Randomness extraction via a quantum generalization of the conditional collision entropy

TL;DR

This paper introduces a quantum generalization of collision entropy for randomness extraction against quantum side information, optimizing extractable key length and providing asymptotic optimality with a novel eigenvalue-based evaluation.

Contribution

It presents a new quantum collision entropy measure for randomness extraction, optimizing it with respect to side information, and proves its asymptotic optimality.

Findings

Derived a lower bound expressed as the difference of two entropies

Reduced evaluation to an eigenvalue problem of two states

Established asymptotic optimality of the proposed entropy measure

Abstract

Randomness extraction against side information is the art of distilling from a given source a key which is almost uniform conditioned on the side information. This paper provides randomness extraction against quantum side information whose extractable key length is given by a quantum generalization of the collision entropy, which is smoothed and conditioned differently from how this is done in existing schemes. Based on the fact that the collision entropy is not subadditive, its optimization with respect to additional side information is introduced, and is shown to be asymptotically optimal. The lower bound derived there for general states is expressed as the difference between two unconditional entropies and its evaluation reduces to an eigenvalue problem of two states, which are the entire state and the marginal state of side information.

Equations

$$H_{\min }^{ϵ}(A|B{)}_{\rho }$$

$$H_{\min }(A|B{)}_{\rho }$$

$$\{X\ge 0\}=\sum _{i:{\lambda }_i\ge 0}{E}_i.$$

$$d_1(A,B)$$

$$D(A\Vert B)$$

$$S(A)=-\mathrm{Tr}A{\log }_{2}A.$$

$$S(A)$$

$$D(A\Vert B)$$

$$\displaystyle f\Big{(}\sum_{i}C_{i}^{{\dagger}}X_{i}C_{i}\Big{)}\leq\sum_{i}C_{i}^{{\dagger}}f(X_{i})C_{i}$$

$$\mathrm{Pr}[G(x_0)=G(x_1)]\le \frac{1}{|\mathcal{S}|}$$

$${\rho }_{XB}=\sum _{x\in \mathcal{X}}{p}_x|x⟩⟨x|\otimes {\rho }_x,$$

$$d(X|B{)}_{\rho }=d_1({\rho }_{XB},{\pi }_X\otimes {\rho }_B),$$

$$D(X|B{)}_{\rho }=D({\rho }_{XB}\Vert {\pi }_X\otimes {\rho }_B).$$

$$\displaystyle(2/\ln 2)\big{(}d(X|B)_{\rho}\big{)}^{2}\leq D(X|B)_{\rho},$$

$$\displaystyle R_{\epsilon}(A|B)_{\rho}=\sup_{\lambda}\big{\{}\lambda{\big{|}}\mathrm{Tr}\big{[}\big{\{}\Lambda_{B}-2^{-\lambda}\rho_{B}^{2}\leq 0\big{\}}\rho_{B}\big{]}\geq 1-\epsilon\big{\}},$$

$$\displaystyle\Lambda_{B}=\mathrm{Tr}_{A}\big{[}\rho_{AB}^{2}\big{]}.$$

$${\bar{R}}_{ϵ}(A|B{)}_{\rho }=\underset{{\mathcal{H}}_C,{\rho }_{ABC}:{\mathrm{Tr}}_C[{\rho }_{ABC}]={\rho }_{AB}}{\sup }{R}_{ϵ}(A|BC{)}_{\rho },$$

$$R_{ϵ}(A|BC{)}_{\rho }>R_{ϵ}(A|B{)}_{\rho }$$

$${\bar{R}}_{ϵ}(A|B{)}_{\rho }\le {\bar{R}}_{ϵ}(A|B^{\prime }{)}_{\mathcal{F}(\rho )}.$$

$$\displaystyle{\cal{F}}(\rho_{B})=\mathrm{Tr}_{E}\big{[}U\rho_{B}U^{{\dagger}}\big{]}$$

$$R_{ϵ}(A|BC{)}_{\rho }=R_{ϵ}(A|B^{\prime }EC{)}_{U\rho U^{†}}\le {\bar{R}}_{ϵ}(A|B^{\prime }{)}_{\mathcal{F}(\rho )},$$

$${\bar{R}}_{ϵ}(A|B{)}_{\rho }$$

$$\le {\bar{R}}_{ϵ}(A|B^{\prime }{)}_{\mathcal{F}(\rho )}.$$

$$\displaystyle D(S|BG)_{\sigma_{SBG}}\leq\epsilon\log_{2}\big{(}d|{\cal{S}}|\big{)}+\eta_{0}(\epsilon)+\frac{\delta+\epsilon+\epsilon^{1/2}}{\ln 2}$$

