Position-based coding and convex splitting for private communication over quantum channels

TL;DR

This paper introduces a new lower bound on the one-shot private classical capacity of cq wiretap channels using position-based coding and convex splitting, advancing understanding of secure quantum communication.

Contribution

It provides the first one-shot lower bound on private capacity leveraging recent coding techniques, connecting hypothesis testing mutual information and smooth max-information.

Findings

Lower bound on one-shot private capacity established

Connection between hypothesis testing mutual information and max-information

Implications for second-order coding rate in quantum privacy

Abstract

The classical-input quantum-output (cq) wiretap channel is a communication model involving a classical sender $X$, a legitimate quantum receiver $B$, and a quantum eavesdropper $E$. The goal of a private communication protocol that uses such a channel is for the sender $X$ to transmit a message in such a way that the legitimate receiver $B$ can decode it reliably, while the eavesdropper $E$ learns essentially nothing about which message was transmitted. The $\varepsilon $-one-shot private capacity of a cq wiretap channel is equal to the maximum number of bits that can be transmitted over the channel, such that the privacy error is no larger than $\varepsilon\in(0,1)$. The present paper provides a lower bound on the $\varepsilon$-one-shot private classical capacity, by exploiting the recently developed techniques of Anshu, Devabathini, Jain, and Warsi, called position-based coding and convex splitting. The lower bound is equal to a difference of the hypothesis testing mutual information between $X$ and $B$ and the "alternate" smooth max-information between $X$ and $E$. The one-shot lower bound then leads to a non-trivial lower bound on the second-order coding rate for private classical communication over a memoryless cq wiretap channel.

Equations

$$\underset{p_X}{\max }\left[I(X;Y)-I(X;Z)\right]$$

$$x\to {\rho }_{BE}^x,$$

$$\underset{p_X}{\max }\left[I(X;B)-I(X;E)\right],$$

$${\log }_2{M}_{\mathrm{priv}}^{\ast }({\epsilon }_1+\sqrt{{\epsilon }_2})\ge I_H^{{\epsilon }_1-{\eta }_1}(X;B)-{\tilde{I}}_{\max }^{\sqrt{{\epsilon }_2}-{\eta }_2}(E;X)-{\log }_2(4{\epsilon }_1/{\eta }_1^2)-2{\log }_2(1/{\eta }_2).$$

$$\begin{gathered} {\log }_2{M}_{\mathrm{priv}}^{\ast }(n,{\epsilon }_1+\sqrt{{\epsilon }_2})\ge n\left[I(X;B)-I(X;E)\right] \\ +\sqrt{nV(X;B)}{\Phi }^{-1}({\epsilon }_1)+\sqrt{nV(X;E)}{\Phi }^{-1}({\epsilon }_2)+O(\log n). \end{gathered}$$

$${\rho }_{R_1}\otimes \cdots \otimes {\rho }_{R_{m-1}}\otimes {\rho }_{R_{m}B}\otimes {\rho }_{R_{m+1}}\otimes \cdots \otimes {\rho }_{R_M},$$

$$\frac{1}{M}\sum _{m=1}^M{\rho }_{R_1}\otimes \cdots \otimes {\rho }_{R_{m-1}}\otimes {\rho }_{R_{m}B}\otimes {\rho }_{R_{m+1}}\otimes \cdots \otimes {\rho }_{R_M}.$$

$$F({\rho }_A,{\sigma }_A)=\underset{U}{\max }{\left|⟨{\varphi }^{\sigma }{|}_{RA}{U}_R\otimes I_A|{\varphi }^{\rho }{⟩}_{RA}\right|}^2,$$

$$C(\rho ,\sigma )\equiv \sqrt{1-F(\rho ,\sigma )}$$

$$P(\rho ,\sigma )\equiv C(\rho \oplus \left[1-\mathrm{Tr}\{\rho \}\right],\sigma \oplus \left[1-\mathrm{Tr}\{\sigma \}\right]).$$

$$\frac{1}{2}{\Vert \rho -\sigma \Vert }_1\le P(\rho ,\sigma ).$$

$$D(\omega \Vert \tau )\equiv \mathrm{Tr}\{\omega [{\log }_2\omega -{\log }_2\tau ]\}$$

$$V(\omega \Vert \tau )\equiv \mathrm{Tr}\{\omega [{\log }_2\omega -{\log }_2\tau -D(\omega \Vert \tau ){]}^2\},$$

$$D_H^{\epsilon }(\omega \Vert \tau )\equiv -{\log }_2\underset{\Lambda }{\inf }\left\{\mathrm{Tr}\{\Lambda \tau \}:0\le \Lambda \le I\wedge \mathrm{Tr}\{\Lambda \omega \}\ge 1-\epsilon \right\}.$$

$$D_{\max }(\omega \Vert \tau )\equiv \inf \left\{\lambda \in \mathbb{R}:\omega \le 2^{\lambda }\tau \right\}.$$

$$D_{\max }^{\epsilon }(\omega \Vert \tau )\equiv \inf \left\{\lambda \in \mathbb{R}:\tilde{\omega }\le 2^{\lambda }\tau \wedge P(\omega ,\tilde{\omega })\le \epsilon \right\}.$$

$$D_H^{\epsilon }({\omega }^{\otimes n}\Vert {\tau }^{\otimes n})$$

$$D_{\max }^{\sqrt{\epsilon }}({\omega }^{\otimes n}\Vert {\tau }^{\otimes n})$$

$$\Phi (a)\equiv \frac{1}{\sqrt{2\pi }}{\int }_{-\infty }^{a}dx\exp \left(-x^2/2\right),$$

$$I(X;B{)}_{\rho }$$

$$V(X;B{)}_{\rho }$$

$${\rho }_{XB}=\sum _x{p}_X(x)|x⟩⟨x{|}_X\otimes {\rho }_B^x,$$

$$I_H^{\epsilon }(X;B{)}_{\rho }\equiv D_H^{\epsilon }({\rho }_{XB}\Vert {\rho }_X\otimes {\rho }_B).$$

$$D_{\max }^{\epsilon }({\theta }_{AB}\Vert {\theta }_A\otimes {\theta }_B).$$

$$I_H^{\epsilon }(X^n;B^n{)}_{{\rho }^{\otimes n}}$$

$$D_{\max }^{\sqrt{\epsilon }}({\rho }_{XB}^{\otimes n}\Vert {\rho }_X^{\otimes n}\otimes {\rho }_B^{\otimes n})$$

$${\tilde{I}}_{\max }^{\epsilon }(B;A{)}_{\theta }\equiv \underset{{\theta }_{AB}^{\prime }:P({\theta }_{AB}^{\prime },{\theta }_{AB})\le \epsilon }{\inf }{D}_{\max }({\theta }_{AB}^{\prime }\Vert {\theta }_A\otimes {\theta }_B^{\prime }).$$

$${\tilde{I}}_{\max }^{\epsilon }(B;A{)}_{\theta }\le D_{\max }^{\epsilon -\gamma }({\theta }_{AB}\Vert {\theta }_A\otimes {\theta }_B)+{\log }_2\left(\frac{3}{{\gamma }^2}\right).$$

$$D_{\max }({\overline{\omega }}_{AB}\Vert {\xi }_A\otimes {\overline{\omega }}_B)\le D_{\max }({\omega }_{AB}\Vert {\xi }_A\otimes {\kappa }_B)+{\log }_2\left(\frac{3}{{\delta }^2}\right).$$

$$D_{\max }({\overline{\theta }}_{AB}\Vert {\theta }_A\otimes {\overline{\theta }}_B)\le D_{\max }^{\epsilon -\gamma }({\theta }_{AB}\Vert {\theta }_A\otimes {\theta }_B)+{\log }_2\left(\frac{3}{{\gamma }^2}\right).$$

$$I-(S+T{)}^{-1/2}S(S+T{)}^{-1/2}\le (1+c)(I-S)+(2+c+c^{-1})T.$$

$${\tau }_{A_1\cdots A_{K}B}\equiv \frac{1}{K}\sum _{k=1}^K{\rho }_{A_1}\otimes \cdots \otimes {\rho }_{A_{k-1}}\otimes {\rho }_{A_{k}B}\otimes {\rho }_{A_{k+1}}\otimes \cdots \otimes {\rho }_{A_K}.$$

