Two-way covert quantum communication in the microwave regime

Quantum communication addresses the problem of exchanging information across macroscopic distances by employing encryption techniques based on quantum mechanical laws. Here, we advance a new paradigm for secure quantum communication by combining backscattering concepts with covert communication in the microwave regime. Our protocol allows communication between Alice, who uses only discrete phase modulations, and Bob, who has access to cryogenic microwave technology. Using notions of quantum channel discrimination and quantum metrology, we find the ultimate bounds for the receiver performance, proving that quantum correlations can enhance the SNR by up to $6$ dB. These bounds rule out any quantum illumination advantage when the source is strongly amplified, and show that a relevant gain is possible only in the low photon-number regime. We show how the protocol can be used for covert communication, where the carrier signal is indistinguishable from the thermal noise in the environment. We complement our information-theoretic results with a feasible experimental proposal in a circuit-QED platform. This work makes a decisive step toward implementing secure quantum communication concepts in the previously uncharted $1$-$10$ GHz frequency range, in the scenario when the disposable power of one party is severely constrained.


Introduction
It is well understood that the application of quantum mechanics to traditional technology-related problems may give a new twist to a number of fields. Quantum communication is a potential candidate for over-passing its classical counterpart in terms of information-theoretic security.
By appropriately encoding the information in the degrees of freedom of quantum systems, a possible eavesdropping attack can be detected due to the sensitivity of the system to the measurement process. This simple reasoning has been at the basis of defining a number of quantum key distribution (QKD) protocols during the first quantum information era, such as BB84, E91 and B92. The defined protocols have been proven to be unconditionally secure provided that the transmitting channel has a low noise (1). The same level of security would be impossible to reach even in the most sophisticated known classical architectures, which rely on the current impossibility of solving efficiently specific problems, such as prime number factorization or finding the solution of systems of multivariate equations (2). This means that classical encryption techniques are not fundamentally secure: information considered to be safely stored today is not guaranteed to be so tomorrow (3). Quantum communication aims to solve this long-term security problem at some infrastructure costs yet to be quantified.
From a theoretical point of view, there is a challenge in defining quantum communication protocols which are secure, efficient and practical at the same time. In this respect, optical systems have been considered for decades the main candidates for quantum communication, as thermal effects are negligible in this frequency range. For instance, QKD security proofs require level of noises which at room temperature are reachable only by frequencies at least in the Terahertz band (4). In addition, entanglement can be distributed with minimal losses, allowing then enable real-life applications. Recent theoretical results in noisy quantum sensing and metrology show that preserving entanglement in an experiment is not a fundamental feature for reaching a quantum advantage (19), paving the way for the implementation of open-air quantum microwave protocols.
This Article exploits recent results in quantum communication, quantum sensing and cQED in order to introduce a feasible secure two-way quantum communication protocol in the microwave regime. The protocol combines microwave quantum radar technology with covert communication. It consists in the secure exchange of information between a classical party (Alice) and a quantum party (Bob), who pre-share a secret. Bob sends a continuous-variable microwave signal to Alice, which encodes her message in the phase modulation according to a pre-agreed alphabet. The signal is then transmitted back to Bob and measured in order to discriminate between the different modulations (see Fig. 1). As Alice is performing uniquely passive operations at room temperature, she needs only classically available components. If seen from the energy-expenditure perspective, one can think of one-and two-way protocols as having fundamentally different features in quantum communication. In one-way protocols, Alice (the message transmitter) generates quantum states of some sort, while Bob (the message receiver) has access to some operations typically easy to implement, and a measurement device. Taking into account that even the simplest of the detection schemes, such as homodyne or heterodyne, requires amplifiers and signal generators, a non-negligible energy disposal for both Alice and Bob is required in order to implement any one-way protocol. Our two-way protocol, instead, puts all the challenging technological requirements at Bob's side. In addition, Alice's energy requirements are minimized, envisioning real-life applications in ultra-low power RF communications, Internet-of-Things, and Near Field Communication (NFC) based technology, among others. Our protocol brings in a significant advantage with respect to previous proposals (20,21), as it does not require active control at Alice side. We discuss both the cases when the signal is in a coherent state and when it is correlated with an idler. The latter shows a gain of up to 6 dB in the signal-to-noise ratio (SNR) with respect to the former one, at some experimental cost in the preparation and the detection stages by Bob. The setup resembles the Gaussian quantum illumination protocol (19), where a weak two-mode squeezed vacuum (TMSV) state is transmitted in a bright environment in order to detect the presence or absence of a low-reflectivity object in a region of space. Unlike radar applications, for which the quantum illumination paradigm is usually employed (15,18), and where location, velocity and cross-section are unknown, our communicating setup can be thought to be applied with static antennas where all these properties are known and can be engineered. In the first part of the paper, we derive a general expression for the error probability, putting an emphasis on Gaussian states and Schrödinger's cat (SC) states (22). We prove that 6 dB is indeed the maximal gain in the error probability exponent reachable by a quantum-correlated state over a coherent state receiver. This also solves an open problem in quantum illumination (23). We show that our communication protocol is unconditionally secure by means of covertness (24). In a covert quantum communication protocol the signal is hidden in the thermal noise unavoidably present in a room-temperature environment, so that Eve's detection probability collapses. The basic idea is therefore to protect unconditionally the message content by hiding its existence. This concept has a natural application in low-frequency spectrum communication. Security is achievable only if the generated signal is weak enough, so that cryogenic detection technology is needed at Bob's side. Here, we show the square-root-law for our two-way communication protocol, proving that the number of bits that can be sent over n channel usages scales as O( √ n). Finally, we design an entanglement-assisted protocol based on SC states in a circuit QED (cQED) setup, which relies solely on Jaynes-Cumming interactions and qubit measurements. This shows the path for future experimental investigation of our concept.

