Wiretap channel capacity: Secrecy criteria, strong converse, and phase change

TL;DR

This paper analyzes the capacity of the discrete memoryless wiretap channel under four secrecy criteria using equal-image-size source partitioning, revealing differences in capacity and phase change phenomena depending on the criteria and tolerances.

Contribution

It introduces a unified approach to derive capacities under various secrecy criteria and uncovers phase change phenomena and conditions for the strong converse property.

Findings

Capacities differ under various secrecy criteria with non-zero error and secrecy tolerances.

Strong converse property holds only under tail probability-based criteria.

Phase change phenomenon occurs as secrecy tolerances vary.

Abstract

This paper employs equal-image-size source partitioning techniques to derive the capacities of the general discrete memoryless wiretap channel (DM-WTC) under four different secrecy criteria. These criteria respectively specify requirements on the expected values and tail probabilities of the differences, in absolute value and in exponent, between the joint probability of the secret message and the eavesdropper's observation and the corresponding probability if they were independent. Some of these criteria reduce back to the standard leakage and variation distance constraints that have been previously considered in the literature. The capacities under these secrecy criteria are found to be different when non-vanishing error and secrecy tolerances are allowed. Based on these new results, we are able to conclude that the strong converse property generally holds for the DM-WTC only under the two secrecy criteria based on constraining the tail probabilities. Under the secrecy criteria based on the expected values, an interesting phase change phenomenon is observed as the tolerance values vary.

Equations

$$\mathrm{Pr}\left\{{\phi }^n(Y^n)\ne M\right\}\le {ϵ}_n$$

$$\Vert P_{M,Z^n}-P_M{P}_{Z^n}{\Vert }_1$$

$$\triangleq \frac{1}{2}\sum _{(m,z^n)\in \mathcal{M}\times {\mathcal{Z}}^n}\left|P_{M,Z^n}(m,z^n)-P_M(m)P_{Z^n}(z^n)\right|$$

$$P_{M,Z^n}\left(\left\{(m,z^n)\in \mathcal{M}\times {\mathcal{Z}}^n:\frac{P_M(m)P_{Z^n}(z^n)}{P_{M,Z^n}(m,z^n)}\ge \tau \right\}\right)$$

$$\to 1\text{ as }n\to \infty$$

$$v(m,z^n)\triangleq \{\begin{array}{ll}{\left[1-\frac{P_M(m)P_{Z^n}(z^n)}{P_{M,Z^n}(m,z^n)}\right]}^{+}& \text{if }{P}_{M,Z^n}(m,z^n)>0\\ 0& \text{if }{P}_{M,Z^n}(m,z^n)=0\end{array}$$

$$i(m,z^n)\triangleq \{\begin{array}{ll}-{\log }_2\frac{P_M(m)P_{Z^n}(z^n)}{P_{M,Z^n}(m,z^n)}& \text{if }{P}_{M,Z^n}(m,z^n)>0\\ 0& \text{if }{P}_{M,Z^n}(m,z^n)=0.\end{array}$$

$${\mathbf{S}}_1({\delta }_n)$$

$${\mathbf{S}}_2({\delta }_n)$$

$${\mathbf{S}}_3(l_n)$$

$${\mathbf{S}}_4(l_n)$$

$$C(r_l)=$$

$$\underset{P_{W,U,X}}{\max }\min \left(I(Y;U|W)-I(Z;U|W)+r_l,I(Y;U,W)\right),$$

$$C(0)$$

$$C(\infty )$$

$${\mathbb{C}}_1(\delta )\triangleq \{\begin{array}{ll}C(0)& \text{if }\delta <1\\ C(\infty )& \text{otherwise}.\end{array}$$

$${\mathbb{C}}_2(ϵ,\delta )\triangleq \{\begin{array}{ll}C(0)& \text{if }ϵ+\delta <1\\ C(\infty )& \text{otherwise}.\end{array}$$

$${\mathbb{C}}_3(r_l)\triangleq C(r_l)$$

$${\mathbb{C}}_4(ϵ,r_l)\triangleq C\left(\frac{r_l}{1-ϵ}\right).$$

$${\mathcal{Q}}_n^R\triangleq \left\{q_n\in {\mathcal{Q}}_n:R\le \frac{1}{n}I(M;Y^n|Q_n=q_n)+{\zeta }_n\right\}$$

$${\mathcal{Q}}_n^S(r)\triangleq \left\{q_n\in {\mathcal{Q}}_n:\frac{1}{n}I(M;Z^n|Q_n=q_n)\le r+{\tau }_n\right\}$$

$${\Omega }_n(r)$$

$$\displaystyle\hskip 40.0ptP_{M,Z^{n}}(m,z^{n})\leq 2^{n(r+\lambda_{n})}P_{M}(m)P_{Z^{n}}(z^{n})\Big{\}},$$

