Optimized Entanglement PurificationStefan Krastanov1,2, Victor V. Albert1,2,3, and Liang Jiang1,2

1Departments of Applied Physics and Physics, Yale University, New Haven, CT 06511, USA2Yale Quantum Institute, Yale University, New Haven, CT 06520, USA3Walter Burke Institute for Theoretical Physics and Institute for Quantum Information and Matter, California Institute ofTechnology, Pasadena, California 91125, USAFebruary 15, 2019

We investigate novel protocols for en-tanglement purification of qubit Bell pairs.Employing genetic algorithms for the de-sign of the purification circuit, we obtainshorter circuits achieving higher successrates and better final fidelities than whatis currently available in the literature. Weprovide a software tool for analytical andnumerical study of the generated purifi-cation circuits, under customizable errormodels. These new purification protocolspave the way to practical implementationsof modular quantum computers and quan-tum repeaters. Our approach is particu-larly attentive to the effects of finite re-sources and imperfect local operations -phenomena neglected in the usual asymp-totic approach to the problem. The choiceof the building blocks permitted in theconstruction of the circuits is based on athorough enumeration of the local Cliffordoperations that act as permutations on thebasis of Bell states.

The eventual construction of a scalable quan-tum computer is bound to revolutionize both howwe solve practical problems like quantum simu-lation, and how we approach foundational ques-tions ranging from topics in computational com-plexity to quantum gravity. However, numer-ous engineering hurdles have to be surmountedalong the way, as exemplified by today’s raceto implement practical quantum error-correctingcodes. While great many high performing error-correcting codes have been constructed by the-orists, only recently did experiments start ap-proaching hardware-level error rates that are suf-ficiently close to the threshold at which codesactually start to help [1, 2]. A promising ap-proach is the modular architecture [3, 4] for

quantum computers with implementations basedon, among others, superconducting circuits [5],trapped ions [6, 7], or NV centers [8]. The cen-tral theme is the creation of a network of smallindependent quantum registers of few qubits,with connections capable of distributing entan-gled pairs between nodes [4, 9]. Such an archi-tecture avoids the difficulty of creating a singlecomplex structure as described in more mono-lithic approaches and offers a systematic way tominimize undesired crosstalk and residual inter-actions while scaling the system. Moreover, thesame modules might also be used for the designof quantum repeaters for use in quantum commu-nication [10–14].

Experimentally, there have been significant ad-vances in creating entanglement between mod-ules, with demonstrations in trapped ions [6, 15],NV centers [16, 17], neutral atoms [18], and su-perconducting circuits [5]. However, the infidelityof created Bell pairs is on the order of 10%, whilenoise due to local gates and measurements can bemuch lower than 1%. Purification of the entan-glement resource will be necessary before success-fully employing it for fault-tolerant computationor communication. Although various purificationprotocols have been proposed [7, 9, 10, 14, 19–22], there is still a lack of systematic compari-son and optimization of purification circuits, asthe number of possible designs increases exponen-tially with the size of the circuits. In this paperwe develop tools to generate and compare purifi-cation circuits and we present multiple purifica-tion protocols outperforming the contenders wetest against [7, 9, 14] over a wide range of realis-tic hardware parameters. We review the notion ofan entanglement purification circuit and presentour approach to generating and evaluating suchcircuits. We compare our results to recent pro-

Accepted in Quantum 2019-02-13, click title to verify 1

arX

iv:1

712.

0976

2v3

[qu

ant-

ph]

14

Feb

2019

Figure 1: A simple purification circuit of width 2 (i.e.2 local qubits for Alice or Bob.). The upper half is ranby Alice, while the bottom half is ran by Bob. Thedashed lines correspond to the initialization of registerswith low-quality “raw” Bell pairs. The top and bottomregister correspond to the two qubits of the sacrificialBell pair. A coincidence measurement in the Z basismarks a successful purification procedure.

posals for practical high-performance purificationcircuits, and finally discuss the design principlesand key ingredients for efficient purification cir-cuits.

Importantly, we pay particular attention tothe limitations imposed by working with finitehardware resources. One can find many highlyefficient purification schemes in the literature,which reach perfect fidelities at high yield in theasymptotic regime (e.g. [10, 20]), however suchasymptotic resource theories neglect the imper-fections and size limitations of the purificationhardware. Moreover, a large family of such cir-cuits can be constructed from error correctingcodes[20, 23], however they can often be imprac-tically wide as they do not exploit the possibilityof renewed generation of entanglement in alreadymeasured qubit registers. Our work optimizes en-tanglement purification in today’s NISQ [24] de-vices, complementing the protocols that are opti-mal only in the asymptotic regime of arbitrarilymany available qubits and perfect gates and mea-surements. The imperfections in the local gatesand measurements are the limiting factor in real-world hardware. We compare our results to otherknown finite protocols (including Oxfords’s andIBM’s [19, 25], STRINGENT [9, 22], and somerecursive or iterative [10] versions of the same).

Purification of Bell Pairs In an entangle-ment purification protocol, two parties, Alice andBob, start by sharing a number of imperfect Bellpairs and by performing local gates and measure-ments and communicating classically, they obtaina single pair of higher fidelity. For conciseness we

use A, B, C, and D to denote the Bell basis states.

A = |φ+〉 = |00〉+|11〉√2

B = |ψ−〉 = |01〉−|10〉√2

C = |ψ+〉 = |01〉+|10〉√2

D = |φ−〉 = |00〉−|11〉√2

(1)

The imperfect pairs are described in the Bell basis(eq. 1) by ρ0 = F0|A〉〈A|+ 1−F0

3 (|B〉〈B|+|C〉〈C|+|D〉〈D|). If we have a state of multiple pairs (likeAA), the first letter will denote the pair to bepurified.

To explain the roles of the local gates and coin-cidence measurements let us consider, in Fig. 1,the simplest purification circuit, in which Aliceand Bob share two Bell pairs and sacrifice one ofthem. One way to explain the circuit is to de-scribe it as an error-detecting circuit: If we startwith two perfectly initialized Bell pairs in thestate A, then the coincidence measurement willalways succeed; however, if an X error (a bit flip)happens on one of the qubits, that error will bepropagated by the CNOT operations and it willcause the coincidence measurement to fail (thetwo qubits will point in opposite directions on theZ axis). It is important to note that only X andY errors can be detected by this circuit, but notZ errors (phase flips) as the coincidence measure-ment can not distinguish A from D states. Oneneeds a circuit running on more than two Bellpairs to address X, Y, and Z errors.

For the purpose of designing an optimal purifi-cation circuit, it is enlightening to also interpretthe local operations in terms of permutations ofthe basis vectors[26, 27]. The initial state of the4 qubit system is described by the density ma-trix ρ0 ⊗ ρ0, or equivalently by the 16 scalars inits diagonal in the Bell basis {AA,AB, . . . ,DD}.The “mirrored” CNOT operations that both Aliceand Bob perform result in a new diagonal den-sity matrix with diagonal entries being a permu-tation of those of the original density matrix. Acoincidence measurement on the Z axis follows,which results in projecting out half of the pos-sible states, i.e. deleting 8 of the scalars andrenormalizing and adding by pairs the other 8.The permutation operation and coincidence mea-surement have to be chosen together such thatthis projection (when the coincidence measure-ment is successful) results in filtering out manyof the lower-probability B, C, and D states. A

Accepted in Quantum 2019-02-13, click title to verify 2

detailed run through this example is given in thesupplementary materials.

