Accessing inaccessible information via quantum indistinguishability

Indistinguishable particles are commonly represented in quantum-mechanical models in two distinct ways: roughly, the first-quantization formalism models their state vectors as elements of the (anti)symmetric subspace of a multi-particle Hilbert space, whereas the second-quantization formalism takes their state space to be given by a Fock space of modes ⁴ . Interestingly, the former option allows for the state of independently prepared indistinguishable particles—e.g. the state of two electrons stemming from causally disconnected galaxies—to be entangled, despite the absence of common past interactions between the particles. On the contrary, in the second-quantization formalism, the entanglement between the particles' modes is contingent on the particles' past interactions: indeed, the state of independently prepared particles is represented as separable.

This representational ambiguity motivates the question of whether independently prepared indistinguishable particles ought to be regarded as entangled or not: possible answers are still being actively debated [3–8]. Furthermore, since entanglement is a paradigmatic resource for quantum information processing, another question that has arisen is whether the entanglement that is apparently intrinsic according to the first-quantization formalism can in principle be accessed and used: here an affirmative answer has been supported by various tasks in which particle indistinguishability provides similar advantages to those obtainable from entanglement [9–44]. A feature that is common to these tasks is that the advantage brought forth by particle indistinguishability is present only if the involved particles spatially overlap at least at some moment during the protocol, i.e. the particles should not be fully distinguishable by their spatial degree of freedom, if their entanglement is to be exploitable.

In this paper, we propose a new information-theoretic task that can be solved with the use of independently prepared indistinguishable particles, but cannot be solved with distinguishable ones, unless they are entangled. We thereby show that, in the context of our task, the indistinguishability of independently prepared particles provides an equal resource to the one obtainable from the entanglement of distinguishable particles, thus providing further support to the claim that the entanglement inherently present according to the first-quantization formalism is more than a mere mathematical artifact, and can indeed be used in information processing. Unlike previously proposed examples that support the latter claim, our protocol does not require its involved particles to spatially overlap at any moment—in fact, the protocol's success does not depend in any way on the distance between the particles.

The paper is structured as follows. Section 2 offers an informal presentation of our task, whereas its precise formulation is given in section 3. The same section also contains the quantum-mechanical analysis of the task and an expansion on the requirements necessarily satisfied by any quantum-mechanical protocol that solves it. Finally, section 4 provides a discussion and an outlook on possible future developments of our results and on their potential practical applications.

Consider the following scenario. An agent named Alice is given a box, which contains a physical object (e.g. an atom) prepared in one of two perfectly distinguishable states, thereby encoding one bit of information. The box is sealed in such a way that Alice does not have the means of opening it and thus cannot access the object directly. Suppose that the only action she can perform on the box is to move it in space, e.g. she can move the box from some initial position $\vec{x}$ to another position $\vec{x}^{\prime}$. Alice may also have available various experimental devices and other physical objects (as for example other boxes). Lastly, we will assume that spatially moving the box leaves the state of the object within it invariant, and that Alice cannot infer the state by merely moving the box (e.g. via some state-dependent back-reaction acting on Alice's experimental devices or additional objects). An example of this scenario, where the additional objects consist of other boxes, is pictured in figure 1.

Zoom In Zoom Out Reset image size

Now we are ready to formulate the task: can Alice learn the state of the object within the box, given the above restrictions on what she is allowed to do? At the current stage, this question may appear nonsensical: if (i) Alice is only able to move the box, and (ii) a mere movement of the box cannot reveal the state of the object within it, then it trivially follows that Alice cannot accomplish the task! However, if the box can be treated quantum-mechanically and if Alice has at disposal additional identical quantum systems, then, as we will show in the next section, she can in fact learn the state of the object, while—in a sense that will be made precise below—still only moving the box. Let us now provide a formalized version of the task and the quantum-mechanical protocol that can be used to solve it.

Here we will put the scenario presented in the previous section on more formal and abstract grounds. Consider that Alice is given a localized physical object, henceforth named $\cal{T}$. $\cal{T}$ can be characterized to have two degrees of freedom (d.o.f.): an intrinsic one, which we will label with k, and a position, labeled with $\vec{x}$. We will thus represent the overall state of the object with the ordered pair $(\vec{x},k)_T$. Throughout the paper, we attach only an operational meaning to states, i.e. the sentence 'the object is in state $(\vec{x},k)_T$' is hereafter synonymous with 'a position measurement on the object would output value $\vec{x}$, and an appropriate measurement of the internal d.o.f. would output value kʹ. We furthermore assume that k can take only two possible values, 0 or 1. Let us now suppose that Alice is only allowed to move the object through space, while keeping the internal d.o.f. intact. We will model this restriction by assuming that she has at disposal a device $\cal{D}$ that can implement any transformation in M, where M is a set of transformations $M: \mathbb{R}^3 \rightarrow \mathbb{R}^3$, the latter being operators that map position vectors $\vec{x}$ into position vectors $\vec{x}^{\prime} = M\vec{x}$. We will associate states $(M)_D$ to the device, where M indicates which map the device is set to implement on a potential target object. The device is constructed in such a way that the dynamical interaction with the localized target object $\cal{T}$, which is initially in state $(\vec{x},k)_T$, is given by

$$\begin{align} \left(M\right)_D\left(\vec{x},k\right)_T \rightarrow \left(M\right)_D\left(M\vec{x},k\right)_T. \end{align} \tag{ 1 }$$

Furthermore, Alice may have at disposal other localized objects, which cannot interact directly with the initial object $\cal{T}$, but can interact with the device $\cal{D}$. Labeling collectively these additional objects with $\cal{A}$, and their pertaining state with $(\alpha)_A$, the latter constraint means that the overall interaction between $\cal{D}$, $\cal{A}$ and $\cal{T}$ can be represented as:

$$\begin{align} \left(M\right)_D\left(\alpha\right)_A\left(\vec{x},k\right)_T \rightarrow \left(M\right)_D\left(\tilde{\alpha}\left(M,\alpha\right)\right)_A\left(M\vec{x},k\right)_T, \end{align} \tag{ 2 }$$

where the final state $\tilde{\alpha}(M,\alpha)$ of $\cal{A}$ is in principle any function insensitive to the internal d.o.f. pertaining to $\cal{T}$. Moreover, if the initial state of $\cal{D}$ is not equal to any $(M)_D$ (but is e.g. a probabilistic mixture, a quantum superposition state or some generalized probabilistic state [45, 46]), we assume that it is still the case that, were one to find the final state of $\cal{D}$ to be $(M)_D$, one would find the final state of $\cal{T}$ and $\cal{A}$ to be $(\tilde{\alpha}(M,\alpha))_A(M\vec{x},k)_T$. Stated more precisely, for any initial state of $\cal{D}$, post-selecting the final state on a definite state $(M)_D$ of $\cal{D}$ results in the postselected joint state being equal to the RHS of equation (2). Finally, we assume that, for arbitrary initial states of $\cal{D}$, the probability of finding $\cal{D}$ in state $(M)_D$ does not change upon the above interaction.