$$P_{M,Z^n}\left({\Omega }_n(r)\right)\le P_{Q_n}\left({\mathcal{Q}}_n^S(r)\right)+{\mu }_n.$$

$$P_{Q_n}\left({\mathcal{Q}}_n^S(0)\right)\ge P_{M,Z^n}\left({\Omega }_n(0)\right)-{\mu }_n\ge 1-{\rho }_n-{\mu }_n.$$

$$R$$

$$\frac{1}{n}I(M;Z^n|Q_n=q_n)$$

$$R\le C(0)+{\zeta }_n+{\tau }_n$$

$$R\le C(\infty )+{\zeta }_n$$

$$\delta$$

$$\ge \sum _{(m,z^n)\in \mathcal{M}\times {\mathcal{Z}}^n\setminus {\Omega }_n(0)}{P}_{M,Z^n}(m,z^n)-P_M(m)P_{Z^n}(z^n)$$

$$\ge \sum _{(m,z^n)\in \mathcal{M}\times {\mathcal{Z}}^n\setminus {\Omega }_n(0)}{P}_{M,Z^n}(m,z^n)\left(1-2^{-n{\lambda }_n}\right)$$

$$=\left[1-2^{-n{\lambda }_n}\right]\left[1-P_{M,Z^n}\left({\Omega }_n(0)\right)\right].$$

$$P_{Q_n}\left({\mathcal{Q}}_n^S(0)\right)\ge 1-\delta -2^{-n{\lambda }_n}-{\mu }_n.$$

$$P_{Q_n}({\mathcal{Q}}_n^R\cap {\mathcal{Q}}_n^S(0))\ge 1-ϵ-\delta -{\zeta }_n-2^{-n{\lambda }_n}-{\mu }_n>0$$

$$R\le C(0)+{\zeta }_n+{\tau }_n$$

Full text

I Introduction

The discrete memoryless wiretap channel (DM-WTC) $(\mathcal{X},P_{Y,Z|X},\mathcal{Y}\times\mathcal{Z})$ consists of a sender $X$, a legitimate receiver $Y$, and an eavesdropper $Z$. A message $M$ is to be sent reliably from $X$ to $Y$ and discreetly against eavesdropping by $Z$. Over $n$ uses of the DM-WTC, let $f^{n}:\mathcal{M}\rightarrow\mathcal{X}^{n}$ and $\varphi^{n}:\mathcal{Y}^{n}\rightarrow\mathcal{M}$ be the encoding and decoding functions respectively employed at $X$ and $Y$, where $\mathcal{M}=[1:2^{nR}]$ is the message set and $M$ is uniformly distributed over $\mathcal{M}$. The transmission reliability requirement is specified by

[TABLE]

where $\epsilon_{n}\in(0,1)$ denotes the error tolerance. The secrecy requirement assesses how much one may learn about $M$ from $Z^{n}$. This requirement is often quantified by measuring the level of “independence” between $M$ and $Z^{n}$ based on either the variation distance

[TABLE]

or the divergence $D(P_{M,Z^{n}}\|P_{M}P_{Z^{n}})=I(M;Z^{n})$ between $P_{M,Z^{n}}$ and $P_{M}P_{Z^{n}}$. Another way of quantifying the secrecy requirement is to view the problem as a binary hypothesis testing of the alternate hypothesis of $M$ and $Z^{n}$ being independent against the null hypothesis of $M$ and $Z^{n}$ being correlated. This is an interesting case in which we would like the false positive probability given by the likelihood ratio test

[TABLE]

111Hereafter, convergence of any quantity indexed by $n$ means convergence as $n\rightarrow\infty$. For example, $\delta_{n}\rightarrow 0$ means $\delta_{n}$ converges to [math] as $n\rightarrow\infty$.

where the decision threshold $\tau\in[0,1)$ serves as a measure of secrecy with $\tau\rightarrow 1$ being the most secret situation. Note that the log-likelihood $\log_{2}\frac{P_{M}(m)P_{Z^{n}}(z^{n})}{P_{M,Z^{n}}(m,z^{n})}$ may also be used in the hypothesis testing problem above.

For every $(m,z^{n})\in\mathcal{M}\times\mathcal{Z}^{n}$, define

[TABLE]

where $[c]^{+}$ equals $c$ if $c>0$ and [math] otherwise, and

[TABLE]

All the secrecy requirements discussed above can be compactly specified in terms of the tail probabilities and expected values of $v(M,Z^{n})$ and $i(M,Z^{n})$:

[TABLE]

where $\delta_{n}\in(0,1]$, $l_{n}\in(0,\infty)$, and $E_{M,Z^{n}}[\cdot]$ denotes the expectation w.r.t. $P_{M,Z^{n}}$. Note that $\mathbf{S}_{2}(\delta_{n})$ and $\mathbf{S}_{4}(l_{n})$ are the variation distance and divergence (leakage) constraints, respectively, while $\mathbf{S}_{1}(\delta_{n})$ and $\mathbf{S}_{3}(l_{n})$ correspond to the secrecy requirements specified by the hypothesis testing problem using the likelihood and log-likelihood ratios, respectively.

