Hiding and masking quantum information in complex and real quantum mechanics

Classical information can be completely hidden in the correlations of bipartite quantum systems. However, it is impossible to hide or mask all quantum information according to the no-hiding and no-masking theorems derived recently. Here we show that any set of informationally complete quantum states is neither hidable nor maskable, thereby strengthening the no-hiding and no-masking theorems known before. Then, by virtue of Hurwitz-Radon matrices (representations of the Clifford algebra), we show that information about real quantum states can be completely hidden in the correlations, although the minimum dimension of the composite Hilbert space required increases exponentially with the dimension of the original Hilbert space. Moreover, the set of real quantum states is a maximal maskable set within quantum theory and has a surprising connection with maximally entangled states. These results offer valuable insight on the potential and limit of hiding and masking quantum information, which are of intrinsic interest to a number of active research areas.


I. INTRODUCTION
Hiding information in correlations is a simple way of realizing secret sharing [1,2], which is a primitive to cryptography and secure multiparty computation. In the quantum world, a similar idea is of interest to a wide spectrum of research topics, including but not limited to quantum secret sharing [3][4][5], quantum communication, information scrambling, and the black-hole information paradox [6][7][8][9]. However, it is impossible to hide or mask all quantum information in correlations according to the no-hiding theorem [10] and no-masking theorem [11] derived recently, in sharp contrast with classical information. These no-go theorems are reminiscent of the no-cloning theorem [12][13][14] and no-broadcasting theorem [15], which play crucial roles in quantum cryptography. On the other hand, little is known about hiding or masking quantum information in restricted sets of quantum states [16][17][18]. An example of special interest is the set of real quantum states as represented by real density matrices [19][20][21][22][23], which is the starting point of the resource theory of imaginarity [24,25].
Here we show that it is impossible to hide or mask any set of quantum states that is informationally complete (IC), thereby strengthening the no-hiding and nomasking theorems and establishing an information theoretical underpinning of these no-go results. This conclusion can serve as the common starting point for deriving and strengthening a number of results on quantum information masking. As implications, a set of qubit states is hidable or maskable iff the corresponding set of Bloch vectors is contained in a disk [11,16,17]. In addition, it is impossible to hide or mask any set of quantum states that has a nonzero measure; previously, quite restrictive * zhuhuangjun@fudan.edu.cn assumptions are required to derive a similar result [26]. Furthermore, it is impossible to hide or mask any set of quantum states that can form a (weighted complex projective) 2-design.
By virtue of Hurwitz-Radon (HR) matrices [27][28][29], we further show that information about real quantum states can be completely hidden in the correlations. In addition, we determine the minimum dimension and entanglement cost required to achieve this task. It turns out the minimum dimension increases exponentially with the dimension of the original Hilbert space. Moreover, the set of real quantum sates is a maximal maskable set within quantum theory. Meanwhile, there is a simple connection between the concurrence [30][31][32] of the output state of any masker for real quantum states and the robustness of imaginarity of the input state [24,25]. Our study offers valuable insight on the potential and limit of hiding and masking quantum information. It may shed light on a number of active research areas, including quantum secret sharing [3][4][5], information scrambling, black-hole information paradox [6][7][8][9], resource theory of imaginarity [24,25], and foundational studies on quantum mechanics [33][34][35].
The rest of this paper is organized as follows. In Sec. II we review the basic ideas of hiding and masking quantum information and introduce the concepts of masking spectrum, masking purity, entanglement of masking, and maximal maskable sets. In Sec. III we prove that it is impossible to hide or mask any set of quantum states that is IC. In Sec. IV we discuss the properties and construction of HR matrices. In Sec. V we prove that the set of real quantum states is maskable and is a maximal maskable set. In Sec. VI we construct a hidable set that is not maskable. In Sec. VII we clarify the relation between real states and phase-parameterized states. Section VIII summarizes this paper. To streamline the presentation, most technical proofs are relegated to the Appendix. ( If the reduced state A is independent of ρ in S , then M can hide the information of quantum states in the set S from subsystem A (cf. Fig. 1) and is called a partial masker (here we only consider partial maskers for subsystem A). So it is natural to expect that the information about the original states spreads over the correlations. However, this possibility is ruled by the no-hiding theorem when S = D(H) or S = P(H). In this case, any partial masker can only hide the information in a trivial way by transferring the information to another subsystem [10]. This surprising fact has implications for many active research topics, including the black-hole information paradox. However, little is known about this issue when S is a smaller subset. The set S is hidable if it consists of only one quantum state or if there exists a nontrivial partial masker. Otherwise, the set S is antiscrambling. In the latter case, S contains at least two distinct quantum states and every partial masker M : H → H A ⊗ H B for S is trivial in this sense: there exists a subspace H B = H B1 ⊗ H B2 in H B such that where AB1 is a fixed density matrix on H A ⊗H B1 , which is independent of ρ in S , while B2 is a density matrix on H B2 that depends on ρ. In the current language, the no-hiding theorem [10] states that P(H) and D(H) are antiscrambling. By contrast, M can mask the set S if both A and B are independent of ρ (cf. Fig. 1); that is, where τ A and τ B are fixed density matrices and are referred to as the common reduced density matrices. In this case, M is called a masker for S , and S is maskable. Note that the masker M can hide the information from both A and B, so all information is hidden in the correlations. Meanwhile, this masker offers a (2,2) threshold Hiding and masking of quantum information. In the former case, A is independent of ρ (in a given set S ); in the latter case, both A and B are independent of ρ.
scheme for quantum secret sharing [4]. A maskable set S is maximal if it is not contained in any other maskable set in D(H).
The masking spectrum of M is defined as the nonzero spectrum of τ A or τ B , assuming that S contains at least one pure state, so that τ A and τ B have the same nonzero spectrum. The masking purity ℘ of M refers to the purity of τ A or τ B , that is, Given a bipartite entanglement monotone E [36], the entanglement of masking of S is defined as where the minimization is over all maskers M for S . The entanglement of masking associated with real maskers can be defined in a similar way and is denoted by E R (S ). The following lemma is proved in Appendix A.
