Hacking Quantum Networks: Extraction and Installation of Quantum Data

Seok Hyung Lie,1 Yong Siah Teo,1 and Hyunseok Jeong1, ∗

1Department of Physics and Astronomy, Seoul National University, Seoul, 151-742, Korea(Dated: June 21, 2021)

We study the problem of quantum hacking, which is the procedure of quantum-information extraction fromand installation on a quantum network given only partial access. This problem generalizes a central topic in con-temporary physics—information recovery from systems undergoing scrambling dynamics, such as the Hayden–Preskill protocol in black-hole studies. We show that a properly prepared partially entangled probe state cangenerally outperform a maximally entangled one in quantum hacking. Moreover, we prove that finding an opti-mal decoder for this stronger task is equivalent to that for Hayden–Preskill-type protocols, and supply analyticalformulas for the optimal hacking fidelity of large networks. In the two-user scenario where Bob attempts tohack Alice’s data, we find that the optimal fidelity increases with Bob’s hacking space relative to Alice’s userspace. However, if a third neutral party, Charlie, is accessing the computer concurrently, the optimal hackingfidelity against Alice drops with Charlie’s user-space dimension, rendering targeted quantum hacking futile inhigh-dimensional multi-user scenarios without classical attacks. When applied to the black-hole informationproblem, the limited hacking fidelity implies a reflectivity decay of a black hole as an information mirror.

Advancements in quantum technologies have triggered an-ticipations of a new quantum-computing era, where eachquantum computer can be connected either to a quantum net-work [1–3], or to the quantum internet [4–8]. In such a de-localized quantum-computation setting, a third party can begranted access to a part of a quantum network. Suppose thatAlice operates such a network with an architecture that ispublicly given by a multipartite unitary operator. Alice grantsBob, a client, access to an input port of the network. In thissituation, Bob might be a hacker who attempts to extract asmuch data from Alice as possible.

This problem can naturally emerge in non-artificial quan-tum interactions. It reduces to the information recovery prob-lem, which is actively studied in the field of scrambling ofquantum information [9–11]. One notable example is theHayden–Preskill protocol for recovering quantum informationfrom the Hawking radiation of old black holes [12–16]. Its op-timal decoding map is not completely understood and requirescreative construction. In [17], although an efficient decodingmap was proposed for the information recovery task, its opti-mality is still an open question. On the other hand, from theperspective of the decoupling approach [18] to quantum in-formation, perfect recovery is equivalent to implementing aquantum channel without leaking information to a particularsubsystem. This is also studied in the context of catalysis ofquantum randomness [19–23].

By the no-cloning theorem [24], however, Bob cannot sim-ply copy out Alice’s quantum data, but has to replace it withanother. Although this aspect of information recovery is gen-erally overlooked, the problem of deciding which data to in-stall and how well this installation can be implemented is nowrelevant. If Bob additionally wants to extract information ofAlice’s next computation, he needs the side information ofthe quantum state currently in Alice’s memory. Naturally, theability to change the quantum data of Alice to whatever Bobprepared is the most desirable, but we will show that it is pos-sible only in trivial cases. Therefore, when Alice’s next step is

∗ h.jeong37@gmail.com

unknown, Bob would typically want to replace Alice’s quan-tum data with a part of a maximally entangled state whosereference system is in his possession for the maximal side in-formation. We refer to this task of extraction and installationof quantum data as quantum hacking.

Quantum hacking.—For simplicity, we first consider aquantum network accessed by only two users, Alice and Bob,described as a dAdB-dimensional unitary operator U on sys-temsAB. As a hacker, Bob might try to extract as much quan-tum information stored in A as possible and replace it withan arbitrary quantum state of his choice. This is equivalent tofeeding a ‘probe’ quantum state that depends on the quantumdata Bob wants to install into U and applying a recovery mapto the output state to simulate the SWAP operation [25]. How-ever, if this task can be done with error ε (measured by theaverage infidelity of pure state inputs), then the unitary opera-tor U itself should be close to the SWAP operator (up to localoperations) with error ε and vice versa. It is thus impossible tosubstitute quantum data through a non-SWAP operator [26].

The next optimal strategy for Bob is to build as much cor-relation as possible with the target system A while extractingquantum information out of it (See Fig. 1). This is becausebuilding correlations allows the extraction of quantum infor-mation from the next (undecided) computation step providedBob has access to a part of the current computation output. Ingeneral, Bob possesses a reference systemB′ (dB = dB′ ) andprepares an entangled input probe state |φ〉BB′ . Bob’s goalsare, therefore, to extract the input information stored inA, andinstall an output maximally entangled state in AB. The lattercan be interpreted as an extraction of quantum data of futurequantum computation on A [27], because having a maximallyentangled state with the target system yields the maximumside information.

To achieve both goals, Bob applies a unitary recovery mapR on systems BB′. Since the input data in A is unknown, forthe purpose of evaluating Bob’s strategy following the stan-dard approach [13, 17], we assume that it is in a maximallyentangled |ψ〉AA′ state with an environment A′ (dA = dA′ ),where |ψ〉XY =

∑d′

i=1 |ii〉XY /√d′ and d′ = mindX , dY

arX

iv:2

105.

1382

3v2

[qu

ant-

ph]

18

Jun

2021

2

FIG. 1. (a) Schematic diagram of quantum hacking of a unitary pro-cess U (quantum network or quantum computer) in the two-user sce-nario. (b) Ideally, Bob, the hacker would successfully extract Alice’sinformation and plant a maximally entangled state for the next quan-tum computation.

for any systems XY . For this case, successful data extrac-tion from A means entanglement swapping; Bob should have|ψ〉A′B′ in the final stage. The fidelity with maximally entan-gled inputs is known to be a monotone function of the averagefidelity of a pure-state input [28]. Consequently, we define thequantum-hacking fidelity as

phack := | 〈ψ|AB 〈ψ|A′B′ RBB′UAB |ψ〉AA′ |φ〉BB′ |2. (1)

Since the fidelity never decreases under a partial trace,phack serves as a lower bound for both fidelities of the ex-tracted quantum data (systems A′B′) and implemented entan-gled state (systemsAB). We can parametrize any bipartite en-tangled pure state |φ〉BB′ with an operator χ acting on systemB′ such that |φ〉BB′ =

∑i |i〉B⊗χ|i〉B′ with ‖χ‖2 = 1. Here

‖X‖p := (Tr |X|p)1/p, where |X| :=√X†X , is the Schatten

p-norm. With these, Eq. (1) is simplified to

p(R,χ)hack = |Tr[R(IB ⊗ χ)Uo]|2/d3

A. (2)

Here, the (generally non-unitary) map Uo : AA′ → BB′

is represented by a matrix, understood as a tensor, formedby cyclically rotating the indices of U clockwise by oneposition—Uoijkl := Ukilj . Here, Xij

kl := 〈ij|X |kl〉 in thecomputational basis [26]. This amounts to rotating U clock-wise by 90 degrees in tensor-network diagrams [29, 30], andis closely related to tensor reshuffling [31–33]. Note that‖Uo‖2 = ‖U‖2 =

√dAdB [34].