Clearly these secrecy requirements are related to each other. For example, we have $\mathbf{S}_{1}(\delta_{n})=\mathbf{S}_{3}\left(-\log_{2}(1-\delta_{n})\right)$. Also, $\mathbf{S}_{1}(\delta_{n})$ implies $\mathbf{S}_{2}(\delta_{n}+\mu_{n})$. By Markov’s inequality, $\mathbf{S}_{2}(\delta_{n})$ implies $\mathbf{S}_{1}(\sqrt{\delta_{n}})$ if $\delta_{n}\rightarrow 0$. Thus for vanishing tolerances (i.e., $\delta_{n}\rightarrow 0$), $\mathbf{S}_{1}$, $\mathbf{S}_{2}$, and $\mathbf{S}_{3}$ are essentially equivalent. In addition, by Pinsker’s inequality, $\mathbf{S}_{4}(l_{n})$ implies $\mathbf{S}_{2}\left(\sqrt{\frac{l_{n}\ln 2}{2}}\right)$ if $l_{n}\in(0,\frac{2}{\ln 2})$.

Special cases of these secrecy requirements have been considered in the literature. For example, requiring $\epsilon_{n}\rightarrow 0$ in (1), $\mathbf{S}_{4}(nr_{l})$ is the equivocation constraint originally considered in [1]. Six secrecy requirements $\mathbb{S}_{1}$–$\mathbb{S}_{6}$ are more recently considered222Note that $\mathbb{S}_{5}$ in [2] seems problematic as it can always be trivially satisfied. in [2]. Setting $\epsilon_{n}\rightarrow 0$, $\mathbb{S}_{1}$ is $\mathbf{S}_{4}(l_{n})$ for some $l_{n}\rightarrow 0$, $\mathbb{S}_{2}$ is $\mathbf{S}_{2}(\delta_{n})$ for some $\delta_{n}\rightarrow 0$, $\mathbb{S}_{3}$ is $\mathbf{S}_{3}(l_{n})$ for some $l_{n}\rightarrow 0$, $\mathbb{S}_{4}$ is $\mathbf{S}_{4}(l_{n})$ for some $\frac{l_{n}}{n}\rightarrow 0$, and $\mathbb{S}_{6}$ is $\mathbf{S}_{3}(l_{n})$ for some $\frac{l_{n}}{n}\rightarrow 0$.

The majority of known secrecy capacity results under the above secrecy requirements are for cases with vanishing error tolerance, $\epsilon_{n}\rightarrow 0$, and secrecy tolerance, $l_{n}\rightarrow 0$, $\frac{l_{n}}{n}\rightarrow 0$, or $\delta_{n}\rightarrow 0$. These results are nicely summarized in [2], which shows that the secrecy capacities under $\mathbb{S}_{1}$–$\mathbb{S}_{6}$ (see footnote 2) of the DM-WTC are all given by $\max_{P_{U,X}}I(U;Y)-I(U;Z)$, where U\operatorname{\begin{picture}(1.0,1.0)\put(0.0,0.22){\line(1,0){1.0}} \put(0.5,0.22){\circle{0.3}} \end{picture}}X\operatorname{\begin{picture}(1.0,1.0)\put(0.0,0.22){\line(1,0){1.0}} \put(0.5,0.22){\circle{0.3}} \end{picture}}Y,Z. Here we are mainly interested in cases where both the error tolerance $\epsilon_{n}$ and secrecy tolerance $\delta_{n}$, $l_{n}$ or $\frac{l_{n}}{n}$ are non-vanishing, on which only a few partial results exist. The oldest such result dates back to Wyner’s original paper [1], in which the secrecy capacity under $\mathbf{S}_{4}(nr_{l})$, where $r_{l}>0$ denotes the leakage rate, of the degraded DM-WTC ($P_{Y,Z|X}=P_{Z|Y}P_{Y|X}$) is calculated for the case of $\epsilon_{n}\rightarrow 0$. The $\epsilon$-secrecy capacity under $\mathbf{S}_{4}(l_{n})$ of the degraded DM-WTC is obtained in [3] for the case of $\frac{l_{n}}{n}\rightarrow 0$. This case has also been extended to the general DM-WTC in [4] and [5]. The $\epsilon$-secrecy capacity under $\mathbf{S}_{2}(\delta)$ of the degraded DM-WTC is found in [6].