Full text

1 Introduction

Among the many results of information theory, the ability to use the noise in a wiretap channel for the purpose of private communication stands out as one of the great conceptual insights [Wyn75]. A classical wiretap channel is modeled as a conditional probability distribution $p_{Y,Z|X}$, in which the sender Alice has access to the input $X$ of the channel, the legitimate receiver Bob has access to the output $Y$, and the eavesdropper Eve has access to the output $Z$. The goal of private communication is for Alice and Bob to use the wiretap channel in such a way that Alice communicates a message reliably to Bob, while at the same time, Eve should not be able to determine which message was transmitted. The author of [Wyn75] proved that the mutual information difference

[TABLE]

is an achievable rate for private communication over the wiretap channel, when Alice and Bob are allowed to use it many independent times. Since then, the interest in the wiretap channel has not waned, and there have been many increasingly refined statements about achievable rates for private communication over wiretap channels [CK78, Hay06, Tan12, Hay13, YAG13, YSP16, TB16].

Many years after the contribution of [Wyn75], the protocol of quantum key distribution was developed as a proposal for private communication over a quantum channel [BB84]. Quantum information theory started becoming a field in its own right, during which many researchers revisited several of the known results of Shannon’s information theory under a quantum lens. This was not merely an academic exercise: doing so revealed that remarkable improvements in communication rates could be attained for physical channels of practical interest if quantum-mechanical strategies are exploited [GGL*+*04].

One important setting which was revisited is the wiretap channel, and in the quantum case, the simplest extension of the classical model is given by the classical-input quantum-output wiretap channel (abbreviated as cq wiretap channel) [Dev05, CWY04]. It is described as the following map:

[TABLE]

where $x$ is a classical symbol that Alice can input to the channel and $\rho_{BE}^{x}$ is the joint output quantum state of Bob and Eve’s system, represented as a density operator acting on the tensor-product Hilbert space of Bob and Eve’s quantum systems. The goal of private communication over the cq wiretap channel is similar to that for the classical wiretap channel. However, in this case, Bob is allowed to perform a collective quantum measurement over all of his output quantum systems in order to determine Alice’s message, while at the same time, we would like for it be difficult for Eve to figure out anything about the transmitted message, even if she has access to a quantum computer memory that can store all of the quantum systems that she receives from the channel output. The authors of [Dev05, CWY04] independently proved that a quantum generalization of the formula in (1.1) is an achievable rate for private communication over a cq quantum wiretap channel, if Alice and Bob are allowed to use it many independent times. Namely, they proved that the following Holevo information difference is an achievable rate:

[TABLE]

where the information quantities in the above formula are the Holevo information to Bob and Eve, respectively, and will be formally defined later in the present paper.

Since the developments of [Dev05, CWY04], there has been an increasing interest in the quantum information community to determine refined characterizations of communication tasks [TH13, Li14, TT15, DTW16, DHO16, DL15, BDL16, TBR16, WTB17], strongly motivated by the fact that it is experimentally difficult to control a large number of quantum systems, and in practice, one has access only to a finite number of quantum systems anyway. One such scenario of interest, as discussed above, is the quantum wiretap channel. Hitherto, the only work offering achievable one-shot rates for private communication over cq wiretap channels is [RR11]. However, that work did not consider bounding the second-order coding rate for private communication over the cq wiretap channel.

The main contribution of the present paper is a lower bound on the one-shot private capacity of a cq wiretap channel. Namely, I prove that

[TABLE]

In the above, $\log_{2}M_{\operatorname{priv}}^{\ast}(\varepsilon_{1}+\sqrt{\varepsilon_{2}})$ represents the maximum number of bits that can be sent from Alice to Bob, using a cq wiretap channel once, such that the privacy error (to be defined formally later) does not exceed $\varepsilon_{1}+\sqrt{\varepsilon_{2}}\in(0,1)$, with $\varepsilon_{1},\varepsilon_{2}\in(0,1)$. The quantities on the right-hand side of the above inequality are particular one-shot generalizations of the Holevo information to Bob and Eve, which will be defined later. It is worthwhile to note that the one-shot information quantities in (1.4) can be computed using semi-definite programming, and the computational runtime is polynomial in the dimension of the channel. Thus, for channels of reasonable dimension, the quantities can be efficiently estimated numerically. The constants $\eta_{1}$ and $\eta_{2}$ are chosen so that $\eta_{1}\in(0,\varepsilon_{1})$ and $\eta_{2}\in(0,\sqrt{\varepsilon_{2}})$. By substituting an independent and identically distributed (i.i.d.) cq wiretap channel into the right-hand side of the above inequality, using second-order expansions for the one-shot Holevo informations [TH13, Li14], and picking $\eta_{1},\eta_{2}=1/\sqrt{n}$, we find the following lower bound on the second-order coding rate for private classical communication:

[TABLE]

In the above, $\log_{2}M_{\operatorname{priv}}^{\ast}(n,\varepsilon_{1}+\sqrt{\varepsilon_{2}})$ represents the maximum number of bits that can be sent from Alice to Bob, using a cq wiretap channel $n$ times, such that the privacy error does not exceed $\varepsilon_{1}+\sqrt{\varepsilon_{2}}\in(0,1)$. The Holevo informations from (1.3) make an appearance in the first-order term (proportional to the number $n$ of channel uses) on the right-hand side above, while the second order term (proportional to $\sqrt{n}$) consists of the quantum channel dispersion quantities $V(X;B)$ and $V(X;E)$ [TT15], which will be defined later. They additionally feature the inverse $\Phi^{-1}$ of the cumulative Gaussian distribution function $\Phi$. Thus, the one-shot bound in (1.4) leads to a lower bound on the second-order coding rate, which is comparable to bounds that have appeared in the classical information theory literature [Tan12, YAG13, YSP16, TB16].

