Quantum-Logic Gate between Two Optical Photons with an Average Efficiency above 40%

Optical qubits uniquely combine information transfer in optical fibers with a good processing capability and are therefore attractive tools for quantum technologies. A large challenge, however, is to overcome the low efficiency of two-qubit logic gates. The experimentally achieved efficiency in an optical controlled NOT (CNOT) gate reached approximately 11% in 2003 and has seen no increase since. Here we report on a new platform that was designed to surpass this long-standing record. The new scheme avoids inherently probabilistic protocols and, instead, combines aspects of two established quantum nonlinear systems: atom-cavity systems and Rydberg electromagnetically induced transparency. We demonstrate a CNOT gate between two optical photons with an average efficiency of 41.7(5)% at a postselected process fidelity of 81(2)%. Moreover, we extend the scheme to a CNOT gate with multiple target qubits and produce entangled states of presently up to five photons. All these achievements are promising and have the potential to advance optical quantum information processing in which almost all advanced protocols would profit from high-efficiency logic gates.


I. INTRODUCTION
The field of quantum information processing based on optical systems has advanced impressively in the last two decades [1][2][3][4]. A recent highlight is the experimental demonstration of the quantum computational advantage in Gaussian boson sampling [5]. However, the low efficiency of optical two-qubit gates hampers many other developments in the field. Hitherto, the record for the experimentally achieved efficiency of approximately 11% was set in 2003 [6] with a scheme that uses only linear optics and postselection. Without additional resources, such inherently probabilistic schemes experience a fundamental upper bound for the efficiency of 1/9 [7]. With additional resources, including a large number of ancilla photons from deterministic single-photon sources, the KLM scheme [8] shows that it is hypothetically possible to get arbitrarily close to 100% efficiency. In practice, however, and despite experimental progress regarding such improved schemes [9], the actually achieved efficiency of a controlled NOT (CNOT) gate between optical photons has not exceeded 1/9 yet. An alternative strategy focuses on CNOT gates based on quantum nonlinear systems that avoid inherently probabilistic protocols. Such gates were demonstrated in two recent experiments, one using an atom-cavity system [10], the other using Rydberg electromagnetically induced transparency (EIT) [11]. However, the demonstrated average efficiency in these two experiments remained below 5% for technical reasons.
We combine key components of these two experiments in a cavity Rydberg EIT experiment [12][13][14][15][16][17]. This new approach overcomes previous difficulties and, for the first time, outperforms the 1/9 bound of postselected linear optical systems. It improves the long-standing record for the average efficiency of optical CNOT gates by a factor of 3.8, leaving a factor of 2.4 to 100% efficiency. An analysis of current imperfections shows that these can be overcome in the future. Moreover, theory predicts that much higher efficiencies and fidelities are realistic with our system. This opens up perspectives for applications in optical quantum computing [2], in distributed quantum computing [18], or in high-efficiency optical Bellstate detection [19], which would be useful for linearoptics quantum-repeater schemes [20] and for a future quantum internet [4]. Concepts might also be transferred to the microwave domain [21]. Our multiple-target CNOT gate is interesting for applications in quantum error correction [1], and multiphoton entangled states might become powerful resources for linear optical quantum computing [3] and for measurement-based quantum computing [22].

II. PROTOCOL
Rydberg EIT in an ultracold atomic gas essentially maps the giant dipole-dipole interaction between Rydberg atoms onto optical photons. This makes it possible to build a single-photon switch [23][24][25][26] in which the presence of a single photon toggles the transmission of another photon from on to off. To this end, it is advantageous to store the first photon, called the control photon, in the atomic ensemble in the atomic Rydberg state |r , see Fig. 1(b), using EIT-based storage [27]. Next, the second photon, called the target photon, impinges on the atomic ensemble. Finally, the control photon is retrieved, see Fig. 1(c) for an overview of this timing sequence.
In the absence of a stored excitation in state |r , the target photon experiences Rydberg EIT with a Rydberg state |r resulting in high transmission. If an excitation in state |r is present, however, then the interaction between the two Rydberg states will shift the system away from the EIT two-photon resonance, thus causing low . Polarizing beam splitters (PBSs, blue squares) map between incoming and outgoing polarization qubits and internal dual-rail qubits. One rail of each qubit impinges on the cavity, and the other rail bypasses the cavity. If the control qubit impinges on the cavity, it is stored in a Rydberg state. Subsequently, the target photon enters the system. A conditional π phase shift is experienced if both qubits are in their cavity rails. After the interaction with the target photon, the control photon is retrieved. The bypass rail of the control qubit is delayed in an optical fiber to match the delay resulting from storage. The octagon represents the vacuum chamber. (b) Atomic level scheme. Coupling light (blue, cyan) creates EIT for the signal light (red, purple). (c) Timing sequence of the light power of the incoming pulses. The vertical axis uses different scales for different light fields. In the first microsecond, the control pulse is stored; in the second microsecond, the target pulse interacts with the system; and in the third microsecond, the control pulse is retrieved.
transmission of the target photon. Overall, this yields loss of the target photon conditioned on the presence of a single control photon.
Placing this system inside a one-sided optical resonator converts the conditional loss into a conditional π phase shift [10,28,29]. This is because, for large (small) intracavity loss, the cavity is undercoupled (overcoupled). This cavity approach offers an efficient way of harvesting the nonlinearity of Rydberg EIT and makes a highefficiency CNOT gate possible, similar to the proposals in Refs. [12,13]. Compared to our previous work [11], this cavity approach offers the additional advantage that the conditional π phase shift is much more robust against changes in the optical depth of the atomic ensemble. Here, the control qubit is listed first and H, V , D, and A denote the linear polarizations which are horizontal (H), vertical (V ), diagonal (D, 45 • ), and antidiagonal (A, −45 • ). In essence, the scheme in the figure temporarily converts the incoming polarization qubits into dualrail qubits. The quantum amplitude corresponding to the rails in which both qubits impinge on the cavity experiences the conditional π phase shift. The CPHASE gate is identical to a CNOT gate up to single-qubit unitaries [1], which are easily implemented using wave plates. In our experiment, the incoming signal light pulses are derived from a laser and have a Poissonian photon number distribution with a mean photon number much below 1. Some data in this paper are postselected upon the detection of exactly one control photon and exactly one target photon. Mostly, this removes cases in which an incoming pulse contains zero photons or in which an incoming pulse contains one photon which is lost. Note, however, that the gate does not use an inherently probabilistic scheme.
The core of the experiment is an ensemble of 260 87 Rb atoms at a temperature of 0.4 µK, held in an optical dipole trap (ODT), located in a bow-tie cavity with a finesse of 350. The coupled atom-cavity system is characterized by (g, κ, γ)/2π = (1.0, 2.3, 3.0) MHz, where g is half of the vacuum Rabi frequency for a maximallycoupled single atom, κ is the half width at half maximum (HWHM) cavity linewidth, and γ is the HWHM linewidth of the atomic transition |g ↔ |e . This results in a collective cooperativity of 21. Each light pulse lasts 1 µs, thus roughly matching 2π/κ. The experiment is repeated every 100 µs. For details regarding the setup, see appendix A.

