{'fraction_non_alphanumeric': 0.04397631374784275, 'fraction_numerical': 0.015888471951740844, 'mean_word_length': 4.2632916666666665, 'pattern_counts': {'":': 2, '<': 3, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 28, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Quantum cloning

The impossibility of perfectly copying (or cloning) an arbitrary quantum state is one of the basic rules governing the physics of quantum systems. The processes that perform the optimal approximate cloning have been found in many cases. These"quantum cloning machines"are important tools for studying a wide variety of tasks, e.g. state estimation and eavesdropping on quantum cryptography. This paper provides a comprehensive review of quantum cloning machines (both for discrete-dimensional and for continuous-variable quantum systems); in addition, it presents the role of cloning in quantum cryptography, the link between optimal cloning and light amplification via stimulated emission, and the experimental demonstrations of optimal quantum cloning.


IV. Application of quantum cloning to attacks in quantum cryptog
The concept of "information" is shaping our world: communication, economy, sociology, statistics... all benefit from this wide-encompassing notion. During the last decade or so, information entered physics from all sides: from cosmology (e.g. entropy of black-holes 1 ) to quantum physics (the entire field of quantum information processing). Some physicists even try to reduce all natural sciences to mere information (Brukner and Zeilinger, 2002;Collins et al., 2004;Fuchs, 2002). In this review, we concentrate on one of the essential features of information: the possibility to copy it. One might think that this possibility is an essential feature of any "good" encoding of information. This is however not the case: when information is encoded in quantum systems, in general it cannot be replicated without introducing errors. This limitation, however, does not make quantum information useless -quite the contrary, as we are going to show.
But we should first answer a natural question: why should one encode information in quantum systems? Well, in the final analysis, the carriers of information can only be physical systems ("information is physical", as Rolf Landauer summarized it); and ultimately, physical systems obey the laws of quantum physics. So in some sense, the question that opened this paragraph can be answered with another question: do you know any carriers of information, other than quantum systems? The answer that most physicists give is, "No, because everything is quantum" -indeed, the boundary between the classical and the quantum world, if any such boundary exists, has not been identified yet. Other reasons to be interested in quantum information will soon become clear.
Still, even if the carrier of information is a quantum system, its encoding may be classical. The most striking example found in nature is DNA: information is encoded by molecules, which are definitely quantum systems; but it is encoded in the "nature" of the molecules (adenine, thymine, cytosine, guanine), not in their state 2 . Such an encoding is classical, because one cannot find a superposition of "being adenine" and "being thymine". If information is encoded this way, it can be replicated perfectly: this process is called cloning, nature performs it and biologists are struggling to master it as well.
Here, we concentrate on the quantum encoding of information, when information is encoded in the state ψ of quantum systems. The process of replicating the state, written ψ → ψ ⊗ ψ and called cloning as well, can be done perfectly and with probability 1 if and only if a basis to which ψ belongs is known. Otherwise, perfect cloning is impossible: either the copies are not perfect, or they are perfect but sometimes the copying process simply gives no outcome. These are the content and the consequences of the no-cloning theorem of quantum information. Similar to Heisenberg's uncertainty relations, the no-cloning theorem defines an intrinsic impossibility, not just a limitation of laboratory physics.
After some thinking though, one may object that the possibility of classical telecommunication contradicts the no-cloning theorem: after all, information travelling in optical fibers is encoded in the state of light, so it should be a quantum encoding; and this information is amplified several times from the source to the receiver, so it should degrade. Indeed, it does. However, a telecom signal consists of a large number of photons prepared in the very same quantum state; so, amplification in telecom amounts to producing some new copies of ψ out of ψ ⊗N . In short, the no-cloning theorem does apply to the amplification of telecom signals, because spontaneous emission is always present in amplifiers; but the copy is almost perfect, because stimulated emission is the dominating effect. The sensitivity of present-day devices is such that the quantum limit should be reached in the foreseeable future 3 .
We left for the end of the introduction the most surprising: an encoding of information that obeys the nocloning theorem is helpful. The impossibility of perfectly copying quantum information does not invalidate the entire concept of quantum information. Quite the opposite, it provides an illustration of its power. There is no way for someone to perfectly copy the state of a quantum system, for a clever encoding of information which uses a set of non-orthogonal states. Consequently, if such a system arrives unperturbed at a receiver, then, for sure, it has not been copied by any adversary. Hence, due to the no-cloning theorem, quantum information provides a means to perform some tasks that would be impossible using only ordinary information, such as detecting any eavesdropper on a communication channel: this is the idea of quantum cryptography.
The outline of the review will be given in paragraph I.D.3, after some concepts have been introduced. We start by stating and demonstrating the no-cloning theorem, and by sketching its history. 3 The security parameter for the acceptable error is presently set at e = 10 −9 . Let's make a simple estimate of the ultimate quantum limit that corresponds to it: the signal is a coherent state |α , and let's say that an error is possible for the vacuum component, because for that component there is no stimulated emission. Then e ≈ | α|0 | 2 = exp(−|α| 2 ), which is equal to 10 −9 for an average number of photons |α| 2 ≈ 20. In actual networks, a telecom pulse that has travelled down a fiber reaches the amplifier with an intensity of some 100 photons on average.

B. The no-cloning theorem
It is well-known that one cannot measure the state |ψ of a single quantum system: the result of any single measurement of an observable A is one of its eigenstates, bearing only very poor information about |ψ , namely that it must not be orthogonal to the measured eigenstate. To reconstruct |ψ (or more generally, any mixed state ρ) one has to measure the average values of several observables, and this implies making statistical averages over a large number of identically prepared systems (Wootters and Fields, 1989). One can imagine how to circumvent this impossibility in the following way: take the system in the unknown state |ψ and let it interact with N other systems previously prepared in a blank reference state |R , in order to obtain N + 1 copies of the initial state: (1) Such a procedure would allow one to determine the quantum state of a single system, without even measuring it because one could measure the N new copies and leave the original untouched. The no-cloning theorem of quantum information formalizes the suspicion that such a procedure is impossible: No-cloning theorem: No quantum operation exists that can duplicate perfectly an arbitrary quantum state.
The theorem can be proved with a reductio ad absurdum by considering the 1 → 2 cloning. The most general evolution of a quantum system is a trace-preserving completely-positive (CP) map. A well-known theorem (Kraus, 1983) says that any such map can be implemented by appending an auxiliary system (ancilla) to the system under study, let the whole undergo a unitary evolution, then trace out the ancilla. So let us suppose that perfect cloning can be realized as a unitary evolution, possibly involving an ancilla (the "machine"): |ψ ⊗ |R ⊗ |M U? −→ |ψ ⊗ |ψ ⊗ |M(ψ) . (2) In particular then, for two orthogonal states labelled |0 and |1 , we have: But because of linearity (we omit tensor products) these conditions imply: |0 + |1 |R |M −→ |00 |M(0) + |11 |M(1) .

S x|z M QCM
FIG. 1 Setup devised by Herbert to achieve signaling. A source S produces pairs of qubits in a maximally entangled state; on the left, Alice measures either σx or σz. On the right, Bob applies a perfect quantum cloning machine (QCM) and then measures the two clones (the measurement M may be individual or collective).
C. History of the no-cloning theorem 1. When "wild" ideas trigger deep results Historically, the no-cloning theorem did not spring out of deep thoughts on the quantum theory of measurement. The triggering event was a rather unconventional proposal by Nick Herbert to use quantum correlations to communicate faster-than-light (Herbert, 1982). Herbert called his proposal FLASH, as an acronym for "First Light Amplification Superluminal Hookup". The argument goes as follows (Fig. 1). Consider two parties, Alice and Bob, at an arbitrary distance, sharing two qubits 4 in the singlet state On her qubit, Alice measures either σ x or σ z . Because of the properties of the singlet, if Alice measures σ z , she finds the eigenstate |0 (resp. |1 ) with probability 1 2 , and in this case she prepares Bob's qubit in the state |1 (resp. |0 ). Without any knowledge on Alice, Bob sees the mixed state 1 2 |0 0| + 1 2 |1 1| = 1 2 1 1, just as if Alice had done nothing. Similarly, if Alice measures σ x , she finds the eigenstate |+ (resp. |− ) with probability 1 2 , and in this case she prepares Bob's qubit in the state |− (resp. |+ ). Again, without any knowledge on Alice, Bob sees the mixed state 1 2 |+ +| + 1 2 |− −| = 1 2 1 1. However, suppose that Bob has a perfect 1 → 2 cloner, QCM in Fig. 1, and that he has his qubit pass through it. Now, if Alice measures σ x , Bob's mixture is ρ x = 1 2 | + + + + | + 1 2 | − − − − |; if Alice measures σ z , Bob's mixture is ρ z = 1 2 |00 00| + 1 2 |11 11|. It is easily verified that ρ x = ρ z (for instance, 01|ρ x |01 = 1 4 while 01|ρ z |01 = 0). Thus, at least with some probability, by measuring his two perfect clones, Bob could know the measurement that Alice has chosen without any communication with her. This is an obvious violation of the no-signaling condition, but the argument was clever -that is why it was published (Peres, 2002) -and triggered the responses 5 of Wootters and Zurek (1982), Dieks (1982), Milonni and Hardies (1982) and slightly later Mandel (1983). In these papers, the no-cloning theorem was firmly established as a consequence of the linearity of quantum mechanics. It was also shown that the bestknown amplification process, spontaneous and stimulated emission of a photon by an excited system, was perfectly consistent with this no-go theorem (Mandel, 1983;Milonni and Hardies, 1982;Wootters and Zurek, 1982).

Missed opportunities
Once the simplicity of the no-cloning theorem is noticed, one cannot but wonder why its discovery was delayed until 1982. There is no obvious answer to this question. But we can review two "missed opportunities".
In 1957, during a sabbatical in Japan, Charles Townes worked out with Shimoda and Takahasi the phenomenological equations which describe the amplification in the maser that he had demonstrated four years before (Shimoda et al., 1957;Townes, 2002). In this paper, see discussion in paragraph VI.A.3 for more details, some rate equations appear from which the "fidelity" of optimal quantum cloning processes 6 immediately follows. At that time however, nobody used to look at physics in terms of information; so in particular, nobody thought of quantifying amplification processes in terms of the accuracy to which the input state is replicated.
The second missed opportunity involved Eugene Paul Wigner. In a Festschrift, he tackled the question of biological cloning (Wigner, 1961). Wigner tentatively identified the "living state" with a pure quantum mechanical state, noted ν; he then noticed that, among all the possible unitary transformations, those that implement ν ⊗ w → ν ⊗ ν ⊗ r are a negligible set -but he did not notice that no transformation realizes that task for any ν, which would have been the no-cloning theorem. From his observation, Wigner concluded that biological reproduction "appears to be a miracle from the point of view of the physicist". We know nowadays that his tentative description of the living state is not correct, and that reproduction is possible because the encoding in DNA is classical (see the Introduction of this review). 5 NG: "I vividly remember the conference held somewhere in Italy for the 90th birthday of Louis de Broglie. I was a young PhD student. People around me were all talking about a "FLASH communication" scheme, faster than light, based on entanglement. This is where -I believe -the need for a no-cloning theorem appeared.
Zurek and Milonni were among the participants." 6 Specifically, universal symmetric N → M cloning of qubits, see below.
3. From no-cloning to optimal cloning Immediately after its formulation, the no-cloning theorem became an important piece of physics, cited in connection with both no-signaling (Bussey, 1987;Ghirardi and Weber, 1983) and amplification (Yuen, 1986). Interestingly, no-cloning was invoked to argue for the security of quantum cryptography from the very beginning (Bennett and Brassard, 1984). Sect. 9-4 of Peres' book (Peres, 1995) is a good review of the role of the theorem before 1996. In the first months of that very year, Barnum et al. (1996) considered the possibility of the perfect cloning of non-commuting mixed states, and reach the same no-go conclusion as for pure states. Everything fell into place.
The situation suddenly changed a few months later: in the September 1996 issue of Physical Review A, Vladimír Bužek and Mark Hillery published a paper whose title is "Quantum copying: beyond the no-cloning theorem" (Bužek and Hillery, 1996). Of course, they did not claim that the no-go theorem was wrong. But the theorem applied only to perfect cloning, whereas Bužek and Hillery suggested the possibility of imperfect cloning. Specifically (see II.A below for all details), they found a unitary operation such that the partial traces on the original qubit A and on the cloned qubit B satisfy with a fidelity F that is "not too bad" ( 5 6 ) and is the same for any input state |ψ . The Bužek-Hillery unitary transformation is the first Quantum Cloning Machine; it triggered an explosion in the number of investigations on quantum cloning. D. Quantum Cloning Machines (QCM): generalities

Definition of cloning
Any interaction (i.e. any CP map) between two quantum systems A and B, possibly mediated by an ancilla M, has the effect of "shuffling" the quantum information between all the sub-systems. When the input state takes the form |ψ A |R B , then at the output of any CP map the quantum information contained in |ψ will have been somehow distributed among A and B (and possibly the ancilla). This suggests the following definition of the process of cloning of pure states, that we generalize immediately to the case of N → M cloning: where |ψ is the state of H to be copied, |R is a reference state arbitrarily chosen in the same Hilbert space H, and |M is the state of the ancilla. In other words: • The fact that the process is a form of cloning is determined by the form of the input state, l.h.s. of (5): N particles ("originals") carry each the pure state |ψ to be copied. In particular then, the N originals are disentangled from the M − N particles that are going to carry the "copies" (that start in a blank state) and from the "ancillae". In fact, sometimes (e.g. in paragraphs II.C, II.D) it will be convenient to consider that the copies and the ancillae start in an entangled state. This does not contradict (5): one simply omits to mention a "trivial" part of the QCM, that prepares the copies and the ancillae in the suitable state. It is important to stress that we consider only pure states as inputs; to our knowledge, there are no results on QCM that would be optimal for mixed states.
• The cloning process (5) is defined by the Quantum Cloning Machine (QCM), which is the tracepreserving CP map, or equivalently the pair A QCM can be seen as a "quantum processor" U , that processes the input data according to some "program" |M . Examples of QCM, that produce clones of very different quality, are easily found: just take the identity |ψ A |R B → |ψ A |R B that transfers no information from A to B, or the swap |ψ A |R B → |R A |ψ B that transfers all the information from A to B -both unitary operations, with no ancilla. The possibility to define coherent combinations of such processes suggests that nontrivial QCM can be found: and indeed, we'll see that this intuition is basically correct (see particularly II.C), although not fully, because ancillae play a crucial role.

