1 Introduction

The no-cloning theorem of quantum information is the formal statement of the fact that unknown quantum states cannot be perfectly copied [1, 2]. Without this restriction one would be allowed to completely determine the quantum state of a system by measuring copies of it, even leaving the original system untouched! This theorem underlies the security of all Quantum Key Distribution (QKD) protocols, and has consequences at a technological level, imposing limitations on error correction techniques and on other tasks that involve transmission of information [3,4,5]. Despite this strong restriction, several approximate cloning machines can be constructed. That is, the production of imperfect copies is indeed allowed. In general, this is achieved by coupling the system to be cloned to an auxiliary system and applying a trace-preserving, completely positive map to the composite system [6,7,8,9,10].

Among the family of Quantum Cloning Machines (QCM), one can make a distinction between universal cloning machines (UQCM), which copy all the states with the same fidelity F, regardless of the state \(| \psi \rangle\) to be cloned, and state-dependent QCM. For qubits, the optimum UQCM can achieve a cloning fidelity F of \(5/6=0.833\) [6,7,8, 11]. UQCMs have been experimentally realized in photon stimulated emission setups [12,13,14], linear optics [15] and NMR systems [16]. State-dependent machines can be designed to perform better for those restricted input states than a UQCM.

One of the most relevant features of quantum cloning is its usefulness for eavesdropping on QKD systems over noisy quantum channels. This quantum channel is controlled by Eve, the eavesdropper, who can perform any operation allowed by quantum mechanics. By exploiting quantum cloning, Eve can keep one of the output states and send another to the legitimate receiver, Bob. Eve’s strategy is to try to get as much information as she can while producing as less disturbance in Bob’s state. For this task, an optimal quantum cloning machine is required, in the sense that for a given fidelity of the original state, the fidelities of the cloned states are maximal. Depending of the specific QKD protocol, different cloning machines can be designed for optimal fidelity. That is, a UQCM may not be optimal for the specific set of states that are involved in a particular QKD protocol, but rather a particular state-dependent QCM may perform optimally the task [17, 18].

The best-known state-dependent QCM is the so-called phase-covariant QCM. It can optimally clone states of the form \(| \psi \rangle =\frac{1}{\sqrt{2}}(| 0\rangle +e^{i\phi }| 1\rangle )\), that lie on the equator of the Bloch sphere. The phase-covariant cloning (PCC) machine has a remarkable application in quantum cryptography, since it is used in the optimal incoherent strategy for eavesdropping on the BB84 QKD protocol [19,20,21] that runs with the bases of eigenstates of \(\sigma _x\) and \(\sigma _y\). The eavesdropper on BB84 needs to gather information only on the four states \(\frac{1}{\sqrt{2}}(| 0\rangle \pm | 1\rangle )\) and \(\frac{1}{\sqrt{2}}(| 0\rangle \pm i | 1\rangle )\); however, it can be shown that the optimal solution for cloning these four states and for cloning all the states from the equator is the same [22].

The task of optimally cloning the equator of the Bloch sphere can be accomplished without ancilla [23]. This situation is usually depicted as a \(1\rightarrow 2\) cloning; a single qubit that interacts with another qubit in a blank state (Eve’s qubit), which results in a transformation on a two qubit system that makes two imperfect copies of the first qubit. The asymmetric PCC transformation on Bob and Eve’s qubit can be expressed as

$$\begin{aligned} \begin{aligned}&|0\rangle _{\text {B}}|0\rangle _{\text {E}}\rightarrow |0\rangle _{\text {B}}|0\rangle _{\text {E}}\\&|1\rangle _{\text {B}}|0\rangle _{\text {E}}\rightarrow \sqrt{1-q}|1\rangle _{\text {B}}|0 \rangle _{\text {E}}+\sqrt{q}|0\rangle _{\text {B}}|1\rangle _{\text {E}} \end{aligned} \end{aligned}$$
(1)

where \(0\le q\le 1\) controls the asymmetry of the cloning operation. Once applied to states on the equator, the reduced density matrices \(\rho _{\text {B}}\) and \(\rho _{\text {E}}\) can be obtained and the fidelities of the clones can be calculated as \(F_{\text {B}}=\langle \psi |\rho _{\text {B}}| \psi \rangle =\frac{1}{2}(1+\sqrt{1-q})\) and \(F_{\text {E}}=\langle \psi |\rho _{\text {E}}| \psi \rangle =\frac{1}{2}(1+\sqrt{q})\). Both fidelities are independent of the phase \(\phi\) of the input state and for the symmetric case in which \(q=0.5\) we obtain \(F_{\text {B}}=F_{\text {E}}=0.8536\), outperforming a UQCM. Therefore, the PCC machine allows for a higher fidelity than that of the universal cloning machine for all states on the equator of the Bloch sphere.