In this paper, we determine the secrecy capacities for the general DM-WTC under the above four security requirements, $\mathbf{S}_{1}$–$\mathbf{S}_{4}$, with non-vanishing tolerances. The converses of all of these capacity results are new, and are straightforwardly obtained using our recently developed equal-image-size source partitioning techniques [4, 7]. Further, the $\epsilon$-secrecy capacity for each of these four requirements is unique. Under $\mathbf{S}_{1}$ and $\mathbf{S}_{3}$ the strong converse property holds, while it does not under $\mathbf{S}_{2}$ and $\mathbf{S}_{4}$ in general. In addition, under $\mathbf{S}_{2}$ and $\mathbf{S}_{4}$, the capacity can be broken into distinct phases depending on the error tolerance. For instance, under $\mathbf{S}_{2}$ the capacity of the channel is either equal to the capacity of the channel with vanishing error, or the capacity of the channel with no secrecy requirement. We call this interesting phenomenon a phase change.

II Main results

For $i\in\left\{1,2,3,4\right\}$, we call $(f^{n},\varphi^{n})$ a $(n,R_{n},\epsilon_{n},\mathbf{S}_{i}(\eta_{n}))$-code if the domain of $f^{n}$ (i.e., $\mathcal{M}$) is of cardinality $2^{nR_{n}}$, and the pair satisfy both (1) and $\mathbf{S}_{i}(\eta_{n})$. Further we say the rate error secrecy (RES)-triple $(a,b,c)\in\mathbb{R}^{3}$ is $\mathbf{S}_{i}$-achievable if there exists a sequence of $(n,R_{n},\epsilon_{n},\mathbf{S}_{i}(\eta_{n}))$-codes such that $\lim_{n\rightarrow\infty}(R_{n},\epsilon_{n},\eta_{n})=(a,b,c)$ if $i\in\left\{1,2\right\}$, and $\lim_{n\rightarrow\infty}\left(R_{n},\epsilon_{n},\frac{\eta_{n}}{n}\right)=(a,b,c)$ if $i\in\left\{3,4\right\}$. Then the $\epsilon$-secrecy capacity under the appropriate $\mathbf{S}_{i}(\cdot)$ is the maximum $R$ such that the RES-triple $(R,\epsilon,\eta)$ is $\mathbf{S}_{i}$-achievable.

Note that for $\mathbf{S}_{3}$ and $\mathbf{S}_{4}$, the above definition corresponds to what is called “weak” secrecy in the literature [2]. If “strong” secrecy is desired, the definition could be modified to that the RES-triple $(R,\epsilon,\eta)$ is $\mathbf{S}_{i}$-achievable when there exists a sequence of $(n,R_{n},\epsilon_{n},\mathbf{S}_{i}(\eta_{n}))$-codes such that $\lim_{n\rightarrow\infty}(R_{n},\epsilon_{n},\eta_{n})=(R,\epsilon,\eta)$, for $i\in\left\{3,4\right\}$. We have instead chosen to present the “weak” versions of these criteria, simply because their proofs trivially recover their “strong” counterparts.

Write $C(r_{l})$ to denote the capacity of the wiretap channel subject to the weak leakage constraint $r_{l}\geq n^{-1}I(Z^{n};M)$. In specific,

[TABLE]

where $\left|\mathcal{U}\right|\leq(\left|\mathcal{X}\right|+1)(\left|\mathcal{X}\right|+3)$ and $\left|\mathcal{W}\right|\leq\left|\mathcal{X}\right|+3$. Two values of distinction which will arise in our results are that of $C(0)$ and $C(\infty)$ for which

[TABLE]

Next, restrict $\epsilon\in[0,1)$ and $\delta\in[0,1]$, and $r_{l}\in[0,\infty)$. Then the following theorems give our main results regarding the secrecy capacities:

Theorem 1**.**

The $\epsilon$-secrecy capacity under $\mathbf{S}_{1}(\delta)$ of the DM-WTC is given by

[TABLE]

for all $\epsilon$.

Theorem 2**.**

The $\epsilon$-secrecy capacity under $\mathbf{S}_{2}(\delta)$ of the DM-WTC is given by

[TABLE]

Theorem 3**.**

The $\epsilon$-secrecy capacity under $\mathbf{S}_{3}(nr_{l})$ of the DM-WTC is given by

[TABLE]

for all $\epsilon$.

Theorem 4**.**

The $\epsilon$-secrecy capacity under $\mathbf{S}_{4}(nr_{l})$ of the DM-WTC is given by

[TABLE]

As mentioned before, the main new contributions are the converses of the theorems. Theorem 2 extends the result in [6] from the degraded DM-WTC to the general DM-WTC. Theorems 3 and 4 extend the results in [2] and in [4, 5] to the case of $r_{l}>0$, respectively.