The Setup
The two-way communication protocol is depicted in Fig. 2. Alice and Bob use n = mM modes of the bosonic channel simultaneously in order to communicate m symbols. They use M modes to transmit a symbol φ taken from a discrete alphabet A. We refer to each these M channel usages as a slot. In each slot, Bob generates M independent and identically distributed which are retained in the lab by Bob for the measurement stage. The signals are generated at a low enough temperature to consider the signal-idler (SI) state as pure. Although the results of this article are general, we emphasize the application in the microwave spectrum, specifically in the range of operating frequencies of a cQED setup, i.e. 1-10 GHz. In this range of frequencies, T ≃ 20 mK is required to avoid thermal fluctuations. We refer to the idler-free case when the idler is absent, or, equivalently, when the signal and the idler are uncorrelated. The signal modes are sent to Alice through a room-temperature channel (T B = 300 K), which is modeled as a beamsplitter. Alice receives the modes {â Here, η is the power transmitting rate of the channel and {ĥ (k) ← } are independent thermal modes with N B average number of photons. The numerical value of N B depends on the signal op- In the 1 − 10 GHz spectrum this results to values of the order N B ∼ 10 3 , therefore we will emphasize the N B ≫ 1 case. Alice modulates the phase ofâ  assumption, corresponding to a very lossy thermal propagation channel. This is typically the case for open-air wave propagation. The number M has to be chosen to be large enough in order to give Bob the chance of discriminating between the possible phases in A with high confidence.
The measurement discriminating between the symbols depends on the adopted SI system. We consider mainly the Binary-Phase-Shift-Keying (BPSK) alphabet, when A = {0, π}. However, the results in this article can be extended to more complex alphabets. Different figures of merit can be used to quantify the performance of the optimal strategies to discriminate between the distinct modulations, depending on their a priori probabilities. Here, we discuss the case where all the modulations in the key have the same a priori probability of being realized, which is the most natural scenario for quantum communication.
The setup can be mapped to quantum illumination (19), also referred to On-Off-Keying (OOK), where Alice modulates the amplitude of the signal. In fact, BPSK and OOK share the same optimal strategies in the η ≪ 1 limit (see Material and Methods). In addition, BPSK performs better than OOK for given transmitting power, as the distance of the symbols in the phase-space is larger. A similar setup has been studied in the optical domain (21). Here, a phase-insensitive amplification by Alice is required in order to add thermal noise and ensure security with respect to a passive Eve. In the low-frequency spectrum, the thermal noise is naturally present in the environment, so that no amplification is needed and covertness can be ensured. Instead, in Ref. (25), the authors discuss the advantage of using pre-shared entanglement between Alice and Bob for communication in noisy environment, finding that the number of covert bits that can be sent increases by a logarithmic factor with respect to the unentangled case. Although their setup falls in the one-way scenario, these results suggest that using quantum correlations should come with a logarithmic overhead in the capacity also in our case.

Results
Ultimate bounds for the receiver performance We find the ultimate bounds on the receiver performance for the protocol described in Fig. 2.
These results hold for SI systems in any quantum state. We set the encoding operation to the identity, i.e. we fix ϕ k = 0. This is possible because both Alice and Bob have a pre-shared knowledge of ϕ k , therefore this operation can be reversed by Bob. In the BPSK case, where the φ ∈ {0, π}, our aim is to minimize the total error probability where Pr (φ = π|φ = 0) is the probability of detecting a phase φ = π given that Alice has modulated the phase of the signal by φ = 0, and a similar definition holds for Pr (φ = 0|φ = π).
The main strategies to achieve this can be classified in (i) collective, where the M modes are allowed to be measured together, and (ii) local, where the copies are measured separately, allowing classical communication between the measurements on the different copies. We consider the performance of a coherent state transmitter as reference for the correlated cases. In other contexts, such as in quantum illumination, coherent states transmitters are usually used as a classical reference. This choice is done mainly for two reasons: 1) they achieve the optimal error probability in the idler-free case and 2) they describe faithfully coherent signals that can be generated with classical technology.

A. Collective strategies
The quantum Chernoff bound (26) provides an upper bound on the achievable error probability (EP) in the binary detection problem. Indeed, we have that p err ≤ 1 2 e −βηM , where β η = − min s∈(0,1) log Tr (ρ s η,0 ρ 1−s η,π ). This bound is tight for M ≫ 1, and its exponent β η can be used as figure of merit for quantifying the performance of the optimal discrimination protocol.
Generally, one needs a collective measurement over all the M modes in order to saturate this bound. There are few exceptions to this statement, for instance, when either one of ρ η,0 or ρ η,π is close enough to a pure state (30), or for coherent state illumination in a bright environment.
In the following, we focus on computing analytically β η up to the first relevant order in η, using a metric-based approach. As the the expansion of β η to the first order of η is zero (see Material and Methods, Lemma 3), we can define the figure of merit for collective strategies as This metric provides us a framework for conducting comparative analysis between different transmitters. In addition, the found relations can be analytically computed, providing an insight on the scaling of the performance with respect to the system parameters. We are particularly interested in the N S ≪ 1 and N B ≫ 1 limits of β col , where the protocol based on quantum correlations will present the maximal advantage with respect to a coherent state input with the same power. In addition, we will see that unconditional security by means of covertness can be ensured in this regime. In the following, for simplicity, we will refer to β col as the quantum Chernoff bound (QCB). However, we stress that in the literature the QCB is generally referred as β η . The following results define the optimal receiver performances.
This is in agreement with the result of the standard quantum illumination protocol, up to a factor of four (see Material and Methods). We notice that β col cl ≃ N S /N B in the N B ≫ 1 limit, which makes the comparison with the general correlated case easier.
The bound in Theorem 2 is tight for N S ≪ 1 and for N S , N B ≫ 1. By a direct comparison with the bound in Theorem 2 and the QCB for coherent states, we see that the optimal gain with respect to the idler-free case is 6 dB, and the maximal advantage can be achieved when N B ≫ 1 and N S ≪ 1. No advantage can be detected in a vacuum environment (N B ≪ 1), which is the case of the optical systems. In addition, even in the N B ≫ 1 limit, the gain decreases with increasing number of signal photons N S , achieving the same performance of a coherent state transmitter in the N S ≫ 1 limit. This makes the setup in Fig. 2 particularly relevant for studying entanglement-assisted low-frequency communication in very noisy environment. However, one must note that the advantage of using quantum correlations is kept when the environment is not bright, see Fig. 3a. For instance, a 4.6 dB maximal advantage can be achieved for N B ≃ 1, implying that the advantage in using quantum correlations is not limited to the N B ≫ 1 case.

