Lecture Notes

Quantum Cryptography Week 2: The Power of Entanglement

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Licence.
 Contents

2.1 Entanglement 3
2.2 Purifications 5
2.2.1 The Schmidt decomposition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2.2 Uhlmann’s theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Secret sharing 7
2.4 Bell-Nonlocality 9
2.4.1 Example of a non-local game: CHSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4.2 Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5 The monogamy of entanglement 12
2.5.1 Quantifying monogamy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.2 A three-player CHSH game . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
 2.1 Entanglement 3

We already encountered quantum entanglement in the form of the EPR pair |EPRi = √1 |00i +
2
√1 |11i. This week we will define entanglement more formally and explore some of the reasons
2
that make it such an interesting topic in quantum information. To wet your appetite, let it already
be said that in later weeks we will see that entanglement allows us to guarantee the security of
communications based only on the laws of nature. We also know that entanglement is a necessary
ingredient in the most impressive quantum algorithms, such as Shor’s algorithm for factoring, and
for quantum error correction.

2.1 Entanglement
If we combine two qubits A and B, each of which is in a pure state, the joint state of the two qubits
is given by

|ψiAB = |ψ1 iA ⊗ |ψ2 iB . (2.1)

Any two-qubit state that is either directly of this form, or is a mixture of states of this form, is called
separable. Entangled state are states which are not separable. In other words, a pure state |ψi is
entangled if and only if

|ψi 6= |ψ1 i ⊗ |ψ2 i , (2.2)

for any possible choice of |ψ1 i and |ψ2 i. A mixed state ρ is entangled if and only if it cannot be
written as a convex combination of pure product states of the form in Eq. (2.1).
 Example 2.1.1 An example of an entangled state of two qubits is the EPR pair

1
|EPRiAB = √ (|00iAB + |11iAB ) . (2.3)
2
When we learn more about entanglement later on, we will see that this state is, in a precise sense,
the “most entangled” state of two qubits. The EPR pair is thus often referred to as a maximally
entangled state. (There are other two-qubit states which are different from the EPR pair but have
just about the same “amount” of entanglement; we will learn about these other maximally entangled
states later.) 

We have already seen that the EPR pair has the special property that it can be written in many
symmetric ways. For instance, in the Hadamard basis
1
√ (| + +iAB + | − −iAB ) . (2.4)
2
Thus measurements of both qubits in the standard basis, or the Hadamard basis, always produce the
same outcome. In a few weeks we will see that this property can even be used to characterize the
EPR pair: it is the only two-qubit state having this property!

Exercise 2.1.1 Suppose that ρAB is a two-qubit separable state. Show that if a measurement of
both qubits of ρAB in the standard basis always yields the same outcome, then a measurement
of both qubits in the Hadamard basis necessarily has non-zero probability of giving different
outcomes. Deduce a proof that the EPR pair (2.3) is not a separable state. 

Entanglement has another interesting property which we will see later, called “monogamy”.
Monogamy states that if two systems are maximally entangled with each other then they cannot
have any entanglement with any other system: equivalently, they must be in tensor product with the
remainder of the universe.
4

 Example 2.1.2 Consider the state

1
|ψiAB = √ (|01iAB + |11iAB ) . (2.5)
2
In contrast to the EPR pair in Example 2.1.1 this state is not entangled, since |ψiAB = √12 (|0iA + |1iA )⊗
|1iB = |+iA ⊗ |1iB . 

Definition 2.1.1 — Entanglement. Consider two quantum systems A and B. The joint state
ρAB is separable if there exists a probability distribution {pi }i , and sets of density matrices
{ρiA }i , {ρiB }i such that

ρAB = ∑ pi ρiA ⊗ ρiB . (2.6)

i

If there exists no such decomposition ρAB is called entangled.

If ρAB = |ΨihΨ|AB is a pure state, then |ΨiAB is separable if and only if there exists |ψiA , |ψiB
such that

|ΨiAB = |ψiA ⊗ |ψiB . (2.7)

 Example 2.1.3 Consider the density matrix

1 1
ρAB = |0ih0|A ⊗ |1ih1|B + |+ih+|A ⊗ |−ih−|B . (2.8)
2 2
Such a state is in the form of Eq. (2.6), so it is not entangled: it is separable. Note that this does
not imply that the systems A and B are necessarily independent: here they are correlated, but not
entangled. (We would typically say that they are “classically correlated”.) 

Q
 Example 2.1.4 Any cq-state, i.e. a state of the form ρXQ = ∑i pi |xihx|X ⊗ ρx , is separable. 