Each pair R,χ constitutes a hacking strategy for Bob. Fora given χ, which is identical to fixing Bob’s probe state, the

optimal unitary recovery R is the one that gives the polar de-composition (IB ⊗ χ)Uo = R†|(IB ⊗ χ)Uo|. This leads to

p(χ)hack = max

Rp

(R,χ)hack = ‖(IB ⊗ χ)Uo‖21/d3

A , (3)

which is equivalent to inverting a possibly non-unitary opera-tor with a unitary one [35]. This leaves the problem of findingan optimal χ that achieves the largest hacking fidelity. A nat-ural candidate would be χ = IB/

√dB , which corresponds to

a maximally entangled probe state. Equation (3) then imme-diately yields the fidelity pME

hack = ‖Uo‖21/(d3AdB), which is a

unitarity measure of Uo as ‖Uo‖1 is the maximal inner prod-uct of Uo and an isometry. With this strategy, perfect hacking(pME

hack = 1) is only possible when Uo is proportional to anisometry—Uo†Uo = (dB/dA)IAA′ . On the contrary, pME

hackreaches its minimum 1/d2

A when Uo is rank-1, which hap-pens if U = IA ⊗ IB , for instance. This value serves as alower bound of the optimal hacking fidelity. Physical intuitionmay lead to the putatively obvious conclusion that a maxi-mally entangled probe state is optimal for quantum hacking.As it turns out, this is, however, not the case in general. Forexample, for a qubit-qudit controlled unitary operator givenas Uc = IA ⊗ |0〉〈0|B +XA ⊗ (IB − |0〉〈0|B), with the PauliX operator acting on A, pME

hack is smaller than the p(χ)hack with

χ = (|0〉〈0|B + |1〉〈1|B)/√

2.To maximize p(R,χ)

hack in Eq. (2), recalling that ‖χ‖2 = 1,we may invoke the Cauchy–Schwarz inequality,|TrB′ [χTrB [UoR]]| ≤ ‖TrB [UoR]‖2. This bound issaturated when χ = TrB [R†Uo†]/‖TrB [UoR]‖2. Hence, thetrue optimal hacking fidelity reads

popthack = max

R‖TrB [UoR]‖22/d3

A, (4)

where the maximization is over all d2A × d2

B coisometry op-erator R (RR† = IAA′ ). By exploiting the polar decomposi-tion once more, a canonical choice of R is UoR = |Uo†| andyields the fidelity pPG

hack = ‖TrB |Uo†|‖22/d3A. As we shall

soon demonstrate that this hacking strategy is near-optimal,we will call this the “pretty good” (PG) strategy. As this strat-egy also outperforms that using a maximally entangled probestate, the following inequalities hold:

pMEhack ≤ pPG

hack ≤ popthack . (5)

Note that the PG strategy is optimal when Uo is proportionalto an isometry (pME

hack = pPGhack = popt

hack = 1). If dA = dB , theinequality 1− pME

hack ≤ 4(1− popthack) implies that near-perfect

hacking (popthack ≈ 1) is possible only when Uo is nearly uni-

tary (pMEhack ≈ 1) [26].

Optimal hacking performance.—For a quantum networkdescribed by a generic unitary U and an optimal hackingstrategy defined by optimizing R and χ, the hacking fi-delity phack defined in Eq. (1) reaches an optimal value popt

hackstated in Eq. (4). As previously discussed, the optimal probestate (χopt) for popt

hack is generally not maximally entangled(χopt 6= IB/

√dB). While the general solution of χopt for

the maximization problem in Eq. (4) has no known analytical

3

FIG. 2. Averaged quantum-hacking performance (over 20 randomlygenerated Haar unitary networks U ’s) featuring the optimal strat-egy (Opt) via (4), the PG strategy with χ, and a random one (Rand)using an arbitrarily-chosen probe state. When κ = 1, PG is almostthe same as Opt in hacking performance. As κ increases, popthack →I2κ → 1. All theoretical dashed curves are computed with (6).

form, we derive an iterative gradient-ascent algorithm [36, 37]to acquire χopt in [26].

Interestingly, one can calculate an analytical form of popthack

for sufficiently large dimensions (dA, dB 1). To do this,we observe that a maximally entangled probe state is asymp-totically optimal for quantum hacking—χopt → IB/

√dB .

This follows from the fact that the reduced state of anyhigh-dimensional pure state approaches the maximally mixedstate [38], which then implies that popt

hack → ‖Uo‖21/(d3AdB).

We shall consider U as a random unitary operator distributedaccording to the Haar measure of the unitary group. Usingproperties of this measure and results from random matrixtheory [39–41], in the two-user scenario where only Aliceand Bob are connected to the quantum network, we have theasymptotic Haar-averaged formula for dB ≥ dA,

popthack ≈ I

2κ+(1−I2

κ)/d2A , Iκ = 2F1

(1/2,−1/2; 2; 1/κ2

),

(6)with κ = dB/dA and 2F1(·) is the hypergeometric func-tion [26]. Specifically, I1 = 8/(3π). If dB < dA, we insteadhave popt

hack ≈ κ2I2κ+(1−I2

κ)/d2A, which appeals to common

sense that a hacking space smaller than Alice’s user space isinadequate for hacking.