Now suppose that Alice is allowed only to interact with her device, i.e. she is solely able to control and to read out the state of $\cal{D}$. In other words, she can interact only indirectly with objects $\cal{T}$ and $\cal{A}$, via mediation through $\cal{D}$. Furthermore, Alice has perfect knowledge of the initial state $(\alpha)_A$ associated to the additional objects $\cal{A}$, but does not have any prior knowledge of the value k pertaining to $\cal{T}$. The information-theoretic task can now be formulated as follows:

Task: can Alice learn the state k pertaining to $\cal{T}$, solely by manipulating the given device $\cal{D}$?

As can be immediately seen from equation (2), the state of $\cal{D}$ is insensitive to k, so the answer to the latter question seems to be an immediate 'No'. Also, at the current stage, it is admittedly not clear at all what role, if any, the additional objects $\cal{A}$ could play for the accomplishment of the required task. However, in what follows, we will show that if $\cal{D}$, $\cal{A}$ and $\cal{T}$ can be treated as quantum systems, and if Alice is able to coherently manipulate the device $\cal{D}$, then she can in fact learn the required value k, given that $\cal{A}$ and $\cal{T}$ can be modeled as indistinguishable quantum particles.

3.1. The quantum protocol

We will now assume that $\cal{D}$, $\cal{A}$ and $\cal{T}$ can be treated as quantum systems that can be modeled via the usual rules of quantum mechanics. Therefore, we can associate a quantum state

$$\begin{align} \vert \psi\rangle \in \cal{H}\equiv H_D\otimes H_A \otimes H_T \end{align} \tag{ 3 }$$

to the joint system comprised of $\cal{D}$, $\cal{A}$ and $\cal{T}$. The Hilbert space $\cal{H}_D$ associated to the device is spanned by vectors $\left\{\vert M\rangle , \forall M \in \mathbf{M} \right\}$, whereas the Hilbert space $\cal{H}_T$ associated to $\cal{T}$ is spanned by $\{\vert \vec{x},k\rangle \equiv \vert \vec{x}\rangle \otimes \vert k\rangle ,$ $\forall \vec{x} \in \mathbb{R}^3, \forall k = 0,1 \}$. Vectors $\vert M\rangle$ are eigenstates of the observable $\hat{M}$ that corresponds to the 'measurement' of the device in the intended classical basis, whereas $\vert \vec{x}\rangle$ and $\vert k\rangle$ are respectively eigenstates of observables $\hat{\vec{x}}$ and $\hat{k}$ corresponding to measurements of the position and internal d.o.f. of $\cal{T}$. The structure of the Hilbert space $\cal{H}_A$ pertaining to $\cal{A}$ remains for now unspecified. We now assume, in accord with equation (2), that the interaction between $\cal{D}$, $\cal{A}$ and $\cal{T}$ is given by the following unitary evolution:

$$\begin{align} \vert M\rangle _D \vert \alpha\rangle _A \vert \vec{x},k\rangle _T \rightarrow \vert M\rangle _D \vert \tilde{\alpha}\left(M,\alpha\right)\rangle _A\vert M\vec{x},k\rangle _T. \end{align} \tag{ 4 }$$

Notice that the above corresponds to a control gate, where the device $\cal{D}$ acts as the control system, and the objects $\cal{T}$ and $\cal{A}$ act as targets. We stress that we are assuming that $\cal{D}$, $\cal{A}$ and $\cal{T}$ are not interacting with any further environment, i.e. that they constitute an isolated system; in the next subsection we will analyze protocols that violate this assumption.

Let us now specify the additional objects $\cal{A}$ to consist only of one object localized at position $\vec{x}_A$, and possessing a binary internal d.o.f., whose value is for simplicity set to $k_A = 0$. The Hilbert space associated to $\cal{A}$ is thus isomorphic to the one associated to $\cal{T}$, and the object $\cal{A}$ is assigned state $\vert \vec{x}_A,0\rangle$. We also assume that the device $\cal{D}$ can be used to move $\cal{A}$ through space. Consequently, Alice is now able to swap the two objects with the use of her device, by moving $\cal{T}$ to position $\vec{x}_A$, and $\cal{A}$ to position $\vec{x}_T$. In order to simplify the discussion, let us introduce an effective state of $\cal{D}$, which we will label with 'S', and that is constructed in such a way that it effectively swaps the two objects upon interaction, i.e.

$$\begin{align} \vert S\rangle _D \vert \vec{x}_A,0\rangle _A \vert \vec{x}_T,k_T\rangle _T \rightarrow \vert S\rangle _D \vert \vec{x}_T,0\rangle _A \vert \vec{x}_A,k_T\rangle _T, \end{align} \tag{ 5 }$$

where we introduced more indices in order to avoid confusion.

Under the assumption that $\cal{A}$ and $\cal{T}$ are distinguishable systems, equation (4) implies that Alice cannot accomplish the task, because the internal degree of freedom pertaining to $\cal{T}$ is isolated from the other subsystems. Let us now suppose that objects $\cal{A}$ and $\cal{T}$ are indistinguishable, i.e. that they can be modeled as indistinguishable quantum particles: here we assume for simplicity the bosonic case, even though the protocol would also work in the fermionic case, as it can be easily checked. This warrants us to introduce the 'second quantization' notation via the following recipe:

$$\begin{align} \vert \vec{x}_A,0\rangle _A \vert \vec{x}_T,k_T\rangle _T \Rightarrow \vert 0\rangle _{\vec{x}_A}\vert k_T\rangle _{\vec{x}_T}, \end{align} \tag{ 6 }$$

where the latter state means that at location $\vec{x}_A$ there is an object with internal state 0, and at location $\vec{x}_T$ an object with internal state k_T , with no further labels that may distinguish the objects ⁵ . Mathematically, the quantum state is now an element of $\mathcal{H}_{\vec{x}_T} \otimes \mathcal{H}_{\vec{x}_A}$, where $\mathcal{H}_{\vec{x}_{T/A}}$ is associated to spatial mode $\vec{x}_{T/A}$ and is spanned by vectors $\{\vert 0\rangle _{\vec{x}_{T/A}},\vert 1\rangle _{\vec{x}_{T/A}}\}$. The interaction between the device $\cal{D}$ set in state 'S' and the two indistinguishable objects is thus given by:

$$\begin{align} \vert S\rangle _D \vert 0\rangle _{\vec{x}_A} \vert k_T\rangle _{\vec{x}_T} \rightarrow \vert S\rangle _D \vert k_T\rangle _{\vec{x}_A} \vert 0\rangle _{\vec{x}_T}.\end{align} \tag{ 7 }$$

Now comes the crucial observation: unlike as in the case of distinguishable objects (see equation (5)), the overall quantum state in equation (7) is invariant upon interaction if and only if $k_T = k_A$, i.e. $k_T = 0$. This enables the construction of the following protocol that can be used by Alice to learn k_T with probability higher than $\frac{1}{2}$, given that she knows the value $k_A = 0$ of the additional system $\cal{A}$. The procedure goes as follows