Lemma 1. Suppose S contains a pure state ρ 0 and M is a masker for S . Then E(S , M ) = E(M (ρ 0 )) for any entanglement monotone E.
If there exists no masker for S , then S is not maskable. By Ref. [11], the sets P(H) and D(H) are not maskable. This no-masking theorem also follows from the no-hiding theorem [10]; note that a maskable set is hidable (not antiscrambling) by definition, and an antiscrambling set is not maskable. Nevertheless, a maskable set can contain infinite nonorthogonal quantum states. In particular, any set of phase-parameterized states is maskable [11] (cf. Sec. VII). In addition, any set of commuting density matrices is maskable [18] since these density matrices can be expressed as convex mixtures of pure states in an orthonormal basis and so can be masked using a generalized Bell basis. Together with Ref. [15], this fact implies that any set of quantum states that can be broadcast is maskable, as illustrated in Fig. 2. Hierarchy of no-go theorems and associated sets of quantum states. A set of quantum states can be cloned iff distinct states are orthogonal, while it can be broadcast iff all states commute with each other [12,13,15]. Any set that can be broadcast is equivalent to a subset of the set D R (H) of real states, which can be masked even with a real masker. Any maskable set can hide from one party in a nontrivial way. So no-hiding and no-masking theorems do not apply to real quantum mechanics. By contrast, any IC set is antiscrambling (cannot hide from one party in a nontrivial way). Note that the set marked by "Antiscrabmling" is the complement of the set marked by "Hidable", as indicated by the color coding.

III. LIMITATIONS ON HIDING AND MASKING QUANTUM INFORMATION
A. Stronger no-hiding and no-masking theorems Let S ⊆ D(H) be a set of density matrices. The set S is IC if span(S ) = span(D(H)). In this case, any other density matrix is uniquely determined by the overlaps (transition probabilities) with density matrices in the set. This definition is motivated by an analogous definition for quantum measurements, usually represented by positive operator-valued measures (POVMs) [37][38][39]. By virtue of this concept, we can strengthen the no-hiding and nomasking theorems [10,11], which is instructive to understanding the distinctions between complex quantum mechanics and real quantum mechanics. Proposition 1 below follows from the very definitions.
Theorem 1. Any IC set of quantum states is antiscrambling.
Theorem 1 follows from Ref. [10] and Proposition 1. It implies Theorem 2 below, which also follows from Ref. [11] and Proposition 1. Self-contained proofs can be found in Appendix B.
Theorem 2. Any IC set of quantum states is not maskable.
The implications of Theorems 1 and 2 are discussed in more detail in the next subsection. Here it should be noted that Theorems 1 and 2 do not apply to real quantum mechanics, which is tied to the failure of local tomography [19], as discussed in Appendix B.

B. Implications
To understand the implications of Theorems 1 and 2 concerning the limit of hiding and masking quantum information, it is instructive to point out a basic property of IC sets of quantum states. Note that each density matrix on H can be expressed as j=1 is an orthonormal basis in the space of traceless hermitian matrices, and r = (r j ) d 2 −1 j=1 is a generalized Bloch vector. The affine dimension of a set of generalized Bloch vectors is defined as the smallest dimension of affine spaces that contain this set. In this terminology, a set of density matrices is IC iff the (corresponding) set of generalized Bloch vectors has affine dimension d 2 − 1. For a qubit, this fact leads to a simple geometric criterion.
Proposition 2. A set of qubit density matrices is IC iff the set of Bloch vectors is not contained in any disk-the intersection of the Bloch ball with a plane.
In addition, any set of qubit states that is contained in a disk in the Bloch ball is maskable [11,16,17] and thus not antiscrambling. To see this, it suffices to consider pure states. Up to a unitary transformation and irrelevant phase factors, such a set of kets is contained in a set of the form where 0 ≤ θ ≤ π/4. This set can be masked by the isometry: |0 → |00 , |1 → |11 [11]. So Theorems 1 and 2 imply the following corollary.
Corollary 1. A set of qubit states is hidable (or maskable) iff the set is not IC, iff the set of Bloch vectors is contained in a disk.
Corollary 1 confirms the hyperdisk conjecture proposed in Ref. [11] for the qubit case. Here the proof is simpler than previous proofs and has wider applicability [16,17]. This corollary also shows that a nontrivial disk (not a single point) in the qubit case is a maximal maskable set. In particular, D R (H) is a maximal maskable set, which is consistent with Theorem 4 presented in Sec. V below. Corollary 1 also implies that any hidable or maskable set in the qubit case has measure zero. This conclusion is not a coincidence as confirmed by the following corollary.
Corollary 2. Any hidable set of pure (mixed) states in P(H) (D(H)) has measure zero with respect to the uniform measure, and so does any maskable set of pure (mixed) states.
Here the uniform measure means the measure induced by the Hilbert-Schmidt distance. In the case of pure states, it coincides with the measure induced by the Haar measure on the unitary group. For pure states, Ref. [26] proved that any maskable set has measure zero given the assumption that the output Hilbert spaces H A and H B have the same dimension as H. However, this assumption is too restrictive according to our study on the masking of real quantum states as presented in Sec. V.
Proof. Suppose S ∈ P(H) is hidable. Then S is not IC according to Theorem 1. Therefore, we can find a nonzero hermitian operator Q such that tr(Qρ) = 0 for all ρ ∈ S , which implies that S has measure zero within P(H). A similar proof applies to mixed states and to any hidable or maskable set.
Let t be a positive integer. A weighted set of quantum states {|ψ j , w j } j in H with w j > 0 is a weighted t-design if j w j (|ψ j ψ j |) ⊗t is proportional to the projector onto the symmetric subspace in H ⊗t ; it is a tdesign if all weights w j are equal [38,40,41]. Note that any weighted t-design with t ≥ 2 is automatically a weighted 2-design. In addition, the set {|ψ j } j is IC if {|ψ j , w j } j is a weighted 2-design for some choice of weights w j [38,39]. Together with Theorems 1 and 2, these observations yield the following corollary. Prominent examples of 2-designs include symmetric informationally complete (SIC) POVMs [40][41][42] and complete sets of d + 1 mutually unbiased bases [43][44][45]. Recall that a SIC POVM in dimension d is composed of d 2 pure states with the equal pairwise fidelity of 1/(d + 1). Two bases {|ψ j } j and {|φ k } k are mutually unbiased if | ψ j |φ k | 2 = 1/d for all j, k. A set of mutually unbiased bases in dimension d is complete if it contains d+1 bases. According to Corollary 3, all these sets are antiscrambling and not maskable.

