# A Relational Model for One-Shot Classification

Arturs Polis and Alexander Ilin
Aalto University  Espoo  Finland

###### Abstract

We show that a deep learning model with built-in relational inductive bias can
bring benefits to sample-efficient learning, without relying on extensive data
augmentation. The proposed one-shot classification model performs relational
matching of a pair of inputs in the form of local and pairwise attention. Our
approach solves _perfectly_ the one-shot image classification Omniglot
challenge. Our model exceeds human level accuracy, as well as the previous
state of the art, with no data augmentation.

##  1 Introduction

Humans can often learn to distinguish previously unseen visual objects after
being shown only a few example images of a novel object. Deep neural networks,
on the other hand, typically require thousands of training images to
generalize to new examples of classes seen during training. The field of few-
shot learning aims to address this by developing models that can work with
scarce data: only a few examples being available for training. One-shot
classification is a special case of few-shot learning, where the system needs
to learn to classify after seeing only one example of each class. Although
deep learning models have made great progress in few-shot learning [1, 2, 3],
reaching human level performance has been hard [4] even on simple datasets
like Omniglot [5] which is one the main benchmarks for this task.

In this work, we propose to use a deep learning model with relational
inductive bias [6] for the task of one-shot classification. The proposed model
uses self-attention and cross-attention blocks of the Transformer [7] to
compare a pair of images. Relational models with Transformer-based attention
have recently been shown to succeed in vision tasks [8, 9, 10] and in this
paper we show that this type of models can perform well in few-shot learning.
Our proposed model is to the best of our knowledge the first deep learning
model that achieves perfect (and better than human) accuracy in the most
challenging Omniglot classification setup: one-shot within alphabet
classification with 20 alternative classes without using data augmentation.

Figure 1: Omniglot data as images and points. Points that belong to the same
pen stroke share color. Larger points mark the beginning, and empty circles –
the end of the motion of the pen.

Table 1: Omniglot within alphabet one-shot, 20-way classification accuracy on
the Evaluation set. Full and Min. denote the type of Background set used for
training. We show the previously published results, when available, for: Human
and BPL [5, 4], Prototypical Networks [3, 4] and ARC [11].

| Unaugmented | Augmented
---|---|---
Model | Full | Min. | Full | Min.
Human | $95.5$ | – | – | –
BPL | $96.7$ | $\mathbf{95.8}$ | – | –
Prototypical Networks | $86.3$ | $69.9$ | $94$ | –
ARC | – | – | $97.75$ | –
ARC (full context) | – | – | $98.5$ | –
AM (ours) – points | $85.5$ | $44.7$ | $94$ | $74.1$
AM (ours) – images | $97.5$ | $79$ | $98.25$ | $95.1$
| AM (ours) – images
---
(full context)
$\mathbf{100}$ | $81.38$ | $\mathbf{99.5}$ | $\mathbf{98.5}$

##  2 Omniglot challenge

Lake et al. [5] proposed Omniglot benchmark to measure progress of
generalization from few examples in various tasks such as classification,
generation of new examples and parsing objects into parts. Omniglot dataset
contains characters from 50 alphabets, 1623 character classes in total, each
character represented by only 20 hand-drawn instances, available both in image
and pen trajectory formats (a few samples are shown in Fig. 1). The dataset is
split into a 30-alphabet Background set (with 964 classes) used for training,
and a 20-alphabet Evaluation set (with 659 classes). Recently, the “Minimal”
[4] version of the training data has been proposed, containing two five-
alphabet subsets of the Background set. The evaluation procedure of the
$N$-way one-shot classification task consists of multiple episodes. Each
episode is a classification task with $N$ classes from the same alphabet. The
classifier can use $N$ support examples (one example per class) to assign $N$
query examples to one of the $N$ classes. The Background set can be used for
training. For evaluation, we use pre-defined episodes from the Evaluation set
with $N=20$, which were proposed by the authors of Omniglot [5].

The authors of Omniglot developed a generative probabilistic model called
Bayesian Program Learning (BPL)111https://github.com/brendenlake/BPL, as a
non-neural baseline for Omniglot tasks. BPL has held the state of the art for
the most challenging setup: the 20-way one-shot classification task without
the use of data augmentations during training, it also generalizes very well
from the Minimal training set (see Table 1). The authors argue [4] that the
challenge remains unsolved because the human level on the _within-alphabet_
classification has been out of reach for deep learning models that do not rely
on heavy data augmentation. Most of the published research on Omniglot
classification addresses a simpler _between-alphabets_ classification task, in
which testing episodes contain characters from different alphabets, making the
examples easier to distinguish.

CNNflatten + pos. enc.self-attentioncross-attentionCNNflatten + pos. enc.self-
attentioncross-attentionaggregatescore$2\times$

(a)

+NormMLPConcat Multi-Head Attention Features

(b)

from $A$: |  to $B$:
---|---
|
|
|
|

(c)

Figure 2: (a): The architecture of the proposed AttentiveMatcher model. (b):
The attention layer used in our model. (c): Cross-attention strength from
image $A$ to image $B$, colors show which regions in $A$ attend to which
regions in $B$. The corresponding parts match despite being drawn quite
differently.

##  3 AttentiveMatcher: the proposed model

As humans, when we compare two unfamiliar images to see if they show the same
item, we first look at each image to verify its contents, and then compare
parts of each image to one other to see if all parts match. The same idea
informs the approach presented in this paper: our model uses self-attention to
learn the structure of each image, and cross-attention to match the
corresponding parts between the two images, then the model aggregates this
information to determine if images belong to the same class. With the above
intuition in mind we call our model AttentiveMatcher (AM).

The training of AttentiveMatcher is performed on pairs of input, $A$ and $B$,
to predict whether they belong to the same class or not. The architecture of
the model is illustrated in Fig. 2a. We use a convolutional network to embed
the input images, obtaining a grid of $16\times 16$ super-pixels, which we
treat as $256$ features. Similar to the hybrid model in [8] we use these
features as inputs to the Transformer layers. First, we separately perform
self-attention on the features coming from the two images. Next, we perform
cross-attention between the features in the two inputs. We apply the above
sequence of attention operations twice, in order for information in each
feature to propagate across both inputs.

As the attention blocks, we use the Transformer [7] attention layers with the
modifications inspired by [10]. Unlike in Transformer, where the outputs of
the multi-head attention blocks are passed through a feed-forward block
directly, we first concatenate the attention outputs with the input features
before passing them to the feed-forward block followed by Layernorm [12] (see
Fig. 2b). The feed-forward multilayer perceptron (MLP) is then followed by a
residual connection. All the MLPs in our network have one ReLU-activated
hidden layer.

After performing two rounds of self and cross-attention, we aggregate all the
transformed local features into a single scalar score predicting the match
between $A$ and $B$. The aggregation is inspired by the Graph Matching
Networks [13]:

$s=h\left(\sum_{i}\ \boldsymbol{\alpha}_{i}\odot\
f(\mathbf{z}_{i})\right),\quad(\boldsymbol{\alpha}_{i})_{k}=\frac{\exp
g_{k}(\mathbf{z}_{i})}{\sum_{j}\exp g_{k}(\mathbf{z}_{j})}\,,$ (1)

where $\mathbf{z}_{i}$ are the local features from the two inputs,
$(\boldsymbol{\alpha}_{i})_{k}$ is the $k$-th element of $K$-dimensional
vector $\boldsymbol{\alpha}_{i}$ and functions $f,g_{k},h$ are modeled with
MLPs. The output layer of $h$ has the sigmoid function, which results in score
$s\in(0,1)$ treated as the probability that the two inputs belong to the same
class. The training batches are constructed by sampling positive (same class)
and negative (different classes) pairs from the training set. We use the
binary cross-entropy loss to tune the parameters of the model.

The testing episodes are constructed by pairing each query input with each
support input, resulting in $N\times N$ comparison pairs for each episode.
Each query example is assigned a label of the support example with the highest
score $s$. The model accuracy is defined as the fraction of the labels
correctly assigned. To compare our model with ARC [11], which is the previous
state of the art for the task, we also experimented in the scenario assumed by
ARC when the query examples in one episode are known to belong to different
classes. We used Hungarian matching [14] which assigns each support example to
a unique query example in the episode, while maximizing overall score.

##  4 Experiments and results

We perform one-shot classification for 20-way Omniglot within alphabet task.
Images are resized to $64\times 64$ and passed through a four-layer
convolutional network commonly used in few-shot models [3, 15]. We use kernel
of size $3$, with padding and the stride of $1$, and we use max-pooling only
after the first two convolutional layers. This results in a $16\times 16$
feature map with $d_{f}=128$ channels which we flatten into a sequence of
$256$ local features of size $d_{f}$ that we use as input tokens to the
Transformer layers. We use simple 1D positional encoding [7] for the inputs to
the Transformer block and we use $K=2048$ dimensions in the aggregation
network in (1).

We run our experiments on both unaugmented and augmented data. When
augmenting, we add rotations at 90°, 180°, 270° as extra training classes,
similar to [3], resulting in 3856 classes. We use the batch size of 256 and we
construct mini-batches such that the contribution of the positive examples in
the loss is similar to the contribution of the negative examples. We use the
Adam [16] optimizer with initial learning rate of $0.0001$ reduced by factor
of $0.1$ every $100$ epochs, and clip gradients at $2.5$. While training, we
validate by forming random within-alphabet episodes from the ten alphabets not
in the test set. We stop the training once validation accuracy stops
improving.

Additionally, we test our model with input characters represented as sequences
of points. To extract points from Omniglot strokes, we follow the pre-
processing done by BPL and linearly interpolate for equal spacing with $5$
pixels between neighbour points. We represent inputs as sequences of point
coordinates. Each point is embedded using an MLP to size $d_{f}=64$ and
followed by dropout. We use $K=1024$ in the aggregation network in (1).