Theorems 1 and 3 state that the $\epsilon$-secrecy capacities of the DM-WTC under $\mathbf{S}_{1}(\delta)$ and $\mathbf{S}_{3}(nr_{l})$ are invariant to the value of $\epsilon\in[0,1)$ for all valid values of $\delta$ and $r_{l}$, respectively. In other words, the strong converse property holds under $\mathbf{S}_{1}(\delta)$ and $\mathbf{S}_{3}(nr_{l})$. Although invariant of the error tolerance, the $\epsilon$-secrecy capacity under $\mathbf{S}_{3}(nr_{l})$ is non-trivially dependent on the leakage rate $r_{l}$. In specific, the $\epsilon$-secrecy capacity under $\mathbf{S}_{3}(nr_{l})$ increases linearly as a function of $r_{l}$ from $C(0)$ until it saturates at $C(\infty)$, the (non-secret) capacity of the discrete memoryless channel (DMC) $(\mathcal{X},P_{Y|X},\mathcal{Y})$.

For the secrecy requirements $\mathbf{S}_{2}(\delta)$ and $\mathbf{S}_{4}(nr_{l})$, Theorems 2 and 4 respectively show that the strong converse property no longer holds for the DM-WTC as the $\epsilon$-secrecy capacities generally depend on the value of $\epsilon$. Under $\mathbf{S}_{2}(\delta)$, the $\epsilon$-secrecy capacity remains at $C(0)$ as long as $\epsilon\in[0,1-\delta)$. However, for $\epsilon\in[1-\delta,1)$, the $\epsilon$-secrecy capacity value experiences an abrupt phase change, increasing to $C(\infty)$ as if there is no secrecy requirement. Restricting to within either of the two value ranges, the $\epsilon$-secrecy capacity under $\mathbf{S}_{2}(\delta)$ is invariant to $\epsilon$.

Under $\mathbf{S}_{4}(nr_{l})$, the $\epsilon$-secrecy capacity remains at $C(0)$ when $r_{l}=0$ for all $\epsilon\in[0,1)$. Note that this also includes the cases of strong secrecy ($\mathbf{S}_{4}(l_{n})$ with $l_{n}\rightarrow 0$) and bounded leakage ($\mathbf{S}_{4}(l_{n})$ with $l_{n}=l$). Thus the strong converse property holds when $r_{l}=0$ as proven in [4] and [5]. For any fixed $r_{l}\in(0,C(\infty)-C(0))$, the $\epsilon$-secrecy capacity increases from $C(r_{l})$ to $C(\infty)$ and then levels off as $\epsilon$ increases in the range $[0,1)$. The DM-WTC exhibits a phase change from where the strong converse property holds to where it does not. When $r_{l}\geq C(\infty)-C(0)$, the $\epsilon$-secrecy capacity value remains at $C(\infty)$ for all $\epsilon\in[0,1)$, and the DM-WTC exhibits another phase change after which the strong converse property holds again.

III Proofs of Theorems

We prove the converses in Theorems 1–4 by employing the following strong Fano’s inequality developed in [4] and information stabilization result developed in [7]:

Strong Fano’s inequality**.**

For any $(f^{n},\varphi^{n})$ of rate $R$ that gives $\Pr\{\varphi^{n}(Y^{n})\neq M\}\leq\epsilon$ over the DM-WTC, there exist a random index $Q_{n}$ (correlated with $M$, $Y^{n}$, and $Z^{n}$) that ranges over an index set $\mathcal{Q}_{n}$ whose cardinality is at most polynomial in $n$, $\zeta_{n}\rightarrow 0$, and an index subset

[TABLE]

satisfying $P_{Q_{n}}(\mathcal{Q}^{R}_{n})\geq 1-\epsilon-\zeta_{n}$.

Information stabilization**.**

For the $(f^{n},\varphi^{n})$ pair, random index $Q_{n}$, and index set $\mathcal{Q}_{n}$ above, there exist $\xi_{n}\rightarrow 0$ and an index subset $\mathcal{Q}_{n}^{Z}\subseteq\mathcal{Q}_{n}$ satisfying $P_{Q_{n}}(\mathcal{Q}^{Z}_{n})\geq 1-\xi_{n}$:333For any non-negative $\lambda_{n}\rightarrow 0$, $a_{n}>0$, and $b_{n}>0$, $a_{n}\doteq_{\tiny{\lambda_{n}}}b_{n}$ means $\left|\frac{1}{n}\log_{2}{a_{n}}-\frac{1}{n}\log_{2}{b_{n}}\right|\leq\lambda_{n}$.

$P_{Z^{n}|Q_{n}}(\mathcal{\hat{Z}}^{n}(q_{n})|q_{n})\geq 1-\xi_{n}$, where \mathcal{\hat{Z}}^{n}(q_{n})\triangleq\big{\{}z^{n}\in\mathcal{Z}^{n}:P_{Z^{n}|Q_{n}}(z^{n}|q_{n})\doteq_{\tiny{\xi_{n}}}2^{-H(Z^{n}|Q_{n}=q_{n})}\big{\}}, 2. 2.

there exists a $\mathcal{\tilde{M}}(q_{n})\subseteq\mathcal{M}$ satisfying $P_{M|Q_{n}}(\mathcal{\tilde{M}}(q_{n})|q_{n})\geq 1-\xi_{n}$, and $P_{M|Q_{n}}(m|q_{n})\doteq_{\tiny{\xi_{n}}}2^{-H(M|Q_{n}=q_{n})}$ for each $m\in\mathcal{\tilde{M}}(q_{n})$, and 3. 3.