B. Quantum estimation strategies
An approach based on the quantum estimation of the amplitude modulation has been developed in Ref. (27) in the quantum illumination context. This is less experimentally demanding than the collective strategy, as it does not require the interaction between the M copies of the received signal. However, it comes at some loss in the error exponent of the EP, quantified as at least 3 dB with respect to the optimal collective strategy. Here, we use the same concept in order to deal with the BPSK case. We address this approach as local strategy, as opposite of the collective strategies previously discussed. First, we notice that the received modes {â → are thermal modes with N B average number of photons. We can thus optimally estimate the parameter κ ≡ η e −iφ ∈ R, obtaining a value κ est , and deciding towards the hypothesis κ est < 0. We refer to this strategy as "threshold discrimination strategy". The main figure of merit quantifying the quantum estimation performance is the quantum Fisher information (QFI), defined as (28) where dρ = (∂ κ ρ κ ) |κ=0 , with ρ κ ≡ ρ η.φ , and λ m is the eigenvalue of ρ 0 corresponding to the eigenstate |φ m . This is due to the Cramer-Rao bound, which asserts the limit of the achievable precision of an unbiased estimatorκ: ∆κ 2 ≥ 1/M F . An estimator saturating the Cramer-Rao bound is given by the mean over the M single-copy measurements of the observableÔ = L/F , whereÔ = mn φm|dρ|φn λm+λn |φ m φ n | is the symmetric logarithmic derivative computed at κ = 0. Due to the central limit theorem, the EP for the threshold discrimination strategy is The previous discussion holds whenever one has an a priori knowledge of the neighborhood where κ belongs to (in our case κ ≪ 1). If no assumptions of this sort can be made, generally the optimal strategy consists of a two-stage adaptive protocol: use M 1/δ (with δ > 1) copies to estimate the neighborhood and then use the rest of the copies to optimal estimate the parameter. This provides the same asymptotic performance as when the information on the neighborhood is provided. The same adaptive protocol can be used to generalize the ideas of this article to more complex alphabets, by first having a rough estimation of the phase φ, and then rotate the system in order to maximize the classical Fisher information (29).
Similarly to the case of collective strategies, we will adopt the exponent of the EP to the first relevant order in η as figure of merit, i.e. β loc ≡ F/2. We have the following bounds on the achievable EP decaying rate using quantum estimation methods.
Similarly to Theorem 2, the bound in Theorem 3 is tight for N S ≪ 1 and for N S , N B ≫ 1. It follows that the maximal advantage with respect to the classical case is 3 dB in the EP exponent if we adopt a threshold discrimination strategy.
The optimal detector is homodyne.
This means that the optimal detector in the classical case can be implemented with local measurements in the N B 2 regime, as in this case β loc cl ≃ β col cl . However, this is not anymore valid in the N B 1 regime, where collective measurements start to perform better, achieving β col cl ≃ 2β loc cl in the N B ≪ 1 limit.

Examples
The aim of this section is to discuss two topical examples of transmitters whose optimal receiver saturates the ultimate bounds in the correlated case. In order to do so, we have derived explicit, general, formulas for the QCB in terms of the Schmidt values of the input state (see Material and Methods).

A. Two-mode squeezed vacuum state transmitter
We compute the ideal performance of entangled Gaussian states using the figures of merit β col and β loc . TMSV states are defined as where {|n } ∞ n=0 is the Fock basis. They have been thoroughly studied in the context of QI because they are a good benchmark to show a quantum advantage and because they are experimentally easy to generate, regardless of the frequency regime. The performance for the optimal receiver of a TMSV state transmitter are given by where c S = N S 1+N S and c B = N B 1+N B (see Material and Methods). The optimal receiver for a threshold discrimination strategy consists in measuring in the eigenbasis ofâ IâR +â † Iâ † R . It is clear that TMSV states saturate the bound of Theorem 2 in the N S ≪ 1 limit. In addition, the advantage of using the optimal detector for TMSV states decays slowly with increasing N S , making the protocol useful also for finite number of signal photons. The detectors achieving the maximal gain are known for both the collective (only for N S ≪ 1 (30)) and the local (for any N S (31)) cases. Generally, they involve photon-counting devices, which are yet to be developed in the microwave regime. A possible solution is the use optomechanical transducers into optical frequencies, where sensitive detectors are available (17). However, current optomechanical transducers are still in infancy, as they suffer from low efficiencies and high thermal added noise. A different solution is to use a qubit as single-photon detector. This approach has the advantage of seamless integration with cQED platforms, as dispersive qubit measurements can be implemented already in the lab (36). However, single-photon detection devices so far have achieved only a 70 % fidelity, making this approach currently unsuitable for practical applications. On a different note, the idler storage must be carefully considered in order to understand how quantum correlations can be useful in practice. In cQED, memory elements based on a coaxial λ/4 resonator with coherence time of nearly 1 ms have been demonstrated (32).
This corresponds to 300 Km of free-space propagation of light. Another promising alternative consists in transferring the idler bosonic degrees of freedom to the delay line based on surface acoustic waves (33).
Assuming that an effective way of measuring the power of large bandwidth signals with few-photons sensitivity is available, then a Gaussian state protocol is arguably the best option for implementing the ideas presented this article. In fact, if we consider N S = 10 −2 , N B = 10 3 and η = 10 −2 as typical parameter values, a time-bandwidth product M = 10 8 is needed for reaching low enough receiver error probabilities. The ability of generating large bandwidth Gaussian signals would reduce the time complexity of the protocol. Even though at the present stage Gaussian states remains the main solution for sensing and metrology in noisy regime, we discuss an alternative based on a promising quantum computing paradigm in cQED.