IV. HURWITZ-RADON MATRICES
In this section, we introduce the concept of HR matrices (operators) [27][28][29], which is crucial to establishing our main result on the masking of real quantum states. Except for Lemma 3 below, most results presented in this section are well known [29]. For the convenience of the reader, here we formulate these results in a language that is familiar to researchers in the quantum information community.

A. Definition and basic properties of HR matrices
A set {U j } s j=1 of m × m unitary matrices (operators) is a set of HR matrices (operators) [27][28][29] if For example, let σ x , σ y , σ z be the three Pauli matrices; then {iσ x , iσ y , iσ z } is a set of HR matrices in dimension 2. Such matrices play crucial roles in the Dirac equation and in the representations of the Clifford algebra [46]. The defining equation above implies that So each U j has at most two distinct eigenvalues, namely, i and −i; in addition U j and U k are orthogonal with respect to the Hilbert-Schmidt inner product when j = k. If s ≥ 2, then Eq. (8) implies that tr(U j ) = 0 (cf. Lemma 3 below); in the case s = 1, this conclusion does not hold automatically, and this fact has important implications for the masking of real density matrices, as we shall see later.
The main properties of HR matrices (operators) are summarized below and proved in Appendix C.
Then the following statements are equivalent:  Lemma 3. Suppose U 0 = 1 1 and {U j } s j=1 with s ≥ 2 is a set of HR matrices that commute with a hermitian matrix τ . Suppose j, k, j , k are integers that satisfy the conditions 0 ≤ j < k ≤ s and 0 ≤ j < k ≤ s; let α > 0. Then where kj k is equal to 1 (−1) if (k, j , k ) is an even (odd) permutation of (1, 2, 3) and is equal to 0 otherwise; jkk is defined in a similar way.

B. Construction of HR matrices
In dimension 2, {iσ x , iσ y , iσ z } is a set of HR matrices as mentioned before. In higher dimensions, HR matrices can be constructed iteratively. Given a set {U j } s j=1 of s HR matrices in dimension m, then s + 2 HR matrices can be constructed in dimension 2m as follows, In this way, 2b + 1 HR matrices can be constructed in dimension 2 b , which attain the maximum number according to Lemma 4 below. If instead the dimension is divisible by 2 b , then the same number of HR matrices can be constructed by considering the tensor product with a suitable identity matrix. Suppose {U j } r j=1 and {V j } s j=1 are two sets of HR matrices in dimensions m 1 and m 2 , respectively. Then we can construct a set of r + s + 1 HR matrices in dimension 2m 1 m 2 as follows [29], Note that this construction works even when r = 0 and m 1 = 1. HR matrices can also be constructed from real orthogonal matrices. The maximum number of such HR matrices in dimensions 2, 4, 8 are 1, 3, 7, respectively. For example, iσ y is an HR matrix in dimension 2, and iσ y ⊗ σ z , iσ y ⊗ σ x , 1 1 ⊗ iσ y are three HR matrices in dimension 4; seven HR matrices in dimension 8 can be constructed as follows, Real orthogonal HR matrices in higher dimensions can be constructed iteratively by virtue of Eq. (18), note that W j is real orthogonal if both U j and V j−r are real orthogonal.
In particular s + 8 real orthogonal HR matrices can be constructed in dimension 16m if s real orthogonal HR matrices can be constructed in dimension m.
Lemma 4 follows from Refs. [27][28][29]. It clarifies the minimum dimension required to construct a given number of HR matrices. Incidentally, the variations of κ(d) and κ R (d) exhibit Bott periodicity [29], which is of key interest in algebraic topology.

V. MASKING QUANTUM INFORMATION IN REAL QUANTUM MECHANICS
In this section we show that the set D R (H) of real density matrices is maskable and is actually a maximal maskable set. In addition, we determine the entanglement of masking and the minimum dimension of the output Hilbert space required to mask D R (H).

A. Construction of a masker
Let m be an even positive integer that is divisible by κ(d). Let H A and H B be two m-dimensional Hilbert spaces and then M is a masker for P R (H) and D R (H).
To verify the above claim, note that the d states |Φ j are orthonormal since Given any normalized vector c = (c 0 , c 1 , . . . , c d−1 ) and the state |ψ(c) = j c j |j ∈ H, the output state has the form j=1 is a set of HR matrices, which implies that |Ψ(c) is maximally entangled. So M is a masker for P R (H) and D R (H).
If m is divisible by κ R (d) and each U j is real orthogonal, then the output Hilbert space could be real, which leads to a real masker for P R (H) and D R (H). Therefore, the set of real states can be masked even with a real masker. In other words, the information about quantum states in real quantum mechanics can be completely hidden in the correlations. This fact shows that the no-hiding and no-masking theorems do not apply to real quantum mechanics, in sharp contrast with complex quantum mechanics, as illustrated in Fig. 2.
When d = 4 for example, a masker for D R (H) can be constructed using the set of HR matrices {iσ x , iσ y , iσ z }, which is tied to the two-qubit magic basis [30] Let M be the isometry from H to the two-qubit Hilbert space H A ⊗ H B as defined by the map |j → |Φ j for j = 0, 1, 2, 3. Then M can mask the set D R (H). Here the concurrence of the output state |Ψ(c) = j c j |Φ j reads [30] so |Ψ(c) is maximally entangled iff |ψ(c) is a real ket up to an overall phase factor. In this way, the masker M establishes a one-to-one correspondence between real pure states in H and maximally entangled states in H A ⊗ H B . This correspondence is tied to the geometric facts that normalized real kets in H form a 3-sphere, and so does the special unitary group SU (2). Incidentally, based on this example, we can construct a hidable set that is not maskable, as shown in Sec. VI later.