$P_{Z^{n}|M,Q_{n}}(\mathcal{\tilde{Z}}^{n}(m,q_{n})|m,q_{n})\geq 1-\xi_{n}$* where \mathcal{\tilde{Z}}^{n}(m,q_{n})\triangleq\big{\{}z^{n}\in\mathcal{Z}^{n}:P_{Z^{n}|M,Q_{n}}(z^{n}|m,q_{n})\doteq_{\tiny{\xi_{n}}}2^{-H(Z^{n}|M,Q_{n}=q_{n})}\big{\}},*

for each $q_{n}\in\mathcal{Q}_{n}^{Z}$.

Obtained through the information stabilization result in the appendix, the following lemma will also be needed:

Lemma 5**.**

For any $r\geq 0$, there exist $\tau_{n}\rightarrow 0$, $\mu_{n}\rightarrow 0$, and $\lambda_{n}\rightarrow 0$ satisfying $n\lambda_{n}\rightarrow\infty$ such that by defining

[TABLE]

and

[TABLE]

then

[TABLE]

For proving achievability in Theorems 2 and 4, we will make use of the following lemma to simplify discussions:

Lemma 6**.**

For $i\in\left\{2,4\right\}$, if the RES-triple $(R,0,\eta)$ is $\mathbf{S}_{i}$-achievable, then the RES-triple $(R,\gamma,(1-\gamma)\eta)$ is also $\mathbf{S}_{i}$-achievable for any $\gamma\in[0,1)$.

III-A Proof of Theorem 1

**(Direct) **For any $\delta\in[0,1)$ and $\epsilon\in[0,1)$, the RES-triple $(C(0),\epsilon,\delta)$ being $\mathbf{S}_{1}$-achievable follows directly from [8, Theorem 17.11], which in particular shows the RES-triple $(C(0),0,0)$ is $\mathbf{S}_{1}$-achievable. On the other hand, the RES-triple $(C(\infty),0,1)$ is $\mathbf{S}_{1}$-achievable since $C(\infty)$ is the channel capacity for the DMC $(\mathcal{X},P_{Y|X},\mathcal{Y})$, and $\delta=1$ corresponds to no secrecy constraint.

(Converse) To prove that $\mathbf{C}_{1}(\delta)$ is an upper bound on the $\epsilon$-secrecy capacity under $\mathbf{S}_{1}(\delta)$, first apply Lemma 5 to obtain values $\tau_{n}$, $\mu_{n}$, and $\lambda_{n}$ which converge to [math] as $n$ increases, such that $P_{M,Z^{n}}\left(\Omega_{n}(0)\right)\leq P_{Q_{n}}\left(\mathcal{Q}_{n}^{S}(0)\right)+\mu_{n}$, for sets $\Omega_{n}(0)$ and $\mathcal{Q}_{n}^{S}(0)$ as defined in Lemma 5. We also have that $P_{M,Z^{n}}\left(\Omega_{n}(0)\right)\geq 1-\rho_{n}$ for some $\rho_{n}\rightarrow 0$, due to $\mathbf{S}_{1}(\delta)$. Thus $\mathbf{S}_{1}(\delta)$ and Lemma 5 together imply that

[TABLE]

But then the strong Fano’s inequality and (2) together give the existence of a $q_{n}\in\mathcal{Q}_{n}$ such that

[TABLE]

since $P_{Q_{n}}\left(\mathcal{Q}_{n}^{R}\cap\mathcal{Q}_{n}^{S}(0)\right)\geq 1-\epsilon-\zeta_{n}-\rho_{n}-\mu_{n}>0$ for large enough $n$ and $\epsilon\in[0,1)$. Combining Equations (3) and (4) gives

[TABLE]

for all $\epsilon\in[0,1)$. On the other hand, when $\delta=1$, the strong Fano’s inequality (i.e., (3)) gives

[TABLE]

for all $\epsilon\in[0,1)$, as in the standard strong converse argument for the DMC $(\mathcal{X},P_{Y|X},\mathcal{Y})$.

III-B Proof of Theorem 2

(Direct) The RES-triple $(C(0),\epsilon,\delta)$ is $\mathbf{S}_{2}$-achievable, once again, by [8, Theorem 17.11], for $\epsilon+\delta<1$. For $\epsilon+\delta\geq 1$, the RES-triple $(C(\infty),\epsilon,1-\epsilon)$ is $\mathbf{S}_{2}$-achievable by Lemma 6, since the RES-triple $(C(\infty),0,1)$ is $\mathbf{S}_{2}$-achievable.