B. Schrödinger's cat state transmitter
We now discuss the performance of the protocol based on SC states, created by the interaction of a qubit with a continuous-variable signal. It comes as no surprise that SC states show the same advantage of Gaussian states for N S ≪ 1, because in this limit the two states approximate each other. However, in the following we will see that the underlying physics is different. In fact, the proposed architecture will provide us with a digital way to store the idler in a cQED setup. The SC states that we consider are defined as where |± = 1 √ 2 (|g ± |e ) are eigenstates of the Pauli operatorσ x , |α is a coherent state with amplitude α > 0 (N S = |α| 2 ), assumed to be real for simplicity. Of particular interest will be the case of |α| ≪ 1, that shows the maximal advantage with respect to the classical case. This state can be written in the Schmidt decomposition as The performance of the optimal receiver for a SC-state transmitter are given by where f col The optimal threshold discrimination strategy in the N B ≫ 1 regime consists in measuring in the eigenbasis of the observableÔ opt =σ − [λ +âR + λ −â † R ] + c.c.. The exact expressions of f col SC and f loc SC are given in the Material and Methods. A comparison with the TMSV state case is shown in Fig. 3b. As expected, the maximal gain can be achieved for N S ≪ 1. In addition, the gain decays exponentially with increasing N S . In fact, the observableσ performs the same as |ψ SC in this regime. This loss of gain for finite N S can be mitigated by considering states with larger Schmidt rank, i.e. 1 27). This state can be implemented by letting several transmon qubits interacting with the same resonator. However, in this case the optimal detector is complicated and we will not consider it in the implementation discussion.

Covert quantum communication
We now discuss the possibility of performing secure quantum communication using the setup depicted in Fig. 2, by exploiting recent results about covert quantum communication (24,35. The basic idea is to protect the content of the message to be transmitted by covering the existence of the carrier in a given bandwidth and temporal frame. In this context, Eve's main task becomes to understand whether a message is being transmitted or not through the channel. Here, we provide bounds for Eve's detection probability depending on the receiver performance. The results of this Section holds for states which well approximates Gaussian states in the N S ≪ 1 limit. We prove thatm = O( √ n) number of bits securely transmittable over n channel usages with an arbitrary small EP. We also show that quantum correlations can increase the bit transmission rate by a constant factor, depending on strategy adopted (i.e. collective or local).
A natural way of defining covertness consists in bounding from below the probability of detecting that communication between Alice and Bob is happening.
We focus primarily to the BPSK case, corresponding to A = {0, π}, keeping in mind that the concept can be generalised to more complex constellations. Each symbol transmission is done by performing the two-way protocol described in the Fig. 2. We define the on-setting, corresponding to the case when the communication is happening, and the off -setting, when no information is exchanged between Alice and Bob. In other words, we consider the on-setting when Alice and Bob applies the protocol with N S > 0, while the off -setting is when N S = 0.
We consider a passive eavesdropper, able to catch all the modes that are lost in the Bob-Alice path, denoted with the ← subscript, and Alice-Bob path, denoted with the → subscript. For a given slot, Eve gets the modeŝ with 0 ≤ c ≤ 1. Then, the communication between Alice and Bob is δ-covert over n channel In the Supplemental Material we also prove the converse of Lemma 1. Lemma 1 can be directly applied to a TMSV state transmitter, which corresponds to c = 1. It can be also applied to coherent state and SC state transmitters, if we allow Bob to perform random phase modulations.
In fact, let |α k with α = |α|e −ikπ/4 be a coherent state, then ρ S = 1 Widely used Advanced Encryption Standard and the Secure Hashing Algorithm have outputs that are exponentially larger than their seeds while still retaining computational indistinguishability from true randomness (37). This is therefore a practical tool for for covert quantum key distribution protocols, where one wants to covertly expand a pre-shared key, keeping in mind that the security of the protocol is bounded by the security of the pseudo-random function f .

