Reductions to IID in Device-independent Quantum Information Processing

TL;DR

This paper introduces methods to simplify the analysis of device-independent quantum protocols by reducing complex devices to simpler IID models, enabling easier proofs and improved quantitative results.

Contribution

It presents two mathematical reduction techniques to IID in DI quantum information, with applications demonstrating their effectiveness and benefits.

Findings

Reductions to IID simplify the analysis of DI protocols.

The techniques enable tighter quantitative results.

Applications show significant proof simplifications.

Abstract

The field of device-independent (DI) quantum information processing concerns itself with devising and analysing protocols, such as quantum key distribution, without referring to the quality of the physical devices utilised to execute the protocols. Instead, the analysis is based on the observed correlations that arise during a repeated interaction with the devices and, in particular, their ability to violate the so called Bell inequalities. Since the analysis of DI protocols holds irrespectively of the underlying physical device, it implies that any device can be used to execute the protocols: If the apparatus is of poor quality, the users of the protocol will detect it and abort; otherwise, they will accomplish their goal. This strong statement comes at a price-- the analysis of DI protocols is, a priori, extremely challenging. The thesis presents an approach that can be taken to simplify the analysis of DI information processing protocols. The idea is the following: Instead of analysing the most general device leading to the observed correlations, one should first analyse a significantly simpler device that, in each interaction with the user, behaves in an identical way, independently of all other interactions. We call such a device an independently and identically distributed (IID) device. As the next step, special techniques are used to prove that, without loss of generality, the analysis of the IID device implies similar results for the most general device. These are termed reductions to IID. We present two mathematical techniques that can be used as reductions to IID in the DI setting, each accompanied by a showcase-application that exemplifies the reduction's usage and benefits. Performing the analysis via a reduction to IID leads to simpler proofs and significant quantitive improvements, matching the tight results proven when analysing IID devices.

Figures

Tables

Table 1. Table 1.1: Reading suggestion according to the reader’s main interest.

Reader’s interest	Recommended sections
Reductions to IID	All chapters
Parallel repetition	4.1, 5.1, 6.1, 7.1, 7.3.1, 8, 10
Device-independent cryptography	4.2, 5, 6.2, 7.1, 7.2, 7.3.2, 9, 11

Table 2. Table C.1: Parameters used in Chapter  11

Symbol	Meaning
$n\in {\mathbb{N}}_{+}$	Number of rounds
$\gamma \in (0,1]$	Expected fraction of Bell violation estimation rounds
${\omega }_{\exp }\in [0,1]$	Expected winning probability in an honest (perhaps noisy) implementation
${\delta }_{\mathrm{est}}\in (0,1)$	Width of the statistical confidence interval for the Bell violation estimation test
${\epsilon }_{\text{s}}$	Smoothing parameter
${\epsilon }_{EA}^c$	Completeness error of the entropy accumulation protocol
${\epsilon }_{\mathrm{EA}}$	The error probability of the entropy accumulation protocol
${\mathrm{leak}}_{\mathrm{EC}}$	The leakage of the error correction protocol
${\epsilon }_{\mathrm{EC}},{\epsilon }_{\mathrm{EC}}^{\prime }$	Error probabilities of the error correction protocol
${\epsilon }_{\mathrm{EC}}^c$	Completeness error of the error correction protocol
${\epsilon }_{\mathrm{PE}}^c$	Completeness error of the parameter estimation step
${\epsilon }_{\mathrm{PA}}$	Error probability of the privacy amplification protocol
$\ell$	Final key length in the DIQKD protocol
${\epsilon }_{QKD}^c$	Completeness error of the DIQKD protocol
${\epsilon }_{QKD}^s$	Soundness error of the DIQKD protocol

Table 3. Table C.2: Random variables and quantum systems used in Chapter  11

Random variables and systems	Meaning
$X_i\in \{0,1\}$	Alice’s input in round $i\in \left[n\right]$
$Y_i\in \{0,1\}$	Bob’s input in round $i\in \left[n\right]$
$A_i\in \{0,1\}$	Alice’s output in round $i\in \left[n\right]$
$B_i\in \{0,1,⟂\}$, ${\tilde{B}}_i\in \{0,1\}$	Bob’s output in round $i\in \left[n\right]$
$T_i\in \{0,1\}$	Indicator of the estimation test in round $i$:
$W_i\in \{⟂,0,1\}$	Indicator of the correlation in the test rounds:
$E$	Register of Eve’s quantum state
$R_i$	Register of the (unknown) quantum state ${\rho }_{Q_A{Q}_B}^i$ of Alice and Bob’s devices after step $i$ of the protocol, for $i\in \left\{0\right\}\cup \left[n\right]$.

Equations

$$\mathrm{O}_{ABXY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}(\tilde{a}\tilde{b}\tilde{x}\tilde{y})=\frac{\Big{|}\left\{i:(a_{i},b_{i},x_{i},y_{i})=(\tilde{a},\tilde{b},\tilde{x},\tilde{y})\right\}\Big{|}}{n}$$

$${\mathrm{O}}_{AB|XY}^{\text{freq}(\text{mathbold}a,\text{mathbold}b,\text{mathbold}x,\text{mathbold}y)}=\frac{{\mathrm{O}}_{ABXY}^{\text{freq}(\text{mathbold}a,\text{mathbold}b,\text{mathbold}x,\text{mathbold}y)}}{{\mathrm{Q}}_{XY}}.$$

$$\Vert \nabla f{\Vert }_{\infty }=\sup \left\{\frac{\partial }{\partial s_i}f(\text{mathbold}s):\text{mathbold}s\in \mathcal{S},i\in [n]\right\}.$$

$${\mathrm{P}}_X(x)=\sum _y{\mathrm{P}}_{XY}(x,y).$$

$$\forall x,{\mathrm{P}}_{X|Y=y}(x)=\frac{{\mathrm{P}}_{XY}(x,y)}{{\mathrm{P}}_Y(y)}.$$

$$\forall x,{\mathrm{S}}_X(x)=q{\mathrm{P}}_X(x)+(1-q){\mathrm{R}}_X(x).$$

$$\forall \text{mathbold}x,{\mathrm{P}}_X^{\otimes n}(\text{mathbold}x)=\prod _i{\mathrm{P}}_X(x_i),$$

$$\mathrm{Pr}\left[\sum _i{X}_i-n\mathbb{E}[X]\ge tn\right]\le \exp \left(-2n{t}^2\right)$$

$$\Pr\left[\Big{|}\sum_{i}X_{i}-n\mathbb{E}[X]\Big{|}\geq tn\right]\leq 2\exp\left(-2nt^{2}\right)\;.$$

$$\mathrm{O}_{AX}^{\textup{freq}(\mathbold{a},\mathbold{x})}(\tilde{a}\tilde{x})=\frac{\Big{|}\left\{i:(a_{i},x_{i})=(\tilde{a},\tilde{x})\right\}\Big{|}}{n}$$

$${\mathrm{O}}_{A|X}^{\text{freq}(\text{mathbold}a,\text{mathbold}x)}=\frac{{\mathrm{O}}_{AX}^{\text{freq}(\text{mathbold}a,\text{mathbold}x)}}{{\mathrm{Q}}_X}.$$

$$\mathrm{Pr}_{\mathbold{a}\mathbold{x}\sim\mathrm{O}_{AX}^{\otimes n}}\left[\big{|}\mathrm{O}_{A|X}^{\textup{freq}(\mathbold{a},\mathbold{x})}-\mathrm{O}_{A|X}\big{|}_{1}>\epsilon\right]\leq\delta(n,\epsilon)$$

$$\big{|}\mathrm{O}_{A|X}^{\textup{freq}(\mathbold{a},\mathbold{x})}-\mathrm{O}_{A|X}\big{|}_{1}=\sum_{\tilde{x}}\mathrm{Q}_{X}(\tilde{x})\sum_{\tilde{a}}\big{|}\mathrm{O}_{A|X}^{\textup{freq}(\mathbold{a},\mathbold{x})}(\tilde{a}|\tilde{x})-\mathrm{O}_{A|X}(\tilde{a}|\tilde{x})\big{|}\;.$$

$$|\psi ⟩,|\varphi ⟩\in \mathcal{H}\text{and}{\lambda }_1,{\lambda }_2\in \mathbb{C}\to {\lambda }_1|\psi ⟩+{\lambda }_2|\varphi ⟩\in \mathcal{H}$$

$$P_{{\mathcal{H}}^{\prime }}=\sum _{i\in {\mathcal{I}}^{\prime }}|{\varphi }_i⟩⟨{\varphi }_i|.$$

$$\rho ={\rho }^{†};\rho ⪰0;\mathrm{Tr}(\rho )=1.$$

$$\rho =\sum _i{p}_i|{\psi }_i⟩⟨{\psi }_i|.$$

$${\rho }_A$$

$${\rho }_A=\sum _{a\in \mathcal{A}}{\mathrm{P}}_A(a)|a⟩⟨a|,$$

$${\rho }_{AE}=\sum _a{\mathrm{P}}_A(a)|a⟩⟨a|\otimes {\rho }_E^a,$$

$${\rho }_{AE|\Omega }=\frac{1}{\mathrm{Pr}[\Omega ]}\sum _{a\in \Omega }{\mathrm{P}}_{A|\Omega }(a)\otimes {\rho }_E^a,$$

$${\rho }_{AB}=\sum _i{p}_i{\rho }_A^i\otimes {\rho }_B^i$$

$$|{\Phi }^{+}⟩=\frac{1}{\sqrt{2}}\left(|00⟩+|11⟩\right),|{\Phi }^{-}⟩=\frac{1}{\sqrt{2}}\left(|00⟩-|11⟩\right),$$

$$|{\Psi }^{+}⟩=\frac{1}{\sqrt{2}}\left(|01⟩+|10⟩\right),|{\Psi }^{-}⟩=\frac{1}{\sqrt{2}}\left(|01⟩-|10⟩\right).$$

$$\mathrm{Pr}(i)=\mathrm{Tr}(K_i\rho K_i^{†}).$$

$${\rho }_i=\frac{K_i\rho K_i^{†}}{\mathrm{Tr}(K_i\rho K_i^{†})}.$$

$$\mathrm{Pr}(i)=\mathrm{Tr}(M_i\rho ).$$

$$\text{leavevmode}{\sigma }_x=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right);{\sigma }_y=\left(\begin{array}{cc}0& -i\\ i& 0\end{array}\right);{\sigma }_z=\left(\begin{array}{cc}1& 0\\ 0& 1\end{array}\right).$$

$$(\mathcal{E}\otimes {\mathbb{I}}_R)({\rho }_{AR})⪰0,$$

$$\mathrm{Pr}[\text{correct guess}]=\frac{1}{2}\left(1+\frac{1}{2}\Vert \rho -\tau {\Vert }_1\right)=\frac{1}{2}+\Delta (\rho ,\tau ).$$

$$\Delta (\rho ,\tau )=\frac{1}{2}\Vert \rho -\tau {\Vert }_1+\frac{1}{2}|\mathrm{Tr}(\rho -\tau )|.$$

Full text

The field of device-independent quantum information processing concerns itself with devising and analysing protocols, such as quantum key distribution and quantum tomography, without referring to the quality of the physical devices utilised to execute the protocols. Instead, the analysis is based on the observed correlations that arise during a repeated interaction with the devices and, in particular, their ability to violate the so called Bell inequalities.

Since the analysis of device-independent protocols holds irrespectively of the underlying physical device, it implies that any device can be used to execute the protocols: If the apparatus is of poor quality, the users of the protocol will detect it and abort; otherwise, they will accomplish their goal. This strong statement comes at a price — the analysis of device-independent protocols is, a priori, extremely challenging. Having good techniques at hand is thus crucial.

The thesis presents an approach that can be taken to simplify the analysis of device-independent information processing protocols. The idea is the following: Instead of analysing the most general device leading to the observed correlations, one should first analyse a significantly simpler device that, in each interaction with the user, behaves in an identical way, independently of all other interactions. We call such a device an independently and identically distributed (IID) device. As the next step, special techniques are used to prove that, without loss of generality, the analysis of the IID device implies similar results for the most general device. Such techniques reduce the problem of analysing the general scenario to that of analysing an IID one and, hence, we term them reductions to IID.

We present two mathematical techniques that can be used as reductions to IID in the device-independent setting: de Finetti reductions for correlations and the entropy accumulation theorem. Each technique is accompanied by a showcase-application that exemplifies the reduction’s usage and benefits. Specifically, we use our de Finetti reduction to prove a non-signalling (super-quantum) parallel repetition theorem, belonging to a family of theorems discussed in theoretical computer science. The entropy accumulation theorem is used to prove the security of device-independent quantum cryptographic protocols.

Performing the analysis via a reduction to IID instead of directly analysing the most general scenarios leads to simpler proofs and significant quantitive improvements, matching the tight results proven when analysing IID devices. In particular, our analysis of device-independent quantum key distribution protocols produces essentially optimal key rates and noise tolerance, crucial for all future experimental implementations of device-independent cryptography.

Die geräteunabhängige Quanteninformationsverarbeitung beschäftigt sich mit der Entwicklung und Analyse von Protokollen, wie z.B. dem Quantenschlüsselaustausch oder der Quantentomographie, welche unabhängig von der Qualität der eingesetzten physikalischen Geräte ist. Stattdessen basiert die Analyse auf beobachteten Korrelationen, die durch wiederholte Wechselwirkung mit den Geräten entstehen, insbesondere ihrer Fähigkeit Bellsche Ungleichungen zu verletzen.