Figure 2 shows the performances of three hacking strategieswith optimal recovery R [see (3)]. The results indicate thatefforts in using optimal probe states for a given network Udo pay off with a much higher hacking fidelity compared toall other random choices of Bob’s probe state. The quantityI2κ is an important indicator of the limiting performance for

hacking large quantum networks of a fixed dimension ratio κ.It also suggests that in the two-user scenario, a larger Hilbertspace of Bob relative to Alice’s results in a larger popt

hack. Asingle-qubit ancilla (κ = 2) is enough to boost popt

hack all theway to ≈ 0.936. We also find that the PG strategy χ := χ =TrB |Uo†|/‖TrB |Uo†|‖2 is almost optimal for any dA and

FIG. 3. Averaged optimal quantum-hacking performance for situa-tions where Bob the hacker has restricted amount of network usage(d0 ≥ 1). The case d0 = 1 corresponds to Charlie’s absence. Bob’soptimal hacking fidelity drops rapidly with dA as soon as there existsa third-party user with a Hilbert-space dimension identical to Alice’s.All theoretical dashed curves are given by popthack(d0).

dB . In particular, when dA = 2 = dB , we precisely get χ =χopt = IB/

√dB [26].

The hacking landscape becomes very different when thereare multiple users connected to the quantum computer. Letus suppose that Charlie, a third party who represents either asingle user or user group, is using the computer described bysome unitary U , and Bob is interested in hacking only Alice’sdata. In this case, Charlie’s data, encoded in a (dC = d0)-dimensional space, should remain untempered after passingthrough U . The resulting hacking fidelity has essentially thesame form as that in (1), only that Uo is now a rotatedTrC U/d0. Correspondingly, popt

hack(d0) = popthack/d

20 [26]. Fig-

ure 3 illustrates the hacking performance when Charlie ispresent. We note that for d0 > 1, the asymptotic optimalhacking fidelity is lower than that when d0 = 1 (no Charlie),which is obvious from the 1/d2

0 dependence in popthack(d0). If

Charlie uses a Hilbert space of the same dimension as Al-ice’s to encode his data (dA = d0), we see that popt

hack =O(1/d2

A)→ 0. Such a characteristic becomes conspicuous foran arbitrarily large quantum computer (d0 1), and revealsthe exceedingly-low plausibility of targeted quantum hackingfor large networks.

Duality with Hayden–Preskill protocols.—Surprisingly, theseemingly harder problem of finding an optimal quantum-hacking strategy by Bob on Alice is equivalent to that of aHayden–Preskill-type protocol of Alice on Bob. In this set-ting we assume that, instead of U , its (computational-basis)transpose (U>)ijkl = Uklij is applied to systems AB. Now, Al-ice wants to extract information from Bob’s system B. Simi-lar to quantum hacking, to model such information extraction,we assume that a maximally entangled state |ψ〉BB′ is fed intoU>. Alice also chooses a maximally entangled state |ψ〉AA′ asa probe state. SystemsAB interact with U> and Alice appliesa d2

A-dimensional unitary operator W on AA′. Alice’s goal

4

is to prepare a maximally entangled state on systems AB′.The optimal fidelity between the actual and ideal states ispopt

HP = maxW 〈ψ|AB′ TrA′B [W U(|ψ〉〈ψ|⊗2A′ABB′)] |ψ〉AB′ .

Here, W(ρ) := WAA′ρW†AA′ ≡ WρW † and U(ρ) :=

U>ABρU∗AB ≡ U>ρU∗. This expression can also be simpli-

fied in terms of the SWAP operator F to

poptHP = max

W‖TrB [UoW>F ]‖22/(dAd2

B). (7)

It follows that the optimal hacking strategy of Eq. (4) and theoptimal strategy to pHP are related by R = W>F . Therefore,quantum hacking is a dual problem of the Hayden–Preskillprotocol, in the sense that if one problem is solvable for an ar-bitrary U , then so is the other. It follows that popt

HP = popthack/κ

2

and poptHP < 1 when dB > dA.

Quantum hacking and entanglement recycling.—The oper-ator Uo appears in various scenarios. In some, the input andoutput systems of the unitary operator U need not match. LetU : AB → KL be a map of dimension D = dAdB = dKdL.By using a probe state (χ) and recovery map R on LB′ withmatching dimensions, we get the modified hacking fidelityp

(R,χ)hack = |Tr[R(IL ⊗ χ)Uo]|2/(d2

AdK). One remarkable ex-ample is the evaporation of an old black hole, where the probestate is maximally entangled between the inner degrees offreedom of the black hole and all Hawking radiation emittedfrom the back hole up to that point. The black-hole degrees offreedom is typically much larger than those of matter fallinginto it momentarily. Let the former be DB = dB = dK andthe latter be, say, qudit: dM = dA = dL. If Bob collects anadditional dM -dimensional Hawking radiation, the resultingoptimal hacking fidelity is pBH

hack = ‖Uo‖21/D2.We remark that the dimension of the black-hole interior

state remains the same since a qudit enters the black hole andanother exits it. Depending on the assumptions made on thedynamics of black holes (see [42] for the recent discussion onthe effect of symmetry for information recovery), there maybe an estimated value 1− εBH of pBH

hack. For example, for Haarrandom U , pBH

hack tends to (8/3π)2 ≈ 0.72 for large D [26].This also serves as a lower bound for the fidelity between theposterior probe state and a maximally entangled state. If oneuses a probe state whose maximal fidelity with a maximallyentangled state is f for the information extraction of the nextqudit falling into the black hole, where optimal hacking fi-delity is typically pBH

hack for large D, then the optimal hack-ing fidelity approaches to the product fpBH

hack. However, for agiven hacking fidelity phack and the fidelities of the extractedquantum data (fext), and between the posterior probe state anda maximally entangled state (fpost), the following trade-offrelation exists [26]:√

1− fext +√

1− fpost ≥ 2(1− phack)/3. (8)

So one should choose between accurate data extraction andgood entanglement recycling for imperfect hacking; giving upthe former means inaccurate data extraction for the currentround of hacking, and giving up the latter leads to a worsefidelity in the next round.