• (a)  
  Alice prepares the device in state $\vert \phi\rangle \equiv \frac{1}{\sqrt{2}}\left( \vert \unicode{x1D7D9}\rangle _D + \vert S\rangle _D \right)$, where '$\unicode{x1D7D9}$' is the state of the device that implements the identity transformation.
• (b)  
  She then lets $\cal{D}$, $\cal{A}$ and $\cal{T}$ interact as:

  $$\begin{align} \begin{split} &\frac{1}{\sqrt{2}}\left( \vert \unicode{x1D7D9}\rangle _D + \vert S\rangle _D \right) \vert 0\rangle _{\vec{x}_A} \vert k_T\rangle _{\vec{x}_T} \rightarrow \frac{1}{\sqrt{2}}\left( \vert \unicode{x1D7D9}\rangle _D \vert 0\rangle _{\vec{x}_A} \vert k_T\rangle _{\vec{x}_T} + \vert S\rangle _D \vert k_T\rangle _{\vec{x}_A}\vert 0\rangle _{\vec{x}_T} \right). \end{split} \end{align} \tag{ 8 }$$

  After the interaction, the reduced density state ρ associated to $\cal{D}$ is:

  $$\begin{align} \rho = \begin{cases} \vert \phi\rangle \langle \phi\vert &\text{if}{\,\,}k_T = 0\\ \frac{1}{2}\unicode{x1D7D9}_2 &\text{if}{\,\,}k_T = 1, \end{cases} \end{align} \tag{ 9 }$$

  where $\unicode{x1D7D9}_2$ is the identity operator on $\cal{H}_D$ restricted to the subspace spanned by $\left\{\vert \unicode{x1D7D9}\rangle _D, \vert S\rangle _D\right\}$. Notice that, were the objects $\cal{T}$ and $\cal{A}$ distinguishable, the device would end up in a maximally mixed state for all combinations of $k_T,k_A$.
• (c)  
  Finally, Alice measures $\cal{D}$ with projectors $\left\{\Pi_0 = \vert \phi\rangle \langle \phi\vert , \Pi_1 = \unicode{x1D7D9}_2 - \vert \phi\rangle \langle \phi\vert \right\}$. If she obtains outcome '0', she guesses $k_T = 0$; conversely, if she obtains '1' she guesses $k_T = 1$: the probability of a correct guess is $\frac{3}{4}$, thereby beating a random guess. Can the probability of success be raised closer to unity? The answer is affirmative, and is given by a straightforward extension of the protocol, where $\cal{A}$ now consists of $(N-1)$ additional identical quantum objects, each of them set in the reference state $k_A = 0$. The extended protocol is presented in appendix A, where it is shown that Alice's probability P_W of correctly guessing the required bit is

  $$\begin{align} P_W = 1-\frac{1}{2N}, \end{align} \tag{ 10 }$$

  that asymptotically reaches unity for large N.

Note that if Alice at the end of the process wants to guess which of the objects is the one containing k_T (i.e. $\cal{T}$), she is able to do so only with probability $\frac{1}{N}$. Alternatively, instead of implementing measurement $\left\{\Pi_0, \Pi_1 \right\}$, she could have measured $\cal{D}$ in the $\left\{\vert \unicode{x1D7D9}\rangle _D, \vert S\rangle _D\right\}$ basis and found out with certainty the location of k_T , which would however not have provided her with any knowledge of the value of k_T . There is thus a trade-off between the possibility of acquiring knowledge of the value of k_T and of retaining knowledge of its location, which is inherited from the non-commutativity of the observables on $\cal{D}$ that would correspondingly need to be measured.

3.2. The necessity of entanglement and indistinguishability

In the protocol presented in the previous subsection, the interaction between the target objects ($\cal{T}$ and $\cal{A}$) and the device $\cal{D}$ produces a k_T -dependent back-reaction on the latter: in particular, the device gets entangled with the target objects if and only if $k_T = 1$. This suggests that the possibility of establishing entanglement between the device and the targets, along with the targets being indistinguishable, may be a necessary ingredient for the protocol to work. However, it is not yet clear whether this is the case, since the transformation defined abstractly in equation (2) admits other quantum-mechanical realizations besides the ideal quantum control gate that was assumed in equation (4): we thus cannot yet exclude the possibility of there being a noisy control gate that produces a k_T -dependent transformation on the device even without the latter getting entangled with the target objects. Nevertheless, as we will sketch here (while leaving the proof for appendix B), the possibility of establishing entanglement between $\cal{D}$ and the targets turns out after all to be a necessary condition for any quantum-mechanical protocol to solve the task.

Let us assume that N = 2 and that the two target objects are indistinguishable. As before, states $\vert \unicode{x1D7D9}\rangle _D$ and $\vert S\rangle _D$ pertaining to $\mathcal{D}$ correspond to the 'identity' and 'swap' operations. The assumption of our task is that the interaction between $\mathcal{D}$ and the targets is such that, postselecting the final state on $\vert \unicode{x1D7D9}\rangle _D$ leaves the targets' state invariant, whereas postselecting on $\vert S\rangle _D$ leaves the targets in a 'swapped' state. More precisely, the most general allowed interaction G is a CPTP-map that satisfies the following: for any quantum states $\rho^{(D)}$ and $\rho^{(T)}$ of the device $\cal{D}$ and the targets $\cal{T}$ and $\cal{A}$, the post-interaction state $\tilde{\rho} \equiv G(\rho^{(D)} \otimes \rho^{(T)})$ satisfies

$$\begin{align} \begin{aligned} {\textrm{Tr}}_D \left[ \left(\Pi_1 \otimes \unicode{x1D7D9}\right) \tilde{\rho}\right] & = p_1 \rho^{\left(T\right)}\nonumber\\ {\textrm{Tr}}_D \left[ \left(\Pi_S \otimes \unicode{x1D7D9}\right) \tilde{\rho}\right] & = p_S \hat{S}\rho^{\left(T\right)}\hat{S}^{\dagger}, \end{aligned} \end{align} \tag{ 11 }$$

where $\Pi_{1/S}\equiv \vert \unicode{x1D7D9}/S\rangle _D\langle \unicode{x1D7D9}/S\vert$, and $\hat{S}$ is the 'swap' operator acting on the targets. The factors $p_1\equiv {\textrm{Tr}} \left(\Pi_1 \rho^{(D)} \right)$ and $p_S\equiv {\textrm{Tr}} \left(\Pi_S \rho^{(D)} \right)$ are determined by the additional assumption that the probabilitiy of finding $\cal{D}$ in state $\vert \unicode{x1D7D9}\rangle _D$ or $\vert S\rangle _D$ does not change upon interaction with the target objects.