Fidelity, and the Glossary of QCM
Having defined the meaning of "cloning", we can introduce the basic glossary that is used in the study and classification of QCMs. The very first object to define is a figure of merit according to which the output of the QCM should be evaluated. The usual figure of merit is the single-copy fidelity, called simply fidelity unless some ambiguity is possible. This is defined for each of the outputs j = 1...M of the cloning machine, as the overlap between ρ j and the initial state |ψ : where ρ j is the partial state of clone j in the state |Ψ defined in (5). Note that the worst possible fidelity for the cloning of a d-dimensional quantum system is F j = 1 d , obtained if ρ j is the maximally mixed state 1 1 d . The following, standard classification of QCM follows: • A QCM is called universal if it copies equally well all the states, that is, if F j is independent of |ψ . The notation UQCM is often used. Non-universal QCM are called state-dependent.
• A QCM is called symmetric if at the output all the clones have the same fidelity, that is if F j = F j ′ for all j, j ′ = 1, ..., M . For asymmetric QCM, further classifications are normally needed: for instance, in the study of 1 → 3 asymmetric QCM, one may restrict to the case F 1 = F 2 = F 3 (that we shall write 1 → 1 + 2) or consider the general case 1 → 1+1+1 where all the three fidelities can be different.
• A QCM is called optimal if, for a given fidelity of the original(s), the fidelities of the clones are the maximal ones allowed by quantum mechanics. More specifically, if S is the set of states to be cloned, optimality can be defined by maximizing either the average fidelity over the states F = S dψF (ψ), or the minimal fidelity over the states F min = min ψ∈S F (ψ). These definitions often coincide.
According to this classification, for instance, the Bužek-Hillery QCM is the optimal symmetric UQCM for the cloning 1 → 2 of qubits. The generalization to optimal symmetric UQCM for the cloning N → M have been rapidly found, first for qubits (Bruß, DiVincenzo et al., 1998;Gisin and Massar, 1997), then for arbitrarydimensional systems (Keyl and Werner, 1999;Werner, 1998). Also the family of optimal asymmetric UQCM for the cloning 1 → 1 + 1 of arbitrary dimension has been fully characterized (Braunstein, Bužek and Hillery, 2001;Cerf, 2000b;Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005). The study of the optimal universal asymmetric QCM N → M 1 + M 2 has been undertaken later, motivated by the fact that the 2 → 2 + 1 QCM is needed for the security analysis of quantum cryptography protocols. As the reader may easily imagine, the full zoology of QCM has not been explored: there are hard problems that wait for a motivation. For instance, very few examples of optimal state-dependent QCM are known.

Outline of the paper
The outline of this review is as follows. In Section II, we review the cloning of discrete quantum systems, presenting the QCMs for qubits and stating the generalizations to larger-dimensional systems. We introduce at the end of this section the link between cloning and state estimation. In Section III, we will review the cloning of continuous variables. Section IV is devoted to the application of quantum cloning for eavesdropping in quantum cryptography. The last two sections are devoted to the realization of quantum cloning. Section V shows how the amplification based on the interplay of spontaneous and stimulated emission achieves optimal cloning of discrete systems encoded in different modes of the light field. We present a self-contained derivation of this claim. In Section VI, we review the experimental proposals and demonstrations of cloning, for the polarization of photons and for other physical systems.
Some topics related to cloning are omitted in this review. One of them is probabilistic exact cloning (Duan and Guo, 1998;Pati, 1999): while in the spirit of Bužek-Hillery one circumvents the no-cloning theorem by allowing imperfect cloning, in probabilistic cloning one wants to always obtain a perfect copy, but the price is that the procedure works only with some probability. This is related to unambiguous state discrimination procedures in state-estimation theory. In comparison to probabilistic cloning, the cloning proceduresà la Bužek-Hillery that we describe in this review are called deterministic cloning, because the desired result, namely imperfect copying, is always obtained. Hybrid strategies between probabilistic-exact and deterministic-imperfect cloning have also been studied and compared to results of state-estimation theory (Chefles and Barnett, 1999).
Another topic that will be omitted is telecloning, that is, cloning at a distance. In this protocol, a party Alice has a copy of an unknown quantum state, and wants to send the best possibly copy to each of M partners. An obvious procedure consists in performing locally the optimal 1 → M cloning, then teleporting the M particles to each partner; this strategy requires M singlets (that is, M bits of entanglement or e-bits) and the communication of 2M classical bits. It has been proved (Murao et al., 1999) that other strategies exist, that are much cheaper in terms of the required resources. In particular, the partners can share a suitable entangled state of only O(log 2 M ) e-bits, and in this case the classical communication is also reduced to public broadcasting of two bits.

E. No-cloning and other "limitations"
As a last general discussion, we want to briefly sketch the link between cloning and other "limitations" that are found in quantum physics; specifically, the no-signaling condition and the uncertainty relations.

Relation to no-signaling
As we said in paragraph I.C, a perfect cloner would allow signaling through entanglement alone. Shortly after the idea of imperfect cloning was put forward, (Gisin, 1998) noticed that one can also study optimal imperfect cloning starting from the requirement that no-signaling should hold. The proof was given for universal symmetric 1 → 2 cloning for qubits. The idea is to require that the input state |ψ ψ| = 1 2 (1 1 +m · σ) is copied into a two qubit state such that the two one-qubit partial states are equal and read ρ 1 = ρ 2 = 1 2 (1 1 + ηm · σ): i.e., the Bloch vector points in the same direction as for the original but is shrunk by a factor η (shrinking factor), related to the fidelity defined in (7) through F = 1+η 2 . On the one hand, we know from the no-cloning theorem that η = 1 is impossible and would lead to signaling; on the other hand, η = 0 is obviously possible by simply throwing the state away in a non-monitored mode and preparing a new state at random. So there must be a largest shrinking factor η compatible with the no-signaling condition.
The form of the partial states ρ 1,2 implies that the state of systems 1 and 2 after cloning should read The tensor t ij has some structure because of the requirement of universality, that implies covariance: This means that the following two procedures are equivalent: to apply a unitary U on the original and then the cloner, or to apply the cloner first and then U to both copies. These are the requirements of universality, η accounting for imperfect cloning. With this definition of QCM, one can run again the Gedankenexperiment discussed in paragraph I.C (Fig. 1). Bob's mixtures after cloning read now ρ x = 1 2 ρ out (+x) + 1 2 ρ out (−x) and ρ z = 1 2 ρ out (+z) + 1 2 ρ out (−z). No-signaling requires ρ x = ρ z . By using the fact that density matrices must be positive operators, one finds after some calculation the bound η ≤ 2 3 (F ≤ 5 6 ) for any universal symmetric 1 → 2 QCM for qubits. This analysis alone does not say whether this bound can be attained; but we know it can: the Bužek-Hillery QCM reaches up to it. Thus, the nosignaling condition provides a bound for the fidelity of quantum cloning, and this bound is tight since there exists a QCM that saturates it; in turn, this provides a proof of the optimality of the Bužek-Hillery QCM. The argument can be generalized for the 1 → N symmetric cloning (Simon, 2001). Other QCMs on the edge of the no-signaling condition have been described more recently (Navez and Cerf, 2003).
In conclusion, the no-signaling condition has been found to provide tight bounds for cloning -in fact, this observation was extended to any linear tracepreserving CP map . The converse statement also holds: no linear trace-preserving CP map (so in particular, no QCM) can lead to signaling . Finally, it has been proved recently that no-cloning is a feature that holds for all non-local no-signaling theories (Masanes et al., 2005).

Relation to uncertainty relations and knowledge
In addition to allowing signaling through entanglement alone, perfect cloning would also violate one of the main tenets of quantum mechanics, namely that the state of a single quantum system cannot be known 7 . If perfect cloning were possible, one could know everything of a single particle's state without even measuring it, just by producing clones and measure these (see I.B). In turn, this would invalidate quantum cryptography (see Section IV), and lead to the violation of some informationtheoretical principles, such as Landauer's erasure principle (Plenio and Vitelli, 2001). The link between optimal cloning and the amount of knowledge that one can obtain on the state of a limited number of quantum systems (in the limit, just one) can be made quantitative, see II.E in this review.
Of course, perfect cloning would not invalidate the existence of incompatible observables: having N copies of an eigenstate of σ z does not mean that the result of a measurement of σ x becomes deterministic. In particular, the relation between observables ∆A∆B ≥ 1 2 | [A, B] | would still hold in the presence of perfect cloning.

II. CLONING OF DISCRETE QUANTUM SYSTEMS
In this Section, we review the main results about cloning of discrete quantum systems, that is, systems described by the Hilbert space H = C d . We start from the simplest case, 1 → 2 symmetric cloning for qubits, and describe the Bužek-Hillery QCM (II.A). Then, we present the two natural extensions: N → M symmetric cloning (II.B), and 1 → 1 + 1 asymmetric cloning (II.C). The last paragraph of this Section is devoted to statedependent cloning (II.D). An important remark when comparing with the original articles: in this review, we use d systematically for the dimension, and capital letters such as N and M for the number of quantum systems. This notation is nowadays standard; however, until recently, N was often used to denote the dimension of the Hilbert space. 7 Invoking the same argument as in paragraph 9-4 of Peres' book (Peres, 1995), perfect cloning would thus lead to a violation of the second law of thermodynamics. However, the cogency of this argument is disputed (see Mana et al. (2005) for a recent analysis). In fact, to derive the violation of the second law, one makes the assumptions that (i) non-orthogonal states are deterministically distinguishable, and (ii) entropies are computed using the quantum formalism. Clearly, the two assumptions already look contradictory.

Trivial cloning
In order to appreciate the performance of the optimal 1 → 2 cloning for qubits (Bužek-Hillery), it is convenient to begin by presenting two trivial cloning strategies. The first trivial cloning strategy is the "measurement-based" procedure: one measures the qubit in a randomly chosen basis and produces two copies of the state corresponding to the outcome. Suppose that the original state is | + a , whose projector is 1 2 (1 1+ a· σ), and that the measurement basis are the eigenstates of b · σ. With probability P ± = 1 2 (1 ± a · b), two copies of | ± b are produced; in either case, the fidelity is F ± = | + a| ± b | 2 = P ± . The average fidelity is where S 2 is the 2-sphere of unit radius (surface of the Bloch sphere). This cloning strategy is indeed universal: the fidelity is independent of the original state | + a .
The second trivial cloning strategy can be called "trivial amplification": let the original qubit fly unperturbed, and produce a new qubit in a randomly chosen state. Suppose again that the original state is | + a , and suppose that the new qubit is prepared in the state | + b . We detect one particle: the original one with probability 1 2 and in this case F = 1; the new one with the same probability and in this case the fidelity is F = | + a| + b | 2 = P + . Thus the average single-copy fidelity is This second trivial strategy is also universal. In conclusion, we shall keep in mind that a fidelity of 75% for universal 1 → 2 cloning of qubits can be reached by a rather uninteresting strategy.

Optimal Symmetric UQCM (Bužek-Hillery)
It's now time to present explicitly the symmetric UQCM for 1 → 2 cloning of qubits found by Bužek and Hillery (B-H). This machine needs just one qubit as ancilla. Its action in the computational basis of the original qubit is 8 with |Ψ + = 1 √ 2 |1 |0 + |0 |1 . By linearity, these two relations induce the following action on the most general input state |ψ = α|0 + β|1 : From Eq. (13), one sees immediately that A and B can be exchanged, and in addition, that the transformation has the same form for all input state |ψ . Thus, this QCM is symmetric and universal. The partial states for the original and the copy are From the standpoint of both A and B then, the B-H QCM shrinks the original Bloch vectorm by a shrinking factor η = 2 3 , without changing its direction. As mentioned previously, the fidelity is F A = F B = ψ|ρ A |ψ = 5 6 , outperforming the trivial strategies described above. This was proved later to be the optimal value (Bruß, DiVincenzo et al., 1998;Gisin and Massar, 1997;Gisin, 1998); in their original paper, Bužek and Hillery had proved the optimality of their transformation with respect to two different figures of merit.
3. The transformation of the ancilla: "anti-clone" Although everything was designed by paying attention to qubits A and B, the partial state of the ancilla turns out to have a quite interesting meaning too. We have This state is related to another operation which, like cloning, is impossible to achieve perfectly, namely the NOT operation that transforms |ψ = α|0 + β|1 into |ψ ⊥ = α * |1 − β * |0 . Because of the need for complex conjugation of the coefficients, the perfect NOT transformation is anti-unitary and cannot be performed 9 . Just as for cloning, one can choose to achieve the NOT on some states while leaving other states unchanged; or one can find the operation that approximates at best the NOT on all states, called the universal NOT (U-NOT). This operation was anticipated in a remark by Bechmann-Pasquinucci and , then fully described by Bužek, Hillery and Werner (1999). The U-NOT gate gives precisely ρ N OT = ρ M , and is thus implemented as a by-product of cloning 10 . It has become usual to say that, at the output of a QCM, the ancilla carries the optimal anti-clone of the input state.

