# Fast and robust cat state preparation utilizing higher order nonlinearities

S. Zhao  Institute for Quantum Materials and Technology, Karlsruhe Institute
of Technology, 76344 Eggenstein-Leopoldshafen, Germany  Freie Universität
Berlin, Arnimallee 14, D-14195 Berlin, Germany  M. G. Krauss  Freie
Universität Berlin, Arnimallee 14, D-14195 Berlin, Germany  T. Bienaimé
Institut de Science et d’Ingénierie Supramoléculaires (ISIS, UMR7006),
University of Strasbourg and CNRS  S. Whitlock  Institut de Science et
d’Ingénierie Supramoléculaires (ISIS, UMR7006), University of Strasbourg and
CNRS  C. P. Koch  Freie Universität Berlin, Arnimallee 14, D-14195 Berlin,
Germany  Dahlem Center for Complex Quantum Systems and Fachbereich Physik  S.
Qvarfort  Nordita, KTH Royal Institute of Technology and Stockholm University,
Hannes Alfvéns väg 12, SE-106 91 Stockholm, Sweden  Department of Physics,
Stockholm University, AlbaNova University Center, SE-106 91 Stockholm, Sweden
A. Metelmann  Institute for Theory of Condensed Matter, Karlsruhe Institute of
Technology, 76131 Karlsruhe, Germany  Institute for Quantum Materials and
Technology, Karlsruhe Institute of Technology, 76344 Eggenstein-Leopoldshafen,
Germany  Institut de Science et d’Ingénierie Supramoléculaires (ISIS,
UMR7006), University of Strasbourg and CNRS  Freie Universität Berlin,
Arnimallee 14, D-14195 Berlin, Germany

###### Abstract

Cat states are a valuable resource for quantum metrology applications,
promising to enable sensitivity down to the Heisenberg limit. Moreover,
Schrödinger cat states, based on a coherent superposition of coherent states,
show robustness against phase-flip errors making them a promising candidate
for bosonic quantum codes. A pathway to realize cat states is via utilizing
single Kerr-type anharmonicities as found in superconducting devices as well
as in Rydberg atoms. Such platforms nevertheless utilize only the second order
anharmonicity, which limits the time it takes for a cat state to be prepared.
Here we show how proper tuning of multiple higher order nonlinear interactions
leads to shorter cat state preparation time. We also discuss practical aspects
including an optimal control scheme which allows us to start the state
preparation from the vaccum state under standard single mode driving. Lastly,
we propose an ensemble of Rydberg atoms that exhibits higher order
nonlinearities as a platform to prepare cat states in the laboratory.

In bosonic systems, cat states usually refer to the superposition of two
coherent states of the same amplitude but with opposite phases. Such
nonclassical states find applications in quantum information processing and
quantum metrology. For instance, the superposition may serve as a qubit, which
when equipped with an error correction scheme, becomes robust against phase-
flip errors [1]. Alternatively, since a weak-force can impose an extra phase
on the cat state, entangling many copies of it would accumulate the phase and
allow for weak-force sensing at the Heisenberg limit [2]. Furthermore, cat
states may also be used as a robust information carrier against dissipation in
quantum teleportation [3].

Despite its many applications, cat states are challenging to prepare in an
experimental setting. A coherent state can evolve into a cat state under a
single nonlinearity, with higher order anharmonicities shortening the required
evolution time, providing a way to beat decoherence [4]. Some systems in which
cat states are prepared via anharmonicities include both superconducting
devices [5, 6, 7, 8, 9], as well as Rydberg atoms [10, 11]. These platforms
nevertheless utilize only the second order anharmonicity, which limits the
time it takes for a cat state to be prepared. Furthermore, dissipation and
finite temperature effects are relevant drawbacks in experimentally feasible
systems [12], which in turn also limits the time a cat state can be stored.
Although different types of dissipation can be partially coped with by
squeezing, as demonstrated theoretically in numerical simulations [13], as
well as experimentally [14], the optimal squeezing conditions are still an
open question.

In this article, we utilize higher order anharmonicities to speed up the
preparation of cat states. With this we extend the system of single nonlinear
order, as discussed in Ref. [4], to a sum of multiple nonlinear orders, and
show that the shortest possible time for a coherent state to evolve into a cat
state scales inversely the maximum nonlinear order of the sum. Crucially,
within the framework of optimal control we circumvent the use of any non-
trivial inital state preparation or driving scheme. We simply equip the system
with a linear drive, and control its pulse to prepare the cat state from a
vacuum state instead of a coherent state. A method applicable as well to
architectures utilizing only the second order anharmonicity. The extra control
enables cat states to be formed much faster compared to a preparation protocol
without control. Moreover, we employ a squeezing protocol to enhance the
lifetime of our state. With this, we analytically derive an optimal squeezing
condition on how to achiev the longest storage time for the prepared cat
states. We conclude our work by discussing the feasablity of our model and
explain how to implement our state preparation protocol with an ensemble of
Rydberg atoms.

We start by considering cat states of the general form
$|\psi_{\mathrm{cat}}\rangle\sim|\alpha\rangle+e^{i\phi}|-\alpha\rangle$, in
which $|\pm\alpha\rangle$ are coherent states with large enough complex
amplitudes $\pm\alpha$ for them to be distinguishable
$|\langle\alpha|-\alpha\rangle|\sim 0$. $\phi$ denotes the phase which
characterizes the cat state. The cat state of $\phi=\frac{\pi}{2}$ can be
obtained from a coherent state evolving under the Hamiltonian containing
multiple nonlinear orders $(\hbar=1)$

$\displaystyle\hat{H}$
$\displaystyle=\sum_{j=2}^{m}\mathcal{K}_{j}(\hat{a}^{\dagger}\hat{a})^{j},$
(1)

where $\mathcal{K}_{j}$ is the coefficient of j-th nonlinear order, while
$\hat{a}$ and $\hat{a}^{\dagger}$ denote bosonic annihilation and creation
operators. Originially it has been proposed that for vanishing lower nonlinear
orders $\mathcal{K}_{j<m}$, the coherent state evolves into the cat state at
$t=\frac{\pi}{2\mathcal{K}_{m}}$ [4]. However, systems that exhibit higher-
order nonlinearities often contain lower orders, e.g. nonlinearities of a
Josephson junction as found in superconducting circuit arhcitectures come from
the expansion of a cosine potential [8] containing all orders. Here, we show
that by including non-vanishing $\mathcal{K}_{j<m}$, the time $t$ is reduced
by an extra factorial factor $m!$.

To illustrate the time reduction, we first write out the evolution of a
coherent state $|\alpha\rangle$ under Eq. (1) in the basis of number
eigenstates (or Fock states):

$\displaystyle|\psi_{\mathrm{cat}}\rangle$
$\displaystyle=e^{-i\hat{H}t}|\alpha\rangle=e^{-\frac{|\alpha|^{2}}{2}}\sum_{n=0}^{\infty}\frac{\alpha^{n}}{\sqrt{n!}}e^{-ip(n)t}|n\rangle,$
(2)

where $p(n)=\sum_{j=2}^{m}\mathcal{K}_{j}n^{j}$ is a function in $n$ obtained
by applying Eq. (1) to the number eigenstates. With particular choices of
$\mathcal{K}_{j}$ and a critical time $t_{c}$, e.g.
$\frac{\mathcal{K}_{2}}{5}=\frac{\mathcal{K}_{3}}{2}=\mathcal{K}_{4}$ and
$t_{c}=\frac{\pi}{12\mathcal{K}_{4}}$, the exponential part $e^{-ip(n)t_{c}}$
depends only on the parity of photon numbers $n$: $e^{-ip(n)t_{c}}=1$ for even
$n$ and $-i$ for odd $n$. This splits Eq. (2) into even and odd sums, which
gives rise to the two cat components:

$\displaystyle|\psi_{\mathrm{cat}}\rangle$
$\displaystyle\sim\left(\sum_{\begin{subarray}{c}n=\\\
\mathrm{even}\end{subarray}}^{\infty}-i\sum_{\begin{subarray}{c}n=\\\
\mathrm{odd}\end{subarray}}^{\infty}\right)\frac{\alpha^{n}}{\sqrt{n!}}|n\rangle\sim|\alpha\rangle+e^{i\frac{\pi}{2}}|-\alpha\rangle.$
(3)

Our aim is to find combinations of multiple nonlinear coefficients, such that
the cat preparation time $t_{c}$ is as short as possible. The idea is to solve
a system of $m-1$ equations for the $m-1$ variables
$\mathcal{K}_{j=2,3,...,m}$, which can be constructed by equating
$p(n=2,3,...,m)$ to values that satisfy the parity dependence mentioned above,
see the supplementary material for the detailed calculations. On another hand,
since the system of equations also involves the time variable $t_{c}$, we can
find the shortest cat preparation time $t_{c,\mathrm{min}}$ by looking for the
smallest $t_{c}$ with which the system of equations is still solvable:

$\displaystyle
t_{c,\mathrm{min}}=\begin{cases}\frac{\pi}{2\mathcal{K}_{2}}&\text{ for
$m=2$},\\\ \frac{2\pi}{\mathcal{K}_{m}m!}&\text{ for $m>2$}.\end{cases}$ (4)

Eq. (4) agrees with [4] for $m=2$, whereas for $m>2$, the lower nonlinear
orders included in our consideration contribute an additional factorial
reduction $\frac{1}{m!}$ to the cat preparation time. For example, when $m=4$,
the shortest preparation time is $\frac{\pi}{12\mathcal{K}_{4}}$, with
$\mathcal{K}_{2}=5\mathcal{K}_{4}$, $\mathcal{K}_{3}=2\mathcal{K}_{4}$ and
$\mathcal{K}_{4}=\mathcal{K}_{4}$.

Figure 1:  Infidelity for different values of $\mathcal{K}_{3}$ after
optimization plotted against pulse duration $T$. The different values of
$\mathcal{K}_{3}$ are indicated by the marker style and color. All markers
correspond to the smallest infidelity obtained from a series of optimizations
performed with the same parameters but different guess pulses.

So far, the accelerated preparation of the cat states through nonlinearities
has relied on the assumption of coherent states as initial states. But, in
practice, it is more feasible to start from the vacuum state. This suggests
that a straightforward protocol for creating these states from the vacuum
state can constist of generating a coherent state via the application of a
short, coherent Gaussian pulse of appropriate strength and afterwards allowing
the system to evolve without any additional drive. However, this raises the
question of whether these field-free dynamics indeed yield the shortest
realization of the cat state preparation or if taylored pulses can achieve
even faster implementations, harvesting the full potential of the additional
anharmonicities. Quantum optimal control [15, 16] allows us to answer this
particular question and estimate the fundamental limit of how fast cat states
can be generated by utilizing higher-order nonlinearities. In particular, we
investigate how adding a linear drive

$\displaystyle\hat{H}_{i}$
$\displaystyle=\varepsilon(t)(\hat{a}+\hat{a}^{\dagger})\,,$ (5)

with an appropriately shaped pulse $\varepsilon(t)$, to the Hamiltonian in Eq.
1 can further speed up the generation of a cat state.

For the optimization, we employ Krotov’s method [17, 18, 19] to minimize the
infidelity $1-\big{|}\langle\psi_{\mathrm{cat}}|\psi(T)\rangle\big{|}^{2}$,
which we use as optimization functional. This corresponds to maximizing the
overlap between the evolved state $|\psi(T)\rangle$ at final time $T$ and the
target cat state $|\psi_{\mathrm{cat}}\rangle$ from Eq. 3. The quantity to be
optimized is the pulse shape of the linear drive. Using this, the shortest
possible pulse duration is determined by optimizing towards the same cat state
for different pulse durations $T$. Similar protocols have proven to be capable
of identifying the shortest possible pulse durations for various states and
systems [20]. Each of the optimizations uses the ground state as the initial
state. The pulse amplitude is restricted to $|\varepsilon(t)|\leq
30\mathcal{K}_{2}$ during all times. Similar optimizations with
$|\varepsilon(t)|\leq 5\mathcal{K}_{2}$, did not yield a significant speedup
for larger nonlinearities.

Fig. 1 shows the optimization results for different values of
$\mathcal{K}_{3}$, which varies between the different curves. All curves
exhibit a similar shape, but are offset from one another. If the pulse
duration is long enough, the optimization can reach very small infidelities,
i.e. a large overlap between the final state and the targeted cat state. In
Fig. 1 the smallest reached infidelity lies at $10^{-3}$, which corresponds to
the fidelities for which the optimization was assumed to have converged.
Reaching this value is assumed to be a successful preparation of the cat
state. On the other hand, if the pulse duration is too small, it is not
possible anymore to reach the target state, which is indicated by an increase
of the final infidelities towards shorter pulse durations. The shortest pulse
duration for which the optimization still succeeds is then considered to be
the the physical bound for the preparation of the cat state. The curves in
Fig. 1, show a clear shift towards shorter times for larger values of
$\mathcal{K}_{3}$. The preparation time for $\mathcal{K}_{3}=0$ (solid blue
curve) is longer compared to the one without linear drive, which corresponds
to $T_{\mathrm{min}}=\frac{\pi}{2}\mathcal{K}_{2}$. This originates from the
fact, that the optimization starts in the ground state. In contrast to this,
the shortest possible pulse duration decreases by about a factor of 5 for the
case when $\mathcal{K}_{3}=\mathcal{K}_{2}$. This demonstrates that higher-
order terms can indeed be utilized for reducing the preparation time for cat
states.