Da die Analyse geräteunabhängiger Protokolle unabhängig von den eingesetzten Geräten ist, können beliebige Geräte benutzt werden um die Protokolle auszuführen: Weist das genutzte Gerät eine schlechte Qualität auf, detektiert das Protokoll dies und bricht ab. Ansonsten wird das Protokoll erfolgreich sein. Diese starke Aussage hat jedoch ihren Preis: die Analyse geräteunabhängiger Protokolle ist extrem herausfordernd. Deswegen sind gute Methoden für deren Analyse essentiell.

Diese Dissertation stellt eine Herangehensweise zur Vereinfachung der Analyse geräteunabhängiger Protokolle vor, basierend auf folgender Idee: Statt die allgemeinsten Geräte zu analysieren, welche zu den beobachteten Korrelationen führen, wird zunächst ein deutlich einfacheres Gerät analysiert, das sich in jeder Wechselwirkung mit dem Benutzer identisch verhält, unabhängig von allen anderen Wechselwirkungen. Wir nennen solch ein Gerät ein identisch und unabhängig verteiltes (IID) Gerät. Dann werden spezielle mathematische Methoden benutzt um zu zeigen, dass diese einfachere Analyse ähnliche Ergebnisse wie die Analyse der allgemeinsten Geräte liefert. Solche Methoden reduzieren die Analyse des allgemeinen Problems auf die des IID-Problems. Daher bezeichnen wir sie als Reduktionen auf das IID-Problem.

Wir präsentieren zwei Reduktionen auf das IID-Problem: de Finetti Reduktionen für Korrelationen sowie den Entropieanhäufungssatz. Beide Methoden werden durch Beispielanwendungen illustriert. Spezifisch benutzen wir die de Finetti Reduktion um einen sogenannten*“non-signalling parallel repetition”*-Satz zu beweisen, welcher zu einer Familie von Sätzen gehört, die in der theoretischen Informatik diskutiert werden. Der Entropieanhäufungssatz wird benutzt um die Sicherheit von geräteunabhängigen Quantenkryptografieprotokollen zu beweisen.

Indem man die Analyse durch Reduktionen auf den IID Fall durchführt, anstelle einer Analyse der allgemeinsten Szenarien, erhält man einfachere Beweise und signifikante quantitative Verbesserungen, welche mit den strengen Resultaten für IID Geräte übereinstimmen. Insbesondere führt unsere Analyse von geräteunabhängigen Protokollen für Quantenschlüsselaustausch zu annähernd optimalen Schlüsselraten und Fehlertoleranzen, welche essentiell für alle zukünftigen experimentellen Implementierungen von geräteunabhängiger Kryptographie sind.

{dedication}

To Neer, Avishai, and Omri

1. 1 Introduction

2. 1.1 Motivation

3. 1.1.1 Device-independent information processing

4. 1.1.2 Reductions to IID

5. 1.2 Content of the thesis

6. 1.2.1 Reductions

7. 1.2.2 Showcases

8. 1.3 How to read the thesis

9. 2 Preliminaries: basics and notation

10. 2.1 General notation

11. 2.2 Probability distributions and random variables

12. 2.2.1 Independent and identical random variables

13. 2.2.2 Concentration inequalities

14. 2.3 Quantum formalism

15. 2.3.1 Operators

16. 2.3.2 Hilbert spaces

17. 2.3.3 Quantum states

18. 2.3.4 Quantum operations

19. 2.4 Distance measures

20. 2.5 Entropies

21. 2.5.1 Shannon and von Neumann Entropy

22. 2.5.2 Min- and max-entropies

23. 3 Preliminaries: device-independent concepts

24. 3.1 Black boxes

25. 3.1.1 Non-signalling boxes

26. 3.1.2 Quantum boxes

27. 3.1.3 Classical boxes

28. 3.1.4 Correlations’ space

29. 3.2 Bell inequalities

30. 3.2.1 Non-local games

31. 3.2.2 The CHSH game

32. 3.3 Untrusted devices

33. 4 Introduction to the showcases

34. 4.1 Introduction to non-signalling parallel repetition

35. 4.1.1 Parallel repeated games

36. 4.1.2 Threshold theorems

37. 4.2 Introduction to device-independent quantum cryptography

38. 4.2.1 DIQKD security definitions

39. 4.2.2 DIQKD protocol

40. 4.2.3 Main task of a security proof

41. 4.2.4 The honest implementation

42. 4.2.5 Model of an arbitrary device

43. 5 Single-round box

44. 5.1 The model

45. 5.2 Showcase: device-independent quantum cryptography

46. 6 Multi-round box

47. 6.1 Parallel interaction

48. 6.2 Sequential interaction

49. 6.2.1 Without communication between the rounds

50. 6.2.2 With communication between the rounds

51. 7 Working under the IID assumption

52. 7.1 The IID assumption

53. 7.2 Asymptotic equipartition property

54. 7.2.1 Classical asymptotic equipartition property

55. 7.2.2 Quantum asymptotic equipartition property

56. 7.3 Using the IID assumption

57. 7.3.1 Showcase: non-signalling parallel repetition

58. 7.3.2 Showcase: device-independent quantum cryptography

59. 7.4 Beyond IID

60. 8 Reductions to IID: parallel interaction

61. 8.1 Permutation invariance

62. 8.2 de Finetti reductions for correlations

63. 8.3 Ways of using the reductions

64. 8.3.1 Post-selecting permutation invariant boxes

65. 8.3.2 Failure probability of a test

66. 8.3.3 Diamond norm

67. 8.4 Impossibility results

68. 9 Reductions to IID: sequential interaction

69. 9.1 Sequential quantum processes

70. 9.2 Entropy accumulation theorem

71. 9.2.1 Conceptual difficulties to overcome

72. 9.2.2 Prerequisites of the theorem

73. 9.2.3 Statement of the theorem

74. 10 Showcase: non-signalling parallel repetition

75. 10.1 Main challenge and goal

76. 10.2 Approximately non-signalling marginals

77. 10.2.1 Single-round boxes from frequencies

78. 10.2.2 Signalling test

79. 10.2.3 Guessing game

80. 10.3 Threshold theorem

81. 10.3.1 Winning probability of approximately non-signalling strategies

82. 10.3.2 Final result

83. 10.4 Open questions

84. 11 Showcase: device-independent quantum cryptography

85. 11.1 Main challenge and goal

86. 11.2 Device-independent entropy accumulation

87. 11.2.1 EAT channels

88. 11.2.2 Min-tradeoff function

89. 11.2.3 Smooth min-entropy rate

90. 11.3 Device-independent quantum key distribution

91. 11.3.1 Completeness

92. 11.3.2 Soundness

93. 11.3.3 Key rate analysis

94. 11.4 Open questions

95. 12 Outlook

96. A Additional proofs: de Finetti reductions

97. A.1 Bounding the de Finetti box

98. A.2 Diamond norm reduction

99. B Additional proofs: non-signalling parallel repetition

100. B.1 Signalling measure and test

101. B.2 Sensitivity analysis

102. C Additional proofs: device-independent quantum cryptography

103. C.1 Single-round statement

104. C.2 An improved dependency on the test probability

105. C.2.1 Modified entropy accumulation protocol

106. C.2.2 Modified min-tradeoff function

107. C.2.3 Modified entropy rate

108. C.2.4 Modified key rate

109. C.3 Summary of parameters and variables

\startnumbering

Chapter 1 Introduction

1.1 Motivation

1.1.1 Device-independent information processing

The study of quantum information unveils new possibilities for remarkable forms of computation, communication, and cryptography by investigating different ways of manipulating quantum states. Crucially, the analysis of quantum information processing tasks must be based, in one way or another, on the actual physical processes used to implement the considered task; the physical processes must be inherently quantum as otherwise no advantage can be gained compared to classical information processing. In most applications, the starting point of the analysis is an explicit and exact characterisation of the quantum apparatus, or device, used to implement the task of interest.

As an example, consider the task of quantum key distribution (QKD). In a QKD protocol, the goal of the honest parties, called Alice and Bob, is to create a shared key, unknown to everybody else but them. The protocol is intrinsically quantum: To execute it Alice and Bob hold entangled quantum states in their laboratories and perform quantum operations, or measurements, on the quantum states. Informally, proving the security of a QKD protocol amounts to showing that no adversary can hold (significant) information about the produced key. To prove security one usually needs to have a complete description of the quantum devices, i.e., the quantum states and measurements, used by Alice and Bob. For example, the security proof of the celebrated BB84 protocol [Bennett and Brassard, 1984] builds on the assumptions that Alice and Bob hold two-qubit states and are able to measure them in a specific way. When these assumptions are dropped, the protocol is no longer secure [Pironio et al., 2009]. Thus, if Alice and Bob wish to use their quantum devices in order to implement a QKD protocol they need to first make sure that the device is performing the exact operations described by the protocol.

Unfortunately, in practice we are unable to fully characterise the physical devices used in quantum information processing tasks. Even the most skilled experimentalist will recognise that a fully characterised, always stable, large-scale quantum device that implements a QKD protocol is extremely hard to build. If the honest users’ device is different from the device analysed in the accompanying security proof, security is no longer guaranteed and imperfections can be exploited to attack the protocol.

Noise and imperfections cannot be completely avoided when implementing quantum information processing tasks. Furthermore, imperfections being imperfections, one also cannot expect to perfectly characterise them. That is, we cannot say for sure what exactly is about to go wrong in the quantum devices: Maybe the measurements are not well-calibrated, perhaps some noise introduces correlations between particles which are intended to be independent, or interaction with the environment may possibly lead to decoherence. Even the advent of fault-tolerant computation, if achievable one day, cannot resolve all types of errors if no promise is given regarding the number of errors and their, possibly adversarial, nature. Once we come to terms with the above, a natural question arises:

Can quantum information processing tasks be accomplished by utilising uncharacterised, perhaps even adversarial, physical devices?

An adversarial, or malicious, device is one implemented by a hostile party interested in, e.g., breaking the cryptographic protocol being executed. Clearly, this is an extreme scenario to consider. Note, however, that even if the manufacturer of the device is to be trusted, he may still be incompetent — the physical apparatus will be subject to uncharacterised imperfections even though the manufacturer is honest and has good intentions.

The field of device-independent information processing addresses the above question. In the device-independent framework we treat the physical devices, on which a minimal set of constraints is enforced,111Clearly, one cannot perform any cryptographic task if the device includes a transmitter that just sends all the information to the adversary. Few minimal assumptions regarding the device will be needed; see Section 3.3. Depending on the considered task, some of the assumptions can be enforced in practice while others may require some minimal level of trust. as black boxes — Alice and Bob hold a box and can interact with it classically (as explained below) to execute the considered protocol, but they cannot open it to assess its internal workings.222Notice that even if Alice and Bob did have some information about the physical apparatus, the device-independent framework does not allow them to take advantage of this information in the analysis. For example, Alice and Bob may be able to distinguish a device that uses the polarisation of a photon to encode a qubit from one based on superconducting qubits (even the author is able to do that). Yet, this information is not to be used when treating the device as a black box. They have no knowledge regarding the physical apparatus and do not trust that it works as alleged by the manufacturer of the device.

What can Alice and Bob do with the black box? They can interact with it by pushing buttons, each associated with some classical input (e.g., a bit) and record the classical outputs produced by the box in response to pressing its buttons. Thus, the only information available to Alice and Bob is the observed classical data created during their interaction with the black box. (Hence the name “device-independent”).

Since the device is not to be trusted, the classical information collected by Alice and Bob during the interaction with the box must allow them, somehow, to test the possibly faulty or malicious device and decide whether using it, e.g., to create their keys by executing a QKD protocol, poses any security risk. A protocol or task is said to be device-independent if it guarantees that by interacting with the device according to the specified steps the parties will either abort, if they detect a fault, or accomplish the desired task (with high probability).

The possibility of device-independent information processing is quite surprising. Indeed, restricting ourselves to classical physics and classical information, it is impossible to derive device-independent statements.333Consider for example the case of device-independent QKD. Classical devices can always be pre-programmed by the adversary to output a fixed key of her choice. The most important ingredients for device-independent protocols are the existence of Bell inequalities and quantum “non-local” correlations that violate them [Bell, 1964]. These two facts are far from trivial and play a fundamental role in quantum theory. In the context of device-independent information processing, a Bell inequality acts as a “test for quantumness” that allows the users of the device to verify that their device is “doing something quantum” and cannot be simulated by classical means. This “quantumness”, of a specific form discussed below, is what allows us to, e.g., prove security of a QKD protocol.

A Bell inequality can be thought of as a multi-player game, also called a non-local game, played by the parties using the device they share. A non-local game goes as follows. A referee asks each of the (cooperating) parties a question chosen according to a given probability distribution. The parties need to supply answers which fulfil a pre-determined requirement according to which the referee accepts or rejects the answers. In order to do so, they can agree on a strategy beforehand, but once the game begins communication between the parties is not allowed. If the referee accepts their answers the players win. The goal of the parties is, naturally, to maximise their winning probability in the game.

Different devices held by the parties implement different strategies for the game and may lead to different winning probabilities. In the device-independent setting we are interested in games that have a special “feature” — there exists a quantum device which achieves a winning probability in the game that is greater than all classical, local, devices. If the honest parties learn, by interacting with the device, that their device can win the game with probability higher than that of all classical devices, they conclude it cannot be explained by classical physics alone.444We postpone the formal and more technical discussion to a later point; an enthusiastic reader may jump ahead to Section 3.2.