A relevant issue is that being not universal, a PCC machine comprises an operation that shrinks the Bloch sphere of the copied state non-uniformly towards the north pole (i.e., the \(|0\rangle\) state). As a consequence, a bias on the \(\sigma _z\) basis appears when cloning states that lie on the Bloch sphere’s equator. Such footprint can be easily detected in a QKD implementation just by adding a single projective measurement in the \(\sigma _z\) basis (for example, detecting \(|0\rangle\) states). To overcome this issue, a desirable property of a PCC machine is for it to be able to prepare clones with no bias, but with the same individual fidelity. This can be achieved by performing the transformation (1) and also its mirrored version, that is, one that shrinks the bloch sphere towards the \(|1\rangle\) state. Several experimental implementations of the PCCM have been performed in discrete variable systems, mainly using photons [24,25,26,27,28], NMR systems [29, 30], nitrogen-vacancy defect centers in diamond [31], and in continuous variable systems [32,33,34,35]. The use of mirrored PCCM has been introduced in [15, 36, 37], in the context of assuming partial knowledge about the input state.

In this work we simulate the mirrored PCC machines using two qubits encoded in the polarization and linear momentum (path) degrees of freedom of a single photon, rather than in two different photons for the two cloned outputs. The interaction is produced in a linear optics setup, via a series of displaced Sagnac polarizing interferometers. We experimentally observe that by alternating randomly between these two operations, Eve can generate a balanced mixture of cloned states and pass unnoticed the test sketched above. In spite of the fact that the polarization-path dual encoding does not produce a physical clone of the transmitted qubits, with this setup we can access to the full range of the cloning parameter q, which allows us to study optimal and non-optimal cloning conditions. The asymmetry of the clones is easily tunable by means of a waveplate rotation, without the need of custom beam splitters or imposing additional losses that reduce the overall throughput, as required in two photon experiments. Furthermore, the intrinsic stability of the displaced Sagnac interferometers does not require any active stabilization, allowing to study the PCC protocol in different regimes.

Section 2 of this work presents the experimental setup that implements the phase-covariant cloning machines, and Sect. 3 is devoted to the results obtained for different experimental conditions.

2 Photonic quantum simulator

The experimental arrangement that implements the PCC machine is shown in Fig. 1. In this scheme, Alice and Bob share a polarization-entangled photonic state. Photon pairs are generated by spontaneous parametric downconversion (SPDC) in a BBO type-I nonlinear crystal arrangement [38, 39], pumped by a 405 nm CW laser diode, polarization entanglement is optimized using temporal and spatial compensating birefringent crystals on the pump beam and on the photon pair paths. Alice’s photon is directed into a polarization analysis arrangement where she may perform projective measurements on her photon. Single-photon counting devices detect the incoming photons and send the detections to an FPGA-based coincidence counter.

2.1 Linear optics PCC implementation

In this quantum simulator, the eavesdropper is encoded on the path qubit of Bob’s photon using a displaced Sagnac interferometer based on a polarizing beam splitter (PBS) [40]. An equivalent optical setup has been implemented using calcite beam displacers in [41] to study the dynamics of multipartite entanglement. By associating the horizontal polarization component H with the state \(| 0\rangle\) and the vertical polarization V with state \(| 1\rangle\), and the eavesdropper is represented by the two path modes of the photon (0 and 1), the PCC transformation is implemented as follows: an incoming photon in mode 0 is split into its H and V components by the PBS. The vertically polarized photons are reflected and propagate inside the interferometer in the clockwise direction, passing through a half-wave plate (H1) which transforms the vertical polarization state into \(\cos (2\alpha )|V\rangle +\sin (2\alpha )|H\rangle\), where \(\alpha\) is the physical angle of the half-wave plate. The horizontal component of this rotated state exits the interferometer, transmitted into mode 1 (dashed-line in Fig. 1) with probability \(q=\sin ^{2}(2\alpha )\), while the vertical component is reflected into mode 0 with probability \(1-q=\cos ^{2}(2\alpha )\).