Let us label with $\rho^{(T)}_{k_T}$ the initial state of the targets when the unknown bit's value is k_T . For any gate G that satisfies equation (11) and any initial state $\rho^{(D)}$ of $\mathcal{D}$, our task can be solved with probability higher than $\frac{1}{2}$ only if the final reduced state of $\mathcal{D}$ depends on k_T , i.e.

$$\begin{align} {\textrm{Tr}}_T \left( \tilde{\rho}_0 \right) \neq {\textrm{Tr}}_T \left(\tilde{\rho}_1\right), \end{align} \tag{ 12 }$$

where $\tilde{\rho}_{k_T} \equiv G(\rho^{(D)} \otimes \rho^{(T)}_{k_T})$. In appendix B we show that—for general $N\unicode{x2A7E} 2$—while the permutation invariance of state $\rho^{(T)}_0$ implies that $\tilde{\rho}_0$ is a separable state, equation (12) holds if and only if $\tilde{\rho}_1$ is an entangled state. Therefore, the necessary conditions for a quantum-mechanical protocol to outperform a random guess are that (i) it involves indistinguishable target objects, and that (ii) the final quantum state of the device and the target objects is entangled if and only if $k_T = 1$.

We have seen in the previous section that Alice can accomplish her task thanks to the indistinguishability of the target objects and the possibility of establishing entanglement between the latter and the device. We now want to emphasize that the task and its solution are reminiscent of the well known swap test [47], which enables one to check whether two quantum systems are prepared in equal states by performing a control-swap operation on them, where the swap operation—henceforth referred to as 'abstract swap' - acts as $\vert \psi\rangle \otimes \vert \phi\rangle \rightarrow \vert \phi\rangle \otimes \vert \psi\rangle$. This offers another angle on how to understand the necessity of the targets' indistinguishability for the quantum protocol to solve our task. Namely, when applied to independently prepared indistinguishable particles, spatially swapping the particles precisely implements, on the space of the particles' spatial modes, the 'abstract swap' operation that is required for the swap-test; on the other hand, a spatial swap of independently prepared distinguishable particles strictly differs from an 'abstract swap' operation acting on their joint Hilbert space. Stated succinctly, a spatial swap of two independently prepared particles implements the 'abstract swap' operation (of the kind needed in the swap-test) if and only if the particles are indistinguishable: particle indistinguishability is what enables the operations allowed in our task to be used to implement a standard swap-test.

As our task presents an instance of quantum indistinguishability serving as an information-theoretic resource, this leads us back to the ongoing debate on the possible physical merit of the entanglement apparently intrinsic to indistinguishable particles, as mentioned in the introductory section. Indeed, notice that our task cannot be solved with distinguishable particles under the requirement that the target objects $\cal{T}$ and $\cal{A}$ be prepared independently. However, if we drop this assumption, the task can be equally well solved with mutually entangled distinguishable particles, as briefly explained in what follows.

In fact, notice that in the first-quantization formalism, the quantum state associated to a pair of independently prepared indistinguishable particles is mathematically equivalent to a maximally entangled state of ordinary distinguishable particles. Therefore, the quantum-mechanical protocol presented in section 3—originally interpreted as involving indistinguishable particles—can be straightforwardly re-interpreted, without any change in the mathematical expressions, as involving maximally entangled distinguishable particles ⁶ . Indistinguishability and entanglement thus represent equivalent information-theoretic resources in our task, which we take to support the claim that the entanglement that appears in the first quantization notation is more than a mere representational artefact. However, we do not want to delve here into a more detailed discussion on whether independently prepared indistinguishable particles need to (or can) be considered as entangled or not, the answer of which would starkly depend on particular definitions and measures of entanglement [6]: our aim is only to point out that there exists a simple information-theoretic task in which the indistinguishability of independently prepared particles and the entanglement of non-independently prepared distinguishable particles serve as equivalent resources. Importantly, the particles involved in the protocol do not need to spatially overlap and can in fact be arbitrarily distant from each other throughout the whole duration of the protocol.

Let us now comment on possible future developments of our results. In the current manuscript we have provided only a quantum-mechanical analysis of our task; however, we believe that the latter, as presented abstractly at the beginning of section 3, can be transposed into the framework of generalized probabilistic theories [45, 46], which would enable the assessment of how much of our results hinge on the specificities of quantum theory. We may thereby gain a better understanding of the general relationship between indistinguishability and entanglement, by analyzing questions such as the following. In which other operational theories are the indistinguishability of the targets and the possibility of entangling the latter and the device, both necessary to solve the task? In which theories do indistinguishability and entanglement of the targets constitute equivalent resources for our task?

Finally, moving on to potential practical aspects of our findings, it is commonly expected that, following Moore's law, hardware components used in information processing may soon reach a regime in which quantum-mechanical effects cannot be neglected [48]. When (and if) that becomes the case, our results may prove relevant for hardware-security modules that incorporate physical protection against tampering. Examples of this type of devices can already be found both in classical and quantum computing, where the security of one-time programs essentially relies on hardware components, i.e. on one-time memories [49, 50]. Other potential applications of our results may be expected to be found in cryptography and hardware security in general.

We thank two anonymous referees for insightful comments and for pointing out several useful references. This research was funded in whole, or in part, by the Austrian Science Fund (FWF) ([F7115] and [P36994]). For the purpose of open access, the authors have applied a CC BY public copyright licence to any Author Accepted Manuscript version arising from this submission.

No new data were created or analysed in this study.

Suppose that Alice is given the object $\mathcal{T}$ in state $\vert k_T\rangle _{\vec{x}_T}$ and wants to find out the value k_T by using her device $\mathcal{D}$. Let us assume that $\mathcal{A}$ now consists of $(N-1)$ additional identical quantum objects, each of them set in the reference state $k_A = 0$ (which is known to Alice), and located at positions $\vec{x_2}$,...,$\vec{x}_{N}$. The joint state of $\mathcal{T}$ together with the $(N-1)$ additional objects is thus $\vert k_T\rangle _{\vec{x}_1}\vert 0\rangle _{\vec{x}_2}...\vert 0\rangle _{\vec{x}_{N}}$, where we have for simplicity renamed position $\vec{x}_T$ into $\vec{x}_1$. Alice's device $\mathcal{D}$ can now be used to swap any pair of the target objects: let us label with 'S_i ' the state of $\mathcal{D}$ that is set to swap $\mathcal{T}$ with the ith object. The protocol is then partitioned in three steps:

• (a)  
  Alice prepares $\mathcal{D}$ in state $\vert \phi\rangle = \sum_{i = 1}^{N} \vert S_i\rangle _D$, where $\vert S_1\rangle _D \equiv \vert \unicode{x1D7D9}\rangle _D$.
• (b)  
  She lets $\mathcal{D}$, $\mathcal{T}$ and the $(N-1)$ additional objects interact as:

  $$\begin{align} \frac{1}{\sqrt{N}}\sum_{i = 1}^{N} \vert S_i\rangle _D \vert k_T\rangle _{\vec{x}_1} \vert 0\rangle _{\vec{x}_2}{\ldots}\vert 0\rangle _{\vec{x}_{N}} \rightarrow \frac{1}{\sqrt{N}}\sum_{i = 1}^{N} \vert S_i\rangle _D \vert 0\rangle _{\vec{x}_1} \vert 0\rangle _{\vec{x}_2}{\ldots}\vert k_T\rangle _{\vec{x}_i}{\ldots}\vert 0\rangle _{\vec{x}_{N}}. \end{align} \tag{ A1 }$$