If we restrict ourselves to finding the best “sin-gle sacrifice” circuits, i.e. circuits that sacrificeone Bell pair in an attempt to purify anotherone, we need to find the best set of permutationsand measurements. There are 3 coincidence mea-surements of interest - coincidence in the Z basiswhich selects for A and D; coincidence in X basiswhich selects for A and C; and anti-coincidencein the Y basis which selects for A and B. All ofthose measurements can be implemented as a Zmeasurement preceded by a local Clifford opera-tion.

The group of possible permutations is rathercomplicated. Firstly, all permutations of the Bellbasis are Clifford operations because the permu-tation operation can be written as a permutationon the stabilizers of each state (moreover, we donot have access to all 16! permutations, as onlyoperations local for Alice and Bob are permitted).This restriction permits us to efficiently enumer-ate all possible permutations and study their per-formance. The software for performing this enu-meration is provided with this manuscript. Theenumeration goes as follows [28, 29]. There are11520 operations in the Clifford group of twoqubits C2. After exhaustively listing all opera-tions in C⊗2

2 we are left with 184320 unique Clif-ford operations that act as permutations of theBell basis of two Bell pairs. Accounting for 16different operations that change only the globalphase of the state (e.g. XX which maps B to -B)we are left with 11520 unique permutations. Re-stricting ourselves to permutations that map Ato A cuts that number by a factor of 4 for eachpair, which leaves us with 720 unique restrictedpermutations. Out of those, 72 operations do notchange the fidelity (72 = 2 × 6 × 6 correspondto two operations (the identity and SWAP) un-der the six possible BCD permutations for eachpair). The remaining 648 permitted operationsperform equally well when purifying against de-polarization noise, if they are used with the ap-propriate coincidence measurement. Half of themcan be generated from the mirrored CNOT oper-ation from Fig. 1 together with BCD permuta-tions performed before or after on each of thetwo pairs. The other half can be generated ifwe also employ a SWAP gate (such gate can beof importance for hardware implementations that

have “hot” communication qubits and “cold” stor-age qubits[7]). When we break the symmetry ofthe depolarization noise and use biased noise in-stead, all of these operations still permit purifi-cation, but a small fraction of them significantlyoutperform the rest. So far, we have only countedpurification circuits with 2 local qubits. We mayincrease the width (i.e., number of local qubits)to boost the performance of the entanglement pu-rification. However, the number of possible pu-rification circuits grows exponentially with notonly the length, but also the width of the circuit.Even for relatively small circuits (e.g., length 10and width 3), there will be > 1040 different con-figurations, if we use the operations discussedabove, which are impossible to exhaustively com-pare. Therefore, we need an efficient procedureto choose the appropriate permutation operationat each round of our purification protocol.

Figure 2: Comparing circuits designed by our genetic al-gorithm (for three-qubit registers) to prior art. Each cir-cle marks a unique circuit. The horizontal axis is the infi-delity of the final pair. The vertical axis is the probabilityof success. Also shown are the “Oxford” scheme on twoBell pairs [19], which outperforms the IBM scheme [20].The Innsbruck’s “Pumping(2)” and “Pumping(4)” arethat same scheme applied consecutively two or fourtimes from [10](Sec 3.a). The aforementioned schemesrequire two-qubit registers while the rest are for three-qubit registers. “Recurrent(2)” is the recursive version(at depth 2) of “Oxford” from[10, 20]. In “Rec.&Pump.”one recursively repeats the pumping protocol insteadof the Oxford protocol. To our knowledge “EXPEDI-ENT” and “STRINGENT” are some of the best cir-cuits [9, 22]). Evaluations done at p2 = η = 0.99 andF0 = 0.9. The red triangle marks a circuit of ours wediscuss more in Fig. 3.

Accepted in Quantum 2019-02-13, click title to verify 3

Discrete optimization algorithm The de-sign of circuits, whether quantum or classical,lends itself naturally to the use of evolution-ary (or genetic) algorithms with numerous in-teresting examples in, for instance, electronicsand robotics [30]. In particular, in the fieldof quantum information, such optimization tech-niques have been used in widely different set-tings, including control [31], state preparationand metrology [32], and studies of locality as re-lated to Bell’s inequality [33]. An evolutionaryalgorithm is an optimization algorithm particu-larly useful for cost functions over discrete pa-rameter spaces. A candidate solution (a pointin parameter space) plays the role of an individ-ual in a population subjected to simulated evo-lution. Depending on the particular implementa-tion, each individual generates a number of chil-dren, whether through mutations or through sex-ual modes of reproduction with other individualsin the population. The population is then culledso only the fittest candidate-solutions remain andthe procedure is repeated for multiple generationsuntil the convergence criteria are fulfilled.

In our particular implementation1 the individ-uals are quantum entanglement purification cir-cuits. We restrict ourselves to circuits that purifythe entanglement between two parties, Alice andBob, without the involvement of a third party.The circuit can contain any of the previously dis-cussed coincidence measurements (coincidence inZ, coincidence in X, anti-coincidence in Y). Thecircuit is also permitted to contain the “mirrored”CNOT operation from Fig. 1 together with anypermutation of the {B,C,D} states applied beforethe CNOT operation. Applying the {B,C,D} per-mutation after the CNOT is unnecessary as thenext operation would already have that degree offreedom. However, the final result will have a bi-ased error, so a single {B,C,D} permutation atthe very end might be required.

1https://qevo.krastanov.org/ (online repository) Theprovided software tools and examples in the supplemen-tary materials are readily usable in pedagogical settingsas well. Moreover, our software provides analytical ex-pressions for the final fidelities and numerical estimatesfor the expected resource overhead. The circuits can befine-tuned during the optimization run for the error modelof the particular hardware. This online resource is clonedat krastanov.github.io/qevo/index.html.

Operation and measurement errors Thedesign of the purification protocol is sensitive toimperfections in the local operations as well. Weparameterize the operational infidelities with theparameters p2, where 1 − p2 is the chance for atwo-qubit gate to cause a depolarization, and η,where 1 − η is the chance for a measurement toreport the incorrect result.

No memory errors or single-qubit gate errorsare considered in our treatment as they are gen-erally much smaller [34, 35], but they can be ac-counted for in the same manner.

After a measurement the measured qubit pairis reset to a new Bell pair and Alice and Bobcan again use it as a purification resource. Theinitial fidelity of each Bell pair is a parameterF0 set at the beginning of the algorithm. Simi-larly, we set the measurement fidelity η and thetwo-qubit gate fidelity p2 at the beginning. Morecomplicated settings with different error modelsare possible as well – of special interest would becircuits adapted for registers containing a “hot”communication side (e.g. only one qubit in theregister is able to establish initial remote entan-glement) and a “cold” memory side (considered inNigmatullin et al. [7]). For that type of registersone would also add the SWAP gate to the per-mitted genome. However, we show such circuitsonly in the supplementary materials as the ma-jority of circuits in the literature are designed forregisters where all qubits have similar properties.

The “fitness” that we optimize is the fidelityof the final purified Bell pair, however differentweights can be placed on the “infidelity compo-nents” along |B〉, |C〉, and |D〉 if needed. Inpractice, the genetic algorithm is fairly robust tochanging parameters like the population size, mu-tation rates, or number of children circuits. Weprovide both pregenerated circuits and ready-to-run scripts to generate circuits from scratch.

Importantly, depending on the parameterregime and error model, different circuits wouldbe the top performers. This showcases the impor-tance of rerunning the optimization algorithm forthe given hardware. An example of such differ-ence is provided in the supplementary materials.