B. All maskers for real quantum states
Next, we determine all maskers for the sets P R (H) and j=1 is a set of HR matrices that commute with τ A and satisfy tr( then the kets |Ψ j for j = 0, 1, . . . , d − 1 are orthonormal, and the isometry M : j → |Ψ j is a masker for P R (H) and D R (H). The following theorem proved in Appendix D shows that essentially all maskers can be constructed in this way. It implies Corollaries 4-6 below, which are proved in Appendix E. where are two sets of HR matrices. Meanwhile, U j and V j commute with τ A and τ B , respectively, and satisfy tr(U j τ A ) = tr(V j τ B ) = 0. Here λ o refer to distinct eigenvalues, while µ l for different l may equal each other.
Given a density matrix ρ ∈ D(H), the robustness of imaginarity I R (ρ) [24,25] is defined as (30) A closed formula was presented in Ref. [25] as reproduced here, Here we are interested in I R (ρ) because of its intimate connection with the properties of the output state of any masker for D R (H) with d = dim(H) ≥ 3 as shown in the following corollary; see also Eq. (46) below. It should be noted that this corollary is not applicable when d = 2.
(1) for all ρ ∈ D(H). In addition, is the Hilbert-Schmidt norm of ρ − ρ T , and ℘ is the masking purity defined in Eq. (5). If in addition d = 4, then When d ≥ 3, Eq. (32) implies that and the inequality is saturated iff ρ is a real density matrix, that is, ρ ∈ D R (H). If in addition d = 4, then Eq. (34) implies that and each inequality is saturated iff ρ is a real density matrix. C. Entanglement of masking and masking purity By virtue of Theorem 3 and Corollary 4, we can determine the minimum entanglement cost required to mask the set of real quantum states. The following corollary is proved in Appendix F.
Corollary 7. Let E be an entanglement monotone; then where |Φ(m) is a maximally entangled state of Schmidt rank m.
For a bipartite pure state, the entanglement cost, entanglement of formation, distillable entanglement, and relative entropy of entanglement all coincide with the von Neumann entropy of each reduced state [36]. If E is one of these entanglement measures, say, the entanglement cost E C , then Corollary 7 and Lemma 4 imply that Note The entanglement of masking quantified by the entanglement cost E C is approximately linear in d, and the deviation exhibits Bott periodicity, as illustrated in Fig. 3 If the concurrence C [30][31][32] is chosen to quantify the entanglement, then we have In addition, Corollary 4 implies that the masking purity ℘ of any masker for D R (H) satisfies ℘ ≤ 1/κ(d) (cf. the proof of Corollary 7); by contrast, ℘ ≤ 1/κ R (d) for any real masker. This conclusion is expected given the close connection between the concurrence of a bipartite pure state and the purity of each reduced state.
D. Real quantum mechanics as a maximal maskable subtheory Here we show that the set D R (H) of real density matrices is a maximal maskable set within D(H). Such maximal maskable sets are valuable to understanding the potential and limit of hiding and masking quantum information. However, no maximal maskable sets beyond the qubit system have been found before the current study as far as we know. This conclusion shows that real quantum mechanics is a maximal maskable subtheory in the usual quantum mechanics. Theorems 4 and 5 below are proved in Appendix G.  A strict entanglement monotone E means E(|Ψ 1 ) > E(|Ψ 2 ) whenever |Ψ 1 can be turned into |Ψ 2 by LOCC, but not vice versa. Prominent examples of convex strict monotones include entanglement of formation, entanglement cost, relative entropy of entanglement, and concurrence [30][31][32]36]. For concurrence, we can further derive the following result (assuming d ≥ 3) where A = tr B ( ) and B = tr A ( ) with = M (ρ).
Here the second inequality follows from Eq. (32) in Corollary 6. If ρ is pure, then is pure, and A , B have the same purity, so the first two inequalities in Eq. (44) are saturated, which yields for d ≥ 3. By contrast, the last inequality in Eq. (44) [also in Eq. (45)] is saturated iff ρ is a real density matrix. For a pure input state ρ, the concurrence C(M (ρ)) of the output state is tied to the robustness of imaginarity I R (ρ) defined in Eq. (30) [24,25], which plays a key role in the resource theory of imaginarity. In particular, Eqs. (31) and (45) together imply that note that ρ − ρ T 1 = √ 2 ρ − ρ T HS and when ρ is pure (which means ρ T is also pure). In this case C(M (ρ)) is completely determined by the masking purity ℘ and robustness of imaginarity I R (ρ). This result is illustrated in Fig. 4 and is of intrinsic interest to the resource theory of imaginarity.
Here it should be pointed out that Theorem 5 and Eqs. (44)- (46) are not applicable when d = 2 since Corollary 6 is not applicable in this special case. To construct a counterexample, let Then According to the majorization criterion [47], M |ψ can be turned into |Ψ 0 by LOCC, but not vice versa. Therefore, E(M (|ψ ψ|)) ≥ E(|Ψ 0 Ψ 0 |) for any entanglement monotone E, and the inequality is strict when E is the entanglement cost, entanglement of formation, distillable entanglement, relative entropy of entanglement, or concurrence, which contradicts Theorem 5. For example, the concurrence of M (|ψ ψ|) reads which contradicts Eqs. (44)- (46).

VI. A HIDABLE SET THAT IS NOT MASKABLE
In this section we provide an example which is hidable but not maskable. Such an example has never been constructed in the literature previously as far as we know. Suppose dim(H) = 4 and S ⊂ D(H) is the set of density matrices ρ = 3 j,k=0 ρ jk |j k| defined by the following constraints where denotes the imaginary part of a complex number. Then S contains D R (H) as a strict subset and is thus not maskable according to Theorem 4. Nevertheless, S is hidable as we shall see shortly.