Circuit-QED Implementation
The ideas introduced in this paper can be easily implemented using coherent states properly modulated, as described in the previous section, and heterodyne measurement. While this scheme does not achieve any of the ultimate bounds for the receiver, it is the most practical way of realizing the protocol. If one is allowed to implement certain entangling operations at the transmitting and receiver level, then larger key rates are achievable. In this context, optimal schemes for the Gaussian state receiver have been thoroughly studied in the literature. Instead, a receiver for the SC state transmitter is still missing. In this Section, we fill this gap by introducing an implementation in a circuit QED setup for a SC state based transmitter and receiver.
We show that Jaynes-Cumming (JC) operations and qubit measurements are sufficient to fully implement the protocol. This is a big advantage with respect to the Gaussian state receiver, which requires photo-detectors. We also provide an analysis of how the decoherence affects the protocol based on quantum correlations. The discussion will be mostly at the model level.
However, it is noteworthy to observe that all the operations described in the following have been proved in cQED since fifteen years, with increasing enhancements of fidelity for the gate implementation and state storage.
Here, ω r and ω q are the frequency of the resonator and the qubit respectively, and g is the coupling between these two systems. We also define the detuning ∆ = ω r − ω q and Γ = max{κ, 1/T 1 , 1/T 2 }, where κ is the cavity decay rate, and T 1 and T 2 are the qubit decaying and dephasing times respectively (see Supplemental Material). In the dispersive regime, where ∆ ≫ g, one can apply perturbation theory to the first order of the parameter g/∆, finding the effective HamiltonianĤ where χ = g 2 /∆ (38). We assume that χ ≫ Γ, which is known as the strong-dispersive regime (SDR). In this way, any losses of the bosonic mode and the qubit are negligible during the implementation of the gate, as long as the operating time will be sufficiently short. The preparation protocol is based on the fact that the Hamiltonian H SDR is a conditional phase-shift on the resonator, with the qubit acting as the control. To put this easier in evidence, we will work in a rotating frame defined by the free HamiltonianĤ . The preparation protocol consists in the following steps, assuming an initial qubit-resonator state |g |0 (see Fig. 5).
Step 1 Apply a π/2σ y -pulse to the qubit in the ground state, and drive the resonator at frequency ω r with a signal calibrated such that the coherent state | − iα is prepared.
Step 2 Let the qubit and the resonator interact for a time t χ = π 2χ . This results in a conditional phase shift on the cavity state by the operator |g g| ⊗ exp(iπâ †â /2) + |e e| ⊗ exp(−iπâ †â /2), Its action on the state prepared at Step 1 can be understood as a uniform counterclockwise rotation by an angle π/2 of the coherent state, followed by the application of the photon parity operator exp(−iπâ †â ) if the qubit is excited. The state after this Step 3 Apply a π/2σ y -pulse to the qubit. The state after this step is 1 In order to implement Step 1 and Step 3 we would need to decouple the qubit and the resonator: this can be achieved either by a tunable coupler or by further detuning the qubit. Also we have considered here the ideal situation when all the operations can be realized with high fidelity, which is a good approximation in the strong regime (22). The main remaining source of errors is due to the spurious thermal contribution present in the cryogenic environment prior to the preparation stage. This will be the object of a later on discussion.

B. Receiver for the entanglement-assisted protocol
For the implementation of the optimal observableÔ opt we will make use of the JC Hamiltonian defined in Eq. (23) in the strong-resonant regime, i.e. when ω q = ω r and g ≫ Γ.
The qubit-resonator system evolution under a time t g = τ /g corresponds to applying the gatê Step 1 Perform a squeezing operationŜ(r) on the reflected modeâ R , with squeezing parameter Step 2 Apply a π/2σ x -pulse to the qubit state. This switchesσ − withσ + .
Step 3 Let the qubit-signal system interact with the JC Hamiltonian in the strong-resonant regime for a time t g = τ /g, with a small enough τ . This generates the transformation where V =Û τŜ (r)σ x .
Step 4 Measure the qubit in the basis {|g g|, |e e|}.
If τ is low enough, this protocol approximates the measurement in the low-energy eigenspace We choose the τ value in order to maximize the SNR QÔ τ for the observableÔ τ , defined as where For, instance, if we choose Lastly, interfacing a signal with N B ∼ 10 3 number of photons with a low-temperature environment is challenging. An initial attenuation is needed, making the protocol less efficient in terms of the SNR. An attenuation can be modeled with the beamsplitter input-output relationsâ R,att = √ η attâR + √ 1 − η attv , where η att is a power attenuator and v is a bosonic mode assumed to be in a vacuum state. This can be achieved with cryogenic microwave attenuators. The measurement protocol is applied to the modeâ R,att , resulting in a rescaled SNR: in the N S ≪ 1 limit, This means that the performance is not affected as long as η att N B is kept large enough.

C. Effects of decoherence on the performance
In the discussed scheme, the main source of inefficiency is given by the spurious thermal contribution present in the cryogenic environment prior to the preparation stage. In addition, while any sort of signal dissipation after the state preparation is already included in the model in an effective way, the idler decoherence must be characterized and bounded in order to understand the actual performance of the protocol in practical scenarios. Let us first discuss how the protocol is affected by the initial thermal noise. We assume a Markovian environment at temperature T , whose Lindblad master equation is ∂ t ρ = [L q D + L r D ]ρ. Here, models the qubit decoherence, and with N T = (e β ωr − 1) −1 and β = (k B T ) −1 , is the resonator dissipation in an environment at temperature T . The Lindblad operators act on a general qubit-resonator state ρ as hold for a qubit in an environment at temperature T . In a T ≃ 20 mK environment we have that β ω r,q ≫ 1 for ω r,q ∼ 1 − 10 GHz, therefore decoherence and dissipations in principle should not play a role in the performance evaluation. However, small thermal contributions can be relevant in the low-photons regime, and their effects on the SNR need to be quantified. We assume the initial qubit-resonator state to be the steady state of the Lindblad master equation, i.e. ρ q ⊗ ρ r with ρ q = a g |g g| + a e |e e| and ρ r = 1 1+N T ∞ n=0 N T 1+N T n |n n|. By applying the state preparation protocol, we ob- This implies a rescaling of the optimal SNR for fixed transmitting power, given by Q noisŷ Oopt /QÔ opt = (ag−ae) 2 1+c −1 , where we have set |α| 2 = cN T . We notice that for c ≤ [2(a g − a e ) 2 − 1] −1 we cannot have any quantum advantage. This sets an upper limit to the amount of thermal noise tolerable before losing all the advantage with respect to a coherentstate transmitter. The initial thermal contribution can be experimentally characterized in several ways. For instance, recently a primary thermometry for propagating microwaves with sensitiv-ity of 4 × 10 −4 photons/ √ Hz and a bandwidth of 40 MHz has been developed (39). A similar analysis can be performed for the TMSV state case, obtaining comparable results.
The main source of losses appears in the traveling phase of the protocol. Here, the idler must be preserved coherently in order to profit from the initial quantum correlations. In fact, it is easy to see that under the lossy dynamics described in Eq. (28), we have that where Q deĉ Oopt is the SNR for the protocol applied to the state ρ dec = e tL q D / [|ψ SC ψ|], , t is the traveling time, and we have discarded any initial thermal contributions (see Digital methods based on error correction have been widely studied in the context of quantum computing. There are principally two approaches to tackle the decoherence problem with a digital approach. We may encode the idler into a logical qubit since the beginning, and perform the protocol in the logical Hilbert space. This is always doable in principle, and one may make a statement that an efficient cQED error-correction code implementation will be soon reached in the context of quantum computing (40). However, this approach is generally costy, as it requires