Crucially, the winning probability in the game does not merely indicate that the device is doing something quantum but how non-classical it is. Relations are known between the probability of winning some non-local games and various other quantities. Some examples for quantities of interest are the entropy produced by the device, the amount of entanglement consumed to play the game, or the distance (under an appropriate distance measure) of the device from a specific fully characterised quantum device. Such relations lie at the heart of any analysis of device-independent information processing tasks.

Although above we only mentioned device-independent QKD as an example for a device-independent task, the framework of device-independence does not only concern the more-than-average paranoid cryptographers. The framework fits any scenario in which, a priori, we do not want to assume anything about the utilised devices and their underlying physical nature. To reassure the reader, we give three additional examples.

Bell inequalities were originally introduced in the context of the foundations of quantum mechanics in order to resolve the EPR paradox [Einstein et al., 1935]. When trying to test quantum theory against an alternative classical world that admits a “local hidden variable model” (or, in other words, falsify all classical explanations of a behaviour of a physical system), one cannot assume that quantum theory holds to begin with and must treat the device as a black box without assuming to know its internal workings.

A second example is that of blind tomography, also termed self-testing. Assume a quantum state is being produced in some experimental setting. Quantum tomography is the process of estimating which state is being created by performing measurements on copies of the state and collecting the statistics [Paris and Řeháček, 2004]. To get a meaningful estimation, a certain set of measurements needs to be used, depending on the dimension of the state. In other words, in order to estimate and characterise the quantum state, we must be able to first characterise the measurement devices. Blind quantum tomography refers to the process in which the measurements are also unknown. In such a case, nothing but the observed statistics can be used [Mayers and Yao, 1998, Bancal et al., 2015].

Another interesting example is that of verification of computation — given a device claimed to be a quantum computer, how can human beings, who cannot perform quantum computations by themselves, verify that this is indeed the case? There are different ways of addressing this question, but in all cases we would like to make statements without presuming that the considered devices are performing any particular quantum operations (see, e.g., [Reichardt et al., 2013]).

The device-independent framework becomes relevant whenever one wishes to make concrete statements without referring to the underlying physical nature of the utilised devices and the types of imperfections or errors that may occur. The derived statements are extremely strong. Device-independent security, for example, is regarded as the gold standard for quantum cryptography, since attacks exploiting the mismatch between security proof and implementation are no longer an issue. Making such strong statements comes at a price. The analysis of device-independent tasks is, a priori, extremely challenging: We treat the devices as black boxes and thus the proofs need to account for an almost arbitrary, even adversarial, behaviour of the devices. Having good techniques for the analysis at hand is therefore crucial. This is further discussed in the following section.

1.1.2 Reductions to IID

In the device-independent setting one does not have a description of the specific device used in the considered task and, hence, must analyse the behaviour of arbitrary devices. For example, when proving security of cryptographic protocols we clearly need to consider any possible device that the adversary may prepare. Unfortunately, analysing the behaviour of arbitrary devices can be wearying at best and infeasible at worst. Let us start by explaining why this is the case.

As mentioned above, the ability to achieve device-independent information processing tasks is based on the existence of non-local games and quantum strategies to play them that can beat any classical strategy. To perform complex tasks, such as device-independent cryptography, employing the device to play a single non-local game is clearly not enough; we cannot conclude any meaningful information regarding the device by asking it to produce outputs only for a single game. To put quantum information to work we must consider protocols in which the device is used to play many non-local games. This way, the parties executing the protocol can collect statistics and test their device. If the device does not pass the test the parties abort the protocol (see Protocol 1.1 below for an example).

The reason for the difficulty of the analysis lies in the fact that one needs to examine the overall behaviour of the device during the entire execution of the protocol, consisting of playing many games with the device, instead of its behaviour in a single game. As the device is uncharacterised its actions when playing one game may depend on other games.

In general, there are two families of devices able to play many games that one can consider — parallel and sequential devices. A parallel device is one which can be used to play all the games at once. That is, the parties executing the protocol are instructed to give all the inputs, for all the games, to the device and only then the device produces the outputs for all the games. In such a case, the actions of the device in one game may depend on all other games.

A sequential device, on the other hand, is used to play the games one after the other, i.e., the parties give the device the first inputs and wait for its outputs and only then proceed to play the next game. In between the games, some communication may be allowed between the parties and the different components of the device. In the case of a sequential device, the behaviour of the device in one game may depend on all previous games as well as communication taking place during the time between the games.555The formal definitions of parallel and sequential devices are given in Chapter 6. In both cases, the input-output behaviour of the devices gets quite complicated.

One common assumption introduced to simplify the analysis of device-independent information processing tasks is the so called “independent and identically distributed” (IID) assumption. As the name suggests, a device is said to be an IID device if it plays each of the games independently of the others and utilises the same strategy for all games. An IID device is a special case of both parallel and sequential devices and, since it is highly structured, analysing its behaviour can be significantly simpler than analysing the more general devices; see Figure 1.1.

The IID assumption heavily restricts the structure of the device. It is therefore not clear at all that analysing device-independent information processing tasks under the IID assumption is sufficient. Returning to the example of device-independent cryptography, an adversary who can prepare arbitrary devices (let it be sequential or parallel) may be strictly stronger, i.e., can get more information about the outputs of the honest parties, than an adversary restricted to IID devices. Thus, simplifying the analysis by using the IID assumption comes at the cost of weakening the final statement.

The main question addressed in this thesis is the following:

Can the analysis of device-independent information processing tasks be reduced to that performed under the IID assumption?

The term reduction is widely used in theoretical computer science and is meant to describe the process of showing that one problem is as hard/easy as another. In our case, we ask whether analysing general devices is as easy as analysing IID devices or, in other words, does an analysis performed under the IID assumption imply results concerning general devices (i.e., statements which are not restricted to the IID case). A priori, it is not at all obvious that this is the case; clearly, not all devices are IID devices. A positive answer to the above question means that even though there exist devices that cannot be described as IID ones, it is sometimes possible to restrict the attention solely to IID devices and the rest will follow.

The idea of applying a reduction to IID as a proof technique was conceived666Perhaps surprisingly, as far as the author is aware the idea of a “reduction to IID” does not appear or used in classical information processing and cryptography. in [Christandl et al., 2007], following which a concrete reduction relevant for applications was developed in [Renner, 2008] and used to reduce the security proof of QKD protocols to that done under the IID assumption.777In the context of QKD, security under the IID assumption is called security against collective attacks. As such, [Renner, 2008] acts as the first example for a proof using a reduction to IID.

Analysing information processing tasks via a reduction to IID has several significant advantages. Analysing IID devices is relatively easy and almost always intuitive. Thus, having tools that allow us to extend the analysis to the general case greatly simplifies proofs.888The reductions themselves are not necessarily simple, but that is fine. They are technical tools that are only proved once and can then be used to simplify many other proofs. The researcher using the reduction does not need to reprove anything. The simplicity, in turn, allows for clear and modular statements as well as quantitively strong results.999This is in agreement with Occam’s razor; while there is no notion of the “right proof” out of several possible proofs (assuming they are all mathematically correct), the simplest proof usually turns out to be the most useful and insightful one.

The importance of quantitively strong results is obvious, especially when discussing quantum information processing tasks: If we wish to benefit from the new possibilities brought by the study of quantum information, we must be able to implement the protocols in practice. Without strong quantitive bounds on, e.g., key rates and tolerable noise levels, we cannot take the device-independent field from theory to practice. Clarity and modularity should also not be dismissed. Science is not a “one-man’s job”; clarity and modularity are crucial when advancing science as a community. Indeed, complex and fine-tuned proofs are hard to verify, adapt to other cases of interest, and quantitively improve.

Another advantage of reducing a general analysis to IID is that it allows us to separate the wheat from the chaff. The essence of the arguments used in proofs of information processing tasks almost always enter the game in the analysis of the IID case. Proofs that address the most general scenarios directly (i.e., not via a reduction to IID) are at risk of obscuring the “physics” by more technical mathematical steps. When using a reduction to IID this is (mostly) not the case — the essence, or the interesting part, lies in the analysis of IID devices while the technicalities are pushed into the reduction itself.

With the above advantages, the development and application of reductions to IID flourished in quantum information processing. Yet, the benefits did not reach the subfield of device-independent quantum information processing. The reason was clear — all the techniques used as reductions to IID had to make assumptions regarding the investigated system, which are too restrictive when studying uncharacterised devices.

As we will show in the thesis, reductions to IID can also be developed and employed in device-independent quantum information processing. We present two techniques that can be used as reductions to IID, accompanied by two showcase-applications that illustrate how the reductions can be used and their benefits in terms of the derived theorems. The following section presents the content of the thesis in more detail.

1.2 Content of the thesis

The goal of the thesis is to explain how reductions to IID can be performed in the context of device-independent information processing. To this end, after explaining the different mathematical objects that one needs to consider and their relevance, we discuss the IID assumption and its implications in the device-independent setting. We then present two techniques, or tools, that can be used as reductions to IID in the analysis of device-independent information processing tasks, one relevant for parallel devices and the other for sequential ones.

To better comprehend the topic and exemplify the usage of the two reductions, we consider two applications as showcases, namely, parallel repetition of non-local games and device-independent cryptography. These are studied in detail throughout the chapters of the thesis, while taking the perspective of reductions to IID.

1.2.1 Reductions

Two types of reductions are presented. The reductions are applicable in different scenarios and give statements of different forms; see Figure 1.2.

de Finetti reduction for correlations

The first reduction, the topic of Chapter 8, is called “de Finetti reduction for correlations” and was developed in [Arnon-Friedman and Renner, 2015]. The de Finetti reduction is relevant for the analysis of permutation invariant parallel devices. Permutation invariance is an inherent symmetry in many information processing tasks, device-independent tasks among them. Thus, analysing permutation invariant devices is of special interest.

In short, in our context, a de Finetti reduction is a theorem that relates any permutation invariant parallel device to a special type of device, termed de Finetti device, which behaves as a convex combination of IID devices (see Chapter 8 for the formal definitions). The given relation acts as a reduction to IID when considering tasks admitting a permutation invariance symmetry and in which a parallel device needs to be analysed. Our showcase of parallel repetition of non-local games fits this description and thus can benefit from our de Finetti reduction.

Various quantum de Finetti theorems were know prior to our work and were successfully used to substantially simplify the analysis of many quantum information tasks. However, they cannot be applied in the device-independent setting, since they make many assumptions regarding the permutation invariant quantum states being analysed and therefore cannot accommodate uncharacterised devices. The unique property of the reduction presented in Chapter 8 is that, apart from permutation invariance, it makes no assumptions whatsoever regarding the systems of interest and is therefore applicable in the analysis of device-independent information processing.

For pedagogical reasons, we choose to present in the thesis a de Finetti reduction which is relevant to the case of bipartite devices, i.e., devices which are shared between two parties, Alice and Bob. The statements can be extended to any number of parties, as shown in [Arnon-Friedman and Renner, 2015]; the proofs of the general case do not include fundamental insights on top of those used in the bipartite case but require somewhat heavy notation. We therefore omit the more general theorems and proofs (while supplying the full analysis of the bipartite case in Chapter 8), with the hope of making the content more inviting for readers unfamiliar with the topic.

Apart from presenting the reduction and the possible ways of using it, Chapter 8 also includes a discussion of ways in which it may be possible to extend or modify the reduction (to be more specific, we mainly present impossibility results). This content does not appear in detail in other published papers and can be relevant for future studies of the topic.

Entropy accumulation theorem

The second reduction to IID that can be used in the device-independent setting is the entropy accumulation theorem (EAT) [Dupuis et al., 2016] and is the topic of Chapter 9. The EAT can be seen as an extension of the entropic formulation of the asymptotic equipartition property (AEP) [Holenstein and Renner, 2011, Tomamichel et al., 2009], applicable only under the IID assumption, to more general sequential processes.

The AEP, presented in Chapter 7, basically asserts that when considering IID random variables, the smooth min- and max-entropies of the random variables converge to their von Neumann (or Shannon, in the classical case) entropy, as the number of copies of the random variable increases. The AEP is of great importance when analysing, both classical and quantum, information processing tasks under the IID assumption: It explains why the von Neumann entropy is so important in information theory — the smooth entropies, which describe operational tasks, converge to the von Neumann entropy when considering a large number of independent repetitions of the relevant task.101010A commonly used example is that of “data compression”. There, one would like to encode an $n$ bit string using less bits. If we allow for some small error when decoding the data, the smooth max-entropy roughly describes the number of bits needed. However, for a large enough number of independent repetitions, less bits suffice and the exact amount is governed by the Shannon entropy.

Moving on from the IID setting, the EAT considers a certain class of quantum sequential processes. That is, in our context, it is relevant when studying sequential devices.111111To be more precise, some requirements regarding the process, or protocol, in which the sequential device is to be used must hold. This is explained in details in Chapter 9. Similarly to the AEP, when applicable, the EAT allows one to bound the total amount of the smooth min- and max-entropies using the same bound on the von Neumann entropy calculated for the IID analysis, i.e., the one used when applying the AEP. In this sense, the EAT can be seen as a reduction to IID — with the aid of the EAT the analysis done under the IID assumption using the AEP can be extended to the one relevant for sequential devices.