Table 1 contains the obtained results. Our unaugmented model outperformed
other published results, including BPL [5] and Prototypical Networks [3] and
achieved perfect accuracy after applying Hungarian algorithm at test time,
denoted by “full context” in the results. When training on the Minimal set,
our model benefits from augmentation, and when full context is used,
outperforms the previous state of the art, BPL. The model trained on points
using data augmentation (three extra rotations per character) shows comparable
accuracy to our image model, while the unaugmented results on points fall
short of the corresponding image results. This is somewhat surprising, as one
would assume that stroke trajectories contain the same amount of relevant
information as the images. A likely reason for images performing better is the
translation invariance induced by the convolutional network helping model to
generalize better when compared to point-features prepared by simple MLPs.

The model allows us to visualize the attention, as shown in Fig. 2c. The
cross-attention patterns obtained on Omniglot are meaningful: the classifier
matches parts of its two inputs that represent the same strokes.

We also tested our model on natural images using the popular miniImageNet [1]
benchmark. The model works well but does not exceed the state of the art. The
performance of our model on natural images could also have been constrained by
the small model size. We also studied the cross-attention patterns on the
miniImageNet data and found that the model paid more attention to similarities
in textures rather than semantically similar high-level parts and objects.

##  5 Conclusion

Our model obtains a perfect accuracy on the challenging Omniglot within
alphabet classification task, exceeding both human level and BPL on
unaugmented data, and to the best of our knowledge is the first model to do
so. Our work shows that the relational inductive bias, in the form of local
and pairwise attention, can be useful in solving few-shot learning problems.
More work is needed to investigate the potential of this approach on natural
images, where it is more challenging to develop meaningful relational
representations in terms of objects and object parts. In addition, the
relation between model size and interpretability of attention patterns for
input matching should be explored. Working in this direction will drive the
improvement in deep learning methods for efficient and scalable relational
representation.

We thank CSC (IT Center for Science, Finland) for computational resources and
the Academy of Finland for the support within the Flagship programme: Finnish
Center for Artificial Intelligence (FCAI).

## References

  * [1] Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al.  Matching networks for one shot learning.  In Advances in neural information processing systems, pages 3630–3638, 2016.
  * [2] Chelsea Finn, Pieter Abbeel, and Sergey Levine.  Model-agnostic meta-learning for fast adaptation of deep networks.  In Proceedings of the 34th International Conference on Machine Learning-Volume 70, pages 1126–1135. JMLR. org, 2017.
  * [3] Jake Snell, Kevin Swersky, and Richard Zemel.  Prototypical networks for few-shot learning.  In Advances in neural information processing systems, pages 4077–4087, 2017.
  * [4] Brenden M Lake, Ruslan Salakhutdinov, and Joshua B Tenenbaum.  The omniglot challenge: a 3-year progress report.  Current Opinion in Behavioral Sciences, 29:97–104, 2019.
  * [5] Brenden M Lake, Ruslan Salakhutdinov, and Joshua B Tenenbaum.  Human-level concept learning through probabilistic program induction.  Science, 350(6266):1332–1338, 2015.
  * [6] Peter W Battaglia, Jessica B Hamrick, Victor Bapst, Alvaro Sanchez-Gonzalez, Vinicius Zambaldi, Mateusz Malinowski, Andrea Tacchetti, David Raposo, Adam Santoro, Ryan Faulkner, et al.  Relational inductive biases, deep learning, and graph networks.  arXiv preprint arXiv:1806.01261, 2018.
  * [7] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin.  Attention is all you need.  In Advances in neural information processing systems, pages 5998–6008, 2017.
  * [8] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al.  An image is worth 16x16 words: Transformers for image recognition at scale.  arXiv preprint arXiv:2010.11929, 2020.
  * [9] Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin.  Emerging properties in self-supervised vision transformers.  arXiv preprint arXiv:2104.14294, 2021.
  * [10] Paul-Edouard Sarlin, Daniel DeTone, Tomasz Malisiewicz, and Andrew Rabinovich.  Superglue: Learning feature matching with graph neural networks.  arXiv preprint arXiv:1911.11763, 2019.
  * [11] Pranav Shyam, Shubham Gupta, and Ambedkar Dukkipati.  Attentive recurrent comparators.  In Proceedings of the 34th International Conference on Machine Learning-Volume 70, pages 3173–3181. JMLR. org, 2017.
  * [12] Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton.  Layer normalization.  arXiv preprint arXiv:1607.06450, 2016.
  * [13] Yujia Li, Chenjie Gu, Thomas Dullien, Oriol Vinyals, and Pushmeet Kohli.  Graph matching networks for learning the similarity of graph structured objects.  arXiv preprint arXiv:1904.12787, 2019.
  * [14] Harold W Kuhn.  The hungarian method for the assignment problem.  Naval research logistics quarterly, 2(1-2):83–97, 1955.
  * [15] Flood Sung, Yongxin Yang, Li Zhang, Tao Xiang, Philip HS Torr, and Timothy M Hospedales.  Learning to compare: Relation network for few-shot learning.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1199–1208, 2018.
  * [16] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.


# Different Spectral Representations in Optimized Artificial Neural Networks
and Brains

Richard C. Gerum
Department of Physics and Astronomy
York University University
Toronto, ON, Canada
<EMAIL_ADDRESS>
&Cassidy Pirlot
Departments of Computing Science and Psychology
University of Alberta
Edmonton, AB, Canada
<EMAIL_ADDRESS>
Alona Fyshe
Departments of Computing Science and Psychology
University of Alberta
Edmonton, AB, Canada
<EMAIL_ADDRESS>
&Joel Zylberberg
Department of Physics and Astronomy
York University University
Toronto, ON, Canada
<EMAIL_ADDRESS>

###### Abstract

Recent studies suggest that artificial neural networks (ANNs) that match the
spectral properties of the mammalian visual cortex—namely, the $\sim 1/n$
eigenspectrum of the covariance matrix of neural activities—achieve higher
object recognition performance and robustness to adversarial attacks than
those that do not. To our knowledge, however, no previous work systematically
explored how modifying the ANN’s spectral properties affects performance. To
fill this gap, we performed a systematic search over spectral regularizers,
forcing the ANN’s eigenspectrum to follow $1/n^{\alpha}$ power laws with
different exponents $\alpha$. We found that larger powers (around 2–3) lead to
better validation accuracy and more robustness to adversarial attacks on dense
networks. This surprising finding applied to both shallow and deep networks
and it overturns the notion that the brain-like spectrum (corresponding to
$\alpha\sim 1$) always optimizes ANN performance and/or robustness. For
convolutional networks, the best $\alpha$ values depend on the task complexity
and evaluation metric: lower $\alpha$ values optimized validation accuracy and
robustness to adversarial attack for networks performing a simple object
recognition task (categorizing MNIST images of handwritten digits); for a more
complex task (categorizing CIFAR-10 natural images), we found that lower
$\alpha$ values optimized validation accuracy whereas higher $\alpha$ values
optimized adversarial robustness. These results have two main implications.
First, they cast doubt on the notion that brain-like spectral properties
($\alpha\sim 1$) _always_ optimize ANN performance. Second, they demonstrate
the potential for fine-tuned spectral regularizers to optimize a chosen design
metric, i.e., accuracy and/or robustness.

##  1 Introduction

Artificial neural networks (ANNs) trained to perform object recognition tasks
learn representations of input images that bear a surprising resemblance to
the ones observed within the mammalian visual cortex (Yamins et al.,, 2014;
Yamins and DiCarlo,, 2016; Khaligh-Razavi and Kriegeskorte,, 2014).
Excitingly, this resemblance suggests that common principles might underlie
both the task-trained ANNs and the mammalian visual system (MVS) (Richards et
al.,, 2019), and highlights the potential for advances in machine learning and
in neuroscience to reinforce each other. Building on these successes, two
recent studies (Nassar et al.,, 2020; Kong et al.,, 2022) asked whether the
spectral properties of the visual representations in mammalian visual
cortex—namely, the $\sim 1/n$ eigenspectrum of the covariance matrix of neural
activities (Stringer et al.,, 2019)—might have functional benefit for ANNs.
First, Kong et al., (2022) showed that networks which were more robust to
adversarial attacks, had eigenspectra closer to those observed in the brain.
Second, and more directly, Nassar et al., (2020) trained ANNs with a
regularizer that forced them to match the $\sim 1/n$ eigenspectrum seen in
neuroscience experiments and found that the resultant ANNs were more robust to
adversarial attacks than were ANNs trained without the spectral regularizer.
These results suggest that the $\sim 1/n$ eigenspectrum might be among the
lessons learned from the MVS that can enhance ANN function111Another recent
study by Ghosh et al., (2022) also concluded that $\sim 1/n$ eigenspectra are
associated with improved performance in ANNs. We discuss the relationship
between our findings and this previous result in detail in our Discussion
section., but they also open the question of whether other spectral
regularizers (i.e., ones that generate ANNs with eigenspectra following power
law $1/n^{\alpha}$ with power $\alpha$ significantly different than 1) might
be even better.

To address that outstanding question, we performed a systematic search over
spectral regularizers, characterized by their power law exponents $\alpha$,
and found that, for dense networks, larger powers (around 2–3) lead to better
validation accuracy and to better robustness to adversarial attacks. This
surprising finding persisted for both shallow and deep dense networks. For
convolutional networks, the best $\alpha$ values depended on the evaluation
metric and task. For a simpler object recognition task (categorizing MNIST
images of handwritten digits), validation accuracy and adversarial robustness
were best for smaller values of $\alpha$ (around 1). For a more complex task
(categorizing natural images from the CIFAR 10 dataset), validation accuracy
was best for smaller $\alpha$ values but robustness to adversarial attacks was
best for larger values of $\alpha$ (around 2–3).

