Compounds of symmetric informationally complete measurements and their application in quantum key distribution

Symmetric informationally complete measurements (SICs) are elegant, celebrated and broadly useful discrete structures in Hilbert space. We introduce a more sophisticated discrete structure compounded by several SICs. A SIC-compound is defined to be a collection of $d^3$ vectors in $d$-dimensional Hilbert space that can be partitioned in two different ways: into $d$ SICs and into $d^2$ orthonormal bases. While a priori their existence may appear unlikely when $d>2$, we surprisingly answer it in the positive through an explicit construction for $d=4$. Remarkably this SIC-compound admits a close relation to mutually unbiased bases, as is revealed through quantum state discrimination. Going beyond fundamental considerations, we leverage these exotic properties to construct a protocol for quantum key distribution and analyze its security under general eavesdropping attacks. We show that SIC-compounds enable secure key generation in the presence of errors that are large enough to prevent the success of the generalisation of the six-state protocol.

Introduction.-Quantum information theory has established a permanent link between the foundations of quantum theory and quantum information technologies. This has reinvigorated interest in understanding the ultimate limitations of quantum states and measurements as discrete structures in Hilbert space. Quantum states and measurements have a rich geometry that has no counterpart in classical models. Therefore, it is unsurprising that the most elegant and sophisticated discrete structures that can be found in Hilbert space frequently also are the most celebrated and useful resources for the processing of quantum information.
An outstanding example is known as a symmetric informationally complete set of pure quantum states (SIC). A SIC is a maximal set (size d 2 ) of d-dimensional states, {|φ k } d 2 k=1 , with the property that the overlap between any pair of states has the same magnitude: where the constant on right-hand-side is fixed by normalisation. Interestingly, a SIC can both be interpreted as a set of states (as above) and as a generalised quantum measurement (positive operator-valued measure, POVM) with d 2 possible outcomes. The measurement operators in such a SIC-POVM are merely the subnormalised projectors of a SIC, namely . SICs have been investigated for a long time in many different contexts [1][2][3][4][5]. Their relevance in pure mathematics is remarkably diverse [6][7][8] and they even have technological applications in high-resolution radar [9] and speech recognition [10]. However, their interest in physics stems from their prominent role in quantum information theory [5]. SIC-POVMs are key tools for quantum state tomography [11][12][13], which has motivated their experimental realisation in highdimensional Hilbert spaces [14][15][16]. Generally, SICs and SIC-POVMs are used in a range of protocols: quantum key distribution (QKD) [17][18][19], entanglement detection [20][21][22], device-independent random number generation [23,24], dimension witnessing [25] and characterisation of quantum de-vices [26][27][28][29][30]. Moreover, SICs have been studied in the context of quantum nonlocality [24,[31][32][33] and they have an interesting foundational role in QBism [34]. All this has triggered much interest in addressing the existence of SICs in general Hilbert space dimensions. Presently, existence has been proven numerically at least up to d = 151 [5,[35][36][37] and is conjectured for any d (see [37] for a review).
In this work, we introduce a natural discrete Hilbert space structure that is compounded of many separate SICs. The resulting SIC-compound is a set of . . , s}) with the following two properties: I For every k, the states {|ψ jk } j form a SIC.
II For every j, the states {|ψ jk } k form an orthonormal (ON) basis of Hilbert space.
