{'fraction_non_alphanumeric': 0.04065097436613816, 'fraction_numerical': 0.010267514144024586, 'mean_word_length': 4.310830860534125, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Experimental Quantum Coin Tossing

In this letter we present the first implementation of a quantum coin tossing protocol. This protocol belongs to a class of ``two-party'' cryptographic problems, where the communication partners distrust each other. As with a number of such two-party protocols, the best implementation of the quantum coin tossing requires qutrits. In this way, we have also performed the first complete quantum communication protocol with qutrits. In our experiment the two partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular momentum. We also show the experimental bounds of a possible cheater and the ways of detecting him.

In the last years this kind of protocols have received a lot of attention from both the cryptographic and quantum information communities. Although the perfect security of some of the "two-party" protocols seems impossible [3,4,5], it is yet unclear which bounds can be imposed on the security. There have been also some speculation about the possibility that quantum mechanics can be derived only from purely quantum information postulates, stating the possibility and impossibility of, respectively, quantum key distribution and quantum bit commitment [6].
In the case of "coin tossing", a set of solutions to this problem works in the following way: Alice throws the coin, locks it in a "box" and sends it to Bob. Bob has the proof that the coin was thrown, but cannot see the actual result. Bob makes his bet and, upon receiving his bet, Alice sends the key to Bob, so that he is able to unlock the result [7]. Up to now, there is no proof that the "boxes" used in the classical implementations of this protocol (for example, one-way functions), are truly impossible to unlock by Bob, or cannot be modified by Alice (see Fig. 1(a)). In general, there is no classical protocol which allows unrestricted security against cheating for the "coin tossing" protocols. On the other hand, using quantum mechanics, it is possible to at least limit the ability of any party to cheat.
In quantum coin tossing [8,9,10,11,12], we replace the "box" by a quantum state. Alice chooses one among a series of non-orthogonal states and sends it to Bob. Each of the states encodes the result of the throw of the coin. In this way, without previous knowledge, Bob cannot know with certainty which of the states he possesses. At this point, Bob makes his bet. To "unlock" the state, Alice only has to tell Bob which was the state she sent and then he can measure it in an orthogonal basis to check that Alice is honest. If Bob's measurement corresponds with Alice's predicted state, the protocol is a success. Otherwise, Alice and Bob would consider the throw as a "failure" and would disregard it. This coin tossing scheme limits the probability of a cheater to succeed. We will show that, in reality, cheating is actually detected when the "failures" in a row of throws increase over the statistical errors.
Our implemented protocol is based on a proposal by Ambainis [8] which uses three-dimensional quantum states (also called "qutrits"). Up to now, all the devised protocols using qubits allow a theoretical higher probability for the cheater to win [13]. In this sense the protocols using qutrits are better suited for this particular problem. This raises an interesting question about which other problems can also be more efficiently solved with higher dimensional states [14].
The series of states that Alice can send and the correspondent throw of the coin are presented in Table 1 [15]. Alice's states are divided into two sets, each of them containing two orthogonal states. States of one set have a  non-vanishing projection onto states of the other set. For this reason, Bob needs two different measuring bases in order to determine the state of each possible photon sent by Alice. In Table 1, we also show the elements of Bob's bases associated with each set. Note that every basis contains, besides the states of the corresponding set, a third state orthogonal to them, which in our case is either |2 (set 1) or |1 (set 2). These additional states are crucial for increasing the chances to detect cheating, as we will show below. Ambainis [8] demonstrated that the maximum probability that one of the partners biases the result without being noticed is 25%. Remember that, in any coin tossing, each party needs to cheat only in 50% of the throws, because that's the probability of losing, which limits the theoretical probability of a cheater to win to 75%. In our experiment Alice and Bob agreed to build the following set-up to implement the protocol (See Fig.  1(b)). Alice possess a source of orbital angular momentum entangled photons [16,17]. She keeps one photon of the pair and sends the other one to Bob. When she projects her photon onto one of the four states in Tab. 1 and detects it, she knows that she is sending to Bob a triggered photon [18] carrying an orbital angular momentum qutrit. Together with the photon, she sends a signal to Bob, telling him that a coin has been thrown and so, the corresponding entangled photon with the right state is being sent to him. Once Bob receives the signal, he sends his bet to Alice. Now she can tell Bob which was the state. Using this information, Bob can measure the state of the photon and verify the honesty of Alice.