These results have two main implications. First, they suggest that low
dimensional image representations222higher exponents $\alpha$ imply lower
dimensional representations might be a guiding principle for developing robust
ANNs for complex visual tasks, and highlight the potential for spectral
regularizers with appropriately-chosen $\alpha$ values to optimize ANNs for
different task types. Second, the deviation between the optimal spectral
properties of the object-recognition ANNs and that which is observed in the
MVS suggests that there could be important deviations between the principles
underlying object-recognition ANNs and those that underlie the MVS. For
example, perhaps ANNs optimized for tasks other than complex object
recognition and/or robustness might be better matches to the MVS (Zhuang et
al.,, 2021; Bakhtiari et al.,, 2021; Christensen and Zylberberg,, 2020), or
perhaps there are fundamental differences between ANNs and the MVS that extend
beyond the choice of objective function. We leave the task of speculating
about the answers to these interesting questions for future work.

Figure 1: a, Image presented to a mouse. b, From the visual cortex of the
mouse the neural representations of $f$ neurons are recorded in response to
$N$ images. c, The values of rank-ordered eigenvalues along with a power-law
fit (data from Stringer et al., (2019)). e, MNIST digit, presented to a dense
artificial neural network f. The activation of the hidden layer to a batch of
images can be analysed analogously to the neural recordings to obtain the
eigenvalue spectrum e. e, Eigenvalue spectrum for an unregularized network
(orange, gray fit) and for a regularized network (blue, black fit).

##  2 Method

###  2.1 Eigenspectrum

Our study is motivated by observations of the spectral properties of visual
cortex. To measure those spectral properties, Stringer et al., (2019)
presented images to mice and recorded the neural activity in the primary
visual cortex (V1). This yields a partial snapshot of the neural
representation of the image (Fig. 1a,b). After obtaining the activity from $f$
neurons in response to $N$ images, the data can be represented in a matrix
$A$.

For this matrix $A$, the matrix $\Sigma$, which is proportional to the data
covariance matrix, is calculated from the mean corrected data $\hat{A}$.

$\displaystyle\hat{A_{i}}$ $\displaystyle=A_{i}-\bar{A}$ (1)
$\displaystyle\Sigma$ $\displaystyle=\hat{A}^{\mathrm{T}}\hat{A}$ (2)

where $\bar{\cdot}$ denotes the average over $i$.

This matrix $\Sigma$ can be decomposed into its eigenvalues and vectors.

$\displaystyle\Sigma$ $\displaystyle=V\Lambda V^{\mathrm{T}}$ (3)

where $V$ is an orthonormal matrix of eigenvectors and $\Lambda$ is a diagonal
matrix with the (sorted) eigenvalues $\lambda_{i}$ of $\Sigma$ on the
diagonal.

Plotting the these eigenvalues, sorted descending, over their order indices
$I_{i}$, ranging from 1 to the number of eigenvalues $n$, Stringer et al.,
(2019) saw a decaying power-law with a slope of -1 (Fig. 1c).

###  2.2 Constructing the Spectral regularizer

The same principle can be leveraged to get the spectral representation of an
artificial neural network. When presenting an image (Fig. 1e) to a network
(Fig. 1f), the activations of units in a hidden layer can be represented by a
matrix $A$ for which the eigenvalues $\lambda$ and their rank-ordered indices
$I_{i}$ can be obtained. To estimate the decay of the eigenvalue spectrum, we
fit a power-law to the eigenvectors $\lambda_{i}$ over the indices of sorting
$I_{i}$.

Therefore, we use linear least squares fit to the logarithms of these which
has a closed form

$\displaystyle\hat{\alpha}=\frac{\sum_{i=i_{\mathrm{min}}}^{i_{\mathrm{max}}}(\log{I_{i}}-\left<\log{I}\right>_{i})(\log{\lambda_{i}}-\left<\log{\lambda}\right>_{i})}{\sum_{i=i_{\mathrm{min}}}^{i_{\mathrm{max}}}(\log{I_{i}}-\left<\log{I}\right>_{i})^{2}}$
(4)

Where $\left<\cdot\right>_{i}$ denotes the average in the range
$i_{\mathrm{min}}\leq i\leq i_{\mathrm{max}}$. The range
$[i_{\mathrm{min}},i_{\mathrm{max}}]$ is chosen to capture the linear range of
the spectrum.

We now define the value $\alpha$ as the negative of this slope:

$\displaystyle\alpha=-\hat{\alpha}$ (5)

We use the absolute deviation from the chosen target alpha value,
$\alpha_{\mathrm{target}}$, as a regularizing loss term with strength $\beta$:

$\displaystyle\operatorname{loss}=\beta\left|\alpha-\alpha_{\mathrm{target}}\right|$
(6)

This spectral loss is differentiable and hence it allows for the gradient of
this loss to be used during training.

###  2.3 Assessing Adversarial Robustness

To determine whether this regularization method leads to more robust networks,
we train networks with different regularization strengths, $\beta$, and target
values, $\alpha_{\mathrm{target}}$, and then perform two different kinds of
common attacks on the trained networks.

The fast gradient sign method (FGSM, Goodfellow et al., (2014)) perturbs an
input image with pixel values $x^{j}_{i}$ and label $y^{j}$, to one with pixel
values $\hat{x}^{j}_{i}$:

$\displaystyle\hat{x}^{j}_{i}=x^{j}_{i}+\epsilon\operatorname{sgn}\left(\frac{\partial}{\partial
x_{i}}L\left(f(x^{j},\Theta),y^{j}\right)\right)$ (7)

The perturbation depends on the sign of the derivative of the classification
loss function $L(\cdot)$ (in our case the categorical cross entropy loss) with
respect to the $i$th input pixel, multiplied with an attack strength
$\epsilon$. This perturbation is added to the initial input image $x^{j}$ to
produce the attack image $\hat{x}^{j}$. To ensure that the attack image
$\hat{x}^{j}$ is still a valid image, values are clipped to the range of
$[0,1]$. This perturbation has the effect of modifying the pixel values so as
to increase the loss, and hence decrease the likelihood that the network can
correctly categorize the image.

The projected gradient descent (PGD, Mądry et al., (2017)), takes an iterative
approach using gradient ascent to find changes to the input image that
maximize the loss function.

$\displaystyle\hat{x}^{j,n+1}_{i}=\operatorname*{proj}_{\|x-\hat{x}\|_{\infty}\leq\epsilon}\hat{x}^{j,n}_{i}+\mu\left(\frac{\partial}{\partial
x_{i}}L\left(f(x^{j},\Theta),y^{j}\right)\right)$ (8)

with $\hat{x}^{j,n}$, referring to the attack image at the $n$th iteration,
$\mu$ the learning rate for the gradient ascent, $\operatorname*{proj}(\cdot)$
to projecting the change to a maximum change of $\epsilon$, the attack
strength, per pixel ($\|\cdot\|_{\infty}$ refers to the infinity norm). We use
a learning rate $\mu$ of 0.01 and 40 iterations.

##  3 Results

Figure 2: a, Validation accuracy over spectral slope, $\alpha$, after training
a shallow perceptron with one 2000 unit hidden layer on MNIST for 50 epochs
with spectral regularization for different regularization strengths $\beta$
("baseline": no regularization, blue; "weak": $\beta=0.1$, orange; "strong":
$\beta=1.0$, green; color saturation shows target $\alpha$, see color bars).
Adversarial attacks with b FGSM and c PGD with a strength $\epsilon=0.05$.
d,e, Measured $\alpha$ value during training for different target $\alpha$
values (bright orange/green $\alpha_{\mathrm{target}}=5$, gray
$\alpha_{\mathrm{target}}=0.6$) for weak regularization strength (orange,
$\beta=0.1$) and strong regularization (green, $\beta=1.0$). f, Robustness
against attacks for different attack strengths $\epsilon$ show comparable
results to a–c. Figure 3: Validation accuracy and adversarial robustness for
different architectures. a,b,c, Multilayer perceptron with 3 hidden layers
trained on MNIST. a, Validation accuracy is higher than baseline (blue) for
alpha of 2.4 and weak regularization strength (orange) but lower for stronger
regularization (green). b, FGSM and c PGD with a strength $\epsilon=0.05$ show
similar robustnes for $\alpha$ values of 2.1. d,e,f, Convolutional neural
network trained on MNIST. d, Validation accuracy cannot be improved against
baseline and only shows a clear maximum for strong regularization. e, FGSM and
PGD f attacks with a strength $\epsilon=0.1$ show only strong differences for
regularization strength for PGD and do not have a pronounced maximum. g,h,i,
Convolutional neural network trained on CIFAR-10. g, Validation accuracy is
strongest for weak regularization and $\alpha$ values smaller than one. h,
FGSM and PGD i attacks with a strength $\epsilon=0.01$ show that strong
regularization and $\alpha$ values around 3 improve robustness.

###  3.1 Optimizing $\alpha$ to Improve Accuracy and Robustness

We first trained a shallow densely connected network to categorize MNIST
images of handwritten digits: our later experiments explore deeper networks,
convolutional architectures, and more complex tasks. This first network had
one hidden layer with 2000 units with tanh activations followed by a softmax
output layer. We train with a batch size of 2500 for 50 epochs using the Adam
optimizer with a low learning rate of $10^{-4}$. The network architectures and
hyperparameters were chosen to be comparable to the experiments that Nassar et
al., (2020) performed.

During training, the representation in the hidden layer was regularized with
the spectral regularizer (Eq. 6), which encourages the eigenspectrum of the
covariance matrix to follow a power-law with the given slope
$\alpha_{\mathrm{target}}$.