A. Initial Characterization
A widely used method [6,10,11] for a first characterization of a CNOT gate is to consider a CNOT truth table together with one generated Bell state. Additionally, we consider a CPHASE truth table. Figures 2(a) and 2(b) show postselected truth tables in the CPHASE basis and a CNOT basis. To measure these data, one of the indicated states is used as an input, and the measured probabilities of obtaining the indicated output states in a measurement are displayed. The average fidelity of the truth table is the arithmetic mean of the four labeled probabilities.
The postselected CPHASE truth table in Fig. 2 imperfections. This insight will be useful below. This is expected from the setup because photons do not jump from one rail to the other. Hence, deviations from a perfect CPHASE truth table come mostly from imperfections in PBSs and wave plates.
Figures 2(c) and 2(d) show the postselected output density matrix obtained in quantum-state tomography [1] for the input state |DD . Ideally, the output state should be a Bell state. The fact that the postselected Bell-state fidelity [30] exceeds 50% amounts to witnessing two-qubit entanglement. The postselected Bell-state fidelity obtained here is clearly higher than the 64% in Ref. [11] and a bit higher than the 76% in Ref. [10].

B. Quantum Process Tomography
Instead of characterizing the output state for only a few selected input states, we now fully analyze the performance using quantum process tomography [1]. The latter gives a complete characterization of the quantum process, i.e. it yields a map E from the 4×4 density matrix ρ in at the input to the 4 × 4 density matrix ρ out = E(ρ in ) at the output. The map E is assumed to be linear. Hence, to characterize E, it suffices to experimentally determine ρ out using quantum-state tomography for a basis of 16 matrices ρ in .
Thus, the reconstructed map E can be written in a chi-matrix representation as [1] where the 4 × 4 matrices A i are chosen at will to form a basis A of operators. The complex expansion coefficients χ i,j form the 16×16 process matrix χ [30]. Of course, the χ i,j depend on the choice of the basis A. From the experimental data for a basis of 16 matrices ρ in , we calculate a linear, unbiased estimator for χ by inverting a linear system [1], see also appendix O. Once χ has been determined, ρ out = E(ρ in ) can be predicted for an arbitrary ρ in using Eq. (2). Possible loss of photons is represented by tr(ρ out ) ≤ 1, i.e. E is typically not trace preserving [1]. If the basis A was orthonormal, i.e. if tr(A † i A j ) = δ i,j , then one would obtain tr(χ) = 4η with the average efficiencyη of Eq. (3). We normalize the process matrix upon postselection to correct its trace, i.e. we consider the postselected process matrix χ ps = χ/η.
We choose A i = U B i , where the unitary 4×4 matrix U describes the operation of the ideal two-qubit gate given by Eqs. (1a) and (1b) and where the 4 × 4 matrices B i are the 16 tensor products which can be formed from the single-qubit Pauli matrices I, X, Y , and Z in the (|H , |V ) basis, i.e.
2 A i form an orthonormal basis. Hence tr(χ ps ) = 1. This choice of the A i is beneficial because for the ideal process matrix, it yields the simple expression χ id i,j = δ 1,i δ 1,j . The elements of χ ps are shown in Fig. 3 with the B i used as labels. A simple model, which includes only the four measured efficiencies of the CPHASE basis states and two single-qubit visibilities V c = 86(4)% and V t = 78(3)% for the control and the target qubit agrees fairly well with the measured χ ps , see appendix B. Now, we turn to the process fidelity. If the basis A was orthonormal, then the process fidelity would be [30] F pro = 1 16 tr(χ id χ). Hence, F pro = tr(χ id χ) for the basis A chosen here. The postselected version thereof is the postselected process fidelity F ps pro = tr(χ id χ ps ). Using that E is typically a completely positive map [1], one can show that this yields F ps pro ≤ 1. Using χ id i,j = δ 1,i δ 1,j , one obtains F ps pro = χ ps 1,1 [31,32]. Hence, Fig. 3 yields F ps pro = 81(2)%. This is clearly above the classical limit of 50%. Multiplying F ps pro with the average efficiencyη of Eq. (3) yields a process fidelity without postselection of F pro = 34(1)%, which is much better than in all previous measurements of CNOT gates with optical photons, in which F pro never exceeded 11%. The

C. Efficiency
The efficiency of the gate is the probability that no photon is lost inside the gate, if one control and one target photon impinge on the gate. The gate is the part of the setup shown in Fig. 1(a). The efficiency also includes optical elements like lenses and wave plates which are not drawn in Fig. 1(a) for simplicity. The only components which are not included in the efficiency are the light source and the detection setup. This makes sense because neither light sources nor detectors need to be cascaded in a sequence of gates.
The efficiency η depends on the input density matrix ρ in and can be written as η(ρ in ) = tr[E(ρ in )]. For comparing different experiments, one can introduce various figures of merit, which attempt to express the most relevant information about the function η in just one number. Obvious choices include the maximum, the minimum, and various averages. We define the average efficiencȳ η = dψη(|ψ ψ|), where the integral is over the uniform (Haar) measure [33] of all normalized input state vectors, similar to the definition of the average fidelity [30]. For any orthonormal basis of state vectors |v i , the average efficiency can be rewritten as, see appendix M Instead of considering onlyη, one can characterize the full function η for all ρ in . As the map from ρ in to η(ρ in ) is a linear form, it can be written as η(ρ in ) = tr(Θ † ρ in ) with a 4 × 4 matrix Θ, which we call the efficiency matrix. As η(ρ in ) is real for all Hermitian ρ in , Θ is Hermitian. For a full characterization of the efficiency function it suffices to measure η(ρ in ) for a basis of 16 input density matrices ρ in . From this, Θ can be reconstructed by inverting a linear system, see appendix M. If a process matrix has already been determined, one finds Θ = 16 i,j=1 A † j A i χ i,j . In our experiment, the postselected CPHASE truth table in Fig. 2(a) is ideal, to a good approximation. Hence, the matrix representation of Θ in the CPHASE basis is diagonal, to a good approximation, see appendix B. To give the full information about Θ, it therefore suffices to quote only these diagonal elements, i.e. the efficiencies obtained if one of the CPHASE basis states is used as an input state. These are measured to be (η HH , η HV , η V H , η V V ) = (35.1(7), 15.7(1.4), 61.1(1), 54.9(1.0))%. According to Eq. (3), the arithmetic mean of these four efficiencies is the average efficiencyη = 41.7(5)%.
These values are obtained when choosing the experimental parameters to maximizeη. If, instead, one was interested e.g. in maximizing the minimum eigenvalue η min of Θ, one would have to choose different parameters. We find e.g. η min = 24.4(2.2)% for a target coupling Rabi frequency of 20 MHz and an atom number of 500, resulting in a collective cooperativity of 40. At these parameters, we obtain (η HH , η HV , η V H , η V V ) = (38.2(7), 24.4(2.2), 61.1(1), 34.4(5))% andη = 39.5(6)% along with a Bell-state fidelity of 73(1)% for the output state generated from the input state |DD .
Experimentally, two-photon coincidences are detected at a rate of 560 s −1 per incoming photon pair, see appendix D. This number is factors of 520 and 1.3 × 10 4 larger than in Refs. [10] and [11], respectively, thus making much more demanding experiments possible in a realistic data acquisition time.
A key factor as to why the average efficiency outperforms that reported in Ref. [10] is that more atoms create more conditional loss. This allows us to operate at higher collective cooperativity and at much lower cavity finesse, which both mitigate a variety of technical problems such as mirror absorption and mirror scattering relative to mirror transmission. Compared to Ref. [11], the outperformance comes from the cavity that makes the light pass through the same Rydberg blockade volume many times. This enables us to reduce the atomic density and, in consequence, the dephasing rate due to atomic collisions [23,34].
The average efficiency we achieved is below 100% for technical reasons. The dominant limitation is dephasing, although of a different origin than in Ref. [11]. When EIT coupling light is on (off), dephasing is now dominated by laser phase noise (differential light shifts in the dipole trap). Reducing laser phase noise and operating the dipole trap at a different wavelength [34] is expected to massively reduce dephasing. In addition, the delay fiber could be replaced by a high-efficiency quantum memory. A detailed analysis based on the models of Refs. [13,27] predicts an average efficiency of the twoqubit gate far above 90% along with a much improved postselected fidelity.