It is important to make the distinction between the two states

1 1
ρAB = |0ih0|A ⊗ |0ih0|B + |1ih1|A ⊗ |1ih1|B and σAB = |EPRihEPR|AB . (2.9)
2 2
For the state ρAB , if A is measured in the standard basis then whenever |0iA is observed the state on
B is |0iB ; likewise when |1iA is observed, the state on B is |1iB . This is also true for σAB . However,
consider measuring system A of ρAB in the Hadamard basis. The corresponding measurement
operators are |+ih+|A ⊗ IB , |−ih−|A ⊗ IB . The post-measurement state conditioned on obtaining
the outcome |+iA is then
AB (|+ih+|A ⊗ IB )ρAB (|+ih+|A ⊗ IB )
ρ|+ = (2.10)
A
tr((|+ih+|A ⊗ IB )ρAB )
 
11 11
= 2· |+ih+|A ⊗ |0ih0|B + |+ih+|A ⊗ |1ih1|B (2.11)
22 22
IB
= |+ih+|A ⊗ , (2.12)
2
and we see that the reduced state on B, ρ|+B = IB is maximally mixed. In contrast, using that the
A 2
state |EPRiAB can be rewritten as
1 1
|EPRiAB = √ (|00iAB + |11iAB ) = √ (| + +iAB + | − −iAB ), (2.13)
2 2
when σAB is measured with respect to the Hadamard basis on system A, conditioned on the outcome
B = |+ih+| . In particular this state is pure: it is very different
|+iA , the reduced state on B is σ|+A
B
from the totally mixed state we obtained by performing the same experiment on ρAB . This is a
sense in which the correlations in σAB are stronger than those in ρAB .
 2.2 Purifications 5

2.2 Purifications
Last week we learned about the partial trace operation, which provides a way to describe the state
of a subsystem when given a description of the state on a larger composite system. Even if the state
of the larger system is pure, the reduced state can sometimes be mixed, and this is a signature of
entanglement in the larger state.
Is it possible to reverse this process? Suppose given a density matrix ρA describing a quantum
state on system A. Is it always possible to find a pure state ρAB = |ΨihΨ|AB such that trB (ρAB ) = ρA ?
Such a state is called a purification of ρA .
Definition 2.2.1 — Purification. Given any density matrix ρA , a pure state |ΨAB i is a purifica-
tion of A if trB (|ΨihΨ|AB ) = ρA .

Let’s see how an arbitrary density matrix ρA can be purified. As a first step, diagonalize ρA ,
expressing it as a mixture
dA
ρA = ∑ λ j |φ j ihφ j | , (2.14)
j=1

where λ j are the (necessarily non-negative) eigenvalues of ρA and |φ j i the eigenstates. Since ρA
is a density matrix the λ j are non-negative and sum to 1. We’ve seen an interpretation of density
matrices before: here we would say that ρA describes a quantum system that is in a probabilistic
mixture of being in state |φ j i with probability λ j . But who “controls” which part of the mixture A
is in?
Let’s introduce an imaginary system B which achieves just this. Let {| jiB } j∈{1,...,dB } be the
standard basis for a system B of dimension dB = dA , and consider the pure state
dA
q
|ΨiAB = ∑ λ j |φ j iA ⊗ | jiB , (2.15)
j=1

where {| jiB } j is the standard basis on system B. Suppose we were to measure the B system of |ΨiAB
in the standard basis. We know what would happen: we will obtain outcome j with probability
hΨ|AB M j |ΨiAB , where M j = IA ⊗ | jih j|B , and a short calculation will convince you this equals λ j .
Since we’re using a projective measurement, we can describe the post-measurement state easily as
being proportional to M j |ΨihΨ|AB M j , and looking at the A system only we find that it is |φ j ihφ j |A .
To summarize, a measurement of system B gives outcome j with probability λ j , and the post-
measurement state on A is precisely |φ j ihφ j |. This implies that TrB (|ΨihΨ|AB ) = ρA , a fact which
can be verified directly using the mathematical definition of the partial trace operation.
Are purifications unique? You’ll notice that in the above construction we made the choice of
the standard basis for system B, but any other basis would have worked just as well. So it seems
like we at least have a choice of basis on system B: there is a “unitary degree of freedom”. To see
that this is the only freedom that we have in choosing a purification, we first need to learn about a
very convenient representation of bipartite pure states, the Schmidt decomposition.