Validation accuracy (without any attack) depended only slightly on the
regularization strength and $\alpha_{\mathrm{target}}$ (between 0.93 and 0.95,
Fig. 2a), and regularization was only beneficial compared to the unregularized
network for small regularization strengths ($\beta=0.1$) and alpha values
higher than 1.5. The optimal $\alpha$ was around 3. For stronger regularized
networks ($\beta=1.0$), no $\alpha_{\mathrm{target}}$ value yielded a higher
accuracy than the unregularized network.

However, testing the network for robustness against adversarial attacks, led
to quite a different picture. When $\alpha_{\mathrm{target}}$ was such that
the weakly regularized network had the same $\alpha$ value as the baseline
network (with no regularization), both the weakly regularized and the
unregularized baseline network had the same robustness to adversarial attacks
(Fig. 2b,c). At the same time, higher $\alpha_{\mathrm{target}}$ values,
leading to higher $\alpha$ values in the trained networks, led to greater
robustness.

For stronger regularization (green curve in Fig. 2a–c), we generally observed
greater robustness to adversarial attacks, and once again found that higher
$\alpha$ values were associated with greater robustness. Stronger
regularisation differed from the weaker regularisation in reaching the target
alpha value earlier in training (Fig. 2d,e).

These findings were qualitatively unchanged when using a PGD attack instead of
an FGSM attack (Fig. 2c). They also do not depend on the exact strength of the
attack (Fig. 2f), as qualitatively similar results were observed for different
attack strengths $\epsilon$.

Overall, these results highlight that spectral regularization can improve both
validation accuracy and adversarial robustness, and that the optimal $\alpha$
values can be much larger than those that are observed in the mammalian visual
system.

###  3.2 Deeper and Convolutional Architectures

To investigate how much our results depend on the network architecture and/or
task complexity, we trained deeper dense networks and convolutional networks
to categorize MNIST images of handwritten digits. We separately trained the
convolutional networks to categorize CIFAR-10 natural images (We do not
include results of dense networks on the CIFAR-10 dataset because performance
was too low.) These network architectures were chosen to match the ones used
in a recent study of spectral regularizers (Nassar et al.,, 2020).

The specific network architectures were as follows. Our deeper dense network
had three hidden layers each with 1000 neurons (tanh activation) followed by a
10 unit softmax output layer (Fig. 3a,b,c). This network was trained on MNIST.
Our convolutional network had two convolutional layers (16 filters, 3x3
kernel, and 32 units 3x3 kernel, tanh activation) followed by a dense softmax
output layer, which we trained on either MNIST (Fig. 3e,f,g) or CIFAR10 (Fig.
3g,h,i) for 200 epochs.

For each trained network, we report validation accuracy, and we report
robustness against attacks of a strength $\epsilon$. This attack strength was
chosen so as to lower the accuracy to about 50% of the validation accuracy.
The required attack strength was different for the different networks (see
figure caption). We include the results for the whole range of attack
strengths we explored in the Supplementary Material (Fig. S1).

Training the deeper dense network on the MNIST dataset showed qualitatively
the same results as we found with the shallower dense network (Fig. 2), with
an optimal $\alpha$ of $\sim 3$. Once again, weak regularization showed the
best validation accuracy (Fig. 3a). Stronger regularization led to more
robustness against adversarial attacks, and we observe that $\alpha\sim 2$
provides the best protection against attacks (Fig. 3b,c).

When training the convolutional network on the MNIST dataset, there was no
clear peak defining the optimal $\alpha$ value, and strong regularization only
provided an improvement on PDG attacks. Nevertheless, lower $\alpha$ values
were generally associated with better validation accuracy in this case.

Finally, training the CNN on the MNIST dataset showed a surprising plateau for
values of $\alpha<1$ for validation accuracy. For robustness against attacks,
we observe a broad peak around $\alpha\sim 3$.

These results reinforce our conclusions obtained with the shallow dense
network, namely that spectral regularization can improve both validation
accuracy and adversarial robustness, and that the optimal $\alpha$ values can
be quite different from those that are observed in the mammalian visual system
(which are $\sim 1$).

##  4 Limitations

While we have demonstrated our main conclusions for a variety of network
architectures and for tasks of two different levels of complexity, our study
nevertheless has several limitations that must be acknowledged.

First, we have only investigated network architectures of relatively small
size. State of the art networks often use far larger architectures which might
benefit from different $\alpha$ values than the ones observed here. Also while
the architectures we studied here were limited to dense and convolutional
networks, there are other relevant architectures that were not included. For
example, transformer networks might have an entirely different optimal
$\alpha$ value, and the results of Ghosh et al., (2022) suggest that very low
$\alpha$ values (much less than 1) might be optimal for these architectures.
We leave the test of this hypothesis for future work.

Second, we limited our investigation to image classification tasks, in part to
stay close to the work of Stringer et al., (2019) that reported findings on
the mammalian visual system. But even for image based tasks, classification is
not the only relevant task: image transformations or video prediction tasks
(Bakhtiari et al.,, 2021) could lead to different preferred $\alpha$ values.

Finally, while our work is inspired by the properties of the mammalian visual
system, we have investigated only feedforward neural networks here. While this
choice is consistent with much previous work in this area (Safarani et al.,,
2021; Nassar et al.,, 2020; Federer et al.,, 2020; Christensen and
Zylberberg,, 2020; Khaligh-Razavi and Kriegeskorte,, 2014; Yamins et al.,,
2014), it nevertheless has importance deviation from the recurrent structure
of the brain’s neural circuits. This discrepancy might be important to
consider when observing that ANNs show different optimal representations
compared to those found in the brain.

##  5 Discussion

We investigated how the dimensionality of intermediate representation affects
the performance and adversarial robustness of dense and convolutional neural
networks trained on MNIST and CIFAR-10 object recognition tasks. We performed
this investigation by adjusting the power law exponent of of the eigenspectrum
of the covariance matrix of unit activations with a regularizer: higher power
law exponents correspond to lower dimensionality and vice versa. Previous
results and theoretical derivations from Stringer et al., (2019), Nassar et
al., (2020), or Ghosh et al., (2022) suggested that a power-law exponent of
$\alpha\sim 1$ would be the optimal representation because that corresponds to
the highest-dimensional representation that is still smooth.

Ghosh et al., (2022) studied networks trained without spectral regularization
and found that the best-performing networks (in terms of categorization
performance) had $\alpha\sim 1$. The difference between these findings and
ours could be attributed to the difference between letting the networks train
and the seeing what $\alpha$ value is associated with good performance (the
approach of Ghosh et al., (2022)) vs using regularizing to change the $\alpha$
value and then asking which target $\alpha$ is best (our approach). In other
words, networks that learn to do the task well might converge to $\alpha\sim
1$ even if forcing $\alpha\to 1$ does not guarantee better performance. In
that sense, $\alpha\sim 1$ may not be _causally_ linked to improved
performance in neural networks.

Given that Stringer et al., (2019) presented insightful theoretical arguments
for why optimal representations should have $\alpha\sim 1$, it is natural to
ask why our findings deviate so strongly from that value. Recall that Stringer
et al., (2019) argue that an $\alpha$ value of $1+2/d$ would lead to a
representation with maximal dimensionality while still keeping the
representation smooth. Therefore, $\alpha$ values above one (for large input
data dimensionality $d$) would be lower dimensional than is optimal.
Consistent with notion, Stringer et al., (2019) find that neural data from
visual cortex is consistent with $\alpha\sim 1$. For contrast, we find that
higher values of $\alpha$ typically improve performance in our ANNs.

One speculative explanation for this discrepancy is that, while the brain is
optimized for a wide variety of stimuli and tasks, and hence benefits from
higher-dimensional representations Rigotti et al., (2013), our ANNs were
trained on a single image type and task. For these very restricted tasks, it
may be more beneficial (in terms of generalization error and adversarial
robustness) for the network to extract a small number of task-relevant
relevant image features rather than a higher-dimensional representation. This
lower dimensionality corresponds to the higher $\alpha$ values we observed.

The spectral regularization approach to comparing ANN representations to brain
representations has the advantage of simplicity and it can be applied in
principle to any task, including those for which no brain data is available.
At the same time, other, more sophisticated approaches have also been pursued
that tailor object recognition neural networks to more directly mimic the
brain’s visual representations. For example, Federer et al., (2020)
regularized convolutional networks to representation similarity matrices that
are close to those obtained in the visual cortex when an animal views images,
and Safarani et al., (2021) which directly trained their network to predict
neural responses. This latter approach forces the network to extract
sufficient stimulus information to predict the neural responses, and thus
encourages a more brain-like representation. Compared to our spectral
regularization approach, these other methods require training data consisting
of neural activity data and the corresponding images. This limits the
application of these methods to cases were such data are available.

##  6 Potential negative societal impacts

Our work currently only addresses classification of MNIST and CIFAR-10
datasets which are itself quite limited for applications with wide societal
impact. Of course this work of using an optimal spectral representation can
lead to performance gains in larger and more directly relevant classification
tasks and thus also potentially impact society. In general, transitioning to
networks more robust against adversarial attacks should provide more safety
for systems that critically rely on machine learning, e.g. autonomous
vehicles. At the same time, it might also lead to less defense against
possibility malevolent uses of machine learning systems, e.g. autocratic
surveillance systems.

##  7 Data Availability Statement

There are no primary data in the paper, all code is available at
https://github.com/rgerum/spectral-representations under MIT licence.

##  8 Software and Datasets

Experiments were run with Python (Van Rossum and Drake,, 2009) using Keras
(Chollet et al.,, 2015) and the Tensorflow backend (Abadi et al.,, 2015).
Evaluations used Numpy, Pandas. Results were visualised using Matplotlib
(Hunter,, 2007) and Pylustrator (Gerum,, 2020).