Figure 2: Overlap decay curves comparing the optimized squeezed cat states
with other squeezed cat states. The curves show the pure decay of the system
under dissipation, i.e. without Kerr nonlinearities and free oscillations.
Besides the optimized squeezed cat state (in red) and the unsqueezed cat state
(in blue), we also show curves for other squeezing parameters $r$ (from 0 to
1) and $\phi=0,\text{ }\frac{\pi}{2}\text{ and }\pi$ (in light blue). The cat
state amplitude is set to be $\alpha=2$ for illustration, and
$\kappa_{1\mathrm{ph}}=\kappa_{\phi}$ (only for illustration purpose, not
specified to a physical platform), for which we find the optimized squeezing
parameters to be $\phi=0$ and $r\approx 0.51$. The red curve illustrates the
result with $\phi=0$ and $r\approx 0.51$.

In practice, the impact of dissipation will accumulate in time and decohere
quantum states. Although it can be ignored in the quick cat preparation stage
discussed previously (see supplementary materials), it has to be considered
when dealing with larger timescales such as the storage of cat states in a
noisy environment. It has been experimentally and numerically shown, that
squeezing cat states makes them more robust under the two major types of
dissipation: 1-photon loss and dephasing, prolonging the lifetime of cat
states [14, 13]. Here, we squeeze cat states with the operator
$\hat{S}(r,\phi)=e^{\frac{1}{2}r(e^{-i\phi}\hat{a}^{2}-e^{i\phi}\hat{a}^{{\dagger}2})}$,
and analytically derive an optimal condition for the squeezing parameter $r$
and phase $\phi$ to reach the maximum protection.

To determine the benefits gained from squeezing cat states, we model
dissipation and dephasing with the Lindblad equation, and look at their
effects on an initially ideal squeezed cat state
$|\psi_{\mathrm{SqCat}}\rangle$. While the state evolves under dissipation, we
compute and expand the overlap
$\mathcal{V}=|\langle\psi_{\mathrm{SqCat}}|\psi_{\mathrm{sys}}\rangle|^{2}$
between the system state $|\psi_{\mathrm{sys}}\rangle$ and the target state
$|\psi_{\mathrm{SqCat}}\rangle$ (see supplementary material):

$\displaystyle\mathcal{V}$ $\displaystyle\approx
1-\kappa_{1\mathrm{ph}}K^{(1)}-\kappa_{\phi}K^{(2)}+\frac{\kappa_{1\mathrm{ph}}\kappa_{\phi}}{2}\left(K^{(3)}+2K^{(1)}K^{(2)}\right)$
$\displaystyle\hskip
14.22636pt+\mathcal{O}(\kappa_{1\mathrm{ph}}^{2},\kappa_{\phi}^{2})$ (6)

where $t\kappa_{1\mathrm{ph}}\rightarrow\kappa_{1\mathrm{ph}}$ and
$t\kappa_{\phi}\rightarrow\kappa_{\phi}$ are dimensionless rates of 1-photon
loss and dephasing rescaled with time, $K^{(n)}$ is the n-th cumulant of
$\hat{a}^{\dagger}\hat{a}$ with respect to the target state, e.g.
$K^{(1)}=\langle\hat{a}^{\dagger}\hat{a}\rangle$, and
$K^{(2)}=\langle(\hat{a}^{\dagger}\hat{a})^{2}\rangle-\langle\hat{a}^{\dagger}\hat{a}\rangle^{2}$.
$\mathcal{O}(\kappa_{1\mathrm{ph}}^{2},\kappa_{\phi}^{2})$ corresponds to the
expansions in $\kappa_{1\mathrm{ph}}^{2}$, $\kappa_{\phi}^{2}$ that are
irrelevant here, as well as higher-orders that are ignored for weak enough
decays.

The terms linear in $\kappa_{1\mathrm{ph}}$ and $\kappa_{\phi}$ from Eq. (6)
indicate that in the presence of only 1-photon loss or dephasing, the optimal
squeezing for maximally protecting cat states occurs in such a way that the
average photon number $\langle\hat{a}^{\dagger}\hat{a}\rangle$ or the photon
number variance $\sigma_{N}^{2}=K^{(2)}$ in the system is minimized. In the
presence of both types of dissipation, a compromise between these quantities
must be made. This can be done by tuning the squeezing parameter $r$ and its
phase $\phi$ to a particular value, which has been calculated in supplementary
material. We stress that the choice of $r$ and $\phi$ depends on the coherent
state amplitude $|\alpha|$ in cat states, as well as the number of cat state
components. In addition, the cross term $\kappa_{1\mathrm{ph}}\kappa_{\phi}$
suggests that 1-photon loss and dephasing can enhance the influence of each
other, leading to the “loss-dephasing” phenomenon [21], and may play a
significant role at later time when $\kappa_{1\mathrm{ph}}$ and
$\kappa_{\phi}$ become large. To visualize our discussion, in Fig. 2, we plot
how the overlap $\mathcal{V}$ (or fidelity) decays over the dimensionless time
$t\kappa=\kappa_{1\mathrm{ph}}=\kappa_{\phi}$ for different values of $r$ and
$\phi$. The slowest decay occurs at the point where the average and varaince
of the photon number have made a good compromise, see supplementary material.

Figure 3: (a): Energy level structures of two Rydberg atoms interacting via
Rydberg interaction. $g$, $e$ and $r$ denote ground state, excited state and
Rydberg state. A laser of Rabi frequency $\Omega_{er}$ drives the transition
$e\leftrightarrow r$ transitions with a detuning $\Delta$. Two Rydberg states
$|r_{i}\rangle$ and $|r_{j}\rangle$ interact via $V_{ij}$. (b): Nonlinear
strengths $\mathcal{K}_{2}$ and $\mathcal{K}_{3}$ of second (blue) and third
(red) orders in units of the linear frequency $\mathcal{K}_{1}$, plotted from
the effective Hamiltonian Eq. (7) using $\Omega_{er}/2\pi=50\text{ MHz}$,
$\Delta/2\pi=150\text{ MHz}$. Both orders of nonlinearity grow stronger near
the multiphoton resonance regions, where $V=\frac{2\Delta}{m}$ for
$m=1,2,3,...$.

We now consider the prospects for using higher-order nonlinearities to speed
up cat-state preparation in experiments. While these nonlinearities at the
required strength are difficult to create in e.g. superconducting systems
[22], Rydberg atoms, which exhibit a wide range of applications [23, 24, 25],
can provide a suitable alternative. We consider an ensemble of Rydberg atoms
where each atom has three energy levels (ground $|g\rangle$, excited
$|e\rangle$ and Rydberg $|r\rangle$ states). Two atoms namely i and j interact
with each other via $V_{ij}$ if both are in Rydberg states, see Fig. 3 (a).
The transition between excited and Rydberg states of each atom is driven at
the Rabi frequency $\Omega_{er}$ with a detuning $\Delta$. In the limit of
$\Delta>>\Omega_{er}$, we can adiabatically eliminate the Rydberg states from
the system due to their short lifetime $\sim\frac{1}{\Delta}$, so that there
are only ground and excited states left. In other words, since atoms in
Rydberg states quickly decay to excited states, we may regard them as if they
have always been in excited states. The effective Hamiltonian after
eliminating the Rydberg states is (see supplementary material)

$\displaystyle\hat{H}_{eff}$
$\displaystyle=\sum_{n=2}^{N}\mathcal{K}_{n}\hat{N}_{e}^{n},$ (7)

where $\mathcal{K}_{n}=\sum_{m=0}^{N-1}s(m+1,n)f(m)$ for which $s(m,n)$ is the
Stirling number of the first kind and

$\displaystyle f(m)$
$\displaystyle=\begin{cases}\frac{\Omega_{er}^{2}}{4\Delta}&m=0,\\\
\frac{1}{(m-1)!}\frac{V\Omega_{er}^{2+2m}}{2^{3+2m}\Delta(\Delta-\frac{m}{2}V)\prod_{k=1}^{m}(\Delta-\frac{k-1}{2}V)^{2}}\hskip
14.22636pt&\text{else}.\end{cases}$

$\hat{N}_{e}=\sum_{i=1}^{N}\hat{\sigma}_{i}^{ee}$ is the number operator that
is generated from the atomic operator $\hat{\sigma}_{i}^{ee}$ acting on the
ith atom, this operator counts how many excited states are in the system. We
note that Eq. (7) is of the same form as Eq. (1). Nonlinear coefficients may
diverge due to singularities that come from the denominator of $f(m)$, and
correspond to $m+1$-photon resonances. In other words, we may obtain strong
nonlinearities by tuning the system to regions near these singularities. As an
illustration, $\mathcal{K}_{2}$ and $\mathcal{K}_{3}$ have been plotted in
units of the linear frequency $\mathcal{K}_{1}$ (see Fig. 3 (b)), and they
diverge at $V=\frac{2\Delta}{m}$ for $m=1,2,3,...$, which correspond to the
$m+1$-photon resonance, or the Rydberg blockade [26, 27, 28]. We can treat Eq.
(7) as a bosonized version of an atomic ensemble, in which Fock state
represents the number of excited states in the ensemble, and the coherent
state follows the binomial distribution which agrees with the Poisson
distribution when the ensemble contains large enough number of atoms. Such
atomic coherent states have been well studied in two-level system ensembles
[29, 30, 31, 32].

To create the initial (atomic) coherent state required from the cat
preparation scheme, we need to add another laser that drives the transition
between ground and excited states of each atom:

$\displaystyle\hat{H}_{eff}^{\prime}$
$\displaystyle=\sum_{i=2}^{N}\mathcal{K}_{i}(\hat{a}^{\dagger}\hat{a})^{i}\otimes\mathds{1}+\frac{\Omega_{eg}}{2}(e^{i(\mathcal{K}_{1}+\omega_{eg})t}\hat{a}^{\dagger}\otimes\hat{a}+\mathrm{h.c.}),$
(8)

where $\Omega_{eg}$ is the frequency of the laser, $\omega_{eg}$ is the energy
difference between ground and excited states, and $\mathcal{K}_{1}$ is the
linear term coefficient. The system state is denoted as
$|N_{e}\rangle\otimes|N_{g}\rangle$ corresponding to the two modes in Eq. (8):
the first mode denotes the number of atoms in excited state, and the second in
ground state.

We now look at some experimental aspects. We first want to maintain a certain
distance from the multiphoton resonance regions; although we obtain strong
nonlinearities near these regions, our assumptions of adiabatic elimination
may also break down, causing the accuracy of the effective Hamiltonian to
drop. We analyzed several regions using realistic experimental parameters [28,
33, 34, 35, 11], e.g. $\Omega_{er}/2\pi=50\text{ MHz}$,
$-200\leq\Delta/2\pi\leq 200\text{ MHz}$, and $-400\leq V/2\pi\leq 400\text{
MHz}$, and found that there are regions where we can obtain strong higher-
order nonlinearities, while the effective Hamiltonian in Eq. (7) still holds
accurate. The detailed discussions are provided in supplementary material. In
these regions, preparation times of the cat state are of three orders of
magnitude shorter than its lifetime derived from [36].

To conclude, cat states can be quickly generated by a proper tuning of
multiple higher order nonlinear coefficients in an anharmonic system, such
that the shortest limit of cat preparation time depends on the maximum
anharmonic order. In addition to this, employing a controllable coherent
driving to the system further accelerates the cat generation process, pushing
the preparation time beyond the previous limit. After being prepared, cat
states can also survive longer in a noisy environment with an appropriate
squeezing. Moreover, an ensemble of Rydberg atoms can be used to implement the
cat preparation scheme, but has the experimental challenge of maintaining
constant nonlinearities.

We acknowledge fruitful discussions with F. Gago Encinas, L. Orr, and N. Diaz-
Naufal. AM acknowledges funding by the Deutsche Forschungsgemeinschaft through
the Emmy Noether program (Grant No. ME 4863/1-1) and the project CRC 183. SQ
is funded in part by the Wallenberg Initiative on Networks and Quantum
Information (WINQ) and in part by the Marie Skłodowska–Curie Action IF
programme “Nonlinear optomechanics for verification, utility, and sensing”
(NOVUS) – Grant-Number 101027183. Nordita is partially supported by Nordforsk.
MGK and CPK acknowledge financial support from the Deutsche
Forschungsgemeinschaft (DFG), Project No. 277101999, CRC 183 (project C05).