To show that S is hidable, it suffices to construct a nontrivial partial masker for S . Consider the masker M for D R (H) that is constructed using the magic basis in Eq. (26). Although M is not a masker for S , it is straightforward to verify that Therefore, M is a partial masker for S . This partial masker is nontrivial because the information about all real quantum states in S is encoded in the correlations. This example demonstrates that not all hidable sets of quantum states are maskable. In other words, not all sets of quantum states that are not maskable are antiscrambling; the property of being antiscrambling is much stronger, as illustrated in Fig. 2.
(54) Let P(c) be the set of phase-parameterized states associated with kets in K (c) and let P(c) be the convex hull of P(c). According to Ref. [11], the sets P(c) and P(c) can be masked by the isometry defined as follows, This isometry is well known although it was not recognized as a masker before the study in Ref. [11]. Here the dimension of each subsystem of the output system is the same as that of the input system, which is much smaller compared with the counterpart for masking the set of real quantum states as discussed in Sec. V. Moreover, Ref. [11] conjectured that any maskable set can be embedded in P(c) for a suitable choice of c, which is known as the hyperdisk conjecture. Although this conjecture has been disproved [17], it is plausible that P(c) is a maximal maskable set.
Here we clarify the relation between the set P(c) of phase-parameterized states defined above and the set P R (H ) of real states. For generality, here H is a Hilbert space whose dimension may be different from that of H. When d = 2 and c 0 = c 1 = 1/ √ 2, the set P(c) corresponds to a great circle on the Bloch sphere and is equivalent to the set P R (H ) with dim(H ) = 2. Here "equivalent" means that P(c) can be mapped to P R (H ) by some isometry S, that is It turns out this is the only case in which P(c) is equivalent to a subset of P R (H ), as shown in Proposition 3 below and proved in Appendix H. Conversely, P R (H ) is equivalent to a subset of P(c) only if dim(H ) = 2, as shown in Proposition 4 below and proved in Appendix H.  Propositions 3 and 4 still hold if P(c) is replaced by P(c) and P R (H ) is replaced by D R (H ). By Proposition 4, the set D R (H ) with dim(H ) ≥ 3 cannot be embedded in P(c) irrespective of the choice of c, which disproves again the hyperdisk conjecture posed in Ref. [11] (cf. Ref. [17]). This conclusion is consistent with the fact that D R (H ) is a maximal maskable set as shown in Theorem 4. On the other hand, except for the special case specified in Proposition 3, P(c) cannot be embedded in D R (H ), so any maximal maskable set containing P(c) cannot be equivalent to D R (H ). Quite likely, P(c) is itself a maximal maskable set as stated in Conjecture 1. In any case, Propositions 3 and 4 imply that there exist inequivalent maximal maskable sets, which reflects the complexity of the masking problem.

VIII. SUMMARY
We showed that it is impossible to hide or mask any set of quantum states that is IC, which strengthens the no-hiding and no-masking theorems and establishes an information theoretical underpinning of these no-go results. In sharp contrast, quantum information can be completely hidden in correlations for real quantum mechanics, although the minimum dimension of the output Hilbert space has to increase exponentially with the dimension of the original Hilbert space. Moreover, in a precise sense real quantum mechanics is a maximal maskable subtheory within complex quantum mechanics.
Our study offers valuable insight on the potential and limit of hiding and masking quantum information, which are of intrinsic interest to foundational studies. Meanwhile, the masking protocols we constructed are useful to quantum secret sharing and quantum communication. This is the case in particular when quantum states with real density matrices are easier to prepare and manipulate, say, in linear optics [25]. Furthermore, our study may shed light on a number of other active research areas, including information scrambling and the black-hole information paradox. Notably, the no-hiding theorem derived in Ref. [10] aggravates the tension between unitarity and Hawking's semiclassical analysis of black-hole radiation. The tension would not be so serious in real quantum mechanics thanks to the breakdown of the no-hiding theorem. In addition, our study indicates that Bott periodicity might play an important role in these research areas. We hope that our work can stimulate further progresses in these research topics.

APPENDIX
In this Appendix, we prove the key results presented in the main text, including Lemmas 1-3, Theorems 1-5, Corollaries 4-7, and Propositions 3, 4. For the convenience of the readers, lemmas, theorems, corollaries, and propositions will be restated before their proofs. In the course of study, we also derive a few auxiliary results on bipartite pure states and on the masking of real quantum states, which are of some independent interest.
The last equation implies that for all ∈ M (S ), where E(|Ψ 0 Ψ 0 |) and E(|Ψ Ψ |) refer to the bipartite entanglement of |Ψ 0 Ψ 0 | and |Ψ Ψ | with respect to the partition between A and BC. The two equalities in Eq. (A3) follow from the fact that 0 , |Ψ 0 Ψ 0 |, and |Ψ Ψ | have the same nonzero Schmidt coefficients, while the inequality follows from the monotonicity of E under partial trace. As an immediate corollary of Eq. (A3), we can deduce that which confirms Lemma 1.
Appendix B: Proofs of Theorems 1 and 2 Theorem 1. Any IC set of quantum states is antiscrambling.
Proof of Theorem 1. Thanks to Proposition 1, it suffices to consider an IC set that is composed of pure states, in which case it is more convenient to work with kets. Let K = {|ψ h } h ⊂ H be an arbitrary set of kets that is IC (which means the corresponding set of states is IC), then |K | ≥ d 2 with d = dim(H). Without loss of generality, we can assume that d of the kets in K , say |ψ 0 , |ψ 1 , . . . , |ψ d−1 , are linearly independent, so they form a basis (not necessarily orthogonal) for H, denoted by B := {|ψ 0 , |ψ 1 , . . . , |ψ d−1 } henceforth. Let B = {|φ 0 , |φ 1 , . . . , |φ d−1 } be the dual basis of B defined by the requirement φ j |ψ k = δ jk , where the tilde is used to indicate that the kets |φ j are not necessarily normalized. Here and in the rest of this proof we assume that j, k can take on the values 0, 1, . . . , d − 1.
