abstract: Wiesner's unforgeable quantum money scheme is widely celebrated as the first quantum information application. Based on the no-cloning property of quantum mechanics, this scheme allows for the creation of credit cards used in authenticated transactions offering security guarantees impossible to achieve by classical means. However, despite its central role in quantum cryptography, its experimental implementation has remained elusive because of the lack of quantum memories and of practical verification techniques. Here, we experimentally implement a quantum money protocol relying on classical verification that rigorously satisfies the security condition for unforgeability. Our system exploits polarization encoding of weak coherent states of light and operates under conditions that ensure compatibility with state-of-the-art quantum memories. We derive working regimes for our system using a security analysis taking into account all practical imperfections. Our results constitute a major step towards a real-world realization of this milestone protocol.
author: Mathieu Bozzio; Adeline Orieux; Luis Trigo Vidarte; Isabelle Zaquine; Iordanis Kerenidis; Eleni Diamanti
bibliography: ExpQuantumMoney_bib.bib
date: 2024-09-30
title: Experimental investigation of practical unforgeable quantum money

The fundamental property of quantum mechanics at the heart of quantum cryptography is the no-cloning theorem , which states that it is physically impossible to clone an unknown quantum system, that is, to generate two identical copies of the system starting from a single copy. This property in essence prevents a malicious party from recovering information about the system without disturbing it, something that is always possible in the classical world. In his seminal work , Wiesner used this property to show that by encoding classical information into conjugate quantum bases it is possible to protect the encoded information from forgery. For instance, classical bits can be encoded using the bases $\{|0\rangle,|1\rangle\}$ and $\{|+\rangle,|-\rangle\}$, with $|\pm\rangle = (|0\rangle \pm |1\rangle)/\sqrt{2}$, where the first qubit state in each basis encodes the bit 0 and the second the bit 1. Then, Heisenberg's uncertainty principle ensures that measuring the encoded qubit in one of the two bases destroys any information about the encoding in the other, while the no-cloning theorem ensures that only a party knowing the basis used for the encoding can unambiguously recover the encoded information upon measurement of the qubit. This idea was subsequently extensively used in many quantum cryptographic schemes , and in particular in the BB84 quantum key distribution protocol , which has since thrived as one of the most studied and successfully implemented quantum information applications .

The application that Wiesner's original work was interested in was unforgeable quantum money. The goal of a quantum money scheme is to perform an authenticated and efficient transaction between a client, a vendor and a bank via the use of a prepaid credit card (private-key money scheme) or between a client and a vendor via the use of banknotes (public-key money scheme), with maximal security guarantees. More precisely, in a quantum credit card system, a trusted bank uses a secret to preload a certain amount of money on a credit card, namely a device that contains encoded quantum information, and gives it to a client who can make payments to a vendor who has in his possession a credit card reader, namely a device that can access the card and communicate with the bank, which can then verify using the initial secret if the credit card is valid and can be used for the payment. The security guarantee is that the client cannot duplicate the credit card or increase the amount of money associated with it. In quantum banknotes, the difference is that the verification must be done without the help of the bank, hence there is no private key involved in the process.

In the classical world, money schemes are impossible with information-theoretic security and are therefore based on computational assumptions. In the quantum world, schemes for unforgeable quantum credit cards typically involve verification procedures with quantum communication with the bank . A simpler information-theoretically secure credit card scheme using classical communication during verification was proposed , and is based on hidden matching quantum retrieval games ; these typically involve several rounds of communication between the vendor and the bank and the use of specific entangled states, although these requirements have been improved recently . This classical verification scheme has also been further simplified to use again the so-called BB84 states as in the original Wiesner scheme, additionally taking into account realistic conditions . As regards to quantum banknotes, it is known that even in the quantum world such schemes cannot base their security solely on the no-cloning theorem but must also use some computational assumptions, such as knot problems or quantum obfuscation . This computational security is still interesting since in the classical world there can be no notion of mathematical security for banknotes; their security is based only on the fact that it is difficult for a counterfeiter to copy a banknote due to its intricate coloring and hologram design. Recent experimental work has shown how such quantum banknotes can be constructed on-the-fly but also forged . On the other hand, unforgeable quantum credit card schemes have never been implemented until now.

Here we develop and implement an on-the-fly version of a practical unforgeable quantum money scheme for credit card transactions for the first time (independent work implementing a hidden matching version of quantum money has appeared since in ). Our protocol builds upon the work in  in conjunction with the techniques developed in , and uses only BB84 states and a single round of classical communication for the verification. Our construction allows us to formulate conditions for correctness and security that can be experimentally tested. In particular, we derive conditions in scenarios of practical interest, corresponding to quantum memories based on single emitters or on atomic ensembles , and to implementations with weak coherent states. In all cases, we demonstrate that these conditions are rigorously satisfied experimentally using a practical photonic setup based on polarization encoding of weak coherent states of light, and we analyze operational regimes where unforgeability is guaranteed. Our experiment includes the full procedure of credit card state generation, readout and verification and is compatible with the future use of quantum storage devices, hence paving the way for the realization of quantum money transactions with information-theoretic security impossible to achieve in the classical world.

**The quantum money protocol.** To describe the protocol that we have analyzed, we first define a reduced scheme that guarantees a weak security condition, before extending it to a larger scheme with exponentially good security parameters. The reduced scheme is schematically shown in Fig. .

Let us assume that the bank prepares a prepaid credit card state, which for now consists of a single pair of qubits only, chosen from the following set using a random secret classical string $s$ : $$S_{\text{pair}}=\{|0+\rangle,|0-\rangle,|1+\rangle,|1-\rangle,|+0\rangle,|+1\rangle,|-0\rangle,|-1\rangle\},
\label{eq:Spair}$$ where $|0\rangle$, $|1\rangle$ and $|+\rangle$, $|-\rangle$ are the Pauli $\sigma_{z}$ and $\sigma_{x}$ basis eigenstates, respectively. The secret string $s$ consists of three bits, $\{b,c_0,c_1\}$, where $b=0$ indicates that the first qubit is encoded in the $\sigma_{z}$ basis and the second in the $\sigma_{x}$ basis, while $b=1$ indicates that the first one is encoded in the $\sigma_{x}$ basis and the second in the $\sigma_{z}$ basis. $c_0,c_1$ are the two encoded bits, with $0$ corresponding to the states $|0\rangle,|+\rangle$ and $1$ corresponding to the states $|1\rangle,|-\rangle$.

When a transaction is to be made, the following interactions occur: first, the client hands the credit card to the vendor, who chooses at random one out of two *challenge questions* and accesses the credit card, *i.e.*, performs a measurement on the stored qubits in order to get an answer for the selected challenge. As a second step, the vendor sends the classical bits corresponding to the chosen challenge, along with the answer obtained upon measurement, to the bank. Finally, the bank verifies the authenticity of the credit card using the secret string $s$ and responds with a yes or no. If the answer of the bank is yes then the transaction may occur, otherwise the card is rejected and declared as a counterfeit.

The two challenge questions, $Q_{zz}$ and $Q_{xx}$, read:

$Q_{zz}$ = *Guess the two bits $c_0,c_1$, such that the guess corresponding to the qubit prepared in the $\sigma_{z}$ basis is correct.*

$Q_{xx}$ = *Guess the two bits $c_0,c_1$, such that the guess corresponding to the qubit prepared in the $\sigma_{x}$ basis is correct.*

We may also define the conjunction of both challenges:

$Q_{\epsilon}$ = *Guess the two bits $c_0,c_1$.*

The main idea here is that a valid credit card can always be verified in the ideal case: the vendor performs a measurement in the $\sigma_{z} \otimes \sigma_{z}$ basis in order to verify the $Q_{zz}$ challenge, and in the $\sigma_{x} \otimes \sigma_{x}$ basis in order to verify the $Q_{xx}$ challenge. In general, we denote by $c$ the probability of successfully answering $Q_{zz}$ or $Q_{xx}$, and we call this the *correctness parameter*. In the ideal case, $c$ is equal to 1 for the above challenges: measuring both qubits in the $\sigma_{z}$ basis always answers the $Q_{zz}$ challenge correctly, and similarly for $Q_{xx}$. In a realistic implementation, however, $c$ might not be equal to 1 due to system imperfections. It might also take different values, $c_{zz}$ and $c_{xx}$, for $Q_{zz}$ and $Q_{xx}$, respectively. In this case, $c$ can be calculated as the average of $c_{zz}$ and $c_{xx}$, as we describe later.

Let us now see what happens if a dishonest client tries to duplicate the credit card. Since the 2-qubit state is unknown, there is no way that the two copies of the credit card can pass both challenges with high probability. The upper bound on this cheating probability has been derived in   and shown to be $3/4$. A crucial property of the game is that if one plays in parallel $t$ such games, then one can upper bound the probability a dishonest client can answer the challenge $Q_{\epsilon}$ for all $t$ games as $(3/4)^t$  . In other words, performing a general attack on the composite Hilbert space of all qubit pairs in the card cannot yield a higher cheating probability than performing an optimal attack on each individual pair. In general, we denote by $\epsilon$ the probability of successfully answering the conjunction challenge $Q_{\epsilon}$, *i.e.*, the probability of successfully cheating, and we call this the *security parameter* materializing the non-clonability of the quantum state. We refer to such a challenge game as a ($c$,$\epsilon$)-game $G$.