We used the MNIST (LeCun et al.,, 1998) (released under the "Creative Commons
Attribution-Share Alike 3.0 license") and the CIFAR-10 (Krizhevsky,, 2009)
datasets (no license specified). Datasets are loaded using the respective
Keras functions which include a split into training and validation data.

Experiments were run on a personal computer equipped with Intel® Core™
i9-10980XE CPU @ 3.00GHz × 36 and a NVIDIA GeForce RTX 3080 and on a Shared
Cluster with NVIDIA P100 and V100 GPUs.

## References

  * Abadi et al., (2015) Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G. S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Levenberg, J., Mané, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., Talwar, K., Tucker, P., Vanhoucke, V., Vasudevan, V., Viégas, F., Vinyals, O., Warden, P., Wattenberg, M., Wicke, M., Yu, Y., and Zheng, X. (2015).  TensorFlow: Large-scale machine learning on heterogeneous systems.  Software available from tensorflow.org.
  * Bakhtiari et al., (2021) Bakhtiari, S., Mineault, P., Lillicrap, T., Pack, C., and Richards, B. (2021).  The functional specialization of visual cortex emerges from training parallel pathways with self-supervised predictive learning.  Advances in Neural Information Processing Systems, 34.
  * Chollet et al., (2015) Chollet, F. et al. (2015).  Keras.  https://keras.io.
  * Christensen and Zylberberg, (2020) Christensen, E. and Zylberberg, J. (2020).  Models of primate ventral stream that categorize and visualize images.  bioRxiv.
  * Federer et al., (2020) Federer, C., Xu, H., Fyshe, A., and Zylberberg, J. (2020).  Improved object recognition using neural networks trained to mimic the brain’s statistical properties.  Neural Networks, 131:103–114.
  * Gerum, (2020) Gerum, R. (2020).  pylustrator: code generation for reproducible figures for publication.  JOSS, 5(51):1–4.
  * Ghosh et al., (2022) Ghosh, A., Mondal, A. K., Agrawal, K. K., and Richards, B. (2022).  Investigating power laws in deep representation learning.
  * Goodfellow et al., (2014) Goodfellow, I. J., Shlens, J., and Szegedy, C. (2014).  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572.
  * Hunter, (2007) Hunter, J. D. (2007).  Matplotlib: A 2d graphics environment.  Computing in Science & Engineering, 9(3):90–95.
  * Khaligh-Razavi and Kriegeskorte, (2014) Khaligh-Razavi, S.-M. and Kriegeskorte, N. (2014).  Deep supervised, but not unsupervised, models may explain it cortical representation.  PLoS computational biology, 10(11):e1003915.
  * Kong et al., (2022) Kong, N. C. L., Margalit, E., Gardner, J. L., and Norcia, A. M. (2022).  Increasing neural network robustness improves match to macaque v1 eigenspectrum, spatial frequency preference and predictivity.  PLOS Computational Biology, 18(1):1–25.
  * Krizhevsky, (2009) Krizhevsky, A. (2009).  Learning multiple layers of features from tiny images.  Technical report, .
  * LeCun et al., (1998) LeCun, Y., Bottou, L., Bengio, Y., and Haffner, P. (1998).  Gradient-based learning applied to document recognition.  Proceedings of the IEEE, 86(11):2278–2324.
  * Mądry et al., (2017) Mądry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017).  Towards deep learning models resistant to adversarial attacks.  stat, 1050:9.
  * Nassar et al., (2020) Nassar, J., Sokol, P., Chung, S., Harris, K. D., and Park, I. M. (2020).  On 1/n neural representation and robustness.  In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H., editors, Advances in Neural Information Processing Systems, volume 33, pages 6211–6222. Curran Associates, Inc.
  * Richards et al., (2019) Richards, B. A., Lillicrap, T. P., Beaudoin, P., Bengio, Y., Bogacz, R., Christensen, A., Clopath, C., Costa, R. P., de Berker, A., Ganguli, S., et al. (2019).  A deep learning framework for neuroscience.  Nature neuroscience, 22(11):1761–1770.
  * Rigotti et al., (2013) Rigotti, M., Barak, O., Warden, M. R., Wang, X.-J., Daw, N. D., Miller, E. K., and Fusi, S. (2013).  The importance of mixed selectivity in complex cognitive tasks.  Nature, 497(7451):585–590.
  * Safarani et al., (2021) Safarani, S., Nix, A., Willeke, K., Cadena, S., Restivo, K., Denfield, G., Tolias, A., and Sinz, F. (2021).  Towards robust vision by multi-task learning on monkey visual cortex.  In Ranzato, M., Beygelzimer, A., Dauphin, Y., Liang, P., and Vaughan, J. W., editors, Advances in Neural Information Processing Systems, volume 34, pages 739–751. Curran Associates, Inc.
  * Stringer et al., (2019) Stringer, C., Pachitariu, M., Steinmetz, N., Carandini, M., and Harris, K. D. (2019).  High-dimensional geometry of population responses in visual cortex.  Nature, 571(7765):361–365.
  * Van Rossum and Drake, (2009) Van Rossum, G. and Drake, F. L. (2009).  Python 3 Reference Manual.  CreateSpace, Scotts Valley, CA.
  * Yamins and DiCarlo, (2016) Yamins, D. L. and DiCarlo, J. J. (2016).  Using goal-driven deep learning models to understand sensory cortex.  Nature neuroscience, 19(3):356–365.
  * Yamins et al., (2014) Yamins, D. L., Hong, H., Cadieu, C. F., Solomon, E. A., Seibert, D., and DiCarlo, J. J. (2014).  Performance-optimized hierarchical models predict neural responses in higher visual cortex.  Proceedings of the national academy of sciences, 111(23):8619–8624.
  * Zhuang et al., (2021) Zhuang, C., Yan, S., Nayebi, A., Schrimpf, M., Frank, M. C., DiCarlo, J. J., and Yamins, D. L. (2021).  Unsupervised neural network models of the ventral visual stream.  Proceedings of the National Academy of Sciences, 118(3).

## Supplementary Material

Figure S1: Robustness against adversarial attacks for the different networks
used in the main text: deep MLP, CNN MNIST and CNN CIFAR-10. Upper row: FGSM
attack, lower row: PGD attack, columns correspond to different attack
strengths. Results for baseline (blue) weak (orange) and strong (green)
regularisation.


# A guided light system for agile individual addressing of Ba+ qubits with
$10^{-4}$ level intensity crosstalk

Ali Binai-Motlagh, Matthew Day, Nikolay Videnov, Noah Greenberg, Crystal
Senko, and Rajibul Islam  Institute for Quantum Computing and Department of
Physics and Astronomy, University of Waterloo, Waterloo, Ontario, N2L 3G1,
Canada

###### Abstract

Trapped ions are one of the leading platforms for quantum information
processing, exhibiting the highest gate and measurement fidelities of all
contending hardware. In order to realize a universal quantum computer with
trapped ions, independent and parallel control over the state of each qubit is
necessary. The manipulation of individual qubit states in an ion chain via
stimulated Raman transitions generally requires light focused on individual
ions. In this manuscript, we present a novel, guided-light individual
addressing system for hyperfine Ba+ qubits. The system takes advantage of
laser-written waveguide technology, enabled by the atomic structure of Ba+,
allowing the use of visible light to drive Raman transitions. Such waveguides
define the spatial mode of light, suppressing aberrations that would have
otherwise accumulated in a free-space optics set up. As a result, we
demonstrate a nearest neighbour relative intensity crosstalk on the order of
10-4, without any active aberration compensation. This is comparable to or
better than other previous demonstrations of individual addressing. At the
same time, our modular approach provides independent and agile control over
the amplitude, frequency, and phase of each channel; combining the strengths
of previous implementations.

##  I Introduction

Trapped ions have the longest coherence times [1, 2], highest fidelity single
and two qubit gate operations [3, 4] as well as state-preparation and
measurement (SPAM) fidelities [5, 6, 7] of any experimental quantum
information processing (QIP) platform. In recent years, barium has emerged as
a popular candidate for trapped ion QIP due to the availability of a spin-1/2
isotope, long lived meta-stable states and visible wavelength atomic
transitions. This favourable atomic structure has allowed for the highest
experimentally demonstrated SPAM fidelities of any experimental qubit [8]. For
applications in QIP, the ability to manipulate the quantum state of individual
ions is of utmost importance. Independent, coherent control of one or more
qubits encoded in the hyperfine structure of an ion can be accomplished via
stimulated Raman transitions. This experimental challenge is realized by
tightly focusing individual laser beams at chosen ion sites across a chain [9,
10]. The focus of this manuscript is on the necessary optical infrastructure
needed for the individual addressing of long chains ($N>10$) of Ba+ ions with
low crosstalk and independent control. The visible wavelength Raman transition
(532 nm) in Ba+ ions enables the use of laser-written waveguides as well as
fiber coupled AOMs. The operation of the former has not been demonstrated in
the UV, while the latter is not commercially available for such short
wavelengths. The ion of choice for many previous demonstrations of quantum
computation has been ${}^{171}\mathrm{Yb}^{+}$, with 355 nm Raman transitions.
${}^{133}\mathrm{Ba}^{+}$ has all the same desirable properties of
${}^{171}\mathrm{Yb}^{+}$, with the added benefit of visible wavelength
transitions, that enable the use of new optical technologies for robust
quantum control of the ion. The ability to split and modulate light in
waveguides, afforded by the use of such technologies, is central to the
benefits of our implementation.