The proof of the EAT is not presented in the thesis (and should not be attributed to the author). We focus on motivating, presenting, and explaining the EAT in the form relevant for device-independent quantum information processing [Arnon-Friedman et al., 2018] (as well as quantum cryptography in general), so it can be later used in our showcase of device-independent cryptography. The pedagogical presentation of the EAT given in Chapter 9 does not appear in full in any other published material and we hope that it will make the theorem more broadly accessible.

Before presenting our showcases, let us remark that both of the reductions mentioned above are not “black box” reductions, in the sense that one cannot simply say that if a problem is solved under the IID assumption then it is solved in the general case. In particular, one should be familiar with the exact statements of the reductions (though not with their proofs) as well as the analysis of the considered task under the IID assumption in order to apply the reductions (or even just check whether they are applicable or not). When discussing the reductions in Chapters 8 and 9, we explicitly explain in what sense the presented tools count as reductions to IID techniques.

1.2.2 Showcases

We use two showcases throughout the thesis in order to exemplify the approach of reductions to IID and the more technical usage of the presented reductions. The showcase of parallel repetition of non-local games uses the de Finetti reduction technique while the showcase of device-independent cryptography builds on the EAT. As mentioned in Section 1.1.2 above, we believe that analysing device-independent tasks using a reduction to IID has its benefits. The derived theorems are, arguably, more intuitive and insightful and, in addition, give strong quantitive results.

We shortly discuss below each of our showcases. We present informal theorems describing the results proven for the showcases. The informal theorems shed light on the fundamental nature and strength of the approach of reductions to IID.

Non-signalling parallel repetition

Our first showcase is that of non-signalling parallel repetition. Chapter 10 presents our formal statements and proofs, which previously appeared in [Arnon-Friedman et al., 2016b]. As before, we focus in the thesis on the bipartite case for pedagogical reasons; [Arnon-Friedman et al., 2016b] includes the general analysis, which is valid for any number of parties playing the game.

Non-local games, as mentioned in Section 1.1.1, are games played by several cooperating parties, also called players. A referee asks each of the players a question chosen according to a given probability distribution. The players need to supply answers which fulfil a pre-determined requirement according to which the referee accepts or rejects the answers. In order to do so, they can agree on a strategy beforehand, but once the game begins communication between the parties is no longer allowed. If the referee accepts their answers the players win.

In the language used so far, we can think of a device as implementing a strategy for the game. Depending on the field of interest, one can consider classical, quantum, or non-signalling devices, the latter referring to devices on which the only restriction is that they do not allow the players to communicate. We focus below on the case of non-signalling strategies, or devices.

One of the most interesting questions regarding non-local games is the question of parallel repetition. Given a non-local game with optimal winning probability $1-\alpha$ using non-signalling strategies, we are interested in analysing the optimal winning probability of a non-signalling strategy in the repeated, or threshold, game. A threshold game is a game in which the referee asks the players to play $n\in\mathbb{N}$ instances of the non-local game, all at once, and the players’ goal is to win more than $1-\alpha+\beta$ fraction of the games, for $\beta>0$ a parameter of the threshold game. The parallel repetition question concerns itself with upper-bounding the optimal winning probability in the threshold game, as the number of games $n$ increases.121212This is actually a generalisation of the more commonly known parallel repetition question, in which one wishes to upper-bound the probability of winning all the $n$ games.

One trivial strategy that the players can use in the threshold game is a strategy employing a non-signalling IID device. That is, they simply answer each of the $n$ questions independently using the optimal non-signalling device used to play a single game. Using an IID device, the fraction of successful answers is highly concentrated around $1-\alpha$ and the probability to win more than a $1-\alpha+\beta$ fraction of the games decreases exponentially fast with $n\beta^{2}$, as follows from the optimal formulation of the Chernoff bound.

However, since the players receive from the referee all the questions to the $n$ instances of the non-local game at once, an IID device is not the most general device that they can use. Instead, they can use any non-signalling parallel device to implement their strategy. As parallel devices are strictly more general than IID ones, using parallel devices in fact allows them to win the threshold game with higher probability than in the IID case.131313When first encountering the question of parallel repetition it may seem surprising that the players can do better using a parallel device, but this is indeed the case; see Section 4.1.2 a concrete example. Still, one may ask how the winning probability behaves for a sufficiently large number of repetitions $n$ and, especially, whether it decreases in a similar fashion as for IID strategies.

To answer the above question, we wish to reduce the study of strategies employing parallel devices to those using IID devices. A crucial observation that allows us to do so is that the threshold game itself admits a permutation invariance symmetry (i.e., the order of questions-answers tuples does not matter; see Chapter 10 for the details) and, therefore, we can assume without loss of generality that the optimal strategy is also permutation invariant. Now that we can restrict our attention to permutation invariant parallel devices, de Finetti reductions become handy and can be used as a tool for reduction to IID.

In Chapter 10 we consider the case of non-signalling strategies for complete-support games. A complete-support game is one in which all possible combinations of questions being sent to the players have some non-zero probability of being asked by the referee. We prove the following via a reduction to IID:

Theorem 1.1** (Informal).**

Given a game with optimal non-signalling winning probability $1-\alpha$, for any $\beta>0$, the probability to win more than a fraction $1-\alpha+\beta$ of $n$ games played in parallel using a non-signalling strategy is exponentially small in $n\beta^{2}$, as in the IID case.

Perhaps surprisingly, while the parallel repetition question is a well-investigated one, an exponential decrease that matches the IID case, as far as we are aware, was not known prior to our work (also not for classical or quantum strategies). In the context of reductions to IID, however, achieving the same behaviour as in the IID case is not unexpected.

To prove Theorem 1.1 we first prove another statement that has a “reduction to IID flavour” and is perhaps of more fundamental nature. To present it, however, we need to first set some notation.141414We are jumping ahead now with the aim of being able to explain Theorem 1.2 to readers who are already somewhat familiar with device-independent information processing and non-signalling systems. For a reader unfamiliar with these topics, the mathematical statements may seem puzzling without further explanations. We will get back to the discussed theorem in Chapter 10, after giving all the preparatory information throughout the thesis. A reader unfamiliar with the used terminology can therefore skip the current discussion without the risk of missing out.

As mentioned above, we focus on two-player games, i.e., games played by Alice and Bob (and the referee). A parallel device used for the threshold game can be described using a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, where $\mathbold{A}=A_{1},\dots,A_{n}$ is the random variable describing Alice’s answers in the threshold game ($A_{i}$ being her answer in the $i$’th game) and, similarly, $\mathbold{B}=B_{1},\dots,B_{n}$ describes Bob’s answers, and $\mathbold{X}=X_{1},\dots,X_{n}$ and $\mathbold{Y}=Y_{1},\dots,Y_{n}$ are Alice’s and Bob’s questions, respectively.

When we say that a parallel device is non-signalling, we mean that it cannot be used as means of communication between the parties. The behaviour of the device in one game, however, may depend on the other games.151515In other words, the local strategy of each player does require “communication between the games”: In order to (locally) answer the $i$’th question received from the referee, the player needs to know his $j$’th question (with $i\neq j$). Mathematically, this means that, while the marginals $\mathrm{P}_{\mathbold{A}|\mathbold{X}}$ and $\mathrm{P}_{\mathbold{B}|\mathbold{Y}}$ are proper conditional probability distributions, objects such as $\mathrm{P}_{A_{1}|X_{1}}$ are not well-defined.

During the threshold game, the device used by the players produces the observed data in the $n$ games: $\mathbold{a}=a_{1},\dots,a_{n}$, $\mathbold{b}=b_{1},\dots,b_{n}$, $\mathbold{x}=x_{1},\dots,x_{n}$, and $\mathbold{y}=y_{1},\dots,y_{n}$. These are distributed according to $\mathrm{Q}_{XY}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, where $\mathrm{Q}_{XY}$ denotes the distribution used by the referee to choose the questions in a single non-local game. $\mathrm{Q}_{XY}^{\otimes n}$ is then the IID distribution according to which the questions are chosen in the threshold game.

The observed data $\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y}$ can be used to calculate frequencies and define a “frequencies’ conditional probability distribution”, which we denote by $\mathrm{O}_{ABXY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$, as:

[TABLE]

and define

[TABLE]

$\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ can be seen as a (not necessarily physical) device, or a strategy, for a single game. Starting with IID devices, which can be written in the form of161616An IID device is illustrated in the bottom of Figure 1.2. We can then think of each copy $\mathrm{O}_{AB|XY}$ as describing a single copy of the smaller boxes in the figure, while $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}=\mathrm{O}_{AB|XY}^{\otimes n}$ described the device including all the copies together. $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}=\mathrm{O}_{AB|XY}^{\otimes n}$, it holds that if the device $\mathrm{O}_{AB|XY}$ is non-signalling then $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is non-signalling and vice versa. This also implies that, for sufficiently large $n$, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is non-signalling with high probability.

For a non-IID, but non-signalling, device $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, however, it is not clear at all that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ should be non-signalling as well. Using a reduction to IID, the following theorem is proven:

Theorem 1.2** (Informal).**

Let $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ be a non-signalling permutation invariant parallel device and $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ as in Equation (1.1). Then, for sufficiently large $n$, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is close to a non-signalling device with high probability. In particular, this means that the observed data produced by a non-signalling permutation invariant parallel device can be seen as if, with high probability, it was sampled using an IID device $\mathrm{O}_{AB|XY}^{\otimes n}$ in which every single device $\mathrm{O}_{AB|XY}$ is close to a non-signalling one.

Theorem 1.1 follows directly from Theorem 1.2 by noting that the number of games won in a given use of the device can be directly read from $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ and that if $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is close to a non-signalling device then its winning probability cannot be too far from the optimal non-signalling winning probability $1-\alpha$.

Device-independent quantum cryptography

Chapter 11 is devoted to the analysis of our second showcase — device-independent cryptography. The chapter’s content previously appeared in [Arnon-Friedman et al., 2016c]. The most challenging cryptographic task in which device-independent security has been considered is device-independent QKD (DIQKD); we will use this task as our main example. In DIQKD the goal of the honest parties, called Alice and Bob, is to create a shared key, unknown to everybody else but them. To execute the protocol they hold a device consisting of two parts: Each part belongs to one of the parties and is kept in their laboratories. Ideally, the device performs measurements on some entangled quantum states it contains.

The basic structure of a DIQKD protocol is presented as Protocol 1.1. The protocol consists of playing $n$ non-local games, one after the other, with the given untrusted device and calculating the average winning probability from the observed data (i.e., Alice and Bob’s inputs and outputs). If the average winning probability is below the expected winning probability $\omega_{\mathrm{exp}}$ defined by the protocol, Alice and Bob conclude that something is wrong and abort the protocol. Otherwise, they apply classical post-processing steps that allow them to create identical and uniformly distributed keys. (The full description of the considered DIQKD protocol is presented and discussed in the following chapters).

The central task when proving security of DIQKD consists in bounding the information that an adversary, called Eve, may obtain about Alice’s raw data $\mathbold{A}=A_{1},\dots,A_{n}$ used to create the final key (see Protocol 1.1). More concretely, one needs to establishing a lower bound on the smooth conditional min-entropy $H_{\min}^{\varepsilon}(\mathbold{A}|E)$, where $E$ is Eve’s quantum system, which can be initially correlated to the device used by Alice and Bob in the protocol and $\varepsilon>0$ is one of the security parameters of the protocol (see Section 4.2). The quantity $H_{\min}^{\varepsilon}(\mathbold{A}|E)$ determines the maximal length of the secret key that can be created by the protocol. Hence, proving security amounts to lower-bounding $H_{\min}^{\varepsilon}(\mathbold{A}|E)$. Evaluating the smooth min-entropy $H_{\min}^{\varepsilon}(\mathbold{A}|E)$ of a large system is often difficult, especially in the device-independent setting where Alice and Bob are using an uncharacterised device, which may also be manufactured by Eve.

The IID assumption is commonly used in order to simplify the calculation of $H_{\min}^{\varepsilon}(\mathbold{A}|E)$. In the IID case we can assume that Alice and Bob use an IID device to execute the protocol and, hence, each $A_{i}$ is produced independently of all other outputs. Furthermore, one can assume that Eve’s quantum information also takes the IID form $E=E_{1},\dots,E_{n}$, where each $E_{i}$ holds information only regarding $A_{i}$. Then, the AEP, briefly mentioned above, can be used to calculate an upper-bound on $H_{\min}^{\varepsilon}(\mathbold{A}|E)$ and, by this, prove security.

The most general adversarial device to consider is, clearly, not an IID one. Due to the sequential nature of the protocol, the relevant devices to consider are sequential devices. As sequential devices are more complex than IID ones, security proofs for DIQKD that proved security by addressing the most general device directly, e.g., [Reichardt et al., 2013, Vazirani and Vidick, 2014], had to use techniques which are far more complicated than the ones used for security proofs under the IID assumption, e.g., in [Pironio et al., 2009]. Consequently, the derived security statements were of limited relevance for practical experimental implementations; they are applicable only in an unrealistic regime of parameters, e.g., small amount of tolerable noise and large number of signals.

We take the approach of reductions to IID in order to prove the security of our DIQKD protocol. In particular, we leverage the sequential nature of the protocol, as well as the specific way in which classical statistics are collected by Alice and Bob, to prove its security by reducing the analysis of sequential devices to that of IID devices using the EAT. The resulting theorem can be informally stated as follows:

Theorem 1.3** (Informal).**

Security of DIQKD in the most general case follows from security under the IID assumption. Moreover, the dependence of the key rate on the number of rounds of the protocol, $n$, is the same as the one in the IID case, up to terms that scale like $1/\sqrt{n}$.