Starting from a $(c,\epsilon)$-game $G$ that consists of a single pair of qubits and for which the following relation between the correctness and the security parameter holds, $$c>\frac{\epsilon +1}{2},
\label{eq:cepsilon}$$ we can construct a different game $G'$ that consists of $n$ such pairs of qubits, where we denote by $|\$_{s}\rangle$ the $2n$-qubit state chosen by a randomly generated secret classical string $s$ of length $3n$. Here again, the vendor chooses at random one out of two challenge questions and performs a measurement on all $2n$ qubits accordingly (either $\sigma_{z} \otimes \sigma_{z}$ on all $n$ pairs or $\sigma_{x} \otimes \sigma_{x}$ on all $n$ pairs). If we now define the two challenges as: (i) answering the challenge $Q_{zz}$ correctly for at least a fraction $c-\delta$ of the $n$ pairs, and (ii) answering the challenge $Q_{xx}$ for at least a fraction $c-\delta$ of the $n$ pairs, where we define (see Methods) $$\delta =\frac{2c-\epsilon-1}{3}>0,
\label{eq:delta}$$ then we can use the analysis in , based on a Chernoff bound argument , and have that the correctness $c'$ and security $\epsilon'$ of the game $G'$ satisfy $$c'=1-e^{-\frac{cn}{2}\delta^{2}} \mbox{ and } \epsilon'=e^{-\frac{\epsilon n}{3}\delta^{2}}.
\label{eq:cepsilonprime}$$ This means that, for the game $G'$, the correctness parameter $c'$ is exponentially close to 1 and the security parameter $\epsilon'$ exponentially close to zero.

Since in our initial game $G$ we have $\epsilon = 3/4$, then we can see from Eq. () that in any secure implementation of the game $G$ we need to achieve $c > 7/8 = 0.875$. The more $c$ exceeds this bound, the better security (*i.e.*, the lower $\epsilon'$) we will get for a game $G'$ of size $n$.

The above description provides a game with exponentially good security parameters. By including quantum states that correspond to many such games in the same credit card as well as a unique classical serial number, one can use theorems from  to extend the above scheme into a quantum prepaid credit card scheme, where the quantum credit card may be re-used multiple times and a dishonest client cannot create a copy of the credit card even if he has in his possession multiple credit cards. Hence, satisfying Eq. () experimentally is enough to implement a full quantum money scheme with information-theoretic security given by correctness and security parameters from Eq. ().
**Security analysis for weak coherent states.** In our discussion up till now, we have assumed that the bank creates single-qubit states and stores them in the credit card. In practice, this assumption would be compatible with an implementation using either a quantum memory based on single emitters , which are expected to emit true single photons to be measured by the vendor for verification regardless of the input state used by the bank in the card preparation stage, or a quantum memory based on atomic ensembles  when the input state is a true single-photon state. In the following, we shall refer to this case as the "single-photon state" protocol. The correctness and security parameters defined above apply to this case.

In other cases of practical interest, however, we would like to use atomic-ensemble quantum memories and also weak coherent states as an input, as is typically the case, for instance, in quantum cryptographic applications . In this case, the memory preserves the Poisson photon statistics in the output state and simply introduces attenuation, hence reducing the average photon number per pulse $\mu$ that characterizes such states. The security threshold therefore has to be modified. More specifically, the bound that $c$ must exceed has to be a function of $\mu$. In the following, we shall refer to this case as the "weak coherent state" protocol. Our security analysis first considers specific attacks that may take place in an experimental implementation where the phase of each state is not randomized, namely unambiguous state discrimination (USD) attacks. As a second step, we derive a rigorous bound that applies to all attacks in the phase randomized case.

Starting with the non phase-randomized case, USD attacks are possible only for sets of linearly independent states , which is the case for the set of states used in our protocol when physically realized with weak coherent state encoding. A dishonest client willing to copy the credit card can perform specific positive operator valued measurements (POVM) to perfectly discriminate and identify a fraction of the states in the card. Successfully identifying one state in a pair allows the successful cloning of the whole pair, since the adversary knows that the other state is prepared in the conjugate basis. Following the analysis in Refs.  and  for our set of states, for $\mu \leq 2$, and assuming that no phase randomization is performed on our states, gives a probability for successful USD $$P_{D} = 2 e^{-\frac{\mu}{2}} \left(\sinh{\frac{\mu}{2}}-\sin{\frac{\mu}{2}}\right).$$

By a Chernoff bound argument , we then have that for $n$ pulses (in the $2n$-qubit sequence) that are created according to the Poisson distribution with a mean photon number $\mu$, with very high probability the number of pulses among these $n$ pulses for which the USD is successful is very close to its expectation. In other words, if $L_1,...L_n$ are random variables that take the value 1 if the pulse leads to a successful USD, then we have for the sum $L=\sum_i L_i$ that $$\label{eq:probL}
\Pr[L \geq (1+\eta) P_{D}] \leq e^{- \frac{P_{D}n}{3} \eta^2},$$ where $\eta > 0$ is a parameter accounting for finite number statistics that can be optimized as discussed further on.

We can now define a new parameter $\delta$ as $$\delta =\frac{2c-\epsilon-(1+\eta)P_{D}-1}{3}>0,
\label{eq:delta2}$$ and restate the condition of Eq. () as $$c>\frac{\epsilon + (1+\eta)P_{D} +1}{2},
\label{eq:cepsilon2}$$ leading to the following correctness and security parameters that take into account possible USD attacks: $$c'=1-e^{-\frac{cn}{2}\delta^{2}} \mbox{ and } \epsilon' \leq e^{-\frac{\epsilon n}{3}\delta^{2}} + e^{-\frac{P_{D}n}{3}\eta^2}.
\label{eq:cepsilonprime2}$$ Note that the second term in the expression of $\epsilon'$ comes from the fact that, in case $L$ is bigger than its expectation, then the dishonest client can perfectly cheat on a larger number of pairs.

A dishonest client may further boost his cheating probability by exploiting the losses present in a realistic implementation. In the presence of losses, the client having used USD to copy the card may indeed replace the states that he has successfully identified with states containing a higher average photon number $\mu$ at the input of the card reader, in order to increase the probability of detection by the vendor, and replace the ones that he failed to identify with vacuum states. Such a strategy will not be detected when a state is measured in the correct basis but it will induce an increase in the number of total clicks on the detectors registered by the card reader when a state is measured in the conjugate basis. As was shown in , in order for this cheating strategy to be detected and thus for the protocol to be secure, the total efficiency must fulfill the condition $$\eta_{\text{qm}}\eta_{\text{det}}>\frac{-\textrm{ln}(1-P_{D})}{\mu},
\label{eq:pertes}$$ where $\eta_{\text{qm}}$ is the retrieval efficiency of the quantum memory in the original valid card and $\eta_{\text{det}}$ is the detection efficiency of the card reader.

Thus, for the "weak coherent state" protocol, as long as it is possible to satisfy Eqs. () and () experimentally, then a quantum credit card scheme secure against USD attacks, characterized by correctness and security parameters given in Eq. (), can be implemented.

In the case where phase randomization is performed, then each weak coherent state appears to the adversary as a Poisson distributed mixture of Fock states : $$\frac{1}{2\pi}\int_{0}^{2\pi} |\sqrt{\mu} e^{i\phi}\rangle\langle\sqrt{\mu} e^{i\phi}|d\phi = e^{-\mu}\sum_{n=0}^{\infty}\frac{\mu^n}{n!}|n\rangle\langle n|$$

This allows us to derive a general security bound considering three distinct cases. If the state is a vacuum state, then there is no information content. If the state is a single-photon state, then the previous security analysis may be used against general attacks. If the state contains 2 photons or more, then we assume that the adversary may perfectly cheat. This allows us to derive a more pessimistic yet rigorous security threshold, $$c>\frac{\epsilon + (1+\eta)\lambda +1}{2},
\label{eq:cepsilonlambda}$$ where $\lambda=\frac{1-(1+\mu) e^{-\mu}}{1-e^{-\mu}}$, and $$c'=1-e^{-\frac{cn}{2}\delta^{2}} \mbox{ and } \epsilon' \leq e^{-\frac{\epsilon n}{3}\delta^{2}} + e^{-\frac{\lambda n}{3}\eta^2}.
\label{eq:cepsilonprimelambda}$$

As long as it is possible to satisfy Eq. () experimentally, then a quantum credit card scheme with information-theoretic security against all attacks performed on uniformly phase randomized weak coherent states, characterized by correctness and security parameters given in Eq. (), can be implemented.
**Experimental principle and setup.** In order to test in practice the security conditions from Eqs. (), () and () and identify suitable operation regimes, we have implemented an on-the-fly version of our quantum money protocol in which the qubit pairs of the credit card are sent directly to the vendor's card reader, without intermediate storage in a quantum memory. In our experiment we have not performed phase randomization (this can be implemented subsequently in the same manner as  ), hence the security bound of Eq. () has not been explicitly considered. The verification test consists in measuring the correctness parameters $c_{zz}$ for the challenge question $Q_{zz}$ and $c_{xx}$ for $Q_{xx}$ on blocks of $n$ qubit pairs, each of which is randomly chosen from the set of Eq. (). This is done by measuring each block in the $\sigma_{z}\otimes\sigma_{z}$ basis or in the $\sigma_{x}\otimes\sigma_{x}$ basis, respectively. As noted earlier, the correctness parameter is calculated as $c = (c_{zz} + c_{xx})/2$, and must exceed the thresholds from Eqs. () and () in order for the credit card to be validated by the bank. This does not compromise the security of the implementation as it is always possible to symmetrize the data by relabeling the bases such that in practice the two parameters become effectively the same. Once $c$ has been measured, the correctness and security of the full protocol can be estimated for the different scenarios from Eqs. () and ().