On the other hand, the horizontally polarized photons of the input state propagate through the interferometer in the counter-clockwise direction and exit through the PBS into mode 0, with their polarization state unchanged. In this way, we obtain the following transformation

$$\begin{aligned} \begin{aligned}&|H\rangle |0\rangle \rightarrow |H\rangle |0\rangle \\&|V\rangle |0\rangle \rightarrow \sqrt{1-q}|V\rangle |0 \rangle +\sqrt{q}|H\rangle |1\rangle , \end{aligned} \end{aligned}$$
(2)

which is a PCC transformation (1) with \(q=\sin ^{2}(2\alpha )\). A HWP oriented at \(0^{\circ }\) (H2) is placed on the H photons path to compensate for the optical path difference. The relative path length of the interferometer is adjusted so that when H1 is oriented at \(0^{\circ }\) the polarization of the input state remains unaltered.

Bob performs standard quantum state tomography (QST) of his polarization state, in coincidence with Alice’s detections, using quarter-wave plates on each path, a half-wave plate, and a third passage through the polarizing beam splitter. H polarized photons on mode 1 are rotated by a HWP oriented at \(45^{\circ }\) (H3) just before passing through the PBS. This operation recombines mode 1 into mode 0 coherently so that both modes exit the interferometer through the same path. Eve’s qubit encoded on Bob’s path photon is mapped into a polarization qubit by this operation, since photons propagating through mode 0 are horizontally polarized at the output of the PBS and photons propagating through mode 1 are vertically polarized. Therefore, Eve can also perform standard QST on her qubit using a QWP, a HWP and a PBS.

Fig. 1
figure 1

(Color online) Experimental setup for the implementation of the phase covariant cloning machine. The PCC machine is implemented using a displaced Sagnac polarization interferometer: photons enter the interferometer through a PBS, where the H and V polarization components are routed in different directions. If \(\alpha =0^{\circ }\) (H1) both polarization components are coherently recombined in the PBS and exit the interferometer in the same path. For every other angle of \(\alpha\) the V component is transformed into an H polarized photon with probability \(q=\sin ^{2}(2\alpha )\) and exits the interferometer through path mode 1, in dashed-lines. Bob may perform quantum state tomography on his polarization qubit before it exits the interferometer using a combination of QWPs and a HWP. Both paths are later coherently recombined using a HWP oriented at \(45^{\circ }\) (H3) on path 1 and pass one more time through the polarizing beam splitter. In this way, Eve’s qubit is ultimately mapped into a polarization qubit and standard quantum state tomography can be performed using another set of QWP, HWP and a PBS

Full size image

2.2 Mirrored device

We now describe how to obtain the action of a mirrored PCC operation, so that the fidelity for cloning states on the southern hemisphere is now enhanced. This transformation is implemented in the following way: for the input states \(\{| 1\rangle _{\text {B}}| 0\rangle _{\text {E}}, | 0\rangle _{\text {B}}| 0\rangle _{\text {E}}\}\) we first apply a bit-flip operation on the first qubit, followed by the PCC (1), and finally another bit-flip on the first qubit, resulting in the following transformation

$$\begin{aligned} \begin{aligned}&|1\rangle _{\text {B}}|0\rangle _{\text {E}}\rightarrow |1\rangle _{\text {B}}|0\rangle _{\text {E}}\\&|0\rangle _{\text {B}}|0\rangle _{\text {E}}\rightarrow \sqrt{1-q}|0\rangle _{\text {B}}|0\rangle _{\text {E}}+\sqrt{q}|1\rangle _{\text {B}}|1\rangle _{\text {E}} \end{aligned} \end{aligned}$$
(3)

where again \(0\le q\le 1\) controls the asymmetry of the cloning operation. It is easy to see that for states on the equator the fidelities of the clones are once again \(F_{\text {B}}=\langle \psi |\rho _{\text {B}}| \psi \rangle =\frac{1}{2}(1+\sqrt{1-q})\) and \(F_{\text {E}}=\langle \psi |\rho _{\text {E}}| \psi \rangle =\frac{1}{2}(1+\sqrt{q})\), independent of the phase \(\phi\) of the input state. This operation shrinks the Bloch sphere of the copied state towards the state \(| 1\rangle\). By applying randomly these two mirrored operations, Eve can clone the equatorial states with optimized fidelity, while adding no bias on \(\sigma _z\).