  After the interaction, the reduced density state ρ associated to $\mathcal{D}$ is:

  $$\begin{align} \rho = \begin{cases} \vert \phi\rangle \langle \phi\vert &\text{if}\ k_T = 0\\ \frac{1}{N}\unicode{x1D7D9}_{N} &\text{if}\ k_T \neq 0, \end{cases} \end{align} \tag{ A2 }$$

  where $\unicode{x1D7D9}_{N}$ is the identity operator on $\mathcal{H}_D$ when restricted to the corresponding subspace.
• (c)  
  Finally, Alice measures $\mathcal{D}$ with projectors $\left\{\Pi_0 = \vert \phi\rangle \langle \phi\vert , \Pi_1 = \unicode{x1D7D9}_D - \vert \phi\rangle \langle \phi\vert \right\}$. If she obtains outcome '0', she guesses $k_T = 0$; conversely, if she obtains '1' she guesses $k_T = 1$. The probability of a correct guess P_W is

  $$\begin{align} P_W = 1-\frac{1}{2N}, \end{align} \tag{ A3 }$$

  which coincides with the maximum possible value given by the Helstrom bound [51], thereby showing that the above measurement is optimal.

Here we will provide the proof that in all quantum-mechanical protocols that solve our task with probability higher than $\frac{1}{2}$, the device and the targets get entangled upon interaction in the case that k = 1. We will delve immediately into the general case, where $\mathcal{A}$ consists of $(N-1)$ identical quantum systems set in state 0 and located at positions $\vec{x}_2$,...,$\vec{x}_{N}$, whereas $\mathcal{T}$ is set in state k and located at position $\vec{x}_1$. The joint initial state of the targets is thus $\vert k\rangle _{\vec{x}_1} \vert 0\rangle _{\vec{x}_2}{\ldots}\vert 0\rangle _{\vec{x}_{N}}$. Let us for simplicity introduce the following notation:

$$\begin{align} \begin{split} &\vert 0\rangle _T\equiv \vert 0\rangle _{\vec{x}_1}\vert 0\rangle _{\vec{x}_2} {\ldots}\vert 0\rangle _{\vec{x}_{N}}\\ &\vert i\rangle _T\equiv \vert 0\rangle _{\vec{x}_1}\vert 0\rangle _{\vec{x}_2} {\ldots}\vert 1\rangle _{\vec{x}_i} {\ldots} \vert 0\rangle _{\vec{x}_{N}}, \quad i = 1,{\ldots},N. \end{split} \end{align} \tag{ B1 }$$

Since by assumption Alice is only able to coherently swap the targets, the effective Hilbert space $\mathcal{H}_T$ that can be associated to the latter is spanned by the vectors in equation (B1), i.e. $\mathcal{H}_T = \text{Span}(\vert i\rangle _T, i = 0,{\ldots},N)$. A swap gate S_j that swaps the first and j-th object thus acts as $S_j \vert 0\rangle _T = \vert 0\rangle _T$, and $S_j \vert 1\rangle _T = \vert j\rangle _T$ (notice that S₁ is the identity operator). The initial targets' state is equal to $\vert k\rangle _T$, with k being 0 or 1. Finally, the Hilbert space $\mathcal{H}_D$ associated to the device $\mathcal{D}$ is spanned by vectors $\left\{\vert j\rangle _D, j = 1,{\ldots},N \right\}$, with each $\vert j\rangle _D$ representing the setting corresponding to swap gate S_j .

Now we want to characterize the most general interaction between $\mathcal{D}$ and the targets that is allowed by the assumptions of our task. Let $\mathbf{St}_{DT}$, St_D and St_T be respectively sets of density operators on $\mathcal{H}_D \otimes \mathcal{H}_T$, $\mathcal{H}_D$ and $\mathcal{H}_T$. We will label with $\mathbf{Ch}_{DT}$ the set of completely positive trace preserving (CPTP) superoperators that map $\mathbf{St}_{DT}$ into itself. Let $\mathcal{G}$ be the subset of CPTP maps that represent the device-targets interactions implementable by Alice. The abstract formulation of the task implies that, for any $G \in \mathcal{G}$, if the initial state of $\mathcal{D}$ is some $\vert i\rangle _D$, then the interaction is given by

$$\begin{align} G\left(\vert i\rangle _D\langle i\vert \otimes \rho^{\left(T\right)}\right) = \vert i\rangle _D\langle i\vert \otimes S_i\rho^{\left(T\right)}S_i, \end{align} \tag{ B2 }$$

for any $\rho^{(T)} \in \mathbf{St}_{T}$, where we have used the property $S^{\dagger}_i = S_i$. More generally, if the initial state of $\mathcal{D}$ is an arbitrary density operator $\rho^{(D)} \in \mathbf{St}_{D}$, then the interaction is such, that postselecting the final state on the device's state $\vert i\rangle _D$ implements gate S_i on the targets, i.e.

$$\begin{align} {\textrm{Tr}}_D \left[ \left(\Pi_i \otimes \unicode{x1D7D9} \right) G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) \right] = p_i S_i\rho^{\left(T\right)}S_i, \end{align} \tag{ B3 }$$

where $\Pi_i\equiv \vert i\rangle _D\langle i\vert$. The factors $p_i = {\textrm{Tr}} \left(\Pi_i \rho^{(D)} \right)$ are determined by the further assumption that the probabilitiy of finding $\cal{D}$ in state $\vert i\rangle _D$ is invariant upon interaction with the targets.

Therefore, the assumptions of the task imply that the set $\mathcal{G}$ of allowed device-targets interactions can be characterized as follows:

$$\begin{align} & \mathcal{G} = \left\{G \in \mathbf{Ch}_{DT} \vert \quad \forall \rho^{\left(D\right)} \in \mathbf{St}_{D}, \rho^{\left(T\right)} \in \mathbf{St}_{T}, i = 1,{\ldots},N:\right.\nonumber\\ & \qquad \left. {\textrm{Tr}}_D \left[ \left(\Pi_i \otimes \unicode{x1D7D9} \right) G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) \right] = p_i S_i\rho^{\left(T\right)}S_i\right\}, \end{align} \tag{ B4 }$$

where $p_i\equiv{\textrm{Tr}} \left(\Pi_i \rho^{(D)} \right)$. $\mathcal{G}$ can be understood as the class of generalized control gates, with $\mathcal{D}$ being the control system and $\mathcal{A}$ and $\mathcal{T}$ constituting the target system. In the main text we have seen that in the case of the ideal control gate, which is a particular element of $\mathcal{G}$, the device and the targets get entangled upon interaction if k = 1; in what follows we will prove that this is the case for any element of $\mathcal{G}$ that can be used to outperform a random guess at solving our task. Let us first slightly generalize the discussion by defining a broader class of generalized control gates for which we will prove a lemma that will be of use later.