For complete quantum control over a chain of ions, an individual addressing
system must provide agile (with a time scale faster than the single qubit gate
time) and independent control over the temporal characteristics (intensity,
frequency, phase) of each beam. These are key requirements for enabling
arbitrary single qubit, and high fidelity multi-qubit entangling gates as well
as several quantum simulation protocols [11, 12]. Another major concern for
the design of such a system is the intensity crosstalk between ion sites due
to overlap of neighbouring laser beams. This presents a demanding optical
engineering challenge as for most ions, the diffraction limited spot of the
individual addressing beam is on order of a micron while the ion spacing is at
most several microns in a typical chain. Thus, one must consider the error
introduced to neighbouring sites when a given ion is addressed. Since this
error is unitary, algorithmic techniques can be used to reduce the effects of
crosstalk at the cost of greater circuit depth [13]. However, to get the most
out of NISQ devices it is more favourable to reduce this error through optical
engineering. A good target for the crosstalk intensity, relative to the
intensity of the target ion, is 10-4. Under a suitable optical scheme, this
translates to a gate error on the order of $10^{-4}$ which is below the
threshold for many error correcting codes for fault-tolerant quantum
computation [14].

Previous demonstrations of individual addressing have been enabled by three
predominant technologies: micro-mirrors, multi-channel acousto optic
modulators (MAOMs) and acousto-optic deflectors (AODs). Table 1 provides a
comparison of each of these technologies. Beam steering with a single micro-
mirror device allows the deflection of a high quality beam between array
sites, leading to low crosstalk between sites at the expense of serial
addressing [15]. Holographic beam shaping has further extended the micro-
mirror device concept by using micro-mirror arrays, with each mirror much
smaller than the beam size such that arbitrary beam profiles can be generated
at ion sites [16]. This allows for parallel, selective addressing with low
crosstalk at the sacrifice of independent control of the frequency of each
beam. While independent control over the intensity of each channel is
possible, the slow switching rate of the micro-mirrors inhibits pulse shaping
for the purpose of optimal control. AODs allow for agile intensity control,
however, they also cannot provide independent frequency control at specific
ion sites. On the other hand, independent and agile control of frequency,
intensity and phase can be accomplished through the use of MAOMs, which can
generate an array of beams using a single diffractive optical element.
However, since the MAOM is formed from a single crystal with individual
acoustic transducers utilized to generate each beam, there is significant
crosstalk between neighboring channels [9, 17]. To combine full independent
control of each beam with low cross talk, we propose a guided-light individual
addressing system (GLIAS) that makes use of a laser-written waveguide
splitter, manufactured using femtosecond laser direct-write (FLDW), and fiber
coupled AOMs for the individual addressing of trapped ions. The use of
waveguides suppresses aberrations that would otherwise be introduced in a
free-space optical system. Fiber coupled AOMs allow for Agile and independent
control of each channel’s temporal characteristics without distortion of the
beam’s spatial profile.

| Intensity Crosstalk | Intensity Control | Frequency Control | Phase Control
---|---|---|---|---
AOD [18] | 5e-3 | ✓ |  | ✓
DMD [16] | 1e-4 | ✓* |  | ✓*
MCAOM [17] | 1e-3 | ✓ | ✓ | ✓
GLIAS | 1e-4 | ✓ | ✓ | ✓
Table 1: Comparison of the characteristics of several Individual addressing
systems. Check mark indicates that independent control (i.e. the ability to
control a characteristic of one channel/beam without affecting that of the
other channels) is possible. Asterisks in the DMD row indicate that
independent control is possible, however it is slow relative to typical single
qubit gate times. Figure 1: (a) Schematic of the GLIAS, starting with the
splitting done by the laser-written waveguide, modulation of the frequency and
intensity of the light with fiber AOMs, temporal overlapping of the individual
beams with delay stages, and spacial mode-matching of the ion chain with a
micro-lens array before re-imaging onto the ion plane. (b) Diagram of the
laser-written waveguide, the key enabling technology for the proposed GLIAS
for use with Ba+ ions. The laser-written waveguide is used to split light into
16 addressing channels, which can then each be fiber coupled, allowing
independent modulation with fiber based AOMs. (c) Typical beam orientation for
Raman transitions used to drive phase-stable single and two qubit gates in
trapped ion chains [19]. The overlap of two beams is necessary to modify the
quantum state of the ions. In this case one of the beams illuminates the
entire chain while the other is tightly focused on each ions. It is also
possible to replace this global beam with a second set of individual
addressing beams. This can help reduce gate errors at the cost of additional
engineering complexity.

An overview of this optical system and the orientation of the beams relative
to the ions is shown in Fig. 1. The source is a 532 nm, mode-locked laser (NKT
Photonics aeroPULSE PS) that gets divided into two beams. In the most common
configuration, the profile in one arm is for global addressing and is shaped
such that it illuminates the entire chain. The other arm is for individual
addressing and is sent through a series of optics that splits the single beam
into multiple channels and focuses each to a size significantly smaller than
the ion spacing. The amplitude of each channel can be modulated with fiber
AOMs to set the Rabi rate (the characteristic oscillation frequency of each
qubit, that sets the single qubit gate time) for single qubit gates or to
determine which ions are involved in a multi-qubit gate [19]. The normal modes
of the ions are used as a vibrational data bus to create entanglement between
two ions and hence enable the implementation of multi-qubit gates. Control
over the applied frequency provided by each AOM determines which normal modes
are used to mediate entanglement. This gives independent, agile control of
each beam at the ion plane. We discuss each element of our proposed system,
before presenting the results on the characterization of this individual
addressing scheme.

##  II System design

The GLIAS is composed of four principal sections shown in Fig. 1 (a):
splitting, modulation, path-length matching and mode-matching. Each will be
discussed in detail in the following sections.

###  II.1 Splitting and modulation

The splitting of a single beam from the laser source is implemented via a
custom laser-written waveguide array (manufactured by OptoFab, Access
Macquarie Ltd), which is written inside a monolithic block of alumino-
borosilicate glass shown in Fig. 1 (b). The chip takes a single beam and
sequentially splits the light through concatenated 50/50 evanescent
directional couplers. The initial input beam is split into 16 channels for the
individual addressing of ions. The amount of coupled light between two
waveguides is determined by the proximity as well as length of the waveguides
and typical spacing is on the order of microns. The waveguides are created by
using a high power, tightly focused femtosecond laser that locally heats up
the piece of glass onto which the waveguide is being written. This locally
changes the bonding structure of the underlying material at the focus, which
increases the local refractive index by a small amount $\approx 10^{-3}$
relative to the surrounding material [20].

Power coupling from free space into the waveguide is done with a 3-axis
translation stage and an objective (20 mm EFL, 15 mm WD, 0.25 NA). The input
waveguide is recessed into the glass by 200 $\mu$m to increase the amount of
power that can be incident on the input facet without damage. The input
waveguide has a mode field diameter of $\sim$ 4.5 $\mu$m and 2 W of average
power can be coupled without damage to the input facet. The waveguide array is
coupled into a fiber array, where the 16 individual addressing outputs of the
waveguide are each coupled to a single-mode polarization maintaining fiber
(PM460). A power tap from the input waveguide is coupled into a multi-mode
fiber. The waveguide and fiber array are bonded together using UV curable
epoxy. Care was taken to ensure that epoxy does not enter the gap between the
fiber and waveguide as the epoxy can be damaged from the high optical power,
thereby reducing the transmittance of the device. The entire device is placed
inside an aluminum case that serves to protect and strain relieve the fragile
waveguide-fiber bond.

Each of the 16 channels is sent to a fiber coupled AOM (manufactured by Gooch
$\&$ Housego PLC). The AOMs act as fast optical switches that can be used to
precisely time when light is incident on a given ion in a chain, an essential
requirement for individual quantum control. These AOMs also allow independent
modulation of the amplitude, frequency and phase of each channel, which are
key for complete control over the quantum state of the entire chain.

###  II.2 Path length matching

To drive stimulated Raman transitions, the counter propagating beams must have
spatial and temporal overlap. The spatial overlap can be obtained by suitable
imaging techniques or monitoring ion signals that rely on IA Raman beams (for
example measuring the AC stark shift). Temporal overlap is made difficult as
the fiber cables length tolerances are on the order of several millimeters. As
the pulses from the 532 nm mode-locked laser are 10 picosecond in duration,
corresponding to an approximately $L=$ 3 mm pulse length, the paths must be
matched to a length $\Delta L\ll L$. To temporally align all pulses, miniature
fiber delay stages with 4 mm of travel and a resolution of 210 $\mu$m
(manufactured by OZ Optics Ltd.) are used for each individual addressing
channel. For channels that have a length mismatch beyond what can be
accommodated by the 4 mm travel range, the corresponding fibers can be cleaved
and spliced.

Figure 2: (a) Telecentric re-imaging system for mapping the microlens array
(MLA) image onto the ion plane. The beam shape at the ion is elliptical, with
a size orthogonal to the chain that is 4 times larger than that along the
chain. This was done to reduce the magnitude of intensity fluctuations on the
ion due to instabilities in beam pointing. The elliptical beam requires
separate reshaping of the beam waists along the x-axis and y-axis with
cylindrical lenses before focusing at the ion plane with an acromatic
objective (manufactured by Special Optics Inc.). OpticStudio simulations of
the focus at the ion plane through the MLA-Telescope optical system show
$<10^{-5}$ crosstalk along the ion chain axis (x-axis). (b) Optical re-imaging
constraints set by the vacuum viewport (0.37 NA) [21] and ion spacing (4
$\mu$m), necessitating a reduction in object NA by a MLA in order to satisfy
crosstalk requirements for high fidelity gates [22]. (c) Profile and picture
of the MLA used in part to match the spatial mode of the VGA to the calculated
ion spacing. The lenses contained in each row have the same profile, but each
row of lenses are different. A single row from the MLA was used to create an
image at the ion plane. The MLA was also designed in OpticStudio.