Suppose M is an isometry from H to H A ⊗ H B and a partial masker for the set K . Let |Ψ h = M |ψ h and τ A = tr B (|Ψ h Ψ h |); note that τ A is independent of h by assumption. Suppose τ A has the spectral decomposition τ A = λ u |a u a u |, where λ u are eigenvalues of τ A and |a u form an orthonormal eigenbasis. Then |Ψ h can be expressed as follows, where the kets |b (h) u for a given h are orthonormal. In addition, j |ψ j φ j | is the identity operator on H, so where µ jh = φ j |ψ h and the two summations run over j = 0, 1, . . . , d−1. Accordingly, |b where By assumption the set K is IC, so Eq. (B3) implies that R(v, u) = 0 and R kj (v, u) = 0, that is, Define |b (j) u := |u ⊗|ψ j , where |u are orthonormal kets in a suitable Hilbert space; then b u . So there exists an isometry that maps |b (j) u to |u ⊗ |ψ j . This isometry induces the following transformation, which implies that M |ψ h ψ h |M † have the form in Eq. (3). It follows that K is antiscrambling, which confirms Theorem 1.
Theorem 2. Any IC set of quantum states is not maskable.
Suppose on the contrary that K can be masked by the masker M , which maps H to a subspace of H A ⊗ H B . Let |Ψ h = M |ψ h for all h; then the two reduced states τ A := tr B (|Ψ h Ψ h |) and τ B := tr A (|Ψ h Ψ h |) are independent of h by assumption. Suppose τ A has spectral decomposition τ A = u λ u |a u a u |, where the eigenkets |a u are orthonormal. Then |Ψ h can be expressed as where the kets |b (h) u for a given h are orthonormal. Accordingly we have In addition, each ket |ψ h in K can be expressed as where µ jh = φ j |ψ h , so that where 1 1 B is the identity operator on H B and Note thatR is a hermitian operator acting on H ⊗ H B . By assumption the set K is IC, so Eq. (B12) implies thatR = 0, which in turn implies thatR (jk) = 0 for j, k = 0, 1, . . . , d − 1. In conjunction with Eqs. (B9) and (B14), we can deduce the following equality, (B15) However, this equation cannot hold whenever λ u > 0 given that | ψ k |ψ j | < 1 and | b Here it is instructive to clarify why the above proof does not apply to real quantum mechanics. It is well known that local tomography fails in real quantum mechanics, which means it is in general impossible to determine the state of a composite system by local measurements only [19]. In the case of two qubits for example, each real density matrix can be expressed as where σ x , σ y , σ z are the three Pauli matrices, and a x , a z , b x , b z , T xx , T xz , T zx , T zz , T yy are real coefficients. With local measurements only, it is impossible to determine the state ρ completely because such measurements provide no information about T yy . Now, let us turn back to the proof of Theorem 2. In real quantum mechanics, due to the failure of local tomography, Eq. (B12) alone does not imply the equalitỹ R = 0, so the reasoning in the proof of Theorem 2 breaks down. Nevertheless, this fact offers little clue on how to construct a masker for the set of real density matrices, so itself does not disprove the no-masking and no-hiding theorems on real quantum mechanics. The maskers we construct in the main text are crucial to settling this issue completely.
Then the following statements are equivalent: is a set of s HR matrices.

U (c) is unitary for each normalized real vector c.
Proof of Lemma 2. Let then V 0 = 1 1 and V (c) = U † 0 U (c). If statement 1 holds, which means {V j } s j=1 is a set of s HR matrices, then Therefore, which implies that U (c) † U (c) = |c| 2 1 1 and confirms the implication 1 ⇒ 2. The implication 2 ⇒ 3 is obvious. If statement 3 holds, then the matrix V (c) is unitary for each normalized real vector c. Notably, (1 1 + V j )/ √ 2 is unitary for j = 1, 2, . . . , s, which means V † j = −V j and V 2 j = −1 1. In addition, the requirement that ( Therefore, {V j } s j=1 is a set of s HR matrices, which confirms the implication 3 ⇒ 1.
Lemma 3. Suppose U 0 = 1 1 and {U j } s j=1 with s ≥ 2 is a set of HR matrices that commute with a hermitian matrix τ . Suppose j, k, j , k are integers that satisfy the conditions 0 ≤ j < k ≤ s and 0 ≤ j < k ≤ s; let α > 0. Then where kj k is equal to 1 (−1) if (k, j , k ) is an even (odd) permutation of (1, 2, 3) and is equal to 0 otherwise; jkk is defined in a similar way.
Proof of Lemma 3. Since {U j } s j=1 is a set of HR matrices, we have By the assumptions s ≥ 2 and 0 ≤ j < k ≤ s, we can always find a matrix V in U := {U j } s j=1 that anticommutes with U j U k . Therefore, which implies Eq. (11). Next, we can prove Eq. (12) in the case s = 3. When j = j and k = k , Eq. (12) follows from the fact that (U j U k ) 2 = −1 1. When j = j or k = k , we can always find a matrix V ∈ U that anticommutes with U j U k U j U k , which implies that tr(U j U k U j U k τ α ) = 0 and confirms Eq. (12).
It remains to prove Eq. (13) in the case s = 3. When j = j and k = k , Eq. (13) follows from the fact that (U j U k ) 2 = −1 1 as Eq. (12). When j = 0 and (k, j , k ) is a permutation of (1, 2, 3), Eq. (13) follows from the fact that U k , U j , U k anticommute with each other. When j = 0 and (j, k, k ) is a permutation of (1, 2, 3), Eq. (13) follows from a similar reasoning. In all other cases, we can always find a matrix V ∈ U that anticommutes with U j U k U j U k , which implies that tr(U j U k U j U k τ α ) = 0 and confirms Eq. (13).
where {U j } d−1 j=1 and {V j } d−1 j=1 are two sets of HR matrices. Meanwhile, U j and V j commute with τ A and τ B , respectively, and satisfy tr(U j τ A ) = tr(V j τ B ) = 0.