Definition 1. Consider $\mathcal{H}_D\equiv \mathbb{C}^{N_D}$ and $\mathcal{H}_T\equiv \mathbb{C}^{N_T}$ for some finite natural numbers N_D and N_T . Let $\mathbf{St}_{DT}$, St_D and St_T be sets containing all and only density operators on respectively $\mathcal{H}_D \otimes \mathcal{H}_T$, $\mathcal{H}_D$ and $\mathcal{H}_T$. Let $\mathbf{Ch}_{DT}$ be the set of completely positive trace preserving (CPTP) superoperators that map $\mathbf{St}_{DT}$ into itself.

Let $\vec{U}\equiv \langle U^{(1)},{\ldots},U^{(N_D)} \rangle$ be a list of N_D unitary operators on $\mathcal{H}_T$, and let $\vec{\Pi}\equiv \langle\Pi_1,{\ldots},\Pi_{N_D}\rangle$ be a list of projectors that form a projection-valued measure on $\mathcal{H}_D$. Define a 4-tuple X as $X\equiv \langle N_D,N_T,\vec{U},\vec{\Pi}\rangle$.

The set of generalized control gates relative to X is a set $\mathcal{G}_X$ defined as

$$\begin{align*} & \mathcal{G}_X = \left\{G \in \mathbf{Ch}_{DT} \vert \quad \forall \rho^{\left(D\right)} \in \mathbf{St}_{D}, \rho^{\left(T\right)} \in \mathbf{St}_{T}, i = 1,{\ldots},N_D:\right.\nonumber\\ & \qquad \left.{\textrm{Tr}}_D \left[ \left(\Pi_i \otimes \unicode{x1D7D9} \right) G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) \right] = p_i U^{\left(i\right)}\rho^{\left(T\right)}U^{\left(i\right)\dagger}\right\}, \end{align*}$$

where $p_i = {\textrm{Tr}} \left(\Pi_i \rho^{(D)} \right)$.

Lemma 1. Consider a four-tuple $X\equiv \langle N_D,N_T,\vec{U},\vec{\Pi}\rangle$, where $N_D,N_T$ are natural numbers, $\vec{U}\equiv \langle U^{(1)},{\ldots},$ $U^{(N_D)} \rangle$ is a list of unitary operators on $\mathcal{H}_T\equiv \mathbb{C}^{N_T}$, and $\vec{\Pi}\equiv \langle \Pi_1,{\ldots},\Pi_{N_D} \rangle$ is a projection-valued measure on $\mathcal{H}_D\equiv \mathbb{C}^{N_D}$. Let $\mathcal{G}_X$ be the set of generalized control gates relative to X.

Then, for any $G\in \mathcal{G}_X$, there exists a natural number M and a set $\left\{\vec{v}^{(1)},{\ldots},\vec{v}^{(N_D)}\right\}$ of unit vectors in $\mathbb{C}^{M}$, such that, for all $\rho^{(D)} \in \mathbf{St}_{D}$ and $\rho^{(T)} \in \mathbf{St}_{T}$:

$$\begin{equation*} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) = \sum_{k,l = 1}^{N_D} \vec{v}^{\left(k\right)}\cdot \vec{v}^{\left(l\right)} \rho^{\left(D\right)}_{kl} \vert k\rangle \langle l\vert \otimes U^{\left(k\right)} \rho^{\left(T\right)} U^{\left(l\right)\dagger}, \end{equation*}$$

where $\vec{v}^{(k)}\cdot \vec{v}^{(l)} = \sum_{j = 1}^{M} v_j^{(k)} v_j^{(l)*}$ is the dot product in $\mathbb{C}^M$, and $\rho^{(D)}_{kl}$ are the components of $\rho^{(D)}$ in the basis $\left\{\vert 1\rangle ,{\ldots},\vert N_D\rangle \right\}$ associated to the list of projectors $\vec{\Pi}$.

Proof. Take arbitrary elements $G \in \mathcal{G}_X$, $\rho^{(D)} \in \mathbf{St}_{D}$ and $\rho^{(T)} \in \mathbf{St}_{T}$. Since G is a CPTP operator, then, for some $M \unicode{x2A7E} 1$, there exists a set of Kraus operators $\left\{K_1,{\ldots},K_M \right\}$ on $\mathcal{H}_D \otimes \mathcal{H}_T$ that satisfy $\sum_j K_j^{\dagger}K_j = \unicode{x1D7D9}$ and

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) = \sum_{j = 1}^{M} K_j \left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) K_j^{\dagger}. \end{align} \tag{ B5 }$$

For each Kraus operator K_j let us introduce a set of $(N_D)^2$ operators $\{B_j^{(kl)}\}$ on $\mathcal{H}_T$, such that the following holds:

$$\begin{align} K_j = \sum_{k,l = 1}^{N_D} \vert k\rangle \langle l\vert \otimes B_j^{\left(kl\right)}, \end{align} \tag{ B6 }$$

where the basis vectors $\left\{\vert 1\rangle ,{\ldots},\vert N_D\rangle \right\}$ are the ones associated to the projectors $\vec{\Pi}$. Plugging in decomposition (B6) into the Kraus representation (B5) we obtain

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) = \sum_{j = 1}^{M}\sum_{k,l,n,m = 1}^{N_D} \rho_{lm}^{\left(D\right)} \vert k\rangle \langle l\vert \otimes B_j^{\left(kl\right)} \rho^{\left(T\right)} B_j^{\left(nm\right)\dagger}. \end{align} \tag{ B7 }$$

Since G is an element of $\mathcal{G}$, it satisfies

$$\begin{align} {\textrm{Tr}}_D \left[ \left(\Pi_s \otimes \unicode{x1D7D9} \right) G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) \right] = {\textrm{Tr}}_D \left(\Pi_s \rho^{\left(D\right)} \right) U^{\left(s\right)}\rho^{\left(T\right)}U^{\left(s\right)\dagger}, \end{align} \tag{ B8 }$$

for any $s = 1,{\ldots},N_D$. Together with equation (B7), this implies that the following holds for all $\rho^{(D)}, \rho^{(T)}$:

$$\begin{align} \sum_{j = 1}^{M}\sum_{l,m = 1}^{N_D} \rho_{lm}^{\left(D\right)} \otimes B_j^{\left(sl\right)} \rho^{\left(T\right)} B_j^{\left(sm\right)\dagger} = \rho_{ss}^{\left(D\right)}U^{\left(s\right)}\rho^{\left(T\right)}U^{\left(s\right)\dagger}. \end{align} \tag{ B9 }$$

Since the latter is valid for all density operators $\rho^{(D)}$, then it must also hold for for all operators in $\left\{\vert a\rangle \langle b\vert , a,b = 1{\ldots},N_D \right\}$, as the latter constitutes a basis for the space of density operators on $\mathcal{H}_D$. Therefore, for all $s,a,b = 1{\ldots},N_D$, and all $\rho^{(T)}$:

$$\begin{align} \sum_{j = 1}^{M} B_j^{\left(sa\right)} \rho^{\left(T\right)} B_j^{\left(sb\right)\dagger} = \delta_{s,a}\delta_{s,b} U^{\left(s\right)}\rho^{\left(T\right)} U^{\left(s\right)\dagger}. \end{align} \tag{ B10 }$$