To prove the one-shot bound in (1.4), I use two recent and remarkable techniques: position-based coding [AJW17] and convex splitting [ADJ17]. The main idea of position-based coding [AJW17] is conceptually simple. To communicate a classical message from Alice to Bob, we allow them to share a quantum state $\rho_{RA}^{\otimes M}$ before communication begins, where $M$ is the number of messages, Bob possesses the $R$ systems, and Alice the $A$ systems. If Alice wishes to communicate message $m$, then she sends the $m$th $A$ system through the channel. The reduced state of Bob’s systems is then

[TABLE]

where $\rho_{R_{m}B}=\mathcal{N}_{A_{m}\rightarrow B}(\rho_{R_{m}A_{m}})$ and $\mathcal{N}_{A_{m}\rightarrow B}$ is the quantum channel. For all $m^{\prime}\neq m$, the reduced state for systems $R_{m^{\prime}}$ and $B$ is the product state $\rho_{R_{m^{\prime}}}\otimes\rho_{B}$. However, the reduced state of systems $R_{m}B$ is the (generally) correlated state $\rho_{R_{m}B}$. So if Bob has a binary measurement which can distinguish the joint state $\rho_{RB}$ from the product state $\rho_{R}\otimes\rho_{B}$ sufficiently well, he can base a decoding strategy off of this, and the scheme will be reliable as long as the number of bits $\log_{2}M$ to be communicated is chosen to be roughly equal to a one-shot mutual information known as hypothesis testing mutual information (cf., [WR12]). This is exactly what is used in position-based coding, and the authors of [AJW17] thus forged a transparent and intuitive link between quantum hypothesis testing and communication for the case of entanglement-assisted communication.

Convex splitting [ADJ17] is rather intuitive as well and can be thought of as dual to the coding scenario mentioned above. Suppose instead that Alice and Bob have a means of generating the state in (1.6), perhaps by the strategy mentioned above. But now suppose that Alice chooses the variable $m$ uniformly at random, so that the state, from the perspective of someone ignorant of the choice of $m$, is the following mixture:

[TABLE]

The convex-split lemma guarantees that as long as $\log_{2}M$ is roughly equal to a one-shot mutual information known as the alternate smooth max-mutual information, then the state above is nearly indistinguishable from the product state $\rho_{R}^{\otimes M}\otimes\rho_{B}$.

Both position-based coding and convex splitting have been used recently and effectively to establish a variety of results in one-shot quantum information theory [AJW17, ADJ17]. In the present paper, I use the approaches in conjunction to construct codes for the cq wiretap channel. The main underlying idea follows the original approach of [Wyn75], by allowing for a message variable $m\in\{1,\ldots,M\}$ and a local key variable $k\in\{1,\ldots,K\}$ (local randomness), the latter of which is selected uniformly at random and used to confuse the eavesdropper Eve. Before communication begins, Alice, Bob, and Eve are allowed share to $MK$ copies of the common randomness state $\theta_{X_{A}X_{B}X_{E}}\equiv\sum_{x}p_{X}(x)|xxx\rangle\langle xxx|_{X_{A}X_{B}X_{E}}$. We can think of the $MK$ copies of $\theta_{X_{A}X_{B}X_{E}}$ as being partitioned into $M$ blocks, each of which contain $K$ copies of the state $\theta_{X_{A}X_{B}X_{E}}$. If Alice wishes to send message $m$, then she picks $k$ uniformly at random and sends the $(m,k)$ $X_{A}$ system through the cq wiretap channel in (1.2). As long as $\log_{2}MK$ is roughly equal to the hypothesis testing mutual information $I_{H}^{\varepsilon}(X;B)$, then Bob can use a position-based decoder to figure out both $m$ and $k$. As long as $\log_{2}K$ is roughly equal to the alternate smooth max-mutual information $\widetilde{I}_{\max}^{\varepsilon}(E;X)$, then the convex-split lemma guarantees that the overall state of Eve’s systems, regardless of which message $m$ was chosen, is nearly indistinguishable from the product state $\rho_{X_{E}}^{\otimes MK}\otimes\rho_{E}$. Thus, in such a scheme, Bob can figure out $m$ while Eve cannot figure out anything about $m$. This is the intuition behind the coding scheme and gives a sense of why $\log_{2}M=\log_{2}MK-\log_{2}K\approx I_{H}^{\varepsilon}(X;B)-\widetilde{I}_{\max}^{\varepsilon}(E;X)$ is an achievable number of bits that can be sent privately from Alice to Bob. The main purpose of the present paper is to develop the details of this argument and furthermore show how the scheme can be derandomized, so that the $MK$ copies of the common randomness state $\theta_{X_{A}X_{B}X_{E}}$ are in fact not necessary.

The rest of the paper proceeds as follows. In Section 2, I review some preliminary material, which includes several metrics for quantum states and pertinent information measures. Section 3 develops the position-based coding approach for classical-input quantum-output communication channels. Position-based coding was developed in [AJW17] to highlight a different approach to entanglement-assisted communication, but I show in Section 3 how the approach can be used for shared randomness-assisted communication; I also show therein how to derandomize codes in this case (i.e., the shared randomness is not actually necessary for classical communication over cq channels). Section 4 represents the main contribution of the present paper, which is a lower bound on the $\varepsilon$-one-shot private classical capacity of a cq wiretap channel. The last development in Section 4 is to show how the one-shot lower bound leads to a lower bound on the second-order coding rate for private classical communication over a memoryless cq wiretap channel. Therein, I also show how these lower bounds simplify for pure-state cq wiretap channels and when using binary phase-shift keying as a coding strategy for private communication over a pure-loss bosonic channel. Section 5 concludes with a summary and some open questions for future work.

2 Preliminaries

I use notation and concepts that are standard in quantum information theory and point the reader to [Wil16] for background. In the rest of this section, I review concepts that are less standard and set some notation that will be used later in the paper.

Trace distance, fidelity, and purified distance. Let $\mathcal{D}(\mathcal{H})$ denote the set of density operators acting on a Hilbert space $\mathcal{H}$, let $\mathcal{D}_{\leq}(\mathcal{H})$ denote the set of subnormalized density operators (with trace not exceeding one) acting on $\mathcal{H}$, and let $\mathcal{L}_{+}(\mathcal{H})$ denote the set of positive semi-definite operators acting on $\mathcal{H}$. The trace distance between two quantum states $\rho,\sigma\in\mathcal{D}(\mathcal{H})$ is equal to $\left\|\rho-\sigma\right\|_{1}$, where $\left\|C\right\|_{1}\equiv\operatorname{Tr}\{\sqrt{C^{{\dagger}}C}\}$ for any operator $C$. It has a direct operational interpretation in terms of the distinguishability of these states. That is, if $\rho$ or $\sigma$ are prepared with equal probability and the task is to distinguish them via some quantum measurement, then the optimal success probability in doing so is equal to $\left(1+\left\|\rho-\sigma\right\|_{1}/2\right)/2$. The fidelity is defined as $F(\rho,\sigma)\equiv\left\|\sqrt{\rho}\sqrt{\sigma}\right\|_{1}^{2}$ [Uhl76], and more generally we can use the same formula to define $F(P,Q)$ if $P,Q\in\mathcal{L}_{+}(\mathcal{H})$. Uhlmann’s theorem states that [Uhl76]

[TABLE]

where $|\phi^{\rho}\rangle_{RA}$ and $|\phi^{\sigma}\rangle_{RA}$ are fixed purifications of $\rho_{A}$ and $\sigma_{A}$, respectively, and the optimization is with respect to all unitaries $U_{R}$. The same statement holds more generally for $P,Q\in\mathcal{L}_{+}(\mathcal{H})$. The fidelity is invariant with respect to isometries and monotone non-decreasing with respect to channels. The sine distance or $C$-distance between two quantum states $\rho,\sigma\in\mathcal{D}(\mathcal{H})$ was defined as