###  II.3 Mode-matching

The guided light system terminates at the output of a 16 channel fiber array
with a 3.3 $\mu$m mode diameter and a 250 $\mu$m mode-spacing. This must be
mapped onto the 4 $\mu$m spacing between the ions in the chain. To satisfy the
pitch change, a telecentric imaging system with a demagnification of 62.5x was
built, with a design shown in Fig. 2 (a). The pitch between the ions is fixed
at 4 $\mu$m (chosen as it enables us to attain our desired crosstalk figure
while still allowing for relatively high normal modes frequencies) and the
maximum available NA is fixed at 0.37 by the geometry of the trap and the
vacuum re-entrants. Given these two constraints at the ion plane, we cannot
directly image every fiber core and still satisfy the Lagrange invariant [23].

This problem is depicted in Fig. 2 (b). At conjugate planes, the product of
the height of the chief ray and the angle of the marginal ray is conserved for
paraxial optical systems (perfect imaging). There are two plausible solutions.
One could reduce the pitch between channels, thus reducing the height of the
Chief ray or one could reduce the fiber NA, thus reducing the angle of the
Marginal ray. The former approach was dismissed as simulations indicated
significant crosstalk between neighbouring waveguides [22]. To reduce the NA
of each fiber core, an array of microlenses are placed at the facet of each
fiber to expand the beam waist out of each channel. The custom microlenses
were designed using OpticStudio and manufactured by FEMTOprint. An aspheric
profile, optimized by considering the resulting crosstalk in the ion plane as
well as typical alignment tolerances, was used to minimize spherical
aberrations in the system. A picture of these microlenses is shown in Fig. 2
(c).

Simulations of the microlenses with the telecentric imaging system indicate a
nearest neighbour intensity crosstalk of $<10^{-5}$. The simulated beam
profile after the telecentric imaging system is shown in Fig. 2 (a). The
individual addressing system is designed to be telecentric so that the
wavevectors of the beams from different channels are all parallel to each
other and orthogonal to the chain. This is necessary to minimize coupling to
the axial modes of the chain, which are not intended to be used for QIP in
this optical configuration.

##  III Results

###  III.1 Splitting ratios and maximum power throughput

All channels coming out of the waveguide were designed to have equal optical
powers, so that each ion experiences the same Rabi rate. However, as shown in
Fig. 3 (a) we observe relatively large, unpredictable variations in the power
output of each channel, due to uncontrolled fabrication variations in
individual couplers. There is roughly a factor of 5 difference in the optical
power out of the best performing channel (6) and the worst performing channel
(16). The channel with the lowest optical power determines the maximum single
qubit gate time of the computer. This variation adds a slight complexity to
the experiment as the Rabi rate of each ion must be independently known and
tracked. If equal Rabi frequencies are desired, the powers on each channel
must be made equal, which can be done by controlling the RF power sent to the
individual AOMs.

Knowledge of the power reaching the ions is of utmost importance as it sets an
upper bound on the possible Rabi rate. Insertion losses for major components
of the individual addressing system are shown in Table 2. If equal optical
power is desired for all channels, the input power must be further attenuated
by the AOMs so that all channels have the same power as the channel with the
smallest splitting ratio. This balanced output power can be increased by using
a subset of all the available channels, ignoring one or more of the channels
with the smallest output power. This is because through this omission, the
AOMs must compensate for a smaller variation in the unbalanced power out of
each channel. The curve in Fig. 3 (b) shows how the power per channel at the
ions increases as the number of included channels are reduced, where each time
we choose not to use the worst-performing channel in the set. To attain a Rabi
rate of around $2\pi\times 1~{}$MHz, we need the optical power to be around 2
mW on the individual addressing side, assuming equal optical intensities on
both arms of the individual addressing system (see supplementary). From this
curve it is evident that to attain our desired $2\pi\times 1~{}$MHz Rabi rate,
we must exclude the two worst-performing channels (channels 15 and 16). It may
be possible to extract more power from the device by splicing each subsystem
of the individual addressing device together and shortening the length of the
fibers. This data is based on an input average power of 2 W into the waveguide
chip, which is below the damage threshold for the chip.

To protect against power fluctuations due to temperature gradients produced by
ambient fluctuations or scattered light, active control of the temperature was
built into the protected waveguide casing. Varying the temperature from 20-26
∘C, well beyond the expected change in the temperature of the device, we
observe a relatively small change in the splitting ratio (at most 0.6%). This
data is shown in Fig. 3 (a).

Element |  | Insertion loss (dB)
---
Waveguide | 5 $\pm 0.4$
Waveguide-VGA bond + Fibers | 4.9 $\pm 0.4$
AOM (single device) | 3 $\pm 0.4$
Variable Delay lines | 1.9-4.6 $\pm 0.4$
VGA | 1.4 $\pm 0.4$
Telescope + Viewport | 1.2 $\pm 0.4$
Table 2: Breakdown of the insertion loss of the major components of the
guided-light individual addressing system. Besides loss of power from
individual components, mismatch in the output power from different waveguide
channels is a limiting factor in maximum obtainable uniform power at each ion
site across the chain. Loss from power matching is characterised in Fig. 3.
Errors are calculated based on the measurement uncertainty of the power sensor
used for measurements ($\pm 3\%$).

###  III.2 Path length matching characterisation

To optimize the temporal overlap we send light from two channels of the FLDW
splitter chip through to the VGA and block the rest using the AOMs. The
resulting interference pattern formed by the two beams is then captured using
a camera, at a point where they have significant spatial overlap. If there is
no temporal overlap between the pulses then no interference fringes will be
detected on the camera. The overlap between the pulses can be optimized by
maximizing the contrast of the resulting fringes, through displacement of the
fiber delay stages. The experiment is described in Fig. 4 (a) and the
resulting fringe contrast is shown in Fig. 4 (b). Prior to optimization, the
fringes are faint and hard to detect. After optimization, we see a clear
interference pattern with large fringe contrast. For some channels in the
system, the 4 mm range of the stages was not sufficient to fully optimize the
interference pattern. For these, we use a pair of stages with longer travel
range to precisely determine the length mismatch then splice the fibers to
correct for this difference. For further fine tuning of the spatial and
temporal overlap, the measured Rabi frequency or AC stark-shift at the ions
can be used as the feedback signal.

Figure 3: (a) Relative power output of a single-mode fiber glued to each
channel of the laser-written waveguide. (b) The maximum balanced power per
channel as a function of the number of channels included. Error bars are
calculated based on the measurement uncertainty of the power sensor used for
measurements ($\pm 3\%$). Figure 4: (a) Overview of the entire IA system with
fiber delay stages to ensure that the pulses arrive at the ions at the same
time. Stages with 4 mm travel range were used to achieve temporal overlap
between a pair of beams in the individual addressing system. (b) Fringe
contrast created by the overlap of the two beams. Maximizing the fringe
contrast ensures that all pulses arrive at the ions at the same time. For the
purpose of path length matching, all AOMs are set to the same frequency.

###  III.3 Microlens array characterisation

The microlenses are manufactured using ultrafast lasers to locally modify the
index and density of a piece of glass. This technique combined with chemical
etching can be used to realize complex three dimensional structures in glass,
such as our microlenses. The initial set of fabricated microlenses possessed a
shorter focal length than what we had designed for, possibly due to the lens
polishing step in the manufacturing process. To account for these fabrication
inaccuracies, a grid of microlenses was designed with a range of effective
focal lengths (EFL) starting from 0.525 mm and going up to 1 mm in 0.025 mm
increments. A total of 20 microlens arrays (MLA) were produced, with each
array (row) containing identical microlenses. Through this process, we were
able to identify a row with the desired EFL.

Figure 5: (a) High-dynamic range images of the IA beams measured on the
DataRay WinCamD beam profiling camera. The beams after the MLA are imaged onto
the camera using a single 250 mm focal length lens, providing a 0.5x
magnification. Only two channels exhibit significantly higher crosstalk than
expected, likely due to manufacturing imperfections of the MLA. Error bars are
too small to be seen in the plot. (b) Intensity on each ion site when light is
shining on its nearest neighbour(s). (c) Profile of a beam at the ion plane
after the entire IA system, measured using the Raspberry Pi NoIR V2 camera.
This shows crosstalk at the 10-4 level, consistent with the prior measurements
at lower magnification. The red dashed line indicates the noise floor for the
measurement. Errors are calculated based on typical CMOS sensor dark noise,
read-out noise as well as the photon shot noise.

###  III.4 Crosstalk intensity characterisation

To characterize the intensity crosstalk between channels, the beams after the
MLA are imaged onto a camera using a single 250 mm focal length lens,
providing a 0.5x magnification. Several profiles at multiple exposures were
recorded and stitched together, to obtain a single profile with sufficient
dynamic range to assess the crosstalk level between the neighbouring channels.
The beam profile images are taken with one channel turned on at a time. The
data for all 16 channels is shown in Fig. 5 (a). The profiles near the left
end of the the system are broadened compared to the rest of the channels and
as a result exhibit a larger amount of intensity crosstalk. For the first
three channels, the crosstalk is on the order of 10-3. For the rest, it is on
the order of 10-4. This asymmetry is most likely due to imperfections in the
MLA manufacturing process. Fig. 5 (b) elucidates this by showing the crosstalk
for each channel, when its nearest neighbours are simultaneously turned on.

To verify these results, the crosstalk measurement was repeated for a single
channel after the full individual addressing system (62.5x demagnification).
To capture the beam profile at the ion plane, a camera with a relatively small
pixel size is required, given that the expected beam waist at the focus of the
objective is around 0.9 $\mu$m. For this we use the Raspberry Pi Noir V2
camera. It is a color camera with each unit cell consisting of 2 green pixels,
one red pixel and one blue pixel. The size of each unit cell is 1.12 $\mu$m,
thus the resolution is too low relative to the beam radius to obtain a precise
beam profile. Nevertheless, the measured intensity crosstalk level should be
comparable to that obtained in the prior measurement. This profile is shown in
Fig. 5 (c). Our measurements indicate an intensity crosstalk slightly greater
than 10-4, 4 $\mu$m away from the peak, at the location of the neighbouring
ions. This is commensurate with the data shown in Fig. 5 (a).