D. Multiphoton Entanglement
The two-photon gate implemented here is easily extended to a multiple-target CNOT gate [1], thus allowing us to directly produce multiphoton entanglement. This scalability provided by our scheme is advantageous because fewer resources are required compared to cases where several two-qubit gates are cascaded. In particular, an N -photon Greenberger-Horne-Zeilinger (GHZ) state |ψ N = (|H ⊗N + |V ⊗N )/ √ 2 can be generated by sending one control photon and N − 1 target photons onto the gate in an input state with polarization |D ⊗N . We choose to assemble all target photons in one pulse. The target pulse lasts long enough that interactions among target photons are negligible. Hence, each target photon simply acquires a π phase shift conditioned on the presence of the same control photon. Hence, this input state is mapped onto the output state (|H |A ⊗(N −1) + |V |D ⊗(N −1) )/ √ 2. A simple singlequbit unitary applied to all outgoing target photons converts this into the above GHZ state |ψ N .
To detect an N -photon GHZ state, we again use input pulses with a Poissonian photon number distribution. But this time, we postselect upon the detection of exactly one control and exactly N − 1 target photons. To verify the N -photon entanglement, we study parity oscillations [35][36][37]. From the experimental data in Fig. 4, we calculate the coherence kπ/N . In addition, we measure the populations p H = |H ⊗N H ⊗N | and p V = |V ⊗N V ⊗N | of the states |H ⊗N and |V ⊗N and use the results to calculate P N = p H + p V . Combining these results, we determine the postselected GHZ-state fidelity [35][36][37] 3)%, and F 6 = 35.9(3.7)%. Note that F N > 50% implies genuine N -photon entanglement [35][36][37]. Assuming that the statistical uncertainties quoted here correspond to a Gaussian distribution, the p-value, i.e. the probability of F N < 50%, is (10 −207 , 5 × 10 −4 , 0.18) for N = (3, 4, 5). A simple model, taking efficiencies and single-qubit visibilities into account agrees well with the experimental data, see appendix E.
To verify genuine Nphoton entanglement, we study parity oscillations. To this end, we measure all photons in the same polarization ba- where ϑ is real. The measurement outcomes yield the generalized Stokes parameter S

V. CONCLUSIONS
High-efficiency optical gates have the potential to become useful for many applications in optical quantum information. For example, high-efficiency gates could drastically reduce the resource cost [38] in a variety of optical quantum computing schemes. The fact that the first realization of an optical photon-photon CNOT gate [6] already achieved an efficiency around 1/9 and that no improvement had been made in almost two decades might have narrowed the application perspective of optical quantum computing. Questions like which optical quantum computing schemes are most promising might find new answers, now that the present work makes much higher efficiencies in photon-photon quantum gates a reality. excellence strategy via Munich Center for Quantum Science and Technology EXC-2111-390814868. T.S. acknowledges support from Studienstiftung des deutschen Volkes.
Note added.-Recently, we became aware of a measurement of a conditional π phase shift based on cavity Rydberg EIT [39].
Appendix A: Experimental Setup

Cavity
As the vacuum system used in our previous experiments [11,23,24] did not offer enough room to house the cavity, we set up a new vacuum system. The cavity consists of four mirrors in bow-tie geometry, see appendix K, with an axial mode spacing of ∆ω ax /2π = 1.59 GHz, a finesse of F = 350, and a beam waist (1/e 2 radius of intensity) of w c = 8.5 µm. The cavity is one-sided, i.e. it has an input-output coupler with a moderate reflectivity of 98.3% while each of the other cavity mirrors has a much higher reflectivity of 99.990%. These numbers refer to EIT signal light at a wavelength of 780 nm. For EIT coupling light at a wavelength of 480 nm, however, all mirrors have negligible reflectivity. A piezo actuator is used to stabilize the cavity length.

Atomic Ensemble and Transitions
The experiment begins with the preparation of an ultracold gas of 87 Rb atoms in a crossed-beam ODT, see appendix F. The atomic ensemble is located at the beam waist of the cavity. We choose the z axis such that it points along the wave vector of the control signal light at the location of the atomic ensemble. We choose the y axis to be vertical. The atomic ensemble has a temperature of T = 0.44 µK and an atom number of N a = 260. With measured trapping frequencies of (ω x , ω y , ω z )/2π = (0.31, 0.23, 0.60) kHz, the root-meansquare (rms) radii of the atomic ensemble are estimated to be (σ x , σ y , σ z ) = (3.3, 4.5, 1.7) µm.
The atomic energy levels used in the experiment are the ground state |g = |5S 1/2 , F =2, m F =−2 , the first electronically excited state |e = |5P 3/2 , F =3, m F =−3 and two Rydberg states, namely |r = |48S 1/2 , F =2, m F =−2 for the control qubit and |r = |50S 1/2 , F =2, m F =−2 for the target qubit. Here, F, m F are hyperfine quantum numbers. All atoms are prepared in the stretched spin state |g . A magnetic hold field of 0.10 mT applied along the positive z axis suppresses the randomization of the spin orientation by noise of the ambient magnetic field.
The rms cloud radii along all three dimensions are smaller than the Rydberg blockade radius of approximately 7 µm, see appendix L. This results in a superatom geometry [40], in which a single stored Rydberg excitation from the control pulse causes Rydberg blockade for all atoms during the target pulse. To address an electrically tuned Förster resonance [26], an electric field of 0.7 V/cm is applied along the positive z axis.

EIT
The EIT signal light is resonant with the |g ↔ |e transition. The EIT coupling light during the control (target) pulse is resonant with the |e ↔ |r (|e ↔ |r ) transition. As seen in Fig. 1(a), the EIT signal light beams for control and target light counterpropagate each other. The wave vector of each of the two EIT coupling beams is chosen to counterpropagate the corresponding EIT signal beam. This minimizes the net photon recoil in the EIT two-photon transition. Hence, this minimizes dephasing caused by thermal atomic motion [34]. The control (target) EIT coupling beam has a peak power of 30 mW (70 mW). At this value, the coupling Rabi frequency was measured to be 20 MHz (43 MHz), see appendix H. From this, we estimate a beam waist of 21 µm (14 µm).
The incoming control signal light pulse has an intensity proportional to cos 2 (π(t−t c,in )/t c ) if |t−t c,in | ≤ t c /2 and 0 otherwise. Here, t c = 1.0 µs is the control pulse duration and t c,in is the center of the control pulse. The outgoing control signal light pulse has the same pulse shape with the same duration t c but a delayed center t c,out = t c,in + t c + t t . The incoming target signal light also has the same pulse shape with a target pulse duration t t = 1.0 µs and a center of the incoming target pulse t t,in = t c,in +(t c +t t )/2. During storage and retrieval, the pulse shape of the control EIT coupling light is chosen according to the model of Ref. [27]. During the target pulse, however, the target EIT coupling light has a constant power, which is chosen to be the above-mentioned maximum.