[TABLE]

and proven to be a metric in [Ras02, Ras03, GLN05, Ras06]. It was later [TCR09] (under the name “purified distance”) shown to be a metric on subnormalized states $\rho,\sigma\in\mathcal{D}_{\leq}(\mathcal{H})$ via the embedding

[TABLE]

The following inequality relates trace distance and purified distance:

[TABLE]

Relative entropies and variances. The quantum relative entropy of two states $\omega$ and $\tau$ is defined as [Ume62]

[TABLE]

whenever $\operatorname{supp}(\omega)\subseteq\operatorname{supp}(\tau)$ and it is equal to $+\infty$ otherwise. The quantum relative entropy variance is defined as [TH13, Li14]

[TABLE]

whenever $\operatorname{supp}(\omega)\subseteq\operatorname{supp}(\tau)$. The hypothesis testing relative entropy [BD10, WR12] of states $\omega$ and $\tau$ is defined as

[TABLE]

The max-relative entropy for states $\omega$ and $\tau$ is defined as [Dat09]

[TABLE]

The smooth max-relative entropy for states $\omega$ and $\tau$ and a parameter $\varepsilon\in(0,1)$ is defined as [Dat09]

[TABLE]

The following second-order expansions hold for $D_{H}^{\varepsilon}$ and $D_{\max}^{\varepsilon}$ when evaluated for tensor-power states [TH13, Li14]:

[TABLE]

The above expansion features the cumulative distribution function for a standard normal random variable:

[TABLE]

and its inverse, defined as $\Phi^{-1}(\varepsilon)\equiv\sup\left\{a\in\mathbb{R}\,|\,\Phi(a)\leq\varepsilon\right\}$.

Mutual informations and variances. The quantum mutual information $I(X;B)_{\rho}$ and information variance $V(X;B)_{\rho}$ of a bipartite state $\rho_{XB}$ are defined as

[TABLE]

In this paper, we are exclusively interested in the case in which system $X$ of $\rho_{XB}$ is classical, so that $\rho_{XB}$ can be written as

[TABLE]

where $p_{X}$ is a probability distribution, $\{|x\rangle_{X}\}_{x}$ is an orthonormal basis, and $\{\rho_{B}^{x}\}_{x}$ is a set of quantum states. The hypothesis testing mutual information is defined as follows for a bipartite state $\rho_{XB}$ and a parameter $\varepsilon\in(0,1)$:

[TABLE]

From the smooth max-relative entropy, one can define a mutual information-like quantity for a state $\theta_{AB}$ as follows:

[TABLE]

Note that we have the following expansions, as a direct consequence of (2.10)–(2.11) and definitions:

[TABLE]

Another quantity, related to that in (2.17), is as follows [AJW17]:

[TABLE]

We recall a relation [AJW17, Lemma 1] between the quantities in (2.17) and (2.20), giving a very slight modification of it which will be useful for our purposes here:

Lemma 1

For a state $\theta_{AB}$, $\varepsilon\in(0,1)$, and $\gamma\in(0,\varepsilon)$, the following inequality holds

[TABLE]

Proof. To see this, recall [AJW17, Claim 2]: For states $\omega_{AB}$, $\xi_{A}$, $\kappa_{B}$, there exists a state $\overline{\omega}_{AB}$ such that $P(\omega_{AB},\overline{\omega}_{AB})\leq\delta$ and

[TABLE]

Let $\theta_{AB}^{\ast}$ denote the optimizer for $D_{\max}^{\varepsilon-\gamma}(\theta_{AB}\|\theta_{A}\otimes\theta_{B})$. Then, in (2.22), taking $\omega_{AB}=\theta_{AB}^{\ast}$, $\xi_{A}=\theta_{A}$, $\kappa_{B}=\theta_{B}$, we find that there exists a state $\overline{\theta}_{AB}$ such that $P(\theta_{AB}^{\ast},\overline{\theta}_{AB})\leq\gamma$ and

[TABLE]

By the triangle inequality for the purified distance, we conclude that $P(\theta_{AB},\overline{\theta}_{AB})\leq P(\theta_{AB},\theta_{AB}^{\ast})+P(\theta_{AB}^{\ast},\overline{\theta}_{AB})\leq\left(\varepsilon-\gamma\right)+\gamma=\varepsilon$. Since the quantity on the left-hand side includes an optimization over all states $\theta_{AB}^{\prime}$ satisfying $P(\theta_{AB}^{\prime},\theta_{AB})\leq\varepsilon$, we conclude the inequality in (2.21).

Hayashi–Nagaoka operator inequality. A key tool in analyzing error probabilities in communication protocols is the Hayashi–Nagaoka operator inequality [HN03]: given operators $S$ and $T$ such that $0\leq S\leq I$ and $T\geq 0$, the following inequality holds for all $c>0$

[TABLE]

Convex-split lemma. The convex-split lemma from [ADJ17] has been a key tool used in recent developments in quantum information theory [AJW17, ADJ17]. We now state a variant of the convex-split lemma, which is helpful for obtaining one-shot bounds for privacy and an ensuing lower bound on the second-order coding rate. Its proof closely follows proofs available in [AJW17, ADJ17] but has some slight differences. For completeness, Appendix A contains a proof of Lemma 2.

Lemma 2** (Convex split)**

Let $\rho_{AB}$ be a state, and let $\tau_{A_{1}\cdots A_{K}B}$ be the following state:

[TABLE]

Let $\varepsilon\in(0,1)$ and $\eta\in(0,\sqrt{\varepsilon})$. If

[TABLE]

then

[TABLE]

for some state $\widetilde{\rho}_{B}$ such that $P(\rho_{B},\widetilde{\rho}_{B})\leq\sqrt{\varepsilon}-\eta$.

3 Public classical communication

3.1 Definition of the one-shot classical capacity

We begin by defining the $\varepsilon$-one-shot classical capacity of a cq channel

[TABLE]

We can write the classical–quantum channel in fully quantum form as the following quantum channel:

[TABLE]

where $\{|x\rangle_{X^{\prime}}\}_{x}$ is some orthonormal basis. Let $M\in\mathbb{N}$ and $\varepsilon\in(0,1)$. An $(M,\varepsilon)$ classical communication code consists of a collection of probability distributions $\{p_{X|M}(x|m)\}_{m=1}^{M}$ (one for each message $m$) and a decoding positive operator-valued measure (POVM) $\{\Lambda_{B}^{m}\}_{m=1}^{M}$,111We could allow for a decoding POVM to be $\{\Lambda_{B}^{m}\}_{m=0}^{M}$, consisting of an extra operator $\Lambda_{B}^{0}=I_{B}-\sum_{m=1}^{M}\Lambda_{B}^{m}$, if needed. such that

[TABLE]

We refer to the left-hand side of the above inequality as the decoding error. In the above, $\{|m\rangle_{\hat{M}}\}_{m=1}^{M}$ is an orthonormal basis, we define the state $\rho_{B}^{m}$ as

[TABLE]

and the measurement channel $\mathcal{M}_{B\rightarrow\hat{M}}$ as

[TABLE]

The equality in (3.3) follows by direct calculation:

[TABLE]

For a given channel $\mathcal{N}_{X^{\prime}\rightarrow B}$ and $\varepsilon$, the one-shot classical capacity is equal to $\log_{2}M_{\operatorname{pub}}^{\ast}(\varepsilon)$, where $M_{\operatorname{pub}}^{\ast}(\varepsilon)$ is the largest $M$ such that (3.3) can be satisfied for a fixed $\varepsilon$.