Discussion.—We proposed a quantum hacking task, whichentails the extraction and replacement of quantum data

through limited interaction with a quantum network, and ana-lyzed its performance in terms of the hacking fidelity. In find-ing good hacking strategies and calculating the optimal hack-ing fidelity for generic multipartite unitary networks, we giveexplicit operational meaning to 90-degree tensor rotations ofunitary operators. While Bob’s hacking fidelity on Alice sat-urates at a nonzero value in the two-network-user scenario,we find that with multiple users, naive attempts to hack anysingle user would generally result in exceedingly-low hack-ing fidelity. To improve the hacking success, it is necessaryto perform program modifications to U , akin to hackers intro-ducing malware to control classical computers. For quantumnetworks, quantum circuits would constitute such a program,but since an arbitrary quantum program cannot be encodedinto a state owing to the no-programming theorem [43], Bobwould need to supplement his quantum resources with addi-tional classical attacks to improve the hacking fidelity.

As an interesting application, we considered aninformation-reflection model for black holes, and sur-veyed the sustainability of black-hole mirroring. From ourtrade-off relation in (8) and analysis of black-hole hacking,we conclude that the black hole in this model indeed func-tions as a mirror [13], but its “reflectivity” may be graduallydegraded over time (See Ref. [44, 45] for different notionsof reflectivity of quantum black holes). One could collectmore Hawking radiation to increase the hacking fidelity, butthat necessitates an entanglement reduction [13], therebyleading to yet another type of reflectivity degradation. Thisquestions whether quantum information gets destroyed whenit falls into an ‘older’ black hole that has already reflected asignificant amount of quantum information that fell into it.

ACKNOWLEDGMENTS

This work is supported by the National ResearchFoundation of Korea (NRF-2019R1A6A1A10073437,NRF-2019M3E4A1080074, NRF-2020R1A2C1008609,NRF-2020K2A9A1A06102946) via the Institute of AppliedPhysics at Seoul National University and by the Ministryof Science and ICT, Korea, under the ITRC (InformationTechnology Research Center) support program (IITP-2020-0-01606) supervised by the IITP (Institute of Information &Communications Technology Planning & Evaluation).

5

SUPPLEMENTAL MATERIAL

I. IMPLAUSIBILITY OF ARBITRARY QUANTUM-STATEINSTALLATION

For any d-dimensional quantum channel Λ, the infidelity1 − Fent(Λ) = 1 − 〈ψ| (I ⊗ Λ)(|ψ〉〈ψ|)) |ψ〉 for maximallyentangled input state |ψ〉 =

∑di=1 |ii〉 and the average infi-

delity over Haar random pure input state 1 − Fpure(Λ) =1 −

∫dφ 〈φ|Λ(|φ〉〈φ|) |φ〉 have the following linear depen-

dence [28],

1− Fent(Λ) =d

d+ 1(1−Fpure(Λ)) , (9)

we will use the infidelity 1 − Fent(Λ) instead and have theequivalent result without losing generality.

Suppose, with the unitary operators U , P and R, that theSWAP operator can be approximated with error ε according to

|0〉B Tr

A

U

P R

C

≈εA

C

. (10)

Here, ≈ε means that the two circuits are close to each otherwith error ε in the infidelity for maximally entangled inputstates. It means that Σ ≈ε Λ is equivalent to F (JΣ, JΛ) ≥1 − ε where JN is the normalized Choi matrix for quantumchannel N . From the Uhlmann theorem [46], it follows thatthere exists a pure state |s〉B such that

|0〉B

A

U

P R

C

≈ε

A

C

|s〉B

. (11)

Since the fidelity never decreases under partial trace, it followsthat

A

U

C Φ

≈εA

C Ψ

(12)

where

C Φ B =

Tr

|0〉BP

C

, (13)

and

C Ψ =Tr|s〉B

R†

C

. (14)

From the cyclicity of the fidelity for the maximally entangledinput state, it follows that

A

U

B

≈εA Φ†

B Ψ

. (15)

It can be interpreted that unless the target network U it-self is already close to a swapping operator followed by localoperations, it is impossible to nearly perfectly substitute thequantum information out of the network. Conversely, if U isclose to the SWAP operator with error ε (if the dimensions ofA and B do not match, then it can be SWAP ⊕ I), then bychoosing P and R also as SWAP operators, one can achievedata substitution with error ε.

II. ROTATION OF MATRIX AND FIDELITIY BOUNDS

We first show how the fidelity expression

p(R,χ)hack := | 〈ψ|AB 〈ψ|A′B′ RBB′UAB |ψ〉AA′ |φ〉BB′ |

2 ,(16)

is simplified with the rotated matrix Uo. First, note that phack

is the fidelity between the pure states

1√dA

A′

U

A

R

B

χ B′

and 1

dA

A′

A

B

B′

. (17)

Here, =∑i |ii〉 represents an unnormalized maximally

entangled state with the appropriate Schmidt number for thesystem it is defined on. Therefore, it can be expressed with atensor network diagram.

p(R,χ)hack =

1

d3A

U

Rχ

, (18)

6

with the equivalence of |φ〉BB′ and χ:

|φ〉BB′ =χ

. (19)

We remark that the time flows from left to right in the diagram,as opposed to the matrix multiplication order. The definitionof Uo can be expressed in a circuit diagram as follows:

Uo = U . (20)

By plugging this diagram into Eq. (18), we get

p(R,χ)hack =

1

d3A

Uo Rχ

. (21)

This is equivalent to the expression

p(R,χ)hack =

|Tr[R(IB ⊗ χ)Uo]|2

d3A

. (22)

Since√dB‖TrB |Uo†|‖2 ≥ ‖TrB |Uo†|‖1 = ‖Uo‖1,

pPGhack = ‖TrB |Uo†|‖22/d3

A is higher than pMEhack =

‖Uo‖21/(d3AdB). Also, since the PG strategy is a particular

strategy, the fidelity of it is not larger than that of the optimalstrategy, so we have pPG

hack ≤ popthack. In summary, we have

pMEhack ≤ pPG

hack ≤ popthack. (23)

When dA = dB = d, popthack is the maximal fidelity

between a maximally entangled state with the Schmidtrank d2 and a pure state of the form Ωχ := d(UAB ⊗χB′) |ψ〉〈ψ|⊗2

AA′BB′ (UAB ⊗ χB′)† with ‖χ‖2 = 1. Let χM

be a χ that achieves the maximum. Since the partial tracenever decreases the fidelity, by tracing out systems otherthan B′, we get F (IB′/d, |χM |2) ≥ popt

hack. Let the recov-ery map that achieves the optimal fidelity be Ropt and letΘV := VBB′ |ψ〉〈ψ|⊗2

AA′BB′ V†BB′ for any bipartite unitary op-

erator VBB′ , so that popthack = F (ΩχM

,ΘRopt). Since there is a

freedom of local unitary operation to the choice of Ropt andχM , without loss of generality, we can assume that χM is pos-itive semi-definite so that TrχM = Tr |χM |.