(Converse) On the other hand, to prove that $\mathbb{C}_{2}(\epsilon,\delta)$ is an upper bound on the $\epsilon$-secrecy capacity under $\mathbf{S}_{2}(\delta)$, observe that $\mathbf{S}_{2}(\delta)$ implies

[TABLE]

Thus combining Lemma 5 and (5) gives

[TABLE]

As a result, if $\epsilon+\delta<1$, then there must exist a $q_{n}\in\mathcal{Q}_{n}$ such that (3) and (4) are simultaneously satisfied since

[TABLE]

for all sufficiently large $n$. And therefore,

[TABLE]

if $\epsilon+\delta<1$. If though $\epsilon+\delta\geq 1$, then the strong Fano’s inequality (i.e., (3)) gives $R\leq C(\infty)+\zeta_{n}$.

III-C Proof of Theorem 3

(Direct) The RES-triple $\left((C(r_{l}),\epsilon,r_{l}\right)$ is $\mathbf{S}_{3}$ since by definition $\left((C(r_{l}),0,r_{l}\right)$ is $\mathbf{S}_{3}$ achievable.

(Converse) On the other hand, to prove that $\mathbb{C}_{3}(r_{l})$ is an upper bound on the $\epsilon$-secrecy capacity under $\mathbf{S}_{3}(nr_{l})$ of the DM-WTC, we note that Lemma 5 and $\mathbf{S}_{3}(nr_{l})$ directly imply

[TABLE]

for some $\rho_{n}\rightarrow 0$. Thus as before the strong Fano’s inequality and (6) together give the existence of a $q_{n}\in\mathcal{Q}_{n}$ satisfying (3) and

[TABLE]

since $P_{Q_{n}}\left(\mathcal{Q}_{n}^{R}\cap\mathcal{Q}_{n}^{S}(r_{l})\right)\geq 1-\epsilon-\zeta_{n}-\rho_{n}-\mu_{n}>0$. Now

[TABLE]

for all $\epsilon\in[0,1)$, follows directly as a result of Equations (3) and (7).

III-D Proof of Theorem 4

(Direct) First note the RES-triple $\left(C\left(\frac{r_{l}}{1-\epsilon}\right),0,\frac{r_{l}}{1-\epsilon}\right)$ is $\mathbf{S}_{4}$ achievable due to [8, Theorem 17.13]. Hence the RES-triple $\left(C\left(\frac{r_{l}}{1-\epsilon}\right),\epsilon,r_{l}\right)$ is $\mathbf{S}_{4}$-achievable by Lemma 6.

(Converse) To prove $\mathbb{C}_{4}(\epsilon,r_{l})$ upper-bounds the $\epsilon$-secrecy capacity under $\mathbf{S}_{4}(nr_{l})$ of the DM-WTC, notice that $\mathbf{S}_{4}(nr_{l})$ implies

[TABLE]

where $n^{\alpha}$ is the cardinality bound on $\mathcal{Q}_{n}$. But from the strong Fano’s inequality, we have $P_{Q_{n}}(\mathcal{Q}_{n}^{R})\geq 1-\epsilon-\zeta_{n}$. This together with (8) implies that there must be a $q_{n}\in\mathcal{Q}_{n}^{R}$ such that

[TABLE]

Again by the strong Fano’s inequality, for this $q_{n}$ we also have (3). Combining (3) and (8) gives

[TABLE]

IV Conclusions

Employing the recently developed techniques of equal-image-size partitioning, we obtained the $\epsilon$-secrecy capacities under $\mathbf{S}_{1}(\delta)$, $\mathbf{S}_{2}(\delta)$, $\mathbf{S}_{3}(nr_{l})$, and $\mathbf{S}_{4}(nr_{l})$ of the DM-WTC for non-vanishing $\epsilon$, $\delta$, and $r_{l}$. The secrecy criteria considered include the standard leakage and variation distance secrecy constraints often employed in the literature. Our new results show that both the capacity value and the strong converse property of the DM-WTC are in fact dependent on the secrecy criterion adopted. We conjecture that the interesting phase change phenomenon observed in cases where the strong converse property does not hold is commonplace in many other multi-terminal DMCs.

-A Proof of Lemma 5

We need the following lemma to prove Lemma 5:

Lemma 7**.**

Let $Q_{n}$ be a random index ranging over $\mathcal{Q}_{n}$, whose cardinality is at most polynomial in $n$, and $V$ be any discrete random variable distributed over $\mathcal{V}$. Then there exist $\lambda_{n}\rightarrow 0$ and $\xi^{\prime}_{n}\rightarrow 0$ such that $n\lambda_{n}\rightarrow\infty$ and

[TABLE]

Note that $\lambda_{n}$ and $\xi^{\prime}_{n}$ both depend only on the polynomial cardinality bound on $\mathcal{Q}_{n}$.