B. Symmetric UQCM N → M
A symmetric, universal N → M QCM for qubits that generalizes the B-H QCM was found by Gisin and Massar (1997). Its fidelity is that reproduces F 1→2 = 5 6 for N = 1 and M = 2. They gave numerical evidence for its optimality. Later, an analytical proof of optimality was given by , who assumed that the output state belongs to the symmetric subspace of M qubits (this assumption is unjustified a priori but turns out to be correct, see below). The result was further generalized by Werner for systems of any dimension (Keyl and Werner, 1999;Werner, 1998).

Werner's construction
We consider d-dimensional quantum systems described by the Hilbert space H = C d . We introduce the notation H n + for the symmetric subspace of the n-fold tensor product H ⊗n ; the dimension of H n The remarkable fact is that one can restrict to CP maps whose output is in the symmetric subspace H M + . This is clearly true if one considers "all-particle test criteria", such as minimizing the trace-distance between ρ M and σ ⊗M or maximizing the all-particle fidelity F all = Tr σ ⊗M ρ M , as figures of merit (Werner, 1998); but if one wants to optimize the single-copy fidelity, the restriction to the symmetric subspace is not apparent at all, and required further work before being demonstrated (Keyl and Werner, 1999).
In any case, the difficulty of the optimality proofs should not hide the simplicity of the result: a single T optimizes all the figures of merit that have been considered, and this T is in some sense the most intuitive one. One simply takes the non-symmetric trivial extension ρ N → ρ N ⊗ 1 1 M−N , symmetrizes it and normalizes the result. Explicitly, the optimal symmetric UQCM for N → M cloning reads ensures that the map T is trace-preserving. The state of each clone is of the form where |ψ is the input state and where the shrinking factor is found to be The corresponding fidelity is So this is the optimal fidelity for universal symmetric N → M cloning of d-dimensional systems. For qubits (d = 2) it indeed recovers the . For N = 1 and M = 2, F = d+3 2(d+1) . Note that for a fixed amplification ratio r = M N , the fidelity goes as Conversely, if out of a finite number N of originals one wants to obtain an increasingly large number M of clones, the fidelity of each clone decreases as F ≃ N +1 N +d in the limit M → ∞, in agreement with the results of state estimation (Massar and Popescu, 1995) -more in II.E below.

Calculation of the fidelity
We have just summarized, without any proof, the main results for the optimal universal symmetric N → M QCM with discrete quantum systems.
It is a good exercise to compute the single-copy fidelity F = Tr (σ ⊗ 1 1... ⊗ 1 1) T [σ ⊗N ] and recover (21). The first step is a symmetrization: denoting σ (k) the operator that acts as σ on the k-th system and as the identity on the others, and replacing T by its explicit form (17), we have where the second equality is obtained using the linear and cyclic properties of the trace 11 . Now, since σ is a projector, where the additional σ happens at different positions. However, this is not important, since the expression is sandwiched between the S M so it will be symmetrized anyway. Using (18) and some algebra, one obtains (21).

Trivial cloning revisited
We can now have a different look at trivial cloning. The "trivial amplification" strategy described in paragraph II.A.1 can be easily generalized to the general case: one forwards the original N particles, adds M − N particles prepared in the maximally mixed state 1 1/d, and performs an incoherent symmetrization (i.e., instead of projecting into the symmetric subspace, one simply "shuffles" the particles). The fidelity is then As expected, Eq. (21) shows that the Werner construction performs better, but the difference vanishes in the limit d → ∞. We have thus learnt two new insights on optimal cloning: (i) it is the quantum symmetrization that makes optimal cloning non-trivial, and (ii) in the limit of large Hilbert space dimension, trivial cloning performs almost optimally. In summary, Werner's construction solves the problem of finding the optimal universal symmetric QCM for any finite-dimensional quantum system and for any number of input (N ) and output (M > N ) copies. We note that Werner did not provide the implementation of the QCM T as a unitary operation on the system plus an ancilla (6). This was provided by Fan et al. (2001), generalizing previous partial results ( Albeverio and Fei, 2004;. In the rest of this Section, we move to the study of asymmetric (II.C) and statedependent (i.e., non-universal) QCM.
C. Asymmetric UQCM 1 → 1 + 1 Asymmetric universal cloning refers to a situation where output clones possibly have different fidelities.
Here we focus on 1 → 1 + 1 universal cloning. The study of more general cases has been undertaken recently (Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005), motivated by the security analysis of practical quantum cryptography Curty and Lütkenhaus, 2004); we shall present some of these ideas below, together with their possible experimental realization (VI.A.2).
In their comprehensive study of the 1 → 1 + 1 cloning, Niu and Griffiths (1998) had derived, in particular, the optimal asymmetric UQCM 1 → 1 + 1. The same result was found independently by Cerf (1998Cerf ( , 2000a who used an algebraic approach, and by Bužek, Hillery and Bendik (1998) who instead developed a quantum circuit approach, improving over a previous construction for symmetric cloning (Bužek et al., 1997). Optimality is demonstrated by proving that the fidelities of two clones, F A and F B , saturate the no-cloning inequality 12 The same authors extended their constructions beyond the qubit case to any d (Braunstein, Bužek and Hillery, 2001;Cerf, 2000b), although optimality was only conjectured and was proved only recently (Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005).
We review both the Cerf's and the quantum circuit approaches, giving the explicit formalism for qubits and explaining how this generalizes to any dimension. We start with the quantum circuit formalism, which is somehow more intuitive.

Quantum circuit formalism
The quantum circuit that is used for universal 1 → 1 + 1 cloning in any dimension, which has been called 12 This inequality appears in all the meaningful papers with different notations. For example, in The quantum circuit used for universal 1 → 1 + 1 cloning. For d = 2, all the gates are the standard CNOT. For d > 2, the arrows play a role: the arrow towards the right, resp. left, defines the transformation |k |m → |k |m + k , resp. |k |m → |k |m − k -as usual, sums and differences in the kets are modulo d.
a quantum information distributor 13 , is drawn in Fig. 2.
It uses a single d-dimensional system as ancilla. Let's focus on qubits first. For states |σ A |ω B |ξ M in the computational basis, i.e. σ, ω, ξ ∈ {0, 1}, the action of the circuit is where all the sums are modulo 2. It is now an easy exercise to verify that Figuratively, one can say that the state of B-M acts as the "program" for the "processor" defined by the circuit; in particular, |Φ + BM makes the processor act as the identity on A; |0 B |+ M makes the processor swap the state |ψ into mode B. Now, the optimal asymmetric QCM follows quite intuitively: just take as an input state a coherent superposition of "all the information in A" and "all the information in B": The parameters a and b are real; for the input state of B-M to be normalized, they must satisfy a 2 + b 2 + ab = 1.
The partial states for the two clones after the transfor- It is easy to verify that these fidelities saturate the nocloning inequality (23). As expected, for b = 0 (resp. a = 0) we find all the information in A, resp. B. The symmetric case corresponds to a = b = 1 √ 3 , in which case we recover the Bužek-Hillery result F A = F B = 5 6 . The generalization to d > 2 goes exactly along the same lines. The state |Φ + BM is now the maximally entangled state of two qudits 1 After the transformation, the partial states of the two clones read ρ A = (1 − b 2 )|ψ ψ| + b 2 1 1/d and ρ B = (1 − a 2 )|ψ ψ| + a 2 1 1/d, from which the fidelities The normalization condition now reads a 2 + b 2 + 2ab d = 1; in particular, for the symmetric case we recover Werner's result

Cerf's formalism
Cerf's formalism also uses a third d-dimensional system as ancilla. For qubits, the transformation reads where the real coefficients v and x must satisfy v 2 +3x 2 = 1 to conserve the norm. Note that V , as written here, is not unitary; however, (30) defines a unitary transformation. In other words, V is the restriction of a unitary operation when acting on input states of the form |ψ A |Φ + BM . Here lies the appeal of Cerf's formalism: the unitary that defines the QCM reduces to the very compact and easily written transformation (31) when acting on suitable input states. By inspection, one can verify that the state |Ψ in the r.h.s. of (30) is equal to 14 Written |p 0 in Braunstein, Bužek and Hillery (2001), see Eq.
The generalization to d > 2 goes along the same lines (Cerf, 2000b;Cerf, Bourennane et al., 2002). The transformation, acting on the |ψ A |Φ + BM as defined above for qudits, reads which the normalization condition v 2 + (d 2 − 1)x 2 = 1, and in which the unitary operations U m,n that generalize the Pauli matrices are defined as 15 The link with the parameters a and b of the quantum circuit formalism is provided here by 16 a = v − x, b = dx.
D. State-dependent cloning

Cloning of two states of qubits
The first study of state-dependent cloning was based on a different idea, simply, to clone at best two arbitrary pure states of a qubit (Bruß, DiVincenzo et al., 1998). This is a hard problem because of the lack of symmetry, and was not pursued further. One wants to perform the optical symmetric cloning of two states of qubits |ψ 0 and |ψ 1 , related by | ψ 0 |ψ 1 | = s. The resulting fidelity for this task is given by a quite complicated formula: (1 + s) 3 − 3s + 1 − 2s + 9s 2 For s = 0 and s = 1, one finds F = 1 as it should, because the two states belong to the same orthogonal basis. The minimum is F ≈ 0.987, much better than the value obtained with the symmetric phase-covariant cloner (see below). Oddly enough, this minimum is achieved for s = 1 2 , while one would have expected it to occur for states belonging to mutually unbiased bases (s = 1 √ 2 ).

Phase-covariant 1 → 2 for qubits: generalities
The best-known example of state-dependent QCM are the so-called phase-covariant QCM. For qubits, these are defined as the QCM that copy at best states of the form These are the states whose Bloch vector lies in the equator (x − y) of the Bloch sphere; the name "phase-covariant", used for the first time by Bruß, Cinchetti et al. (2000), comes from the fact that the fidelity of cloning will be independent of ϕ. Here we restrict our attention to 1 → 2 asymmetric phasecovariant cloning for qubits. The phase-covariant QCM has a remarkable application in quantum cryptography, since it is used in the optimal incoherent strategy for eavesdropping on the BB84 protocol, see IV.B.2 below. Note that the eavesdropper on BB84 wants to gather information only on four states, defined by ϕ = 0, π 2 , π, 3π 2 : the eigenstates of σ x and σ y , that is, two maximally conjugated bases. But the two problems (cloning all the equator, or cloning just two maximally conjugated bases on it) yield the same solution. In fact, consider a machine, a CP map T , that clones optimally the four states of BB84, in the sense that when acting on | ± x and | ± y , it gives two approximate clones of the form 17 Any state in the equator of the Bloch sphere can be written as Now, using the linearity of T one can see that T [σ x ] = ησ x and the same holds for σ y . Since T (1 1) = 1 1, one has for all ϕ. This shows that the optimal cloning of the four states employed in the BB84 protocol is equivalent to optimally cloning the whole equator of the Bloch sphere. A similar argument applies if the z basis is also included: to clone all mutually unbiased bases in the Bloch sphere, i.e. the states | ± x , | ± y and | ± z , is equivalent to universal cloning.
3. Phase-covariant 1 → 2 for qubits: explicit transformation The task of copying at best the equator of the Bloch sphere, even in the asymmetric case, can be accomplished without ancilla (Niu and Griffiths, 1999); this is 17 Notice that it is assumed here that the cloning process only shrinks the Bloch vector of the initial input state.
definitely impossible for universal cloning (Durt and Du, 2004). The QCM is then just part of a two-qubit unitary transformation that reads with η ∈ 0, π 2 and we have chosen |R = |0 . Then |ψ(ϕ) |0 → 1 √ 2 |0 |0 + cos ηe iϕ |1 |0 + sin ηe iϕ |0 |1 ; the partial states ρ A and ρ B are readily computed, and one finds the fidelities As desired, these fidelities are independent of ϕ. It is easily verified numerically that this QCM is better than the universal one for the equatorial states: one simply where F B is given in (28). In particular, for the symmetric case η = π 4 , one has F x−y A,B = 1 2 1 + 1 √ 2 ≃ 0.8535 > 5 6 . Niu and Griffiths introduced the two-qubit QCM in the context of eavesdropping in cryptography. It was later realized that a version with ancilla of the phase-covariant QCM (Bruß, Cinchetti et al., 2000;Griffiths and Niu, 1997), while equivalent in terms of fidelity of the clones on the equator, is generally more suited for the task of eavesdropping Durt and Du, 2004). This machine can be constructed by symmetrizing (39) with the help of an ancilla qubit as follows: and letting this unitary act on the input state |ψ A |Φ + BM . This reminds Cerf's formalism, and indeed the unitary (41) acts on |ψ A |Φ + BM as the operator (Cerf, 2000b) Notice again how Cerf's formalism appeals to intuition: it is manifest in (42) that the x − y plane is treated differently from the z direction. For a practical illustration of the use of the phase-covariant QCM for eavesdropping in cryptography, we refer the reader to paragraph IV.B.2 below.

