On a Relationship between the Correct Probability of Estimation from Correlated Data and Mutual Information

TL;DR

This paper establishes an inequality linking the probability of correctly estimating a discrete variable from correlated data to the mutual information, with implications for cryptographic security analysis.

Contribution

It introduces a new inequality connecting estimation success probability and mutual information, aiding security evaluations in cryptography.

Findings

Derived an inequality relating estimation probability and mutual information.

Provides insights into the secrecy exponent in strong secrecy criteria.

Useful for analyzing security in cryptographic systems.

Abstract

Let $X$, $Y$ be two correlated discrete random variables. We consider an estimation of $X$ from encoded data $\varphi(Y)$ of $Y$ by some encoder function $\varphi(Y)$. We derive an inequality describing a relation of the correct probability of estimation and the mutual information between $X$ and $\varphi(Y)$. This inequality may be useful for the secure analysis of crypto system when we use the success probability of estimating secret data as a security criterion. It also provides an intuitive meaning of the secrecy exponent in the strong secrecy criterion.

Equations

$$p_{XY}={\left\{p_{XY}(x,y)\right\}}_{(x,y)\in \mathcal{X}\times \mathcal{Y}}$$

$$\left.\begin{array}[]{l}\phi:{\cal X}\to{\cal M}=\left\{\,1,2,\cdots,|{\cal M}|\right\},\vspace{2mm}\\ \varphi:{\cal Y}\to{\cal L}=\left\{\,1,2,\cdots,|{\cal L}|\right\}.\end{array}\right\}$$

$$\psi :\mathcal{M}\times \mathcal{L}\to \mathcal{X}.$$

$${\mathrm{P}}_{\mathrm{e}}(\varphi ,\phi ,\psi |p_{XY})=\mathrm{Pr}\left\{\hat{X}\ne X\right\},$$

$${\mathrm{P}}_{\mathrm{c}}(\varphi ,\phi ,\psi |p_{XY})=1-{\mathrm{P}}_{\mathrm{e}}(\varphi ,\phi ,\psi |p_{XY})=\mathrm{Pr}\left\{\hat{X}=X\right\}.$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(1)}(p_{XY})$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(2)}(p_{XY})$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(3)}(p_{XY})$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(1)}(p_{XY})\ge {\mathrm{P}}_{\mathrm{c},\max }^{(2)}(p_{XY})\ge {\mathrm{P}}_{\mathrm{c},\max }^{(3)}(p_{XY}).$$

$$p_{\max }\stackrel{△}{=}\underset{x\in \mathcal{X}}{\max }{p}_X(x).$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(3)}(p_{XY})$$

$$p_{XYS}(s,x,y)=p_{XY}(x,y)p_{S|Y}(s|y).$$

$${\mathrm{P}}_{\mathrm{c}}(\varphi ,\phi ,\psi |p_{XY})$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(1)}(p_{XY})$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(2)}(p_{XY})\le \text{mbox}{2}^{\nu }(p_{\max })+\frac{1}{\nu }I(X;\phi (Y)).$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(2)}(p_{XY})\le (1+\nu )p_{\max }+\frac{1}{\nu }I(X;\phi (Y)).$$

$$\mathcal{D}\stackrel{△}{=}\{(s,x,y):s=\phi (y),p_{X|S}(x|s)\ge (1/|\mathcal{M}|)\text{mbox}{2}^{-\eta }\},$$

$$\mathcal{E}\stackrel{△}{=}\{(s,x,y):s=\phi (y),\psi (\varphi (x),\phi (y))=x\}.$$

$$p_{SXY}\left({\mathcal{D}}^{\mathrm{c}}\cap \mathcal{E}\right)\le \text{mbox}{2}^{-\eta }.$$

$$p_S(s)=\sum _{y:\phi (y)=s}{p}_Y(y),p_{Y|S}(y|s)=\frac{p_Y(y)}{p_S(s)}.$$

$$p_{SXY}\left({\mathcal{D}}^{\mathrm{c}}\cap \mathcal{E}\right)$$

$$p_{SXY}\left(\mathcal{D}\right)=p_{SX}\left\{\log |\mathcal{M}|\ge \log \frac{1}{p_{X|S}(X|S)}-\eta \right\}.$$

$${\mathrm{P}}_{\mathrm{c}}(\varphi ,\phi ,\psi |p_{XY})$$

$${\mathrm{P}}_{\mathrm{c}}(\varphi ,\phi ,\psi |p_{XY})=p_{SXY}\left(\mathcal{E}\right).$$