## References

  * Ofek  _et al._ [2016] N. Ofek, A. Petrenko, R. Heeres, P. Reinhold, Z. Leghtas, B. Vlastakis, Y. Liu, L. Frunzio, S. M. Girvin, L. Jiang, M. Mirrahimi, M. H. Devoret, and R. J. Schoelkopf, Nature 536, 441 (2016).
  * Munro  _et al._ [2002] W. J. Munro, K. Nemoto, G. J. Milburn, and S. L. Braunstein, Physical Review A 66, 10.1103/physreva.66.023819 (2002).
  * van Enk and Hirota [2001] S. van Enk and O. Hirota, Physical Review A 64, 10.1103/physreva.64.022313 (2001).
  * Yurke and Stoler [1986] B. Yurke and D. Stoler, Phys. Rev. Lett. 57, 13 (1986).
  * Grimm  _et al._ [2020] A. Grimm, N. E. Frattini, S. Puri, S. O. Mundhada, S. Touzard, M. Mirrahimi, S. M. Girvin, S. Shankar, and M. H. Devoret, Nature 584, 205 (2020).
  * Joshi [2000] A. Joshi, Physics Letters A 270, 249 (2000).
  * Bourassa  _et al._ [2012] J. Bourassa, F. Beaudoin, J. M. Gambetta, and A. Blais, Phys. Rev. A 86, 013814 (2012).
  * Josephson [1962] B. Josephson, Physics Letters 1, 251 (1962).
  * Frattini  _et al._ [2017] N. E. Frattini, U. Vool, S. Shankar, A. Narla, K. M. Sliwa, and M. H. Devoret, Applied Physics Letters 110, 222603 (2017).
  * Khazali  _et al._ [2016] M. Khazali, H. W. Lau, A. Humeniuk, and C. Simon, Phys. Rev. A 94, 023408 (2016).
  * Omran  _et al._ [2019] A. Omran, H. Levine, A. Keesling, G. Semeghini, T. T. Wang, S. Ebadi, H. Bernien, A. S. Zibrov, H. Pichler, S. Choi, J. Cui, M. Rossignolo, P. Rembold, S. Montangero, T. Calarco, M. Endres, M. Greiner, V. Vuletić , and M. D. Lukin, Science 365, 570 (2019).
  * Tsarev  _et al._ [2022] D. V. Tsarev, D. V. Ansimov, S. A. Podoshvedov, and A. P. Alodjants, Laser Phys. Lett. 19, 125202 (2022).
  * Schlegel  _et al._ [2022] D. S. Schlegel, F. Minganti, and V. Savona, Phys. Rev. A 106, 022431 (2022).
  * Le Jeannic  _et al._ [2018] H. Le Jeannic, A. Cavaillès, K. Huang, R. Filip, and J. Laurat, Phys. Rev. Lett. 120, 073603 (2018).
  * Glaser  _et al._ [2015] S. J. Glaser, U. Boscain, T. Calarco, C. P. Koch, W. Köckenberger, R. Kosloff, I. Kuprov, B. Luy, S. Schirmer, T. Schulte-Herbrüggen, D. Sugny, and F. K. Wilhelm, Eur. Phys. J. D 69, 279 (2015).
  * Koch  _et al._ [2022] C. P. Koch, U. Boscain, T. Calarco, G. Dirr, S. Filipp, S. J. Glaser, R. Kosloff, S. Montangero, T. Schulte-Herbrüggen, D. Sugny, and F. K. Wilhelm, EPJ Quantum Technol. 9, 19 (2022).
  * Krotov [1995] V. Krotov,  _Global Methods in Optimal Control Theory_ (CRC Press, 1995).
  * Konnov and Krotov [1999] A. I. Konnov and V. F. Krotov, Autom. Remote Control 60, 1427 (1999).
  * Goerz  _et al._ [2019] M. Goerz, D. Basilewitsch, F. Gago-Encinas, M. G. Krauss, K. P. Horn, D. M. Reich, and C. Koch, SciPost Phys. 7, 080 (2019).
  * Caneva  _et al._ [2009] T. Caneva, M. Murphy, T. Calarco, R. Fazio, S. Montangero, V. Giovannetti, and G. E. Santoro, Phys. Rev. Lett. 103, 240501 (2009).
  * Leviant  _et al._ [2022] P. Leviant, Q. Xu, L. Jiang, and S. Rosenblum, Quantum 6, 821 (2022).
  * Blais  _et al._ [2021] A. Blais, A. L. Grimsmo, S. M. Girvin, and A. Wallraff, Rev. Mod. Phys. 93, 025005 (2021).
  * Morgado and Whitlock [2021] M. Morgado and S. Whitlock, AVS Quantum Science 3, 023501 (2021).
  * Saffman  _et al._ [2010] M. Saffman, T. G. Walker, and K. Mølmer, Rev. Mod. Phys. 82, 2313 (2010).
  * Adams  _et al._ [2019] C. S. Adams, J. D. Pritchard, and J. P. Shaffer, J. Phys. B: At. Mol. Opt. Phys. 53, 012002 (2019).
  * Urban  _et al._ [2009] E. Urban, T. A. Johnson, T. Henage, L. Isenhower, D. D. Yavuz, T. G. Walker, and M. Saffman, Nature Physics 5, 110 (2009).
  * Gaëtan  _et al._ [2009] A. Gaëtan, Y. Miroshnychenko, T. Wilk, A. Chotia, M. Viteau, D. Comparat, P. Pillet, A. Browaeys, and P. Grangier, Nature Phys 5, 115 (2009).
  * Balewski  _et al._ [2014] J. B. Balewski, A. T. Krupp, A. Gaj, S. Hofferberth, R. Löw, and T. Pfau, New J. Phys. 16, 063012 (2014).
  * Recamier  _et al._ [2000] J. Recamier, O. Castaños, R. Jáuregui, and A. Frank, Phys. Rev. A 61, 063808 (2000).
  * Agarwal  _et al._ [1997] G. S. Agarwal, R. R. Puri, and R. P. Singh, Phys. Rev. A 56, 2249 (1997).
  * Song  _et al._ [2019] C. Song, K. Xu, H. Li, Y.-R. Zhang, X. Zhang, W. Liu, Q. Guo, Z. Wang, W. Ren, J. Hao, H. Feng, H. Fan, D. Zheng, D.-W. Wang, H. Wang, and S.-Y. Zhu, Science 365, 574 (2019), https://www.science.org/doi/pdf/10.1126/science.aay0600 .
  * Qin  _et al._ [2021] W. Qin, A. Miranowicz, H. Jing, and F. Nori, Phys. Rev. Lett. 127, 093602 (2021).
  * Johnson and Rolston [2010] J. E. Johnson and S. L. Rolston, Phys. Rev. A 82, 033412 (2010).
  * Glaetzle  _et al._ [2017] A. W. Glaetzle, R. M. W. van Bijnen, P. Zoller, and W. Lechner, Nat Commun 8, 15813 (2017).
  * Saßmannshausen  _et al._ [2016] H. Saßmannshausen, J. Deiglmayr, and F. Merkt, Eur. Phys. J. Spec. Top. 225, 2891 (2016).
  * Beterov  _et al._ [2009] I. I. Beterov, I. I. Ryabtsev, D. B. Tretyakov, and V. M. Entin, Phys. Rev. A 79, 052504 (2009).
  * S.Chaturvedi and V.Srinivasan [1991] S.Chaturvedi and V.Srinivasan, Journal of Modern Optics 38, 777 (1991).
  * D’Ariano  _et al._ [2000] G. D’Ariano, P. Lo Presti, and M. Sacchi, Physics Letters A 272, 32 (2000).
  * Alipour  _et al._ [2014] S. Alipour, M. Mehboudi, and A. T. Rezakhani, Phys. Rev. Lett. 112, 120405 (2014).
  * Qvarfort  _et al._ [2021] S. Qvarfort, M. R. Vanner, P. F. Barker, and D. E. Bruschi, Phys. Rev. A 104, 013501 (2021).
  * Keating  _et al._ [2016] T. Keating, C. H. Baldwin, Y.-Y. Jau, J. Lee, G. W. Biedermann, and I. H. Deutsch, Physical Review Letters 117, 10.1103/physrevlett.117.213601 (2016).
  * Bose  _et al._ [1997] S. Bose, K. Jacobs, and P. L. Knight, Physical Review A 56, 4175–4186 (1997).
  * Alexanian [2020] M. Alexanian, Mean number and number variance of squeezed coherent photons in a thermal state of photons (2020), arXiv:2004.07724 [quant-ph] .
  * Dirr and Helmke [2008] G. Dirr and U. Helmke, GAMM-Mitteilungen 31, 59 (2008).
  * Merkel [2009] S. Merkel,  _Quantum Control of D-Dimensional Quantum Systems with Application to Alkali Atomic Spins_ , Ph.D. thesis, The University of New Mexico (2009), arxiv:0906.4790 [quant-ph] .
  * Breuer and Petruccione [2002] H.-P. Breuer and F. Petruccione,  _The Theory of Open Quantum Systems_ (Oxford University Press, Oxford, 2002).

## Supplementary material

### Nonlinear parameters

In this appendix, we derive Eq. (4) and demonstrate how we calculate nonlinear
parameters $\mathcal{K}_{i\geq 2}$ in Eq. (2), so that with these parameters,
a coherent state may evolve into the cat state

$\displaystyle|\psi_{\mathrm{cat}}\rangle$
$\displaystyle=\frac{1-i}{2}|\alpha\rangle+\frac{1+i}{2}|-\alpha\rangle,$ (9)

that is a cat state of $\phi=\frac{\pi}{2}$, where $\phi$ is the phase
characterizing a particular cat state. The evolution of the coherent state
under nonlinearity has been visualized in Fig. 4.

Figure 4: Wigner function plots of a coherent state evolving into a cat state
under the nonlinearities. Without nonlinearity, the initial coherent state
(the blue spot in the upper-left figure) would only rotate along the red
circular path, which can be removed by going to a rotating frame about the
free evolution. With nonlinearity, which we chose the self-Kerr interaction
$\hat{H}=(\hat{a}^{\dagger}\hat{a})^{2}$ for simplicity, the initial coherent
state would be smeared during its evolution, and eventually turn into a cat
state. Here, we show two intermediate steps at $t=\frac{\pi}{12}$ and
$t=\frac{\pi}{6}$ to visualize how the coherent state gets smeared out. At
$t=\frac{\pi}{2}$, the smearing accumulates to the extent such that two blue
spots appears with several strips in between, and is called a cat state.

The key requirement for a coherent state to evolve into the cat state is to
make the time evolution $e^{-ip(n)t_{c}}$ dependent only on the parity of
number eigenstates at the time $t_{c}$, so that each parity corresponds to a
cat component ($|\alpha\rangle$ and $|-\alpha\rangle$ in our case). In other
words, if we take a factor of $\pi$ out of time such that $t_{c}=\pi
t_{c}^{\prime}$ for convenience, then we would want to find the product
$p(n)t_{c}^{\prime}$ such that:

$\displaystyle p(n)t_{c}^{\prime}=\begin{cases}0\ (\mathrm{mod}\ 2)\hskip
56.9055pt&n=\mathrm{even},\\\ \frac{1}{2}\ (\mathrm{mod}\
2)&n=\mathrm{odd},\end{cases}$ (10)

which produces the correct phase for the two cat components. Here, we use the
modulus notation $a\ (\mathrm{mod}\ 2)=a+2z$ where $z$ can be any integers,
because phase factors with a difference of $2z\pi$ give rise to the same
result.

To simplify our calculations later, we first rewrite $p(n)$ in another basis,
the so-called binomial basis:

$\displaystyle p(n)$
$\displaystyle=\sum_{j=2}^{m}\mathcal{K}_{j}n^{j}=\sum_{r=1}^{m}a_{r}\binom{n}{r},$
(11)

where $\mathcal{K}_{j}$ are coefficients of the j-th order nonlinearity shown
in Eq. (1), $a_{r}$ are coefficients of our new binomial basis, e.g.,
$\binom{n}{2}=\frac{n(n-1)}{2!}$. The transformation between coefficients of
the usual polynomial basis $n^{j}$ and the binomial basis $\binom{n}{r}$ can
be done via:

$\displaystyle\mathcal{K}_{j}$
$\displaystyle=\sum_{r=1}^{m}\frac{s(r,j)}{r!}a_{r},$ (12)

where $s(r,j)$ is Stirling number of the first kind.

Denoting $a_{r}t_{c}^{\prime}=\gamma_{r}$, we can insert $n=1,2,...,m$ into
the $p(n)$ in Eq. (10), and obtain $m$ equations about $\gamma_{1,2,...,m}$,
which can be solved when using the binomial basis for $p(n)$:

$\displaystyle\gamma_{1}$ $\displaystyle=\frac{1}{2}\ (\mathrm{mod}\ 2),$
$\displaystyle 2\gamma_{1}+\gamma_{2}$ $\displaystyle=0\ (\mathrm{mod}\ 2),$
$\displaystyle 3\gamma_{1}+3\gamma_{2}+\gamma_{3}$ $\displaystyle=\frac{1}{2}\
(\mathrm{mod}\ 2),$ $\displaystyle...,$
$\displaystyle\sum_{j=1}^{m}\gamma_{j}\binom{m}{j}$
$\displaystyle=\begin{cases}0\ (\mathrm{mod}\ 2)\hskip
14.22636ptm=\mathrm{even},\\\ \frac{1}{2}\ (\mathrm{mod}\ 2)\hskip
14.22636ptm=\mathrm{odd},\end{cases}$

where the first equation tells $\gamma_{1}=\frac{1}{2}\ (\mathrm{mod}\ 2)$,
which then implies that the second equation tells $\gamma_{2}=1\
(\mathrm{mod}\ 2)$, similarly the third equation tells $\gamma_{3}=0\
(\mathrm{mod}\ 2)$, and so on. In general, we have
$\gamma_{3}=\gamma_{4}=...=\gamma_{m}=0\ (\mathrm{mod}\ 2)$.