$$\displaystyle\eta_{0}(\epsilon)=\left\{\begin{array}[]{cl}-\epsilon\log_{2}\epsilon&\mathrm{for}\ 0\leq\epsilon\leq 1/2,\\ 1/2&\mathrm{for}\ \epsilon>1/2,\end{array}\right.$$

$$d=\mathrm{rank}{\rho }_B\text{and}\delta =|\mathcal{S}|2^{-R_{ϵ}(X|B{)}_{\rho }}.$$

$$\displaystyle\begin{split}&D(S|BG)_{\sigma_{SBG}}\\ &=\sum_{g,s}p_{g}\mathrm{Tr}\big{[}\rho_{sg}\log_{2}\rho_{sg}\big{]}-\mathrm{Tr}\big{[}\rho_{B}\log_{2}\rho_{B}\big{]}+\log_{2}|{\cal{S}}|\end{split}$$

$${\rho }_{sg}=\sum _{x\in g^{-1}(s)}{p}_x{\rho }_x$$

$$X_{sg}={\rho }_{sg}+\gamma \mathbb{I}\text{and}{C}_{sg}=(p_g{\rho }_{sg}{)}^{1/2}P{\hat{\rho }}_B^{-1/2}$$

$$\displaystyle\hat{\rho}_{B}=P\rho_{B}P\quad{\text{and}}\quad P=\big{\{}\Lambda_{B}-2^{-r}\rho_{B}^{2}\leq 0\big{\}}$$

$$X_{+}=\mathbb{I}\text{and}{C}_{+}=\mathbb{I}-P_{\rho },$$

$$f(X_{+})=0\text{and}\sum _{s,g}{C}_{sg}^{†}{C}_{sg}+C_{+}^{†}{C}_{+}=\mathbb{I}.$$

Full text

I Introduction

Consider a classical system $X$ and a quantum system $B$ in a joint quantum state $\rho_{XB}$. The task of randomness extraction from the classical source $X$ against the quantum side information $B$ is to distill an almost random key $S$ from $X$ by applying a classical channel $\mathcal{P}_{X\to S}$ from system $X$ to system $S$, which results in a classical-quantum state $\sigma_{SB}=\mathcal{P}_{X\to S}(\rho_{XB})$. Here the randomness of $S$ is measured by the trace distance between the state $\sigma_{SB}$ of composite systems $SB$ and an ideal state $\pi_{S}\otimes\rho_{B}$, where $\pi_{S}$ is the maximally mixed state and $\rho_{B}$ is the marginal state of $\rho_{XB}$. A major application of randomness extraction is privacy amplification [1, 14], whose task is to transform a partially secure key into a highly secure key in the presence of an adversary with side information.

It has been shown that a two-universal hash function [5] can be used to provide randomness extraction against quantum side information, in which the extractable key length is lower-bounded by a quantum generalization of the conditional min-entropy [13]. The extractable key length can also be given by a quantum generalization of the conditional collision entropy (conditional Rényi entropy of order 2) [13, 14]. It should be stated that the collision entropy is lower-bounded by the min-entropy and so gives a better extractable key length than the min-entropy, while the min-entropy has several useful properties such as the monotonicity under quantum operations.

The way to consider a tighter bound on the length of an extractable almost random key is to generalize entropies by smoothing. In fact, the existing extractable key lengths have been described by smooth entropies, most of which are defined as the maximization of entropies with respect to quantum states within a small ball (see e.g. [11, 13, 14, 17, 19]). More precisely, let ${\cal{H}}_{A}$ and ${\cal{H}}_{B}$ be finite-dimensional Hilbert spaces, and ${\cal{S}}({\cal{H}})$ and ${\cal{S}}_{\leq}({\cal{H}})$ denote the sets of normalized and sub-normalized quantum states on a Hilbert space ${\cal{H}}$, respectively; then, for example, the smooth min-entropy $H_{\mathrm{min}}^{\epsilon}(A|B)_{\rho}$ of system $A$ conditioned on system $B$ of a state $\rho\in{\cal{S}}_{\leq}({\cal{H}}_{A}\otimes{\cal{H}}_{B})$ is defined by

[TABLE]

where $\mathbb{I}_{A}$ denotes the identity operator on ${\cal{H}}_{A}$, and B^{\epsilon}(\rho)=\big{\{}\rho^{\prime}\in{\cal{S}}_{\leq}({\cal{H}})\big{|}P(\rho,\rho^{\prime})\leq\epsilon\big{\}} for $\epsilon>0$ and $\rho\in{\cal{S}}_{\leq}({\cal{H}})$ with $P(\rho,\rho^{\prime})=\sqrt{1-F^{2}(\rho,\rho^{\prime})}$ and F(\rho,\rho^{\prime})=\mathrm{Tr}\big{|}\sqrt{\rho}\sqrt{\rho^{\prime}}\big{|}+\sqrt{(1-\mathrm{Tr}[\rho])(1-\mathrm{Tr}[\rho^{\prime}])}.111$F$ is called the generalized fidelity and $P$ the purified distance [16]. The hypothesis testing relative entropy [18, 20] is based on the operator-smoothing [3, 4], which is different from the above standard smoothing called the state-smoothing, but is conditioned in the same way as above, i.e. an operator of the form $\mathbb{I}_{A}\otimes\sigma_{B}$ is introduced and the entropy is maximized with respect to $\sigma_{B}$.