$${\mathrm{P}}_{\mathrm{c}}(\varphi ,\phi ,\psi |p_{XY})=p_{SXY}\left(\mathcal{E}\right)$$

$${\mathrm{P}}_{\mathrm{c},\max }^{(1)}(p_{XY})\stackrel{(\mathrm{a})}{\le }{p}_{SX}\left\{0\ge \log \frac{1}{p_{X|S}(X|S)}-\eta \right\}+\text{mbox}{2}^{-\eta }$$

$$=p_{SX}\{\left[\log \frac{1}{p_{X|S}(X|S)}\le \eta \right]$$

$$\bigcap \left[\log \frac{p_{X|S}(X|S)}{p_X(X)}<\nu \right]\}$$

$$+p_{SX}\{\left[\log \frac{1}{p_{X|S}(X|S)}\le \eta \right]$$

$$\bigcap \left[\log \frac{p_{X|S}(X|S)}{p_X(X)}\ge \nu \right]\}+\text{mbox}{2}^{-\eta }$$

$$\le p_X\left\{\log \frac{1}{p_X(X)}<\eta +\nu \right\}$$

$$+p_{SX}\left\{\log \frac{p_{X|S}(X|S)}{p_X(X)}\ge \nu \right\}+\text{mbox}{2}^{-\eta }$$

$$\stackrel{(\mathrm{b})}{\le }{p}_X\left\{\log \frac{1}{p_X(X)}<\eta +\nu \right\}$$

$$+\frac{1}{\nu }{\mathrm{E}}_{p_{SX}}\left[\log \frac{p_{X|S}(X|S)}{p_X(X)}\right]+\text{mbox}{2}^{-\eta }$$

$$=p_X\left\{\log \frac{1}{p_X(X)}<\eta +\nu \right\}+\frac{1}{\nu }I(X;S)+\text{mbox}{2}^{-\eta }.$$

$$\eta +\nu =\log \frac{1}{p_{\max }}=\underset{x\in \mathcal{X}}{\min }\log \frac{1}{p_X(x)}.$$

Full text

I Introduction

It is well known that the mutual information is a very important quantity for an evaluation of the security of communication system. In the crypto system introduced by Shannon [1] perfect secrecy is defined by the condition that the mutual information between secret data and encrypted data vanishes. In the wiretap channel investigated by Wyner [2] and in the broadcast channel with confidential messages investigated Csiszár and Körner [3], perfect secrecy is defined by an asymptotically vanishing mutual information rate per channel use between the secret messages and the channel outputs obtained by the unauthorized user.

In the several recent researches on the information theorytical security, the strong secrecy condition where the value of mutual information should asymptotically be zero is well used. Specifically, Hayashi [4] has derived the relevant secrecy exponent function to specify the exponentially decreasing speed (i.e., exponent) of the leaked information under the average secrecy criterion when no cost constraint is considered. Han et al.[5] extend his result to the case with cost constraint. The secrecy condition used by Wyner [2] and Csiszár and Körner [3] now called the weak secrecy condition has a clear intuitive meaning that the leak of inforamtion rate on the secret messages is asymptotically zero. On the other hand in the strong secrecy criterion the intuitive meaning of the secrecy exponent function does not seem to be so clear.

In this paper we consider a problem which is related to the intuitive meaning the secrecy exponent. Our problem is as follows. Let $X$, $Y$ be two correlated discrete random variables. We consider an estimation of $X$ from encoded data $\varphi(Y)$ of $Y$ by some encoder function $\varphi(Y)$. We derive an inequality describing a relation of the correct probability of estimation and the mutual information between $X$ and $\varphi(Y)$. This inequality may be useful for the secure analysis of crypto system when we use the success probability of estimating secret data as a security criterion. It also provides an intuitive meaning of the secrecy exponent in the strong secrecy criterion.

II Problem Statement and Results

II-A Data Estimation from Correlated Data

Let ${\cal X}$ and ${\cal Y}$ be discrete sets. We admit the case where those are countably infinite. Let $(X,Y)$ be a disrete random pair taking vaules in ${\cal X}\times{\cal Y}$ and having a probability distribution

[TABLE]

We consider a source estimation system depicted in Fig. 1. Data sequences $X$ and $Y$ are separately encoded to $\phi(X)$ and $\varphi(Y)$ and those are sent to the information processing center. At the center the estimater $\psi$ observes $(\phi(X),\varphi(Y)$ to output the estimation $\hat{X}$ of $X$. The encoder functions $\phi$ and $\varphi$ are defined by

[TABLE]

The estimater $\psi$ is defined by

[TABLE]

The error probability of estimation is

[TABLE]

where $\hat{X}=\psi(\phi(X),\varphi(Y))$. The correct probability of estimation is

[TABLE]

We condsier the following three cases.