2.2.1 The Schmidt decomposition

The purification that we constructed in (2.15) has a special form: it is expressed as a sum, with
non-negative coefficients whose squares sum to 1, of tensor products of basis states for the A and B
systems respectively. As we saw, this particular form is convenient because it lets us compute the
reduced states in A and B very easily. Unfortunately, not every state is always given in this way: for
example, if we write |ΨiAB = √12 (|0iA |0iB + |+iA |1iB ) then the two states |0iA , |+iA on A are not
orthogonal. But maybe the same state can be written in a more convenient form? The answer is yes,
and it is given by the Schmidt decomposition.
6

Theorem 2.2.1 — Schmidt decomposition. Consider quantum systems A and B with dimen-
sions dA , dB respectively, and let d = min(dA , dB ). Any pure bipartite state |ΨiAB has a Schmidt
decomposition
d p
|ΨiAB = ∑ λi |ui iA |vi iB , (2.16)
i=1
√
where λi ≥ 0 and {|ui iA }i , {|vi iB }i are orthonormal vector sets. The coefficients λi are called
the Schmidt coefficients and |ui iA , |vi iB the Schmidt vectors.

We discussed the proof of the theorem in the video module; you can also find a detailed proof in
Section 2.5 of [NC01]. The main idea is to start by expressing |ΨiAB = ∑ j,k α j,k | jiA |kiB using the
standard bases of A and B, and then √ write the singular value decomposition of the dA × dB matrix
with coefficients α j,k to recover the λi (the singular values) and the |ui iA (the left eigenvectors)
and the |vi iB (the right eigenvectors).
The Schmidt decomposition has many interesting consequences. A first consequence is that it
provides a simple recipe for computing the reduced density matrices: given a state of the form (2.16),
we immediately get ρA = ∑i λi |ui ihui |A , and ρB = ∑i λi |vi ihvi |B . An important observation is that
ρA and ρB have the same eigenvalues, which are precisely the squares of the Schmidt coefficients.
As a consequence, given any two density matrices ρA and ρB , there exists a pure bipartite state
|ΨiAB such that ρA = TrB (|ΨihΨ|AB ) and ρB = TrA (|ΨihΨ|AB ) if and only if ρA and ρB have the
same spectrum! Without the Schmidt decomposition this is not at all an obvious fact to prove.
The same observation also implies that the Schmidt coefficients are uniquely defined: they are
the square roots of the eigenvalues of the reduced density matrix. The Schmidt vectors are also
unique, up to degeneracy and choice of phase: if an eigenvalue has an associated eigenspace of
dimension 1 only then the associated Schmidt vector must be the corresponding eigenvector. If
the eigenspace has dimension more than 1 we can choose as Schmidt vectors any basis for the
subspace. And note that in (2.16) we can always multiply |ui i by eiθi , and |vi i by e−iθi , so there is a
phase degree of freedom.
Another important consequence of the Schmidt decomposition is that it provides us with a way
to measure entanglement between the A and B systems in a pure state |ΨAB i. A pfirst, rather rough
but convenient such measure is given by the number of non-zero coefficients λ j . This measure
is the so-called Schmidt rank. If the Schmidt rank is 1 then the state is a product state, and if it is
strictly larger than 1 then the state is entangled.
Definition 2.2.2
√ — Schmidt rank. For any bipartite pure state with Schmidt decomposition
d
|Ψi
√ AB = ∑i=1 λi |ai iA |bi iB , the Schmidt rank is defined as the number of non-zero coefficients
λi . It is also equal to rank(ρA ) and rank(ρB ).

The Schmidt coefficients provide a finer way to measure entanglement than the Schmidt rank. A
natural measure, called “entropy of entanglement”, consists in taking the entropy of the distribution
specified by the squares of the coefficients. If the entropy is 0 then there is only a single coefficient
equal to 1, and the state is not entangled. But as soon as the entropy is positive the state is entangled.
This measure is finer than the Schmidt rank. For example, it distinguishes the entanglement in the
two states

1 1 √ √
|Ψi = √ |00i + √ |11i and |φ i = 1 − ε|00i + ε|11i.
2 2

For small 0 < ε < 1/2 both states have the same Schmidt rank, but the first one has entanglement
entropy 1 whereas the second has entanglement entropy H(ε) (where H is the binary entropy
 2.3 Secret sharing 7

function) going to 0 as ε → 0. This is the reason why we call the EPR pair “maximally entangled”:
its entanglement entropy is maximal among all two-qubit states.

2.2.2 Uhlmann’s theorem

Let’s return to the topic of the freedom in choosing purifications of a density matrix. We saw
that we at least had a unitary degree of freedom by choosing a basis on the purifying system B.
Uhlmann’s theorem states that this is precisely the only freedom we have.