The contributions of this paper are summarized as follows: (i) This paper introduces a quantum generalization $R_{\epsilon}$ of the conditional collision entropy with smoothing parameter $\epsilon$ (Definition 1) and shows that $R_{\epsilon}$ gives a lower bound on the key length of randomness extraction against quantum side information (Theorem 3). Since the smoothing and the conditioning for $R_{\epsilon}$ are not standard,222Here, smoothing is called standard if a quantity of interest is maximized with respect to quantum states within a small ball, and conditioning is called standard if an operator of the form $\mathbb{I}_{A}\otimes\sigma_{B}$ is introduced and a quantity of interest is maximized with respect to $\sigma_{B}$. the proof of the achievability of randomness extraction in this paper might be rather independent of the existing ones. (ii) This paper shows that the conditional collision entropy $\bar{R}_{\epsilon}$ optimized with respect to additional side information333It follows from the monotonicity of the relative entropy that $\bar{R}_{\epsilon}$ also gives a key length of randomness extraction against quantum side information. (Definition 1), which automatically satisfies the strong subadditivity and so the data processing inequality (Proposition 2), is asymptotically optimal (Corollary 7). This result demonstrates that the optimization of a conditional entropy with respect to additional side information can endow the entropy with not only the strong subadditivity but also the asymptotic optimality. (iii) This paper shows that $\bar{R}_{\epsilon}$ has a general lower bound which is asymptotically optimal (Corollary 7) and is expressed as the difference between two unconditional entropies, each asymptotically approaching the von Neumann entropy, with an additive term of $O(\epsilon)$ for small $\epsilon$ (Theorem 6). Since each unconditional entropy can be determined by the eigenvalues of a given state, the evaluation of the lower bound reduces to an eigenvalue problem of two quantum states, which are the entire state and the marginal state of side information.

II Preliminaries

Let ${\cal{H}}$ be a Hilbert space. For an Hermitian operator $X$ on ${\cal{H}}$ with spectral decomposition $X=\sum_{i}\lambda_{i}E_{i}$, let $\{X\geq 0\}$ denote the projection on ${\cal{H}}$ given by

[TABLE]

The projections $\{X>0\}$, $\{X\leq 0\}$ and $\{X<0\}$ are defined analogously. Let $A$ and $B$ be positive operators on ${\cal{H}}$. The trace distance $d_{1}({A},{B})$ and the relative entropy $D(A\|B)$ between $A$ and $B$ are defined as

[TABLE]

respectively, where $\log_{2}$ denotes the logarithm to base $2$. The von Neumann entropy of $A$ is defined as

[TABLE]

For an operator $X>0$, let $X^{\prime}$ denote the normalization of $X$; that is, $X^{\prime}=X/\mathrm{Tr}[X]$. It then follows from $S(A^{\prime})\leq\log_{2}\mathrm{rank}A^{\prime}=\log_{2}\mathrm{rank}A$ and $D(A^{\prime}\|B^{\prime})\geq 0$ that

[TABLE]

More generally, it can be shown that inequality (1) holds for $A\geq 0$ and inequality (2) holds for $A,B\geq 0$ such that $\mathrm{supp}A\subset\mathrm{supp}B$, by using the convention $0\log_{2}0=0$, which can be justified by taking the limit, $\lim_{\epsilon\searrow 0}\epsilon\log_{2}\epsilon=0$.

Let $f$ be an operator convex function on an interval $J\subset\mathbb{R}$. Let $\{X_{i}\}_{i}$ be a set of operators on ${\cal{H}}$ with their spectrum in $J$, and $\{C_{i}\}_{i}$ be a set of operators on ${\cal{H}}$ such that $\sum_{i}C_{i}^{{\dagger}}C_{i}=\mathbb{I}$, where $\mathbb{I}$ is the identity operator on ${\cal{H}}$. Then Jensen’s operator inequality for $f$, $\{X_{i}\}_{i}$ and $\{C_{i}\}_{i}$ is given by

[TABLE]

(see e.g. [2, 9]).