Discussion
We have developed, for the first time, the theory for performing a secure two-way quantum communication protocol in the low-frequency regime, in the scenario where the message sender has a severe bound in the energy. This concept has a natural application in a number of fields, ranging from ultra-low-power RF communications and NFC-based technology to Internet-of-Things. While the results of this article are quite general, we have focused mainly on the 1 − 10 GHz spectrum, where cQED platforms have been highly developed in the late decades.
We have proved the ultimate bounds for the optimal receivers, finding that a quantum correlated detector can be at most a factor of four better in terms of SNR. We have proved the square-root law for covert communication in our two-way setup, showing that O( √ n) bits can be covertly and reliably transmitted by using the channel n times. Finally, we have provided the ingredients for performing a cQED based experiment, using Schrödinger's cat states as resource. On the conceptual level, the results of this paper provide the foundation of a low-power microwave quantum communication theory. While this is a challenging task, due to the amount of noise that the related systems exhibit at room temperature, a positive output would arguably pave the way for building quantum communication systems with lower infrastructural costs than those arising in optical-fiber based implementations.

Notations
We introduce the following notations, useful for the discussion of the technical results.
• Fock basis, indicated with latin alphabet kets (or bra): {|k } ∞ k=0 ; • Coherent states with amplitude α ∈ C, indicated with greek alphabet kets (or bra): |α = • Thermal States with N B average photon numbers: • General signal-idler state of r Schmidt-rank: |ψ SI = r k=0 √ p k |v k I |w k S . The signal mode is indicated byâ S and we use indistinctively the notation |v |w and |v, w . The Schmidt rank r differentiates between the entangled (r > 1) and the idler-free (r = 1) cases; • Constants:

Receiver Error Probability
Here, we discuss the results based on the calculation of the Chernoff bounds and the quantum Fisher information (QFI) relative to Bob's receiver. In the following, as Bob and Alice are sharing ϕ k values, we can set it to zero.

Equivalence between OOK and BPSK
In the η ≪ 1 limit, we can map the problem of discriminating between different φ to the quantum illumination (QI) setup, where Alice decides to modulate the amplitude between η = 0 and η =η, leaving the phase unchanged (φ = 0). This is usually referred as On-Off-Keying (OOK).
We first notice that the received modes {â → are thermal modes with N B average number of photons. This means that if |ψ SI ψ| is the state of the SI system, then the final Bob's state is splitter operation andÛ φ = e −iφn S is a phase-shift operation. We can now prove the equivalence between OOK and BPSK.

Lemma 2. [Equivalence of OOK and BPSK]
In the η ≪ 1 limit, the BPSK and OOK optimal strategies are the same for both the local and the collective cases. The BPSK performs as an OOK withη = 2η.

Quantum Chernoff bound and quantum Fisher information: general formulas
We can now analyze the OOK case to state the general formulas for the quantum Chernoff bound and quantum Fisher information for the BPSK case. In the following, we denote ρ η ≡ ρ η,φ=0 .
Proof. See Supplemental Material.

Lemma 4. [Quantum Fisher information for QI (OOK)]
Given ρ η as in Lemma 3. Then, the quantum Fisher information for estimating the parameter η in the η ≪ 1 neighborhood is Proof. See Supplemental Material.

Ultimate error probability bounds
Proof of Theorem 1. We apply Lemma 3 withη = 2η (see Lemma 2) to the simple case of Schmidt-rank one, finding that β loc Then, by applying the Hölder's inequality, we find that | w|a S |w | 2 ≤ a S |w 2 2 = N S , which is saturated by |w = |α .
Proof of Theorem 2. By applying the inequality By using the completeness relation k ′ |w k ′ w k ′ | = I -which can be assumed by adding zero probability terms to the sum -and by noticing that N S = k p k w k |a † S a S |w k , we conclude that β col ≤ 4N S 1+N S . By applying the inequality of arithmetic and geometric means √ c B , and by using the completeness relation, we find the second inequality β col ≤ 2N S +1 no mixed state can do better, as in this case the bound can be applied to its purification.
Proof of Theorem 3. This is done similarly as in the proof of Theorem 2, with the inequalities √ c B applied to Eq. (33). Also in this case no mixed state can do better, by applying the bound to the purified state.
Proof of Theorem 4. By applying Lemma 4 withη = 2η (seel Lemma 2) to the Schmidt-rank one case, we find that β loc 1+c B , which is maximal for |w = |α (see the proof of Theorem 1). Homodyne is optimal as one can directly see by checking that the signal-to-noise ratio x 2 ρη / x 2 ρ 0 saturates the QFI, and by using Lemma 2.