Atom-Cavity Coupling
An important figure of merit characterizing the coupled atom-cavity system is the collective cooperativity C = Na i=1 |g i | 2 /κγ, where g i is half of the vacuum Rabi frequency of the ith atom, which depends on the position of the ith atom. A high-performance gate requires [12,13,27] C 1. While the single-atom cooperativity g 2 /κγ = 0.14 is below 1, C can easily be made much larger than 1 because N a is large. Unless otherwise noted, all data in this paper are recorded with C = 21(1), see appendix H.

Timing and Dual-Rail Setup
We prepare a new atomic sample every 4.3 s. Once a cold atomic ensemble has been prepared, we repeat the quantum gate experiment many times. Each repetition causes a tiny amount of photon-recoil heating and evaporative atom loss. To avoid large changes of N a and T , we discard the atomic ensemble after 10 4 repetitions of the experiment and we prepare a new atomic ensemble. The EIT coupling light creates a repulsive potential for the atoms [11,23]. To make its effect on the atomic density distribution negligible, each repetition of the experiment which lasts 3 µs is followed by 97 µs of hold time with only the ODT applied, yielding a repetition rate of 10 kHz. Including the time needed to prepare the atomic ensemble, the average repetition rate is 2.3 kHz.
One quantum gate experiment consists of three steps. First, the control photon enters the setup; second, the target photon enters the setup and leaves it; and third, the delayed control photon leaves the setup. The dark time between consecutive steps is negligible. Photons which leave the setup are readily detected.
During step one, the leftmost PBS in Fig. 1(a) converts the polarization qubit of the incoming control light pulse into a dual-rail qubit. One rail impinges upon the cavity and is stored as a stationary Rydberg excitation in state |r during the first step of the experiment. During step three, this photon is retrieved. The storage and retrieval results in a delay of t c + t t . The rightmost PBS in Fig.  1(a) overlaps the retrieved control light with the control light from the other rail such that the dual-rail qubit is converted back into a polarization qubit. To achieve high fidelity of the gate, the components from both rails must have the same delay. Hence, control light in the bypass rail is delayed in a 400-m-long polarization-maintaining single-mode fiber, which causes a delay of 2.0 µs.
During step two, the polarization qubit of the incoming target pulse is also converted into a dual-rail qubit. One rail is reflected from the cavity. Upon this reflection, a conditional π phase shift is acquired. A PBS overlaps the reflected target light with target light in the other rail, which simply bypasses the cavity. This overlap converts the dual-rail qubit back into a polarization qubit and simultaneously separates the target light from the counterpropagating control light. Two of the mirrors shown in Fig. 1(a) are mounted on piezos, which are used to stabilize the path length differences between the rails for each qubit based on measurements with reference light. Quarter wave plates, omitted in Fig. 1(a), map between the linear polarizations H and V and the circular polarizations required for driving the desired atomic transitions.

Appendix B: Process Matrix Model
Here, we model the main imperfections in the process matrix. We start from the process matrix χ P written with respect to the orthonormal basis P, which consists + + + 9 9 + 9 9 + + + 9 9 + 9 9 5Hξ ps D + + + 9 9 + 9 9 + + + 9 9 + 9 9 ξ model |u i u j |ρ|u u k |χ P i,j,k, . Note that we use two indices to number the elements of the orthonormal basis P. Hence, χ P has four indices running from 1 through 4.
The measured CPHASE truth table in Fig. 2 As in Ref. [1], we expect that E is a completely positive map, which implies that χ P is a positive matrix. Hence, Therefore, only 16 out of the 256 matrix elements of χ P are expected to deviate noticeably from zero. We find that the remaining 240 matrix elements of the measured χ P are indeed negligible. Hence, the relevant information about χ P is contained in the 4×4 matrix ξ, which we call the reduced process matrix. The postselected version of ξ is ξ ps = ξ/η. The real part of this is shown in Fig. 5(a). We expect and find experimentally that the imaginary parts of all matrix elements of ξ are negligible. Hence, all the dominant imperfections of the gate are shown in Fig. 5(a). For the ideal CPHASE gate, one would obtain Somewhat similarly to Ref. [11], we now construct a model for the measured ξ by assuming that each experimental shot is described by a linear map from state vectors onto state vectors defined by where (η 1 , η 2 , η 3 , η 4 ) = (η HH , η HV , η V H , η V V ) and where β c and β t are real, single-qubit phases, which exhibit shot-to-shot fluctuations. We denote the average over these fluctuations as · · ·. We assume that the random variables β c and β t are uncorrelated, we abbreviate the single-qubit visibilities V c = e iβc and V t = e iβt , and we assume that V c and V t are real. We calculate a reduced postselected process matrix ξ ps from Eqs. (B2a) and (B2b), average over the variables β c and β t , and obtain with a visibility matrix We perform a least-squares fit of this model to the experimental data for ξ ps using the fixed, known values of the η i together with two free fit parameters V c and V t . This yields the best-fit values quoted in Sec. IV B. Figure 5(b) shows the resulting ξ from the model, which agrees well with the experimental data in Fig. 5(a). The postselected process fidelity between the model and the ideal process is 78(2)%, which agrees well with the postselected process fidelity of F ps pro = 81(2)% measured in the experiment. The contributions made by imperfect visibilities dominate because when setting the visibilities (efficiencies) as perfect in the model, the postselected process fidelity between the model and the ideal process becomes 95% (82(2)%).

Appendix C: Experimental Limitations on the Efficiency
Here, we discuss the main effects which limit the efficiency. The measured combined efficiency of storage and retrieval of the control photon is η sr = 39(1)%, in the absence of a target photon. This number is quite a bit lower than the theoretical expectation of 66%, see appendix I. This discrepancy is probably caused by laser phase noise during storage and during retrieval. The measured transmission of the control photon through the delay fiber is η f = 65%, including mode matching. This is compatible with the specified attenuation of −4.3 dB/km, which would suggest 67%.
The measured reflection coefficient for the target light is |R| 2 = 90(1)% in the absence of a control pulse. However, if a control photon was previously stored in state |r , this causes a Rydberg blockade and the reflectivity of the target light becomes |R b | 2 . At the same time, the fact that a target photon is reflected from the cavity reduces the combined efficiency of storage and retrieval of the control photon to η sr,t ≤ η sr . Most of the experimental data in this paper are not sensitive to η sr,t and |R b | 2 separately, but only to the product η sr,t |R b | 2 . We measure η sr,t |R b | 2 = 17(2)%. If we naively assume η sr,t = η sr , this would correspond to |R b | 2 = 43(4)%.
Note that |R| 2 is nonideal partly because dephasing of the Rydberg state |r causes the EIT transmission to be less than 100% so that the resonator is not infinitely overcoupled. Conversely, |R b | 2 is nonideal partly because the finite atom number causes the absorption without EIT to be less than 100% so that the resonator is not infinitely undercoupled. Note that |R b | 2 could be made much larger e.g. by increasing the cavity finesse. However, this would decrease |R| 2 . In our experiment, the parameters were chosen to maximizeη.
Combining the above numbers and ignoring possible loss if the target photon bypasses the cavity, one expects the efficiencies (η sr , η sr,t |R b | 2 , η f , η f |R| 2 ) = (39, 17, 65, 59)% for the CPHASE basis states. The arithmetic mean thereof is 45%. These values include only the main sources of imperfections, namely the delay fiber, the coefficients for reflection of the target photon from the cavity, and the efficiency of storage and retrieval. Beyond that there are trivial optical losses, e.g. on imperfect antireflection coatings on wave plates, lenses, PBSs, etc., some of which are not shown in Fig. 1(a) for clarity. Taking those trivial losses into account, we obtain the measured efficiencies quoted in Sec. IV C.