Let ${\cal{X}}$ and ${\cal{S}}$ be finite sets and ${\cal{G}}$ be a family of functions from ${\cal{X}}$ to ${\cal{S}}$. Let $G$ be a random variable uniformly distributed over ${\cal{G}}$. Then ${\cal{G}}$ is called two-universal, and $G$ is called a two-universal hash function [5], if

[TABLE]

for every distinct $x_{0},x_{1}\in{\cal{X}}$. For example, the family of all functions from ${\cal{X}}$ to ${\cal{S}}$ is two-universal. A more useful two-universal family is that of all linear functions from $\{0,1\}^{n}$ to $\{0,1\}^{m}$. More efficient families, which can be described using $O(n+m)$ bits and have polynomial-time evaluating algorithms, are discussed in [5, 22].

Let ${\cal{H}}_{X}$ and ${\cal{H}}_{B}$ be Hilbert spaces, and $\rho_{XB}$ be a classical-quantum state on ${\cal{H}}_{X}\otimes{\cal{H}}_{B}$ given by

[TABLE]

where ${\cal{X}}$ is a finite set such that $\{|{x}\rangle\}_{x\in{\cal{X}}}$ forms an orthonormal basis of ${\cal{H}}_{X}$, $\{p_{x}\}_{x\in{\cal{X}}}$ is a probability distribution on ${\cal{X}}$, and $\rho_{x}\in{\cal{S}}({\cal{H}}_{B})$ for $x\in{\cal{X}}$. Then the distance $d(X|B)_{\rho}$ from uniform of system $X$ given system $B$ of a state $\rho$ can be defined as

[TABLE]

where $\pi_{X}$ denotes the maximally mixed state on ${\cal{H}}_{X}$, i.e. $\pi_{X}=\mathbb{I}_{X}/|{\cal{X}}|$.

Instead of the trace distance, another distance measure may be used to define the distance from uniform. For example, the relative entropy can be used to define the distance from uniform of the form

[TABLE]

Here, quantum Pinsker’s inequality (2/\ln 2)\big{(}d_{1}(\rho,\sigma)\big{)}^{2}\leq D(\rho\|\sigma) (see [12]) gives

[TABLE]

which ensures that an upper bound on $D(X|B)_{\rho}$ also gives an upper bound on $d(X|B)_{\rho}$. Therefore, in this paper, we will use $D(X|B)_{\rho}$, instead of $d(X|B)_{\rho}$, as the measure of the distance from uniform.

III Randomness extraction

First, we introduce a quantum generalization of the (smoothed) conditional collision entropy and its optimization with respect to additional side information.

Definition 1**.**

Let ${\cal{H}}_{A}$ and ${\cal{H}}_{B}$ be Hilbert spaces, and $\rho_{AB}$ be a quantum state on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}$. For $\epsilon\geq 0$, the information spectrum collision entropy444This name of $R_{\epsilon}$ follows that of the information spectrum relative entropy $D^{\epsilon}_{s}(\rho\|\sigma)=\sup\{R|\mathrm{Tr}[\rho\{\rho\leq 2^{R}\sigma\}]\leq\epsilon\}$, which can be considered as an entropic version of the quantum information spectrum, $\underline{D}$ and $\overline{D}$ (see [18]). $R_{\epsilon}(A|B)_{\rho}$ of system $A$ conditioned on system $B$ of a state $\rho$ is given by

[TABLE]

where we have introduced

[TABLE]

Moreover, for $\epsilon\geq 0$, the information spectrum collision entropy $\bar{R}_{\epsilon}(A|B)_{\rho}$ of system $A$ conditioned on system $B$ of a state $\rho$ with optimal side information is given by

[TABLE]

where the supremum ranges over all Hilbert spaces ${\cal{H}}_{C}$ and quantum states $\rho_{ABC}$ on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}\otimes{\cal{H}}_{C}$ such that $\mathrm{Tr}_{C}[\rho_{ABC}]=\rho_{AB}$.

In contrast to the conditional von Neumann entropy $S(A|B)_{\rho}=S(\rho_{AB})-S(\rho_{B})$, $R_{\epsilon}(A|B)_{\rho}$ can increase when additional side information is provided; that is,

[TABLE]

is possible (such side information for the classical collision entropy is called spoiling knowledge [1]). On the other hand, $\bar{R}_{\epsilon}(A|B)_{\rho}$ is optimized with respect to additional side information, and so satisfies the following data processing inequality.

Proposition 2**.**

Let ${\cal{H}}_{A}$, ${\cal{H}}_{B}$ and ${\cal{H}}_{B^{\prime}}$ be Hilbert spaces, and $\rho_{AB}$ be a quantum state on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}$. Let ${\cal{F}}$ be a trace preserving completely positive map from system $B$ to system $B^{\prime}$. Then

[TABLE]

Proof.