After finding all $\gamma_{j=1,2,...,m}$, we can choose, without loss of
generality, $\mathcal{K}_{m}=1$ to rescale our unit system such that
$\frac{\mathcal{K}_{j<m}}{\mathcal{K}_{m}}\rightarrow\mathcal{K}_{j<m}$ and
time $t\mathcal{K}_{m}\rightarrow t$ become dimensionless. This corresponds to
choose a specific timescale of the Hamiltonian, in which we can rewrite
$\mathcal{K}_{m}t_{c}^{\prime}=1t_{c}^{\prime}$ using Eq. (12):

$\displaystyle\sum_{r=1}^{m}\frac{s(r,m)}{r!}\gamma_{r}$
$\displaystyle=\frac{\gamma_{m}}{m!}=t_{c}^{\prime}.$ (13)

Since $\gamma_{r}$ in Eq. (13) has been calculated in the modulus form which
has infinitely many possible values, we want to find the specific values for
$\gamma_{r}$ such that the time $t_{c}^{\prime}$ in Eq. (13) is the shortest
possible time. We found that $t_{c}^{\prime}=\frac{\min\\{1\ (\mathrm{mod}\
2)\\}}{2}=\frac{1}{2}$ for $m=2$, and $t_{c}^{\prime}=\frac{\min\\{0\
(\mathrm{mod}\ 2)\\}}{m!}=\frac{2}{m!}$ for $m>2$. Thus, we find the shortest
possible time $t_{c,\mathrm{min}}$ taken by a coherent state to evolve into
the cat state under Eq. (1) to be:

$\displaystyle
t_{c,\mathrm{min}}=\begin{cases}\frac{\pi}{2\mathcal{K}_{2}}&\text{ for
$m=2$},\\\ \frac{2\pi}{\mathcal{K}_{m}m!}&\text{ for $m>2$}.\end{cases}$ (14)

To calculate other $\mathcal{K}_{n<m}$, we first note that Eq. (13) only
imposes a constraint to $\gamma_{m}$, which indirectly suggests that we are
free to take any values for other $\gamma_{1,2,...,m-1}$. In other words, we
can choose any values for $\gamma_{1,2,...,m-1}$ that satisfy their modulus
condition, e.g., $\gamma_{3}=2,4,6=0\ (\mathrm{mod}\ 2)$. However, in
practice, we always have constraints, such as lower order nonlinearities
sometimes can be either stronger, weaker, or equal to the m-th order
nonlinearity. Hence, we will need to solve the system consisting of Eq. (13)
and:

$\displaystyle|\mathcal{K}_{k<m}|t_{c}^{\prime}$
$\displaystyle\sim|\mathcal{K}_{m}|t_{c}^{\prime}=t_{c}^{\prime}$
$\displaystyle\left|\sum_{k=1}^{m}\frac{s(k,n)}{k!}\gamma_{k}\right|$
$\displaystyle\sim t_{c}^{\prime},$ (15)

where $\sim$ indicates possible constraints on lower order nonlinear strengths
$\mathcal{K}_{n<m}$, e.g., $\sim=\leq$ indicates
$|\mathcal{K}_{k<m}|\leq|\mathcal{K}_{m}|$ for some $n$.

### Master equation analysis

We have shown that cat states can be prepared in a very short time, during
which the influence of noise may be neglected. In this appendix, we assume
that we start with a perfect cat state and have turned off the nonlinearities
in the system such that its Hamiltonian is $\hat{H}=0$ in the rotating frame
about the free Hamiltonian. As discussed in the main text, it has been
previously shown experimentally and numerically that squeezing the cat-state
protects it from noise [14, 13]. Here, we take a closer look at how squeezing
the cat state would protect it from noise (namely 1-photon loss and
dephasing), and derive an optimal condition to maximize the protection from
squeezing. We achieve this by analytically solving the Lindblad equation for
1-photon loss and dephasing.

We first show that 1-photon loss and dephasing induce an $\mathfrak{su}(1,1)$
algebra by extending the results in [37], and hence the vectorized Lindblad
equation reads [38, 39, 40]

$\displaystyle\frac{d}{dt}|\hat{\rho}(t)\rrangle$
$\displaystyle=\left(-\frac{\kappa_{1\mathrm{ph}}}{2}\hat{K}_{3}-\frac{\kappa_{\phi}}{2}\hat{K}_{0}^{2}+\kappa_{1\mathrm{ph}}\hat{K}_{-}\right)|\hat{\rho}(t)\rrangle,$
(16)

where $\kappa_{1\mathrm{ph}}$ and $\kappa_{\phi}$ are 1-photon loss and
dephasing respectively, and

$\displaystyle\hat{K}_{-}$ $\displaystyle=\hat{a}\otimes\hat{a},$
$\displaystyle\hat{K}_{0}$
$\displaystyle=\hat{a}^{\dagger}\hat{a}\otimes\mathds{1}-\mathds{1}\otimes\hat{a}^{\dagger}\hat{a},$
$\displaystyle\hat{K}_{3}$
$\displaystyle=\hat{a}^{\dagger}\hat{a}\otimes\mathds{1}+\mathds{1}\otimes\hat{a}^{\dagger}\hat{a}.$
(17)

Here, we have grouped different terms in the Lindblad equation to emphasize
its $\mathfrak{su}(1,1)$ structure that is usually denoted as
$\mathfrak{su}(1,1)=\\{\hat{K}_{0},\hat{K}_{3},\hat{K}_{+},\hat{K}_{-}\\}$. In
our case, $\hat{K}_{+}=\hat{a}^{\dagger}\otimes\hat{a}^{\dagger}$ would
correspond to a thermalized environment that also pumps thermal photons to the
system. For simplicity, we choose to use the Lindblad equation that assumes a
“cold” environment with no thermal photons $\bar{n}=0$, (e.g., an optical
system which has its stationary state being the vacuum state, or a
superconducting system which is cooled to nearly 0K), but one can still
proceed similarly as the followings to obtain a similar solution for the
master equation with $\bar{n}\neq 0$.

We note the ansatz that the exact solution to Eq. (16) is

$\displaystyle|\hat{\rho}(t)\rrangle$
$\displaystyle=\hat{\mathcal{S}}(t)|\hat{\rho}(0)\rrangle,$ (18)

where
$\hat{\mathcal{S}}(t)=e^{F_{0}(t)\hat{K}_{0}^{2}}e^{F_{3}(t)\hat{K}_{3}}e^{F_{-}(t)\hat{K}_{-}}$,
with $F_{0}$, $F_{3}$ and $F_{-}$ time dependent functions. We calculate
$F_{0}$, $F_{3}$ and $F_{-}$ by evaluating
$\left(\frac{d}{dt}\hat{\mathcal{S}}(t)\right)\hat{\mathcal{S}}^{-1}(t)$: we
can either insert Eq. (18) back to Eq. (16), or work directly with the
expression of $\hat{\mathcal{S}}(t)$ from Eq. (18). If we equate the results
from both ways, we obtain

$\displaystyle-\frac{\kappa_{1\mathrm{ph}}}{2}\hat{K}_{3}+\kappa_{1\mathrm{ph}}\hat{K}_{-}$
$\displaystyle=\dot{F}_{3}(t)\hat{K}_{3}+\dot{F}_{-}(t)e^{-2F_{3}(t)}\hat{K}_{-},$
(19)

where we have made use of the fact that $\hat{K}_{0}$ is the Casimir element
which commutes with all other operators, so that we can take its term out:

$\displaystyle F_{0}(t)=-\frac{\kappa_{\phi}}{2}t.$ (20)

Equating the coefficients for $\hat{K}_{3}$ and $\hat{K}_{-}$, we obtain

$\displaystyle F_{3}(t)$ $\displaystyle=-\frac{\kappa_{1\mathrm{ph}}}{2}t,$
$\displaystyle F_{-}(t)$ $\displaystyle=1-e^{-\kappa_{1\mathrm{ph}}t}.$ (21)

Put all these together, we get

$\displaystyle\hat{\mathcal{S}}(t)$
$\displaystyle=e^{-\frac{\kappa_{\phi}}{2}\hat{K}_{0}^{2}t}e^{-\frac{\kappa_{1\mathrm{ph}}}{2}\hat{K}_{3}t}e^{(1-e^{-\kappa_{1\mathrm{ph}}t})\hat{K}_{-}}.$
(22)

To determine the impact of noises during a time period $t$, we use the notion
of overlap. The overlap between the squeezed state in the system and the
target squeezed cat state is

$\displaystyle\mathcal{V}(t)$
$\displaystyle=\llangle\psi_{\mathrm{cat}}|\hat{S}^{-1}(r,\phi)\hat{\mathcal{S}}(t)\hat{S}(r,\phi)|\psi_{\mathrm{cat}}\rrangle,$
(23)

where
$\hat{S}(r,\phi)=e^{\frac{1}{2}r(e^{-i\phi}\hat{a}^{2}-e^{i\phi}\hat{a}^{{\dagger}2})}$
is the squeezing operator with the squeezing strength $r$ and phase $\phi$.

For small $\kappa_{1\mathrm{ph}}t$ and $\kappa_{\phi}t$, we can expand Eq.
(22) up to the second order about $\kappa_{1\mathrm{ph},\phi}$ and evaluate
the overlap:

$\displaystyle\mathcal{V}(t)$ $\displaystyle\approx
1-\kappa_{1\mathrm{ph}}\langle\hat{N}\rangle-\kappa_{\phi}(\langle\hat{N}^{2}\rangle-\langle\hat{N}\rangle^{2})$
$\displaystyle\hskip
5.69046pt+\frac{\kappa_{1\mathrm{ph}}^{2}}{4}\left(\langle\hat{N}^{2}\rangle+\langle\hat{N}\rangle^{2}+2|\langle\hat{a}^{2}\rangle|^{2}\right)$
$\displaystyle\hskip
5.69046pt+\frac{\kappa_{\phi}^{2}}{4}\left(\langle\hat{N}^{4}\rangle+3\langle\hat{N}^{2}\rangle^{2}-4\langle\hat{N}^{3}\rangle\langle\hat{N}\rangle\right)$
$\displaystyle\hskip
5.69046pt+\frac{\kappa_{1\mathrm{ph}}\kappa_{\phi}}{2}\left(\langle\hat{N}^{3}\rangle-\langle\hat{N}\rangle\langle\hat{N}^{2}\rangle\right),$
(24)

where $\hat{N}=\hat{a}^{\dagger}\hat{a}$, and $\langle\hskip
2.84544pt\bullet\hskip 2.84544pt\rangle$ is the expectation value with respect
to the squeezed cat state. In general, we note that any type of decay of the
form $\sqrt{\kappa_{D}}\hat{D}$ would contribute a linear term
$-\kappa_{D}(\langle\hat{D}^{\dagger}\hat{D}\rangle-\langle\hat{D}\rangle^{2})$
to the expression of $\mathcal{V}(t)$.

### Adiabatic elimination

In this appendix, we consider a collection of identical Rydberg atoms with the
atomic energy levels shown in Fig. 3 (a), and show that such an atomic
ensemble exhibit nonlinearities in Eq. (1). As shown in Fig. 3 (a), each atom
has three energy levels: ground $|g\rangle$, excited $|e\rangle$ and Rydberg
states $|r\rangle$, and two atoms $i$ and $j$ interact with each other via
$V_{ij}$ when both are in Rydberg states $|r_{i}\rangle\otimes|r_{j}\rangle$.
The intuition for the presence of nonlinearities lies in the fact that the
energy $E$ of the ensemble does not depend linearly on the number of atoms in
Rydberg states $k$, but $E\propto\frac{k^{2}-k}{2}V_{ij}$. The nonlinear
dependence gets even more complicated in terms of the number of atoms in
excited states, due to the laser that drives the transition between excited
and Rydberg states. Here, we derive an expression of the nonlinear Hamiltonian
by adiabatically eliminating Rydberg states from the ensemble, and show the
nonlinearity of the system in the number of atoms in excited states.

We start from the raw Hamiltonian of the ensemble containing N atoms

$\displaystyle\hat{H}_{\mathrm{raw}}$
$\displaystyle=\frac{\Omega_{er}}{2}\sum_{i=1}^{N}(\hat{\sigma}_{i}^{re}+\hat{\sigma}_{i}^{er})-\Delta\hat{\sigma}_{i}^{rr}+\frac{V}{2}\sum_{j\neq
i}^{N}\hat{\sigma}_{i}^{rr}\hat{\sigma}_{j}^{rr}.$ (25)

where $\Omega_{er}$ is the Rabi frequency of the laser driving the transition
between excited and Rydberg states and $\Delta$ is the detuning of the laser,
$\hat{\sigma}_{i}^{xy}=|x\rangle\langle y|$ are jump operators for the i-th
atom, and we assume a constant Rydberg interaction $V_{ij}=V$. The Schrödinger
equation for only the $i$-th atom being at the Rydberg state $|r_{i}\rangle$
is

$\displaystyle i\frac{d}{dt}|r_{i}\rangle$
$\displaystyle=\frac{\Omega_{er}}{2}|e_{i}\rangle-\left(\Delta-\frac{(N_{r}-1)}{2}V\right)|r_{i}\rangle,$
(26)

where $N_{r}$ denotes the number of Rydberg states.

The assumption of adiabatic elimination $|\Delta|>>\Omega_{er}$ enters as we
equate Eq. (26) to zero, which is similar to the elimination of the fast
oscillating mode from the system:

$\displaystyle|r_{i}\rangle$
$\displaystyle=\frac{\Omega_{er}}{2\left(\Delta-\frac{(N_{r}-1)}{2}V\right)}|e_{i}\rangle.$
(27)

Now, we need to consider case by case. The first case is that the system has
no atoms at Rydberg states, in which we can write the Schrödinger equation for
the i-th atom being at the excited state as

$\displaystyle i\frac{d}{dt}|e_{i}\rangle$
$\displaystyle=\frac{\Omega_{er}}{2}|r_{i}\rangle\stackrel{{\scriptstyle\mathrm{Eq.}\eqref{Eq16}}}{{=}}\frac{\Omega_{er}^{2}}{4\Delta}|e_{i}\rangle,$
(28)

and obtain the single-body Hamiltonian

$\displaystyle\hat{H}_{eff}^{1}=\frac{\Omega_{er}^{2}}{4\Delta}\sum_{i}^{N}\hat{\sigma}_{i}^{ee}=\frac{\Omega_{er}^{2}}{4\Delta}\hat{N}_{e},$
(29)

where $\hat{N}_{e}=\sum_{i}^{N}\hat{\sigma}_{i}^{ee}$ denotes the number
operator counting the number of excited states.