The experimental setup is shown in Fig. . The qubit pairs of the credit card state are encoded in the polarization of weak coherent states of light produced with standard optical communication components. The light emitted at $1564$ nm by a continuous-wave laser diode is first modulated using an acousto-optic modulator to produce pulses with a duration of $20\,\mu$s and a repetition rate of $20$ kHz. A variable optical attenuator is used to reduce the intensity of the pulses and set the average photon number per pulse $\mu$. Then, the light pulses go through a multi-stage polarization controller consisting of an electro-optic modulator, which sets the polarization of each pulse to horizontal, vertical, diagonal or antidiagonal, according to a suitable combination of applied voltages. These polarization states correspond to the qubit states $|0\rangle$, $|1\rangle$, $|+\rangle$ and $|-\rangle$, respectively. The voltage sequences applied to the controller are generated such that two successive pulses form a pair whose polarization state is randomly chosen from the set $S_{\text{pair}}$, as required by our protocol.

The value of $\mu$ is fixed for each experiment at the output of the polarization controller, as described in more detail in the Methods. Finally, the pulses are directed to the credit card reader, where the polarization state of each pulse is measured in either the $\sigma_z$ or the $\sigma_x$ basis by the combination of a half-wave plate, set at an angle $0^\circ$ or $22.5^\circ$ with respect to the horizontal direction, respectively, and a polarization beam splitter whose outputs are directed to two single-photon detectors labeled $D_{0/+}$ and $D_{1/-}$. At the end of the experiment, the data sets corresponding to the credit card state generated by the bank, the bases selected by the vendor, and the measurement outcomes obtained for the different challenge questions are analyzed to assess the security of our implementation.

**Quantum money results.** The experimental results for the values of $c_{zz}$, $c_{xx}$ and $c$, obtained for weak coherent states with different values of $\mu \leq 1$, are shown in Fig.  (green symbols). We also display the security thresholds corresponding to Eq. () for the "single-photon state" protocol (full pink line) and Eqs. () and  () for the "weak coherent state" protocol, which is plotted for different values of the parameter $\eta$ (dashed red and purple lines respectively). We post-select on events for which at least one of the detectors has clicked (see Methods for more details on the extraction of these parameters). We have also plotted simulations of the evolution of $c$ with $\mu$ (cyan lines) according to a theoretical model that takes into account Poisson statistics of weak coherent states, dark count probability, finite detection efficiency, state purity and post-selection of pulses where at least one detector clicks (see Methods for more details). The best fit of our data points corresponds to a state purity $p=93\%$. This reduced purity with respect to the $99.5\%$ purity obtained when all states in a block are, for instance, $\sigma_{z}$ eigenstates, is due to the large voltage differences that are required as an input to the polarization controller for different consecutive states in a block of random states. The limited response time of the involved electronics leads to state generation with non-optimal purity. Note that, even though we are using an attenuated laser in the experiment, our data also gives us a good estimation of the performance we would obtain with true single photons emitted with an efficiency $\mu$. Indeed (see Methods and Fig. ), for our regime of parameters, the expected value of the correctness parameter $c$ for single-photon states (blue lines in Fig. ) is extremely close to those for weak coherent states. Thus, our experimental data can be analyzed for the various input state and quantum memory configurations considered here.

For the "weak coherent state" protocol, the security threshold of Eq. (), taking into account USD attacks only, reaches 1 for $\mu \gtrsim 1$. Hence, for larger values of $\mu$, the protocol is insecure against USD attacks. Note that for the threshold of Eq. () which ensures security against any attack (for phase-randomized states), it can be seen that $\mu$ must not exceed $0.40$. The simulations in Fig.  also show that the protocol is insecure when the state purity $p$ drops below $76\%$, since the value of $c$ then falls below the USD attack security threshold. However, for $0.01 \leq \mu < 1$ and for $p \geq 0.76$, there is a wide region of parameters for which the protocol is secure against such attacks. Indeed, for our experimental results with $p=0.93$, the protocol is secure against USD attacks for values of $\mu$ up to 1. In Fig. , we show the security regions corresponding to Eq. () as a function of $\mu$ and $\eta_\textrm{tot}=\eta_{\text{qm}}\eta_{\text{det}}$: our experiments, with $\eta_{\text{qm}}=1$ and $\eta_{\text{det}}=0.25$, are situated in the secure region for all values of $\mu \leq 2$.

For the "single-photon state" protocol, the security threshold of Eq. () is constant and equal to $7/8=0.875$ for all values of $\mu$. Our experimental data, interpreted as if resulting from single-photon states with a polarization purity $p=0.93$ and an efficiency $0.02 \leq \mu \leq 1$, are secure and show a value of $c$ well above the security threshold. We also notice that the protocol can tolerate large attenuations even for relatively low values of purity.

The measured values for $c$ allow us to estimate the number $n$ of qubit pairs required for our prepaid quantum credit card scheme (corresponding to the game $G'$) to reach a high level of security. In Fig. , we show values for the correctness and security parameters $c'$ and $\epsilon'$ defined in Eq. () for the "single-photon state" protocol, using the experimental values $c=0.953 \pm 0.011$ for $\mu=1$ (full red line), $c=0.966 \pm 0.018$ for $\mu=0.10$ (dashed red line) and $c=0.953 \pm 0.014$ for $\mu=0.025$ (dotted red line). We see that, as $\epsilon'$ drops quickly with the number of qubit pairs $n$, a measured credit card state consisting of a number of pairs comprised between $10^{4}$ and $10^{5}$ is sufficient to reach an arbitrarily small cheating probability in this case, for a wide range of efficiencies $\mu \in [0.025;1]$. Note that when estimating $c'$ and $\epsilon'$, we use the lowest value for the experimental value of $c$ taking into account error bars of $5\sigma$. In this way, there is a probability no higher than $10^{-6}$ that the true $c$ value actually lies beneath this point.

In Fig. , we also display values for the correctness and security parameters $c'$ and $\epsilon'$ defined in Eq. () for the "weak coherent state" protocol, using the experimental values $c=0.953 \pm 0.011$ for $\mu=1$ (full blue line), $c=0.965 \pm 0.010$ for $\mu=0.40$ (mixed blue line), $c=0.966 \pm 0.018$ for $\mu=0.10$ (dashed blue line) and $c=0.953 \pm 0.014$ for $\mu=0.025$ (dotted blue line). The parameter $\eta$ has an opposite effect in the two terms in the expression of $\epsilon'$ and we find that these two terms must be roughly balanced. Values for $\eta$ have therefore been chosen accordingly, and we see that the optimal values strongly depend on $\mu$ : they must be increased as $\mu$ decreases. We also notice that, in general, states with large values of $\mu$ require a higher number of detected pairs than states with small values of $\mu$ in order to reach the same security level. However, as long as $\mu$ is not too big, the minimal number of pairs remains of the order of $10^{5}$, and this effect is counter-balanced by the fact that a higher value of $\mu$ increases the number of useful detected pulses and hence the number $n$ of detected pairs. Thus, despite this trade-off, in order to optimize the performance of the setup, it is in general preferable to keep $\mu$ as high as possible in order to maximize the number of detected pairs. We may therefore conclude that our proof-of-principle experiment for the "weak coherent state" protocol works optimally when $\mu\in[0.10;0.40]$.

The results that we have presented constitute the first on-the-fly implementation of provably unforgeable quantum money. Our implementation is based on a practical photonic setup with requirements close to those of standard quantum key distribution systems, which is used for quantum credit card on-the-fly generation and readout. The validation of our quantum money protocol and the chosen experimental conditions anticipate the future use of state-of-the-art quantum storage devices, based on single emitters or atomic ensembles, for real-world realization of credit card states.

The integration of our system with a quantum memory requires further developments, in particular to ensure wavelength matching and synchronization, and the full system will be mainly limited by the performance of the quantum storage device, in particular with respect to timing and losses. Regarding losses, we remark that our implementation has minimal channel losses as the transaction is performed locally, while detection losses are processed through our post-selection procedure and taken into account in our security analysis when practical weak coherent states are used in the implementation.

Our work sets a complete theoretical and operational framework for quantum money, and is fully compatible with presently existing quantum memories. In this sense, we provide a crucial experimental benchmark for unforgeability of quantum money, and for any other application where our transaction framework may be relevant.