The definitions of $R_{\epsilon}$ and $\bar{R}_{\epsilon}$ at once give that $R_{\epsilon}(A|B)_{\rho}$ is invariant under the adjoint action of an isometry on system $B$ and $R_{\epsilon}(A|BC)_{\rho}\leq\bar{R}_{\epsilon}(A|B)_{\rho}$ for any $\rho_{ABC}$. Moreover, the Stinespring dilation theorem (see [15]) ensures that there exist a Hilbert space ${\cal{H}}_{E}$ and an isometry $U:{\cal{H}}_{B}\rightarrow{\cal{H}}_{B^{\prime}}\otimes{\cal{H}}_{E}$ such that

[TABLE]

for any $\rho_{B}\in{\cal{S}}({\cal{H}}_{B})$. Therefore, for any Hilbert space ${\cal{H}}_{C}$ and $\rho_{ABC}\in{\cal{S}}({\cal{H}}_{A}\otimes{\cal{H}}_{B}\otimes{\cal{H}}_{C})$ such that $\mathrm{Tr}_{C}[\rho_{ABC}]=\rho_{AB}$,

[TABLE]

and so

[TABLE]

This completes the proof. ∎

We are now ready to state a main theorem. Note that the monotonicity of the relative entropy enables to replace $R_{\epsilon}(A|B)_{\rho}$ in this theorem by $\bar{R}_{\epsilon}(A|B)_{\rho}$.

Theorem 3**.**

Let ${\cal{X}}$ and ${\cal{S}}$ be finite sets, and ${\cal{G}}$ be a two-universal family of hash functions from ${\cal{X}}$ to ${\cal{S}}$. Let ${\cal{H}}_{X}$, ${\cal{H}}_{S}$ and ${\cal{H}}_{G}$ be Hilbert spaces of dimensions $|{\cal{X}}|$, $|{\cal{S}}|$ and $|{\cal{G}}|$, respectively. Let ${\cal{H}}_{B}$ be a Hilbert space, and $\rho_{XB}$ be a classical-quantum state on ${\cal{H}}_{X}\otimes{\cal{H}}_{B}$. Let $\pi_{G}$ be the maximally mixed state on ${\cal{H}}_{G}$ independent of $\rho_{XB}$, and suppose that the classical channel from $X$ to $S$ induced by the two-universal hash function $G$ maps $\rho_{XB}\otimes\pi_{G}$ to $\sigma_{SBG}$. Then

[TABLE]

for $\epsilon\geq 0$, where $\eta_{0}$ is a function on $[0,\infty)$ given by

[TABLE]

and we have introduced

[TABLE]

Proof.

Direct calculation shows that

[TABLE]

with $p_{g}=1/|{\cal{G}}|$, where we have defined

[TABLE]

(see (5) for the notation of a classical-quantum state). Since the real function $-\log_{2}$ is operator convex on $(0,\infty)$ (see e.g. [2]), we can estimate the first term of the right-hand side of (11) by applying Jensen’s operator inequality as follows. Let $f=-\log_{2}$ and introduce the operators $X_{sg}$ and $C_{sg}$ by writing

[TABLE]

for $\gamma>0$, where we have defined

[TABLE]

for $r<R_{\epsilon}(X|B)_{\rho}$. It readily follows that $X_{sg}>0$ and $\sum_{s,g}C_{sg}^{{\dagger}}C_{sg}=P_{\rho}$, where $P_{\rho}$ denotes the projection onto the range of $\hat{\rho}_{B}$. Furthermore, let us define the operators $X_{+}$ and $C_{+}$ by

[TABLE]

so that

[TABLE]

Then by Jensen’s operator inequality (3),

[TABLE]

Here, $\sum_{s,g}C_{sg}^{{\dagger}}X_{sg}C_{sg}$ is an operator on the range ${\cal{R}}(\hat{\rho}_{B})$ of $\hat{\rho}_{B}$, while $C_{+}^{{\dagger}}X_{+}C_{+}$ is an operator on its orthogonal complement ${\cal{R}}(\hat{\rho}_{B})^{\perp}$. It thus follows that

[TABLE]

which, in the limit $\gamma\searrow 0$, leads to

[TABLE]

To estimate the right-hand side of (13), let us estimate the sum $\sum_{s,g}p_{g}P\rho_{sg}^{2}P$. Substitution of (12) into this sum gives

[TABLE]

Here, we divide the sum of the right-hand side into two parts so that one part consists of the terms with $x=x^{\prime}$ and the other part consists of the remaining terms. It follows from the definition of $P$ that the former part can be bounded as

[TABLE]

By using (4), the latter part can also be bounded as

[TABLE]

The above two inequalities at once give

[TABLE]

with $\delta_{r}=|{\cal{S}}|2^{-r}$. Note here that $\log_{2}\rho_{sg}\leq 0$ and $\rho_{sg}\geq\rho_{sg}^{1/2}P\rho_{sg}^{1/2}$, and so

[TABLE]

Therefore, by taking the trace of both sides of (13) and then using (14) and $\mathrm{Tr}[\hat{\rho}_{B}]\leq 1$, we obtain