It can be easily seen that equation (B10) implies that, for all j and s ≠ a:

$$\begin{align} B_j^{\left(sa\right)} = 0, \end{align} \tag{ B11 }$$

which motivates us to define a new set of operators $\{B^{(s)}_j \}$ on $\mathcal{H}_T$, such that $B_j^{(sa)} = \delta_{s,a}B_j^{(s)}$. Equation (B10) then implies that for all $s = 1,{\ldots},N_D$:

$$\begin{align} \sum_{j = 1}^{M} B_j^{\left(s\right)} \rho^{\left(T\right)}B_j^{\left(s\right)\dagger} = U^{\left(s\right)} \rho^{\left(T\right)} U^{\left(s\right)\dagger}. \end{align} \tag{ B12 }$$

Getting back to the initially introduced Kraus operators, it is simple to deduce from the normalization condition $\sum_j K_j^{\dagger}K_j = \unicode{x1D7D9}$ that the auxiliary operators $B_j^{(kl)}$ satisfy

$$\begin{align} \sum_{j = 1}^{M}\sum_{k = 1}^{N_D} B_j^{\left(kl\right)\dagger} B_j^{\left(kn\right)} = \delta_{l,n} \unicode{x1D7D9}, \end{align} \tag{ B13 }$$

for all $l,n = 1,{\ldots},N_D$. This in turn implies that the newly defined operators $\{B^{(s)}_j \}$ satisfy

$$\begin{align} \sum_{j = 1}^{M} B_j^{\left(s\right)\dagger}B_j^{\left(s\right)} = \unicode{x1D7D9}. \end{align} \tag{ B14 }$$

Equations (B12) and (B14) entail that for each s, the set $\{B_j^{(s)}, j = 1,{\ldots},M \}$ is a Kraus representation of the CPTP map $\mathcal{C}^{(s)}:\textbf{St}_T \rightarrow \textbf{St}_T$ that acts as

$$\begin{align} \mathcal{C}^{\left(s\right)}\left( \rho^{\left(T\right)}\right) = U^{\left(s\right)} \rho^{\left(T\right)} U^{\left(s\right)\dagger}, \end{align} \tag{ B15 }$$

for all $\rho^{(T)} \in \textbf{St}_T$. One Kraus representation of $\mathcal{C}^{(s)}$ is trivially given by $B_j^{(s)} = \delta_{j,1}U^{(s)}$. Now recall that all Kraus representations of a CPTP map are unitarily equivalent, meaning that for any two representations $\{B_j\}$ and $\{A_j\}$ of the same map, there exists a unitary operator u on $\mathbb{C}^M$, such that $A_i = \sum_{j = 1}^{M}u_{ij}B_j$. Therefore, for all s, all sets that satisfy equations (B12) and (B14) are unitarily equivalent to $\{\delta_{j,1}U^{(s)}\}$, which means that a set $\{B_j^{(s)}, j = 1,{\ldots},M \}$ satisfies equations (B12) and (B14) if and only if there exists a unitary operator $u^{(s)}$, such that $B_j^{(s)} = u^{(s)}_{j1}U^{(s)}$. Since the column $(u^{(s)}_{11},{\ldots},u^{(s)}_{M1})$ of any unitary operator $u^{(s)}$ on $\mathbb{C}^{M}$ is just a unit vector in $\mathbb{C}^{M}$, it follows that $\{B_j^{(s)} \}$ is a viable solution if and only if there exists a unit vector $\vec{v} \in \mathbb{C}^{M}$ such that $B_j^{(s)} = v^{(s)}_{j}U^{(s)}$, with $v^{(s)}_{j}$ being the jth component of vector $\vec{v}^{(s)}$ in some basis.

It thus follows from the defining equation (B6) that for any $G \in \mathcal{G}_X$, and any M-element-set of Kraus operators $\{K_1,{\ldots},K_M\}$ of G, there exists a set $\{\vec{v}_1,{\ldots},\vec{v}_{N_D}\}$ of unit vectors in $\mathbb{C}^M$, such that

$$\begin{align} K_j = \sum_{s = 1}^{N_D} v^{\left(s\right)}_j \vert s\rangle \langle s\vert \otimes U^{\left(s\right)}, \end{align} \tag{ B16 }$$

for all $j = 1,{\ldots},M$. Equation (B16), together with the definition of the Kraus representation, entails that for all $G \in \mathcal{G}$, there exists a natural number $M \unicode{x2A7E} 1$ and a set $\left\{\vec{v}_1,{\ldots},\vec{v}_{N_D}\right\}$ of unit vectors in $\mathbb{C}^M$, such that for all $\rho^{(D)} \in \mathbf{St}_D$ and $\rho^{(T)} \in \mathbf{St}_T$:

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) = \sum_{k,l = 1}^{N_D} \vec{v}^{\left(k\right)}\cdot \vec{v}^{\left(l\right)} \rho^{\left(D\right)}_{kl} \vert k\rangle \langle l\vert \otimes U^{\left(k\right)} \rho^{\left(T\right)} U^{\left(l\right)\dagger}, \end{align} \tag{ B17 }$$

where $\vec{v}^{(k)}\cdot \vec{v}^{(l)} = \sum_{j = 1}^{M} v_j^{(k)} v_j^{(l)*}$ is the dot product in $\mathbb{C}^M$. □

Let us briefly comment on two special cases of equation (B17). Consider a transformation G, which is such that all its corresponding vectors $\vec{v}^{(i)}$ are equal, i.e. $\vec{v}^{(i)} \cdot \vec{v}^{(j)} = 1$ for all $i,j$. Then it is easy to see that G represents an ideal unitary gate, such as the one that we have used in the main text's protocol, i.e.

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)}\right) = U\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)}\right)U^{\dagger}, \quad U = \sum_{k = 1}^{N_D}\vert k\rangle \langle k\vert \otimes U^{\left(k\right)}. \end{align} \tag{ B18 }$$

On the other hand, consider a gate G whose vectors are all mutually orthogonal, i.e. $\vec{v}^{(i)} \cdot \vec{v}^{(j)} = \delta_{i,j}$; then G acts as

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)}\right) = \sum_{k = 1}^{N_D} \rho^{\left(D\right)}_{kk} \vert k\rangle \langle k\vert \otimes U^{\left(k\right)} \rho^{\left(T\right)} U^{\left(k\right)\dagger}. \end{align} \tag{ B19 }$$

The latter gate erases the off-diagonal terms of $\rho^{(D)}$ in the basis defined by projectors $\vec{\Pi}$. In other words, it decoheres the device in the aforementioned basis, and may thus as well be understood as a 'classical control gate'.