The set-up consists of a 351nm wavelength Argon-ion laser pumping a 1.5−mm-thick BBO (β-barium-borate) crystal cut for Type I phase matching condition. The crystal is positioned such as to produce down-converted pairs of identically polarized photons at a wavelength of 702nm emitted at an angle of 4 • off the pump direction. These photons are directly entangled in the orbital angular momentum degree of freedom. One of the photons is sent to Bob, meanwhile the other remains on Alice's side. With a series of beam-splitters, whose reflectances were chosen so that the photons were equally distributed among the different paths, both parties direct their photons probabilistically to a series of holograms and single mode fibers, prepared to project the photon onto a certain state [19]. Alice's and Bob's states are presented in Table 1.
Bob's measurements were performed in the following way: Bob's photons were directed randomly to a projection onto one of the six possible states. The photons going to the wrong basis were discarded.
Once the set-up was built, Alice and Bob decided to try their coin-tossing protocol with a row of throws. In this experiment they obtained 50% heads (1) and 44% tails (0). As Bob's guesses were random, he won in half of the throws. The overall failures in the protocol represented around 6% of the throws, intrinsic to the setup. In Fig. 2 (a)-(b) we present the experimental probabilities of Bob's measurements, for two different states sent by Alice.
In Fig. 3(a), we show a set of the actual throws. Every square of the image represents a throw of the coin. The color of every square represents the result of the throw, as Alice communicates it to Bob (black is tails, white is heads). Red (gray) means that the throw was a failure.
In order to explore the limits of the implementation Alice decided to cheat Bob. We want to remark that it is a harder problem to devise a cheating procedure, than to prepare the honest protocol. In our case, the best way we could find for Alice to cheat was the following one. Alice always sends a random symmetric mixture of the state (|0 − |1 )/ √ 2 and the state (|0 + |2 )/ √ 2, which is a random mixture of being heads or tails [20]. When Bob makes his bet about the state, Alice always tells him that he lost, and then, Bob has to measure in the corresponding basis. For example, if Bob says that it was tails, Alice's answer is that the state was heads ((|0 − |1 )/ √ 2), and Bob measures in this basis. It is an easy task to check that Alice will win in 63.5% of the throws, which is below the theoretical maximum of 75% [8,13]. This strategy resembles a biased coin which can be flipped even after Bob made his choice.
In order to force Alice to cheat, we changed states A12 and A21 to be identical to states number A22 and A11, respectively. Alice does not need to keep a record of which state is being sent. In this way she sends a probabilistic mixture of the two states, which represent correspondingly heads and tails. Her strategy is to tell Bob that the state sent was exactly the opposite of Bob's bet.
In the experimental implementation, of course, it is even harder for Alice to win, because she cannot turn off the statistical errors which also happen in the honest protocol. In our case, we found that the number of failures, when Alice cheats in this way, was a 46% of the throws. In Fig. 2 (c)-(d), one can check Bob's results for the two different states that Alice claimed she was sending. Also, we present the actual row of throws in Fig. 3(b), with the same coding colors than Fig. 3(a). In this case, by comparing the results presented in images (a) and (b) it was very easy for Bob to discover that in (b) the protocol was not followed in the honest way. Also, it was a little bit suspicious to him that in all the proper throws of Fig.  3(b), Alice won. At this point, let us turn back to Fig. 2(c)-(d). We want to note that the state in which most of the failures go is precisely the one which is outside the plane defined by the elements of Alice's set. It is unclear whether other cheating procedures would give rise to the same result but, at least in this case, the use of a three dimensional space is necessary in order that Bob can detect Alice cheating.