One can allow for shared randomness between Alice and Bob before communication begins, in which case one obtains the one-shot shared randomness assisted capacity of a cq channel.

3.2 Lower bound on the one-shot, randomness-assisted classical

capacity

We first consider a one-shot protocol for randomness assisted, public classical communication in which the goal is for Alice to use the classical-input quantum-output (cq) channel in (3.1) once to send one of $M$ messages with error probability no larger than $\varepsilon\in(0,1)$. The next section shows how to derandomize such that the shared randomness is not needed.

The main result of this section is that

[TABLE]

for all $\eta\in(0,\varepsilon)$, is a lower bound on the $\varepsilon$-one-shot randomness-assisted, classical capacity of the cq channel in (3.1). Although this result is already known from [WR12], the development in this section is an important building block for the wiretap channel result in Section 4.2, and so we go through it in full detail for the sake of completeness. Also, the approach given here uses position-based decoding for the cq channel.

Fix a probability distribution $p_{X}$ over the channel input alphabet. Consider the following classical–classical state:

[TABLE]

which we can think of as representing shared randomness. Let $\rho_{XB}$ denote the following state, which results from sending the $X^{\prime}$ system of $\rho_{XX^{\prime}}$ through the channel $\mathcal{N}_{X^{\prime}\rightarrow B}$:

[TABLE]

The coding scheme works as follows. Let Alice and Bob share $M$ copies of the state $\rho_{XX^{\prime}}$, so that their shared state is

[TABLE]

Alice has the systems labeled by $X^{\prime}$, and Bob has the systems labeled by $X$. If Alice would like to communicate message $m$ to Bob, then she simply sends system $X_{m}^{\prime}$ over the classical–quantum channel. In such a case, the reduced state for Bob is as follows:

[TABLE]

Observe that each state $\rho_{X^{M}B}^{m}$ is related to the first one $\rho_{X^{M}B}^{1}$ by a permutation $\pi(m)$ of the $X^{M}$ systems:

[TABLE]

where $W_{X^{M}}^{\pi(m)}$ is a unitary representation of the permutation $\pi(m)$.

If Bob has a way of distinguishing the joint state $\rho_{XB}$ from the product state $\rho_{X}\otimes\rho_{B}$, then with high probability, he will be able to figure out which message $m$ was communicated. Let $T_{XB}$ denote a test (measurement operator) satisfying $0\leq T_{XB}\leq I_{XB}$, which we think of as identifying $\rho_{XB}$ with high probability ($\geq 1-\varepsilon$) and for which the complementary operator $I_{XB}-T_{XB}$ identifies $\rho_{X}\otimes\rho_{B}$ with the highest probability subject to the constraint $\operatorname{Tr}\{T_{XB}\rho_{XB}\}\geq 1-\varepsilon$. From such a test, we form the following measurement operator:

[TABLE]

which we think of as a test to figure out whether the reduced state on systems $X_{m}B$ is $\rho_{XB}$ or $\rho_{X}\otimes\rho_{B}$. Observe that each message operator $\Gamma_{X^{M}B}^{m}$ is related to the first one $\Gamma_{X^{M}B}^{1}$ by a permutation $\pi(m)$ of the $X^{M}$ systems:

[TABLE]

If message $m$ is transmitted and the measurement operator $\Gamma_{X^{M}B}^{m}$ acts, then the probability of it accepting is

[TABLE]

If however the measurement operator $\Gamma_{X^{M}B}^{m^{\prime}}$ acts, where $m^{\prime}\neq m$, then the probability of it accepting is

[TABLE]

From these measurement operators, we then form a square-root measurement as follows:

[TABLE]

Again, each message operator $\Lambda_{X^{M}B}^{m}$ is related to the first one $\Lambda_{X^{M}B}^{1}$ by a permutation of the $X^{M}$ systems:

[TABLE]

This is called the position-based decoder and was analyzed in [AJW17] for the case of entanglement-assisted communication. The error probability under this coding scheme is as follows for each message $m$:

[TABLE]

The error probability is in fact the same for each message, due to the observations in (3.15) and (3.21)–(3.24):

[TABLE]

So let us analyze the error probability for the first message $m=1$. Applying the Hayashi-Nagaoka operator inequality in (2.24), with $S=\Gamma_{X^{M}B}^{1}$, $T=\sum_{m^{\prime}\neq 1}\Gamma_{X^{M}B}^{m^{\prime}}$, $c_{\operatorname{I}}\equiv 1+c$, and $c_{\operatorname{II}}=2+c+c^{-1}$ for $c>0$, we find that this error probability can be bounded from above as

[TABLE]

Consider the hypothesis testing mutual information:

[TABLE]

where

[TABLE]

Take the test $T_{XB}$ in Bob’s decoder to be $\Upsilon_{XB}^{\ast}$, where $\Upsilon_{XB}^{\ast}$ is the optimal measurement operator for $I_{H}^{\varepsilon-\eta}(X;B)_{\rho}$ for $\eta\in(0,\varepsilon)$. Then the error probability is bounded as

[TABLE]

Now pick $c=\eta/(2\varepsilon-\eta)$ and we get that the last line above $=\varepsilon$, for

[TABLE]

Indeed, consider that we would like to have $c$ such that

[TABLE]

Rewriting this, we find that $M$ should satisfy

[TABLE]

Picking $c=\eta/(2\varepsilon-\eta)$ then implies (after some algebra) that

[TABLE]

So the quantity $I_{H}^{\varepsilon-\eta}(X;B)_{\rho}-\log_{2}(4\varepsilon/\eta^{2})$ represents a lower bound on the $\varepsilon$-one-shot randomness-assisted, classical capacity of the cq channel in (3.1). The bound holds for both average error probability and maximal error probability, and this coincidence is due to the protocol having the assistance of shared randomness.

3.3 Lower bound on the one-shot classical capacity

Now I show how to derandomize the above randomness-assisted code. The main result of this section is the following lower bound on the $\varepsilon$-one shot classical capacity of the cq channel in (3.1), holding for all $\eta\in(0,\varepsilon)$:

[TABLE]

Again, note that although this result is already known from [WR12], the development in this section is an important building block for the wiretap channel result in Section 4.2. As stated previously, the approach given here uses position-based decoding for the cq channel.