A word of caution: purification yield andfinite imperfect circuits A common way toevaluate the performance of a purification circuitis to present its yield, defined as follows. For

Accepted in Quantum 2019-02-13, click title to verify 4

a circuit that starts with n imperfect Bell pairsand that produces m Bell pairs with fidelity ar-bitrarily close to 1, the yield is limn→∞

mn . The

limiting procedure is necessary due to the require-ment that the final fidelity needs to be arbitrarilyclose to 1, which is impossible for a finite circuit.In some cases this can be achieved by the recur-sive (nested) application of a known finite cir-cuit or by the use of the more advanced hashingmethod [25], as long as the local operations andmeasurements employed in the circuit are perfect.

However, our focus is on finite circuits of prac-tical interest for near-term hardware. The yieldis not a good measure of efficiency in this case asit is defined in terms of a limiting procedure forasymptotic circuits. Moreover, we specifically op-timize our circuits to work in the presence of mea-surement and operational errors, which makesunit fidelities (required for the definition of yield)impossible for a finite circuit. Optimizing in thepresence of local errors also makes our circuitsbetter than circuits that would have been opti-mized for a figure of merit that neglects such er-rors (the supplementary materials illustrate thiswith examples of circuits designed for differentlevels of errors).

We use the final fidelity, the probability of suc-cess or the average amount of consumed raw Bellpairs as measurements of efficiency, as these arethe quantities of interest in the implementationof small error correcting codes on modular ar-chitectures [9] (these quantities decide the delaynecessary for the performance of a stabilizer mea-surement or gate teleportation).

There is an interesting definition of yield thatcan be used for finite circuits like ours. If one con-catenates a finite circuit with the hashing methodfor purification one can use the yield of the newasymptotic circuit as a figure of merit for the ini-tial finite circuit. This "hashing yield" is still onlydefined in the presence of perfect measurementsand local operations, hence we do not employ itin the main text. However, we discuss it in thesupplementary materials.

Lastly, one can relax the requirement in thedefinition of yield that the final fidelity has to be1. In that case two new definitions of yield canbe considered: 1/N where N is the number ofraw Bell pairs that the circuit would require in abest case run (N is represented as color in Fig. 2)or 1/Navg where Navg is how many raw Bell pairs

are expended on average until completion (takinginto account that the circuit might need to berestarted after a failed measurement). Navg iscalculated through a Monte Carlo simulation andalso shown in Fig. 3 for some of the circuits ofinterest. While N depends only on the particularcircuit, Navg is a function of the error model (e.g.F0, p2, and η).

Comparing with Prior Art We generated afew thousand well performing circuits of lengthsup to 40 operations and acting on up to six pairsof qubits (and the algorithm can easily generatebigger circuits, but soon one hits a wall in perfor-mance due to the imperfections in the local oper-ations as discussed below). The zoo of circuits wehave created can be explored online (see note 1),but importantly, one can generate circuits specif-ically for their hardware using our method. Fig. 2shows how our circuits compare to a number ofother circuits of width 3. We outperform all cir-cuits in the comparison in terms of final fidelity ofthe distilled pair, while also having higher proba-bilities of success, and employing fewer resourcesor shorter circuits.

In Fig. 3 we compare one of the best perform-ing circuits we know (STRINGENT from [9]) toone particular circuit we have designed. We showonly Bob’s side of the circuit. Alice performs thesame operations and the two parties communi-cate to perform coincidence measurements. Theshading permits us to see which qubit pairs areengaged with other pairs: Each qubit Bob pos-sesses starts with a distinct color; The color is“contagious”, i.e. two-qubit gates will “infect” thesecond qubit in the gate with the color of the firstqubit; Measurements followed by regeneration ofthe raw Bell pair resource reset the color of themeasured qubit. The shading clearly shows thatthe best protocols we find have all the qubits en-gaged (entangled) together, a finding consistentwith the use of “multiple selection” purificationprotocols introduced in [22]. In contrast, con-ventional purification protocols have sub-circuitswhere only a subset of the qubits are engaged to-gether.

A potential caveat of that “completely en-gaged” approach needs to be addressed: in Fig. 2we report the probability of all measurement ina given protocol succeeding in a given run, butwe do not report the following overhead. If a sin-

Accepted in Quantum 2019-02-13, click title to verify 5

Figure 3: Comparison of (a) the STRINGENT circuit [9] to (b) the L17 circuit obtained through optimization. TheL17 circuit outperforms STRINGENT in terms of both final obtained fidelity and success probability over a widerange of error parameters. The color coding shows independent sub-circuits in the STRINGENT circuit and no suchsub-circuits in our design. We show only Bob’s side of the circuit. The vertical set of letters before each gate markshow the {B,C,D} states are permuted, which can be achieved with single qubit gates folded in the CNOT gate asdescribed in the supplementary materials. While we use only CNOT two-qubit gates, we intentionally used a modifiedsymbol in order to bring attention to the presence of these permutation operations. The small white circles aftereach measurement represent generation of a new Bell pair resource with fidelity F0. The histograms (c) are of therequired number of Bell pairs for a completion of the protocol (as opposed to a single-shot run) for STRINGENT andthe optimized circuit. We also provide analytical evaluations of all our circuits at our online repository. In particulareven though STRINGENT is longer (24 operations single shot, 29 raw Bell pairs on average) than L17 (17 operationssingle shot, 22 raw Bell pairs on average), STRINGENT has higher final infidelity by a factor of 16

6 ≈ 1.33 if thereare no measurement and operational errors. If we include them, they become the dominant contribution to thefinal infidelity and in the case of STRINGENT vs L17 the infidelity is still higher by a factor of 1.26 (infidelities of0.95% and 0.77%, success probabilities of 17% and 29%, respectively). The optimization and evaluation was donefor F0 = 0.9, p2 = η = 0.99, without memory errors or errors from single-qubit unitaries.

gle measurement fails, the protocol needs to berestarted; the aforementioned conventional pu-rification protocols, that posses sub-circuits, canredo just the failed sub-circuit (for instance, ei-ther of the two green blocks in STRINGENT fromFig. 3), instead of restarting the entire circuit.A priori, this might lead to lower resource over-head compared to our protocols (as they generallycompletely entangle the qubits of each register),even if we still win in terms of final fidelity andprobability of success. However, a detailed evalu-ation of this overhead shows that even when takeninto account, our protocols outperform the ap-proaches we compare with as they require lowernumber of gates, both in best case scenarios andon average (see right panel of Fig. 3).

Our approach can be employed for circuits withmore than two sacrificial pairs. Fig. 4 comparesthe performance of circuits working on 3 pairs (asabove) and circuits working on 4 or more pairsof qubits. With still bigger circuits one quicklyreaches a fidelity limit imposed by the finite im-perfections in the last operations performed bythe circuit (for hardware with perfect local opera-

tions that limitation does not exist and one wouldrather use larger circuits that perform many moreoperations per sacrifice [21, 25, 36]). Examplecircuits are given online (see note 1). For muchwider circuits one can surpass this limitation andeven use error correcting codes in order to per-form perfect (logical) local operations [37, 38],but currently our software is not applicable tothese cases.

