Dirk Englund

We show that the vacuum fluctuations of coherent light can serve as a cryptographic resource for private neural-network inference. A server encodes proprietary model weights into weak coherent states; a client computes the inference optically and returns a certificate state whose excess noise the server verifies. Weight-leakage bounds derived via the Holevo theorem hold against all IID attacks, including non-Gaussian ones. Data-leakage bounds derived via Cramér–Rao inequalities hold against individual attacks with arbitrary probes and collective attacks with Gaussian probes. On MNIST, the protocol achieves >95% accuracy with leakage below 0.1 bits per weight and per data element, an order of magnitude below the precision needed for functional inference. All components are standard CV-QKD hardware. Published in Physical Review X 15, 041056 (2025).

We formalize the security proof chain of the BB84 quantum key distribution protocol in Lean 4, an interactive theorem prover. The development covers IID security, collective attacks, the quantum de Finetti theorem, and the reduction from general attacks to collective attacks. Every deduction is verified by the Lean proof kernel, ensuring that all assumptions and preconditions are explicit and mechanically checked. The project also introduces a reusable quantum information theory library supporting entropy inequalities, quantum channels, and representation-theoretic tools required for QKD security proofs. The resulting development establishes a Lean framework for machine-verified quantum cryptographic security proofs.

The necessity of multi-party computing has become increasingly evident due to the exploding demand for distributed machine learning. Offloading computationally intensive DNN inference to cloud servers introduces vulnerabilities that compromise user data security. To address this challenge, we introduce a coherent linear algebra engine for private multi-party computation of distributed machine learning tasks, leveraging conventional telecom components. We evaluate the fidelity of inner product computations, MNIST classification accuracy, and potential information leakage. Our analyses reveal a trade-off between classification accuracy and data privacy. This trade-off diminishes in significance for large-scale tasks, indicating the potential to achieve both classification accuracy and privacy simultaneously.

We recently introduced a "quantum router" architecture that improves entanglement fidelities in chains of multiplexed repeaters. Here, we address local entanglement routing across general network graphs of routers to optimize entanglement rates and fidelities. Our proposed routing strategy achieves close-to-optimal rates in the limit of high multiplexing.

We develop a protocol that allows a pair of users to sift a secret key starting from shared variable-length Greenberger-Horne-Zeilinger (GHZ) states. It is an extension of the BBM’92 protocol which relies on measurements in the matching basis for entanglement witness. We then design an entanglement generation scheme over a quantum network that equips the quantum key generation protocol to achieve key rates that are independent of the distance between the two users. The key new insight in our protocol is to allow a repeater node to use n-qubit GHZ projective measurements that can fuse n successful entangled links, i.e., two-qubit entangled Bell pairs shared across network edges, incident at that node, into an n-qubit GHZ state shared by the far nodes of those edges. If we allow even 3-fusions at the nodes, we find by developing a connection to a modified version of the site-bond percolation problem that despite lossy (hence probabilistic) link-level entanglement generation, and probabilistic success of the fusion measurements at nodes, one can generate entanglement between end two parties at a rate that stays constant as the distance between them increases. This is not possible to attain with any (non-error-corrected) quantum networking protocol using Bell measurements alone.