Theorem 2.2.2 — Uhlmann’s theorem. Suppose given a density matrix ρA and a purification
of A given by |ΨiAB . Then another state |ΦiAB is also a purification of A if and only if there
exists a unitary UB such that

|ΦiAB = IA ⊗UB |ψiAB . (2.17)

We already saw a proof of the “if” part of the theorem. To show the converse, i.e. that two
purifications must always be related by a unitary, consider the Schmidt decomposition:
p
|ΦiAB = ∑ λi |ui iA |vi iB ,
i
√
|ΨiAB = ∑ µi |wi iA |zi iB .
i

As we know the λi are uniquely defined: they are the eigenvalues of ρA . So if |ΦiAB and |ΨiAB
are both purifications of the same ρA , we must have λi = µi . Now suppose for simplicity that
all eigenvalues are non-degenerate. Then the |ui iA are also uniquely determined: they are the
eigenvectors of ρA associated to the λi . Therefore |ui iA = |wi iA as well! Thus we see that the
only choice we have left are the |vi iB , or |zi iB : since the density matrix ρB of the purification
is not specified a priori, we may choose any orthonormal basis of the B system. Since any two
orthonormal bases of the same space are related by a unitary matrix, this choice of basis is precisely
the degree of freedom that is guaranteed by Uhlmann’s theorem.

2.3 Secret sharing

Let’s discuss a cryptographic application of the notions we just introduced. The application is
called secret sharing. Imagine a country owns nuclear weapons yet wants to make sure that both
the queen (Alice) and king (Bob) have to come together to activate them. One solution would be to
give half of the launch codes s = (s1 , . . . , s` ) ∈ {0, 1}` to Alice, and the other half to Bob, thereby
making sure that they both need to reveal their share of the information in order for the weapons
to be activated. A drawback of this scheme is that each of them does have significant information
about the launch codes, namely half of the bits. And what if there is only one bit? (Although that
wouldn’t be very secure, would it...)
The goal in a secret sharing scheme is to divide the information s into shares in such a way that
any unauthorized set of parties (in the example, Alice or Bob alone) cannot learn anything at all
about the secret. Remembering the idea behind the one-time pad, a much better scheme would be
to choose a random string r ∈ {0, 1}` and give r to Alice and r ⊕ s to Bob. In this case neither Alice
nor Bob individually has any information about s; their respective secrets appear uniformly random.
Yet when they come together they can easily recover s!
From the example above we see that given a random classical bit one can construct a secret
sharing scheme between Alice and Bob that shares a single secret bit s. However they can do better
if they are each given a qubit instead. Consider the case that Alice and Bob are given one of the
8

following four states at random:

1 1
|ψ00 iAB = √ (|00iAB + |11iAB ), |ψ01 iAB = √ (|00iAB − |11iAB ), (2.18)
2 2
1 1
|ψ10 iAB = √ (|01iAB + |10iAB ), |ψ11 iAB = √ (|01iAB − |10iAB ). (2.19)
2 2

These states are called the Bell states. Observe that they are orthonormal and thus form a basis of
C2 ⊗ C2 . We’ve already calculated the reduced density on Alice’s system of one of those states, the
EPR pair |ψ00 iAB :

A
ρ00 = trB (|ψ00 ihψ00 |AB )
1
= |0ih0|A trB (|0ih0|B ) + |0ih1|A trB (|0ih1|B )
2

+ |1ih0|A trB (|1ih0|B ) + |1ih1|A trB (|1ih1|B )
1 IA
= (|0ih0|A + |1ih1|A ) = .
2 2

Calculating the reduced states on either A or B for each each of these states always gives the same
result,

A A A A I
ρ00 = ρ01 = ρ10 = ρ11 = , (2.20)
2
B B B B I
ρ00 = ρ01 = ρ10 = ρ11 = . (2.21)
2

We know what this means: since the reduced state on each subsystem is maximally mixed, neither
Alice nor Bob can gain any information on which of the states |ψ00 iAB , |ψ01 iAB , |ψ10 iAB , |ψ11 iAB
they have one qubit of! However, due to the fact that these states together form a basis, when Alice
and Bob come together they can perform a measurement in that basis that perfectly distinguishes
which state they have, yielding two bits of information.

Exercise 2.3.1 Suppose there are now three parties, Alice, Bob and Charlie (the prime minister
is also given a share of the nuclear codes!). Give a secret sharing scheme, based on a tripartite
entangled state, such that no individual party has any information about the secret but the three
of them together are able to recover the secret. Better: can you give a scheme such that no two
of them has any information about the secret. Different: give a scheme such that no individual
has any information about the secret, but any group of two can recover it. 