From the following relation for arbitrary pure quantumstates |η1〉 and |η2〉,

1

2‖ |η1〉〈η1| − |η2〉〈η2| ‖1 =

√1− | 〈η1|η2〉 |2, (24)

we have√

1− pMEhack = minW ‖ΘW − ΩME‖1/2, where

ΩME := ΩIB′/√d. Therefore

√1− pME

hack ≤ ‖ΘRopt −ΩME‖1/2. Because of the triangle inequality, we have‖ΘRopt

− ΩME‖1 ≤ ‖ΘRopt− ΩχM

‖1 + ‖ΩχM− ΩME‖1.

By Eq. (24), we have ‖ΘRopt −ΩχM‖1/2 =

√1− popt

hack and

‖ΩχM−ΩME‖1/2 =

√1− F (IB′/d, |χM |2) ≤

√1− popt

hack.

As a result, we have√

1− pMEhack ≤ 2

√1− popt

hack thus 1 −pME

hack ≤ 4(1− popthack).

The trade-off relation between the data extraction fidelityfext and the posterior probe state fidelity fprob

√1− fext +

√1− fprob ≥

2

3(1− popt

hack) , (25)

directly follows from the following result.

Theorem 1. For arbitrary bipartite quantum state ρAB andpure states |ψ〉A and |φ〉B , let FA := 〈ψ| ρA |ψ〉, FB :=〈φ| ρB |φ〉 and FAB := 〈ψ|A 〈φ|B ρAB |ψ〉A |φ〉B . Then thefollowing inequality holds√

1− FA +√

1− FB ≥2

3(1− FAB). (26)

Proof. Let ψA := |ψ〉〈ψ| and for other pure states with similarnotations. By applying the Uhlmann theorem [46], it followsthe existence of a (possibly mixed) state φ′B such that FA =F (ψA ⊗ φ′B , ρAB). From the Fuchs-van de Graaf inequality[47], we have ‖ψA ⊗ φ′B − ρAB‖1/2 ≤

√1− FA. From the

monotonicity of 1-norm under partial trace, we have ‖φ′ −ρB‖1/2 ≤

√1− FA. Therefore ‖φB − φ′B‖1/2 ≤ ‖φB −

ρB‖1/2+‖ρB−φ′B‖1/2 ≤√

1− FB +√

1− FA. From thiswe can bound the distance ‖ψA ⊗ φB − ρAB‖1/2 ≤ ‖ψA ⊗(φB−φ′B)‖1/2+‖ψA⊗φ′B−ρAB‖1/2. Here, ‖ψA⊗ (φB−φ′B)‖1/2 = ‖φB − φ′B‖1/2 ≤

√1− FA +

√1− FB and

‖ψA ⊗ φ′B − ρAB‖1/2 ≤√

1− FA, so we have

‖ψA ⊗ φB − ρAB‖1/2 ≤ 2√

1− FA +√

1− FB . (27)

Using the same argument we can also derive

‖ψA ⊗ φB − ρAB‖1/2 ≤√

1− FA + 2√

1− FB , (28)

hence, by averaging two inequalities, and again using theFuchs–van de Graaf inequality 1 − FAB ≤ ‖ψA ⊗ ψB −ρAB‖1/2, since ψA ⊗ φB is a pure state, we get the desiredresult.

Now, consider the black hole radiation problem of Hackingas entanglement recycling section. When the probe state is ageneral mixed bipartite state ΠBB′ =

∑i pi |φi〉〈φi|BB′ with

|φi〉BB′ =∑k(IB⊗χi) |kk〉BB′ , the hacking fidelity is given

as

p(R,Π)hack =

∑i

pi|Tr[R(IB ⊗ χi)Uo]|2

d2MDB

. (29)

7

If the dimension of the Hilberst space of black hole state islarge enough, then the PG strategy becomes nearly optimalthus, p(R,Π)

hack reduces to∑i pi|Tr

[χi TrB |Uo†|

]|2/d3

M .More-over, as D → ∞. TrB |Uo†| converges to ‖Uo‖1I ′B/DB(SeeSec. V), so we have

maxR

p(R,Π)hack ≈

∑i

pi|Trχi|2‖Uo‖21

DBD2

= pMEhack

∑i

pi|Trχi|2

DB

≈ popthackf

′prob. (30)

Where f ′prob =∑i pi|Trχi|2/DB is the fidelity between

ΠBB′ and a maximally entangled state. Therefore the hackingfidelity is asymptotically the product of the optimal hackingfidelity and f ′prob.

III. NUMERICAL MAXIMIZATION OF popthack

Given a quantum computer or network described by U , itis possible to derive an iterative numerical scheme to obtainthe optimal probe state (χopt) that achieves the optimal hack-ing fidelity popt

hack. Rather than directly solving the numericalproblem in (5) of the main text, we can instead start withfχ = ‖(IB ⊗ χ)Uo‖1, which is the objective function in-volving the square root of the rightmost side in (4), and per-form a variation with respect to χ. Furthermore, the constraint‖χ‖2 = 1 invites the following parametrization χ = Z/‖Z‖2,such that

δχ =δZ

‖Z‖2− Z

2‖Z‖32TrB′ [δZZ

† + ZδZ†] . (31)

Upon denoting M = (IB ⊗ χ)Uo, we consequently have

δfχ =1

2TrB′

[TrB [|M†|−1MUo†]

δZ†

‖Z‖2

]+ c.c.