On the fundamental level, the theorem establishes the a priori surprising fact that general quantum adversaries are no stronger than an adversary restricted to preparing IID devices. As mentioned in Section 1.1.2, this does not mean that the most general device that an adversary can prepare is an IID device. Instead, it means that the adversary (at least asymptotically) does not benefit form preparing more complex devices.

On the quantitive level, taking the path of a reduction to IID results in a proof with several advantages. In particular, it allows us to give simple and modular security proofs of DIQKD (as well as other device-independent protocols) and to extend tight results known for DIQKD under the IID assumption to the most general setting, thus deriving essentially optimal key rates and noise tolerance. This is crucial for experimental implementations of device-independent protocols. Our quantitive results have been applied to the analysis of the first experimental implementation of a protocol for randomness generation in the fully device-independent framework [Liu et al., 2017].

1.3 How to read the thesis

We review the structure of the thesis. Depending on the reader’s main interest and prior knowledge, different chapters of the thesis may or may not be relevant.

Chapters 2 and 3 give preliminary information. Chapter 2 presents general introductory information and notation. We remark that in most parts of the thesis, general intuition is sufficient and the exact mathematical definitions are not that important in order to understand the essence. Therefore, even a reader unfamiliar with, e.g., the quantum formalism or the mathematical definitions of the various entropies, may skip Chapter 2 in the first reading and get back to the relevant definitions appearing in it only when wishing to get a better understanding of the complete technical details.

Chapter 3 deals with basic information and terminology related to device-independent information processing. Readers who are unfamiliar with, e.g., non-locality, should first of all read this chapter. Readers already familiar with some device-independent tasks may skip the chapter and come back to it if needed.

Chapter 4 acts as an introduction to our showcases; no theorems or proofs are given there. Thus, readers who are familiar with the question of parallel repetition and the task of DIQKD may pass over this chapter.

Chapters 5 and 6 concern themselves with the mathematical objects that we consider in the thesis — the “black boxes” that model the different types of devices. Chapter 5 defines what we call a “single-round box”, which is, in a sense, a device that can be used to play only a single non-local game. The single-round box acts as an abstract object that allows us to study the fundamental aspects of non-locality, without needing to deal with complex protocols. As we will see, it captures the “physics” of the problem at hand. Hence, studying single-round boxes is the first step in any analysis of device-information processing task. In Chapter 6, we formally define parallel and sequential boxes, which give the mathematical model for parallel and sequential devices, and discuss the relations between them.

After setting the stage, we are ready to start discussing the method of reductions to IID. The first step in this direction is done in Chapter 7, where we discuss the IID assumption and see how it can be used to simplify the analysis of device-independent tasks and, in particular, our showcases. This chapter also presents the asymptotic equipartition property, which acts as a valuable mathematical tool when working under the IID assumption.

The tools used as reductions, i.e., the de Finetti reduction and the entropy accumulation theorem, are the topics of Chapters 8 and 9, respectively. Chapters 10 and 11 are devoted to the analysis of our showcases via a reduction to IID.

Clearly, many open questions and directions for future works arise. We discuss open questions specific for our showcases within the relevant chapters. In addition, the thesis ends with an outlook in Chapter 12 including questions that, in order to answer, require further development of the toolkit of reductions to IID.

A reader interested in the topic of reductions to IID in general is recommended to read the thesis from the beginning to the end, following the order of the chapters. On the other hand, a reader who is mainly interested in one of the showcases may focus only on the sections relevant for the showcase of interest. To assist such readers, we list in Table 1.1 the relevant sections (in the order in which they should be read) for each of the showcases.

Chapter 2 Preliminaries: basics and notation

2.1 General notation

The relevant notation for sets and vectors is summarised below.

• •

$\mathbb{N}$, $\mathbb{R}$, and $\mathbb{C}$ are the sets of natural, real, and complex numbers, respectively.

• •

$[a,b]$ denotes the closed set of real numbers $a\leq x\leq b$.

• •

$[n]$ denotes the set $\{1,2,\dots,n\}$.

• •

When an object $x_{i}$ is defined for all $i\in[n]$, $\left\{x_{i}\right\}_{i\in[n]}$ denotes the set $\{x_{1},x_{2},\dots,x_{n}\}$.

• •

Other sets are mostly denoted by calligraphic letters, e.g., $\mathcal{S}$.

• •

$\mathcal{S}\subseteq\mathcal{P}$ means that $\mathcal{S}$ is a subset of $\mathcal{P}$. $\mathcal{S}\subset\mathcal{P}$ means that $\mathcal{S}$ is a proper subset of $\mathcal{P}$.

• •

$\mathcal{S}\setminus\mathcal{P}=\{s:s\in\mathcal{S}\land s\notin\mathcal{P}\}$ stands for the difference between the two sets.

• •

$\mathcal{S}\times\mathcal{P}=\{(s,p):s\in\mathcal{S}\land p\in\mathcal{P}\}$ is the multiplication of the sets. Furthermore, $\mathcal{S}\times\mathcal{S}$ is denoted by $\mathcal{S}^{2}$ and $\mathcal{S}^{n}$ is defined analogously for any $n$.

• •

For sets $\mathcal{S},\mathcal{P}$ we denote by $\mathrm{Hom}(\mathcal{S},\mathcal{P})$ the set of all homomorphisms from $\mathcal{S}$ to $\mathcal{P}$. The set of all endomorphisms is denoted by $\mathrm{End}(\mathcal{S})$, i.e., $\mathrm{End}(\mathcal{S})=\mathrm{Hom}(\mathcal{S},\mathcal{S})$.

• •

Vectors (of different objects) are marked in bold. For example, we use $\mathbold{x}=x_{1},x_{2},\dots,x_{n}$.

• •

Let $f:\mathcal{S}\rightarrow\mathbb{R}$ be a function over some set $\mathcal{S}\subset\mathbb{R}^{n}$. The infinity norm of the gradient of $f$ is defined as

[TABLE]

We use the following general notation.

• •

$\land$, $\lor$, and $\neg$ denote the logical and, or, and negation, respectively.

• •

$\oplus$ denotes the XOR operation.

• •

We denote by $\log$ the logarithm in base 2.

• •

${n\choose{k_{1},\dots,k_{m}}}$ is the multinomial coefficient, i.e., ${n\choose{k_{1},\dots,k_{m}}}=\frac{n!}{k_{1}!\dots,k_{m}!}$, where $!$ is the factorial operation.

• •

A function $f:\mathbb{N}\rightarrow\mathbb{R}$ is called negligible if for every positive polynomial $p(\cdot)$, there exists an $n_{0}$ such that for all $n>n_{0}$, $f(n)<\frac{1}{p(n)}$. In the thesis, in all cases where the term negligible is used $f(n)$ decreases exponentially fast with $n$.

2.2 Probability distributions and random variables

We use both probability distributions and random variables (RV) and interchange the two when convenient. Specifically,

• •

Capital letters, e.g., $X$, denote RV. When implicit, a RV $X$ takes values from the set denoted by the same letter, i.e., $\mathcal{X}$.

• •

$\mathrm{P}_{X}$ denotes the probability distribution corresponding to the RV $X$. To distinguish different probability distributions we sometimes replace $\mathrm{P}$ by other letters, such as $\mathrm{O}$ and $\mathrm{Q}$.

• •

$\mathrm{P}_{X}(x)$ is the probability that $X=x$.

• •

When a probability distribution is used without a need of referring to the event space etc., we simply use $\{p_{i}\}_{i\in\mathcal{I}}$ for some $\mathcal{I}$ (usually clear from the context or irrelevant) while keeping in mind that $p_{i}\geq 0$ for all $i\in\mathcal{I}$ and $\sum_{i}p_{i}=1$.

• •

When discussing more complex events $\Omega\subseteq\mathcal{X}$ over $\mathcal{X}$, we use $\Pr_{x\sim X}\left[\Omega\right]$ to denote the probability of the event $\Omega$ when sampling according to $\mathrm{P}_{X}$. When it is clear from the context according to which probability distribution the sampling is done we may drop the subscript and write only $\Pr\left[\Omega\right]$. For example, when applying Chernoff-type bounds, we use standard notation such as $\Pr\left[\sum_{i}X_{i}>t\right]$ instead of $\mathrm{P}_{X_{1}\dots X_{n}}\left[\sum a_{i}>t\right]$.

• •

The expectation value $\mathbb{E}[X]$ of $X$ is given by $\mathbb{E}[X]=\sum_{x\in\mathcal{X}}x\mathrm{P}_{X}(x)$.

When considering two RVs $X$ and $Y$, jointly distributed according to $\mathrm{P}_{XY}$, the marginal $\mathrm{P}_{X}$ is defined via

[TABLE]

The conditional distribution of $X$ given $Y=y$, given by

[TABLE]

We mostly use $\mathrm{P}_{X|Y}(x|y)$ to denote $\mathrm{P}_{X|Y=y}(x)$ and the shorthand notation $\mathrm{P}_{X|Y}=\mathrm{P}_{XY}/\mathrm{P}_{Y}$ instead that of Equation (2.1).

Throughout the thesis, we use the following operations on probability distributions:

• •

For any $q\in[0,1]$, $\mathrm{P}_{X}$, and $\mathrm{R}_{X}$, the convex combination $\mathrm{S}_{X}=q\mathrm{P}_{X}+(1-q)\mathrm{R}_{X}$ is defined via

[TABLE]

• •

For any $n\in\mathbb{N}$ and $\mathrm{P}_{X}$, $\mathrm{P}_{X}^{\otimes n}$ denoted the probability distribution over $\mathcal{X}^{n}$ defined via

[TABLE]

where $\mathbold{x}=x_{1},x_{2},\dots,x_{n}$.

2.2.1 Independent and identical random variables

Consider two RV $X$ and $Y$ defined over $\mathcal{X}$ and $\mathcal{Y}$ respectively. We say that the two are independent if and only if for all $(x,y)\in\mathcal{X}\times\mathcal{Y}$, $\mathrm{P}_{XY}(x,y)=\mathrm{P}_{X}(x)\cdot\mathrm{P}_{Y}(y)$. For $\mathcal{X}=\mathcal{Y}$, we say that $X$ and $Y$ are identical if and only if $\mathrm{P}_{X}=\mathrm{P}_{y}$.

A sequence of RVs $\mathbold{X}=X_{1},X_{2},\dots,X_{n}$, each over $\mathcal{X}$ are said to be independently and identically distributed (IID) RVs if and only if they are all independent and identical to one another.

2.2.2 Concentration inequalities

When considering IID RVs, concentration inequalities are of special importance. Roughly speaking, concentration inequalities give bounds on how fast the observed frequencies converge to the expected value when sampling IID RVs. The formal statements relevant for the thesis are given below.

Lemma \thelem (Hoeffding’s inequality).

Consider a RV $X$ defined over $\mathcal{X}=\{0,1\}$ and let $X_{1},X_{2},\dots,X_{n}$ be a sequence of $n$ identical and independent copies of $X$. Then,

[TABLE]

and

[TABLE]

Sanov’s inequality can be seen as a concentration inequality for conditional probability distributions, in the following sense. Let $\mathrm{O}_{A|X}$ be a conditional probability distribution over $\mathcal{A}$ and $\mathcal{X}$, $\mathrm{Q}_{X}$ be a probability distribution over $\mathcal{X}$ and denote $\mathrm{O}_{AX}=\mathrm{Q}_{X}\mathrm{O}_{A|X}$. Fix $n\in\mathbb{N}$. Consider a scenario in which we sample $\mathbold{a}=a_{1},\dots,a_{n}$ and $\mathbold{x}=x_{1},\dots,x_{n}$ using $\mathrm{O}_{AX}^{\otimes n}$ and estimate $\mathrm{O}_{A|X}$ from the sample by calculating $\mathrm{O}_{AX}^{\textup{freq}(\mathbold{a},\mathbold{x})}$ defined by

[TABLE]

and define

[TABLE]

Lemma \thelem (Sanov’s inequality).

For every $\mathrm{O}_{AX}$ and $n$,

[TABLE]

where $\mathrm{O}_{A|X}^{\textup{freq}(\mathbold{a},\mathbold{x})}$ is as in Equation (2.2), $\delta(n,\epsilon)=(n+1)^{|\mathcal{A}|\cdot|\mathcal{X}|-1}e^{-n\epsilon^{2}/2}$, and

[TABLE]

2.3 Quantum formalism

The basic notation used in the thesis related to the quantum formalism is listed below. We remark, however, that understanding what is meant by a “state” and “measurements” on the intuitive level will almost always suffice in order to understand the essence of the thesis. The exact definitions below are given for the sake of completeness. Clearly, they do not cover all concepts and definitions employed in quantum physics and quantum information theory. Readers who are not familiar with the topics and would like to get a more comprehensive understanding are directed to [Nielsen and Chuang, 2002].

We use the Dirac notation: $\ket{\psi}$ denotes a column vector while $\bra{\psi}$ is a row vector. $\langle\phi|\psi\rangle$ and $\ket{\phi}\bra{\psi}$ denote inner and outer products of the two vectors, respectively.

2.3.1 Operators

We use the following standard notation and definitions.

• •

The identity matrix, or operator, of dimension $d$ is denoted by $\mathbb{I}_{d}$. Alternatively, instead of indicating the dimension, we use, e.g., $\mathbb{I}_{X}$ to denote the identity operator acting in a specific space associated to $X$ (see below). When the space or dimension is clear from the context we simply write $\mathbb{I}$.