Appendix D: Coincidence Rate
The experimental apparatus includes two identical detection setups, one at each output port of the gate. To perform a polarization resolved detection of signal photons, each detection setup consists of wave plates and one PBS. Each of the two output ports of each PBS is sent to a superconducting nanowire single-photon detector (SNSPD). Polarization-maintaining single-mode fibers are used to transport the light to the SNSPDs. The fiber coupling efficiency of approximately 85% is caused partly by mode matching, partly by losses in the inputoutput couplers of the fiber, and partly by losses caused by a fiber splice. The quantum efficiency of each SNSPD is specified to be above 90%. Hence, if one control and one target photon leave the gate, the probability of detecting both is approximately (0.85×0.90) 2 = 0.59. Multiplying this by the 41.7% average efficiency of the gate, one obtains a 24% probability of detecting a two-photon coincidence per incoming photon pair. Multiplying this with the average repetition rate from appendix A 5 yields a two-photon coincidence rate of 560 s −1 per incoming photon pair. This is a factor of 1.3 × 10 4 larger than in our previous apparatus [11] for reasons discussed in appendix G. This is a tremendous improvement.
The mean photon numbern c (n t ) in the incoming control (target) pulse should not be too large because that would degrade the measured postselected fidelity due to events with more than one incoming control (target) photon. On the other hand,n c andn t should not be too small because that would increase the data acquisition time and make the system more sensitive to dark counts. The data in Figs. 2 and 3 are measured withn c = 0.14 andn t = 0.13. We multiplyn cnt by the two-photon coincidence rate per incoming photon pair and obtain a naive estimate for the two-photon coincidence rate of 10 s −1 . In daily alignment, we measure 9 s −1 . It is this high coincidence rate which makes it possible to perform demanding measurements in a reasonable data acquisition time. For the process tomography in Fig. 3, for example, the data acquisition time was 69 min.

Appendix E: GHZ States
For simplicity, we fit S (N ) ϑ = p cos(N ϑ) with a free fit parameter p ∈ [0, 1] to the data in Fig. 4. This simple curve is expected, e.g. if ρ out = p|ψ N ψ N | + (1 − p)I, where I is the identity matrix. As an alternative to the direct calculation of C N as described above, one can insert the fit curve into this calculation, which yields C N = p and makes use of all the available data instead of only the points for ϑ = πk/N with k ∈ {0, 1, 2, . . . , N − 1}. We use this method only for processing the N = 6 data.
The measurements for N ≤ 5 usen c = 0.31 andn t = 0.41. As a matter of fact, all N ≤ 5 data are extracted from the same raw data by postselecting upon different numbers of detected photons. The measurement for N = 6 is from a different data set, usingn c = 0.28 andn t = 0.88.
To understand the present limitations of the GHZ-state production, we consider Fig. 6 which shows how p H , p V , P N , and C N depend on N . The lines represent a simple model, see appendix N Here, η N is the probability that no photon is lost for an input state with exactly one control photon and exactly N − 1 target photons. For simplicity, we assume R > 0 and R b < 0.
For p H , p V , and P N = p H + p V , the model uses the target visibility V t from appendix B together with the efficiencies expressed by the quantities η sr , η f , |R b | 2 , and |R| 2 from appendix C and it has no free fit parameters. For C N , the model additionally uses one free fit parameter V c with the best-fit value V c = 72%. Note that Eqs. (E1)-(E3) are independent of V c . The model agrees fairly well with the experimental data.
The best-fit value V c = 72% obtained here is lower than the value V c = 86(4)% extracted from the process matrix in appendix B. A detailed analysis shows that this is mostly due to the incoming mean photon numbersn c andn t , which are larger here than in appendix B. In essence, the nonideal detection efficiency combined with the Poisson distributions of the incoming photon numbers reduces C N by a constant factor, which is independent of N . When varying V c to fit Eq. (E4) to the experimental data, this causes an effective reduction of the best-fit value of V c .
The combination of the nonideal detection efficiency with the Poisson distributions of the incoming photon numbers also contributes a factor of 0.98 to the postselected process fidelity F ps pro extracted from Fig. 3. Assuming ideal efficiencies in the model has little effect on P N and only a moderate effect on C N . Hence, much like in appendix B, we conclude that the nonideal visibilities are the dominant experimental imperfections.
The rates R N at which N -fold coincidences are detected are listed in table I. Note that R N describes the  coincidence events with exactly one detected control photon and exactly N −1 detected target photons. Here, R N is based on the average repetition rate, which includes the time needed to prepare the atomic ensemble.
To develop a simple model for the rates R N , we approximate η c = 1 2 (η sr + η f ) and η t = 1 4 (2 + |R| 2 + |R b | 2 ) as uncorrelated mean efficiencies with which each control and target photon is transmitted. We use the efficiency from appendix D with which each photon is detected as η d = 0.85 × 0.90. We obtain a rough estimate for the mean number of detected control (target) photons of ν c = η d η cnc = 0.12 (ν t = η d η tnt = 0.26.) We assume uncorrelated Poisson distributions for the probabilities of detecting a given number of control and target photons. We obtain the probability p N = ν c e −νc 1 (N −1)! ν N −1 t e −νt of detecting exactly one control photon and exactly N −1 target photons. Multiplying this with the average repetition rate from appendix A 5, we find fairly good agreement with the experimental data in table I.

Appendix F: Cooling and Trapping of Atoms
To prepare the atomic ensemble in our new vacuum system, a two-dimensional magneto-optical trap (MOT) generates a continuous cold beam of 87 Rb atoms, which is captured in a three-dimensional (3D) MOT. The latter is overlapped with the crossed-beam ODT with a light wavelength of 1064 nm. One ODT beam has a power of 0.45 W, a horizontal wave vector, and beam waists of w y = 15 µm and w z = 11 µm. The other ODT beam has a power of 0.10 W, a vertical wave vector, and beam waists of w x = w z = 12.5 µm. After collecting atoms in the 3D MOT for 0.5 s, the parameters of the 3D MOT are altered similarly to Ref. [41] to increase the atom number in the ODT. In particular, the power of the repumping laser is much reduced. After 30 ms, both MOTs are switched off and polarization gradient cooling is applied for 50 ms. Then, the atoms are held in the ODT.
The atomic ensemble in the ODT is further cooled by applying the first two stages of Raman cooling described in Ref. [42] but in a crossed-beam ODT. This Raman cooling lasts 0.5 s and it spin polarizes the atoms by optically pumping them into the state |g . During the cooling, the powers of both ODT beams are progressively lowered. For a cold dilute ensemble in a deep ODT, we measured a 1/e lifetime of the atom number of 30 s, which sets a limit to background gas collisions. After the Raman cooling, the power of the ODT is lowered to 4.5 mW (5 mW) for the ODT beam with a horizontal (vertical) wave vector to reach T = 0.44 µK and N a = 260. This corresponds to a peak density of peak = 6 × 10 11 cm −3 and a peak phase-space density of 0.014. Note that density-dependent dephasing resulting from collisions of a Rydberg atom with surrounding ground-state atoms is less of an issue than it was in Ref. [23] because we operate at a much lower principal quantum number. For signal light at λ = 780 nm driving a cycling transition, the cross section for absorption of a photon is σ cyc = 3λ 2 /2π and the maximal on-axis (x = y = 0) on-resonance optical depth is d t,peak = σ cyc dz = 0.8.