Let us now use the obtained results to prove that any protocol that solves our task necessarily establishes entanglement between the target and the devices if k = 1. Applying definition 1 to equation (B4), we see that the set $\mathcal{G}_Y \equiv \mathcal{G}$ of generalized control gates that are allowed in our task is defined relative to the four-tuple $Y\equiv \langle N_D,N_T,\vec{U},\vec{\Pi}\rangle$, with the following identifications: $N_D = N$ and $N_T = N+1$, where N is the number of target objects; $\vec{U} = \langle S_1,{\ldots},S_N \rangle$ where the unitary operators S_i are swap-gates; and $\vec{\Pi} = \langle \Pi_1,{\ldots},\Pi_N \rangle$ is the set of projectors on states representing settings associated to the corresponding swap-gates. Lemma 1 then implies that for any $G \in \mathcal{G}_Y$, there exists a natural number $M \unicode{x2A7E} 1$ and a set $\left\{\vec{v}^{(1)},{\ldots},\vec{v}^{(N_D)}\right\}$ of unit vectors in $\mathbb{C}^M$, such that for all $\rho^{(D)} \in \mathbf{St}_D$ and $\rho^{(T)} \in \mathbf{St}_T$:

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)} \right) = \sum_{k,l = 1}^{N} \vec{v}^{\left(k\right)}\cdot \vec{v}^{\left(l\right)} \rho^{\left(D\right)}_{kl} \vert k\rangle \langle l\vert \otimes S_k \rho^{\left(T\right)} S_l, \end{align} \tag{ B20 }$$

where $\vec{v}^{(k)}\cdot \vec{v}^{(l)} = \sum_{j = 1}^{M} v_j^{(k)} v_j^{(l)*}$ is the dot product in $\mathbb{C}^M$. If the unknown bit k is equal to 0, then $\rho^{(T)}$ is equal to $\rho^{(T)}_0 = \vert 0\rangle \langle 0\vert$. Therefore, since $S_k \vert 0\rangle \langle 0\vert S_l = \vert 0\rangle \langle 0\vert$, then

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)}_0 \right) = \sum_{k,l = 1}^{N} \vec{v}^{\left(k\right)}\cdot \vec{v}^{\left(l\right)} \rho^{\left(D\right)}_{kl} \vert k\rangle \langle l\vert \otimes \rho^{\left(T\right)}_0. \end{align} \tag{ B21 }$$

On the other hand, if k = 1, then $\rho^{(T)}$ is equal to $\rho^{(T)}_1 = \vert 1\rangle \langle 1\vert$. Since $S_k \vert 1\rangle \langle 1\vert S_l = \vert k\rangle \langle l\vert$, then

$$\begin{align} G\left(\rho^{\left(D\right)} \otimes \rho^{\left(T\right)}_1 \right) = \sum_{k,l = 1}^{N} \vec{v}^{\left(k\right)}\cdot \vec{v}^{\left(l\right)} \rho^{\left(D\right)}_{kl} \vert k\rangle \langle l\vert \otimes \vert k\rangle \langle l\vert . \end{align} \tag{ B22 }$$

If we define the corresponding reduced density states of $\mathcal{D}$ as $\tilde{\rho}^{(D)}_k\equiv {\textrm{Tr}}_T [G(\rho^{(D)} \otimes \rho^{(T)}_k )]$, then equations (B21) and (B22) imply

$$\begin{align} \begin{split} & \tilde{\rho}^{\left(D\right)}_0 = \sum_{i,j = 1}^{N}\alpha_{ij}\vert i\rangle \langle j\vert ,\\ & \tilde{\rho}^{\left(D\right)}_1 = \sum_{i}^{N}\alpha_{ii}\vert i\rangle \langle j\vert , \end{split} \end{align} \tag{ B23 }$$

where $\alpha_{ij}\equiv \vec{v}^{(i)} \cdot \vec{v}^{(j)} \rho^{(D)}_{ij}$.

In order to be able to acquire some information about the value k via a measurement on $\mathcal{D}$, the two states $\tilde{\rho}^{(D)}_0$ and $\tilde{\rho}^{(D)}_1$ cannot be equal. Therefore, equation (B23) implies that the probability P_W of successfully solving the task can be higher than $\frac{1}{2}$ if and only if there exists at least one pair n ≠ m, such that $\alpha_{nm}\neq 0$. The latter is equivalent to the requirement that $\rho^{(D)}_{nm}\neq 0$ and $\vec{v}^{(n)} \cdot \vec{v}^{(m)} \neq 0$, which means that the initial state of $\mathcal{D}$ needs to have some coherence in the preferred basis chosen by projectors $\vec{\Pi}$, and that the gate cannot fully decohere the control in the latter basis, i.e. it cannot be a 'classical control gate'. This establishes a sense in which the task cannot be solved classically: the initial state of the control needs to be 'non-classical' in the sense of having coherence in the aforementioned basis, and the interaction between the device and the targets need to be non-classical, in the sense of preserving the device's coherence terms.

Now we are finally ready to inspect whether it is possible to gain some information about k without establishing entanglement between the device and the targets when k = 1. In other words, if $\alpha_{nm}\neq 0$ for at least one pair n ≠ m, is the state $G(\rho^{(D)} \otimes \rho^{(T)}_1 )$ necessarily entangled? We are going to answer this question by employing the PPT criterion, which states that a necessary condition for a quantum state ρ defined on $\mathcal{H}_A \otimes \mathcal{H}_B$ to be separable is that the partially transposed state $\rho^{T_B}\equiv (\unicode{x1D7D9}\otimes T)\rho$ does not have negative eigenvalues, where the transpose T acts as $T\vert i\rangle \langle j\vert = \vert j\rangle \langle i\vert$ [52]. Consequently, a sufficient (but generally not necessary) condition for a state to be entangled is that its partial transpose has at least one negative eigenvalue.

Let us apply the partial transpose operation on $\rho_1\equiv G(\rho^{(D)} \otimes \rho^{(T)}_1 )$, thereby obtaining

$$\begin{align} \left(\unicode{x1D7D9}\otimes T\right)\rho_1 = \sum_j \alpha_{jj} \vert j\rangle \langle j\vert \otimes \vert j\rangle \langle j\vert +\sum_{m < n} \alpha_{mn} \vert m\rangle \langle n\vert \otimes \vert n\rangle \langle m\vert + \sum_{m < n} \alpha_{mn}^* \vert n\rangle \langle m\vert \otimes \vert m\rangle \langle n\vert . \end{align} \tag{ B24 }$$

Now suppose that there exist k ≠ l, for which $\alpha_{kl}\neq 0$. Then it is simple to check that the vector $\vert \psi\rangle _{kl}$ defined as

$$\begin{align} \vert \psi\rangle _{kl}\equiv \vert k\rangle \otimes \vert l\rangle - \frac{\alpha_{kl}^*}{|\alpha_{kl}|}\vert l\rangle \otimes \vert k\rangle \end{align} \tag{ B25 }$$

is an eigenvector of $(\unicode{x1D7D9}\otimes T)\rho_1$ with its corresponding eigenvalue equal to $-|\alpha_{kl}|$, which is negative. Therefore, if $\alpha_{kl}\neq 0$ for some k ≠ l, then the state ρ₁ is necessarily entangled. We thereby completed the proof that a quantum-mechanical protocol that involves indistinguishable particles can outperform a random guess if and only if the device and the targets get entangled upon interaction when k = 1.