Application: Superdense coding

A different application of the usefulness of entanglement is to superdense coding. The task in dense
coding consists in sending classical bits of information from Alice to Bob by encoding them in
a quantum state that is as small as possible. Let’s see how using entanglement we can send two
classical bits using a single qubit.
Suppose Alice and Bob share the state |ψ00 iAB = √12 (|00iAB + |11iAB ), and that Alice performs
a unitary on her qubit as indicated in Table 2.1, depending on which bits ab ∈ {00, 01, 10, 11} she
wants to send to Bob.
As we already saw, the four states on the right-hand side in Table 2.1 form the Bell basis, and
in particular they are perfectly distinguishable. Hence if Alice sends her qubit over to Bob, he can
perform a measurement in the Bell basis and recover both of Alice’s classical bits.
 2.4 Bell-Nonlocality 9

Classical information a, b Unitary XAa ZAb Final joint state

00 IA √1 (|00iAB + |11iAB )
2

01 XA √1 (|10iAB + |01iAB )
2

10 ZA √1 (|00iAB − |11iAB )
2

11 −XA ZA √1 (|01iAB − |10iAB )

2

Table 2.1: Unitary operation performed by Alice in order to encode her two classical bits ab ∈
{0, 1}2 .

2.4 Bell-Nonlocality
Entanglement has many counter-intuitive properties, many of which we will discover during the
course of this lecture series. A very important one is that it allows correlations between two
particles — two qubits — that cannot be replicated classically. The very first example of such
correlations was demonstrated in [Bel64], where Bell proved that the predictions of quantum theory
are incompatible with those of any classical theory satisfying a natural notion of locality.
The modern way to understand Bell non-locality is by means of so-called non-local games
(see [Bru+14] for a detailed review on Bell non-locality). Let’s imagine that we play a game with
two players, which we’ll again call Alice and Bob. Alice has a system A, and Bob has some system
B. In this game, we will ask Alice and Bob questions, and collect answers. Let us denote the
possible questions to Alice and Bob x and y, and label the answers a and b. We will play this
game many times, and in each round choose the questions to ask with some probability p(xy). As
you might have guessed our little game has some rules. We denote these rules using a predicate
V (a, b|x, y), which takes the value “1” if a and b are winning answers for questions x and y. To be
fair, Alice and Bob know the rules of the game given by V (a, b|x, y), and also the distribution p(xy).
They can agree on any strategy before the game starts. However, once we start asking questions
they are no longer allowed to communicate. Of interest to us will be the probability that Alice and
Bob win the game, maximized over all possible strategies. That is,

pwin = max ∑ p(x, y) ∑ V (a, b|x, y) p(a, b|x, y) , (2.22)

strategy x,y
a,b

where p(a, b|x, y) is the probability that Alice and Bob produce answers a and b given x and y
according to their chosen strategy.
What are these strategies? In a classical world, Alice and Bob can only have a classical strategy.
A deterministic classical strategy is simply given by functions fA (x) = a and fB (y) = b that take
the questions x and y to answers a and b. We then have p(a, b|x, y) = 1 whenever a = fA (x) and
b = fB (y), and p(a, b|x, y) = 0 otherwise. Possibly, Alice and Bob also use shared randomness. That
is, they have another string r, which they share with probability p(r). In physics, r is also referred
to as a hidden variable, but we will take the more operational viewpoint of shared randomness.
In a strategy using shared randomness r, classical Alice and Bob can however still only apply
functions: a = fA (x, r) and b = fB (y, r). In terms of the probabilities we then have p(a, b|x, y, r) = 1
if a = fA (x, r) and b = fB (y, r) and p(a, b|x, y, r) = 0 otherwise. This gives

p(a, b|x, y) = ∑ p(r)p(a, b|x, y, r) . (2.23)

r

Does shared randomness help Alice and Bob? Note that for a classical strategy based on shared
 10

randomness we have
pwin = max ∑ p(x, y) ∑ V (a, b|x, y) ∑ p(r)p(a, b|x, y, r) (2.24)
class.strat. x,y a,b r
 
= max ∑ p(r) ∑ p(x, y) ∑ V (a, b|x, y) p(a, b|x, y, r) . (2.25)
class.strat. r x,y a,b

Note that the quantity in brackets is largest for some particular value(s) of r. Since Alice and
Bob want to maximize their winning probability, they can thus fix the best possible r giving a
deterministic strategy a = fA (x, r) and b = fA (y, r) where r is now fixed.
Why would we care about this at all? It turns out that for many games, a quantum strategy
can achieve a higher winning probability. This is of fundamental importance for our understand-
ing of nature. What’s more, however, observing a higher winning probability is a signature of
entanglement: quantumly, Alice and Bob can achieve a higher winning probability only if they are
entangled, making such games into tests for entanglement. Testing whether the stated shared by
Alice and Bob is entangled forms a crucial element in quantum key distribution, as we will see in
later weeks.
Specifically, a quantum strategy means that Alice and Bob can pick a state ρAB to share, and
agree on measurements to perform depending on their respective questions. That is, x and y will
label a choice of measurement, and a and b are the outcomes of that measurement.

x y

a b
Figure 2.1: A non-local game. Alice and Bob are given questions x and y, and must return answers
a and b. If Alice and Bob are quantum, then x and y label measurement settings and a and b are
measurement outcomes.