Before proving Theorem 3, it is worth pointing out that it does not cause any loss of generality to assume that τ A and τ B have full rank. Note that all states |Ψ j for j = 0, 1, . . . , d − 1 have the same reduced density matrix for each party since M is a masker for D R (H). Proof of Theorem 3. By assumption each |Ψ j for j = 1, 2, . . . , d − 1 has the same reduced states as |Ψ 0 , so there exists a unique unitary matrix U j acting on H A and a unique unitary matrix V j acting on H B that satisfy Eq. (29) in Theorem 3 according to Lemma 5 below. In addition, U j and V j commute with τ A and τ B , respectively. Furthermore, we have since M is an isometry.
Let c := (c 0 , c 1 , . . . , c d−1 ) be an arbitrary normalized real vector; let |ψ(c) = j c j |j and |Ψ(c) = M |ψ(c) . Then where U 0 = 1 1 A . By assumption |Ψ(c) has the same reduced states as |Ψ 0 , so U (c) is a unitary matrix that commutes with τ A according to Lemma  2. An auxiliary lemma Lemma 5. Suppose |Ψ 1 , |Ψ 2 ∈ H A ⊗H B are bipartite pure states that have the same reduced states τ A and τ B for the two parties, respectively, that is, where τ A has full rank on H A . Then there exists a unique linear operator U acting on H A that satisfies in addition, U is unitary and commutes with τ A .
The last conclusion in Lemma 5 means U is block diagonal with respect to the eigenspaces of τ A .
Proof. By assumption both |Ψ 1 and |Ψ 2 are purifications of τ B , so they can be turned into each other by local unitary transformations on H A . In other words, we can find a unitary operator U acting on H A that satisfies Eq. (D5). Let be the decomposition of |Ψ 1 and |Ψ 2 in the computational basis and define Then we have which imply that given that τ A has full rank. So there exists only one linear operator U that can satisfy Eq. (D5). In addition, Eq. (D8) implies that j=1 is a set of HR matrices that commute with τ A . Define as in the main text. Then given that U k anticommutes with U j and U † k U j for j = k Conversely, the existence of a real masker with masking spectrum {λ o , m o } o implies that each m o is divisible by κ R (d) according to a similar reasoning employed above.
It remains to consider complex maskers for a qubit (with d = 2). Suppose there exists a vector v = (v l ) l composed of 1 and −1 that satisfies the equality l v l µ l = 0. Let U = l iv l |l l| and Then |Ψ 0 , |Ψ 1 are orthonormal, and the isometry M defined by the map |j → |Ψ j for j = 0, 1 is a masker for D R (H).
Conversely, suppose M is a masker for the set D R (H) with masking spectrum {µ l } l . Let |Ψ 0 = M |0 and τ A = tr B (|Ψ 0 Ψ 0 |). Without loss of generality, we can assume that τ A has full rank. According to Theorem 3, there exists an HR matrix U that commutes with τ A and satisfies tr(U τ A ) = 0. By a suitable choice of orthonormal basis if necessary, we can assume that both U and τ A are diagonal. The diagonal entries of τ A happen to be µ l , while the diagonal entries of U have the form v l i with v l = ±1, given that each eigenvalue of U is either i or −i. Therefore, i l v l µ l = tr(U τ A ) = 0, which completes the proof of Corollary 4.
where ρ − ρ T HS = tr[(ρ − ρ T ) 2 ] is the Hilbert-Schmidt norm of ρ − ρ T , and ℘ is the masking purity defined in Eq. (5). If in addition d = 4, then Proof of Corollary 6. Without loss of generality, we can assume that τ A and τ B have full rank. Let |Ψ j = M |j , then |Ψ j have the form in Eq. (29) according to Theorem 3, so A and B have the form in Eqs. (E15) and (E16) according to Lemma 6 below. In addition, A and B commute with τ A and τ B , respectively. Let P be the projector onto the eigenspace of τ A associated with any nonzero eigenvalue λ; then P commutes with A . Meanwhile, tr(P U j U k ) = 0 for 0 ≤ j < k < d since we can always find a matrix in {U j } d−1 j=1 that anticommutes with U j U k (note that this conclusion does not hold when d = 2, and that is why we assume d ≥ 3 in Corollary 6). Therefore, tr(P A ) = tr(P τ A ) + 0≤j<k<d (ρ kj − ρ jk ) tr(P U j U k τ A ) = tr(P τ A ) + 0≤j<k<d (ρ kj − ρ jk )λ tr(P U j U k ) = tr(P τ A ), (E5) which implies that P τ A is majorized by P A given that P τ A = λP is proportional to a projector. As a corollary, τ A is majorized by A . By the same token τ B is majorized by B .
When d = 4, by Lemma 3 in the main text and Lemma 6 below, the purity of A can be computed as follows, where ℘ = tr(τ 2 A ) = tr(τ 2 B ) is the masking purity. Here the last equality follows from the fact that By the same token we can deduce which, together with Eq. (E6), confirms Eqs. (32) and (34). Equation (33) is a corollary of Eq. (32) and the following equation, Here the first inequality is well known given that ρ is a density matrix on a Hilbert space of dimension d; the second inequality follows from the fact that ρ − ρ T is hermitian and antisymmetric, which means its nonzero eigenvalues form pairs of opposite signs. Similarly, Eq. (35) is a corollary of Eqs. (34) and (E9). When d = 4, by Lemmas 3 and 6, the purity of A reads Similarly, the purity of B reads which, together with Eq. (E11), implies Eq. (32). The second equality in Eq. (E12) is a consequence of the equality , which can be derived as follows. From Eq. (29) we can deduce that which implies that Here the first equality follows from Lemma 7 below, and the second one follows from the fact that U 1 , U 2 , U 3 anticommute with each other. Equation (33) is still a corollary of Eqs. (32) and (E9). This observation completes the proof of Corollary 6.
Proof. By assumption we have Therefore, Here the third equality follows from the fact that U k and U † k commute with τ A . The last equality follows from the fact that U 0 = 1 1 A and {U j } d−1 j=1 is a set of HR matrices on H A , which means Equation (E16) can be proved in a similar way.