Once the subject was clarified between Alice and Bob, he decided to build a table where he could infer the amount of dishonest throws, given the number of failures during the protocol (Fig. 3(c)).
Before finishing, we would like to discuss a few details from this particular implementation. In a proper protocol, the detection of the photon by Bob should be delayed until he can send his bet to Alice. In our set-up, it was very difficult to prepare such a delay and so, we simulated it by software. A more realistic implementation should include an optical delay with, for example, a couple of parallel mirrors.
Another difference with respect to an ideal implementation is that both Alice and Bob could not deterministically project their photon onto a given state. Although it is clear that this is not a problem for an honest Alice, who chooses at random which state to send among the possible four, it might present a security hazard when one of the parties cannot be trusted. A closer look to the set-up shows that this is not the case.
If Bob's photon goes to the wrong projection, Bob just loses the photon and has to ask Alice to send it again. Alice cannot take profit of this effect, because she never knows whether the photon she sends is going to the right projection or not.
On the other hand, Bob could try to use this probabilistic behavior in his favor, just by not acknowledging a right measurement of a lost bet. But then Alice would notice an abnormal increase of lost photons and would stop the communication, in the same way as an increase of "failures" would be the trademark of a cheater.
In conclusion, we have experimentally demonstrated a "quantum coin tossing" protocol. To our knowledge, this is the first "two-party" communication protocol which is solved using the laws of quantum physics to encode the communication. It is worth mentioning that, contrary to the usual "key distribution" protocols, in this case the information shared by Alice and Bob is truly exchanged through the quantum states. Also, this protocol is the first to be implemented, where the use of more than two dimensions presents a clear advantage. Using our set-up we could share a set of a few tens of thousand coin throws in a few seconds among two parties. We also allowed one party to try to cheat, which could be easily detected by a significant increase of "failures". We could not find an optimal cheating procedure, but we hope that this work triggers others, where the possibilities of realistic dishonest parties are studied. This work was supported by the Austrian Sciences Foundation (F.W.F) and the European Commission through the Marie-Curie program and the RAMBO-Q project of the IST program. Discussions with Markus Aspelmayer and Kevin Resch are gratefully appreciated. [9] C. H. Bennett and G. Brassard, Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing, 175-179 (1984) [10] H.-K. Lo, H. F. Chau, Physica D 120, 177 (1998 Using beamsplitters, she projects probabilistically one of the photons onto one of the four possible states shown in Table 1. This state is transferred nonlocally to the other photon, which is on its way to Bob. Bob's photon is projected randomly onto one of the six possible elements of the two bases. Photons going to a wrong basis are not considered. FIG. 2: Statistics of Bob's measurements. Red (gray) bars correspond to "failures" of the protocol. Black (heads) and white (tails) bars correspond to proper throws and indicate the result of the tossing. (a)-(b) Alice is honest. We present only two of the possible four states sent by Alice: (a) she sends the state |0 + |1 )/ √ 2 (Heads) and (b) she sends the state |0 − |2 )/ √ 2 (Tails). The errors in this case are due to misalignments of the set-up and are intrinsic to it. (c)-(d) Alice is cheating. She always sends a mixture of two states. After Bob makes his bet, she decides which state she must tell him: (c) she claims to send state |0 − |1 )/ √ 2, (d) she claims to send state |0 + |2 )/ √ 2. In this case, the errors are clear indicators of the presence of a cheater. The difference of the errors of cases (c) and (d) are mainly due to the fact that Alice is not sending a perfect mixture of the two states.  Fig. 2, Black: head, White: tail and Red (gray): "Failure". (a) Bob and Alice are honest: Heads 50%, tails 44%, failures 6%. The difference between heads and tails due to different efficiencies of the detectors and the failures due to imperfections of the set-up. (b) Bob honest, Alice cheats. Heads 26%, tails 28%, failures 46%. One can clearly see how the failures increase due to the fact that Alice is cheating. (c)