Similarly, the second case is that the system has one Rydberg state, then

$\displaystyle
i\frac{d}{dt}|e_{i},r_{j}\rangle-i\left(\frac{d}{dt}|e_{i}\rangle\right)\otimes|r_{j}\rangle=\bigg{[}\frac{\Omega_{er}^{3}}{8\Delta(\Delta-\frac{V}{2})}-\frac{\Omega_{er}^{3}}{8\Delta^{2}}\bigg{]}|e_{i},e_{j}\rangle,$
(30)

where we subtract the single body terms from the two body term to obtain the
pure two body interaction. The Hamiltonian corresponding to the two body
interaction is

$\displaystyle\hat{H}_{eff}^{2}$
$\displaystyle=\bigg{(}\frac{\Omega_{er}^{3}}{8\Delta(\Delta-\frac{V}{2})}-\frac{\Omega_{er}^{3}}{8\Delta^{2}}\bigg{)}\sum_{\begin{subarray}{c}i,j\\\
i\neq j\end{subarray}}\hat{\sigma}_{i}^{ee}\hat{\sigma}_{j}^{er},$ (31)

but $\hat{\sigma}^{er}=|e\rangle\langle
r|=\frac{\Omega_{er}}{2\Delta}|e\rangle\langle
e|=\frac{\Omega_{er}}{2\Delta}\hat{\sigma}^{ee}$, so we eventually have

$\displaystyle\hat{H}_{eff}^{2}$
$\displaystyle=\frac{\Omega_{er}}{2\Delta}\bigg{(}\frac{\Omega_{er}^{3}}{8\Delta(\Delta-\frac{V}{2})}-\frac{\Omega_{er}^{3}}{8\Delta^{2}}\bigg{)}\binom{\hat{N}_{e}}{2},$
(32)

where $\binom{\hat{N}_{e}}{2}$ denotes the binomial representation of
$\frac{\hat{N}_{e}(\hat{N}_{e}-1)}{2}$.

We can obtain $\hat{H}_{eff}^{j>2}$ by proceeding similarly for other cases in
which there are two or more Rydberg states in the ensemble. Summing up all the
Hamiltonians $\hat{H}_{eff}^{j}$, we have

$\displaystyle\hat{H}_{eff}$ $\displaystyle=\sum_{i=1}^{N}\hat{H}_{eff}^{i},$
$\displaystyle=\sum_{n=1}^{N}\underbrace{\left(\sum_{m=0}^{N-1}s(m+1,n)f(m)\right)}_{\mathcal{K}_{n}}\hat{N}_{e}^{n}=\sum_{n=1}^{N}\mathcal{K}_{n}\hat{N}_{e}^{n},$
(33)

where $s(m,n)$ is the Stirling number of the first kind, and

$\displaystyle f(m)$
$\displaystyle=\begin{cases}\frac{\Omega_{er}^{2}}{4\Delta}&m=0,\\\
\frac{1}{(m-1)!}\frac{V\Omega_{er}^{2+2m}}{2^{3+2m}\Delta(\Delta-\frac{m}{2}V)\prod_{k=1}^{m}(\Delta-\frac{k-1}{2}V)^{2}}\hskip
14.22636pt&\text{else}.\end{cases}$ (34)

For example, the strength of $\mathcal{K}_{2}$ is plotted in Fig. 5. Similar
plots apply for $\mathcal{K}_{i\geq 3}$. As shown in the figure, stronger
nonlinearities occur near the multiphoton resonance regions, where the
assumptions for adiabatic elimination break down and the effective Hamiltonian
loses its accuracy. We therefore want to examine several regions to show that
we can obtain stronger higher order nonlinearities while the effective
Hamiltonian remains accurate, and results are given in Table. 1.

Figure 5: Strenght of $\mathcal{K}_{2}$ for varying $\Delta$ and $V$. The horizontal band around $\Delta=0$ corresponds to the single photon resonance. One could find large second order nonlinearites here, but it is also where the approximation $|\Delta|>>\Omega_{er}$ breaks down and where we expect large losses from the high r state admixture. The upper left and lower right quadrants (away from $\Delta\sim 0$) represent relatively ”stable” regions but with correspondingly weak nonlinearities. The (strong) Rydberg blockade condition is expected for $|V|>>|\Delta|,\text{ }\Omega_{er}$ (far left or right of graph). Radiating ”rays” from the center correspond to multiphoton resonances where $\mathcal{K}_{2}$ diverges, e.g., $\Delta-\frac{m}{2}V=0$ associated to the $m+1$-photon resonance. To minimize collective losses, one should also avoid these rays. But in between one can obtain relatively strong nonlinearities, including potentially interesting higher order nonlinearities ($\mathcal{K}_{3}$, $\mathcal{K}_{4}$, etc.). Sym. | $\mathcal{K}_{2}[\mathrm{MHz}]$ | $\mathcal{K}_{3}[\mathrm{MHz}]$ | $\mathcal{K}_{4}[\mathrm{MHz}]$ | $\tau[\mu s]$ | $t_{c}[\mu s]$ |  $\epsilon$ [MHz]
---|---|---|---|---|---|---
- | 0.34938 | 0 | 0 | 570.75 | 0.91 | 0.67451
$\blacksquare$ | 0.88096 | 0.02643 | 0.00001 | 496.27 | 0.22 | 2.90457
$\blacksquare$ | 0.63003 | 0.63002 | 0.02169 | 201.03 | 0.10 | 10.95341
$\blacktriangle$ | 0 | 0.08088 | 0.00343 | 374.15 | 0.6 | 0.90703
$\bullet$ | -0.10195 | 0.10195 | 0.00194 | 299.04 | 0.6 | 1.09153
Table 1: Table for the selected points in Fig. 5, and an extra point out of
the figure (labeled as $-$). The first three columns are strengths of
nonlinearities $\mathcal{K}_{2}$, $\mathcal{K}_{3}$ and $\mathcal{K}_{4}$,
$\tau$ is the lifetime calculated by considering the Rydberg decay rate
$\gamma/2\pi=1.5\text{ kHz}$, $t_{c}$ is the preparation time of cat states
obtained from the optimal control, and $\epsilon$ is the ground state energy
difference per atom between the full Hamiltonian and the effective
Hamiltonian, to quantify the error caused by the assumptions of adiabatic
elimination.

Furthermore, We may also add a laser with Rabi frequency $\Omega_{eg}$ driving
the transition between ground and excited states:

$\displaystyle\hat{H}_{eff}^{\prime}$
$\displaystyle=\hat{H}_{eff}+\frac{\Omega_{eg}}{2}\sum_{i}\left(\hat{\sigma}_{i}^{eg}+\hat{\sigma}_{i}^{ge}\right).$
(35)

We define Fock states to be the number of excited atoms in symmetrized Dicke
states [41]

$\displaystyle|n\rangle$ $\displaystyle=\\{|g\rangle^{\otimes
N-n}\otimes|e\rangle^{\otimes n}\\}_{\mathrm{sym}},$ (36)

then the atomic operators in Eq. (35) become

$\displaystyle\sum_{i}\hat{\sigma}_{i}^{eg}$
$\displaystyle=\hat{a}^{\dagger},$
$\displaystyle\sum_{i}\hat{\sigma}_{i}^{ge}$ $\displaystyle=\hat{a},$ (37)

such that

$\displaystyle\hat{a}^{\dagger}|n\rangle$
$\displaystyle=\sqrt{(n+1)(N-n-1)}|n+1\rangle,$
$\displaystyle\hat{a}|n\rangle$ $\displaystyle=\sqrt{n(N-n+1)}|n-1\rangle.$
(38)

This is atomic analogue of the coherent drive for $\mathfrak{su}(2)$ algebra
(the creation and annihilation operators here have slightly different actions
on Fock states to ensure the $SU(2)$ symmetry) to generate atomic coherent
states, and we can make it controllable e.g.,
$\epsilon(t)\hat{a}+\epsilon^{*}(t)\hat{a}^{\dagger}$ to realize the full
controllability of the system [41]. Note that in the main context, we instead
use the notation $\hat{a}^{\dagger}\otimes\hat{a}$ with the usual definition
of creation and annihilation operators to avoid confusion.

### Optimized squeezing

Eq. (6) suggests that the optimal squeezing to maximally protect the cat state
from 1-photon loss and dephasing occurs at around the minimum 1-st and 2-nd
cumulants of the number operator $\hat{a}^{\dagger}\hat{a}$ respectively.
Hence, it is sufficient to calculate $\langle\hat{a}^{\dagger}\hat{a}\rangle$
and $\langle(\hat{a}^{\dagger}\hat{a})^{2}\rangle$ with respect to the
squeezed cat state $|\psi_{\mathrm{SqCat}}\rangle$ in this appendix, and the
first two cumulants $K^{(1)}=\langle\hat{a}^{\dagger}\hat{a}\rangle$ and
$K^{(2)}=\langle(\hat{a}^{\dagger}\hat{a})^{2}\rangle-\langle\hat{a}^{\dagger}\hat{a}\rangle$
can be minimized with mathematical softwares.

We first denote the squeezed c-component cat state that can be obtained in
Yurke-Stoler’s method, with the fractional revival method, as [42]:

$\displaystyle|\psi_{\mathrm{SqCat}}^{c}\rangle$
$\displaystyle=\hat{S}(r,\phi)e^{\pm
i\frac{\pi}{c}(\hat{a}^{\dagger}\hat{a})^{2}}|\alpha\rangle,$ (39)

where
$\hat{S}(r,\phi)=e^{\frac{1}{2}r(e^{-i\phi}\hat{a}^{2}-e^{i\phi}\hat{a}^{{\dagger}2})}$
is the squeezing operator.

Without loss of generality, we also assume $\alpha$ to be real. With this, we
found

$\displaystyle\langle\hat{a}^{\dagger}\hat{a}\rangle$
$\displaystyle=\langle\psi_{\mathrm{SqCat}}^{c}|\hat{a}^{\dagger}\hat{a}|\psi_{\mathrm{SqCat}}^{c}\rangle,$
$\displaystyle=\sinh^{2}(r)+\alpha^{2}\cosh(2r)-\frac{1}{2}\sinh(2r)\alpha^{2}A,$
(40)

and

$\displaystyle\langle(\hat{a}^{\dagger}\hat{a})^{2}\rangle$
$\displaystyle=\langle\psi_{\mathrm{SqCat}}^{c}|(\hat{a}^{\dagger}\hat{a})^{2}|\psi_{\mathrm{SqCat}}^{c}\rangle,$
$\displaystyle=\alpha^{2}(1+\alpha^{2})\cosh^{2}(2r)+\sinh^{4}(r)$
$\displaystyle\hskip
5.69046pt+2\alpha^{2}\sinh^{2}(r)\left(\cosh(2r)-\frac{1}{2}\sinh(2r)A\right)$
$\displaystyle\hskip
5.69046pt-\frac{1}{4}\sinh(4r)\alpha^{2}B+\frac{1}{4}\sinh^{2}(2r)C,$ (41)

where

$\displaystyle A$
$\displaystyle=2e^{-\alpha^{2}}\text{Re}[e^{-i\phi}e^{i\frac{4\pi}{c}}e^{\alpha^{2}e^{i\frac{4\pi}{c}}}],$
$\displaystyle B$
$\displaystyle=2e^{-\alpha^{2}}Re\bigg{[}e^{-i\phi}e^{i\frac{4\pi}{c}}e^{\alpha^{2}e^{i\frac{4\pi}{c}}}(\alpha^{2}+2+\alpha^{2}e^{i\frac{4\pi}{c}})\bigg{]},$
$\displaystyle C$
$\displaystyle=2(\alpha^{2}+1)^{2}+2\alpha^{4}e^{-\alpha^{2}}Re\bigg{[}e^{-2i\phi}e^{i\frac{16\pi}{c}}e^{\alpha^{2}e^{i\frac{8\pi}{c}}}\bigg{]}.$
(42)

$K^{(2)}$ or the photon number variance $\sigma_{N}^{2}$ of the system is then

$\displaystyle\sigma_{N}^{2}$
$\displaystyle=\langle(\hat{a}^{\dagger}\hat{a})^{2}\rangle-\langle\hat{a}^{\dagger}\hat{a}\rangle^{2},$
$\displaystyle=\alpha^{2}\cosh^{2}(2r)-\frac{1}{2}\cosh(2r)\sinh(2r)\alpha^{2}(B-2\alpha^{2}A)$
$\displaystyle\hskip 5.69046pt+\frac{1}{4}\sinh^{2}(2r)(C-\alpha^{4}A^{2}).$
(43)

Note that for the 2-component cat state $c=2$, Eq. (40)-(42) are identical to
that of the squeezed coherent states calculated in [43].

Finally, the optimal squeezing condition can be calculated by minimizing (40)
and Eq. (42) with some mathematical softwares.

### Controllability

In this appendix, we want to show that a linearly driven Kerr Hamiltonian of
the form

$\displaystyle\hat{H}$
$\displaystyle=\mathcal{K}_{2}\hat{a}^{{\dagger}2}\hat{a}^{2}+\epsilon_{1}(t)(\hat{a}^{\dagger}+\hat{a}),$
(44)

is controllable. In other words, if we are able to control the pulse
$\epsilon(t)$ of the linear drive, then we can realize any quantum states of
the system regardless of the initial state. To be more precise, since the
Hilbert space of Eq. (44) is infinite dimensional, we will show that the
Hamiltonian is approximate controllable, meaning the actual state produced may
only have a fidelity that is infinitesimally close to 1, but is never 1.