**Derivation of $\bm \delta$.** For the completeness of game $G'$, we have that the honest client must ensure at least $c-\delta$ of the $Q_{xx}$ challenges, or at least $c-\delta$ of the $Q_{zz}$ challenges, are answered correctly. The correctness $c'$ in the first half of Eq. () comes from a simple Chernoff bound, since the client succeeds with probability $c$ in the challenge. In order to prove that the security parameter $\epsilon'$ is the one given in the second part of Eq. (), it suffices to show that the cheating client has to ensure the challenge $Q_{\epsilon}$ is answered correctly for a fraction of at least $\epsilon+\delta$ of the games $G$ in order to cheat in $G'$. Note that the client must be able to ensure the correct answer for at least a fraction of $c-\delta$ of each of the two challenges and hence the fraction of games where both challenges must be answered is at least $2(c-\delta)-1$, as illustrated below:

Making this equal to $\epsilon+\delta$ provides the value of $\delta$ for the "single-photon state" protocol: $$\begin{aligned}
\epsilon + \delta  & = & 2(c-\delta) - 1\nonumber\\
\delta & = & \frac{2c-\epsilon-1}{3}
\label{eq:delta}
\end{aligned}$$ For the "weak coherent state" protocol, taking into account the Poissonian nature of these states, we have that the extra probability $(1+\eta)P_{D}$ of successful USD per pulse goes straight to the adversary. Equation () may then be rewritten as $$\delta=\frac{2c-\epsilon - (1+\eta)P_{D}-1}{3}.$$

**Setting of $\bm \mu$.** The value of $\mu$ in our experiment is defined as the average photon number per single-photon-detector gate at the output of the polarization controller. It can be expressed as follows: $$\mu = \frac{\lambda}{hc}\frac{\tau_{\text{gate}}}{\tau_{\text{pulse}}}\frac{\eta_{\text{PC}}\:r_{\text{split}}\:P_{99\text{mean}}}{f_{\text{rep}}},$$ where $\lambda=1564$ nm is the wavelength, $h$ is Planck's constant, $c$ is the speed of light in vacuum, $\tau_{\text{gate}}=500$ ps is the duration of the detection gate of the single-photon detectors, $\tau_{\text{pulse}}=20\,\mu$s is the duration of the light pulses, $f_{\text{rep}}=20$ kHz is the repetition rate of these pulses, $r_{\text{split}}$ is the exact splitting ratio of the 99/1 beam splitter, $\eta_{\text{PC}}=0.50$ is the transmission coefficient of the polarization controller and $P_{99\text{mean}}$ is the mean power measured at the 99 output of the 99/1 beam splitter.

**Extraction of $\bm c_{zz}$ and $\bm c_{xx}$.** We estimate the values of the correctness parameters from the experimental results by post-selecting pulses where at least one of the single-photon detectors clicked as follows: $$\begin{aligned}
c_{zz} &=& \frac{1}{2}(c_0+c_1) \nonumber \\
&=& \frac{1}{2}\frac{N_{|0\rangle}(D_{0/+}\,\text{only})}{N_{|0\rangle}(D_{0/+}\,\text{or}\,D_{1/-})} \nonumber \\
&+& \frac{1}{2}\frac{N_{|1\rangle}(D_{1/-}\,\text{only})}{N_{|1\rangle}(D_{0/+}\,\text{or}\,D_{1/-})},
\end{aligned}$$ and $$\begin{aligned}
c_{xx} &=& \frac{1}{2}(c_++c_-) \nonumber \\
&=& \frac{1}{2}\frac{N_{|+\rangle}(D_{0/+}\,\text{only})}{N_{|+\rangle}(D_{0/+}\,\text{or}\,D_{1/-})} \nonumber \\
&+& \frac{1}{2}\frac{N_{|-\rangle}(D_{1/-}\,\text{only})}{N_{|-\rangle}(D_{0/+}\,\text{or}\,D_{1/-})},
\end{aligned}$$ where $c_s$ is the fidelity of the state $|s\rangle$, $N_{|s\rangle}(D_{0/+}\,\text{or}\,D_{1/-})$ is the number of pulses corresponding to the state $|s\rangle$ that generated a click on at least one of the detectors, $N_{|s\rangle}(D_{0/+}\,\text{only})$ and $N_{|s\rangle}(D_{1/-}\,\text{only})$ are the number of pulses corresponding to the state $|s\rangle$ that generated a click on the detector $D_{0/+}$ but not on the detector $D_{1/-}$ or on $D_{1/-}$ but not on $D_{0/+}$, respectively, with $s=0,1,+,-$.

The parameter $c_{zz}$ is estimated from measurements performed in the $\sigma_z$ basis for the entire block, *i.e.*, with the half-wave plate rotated to $0^\circ$, while $c_{xx}$ is estimated from measurements performed in the $\sigma_x$ basis for the entire block, *i.e.*, with the half-wave plate rotated to $22.5^\circ$.

**Statistical errors.** The pulse sequences used for measuring $c_{zz}$ and $c_{xx}$ for each value of $\mu < 1$ consisted of $3\times10^6$ pulses (*i.e.*, $1.5\times10^6$ pairs) before post-selection. Each of the four polarization states was generated with probability $0.25$, that is, each state was produced $7.5\times 10^{5}$ times in the random sequence. The total number of post-selected pairs for each block was comprised between $1.3\times 10^{5}$ and $2.6\times 10^{5}$ depending on the value of $\mu$ and for a detection efficiency of $25\%$. Errors on the correctness parameters were estimated by propagating the Poisson errors of the click counting.

**Theoretical models for $\bm c$.** The correctness parameter and its evolution with $\mu$ can be simulated with a simple theoretical model taking into account experimental parameters. This model was used to plot the simulation curves in Fig. . We model the polarization state generated by the polarization controller as a density matrix $\rho = p|s\rangle\langle s| + (1-p)\frac{\mathop{\mathrm{\mathds{1}}}}{2}$, where $|s\rangle$ is the ideal target state, with $s=0,1,+,-$, $\mathop{\mathrm{\mathds{1}}}$ is the identity matrix and $p$ is the polarized fraction of the light.

This polarization state is associated with a weak coherent state $|\alpha\rangle =  e^{-\frac{\mu}{2}}\sum_{n=0}^{\infty} \frac{\alpha^n}{\sqrt{n!}}|n\rangle$ with mean photon number $\mu = |\alpha|^2$. For a threshold single-photon detector with detection efficiency $\eta_{\text{det}}$ and dark count probability per detection gate $P_{dc}$, the click probabilities for $\rho$ can be expressed as: $P(D_{s})=P_{dc}+\big(1-e^{-\mu\eta_{\text{det}}}\big)(1+p)/2$ and $P(D_{\bar{s}})=P_{dc}+\big(1-e^{-\mu\eta_{\text{det}}}\big)(1-p)/2$, where $s={0/+}$ and $\bar{s}={1/-}$ if $s=0,+$, and $s={1/-}$ and $\bar{s}={0/+}$ if $s=1,-$. If instead, we consider true single-photon states, with an emission efficiency $\mu$, the click probabilities for $\rho$ are: $P(D_{s})=P_{dc}+\mu\eta_{\text{det}}(1+p)/2$ and $P(D_{\bar{s}})=P_{dc}+\mu\eta_{\text{det}}(1-p)/2$.

In both cases, the state correctness, post-selected on events with at least one click, can be expressed as: $c_s=\frac{P(D_{s})\big(1-P(D_{\bar{s}})\big)}{1-\big(1-P(D_{s})\big)\big(1-P(D_{\bar{s}})\big)}$.

We thank Julien Laurat and Frederic Grosshans for useful discussions. This research was supported by the European Research Council project QCC, the French National Research Agency project quBIC and the BPI France project RISQ.


abstract: Experimental joint multiplicity distributions of neutrons and charged particles provide a striking signal of the characteristic decay processes of nuclear systems following energetic nuclear reactions. They present, therefore, a valuable tool for testing theoretical models for such decay processes. The power of this experimental tool is demonstrated by a comparison of an experimental joint multiplicity distribution to the predictions of different theoretical models of statistical decay of excited nuclear systems. It is shown that, while generally phase-space based models offer a quantitative description of the observed correlation pattern of such an experimental multiplicity distribution, some models of nuclear multifragmentation fail to account for salient features of the observed correlation.

**Statistical Interpretation of Joint Multiplicity Distributions of Neutrons and Charged-particles** J. Tõke, D.K. Agnihotri, W. Skulski, and W.U. Schröder
*Department of Chemistry and Nuclear Science Research Laboratory,
University of Rochester, Rochester, New York 14627*

Nuclear multifragmentation, the production of multiple intermediate-mass fragments (IMFs) in individual reaction events, has been one of the central issues in intermediate-energy heavy-ion reactions in the last decade. The theoretical effort to understand this phenomenon is largely driven by an expectation that this process may reveal a macroscopic behavior of nuclear matter at very high excitation energies that is qualitatively different from its behavior at lower excitation energies. Of particular interest in this context is the prospect of probing the nuclear liquid-gas phase transition, which has often been associated with multiple IMF production. Parallel with purely theoretical effort, a search has been conducted for experimental signatures that could be connected to certain IMF production scenarios by means of simple and reliable simulation calculations. At the present stage of this research, select partial sets of experimental observations are apparently consistent with different reaction scenarios and mutually exclusive physical concepts. For further progress in the understanding of the reaction mechanism, it is therefore essential to identify reliable experimental observations that would challenge some but not other models and propositions. It now appears, that the directly measured joint distribution of neutron and charged-particle multiplicities is one such reliable observable. The significance of this observable, in general, and for the ongoing discussion regarding the character of multi-fragmentation, in particular, has gone so far largely unnoticed, due to a seemingly trivial character of the information contained in the above joint distributions. The present work demonstrates the discriminative power of the combined multiplicity observable in two sample analyses.