Appendix G: Improved Coincidence Rate
Here, we discuss the physical origin of the factor of 1.3 × 10 4 improvement of the coincidence rate per incoming photon pair compared to our previous apparatus [11], in which the two-photon coincidence rate was 1.3×10 −5 ×0.56 kHz/(0.33×0.50) = 0.044 s −1 per incoming photon pair. An obvious contribution comes from the higher average repetition rate, which was 10 4 /(18 s) = 0.56 kHz in Ref. [11]. Another contribution comes from the higher efficiency of collecting and detecting an outgoing signal photon, which was 25% in Ref. [43], caused partly by the different fiber coupling efficiency and partly by the different efficiency of the single-photon detector, which was 50% in Ref. [11]. Yet another contribution comes from the higher average efficiency of the gate, which in Ref. [11] included only loss in the atomic ensemble and was (7.7, 2.3, 1.5, 0.45)% for the CPHASE basis states with an average of 3.0%. When creating a Bell state, the polarizations with higher gate efficiency were attenuated in the first interferometer in Ref. [11] before the light impinged on the atoms. On the upside, these imbalanced input intensities resulted in well-balanced output intensities, which boosted the postselected Bell-state fidelity. On the downside, for this input state the efficiency is the harmonic mean of the CPHASE efficiencies 1.2% = 1.4 × 10 3 , which is the biggest part of the overall effect.
The remaining factor of approximately 9 comes from three contributions. First, the second interferometer, which was needed to remove a frequency shift, contributed to loss of photons between the atomic ensemble and the detector in Ref. [11]. Second, the light was coupled into a fiber in front of this interferometer and into a second fiber behind this interferometer so that two fiber coupling efficiencies occurred between the atoms and the detector. This interferometer is no longer needed in the new apparatus and now light passes through only one fiber between the atoms and the detector. Third, the data acquisition time for quantum-state tomography of one Bell state in Ref. [11] was long. These data were accumulated from several nonconsecutive days. Some components were not perfectly kept at optimal performance over this full time span.
For comparison, the single-atom experiment in Ref.
[10] measured a two-photon coincidence rate of 0.033 s −1 in daily alignment. Division byn cnt withn c =n t = 0.17 yields a two-photon coincidence rate of 1.1 s −1 per incoming photon pair. This is a factor of 25 higher than in our previous experiment [11] and a factor of 520 lower than our present experiment.
Appendix H: Cavity EIT

Theory
The one-sided cavity is characterized by the complex reflection coefficient r in of the input-output (I/O) coupler and by the product r H of the complex reflection coefficients of all three highly reflective (HR) cavity mirrors. We use these quantities to define Here, the decay rate coefficient κ in (κ H ) describes the decay of the intracavity field caused by the I/O coupler (HR mirrors), κ = κ in +κ H is the total decay rate, and F is the empty-cavity (i.e. N a = 0) finesse. For simplicity, the I/O coupler is assumed to be lossless.
In the absence of a Rydberg blockade, the reflection of the signal light field impinging on the cavity is described by the complex coefficient [13] where ∆ c = ω − ω c is the detuning of the angular frequency ω of the signal light from the nearest cavity resonance ω c . In addition, we abbreviate an effective cooperativity where 1/Γ e = 1/2γ is the 1/e lifetime for population decay of state |e and where γ rg describes the decay of the density matrix element ρ rg according to (∂ t + 1 2 γ rg )ρ rg = 0, which is typically dominated by dephasing [34]. Note that ∆ s = ω−ω ge (∆ co = ω co −ω er ) is the detuning of the angular frequency ω (ω co ) of the EIT signal (coupling) light from the atomic resonance ω ge (ω er ), and Ω is the Rabi frequency of the EIT coupling light.
The model of Eqs. (H4) and (H5) relies on neglecting all but one of the axial cavity modes. This is a good approximation, if F 1, |∆ c | ∆ω ax , and |C eff | F/π.
The last condition is equivalent to saying that the transversely averaged optical depth in a single round-trip in the cavity must be small. In addition, Eq. (H4) assumes perfect matching of the incoming light to the fundamental transverse mode of the cavity. Moreover, if the ensemble is small in the transverse direction, this might result in a fairly large on-axis optical depth d t,peak . Hence, some part of the atoms might experience a noticeable shadow cast by other atoms upon a single passage of the light through the medium. The model of Eqs. (H4) and (H5) with C = Na i=1 |g i | 2 /κγ does not take into account a possible transverse inhomogeneity of such a shadow effect.

Experiment
With a standard method, based on light transmitted through the cavity, we extract a mode matching of 99.1% of the incoming light to the fundamental transverse cavity mode. With an alternative method, based on light reflected from the cavity, we extract a mode matching of 98.0%.
Measurements of ∆ω ax and κ yield F = 350. Combining this with the measured resonant empty-cavity reflection coefficient |R empty | 2 = 0.932 and with Eq. (H4) with C eff = 0 yields F H = 2.0 × 10 4 . From this result, we obtain |r in | 2 = 98.3% for the I/O coupler and |r H | 2/3 = 99.990% for each of the three HR mirrors. The latter is consistent with the finesse measured in a test resonator made of four HR mirrors from the same coating run.
For calibration purposes, we perform measurements without the control photon. Figures 7(a) and 7(b) show the relative intensity and the phase of target signal light reflected from the cavity as a function of the detuning ∆ c /2π of the signal light from the cavity resonance. The measurement is performed with ∆ co ≈ 0, and with ω c ≈ ω ge , so ∆ c ≈ ∆ s , see appendix K. The red data are taken in the absence of EIT coupling light, Ω = 0. The intensity clearly exhibits a normal-mode splitting, which is much larger than the linewidth. The phase shows two dispersive features with small amplitude, one at each normal mode. The blue data are taken in the presence of EIT coupling light. The resulting cavity EIT causes the intensity to exhibit a narrow EIT feature centered at ∆ c = 0. In addition, the normal-mode splitting is somewhat increased. When tuning ∆ c through zero, cavity EIT causes a 2π phase boost.
At resonance, ∆ c = 0, the phase is 0 (π) in the absence (presence) of EIT coupling light. This shows the origin of the conditional π phase shift on which the gate is built, much like in Ref. [43]. This is because if a stationary Rydberg excitation is added, then the Rydberg blockade will detune the EIT coupling light so far that the presence of the EIT coupling light becomes irrelevant. Hence, the presence (absence) of a stationary Rydberg excitation is expected to be equivalent to the absence (presence) of 5HOLQWHQVLW\

EIT coupling light.
To characterize the parameter values of the cavity Rydberg EIT system, we fit the above analytic model in Eqs. (H4) and (H5) simultaneously to the data in Figs. 7(a) and 7(b). The fit to the red data in Fig. 7 yields the collective cooperativity C = 21.4 (2), where the values of F, κ, and κ in are taken from previously described measurements and the value of the atomic linewidth Γ e /2π = 6.0666 MHz is taken from the literature. A subsequent fit to the blue data yields the EIT coupling Rabi frequency Ω/2π = 42.7(3) MHz and the coherence time 1/γ rg = 0.22(5) µs, where the previous values of F, κ, κ in , Γ e , and C are used.
Apart fromn c = 0,n t = 0.19, and scanning ω, this measurement is performed at the same settings as for the process tomography in Fig. 3, e.g. with the same target pulse shape, the same target pulse duration, the same Rydberg state |r = |50S 1/2 , F =2, m F =−2 , and the same electric field of 0.7 V/cm.
If N a = 260 atoms were maximally coupled, then we would expect to measure C = 37. The discrepancy from the experimental observation is mostly due to the nonzero transverse sample size which reduces the expectation for C by a factor of [1 + (2σ x /w c ) 2 ] −1/2 × [1 + (2σ y /w c ) 2 ] −1/2 = 0.54 to C = 20. Including the transversely inhomogeneous shadow, discussed below Eq. (H5), reduces this expectation to C = 19. Additional contributions might come from imperfect alignment of the cloud center relative to the cavity mode and uncertainties in the calibration of the measurement of the atom number based on absorption imaging. The overall factor resulting from these additional contributions seems to be small.