To illustrate this, we first define the controllability of a system. A system
of the form

$\displaystyle i\frac{\partial}{\partial t}\hat{U}(t)$
$\displaystyle=[\hat{H}_{0}+\sum_{k}u_{k}(t)\hat{H}_{k}]\hat{U}(t),$ (45)

is controllable if $\\{-i\hat{H}_{0},-i\hat{H}_{1},...,-i\hat{H}_{k}\\}$ is a
generating set of the $\mathfrak{su}(d)$ Lie algebra with its elements being
skew symmetric, where $d$ is the dimension of the system Hilbert space [44].

Considering the system in Eq. (44), we can identify

$\displaystyle\hat{H}_{0}$
$\displaystyle=\mathcal{K}_{2}\hat{a}^{{\dagger}2}\hat{a}^{2},$
$\displaystyle\hat{H}_{1}$ $\displaystyle=\hat{a}^{\dagger}+\hat{a}\hskip
14.22636pt$ $\displaystyle u_{1}(t)=\epsilon_{1}(t).$ (46)

We first obtain the term $-i\hat{H}_{2}=\hat{a}^{\dagger}-\hat{a}$ by

$\displaystyle i^{4}[[[\hat{H}_{0},\hat{H}_{1}],\hat{H}_{1}],\hat{H}_{1}]$
$\displaystyle=-12\mathcal{K}_{2}(\hat{a}^{\dagger}-\hat{a}).$ (47)

Then, we obtain the operator representation of the $\mathfrak{su}(2)$ algebra
by

$\displaystyle i^{3}[[\hat{H}_{0},\hat{H}_{1}],\hat{H}_{2}]$
$\displaystyle=2\mathcal{K}_{2}(\hat{a}^{{\dagger}2}-\hat{a}^{2}),$
$\displaystyle
i^{3}\left([[\hat{H}_{0},\hat{H}_{1}],\hat{H}_{1}]-[[\hat{H}_{0},\hat{H}_{2}],\hat{H}_{2}]\right)$
$\displaystyle=4\mathcal{K}_{2}i(\hat{a}^{{\dagger}2}+\hat{a}^{2}).$ (48)

Now, we can recover the $\mathfrak{su}(2)$ algebra by identifying

$\displaystyle\hat{J}_{x}$
$\displaystyle=\frac{\hat{a}^{{\dagger}2}-\hat{a}^{2}}{4},$
$\displaystyle\hat{J}_{y}$
$\displaystyle=i\frac{\hat{a}^{{\dagger}2}+\hat{a}^{2}}{4},$
$\displaystyle\hat{J}_{z}$
$\displaystyle=[\hat{J}_{x},\hat{J}_{y}]=-\frac{i}{4}\left(\hat{a}^{\dagger}\hat{a}+\frac{1}{2}\right),$
(49)

which we have shown to be obtainable.

To recover the $\mathfrak{su}(d>2)$ algebra, we look for an operator $\hat{h}$
such that it has non-zero overlap with the rank-3/2 tensor $T_{1/2}^{(3/2)}$
(modified from Theorem 1 of [45]), e.g.,
$\mathrm{Tr}\\{\hat{h}T_{q}^{(3/2)}\\}\neq 0$. Here, a rank-$k/2$ tensor
$T_{q}^{(k/2)}$ is simply the product of k mixed creation and annihilation
operators. It is easy to find one such operator:

$\displaystyle\hat{h}$
$\displaystyle=[\hat{a}^{{\dagger}2}\hat{a}^{2},\hat{H}_{1}]=\hat{a}^{{\dagger}2}\hat{a}-\hat{a}^{\dagger}\hat{a}^{2}.$
(50)

Hence, we show that the system Eq. (44) is (operator) controllable. The
intuition of the proof is that one can commute and sum around the operators
$\hat{H}_{1,2}$ (lower the rank by 1/2), $\hat{J}_{x,y}$ (stabilizing the
rank) and $\hat{h}$ (raise the rank by 1/2) to generate all possible skew
symmetric operators of arbitrary ranks.

### Open system simulation for quantum control

One of the main reasons to speed up the preparation time of the cat states is
to improve robustness against dissipation. In the following, we demonstrate
how the optimized results presented in Fig. 1 perform under dissipation.

To analyze the impact of the dissipation we use the Gorini-Kossakowski-
Sudarshan-Lindblad master equation to model our system [46]:

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}\hat{\rho}(t)$
$\displaystyle=-i\big{[}\hat{H}(t),\hat{\rho}(t)\big{]}$
$\displaystyle+\kappa_{1\mathrm{ph}}\Big{(}\hat{a}\hat{\rho}(t)\hat{a}^{\dagger}-\frac{1}{2}\big{\\{}\hat{a}^{\dagger}\hat{a},\hat{\rho}(t)\big{\\}}\Big{)}$
$\displaystyle+\kappa_{\phi}\Big{(}\hat{a}\hat{a}^{\dagger}\hat{\rho}(t)\hat{a}\hat{a}^{\dagger}-\frac{1}{2}\big{\\{}\big{(}\hat{a}\hat{a}^{\dagger}\big{)}^{2},\hat{\rho}(t)\big{\\}}\Big{)}\,,$
(51)

where $\hat{\rho}(t)$ is the density operator of the system and,
$\kappa_{1\mathrm{ph}}$ and $\kappa_{\phi}$ are the rate of 1-photon loss and
the dephasing, respectively.

Figure 6: Results from Fig. 1, propagated with dissipation
$\kappa_{\mathrm{1ph}}=\kappa_{\phi}=3\times 10^{-3}\mathcal{K}_{2}$. Due to
open system dynamics, the fidelity is generalized to
$F(\hat{\rho},\hat{\sigma})=\mathrm{Tr}\left\\{\sqrt{\sqrt{\hat{\rho}}\hat{\sigma}\sqrt{\hat{\rho}}}\right\\}^{2}$.

Fig. 6 shows the optimized results from Fig. 1 taking dissipation into
account. For the dissipation strength we choose
$\kappa_{1\mathrm{ph}}=\kappa_{\phi}=3\times 10^{-3}\mathcal{K}_{2}$. For all
points the error, measured by the infidelity, increases substantially.
However, the dash-dotted yellow curve, corresponding to the results for
$\mathcal{K}_{3}=\mathcal{K}_{2}$, stands out, as it performs best of all
curves. This is not surprising, as we already found that larger
$\mathcal{K}_{3}$ allow for faster preparation of the cat state, as we have
already observed in Fig. 1. This leads to a smaller deterioration of the
optimized pulse due to dissipation and therefore smaller infidelities.
Notably, the curve exhibits a plateau within
$T\in[0.4\mathcal{K}_{2},1.0\mathcal{K}_{2}]$, which is due to the
optimization strategy of the corresponding pulses. This strategy, which we
observe for all data points on the plateau, is to keep the system in the
ground state for as long as possible, while initiating the preparation only at
the very end of the preparation period. As the ground state is protected
against decay and the preparation time at the end of the pulse duration takes
place on very similar time scales, taking dissipation into account yields
comparable errors among the results of the plateau region. This demonstrates
that the shorter pulse duration induced by the increase of $\mathcal{K}_{3}$
enhances the robustness of the preparation against dissipation.


# Privacy Regularization: Joint Privacy-Utility Optimization in Language
Models

Fatemehsadat Mireshghallah1, Huseyin A. Inan3, Marcello Hasegawa2,
Victor Rühle2, Taylor Berg-Kirkpatrick1, Robert Sim3
1 University of California San Diego, 2 Microsoft Corporation, 3 Microsoft
Research
{fatemeh<EMAIL_ADDRESS>
{huseyin.inan, marcellh, virueh<EMAIL_ADDRESS>
Work done as part of an MSR internship.

###### Abstract

Neural language models are known to have a high capacity for memorization of
training samples. This may have serious privacy implications when training
models on user content such as email correspondence. Differential privacy
(DP), a popular choice to train models with privacy guarantees, comes with
significant costs in terms of utility degradation and disparate impact on
subgroups of users. In this work, we introduce two privacy-preserving
regularization methods for training language models that enable joint
optimization of utility and privacy through (1) the use of a discriminator and
(2) the inclusion of a novel triplet-loss term. We compare our methods with DP
through extensive evaluation. We show the advantages of our regularizers with
favorable utility-privacy trade-off, faster training with the ability to tap
into existing optimization approaches, and ensuring uniform treatment of
under-represented subgroups.

##  1 Introduction

Figure 1: Workflow of our adversarial training regularization. The last hidden
state ($h_{x}$) of the LM is fed to the discriminator to generate a
distribution over the authors ($p_{d}$). $p_{d}$ is used to compute
$\mathcal{L}_{\textsc{LM-P}}$, the privacy loss.

Neural language models Bengio et al. (2003); Mikolov et al. (2010) have
recently seen significant gains in capabilities, and are deployed at scale in
several real-world scenarios Chen et al. (2019); Adam et al. (2020). Training
these models on domain-specific user data can further improve their utility.
The volume of data required, coupled with the inherent sparsity of natural
language which often means all data are unique, opens the door to an array of
privacy attacks against models and their training data. Sample memorization
poses a substantial risk by enabling model inversion attacks Carlini et al.
(2020); Ramaswamy et al. (2020); Inan et al. (2021). In these attacks, a
curious or malevolent user can query a pre-trained language model on any data
record with the intention of reconstructing (parts of) training samples111A
naïve example is an attacker querying “My account number is” and hoping to
receive a user’s account number..

Differential Privacy (DP) Dwork (2006) is the gold standard approach to
address this issue, thanks to its strong and rigorous privacy guarantees. DP-
SGD Abadi et al. (2016) is a popular method to train neural models with
differential privacy guarantees and it works by clipping of the gradients and
addition of noise in each update, which provides worst-case guarantees that
reflect the likelihood of leaking any attribute of any member of the dataset
into the trained model. The worst-case guarantees of differential privacy are
not customizable, in other words, they cannot be relaxed to protect only
certain attributes. Therefore, DP incurs significant loss to model utility
Tramèr and Boneh (2020). DP training of models is also much slower, with
cumbersome hyper-parameter tuning and development Wu et al. (2017); Subramani
et al. (2020). It has also been shown that DP’s utility loss is much worse for
under-represented groups Bagdasaryan et al. (2019); Farrand et al. (2020),
which can have financial and societal ramifications Pujol et al. (2020).

To address these issues, we relax the strong assumptions of the DP threat
model and assume an adversary with finite-capacity (finite statistical,
compute, and side information) who attempts to recover sensitive user-level
information from the trained model Carlini et al. (2019). We propose two
privacy regularization methods, one based on adversarial training and another
on a novel privacy loss term, to jointly optimize for privacy and utility of
language models. The main idea of our regularizers is to prevent the last
hidden state representation of the language model for an input sequence $x$
from being linked back to the sensitive attribute we are trying to protect, in
our case, the identity of the author. We use the last hidden state as it
corresponds to the embedding of the sequence $x$.222Although we consider
recurrent neural network-based language models in this work, our approach is
applicable in transformer-based language models as well. In the latter, one
can consider the representation corresponding to the special token [CLS] as
the embedding of the sequence $x$. We consider the linkability of the input
representation to the sensitive attribute (author) as a proxy since it is
commensurate with the linked and linkable information definitions in the
General Data Protection Regulation GDPR Article 29 Working Party (2014). By
framing privacy as an optimization problem, we can apply the well-developed
machinery of large-scale gradient-based optimization, enabling us to train
models at scale while jointly tuning for an optimal privacy-utility trade-off.

To validate our approach, we develop an evaluation framework for assessing a
model’s privacy loss. We employ the exposure metric introduced in Carlini et
al. (2019) and introduce a reconstruction (tab) attack as a realistic scenario
to evaluate and compare LSTM language models trained using our regularization
with those trained with differential privacy, on Avocado Oard et al. (2015)
and Reddit Völske et al. (2017) datasets. We also empirically demonstrate
that, unlike DP, our technique does not have disparate impacts on under-
represented groups.

Our work is closely related to Coavoux et al. (2018) and Li et al. (2018).
Coavoux et al. consider an attacker who eavesdrops on the hidden
representations of a pre-trained model during inference and tries to recover
information about the input text. Adversarial training is used as a mitigation
to reduce the attacker’s performance Wang et al. (2019). Li et al. use
adversarial training to protect private author attributes such as age or
gender, in learned text representations for part-of-speech tagging and
sentiment analysis to gain better performance on out-of-domain corpora. We, on
the other hand, use adversarial training and a triplet-based regularization to
train private language models that do not memorize sensitive user information,
which has not been explored before. We evaluate our models accordingly, by
trying to extract training samples. Prior work has studied membership
inference attacks against models Shokri et al. (2017); Yeom et al. (2018);
Song and Shmatikov (2019), however, our regularizations do not target these
attacks.

##  2 Approach

In this section, we explain our proposed regularizers and training techniques
in more detail.

(a) Avocado - High PPL ($\sim 100$)

(b) Avocado - Low PPL ($\sim 60$)

(c) Reddit (PPL $\sim 100$)

Figure 2: Exposure metric results for different training schemes at similar
perplexities. Unmitigated denotes conventional training. Adversarial and
Triplet are our regularizers. Higher exposure indicates lower privacy.