2.4.1 Example of a non-local game: CHSH

Let us have a look at a very simple game based on the famous CHSH inequality. It will turn out to
be extremely useful for quantum cryptography. At the start of the game, we send two bits x and y to
Alice and Bob respectively, where we choose x with uniform probabilities p(x = 0) = p(x = 1) =
1/2 and y with probabilities p(y = 0) = p(y = 1) = 1/2. In turn, Alice and Bob will return answer
bits a and b. Alice and Bob win the game if and only if
x·y = a+b mod 2 . (2.26)
In terms of the predicate V (a, b|x, y) this means that V (a, b|x, y) = 1 if x · y = a + b mod 2 and
V (a, b|x, y) = 0 otherwise. We are interested in the probability that Alice and Bob win the game.
This probability can be written as
1
pCHSH
win = ∑ ∑ p(a, b|x, y) , (2.27)
4 x,y∈{0,1} a,b
a+b mod 2=x·y
2.4 Bell-Nonlocality 11

where p(a, b|x, y) is the probability that Alice and Bob answer a and b given questions x and y.
What can Alice and Bob do to win this game?
Classical winning probability
Classically, a is simply a function of x. For example, if x = 0, then Alice and Bob could agree as
part of their strategy that Alice will then always answer a = 0. We see that as long as x = 0 or y = 0,
then x · y = 0. In this case, Alice and Bob want to achieve a + b mod 2 = 0. However, if x = y = 1
then they would like to give answers such that a + b mod 2 = 1. What makes this difficult for
Alice and Bob is that they cannot communicate during the game. This means in particular that
Alice’s answer a can only depend on x (but not on y) and similarly Bob’s answer b can only depend
on y (but not on x).
It it not difficult to see (you may wish to check!) by trying out all possible strategies for Alice
and Bob, that classically the maximum winning probability that can be achieved is
3
pCHSH
win = . (2.28)
4
Alice and Bob can achieve this winning probability with the strategy of answering a = b = 0
always, which means a + b mod 2 = 0, which is correct in 3 out of the 4 possible cases. Only
when x = y = 1 will Alice and Bob make a mistake.
Quantum winning probability
It turns out that Alice and Bob can do significantly better with a quantum strategy, using shared
entanglement. Indeed, suppose that Alice and Bob share an EPR pair, where we label the qubit
held by Alice (A) and the one held by Bob (B).
1
|ΨiAB = √ (|0iA |0iB + |1iA |1iB ) . (2.29)
2
Suppose now that when x = 0, Alice measures her qubit in the basis {|0i, |1i}. Otherwise when
x = 1, she measures in the basis {|+i, |−i}. Suppose furthermore that when y = 0, Bob measures
his qubit in the basis |v1 i, |v2 i where
|v1 i = cos(π/8)|0i + sin(π/8)|1i, |v2 i = − sin(π/8)|0i + cos(π/8)|1i, (2.30)
and when y = 1, he measures in the basis |w1 i, |w2 i, where
|w1 i = cos(π/8)|0i − sin(π/8)|1i, |w2 i = sin(π/8)|0i + cos(π/8)|1i. (2.31)
Consider the case where x = 0, y = 0. This means Alice measures in the basis {|0i, |1i} and
Bob in the basis {|v1 i, |v2 i}. The probability of winning, conditioned on x = 0, y = 0 is given by
pwin|x=0,y=0 = p(a = 0, b = 0|x = 0, y = 0) + p(a = 1, b = 1|x = 0, y = 0) (2.32)
= |h0A v1B |ΨAB i|2 + |h1A v2B |ΨAB i|2 (2.33)
2
1 π π
= 2 √ cos = cos2 . (2.34)
2 8 8

The probability of winning, conditioned on x = 0, y = 1 is given by a similar expression

pwin|x=1,y=0 = p(a = 0, b = 0|x = 1, y = 0) + p(a = 1, b = 1|x = 1, y = 0) (2.35)
2 2
= |h0A w1B |ΨAB i| + |h1A w2B |ΨAB i| (2.36)
2
1 π π
= 2 √ cos = cos2 . (2.37)
2 8 8
 12

On the other hand,

pwin|x=0,y=1 = p(a = 0, b = 0|x = 0, y = 1) + p(a = 1, b = 1|x = 0, y = 1) (2.38)

2 2
= |h+A v1B |ΨAB i| + |h−A v2B |ΨAB i| (2.39)
π 2 1 1 π 2
   
1 1 π 1 π 1
= √ cos + √ sin + √ cos + √ sin (2.40)
2 2 8 2 8 2 2 8 2 8
1 π π 2
= cos + sin . (2.41)
2 8 8
1