Examples
QCB and QFI of TMSV states: This is done by setting p k = 1 1+N S c k S and |w k = |k (Fock state with k photons) into the Eq. (32), where we setη = 2η, and Eq. (33). It results in a sum of a geometric series and its first derivative, that can be cast as written in the Theorem statement. Similarly, the optimal observable for the threshold discrimination strategy is found by computing kk ′ nn ′ k ′ ,n ′ |dρ|k,n p k ′ τ n ′ +p k τn |k ′ , n ′ k, n| (32). QCB and QFI of SC states: This is done by applying Lemma 3 and 4 to the Schmidt decomposition of the SC state given in Eq. (13) of the main text, i.e. |ψ SC = λ + |g |α + + λ − |e |α − . We then use Lemma 2 to bring the result to the BPSK. The result is with In the N B ≫ 1 limit, these quantities approximate to f loc where we have used that The optimal local observable can be found by computingÔ where p e = λ − and p g = λ + . Alternatively, one can directly compute the SNR ofÔ opt and see that it saturates the QFI in the N B ≫ 1 limit.

Covert Quantum Communication
Here, we provide the technical details present in the discussion about covert communication.
We denote Eve's quantum state when Alice applies a phase modulationφ as ρ corresponds to the on-setting, while N S = 0 is the off -setting. We drop any k superscript and subscript, as we are in the i.i.d assumptions. In addition, we introduce the beamsplitter unitary where σ = k,k ′ c kk ′ |k S k ′ |, Tr S denotes the partial trace on the signal mode, and the equality is due to the phase-invariance of the thermal state. The latter is evident at seeing the input-output relations in Eqs. (18)- (19) of the main text. Let us denote by ρ ( Here, we denote the phase shift at Alice asφ, which is ϕ + φ or ϕ depending if we are in the on or off setting respectively. In both cases,φ is distributed uniformly at random in A. Proof of Lemma 1. We have that P (Eve) = 1 2 1 − 1 2 ρ (N S ) ⊗n − ρ (0) ⊗n 1 (30). As done in Ref. (24), we can simplify the calculation by using the Pinsker's inequality, i.e. ρ a − ρ b 1 ≤ 2D(ρ a , ρ b ) for any states ρ a and ρ b , where D(ρ a , ρ b ) = −Tr ρ a ln ρ b + Tr ρ a ln ρ a is the quantum relative entropy between ρ a and ρ b . This provides the bound meaning that ensures that P (Eve) ≥ 1 2 − δ over n modes. We use that the quantum relative entropy is additive for tensor product, i.e. D(ρ (0) ⊗n , ρ (N S ) ⊗n ) = nD(ρ (0) , ρ (N S ) ) to reduce the calculation to the single channel-usage case.
• TMSV case: We have that where we have used the joint convexity property of the relative entropy, and that the D(U ρU † , U σU † ) = D(ρ, σ) for any unitary U and states ρ and σ, together with Eq. (42).
The resulting quantity can be readily computed using Gaussian state quantum information tools (see Supplemental Material). The expansion to the third order in N S gives where a < 0 has allowed us to use the Taylor's remainder theorem.
• General case: We extend the result to signal states of the form ρ S = ∞ j=0 N j S σ j , where with 0 ≤ c ≤ 1. This set of states includes the Gaussian state case (c = 1). In addition, for N S ≪ 1 these states well approximate Gaussian states. Let us consider the Taylor expansion for the logarithm of a matrix and we have introduced ρ k = 1 |A| φ∈A Eφ[σ k ]. First, we notice that b 0 = 0, given that ∞ 0 s (s+z) 2 dz = 1 and ρ (N S ) − ρ (0) is traceless. Next, we prove that b 2 ≤ 0. Let use define where we have used that (A z B z ) 2 ≥ 0 and that ρ 1 is traceless.
We can now bound D c regardless of the sign of b 3 , by using Eq. (49), as c = 1 includes the Gaussian case. In fact, assume that We can use Eq. (49) and the Taylor's remainder theorem to conclude that D 0≤c≤1 ≤ S by the Taylor's remainder theorem. In addition, we have that the bound , then we have that P (Eve) ≥ 1 2 − δ over n channel usages.
Lemma 1 implies the square-root law, provided that Alice and Bob share a codebook. Notice that the error probability of reading one wrong bit is where p err is the single-bit receiver error probability. This automatically means that a number m = O( √ n/ log n) bits are reliably transmissible. In fact, we have that p err ≤ 1 2 exp (−M βη 2 N S 1+N B ) for M large enough. Here, β = 4 for the TMSV state and SC state transmitters with the optimal collective receiver, β = 2 for the TMSV state and SC state transmitter with the optimal local receiver, and β = 1 for the coherent state transmitter with a homodyne detector receiver. By We can use the results in Refs. (24,43) for AWGN channels in order to get a better scaling for the decoding error probability. This is Theorem 5 of the main text.
Proof of Theorem 5. Let us define σ 2 β = 1+N B 2βη 2 M . In the optimal local protocol case, the induced AWGN channel for M ≫ 1 has a variance σ 2 β=2 . For the coherent state case, the induced AWGN channel for any M has a variance σ 2 β=1 . In the optimal collective protocol case, we can induce a AWGN channel by dividing M into K ≫ 1 slots of M/K samples each, and apply the optimal collective protocol on each of the K slots. This provides the same asymptotic performance for the receiver as long as M/K ≫ 1. The resulting AWGN channel has σ 2 β=4 variance. In all cases, we can use Equation (9) of Ref. (43) to upper bound the error probability for transmittingm bits over m modes in a AWGN channel using a random Gaussian codebook, and M = n m , we get By settingm = 2 log 2 c B βδη 4 √ n + log 2 ǫ, we get that P ≤ ǫ. As this calculation holds for a random codebook, it implies that there exists a specific codebook achieving this performance.
This concludes the proof.