In a handy terminology, we say that a SIC-compound is composed of d "orthogonal SICs", in the sense that elements numbered j in the d SICs are orthogonal to each other. Indeed, given that the existence of SICs is a longstanding open problem [38], deciding the existence of a SIC-compound for a given d is expected to be even more challenging. A priori, it may seem unlikely that SIC-compounds exist at all when d > 2 (it turns out that d = 2 is exceptional). We address the existence of SIC-compounds for d = 3, . . . , 8. For d = 3 we prove that no SIC-compound exists and for d = 5, 6, 7, 8 we give evidence in support of the same conclusion. Remarkably, however, for d = 4 we are able to analytically construct a SICcompound, thus proving that they, in fact, can exist in higherdimensional Hilbert spaces. The many symmetries of the SICcompound, which go beyond its defining properties, allow it to be represented as a Latin square. Moreover, we find that the SIC-compound admits a strong connection to mutually unbiased bases (MUBs) which is revealed through quantum state discrimination. Equipped with the fundamental understanding of the SIC-compound, we consider its practical application for quantum information processing. Specifically, we place the SIC-compound at the heart of protocols for QKD, analyze their security under coherent attacks and show their improved robustness as compared to the four-dimensional counterpart of the six-state protocol [39] (which extends the celebrated BB84 protocol [40]). Qubit SIC-compound.-It is instructive to first consider the simple example of a qubit SIC-compound. In terms of the Bloch sphere representation, a SIC corresponds to four unit Bloch vectors such that any pair has equal magnitude overlap. Hence, the four vectors point to the vertices of a regular tetrahedron. For each vector, the unique orthogonal state is represented by the antipodal Bloch vector, and therefore the four antipodal Bloch vectors also form a regular tetrahedron. By construction, the two SICs together form a SIC-compound. Their convex hull is a cube inscribed in the Bloch sphere.
Generating SICs.-When d > 2, the existence of a SICcompound is far less clear. In order to address the matter, one benefits much from the established knowledge of SICs which heavily exploits the Weyl-Heisenberg (WH) group. This group has two generators, X and Z, which are required to satisfy the relations X d = Z d = 1 1 and ZX = ωXZ, where ω = e 2πi d . Every known SIC (with a single exception in dimension 8 [3]) has been obtained by applying the WH group in the following ansatz, for j ≡ (j 1 , j 2 ) ∈ [d] 2 and for a suitably chosen so-called fiducial state |ϕ . The group generators can conveniently be chosen as the so-called shift and clock operators For d = 2, 3 all SICs are obtained via this ansatz [41,42] and the same is true for any prime d provided that the SIC admits some group structure [43]. Moreover, there is numerical evidence supporting that all SICs for d = 4, 5, 6, 7 can be obtained via the WH group [44].
No qutrit SIC-compound.-Consider the case of qutrits (d = 3). In view of the above, by showing that no SICcompound can be obtained via the WH group, we disprove their existence in full generality. Note that the problem is substantially simplified due to the fact that Eq (2) generates SICs by unitarily acting on a fiducial state. Therefore, in order to construct orthogonal SICs, we must only find orthogonal fiducial states. However, for qutrit systems there are uncountably many relevant fiducial states [4,5] (for a fixed representation of the WH group). Fortunately, using the representation in Eq (3), they all admit a simple parameterisation which allows us efficiently investigate their orthogonalities. In Appendix A, we detail the analysis for d = 3 and show that no more than two orthogonal SICs can be constructed. An example of two orthogonal SICs is straightforwardly obtained from choosing the two fiducial vectors |ϕ 1 = 1 √ 2 (1, 1, 0) T and |ϕ 2 = 1 √ 2 (1, −1, 0) T . Ququart SIC-compound.-For the case of ququarts (d = 4), in contrast to qutrits, there are only 256 fiducial states [45] that yield SICs under the ansatz (2) (for a fixed representation). Within these, one can find a SIC-compound with a simple analytical form. To present it, we change the representation of the WH-group so that the generators are written as [46] Note that the global phase factors only serve to ensure the correct sign of X d and Z d . Consider also the unitary operators which generate a projective representation of the Klein fourgroup Z 2 × Z 2 . Application of 1 1, U , V , and U V on the vector |ϕ 1 = (t, i, i, i) T /n produces an orthonormal basis, where t = 2 + √ 5 and n = 5 + √ 5. Call these states {|ϕ k } k∈ [4] . Then it can be easily verified that the states |ψ jk = X j1 Z j2 |ϕ k form a SIC for each value of k, where j = (j 1 , j 2 ). By construction, the states {|ψ jk } k∈ [4] form an ON-basis for each of the 16 values of j. We remark that if the computational basis is chosen as separable, all 64 states are iso-entangled [47]; the entanglement negativity is 1 This constitutes an interesting parallel to the concept of isoentangled MUBs [48] (which upholds the same degree of entanglement per state as the SIC-compound [49]).