2
Finally, you may easily verify that for x = y = 1, pwin|x=1,y=1 = pwin|x=1,y=0 = 2 cos π8 + sin π8 .

2
Also, convince yourself that 21 cos π8 + sin π8 = cos2 π8 . This implies that

1 π
pwin = pwin|x,y = cos2 ≈ 0.85. (2.42)
4∑x,y 8

2.4.2 Implications
This counterintuitive effect of entanglement has far reaching consequences. The first is of a rather
conceptual nature, as you may have started wondering what actually happens if we “measure” a
quantum particle. Could it be that every particle has a local classical “cheat sheet” attached to it,
which specifies the outcome it will give for any possible measurement that we can make on it?
Such a cheat sheet would correspond precisely to a classical strategy in the game above: For every
x, Alice’s qubit has some outcome a attached. In physics, such cheat sheets are also called local
hidden variables.
The fact that quantum strategies can beat classical strategies in this game, however, implies
that nature does not work that way! There are no classical cheat sheets, but nature is inherently
quantum. Many experiments of ever increasing accuracy have been performed that verify that Alice
and Bob can indeed achieve a higher winning probability in the CHSH game than the classical
world would allow. Recently, an experiment has even proved this, by closing all possible loopholes
(caused by experimental imperfections)[Hen+15]. This tells us that the world is not classical, but
we need more sophisticated tools to describe it - such as quantum mechanics. It also means that
when trying to build the ultimate computing and communication devices, we should make full use
of what nature allows and go quantum.
We will later see how to use this simple game to verify the presence of entanglement, test
unknown quantum devices, and even create secure encryption keys.

2.5 The monogamy of entanglement

Let’s get back to the property mentioned in the very beginning of this lecture: that entanglement
is monogamous. We know that two systems A and B can be in a joint pure state that is entangled,
such as the “maximally entangled” EPR pair |EPRiAB . All our examples, however, had to do with
entanglement between two systems A and B. But what about a third system, call it C for Charlie?
Of course we could always consider three EPR pairs, |EPRiAB , |EPRiBC and |EPRiAC . If this is
the state of the three systems however we don’t really want to talk about tripartite entanglement,
because the correlations are always between any two of the three parties. Is it possible to create
a joint state |ΨiABC in which the strong correlations of the EPR pair are shared simultaneously
between all three systems?
Let’s first argue that, if we require that A and B are strictly in an EPR pair, then it is impossible
for C to share any correlation with the qubits that form the EPR pair.
 2.5 The monogamy of entanglement 13

 Example 2.5.1 Let ρAB = |ΨihΨ|AB . Then ρAB is pure, and in particular its only nonzero
eigenvalue is λ1 = 1. Thus by Uhlmann’s theorem any purification of ρAB must have the form
ρABC = |ΨihΨ|AB ⊗ |ΦihΦ|C for an arbitrary state |ΦiC of system C. But this is a pure state with
Schmidt rank across AB : C equal to 1: it is not entangled! In fact you can see that the same
consequence would hold as soon as AB is required to be in a pure state. In our example, you can
further compute that ρAC = 2I ⊗ ρC , meaning that not only C is uncorrelated with A, but from the
point of view of C A looks maximally mixed, i.e. it completely random. The same holds for ρBC . 

2.5.1 Quantifying monogamy

The previous example demonstrates monogamy of the maximally entangled EPR pair. What about
more general states, could they demonstrate entanglement across three different parties? This is
possible to some extent, as is shown by the example of the GHZ state |ΨiABC = √12 (|000i + |111i).
But the correlations in that state are weaker than those of a maximally entangled state. How do we
make this statement precise?
One possibility is to use so-called entanglement measures E(A : B). An entanglement measure
is any function of bipartite density matrices that satisfies certain desirable properties. We already
saw such a measure, the Schmidt rank; however it only applies to pure bipartite states. For states
that are not pure the situation is much more complicated, and there is no standard entanglement
measure that satisfies all the properties that we would like. Among these properties, there is one
which expresses monogamy as follows: for any tripartite density matrix ρABC it requires that

E(A : B) + E(A : C) ≤ E(A : BC). (2.43)

One way to interpret this inequality is that, whatever the total entanglement that A has with B and
C (right-hand side), this entanglement must split additively between entanglement with B and with
C (left-hand side). You may think this is obvious — but in fact very few entanglement measures are
known to satisfy the monogamy inequality (2.43)!