Operation versus initialization errors Thedesign of efficient purification circuits needs tobalance between the initialization errors (imper-fect raw Bell pairs) and operation errors (im-perfect local gates and measurements). As de-tailed in the supplementary materials, for arbi-trary long purification circuits, the asymptoticinfidelity is ε

2 +O(ε2) where ε = 1− p2 (as indi-cated by the vertical dashed line in Fig. 4), whichis only limited by the operation errors. For finite-length purification circuits, however, the initial-ization errors also play an important role, whichdetermines how fast the purification circuits ap-proach the asymptotic limit with increasing cir-

Accepted in Quantum 2019-02-13, click title to verify 6

cuit length (Fig. 4). By analyzing the circuitsgiven by the discrete optimization algorithm, wehave observed that: (1) For fixed length, depend-ing on the parameter regime and error model,different circuits would be the top performers.This showcases the importance of rerunning theoptimization algorithm for the given hardware;(2) To boost the achievable fidelity, it is impor-tant to use double-selection (where two Bell pairsare simultaneously sacrificed to detect errors ona third surviving Bell pair) [22] instead of re-peated single-selection (where only one Bell pairis sacrificed at each error detection step). Thisstems from the fact that the asymptotic infidelityof single-selection is 7ε

8 , i.e. nearly twice thatof double-selection. Moreover, multiple selection(where n > 2 Bell pairs are simultaneously sac-rificed) has the same dominant asymptotic infi-delity of ε

2 as double selection. Therefore, widercircuits provide diminishing returns in the pres-ence of operational errors.

While the operational errors limit the utilityof very wide circuits, in the case of perfect localoperations this phenomenon of "diminishing re-turns" does not exist. In that case one can stilluse our optimization algorithm to design goodsmall circuits, but for large circuits the cost func-tion as currently defined can not be computedefficiently. Another possible direction of interest,which would require the simulation of large cir-cuits, would be the application of discrete opti-mization algorithms to the purification of multi-party entanglement [9, 39–41], however this mightbe computationally prohibitive. Of note is, how-ever, that the computational complexity stemsfrom the tracking of the purely classical proba-bilities at each measurement branch (the circuitsare composed of Clifford gates that can be simu-lated efficiently). We are hopeful that stochasticevaluation of the cost function (through a MonteCarlo method) will be sufficient to surmount anycomputational challenges in the application of ourprotocol to larger circuits, however we do not pur-sue this in the current work.

In conclusion, we have optimized purificationcircuits of fixed width using a discrete optimiza-tion approach using “building-block” subcircuitsproven to be optimal. The optimized circuits out-perform many other general-purpose purificationprotocols in all three aspects – fidelity of purifiedBell pair, success probability, and circuit length

Figure 4: Similarly to Fig. 2 we compare the performanceof circuits acting on 3 or more pairs. For legibility, onlysome of the best generated circuits of each width areshown (evaluated at F0 = 0.9 and p2 = η = 0.99). Ourcircuits approach the limit of ε

2 = 0.005, derived in themain text and supplementary materials.

(whether measured in terms of average number ofoperations performed or average number of rawBell pairs used). For purification circuits of width2, we analyze the group structure of the Cliffordoperations that fulfill the locality constraints ofpurification. For purification circuits of width≥ 3, we demonstrate the importance of multi-ple selection (using at least two sacrificial Bellpairs to simultaneously detect errors), and spec-ify the diminishing returns of using much widercircuits. We numerically obtain efficient purifica-tion circuits that approach the asymptotic the-oretical limits. Our approach of using discreteoptimization algorithms is applicable to variouserrors models (e.g., dephasing dominated gateerrors, imperfect Bell state beyond the Wernerform, etc). Moreover, it can be used to optimizethe purification circuits in the presence of mem-ory errors, including additional decoherence to alllocal qubits during the creation of Bell pairs, andto investigate the entanglement purification of en-coded Bell pairs.

Acknowledgments

We are grateful for the helpful input from HollyMandel and Kyungjoo Noh. This work wouldnot have been possible without the contribu-tions of the Python, Jupyter, Matplotlib, Numpy,Sympy, Qutip, and Julia open source projects and

Accepted in Quantum 2019-02-13, click title to verify 7

the Yale HPC team. We acknowledge supportfrom ARL-CDQI, ARO (W911NF-14-1-0011,W911NF-14-1-0563), ARO MURI (W911NF-16-1-0349 ), AFOSR MURI (FA9550-14-1-0052,FA9550-15-1-0015), the Alfred P. Sloan Founda-tion (BR2013-049), and the Packard Foundation(2013-39273).

References[1] Julia Cramer, Norbert Kalb, M Adriaan

Rol, Bas Hensen, Machiel S Blok, MatthewMarkham, Daniel J Twitchen, Ronald Han-son, and Tim H Taminiau. Repeatedquantum error correction on a continu-ously encoded qubit by real-time feedback.Nature communications, 7, 2016. DOI:10.1038/ncomms11526.

[2] Nissim Ofek, Andrei Petrenko, ReinierHeeres, Philip Reinhold, Zaki Leghtas,Brian Vlastakis, Yehan Liu, Luigi Frunzio,SM Girvin, L Jiang, et al. Extending thelifetime of a quantum bit with error cor-rection in superconducting circuits. Nature,536(7617):441–445, 2016. DOI: 10.1038/na-ture18949.

[3] Daniel Gottesman and Isaac L Chuang.Demonstrating the viability of universalquantum computation using teleportationand single-qubit operations. Nature, 402(6760):390–393, 1999. DOI: 10.1038/46503.

[4] C Monroe, R Raussendorf, A Ruthven,KR Brown, P Maunz, L-M Duan, and J Kim.Large-scale modular quantum-computer ar-chitecture with atomic memory and pho-tonic interconnects. Physical Review A,89(2):022317, 2014. DOI: 10.1103/phys-reva.89.022317.

[5] A Narla, S Shankar, M Hatridge, Z Legh-tas, KM Sliwa, E Zalys-Geller, SO Mund-hada, W Pfaff, L Frunzio, RJ Schoelkopf,et al. Robust concurrent remote entangle-ment between two superconducting qubits.Physical Review X, 6(3):031036, 2016. DOI:10.1103/physrevx.6.031036.

[6] D Hucul, IV Inlek, G Vittorini, C Crocker,S Debnath, SM Clark, and Cl Monroe. Mod-ular entanglement of atomic qubits usingphotons and phonons. Nature Physics, 11(1):37–42, 2015. DOI: 10.1038/nphys3150.

[7] Ramil Nigmatullin, Christopher J Ballance,

Niel de Beaudrap, and Simon C Ben-jamin. Minimally complex ion traps asmodules for quantum communication andcomputing. New Journal of Physics, 18(10):103028, 2016. DOI: 10.1088/1367-2630/18/10/103028.

[8] Andreas Reiserer, Norbert Kalb, Machiel SBlok, Koen JM van Bemmelen, Tim HTaminiau, Ronald Hanson, Daniel JTwitchen, and Matthew Markham. Ro-bust quantum-network memory usingdecoherence-protected subspaces of nuclearspins. Physical Review X, 6(2):021040, 2016.DOI: 10.1103/physrevx.6.021040.

[9] Naomi H Nickerson, Ying Li, and Simon CBenjamin. Topological quantum comput-ing with a very noisy network and localerror rates approaching one percent. Na-ture communications, 4:1756, 2013. DOI:10.1038/ncomms2773.

[10] W Dür, H-J Briegel, JI Cirac, and P Zoller.Quantum repeaters based on entanglementpurification. Physical Review A, 59(1):169,1999. DOI: 10.1103/physreva.59.169.

[11] Jian-Wei Pan, Christoph Simon, ČaslavBrukner, and Anton Zeilinger. Entangle-ment purification for quantum communica-tion. Nature, 410(6832):1067–1070, 2001.DOI: 10.1038/35074041.

[12] L Childress, JM Taylor, Anders Sønd-berg Sørensen, and Mikhail D Lukin.Fault-tolerant quantum repeaters with mini-mal physical resources and implementationsbased on single-photon emitters. Physi-cal Review A, 72(5):052330, 2005. DOI:10.1103/physreva.72.052330.