The case where the side information $\varphi(Y)$ serves as a helper to estimate $X$ from $\phi(X)$.(Case 1)

• 2.

The case where only the helper $\varphi(Y)$ is avairable for an estimation of $X$.(Case 2) Case 2 corresponds to the case where $|{\cal M}|=1$ and $\phi$ is a constant function given by $\phi(x)=1,x\in{\cal X}$. The decoder function $\psi$ in this case is given by $\psi:{\cal L}\to{\cal X}$.

• 3.

The case where no information is avairable for an estimation of $X$.(Case 3) Case 3 corresponds to the case where $|{\cal M}|=|{\cal L}|=1$ and $\phi$ and $\varphi$ are constant functions given by $\phi(x)=1,x\in{\cal X}$ and $\varphi(y)=1,y\in{\cal Y}$. The decoer function $\psi$ in this case is given by $\psi:\{1\}\to{\cal X}$.

Let the correct probability of estimation in Case 2 is denoted by ${\rm P}_{\rm c}(\varphi,\psi|p_{XY}).$ Let the correct probability of estimation in Case 3 is denoted by ${\rm P}_{\rm c}(\psi|p_{XY}).$ Set

[TABLE]

Our aim is to clarify relationships between the above three quantities. By definition it is obvious that

[TABLE]

Set

[TABLE]

Then we have

[TABLE]

We are particularly interested in a difference between ${\rm P}_{\rm c,\max}^{(2)}($ $p_{XY})$ and ${\rm P}_{\rm c,\max}^{(3)}(p_{XY})$. If there is no difference between those to quantities. The side information $\varphi(Y)$ is of no use to estimate $X$. In this paper we derive an inequality stating that the difference is upper bounded by the mutual information between the side information $\varphi(Y)$ and the source $X$.

II-B Main Results

In this subsection we sate our main result. We first give a proposition which plays a key role in deriving our main results. Set $S=\varphi(Y)$. The joint distribution $p_{XY}$ of $(X,Y,S)$ is given by

[TABLE]

It is obvious that the random variables $X,Y,S$ form Markov chain $X\leftrightarrow Y\leftrightarrow S$. The following proposition providing an upper bound of ${\rm P}_{\rm c,\max}^{(0)}(p_{XY})$ is useful to derive our main result.

Proposition 1

For any $\eta>0$ and for any $(\phi$, $\varphi,\psi)$, we have

[TABLE]

Specifically, we have

[TABLE]

Proof of this proposition is given in the next section. Using this proposition, we obtain the following result.

Theorem 1

For any $\nu\in(0,\log\frac{1}{p_{\max}})$, we have

[TABLE]

Proof of this theorem is given in the next section. From Theorem 1 and $\mbox{\rm 2}^{\nu}\leq 1+\nu\mbox{ for }\nu\in[0,1],$ we have the following corollary.

Corollary 1

For any $\nu\in(0,\min\{1,\log\frac{1}{p_{\max}}\})$, we have

[TABLE]

III Proofs of the Results

In this section we prove Proposition 1 and Theorem 1. We first prove Proposition 1. To prove this proposition, we prepare a lemma. Set

[TABLE]

Then we have the following lemma.

Lemma 1

[TABLE]

Proof: We first observe that

[TABLE]

We have the following chain of inequalities:

[TABLE]

Step (a) follows from that the number of $x\in{\cal X}$ correctly decoded does not exceed $|{\cal M}|$. ∎

Proof of Proposition 1: By definition we have

[TABLE]

Hence, it suffices to show

[TABLE]

to prove Proposition 1. By definition we have

[TABLE]

Then we have the following.

[TABLE]

Step (a) follows from Lemma 1. ∎

*Proof of Theorem 1: * We have the following chain of inequalities:

[TABLE]

In step (a) we use Proposition 1 for $|{\cal M}|=1$. Step (b) follows from the Markov’s inequality. In (6), we choose $\eta,\nu$ so that

[TABLE]

Since

[TABLE]

$\nu$ must satisfy $\nu\in(0,\log\frac{1}{p_{\max}})$, For this chooice of $\eta,\nu$, we have

[TABLE]

From (6) and (7), we have the bound (5) in Theorem 1. ∎