2.5.2 A three-player CHSH game

Another, more intuitive way of measuring monogamy is through the use of nonlocal games, such
as the CHSH game that we discussed in Section 2.4. First consider a three-player variant of this
game where Alice would be required to successfully play the CHSH game simultaneously with two
different partners, Bob and Charlie. That is, Alice would be sent a random x, Bob a random y and
Charlie a random z; they would have to provide answers a, b and c respectively such that xy = a + b
mod 2 and xz = a + c mod 2. Can they do it? The fact, discussed in Example 2.5.1, that the EPR
pair has no entangled extension to three parties should give you a hint that things are going to be
difficult for Alice!
In fact it is possible to make an even stronger statement. Consider now the following three-
player variant of the CHSH game:
• The referee selects two of the three players at random, and sends each of them the message
“You’ve been selected!”.
• The referee plays the CHSH game with the selected players, sending each of them a random
question and checking their answers for the CHSH condition. The third player is completely
ignored.
Now, what do you think is the players’ maximum success probability in this game? For the case of
classical players the answer should be clear: 3/4. Indeed, there is nothing more or less they can do
in this variant than in the original two-player CHSH. (Make sure you are convinced of this fact.
What is an optimal strategy for the three players?)
What about quantum players? Can they win with probability cos2 (π/8)? Why not? Let’s think
of a possible extension of the two-player strategy we saw in Section 2.4.1. First of all we need the
14

three players, Alice, Bob and Charlie, to decide on an entangled state to share. Given they know
two of them are going to be asked to play CHSH, it is natural to set things up with three EPR pairs,
one between Alice and Bob, another between Bob and Charlie, and the third between Alice and
Charlie.
Now the game starts, and two players are told they are to play the game. However, the crucial
point to observe is that each of the selected players is not told with whom they are to play the game!
So, for instance Alice will know she has been selected, but will not be told who is the other lucky
winner — Bob or Charlie. Which EPR pair is she going to use to implement her strategy?
It turns out there is no answer to this question: Alice is stuck! Although we won’t do it here, it
is possible to show that the optimal winning probability in the three-player CHSH game described
above, for quantum players, is no larger than the classical optimum: 3/4. (See [Ton09] for more
details if you are interested in seeing how to show this.) This is a powerful demonstration of
monogamy of entanglement, showing in particular that there is no nice extension of the EPR pair
to a tripartite state — at least not one that allows any two of them to win the CHSH game! We
will return to a similar manifestation of monogamy by analyzing a “tripartite guessing game” next
week.

Acknowledgements
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0
International Licence. The lecture notes are written by Nelly Ng, Thomas Vidick and Stephanie
Wehner. We thank David Elkouss, Kenneth Goodenough, Jonas Helsen, Jérémy Ribeiro, and
Charles Xu for proofreading.
2.5 The monogamy of entanglement 15

Important identities for calculations

Purification of states
Given any density matrix diagonalized as ρA = ∑i λi |φi ihφi |A , a purification of A is
p
|ΨiAB = ∑ λi |φi iA |wi iB , (2.44)
i

for any set of orthonormal vectors {|wi iB }i .

Schmidt decomposition of bipartite pure states

Any bipartite pure state |ΨiAB can be written into the form
d p
|ΨiAB = ∑ λi |ai iA |bi iB , (2.45)
i=1

where {|ai iA }i , {|bi iB }i are orthonormal vector sets, and ∑di=1 λi = 1.

CHSH game winning probability

Consider Alice and Bob playing in a game, where questions x, y ∈ {0, 1} are sent to them,
and they respond with answers a, b ∈ {0, 1} respectively. Alice and Bob win the game if
a + b (mod 2) = x · y. The winning probability is given by

1
pCHSH
win = ∑ ∑ p(a, b|x, y) . (2.46)
4 x,y∈{0,1} a,b
a+b mod 2=x·y

For any classical strategy, pCHSH

win = 34 .
If Alice and Bob shares an EPR pair, then pCHSH
win = cos2 π8 ≈ 0.85.
 Bibliography

[Bel64] John S Bell. On the Einstein Podolsky Rosen Paradox. 1964 (cited on page 9).
[Bru+14] Nicolas Brunner et al. “Bell nonlocality”. In: Reviews of Modern Physics 86.2 (2014),
page 419 (cited on page 9).
[Hen+15] Bas Hensen et al. “Loophole-free Bell inequality violation using electron spins sep-
arated by 1.3 kilometres”. In: Nature 526.7575 (2015), pages 682–686 (cited on
page 12).
[NC01] Michael A. Nielsen and Isaac L. Chuang. Quantum Computation and Quantum Infor-
mation. Cambridge University Press, 2001 (cited on page 6).
[Ton09] Ben Toner. “Monogamy of non-local quantum correlations”. In: Proceedings of the
Royal Society of London A: Mathematical, Physical and Engineering Sciences. Vol-
ume 465. 2101. The Royal Society. 2009, pages 59–69 (cited on page 14).