[13] L Jiang, JM Taylor, and MD Lukin. Fastand robust approach to long-distance quan-tum communication with atomic ensembles.Physical Review A, 76(1):012301, 2007. DOI:10.1103/physreva.76.012301.

[14] Naomi H Nickerson, Joseph F Fitzsimons,and Simon C Benjamin. Freely scalablequantum technologies using cells of 5-to-50qubits with very lossy and noisy photoniclinks. Physical Review X, 4(4):041041, 2014.DOI: 10.1103/physrevx.4.041041.

[15] DL Moehring, P Maunz, S Olmschenk,KC Younge, DN Matsukevich, L-M Duan,and C Monroe. Entanglement of single-atom quantum bits at a distance. Nature,

Accepted in Quantum 2019-02-13, click title to verify 8

449(7158):68–71, 2007. DOI: 10.1038/na-ture06118.

[16] Wolfgang Pfaff, Tim H Taminiau, Lu-cio Robledo, Hannes Bernien, MatthewMarkham, Daniel J Twitchen, and RonaldHanson. Demonstration of entanglement-by-measurement of solid-state qubits. Na-ture Physics, 9(1):29–33, 2013. DOI:10.1038/nphys2444.

[17] Bas Hensen, Hannes Bernien, Anaïs EDréau, Andreas Reiserer, Norbert Kalb,Machiel S Blok, Just Ruitenberg, Ray-mond FL Vermeulen, Raymond N Schouten,Carlos Abellán, et al. Loophole-free bell in-equality violation using electron spins sepa-rated by 1.3 kilometres. Nature, 526(7575):682–686, 2015. DOI: 10.1038/nature15759.

[18] Stephan Ritter, Christian Nölleke, Car-olin Hahn, Andreas Reiserer, AndreasNeuzner, Manuel Uphoff, Martin Mücke,Eden Figueroa, Joerg Bochmann, and Ger-hard Rempe. An elementary quantum net-work of single atoms in optical cavities.Nature, 484(7393):195–200, 2012. DOI:10.1364/icqi.2011.qwb2.

[19] David Deutsch, Artur Ekert, Richard Jozsa,Chiara Macchiavello, Sandu Popescu, andAnna Sanpera. Quantum privacy amplifica-tion and the security of quantum cryptogra-phy over noisy channels. Physical review let-ters, 77(13):2818, 1996. DOI: 10.1103/phys-revlett.77.2818.

[20] Charles H Bennett, Gilles Brassard, SanduPopescu, Benjamin Schumacher, John ASmolin, and William K Wootters. Purifica-tion of noisy entanglement and faithful tele-portation via noisy channels. Physical reviewletters, 76(5):722, 1996. DOI: 10.1103/phys-revlett.76.722.

[21] Wolfgang Dür and Hans J Briegel. Entan-glement purification and quantum error cor-rection. Reports on Progress in Physics,70(8):1381, 2007. DOI: 10.1088/0034-4885/70/8/r03.

[22] Keisuke Fujii and Katsuji Yamamoto. En-tanglement purification with double selec-tion. Physical Review A, 80(4):042308, 2009.DOI: 10.1103/physreva.80.042308.

[23] Hans Aschauer. Quantum communication innoisy environments. PhD thesis, lmu, 2005.

[24] John Preskill. Quantum computing in

the nisq era and beyond. arXiv preprintarXiv:1801.00862, 2018. DOI: 10.22331/q-2018-08-06-79.

[25] Charles H Bennett, David P DiVincenzo,John A Smolin, and William K Wootters.Mixed-state entanglement and quantum er-ror correction. Physical Review A, 54(5):3824, 1996. DOI: 10.1103/physreva.54.3824.

[26] Jeroen Dehaene, Maarten Van den Nest,Bart De Moor, and Frank Verstraete. Localpermutations of products of bell states andentanglement distillation. Physical ReviewA, 67(2):022310, 2003. DOI: 10.1103/phys-reva.67.022310.

[27] H Bombin and MA Martin-Delgado. En-tanglement distillation protocols and num-ber theory. Physical Review A, 72(3):032313,2005. DOI: 10.1103/physreva.72.032313.

[28] Maris Ozols. Clifford group. 2008. DOI:10.1117/12.266854.

[29] A Robert Calderbank, Eric M Rains,PM Shor, and Neil JA Sloane. Quan-tum error correction via codes over gf(4). IEEE Transactions on InformationTheory, 44(4):1369–1387, 1998. DOI:10.1109/isit.1997.613213.

[30] Thomas Geijtenbeek, Michiel van dePanne, and A Frank van der Stappen.Flexible muscle-based locomotion forbipedal creatures. ACM Transactions onGraphics (TOG), 32(6):206, 2013. DOI:10.1145/2508363.2508399.

[31] CA Weidner, Hoon Yu, Ronnie Kosloff, andDana Z Anderson. Atom interferometry us-ing a shaken optical lattice. Physical ReviewA, 95(4):043624, 2017. DOI: 10.1103/phys-reva.95.043624.

[32] PA Knott. A search algorithm for quantumstate engineering and metrology. New Jour-nal of Physics, 18(7):073033, 2016. DOI:10.1088/1367-2630/18/7/073033.

[33] Robin Harper, Robert J Chapman, Christo-pher Ferrie, Christopher Granade, RichardKueng, Daniel Naoumenko, Steven T Flam-mia, and Alberto Peruzzo. Explaining quan-tum correlations through evolution of causalmodels. Physical Review A, 95(4):042120,2017. DOI: 10.1103/physreva.95.042120.

[34] Rami Barends, Julian Kelly, AnthonyMegrant, Andrzej Veitia, Daniel Sank, EvanJeffrey, Ted C White, Josh Mutus, Austin G

Accepted in Quantum 2019-02-13, click title to verify 9

Fowler, Brooks Campbell, et al. Super-conducting quantum circuits at the surfacecode threshold for fault tolerance. Nature,508(7497):500–503, 2014. DOI: 10.1038/na-ture13171.

[35] CJ Ballance, TP Harty, NM Linke, MA Se-piol, and DM Lucas. High-fidelity quan-tum logic gates using trapped-ion hyper-fine qubits. Physical review letters, 117(6):060504, 2016. DOI: 10.1103/phys-revlett.117.060504.

[36] Joseph M Renes, David Sutter, FrédéricDupuis, and Renato Renner. Efficient quan-tum polar codes requiring no preshared en-tanglement. IEEE Transactions on Informa-tion Theory, 61(11):6395–6414, 2015. DOI:10.1109/isit.2013.6620247.

[37] Lan Zhou and Yu-Bo Sheng. Purification oflogic-qubit entanglement. Scientific reports,6:28813, 2016. DOI: 10.1038/srep28813.

[38] Lan Zhou and Yu-Bo Sheng. Polar-ization entanglement purification for con-catenated greenberger–horne–zeilinger state.Annals of Physics, 385:10–35, 2017. DOI:10.1016/j.aop.2017.07.012.

[39] M Murao, MB Plenio, Sandu Popescu, V Ve-dral, and PL Knight. Multiparticle entangle-ment purification protocols. Physical ReviewA, 57(6):R4075, 1998. DOI: 10.1103/phys-reva.57.r4075.

[40] F Fröwis and W Dür. Stable macro-scopic quantum superpositions. Physical re-view letters, 106(11):110402, 2011. DOI:10.1103/physrevlett.106.110402.