Fig. 1 shows a typical joint distribution of neutron and light charged-particle multiplicities, $m_n$ and $m_{LCP}$, as observed in the $^{209}$Bi+$^{136}$Xe reaction at E/A=28 MeV and reported on earlier. The notable feature of the observed distribution is the presence of a well-defined correlation ridge with a characteristic bend around ($m_n$,$m_{LCP}$) $\approx$ (15,0). When following the crest of the correlation ridge in Fig. 1 beginning from the origin of the plot, one first encounters a rather long segment running straight and parallel to the $m_n$ axis. Along this first segment, $m_{LCP}\approx 0$ and, hence, the role of the charged-particle emission is insignificant. The latter decay mode becomes a factor only when the measured neutron multiplicity exceeds rather significant values of the order of $m_n$=15 (corresponding to a true, efficiency-corrected value of $m_n\approx$`<!-- -->`{=html}30). At above multiplicities of $m_n\approx$ 15, the crest of the correlation ridge is seen to part with the neutron multiplicity axis and run at a constant angle with respect to the $m_n$ axis, until a saturation in both, neutron and LCP multiplicities is reached. It is the presence of the first, $m_{LCP}\approx 0$ segment of the joint distribution and its appreciable length that poses a challenge to some propositions regarding IMF production.

>  Fig. 1. Experimental$^9$ logarithmic (base 2) contour plot of the joint distribution of neutron and charged-particle multiplicities. Trends predicted by the codes SMM,$^7$ MMMC,$^8$, and GEMINI$^{20}$ are illustrated by circles, squares, and a dashed line, respectively. The slanted bars attached to some of the theoretical data points illustrate the (efficiency-corrected) local orientation and lengths (FWHM) of the major and minor axes of the $m_n$-$m_{LCP}$ covariance tensor for a fixed total excitation energy.

It is important to emphasize that the above two-segment topography of the correlation ridge in the joint $m_n$ *vs.* $m_{LCP}$ distribution has been observed for many systems and at different bombarding energies. The pertinent feature discussed above is also consistent with earlier observations of average neutron and charged-particle multiplicity correlations for other systems. As a matter of fact, the same characteristic shape has been observed in any experiment where such joint distributions or average correlations were measured. These experiments include those studying reactions induced by relativistic protons and antiprotons.

The behavior seen in Fig. 1 is consistent with a dominantly statistical, phase-space governed, emission scenario of neutrons and light charged products. One expects that the lack of a Coulomb barrier for neutrons would lead to a strong dominance of the neutron emission channels at low excitation energies and, hence, to the presence of the first, $m_{LCP}\approx 0$ segment of the correlation ridge. Simulation calculations confirm that phase-space models, such as the evaporation model GEMINI and the Copenhagen model of simultaneous multi-fragmentation (SMM), reproduce quite accurately the topography of the correlation ridge in Fig. 1 and, especially, the location of the crest line of the experimental ridge. As an example, the results of SMM and GEMINI calculations are indicated in Fig. 1 by solid dots and the dashed line, respectively. The "error" bars attached to the dots illustrate the orientation and the lengths (in terms of FWHM) of the main axes of the theoretical correlation tensor of the neutron and LCP multiplicities for fixed excitation energies. In the above model calculations, it was assumed that neutrons and light-charged particles are emitted from fully-accelerated projectile- and target-like fragments produced in the primary dissipative collision. Such an assumption is justified by the experimental observation that, for heavy-ion reactions of interest here and low kinetic-energy losses, particle emission patterns are characteristic of dominantly statistical emission from two equilibrated sources, with only a weak contribution of pre-equilibrium emission to the particle yield. Subsequently, the raw theoretical predictions have been corrected for the efficiency of the Rochester RedBall neutron multiplicity meter, used in the measurement of the joint multiplicity distribution shown in Fig. 1. These efficiencies were calculated using a modified version of the Monte Carlo code DENIS, which has been calibrated using various sets of experimental data. For the assumed binary kinematics, they are in the range of 55% – 61%.

In view of the above, an interpretation of the correlation ridge seen in Fig. 1 in terms of a dominantly statistical process is well warranted. This is especially true for low total excitation energies, on which the conclusions of the present paper rely.

The importance of the experimental measurements of joint distributions of neutron and LCP multiplicities is demonstrated by the fact that not all prominent models for the decay of hot nuclear matter account for the gross trends observed in the experimental data. Quite obviously then and, possibly, contrary to one's intuition, these trends are not trivial at all. Notably, the Berlin microcanonical fragmentation model, as implemented in the Metropolis Monte Carlo code MMMC, does not reproduce satisfactorily the first, relatively long segment of the $m_n$ *vs.* $m_{LCP}$ correlation ridge parallel to the $m_n$ axis. Instead, as illustrated by the triangles in Fig. 1, the model predicts a correlation ridge that is characterized by an approximately straight proportionality between average multiplicities of neutrons and charged-particles. We note, that calculations for all three models were performed for identical initial conditions, to provide for a meaningful comparison.

It is clear from Fig. 1 that MMMC calculations largely underestimate the role of neutron emission channels in the decay of excited nuclear systems and apportion the thermal energy incorrectly to the different particle types. While the physics captured by the MMMC, on the one hand, and the SMM, on the other hand, appears to be very similar, these two codes differ strongly in the way they treat fragment excitation and neutron emission. In the SMM, neutrons are allowed to be emitted sequentially from thermally equilibrated excited primary fragments, whereas the MMMC requires *all* the emitted neutrons to be in a narrow band of continuum states simultaneously at one particular moment in time, while the core fragments are essentially cold. Obviously, the latter process is statistically much less likely than sequential emission from hot fragments. It is this difference in the treatment of neutron emission that makes the predictions by the MMMC for the $m_n$ *vs.* $m_{LCP}$ correlations qualitatively different from the predictions by the SMM for the same experimental observable. Furthermore, in the MMMC, the neutron multiplicity is largely determined by the choice of weight factors describing different multiplicities of "evaporated" neutrons. Conceptually, these weight factors are to represent the density of micro states of the collection of all "evaporated" neutrons at a given total energy of this collection. However, in the MMMC, they are approximated by

$$\label{eq:weight}
W_p\propto V_p^{m_{ev}},$$

where $V_p$ is the volume of a spherical shell in momentum space, enclosed between $p_{min} = \sqrt{2U_n}$ ($U_n$ = 50 MeV being the depth of the single-neutron potential well) and a "suitably chosen" $p_{max}$. In Eq. , $m_{ev}$ is the multiplicity of "evaporated" neutrons. The momentum distribution described by Eq. , corresponds not to a definite energy but to a broad spectrum of the total energy of all "evaporated" neutrons and, hence, $W_p$ are not microcanonical, as are most (but not all remaining) weight factors in the MMMC. One notes, that in the MMMC, the competition by channels with various neutron multiplicities is largely decided by what is termed a "suitable choice" of a critical parameter $p_{max}$ in a particular (non-microcanonical) parameterization of $W_p$ via Eq. . Therefore, the discrepancy between the MMMC prediction, on the one hand, and the predictions by the codes SMM and GEMINI, on the other hand, cannot be traced to any physical effects, but rather to the accuracy of mathematical/physical shortcuts adopted by the MMMC.

The utility of the joint multiplicity distributions ($m_n$ *vs.* $m_{LCP}$) as a powerful tool for scrutinizing theoretical concepts is further demonstrated in the context of pseudo-Arrhenius plots for multi-IMF distributions. In an ongoing discussion, the merits of a proposed statistical interpretation of pseudo-Arrhenius plots for nuclear multi-fragmentation have been debated.. Two types of such plots have been considered in the published literature. In the first one, the logarithm of an inverse "binomial probability" ln($1/p$) is plotted versus the inverse square root of the transverse kinetic energy $1/\sqrt{E_t}$ of charged reaction products. In the second realization, the average IMF multiplicity $<m_{IMF}>$ is plotted versus $1/\sqrt{E_t}$. The "binomial probability" $p$ has been introduced based on an experimental discovery that IMF multiplicity distributions for any given transverse energy are well approximated by binomial distributions:

$$\qquad P_n^m(p) = {m!\over n!(m-n)!}p^n(1-p)^{m-n}\;,
\label{eq_bindist}$$

where $m$ and $p$ are the number of trials and the probability for success in any one of these trials, respectively. The transverse energy is defined as $E_t=\Sigma E_ksin^{2}(\Theta_k)$, where the summation extends over all charged products, excluding fission fragments and projectile- or target-like residues, and $\Theta_k$ is the emission angle of the $k$-th product. The declared, rationale for these kinds of plots is the expectation that for statistical IMF emission, the emission probability should be proportional to the Boltzmann factor $e^{-B/T}$, where $B$ is an effective emission barrier and $T$ is the nuclear temperature. This rationale relies critically on the validity of the assumption that the nuclear temperature $T$ is proportional to $\sqrt{E_t}$, which presumes a direct proportionality between $E_t$ and the thermal excitation energy $E^*$. These assumptions also entail that $E^*$ is proportional to the square of the temperature, as is proper for a Fermi gas. The validity of the two above assumptions determines the appropriateness of an interpretation of pseudo-Arrhenius plots in terms of thermal scaling, proposed in a series of recent papers. For example, had $E_t$ depended quadratically or exponentially on $E^*$, there would have been no obvious justification for choosing an abscissa variable $1/\sqrt{E_t}$ for the pseudo-Arrhenius plots. Accordingly, these papers rely on limited simulation calculations, which always explicitly state and take for granted, a strict proportionality between $E_t$ and $E^*$. However, the character of the joint multiplicity distributions discussed above demonstrates unambiguously the lack of even an approximate, or average, proportionality between $E_t$ and $E^*$. This is so, because neutrons are not included in the experimental definition of the transverse energy $E_t$ in the quoted work, whereas neutron emission is seen and understood to be essentially the only significant decay channel available to medium-weight or heavy nuclear systems at excitation energies of up to several hundred MeV. As a result, $E_t\approx 0$ for the first few hundreds of MeV of the total excitation energy, precluding direct proportionality between $E_t$ and $E^*$ at higher excitation energies.