− 1

2Tr |M†|TrB′ [δZZ

† + ZδZ†]

‖Z‖22, (32)

which leads to the operator gradient

δfχδZ†

=1

2‖Z‖2

(TrB [|M†|−1MUo†]− Tr |M†| Z

‖Z‖2

)(33)

with respect to Z†. Setting it to zero would then gives theextremal equation

χ =TrB [|M†|−1MUo†]

‖TrB [|M†|−1MUo†]‖2, (34)

which may alternatively be gotten from reasoning with theCauchy-Schwarz inequality. As ‖(IB ⊗χ)Uo‖1 is concave inρB′ = χ†χ, one can generally expect a convex solution setof ρB′ ’s that solve (34), all of which give the unique maximalfidelity popt

hack.

In other words, popthack is achieved when a solution χ =

χopt for Eq. (34) is obtained. While there are no knownclosed-form expressions for this solution, we can neverthe-less find explicit analytical forms for certain special cases.The most immediate one happens to be the limiting casedB → ∞, whence we have χopt → IB/

√dB , since in

this limit, TrB A → TrA/dB for any bipartite operator Aof systems BB′. For finite dB , we may still have an esti-mate for χopt ≈ χ. A straightforward way to do this isto simply iterate the extremal equation (34) once by substi-tuting IB/

√dB for χ on the right-hand side. This gives us

χ = TrB |Uo†|/‖TrB |Uo†|‖2, which is in practice very closeto χopt.

To numerically compute the actual χopt, we adoptthe steepest-ascent methodology and require that δfχ =Tr[(δfχ/δZ

†)δZ† + δZ(δfχ/δZ)]≥ 0. This amounts to

defining the increment δZ := ε δfχ/δZ† for some small real

ε > 0 that functions as a fixed iteration step size. This allowsus to state the iterative equations

Zk+1 =

(1− ε

2

Tr |M†k |‖Zk‖2

)Zk +

ε

2TrB [|M†k |

−1MkUo†] ,

χk+1 =Zk+1

‖Zk+1‖2(35)

that can be used to converge χk to χopt starting withZ1 = IB ,where a factor of ‖Zk‖2 has been neglected for a suitably cho-sen magnitude of ε. As δfχ = 2εTr

[|δfχ/δZ|2

]> 0 by con-

struction, convergence is guaranteed as long as ε is sufficientlysmall. Operationally, one can afford to choose a reasonablylarge ε to increase the convergence rate.

IV. OPTIMAL QUANTUM HACKING OF TWO-QUBITQUANTUM NETWORKS

The case where dA = 2 = dB presents the unique situa-tion in which one can confirm, indeed, that χopt = IB/

√dB .

To this end, we proceed to construct the exact expression of|Uo†|. Since UU† = I , in terms of the product computationalbasis 〈jk|U |lm〉 = U jklm, the basic relation

1∑l,m=0

U j1k1lm U j2k2∗lm = δj1,j2δk1,k2 (36)

shall be immensely useful in the subsequent discussion.Using Eq. (36), we first note that the product

UoUo† =∑l,m,m′

[|0,m〉 (U00

lmU00∗lm′ + U10

lmU10∗lm′ ) 〈0,m′|

+ |1,m〉 (U01lmU

01∗lm′ + U11

lmU11∗lm′ ) 〈1,m′|

+ |0,m〉 (U00lmU

01∗lm′ + U10

lmU11∗lm′ ) 〈1,m′|

+ |1,m〉 (U01lmU

00∗lm′ + U11

lmU10∗lm′ ) 〈0,m′|

]=

(A B†

B A−1DetA

)(37)

8

may be characterized, in the product computational basis, byonly two 2× 2 matrices in a highly specific manner, where Bis traceless. Such a structure is absent in higher dimensions.For convenience, we may rewrite

UoUo† =1 +

(a · σ b∗ · σb · σ −a · σ

)(38)

in terms of dot products (v · w = v>w) of the vectorial pa-rameters a and b with the standard vector of Pauli operatorsσ = (σx, σy, σz)

> to separate the matrix representation ofUoUo† into the identity and another 4 × 4 traceless matrix,where a is real and b complex.

With the identity (a · σ)(a′ · σ) = a · a′1 + ia × a′ ·σ, it is a straightforward matter to verify that |Uo†| has thesame matrix-representation structure, where all its parameterssatisfy the following conditions:

|Uo†| = c′1 +

(a′ · σ b′∗ · σb′ · σ −a′ · σ

),

1 = c′2 + |a′|2 + |Reb′|2 + |Imb′|2 ,a = 2 c′a′ − 2 Reb′× Imb′ ,

Reb = 2 c′Reb′ − 2 Imb′× a′ ,

Imb = 2 c′Imb′ − 2a′ × Reb′ . (39)

Here, Re· and Im· respectively denote the real and imag-inary parts of the argument. Evidently, in this fortuitouslyeasy yet general two-qubit scenario, we find that TrB |Uo†| =2 c′IB , such that χ = TrB |Uo†|/‖TrB |Uo†|‖2 =IB/√dB = χopt.

V. ASYMPTOTIC FORMULAS FOR popthack

We first suppose the symmetric problem involving a dAdB-dimensional unitary operator U . In the asymptotic limitdA, dB → ∞ such that κ = dB/dA, according to the discus-sions in Sec. III, the corresponding optimal quantum-hackingfidelity takes the form popt

hack → ‖Uo‖21/(d3AdB). The ana-

lytical form of its average value then necessitates calculatingthe average term ‖Uo‖21 over all random U ’s distributed ac-cording to the Haar measure. We emphasize that since Uo

is represented by a d2B × d2

A matrix that is obtained fromjust a sequence of index swapping operations, such a rectan-gular matrix still retains the statistical properties of a Haarunitary matrix elements, namely Uojklm = 0 and |Uojklm|2 =1/(dAdB) [39]. If we additionally suppose that κ > 1, thenin the asymptotic limit, the eigenvalues (σj) of κ−1Uo†Uo

are independently and identically distributed according to theMarcenko–Pastur distribution [40]:

σj ∼1

2π

√(λ+ − x)(x− λ−)

λx, λ± = (1±

√λ)2 , (40)

where λ = κ−2. With these,

‖Uo‖21 =κ

d2A∑j=1

σj +∑j 6=k

√σj√σk

= dAdB + (d3

A − dA)dBI2κ , (41)

where · now translates to an average with respect to the dis-tribution in (40). The quantity Iκ = x1/2 refers to the half-moment of this distribution. For completeness, we evaluatethe mth moment:

xm =

∫ λ+

λ−

dx

2πλxm−1

√(λ+ − x)(x− λ−)

=2

π(1 + λ)m−1

∫ 1

−1

dt

(1 +

2√λ

1 + λt

)m−1√1− t2

=

(1 +

1

κ2

)m−1

2F1

(1−m

2, 1− m

2; 2;

(2/κ

1 + 1/κ2

)2).