[41] Florian Fröwis and Wolfgang Dür. Stabil-ity of encoded macroscopic quantum super-positions. Physical Review A, 85(5):052329,2012. DOI: 10.1103/physreva.85.052329.

Supplementary Materials

The software and additional online materialsare available at qevo.krastanov.org and kras-tanov.github.io/qevo/index.html.

A Model for operational errors

We consider each two-qubit gate U to be per-formed correctly with a chance p2 and to com-pletely depolarize the two qubits i and j it is act-ing upon with chance 1− p2. Written as densitymatrices, when applied to input ρin it results in

ρout = p2UρinU†+ (1− p2)Tri,j(ρin)⊗ Ii,j

4 , (2)

where Tri,j is a partial trace over the affectedqubits and Ii,j is the identity operator associatedwith qubits i and j. Similarly, measurement onqubit i has a probability η to properly project andmeasure and a probability 1−η to erroneously re-port the opposite result (flipping the qubit in themeasurement basis). For instance, an imperfectprojection on |1〉 reads as

ρout = η|1〉〈1|ρin|1〉〈1|+ (1− η)|0〉〈0|ρin|0〉〈0|.(3)

Memory errors are not considered, but can beeasily added to the optimization if required.

B Purification example when opera-tions are interpreted as permutations ofthe Bell basis

Consider the simple circuit from Fig. 1. As dis-cussed throughout the main text, a useful way torepresent the operations performed in the circuitis as permutations of the Bell basis. For this ex-ample we will use perfect operations (i.e. only ini-tialization errors). The density matrix describingthe system will be diagonal throughout the exe-cution of the entire protocol as only permutationoperations are performed. The following table de-scribes how “mirrored” CNOT operation acts onthe basis states (“AD” stands for “the sacrificialpair is in state D and the pair to be purified is instate A”):

Accepted in Quantum 2019-02-13, click title to verify 10

initial state mapped toAA AAAB DBAC ACAD DDBA BCBB CDBC BABD CBCA CCCB BDCC CACD BBDA DADB ABDC DCDD AD

With this mapping we can trace how the stateof the system evolves. The following table givesthe diagonal of the density matrix describing thesystem at each step. In the table q = 1−F

3 . Themeasurement column assumes a successful coinci-dence measurement has been performed. By nor-malizing and tallying the states that remain inA (for the purified pair) we are left with fidelityafter purification Ffinal = F 2+q2

F 2+5q2+2F q> F .

state initial after CNOT finalAA F 2 F 2 F 2

AB Fq q2

AC Fq Fq

AD Fq q2 q2

BA Fq q2 q2

BB q2 q2

BC q2 Fq

BD q2 q2 q2

CA Fq q2 q2

CB q2 q2

CC q2 Fq

CD q2 q2 q2

DA Fq Fq Fq

DB q2 Fq

DC q2 q2

DD q2 Fq Fq

Table 1 gives more details on how different co-incidence measurements act on the Bell pair.

C Purification example when opera-tions are interpreted as error detections

coinX A or CantiX B or D

coinY C or DantiY A or B

coinZ A or DantiZ B or C

coinX detects Y and ZantiY detects X and ZcoinZ detects X and Y

Table 1: Coincidence and Anticoincidence Measure-ments. The three tables at the top show which twoBell states are selected by different Bell measurements.The measurements that select A, the state we are dis-tilling, are highlighted. The other 3 possible coincidencemeasurements do not select for A so they are not high-lighted, nor used as building blocks for our circuits. Forthe 3 measurements preserving A, the bottom table re-states the same information in terms of what single qubiterrors (I, X, Y, or Z Pauli operations) are detectable byeach (if we have started in state A).

Another way to interpret the purification proto-cols is to look at them as error detection proto-cols. This way of thinking was used in the maintext in the discussion of the limits imposed bythe operational errors. Here we will repeat thisdiscussion with more pedagogical visual aids for aparticular choice of two-qubit operation and mea-surement. As in the main text, we will first con-sider a single selection circuit (where Alice andBob share two Bell pairs and sacrifice one of themto detect errors on the other one). We are show-ing only Bob’s side of the circuit.

We assume that Alice and Bob started withtwo perfect Bell pairs in the state A. Each of thetwo registers (the one Alice uses to store her twoqubits and the one Bob uses for his) are subjectto complete depolarization with probability ε =1− p2. This is equivalent to saying that for eachof the registers there is probability ε

16 for one ofthe 16 two qubit Pauli operators to be appliedto the state. Writing the possibilities down in atable (columns correspond to the possible errorson the top/preserved qubit, rows correspond tothe possible errors on the bottom/sacrificial, andeach cell gives the corresponding tensor product):

Accepted in Quantum 2019-02-13, click title to verify 11

on preservedI X Y Z

onsacrificial I II XI YI ZI

X IX XX YX ZXY IY XY YY ZYZ IZ XZ YZ ZZ

If we are to perform a coincidence measure-ment immediately, we will be able to detect theerrors that have occurred on the sacrificial qubit,however they are not correlated with errors thathave occurred on the preserved qubit, thereforeno errors on the preserved Bell pair would be de-tected. However, if we perform a CNOT gate,errors on either qubit will be propagated to theother one, and we will be able to detect someof the errors that have occurred on the Bell pairto be preserved by measuring the sacrificial Bellpair. Bellow we describe how the errors propa-gate:

After the CNOT gate we have the followingredistribution of errors:

on preservedI X Y Z

onsacrificial I II XX YX ZI

X IX XI YI ZXY ZY YZ XZ IYZ ZZ YY XY IZ

Performing a coincidence Z measurement onthe sacrificial Bell pair will be able to detect X orY errors, which leaves us with the following tableconditioned on successful measurement.

on preservedI X Y Z

onsacrificial I II ZI

X XI YIY YZ XZZ ZZ IZ

Out of the 8 possibilities (16 initially), 2 (II &IZ) are harmless to the preserved Bell pair and

the remaining 6 are damaging, which leaves uswith infidelity, to first order, 6

16ε × 2 (the factorof 2 comes from the fact that both Alice and Bobare subject to depolarization errors).

We can now augment the circuit with anotherlevel of detection that will be able to detect theZ error on the sacrificial Bell pair:

To first order any errors contributed by thisextension are negligible and can not propagateback to the preserved Bell pair. The Z error thatmight have occurred on the middle line (and wasleft undetected) will now propagate to the bot-tom line and be detected by the coincidence Xmeasurement leaving us with the following table:

on preservedI X Y Z

onsacrificial I II ZI

X XI YIYZ

Out of the 4 undetected errors, 3 still harm thepreserved Bell pair, so we are left with fidelity316ε × 2. Those three are undetectable as theydo not propagate to the sacrificial qubits (theyact as the identity on the sacrificial qubits). Assuch, using bigger registers (wider circuits) wouldprovide only small higher-order corrections.

Finally, the asymptote reached by our circuitscontains one additional source of infidelity. Theblack vertical lines in Fig. 5 correspond to shortcircuits with zero initialization error. However,a real purification protocol would need multiplerounds of purification until it lowers the non-zeroinitialization error to the steady-state floor gov-erned by the operational error. In this steadystate an additional round of purification wouldbe able to detect only 2 of the possible 3 Paulierror that were already present, therefore rais-ing the bound of the achievable infidelity from316ε× 2 to 3+1

16 ε× 2 (to first order in ε). For theparameters of Fig. 5 this would correspond to an

Accepted in Quantum 2019-02-13, click title to verify 12

Figure 5: Same as 4 but we add some additional infor-mation. Dashed vertical lines, corresponding to perfectlyinitialized (F0 = 1, p2 = η = 0.99) short purificationcircuits, are shown as a guide to how well the circuitsperform in terms of initialization versus operational er-rors as described in the main text. In “single selection”circuits each party uses registers of size two, size threefor “double selection”, and size four for “triple selection”.

asymptote at infidelity of 0.005 which is indeedwhat we observe.