• •

A Hermitian, or self-adjoint, operator $A$ is an operator satisfying $A=A^{\dagger}$.

• •

A unitary operator $A$ is an operator satisfying $AA^{\dagger}=A^{\dagger}A=\mathbb{I}$.

• •

The trace of a square matrix $A$, i.e., the sum of the elements on the main diagonal of $A$, is denoted by $\mathrm{Tr}(A)$.

• •

$A\succeq 0$, for $A$ Hermitian, means that the eigenvalues of $A$ are non-negative. $A\succeq B$ stands for $A-B\succeq 0$.

• •

The 1-norm is defined as $\|A\|_{1}=\mathrm{Tr}|A|=\mathrm{Tr}\sqrt{A^{\dagger}A}$, where $A^{\dagger}$ denotes the conjugate transpose of $A$.

• •

For a diagonal matrix $A$ with eigenvalues $\{a_{i}\}_{i}$, $\log(A)$ is the diagonal matrix with eigenvalues $\{\log(a_{i})\}_{i}$.

2.3.2 Hilbert spaces

The postulates of quantum mechanics tell us that all quantum states “belong” to a complex vector space called a Hilbert space. All quantum states and operations will be defined with respect to the considered Hilbert spaces. We give the formal definitions below.

Definition \thedefn (Hilbert space).

A Hilbert space $\mathscr{H}$ is a complex vector space, i.e.,

[TABLE]

such that for all $\ket{\psi},\ket{\phi}\in\mathscr{H}$, there exists $\langle\phi|\psi\rangle\in\mathbb{C}$ for which

it is linear in $\ket{\psi}$: $\langle\phi|\lambda_{1}\psi_{1}+\lambda_{2}\psi_{2}\rangle=\lambda_{1}\langle\phi|\psi_{1}\rangle+\lambda_{2}\langle\phi|\psi_{2}\rangle$ , 2. 2.

$\overline{\langle\phi|\psi\rangle}=\langle\psi|\phi\rangle$, where the bar denotes the complex conjugate , 3. 3.

for all $\ket{\psi}\in\mathscr{H}$, $\langle\psi|\psi\rangle\geq 0$ and $\langle\psi|\psi\rangle=0\leftrightarrow\ket{\psi}=0$.

The norm of a vector $\ket{\psi}$ is defined as $\|\ket{\psi}\|_{1}=\sqrt{\langle\psi|\psi\rangle}$.

Definition \thedefn (Orthonormal basis).

An orthonormal basis of $\mathscr{H}$ is a set of vectors $\{\ket{\phi_{i}}\}_{i\in I}$ such that

• •

$\langle\phi_{i}|\phi_{j}\rangle=\delta_{ij}$ for all $i,j\in I$  and

• •

$\langle\psi|\phi_{i}\rangle=0$ for all $i\in I$ $\rightarrow\psi=0$ .

We will usually consider Hilbert spaces of finite dimensions, meaning $I$ is a set with a finite amount of elements.

Definition \thedefn (Projector).

Let $\mathscr{H}$ be a Hilbert space and $\mathscr{H}^{\prime}$ a subspace of $\mathscr{H}$ with $\{\ket{\phi_{i}}\}_{i\in\mathcal{I}^{\prime}}$ an orthonormal basis of $\mathscr{H}^{\prime}$. The projector of $\mathscr{H}$ onto $\mathscr{H}^{\prime}$ is the operator

[TABLE]

Given $\mathscr{H}_{A}$ and $\mathscr{H}_{B}$, the tensor product Hilbert space $\mathscr{H}_{A}\otimes\mathscr{H}_{B}$ is defined such that for $\ket{\psi}\in\mathscr{H}_{A}$ and $\ket{\phi}\in\mathscr{H}_{B}$, it associates a vector $\ket{\psi}\otimes\ket{\phi}\in\mathscr{H}_{A}\otimes\mathscr{H}_{B}$ with the property that

$c\cdot\left(\ket{\psi}\otimes\ket{\phi}\right)=(c\cdot\ket{\psi})\otimes\ket{\phi}=\ket{\psi}\otimes(c\cdot\ket{\phi})$ 2. 2.

$(\ket{\psi_{1}}+\ket{\psi_{2}})\otimes\ket{\phi}=\ket{\psi_{1}}\otimes\ket{\phi}+\ket{\psi_{2}}\otimes\ket{\phi}$ 3. 3.

$\ket{\psi}\otimes(\ket{\phi_{1}}+\ket{\phi_{2}})=\ket{\psi}\otimes\ket{\phi_{1}}+\ket{\psi}\otimes\ket{\phi_{2}}$

for all $c\in\mathbb{C}$, $\ket{\psi_{1}},\ket{\psi_{2}}\in\mathscr{H}_{A}$ and $\ket{\phi_{1}},\ket{\phi_{2}}\in\mathscr{H}_{B}$.

2.3.3 Quantum states

Pure and mixed states

There are two “types” of quantum states one can consider — pure and mixed states.

A pure quantum state is associated with a vector belonging to an Hilbert space, $\ket{\psi}\in\mathscr{H}$, with normalisation $\|\ket{\psi}\|_{1}=1$.

Instead of working only with vectors, we can define quantum states as matrices, or operators.

Definition \thedefn (Density operator).

A density operator, or simply a quantum state, $\rho\in\mathrm{End}(\mathscr{H})$ is a Hermitian positive operator with trace 1. That is,

[TABLE]

For a given Hilbert space $\mathscr{H}$, we denote by $\mathcal{S}(\mathscr{H})$ the set of all density operators defined over $\mathscr{H}$.

Any pure state $\ket{\psi}\in\mathscr{H}$ can be written as a density operator $\rho=\ket{\psi}\bra{\psi}\in\mathcal{S}(\mathscr{H})$. Density operators can describe more general states, called mixed quantum states, which can be thought of as a convex combination of pure states:

[TABLE]

Note, however, that different convex combinations can result in the same mixed state $\rho$ and, thus, $\rho$ does not pin-down a specific decomposition to pure states.

A qubit is a quantum state belonging to $\mathcal{S}(\mathscr{H})$ for a two-dimensional Hilbert space $\mathscr{H}$. The basis states are denoted by $\ket{0}$ and $\ket{1}$.

Composite systems

One can consider quantum states over tensor products of Hilbert spaces. Such states are called multipartite states. For example, a bipartite state is a quantum state $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$ for some Hilbert spaces $\mathscr{H}_{A}$ and $\mathscr{H}_{B}$. The state $\rho_{AB}$ can describe a state shared between two parties, Alice and Bob. The most important thing to notice in the context of the thesis is that given a bipartite state $\rho_{AB}$, its marginals are also quantum states; these are called the reduced density operators.

Definition \thedefn (Reduced density operators).

Given $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$, its reduced density operator over $\mathscr{H}_{A}$ is given by

[TABLE]

where $\{\ket{\phi_{i}}\}_{i}$ is a basis of $\mathscr{H}_{B}$, and similarly for $\rho_{B}$.

Thinking of $\rho_{AB}$ as shared between Alice and Bob, Alice’s local state is then $\rho_{A}$ while Bob’s local state is $\rho_{B}$.

Given a state $\rho_{A}$ we can consider its purification.

Definition \thedefn (Purification).

The purification of a state $\rho_{A}\in\mathcal{S}(\mathscr{H}_{A})$ is a pure bipartite state $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$ for which $\mathrm{Tr}_{B}(\rho_{AB})=\rho_{A}$.

Note that by applying a unitary on $B$ the state on $A$ is not being modified and the overall state remains pure. Thus, after the unitary operation, we are still holding a purification. In this sense, we usually say that all purifications are equivalent up to the application of a unitary on the purifying system $B$.

Classical systems

A classical system, defined by a RV $A$ with probability distribution $\mathrm{P}_{A}$, can be represented by the density operator

[TABLE]

where $\{\ket{a}\}_{a}$ is an orthonormal basis of a Hilbert space $\mathscr{H}_{A}$.

One example of a classical system that is of common use is the state associated with the uniform distribution $U_{m}$ over $\{0,1\}^{m}$. This distribution can be written as the state $\rho_{U_{m}}=\frac{1}{m}\mathbb{I}_{m}$, called the completely mixed state on $m$ qubits.

A classical-quantum state is a bipartite state in which one register is classical and the other is quantum. Formally,

Definition \thedefn (Classical-quantum state).

A classical-quantum state $\rho_{AE}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{E})$, classical on $A$, is a state of the form

[TABLE]

where $\{\ket{a}\}_{a}$ is an orthonormal basis of the Hilbert space $\mathscr{H}_{A}$ and, for all $a\in\mathcal{A}$, $\rho_{E}^{a}\in\mathcal{S}(\mathscr{H}_{E})$.

Given a classical-quantum state $\rho_{AE}$ as above, we can consider the quantum state arising from conditioning on an event defined over $\mathcal{A}$. For example, conditioning on the event $A=a$, the quantum state is $\rho_{E}^{a}$. Conditioning can also be done when considering more complicated events. For $\Omega$ some event over $\mathcal{A}$, the state conditioned on $\Omega$ is

[TABLE]

where $\Pr[\Omega]=\sum_{a\in\Omega}\mathrm{P}_{A}(a)$ is the probability of $\Omega$ according to $\rho_{AE}$ and $\mathrm{P}_{A|\Omega}(a)=\Pr[A=a\land\Omega]/\Pr[\Omega]$ is the probability of $a$ given $\Omega$.

Entanglement

Given a bipartite state $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$, shared between two parties, one can study the type of correlations that appear between the two parties. A state is said to be separable if it can be written as

[TABLE]

for some probabilities $p_{i}$, $\rho_{A}^{i}\in\mathcal{S}(\mathscr{H}_{A})$, and $\rho_{B}^{i}\in\mathcal{S}(\mathscr{H}_{B})$. That is, a separable state is a convex combination of tensor product states. Using the above we notice that a pure state $\ket{\psi}_{AB}$ is separable if and only if it is a tensor product of two pure states $\ket{\psi}_{AB}=\ket{\psi_{A}}\otimes\ket{\psi_{B}}$.

Not all quantum states are separable. A bipartite state $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$ is said to be entangled if it cannot be written in the form of Equation (2.3). Such states exhibit correlations which cannot be explained by classical means.

Of specific interest to us are maximally entangled states of two qubits, also called Bell states, denoted by

[TABLE]

Here, $\ket{00}$ stands for $\ket{0}\otimes\ket{0}\in\mathscr{H}_{A}\otimes\mathscr{H}_{B}$, with $\mathscr{H}_{A}$ and $\mathscr{H}_{B}$ two-dimensional Hilbert spaces. $\ket{01}$, $\ket{10}$, and $\ket{11}$ are similarly defined.

2.3.4 Quantum operations

Unitary evolution

The evolution of a closed, or isolated, quantum system is described by unitary operations. By “a closed system” we mean that the transformation of the system of interest is independent of the “rest of the world”, or the environment. We have:

• •

For any unitary $U$, $U$ evolves a pure state $\ket{\psi^{1}}\in\mathscr{H}$ to a pure state $\ket{\psi^{2}}\in\mathscr{H}$ according to $\ket{\psi^{2}}=U\ket{\psi^{1}}$.

• •

More generally, for mixed states, starting with $\rho^{1}\in\mathcal{S}(\mathscr{H})$ we have $\rho^{2}=U\rho^{1}U^{\dagger}\in\mathcal{S}(\mathscr{H})$.

• •

For a bipartite state $\rho^{1}_{AB}$, we can evolve each subsystem locally by $\rho^{2}_{AB}=(U_{A}\otimes U_{B})\rho^{1}_{AB}(U^{\dagger}_{A}\otimes U^{\dagger}_{B})$.

• •

As unitary operations are reversible ($UU^{\dagger}=U^{\dagger}U=\mathbb{I}$), the evolution of closed systems is always reversible.

Quantum measurements

To describe a quantum measurement one can use the so called Kraus operators.

Definition \thedefn (Kraus operators).

A set of Kraus operators $\{K_{i}\}_{i\in\mathcal{I}}$ is a set of operators such that $\sum_{i\in\mathcal{I}}K_{i}^{\dagger}K_{i}=\mathbb{I}$.

Definition \thedefn (Quantum measurement: Kraus representation).

Given a state $\rho$ and a set of Kraus operator $\{K_{i}\}_{i\in\mathcal{I}}$ describing a measurement, the outcome of the measurement on $\rho$ is a RV $I$, defined over the set $\mathcal{I}$, where each outcome $i\in\mathcal{I}$ is associated with the operator $K_{i}$. The probability of observing the outcome $i$ when measuring $\rho$ with $\{K_{i}\}_{i}$ is given by

[TABLE]

The post-measurement state is given by

[TABLE]

We can further identify an operator $M_{i}=K_{i}^{\dagger}K_{i}$ and work with it, instead of the Kraus operators, to ease notation in some cases. These operators, called positive operator valued measures (POVMs), can then be used to describe the relevant measurements.

Definition \thedefn (Positive operator valued measure).

A positive operator valued measure (POVM) is a set of positive Hermitian operators $\{M_{i}\}_{i\in\mathcal{I}}$ such that $\sum_{i\in\mathcal{I}}M_{i}=\mathbb{I}$.

Definition \thedefn (Quantum measurement: POVM representation).