Lemma 7. Let |Ψ 0 be a bipartite ket in the Hilbert space H A ⊗ H B with reduced states τ A = tr B (|Ψ 0 Ψ 0 |) and τ B = tr A (|Ψ 0 Ψ 0 |). Suppose U and V are unitary operators on H A and H B that satisfy Suppose P A and P B are the projectors onto the eigenspaces of τ A and τ B , respectively, which are associated with a same nonzero eigenvalue λ; then Proof. We first prove Eq. (E22). Equation (E20) implies that U commutes with τ A and P A , while V commutes with τ B and P B . In addition, by assumption we have Therefore, λ tr(P A U ) = tr(P A U τ A ) = Ψ 0 |(P A U ⊗ 1 1 B )|Ψ 0 = Ψ 0 |(1 1 A ⊗ P B V )|Ψ 0 = tr(P B V τ B ) = λ tr(P B V ), which implies Eq. (E22). Equation (E21) is a corollary of Eq. (E22) given that τ A and τ B have the same nonzero spectrum. When α = 1, Eq. (E21) can also be derived directly as follows, Appendix F: Proof of Corollary 7 Corollary 7. Let E be an entanglement monotone; then E(D R (H)) = E(P R (H)) = E(|Φ(κ(d)) ), E R (D R (H)) = E R (P R (H)) = E(|Φ(κ R (d)) ), (39) where |Φ(m) is a maximally entangled state of Schmidt rank m.
Proof of Corollary 7. Note that any masker for D R (H) is a masker for P R (H), and vice versa, so we have E(D R (H)) = E(P R (H)) according to Lemma  Here the inequality follows from the fact that the nonzero spectrum of tr B (|Ψ 0 Ψ 0 |) (that is, the masking spectrum of M ) is majorized by the nonzero spectrum of tr B (|Φ(κ(d)) Φ(κ(d))|) according to Corollary 4, so |Ψ 0 can be turned into |Φ(κ(d)) by LOCC according to the majorization criterion of Nielsen [47]. In addition, the inequality in Eq. (F1) can be saturated by choosing a suitable masker according to Corollary 4. This observation confirms Eq. (38). Equation (39) can be proved using a similar reasoning. When d ≥ 3, in conjunction with Corollary 6, this equation implies that tr(ρρ T ) = tr(ρ 2 ), so that ρ ∈ D R (H). Therefore, D R (H) is a maximal maskable set. When d = 2, the density matrix A has the form A = τ A + (ρ 10 − ρ 01 )U τ A (G2) according to Lemma 6, where U is a unitary matrix that satisfies U 2 = −1 1 A . So the equality A = τ A implies that ρ 10 = ρ 01 and that ρ ∈ D R (H). Therefore, D R (H) is a maximal maskable set. Alternatively, this conclusion follows from Corollary 1 (cf. Refs. [16,17]). This observation completes the proof of Theorem 4. For pure states, Theorem 4 can be proved in a simpler way, which is less technical and more instructive. Let |ψ be any ket in H that is not proportional to a real ket. Let S be the union of P R (H) and {|ψ ψ|}. To prove that P R (H) is a maximal maskable set within P(H), it suffices to prove that S is not maskable.
By assumption |ψ has the form |ψ = c 1 |ψ 1 + ic 2 |ψ 2 , where |ψ 1 , |ψ 2 are two real kets that are linearly independent, and c 1 , c 2 are nonzero real coefficients that satisfy the normalization condition c 2 1 + c 2 2 = 1. Let H 2 be the span of {|ψ 1 , |ψ 2 } and let S 2 be the set of all real pure states on H 2 . Then we have |ψ ∈ H 2 and S 2 ∪ {|ψ ψ|} ⊆ S . Geometrically, S 2 is a great circle on the Bloch sphere associated with H 2 , while |ψ ψ| is a point on the sphere, but not on this great circle. Therefore, S 2 ∪ {|ψ ψ|} is not maskable according to Corollary 1, which implies that S is not maskable.
Theorem 5. Suppose d ≥ 3 and M : H → H A ⊗ H B is a masker for D R (H). Let |Ψ 0 = M |0 ; then any state in M (D(H)) can be created from |Ψ 0 Ψ 0 | by local operations and classical communication (LOCC). In addition, E(M (ρ)) ≤ E(|Ψ 0 Ψ 0 |) for any entanglement monotone E and all ρ ∈ D(H). When E is a convex strict monotone, the upper bound is saturated iff ρ ∈ P R (H).
Proof of Theorem 5. Let τ A = tr B (|Ψ 0 Ψ 0 |). Let ρ be an arbitrary state in D(H), = M (ρ), and A = tr B ( ). According to Corollary 6, τ A is majorized by A . If ρ is pure, so that is also pure, then can be created from |Ψ 0 Ψ 0 | by LOCC according to the majorization criterion [47]. The same conclusion applies when ρ is mixed, in which case ρ can be expressed as a convex mixture of pure states and so can accordingly.
By the above discussion, we have E( ) ≤ E(|Ψ 0 Ψ 0 |) for any entanglement monotone E since |Ψ 0 Ψ 0 | can be turned into by LOCC. Next, suppose E is a convex strict monotone. If ρ, are pure and the upper bound E( ) ≤ E(|Ψ 0 Ψ 0 |) is saturated, then and |Ψ 0 Ψ 0 | can be turned into each other by LOCC. Therefore, A , B , τ A , and τ B have the same nonzero spectrum according to the majorization criterion [47] and thus have the same purity. Now Corollary 6 implies that ρ is a real density matrix, that is, ρ ∈ P R (H).
If ρ is mixed, then it can be expressed as a convex mixture of pure states ρ = r a r |ψ r ψ r | with a r > 0 and |ψ r ψ r | / ∈ P R (H) for at least one r. Accordingly, we have = r a r M |ψ r ψ r |M † , and the inequality is strict for at least one r. Therefore, E( ) ≤ r a r E(M |ψ r ψ r |M † ) < E(|Ψ 0 Ψ 0 |), (G4) so the inequality E( ) ≤ E(|Ψ 0 Ψ 0 |) cannot be saturated when ρ is mixed, which completes the proof.