Other state-dependent QCM
Most of the state-dependent QCM that have been studied are generalizations of the phase-covariant one, often called phase-covariant as well. The idea is to clone at best some maximally conjugated bases. Specifically, the following state-dependent cloners have been studied: • Asymmetric 1 → 2 phase-covariant QCM, that clones at best two maximally conjugated bases in any dimension (Cerf, Bourennane et al., 2002;Fan et al., 2003). For d = 3 (Cerf, Durt and Gisin, 2002) and d = 4 (Durt and Nagler, 2003), asymmetric 1 → 2 QCM have been provided that clone three or four maximally conjugated bases. For any d, the symmetric QCM that are optimal for cloning "real quantum states" -that is, a basis and all the states obtained from it using SO(d) -have been found; optimality has been demonstrated using the no-signaling condition (Navez and Cerf, 2003).
• Not related to phase-covariant cloning: Fiuràšek et al. (2002) have studied the cloning of two orthogonal qubits. It is known that, for the task of estimating a directionn, the two qubit state |n, −n gives a better estimate than the state |n,n (Gisin and Popescu, 1999). For cloning, the task is to produce M clones of |n starting from either of those two-qubit states. For M ≤ 6, better copies are obtained when starting from |n, −n .
• Finally, another issue that has been discussed is the optimal cloning of entangled states (Lamoureux et al., 2004).

E. Quantum cloning and state estimation
One could anticipate that there might exist a strong relation between cloning the state of a quantum system and acquiring knowledge about this state. After all, there is a strong analogy between the two processes. In both cases, the (quantum) information contained in the input is transferred into some "larger" system: the output clones in the case of cloning, and the measuring device in the case of state estimation. In this section, we shall see that there is more than a mere analogy. In fact, as first appreciated by Gisin and Massar (1997) and further elaborated by : (i) There is an equivalence between optimal universal N → ∞ quantum cloning machines of pure states and optimal state estimation devices taking as input N replicas of an unknown pure state. (ii) Bounds on optimal cloning can be derived from this equivalence. We are going to present these results. To simplify the presentation, we shall only consider universal cloning of qubits, but the subsequent analysis can be generalized, without difficulty, to qudits (Keyl, 2002).
The equivalence between optimal universal symmetric cloning and state estimation can be established using the notion of shrinking factor, already introduced for cloners. Indeed, we stressed in paragraph II.B that the quality of the optimal N → M UQCM is fully characterized by its shrinking factor η(N, M ): if the input state to clone reads ρ in = |ψ ψ|, then the individual state of each output clone reads η(N, M )|ψ ψ| + (1 − η(N, M )) 1 1 2 . A similar structure arises in the case of state estimation. Given N copies of an unknown qubit state |ψ , there exists an optimal POVM (Positive-Operator-Valued Measure) which 18 yields the best possible estimate of ψ taking the fidelity as figure of merit (Massar and Popescu, 1995).
To each measurement outcome µ, a guess |ψ µ of the input state is associated. During one instance of the state estimation experiment, the outcome µ can appear with probability tr P µ |ψ ψ| = p µ (ψ). Thus, on average, the POVM (43) yields the estimate ρ est (ψ) = µ p µ (ψ)|ψ µ ψ µ |. It turns out (Massar and Popescu, 1995) that this average estimate can be written as and the average fidelity of the state estimation is thus given by (1 + η * (N ))/2. In turn, the performance of the POVM that describes the best state estimation can also be characterized by a shrinking factor η * (N ).
We can now state precisely what we mean when stating that there exists an equivalence between optimal N → ∞ quantum cloning machine and an optimal state estimation device. We have This relation tells us that using N qubits identically prepared in the state |ψ to estimate ψ or to prepare an infinite number of clones of |ψ (and then infer an estimate of ψ) are essentially equivalent procedures: the amount of information one can extract about the input preparation is the same in both cases. To prove Eq. (45), we shall show that both η * (N ) ≤ η(N, ∞) and η * (N ) ≥ η(N, ∞) hold. The first of these inequalities is almost obvious. Consider a N → M cloning procedure in which we first perform state estimation on the N input originals, and then prepare M output clones according to the (classical) outcome we get. If the input state is |ψ ⊗N , then, on average, the state of each 18 Note that the elements of the POVM sum up to the projector S N onto the symmetric subspace H N + , and not to the identity. In fact, one can "complete" the POVM with the operator 1 1 − S N , but the corresponding outcome will never be observed because the input state belongs to H N + .
clone will be of the form (44), and thus characterized by a shrinking factor η * (N ). By definition, such a cloning procedure cannot be better than using an optimal N → M quantum cloning machine. Thus η * (N ) ≤ η(N, M ) for all M , and in particular η * (N ) ≤ η(N, ∞).
To prove the second inequality, η * (N ) ≥ η(N, ∞), we shall conversely consider a situation in which we want to achieve state estimation from N input originals with an intermediate cloning step. Let us remark that the output of an optimal N → M UQCM belongs to the symmetric subspace H N + . Therefore , for any input state |ψ ⊗N , the output state can be written as a pseudo-mixture that is i α i (ψ) = 1 but the coefficients α i (ψ) may be negative.
We are now in a position to further connect quantum cloning and state estimation. Starting from (45), we can show that a limit on the quality of N → M cloning can be derived from state estimation, modulo one assumption: the output state of an N → M cloning machine should be supported by the symmetric subspace H + M . To establish such a limit, our first task is to prove that the shrinking factors of two cascaded cloners multiply. Let us construct an N → L cloning machine by concatenating an N → M machine with an M → L machine, and let such a cloning machine act on some input state ψ ⊗N . Since the output state of the first cloner is assumed to be supported by H + M , it admits the decomposition (46). Processing this output state into the second cloning machine yields From η * (N ) = N/(N + 2) (Massar and Popescu, 1995), we find Comparing with (20), we see that, perhaps not so surprisingly, this last inequality is saturated by optimal UQCM. The foregoing analysis establishes a precise connection between optimal cloning and optimal state estimation, valid when one considers all possible pure states of qubits --in fact, it extends to all pure states of qudits for any d -and looks like a miracle. One could argue that the main reason why this connection appears is that the output state of an optimal N → M cloning machine turns out to be supported by the symmetric subspace H + M , the crucial ingredient in deriving (45) and (48). But this latter fact, although established on a firm mathematical ground (Keyl and Werner, 1999) is still lacking a physical interpretation. A recent result has come to strengthen this connection: it has been proved (Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005) that the optimal asymmetric 1 → 1 + N UQCM, in the limit N → ∞, achieves the optimal "disturbance vs. gain" trade-off for the measurement of one qubit (Banaszek, 2001).
One might wonder if the connection between state estimation and cloning holds in general. To our knowledge, the question is still open. It certainly deserves further investigation, for answering it would allow to understand whether the neat relation between cloning and state estimation is a fundamental feature of quantum theory or a mere peculiarity of the set of all pure states of qudits.

III. CLONING OF CONTINUOUS VARIABLES
This Section reviews the issue of approximate cloning for continuous variable systems (or quantum oscillators). Our analysis will be focussed on N → M Gaussian machines, cloning equally well all coherent states Cerf and Iblisdir, 2000;Cerf, Ipe and Rottenberg, 2000;Fiuràšek, 2001;Lindblad, 2000). The optimality of such machines will be investigated. Upper bounds on the minimal amount of noise the clones should feature will be derived for qubits (III.A) via a connection with quantum estimation theory, using techniques similar to those we have presented in paragraph II.E. Then we shall present transformations achieving these bounds (III.B). Finally, we shall briefly discuss possible variants of our analysis (III.C).
A. Optimal cloning of Gaussian states

Definitions and results
The Hilbert space associated with a quantum oscillator is H ≡ L 2 (R), and is infinite-dimensional. Let us first consider what we can get from asking for universality in such a Hilbert space. Considering the limit for d → ∞ of Eq. (21), we see that where N is the number of input replicas, and M > N the number of clones. Moreover, this limit can also be reached by trivial cloning, see II.B.3. Can we then do better than Eq. (50), by dropping the requirement of universality or taking a different perspective? After all, in some circumstances such as quantum cryptography, it is natural to consider cloners which are optimal only for a subset of states S ⊂ H. Also, the fidelity is not always the most interesting figure of merit to consider.
Here, we shall concentrate on the situation in which we only want to clone the set of coherent states, denoted S. Letx andp denote two mutually conjugated quadratures of a harmonic oscillator, [x,p] = i (h = 1). The set of coherent states is the set of states that satisfy ∆x 2 = x 2 − x 2 = ∆p 2 = p 2 − p 2 = 1/2, (51) and can be parametrized as where α|x|α = x and α|p|α = p. We shall consider N → M symmetric Gaussian cloners (SGC). These cloners are linear, trace-preserving, completely positive maps C outputting M clones from N ≤ M identical replicas of an unknown coherent state |α . To simplify the analysis, we require that the joint state of the M clones C(|α α| ⊗N ) be supported on the symmetric subspace of H ⊗M and be such that the partial trace over all output clones but (any) one is the bi-variate Gaussian mixture: where the integral is performed over all values of β = (x+ ip)/ √ 2 in the complex plane (h = 1), and the operator D(β) = exp(βa † − β * a) achieves a displacement of x in position and p in momentum, withâ = 1 √ 2 (x + ip) and a † = 1 √ 2 (x − ip) denoting the annihilation and creation operators, respectively. Thus, the copies yielded by a SGC are affected by an equal Gaussian noise σ 2 x = σ 2 p = σ 2 N,M on the conjugate variables x and p. The fidelity of the optimal N → M SGC when a coherent state |α is copied can be computed using Eq. (53) and the identity | α|α ′ | 2 = exp(−|α − α ′ | 2 ). One finds We shall prove in the following paragraphs that a lower bound on the noise variance σ 2 N,M is given by implying in turn that the optimal cloning fidelity for Gaussian cloning of coherent states is bounded by Thus, all coherent states are copied with the same fidelity -recall that this property does not extend to all states of H. One can also check that Eqs (55) and (56) fulfill the natural requirement that the cloning fidelity increases with the number of input replicas. At the limit N → ∞, we have f N,M → 1 for all M , that is, classical copying is allowed. Finally, for M → ∞, that is, for an optimal measurement, we get f N,M → N/(N + 1). It is worth noting that the optimal cloning of squeezed states requires a variant of these SGCs. For instance, the best symmetric cloner for the family of quadrature squeezed states with squeezing parameter r must have the form of Eq. (53), but using the definition β = ( x κ + iκp)/ √ 2 with κ = exp(r). These cloners naturally generalize the SGCs and give the same cloning fidelity, Eq. (56), for those squeezed states.
2. Proof of the bounds for 1 → 2 cloning Let us first prove (55) in the simplest case (N, M ) = (1, 2). This case is interesting to single out because it demonstrates the link between quantum cloning and the problem of simultaneously measuring a pair of conjugate observables on a single quantum system. Our starting point is thus the relation derived by Arthurs and Kelly (1965), which constrains any attempt to measurex and p simultaneously on a quantum system: where σ 2 x (1) and σ 2 p (1) denote the variance of the measured values ofx andp, respectively, when simultaneously measuringx andp on some quantum state ρ.
It is crucial to clearly distinguish between the Arthurs and Kelly relation (57), and the Heisenberg uncertainty relation 19 : where ∆x 2 (resp. ∆p 2 ) are intrinsic variance of the observablesx (resp.p) for any quantum state ρ. The Heisenberg relation is valid independently from any measurement performed on the state ρ; in particular, it holds even if we have a perfect knowledge of the state ρ. In contrast, the trade-off between the information aboutx and the information aboutp, that one can acquire during a single measurement on the state ρ, is quantified by the Arthurs-Kelly relation (57). In particular, the best possible simultaneous measurement ofx andp with a same precision satisfies σ 2 x (1) = σ 2 p (1) = 1. Compared with the intrinsic noise of a coherent state ∆x 2 = ∆p 2 = 1/2, we see that the joint measurement of x and p effects an additional noise of minimum variance 1/2. Now, let a coherent state |α be processed by a 1 → 2 SGC, and letx be measured at one output of the cloner whilep is measured at the other output. This is a way of simultaneously measuring x and p, and as such it must obey the Arthurs-Kelly relation (57). Consequently, the intrinsic variances of the observablex andp in the state ρ 1 (α), denoted respectively as δx and δp, must fulfill Using Eq. (53), we get Now using Eq. (58), we conclude that the noise variance is constrained by σ 2 1,2 ≥ σ 2 1,2 = 1/2, A similar argument can be used to characterize the output copies of an asymmetric quantum cloning machine, in which the qualities of the clones are not identical and in which one might desire that the added noise due to cloning is different for both quadratures. Using, Eq. (57), one easily shows that the following relations hold: where σ 2 x,1 (resp. σ 2 p,1 ) refers to the added x quadrature (resp. p quadrature) added noise for the first clone, and where σ 2 x,2 and σ 2 p,2 are defined likewise. These cloning uncertainty relations are useful when assessing the security of some continuous variables quantum cryptographic schemes (Cerf, Lévy and van Assche, 2001).
Let us now prove Eq. (55) in the general case. Our proof is connected to quantum state estimation theory similarly to what was done for quantum bits in paragraph II.E. The key idea is that cloning should not be a way of circumventing the noise limitation encountered in any measuring process. More specifically, our bound relies, as in the discrete case, on the fact that cascading an N → M cloner with an M → L cloner results in a N → L cloner which cannot be better that the optimal N → L cloner. We make use of the property that cascading two SGCs results in a single SGC whose variance is simply the sum of the variances of the two component SGCs (Cerf and Iblisdir, 2000). Hence, the variance σ 2 N,L of the optimal N → L SGC must satisfy In particular, if the M → L cloner is itself optimal and L → ∞, As for the discrete case, in the limit M → ∞, estimators and quantum cloning machines tend to become essentially identical devices. Thus Eq. (65) means that cloning the N replicas of a system before measuring the M resulting clones does not provide a mean to enhance the accuracy of a direct measurement of the N replicas.
Let us now estimate σ 2 N,∞ , that is, the variance of an optimal joint measurement ofx andp on N replicas of a system. From quantum estimation theory (Holevo, 1982), we know that the variance of the measured values ofx andp on a single system, respectively σ 2 x (1) and σ 2 p (1), are constrained by for all values of the constants g x , g p > 0. Note that, for each value of g x and g p , a specific POVM based on a resolution of identity in terms of squeezed states, whose squeezing ∆ is a function of g x and g p , achieves this bound (Holevo, 1982). Squeezed states satisfy ∆x 2 = κ 2 /2 and ∆p 2 = 1/2κ 2 . Moreover, when a measurement is performed on N independent and identical systems, the r. h. s. of (66) is reduced by a factor N −1 , as in classical statistics (Helstrom, 1976). So, applying N times the optimal single-system POVM is the best joint measurement when N replicas are available since it yields σ 2 x (N ) = N −1 σ 2 x (1) and σ 2 p (N ) = N −1 σ 2 p (1). Hence, using Eq. (66) for a coherent state (∆x 2 = ∆p 2 = 1/2) and requiring σ 2 x (N ) = σ 2 p (N ), the tightest bound is obtained for g x = g p . It yields σ 2 N,∞ = 1/N, which, combined with Eq. (65), gives the minimum noise variance induced by cloning, Eq. (55).