[TABLE]

where we have introduced

[TABLE]

Furthermore, by using $\mathrm{Tr}[\hat{\rho}_{B}]\geq 1-\epsilon$ and $\log_{2}(1+x)\leq x/\ln 2$ for $x\geq 0$, this inequality can be simplified to

[TABLE]

It remains to estimate $\Delta$. Let us write $\Delta$ in the form $\Delta=\Delta_{1}+\Delta_{2}$, where

[TABLE]

First, we estimate the first part $\Delta_{1}$. Let $S=\hat{\rho}_{B}$ and $T=\hat{\rho}_{B}^{-1/2}P\rho_{B}^{2}P\hat{\rho}_{B}^{-1/2}$. Since

[TABLE]

and hence $\mathrm{supp}S\subset\mathrm{supp}T$, inequality (2) can be applied to yield

[TABLE]

It is now convenient to define $\phi=\mathrm{Tr}[T-S]$, which can be written as

[TABLE]

Hence by Schwarz’s inequality,

[TABLE]

By use of $\mathrm{Tr}[(\mathbb{I}-P)\rho_{B}]\leq\epsilon$ and \mathrm{Tr}\big{[}\rho_{B}P\hat{\rho}_{B}^{-1}P\rho_{B}\big{]}=\mathrm{Tr}[T]=\mathrm{Tr}[S]+\phi, this inequality can be simplified to \phi\leq\epsilon^{1/2}\big{(}\mathrm{Tr}[S]+\phi\big{)}^{1/2}, which, together with $\mathrm{Tr}[S]=\mathrm{Tr}[\hat{\rho}_{B}]\leq 1$, gives

[TABLE]

Therefore

[TABLE]

Next, we estimate the second part $\Delta_{2}$. Let $\kappa_{P}(\rho_{B})=P\rho_{B}P+(\mathbb{I}-P)\rho_{B}(\mathbb{I}-P)$. Since $\rho_{B}$ and $\kappa_{P}(\rho_{B})$ are density operators, $D(\rho_{B}\|\kappa_{P}(\rho_{B}))\geq 0$, and hence

[TABLE]

From this and (1),

[TABLE]

where $d=\mathrm{rank}\rho_{B}$ and $\eta_{0}$ is a monotone increasing function on $[0,\infty)$ defined by (10).555This inequality is a special case of Fannes inequality [8]. Now, the required inequality (7) follows from (15), (16) and (17) with taking the limit $r\nearrow R_{\epsilon}(X|B)_{\rho}$. This completes the proof. ∎

Let $l^{\epsilon}_{D}(X|B)$ denote the maximal length of randomness of distance $\epsilon$ from uniform measured by the relative entropy $D$ (see (6)), extractable from system $X$ given system $B$. It then follows from this theorem that

[TABLE]

with

[TABLE]

(where we have used $|{\cal{S}}|\leq|{\cal{X}}|$). Since the smooth min-entropy $H_{\mathrm{min}}^{\epsilon}$ upper-bounds the maximal length $l^{\epsilon}$ of randomness (see e.g. [18]), this theorem also gives that $\bar{R}_{\epsilon}(X|B)$ is upper-bounded by $H_{\mathrm{min}}^{\epsilon}$ as

[TABLE]

with $\epsilon^{*}=(2(\ln 2)\epsilon^{\prime})^{1/4}$, where we have used $P(\rho,\sigma)\leq\sqrt{2d_{1}(\rho,\sigma)}$ (see [16]) and quantum Pinsker’s inequality.666The distance $P(S|BG)_{\sigma}$ from uniform in [18] is defined by use of the purified distance as $P(S|BG)_{\sigma}=\min_{\tau_{B}}P(\sigma_{SBG},\pi_{S}\otimes\tau_{B}\otimes\sigma_{G})$, which is upper-bounded by $P(\sigma_{SBG},\pi_{S}\otimes\sigma_{BG})$.

It can be seen from inequality (7) that the lower dimension $d$ of side information gives the longer key length of randomness extraction. Here, it may help to note that the monotonicity of the relative entropy allows us to assume that the dimension $d$ is controlled by legitimate parties even in cryptographic applications where side information should be assumed under the full control of an adversary. For the case where the legitimate parties use high-dimensional states, one may consider a reduction to lower-dimensional states described below. Let ${\cal{X}}$ be a finite set. For any set of quantum states $\{\rho_{x}\}_{x\in{\cal{X}}}$ on ${\cal{H}}_{B}$, one can construct a set of pure states $\{\rho^{*}_{x}\}_{x\in{\cal{X}}}$ on ${\cal{H}}_{B^{*}}$ such that there exists a trace preserving completely positive map ${\cal{F}}:B^{*}\rightarrow B$ satisfying ${\cal{F}}(\rho^{*}_{x})=\rho_{x}$ for all $x\in{\cal{X}}$ [6]. Therefore, for the case where $d=\mathrm{rank}\rho_{B}$ is high, we may substitute $R(X|B)_{{\cal{F}}(\rho)}$ by $R(X|B^{*})_{\rho}$ with $\rho_{XB^{*}}=\sum_{x}p_{x}|x\rangle\langle x|\otimes\rho^{*}_{x}$, where $R(X|B^{*})_{\rho}\leq R(X|B)_{{\cal{F}}(\rho)}$ and $\mathrm{rank}\rho_{B^{*}}\leq|{\cal{X}}|$. (Here, the latter inequality is an advantage but the former is a disadvantage of this reduction.)