Appendix I: Modeling Storage and Retrieval
In the adiabatic limit of slowly varying pulse envelopes, the combined efficiency of storage and retrieval can be modeled analytically, yielding [27] η sr = κ in κ where t dark is the dark time between the end of storage and the beginning of retrieval. The atoms are not truly in the dark during this so-called dark time because the crossed-beam ODT is always on continuously in our present work. We vary t dark and measure the corresponding value of η sr . This yields an approximately Gaussian decay with a 1/e time of 7 µs, which is fairly close to the expectation inside the ODT based on a minor extension of the model of Ref. [34]. Following Ref. [27], we model this as an exponential decay and, for simplicity, we choose the same 1/e time 1/γ rg = 7 µs. Combining this with C = 21 and t c + t dark = 2.0 µs, Eq. (I1) predicts η sr = 66.1%. In the limit γ rg → 0, Eq. (I1) would predict η sr = 88.0%. Hence, according to the model, γ rg gives rise to more than half of the imperfections in η sr . To test the quality of the adiabatic approximation used to derive Eq. (I1), we numerically solve the differential equations in Ref. [27] without approximations. This yields η sr = 64.7%. We conclude that the adiabatic approximation works well in this parameter regime. Note that, for simplicity, γ rg is assumed to be time independent when deriving Eq. (I1). This is not necessarily realistic because issues like laser phase noise or fluctuations of the ambient magnetic or electric field can effectively increase [44] γ rg during storage and retrieval, while they do not contribute to the decay of η sr as a function of the dark time [34].
Reflecting one target photon from the cavity during the dark time decreases the combined efficiency of storage and retrieval from η sr to η sr,t . Measuring η sr,t is nontrivial because we do not use a single-photon source for the target photon. Hence, to learn something about η sr,t we rely on postselecting data upon detection of a reflected target photon. Essentially, this means that we measure a coincidence rate which reveals the product η sr,t |R b | 2 but not η sr,t and |R b | 2 separately. Likewise, when aiming at measuring |R b | 2 , we do not use a single-photon source for the control photon. Hence, we rely on postselecting data upon detection of a retrieved control photon. Essentially, this means that we measure the same coincidence rate as above.
All the input and output polarizations refer to the polarization at the points at which the qubits enter and leave the gate, which is the part of the setup shown in Fig. 1(a). For a plane light wave with wave vector k, the electric field is given by E(x, t) = 1 2 E 0 ue ik·x−iωt + c.c., where E 0 is a complex amplitude, ω > 0 is the angular frequency, and u is the complex polarization unit vector. If k is along the positive z axis, then for horizontal (vertical) polarization u = e x (u = e y ), where (e x , e y , e z ) is the right-handed Cartesian basis. The polarization bases used here are connected by |D = (|H + |V )/ √ 2, |A = (|H − |V )/ √ 2, |R = (|H − i|V )/ √ 2, and |L = (|H +i|V )/ √ 2, where R and L denote right-hand and left-hand circular polarizations. These conventions for R and L are consistent with Ref. [45].

Appendix K: Cavity Geometry
We choose a ring resonator to minimize dephasing resulting from the combination of photon recoil and thermal atomic motion [34]. To achieve this minimization, the signal light and coupling light in Rydberg EIT must counterpropagate with each other. In a standing-wave resonator, the two traveling-wave components of the signal light standing wave could never simultaneously counterpropagate with the coupling light. Hence, a standingwave resonator would lead to fast dephasing of at least one of the traveling-wave components. A ring resonator solves this problem.
Using a ring resonator brings the additional advantage that one can use the novel scheme shown in Fig.  1(a) for converting the conditional π phase shift into a two-photon gate for polarization qubits. In a onesided standing-wave resonator, however, the light reflected from the cavity would exactly counterpropagate with the impinging light, thus requiring an additional effort to separate the beams.
In ring resonators, light is reflected from curved mirrors at a nonzero angle of incidence. This causes the resonator mode to develop an undesired astigmatism. To mitigate this problem, it is advantageous to use small angles of incidence which is possible, e.g., in a four-mirror bow-tie geometry.
In addition, the vacuum Rabi frequency g for one maximally coupled atom should not be too small. In principle, one could compensate for small g by increasing the atom number N a or by decreasing the cavity linewidth κ. However, in order to maintain a superatom geometry, the size of the atomic ensemble should be smaller than the blockade radius and the atomic density should not be too large because otherwise collisions between a Rydberg atom and the surrounding ground-state atoms would result in density-dependent dephasing [23]. Reducing κ is not desirable either because that would make the experiment more susceptible to laser phase noise and to pulse bandwidth effects, which both deteriorate the postselected fidelity. We note that g i = d eg v(x i ) ω/2h 0 , where d eg is the electric dipole moment on the |g ↔ |e transition, x i is the position of the ith atom, and v(x) is the cavity mode function, normalized to d 3 x|v(x)| 2 = 1. In a travelingwave cavity |v(0)| = 2/πw 2 c L c , where the coordinate origin is at the cavity mode waist and L c = 2πc/∆ω ax is the cavity round-trip length. Hence, a short cavity with a small waist is desirable.
To realize a short bow-tie cavity with a small waist, one needs two concave mirrors with small radii of curvature not too far from the waist together with two convex mirrors, much like in Ref. [17]. By varying the radii of curvature of the convex mirrors, one can also vary the frequency splittings to higher transverse modes, thus avoiding degenerate modes, which might lower the cavity finesse, a problem often encountered in near-concentric Fabry-Pérot resonators [46,47].
If the cavity mirrors had a non-negligible reflectivity for the 480-nm EIT coupling light, then one would need a triply resonant cavity, which is resonant with the signal light, the control coupling light, and the target coupling light. We evade this problem by choosing dielectric coatings with small reflectivities at 480 nm.
The bow-tie geometry of the cavity is shown in Fig. 8. The geometry and the dimensions resemble the setup in Ref. [17]. For fixed L 2 and fixed angle of incidence, the resonator is stable for 30.34 mm ≤ L 1 ≤ 31.24 mm. If the Rydberg atoms were too close to a surface, then that might cause rapid dephasing of the Rydberg states. The geometry chosen here places the nearest surface approximately 15 mm from the atomic ensemble which seems to be safe [17].
The EIT signal light drives the |g ↔ |e transition, which requires σ − polarized light. The polarization convention for σ − is relative to the positive z axis (see Fig.  8) and essentially represents the direction of the atomic spins. The polarization convention for L and R, how-ever, is relative to the wave vector of the light. As the control (target) signal light has a wave vector parallel (antiparallel) to the positive z axis, it is R (L) polarized.
One can show that in the absence of birefringence the resonance frequency of the L polarized cavity mode is independent of the propagation direction of the light. The same applies to the R polarized cavity mode. As the two counterpropagating EIT signal light beams for control and target pulses should both be resonant with the atomic transition and with the cavity, the L and R polarized cavity modes should have negligible frequency splitting. Otherwise it is impossible to make both cavity modes resonant with the same atomic resonance. Among other things, this requires the cavity to be planar, i.e. that all the wave vectors of the cavity mode lie in one plane. This is a nontrivial condition for the fine alignment for a resonator with more than three mirrors [48]. Our cavity has polarization eigenmodes with measured polarizations which are to a good approximation R and L with a measured frequency splitting of ω R −ω L = 2π×0.9 MHz, which is smaller than κ and Γ e but unfortunately not much smaller. It is expected that this splitting can be reduced considerably in future experiments.
We choose the signal light during the control and the target pulse to be resonant with their respective cavity resonances. We choose the control signal light to be resonant with the atomic transition ∆ s = 0. Hence, in the absence of target coupling light, the target signal light has a detuning of ∆ s /2π = −0.9 MHz from the atomic transition. In the presence of target coupling light, the atomic ground state experiences a light shift of 0.18 MHz resulting in ∆ s /2π = −0.7 MHz. We optimize the target coupling detuning to obtain a conditional π phase shift, which turns out to be close to the two-photon resonance.