B. Implementation of Gaussian QCMs
Now that we have derived upper bounds on optimal cloning, we shall show that these bounds are achievable, and exhibit explicit optimal cloning transformations. Remarkably, these transformations have a fairly simple implementation, when the quantum oscillator corresponds to a light mode: it requires only a phase-insensitive linear amplifier and a network of beam splitters 20 . We shall also discuss the link between the issue of optimal quantum cloning and that of optimal amplification of quantum states.

Definitions and requirements
Let us first state what we expect from a quantum cloning machine. Let |Ψ = |α ⊗N ⊗ |0 ⊗M−N ⊗ |0 z denote the initial joint state of the N input modes to be cloned (all prepared in the coherent state |α ), the additional M − N blank modes, and an ancillary mode z. The blank modes and the ancilla are assumed to be initially in the vacuum state |0 . Let {x k ,p k } denote the pair of quadrature operators associated with each mode k involved by the cloning transformation 21 , k = 0 . . . N − 1 refers to the N original input modes, and k = N . . . M −1 refers to the additional blank modes. Cloning can be thought of as some unitary transformation Alternatively, in the Heisenberg picture, this transformation can be described by a canonical transformation of the operators {x k , p k }: We work in the Heisenberg picture because cloning turns out to be much simpler to study from that point of view. We now impose several requirements on the transformation Eq. (67) that translate the expected properties for an optimal cloning transformation. First, we require the M output modes quadratures have the same mean values as the the input mode: This means that the state of the clones is centered on the original coherent state. Our second requirement is covariance with respect to rotation in phase space. Coherent states have the property that quadrature variances are left invariant by complex rotations in phase space. That is, for any mode k involved in the cloning process and for any operator v k = cx k + dp k (where c, d are complex numbers satisfying |c| 2 + |d| 2 = 1), we have: We impose this property to be conserved through the cloning process. Taking optimality into account, Eq. (55), rotation covariance yields: where v ′′ k = cx ′′ k + dp ′′ k . The third requirement is, of course, the unitarity of the transformation. In the Heisenberg picture, unitarity translates into demanding that the commutation rules be conserved through the evolution (Caves, 1982):

Optimal Gaussian 1 → 2 QCM
Let us first focus on duplication (N = 1, M = 2). A simple transformation meeting the three conditions mentioned above is given by: This transformation clearly conserves the commutation rules, and yields the expected mean values ( x 0 , p 0 ) for the two clones (modes 0 ′′ and 1 ′′ ). One can also check that the quadrature variances of both clones are equal to 1, in accordance with Eq. (71). This transformation actually coincides with the cloning machine introduced by Cerf, Ipe and Rottenberg (2000). Interestingly, we note here that the state in which the ancilla z is left after cloning is centered on (x 0 , −p 0 ), that is the phaseconjugated state |ᾱ . This means that, in analogy with the universal qubit cloning machine (Bužek and Hillery, 1996), the continuous-variable cloner generates an anticlone (or time-reversed state) together with the two clones. Now, let us show how this duplicator can be implemented in practice. Eq. (73) can be interpreted as a two-step transformation: As shown in Fig. 3, the interpretation of this transformation is straightforward: the first step (which transforms a 0 and a z into a ′ 0 and a ′ z ) is a phase-insensitive amplifier whose (power) gain G is equal to 2, while the second step (which transforms a ′ 0 and a 1 into a ′′ 0 and a ′′ 1 ) is a phasefree 50:50 beam splitter. Clearly, rotational covariance is guaranteed here by the use of a phase-insensitive amplifier. As discussed by Caves (1982), the ancilla z involved in linear amplification can always be chosen such that a z = 0, so that we have a ′′ 0 = a ′′ 1 = a 0 as required. Finally, the optimality of our cloner can be confirmed from known results on linear amplifiers. For an amplifier of gain G, the quadrature variances of a z are bounded by (Caves, 1982): Hence, the optimal amplifier of gain G = 2 yields σ 2 az = 1/2, so that our cloning transformation is optimal according to Eq. (55).

Input Ancilla Vacuum
Anti-clone Clone 2 Clone 1 FIG. 3 Implementation of the optimal Gaussian 1 → 2 QCM for light modes. LA stands for Linear Amplifier, and BS represents a balanced Beam Splitter.

Optimal Gaussian N → M QCM
Let us now derive an N → M cloning transformation. To achieve cloning, energy has to be brought to each of the M − N blank modes in order to drive them from the vacuum state to a state which has the desired mean value. We shall again perform this operation with the help of a linear amplifier. From Eq. (75), we see that the cloning induced noise essentially originates from the amplification process, and grows with the gain of amplifier. So, we shall preferably amplify as little as possible. Loosely speaking, the cloning procedure should then be as follows: (i) concentrate the N input modes into one single mode, which is then amplified; (ii) symmetrically distribute the output of this amplifier amongst the M output modes. A convenient way to achieve these concentration and distribution processes is provided by the Discrete Fourier Transform (DFT). Cloning is then achieved by the following three-step procedure (see Fig. 4). First step: a DFT (acting on N modes), with k = 0 . . . N − 1. This operation concentrates the energy of the N input modes into one single mode (renamed a 0 ) and leaves the remaining N − 1 modes (a ′ 1 . . . a ′ N −1 ) in the vacuum state. Second step: the mode a 0 is amplified with a linear amplifier of gain G = M/N . This results in Third step: amplitude distribution by performing a DFT (acting on M modes) between the mode a ′ 0 and M − 1 modes in the vacuum state: with k = 0 . . . M − 1, and a ′ i = a i for i = N . . . M − 1. The DFT now distributes the energy contained in the output of the amplifier amongst the M output clones.
It is readily checked that this procedure meets our three requirements, and is optimal provided that the amplifier is optimal, that is σ 2 az = [(M/N ) − 1]/2. The quadrature variances of the M output modes coincide with Eq. (55). As in the case of duplication, the quality of cloning decreases as σ 2 az increases, that is amplifying coherent states, or cloning them with the same error for each clone, are two equivalent problems. For 1 → 2 cloning, we have seen that the final amplitude distribution amongst the output clones is achieved with a single beam splitter. In fact, any unitary matrix such as the DFT used here can be realized with a sequence of beam splitters and phase shifters (Reck et al., 1994). This means that the N → M cloning transformation can be implemented using only passive elements except for a single linear amplifier. An explicit sequence of beam splitters achieving a DFT on M modes is given by .
Finally, we note that, if squeezed states are put in rather than coherent states, the transformations and cir-cuits presented here maintain optimum cloning fidelities, provided all auxiliary vacuum modes (the blank modes and the ancillary mode z) are correspondingly squeezed. This means, in particular, that the amplifier mode z needs to be controlled which requires a device different from a simple phase-insensitive amplifier, namely a two-mode parametric amplifier. One can say that the cloning machine capable of optimum cloning of all squeezed states with fixed and known squeezing then operates in a non-universal fashion with respect to all possible squeezed states at the input (Cerf and Iblisdir, 2000).

C. Other continuous variable QCMs
We conclude this Section by summarizing some interesting developments in continuous variable cloning.
Other figures of merit.-The universal Gaussian machines presented in III.A and III.B have been derived requiring that the noise of the output clones be minimum. But, one could have used other figures of merit to judge the quality of the output clones. Then, would we have obtained different solutions? Another related issue is: do we get better cloners if the Gaussian assumption is relaxed? Cerf, Krüger et al. (2005) have proved that if one chooses the global fidelity 22 as the figure of merit, then the universal Gaussian cloner turns out to be optimal too. But surprisingly, the Gaussian assumption is too restrictive if the goal is to optimize the single-clone fidelity. For instance, for 1 → 2 cloning, there exists a non-Gaussian operation whose output clones have a fidelity of 0.6826 with the original for all coherent states, improving on the universal Gaussian machine, which achieves a fidelity of 2/3 ≈ 0.6666, see Eq. (56).
Optimal cloning for finite distributions of coherent states.-In devising optimal cloning machines, we require that all coherent states be cloned with an equal quality. In other words, we devised cloning machines which are optimal for a distribution of coherent states in phase space which is flat. But, for practical reasons, it is interesting to consider situations where the coherent states to be cloned are produced according to a finite distribution over phase space -in other words, to drop the requirement of universality over all coherent states. In particular, the case has been studied (Cochrane et al., 2004;Grosshans, 2002) in which the coherent states to be cloned are produced according to a Gaussian distribution P (α) = 1 2πΣ 2 e −|α| 2 /2Σ 2 .
(79) 22 Global fidelity was introduced in II.B.1 for the case of discrete variables. Recall that in that case, the optimization of the global and of the single-copy fidelity leads to the same optimal UQCM.
It is easily seen that in this setting, the cloning procedures we have considered so far do not produce clones with optimal fidelities. For instance, if P (α) is a sufficiently peaked distribution, then a very trivial cloning machine, from which the first output clone is the unaffected original and the second clone is a mode prepared in the vacuum state, already achieves better fidelities than the universal Gaussian cloner. Actually, one can prove that for all values of Σ, there is a cloning machine achieving a single-clone fidelity of Interestingly, such a cloning machine can be achieved using the setup shown in Fig. 3, but where the gain is adapted to the distribution of coherent states:

A. Generalities
As stated in the introduction, the relationship between the no-cloning theorem and the security of quantum cryptography was already pointed out in the first protocol (Bennett and Brassard, 1984). Let us briefly sketch here the common structure behind any protocol; we refer the reader to the review by Gisin et al. (2002) for a more thorough view on quantum cryptography. A sender, Alice, encodes some classical information on a quantum state, chosen among a set of non-orthogonal alternatives {|ψ i A }. The so-prepared particle goes to a receiver, Bob, who randomly chooses a measurement from a preestablished set of measurements. When more than two states are used for the encoding, the exchange of the particles is usually followed by a "sifting" phase, in which Alice reveals something of the encoding (e.g. the basis to which each state belongs), allowing Bob to know if he has done the good measurement. After this process, Alice and Bob share a list of classically correlated symbols. Using well-established techniques from classical information theory, this list can be transformed into a secret key 23 , which is later consumed for sending private information by means of the one-time pad. So quantum cryptography is actually quantum key distribution (QKD).
Although everything that takes place in Alice and Bob's sites is secure 24 , this is no longer the case for the channel connecting them. This means that an eavesdropper, usually called Eve, can freely interact with the states while they propagate and try to extract information. Eve is allowed to perform the most general action consistent with quantum mechanics. In particular then, she is limited by the no-cloning theorem: contrary to what happens for classical information that can be amplified at will, when Eve obtains information on the state sent by Alice, the state used for the encoding is perturbed and she introduces errors. The larger the information obtained by Eve is, the more the state is perturbed, and consequently the larger is the error rate in the correlations between Alice and Bob.
In fact, QKD is secure because one of the following cases happens: either the error rate observed by Alice and Bob is lower than a critical value D c , in which case a secret key can be extracted using techniques of classical information theory; or the error rate is larger than D c , in which case Alice and Bob throw their data away and never use them to encode any message. In other words, the eavesdropper can either lose the game or prevent any communication, but will never gain any information.
All this reasoning is nice, provided that Alice and Bob are able to find the value of the threshold D c for the protocol that they want to use. That's why it is important to establish quantitative trade-offs between the information acquired by Eve and the error rate. For this calculation, one should assume that Eve has applied the most powerful strategy consistent with quantum mechanics. Therefore, the problem of estimating Eve's information for a given disturbance is equivalent to finding her optimal eavesdropping attack on the protocol that is used. This is a very difficult problem and, to date, the complete solution is not known for any of the existing protocols. Nevertheless, the problem can be solved if Eve is restricted to the so-called incoherent attacks. In what follows, we mainly focus on these attacks, that involve QCMs. The last paragraph of this subsection, however, will be devoted to the possibility of more general quantitative links between QKD and cloning.