By the reasoning from the previous section, we have the following bound on the average error probability for a randomness-assisted code:

[TABLE]

if

[TABLE]

So let us analyze the expression $\operatorname{Tr}\{(I_{X^{M}B}-\Lambda_{X^{M}B}^{m})\rho_{X^{M}B}^{m}\}$. By definition, it follows that

[TABLE]

Also, recall that $\Upsilon_{XB}^{\ast}$ is optimal for $I_{H}^{\varepsilon-\eta}(X;B)_{\rho}$, which implies that

[TABLE]

But consider that

[TABLE]

where we define

[TABLE]

Similarly, we have that

[TABLE]

This demonstrates that it suffices to take the optimal measurement operator $\Upsilon_{XB}^{\ast}$ to be $\sum_{x}|x\rangle\langle x|_{X}\otimes Q_{B}^{x}$, with $Q_{B}^{x}$ defined as in (3.49), and this will achieve the same optimal value as $\Upsilon_{XB}^{\ast}$ does.

Taking $\Upsilon_{XB}^{\ast}$ as such, now consider that

[TABLE]

Then this implies that

[TABLE]

so that

[TABLE]

where

[TABLE]

Observe that $\{\Omega_{B}^{x_{m}}\}_{m=1}^{M}$ is a POVM on the support of $\sum_{m^{\prime}=1}^{M}Q_{B}^{x_{m^{\prime}}}$ and can be completed to a POVM on the full space by adding $\Omega_{B}^{x_{0}}\equiv I_{B}-\sum_{m^{\prime}=1}^{M}Q_{B}^{x_{m^{\prime}}}$. By employing (3.43) and (3.60), we find that

[TABLE]

so that the average error probability is as follows:

[TABLE]

The last line above is the same as the usual “Shannon trick” of exchanging the average over the messages with the expectation over a random choice of code. By employing the bound in (3.41), we find that

[TABLE]

Then there exists a particular set of values of $x_{1}$, …, $x_{M}$ such that

[TABLE]

This sequence $x_{1}$, …, $x_{M}$ constitutes the codewords and $\{\Omega_{B}^{x_{m}}\}_{m=1}^{M}$ is a corresponding POVM that can be used as a decoder. The number of bits that the code can transmit is equal to $\log_{2}M=I_{H}^{\varepsilon-\eta}(X;B)_{\rho}-\log_{2}(4\varepsilon/\eta^{2})$. No shared randomness is required for this code (it is now derandomized).

Remark 3

To achieve maximal error probability $2\varepsilon$, one can remove the worst half of the codewords, and then a lower bound on the achievable number of bits is

[TABLE]

4 Private classical communication

4.1 Definition of the one-shot private classical capacity

Now suppose that Alice, Bob, and Eve are connected by a classical-input quantum-quantum-output (cqq) channel of the following form:

[TABLE]

where Bob has system $B$ and Eve system $E$. The fully quantum version of this channel is as follows:

[TABLE]

where $\{|x\rangle_{X^{\prime}}\}_{x}$ is some orthonormal basis.

We define the one-shot private classical capacity in the following way. Let $M\in\mathbb{N}$ and $\varepsilon\in(0,1)$. An $(M,\varepsilon)$ private communication code consists of a collection of probability distributions $\{p_{X|M}(x|m)\}_{m=1}^{M}$ (one for each message $m$) and a decoding POVM $\{\Lambda_{B}^{m}\}_{m=1}^{M}$, such that

[TABLE]

We refer to the left-hand side of the above inequality as the privacy error. In the above, $\{|m\rangle_{\hat{M}}\}_{m=1}^{M}$ is an orthonormal basis, the state $\sigma_{E}$ can be any state, we define the state $\rho_{BE}^{m}$ as

[TABLE]

and the measurement channel $\mathcal{M}_{B\rightarrow\hat{M}}$ as

[TABLE]

For a given channel $\mathcal{N}_{X^{\prime}\rightarrow BE}$ and $\varepsilon$, the one-shot private classical capacity is equal to $\log_{2}M_{\operatorname{priv}}^{\ast}(\varepsilon)$, where $M_{\operatorname{priv}}^{\ast}(\varepsilon)$ is the largest $M$ such that (4.3) can be satisfied for a fixed $\varepsilon$.

The condition in (4.3) combines the reliable decoding and security conditions into a single average error criterion. We can see how it represents a generalization of the error criterion in (3.3), which was for public classical communication over a cq channel. One could have a different definition of one-shot private capacity, in which there are two separate criteria, but the approach above will be beneficial for our purposes. In any case, a code satisfying (4.3) satisfies the two separate criteria as well, as is easily seen by invoking the monotonicity of trace distance.222Indeed, starting with (4.3) and applying monotonicity of trace distance under partial trace of the $E$ system, we get that $\frac{1}{M}\sum_{m=1}^{M}\frac{1}{2}\left\|\mathcal{M}_{B\rightarrow\hat{M}}(\rho_{B}^{m})-|m\rangle\langle m|_{\hat{M}}\right\|_{1}\leq\varepsilon$. Recalling (3.3), we can interpret this as asserting that the decoding error probability does not exceed $\varepsilon$. Doing the same but considering a partial trace over the $B$ system implies that $\frac{1}{M}\sum_{m=1}^{M}\frac{1}{2}\left\|\rho_{E}^{m}-\sigma_{E}\right\|_{1}\leq\varepsilon$, which is a security criterion. So we get that the conventional two separate criteria are satisfied if a code satisfies the single privacy error criterion in (4.3). Having a single error criterion for private capacity is the same as the approach taken in [HHHO09] and [WTB17], and in the latter paper, it was shown that notions of asymptotic private capacity are equivalent when using either a single error criterion or two separate error criteria.

4.2 Lower bound on the one-shot private classical

capacity

The main result of this section is the following lower bound on the $\varepsilon$-one shot private capacity of a cq wiretap channel, holding for all $\varepsilon_{1},\varepsilon_{2}\in(0,1)$, such that $\varepsilon_{1}+\sqrt{\varepsilon_{2}}\in(0,1)$, and $\eta_{1}\in(0,\varepsilon_{1})$ and $\eta_{2}\in(0,\sqrt{\varepsilon_{2}})$:

[TABLE]

To begin with, we allow Alice, Bob, and Eve shared randomness of the following form:

[TABLE]

where Bob has the $X$ system, Alice the $X^{\prime}$ system, and Eve the $X^{\prime\prime}$ system. It is natural here to let Eve share the randomness as well, and this amounts to giving her knowledge of the code to be used. Let $\rho_{XX^{\prime\prime}BE}$ denote the state resulting from sending the $X^{\prime}$ system through the channel $\mathcal{N}_{X^{\prime}\rightarrow BE}$ in (4.2):

[TABLE]

The coding scheme that Alice and Bob use is as follows. There is the message $m\in\{1,\ldots,M\}$ and a local key $k\in\{1,\ldots,K\}$. The local key $k$ represents local, uniform randomness that Alice has, but which is not accessible to Bob or Eve. We assume that Alice, Bob, and Eve share $MK$ copies of the state in (4.7) before communication begins, and we denote this state as

[TABLE]

To send the message $m$, Alice picks $k$ uniformly at random from the set $\{1,\ldots,K\}$. She then sends the $(m,k)$th $X^{\prime}$ system through the channel $\mathcal{N}_{X^{\prime}\rightarrow BE}$. Thus, when $m$ and $k$ are chosen, the reduced state on Bob and Eve’s systems is

[TABLE]

and the state of Bob’s systems is

[TABLE]

For Bob to decode, he uses the position-based decoder to decode both the message $m$ and the local key $k$. Let $\{\Lambda_{X^{M,K}B}^{m,k}\}_{m,k}$ denote his decoding POVM. By the reasoning from Section 3.2, as long as