The vertical lines of Fig. 5 are slightly offsetfrom the values quoted above because we usedexact numerics for the plots, as opposed to thefirst-order calculations of this section.

D Shortest multi-pair purification cir-cuitsIn the main text we introduced circuits to be usedas benchmarks of initialization-vs-operation er-rors. The idea was to show what performanceis provided by a circuit applied to perfectly ini-tialized raw Bell pairs, or in other words, howmuch damage is caused by operation errors if westart with perfect initialization (as done in Fig. 4and Fig. 7). To do that we found with brute-force enumeration the best “short” circuits, i.e.circuits that do not reinitialize any of the con-sumed Bell pairs. They are named in the mannerintroduced in [22]. The triple select circuit is ac-tually a generalization of the circuit from [22].As described in [22] and in the main text of ourmanuscript, double selection significantly outper-forms single selection, and extending the doubleselection circuit to a triple selection circuit pro-vides only modest higher-order improvements.

Figure 6: A double selection circuit on the left and atriple selection circuit on the right. We show only Bob’sside of the circuit. The circuit from Fig. 1 can be re-ferred to as a single selection circuit. As explained in themain text, there are many circuits with equivalent per-formance, related to the given circuits by permutationof the Bell basis.

E More about initialization errors, op-erational errors, and the length of thecircuitIn Fig. 4 the vertical lines showed the “operationalerror” limit which one would reach if there wereno initialization errors.

To make the comparison between initializa-tion and operational errors clearer we provideFig. 7 which drops the “success probability” axisof Fig. 4 and instead shows how the performancevaries with p2. In it one can see that the ini-tialization infidelity is not a limiting factor - aslong as the operational infidelity can be lowered,we can find longer circuits that iteratively get ridof the initialization error. For a sufficiently longcircuit we reach a point of saturation, where, asdescribed above, the operational error in the lastoperation dominates the infidelity of the final Bellpair. Similarly, if the circuit is wider (i.e. the reg-ister is bigger) we can obtain higher final fideli-ties for a fixed operational error, and the pointsaturation occurs at even lower operational errorlevels.

F Circuits for registers with dedicatedcommunication qubitSome hardware implementations of quantum reg-isters have constraints on the two-qubit opera-tions they can perform. For instance, only asingle "communication" qubit might be able toestablish a raw Bell pair with the remote reg-ister. Works like [7] suggest purification circuitsspecifically designed to fulfill such constraints. Tosee how our optimization protocol compares to

Accepted in Quantum 2019-02-13, click title to verify 13

Figure 7: For each family of generated circuits of var-ious width (color) and for a given operational infidelity(x axis) we show the best achievable final Bell pair fi-delity by a circuit in that family. The top plot limits thepermitted circuits to length less than 30 operations, andthere is a limit of less than 40 operations for the bot-tom plot. Three important observations can be made:(1) as long as we can lower the operational error, wecan design a long enough circuit that is not affected bythe initialization error; (2) a wider register outperformssmaller registers and reaches a point of diminishing re-turns at smaller operational errors; (3) as already men-tioned, circuits of width 2 are insufficient for arbitrarysuppression of the initialization error as they detect only2 of the possible 3 single-qubit errors (X, Y, and Z).The grey lines follow the same conventions as in Fig. 4 -short perfectly initialized circuits used as a benchmark.The triple selection circuit from Fig. 4 is omitted as itcan not be distinguished from the double select circuiton this scale. The “identity” line corresponds to whatwould happen if we simply depolarize a single perfectBell pair with probability 1− p.

Figure 8: The top circuit is the one produced by ourmodified algorithm, while the bottom one is from Nig-matullin et al. [7]. We use the same notation as in therest of the manuscript, in particular the small circles rep-resent the reestablishment of a raw Bell pair (which hereis only possible on the bottom-most qubit, i.e. the com-munication qubit). Our circuit requires only 5 raw Bellpairs (as opposed to 6 for the circuit from [7]), producesa final Bell pair of infidelity of 1.77% (as opposed to2.46%), at a success rate of 48% (as opposed to 43%).The optimization and evaluation was done for F0 = 0.9,p2 = η = 0.99, without memory errors or errors fromsingle-qubit unitaries. As discussed in the rest of thetext, another circuit could be optimal for a different er-ror model.

such hand-crafted circuits we made the follow-ing modifications: SWAP gates were added tothe set of permitted operations; two-qubit gateswere made available only on nearest neighbors;measurements on anything but the communica-tion qubit became destructive; a reset operation(production of a new raw Bell pair) was addedas a possibility, but only for the communicationqubit. For the error regime we considered we wereable to find a shorter circuit with higher fidelityand similar success probability as seen in Fig. 8.

G Different results when optimizing indifferent regimesIn Fig. 9 we demonstrate the importance of op-timizing your purification circuit for the exacthardware at which it would be ran. One can seethat each of the three circuits outperforms theother two, only within a small interval aroundthe parameter regime for which it was optimized.

H Infidelity axesEven if the error model for the circuits and ini-tialization is the depolarization model, the errorin the final result of the purification needs not be

Accepted in Quantum 2019-02-13, click title to verify 14

Figure 9: Each colored line corresponds to the result of acircuit optimization ran the given p = p2 = η (depolar-ization noise). Then each of these circuits are evaluatedat various values of p, different from the one they wereoptimized for. The x axis is the value of 1 − p at eval-uation. The y axis is the obtained value of 1− F . Thedashed lines mark the values at which the optimizationswere ran. The length of the circuits was constrained to≤ 12, the width was 3 and F0 = 0.9.

Figure 10: Top to bottom, the 0.95, 0.98, and 0.99circuits from Fig. 9

Figure 11: Each point corresponds to one of the circuitsshown in Fig. 2. In the top plot they are colored by thefinal infidelity of the Bell pair produced by the circuit. Inthe bottom is the same plot, but the color correspondsto the length of the circuit. The 3 axes of the ternaryplot correspond to the 3 components of the infidelity.As ternary plots require the 3 coordinates to fulfill aconstraint, we plot the relative infidelity. For instance,the left axis (corresponding to the height of a point inthe plot) shows the probability to be in ψ+ divided bythe total probability to be in a state different from φ+(the state being purified). Being in the center of thetriangle means the infidelity in the final result is puredepolarization. Being in one of the corners means thatone of the infidelity components dominates the othertwo. Being near the midpoint of a side means one ofthe infidelity components is much smaller than the othertwo. The 6 symmetries of this triangle correspond to thesix permutations of {B,C,D}.

Accepted in Quantum 2019-02-13, click title to verify 15

depolarization. The infidelity in the final resulthas three components - the probabilities to be instates ψ−, ψ+, and φ−, respectively. Different pu-rification circuits affect the three infidelity com-ponents differently, and giving different weightsin the cost function of the optimization algorithmmight be important, depending on the goal (forinstance, if the purified Bell pairs are used forthe creation of a GHZ state, the particular im-plementation might be more susceptible to phaseerrors, in which case that component would beassigned a higher weight). In Fig. 11 we show thedistribution of the infidelity components of thepurified Bell pair for each of the circuits we havegenerated. Of note is that longer circuits reachnearer the pure depolarization error, by virtue oflowering the infidelity to the level of diminishingreturns where the depolarization from to the fi-nal operation dominates. Moreover, the resultsare biased to one particular type of error, due tothe particular choice of “genes” described in themain text, namely, the {B,C,D} permutationsare performed before the CNOT gate and mea-surements. This bias can be removed if necessaryby applying one final {B,C,D} permutation (thesix {B,C,D} permutations correspond to the sixsymmetries of the triangle in Fig. 11).