Given a state $\rho$ and a POVM $\{M_{i}\}_{i\in\mathcal{I}}$ describing a measurement, the outcome of the measurement on $\rho$ is a RV $I$, defined over the set $\mathcal{I}$, where each outcome $i\in\mathcal{I}$ is associated with the operator $M_{i}$. The probability of observing the outcome $i$ when measuring $\rho$ with $\{M_{i}\}_{i}$ is given by

[TABLE]

Given a POVM $\{M_{i}\}_{i\in\mathcal{I}}$ there are many different decomposition to Kraus operators. While the specific decomposition is not relevant for knowing the measurement statistics, they are needed in order to describe the post-measurement state.

In most of the scenarios considered in this thesis we will only be interested with the observed measurements statistics and therefore we will use POVMs to describe a measurement. When there will be a need to consider the post-measurement state we will switch to Kraus operators. Which form on quantum measurement is being used is usually clear from the context and hence we simply call all of them measurement operators.

The Pauli operators, denoted by $\sigma_{x}$, $\sigma_{y},$ and $\sigma_{z}$, are an example for measurement operators for qubits:

[TABLE]

Quantum channels

Quantum channels, or maps, are functions describing the evolution of quantum states. In order for a map $\mathcal{E}$ to describe a real physical process, transferring one quantum state $\rho\in\mathcal{S}(\mathscr{H}_{A})$ to another $\mathcal{E}(\rho)\in\mathcal{S}(\mathscr{H}_{B})$,111Note that $\mathscr{H}_{B}$ may be different than $\mathscr{H}_{A}$. For a unitary evolution, discussed before, this was not the case. it must fulfil certain conditions. Specifically, it must be completely positive and trace preserving (CPTP).

Definition \thedefn (Quantum channel).

A linear map $\mathcal{E}\in\mathrm{Hom}(\mathcal{S}(\mathscr{H}_{A}),\mathcal{S}(\mathscr{H}_{B}))$ is a quantum channel if it is:

Completely positive (CP): for any $\rho_{AR}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{R})$ with $\rho_{AR}\succeq 0$,

[TABLE]

where $\mathscr{H}_{R}$ is any additional Hilbert space and $\mathbb{I}_{R}$ is the identity map on that Hilbert space. 2. 2.

Trace preserving (TP): for any $\rho\in\mathcal{S}(\mathscr{H}_{A})$, $\mathrm{Tr}\left(\mathcal{E}(\rho)\right)=\mathrm{Tr}(\rho)$.

2.4 Distance measures

The trace distance of two states is given by $\Delta(\rho,\tau)=\frac{1}{2}\|\rho-\tau\|_{1}$. Operationally, the trace distance quantifies the distinguishing advantage when trying to distinguish $\rho$ from $\tau$. Consider a situation in which either the state $\rho$ or the state $\tau$ are chosen uniformly at random and given to someone who has no information as to which state was chosen and needs to output a guess. The probability of succeeding in this task depends on how far $\rho$ and $\tau$ are from one another via

[TABLE]

We will be interested below in the so called purified distance. The purified distance involves sub-normalised states, i.e., states with $\mathrm{Tr}(\rho)\leq 1$. For this, one first needs to extend the definition of the trace distance to describe also the distance between two sub-normalised states.

Definition \thedefn (Generalised trace distance).

The trace distance between two sub-normalised states $\rho$ and $\tau$ is given by

[TABLE]

Another important measure of distance (though not a metric) is the fidelity. The fidelity of two quantum states is given by $F(\rho,\tau)=\left(\mathrm{Tr}|\sqrt{\rho}\sqrt{\tau}|\right)^{2}$. The fidelity is related to the trace distance by

[TABLE]

Here, again, we can define the fidelity between two sub-normalised states.

Definition \thedefn (Generalised fidelity).

The fidelity between two sub-normalised states $\rho$ and $\tau$ is given by

[TABLE]

The last distance measure that will be of importance for us is the purified distance [Tomamichel et al., 2010a]. This measure will be used to define the smooth entropies below and will always be considered with sub-normalised states.

Definition \thedefn (Purified distance).

The purified distance between two sub-normalised states $\rho$ and $\tau$ is given by

[TABLE]

2.5 Entropies

2.5.1 Shannon and von Neumann Entropy

Definition \thedefn (Shannon entropy).

Given RVs $A$ and $B$ defined over $\mathcal{A}$ and $\mathcal{B}$, respectively, the Shannon entropy of $A$ is given by

[TABLE]

The conditional Shannon entropy of $A$ given $B$ is defined to be

[TABLE]

In the case of a RV defined over $\{0,1\}$ with $\mathrm{P}_{A}(0)=p$ the Shannon entropy is reduced to the so called “binary entropy” $h(p)=-p\log(p)-(1-p)\log(1-p)$.

The von Neumann entropy is the extension of the Shannon entropy to quantum states.

Definition \thedefn (von Neumann entropy).

Given a quantum state $\rho_{AB}\in\mathcal{S}(\mathscr{H}_{A}\otimes\mathscr{H}_{B})$, the von Neumann entropy of $A$ is given by

[TABLE]

The conditional von Neumann entropy of $A$ given $B$ is defined to

[TABLE]

When the state on which the entropy is evaluated is clear from the context we drop the subscript and write, e.g., $H(A|B)$.

Definition \thedefn (Mutual information).

For a quantum state $\rho_{ABC}$, the conditional mutual information between $A$ and $B$ conditioned $C$ is given by

[TABLE]

There are other equivalent ways of defining Markov chains for quantum states [Hayden et al., 2004], but for our purposes this definition suffices.

The conditional mutual information fulfils the following properties:

Strong subadditivity: $I(A:B|C)_{\rho}\geq 0$ for any $\rho$. 2. 2.

Data processing: for any quantum channels $\mathcal{E}:\mathcal{S}(\mathscr{H}_{A})\rightarrow\mathcal{S}(\mathscr{H}_{A^{\prime}})$ and $\mathcal{F}:\mathcal{S}(\mathscr{H}_{B})\rightarrow\mathcal{S}(\mathscr{H}_{B^{\prime}})$,

[TABLE]

where $\rho^{\prime}_{A^{\prime}B^{\prime}C}=\mathcal{E}\otimes\mathcal{F}\otimes\mathbb{I}_{C}(\rho_{ABC})$. 3. 3.

$I(A:B|C)=0$ if and only if $A$ and $B$ are independent given $C$, i.e., $\mathrm{P}_{AB|C}=\mathrm{P}_{A|C}\cdot\mathrm{P}_{B|C}$.

Definition \thedefn.

A tripartite quantum state $\rho_{ABC}$ is said to fulfil the Markov chain condition $A\leftrightarrow C\leftrightarrow B$ if $I(A:B|C)=0$.

2.5.2 Min- and max-entropies

We will work with the smooth min- and max-entropies, formally defined as follows.

Definition \thedefn (Smooth conditional entropies).

For any $\varepsilon\in[0,1]$ the $\varepsilon$-smooth conditional min- and max-entropy of a state $\rho_{AB}$ are given by

[TABLE]

for $\mathcal{B}^{\varepsilon}(\rho_{AB})$ the set of sub-normalised states $\sigma_{AB}$ with $P(\rho_{AB},\sigma_{AB})\leq\varepsilon$, where $P$ is the purified distance as in Definition 2.4.

In practice, we will not need the fully general definitions above (which are stated for completeness). When considering the min-entropy, we will be interested in the case where the $A$ system is classical. This leads to more intuitive definitions. When $A$ is classical and $B$ is trivial, one can simply write

[TABLE]

For quantum $B$, the state can be written as $\rho_{AB}=\sum_{a}p_{a}\ket{a}\!\!\bra{a}\otimes\rho_{B}^{a}$. Then, the conditional min-entropy is the directly related to the guessing probability of $A$ given $B$ via

[TABLE]

where $p_{\text{guess}}(A|B)$ is the maximum probability of guessing $A$ given the quantum system $B$:

[TABLE]

and the maximisation is performed over all POVMs $\{M^{a}_{B}\}_{a}$ on $B$. The smooth conditional min-entropy can be written by maximising the min-entropy over all close sub-normalised states, i.e.,

[TABLE]

Moving on to the max-entropy, we will mainly be interested in the case of classical registers. In the classical case, the following holds for the max-entropy

[TABLE]

Evaluating the smooth conditional max-entropy will be done by considering a closely related quantity, namely the classical smooth zero-entropy.

Definition \thedefn (Classical zero-entropy).

For classical RVs $A$ and $B$ distributed according to $\mathrm{P}_{AB}$,

[TABLE]

where $\text{Supp}\left(\mathrm{P}_{A|B=b}\right)=\{a:\mathrm{P}_{A|B=b}\left(a\right)>0\}$. The smooth version of the zero-entropy is given by

[TABLE]

where the minimum ranges over all events $\Omega$ with probability at least $1-\varepsilon$.

Finally, we remark that for any quantum state $\rho_{AB}$,

[TABLE]

The same ordering does not necessarily hold for the smooth entropies.

Chapter 3 Preliminaries: device-independent concepts

The goal of this chapter is to present the basic information needed while reading the thesis. It is by no means a comprehensive review of the topic of device-independent information processing. A reader completely unfamiliar with the concepts of non-locality and device-independent protocols is encouraged to read the survey [Brunner et al., 2014] and lecture notes [Scarani, 2013].

As explained in the introduction, the device-independent framework allows one to examine certain properties of physical devices without referring to their internal workings. Instead of describing a device using its hardware and actions we think of it as a box with buttons, on which the user can press in order to give classical inputs to device, and a display, from which the user can read the classical outputs produced by the device. Then, the only information available to the user of the box is the observed data, i.e., the input-output behaviour of the box.

The input-output behaviour of the box can be described mathematically using a conditional probability distribution $\mathrm{P}_{O|I}$, where $I$ describes the possible inputs of the box and $O$ the possible outputs. For example, if the box has three buttons we can think of $I$ as being a random variable over $\{0,1,2\}$. If the box displays a bit as its output then $O$ is a random variable over $\{0,1\}$. $\mathrm{P}_{O|I}$ then describes the, possibly probabilistic, actions of the box. For example, a box with $\mathrm{P}_{O|I}(0|0)=1/2$ and $\mathrm{P}_{O|I}(1|0)=1/2$ outputs [math] or $1$, each with probability $1/2$, when the user presses the button associated with the input [math].

The following sections are devoted to explaining the types of boxes that one can consider and their properties. In Section 3.1 we define three important classes of boxes according to their input-output behaviour. In Section 3.2 we introduce the topic of Bell inequalities, which lies at the heart of all device-independent information processing tasks. In Section 3.3 we formally discuss the concept of untrusted devices and, in particular, how a possibly malicious box is modelled.

3.1 Black boxes

In this thesis we mainly consider bipartite boxes. We think of a bipartite box as a box with two components, each belonging to a different party – one component for Alice and one for Bob. Crucially later on, the components are separated in space so Alice and Bob may locate their parts of the box in different places. Both of Alice’s and Bob’s component have buttons and a display. Alice has the possibility of supplying an input to her component and reading the output produced by her component. Bob has no access to Alice’s component. Similarly, Bob has the possibility of supplying an input to his component and reading the output produced by his component, while Alice has no access to Bob’s component.

Mathematically the bipartite nature of the box presents itself by considering conditional probability distributions $\mathrm{P}_{AB|XY}$, where $X$ and $A$ denote Alice’s inputs and outputs, respectively, while $Y$ and $B$ denote Bob’s inputs and outputs, respectively. $\mathrm{P}_{AB|XY}$ includes all the information about the input-output behaviour of the box and the correlations between Alice’s and Bob’s outputs.

A priori, there are no restrictions on $\mathrm{P}_{AB|XY}$, i.e., it can be any conditional probability distribution. One may restrict the type of boxes being considered by imposing certain constraints on $\mathrm{P}_{AB|XY}$ that depend on the physical theory being studied. Specifically, we are interested in boxes that describe classical, quantum, and non-signalling devices (as explained below). A quantum box, for example, may exhibit correlations between Alice and Bob that cannot be created by classical means. When considering the space of conditional probability distributions $\mathrm{P}_{AB|XY}$ the constraints imposed on the box define sets to which the different type of boxes belong. The constraints defining the sets of interest are explained below.

3.1.1 Non-signalling boxes

When considering general conditional probability distributions $\mathrm{P}_{AB|XY}$ any dependence between $A$, $B$, $X$, and $Y$ is allowed. In particular, even though we think of Alice and Bob as holding two separated parts of the box, Alice’s output $A$ may depend on both inputs $X$ and $Y$. In practice this means that in order for Alice’s box to produce an output, following Alice’s choice of input $X$, the box first needs to get Bob’s input $Y$ as well. That is, until a signal including Bob’s input arrives to Alice’s component, no actions will be taken by Alice’s component of the box and Alice will need to wait.

In most cases, the above is not a desired behaviour; usually one expects the component of one user to produce an output as a response to pressing the button on that component alone. Mathematically this requirement is phrased using the so called “non-signalling conditions” that imply that the marginals $\mathrm{P}_{A|X}$ and $\mathrm{P}_{B|Y}$ are a well-defined conditional probability distribution. In other words, the behaviour of Alice’s part of the box is described by $\mathrm{P}_{A|X}$, which is independent of Bob’s input $Y$. Thus, Alice’s box does not need to receive $Y$ before producing $A$. A box fulfilling the non-signalling conditions between Alice and Bob is called a non-signalling box and is defined as follows.

Definition \thedefn (Non-signalling box).