[TABLE]

where $\varepsilon_{1}\in(0,1)$ and $\eta_{1}\in(0,\varepsilon_{1})$, then we have the following bound holding for all $m,k$:

[TABLE]

where $\Lambda_{X^{MK}B}^{m,k}$ is defined as in Sections 3.2 and 3.3. By the reasoning from Section 3.3, we can also write (4.13) as

[TABLE]

with $\Omega_{B}^{x_{m,k}}$ defined as in Section 3.3. Define the following measurement channels:

[TABLE]

with it being clear that $\operatorname{Tr}_{\hat{K}}\circ\mathcal{M}_{B\rightarrow\hat{M}\hat{K}}^{\prime}=\mathcal{M}_{B\rightarrow\hat{M}}$. Consider that

[TABLE]

Now averaging the above quantity over $m$, $k$, and $x_{1,1}$, …, $x_{M,K}$, and applying the condition in (4.14), we get that

[TABLE]

Applying convexity of the trace distance to bring the average over $k$ inside and monotonicity with respect to partial trace over system $\hat{K}$ to the left-hand side of (4.21), we find that

[TABLE]

Let us define the state

[TABLE]

Consider that

[TABLE]

Then we can write

[TABLE]

so that

[TABLE]

Using these observations, we can finally write

[TABLE]

Combining with (4.22), the above development implies that

[TABLE]

Now we consider the state on Eve’s systems and the analysis of privacy. If $m$ and $k$ are fixed, then her state is

[TABLE]

(For simplicity of notation, in the above and what follows we are labeling her systems $X^{\prime\prime}$ as $X$.) However, $k$ is chosen uniformly at random, and so conditioned on the message $m$ being fixed, the state of Eve’s systems is as follows:

[TABLE]

We would like to show for $\varepsilon_{2}\in(0,1)$ that

[TABLE]

for some state $\widetilde{\rho}_{E}$. By the invariance of the trace distance with respect to tensor-product states, i.e.,

[TABLE]

we find that

[TABLE]

From Lemma 2 and the relation in (2.4) between trace distance and purified distance, we find that if we pick $K$ such that

[TABLE]

then we are guaranteed that

[TABLE]

where $\widetilde{\rho}_{E}$ is some state such that $P(\widetilde{\rho}_{E},\rho_{E})\leq\sqrt{\varepsilon_{2}}-\eta_{2}$.

Consider that we can rewrite

[TABLE]

Applying (4.38) to (4.47), we find that

[TABLE]

Putting together (4.12), (4.42), (4.33), and (4.48), we find that if

[TABLE]

then we have by the triangle inequality that

[TABLE]

So this gives what is achievable with shared randomness (again, no difference between average and maximal error if shared randomness is allowed).

We now show how to derandomize the code. We take the above and average over all messages $m$. We find that

[TABLE]

So we can conclude that there exist particular values $x_{1,1}$, …, $x_{M,K}$ such that

[TABLE]

Thus, our final conclusion is that the number of achievable bits that can be sent such that the privacy error is no larger than $\varepsilon_{1}+\sqrt{\varepsilon_{2}}$ is equal to

[TABLE]

4.3 Second-order asymptotics for private classical communication

In this section, I show how the lower bound on one-shot private capacity leads to a non-trivial lower bound on the second-order coding rate of private communication over an i.i.d. cq wiretap channel. I also show how the bounds simplify for pure-state cq wiretap channels and when using binary phase-shift keying as a coding strategy for private communication over a pure-loss bosonic channel.

Applying Lemma 1 to (4.55) with $\gamma\in(0,\sqrt{\varepsilon}-\eta)$, we can take

[TABLE]

while still achieving the performance in (4.54).

Substituting an i.i.d. cq wiretap channel into the one-shot bounds, evaluating for such a case and using the expansions for $I_{H}^{\varepsilon}$ in (2.18) and $D_{\max}^{\varepsilon}$ in (2.19), while taking $\eta_{1}=\eta_{2}=\gamma=1/\sqrt{n}$, for sufficiently large $n$, we get that

[TABLE]

4.3.1 Example: Pure-state cq wiretap channel

Let us consider applying the inequality in (4.58) to a cq pure-state wiretap channel of the following form:

[TABLE]

in which the classical input $x$ leads to a pure quantum state $|\psi^{x}\rangle\langle\psi^{x}|_{B}$ for Bob and a pure quantum state $|\varphi^{x}\rangle\langle\varphi^{x}|_{E}$ for Eve. This channel may seem a bit particular, but we discuss in the next section how one can induce such a channel from a practically relevant channel, known as the pure-loss bosonic channel. In order to apply the inequality in (4.58) to the channel in (4.59), we fix a distribution $p_{X}(x)$ over the input symbols, leading to the following classical–quantum state:

[TABLE]

It is well known and straightforward to calculate that the following simplifications occur

[TABLE]

where $H(\sigma)\equiv-\operatorname{Tr}\{\sigma\log_{2}\sigma\}$ denotes the quantum entropy of a state $\sigma$ and

[TABLE]

Proposition 4 below demonstrates that a similar simplification occurs for the information variance quantities in (4.58), in the special case of a pure-state cq wiretap channel. By employing it, we find the following lower bound on the second-order coding rate for a pure-state cq wiretap channel:

[TABLE]

where $V(\rho_{B})$ and $V(\rho_{E})$ are defined from (4.67) below.

Proposition 4

Let

[TABLE]

be a classical–quantum state corresponding to a pure-state ensemble $\{p_{X}(x),|\psi^{x}\rangle_{B}\}_{x}$. Then the Holevo information variance $V(X;B)_{\rho}=V(\rho_{XB}\|\rho_{X}\otimes\rho_{B})$ is equal to the entropy variance $V(\rho_{B})$ of the expected state $\rho_{B}=\sum_{x}p_{X}(x)|\psi^{x}\rangle\langle\psi^{x}|_{B}$, where

[TABLE]

That is, when $\rho_{XB}$ takes the special form in (4.66), the following equality holds

[TABLE]

Proof. For the cq state in (4.66), consider that $I(X;B)_{\rho}=H(B)_{\rho}=H(\rho_{B})$. Furthermore, we have that

[TABLE]

which holds because the eigenvectors of $\rho_{XB}$ are $\left\{|x\rangle_{X}\otimes|\psi^{x}\rangle_{B}\right\}_{x}$. Then

[TABLE]

By direct calculation, we have that

[TABLE]

Observe that $I_{B}-|\psi^{x}\rangle\langle\psi^{x}|_{B}$ is the projection onto the space orthogonal to $|\psi^{x}\rangle_{B}$. Then we find that

[TABLE]

Furthermore, we have that

[TABLE]

So then, by direct calculation,

[TABLE]

In the second-to-last equality, we used the expansion in (4.78) and the fact that $|\psi^{x}\rangle\langle\psi^{x}|_{B}$ and $I_{B}-|\psi^{x}\rangle\langle\psi^{x}|_{B}$ are orthogonal. Finally, putting together (4.73) and (4.83), we conclude (4.68).