##  IV Conclusion

In this paper we demonstrated the design and characterization of a individual
addressing system suited for digital quantum computation and analog simulation
with a chain of up to 16 Barium ions. The system utilizes fiber optic and
waveguide technology, making it modular and thus scalable and upgradable if
addressing of larger chains is desired. This modularity also means that we
could replace the waveguide chip, if we are able to design and manufacture one
with a more balanced splitting ratio, without affecting the alignment of the
system to the ions. Our architecture is not limited to FLDW technology. Future
upgrades could replace this chip with higher index contrast, lithographically
defined integrated waveguides, reducing crosstalk due to evanescent coupling.
This crosstalk sets a threshold on the minimum possible waveguide pitch.
Reduction of this threshold would allow the Lagrange invariant to be satisfied
through a change in the pitch of the VGA fibers, thus removing the need for a
MLA and thereby further reducing the number of mechanical degrees of freedom.
This control would also allow for the pitch to be exactly tailored to the
pitch of the ion chain which is necessary for chains with non-uniform spacing.

We measure an intensity crosstalk on the order of 10-4. If the other arm of
the Raman system in Fig. 1 globally illuminates the ions then the resulting
error in the Rabi rate is proportional to the square root of the intensity
crosstalk. This corresponds to a crosstalk error in Rabi rate of 1% [24, 25],
which is comparable to the state-of-the-art. To make this more concrete, if a
$\pi$-pulse is performed on a desired ion, this crosstalk means that its
nearest neighbours undergo a $\pi$/100 pulse. To reduce this error further,
one can implement individual addressing for both arms of the Raman system in
which case the error in the Rabi rate scales linearly with the intensity
(assuming equal intensity in the two beams). This will result in a crosstalk
error in Rabi rate of 0.01%, commensurate with requirements of quantum error
correction algorithms [14]. At the same time, our individual addressing system
provides rapid, simultaneous control over the frequency, phase and amplitude
of each beam using fiber coupled AOMs. This independent control is necessary
for simulation of arbitrary fully connected spin models with ions [12, 26].
Further, the use of waveguides and fibers simplifies optical alignment and
makes the system modular. Maintenance or upgrades to one part of the system
has no effect on the alignment of components downstream from it. The use of
this technology is not limited in scope to unitary qubit operations. FLDW
waveguide technology is compatible with 493 nm, the S1/2 to P1/2 transition
wavelength of the Barium ion, which is used for quantum state detection. Thus
our system can be used for independent and agile state detection, in addition
to unitary gate operations. This enables the implementation of mid-circuit
measurement which is key to the realization of quantum error correction.

## Acknowledgements

This research was supported in part by the Natural Sciences and Engineering
Research Council of Canada (NSERC), Grant Nos. RGPIN-2018-05253 and
RGPIN-2018-05250, and the Canada First Research Excellence Fund (CFREF), Grant
No. CFREF-2015-00011. CS is also supported by a Canada Research Chair.

## References

  * Harty  _et al._ [2014] T. Harty, D. Allcock, C. Ballance, L. Guidoni, H. Janacek, N. Linke, D. Stacey, and D. Lucas, Physical Review Letters 113, 10.1103/physrevlett.113.220501 (2014).
  * Wang  _et al._ [2021] P. Wang, C.-Y. Luan, M. Qiao, M. Um, J. Zhang, Y. Wang, X. Yuan, M. Gu, J. Zhang, and K. Kim, Nature Communications 12, 10.1038/s41467-020-20330-w (2021).
  * Gaebler  _et al._ [2016] J. P. Gaebler, T. R. Tan, Y. Lin, Y. Wan, R. Bowler, A. C. Keith, S. Glancy, K. Coakley, E. Knill, D. Leibfried, and D. J. Wineland, Phys. Rev. Lett. 117, 060505 (2016).
  * Ballance  _et al._ [2016] C. Ballance, T. Harty, N. Linke, M. Sepiol, and D. Lucas, Physical Review Letters 117, 10.1103/physrevlett.117.060504 (2016).
  * Christensen  _et al._ [2020] J. E. Christensen, D. Hucul, W. C. Campbell, and E. R. Hudson, npj Quantum Information 6, 10.1038/s41534-020-0265-5 (2020).
  * Ransford  _et al._ [2021] A. Ransford, C. Roman, T. Dellaert, P. McMillin, and W. C. Campbell, Phys. Rev. A (Coll. Park.) 104 (2021).
  * An  _et al._ [2022a] F. A. An, A. Ransford, A. Schaffer, L. R. Sletten, J. Gaebler, J. Hostetter, and G. Vittorini, High fidelity state preparation and measurement of ion hyperfine qubits with I $>$ 1/2 (2022a).
  * An  _et al._ [2022b] F. A. An, A. Ransford, A. Schaffer, L. R. Sletten, J. Gaebler, J. Hostetter, and G. Vittorini, Phys. Rev. Lett. 129, 130501 (2022b).
  * Debnath  _et al._ [2016] S. Debnath, N. M. Linke, C. Figgatt, K. A. Landsman, K. Wright, and C. Monroe, Nature 536, 63 (2016), arXiv:1603.04512 .
  * Nam  _et al._ [2020] Y. Nam, J.-S. Chen, N. C. Pisenti, K. Wright, C. Delaney, D. Maslov, K. R. Brown, S. Allen, J. M. Amini, J. Apisdorf, K. M. Beck, A. Blinov, V. Chaplin, M. Chmielewski, C. Collins, S. Debnath, K. M. Hudek, A. M. Ducore, M. Keesan, S. M. Kreikemeier, J. Mizrahi, P. Solomon, M. Williams, J. D. Wong-Campos, D. Moehring, C. Monroe, and J. Kim, npj Quantum Information 6, 10.1038/s41534-020-0259-3 (2020).
  * Leung  _et al._ [2018] P. H. Leung, K. A. Landsman, C. Figgatt, N. M. Linke, C. Monroe, and K. R. Brown, Phys. Rev. Lett. 120, 020501 (2018).
  * Teoh  _et al._ [2020] Y. H. Teoh, M. Drygala, R. G. Melko, and R. Islam, Quantum Science and Technology 5, 024001 (2020).
  * Parrado-Rodríguez  _et al._ [2021] P. Parrado-Rodríguez, C. Ryan-Anderson, A. Bermudez, and M. Müller, Quantum 5, 487 (2021).
  * Benhelm  _et al._ [2008] J. Benhelm, G. Kirchmair, C. F. Roos, and R. Blatt, Nature Physics 4, 463 (2008).
  * Crain  _et al._ [2014] S. Crain, E. Mount, S. Baek, and J. Kim, Applied Physics Letters 105, 181115 (2014).
  * Shih  _et al._ [2021] C.-y. Shih, S. Motlakunta, N. Kotibhaskar, M. Sajjan, R. Hablützel, and R. Islam, npj Quantum Information 7, 10.1038/s41534-021-00396-0 (2021).
  * Egan [2021] L. N. Egan,  _Scaling Quantum Computers With Long Chains of Trapped Ions_ , Ph.D. thesis, University of Maryland, College Park (2021).
  * Pogorelov  _et al._ [2021] I. Pogorelov, T. Feldker, C. D. Marciniak, L. Postler, G. Jacob, O. Krieglsteiner, V. Podlesnic, M. Meth, V. Negnevitsky, M. Stadler, B. Höfer, C. Wächter, K. Lakhmanskiy, R. Blatt, P. Schindler, and T. Monz, PRX Quantum 2, 10.1103/prxquantum.2.020343 (2021).
  * Haljan  _et al._ [2005] P. C. Haljan, K.-A. Brickman, L. Deslauriers, P. J. Lee, and C. Monroe, Phys. Rev. Lett. 94, 153602 (2005).
  * Davis  _et al._ [1996] K. M. Davis, K. Miura, N. Sugimoto, and K. Hirao, Opt. Lett. 21, 1729 (1996).
  * Greenberg [2020] N. Greenberg,  _Vacuum and Optical Designs for an Open-access Trapped Ion Quantum Processor_ , Master’s thesis, University of Waterloo, Waterloo (2020).
  * Videnov [2021] N. Videnov,  _Optical Design for an Open Access Trapped Ion Quantum Processor_ , Master’s thesis, University of Waterloo, Waterloo (2021).
  * Greivenkamp [2004] J. E. Greivenkamp,  _Field guide to geometrical optics_ (SPIE Press, 2004).
  * Ozeri  _et al._ [2007] R. Ozeri, W. M. Itano, R. B. Blakestad, J. Britton, J. Chiaverini, J. D. Jost, C. Langer, D. Leibfried, R. Reichle, S. Seidelin, J. H. Wesenberg, and D. J. Wineland, Physical Review A 75, 10.1103/physreva.75.042329 (2007).
  * Wineland  _et al._ [2003] D. J. Wineland, M. Barrett, J. Britton, J. Chiaverini, B. DeMarco, W. M. Itano, B. Jelenković, C. Langer, D. Leibfried, V. Meyer, T. Rosenband, and T. Schätz, Philosophical Transactions of the Royal Society of London. Series A: Mathematical, Physical and Engineering Sciences 361, 1349 (2003).
  * Rajabi  _et al._ [2019] F. Rajabi, S. Motlakunta, C.-Y. Shih, N. Kotibhaskar, Q. Quraishi, A. Ajoy, and R. Islam, npj Quantum Information 5, 10.1038/s41534-019-0147-x (2019).