Generalities
An incoherent attack is defined by two conditions: (i) Eve interacts individually and in the same way with the states travelling from Alice to Bob; (ii) she measures the quantum systems she has kept after the possible sifting 24 This is a very reasonable assumption for any cryptographic scenario. Indeed, it seems difficult to design a secure protocol if one cannot exclude the possibility that Eve has access to Alice's preparation of quantum states, or Bob's measurement results.
phase 25 but before any reconciliation process has started. In other words, the hypothesis is that after the sifting phase, Alice, Bob and Eve share a list of classical random variables, identically distributed according to a probability law P (A, B, E). Under this hypothesis, the fraction of secret bits R that can be extracted by Alice and Bob using reconciliation protocols with one-way communication satisfies the bound of Csiszár and Körner (1978) where I(X : Y ) = H(X) + H(Y ) − H(XY ) is the mutual information between two parties 26 . This result formalizes the intuition according to which, if Eve has "as much information as Alice and Bob", it is impossible to extract a secret key. Therefore, Eve's optimal individual attack is the one that, for a given error rate D -that is, for a given value of I If we go back to the physical implementation of such attacks, we see that Eve is going to "transfer" some information about the original state onto the state of a particle that she keeps and measures later. Under this perspective, it seems rather natural to guess that the interaction defining the best individual attack is the 1 → 2 asymmetric QCM that clones in an optimal way all possible preparations by Alice, i.e. the set of states {|ψ i A }; although there is no a priori link between the optimality of cloning, based on the single-copy fidelity (7), and the optimality of eavesdropping defined just above. This intuition was proved to hold in the following cases: • BB84 protocol (Bennett and Brassard, 1984): Alice chooses her preparation among the four states | ± x and | ± y of a qubit, which belong to the equator of the Bloch sphere. One can see that Eve's optimal individual attack uses the asymmetric phase-covariant cloning machine (see II.D) (Fuchs et al., 1997). The security condition assumes an easy form: a secret key can no longer be extracted as soon as F Bob = F Eve , that is, the critical value for the error rate is D incoh c = 1−F Eve . Using (40), D incoh c ≃ 14.6%. We shall come back to this example in full detail in the next paragraph.
25 Therefore, individual attacks require a quantum memory. 26 The function H is the usual Shannon entropy. While we were finishing this review, the idea of "pre-processing" was introduced in quantum cryptography Renner et al., 2005). Quite astonishingly, these authors found that security bounds can be improved by letting Alice randomly flip some of her bits. The reason is that this procedure decreases Alice's correlations with Eve much more than her correlations with Bob. This result implies that, apart from the six-state protocol, in which the attacks depend on a single parameter which is the quantum bit error rate (QBER), the truly optimal incoherent attacks may not be those which have been presented in the previous literature. Since this is an open research problem, we haven't taken these new considerations into account in the main text.
• Six-state protocol (Bechmann-Pasquinucci and Bruß, 1998): Alice's preparation is the same as in BB84 plus the poles of the sphere, | ± z . Again, the interaction defining the optimal attack is the universal asymmetric QCM (see II.C). Indeed, it turns out that to optimally clone these six states is equivalent to clone all the states in the Bloch sphere. One can see that the critical disturbance such that R (81) goes to zero is D incoh c ≃ 15.7%. Note that in the six-state protocol Eve's attack is more limited than in BB84 because she has to (imperfectly) clone all the states in the sphere. This intuitively explains why Alice and Bob can tolerate a larger disturbance.
• Continuous variable protocols, using both squeezed and coherent states (Cerf, Lévy and van Assche, 2001;Grosshans and Grangier, 2002): there also exists a link between security and the no-cloning theorem. Indeed, the well-known security limit of 3 dB, common to all these protocols for the case of direct reconciliation, can be understood as the point where Eve's clone becomes equal to Bob's.
The connection between cloning machines and eavesdropping attacks has also been exploited for other protocols and scenarios.
For instance, asymmetric 2 → 2 + 1 cloning machines have been discussed for eavesdropping on practical implementations of QKD, with no claim of optimality Curty and Lütkenhaus, 2004;Niederberger et al., 2005). Going to higher dimensional systems, the relation between cloning machines and incoherent eavesdropping strategies has been analyzed Cerf, Bourennane et al., 2002). Here, optimality is conjectured but not proved (see in this context Kaszlikowski et al. (2004)). In the case of the protocol invented by Scarani, Acín, Ribordy, and Gisin (2004) (SARG04), the optimal incoherent eavesdropping is not known, but the best attack which has been found by Branciard et al. (2005) does not make use of the corresponding optimal cloner (which would be the phasecovariant one, as for BB84).

Optimal incoherent attack on the BB84 protocol
As a completely worked-out example, we describe the optimal incoherent attack on the BB84 protocol. Suppose that the BB84 protocol is run with the bases of the eigenstates of σ x and σ y ; it is then no surprise that the optimal incoherent attack is obtained when Eve makes a copy of each qubit using the phase-covariant cloner described in II.D (Fuchs et al., 1997). However, for eavesdropping in cryptography there is a difference between the two implementations that we presented, the one (39) without ancilla and the one (41) with an ancillary qubit Durt and Du, 2004). Intuitively, the reason is that some kind of information is stored in the ancilla as well, and Eve has an access to it. Here we show in detail what happens.
Let's study the cloner without ancilla first. For simplicity, we focus on an item where Alice has sent | + x , and suppose that Bob has measured σ x so that the item will be kept after the bases-reconciliation. Using (39), the flying qubit becomes entangled to Eve's qubit according to Bob's qubit is thus in the state ρ B = 1 2 (1 1 + sin 2 ησ z + cos ησ x ), so that the measurement of σ x gave him the correct outcome with the probability F AB = +x|ρ B | + x = 1 2 (1 + cos η), which is indeed the fidelity of his clone as expected. The Alice-Bob mutual information is therefore I(A : B) = 1 − H(F AB ). Similarly, Eve's qubit is in the state ρ E = 1 2 (1 1 + cos 2 ησ z + sin ησ x ), whence she will guess the state sent by Alice correctly with probability F AE = 1 2 (1 + sin η). The Alice-Eve mutual information is therefore I(A : E) = 1 − H(F AE ). Obviously, I(A : B) = I(A : E) for η = π 4 , that is for an error rate D AB = 1 − F AB ≃ 0.1464. However, the security criterion for one-way communication (81) says that I(A : B) must be larger than the minimum between I(A : E) and I(B : E), so we need to compute the mutual information Bob-Eve as well. From the state (82), we can compute the probability that Eve's symbol is equal to Bob's, knowing that both measure σ x : P BE = | +x, +x|Ψ BE | 2 + | −x, −x|Ψ BE | 2 = 1 2 1 + 1 2 sin 2η ; whence the mutual information I(B : E) = 1 − H(P BE ). It can be verified that I(B : E) < I(A : B) whenever D AB < 1 2 ; from Eq. (81), Alice and Bob could always extract a key, as long as their correlation is not zero 27 . This is too good to be true; and indeed, the use of the machine with an ancillary qubit yields a more reasonable scenario.
To study the machine with an ancilla, we suppose that Alice and Bob use the same basis, but we consider both eigenstates of σ x . Using (41), the flying qubit | ± x A becomes entangled to Eve's two qubits according to where c = cos η and s = sin η. Bob's qubit is in the state ρ B = 1 2 (1 1 ± cos ησ x ), which gives the same fidelity as above as expected. The easiest way to see what Eve can do with her two qubits consists of writing |Γ ± BE1E2 using the basis | ± x for B and the Bell 27 We note here that this analysis was done first in the Introduction of the article by Scarani and Gisin (2001); but an unfortunate mistake in the computation of P BE , Eq. (5), prevented them from reaching the correct conclusion.
basis |Φ ± = 1 √ 2 (|00 ± |11 ), |Ψ ± = 1 √ 2 (|01 ± |10 ) for Eve's qubits, then in applying on Eve's qubits the unitary transformation |Φ + → |00 , |Ψ + → |10 , |Φ − → |11 , |Ψ − → |01 . After this transformation, the states read (84) where F = 1+c 2 is Bob's qubit fidelity, D = 1 − F the disturbance, and |χ ± = √ F |0 ± √ D|1 . Now Eve's strategy is clear. First, she measures σ z on qubit E 2 : if she finds |0 , resp. |1 , she knows that Bob's bit is identical or opposite, respectively, to Alice's bit. This information is deterministic, and implies that Eve has as much information on Bob's bit as she has on Alice's bit: I(A : E) = I(B : E). This solves the main problem of the machine without ancilla. For completeness, let's conclude the calculation by computing I(A : E). To guess Alice's bit, Eve must distinguish between the two non-orthogonal states |χ ± of qubit E 1 , with a priori probabilities p + = p − = 1 2 since Alice sends | + x and | − x with the same probability. It is known (Helstrom, 1976) that the maximal information she can obtain is I(A : E) = 1 − H(P ) where P = 1 2 1 + 1 − | ψ 1 |ψ 2 | 2 . Since | χ + |χ − | = cos η, we recover the expected result P = 1 2 (1 + sin η). In summary: without ancilla, Eve can make the best possible guess on the bit sent by Alice (because the machine realizes the optimal phase-covariant cloning) but has very poor information about the result obtained by Bob. Adding the ancilla does not modify the estimation of Alice's bit but allows Eve to deterministically symmetrize her information on Alice and Bob's symbols. However, the two machines are equally good from the point of view of cloning.

C. Beyond incoherent attacks
All the links that we have discussed between QKD and quantum cloning hold in the case of incoherent attacks. However, one can also expect a relation between cloning and eavesdropping in more general security analysis. Consider the BB84 protocol, and assume that Eve interacts individually with the states sent by Alice, but she can delay her measurement until the end of the reconciliation process and then possibly perform collective measurements. These types of attacks are often called collective. The results of Devetak and Winter (2005) and of Renner and König (2004) imply that there exists a protocol achieving a key rate which can be understood as the generalization of (81) to the case where Eve's variables are quantum (whence the index Q). The quantity χ is the so-called Holevo bound (Holevo, 1973), which bounds the maximal information on Alice or Bob's symbol accessible to Eve through her quantum states. Indeed, the presence of Eve's attack defines an effective channel between Alice (or Bob) and Eve. For this channel, when Alice encodes the symbol X = 0, 1 on the quantum state |ψ X , Eve receives the state ρ X E obtained by tracing out the qubit that goes to Bob. Holevo's bound then reads where S denotes the von Neumann entropy and ρ E = (ρ 0 E + ρ 1 E )/2. If Eve uses the phase-covariant cloning machine, we know ρ 0,1 E = Tr B (|Γ ± Γ ± |) from Eq. (84) and can compute R. After some simple algebra, one can see that the critical error D c at which R (85) is zero is defined by 1 − 2H(D c ) = 0. Remarkably, this equation is the same as in the Shor and Preskill (2000) proof of security of the BB84 protocol, and leads to a critical disturbance of D c ≈ 11%. The Shor-Preskill proof of security does not make any assumption on Eve's attack: it is thus remarkable that the same bound can be reached by a collective attack in which the individual quantum interaction is defined by the phase-covariant QCM. Actually, the attack based on the phase-covariant cloning machine is optimal, in the sense that it minimizes (85) for a fixed disturbance.

D. Conclusive balance
The relation between the no-cloning theorem and the security of quantum cryptography is certainly deep. However, it is not clear at all how to associate quantitative results for cryptography to some explicit form of imperfect cloning, because cloning is not equivalent to eavesdropping. In particular, the relevant figure of merit that define Eve's optimal attack is a priori unrelated to the single-copy fidelity (7) that is optimized when constructing QCMs -see also the discussion by Bruß, DiVincenzo et al. (1998). Still, the connection has proved to be strong and fruitful in the case of individual attacks, and possibly even beyond.

V. STIMULATED EMISSION AS OPTIMAL CLONING OF DISCRETE VARIABLES IN OPTICS
In this Section, we discuss how the well-known amplification phenomenon of stimulated and spontaneous emission of light is closely related to optimal universal cloning. The results are stated and commented on in V.A; in V.B, we re-derive the main results using a phenomenological model.
A. Cloning as amplification

Encoding of discrete states in different modes
Section III was devoted to the cloning of coherent states of a quantum oscillator; all the discussion, espe-cially about the implementations, was carried out having in mind a single mode of the light field as an example of a quantum oscillator. In this Section, we consider the light field too, but in a different perspective: the quantum system is now the discrete-level system encoded in some modes of the field. The typical example here is polarization: for a given energy ω, the light field has two independent modes a H (ω) and a V (ω), corresponding to two orthogonal polarizations "horizontal" and "vertical". We can then define a qubit as where |vac is the vacuum state of the field. According to this correspondence, for any pair of complex numbers c H , c V such that |c H | 2 + |c V | 2 = 1, we can define a cre- In this sense, polarization in a given frequency mode defines a qubit. Obviously, the N-photon Fock state in which all the photons are prepared in the state |ψ reads The construction clearly generalizes: we can encode a qudit with any d orthogonal modes a 1 , ..., a d . In Section III the unknown parameters were the parameters defining a coherent state in a given mode (i.e., a quantum continuous variable); here, a Fock state of N photons is prepared in a mode a ψ which is a linear combination of d modes a j : the unknown parameters are the coefficients of the linear combination (that is, a qudit). Therefore, we are going to refer back to the cloning of discrete-level systems (Section II). In all that follows, for simplicity, we discuss explicitly the example of polarization in a single energy mode. As might be expected, the results extend to any discrete level system encoded in field modes (Fan et al., 2002); we sketch it in paragraph VI.A.3 for the case of time-bin encoding.