Appendix L: Blockade Radius
In principle, one could calculate the blockade radius in cavity Rydberg EIT near a Förster resonance as with C, Ω, and Γ e as in Eq. (H5). Here, the signal and coupling light are assumed to be resonant with the atomic transitions ∆ s = ∆ co = 0 and the signal light is assumed to be resonant with the cavity ∆ c = 0.
The Förster resonance comes about because the electric dipole-dipole interaction V dd couples the atom pair states |γ, J, M = |48 2 S 1/2 , 50 2 S 1/2 , J, M and |γ , J , M = |48 2 P 1/2 , 49 2 P 1/2 , J , M , where J, M and J , M are the quantum numbers of the total angular momentum and where the z axis is chosen along the internuclear axis. This coupling is described by a matrix element γ, 1, ±1|V dd |γ , 1, ±1 = −C 3 /R 3 , where R is the internuclear distance, the C 3 coefficient is C 3 = 1.2 × 10 6 a.u., and one atomic unit is 6.460 × 10 −49 Jm 3 . The rate coefficient γ F describes the off-diagonal decay of the density matrix according to (∂ t + 1 2 γ F ) g, r |ρ|γ = 0. For R → ∞, the energies of states |γ and |γ differ by the Förster defecth∆ F . In our experiment, this value vanishes by virtue of a static electric field which is applied using electrodes inside the vacuum chamber.
One can generalize this model to accommodate the random distribution of the angle included by the internuclear axes and the wave vector of the EIT signal light. One can combine this with the anisotropy of V dd characterized by γ, 1, 0|V dd |γ , 1, 0 = 2C 3 /R 3 . This yields a small increase of R block , which we neglect.
Note that, γ rg is not dominated by electric field noise because repeating the measurement of Fig. 7 at approximately zero electric field (so that the sensitivity to electric field fluctuations is greatly reduced) does not yield a big improvement regarding γ rg . However, the value of γ F extracted from the above estimate is so large that it seems unlikely that other mechanisms produce a larger value of γ F . Hence, we obtain the worst-case estimates 1/γ F ≥ 25(6) ns and R block ≥ 7 µm.
Appendix M: Efficiency

Average Efficiency
Here, we study some mathematical properties of the average efficiencyη. To motivate the definition ofη, we first review a few properties of two widely used averages F and F pro for describing the fidelity between a real process E and an ideal process E U . In doing so, we assume that the ideal process is unitary, i.e. there exists a unitary operator U such that E U (ρ) = U ρU † . On the one hand, we have the average fidelity [30] F = dψ tr [E U (|ψ ψ|)] † E(|ψ ψ|) , where the integral is over the uniform (Haar) measure of all normalized state vectors. On the other hand, we have the process fidelity F pro . For any orthonormal basis B i of operators, F pro can be expressed as the arithmetic mean where d is the dimension of the space of state vectors. This could serve as a definition of F pro , although it is customary to start from a different definition [30]. Note that Eq. (M2) has been stated e.g. in Eq. (10) in Ref. [30] but with the unnecessary additional restriction that each of the B i √ d be unitary. Both definitions, Eqs. (M1) and (M2), average the expression tr{[E U (ρ)] † E(ρ)} but whileF averages over all normalized state vectors, F pro averages over an orthonormal basis of operators. Both types of averaging seem natural. Interestingly, the two definitions yield different results but are connected by the affine linear function [30] In analogy to the definition of the average fidelityF in Eq. (M1), we define the average efficiencȳ η = dψη(|ψ ψ|), where, again, the integral is over the uniform (Haar) measure of all normalized state vectors. We show below that, for any orthonormal basis |v i of state vectors,η can be expressed as the arithmetic mean This expression is somewhat analogous to F pro in Eq. (M2) but with an interesting difference, namely that the sameη appears in Eqs. (M4) and (M5), whereasF and As an alternative toη, one could consider e.g. the harmonic mean of the eigenvalues of Θ. This harmonic mean appears when applying the gate to produce a postselected Bell state with well-balanced intensities, as discussed in appendix G. But in the long run, a more typical application consists in cascading many CNOT gates in a large network to perform a complicated quantum computation. Here, the relevant figure of merit in terms of efficiency is probably the average efficiencyη, not the harmonic mean of the eigenvalues of Θ. Now, we turn to the proof of Eq. (M5). To this end, we use the following property of the uniform (Haar) measure, proven below, It remains to be shown that Eq. (M6) holds. To see this, we first note that A = dψ|ψ ψ| is a Hermitian operator. Hence, we choose an orthonormal basis of eigenvectors |s i . In addition, we note that U AU † = A for all unitary d × d matrices U because, for any fixed such U , we can substitute the integrand from |ψ to |ξ = U |ψ and use the defining property dψ · · · = dξ · · · of the uniform (Haar) measure. As swapping eigenvectors |s i and |s j is a unitary operation, we find that all eigenvalues of A are identical. Hence, there exists a complex number c such that A = c1. Considering tr(A) and using the fact that the uniform (Haar) measure is normalized, dψ = 1, we obtain c = 1/d.

Efficiency Tomography
Efficiency tomography aims at determining Θ from a sufficiently large set of measurement outcomes. As η is linear, it suffices to measure η(A j ) for all elements A j of an arbitrary basis A of operators. To calculate the efficiency matrix Θ from the measured values η(A j ), it is useful to introduce the dual basis with elements A j defined by tr(A † i A j ) = δ i,j . The dual basis can be calculated according to where g is a metric tensor. A more common notation for h i,j is g i,j . For all operators B, this yields . From this, one easily obtains none of the incoming N photons was lost. The normalized state |ψ loss represents terms in which at least one photon was lost.
Here, β c and β t denote single-qubit phases with shotto-shot fluctuations, just as in Eq. (B2a) and (B2b). For these random variables, we use the same assumptions as above and, again, we abbreviate V c = e iβc and V t = e iβt .
We propagate all target qubits in the state |ψ from Eq. (N1) through the single-qubit unitary with |D → |V and |A → |H . Next, we calculate the resulting density matrix and we average this density matrix over the random variables β c and β t . We calculate the density matrix describing the subensemble postselected upon detection of exactly one control qubit and exactly N − 1 target qubits. From here, we obtain Eqs. (E1)-(E4).