>  Fig. 2. Dependence of the transverse energy $E_t$ on the total excitation energy $E^*$ for the reaction $^{197}$Au+$^{129}$Xe, as predicted by the SMM$^7$ (lines), GEMINI$^{20}$ (circles), and MMMC$^8$ (boxes) codes. The solid and dashed lines represent calculations made assuming equal excitation energies $E^*$ or equal temperatures $T$ of the projectile- and target-like fragments.

Fig. 2 shows the average functional dependence of $E_t$ on $E^*$, as predicted by the codes SMM (solid and dashed lines) and GEMINI (circles) for the system $^{197}$Au+$^{129}$Xe discussed in a recent paper. This system is very close to the $^{209}$Bi+$^{136}$Xe system, discussed earlier above, for which the joint multiplicity of neutrons and charged particles has been actually measured. Hence, it is expected that the SMM and GEMINI models provide for an adequate description of this system as well and, in particular, for the description of the initial segment of the $m_n$–$m_{LCP}$ correlation ridge parallel to the $m_n$ axis. It is the presence of this segment that translates directly and unambiguously into the strong nonlinearity of the functional relationship between $E_t$ and $E^*$ and the lack of a direct proportionality between these two quantities in the range of excitation energies considered in the above papers. For comparison, the predictions by the code MMMC are shown in Fig. 2 by squares. As expected based on the trends exhibited by the MMMC calculations in Fig. 1, the MMMC predicts almost a straight proportionality between $E_t$ and $E^*$.

The two almost overlapping curves in Fig. 2 represent two extreme assumptions made regarding the excitation energy division between Au-like and Xe-like primary fragments, equal excitation energies or equal temperatures (excitation energies are proportional to the masses) of projectile-like and target-like fragments. Obviously, the results exhibit a remarkable insensitivity to the excitation energy division between the fragments. The non-linear functional dependence seen in Fig. 2 can be approximated by two linear segments: $E_t=0$, for $E^*< E^*_o$, and $E^*= a(E^*-E^*_o)$ for $E^*>E^*_o$, where the offset is $E^*_o\approx
340$ MeV and the slope is $a\approx 0.25$.

>  Fig. 3. Nonlinearity of the relationship between the inverse square-roots of $E_t$ and $E^*$ (dashed line) and the resulting nonlinearity of an Arrhenius-like plot, obtained by converting the abscissa of a previously published$^{10,11}$ pseudo-Arrhenius plot for the system $^{197}$Au+$^{129}$Xe (solid line).

The functional dependence seen in Fig. 2 results in a strongly nonlinear relationship between the true "thermal" Arrhenius variable $1/T$ or its measure $1/\sqrt E^*$, on the one hand, and the pseudo-Arrhenius variable $1/\sqrt{E_t}$, on the other hand, over the full range of values considered in the recent papers. This relationship is illustrated by the dashed line in Fig. 3. Accordingly, the persistent striking linearity of experimental pseudo-Arrhenius plots implies a similarly persistent nonlinearity of such plots when converted to a true Arrhenius abscissa $1/T$ or $1/\sqrt{E^*}$. To further demonstrate this point, the solid line in Fig. 3 represents a typical experimental plot converted to a representation where $1/\sqrt{E^*}$ is the abscissa variable. The solid line is obtained based on experimental data for a representative atomic number of $Z$ = 8 and the relationship between $E_t$ and $E^*$ seen in Fig. 2. Obviously, the nonlinearity of the Arrhenius-like plot in Fig. 3 contradict previous conclusions of thermal or microcanonical scaling of IMF distributions. These observations also demonstrate independently that true and pseudo-Arrhenius plots are not equivalent to each other, a fact that has been pointed out earlier on somewhat different grounds.

In conclusion, the joint distributions of neutron and charged-particle multiplicities offer a powerful tool for scrutinizing certain theoretical models and concepts. This has been demonstrated here for two different examples. While the statistical-equilibrium model GEMINI and the Copenhagen model of simultaneous multifragmentation SMM provide a quantitative account of these distributions, the Berlin model of microcanonical fragmentation does not predict the characteristic long $m_{LCP}\approx 0$ segment in the $m_n$ *vs.* $m_{LCP}$ correlation ridge. The experimental joint $m_n$ *vs.* $m_{LCP}$ multiplicity distributions confirm predictions by phase-space models that there is an appreciable offset (in $E^*$) in the approximately linear functional relationship between average transverse energy $E_t$ of charged particles and average total excitation energy $E^*$ at energies above some threshold energy of $E^*_o\approx
340$ MeV. This observation challenges conclusions regarding thermal or microcanonical scaling of multifragmentation, which are all based on the assumption of a direct proportionality between $E_t$ and $E^*$. The present study has demonstrated again the difficulty to interpret in an unambiguous fashion isolated effects observed in complex nuclear reactions. This experience stresses the necessity of a more holistic analysis of energetic nuclear reactions, where many facets of experimental observations are considered simultaneously. Such an approach requires the simultaneous measurement of as many experimental observables as possible and singling out all "probative" correlations that contradict some but not other theoretical or intuitive concepts. More specifically, the present work has demonstrated the great importance of measuring neutron data along with those for charged reaction products.

This work was supported by the U.S. Department of Energy grant No. DE-FG02-88ER40414.


abstract: With present-day detectors in high energy physics one often faces fast analog pulses of a few nanoseconds length which cover large dynamic ranges. In many experiments both amplitude and timing information have to be measured with high accuracy. Additionally, the data rate per readout channel can reach several MHz, which leads to high demands on the separation of pile-up pulses.
  .
  For an upgrade of the COMPASS experiment at CERN we have designed the GANDALF transient recorder with a resolution of 12bit@1GS/s and an analog bandwidth of 500MHz. Signals are digitized with high precision and processed by fast algorithms to extract pulse arrival times and amplitudes in real-time and to generate trigger signals for the experiment. With up to 16 analog channels, deep memories and a high data rate interface, this 6U-VME64x/VXS module is not only a dead-time free digitization unit but also has huge numerical capabilities provided by the implementation of a Virtex5-SXT FPGA. Fast algorithms implemented in the FPGA may be used to disentangle possible pile-up pulses and determine timing information from sampled pulse shapes with a time resolution better than 50ps.
author: S. Bartknecht, H. Fischer, F. Herrmann, K. Königsmann, L. Lauser, C. Schill, S. Schopferer, H. Wollny [^1] [^2] [^3] [^4] [^5] [^6]
title: Development and Performance Verification
  of the GANDALF High-Resolution Transient
  Recorder System

# Introduction

COmmon Muon and Proton Apparatus for Structure and Spectroscopy (COMPASS) at the CERN SPS is a state-of-the-art two stage magnetic spectrometer with a flexible setup to allow for a rich variety of physics programs to be performed with secondary muon or hadron beams. Common to all measurements is the requirement for highest beam intensity and interaction rates with the needs of a high readout speed. Recently a proposal has been submitted for studies of Generalized Parton Distributions (GPD), which combine both nucleon electromagnetic form factors and Parton Distribution Functions. Constraining quark GPDs experimentally by measuring exclusive Deeply Virtual Compton Scattering (DVCS) shows great promise for the disentanglement of the nucleon's spin budget. For the upcoming DVCS measurements the existing COMPASS spectrometer will be extended by a new 2.5m long liquid hydrogen target, which will be surrounded by a new recoil proton detector based on scintillating counters. The high luminosity of about $10^{32}\:\text{cm}^{-2}\text{s}^{-1}$ and the background induced by the wide beam halo will yield rates of the order of several MHz in the recoil detector counters. This imposes great demands on the digitization units and on a hardware trigger based on the recoiled particle. For this purpose we have developed within the GANDALF framework a modular high speed and high resolution transient recorder system featuring digital pulse processing in real-time.

# The GANDALF Framework

GANDALF (Fig. ) is a 6U-VME64x/VXS carrier board which can host two custom mezzanine cards. It has been designed to cope with a variety of readout tasks in high energy and nuclear physics experiments. The exchangeable mezzanine cards allow an employment of the system in very different applications such as analog-to-digital or time-to-digital conversions, coincidence matrix formation, fast pattern recognition or fast trigger generation. Currently two types of mezzanine cards are available: ADC cards and LVDS input cards. Another model with optical interfaces is foreseen to receive data from remote detector frontend modules.

When GANDALF is used as a transient recorder, the carrier board is equipped with two ADC mezzanine cards. A schematic overview is provided in Fig. . The heart of the board is a Xilinx VIRTEX5-SXT FPGA which is connected to each mezzanine card by several single ended and 120 differential signal interconnections. The data processing FPGA can perform complex calculations on data which have been acquired on the mezzanine cards to extract time and amplitude information of the sampled pulses.

Fast and deep memory extensions of 144-Mbit QDRII+ and 4-Gbit DDR2 RAM are connected to a second Virtex5 FPGA. Both FPGAs are linked to each other by eight bidirectional high-speed Aurora lanes with a total bandwidth of 25Gbit/s per direction.

Connected to the VXS backplane GANDALF has 16 high-speed lanes for data transfer to a central VXS module, where the lanes of up to 18 GANDALF modules merge. This connection can be used for continuous transmission of the amplitudes and the time stamps from sampled signals to the VXS trigger processor, which then forms an input to the experiment-wide first-level trigger based on the energy loss and the time-of-flight in the recoil detector.