Proof:

Let $\alpha>0$ be such that $\left|\mathcal{Q}_{n}\right|\leq n^{\alpha}$. First write $\mathcal{A}=\left\{(v,q_{n})\in\mathcal{V}\times\mathcal{Q}_{n}:P_{V|Q_{n}}(v|q_{n})>n^{2\alpha}P_{V}(v)\right\}$ and $\mathcal{B}=\left\{(v,q_{n})\in\mathcal{V}\times\mathcal{Q}_{n}:P_{V|Q_{n}}(v|q_{n})<n^{-2\alpha}P_{V}(v)\right\}$. Then

[TABLE]

where $\lambda_{n}=\frac{2\alpha}{n}\log_{2}n$. Thus the lemma is verified by (10) if we can show that $P_{V,Q_{n}}\left(\mathcal{A}\cup\mathcal{B}\right)\rightarrow 0$. In particular, we do so by bounding $P_{V,Q_{n}}(\mathcal{A})\leq n^{-\alpha}$ and $P_{V,Q_{n}}(\mathcal{B})\leq n^{-2\alpha}$, and setting $\xi^{\prime}_{n}=n^{-\alpha}+n^{-2\alpha}$.

To bound $P_{V,Q_{n}}(\mathcal{A})$, note that for all $(v,q_{n})\in\mathcal{A}$,

[TABLE]

since

[TABLE]

Then the upper bound on $P_{V,Q_{n}}(\mathcal{A})$ follows from (11) as below:

[TABLE]

The upper bound on $P_{V,Q_{n}}(\mathcal{B})$ follows similarly in that

[TABLE]

∎

Apply Lemma 7 three times with $V=M$, $V=Z^{n}$, and $V=(M,Z^{n})$, respectively. Writing

[TABLE]

where $\lambda_{n}$ is obtained in Lemma 7, we have

[TABLE]

Next define

[TABLE]

with the corresponding $\mathcal{Q}^{Z}_{n}$, $\mathcal{\tilde{M}}(q_{n})$, $\mathcal{\hat{Z}}^{n}(q_{n})$, and $\mathcal{\tilde{Z}}^{n}(m,q_{n})$ as given in the information stabilization result summarized in Section III. Similar to before,

[TABLE]

Combining (12) and (13) gives

[TABLE]

From here note that for any $(m,z^{n},q_{n})\in\Xi_{n}\cap\Gamma_{n}$,

[TABLE]

implies

[TABLE]

because $(m,z^{n},q_{n})\in\Gamma_{n}$. And then in turn, for all $(m,z^{n},q_{n})\in\Gamma_{n}\cap\Xi_{n}$,

[TABLE]

since $(m,z^{n},q_{n})\in\Xi_{n}$. Thus Lemma 5 results from (16) by setting $\tau_{n}=4\lambda_{n}+2\xi_{n}$ and $\mu_{n}=3\xi^{\prime}_{n}+4\xi_{n}$, because we have from (14)

[TABLE]

-B Proof of Lemma 6

For $i\in\left\{2,4\right\}$, we can construct a $\left(n,R_{n},(1-\gamma)\epsilon_{n}+\gamma,\mathbf{S}_{i}\left((1-\gamma)l_{n}\right)\right)$-code $(\hat{f}^{n},\varphi^{n})$, given that there exists a $(n,R_{n},\epsilon_{n},\mathbf{S}_{i}(l_{n}))$-code $(f^{n},\varphi^{n})$. Whence the lemma follows by the definition of the RES-triples. Letting $\hat{M}$ be a random variable distributed identical, but independent, to $M$. The new encoder, $\hat{f}^{n}$, is constructed by setting it equal to $f(M)$ with probability $1-\gamma$ and to $f(\hat{M})$ with probability $\gamma$. While the new decoder $\hat{\varphi}^{n}=\varphi^{n}$.

Clearly, an error will likely occur if $\hat{f}(M)$ is set equal to $f(\hat{M})$. On the other hand, the probability of error will revert to that of $(f^{n},\varphi^{n})$ if $\hat{f}(M)$ is set equal to $f(M)$. Thus the probability of error for $(\hat{f}^{n},\hat{\varphi}^{n})$ is at most $(1-\gamma)\epsilon_{n}+\gamma$.

Letting $P_{Z^{n},M}$ be the joint distribution of $Z^{n},M$ for induced by $f^{n}$, we can write the joint distribution of $Z^{n},M$ for $\hat{f}^{n}$ as $(1-\gamma)P_{Z^{n},M}+\gamma P_{Z^{n}}P_{M}$, while the marginals remain $P_{M}$ and $P_{Z^{n}}$. But then, for the variation distance,

[TABLE]

And for divergence

[TABLE]