(42)

The variable substitution x = (λ+ + λ−)/2 + (λ+ − λ−)t/2has been introduced after the second equality in (42). We em-phasize that the last equality in (42) is valid for any real mso long as the previous t integral converges. Upon using theidentity [41]

2F1(2a, 2a+ 1− γ; γ; z) =2F1

(a, a+

1

2; γ;

4z

(1 + z)2

)(1 + z)2a

,

(43)we get xm = 2F1(1 − m,−m; 2; 1/κ2). Thereafter, thesubstitution m = 1/2 nabs us the final answer Iκ =

2F1

(1/2,−1/2; 2; 1/κ2

), so that popt

hack ≈ I2κ + (1−I2

κ)/d2A.

Moreover, we may simplify this expression further by con-sidering a moderately large κ, for which the hypergeomet-ric function has the simple second-order approximation Iκ ≈1 − 1/(8κ2). This simplification works amazingly well evenfor κ = 1—0.875 ≈ 8/(3π)—such that one might as well usethis approximation for any κ.

Now, if dB < dA, one can go through a similar line ofargument and arrive at ‖Uo‖21 = dAdB + dA(d3

B − dB)I2κ,

in which case, we get popthack ≈ κ2I2

κ + (1 − I2κ)/d2

A, whichtells us that the asymptotic optimal quantum-hacking fidelityis going to be smaller than that when dB > dA—by a factor ofκ2 to be more precise. This makes physical sense since Bob,the quantum hacker, now uses a smaller Hilbert space thanAlice.

We are now in the position to discuss the asymmetric prob-lem, where the input and output partitions of U can now bedifferent. That is, U : AB → KL, where systems AB areof dimension dAdB , and systems KL of dimension dKdL.Since unitarity implies that dAdB = dKdL, the usage of theMarcenko–Pastur law remains unchanged, with the exceptionthat we are to now consider cases where dAdK ≤ dBdL anddAdK > dBdL. The first case would again give us the fa-miliar form popt

hack ≈ I2κ + (1 − I2

κ)/(dAdK), which means

9

that the asymptotic quantum-hacking fidelity of I2κ can still be

achieved. The second case, however, leads to the expressionpopt

hack ≈ [dBdL/(dAdK)]I2κ + (1 − I2

κ)/(dAdK), which rea-sonably sets the asymptotic fidelity to [dBdL/(dAdK)]I2

κ <I2κ. Obviously, both expressions revert to those in the symmet-

ric problem when dA = dK and dB = dL.

Finally, we look at what happens when a third party, Char-lie, is also using the quantum computer alongside Alice andBob. If Bob is still only concerned with Alice’s data, then thehacking fidelity is

phack = | 〈Ψ′|RBB′UABC |Ψ〉 |2 , (44)

where |Ψ〉 = |ψ〉AA′ |φ〉BB′ |ψ〉CC′ and |Ψ′〉 =|ψ〉AB |ψ〉A′B′ |ψ〉CC′ . Descriptively, Charlie’s output stateof UABC , after injecting a maximally entangled input state|ψ〉 〈ψ|CC′ with his other ancillary system C ′, should be un-affected by Bob’s action. If the dimensions of C and C ′ areequal to d0, one immediately finds that

〈ψ|CC′ UABC |ψ〉CC′ =1

d0TrC U (45)

for anyUABC = U . Suppose thatU is someDd0-dimensionalunitary operator. In order to calculate the Haar average popt

hack,we would then require the understanding of the matrix ele-ments of TrC U/d0:

1

d0TrC U =

1

d0

D−1∑j,k=0

|j〉d0−1∑l=0

U jlkl 〈k| , (46)

where U jklm are the matrix elements of U in the product com-putational basis, and the dimension of |j〉 is D. It is easy to

see that∑l U

jlkl = 0 and∑

l

U jlkl

∑l′

U∗j′l′

k′l′ = δj,j′δk,k′∑l

|U jlkl |2

=δj,j′δk,k′

Dd0

∑l

1 =δj,j′δk,k′

D. (47)

This shows that the important moment averages of TrC U areindependent of d0, such that the only modification of the re-spective optimal hacking fidelities in both the symmetric andasymmetric problems is solely an extra multiplicative factorof 1/d2

0.

[1] B. Yurke and J. S. Denker, Quantum network theory, PhysicalReview A 29, 1419 (1984).

[2] C. Elliott, Building the quantum network, New Journal ofPhysics 4, 46 (2002).

[3] C. Simon, Towards a global quantum network, Nature Photon-ics 11, 678 (2017).

[4] H. J. Kimble, The quantum internet, Nature 453, 1023 (2008).[5] S. Wehner, D. Elkouss, and R. Hanson, Quantum internet: A

vision for the road ahead, Science 362 (2018).[6] S. Pirandola and S. L. Braunstein, Physics: Unite to build a

quantum internet, Nature News 532, 169 (2016).[7] M. Caleffi, A. S. Cacciapuoti, and G. Bianchi, Quantum in-

ternet: From communication to distributed computing!, inProceedings of the 5th ACM International Conference onNanoscale Computing and Communication (2018) pp. 1–4.

[8] D. Castelvecchi, The quantum internet has arrived (and ithasn’t), Nature 554 (2018).

[9] Y. Sekino and L. Susskind, Fast scramblers, Journal of HighEnergy Physics 2008, 065 (2008).

[10] P. Hosur, X.-L. Qi, D. A. Roberts, and B. Yoshida, Chaos inquantum channels, Journal of High Energy Physics 2016, 4(2016).