By definition, the ququart SIC-compound contains four SICs and 16 ON-bases of C 4 . Interestingly, it turns out that it upholds two additional symmetries (that have no counterpart in the qubit SIC-compound). Firstly, a careful examination of {|ψ jk } j,k shows that every state is not a member of precisely one ON-basis, but in fact of two different ON-bases. Therefore, the SIC-compound houses an additional 16 ONbases. Secondly, one finds that every state |ψ jk upholds the defining (SIC-like) overlap property (1) with 27 other states in the SIC-compound, instead of the expected 15. The additional 12 SIC-like overlaps originate from an additional SIC which shares four states with the defining SIC in the compound. Thus, every state is a member of two distinct SICs (see Ref [47] and Appendix C) that have four elements in common.
Since we are now faced with a total of 8 SICs and 32 ON-bases present in the compound, one benefits from nicely organising the elements. A useful observation is that for each of the four defining SICs, one can find four sets of four states such that each is an orbit under the WH subgroup {1 1, X 2 , Z 2 , X 2 Z 2 } (again a projective Klein four-group). By suitably permuting the label j ∈ [16] in {|ψ jk } jk , so that j 1 indexes the subgroup and j 2 indexes the application of 1 1, X, Z, and XZ, we can group these orbits together and represent the SIC-compound as a Latin square (see Figure 1).
On existence in d = 5, 6, 7, 8.-For dimensions d = 5, 6, 7, 8, using the representation (3), there are only finitely many relevant fiducial states to be considered [45,50]. The number of states that yield SICs when the WH group, in the representation (3), is applied to them can be regarded as known if we combine the high quality numerical results of Ref [35] with the group theoretical analysis of Ref [45]. We have enumerated all of them and exhaustively checked the number of orthogonal SICs that can be constructed using these states. We find that the number of orthogonal SICs varies (2, 4, 2 and 5 respectively) and that no SIC-compound can be constructed. Reminding ourselves of the strong numerical evidence in support of there not existing any other SICs than those that we have explicitly constructed for d = 5, 6, 7, our results render the existence of a SIC-compound for d = 5, 6, 7 very unlikely. However, as previously mentioned, dimension 8 also houses SICs that are not based on the WH group [3,51,52]. Whether a SIC-compound can be formed from these exceptional SICs is left as an open question.
Furthermore, in Appendix B we present a method for certifying [53] a SIC-compound (if it exists) or falsifying their existence (if it does not exist) under the sole assumption of dimension d.
Discriminating the SIC-compound with MUBs.-The ququart SIC-compound admits a simple operational relation to a set of four MUBs. Consider that for fixed j 2 and k, we try to discriminate between the four (equiprobable) states {|ψ j,k } j1 . Since these states are linearly independent, we can use the "pretty good measurement" [54] which is the ON-basis obtained from |ξ j,k = T −1/2 j2,k |ψ j,k by varying j 1 , where T j2,k = j1 |ψ j,k ψ j,k |. Measuring in this basis is in fact optimal for minimising the error probability of the discrimination, which follows from [55]. Moreover, the resulting bases for given j 2 but different k are identical, while the bases for different j 2 are mutually unbiased. Thus, the four rows of the Latin square correspond to four MUBs which, interestingly, are iso-entangled with the largest possible entanglement negativity (each basis element has an entanglement negativity of 1 √ 8 ). In Appendix C, we show that the relation between the SIC-compound and the four MUBs is not a coincidence but traces back to the fact that the Clifford group contains a copy of the bipartite WH group. Finally, we note that also the fifth MUB (the computational basis) emerges from state discrimination in the SIC-compound: a state is randomly sampled from a given column of the Latin square and we are asked to determine which row it belongs to. The optimal measurement is the computational basis.