Main result
Consider a light amplification process based on stimulated emission. We consider two orthogonal polarization modes of a monochromatic component of the field, and suppose that (i) N photons of a given unknown polarization are already present in the medium, and (ii) the component of the field associated to exactly M > N photons is post-selected after amplification. Because spontaneous emission is always present, it is impossible that all M photons are deterministically emitted in the same polarization mode as the input ones: even for large N , there will always be a small probability that a photon is emitted in the orthogonal mode. The claim is that, if the probabilities of emission are independent of the polarization, this amplification process attains the optimal fidelity for universal N → M cloning of qubits. This was noticed in the very early days of quantum cloning (Mandel, 1983;Milonni and Hardies, 1982;Wootters and Zurek, 1982) for the 1 → 2 process, and was generalized more recently to any cloning process (Kempe et al., 2000;. In the rest of this Section, we derive the same results using the more phenomenological approach sketched in Fasel et al. (2002). Consider an inverted medium that can emit photons of any polarization with the same probability (thus, we introduce by hand the assumption of universality). We focus on a monochromatic component of the field. Suppose that N photons are initially present in a given polarization mode, say |V ; and suppose that at the output of the amplifier M = N + k photons are found, the initial ones plus k new ones that have been emitted by the medium 28 . For this amplification process, the single-copy fidelity is the probability of an output photon picked at random to be polarized as the input ones. The no-cloning theorem tells us that the k additional photons cannot be deterministically in the same polarization mode |V as the N input ones; and indeed, we know that stimulated emission is always associated with spontaneous emission.
The derivation of the fidelity for an amplification 1 → 2 can be easily described. If a photon is present in mode |V , a second photon in this mode can be emitted either by spontaneous or by stimulated emission, the two processes being equiprobable; while a photon in mode |H can be emitted only by spontaneous emission. Thus the probabilities P [2, 0|1, 0] and P [1, 1|1, 0] that the new photon is emitted in the same mode as the input or in the orthogonal mode, are related to one another as P [2, 0|1, 0] = 2 P [1, 1|1, 0]: the probability for the new photon to be polarized along |V is 2 3 . If we now pick a photon out of the two, with probability 1 2 it is the original one, whose polarization is certainly |V ; with probability 1 2 , it is the new one. So, the probability for finding one of the output photons in mode |V (the fidelity) is 28 Photons are bosons: the output state will be a symmetrized state of the M photons in which N photons are certainly in state |V and the other ones are in a suitable state. So it does not really make sense to speak of the "initial photons" as if they had conserved any distinctive property whatsoever after amplification. Still, one can use this loose language, provided that the relation between spontaneous and stimulated emission, Eq. (92), is assumed. This relation is a consequence of the bosonic nature of the field. 1 2 × 1 + 1 2 × 2 3 = 5 6 , exactly the same as for optimal symmetric universal 1 → 2 cloning.
In the rest of this Section, we generalize the same considerations to derive the fidelity for the N → M cloning.

Statistics of stimulated emission
As a preliminary for what follows, we need to give the statistics of the process of stimulated and spontaneous emission. This amplification process will be completely described by the probabilities P [N + l, k − l|N, 0], 0 ≤ l ≤ k, that l photons are emitted in mode |V and k − l in mode |H . We normalize these probabilities so that they sum up to the total probability of the process: We stated above the simplest example, P [2, 0|1, 0] = 2 P [1, 1|1, 0]; now we want to show that the general expression is For definiteness, we consider a medium formed of N "Lambda" atoms, in which a unique excited state |e can decay into two orthogonal ground states |g H and |g V through the emission of the correspondingly polarized photon. Omitting coupling constants, the Hamiltonian describing the interaction between the medium and the field is where σ − H,j = |g H e| and σ − V,j = |g V e| acting on atom j. The system is prepared so that all the atoms are in the excited state, N photons are in mode |V and none in mode |H : |in = |N, 0 ; e, e, ..., e . The interaction leads to |ψ(τ ) = e −iHτ /h |in where τ is the interaction time.
At the output, we post-select on the states such that exactly k photons have been emitted; more specifically, we want l additional photons in mode |V and k − l in mode |H . By reading the state of the atoms after the interaction, one could in principle know which atom has emitted which photon, so all the possible output states are distinguishable. Consider all the possible processes in which the first k atoms have emitted a photon -all the other processes contribute with equal weight: |out(ξ) = |N + l, k − l; g ξ(1) , ..., g ξ(k) , e, ..., e where ξ is a k-item sequence containing l times the symbol "V" and k − l times the symbol "H". Then the probability P [N + l, k − l|N, 0] is proportional to ξ out(ξ)|H k |in 2 = This proves Eq. (92). As a consequence of it, Eq. (91) becomes We can now go back to cloning and prove the main result of this Section.

Fidelity N → M
The fidelity of the amplification process is defined as usual, as the probability of finding a photon in the same mode as those of the input: where is the average number of additional photons produced in the same mode as the input. Inserting (92) and (94) into (96) and using which is exactly the .
Our phenomenological model shows that the link between amplification by an inverted medium and quantum cloning is "semi-classical", in the following sense: the relation (92) is derived rigorously from quantum mechanics (the bosonic nature of the field); but once this relation is admitted, the rest becomes just classical event counting. Note in particular how, due to Eq. (92), l N M and consequently F N →M become independent of both P [N, k|N, 0] and P (N → M ). These last probabilities, i.e. how frequent the process N → M is, are in general difficult to compute and depend on the detailed physics of the inverted medium  and Kempe et al. (2000) provide some examples). However, we know that whenever such an amplification process takes place, it realizes the optimal symmetric N → M UQCM.

VI. EXPERIMENTAL DEMONSTRATIONS AND PROPOSALS
This Section reviews the experiments that have been proposed and often performed to demonstrate quantum cloning. They all refer to universal cloning, symmetric or asymmetric. Phase-covariant cloning has also been the object of recent proposals (De Chiara et al., 2004;Fiuràšek, 2003).

A. Polarization of photons
The connection between stimulated emission and quantum cloning (Section V) is the essential ingredient in most of the optical implementations of qubit 1 → 2 cloning machines. The usual scheme consists of sending a single photon into an amplifying medium. In the absence of this photon, the medium will spontaneously emit photons of any polarization (or mode). But if the photon is present, it stimulates the emission of another photon in the same mode, i.e. this mode is enhanced. However, the process of spontaneous emission can never be suppressed, which means that the quality of the amplification process is never perfect. This is indeed a manifestation of the nocloning theorem; remarkably, as discussed in detail in the previous Section, it achieves optimal cloning.
Before discussing this kind of cloning, we must mention that one of the first optical experiments that implemented the Bužek-Hillery cloning (II.A) was an experiment using only linear optics (Huang et al., 2001). The idea there is to realize the three needed qubits with a single photon: one qubit is the polarization, the other two are defined by the location of the photon into four possible paths. As well-known, the optical device called polarizing beam-splitter (PBS) realizes the CNOT gate between he polarization and the path mode. The experimental setup to achieve cloning is a suitable arrangement of PBS and optical rotators. This being mentioned, we focus on cloning through amplification processes.

Experiments with parametric down-conversion
Most optical implementations of the 1 → 2 cloning machine (De Martini et al., 2000Lamas-Linares et al., 2002) use parametric downconversion (PDC) as the amplification phenomenon (see Fig. 5). A strong laser pulse pumps a non-linear crystal. With small probability the pulse is split into two photons, called signal S and idler I. For pulsed type-II frequency degenerated PDC the Hamiltonian reads Notice that this Hamiltonian is invariant under the same unitary operation in both polarization modes, (V S, HS) and (V I, HI). The photon to be cloned and the the pump pulse propagate through the crystal at the same time. Because of the Hamiltonian symmetry, one can take as the state to clone, |1, 0 S = a † V S |vac , without losing generality. Indeed the rotational symmetry of the Hamiltonian guarantees the covariance of the transformation. The state after the crystal is We can expand the previous expression into a Taylor series. Since the down-conversion process only happens with small probability, we restrict our considerations to the first terms in the expansion. The zero-order term simply corresponds to the case where no pair of photons is produced, so at the output one finds the initial state unchanged. The first order term is more interesting, since the resulting normalized state gives i.e. the searched cloning transformation (13). It is straightforward to see that if the two photons in the signal mode are separated, for instance by means of a beamsplitter, the obtained fidelity is equal to 5/6. Indeed the first term corresponds to ideal cloning, while only one of the two photons in the second term is equal to the initial state, so The factor √ 2 is a manifestation of the stimulated emission process. It only appears when the initial photon is completely indistinguishable from the down-converted photon in the signal mode. That is, the two photons should perfectly overlap in space, time and frequency. Any effect increasing the distinguishability of these two photons, such as a difference in the coherence lengths of the pump pulse and down-converted photons, must be compensated in order to achieve a near to optimal cloning. Moreover, it has to be stressed that this implementation of the cloning machine is conditioned on the fact that the three detectors (the one for the idler mode and the two in the state analyzers) click. Then, it is assumed that one photon was present in each mode. Note that there are cases in which more than one pair is produced by the crystal, or the initial state to be cloned actually contains more than one photon. These spurious processes slightly decrease the optimality of the cloning transformation. In any case, the reported fidelities are equal to 0.81 ± 0.01 (Lamas-Linares et al., 2002) and 0.810 ± 0.008 (De Martini et al., 2002, 2004Pelliccia et al., 2003), very close to the theoretical value 5/6 ≈ 0.83. Interestingly, the photon in the idler mode, or anti-clone, gives the optimal realization of the quantum universal NOT gate. The optimal fidelity for this transformation is 2/3, while the reported experimental fidelity is 0.630 ± 0.008 (De Martini et al., 2002, 2004Pelliccia et al., 2003).
More recently, an alternative version of the 1 → 2 quantum cloner for qubits has been proposed and carried out by Irvine et al. (2004) and by Ricci et al. (2004). This is based on the fact that two identical photons bunch at a beam-splitter. The experiment is much simpler but cannot be generalized to N → M cloning. The exper-  5 Experimental implementation of the 1 → 2 universal cloning machine for qubits. The laser works in pulsed mode. A very small fraction of the pulse, below single-photon level, serves as probabilistic preparation of the photon to clone. The rest of the pump pulse is frequency doubled and sent to a non-linear crystal. If the prepared photon is indistinguishable from one of the two down-converted photons, optimal cloning is achieved. The other down-converted photon is often called anti-clone.
imental set-up 29 is schematically shown in Fig. 6. The initial state is combined with one of the down-converted photons into a balanced beam-splitter. It is a wellknown result that if the photons separate after the beamsplitter, a projection onto the singlet state |Ψ − has been achieved. In the other cases, the photons have been projected with onto the two-qubit symmetric subspace. Tracing out the second down-converted photon, the transformation on the photons impinging the beam-splitter is indeed equal to (17), conditioned on the fact that they stick together. On the other hand, it is straightforward to see that the transformation on the second down-converted photon is the optimal U-NOT gate, i.e. the photon in the idler mode is equal to the anti-clone (compare with II.A.3). In a similar way as for the previous implementation, the quality of the cloning process crucially depends on the fact that the two photons arriving at the beamsplitter define the same mode. This means that, as above, they have to be completely indistinguishable. Moreover, multi-photon pulses also deteriorate the quality of the cloning process. The observed fidelities for cloning were approximately 0.81.

Proposals for asymmetric cloning
In this section we show how the previous realizations can be modified in order to cover asymmetric 29 Note that this is the same set-up as for the teleportation of a qubit (Bennett et al., 1993).  6 Alternative implementation of the 1 → 2 universal cloning machine for qubits. The photon to be cloned is now combined into a balanced beam-splitter with one of the downconverted photons. When the two photons stick together, two optimal clones of the initial state are obtained. As in the first scheme, the second down-converted photon provides the anticlone.
cloning machines. Indeed, it has been shown very recently that some of these transformations can be obtained by combining into beam-splitters the photons produced by a symmetric cloning machine (Filip, 2004;Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005). At the moment of writing, these experiments have not yet been performed.
A proposal for the experimental realization of the asymmetric 1 → 1 + 1 cloning machine for qubits was given by Filip (2004). It is represented in Fig. 7. It is convenient for the analysis of this scheme to rewrite the output of the symmetric machine (99) using Cerf's formalism, where |Ψ − is the singlet state. It is simple to see that this state is equivalent to Cerf's construction when v = √ 3/2 (31), but with a simple relabelling of the Bell states for the second clone and the anti-clone. The asymmetry between the clones can now be introduced by changing the ratio of the amplitudes for the first term and the rest. A possible way of achieving this is by successfully applying the projector P asym = a1 1 + b|Ψ − Ψ − | to the second clone and the anti-clone, where a and b are such that 1 1 − P asym ≥ 0. Indeed, the states P asym |ψ 1→2 define, up to normalization, the family of states (31). Changing the ratio between a and b, one can optimally adjust the asymmetry between the quality of the two clones, i.e. the ratio between v and x according to Cerf's notation. A beam-splitter of transmittivity T conditioned on the fact that the photons at the output are separated gives a simple optical implementation of this projector. Indeed, some simple algebra shows that the corresponding operation is equal to The figure shows the optical implementation of the 1 → 1 + 1 and 1 → 1 + 1 + 1 optimal cloning machines. For the 1 → 1 + 1 case, the symmetry between the clones of the 1 → 2 cloning machines is broken by combining one of the clones with the anti-clone into a beam-splitter. The degree of asymmetry depends on the transmittivity T . The idea can be naturally generalized to the 1 → 1 + 1 + 1 case.
When T = 1 no operation is performed, P asym (T = 1) = 1 1, and the two clones are symmetric, F A = F B = 5/6. When T decreases, some asymmetry is introduced between the two clones, since F A increases while F B worsens. In the limiting case T = 1/2, a projection onto the singlet is achieved, as expected, and the state in mode A is projected onto the initial state, F A = 1 and F B = 1/2, that is, the cloning transformation has been undone. In fact, since a projection onto the singlet is realized, the detected photons after the beam-splitter were the ones produced in the crystal. This implies that the photon in mode A must be equal to the initial state. All the interesting values lie between these two limiting cases, 1/2 ≤ T ≤ 1. Indeed, one can see that the trade-off between the obtained fidelities F A and F B saturates the cloning inequality (23).
Note that for all these experimental proposals, the successful implementation of the searched cloning transformation depends on the detection of three photons (all the detectors click). Interestingly, one can see that changing the number of post-selected photons gives other asymmetric cloning machines (Fiuràšek, Filip and Cerf, 2005;Iblisdir et al., 2004;Iblisdir, Acín and Gisin, 2005), in a way similar to what happens for the symmetric case . Indeed, denoting by N , M A and M B the number of photons in the initial mode and modes A and B (see Fig. 7), it has been shown that the optimal 1 → 1 + 2 cloning machine is recovered when N = 1 and M A = 1, M B = 2 and M A = 2, M B = 1, and also the 2 → 2 + 1 case when N = 2 and same post-selection for modes A and B. Unfortunately, the transformation when N = M A = M B = 2 does not correspond to the optimal 2 → 2 + 2 machine. At present, it seems that the previous construction only works for the 1 → 1 + N and N → N + 1 cases, and a feasible optical implementation Remarkably, Filip's construction can be further generalized. Indeed, exploiting the anti-symmetrization by means of beam-splitter allows us to extend this scheme to the 1 → 1 + 1 + 1 case, where three copies of the initial state are produced in such a way that the trade-off between the fidelities is optimal. As shown in Fig. 7, it is possible to consider a more complex situation when the production of two pairs by the pump pulse, instead of one, is stimulated by the presence of the photon to be cloned. The corresponding state is equal to the output of a 1 → 3 symmetric machine, as discussed by . Actually, there are three clones and two anti-clones, namely the two photon in the idler mode. Now, one can apply twice the anti-symmetrization explained above, as shown in Fig. 7. After much algebra, one can see that the fidelities for the clones in modes A, B and C are equal to those defining the optimal 1 → 1 + 1 + 1 cloning machine of Iblisdir et al. (2004), Iblisdir, Acín and Gisin (2005) and Fiuràšek, Filip and Cerf (2005). Although unproven, it seems quite likely that this construction works for any number of clones, and that all 1 → 1 + . . . + 1 cloning machines can be optimally realized by combining into beam-splitters, and conditioned on the number of photons, the output of the 1 → N symmetric machine.