In randomness extraction against classical side information $Y$, the distance from uniform can be upper-bounded as $D(S|BG)_{\sigma_{SBG}}\leq\epsilon\log_{2}|{\cal{S}}|+\delta/\ln 2$ if $G$ and $Y$ are independent [1], and as

[TABLE]

if $Y$ may depend on $G$ [21]. (It should be stated that, in quantum key distribution, adversary’s measurement can wait until the choice of hash functions is announced, and so adversary’s information $Y$ may depend on the choice $G$). Here, we note that for a purely classical state $\rho_{XY}$, $R(X|Y)_{\rho}$ becomes

[TABLE]

where $R(X|Y=y)=-\log_{2}\sum_{x}\mathrm{Pr}[X=x|Y=y]^{2}$. Since $R_{\epsilon}(X|Y)$ coincides with the (smoothed) conditional collision entropy given by [1, 21], $R_{\epsilon}(A|B)_{\rho}$ can be considered as its quantum generalization. Hence it may be of interest to compare the results of these works. It can be seen that the upper bound given in this work (see (7)) is larger than that given in [21] (see above) by $\epsilon\log_{2}(d/\epsilon)+\epsilon^{1/2}/\ln 2$, which is $O(\epsilon^{1/2})$ as $\epsilon\searrow 0$.

IV Asymptotic optimality

We first introduce two information spectrum entropies which asymptotically approach the von Neumann entropy.

Definition 4**.**

Let $\rho_{A}$ be a quantum state on a Hilbert space ${\cal{H}}_{A}$. Then, for $\epsilon\geq 0$, the information spectrum sup-entropy $\overline{S}_{\epsilon}(A)_{\rho}$ and inf-entropy $\underline{S}_{\epsilon}(A)_{\rho}$ of system $A$ of a state $\rho$ are given by

[TABLE]

respectively.777This definition can be derived immediately from the information spectrum relative entropy [18] via the formula $S(\rho)=-D(\rho\|\mathbb{I})$.

Proposition 5**.**

Let $\rho_{A}$ be a quantum state on a Hilbert space ${\cal{H}}_{A}$ of finite dimension $d_{A}$. Then, for $\gamma>0$,

[TABLE]

with

[TABLE]

where we have introduced

[TABLE]

for $\rho\in{\cal{S}}({\cal{H}})$ and $\gamma>0$.

Proof.

Note that $\overline{S}_{\epsilon}(A)_{\rho}$ and $\underline{S}_{\epsilon}(A)_{\rho}$ can be described by the probability distribution induced by the eigenvalues of $\rho_{A}$. Hence, the proposition is a direct consequence of Sanov’s theorem (see e.g. [7]), which gives that, in our notation,

[TABLE]

with

[TABLE]

for $\rho\in{\cal{S}}({\cal{H}})$, where ${\cal{H}}$ is a Hilbert space of finite dimension $d$. ∎

Next, we give a general lower bound on $\bar{R}_{\epsilon}$ in terms of the two information spectrum entropies introduced above, and then show the asymptotic optimality of $\bar{R}_{\epsilon}$. Since each information spectrum entropy is determined by the eigenvalues of a quantum state, the evaluation of the lower bound reduces to the eigenvalue problem of two quantum states $\rho_{AB}$ and $\rho_{A}$.

Theorem 6**.**

Let ${\cal{H}}_{A}$ and ${\cal{H}}_{B}$ be Hilbert spaces, and $\rho_{AB}$ be a quantum state on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}$. Then, for $\underline{\epsilon},\overline{\epsilon}>0$,

[TABLE]

with

[TABLE]

Proof.