Interestingly, the mirrored operation can be easily implemented with the same setup by simply rotating half-wave plate H2 instead of H1, which in turn remains fixed at \(0^{\circ }\). In this case, the horizontally polarized photons passing through half-wave plate H2 are transformed into \(\cos (2\alpha ')|H\rangle +\sin (2\alpha ')|V\rangle\), where \(\alpha '\) is the physical angle of the half-wave plate and we obtain

$$\begin{aligned} \begin{aligned}&|V\rangle |0\rangle \rightarrow |V\rangle |0\rangle \\&|H\rangle |0\rangle \rightarrow \sqrt{1-q}|H\rangle |0\rangle +\sqrt{q}|V\rangle |1\rangle , \end{aligned} \end{aligned}$$
(4)

which is equivalent to the mirrored-PCC operation (3) with \(q=\sin ^{2}(2\alpha ')\). Throughout the rest of the text we will refer to the machines described in (2) and (4) as PCC(+) and PCC(−), respectively.

The action of these mirrored PCC machines can indeed be implemented in two photon experiments, where typically both qubits are encoded on the polarization degree of freedom of two different photons by simply adding half-wave plates before and after the cloning operation, on the signal’s qubit path. When rotated at \(45^{\circ }\), these HWPs essentially perform a bit-flip operation on the signal qubit, which allows for the mirrored PCC to be implemented as described above. Nevertheless, these experimental implementations require more complicated setups, have low throughput due to multiple coincidence requirements [25, 42], and they are less suited to serve as testbeds for different conditions of the cloning protocol.

3 Results

With this experimental setup we can prepare and measure an arbitrary qubit state, and control the asymmetry of the cloning operation by simply rotating half-wave plate H1 (or H2). We tested the action of the PCC machines for different experimental conditions: we projected different polarization states on Alice’s qubit and performed quantum state tomography on Bob and Eve’s qubits. In this way, we obtained the density matrix of both clones and calculated the fidelities for different states and cloning parameters.

3.1 Equatorial states

Figure 2 shows the theoretical curves and the experimentally measured fidelities for both Bob and Eve’s qubits while Alice’s qubit is projected onto state \(| D\rangle \langle D|\), for different values of the cloning parameter q and for both PCC(+) and PCC(−). The shaded areas represent the experimental error, calculated as the standard deviation of the fidelity values obtained for repeated measurements. As the cloning parameter increases, Bob’s fidelity decays to its minimum value F=0.5, while Eve’s fidelity achieves its maximum when q=1. The experimental data shows a good agreement with the theoretical predictions. The fidelity of both cloning machines show the same behavior as a function of the cloning parameter.

Fig. 2
figure 2

(Color online) Fidelity of the clones with respect to the original state \(| D\rangle\), for different cloning parameters q, for both PCC (+) and its mirrored operation (−). Filled lines represent the theoretical prediction and the different symbols the experimental data. The shaded area around the theoretical curve accounts for the experimental error

Full size image

A PCC machine clones equally well all states from the equator of the Bloch sphere: by projecting different states on the equator on Alice’s side for a particular cloning parameter (q=0.4), we obtained the results shown on Fig. 3. The theoretical curves are obtained calculating the fidelity between the ideal equatorial states and the states resulting from projection and cloning processes, applied to the experimentally available input state. Both fidelities for Bob and Eve remain almost constant within the experimental error (represented by the shaded region), as expected. That is, for states of the form \(| \psi \rangle =\frac{1}{\sqrt{2}}(| 0\rangle +e^{i\phi }| 1\rangle )\) the fidelity of the clones is independent of the phase \(\phi\), excluding experimental limitations. This particular election of the cloning parameter produces unbalanced fidelities for the two clones.