Application in QKD.-Let us now consider the usefulness of the d = 4 SIC-compound in QKD. Consider a prepare and measure QKD scheme in which Alice transmits a random state |ψ jk and Bob randomly measures in one of the 16 defining ON bases of the SIC-compound. A variety of specific QKD protocols can be constructed from this starting point, depending on how Alice and Bob transform or "sift" their resulting data into the "raw key". Here we focus on just two sifting protocols. As in the original BB84 protocol, Alice and Bob can use the bases in the compound, taking their k values as the sifted key when their j 1 and j 2 values both match. Call this Sifting B. Another possibility, which we denote Sifting A, is that j 1 is taken as the sifted key value when their j 2 values agree, but their k values disagree. (This turns out to be slightly more favorable than when the k values match.) Both protocols finish with the standard steps of parameter estimation, information reconciliation, and privacy amplification to output a secure key. Since both protocols use the same prepare and measure setup but differ only in the classical postprocessing, we will see that Alice and Bob can first perform parameter estimation on their data and then decide which sifting strategy to employ.
We establish the security of both protocols against arbitrary attacks by adapting the methods of [56][57][58] to ensure security against collective attacks and then invoking [59] to ensure security against arbitrary attacks. The analysis proceeds in the entanglement-based scenario of the protocol. Here Eve supplies Alice and Bob with many copies of an arbitrary bipartite state ρ AB , to which she retains the purification in system E, and Alice and Bob each randomly measure the bases associated with the compound on their respective subsystems. The resulting statistics of their classical measurement choices j and results k, as well as the possible collective attacks, are precisely the same as the prepare-and-measure scenario.
Crucially, the symmetries of the SIC-compound translate into symmetries of both sifting protocols, and this simplifies the form of ρ AB . As we show in Appendix D, for both Sifting A and B we can assume without loss of generality that ρ AB = (1−p−q)Φ AB + qπ AB + pκ AB for some positive parameters q, p with q + p ≤ 1, where Φ AB is the maximallyentangled state, π AB is the maximally-mixed state, and κ AB is the diagonal state of perfect uniform correlation. In other words, the joint state is a partially depolarized and dephased maximally-entangled state.
Alice and Bob can determine both p and q in the parameter estimation phase as follows. It turns out that the probability of sifting success for Sifting A increases with increasing q, while the probability of error in the raw key depends on both p and q. Therefore, before they commit to either sifting procedure, Alice and Bob can use their data to determine both parameters and only then decide which sifting procedure is more appropriate. Knowing the state ρ AB , it is then a simple matter to apply known bounds on the rate of key extraction using information reconciliation and privacy amplification. Fig. 2 depicts the values of q and p which lead to positive key rates. It also displays the region of positive key for the generalisation of the six-state protocol to d = 4 (using a full set of five MUBs). To enable a fair comparison, the latter protocol also discards sifting information [61]. Its symmetries ensure that it treats all states delivered by Eve as depolarized maximally-entangled states, so that when the actual joint state is of the form ρ AB above, it sees a depolarization rate of 1 − p − q. Therefore, the region of positive rate for the five MUBs protocol is symmetric under interchange of p and q. Using the rate expression derived in [62], we find the threshold for p = 0 to be q ≈ 0.309. This is also the threshold of the Sifting B protocol.
Conclusions.-We have introduced SIC-compounds as an elegant and sophisticated discrete structure in Hilbert space. Against initial intuition, we found that SIC-compounds can exist beyond qubit systems and explicitly constructed a fourdimensional SIC-compound. We found that it upholds many unexpected symmetries as well as an operational connection to mutually unbiased bases. Then, through our example of SIC-compounds, we illustrated that foundational understanding of discrete structures of quantum systems not only are interesting in themselves but that they also serve as new, powerful, tools for quantum information processing. We applied SIC-compounds towards quantum key distribution and showed that they can produce secure key in relevant situations in which the generalisation of the six-state protocol no longer is useful.