###  2.1 Adversarial Training

Figure 1 shows our first proposed regularizer which is adversarial in nature.
We feed an input text sequence $x$ to the language model and extract the last
hidden state representation of the model for $x$; denoted by $h_{x}$. $h_{x}$
is then fed to a discriminator parameterized by $\theta_{d}$, which plays the
role of an attacker who attempts to predict what the sensitive label (in our
case, the author, $y$) for $x$ is. The output probability distribution of the
discriminator for the input $h_{x}$, $p_{d}=\Pr(\cdot|h_{x};\theta_{d})$ is
then used to compute both the privacy loss $\mathcal{L}_{\textsc{LM-P}}$ of
the language model and the discriminator loss $\mathcal{L}_{\textsc{D-CE}}$.
During training, the discriminator optimizes for better linking of the last
hidden state representations to the authors. Thus, the discriminator loss is
$\mathcal{L}_{\textsc{D-CE}}(h_{x},y;\theta_{d})\\!=\\!-\log\Pr(y|h_{x};\theta_{d})$.
Conversely, the language model optimizes $\theta_{lm}$ such that it (1)
improves the utility of the language model and (2) flattens the probability
distribution over authors. Thus, we devise the following loss function:

$\begin{split}\mathcal{L}_{\textsc{LM}}(x;\theta_{d},\theta_{lm})\\!=\\!\mathcal{L}_{\textsc{LM-
CE}}+\lambda\mathcal{L}_{\textsc{LM-P}}\end{split}\vspace{-2ex}$ (1)

$\mathcal{L}_{\textsc{LM-CE}}$ is the utility loss, for which we use
conventional cross entropy loss over the next-word predictions.
$\mathcal{L}_{\textsc{LM-P}}$ is the privacy loss:

$\begin{split}\mathcal{L}_{\textsc{LM-P}}(h_{x};\theta_{d})=-\frac{1}{M}\sum_{c=1}^{M}\log\Pr(c|h_{x};\theta_{d})\end{split}\vspace{-2ex}$
(2)

i.e. the KL divergence between the distribution over authors and the uniform
distribution where $M$ is the number of classes (authors). The goal of this
term is to drive the discriminator to predict randomly uniform outputs Raval
et al. (2019). The reason we devised this loss as opposed to using
$-\mathcal{L}_{\textsc{D-CE}}$ is that we do not just want the discriminator
to assign zero probability to the correct author, we want $p_{d}$ to be
uniform so that it has no information about the correct author. Hyperparameter
$\lambda$ allows for trading off privacy and utility.

###  2.2 Triplet-based Loss Function

One potential downside of the proposed adversarial regularizer is that the
capacity of the discriminator must scale with the number of authors, and thus
the size of the training data. To better accommodate the larger number of
authors in large datasets, we investigate another regularizer that does not
require a discriminator. We build on the intuition that to obfuscate an
attribute, we can increase the distance between representations of samples
that have the same label for that attribute while decreasing the distance
between samples with different labels. To this end, we use the language model
loss ($\mathcal{L}_{\textsc{LM}}$) of the previous section (Eq 1), and we set
the privacy loss to be the triplet loss:

$\displaystyle\begin{split}\mathcal{L}_{\textsc{LM-P}}=\lVert
h_{x}-h_{p}\rVert^{2}-\lVert h_{x}-h_{n}\rVert^{2}\end{split}$ (3)

The triplet loss is commonly used in vision tasks for training embeddings that
map images from the same category to neighboring points in the embedding space
Chechik et al. (2010). We, however, invert this loss and use it for an
opposite purpose: privacy regularization. During the training of the language
model, we select a “baseline sample”, $x$, a positive sample $p$ (with
different sensitive label) and a negative sample $n$ (with the same sensitive
label) and feed them through the language model and extract the last hidden
states $h_{x}$, $h_{p}$ and $h_{n}$, respectively. We find the $l_{2}$
distance between $h_{x}$, $h_{p}$, and $h_{n}$ and based on their labels, add
them to or subtract them from the loss. To implement this, in practice, we
sample a baseline batch and a second “auxiliary” batch during training. We
feed both the baseline batch ($x$) and the auxiliary batch ($a$) through the
language model and extract the last hidden states. We then calculate the
distance between the last hidden states of the corresponding samples in the
two batches. If the samples have different labels for the sensitive attribute
(author), we add their distance to the loss, otherwise, we subtract it. The
privacy loss becomes:

$\begin{split}\mathcal{L}_{\textsc{LM-P}}=\sum_{\mathclap{i:y_{x_{i}}=y_{a_{i}}}}\lVert
h_{x_{i}}-h_{a_{i}}\rVert^{2}-\sum_{\mathclap{j:y_{x_{j}}\neq
y_{a_{j}}}}\lVert h_{x_{j}}-h_{a_{j}}\rVert^{2}\end{split}$ (4)

##  3 Evaluation

(a) Avocado - High PPL ($\sim 100$)

(b) Avocado - Low PPL ($\sim 60$)

(c) Impact on Different Subgroups

Figure 3:  (a, b) Tab attack results for reconstructing canary sequences for
two utility levels. Higher attack accuracy indicates lower privacy. (c) Effect
of different mitigations on utility of well represented (Top-5) and under-
represented (Low-5) users for Avocado dataset.

In our experiments, we use a subset of the Avocado corporate email dataset
Oard et al. (2015) with 100 users and 60,000 samples and a subset of Reddit
dataset Völske et al. (2017) with 10,000 users and 3 million samples. Both of
these datasets are in English, covering formal and informal writing. We create
a $80/20\%$ training/test set split. We use a two-layer LSTM model as the
language model for the next-word prediction task. We compare models trained
with our proposed regularizer to differentially private (DP) ones Abadi et al.
(2016). For the privacy accounting, we use Gaussian differential privacy Bu et
al. (2019). We use language model perplexity as a measure of utility. Due to
space limitations, we focus evaluations on privacy metrics for several set
levels of achieved test perplexity, listed in Table 1 in the appendix. See
appendix A.2 for a more detailed description of the experimental setup and
extra analysis of overheads and complexity of each regularizer.

Privacy measurements w/ exposure metric. To empirically compare the privacy of
our methods to that of DP, we adopt the exposure metric introduced in Carlini
et al. (2019). The higher the exposure of a sequence, the more the model’s
memorization and the easier it is to extract the sequence from the language
model. To measure exposure we insert sequences of five random words (canaries)
to the training data (appendix A.5). We insert unique canaries with different
repetitions for each user, and measure the exposure of these canaries.

Figure 2 shows the exposure results per canary repetition. These results are
averaged over all the users. In each sub-figure, the perplexities of the
models are similar, hence we can compare the privacy levels at similar
utilities. Fig. 2(a) compares trained models using different techniques on the
Avocado dataset, where they all have relatively high perplexities compared to
a fully trained conventional model (Table 1). Fig. 2(b) has the same setup,
however, the models have lower perplexities. Naturally, for having better
utility we are trading off privacy, which can be seen by comparing the
exposure values in these two figures and observing that the second one has
higher exposure values (lower privacy). Finally, Fig. 2(c) shows the exposure
results for Reddit.

In all cases, we see that the unmitigated model has the highest exposure, as
expected. We also observe that for canaries (patterns) that are repeated more
than 9 times (for each user), our mitigation offers lower exposure compared to
DP, especially in the high perplexity case. This is because clipping and noise
addition in DP is attribute and data-agnostic, meaning that noise is added to
all samples regardless of whether or not they contain sensitive information.
Therefore, repeated patterns are less protected. If we want to protect a
pattern with $n$ repetitions, we would need to apply noise that is $n\times$
larger, which would degrade the utility gravely and would not yield the same
perplexity. For lower repetition canaries, our mitigations have comparable
performance to DP. For all these experiments the Gaussian differential privacy
criterion $\mu$ is extremely large ($10^{20}$), which practically yields
$\epsilon\sim\infty$. We also experimented with lower $\epsilon$ values (e.g.
$\epsilon\sim 7$), however, it yields a model with perplexity of 650, having
an extremely low utility.

Privacy measurements w/ tab attack accuracy. In this experiment, we input the
first token, and see if the entire sequence is reconstructed using the
language model. We report the rate of correct reconstruction of canaries as
the accuracy of the attack. We use the synthetic canaries from the previous
experiment, and also select “real canaries” from the training corpus to create
a real-world scenario. Fig. 3(a) shows that for a high perplexity model, the
accuracy of the tab attack on synthesized canaries is very small, even for the
unmitigated model. The unmitigated model reaches the designated perplexity in
less than an epoch, and hence it does not memorize the canaries. For the real
canaries, however, the memorization is higher, since they follow grammatical
rules. In the lower perplexity case of Fig. 3(b), we see that the synthesized
canaries are mostly memorized by the unmitigated model. Our mitigations
outperform DP, especially for the synthesized canaries. DP is not context-
sensitive and applies the same amount of noise to all samples, thereby leaving
correlated and higher repeated samples less-protected. Our mitigations,
however, learn what sequences are link-able to their authors, and obfuscate
them such that they no longer leak the “identifying” secret.

Effect on under-represented users. Differential privacy has disparate impact
on the accuracy of different subgroups of the dataset Bagdasaryan et al.
(2019). Here, we want to measure the effect of our mitigations on the utility
of the model among users with various data samples. For each user, we measure
the average perplexity of the model for their samples in the test set, and
then subtract this from the same value for an unmitigated model. This would
yield the average drop in utility, per user. We compare the utility drop of
well-represented users to under-represented ones by taking the top 5 users
with the most samples and the bottom 5 users with the fewest samples from
Avocado dataset. We then measure the average utility drop over each group of 5
users on the test set. Figure 3(c) shows these results. We see that
differential privacy has disparate impact, 29 points, on the two sub-groups of
users (authors), whereas this gap is only 7 points for models trained with our
mitigations.

It’s important to remember that in general, distinguishing “under-represented”
users from those whose data is similar to others but who have contributed
fewer samples is a difficult task. However, for Figure 3(c)’s results, if
these users’ data came from the same distribution as the ones with lots of
samples (i.e. if these people were merely less-contributing), the utility loss
would be similar for all groups when applying “user-level” DP (what we use).
DP’s disparate impact on the utility loss for these two groups suggests that,
in our case, the less-contributing authors are probably also under-
represented.

##  4 Conclusion

This work introduces two privacy mitigation methods to jointly optimize for
privacy and utility. Extensive experiments show that our approach provides
comparable and in certain cases a higher level of privacy compared to
differentially private model training. We further empirically demonstrate,
that our methods do not exhibit disparate impacts on under-represented groups
and have significantly less overhead on training performance.

## Ethical Considerations

The Avocado corpus is licensed for research applications under strict terms
intended to protect the privacy of the correspondents. While the end-user
license agreement does not indicate what consent was granted by the
participants, one term of the license is that “End user will obtain whatever
training and approval is required by their organization for working with human
subjects data”, which we have obtained (more details in Oard et al. (2015)).
While handling sensitive email data (Avocado) we made sure to abide by the
terms of its end-user license agreement (EULA) which has provisions to protect
the privacy of members of the corpus. Furthermore, we took measures such as
scrubbing named entities before using the data for model training. The over-
arching goal of our work is to contribute to language model development that
protects the privacy rights of users who contribute their data. While we
rigorously evaluated our models by applying state-of-the-art attacks,
deploying these models in real-world setups requires further verification that
users’ privacy is preserved.

## Acknowledgments

The authors would like to thank the anonymous reviewers and meta-reviewers for
their helpful feedback. We also thank Peter Kairouz and Mohammadkazem Taram
for insightful discussions. Additionally, we thank our MSR colleagues and UCSD
Berg Lab for their helpful comments and feedback.