4.3.2 Example: Pure-loss bosonic channel

We can induce a pure-state cq wiretap channel from a pure-loss bosonic channel. In what follows, we consider a coding scheme called binary phase-shift keying (BPSK). Let us recall just the basic facts needed from Gaussian quantum information to support the argument that follows (a curious reader can consult [Ser17] for further details). The pure-loss channel of transmissivity $\eta\in\left(0,1\right)$ is such that if the sender inputs a coherent state $|\alpha\rangle$ with $\alpha\in\mathbb{C}$, then the outputs for Bob and Eve are the coherent states $|\sqrt{\eta}\alpha\rangle_{B}$ and $|\sqrt{1-\eta}\alpha\rangle_{E}$, respectively. Note that the overlap of any two coherent states $|\alpha\rangle$ and $|\beta\rangle$ is equal to $\left|\left\langle\alpha|\beta\right\rangle\right|^{2}=e^{-\left|\alpha-\beta\right|^{2}}$, and this is in fact the main quantity that we need to evaluate the information quantities in (4.65). The average photon number of a coherent state $|\alpha\rangle$ is equal to $\left|\alpha\right|^{2}$. A BPSK-coding scheme induces the following pure-state cq wiretap channel from the pure-loss channel:

[TABLE]

That is, if the sender would like to transmit the symbol “0,” then she prepares the coherent state $|\alpha\rangle_{A}$ at the input, and the physical channel prepares the coherent state $|\sqrt{\eta}\alpha\rangle_{B}$ for Bob and $|\sqrt{1-\eta}\alpha\rangle_{E}$ for Eve. A similar explanation holds for when the sender inputs the symbol “1.” A BPSK-coding scheme is such that the distribution $p_{X}(x)$ is unbiased: there is an equal probability 1/2 to pick “0” or “1” when selecting codewords. Thus, the expected density operators at the output for Bob and Eve are respectively as follows:

[TABLE]

A straightforward computation reveals that the eigenvalues for $\rho_{B}$ are a function only of the overlap $\left|\langle-\sqrt{\eta}\alpha|\sqrt{\eta}\alpha\rangle\right|^{2}=e^{-4\eta\left|\alpha\right|^{2}}\equiv e^{-4\eta\bar{n}}$ and are equal to [GW12]

[TABLE]

Similarly, the eigenvalues of $\rho_{E}$ are given by

[TABLE]

We can then immediately plug in to (4.65) to find a lower bound on the second-order coding rate for private communication over the pure-loss bosonic channel:

[TABLE]

where $h_{2}$ and $v_{2}$ respectively denote the binary entropy and binary entropy variance:

[TABLE]

A benchmark against which we can compare the performance of a BPSK code with $\left|\alpha\right|^{2}=\bar{n}$ is the energy-constrained private capacity of a pure-loss bosonic channel [WQ16], given by

[TABLE]

where $g(x)\equiv(x+1)\log_{2}(x+1)-x\log_{2}x$. Figure 1 plots the normal approximation [PPV10] of the lower bound on the second-order coding rate of BPSK coding for various parameter choices for $\varepsilon_{1}$, $\varepsilon_{2}$, $\eta$, and $\bar{n}$, comparing it against the asymptotic performance of BPSK and the actual energy-constrained private capacity in (4.93). The normal approximation consists of all terms in (4.90) besides the $O(\log n)$ term and typically serves as a good approximation for non-asymptotic capacity even for small values of $n$ (when (4.90) is not necessarily valid), as previously observed in [PPV10, TH13, TBR16].

5 Conclusion

This paper establishes a lower bound on the $\varepsilon$-one-shot private classical capacity of a cq wiretap channel, which in turn leads to a lower bound on the second-order coding rate for private communication over an i.i.d. cq wiretap channel. The main techniques used are position-based decoding [AJW17] in order to guarantee that Bob can decode reliably and convex splitting [ADJ17] to guarantee that Eve cannot determine which message Alice transmitted. It is my opinion that these two methods represent a powerful approach to quantum information theory, having already been used effectively in a variety of contexts in [ADJ17, AJW17].

For future work, it would be good to improve upon the lower bounds given here. Extensions of the methods of [YSP16] and [TB16] might be helpful in this endeavor.

Note: After the completion of the results in the present paper, Naqueeb Warsi informed the author of an unpublished result from [War15], which establishes a lower bound on the $\varepsilon$-one-shot private capacity of a cq wiretap channel in terms of a difference of the hypothesis testing mutual information and a smooth max-mutual information.

Acknowledgements. I am grateful to Anurag Anshu, Saikat Guha, Rahul Jain, Haoyu Qi, Qingle Wang, and Naqueeb Warsi for discussions related to the topic of this paper. I acknowledge support from the Office of Naval Research and the National Science Foundation.

Appendix A Proof of convex-split lemma

For the sake of completeness, this appendix features a proof of Lemma 2. Let $\widetilde{\rho}_{AB}$ be the optimizer for

[TABLE]

We take $\widetilde{\rho}_{B}$ as the marginal of $\widetilde{\rho}_{AB}$. We define the following state, which we think of as an approximation to $\tau_{A_{1}\cdots A_{K}B}$:

[TABLE]

In fact, it is a good approximation if $\sqrt{\varepsilon}-\eta$ is small: Consider from joint concavity of the root fidelity that

[TABLE]

which in turn implies that

[TABLE]

So the inequality in (A.6), the definition of the purified distance, and the fact that $P(\rho_{AB},\widetilde{\rho}_{AB})\leq\sqrt{\varepsilon}-\eta$ imply that

[TABLE]

Let $\omega=\sum_{y}p_{Y}(y)\omega^{y}$, for $p_{Y}$ a probability distribution and $\{\omega^{y}\}_{y}$ a set of states. Then the following property holds for quantum relative entropy and a state $\kappa$ such that $\operatorname{supp}(\omega)\subseteq\operatorname{supp}(\kappa)$:

[TABLE]

Applying (A.8), it follows that

[TABLE]

The first term in (A.9) on the right-hand side of the equality simplifies as

[TABLE]

We now lower bound the last term in (A.9). Consider that a partial trace over systems $A_{1}$, …, $A_{k-1}$, $A_{k+1}$, …, $A_{K}$ gives

[TABLE]

where the equality follows because $\widetilde{\tau}_{A_{k}B}=\left[1/K\right]\widetilde{\rho}_{AB}+\left[1-1/K\right]\rho_{A}\otimes\widetilde{\rho}_{B}$. Thus, averaging the inequality in (A.12) over $k$ implies that

[TABLE]

Putting together (A.9), (A.11), and (A.13), we find that

[TABLE]

By the definition of $\lambda^{\ast}$ in (A.1), we have that

[TABLE]

which means that

[TABLE]

An important property of quantum relative entropy is that $D(\omega\|\tau)\geq D(\omega\|\tau^{\prime})$ if $\tau\leq\tau^{\prime}$. Applying it to (A.16) and the right-hand side of (A.14), we get that

[TABLE]

Then the well known inequality $D(\omega\|\tau)\geq-\log_{2}F(\omega,\tau)$, (A.14), and (A.17)–(A.19) imply that

[TABLE]

which in turn implies that

[TABLE]

So if we pick $K$ such that

[TABLE]

then we are guaranteed that

[TABLE]

By the triangle inequality for the purified distance, we then get that

[TABLE]

This concludes the proof.