Lastly, we ask whether four-dimensional SIC-compounds can be used to construct interesting entangled measurements of two (or more) four-dimensional systems; generalising the measurements of [65,66] .
We fix the representation of the WH group to X = d−1 k=0 |k + 1 k| and Z = d−1 k=0 ω k |k k|. For this fixed representation, we prove that no SIC-compound exists for d = 3. It is known that there are infinitely many fiducial states in d = 3 [4,5]. They can be parameterised using a complete set of mutually unibased bases, which can be written (without normalisation) as follows: All [41,42] fiducial states can be obtained via the following [1] procedure. Choose any one of the four bases. Then, choose any pair of elements within the basis. Denote the first element by |e 1 and the second element by |e 2 . The vector |φ = |e 1 − e iθ |e 2 / √ 2, for any θ ∈ [0, 2π], is a valid fiducial state. Repeating this procedure for all twelve relevant pairs appearing in Eq. (A1), one obtains the complete set of fiducial states.
The task of showing that no three fiducial states can form an ON-basis is significantly simplified by the fact that the problem is invariant in such a way that we can without loss of generality choose the first fiducial vector correspoding to the two first elements of the first basis in Eq. (A1), namely |φ 1 = |0 − e iθ1 |1 / √ 2. Moreover, since every basis in Eq. (A1) can be transformed into every other basis in Eq. (A1), it is sufficient to search for an ON-basis with respect to all fiducial states associated to, for instance, the second basis. We name the three elements of the second basis (represented in Eq. (A1) by the Fourier matrix) {|f 1 , |f 2 , |f 3 }. Writing |φ 2 = |f 1 − e iθ2 |f 2 / √ 2, we straightforwardly obtain that (A2) The solutions are found at (θ 1 , θ 2 ) = (2π/3, π/3) and (θ 1 , θ 2 ) = (5π/3, 4π/3). To show that no third orthogonal fiducial state exists, we also consider the cases of |φ ′ 2 = |f 1 − e iθ3 |f 3 / √ 2 and |φ 2 ′′ = |f 2 − e iθ2 |f 3 / √ 2. These give equations analogous to Eq. (A2), each with two solutions. Inspecting these few cases, one easily finds that no orthogonalities exist among these solutions. Thus, we conclude that no qutrit SIC-compound exists. However, as is clear from the above, it is possible to construct two orthogonal qutrit SICs. The perhaps easiest example corresponds to the two orthogonal fiducial states

Appendix B: Certification and falsification of SIC-compounds
We show that SIC-compounds can be certified in a semidevice-independent manner [53] (provided that they exist) and that existence can be disproved using hierarchies of increasingly precise necessary conditions that each can be evaluated as a semidefinite program.
Consider a prepare-and-measure scenario in which Alice has a random input x ∈ [d 2 ] and Bob has an input (y, y ′ ) which labels all pairs of elements in [d 2 ]. For convention, we take y < y ′ . Each measurement of Bob has binary outcomes b ∈ [2]. Alice's states are of dimension no greater than d. In Refs [25,26], it was shown that the quantum maximum of the following functional is uniquely achieved in by Alice's states forming a SIC. Thus, it semi-device-independently certifies SIC preparations. Moreover, one can add another (single) setting to Bob, z ∈ [1], which has o ∈ [d 2 ] possible outcomes, such that the modified functional achieves its quantum maximum when both S ′ and the above sum individually are maximal. The optimal quantum value obeys [26] which can be saturated if and only if Alice prepares a SIC (provided it exists) and the setting z corresponds to the aligned SIC-POVM (obtained from Alice's sub-normalised preparations). We will use this already known communication game for SICs as a building block to construct a communication game for SIC-compounds. Let Alice have inputs x ∈ [d 2 ] and i ∈ [d]. Bob takes inputs (y, y ′ ) and j ∈ [d] and returns a binary outcome. Moreover, Bob additionally has d settings labelled z ∈ [d] which have d 2 possible outcomes. We are only interested in cases in which r ≡ i = j. Let Alice and Bob play the above game (for SICs) d times in parallel: each implementation (indexed by r) uses the preparations {(x, i = r)} x and the measurements {(y, y ′ , j = r) ∪ (z = r)} y,y ′ . We label the score in the r'th game by S r . Naturally, these scores are so far independent since they each correspond to independent sets of preparations and measurements. If all S r are maximal, it thus certifies that Alice and Bob have implemented d independent pairs of SIC preparations and SIC-POVMs. In order to certify a SIC-compound, we need to enforce the orthogonality of the d SICs.