I Implementation of the various per-mutation operations

Here we give explicitly what single-qubit Cliffordoperations are necessary in order to perform apermutation of the Bell basis. H stands for theHadamard gate and P states for the phase gate(in parenthesizes we mark whether the permuta-tion is a rotation or a reflection of the triangle).

permutation Alice does Bob doesBCD nothing nothing

BDC(refl) H H

DCB(refl) HPH PHP

CDB(rot) PH (HP )2

DBC(rot) (PH)2 (HP )4

CBD(refl) H(PH)2 H(HP )4

Even though the decomposition of these oper-ations in terms of H and P has different lengths,in practice these operations are equally easy toimplement on real hardware.

J Canonicalization of generated cir-cuits

Many redundancies can appear in the populationof circuits subjected to simulated evolution. Tosimplify the analysis of the results we filter thegenerated circuits by first ensuring that for eachcircuit:

• the first operation is not a measurement;

• does not contain two immediately consecu-tive measurements on the same qubit;

• does not contain unused qubits;

• does not contain measurement and reset ofthe top-most qubit pair (the one containingthe Bell pair to be purified);

• does not contain non-measurement as a laststep;

and then for the non-discarded circuits we per-form the following canonicalization:

• reorder the qubits of the register so that thequbit closest to the top-most qubit is the oneto be measured last, the second closest ismeasured second to last, etc;

• if a two-qubit gate and a measurement com-mute (i.e. they affect different qubits of theregister), reorder them so that the gate isalways before the measurement (in an im-plementation of that circuit, those two oper-ations will be executed in parallel);

• if two two-qubit gates affect different qubits,put the one that affects top-most qubits be-fore the one that affects lower qubits (in animplementation of that circuit, those two op-erations will be executed in parallel).

The canonicalization rules are arbitrary and anyother consistent set can be used, at the discre-tion of the software writer. However, they en-sure that two circuits that are physically equiv-alent are not presented multiple times in the fi-nal result, substantially lowering the circuits thatneed to be evaluated. The set described above isnot exhaustive, as there are other, more complex,equivalences that we have not considered.

Accepted in Quantum 2019-02-13, click title to verify 16

Figure 12: Monte Carlo evaluation of overhead due to restarts of failed measurements. The evaluation is from thecircuit from Fig. 3 at F0 = 0.9 and p2 = η = 0.99. On the left we have the histogram of completed runs in termsof how many operations a run takes to successfully complete. In each histogram, the mean value of the distributionis showed as well. On the right we have the probability for the protocol (in which reinitializations are permitted)to successfully complete in terms of how many Bell pairs were used (i.e. it is the cumulative version of the top-leftplot).

Figure 13: The relationship between overhead and suc-cess probability for the designs generated by our algo-rithm. Longer circuits have both lower success probabil-ity and higher overhead (expended Bell pairs). However,as shown in the rest of manuscript, longer circuits ap-proach asymptotically the upper bound of performance.

K Yield in the absence of measure-ment and operational errors

As mentioned in the main text, if we concate-nate a finite circuit with the hashing method, wecan define a "hashing" yield even for our finitecircuits. It is defined as P

N (1 − H(F )), whereP is the success probability for the circuit un-der consideration, N is the number of raw Bellpairs being sacrificed, F is the fidelity of the Bellstate produced by the circuit, and H is the en-tropy in that Bell state (the information in thatBell state is the resource exploited by the hashingmethod to asymptotically reach unit fidelity, andconsequently, 1 − H(F0), where F0 is the initial

Figure 14: Plotted is the "hashing yield" of a given pu-rification protocol versus the initial fidelity of the rawBell pairs. The solid black line is the yield of the hash-ing method on its own. The dashed lines are the yieldsof the Oxford method (either on its own or used recur-sively) used as initial purification step and then contin-ued by the hashing method. The colored lines are lowerbounds for various protocols we have generated, used asinitial purification step and then continued by the hash-ing method. The color represents the upper bound ofhow many raw Bell pairs the protocol requires. Of noteis that although the hashing method on its own is thehighest yield protocol when F0 ≈ 1, around F0 ≈ 0.81we get 1−H(F0) = 0 which requires the preprocessing(concatenation) steps, to bring the intermediate stagefidelity to a workable level. We do not optimize for thehashing yield, given that it is defined for perfect localgates and measurements.

Accepted in Quantum 2019-02-13, click title to verify 17

raw Bell pair fidelity, would be the yield one canachieve when using only the hashing method).This "hashing yield" definition faces a couple ofproblems in the parameter regime we work with.First, this quantity only refers to yield for cir-cuits devoid of measurement and operational er-rors, but as we have seen, we need to considersuch errors because the best finite purificationcircuit depends on the error model. Moreover,as our circuits might fail early, before all of theraw Bell pairs have been engaged, the factor 1

Nis only a worst case bound. As such, the yieldgiven by this expression is only a lower bound.We compare the yields given by the circuits wehave generated to a number of known circuits inFig. 14 (in the absence of measurement and op-erational errors). However, we remind the readerthat the yield is not the cost function in our op-timization algorithms, as our circuits are specifi-cally optimized to deal with the aforementionedlocal errors.

L Analytical expressions for the final fi-delity

Our software also produces a symbolic analyti-cal expression for the fidelities obtained by eachcircuit. The quality of the raw Bell pairs is ex-pressed as the quadruplet of probabilities to bein each of the Bell basis states (F0, q, q, q) whereq = 1−F0

3 (more general non-depolarization errormodels are available as well). The purificationcircuit acts as a map that takes (F, q, q, q) to thequadruplet (FA, b, c, d) representing the probabil-ities that the final purified Bell pair is in each ofthe Bell basis states.

The permutations of the Bell basis (i.e. allthe local Clifford operations we are permitting)are polynomial maps, i.e. the output quadrupletcontains polynomials of the variables in the inputquadruplet. Depolarization is a polynomial mapas well. Measurement without normalization is apolynomial map, but it becomes a rational func-tion if normalization is required.

By postponing normalization until the very laststep, we can use efficient symbolic polynomiallibraries like Sympy (using generic symbolic ex-pressions is much slower than using polynomials).The final result is given as a series expansion ofthe normalized expression (in terms of the smallparameters 1− F0, 1− p2, and 1− η).

M Monte Carlo simulations of restartoverheadAs mentioned in the main text, one needs to con-sider how a protocol proceeds when a measure-ment fails. If there is a subcircuit that can berestarted, one needs not redo the entire proto-col, rather only reinitialize at the point where thesubcircuit starts. However, if the top-most qubitpair, the one holding the Bell pair, is entangledwith the qubit pair that undergoes a failed coinci-dence measurement, then the entire protocol hasto be restarted. For most of our circuits, suchsubcircuits do not exist, but they are commonamong manually designed circuits. Our softwareautomatically finds subcircuits and runs a MonteCarlo simulation of the sequence of measurementsand reinitializations in order to evaluate the av-erage resource usage as shown in Fig. 12.

The overhead estimated this way also provesto be closely related to the success probabil-ity of the given protocol, to be expected giventhat greater overhead implies more imperfect op-erations which implies higher chance of a fault(Fig. 13).

Accepted in Quantum 2019-02-13, click title to verify 18