Fig. 3
figure 3

(Color online) Fidelity of the clones for different states on the equator, characterized by the phase \(\phi\), for q=0.4. The theoretical predictions were calculated numerically based on the entangled input state. The experimental fidelity is shown in black circles for Bob’s qubit and blue squares for Eve’s. The shaded area represents the experimental error

Full size image

3.2 Non-equatorial states

Finally, we projected different states of the form \(| \psi \rangle =\cos (2\theta )| H\rangle +\sin (2\theta )| V\rangle\) on Alice’s qubit and reconstructed the density matrix for both Bob and Eve’s qubits, for q=0.5. Figure 4 shows the calculated fidelities for both clones, performing the traditional PCC (black line) and its mirrored operation (blue line). The different symbols represent the experimental data for both operations. Once again, there is a good agreement between the experimental data and the theoretical predictions: PCC(+) clones the state \(| H\rangle\) with maximum fidelity (\(F=1\)) and state \(| V\rangle\) with the minimum possible fidelity (\(F=0.5\)), while the PCC(−) operates in the exact opposite way. Both pairs of curves cross at the balanced superposition state, \(\theta =\pi /8\), recovering the symmetric cloning condition with a measured fidelity of \(0.852\pm 0.005\).

Fig. 4
figure 4

(Color online) Fidelity of the clones for different states of the form \(\cos (2\theta )| H\rangle +\sin (2\theta )| V\rangle\), for \(q=0.5\). Theoretical curves for the PCC(+) (black line) and PCC(−) operation (blue line) are shown. The different symbols plot the experimental data for both operations and the shaded area represents the experimental error

Full size image

3.3 Eavesdropping with PCC

The security limit for the BB84 protocol against incoherent attacks arises from situations where Eve uses a PCC machine [19]. This kind of attack can be easily identified if Bob performs measurements on \(\sigma _{z}\) (or at least he can project the qubits in one of the two states of the basis), because a side effect of this attack is a bias in the value of \(\sigma _{z}\) of the ensemble of received states with respect to the original emitted states (\(\sigma _{z}=0\)). For a PCC attack the bias in terms of the cloning parameter q is: \(\langle \sigma _{z}\rangle =q\).

Such procedure comprises a minor modification to the standard BB84 protocol, given that it can be performed regardless of the states prepared by Alice, and without the need of further classical communication between the parties. In this way, it can be thought of as an intermediate stage protocol; by evidencing the presence of an eavesdropper, they can eventually devise a suitable strategy to avoid it.

Nevertheless, the track left by Eve can be erased if she uses a slightly different strategy, that consists on alternating randomly between PCC(+) and PCC(−), thus sending Bob ensembles of cloned states with no bias in \(\sigma _z\), but with the same individual fidelity. It should be noted that this strategy does not enable Eve to extract more information than she would have obtained by simply using one of the PCC machines. Figure 5 shows the effect on the \(\sigma _z\) mean value for different cloning parameters q under the action of PPC(+) and the strategy proposed above, while the first protocol adds an increasing bias on the computational basis measurement for increasing values of q, the second strategy leaves the z component unbiased, for any strength of the cloning parameter. It can be seen that the experimental implementation of these eavesdropping strategies clearly show the described behaviors.

Fig. 5
figure 5

(Color online) Mean value of the \(\sigma _z\) component of Bob’s reconstructed density matrix for different cloning parameters q. The black line and circles correspond to PCC(+) while the blue line and squares represent the averaged values of \(\sigma _z\) for an unbiased sequence of PCC(+) and PCC(−) implementations. The shaded area around the theoretical curves accounts for the experimental error

Full size image

4 Conclusions

We have presented the results of a photonic realization of a protocol that fully simulates a phase-covariant cloning machine, where Alice and Bob share a polarization entangled state, while the eavesdropper is encoded on Bob’s path qubit. The cloning algorithm is implemented by means of a displaced Sagnac interferometer and retardation waveplates. The versatility of the experimental setup allows us to prepare and measure an arbitrary qubit state, and easily control the asymmetry of the cloning operation in its two mirrored designs. We tested the action of the PCCM and its mirrored version for different experimental conditions, by projecting different polarization states on Alice’s qubit, and performing quantum state tomography on Bob and Eve’s qubits.

Regarding an eavesdropping scenario where Eve uses a PCC machine, output states are left unbalanced in the \(\sigma _z\) basis after the cloning procedure and could therefore be detected by Bob just by adding a single projective measurement in the \(\sigma _z\) basis. We showed that by alternating between both cloning operations PCC(+) and PCC(−), Eve can mask her presence by sending Bob cloned states with no bias in \(\sigma _z\) but with the same individual fidelity.