Cloning in an erbium-doped fiber
Parametric down-conversion is an amplification medium that has been studied intensively because it allows to create entangled photons. In the field of telecommunication optics, however, the common device used for amplification of light are optical fibers doped with erbium ions. These rare-earth ions can be pumped onto an excited state and then constitute an inverted medium that can lase at telecom wavelengths. Fasel et al. (2002) studied quantum cloning due to such an amplifier. The experiment consisted of sending classical, very weak pulses of (say) vertically (V ) polarized light into an erbiumdoped fiber. At the output, light is amplified, but is no longer perfectly polarized because of spontaneous emission: some light has developed in the polarization mode orthogonal to the input one (horizontal, H). The fidelity of the classical amplification is defined as the ratio of the intensities F cl = I out,V /I out,tot .
A theoretical analysis based on a seminal paper on maser amplification (Shimoda et al., 1957) provides a remarkable prediction: let µ in,out be respectively the mean number of photons in the input and the output field (i.e., the intensity of these fields, in suitable units). Then it holds Here, the parameter Q is related to the phenomenology of the emission process: Q = 1 means that all Erbium ions are excited, so that there is no absorption; Q = 0 means that emission and absorption compensate exactly, Q < 0 means that the absorption in the medium overcomes the emission. We see that in the ideal case Q = 1, the formula (104) for F cl looks exactly like the one for the optimal symmetric N → M cloning of qubits (16), but for the fact that µ in and µ out are not restricted to take integer values. This is a signature of the underlying quantum cloning in an experiment with classical states of light. In the actual experiment, the fit yielded Q = 0.8; for the cloning µ in = 1 → µ out = 1.94 ≃ 2, a fidelity F cl ≈ 0.82 was observed, close to the optimal value 5 6 ≃ 0.833. Although the experiment was performed with polarization, the same setup would allow the cloning of quantum states encoded in time-bins. With time-bin encoding, it is very easy to go beyond the qubit case (De Riedmatten et al., 2004;Thew et al., 2004). In particular, the present setup (Fig. 8) would allow to demonstrate optimal cloning for higher-dimensional quantum systems. As an example to support this claim, we compute the fidelity in the computational basis for 1 → 2 cloning -that is, one photon was prepared in a given time-bin, and two photons are found in the outcome. The probability of finding the new photon in the good timebin (associated to F = 1) is just twice the probability of finding it in any of the other d−1 time-bins (in which case F = 1/2, because half of the times we pick the original photon). The average fidelity is then which is the optimal result, see II.B.1. Of course, one should show that the same fidelity holds for any superposition state, which is, however, quite evident when one is familiar with the physics of light amplification. As we mentioned above, this result is not limited to time-bins, but holds for any encoding of a qudit in different modes of the field (Fan et al., 2002); the time-bin encoding is possibly the most easily analyzed and implemented.
B. Other quantum systems

Nuclear spins in Nuclear Magnetic Resonance
A way to achieve quantum cloning of nuclear spins using Nuclear Magnetic Resonance (NMR) has been presented by Cummins et al. (2002), together with its experimental realization. As usual in quantum information processing with NMR, many molecules are present in the sample and the process takes place among nuclear spins within each molecule.
In the present experiment, the molecule is E-(2chloroethenyl)phosphonic acid. After the peculiar pulse sequences needed to prepare the sample in a pseudo-pure state, a spin direction is encoded into the first qubit, which is the spin of the 31 P nucleus. The main part of the scheme is a pulse sequence that implements a version of the optimal symmetric 1 → 2 QCM (Bužek et al., 1997) that maps the quantum information onto the two other qubits -here, nuclear spins of two 1 H atoms. Because of several unwanted mechanisms and imperfections, however, the measured fidelity for both clones was only F ≈ 0.58, even lower than the value achievable with trivial cloning strategies (see II.A.1).

Atomic states in cavity QED
Implementations of the 1 → 2 UQCM for qubits using the techniques of cavity QED have been proposed. The scheme by Milman et al. (2003) uses four Rydberg atoms interacting with two cavities. Atom 2 carries the input state. After the suitable pulse sequence, Atoms 3 and 4 are the two clones: as in the NMR experiment described just above, the transformation is similar to the one of Bužek et al. (1997). Here however, the "circuit" is a new one, and the ancilla is not a single qubit, but two atoms (1 and 2) and the state of the light field in the two cavities. Zou, Pahlke and Mathis (2003) proposed a scheme that uses three atoms and three cavities; interaction between atoms within each cavity is required for this scheme.

A. Some open questions
At the end of this review, we address a few of the questions that are still open at the moment of writing. As far as possible, we list them in the same order as the corresponding themes appear in this review.
• To our knowledge, all the study of optimal cloning has always supposed pure input states. The optimal cloning of mixed states is thus a completely open domain. Also, as we mentioned several times, there is no general result concerning statedependent cloning, and the zoology of cases is a priori infinite.
• We have seen several times in this review (especially Sections III and IV) that the single-copy fidelity is not always the most meaningful figure of merit. However, most of the QCMs are optimal according to it. What about other figures of merit? If the resulting QCMs are found to be different, is there a deep connection among all the results?
• The role of entanglement in cloning may be further elucidated. The trivial strategies discussed in paragraphs II.A.1 and II.B.3 show that the fidelity F triv given in Eq. (22) can be achieved without using any coherent interaction between the clone and the copy. It seems quite plausible that this is the optimal value one can attain using strategies without quantum interaction. Therefore, it would be interesting to understand more precisely what role entanglement plays in optimal cloning, e.g. by studying the entangling power of the optimal cloning machine or the entanglement properties of the corresponding output states (Bruß and Macchiavello, 2003). Note that in the limit of large dimension, no entanglement is required for an optimal cloning. One could also look for links between these results and the entanglement cloning machine of Lamoureux et al. (2004).
• Also the link between cloning and Bell's inequalities is not clear. Consider the setup of Fig. 1. The QCM is an existing one (not Herbert's hypothetical perfect cloner), and let's suppose it universal and symmetric for simplicity. Alice and Bob started with the singlet, which obviously violates Bell's inequalities. Alice keeps the quantum system A, Bob now has two quantum systems B 1 and B 2 . Does ρ AB1 = ρ AB2 violate a Bell inequality? Certainly, it cannot violate any inequality with two settings on Bob's side, because Bob could measure one setting on ρ AB1 and the other setting on ρ AB2 (Terhal et al., 2003). But the general answer is unknown.
• The connection between optimal cloning and state estimation looks natural and, indeed, in paragraph II.E we presented several results in that direction. However, it is still not known whether this connection holds in general. Is it true for any arbitrary set of states, possibly with unequal a-priori probabilities, that the fidelities are equal for the optimal state estimation and for the optimal cloning in the limit of a large number of copies?
• The relation to optimal eavesdropping is also not yet fully understood. For individual attacks on some quantum cryptography protocol, such as BB84 or the six-state protocol, it has been proven that the best strategy uses the cloning machines that are optimal to clone the set of states used for encoding. As we stressed in Section IV, this correspondence is not obvious, since cloning is optimized for fidelities, whereas in eavesdropping one optimizes mutual Shannon information; and indeed, it seems that the correspondence breaks down for the SARG04 protocol. More generally, it has been proven that security bounds can be obtained by restricting attacks to the so-called "collective attacks" Renner et al., 2005), and it is meaningful to ask whether the quantum interaction is described by the corresponding optimal cloner.
• The concepts and tools of cloning have proved useful for the foundations of quantum mechanics, for state estimation and for cryptography. Are there other domains, tasks, situations, etc. in which cloning can be useful? Or, can one find a more general principle which unifies optimal cloning, state estimation, and eavesdropping in cryptography, possibly with spontaneous and stimulated emission?
• Qubits obey fermionic commutation relations, e.g. {σ x , σ y } = 0. Optimal cloning of qubits can be implemented using spontaneous and stimulated emission that comes from bosonic commutation relations, ie [a, a † ] = 1. What is the exact relation? A link between the particle statistics and state estimation has been discussed (Bose et al., 2003), but to our knowledge there is no such study for cloning.
• Many questions are also still open in the field of implementations of quantum cloning. Obviously, any form of cloning can (in principle) be implemented with linear optics using the Knill, Laflamme and Milburn (2001) scheme for quantum computation. Can one implement any cloning transformation using amplification through stimulated emission? If yes, can one it be done by linear-optics elements, or are other non-linear devices needed? Are there other "natural" phenomena that directly implement quantum cloning?
This list will possibly shrink in the coming years as soon as these questions are answered. A regularly updated list of open problems in quantum information is available on the website of Reinhard Werner's group: www.imaph.tu-bs.de/qi/problems/problems.html.
At the moment of this writing, no problems related to cloning are listed there, apart from, possibly, "Complexity of product preparations" proposed by Knill. B. Conclusion: the role of cloning in quantum physics Quantum cloning is likely to remain an active topic for basic research, while simultaneously an ideal subject for teaching elementary quantum physics. The proof of the no-cloning theorem is so simple that it can be presented to students as soon as the linearity of the quantum dynamics has been introduced, and much of quantum mechanics can be presented as a consequence of this deep no-go theorem. Such a presentation would not follow the history of the discovery of quantum physics, but is much closer to the modern view of it in the light of quantum information theory. Optimal cloning clearly shows that incompatible quantities can be measured simultaneously (first clone the system, next perform different measurements on each clone), while illustrating that such measurements can't be ideal, i.e. can't be immediately reproducible.
Apart from the issue of measurement, quantum cloning is closely related to many other aspects of quantum physics: to the no-signaling condition, both historically (I.C) and as limit for optimal cloning (I.E.1); to the phenomenon of spontaneous and stimulated emissions, well known in quantum optics, see Section V... The nocloning theorem also introduces in a natural way the idea of quantum cryptography, and optimal cloning suggests the way eavesdropping can be analyzed. Finally, it elucidates what is so special about quantum teleportation (Bennett et al., 1993): the original has to be destroyed in the process and the Bell-state measurement should not provide any information of the state to be teleported, otherwise there would be a contradiction with the nocloning theorem (more precisely, with the optimal asymmetric cloning result presented in II.C).
of entangled states, that is, states that cannot be written as products |ψ 1 ⊗ |ψ 2 .
The basis formed with four orthogonal maximally entangled states (Bell basis) plays an important role; the notations are standardized by now: We recall that |Ψ − is invariant under identical unitaries on both qubits, i.e. it keeps the same form in all the bases. If the eigenstates of σ x ⊗σ x or of σ y ⊗σ y were taken as computational bases states, the Bell basis remains the same, simply relabelled: |Φ + x = |Ψ + y = |Φ + z , |Φ − x = −i|Φ − y = |Ψ + z and |Ψ + x = |Φ + y = |Φ − z . The general form of a density matrix of two qubits is ρ AB = 1 4 1 1 4 +n A · σ ⊗ 1 1 + 1 1 ⊗n B · σ + i,j=x,y,z where t ij = Tr(ρ σ i ⊗ σ j ). From this form, the partial traces are computed leading to ρ A,B = 1 2 (1 1 +n A,B · σ) .
If |n A | = 1, then ρ A = P A a projector on a pure state; since a projector is an extremal point of a convex set, this necessarily implies ρ AB = P A ⊗ ρ B and in particular t ij = (n A ) i (n B ) j .