To that end, we add a penalty term. If Alice's preparation is (x, i) and Bob implements one of his additional settings with z = i, then the outcome o = x must never occur. If this holds true for every (x, i, z = i), it is equivalent to a SICcompound given that we already know that Alice must prepare SICs. Therefore, we choose our final correlation functional as This has two notable consequences. Firstly, we may numerically search for SIC-compounds by attempting to maximise H (which can be efficiently done through alternating convex searches). Secondly, if one can prove that H cannot attain the value (B3) in a quantum model, one falsifies the existence of any SIC-compound in the given dimension. To enable such a proof, one can use the hierarchy of semidefinite relaxations of the set of dimensionally restricted quantum correlations [67]. However, the computational requirements are significant due to the large number of preparations and measurements. Nevertheless, semidefinite relaxations can be evaluated by employing the symmetrisation techniques of Ref [26]. For instance, we consider the (trivial) case of deciding the existence of three orthogonal SICs for d = 2. The existence of a SIC-compound would enable H ≈ 12.899 while our semidefinite relaxation proves that no larger value is possible in quantum theory than H ≈ 12.728. We could also evaluate the case of three orthogonal SICs in dimension three, but were unable to obtain a bound on H smaller than that achieved by a SIC-compound (our SDP matrix is of size 3915). The falsification (which we have already shown analytically) could require a higher-level relaxation.

Appendix C: SIC-compounds and MUBs in dimension four
Standard lore has it that SICs and MUBs are unrelated in four dimensions. SICs appear as orbits of the Weyl-Heisenberg group, and the SIC-compound is an orbit under a subgroup of the normalizer of the Weyl-Heisenberg group. MUBs on the other hand are obtained from the bipartite Heisenberg group. Since the two groups are different, one does not expect a connection between SICs and MUBs. Nevertheless we found a connection, and it is interesting to see how this arises.
To see this we first recapitulate the analysis by Zhu et al. [47,63], which shows that in this dimension the Clifford group contains two normal copies of the Weyl-Heisenberg group. The Clifford group contains the symplectic group SL(2) with matrix elements chosen to be integers modulo 8. Its representation is fixed once the representation of the Weyl-Heisenberg group is fixed [45]. The subgroup of SL(2) that transforms a given compound to itself is generated by the order 4 symplectic matrices together with an order 3 Zauner matrix [45] which plays no role in this Appendix. The corresponding unitaries are denoted U G1 and U G2 . The generators of the twin Weyl-Heisenberg group are then represented by [47,63]. The presence of this 'extra' Weyl-Heisenberg group explains why the 4 · 16 vectors in the compound can be regrouped in such a way that 4 + 4 SICs appear [63]. But the bipartite Heisenberg group is lurking here as well. A straightforward calculation verifies that −iXZ = σ y ⊗ σ y , where σ x , σ y , σ z are the usual Pauli matrices. These local operators generate the bipartite Heisenberg group, they leave a given SIC compound invariant, and they can be used to create the MUBs mentioned in the main text. The usual construction of five MUBs proceeds by dividing the bipartite Heisenberg group into maximal abelian subgroups. In the main text we obtained 4 MUBs, all of them unbiased relative to the computational basis, as an orbit under the bipartite Heisenberg group. This is the Alltop construction of MUBs. The fact that this construction works in dimension 4 is already known [64], but the relation to the Weyl-Heisenberg Clifford group is new.