A dead-time free data output can either be realized by dedicated backplane link cards connected to each GANDALF P2-connector, i.e. following the 160 MByte/s SLink or Ethernet protocol, or by the VME64x bus in block read mode or by USB2.0 from the front panel. Depending on requirements the data output may contain the results of the digital pulse processing only or also the full sample list.

# Analog-to-Digital Converter

Two models of analog-to-digital converters (ADC) can be used with the GANDALF board, depending on the desired resolution. With the Texas Instruments models ADS5463 (12bit@500MS/s) and ADS5474 (14bit@400MS/s) we chose two of the fastest pipelined high resolution ADC chips that are currently available. Their low latency of only 3.5 clock cycles gives valuable time for the signal processing and the following trigger generation with its tight timing constraints defined by existent readout electronics.

The DC-coupled analog input circuit (Fig. ) uses the differential amplifier LMH6552 from National Semiconductor and has a bandwidth of 500MHz. It adapts the incoming single ended signal, e.g. from a photomultiplier tube (PMT), to the dynamic range of the ADC while the baseline of each channel can be adjusted individually by 16-bit digital-to-analog converters (DAC). Depending on the DAC settings, the input stage accepts unipolar or bipolar pulses. Two adjacent channels can be interleaved to achieve an effective sampling rate of 1GS/s (800MS/s with the ADS5474) at the cost of the number of channels per mezzanine card. In this time-interleaved mode the second ADC receives a sampling clock which is phase-shifted by 180 degree and the input signal is passively split to both channels. Thus the signal is sampled alternately by two ADCs.

On each ADC mezzanine card the high frequency sampling clock is generated by a digital clock synthesizer chip SI5326 from Silicon Labs, which comprises an integrated PLL consisting of an oscillator, a digital phase detector and a programmable loop filter. The experiment-wide 155.52-MHz clock, distributed by the COMPASS trigger and clock distribution system (TCS), is used as reference. Particular attention has been paid to the design of the clock filter networks and the board layout to reach a time interval error smaller than 730fs (Fig. ) , which is essential for high bandwidth sampling applications.

We determined the signal-to-noise ratio (SNR) of the ADC system in a test setup consisting of a high precision function generator (Tektronix AFG3252) and a selection of narrow band pass filters. The filters were connected directly to the analog input of the GANDALF module to suppress the harmonics of the signal source. Sine waveforms of different frequencies were sampled and from the fast Fourier transform the SNR was calculated. The result of these measurements for the 12-bit version (ADS5463) is shown in Fig. as a function of the frequency of the input analog signal and is expressed in dB as well as ENOB (effective number of bits). We achieved an effective resolution of above 10.1ENOB (ADS5463) and 10.6ENOB (ADS5474) respectively over an input frequency range up to 240MHz.

# Digital Pulse Processing

The sampled detector signals are processed by DSP algorithms inside the VIRTEX5-SXT FPGA utilizing the high compute power of its 640 DSP48E Slices. Quantities of interest like pulse arrival time, pulse height and integrated charge are extracted and can be used for real-time calculation of derived quantities such as time-of-flight and energy loss.

## Pulse Time Determination

To extract the time information from the detector signals a digital constant fraction discrimination (dCFD) algorithm was chosen. Inside the FPGA the digitized samples are delayed, multiplied by a fraction factor and added to the original samples (Fig. ). The zero-crossing of the resulting curve is determined by linear interpolation and forms the time stamp of the pulse. Extended simulations helped to determine optimal parameters for the dCFD algorithm also in case of pile-up pulses.

## Performance Verification

First measurements of the timing resolution of the GANDALF digitizer were performed by using a Tektronix Arbitrary Function Generator (AFG3252) to simulate realistic detector pulses. The PMT signals are described by a moyal distribution $$f(t) = A \cdot exp \left(-\frac{1}{2} \left(\frac{t-t_0}{k \cdot t_r} + exp\left(-\frac{t-t_0}{k \cdot t_r}\right) -1\right)\right),$$ with maximum amplitude $A$ at $t=t_0$. For $k=0.69$, $t_r$ is the 10%-90% rise time. Two copies of the signal with constant but arbitrary delay are sampled and the constant fraction timing is performed by the DSP FPGA. The differences between the resulting time stamps show a distribution, whose width is then used to calculate the timing resolution. The dCFD resolution depends on the pulse amplitude. Therefore the measurements were done with a signal amplitude variation over the dynamic range of the input stage. In this test setup pulses with amplitudes from -50mV to -4V were measured with 1GS/s (Fig. ). One can see that with the GANDALF transient recorder a timing resolution of better than 50ps can be reached for signal amplitudes as small as 4% of the relative dynamic range.

To confirm these results in a real environment a measurement setup with a Hamamatsu PMT (R1450) as a signal source was installed. In this configuration a PiLas EIG1000D laser pulser with PiL040 Optical Head (from Advanced Laser Diode Systems) is used as light source. The laser emits very short optical pulses with pulse widths below 45ps (FWHM). The pulser features an additional TTL trigger output, which is used as a time reference. The jitter between the trigger and the optical output is typically below 3ps. In Fig. the timing resolution of the laser and PMT system measured by GANDALF in 1GS/s mode is shown. The resolution of the system as a whole (green continuous line) is composed of the resolution of the GANDALF timing determination (blue dashed line) and the resolution of the laser and PMT system (red dash-dotted line). The latter is quantified in an independent measurement to be 39ps.

The ability of the dCFD algorithm to separate pile-up pulses depends on the ratio of the pulse amplitudes. Fig. shows the minimum delay $\Delta t$ between two pulses which is needed to separate them. The plot is obtained by simulation of two consecutive pulses with risetime $t_r=3\:ns$ for all combinations of amplitudes of the first and second pulse. The simulation result is verified by lab measurements using the AFG3252 to generate pile-up pulses with selected amplitude ratios.

# Conclusion

A low cost VME64x system aimed at digitizing and processing detector signals has been designed and implemented to our full satisfaction. The design is modular, consisting of a carrier board on which two mezzanine boards with either analog or digital inputs can be plugged. The ADC mezzanine cards have been characterized and show excellent performance over a wide input frequency range. An optional high-speed serial VXS backplane offers inter-module communication for sophisticated trigger processing covering up to 288 detector channels.

The GANDALF transient recorder has been installed at the COMPASS experiment during a two-week DVCS pilot run in September 2009. Extensive data have been recorded in order to verify the performance of the hardware and the signal processing algorithms.

# Outlook

Recently an additional type of mezzanine card with 64 digital inputs has been designed, which accepts LVDS and LVPECL signals over a VHDCI connector. Using this digital mezzanine cards a 64-channel mean-timer and subsequent trigger matrix was implemented in the GANDALF module and is in action at COMPASS since April 2010.

In a forthcoming paper we will describe the realization of GANDALF as a 128-channel time-to-digital converter module with 100ps digitization units, comparable to the F1-TDC chip . The TDC design is implemented inside the main FPGA which can host 128 channels of 500-MHz scalers at the same time.

# Acknowledgment

The authors gratefully acknowledge the discussions with their colleagues from the COMPASS collaboration and the support of their local workshops.

[^1]: Manuscript received June 30, 2010. Revised March 3, 2011.

[^2]: This work is supported by BMBF, the University of Freiburg and the European Union.

[^3]: All authors are with the University of Freiburg, Department of Physics, 79104 Freiburg, Germany.

[^4]: Corresponding author: Sebastian Schopferer (telephone: +49-761-203-5877, e-mail: firstname.lastname@example.com).

[^5]:  IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

[^6]: DOI: 10.1109/TNS.2011.2142195


Statistics of infinite dimensional random matrix ensembles

Maciej M. Duras

Institute of Physics, Cracow University of Technology, ulica Podchora̧żych 1, PL-30084 Cracow, Poland

Email: mduras @ riad.usk.pk.edu.pl

"Statistical Mechanics of Space-Time Chaos"; July 12th, 2000 - July 16th, 2000; Max Planck Institute for the Physics of Complex Systems; Dresden, Germany (2000).

AD 2000 July 4

# Abstract

A quantum statistical system with energy dissipation is studied. Its statisitics is governed by random complex-valued non-Hermitean Hamiltonians belonging to complex Ginibre ensemble. The eigenenergies are shown to form stable structure in thermodynamical limit (large matrix dimension limit). Analogy of Wigner and Dyson with system of electrical charges is drawn.

# Summary

A complex quantum system with energy dissipation is considered. The quantum Hamiltonians $H$ belong the complex Ginibre ensemble. The complex-valued eigenenergies $Z_{i}$ are random variables. The second differences $\Delta^{1} Z_{i}$ are also complex-valued random variables. The second differences have their real and imaginary parts and also radii (moduli) and main arguments (angles). For $N$=3 dimensional Ginibre ensemble the distributions of above random variables are provided whereas for generic $N$- dimensional Ginibre ensemble second difference distribution is analytically calculated. The law of homogenization of eigenergies is formulated. The analogy of Wigner and Dyson of Coulomb gas of electric charges is studied.