Let ${\cal{H}}_{C}$ be a two-dimensional Hilbert space with an orthonormal basis $\{|0\rangle,|1\rangle\}$. For $\underline{\epsilon}>0$, define a quantum state $\rho_{ABC}$ on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}\otimes{\cal{H}}_{C}$ by

[TABLE]

where we have introduced

[TABLE]

with $\mu=2^{-\underline{S}_{\underline{\epsilon}}(AB)_{\rho}}$. It is clear from this definition that

[TABLE]

Also, it follows from the definition of $\underline{S}_{\epsilon}$ that

[TABLE]

Moreover, for $\overline{\epsilon}>0$, define $\hat{\rho}_{B}$ and $\check{\rho}_{B}$ by

[TABLE]

with $\lambda=2^{-\overline{S}_{\overline{\epsilon}}(B)_{\rho}}$ and $\bar{\rho}_{B}=\mathrm{Tr}_{A}[\bar{\rho}_{AB}]$. It then follows from $\bar{\rho}_{B}\leq\rho_{B}$ and (21) that

[TABLE]

and so for $\check{c}=1-\underline{\epsilon}^{1/2}$,

[TABLE]

Hence,

[TABLE]

Here, on noting that $\check{\rho}_{B}$ commutes with \big{\{}\rho_{B}\geq\lambda\big{\}}, let us introduce the projection $P$ on ${\cal{H}}_{B}\otimes{\cal{H}}_{C}$ defined by

[TABLE]

It can be seen from this definition that

[TABLE]

Moreover, since

[TABLE]

and

[TABLE]

it follows that

[TABLE]

for $r\leq\underline{S}_{\underline{\epsilon}}(AB)_{\rho}-\overline{S}_{\overline{\epsilon}}(B)_{\rho}+\log_{2}\check{c}$. Hence, $P\leq\{\Lambda_{BC}-2^{-r}\rho_{BC}\leq 0\}$ and so

[TABLE]

for

[TABLE]

This completes the proof. ∎

Corollary 7**.**

Let ${\cal{H}}_{A}$ and ${\cal{H}}_{B}$ be Hilbert spaces of finite dimensions $d_{A}$ and $d_{B}$, respectively, and $\rho_{AB}$ be a quantum state on ${\cal{H}}_{A}\otimes{\cal{H}}_{B}$. Then,

[TABLE]

for $\epsilon$ converging to [math] as $n\rightarrow\infty$.

Proof.

It follows from Theorem 6 and Proposition 5 that

[TABLE]

with

[TABLE]

where $\underline{\epsilon}$ and $\overline{\epsilon}$ are given by (20). Now, suppose that $\rho$, $\sigma$ and $\gamma$ satisfy the condition in the definition of $\overline{D}$ or $\underline{D}$. Then

[TABLE]

with $\delta>0$, for sufficiently small $D(\sigma\|\rho)$, where the second inequality follows from Fannes inequality [8] and the third one from quantum Pinsker’s inequality and $\lim_{x\searrow 0}x^{\delta}\log_{2}x=0$ for $\delta>0$. Therefore, we can take

[TABLE]

for $e_{\gamma}$ and $e_{\epsilon}$ such that

[TABLE]

from which the corollary follows. ∎

V Concluding remarks

There have been many works on the quantities characterizing randomness extraction and it has been shown that these quantities have several useful properties and they are equivalent up to additive terms of $O(\log_{2}\epsilon)$ (see e.g. [13, 18]). Hence, $\bar{R}_{\epsilon}$ should also be examined in more detail to clarify its properties and relations to other quantities. Also, it may be of interest to consider further extensions and generalizations of the results (i)–(iii) (see the last paragraph of Section I). For example, $\bar{R}_{\epsilon}$ is defined for fully quantum states, but this work gives its operational meaning only for classical-quantum states; hence it remains to examine its operational meaning for fully quantum states. Moreover, since the collision entropy is a special case of the Rényi-$\alpha$ entropies, it is of interest to consider analogous generalizations of $\bar{R}_{\epsilon}$ and investigate their operational meanings. Furthermore, it may be natural to consider the possibility to extend the result (ii) to other conditional entropies. Regarding the result (iii), it remains to derive an upper bound on $\bar{R}_{\epsilon}$ consistent with the lower bound in Theorem 6. Moreover, since an asymptotic expansion of the maximal length $l^{\epsilon}$ of randomness with an optimal second-order term (for fixed distance $\epsilon$ from uniform) has been derived [18], it may be of interest to examine how close $\frac{1}{n}\bar{R}_{\epsilon}$ is to this optimum, in particular when the classical large deviation theory giving an optimal second-order asymptotics [10] is applied instead of Sanov’s theorem. Finally, since in many applications such as those in cryptography, $\epsilon$ should converge to [math] faster than any polynomial $n^{-c}$ for sufficiently large $n>n_{c}$, it is also of interest to examine the possibility of further improvement in the second-order asymptotics for $\epsilon$ converging sufficiently fast.888We note that the additive term $\log_{2}(1-\underline{\epsilon}^{1/2})$ in the lower bound is not $O(\log_{2}\epsilon)$ but $O(\epsilon)$.

Acknowledgement

The author is grateful to reviewers for their helpful comments.