[11] M. S. Blok, V. V. Ramasesh, T. Schuster, K. O’Brien, J. M.Kreikebaum, D. Dahlen, A. Morvan, B. Yoshida, N. Y. Yao,and I. Siddiqi, Quantum information scrambling on a supercon-ducting qutrit processor, Phys. Rev. X 11, 021010 (2021).

[12] D. N. Page, Black hole information, in Proceedings of the 5thCanadian conference on general relativity and relativistic as-trophysics, Vol. 1 (World Scientific, 1994) pp. 1–41.

[13] P. Hayden and J. Preskill, Black holes as mirrors: quantuminformation in random subsystems, Journal of high energyphysics 2007, 120 (2007).

[14] N. Bao and Y. Kikuchi, Hayden-preskill decoding from noisy

hawking radiation, Journal of High Energy Physics 2021, 1(2021).

[15] Y. Cheng, C. Liu, J. Guo, Y. Chen, P. Zhang, and H. Zhai, Real-izing the hayden-preskill protocol with coupled dicke models,Physical Review Research 2, 043024 (2020).

[16] B. Yoshida, Firewalls vs. scrambling, Journal of High EnergyPhysics 2019, 1 (2019).

[17] B. Yoshida and A. Kitaev, Efficient decoding for the hayden-preskill protocol, arXiv preprint arXiv:1710.03363 (2017).

[18] F. Dupuis, The decoupling approach to quantum informationtheory, arXiv preprint arXiv:1004.1641 (2010).

[19] P. Boes, H. Wilming, R. Gallego, and J. Eisert, Catalytic quan-tum randomness, Physical Review X 8, 041016 (2018).

[20] H. Wilming, Entropy and reversible catalysis, arXiv preprintarXiv:2012.05573 (2020).

[21] S. H. Lie, H. Kwon, M. Kim, and H. Jeong, Unconditionally se-cure qubit commitment scheme using quantum maskers, arXivpreprint arXiv:1903.12304 (2019).

[22] S. H. Lie and H. Jeong, Randomness cost of masking quantuminformation and the information conservation law, Physical Re-view A 101, 052322 (2020).

[23] S. H. Lie and H. Jeong, Only uniform randomness can yieldquantum advantages, arXiv preprint arXiv:2010.14795 (2020).

[24] W. K. Wootters and W. H. Zurek, A single quantum cannot becloned, Nature 299, 802 (1982).

[25] J. C. Garcia-Escartin and P. Chamorro-Posada, A swap gate forqudits, Quantum information processing 12, 3625 (2013).

[26] See Supplemental Material for arguments against arbi-trary quantum-state installation, derivations of hacking-fidelitybounds, numerical optimization for quantum hacking andderivations of asymptotic optimal-hacking fidelity formulas.

[27] M. Horodecki, J. Oppenheim, and A. Winter, Partial quantuminformation, Nature 436, 673 (2005).

10

[28] M. Horodecki, P. Horodecki, and R. Horodecki, General tele-portation channel, singlet fraction, and quasidistillation, Physi-cal Review A 60, 1888 (1999).

[29] S. Montangero, Montangero, and Evenson, Introduction to Ten-sor Network Methods (Springer, 2018).

[30] J. M. Landsberg, Y. Qi, and K. Ye, On the geometry of tensornetwork states, arXiv preprint arXiv:1105.4449 (2011).

[31] K. Zyczkowski and I. Bengtsson, On duality between quantummaps and quantum states, Open systems & information dynam-ics 11, 3 (2004).

[32] J. A. Miszczak, Singular value decomposition and matrix re-orderings in quantum information theory, International Journalof Modern Physics C 22, 897 (2011).

[33] W. Bruzda, V. Cappellini, H.-J. Sommers, and K. Zyczkowski,Random quantum operations, Physics Letters A 373, 320(2009).

[34] Although R is d2B × d2B , it only acts on a d2A-dimensional sub-space Im(IB ⊗ χ)Uo to the right and (KerUo)⊥ to theleft, so that we may treat R either as a rank-d2A partial unitarymatrix or a d2A × d2B coisometry without losing generality.

[35] G. B. Lesovik, I. A. Sadovskyy, M. Suslov, A. V. Lebedev, andV. M. Vinokur, Arrow of time and its reversal on the ibm quan-tum computer, Scientific reports 9, 1 (2019).

[36] Y. S. Teo, H. Zhu, B.-G. Englert, J. Rehacek, and Z. c. v.Hradil, Quantum-state reconstruction by maximizing likelihoodand entropy, Phys. Rev. Lett. 107, 020404 (2011).

[37] Y. S. Teo, B.-G. Englert, J. Rehacek, and Z. c. v. Hradil,Adaptive schemes for incomplete quantum process tomogra-phy, Phys. Rev. A 84, 062125 (2011).

[38] D. N. Page, Average entropy of a subsystem, Phys. Rev. Lett.71, 1291 (1993).

[39] M. L. Mehta, Random Matrices (Elsevier, Amsterdam, 2004).[40] V. A. Marcenko and L. A. Pastur, Quantum mutual information

and the one-time pad, Math. USSR Sb. 1, 457 (1967).[41] Special Functions, in Table of Integrals, Series, and Products

(Eighth Edition), edited by D. Zwillinger, V. Moll, I. Grad-shteyn, and I. Ryzhik (Academic Press, Boston, 2014) eighthedition ed., pp. 1014–1059.

[42] H. Tajima and K. Saito, Symmetry hinders quantum informa-tion recovery, arXiv preprint arXiv:2103.01876 (2021).

[43] M. A. Nielsen and I. L. Chuang, Programmable quantum gatearrays, Phys. Rev. Lett. 79, 321 (1997).

[44] N. Oshita, Q. Wang, and N. Afshordi, On reflectivity of quan-tum black hole horizons, Journal of Cosmology and Astroparti-cle Physics 2020 (04), 016.

[45] Q. Wang, N. Oshita, and N. Afshordi, Echoes from quantumblack holes, Physical Review D 101, 024031 (2020).

[46] A. Uhlmann, The “transition probability” in the state space ofa-algebra, Reports on Mathematical Physics 9, 273 (1976).

[47] C. A. Fuchs and J. Van De Graaf, Cryptographic distinguisha-bility measures for quantum-mechanical states, IEEE Transac-tions on Information Theory 45, 1216 (1999).