## References

  * Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016.  Deep learning with differential privacy.  In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , pages 308–318.
  * Adam et al. (2020) Martin Adam, Michael Wessel, and Alexander Benlian. 2020.  Ai-based chatbots in customer service and their effects on user compliance.  _Electronic Markets_ , pages 1–19.
  * Bagdasaryan et al. (2019) Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. 2019.  Differential privacy has disparate impact on model accuracy.  In _Advances in Neural Information Processing Systems_ , volume 32, pages 15479–15488.
  * Bengio et al. (2003) Yoshua Bengio, Réjean Ducharme, Pascal Vincent, and Christian Jauvin. 2003.  A neural probabilistic language model.  _Journal of machine learning research_ , 3:1137–1155.
  * Bu et al. (2019) Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J. Su. 2019.  Deep learning with gaussian differential privacy.  _arXiv preprint_ , abs/1911.11607.
  * Carlini et al. (2019) Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019\.  The secret sharer: Evaluating and testing unintended memorization in neural networks.  In _28th USENIX Security Symposium_ , pages 267–284, Santa Clara, CA. USENIX Association.
  * Carlini et al. (2020) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2020.  Extracting training data from large language models.  _arXiv preprint arXiv:2012.07805_.
  * Chechik et al. (2010) Gal Chechik, Varun Sharma, Uri Shalit, and Samy Bengio. 2010.  Large scale online learning of image similarity through ranking.  _Journal of Machine Learning Research_ , pages 1109–1135.
  * Chen et al. (2019) Mia Xu Chen, Benjamin N Lee, Gagan Bansal, Yuan Cao, Shuyuan Zhang, Justin Lu, Jackie Tsay, Yinan Wang, Andrew M Dai, Zhifeng Chen, et al. 2019.  Gmail smart compose: Real-time assisted writing.  In _Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, KDD’19, page 196–206, New York, NY, USA. Association for Computing Machinery.
  * Coavoux et al. (2018) Maximin Coavoux, Shashi Narayan, and Shay B. Cohen. 2018.  Privacy-preserving neural representations of text.  In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_ , pages 1–10. Association for Computational Linguistics.
  * Dwork (2006) Cynthia Dwork. 2006.  Differential privacy.  In _Proceedings of the 33rd international conference on Automata, Languages and Programming_ , pages 1–12. Springer.
  * Farrand et al. (2020) Tom Farrand, Fatemehsadat Mireshghallah, Sahib Singh, and Andrew Trask. 2020.  Neither private nor fair: Impact of data imbalance on utility and fairness in differential privacy.  In _Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice_ , PPMLP’20, page 15–19, New York, NY, USA. Association for Computing Machinery.
  * GDPR Article 29 Working Party (2014) GDPR Article 29 Working Party. 2014.  Opinion 05/2014 on “anonymisation techniques”.  https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf.
  * Hochreiter and Schmidhuber (1997) Sepp Hochreiter and Jürgen Schmidhuber. 1997.  Long short-term memory.  _Neural computation_ , 9:1735–80.
  * Inan et al. (2021) Huseyin A. Inan, Osman Ramadan, Lukas Wutschitz, Daniel Jones, Victor Rühle, James Withers, and Robert Sim. 2021.  Training data leakage analysis in language models.  _arXiv preprint arXiv:2101.05405_.
  * Li et al. (2018) Yitong Li, Timothy Baldwin, and Trevor Cohn. 2018.  Towards robust and privacy-preserving text representations.  In _Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)_ , pages 25–30, Melbourne, Australia. Association for Computational Linguistics.
  * McMahan et al. (2018) H Brendan McMahan, Galen Andrew, Ulfar Erlingsson, Steve Chien, Ilya Mironov, Nicolas Papernot, and Peter Kairouz. 2018.  A general approach to adding differential privacy to iterative training procedures.  _arXiv preprint_ , abs/1812.06210.
  * Mikolov et al. (2010) T. Mikolov, Martin Karafiát, Lukas Burget, J. Cernocký, and S. Khudanpur. 2010\.  Recurrent neural network based language model.  In _Proceedings of the 11th Annual Conference of the International Speech Communication Association_ , pages 1045–1048.
  * Mirshghallah et al. (2020) Fatemehsadat Mirshghallah, Mohammadkazem Taram, Praneeth Vepakomma, Abhishek Singh, Ramesh Raskar, and Hadi Esmaeilzadeh. 2020.  Privacy in deep learning: A survey.  _arXiv preprint arXiv:2004.12254_.
  * Oard et al. (2015) Douglas Oard, William Webber, David Kirsch, and Sergey Golitsynskiy. 2015.  Avocado research email collection.  https://catalog.ldc.upenn.edu/LDC2015T03.
  * Pujol et al. (2020) David Pujol, Ryan McKenna, Satya Kuppam, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. 2020.  Fair decision making using privacy-protected data.  In _Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency_ , FAT* ’20, page 189–199, New York, NY, USA. Association for Computing Machinery.
  * Ramaswamy et al. (2020) Swaroop Ramaswamy, Om Thakkar, Rajiv Mathews, Galen Andrew, H Brendan McMahan, and Françoise Beaufays. 2020.  Training production language models without memorizing user data.  _arXiv preprint arXiv:2009.10031_.
  * Raval et al. (2019) Nisarg Raval, Ashwin Machanavajjhala, and Jerry Pan. 2019.  Olympus: sensor privacy through utility aware obfuscation.  In _Proceedings on Privacy Enhancing Technologies_ , pages 5–25. Sciendo.
  * Shokri et al. (2017) R. Shokri, M. Stronati, C. Song, and V. Shmatikov. 2017.  Membership inference attacks against machine learning models.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , pages 3–18.
  * Song and Shmatikov (2019) Congzheng Song and Vitaly Shmatikov. 2019.  Auditing data provenance in text-generation models.  In _Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, KDD ’19, page 196–206, New York, NY, USA. Association for Computing Machinery.
  * Subramani et al. (2020) Pranav Subramani, Nicholas Vadivelu, and Gautam Kamath. 2020.  Enabling fast differentially private sgd via just-in-time compilation and vectorization.  _arXiv preprint arXiv:2010.09063_.
  * Tramèr and Boneh (2020) Florian Tramèr and D. Boneh. 2020.  Differentially private learning needs better features (or much more data).  _ArXiv_ , abs/2011.11660.
  * Völske et al. (2017) Michael Völske, Martin Potthast, Shahbaz Syed, and Benno Stein. 2017.  Tl;dr: Mining Reddit to learn automatic summarization.  In _Proceedings of the ACL 2017 Workshop on New Frontiers in Summarization_ , pages 59–63.
  * Wang et al. (2019) Tianlu Wang, Jieyu Zhao, Mark Yatskar, Kai-Wei Chang, and Vicente Ordonez. 2019\.  Balanced datasets are not enough: Estimating and mitigating gender bias in deep image representations.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 5310–5319.
  * Wu et al. (2017) Xi Wu, Fengan Li, Arun Kumar, Kamalika Chaudhuri, Somesh Jha, and Jeffrey Naughton. 2017.  Bolt-on differential privacy for scalable stochastic gradient descent-based analytics.  In _Proceedings of the 2017 ACM International Conference on Management of Data_ , SIGMOD ’17, page 1307–1322, New York, NY, USA. Association for Computing Machinery.
  * Yeom et al. (2018) S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha. 2018.  Privacy risk in machine learning: Analyzing the connection to overfitting.  In _2018 IEEE 31st Computer Security Foundations Symposium (CSF)_ , pages 268–282.

##  Appendix A Appendix

###  A.1 Language Models

Language models assign a probability distribution over a sequence of words. A
statistical model for a sequence of words $x_{1}\ldots x_{n}$ can be
represented by the product of the conditional probability of the next word
given all the previous words as $\Pr(x_{1}\ldots
x_{n})=\prod_{i=1}^{n}\Pr(x_{i}|x_{1}\ldots x_{i-1})$. Here
$\Pr(x_{i}|x_{1}\ldots x_{i-1})$ denotes the probability of the occurrence of
word $x_{i}$ given the previous word sequence $x_{1}\ldots x_{i-1}$. Recurrent
Neural Networks (RNNs) are widely used for this task Bengio et al. (2003);
Mikolov et al. (2010) as RNNs can process variable-length input by processing
words one at a time, updating its internal state and predicting the next word
sequentially. Therefore, such variable-length conditional distributions can be
effectively estimated with RNNs. In this work we use LSTMs Hochreiter and
Schmidhuber (1997) in our language model.

###  A.2 Experimental Setup

We use a subset of the Avocado dataset Oard et al. (2015) with 100 users and
60,000 samples. We also use a subset of Reddit dataset Völske et al. (2017)
with 10,000 users and 3 million samples. For both datasets, we fix the
vocabulary to the most frequent 40,000 tokens in the training corpus, and we
create a $80/20\%$ training/test set split. We use a two-layer LSTM model as
the language model for the next-word prediction task. We set both the
embedding dimension and LSTM hidden-representation size to 550 (with 55
million parameters). We use a feed-forward two fully connected layer neural
network with hidden dimension of 1000 as the author discriminator for the
adversarial training regularization scheme.

For optimization, we use the Adam optimizer with the learning rate set to 1e-3
and batch size to 100. We trained our models on a single Titan Xp GPU
accompanied by 12GBs of RAM, and two Intel Xeon E5-2620 CPUs with 256 GBs of
RAM. Table 1 shows the perplexity of the models used in the evaluations.

####  A.2.1 Batching Strategy

Our mitigations can be implemented using different batching strategies during
training: uniform batches that contain training samples from different users,
or per user batches that contain training samples from only a given user.
Through experimentation, we observed that the second method performs better
and we present our results under the second batching strategy. The better
performance is due to the fact that grouping the same users together and
increasing the probability of samples from same people being placed in
corresponding positions in a batch, helps the discriminator (in the
adversarial training scheme) learn user (author) patterns faster. It also
helps the triplet-based scheme to more efficiently distance samples from the
same user. This scheme we increases the probability that the auxiliary batch
is selected from the same user’s data, compared to randomly selecting two
uniform batches. This helps better distribute one user’s data in the embedding
space.

Figure 4:  Per epoch training time break down, normalized to conventional
execution. Differential privacy is $16.44\times$ slower than conventional
execution. Triplet and Adversarial are our proposed regularizations. Table 1:
Training and test perplexities of the models used in the evaluations.

Dataset |  | Unmitigated | DP | Adversarial (ours) | Triplet (ours)
---|---|---|---|---|---
Avocado | Training | 93.5 | 94.2 | 104.7 | 101.4
(High PPL) | Test | 103.5 | 93.5 | 96.6 | 96.5
Avocado | Training | 36.8 | 63.8 | 56.7 | 54.8
(Low PPL) | Test | 51.3 | 69.8 | 69.1 | 69.1
Reddit | Training | 107.5 | 110.3 | 106.7 | 106.4
| Test | 97.3 | 97.4 | 98.2 | 97.6

###  A.3 Overhead and Complexity Analysis

####  A.3.1 Training Time Measurements

Here we compare the training time of our proposed regularizations to
differential privacy. Figure 4 shows the breakdown of the CPU and GPU (CUDA)
time for our two proposed methods, and differential privacy, normalized to the
conventional unmitigated execution time. The results show that differential
privacy is extremely slower than our mitigations. Our adversarial training
mitigation is overall only $1.06\times$ slower than conventional training, and
our triplet-based mitigation is $1.80\times$ slower due to the need to process
an auxiliary batch in each batch. The reason that our triplet-based mitigation
is slower than the adversarial one is that the triplet based loss runs two
batches through the language model during each iteration (the baseline batch
and the auxiliary), whereas the adversarial training scheme runs only one
batch of training data. Differential privacy, however, is $16.44\times$ slower
than conventional execution, which is due to its per-sample gradient
computation, which limits the possibility of parallelism. It is noteworthy
that in our experiments, we have applied the training time optimization
suggested in McMahan et al. (2018) for differential privacy, which increases
parallelism through the use of “micro-batches”. However, even with this
optimization, we are still observing huge slow-downs. Furthermore,
differentialy private training of DNNs and RNNs takes exhaustive
hyperparameter tuning to get the best privacy-utility trade-off, which is
cumbersome Wu et al. (2017); Mirshghallah et al. (2020), and this slow
training process makes the tuning of the parameters extremely harder.

###  A.4 Added Parameters and Complexity

Our adversarial training regularization includes an additional feed-forward
discriminator DNN to predict the author of each sequence, as shown in Figure
1. In our experiments, we use a feed-forward network with two fully connected
layers and a hidden dimension of 1000. The input dimension is the same as the
hidden state dimension of the language model (550) and the output dimension is
the number of authors, 100 for Avocado, and 10,000 for Reddit dataset. This
means that the discriminator parameters scale-up with the number of authors.
For the Avocado case, this would give $550\times 1000+1000*100=650K$ extra
parameters (compared to conventional training), and for Reddit it would be
$550\times 1000+1000\times 10,000=10.55M$ parameters. This is comparatively
reasonable considering the number of parameters in the language model (55M) as
a tradeoff to improve the privacy of the model. It would be interesting to
explore whether reducing the number of hidden dimensions of the discriminator
as the number of users increase would be effective to balance the number of
parameters our *adversarial method* adds to the parameters of the network.

Our triplet-based regularization does not add any extra parameters to the
model, which might be advantageous for settings with massive number of users.
It does, however, need to feed an auxiliary batch to the language model,
alongside the baseline batch which almost doubles the training time.

Figure 4 and Section A.3.1 show the break-down of the training time of DP
training, our triplet-based method, and our adversarial method, compared to
unmitigated training time. Differential privacy does not add any additional
complexity in terms of parameters. However, it adds computational complexity
by having to compute the gradients of each sample separately, thereby not
exploiting the batch processing parallelization offered by GPUs. This in turn
slows down the training procedure extremely, making hyperparameter search
infeasible for large networks.

###  A.5 Exposure Metric

To empirically compare the level of privacy provided by our methods to that of
a DP model, we adopt the exposure metric introduced in Carlini et al. (2019).
This metric measures the extent to which a model memorizes samples in the
training data. The higher the exposure metric for a sequence, the more the
model’s memorization and the easier it is to extract the sequence from the
language model through text generation algorithms. To measure exposure we
insert canaries to the training data. Our canaries are sequences of five
random words from the vocabulary. We insert canaries with different
repetitions for each person. For Avocado dataset, each user (author) is
assigned 14 unique canaries, each of them repeated
$[1,2,3,4,5,6,7,8,9,10,20,30,40,50]$ times. We insert canaries with repition
to mimic “secrets” that belong only to a certain user, but might be repeated
by that user in multiple emails/texts. This means each user is assigned and
overall of $1+2+3+...+50=195$ canaries. This yields and overall of $195\times
100=19500$ canaries injected to the data. This data is then used to train the
model. Once the model is trained, we can then measure the exposure of a given
canary, by finding the probability assigned to it by the language model, and
then finding the rank of that sequence by by sorting all probabilities
assigned to all possible sequences of the same length. Carlini et al. provide
a method to estimate the rank for each sequence without having to actually
enumerate and feed all possible sequences to the model and actually ranking
all of them. Once we have measured the exposure metric for all canary
sequences, we can use them to evaluate the privacy.

For Reddit dataset, each user is assigned 5 unique canaries, with repetitions
of $[1,2,5,6,20]$ times. We use less canaries in the latter so as not to
contaminate the dataset as the Reddit dataset has less samples per user. The
“real canaries” introduced in the experiments are chosen by feeding all the
training data through an unmitigated model, and selecting the sample with
highest perplexity for each user. We hypothesize that these sequences are more
likely to contain sensitive information.