# Introduction

We study generic quantum statistical systems with energy dissipation. The quantum Hamiltonian operator $H$ is in given basis of Hilbert's space a matrix with random elements $H_{ij}$ . The Hamiltonian $H$ is not hermitean operator, thus its eigenenergies $Z_{i}$ are complex-valued random variables. We assume that distribution of $H_{ij}$ is governed by Ginibre ensemble . $H$ belongs to general linear Lie group GL($N$, **C**), where $N$ is dimension and **C** is complex numbers field. Since $H$ is not hermitean, therefore quantum system is dissipative system. Ginibre ensemble of random matrices is one of many Gaussian Random Matrix ensembles GRME. The above approach is an example of Random Matrix theory RMT . The other RMT ensembles are for example Gaussian orthogonal ensemble GOE, unitary GUE, symplectic GSE, as well as circular ensembles: orthogonal COE, unitary CUE, and symplectic CSE. The distributions of the eigenenergies $Z_{1}, ..., Z_{N}$ for $N \times N$ Hamiltonian matrices is given by Jean Ginibre's formula : $$\begin{aligned}
& & P(z_{1}, ..., z_{N})=
\label{Ginibre-joint-pdf-eigenvalues} \\
& & =\prod _{j=1}^{N} \frac{1}{\pi \cdot j!} \cdot
\prod _{i<j}^{N} \vert z_{i} - z_{j} \vert^{2} \cdot
\exp (- \sum _{j=1}^{N} \vert z_{j}\vert^{2}),
\nonumber
\end{aligned}$$ where $z_{i}$ are complex-valued sample points ($z_{i} \in {\bf C}$). For Ginibre ensemble we define complex-valued spacings $\Delta^{1} Z_{i}$ and second differences $\Delta^{2} Z_{i}$: $$\Delta^{1} Z_{i}=Z_{i+1}-Z_{i}, i=1, ..., (N-1),
\label{first-diff-def}$$ $$\Delta ^{2} Z_{i}=Z_{i+2} - 2Z_{i+1} + Z_{i}, i=1, ..., (N-2).
\label{Ginibre-second-difference-def}$$ The $\Delta^{2} Z_{i}$ are extensions of real-valued second differences $$\Delta^{2} E_{i}=E_{i+2}-2E_{i+1}+E_{i}, i=1, ..., (N-2),
\label{second-diff-def}$$ of adjacent ordered increasingly real-valued energies $E_{i}$ defined for GOE, GUE, GSE, and Poisson ensemble PE (where Poisson ensemble is composed of uncorrelated randomly distributed eigenenergies) .

There is an analogy of Coulomb gas of unit electric charges pointed out by Eugene Wigner and Freeman Dyson. A Coulomb gas of $N$ unit charges moving on complex plane (Gauss's plane) **C** is considered. The vectors of positions of charges are $z_{i}$ and potential energy of the system is: $$U(z_{1}, ...,z_{N})=
- \sum_{i<j} \ln \vert z_{i} - z_{j} \vert
+ \frac{1}{2} \sum_{i} \vert z_{i}^{2} \vert.
\label{Coulomb-potential-energy}$$ If gas is in thermodynamical equilibrium at temperature $T= \frac{1}{2 k_{B}}$ ($\beta= \frac{1}{k_{B}T}=2$, $k_{B}$ is Boltzmann's constant), then probability density function of vectors of positions is $P(z_{1}, ..., z_{N})$ Eq. (). Complex eigenenergies $Z_{i}$ of quantum system are analogous to vectors of positions of charges of Coulomb gas. Moreover, complex-valued spacings $\Delta^{1} Z_{i}$ are analogous to vectors of relative positions of electric charges. Finally, complex-valued second differences $\Delta^{2} Z_{i}$ are analogous to vectors of relative positions of vectors of relative positions of electric charges.

The $\Delta ^{2} Z_{i}$ have their real parts ${\rm Re} \Delta ^{2} Z_{i}$, and imaginary parts ${\rm Im} \Delta ^{2} Z_{i}$, as well as radii (moduli) $\vert \Delta ^{2} Z_{i} \vert$, and main arguments (angles) ${\rm Arg} \Delta ^{2} Z_{i}$.

# Second Difference Distributions

We define following random variables for $N$=3 dimensional Ginibre ensemble: $$Y_{1}=\Delta ^{2} Z_{1},
A_{1}= {\rm Re} Y_{1}, B_{1}= {\rm Im} Y_{1},
\label{Ginibre-Y1A1B1-def}$$ $$R_{1} = \vert Y_{1} \vert, \Phi_{1}= {\rm Arg} Y_{1},
\label{Ginibre-polar-second-diff-def}$$ and for the generic $N$-dimensional Ginibre ensemble : $W_{1}=\Delta ^{2} Z_{1}$.

Their distributions for are given by following formulae : $$\begin{aligned}
& & f_{Y_{1}}(y_{1})=f_{(A_{1}, B_{1})}(a_{1}, b_{1})=
\label{Ginibre-marginal-pdf-Y1-def} \\
& & =\frac{1}{576 \pi} [ (a_{1}^{2} + b_{1}^{2})^{2} + 24]
\cdot \exp (- \frac{1}{6} (a_{1}^{2}+a_{2}^{2})).
\nonumber
\end{aligned}$$ $$f_{A_{1}}(a_{1})=
\frac{\sqrt{6}}{576 \sqrt{\pi}} (a_{1}^{4}+6a_{1}^{2}+ 51)
\cdot \exp (- \frac{1}{6} a_{1}^{2}),
\label{Ginibre-marginal-pdf-Y1Re-def}$$ $$f_{B_{1}}(b_{1})=
\frac{\sqrt{6}}{576 \sqrt{\pi}} (b_{1}^{4}+6b_{1}^{2}+ 51)
\cdot \exp (- \frac{1}{6} b_{1}^{2}),
\label{Ginibre-marginal-pdf-Y1Im-def}$$ $$\begin{aligned}
& & f_{R_{1}}(r_{1})=
\label{Ginibre-polar-second-diff-result} \\
& & \Theta(r_{1}) \frac{1}{288}r_{1}(r_{1}^{4}+24) \cdot \exp(- \frac{1}{6} r_{1}^{2}),
\nonumber \\
& & f_{\Phi_{1}}(\phi_{1})= \frac{1}{2 \pi}, \phi_{1} \in [0, 2 \pi].
\nonumber
\end{aligned}$$ $$\begin{aligned}
& & P_{3}(w_{1})=
\label{W1-pdf-I-result} \\
& & = \pi^{-3} \sum_{j_{1}=0}^{N-1} \sum_{j_{2}=0}^{N-1} \sum_{j_{3}=0}^{N-1}
\frac{1}{j_{1}!j_{2}!j_{3}!}I_{j_{1}j_{2}j_{3}}(w_{1}),
\nonumber \\
& & I_{j_{1}j_{2}j_{3}}(w_{1})=
\label{W1-pdf-I-F} \\
& & = 2^{-2j_{2}}
\frac{\partial^{j_{1}+j_{2}+j_{3}}}
{\partial^{j_{1}} \lambda_{1} \partial^{j_{2}} \lambda_{2}
\partial^{j_{3}} \lambda_{3}}
F(w_{1},\lambda_{1},\lambda_{2},\lambda_{3}) \vert _{\lambda_{i}=0},
\nonumber
\end{aligned}$$ $$\begin{aligned}
& & F(w_{1},\lambda_{1},\lambda_{2},\lambda_{3})=
\label{W1-pdf-I-F-final} \\
& & = A(\lambda_{1},\lambda_{2},\lambda_{3})
\exp[-B(\lambda_{1},\lambda_{2},\lambda_{3}) \vert w_{1} \vert^{2}],
\nonumber
\end{aligned}$$ $$\begin{aligned}
& & A(\lambda_{1},\lambda_{2},\lambda_{3})=
\label{W1-pdf-I-A} \\
& & =\frac{(2\pi)^{2}}
{(\lambda_{1}+\lambda_{2}-\frac{5}{4})
\cdot (\lambda_{1}+\lambda_{3}-\frac{5}{4})-(\lambda_{1}-1)^{2}},
\nonumber \\
& & B(\lambda_{1},\lambda_{2},\lambda_{3})=
\label{W1-pdf-I-B} \\
& & =(\lambda_{1}-1) \cdot \frac{2 \lambda_{1}-\lambda_{2}-\lambda_{3}+\frac{1}{2}}
{2 \lambda_{1}+\lambda_{2}+\lambda_{3}-\frac{9}{2}}.
\nonumber
\end{aligned}$$

# Conclusions

We compare second difference distributions for different ensembles by defining following dimensionless second differences: $$C_{\beta} = \frac{\Delta^{2} E_{1}}{<S_{\beta}>},
\label{rescaled-second-diff-GOE-GUE-GSE-PE}$$ $$X_{1}=\frac{A_{1}}{<R_{1}>},
\label{Ginibre-X1-def}$$ where $<S_{\beta}>$ are the mean values of spacings for GOE(3) ($\beta=1$), for GUE(3) ($\beta=2$), for GSE(3) ($\beta=4$), for PE ($\beta=0$) , and $<R_{1}>$ is mean value of radius $R_{1}$ for $N$=3 dimensional Ginibre ensemble .

On the basis of comparison of results for Gaussian ensembles, Poisson ensemble, and Ginibre ensemble we formulate homogenization law : *Eigenenergies for Gaussian ensembles, for Poisson ensemble, and for Ginibre ensemble tend to be homogeneously distributed.* The second differences' distributions assume global maxima at origin for above ensembles. For Coulomb gas the vectors of relative positions of vectors of relative positions of charges statistically vanish. It can be called stabilisation of structure of system of electric charges.

# Acknowledgements

It is my pleasure to most deeply thank Professor Jakub Zakrzewski for formulating the problem.