Effects of the qubit decoherence on the SNR
Here, we show how the decoherence affects the qubit measurements. We are assuming a Markovian noise described by the Lindblad operator where L † D is the dual of L D , and  Figure 1: Sketch of the two-way quantum communication protocol. Bob sends a signal to Alice, who embeds the message by phase modulation. The signal is then sent back to Bob, who retrieve the information via a suitable measurement. Bob may use quantum correlations in order to increase the signal-to-noise ratio. A passive Eve is able to collect the photons lost in both paths, but she does not have access to Bob and Alice labs. I , is generated by Bob. The idler mode is stored in the lab, while the signal is sent through a noisy channel to Alice, who receive the noisy modes a ′(k) S . Alice modulates the phase of the signal bỹ ϕ k = φ + ϕ k , where φ and ϕ k belong to a pre-agreed discrete alphabet A. Here, φ embeds the information to be sent, while e −iϕ k is an encoding operator. The value of ϕ k is taken uniformly at random in A, and it is known only to Alice and Bob. The signal is then scattered back to Bob, who decodes it by applying a phase modulation e iϕ k . This process is repeated M times (k = 1, . . . , M ), for each symbol transmission. Bob performs a measurement on the modes {e iϕ kâ (k) R ,â  Alice and Bob secretly choose to communicate only in the fraction of the temporal and frequency modes at their disposal. In the on-setting (green dots), Alice performs a phase modulation e −i(φ+ϕ) , where φ ∈ A is the symbol that Alice wants to transmit and ϕ is taken uniformly at random in A. The phase ϕ is secretly known to both Alice and Bob. In the off -setting (red dots), Alice performs a phase modulation e −iϕ , where ϕ is taken uniformly at random in A. Figure 5: Scheme for the preparation of the Schrödinger's cat state. A resonator with central frequency ω r is driven with a coherent signal, displacing the state of the cavity to | − iα . A transmon qubit with frequency ω q is initialized in a state |+ = |e +|g √ 2 . A conditional phase shift is then applied. This is implemented by letting the resonator and qubit interact in the strong dispersive regime for a time t χ = π/2χ, where χ = g 2 /∆ is the effective coupling. Here, g is the coupling strength of the qubit-resonator system, ∆ = ω r − ω q and g/∆ ≪ 1. Finally, a π/2σ y -pulse is applied to the qubit. Feasible parameters are ω r = 5 GHz, ω q = ω r + ∆ with ∆ = 20 Mhz, and g = 100 Khz. measurement q-memory Figure 6: Scheme for the implementation of the observable optimizing the quantum Fisher information. During the signal transmission, which happens at frequency ω r , the qubit state is transferred to a quantum memory. The qubit frequency is then tuned to ω q = ω r . Here the quantum memory is a resonator at frequency ω QM , interacting dispersively with the qubit. This allows the implementation of the cat code. The state is transferred back to the qubit for the measurement stage. The received signalâ R is attenuated. A squeezing operation is then applied using a JPA in the degenerate mode. The output interacts with the qubit in the resonant regime. Finally, the qubit is measured in the {|g g|, |e e|} basis.

Bob Alice
where in the last line we have summed on the n ′ index. We now use that the last sum is symmetric under the exchange of k and k ′ and that τ n /τ n−1 = N B 1+N B : Proof of Lemma 4. The QFI is given by (2) The calculation is similar as in Lemma 3.

S2: Relative entropy of Gaussian states
Here, we provide the relative entropy calculation for TMSV which has been used in the proof of Lemma 1 of the main text. Let us define the vector r = (x ← ,p ← ,x → ,p → ) T , wherex l =â l +â † l √ 2 andp l =â l −â † l √ 2i (l ∈ {←, →}). For a zero-mean Gaussian state ρ, the covariance matrix is defined as Σ ij = Tr ({r j ,r k }ρ). The covariance matrix of the Gaussian state ρ where Ω = −iI 2 ⊗ σ y is the symplectic form and H

S3: Converse lemma
Here, we prove that the bound found in Lemma 1 of the main text is tight. This is usually referred as converse.
We then trace-out the modesŵ which comes from the monotonicity of the quantum relative entropy under CPTP maps. This reduces the calculation to the one-way case. Following the proof of Theorem 1 in Ref. (5), we find that Solving for N S ends the proof.

S4: SNR of the SC state receiver
Here, we quantify the performance of the circuit QED implementation ofÔ τ in terms of the signal-to-noise ratio.

S5: Qubit decoherence
Here, we show how the decoherence affects the qubit measurements. We are assuming a Marko  Figure 1 Sketch of the two-way quantum communication protocol. Bob sends a signal to Alice, who embeds the message by phase modulation. The signal is then sent back to Bob, who retrieve the information via a suitable measurement. Bob may use quantum correlations in order to increase the signal-to-noise ratio. A passive Eve is able to collect the photons lost in both paths, but she does not have access to Bob and Alice labs.

Figure 2
Setup for the two-way covert quantum communication through a bright bosonic channel.

Figure 3
Performance of the quantum correlated protocol with respect to the idler-free case. Probabilistic version of the two-way covert quantum communication protocol.

Figure 5
Scheme for the preparation of the Schr¨odinger's cat state. Scheme for the implementation of the observable optimizing the quantum Fisher information.