A non-signalling box is a conditional probability distribution $\mathrm{P}_{AB|XY}$ for which the non-signalling conditions

[TABLE]

hold for all $a\in\mathcal{A}$, $b\in\mathcal{B}$, $x,x^{\prime}\in\mathcal{X}$ and $y,y^{\prime}\in\mathcal{Y}$.

Denote by $\mathrm{P}^{y}_{A|X}(a|x,y)=\sum_{b}\mathrm{P}_{AB|XY}(a,b|x,y)$ the behaviour of Alice’s part of the box, which may a priori depend on Bob’s choice of input $y$. Equation (3.1) states that $\mathrm{P}^{y}_{A|X}=\mathrm{P}^{y^{\prime}}_{A|X}$ and, hence, the conditional probability distribution describing Alice’s part of the box is independent of Bob’s input, i.e., whether Bob inputs $y$ or $y^{\prime}$. We can therefore drop the superscript and simply consider $\mathrm{P}_{A|X}$ — a well defined marginal. Similarly, Equation (3.2) implies that $\mathrm{P}_{B|Y}$ is independent of Alice’s input and faithfully describes Bob’s part of the box.

On the more fundamental level, the non-signalling conditions describe the assumption that the box cannot be used to send instantaneous signals between Alice and Bob. Alice and Bob may locate their components arbitrarily far away from one another. If we require the two components to produce outputs right away, then signals including information about the inputs used by the other party have no time to get from one part of the box to the other and influence its actions. In such a case, using the above notation, if $\mathrm{P}^{y}_{A|X}\neq\mathrm{P}^{y^{\prime}}_{A|X}$, then Alice may conclude from her observed statistics whether Bob used $y$ or $y^{\prime}$, even though this information did not have enough time to travel from Bob to Alice. It follows that a non-signalling box is a device that cannot be used as means of communication between Alice and Bob.

A closely related definition that will be of use later is that of a non-signalling extension. Given Alice’s component, one can consider an extension of it to an additional party Bob. Specifically, we will be interested in what we call a non-signalling extension of a box, defined below.

Definition \thedefn (Non-signalling extension).

A non-signalling extension of a box $\mathrm{P}_{A|X}$ is a non-signalling box $\mathrm{P}_{AB|XY}$ such that for all $a\in\mathcal{A}$, $x\in\mathcal{X}$, and $y\in\mathcal{Y}$, $\sum_{b}\mathrm{P}_{AB|XY}(a,b|x,y)=\mathrm{P}_{A|X}(a|x)$.

In words, given $\mathrm{P}_{A|X}$, $\mathrm{P}_{AB|XY}$ is a non-signalling box with the “correct marginal” on Alice’s side (while Bob’s marginal $\mathrm{P}_{B|Y}$ can be arbitrary).

Before moving on we point to the simplicity of the non-signalling conditions in Equations (3.1) and (3.2). The non-signalling conditions are linear. As a result, the set of non-signalling boxes is a polytope. The faces of the polytope are defined by the various non-signalling conditions as well as the positivity and normalisation constrains fulfilled by any conditional probability distribution.

3.1.2 Quantum boxes

One can further restrict the modelled device by considering quantum boxes, i.e., boxes that exhibit quantum correlations. Such boxes are relevant when considering device-independent processing tasks in which all the resources are quantum.

Quantum correlations are correlations that can be explained within the formalism of quantum physics. To put it differently, we think of a box as a device that “holds” some bipartite quantum state $\rho_{Q_{A}Q_{B}}$, shared between Alice and Bob.111We distinguish the quantum state from the correlations throughout the thesis: $Q_{A}$ and $Q_{B}$ denote quantum registers belonging to Alice and Bob while $A$ and $B$ denote their classical outputs. Alice’s component of the device performs some local quantum measurements on her marginal state $\rho_{Q_{A}}$ and similarly for Bob. Formally:

Definition \thedefn (Quantum box).

A quantum box is a conditional probability distribution $\mathrm{P}_{AB|XY}$ such that there exist a bipartite state $\rho_{Q_{A}Q_{B}}$ and sets of POVMs for Alice and Bob $\{M^{x}_{a}\}_{a\in\mathcal{A}}$ for all $x\in\mathcal{X}$ and $\{M^{y}_{b}\}_{b\in\mathcal{B}}$ for all $y\in\mathcal{Y}$, respectively, for which

[TABLE]

We make the following remarks regarding Definition 3.1.2. First, while we assume that the bipartite box is quantum, we do not assume anything regarding its internal workings. In particular, we only assume here that the state $\rho_{Q_{A}Q_{B}}$ is defined over a bipartite Hilbert space222The definition of a quantum box over a bipartite Hilbert space $\mathscr{H}_{Q_{A}}\otimes\mathscr{H}_{Q_{B}}$ is the standard one in the context of non-relativistic quantum mechanics. When studying relativist quantum mechanics one considers a single Hilbert space $\mathscr{H}$ and two commuting measurements acting on it (instead of tensor product measurements). The two definitions coincide when restricting the attention to finite dimensional Hilbert spaces but otherwise different in general [Slofstra, 2017]. $\mathscr{H}_{Q_{A}}\otimes\mathscr{H}_{Q_{B}}$ (since we consider bipartite boxes) but we do not restrict the dimensions of $\mathscr{H}_{Q_{A}}$ and $\mathscr{H}_{Q_{B}}$.

Second, the non-signalling assumption is “encoded” in the bipartite structure of Alice and Bob’s state $\rho_{Q_{A}Q_{B}}$ together with tensor product structure of their measurements as in Equation (3.3). That is, the conditional probability distribution $\mathrm{P}_{AB|XY}$ is by definition non-signalling. Hence, the set of quantum boxes is a subset of the set of non-signalling boxes.

3.1.3 Classical boxes

A classical box is described by a conditional probability distribution that can be explained in terms of shared randomness alone. That is, we think of Alice’s and Bob’s component of the box as holding a shared random string (in contrast to a shared quantum state). Each component decides on its output depending on its input and the shared string. Formally:

Definition \thedefn (Classical box).

A classical box is a conditional probability distribution $\mathrm{P}_{AB|XY}$ that can be written in the form

[TABLE]

where $\Lambda$ is the random variable describing the randomness shared by the two components of the box.

One can assume without loss of generality that $\mathrm{P}_{A|X\Lambda}$ and $\mathrm{P}_{B|Y\Lambda}$ are deterministic. That is, for all $\lambda$, $x$, and $a$, either $\mathrm{P}_{A|X\Lambda}(a|x,\lambda)=0$ or $\mathrm{P}_{A|X\Lambda}(a|x,\lambda)=1$, and similarly for Bob. This holds since we can always “push” the non-deterministic behaviour of the components to the shared randomness $\lambda$ itself. As the number of deterministic assignments of $a$ to each $x$ is finite (assuming $\mathcal{A}$ and $\mathcal{X}$ are finite), it follows that one can also express all classical boxes as

[TABLE]

for $\lambda$ belonging to a finite set and deterministic $\mathrm{P}_{A|X\Lambda}$ and $\mathrm{P}_{B|Y\Lambda}$.

In the context of Bell inequalities, discussed below, $\Lambda$ is called the “hidden variable” that explains the correlations between Alice’s and Bob’s parts of the box. Conditioned on the value of $\Lambda$, the two components, $\mathrm{P}_{A|X\Lambda}$ and $\mathrm{P}_{B|Y\Lambda}$, are independent of one another, as seen in Equation (3.4). Classical boxes, or correlations, are also termed “local correlations”.333Though common, this is a rather confusing and unjustified terminology. As clear from Equation (3.3), quantum correlations are also local, in the sense that each component performs a local operation on its part of the state.

It is easy to see that when considering scenarios with a single party, i.e., boxes $\mathrm{P}_{A|X}$, all conditional probability distributions can be written in the form of Equation (3.4). Thus, all single-party boxes are classical boxes. This is not an interesting scenario and, in particular, no device-independent information processing task can be performed in such a case. Thus, boxes of two parties or more are always considered.

3.1.4 Correlations’ space

Let $\mathcal{C}$, $\mathcal{Q}$, and $\mathcal{NS}$ denote the sets of classical, quantum, and non-signalling boxes, respectively. It is easy to see that all of these sets are convex: given two classical boxes $\mathrm{P}^{1}_{AB|XY}$ and $\mathrm{P}^{2}_{AB|XY}$, the box $\mathrm{P}_{AB|XY}=p\mathrm{P}^{1}_{AB|XY}+(1-p)P^{2}_{AB|XY}$ is also classical, and similarly for quantum and non-signalling boxes. The convex sets of classical and non-signalling boxes can be described as the convex combination of a finite number of extremal point and hence $\mathcal{C}$ and $\mathcal{NS}$ are polytopes. This is not the case for the quantum set $\mathcal{Q}$. See Figure 3.1 for an illustration.

As clear from the definition of the various types of boxes, any classical box is also a quantum box and any quantum box is also a non-signalling box. Furthermore, there are examples for quantum boxes that cannot be written in the form of Equation (3.4) and for non-signalling boxes that cannot be written in the form of Equation (3.3). It follows that the sets fulfil the relation

[TABLE]

as in Figure 3.1.

Bell inequalities, discussed in the next section, give us a way of separating classical boxes from quantum ones444Separating quantum boxes from non-signalling ones is a far more complicated task; see, e.g., [Navascués et al., 2008]. — an essential tool in any device-independent information processing task.

3.2 Bell inequalities

From now on our discussion is restricted to boxes which fulfil, at the least, the non-signalling conditions. That is, we are considering only boxes which cannot be used as means of communication between two seperated parties, Alice and Bob.

The polytope of classical boxes $\mathcal{C}$ is a strict subset of the set of quantum and non-signalling boxes. As such, some of the affine hyperplanes defining $\mathcal{C}$ separate $\mathcal{C}$ from $\mathcal{Q}$.555Other hyperplanes represent the trivial conditions of positivity of normalisation of the conditional probability distributions which are relevant for all sets. Informally, when we say that a hyperplane separates $\mathcal{C}$ from $\mathcal{Q}$ we mean that all classical boxes are on one side of the hyperplane, while the other side can only include quantum and non-signalling boxes.

The condition of being on “one side of the hyperplane” is written in the form of an inequality

[TABLE]

for some given constants $S$ and $s(a,b,x,y)$, for all $a,b,x,y$.

Given a box $\mathrm{P}_{AB|XY}$, the simple form of Equation (3.5) allows us to test, by calculating $\sum_{a,b,x,y}s(a,b,x,y)\mathrm{P}_{AB|XY}(a,b|x,y)$, if the box cannot be a classical one. In other words, if the inequality is violated, i.e.,

[TABLE]

then $\mathrm{P}_{AB|XY}$ cannot be written in the form of Equation (3.4).

As first noticed by [Bell, 1964], some quantum boxes, arising from measurements performed on entangled states, are capable of violating inequalities as in Equation (3.5).666Notice that the statement that some quantum states violate Bell inequalities is independent from the statement that classical boxes cannot violate the inequality; it could have been the case that no box is able to violated such inequalities. This would have implied that all quantum correlations can be written in the form of Equation (3.4) and, hence, can be described as arising from some shared randomness, or an “hidden variable”, $\lambda$. Bell suggested to use such states in an experiment, proposed to test the EPR paradox [Einstein et al., 1935], that will allow us to check whether there is some classical piece of information, that we are just unaware of or cannot observe, that can explain the apparent “non-local” correlations exhibit by certain quantum states. Such experiments, called today “loophole-free Bell tests” [Hensen et al., 2015, Shalm et al., 2015, Giustina et al., 2015], have verified the violation of Bell inequalities and by this refuted the possibility of classical explanations of the behaviour of some entangled quantum states.

The inequalities which are fulfilled by any classical box while being violated by some quantum boxes are called Bell inequalities; see Figure 3.1. All of the above implies that a Bell inequality acts as a test for “quantumness” or, more precisely, “non-classicalness” and its violation acts as a certificate for passing the test. As such, it is crucial for any device-independent information processing task in which we need to rule out the possibility of executing the considered task with a classical device.

3.2.1 Non-local games

Bell inequalities, as in Equation (3.5), can also be phrased as special types of games, called non-local, or Bell, games. In a game, a referee asks Alice and Bob, the players of the game, a question each, chosen according to a given probability distribution; each player only sees her/his question. The players then need to supply answers which fulfil a pre-determined requirement according to which the referee accepts or rejects the answers. To win the game the players can agree on a strategy beforehand but, once the game begins, communication between the players is not allowed. If the referee accepts their answers the players win.

Formally, a game $\mathrm{G}=(\mathcal{X},\mathcal{Y},\mathcal{A},\mathcal{B},\mathrm{Q}_{XY},w)$ is defined by sets of possible questions $\mathcal{X}$ and answers $\mathcal{A}$ for Alice, sets of possible questions $\mathcal{Y}$ and answers $\mathcal{B}$ for Bob, a probability distribution $\mathrm{Q}_{XY}$ over the questions, according to which the referee choses the questions, and a winning condition $w:\mathcal{A}\times\mathcal{B}\times\mathcal{X}\times\mathcal{Y}\rightarrow\{0,1\}$, where $w(a,b,x,y)=0$ means that the referee rejects $(a,b,x,y)$, i.e., the players lose, and $w(a,b,x,y)=1$ means that the players win with $(a,b,x,y)$.

A strategy for the game is naturally described by a box $\mathrm{P}_{AB|XY}$ held by the players — the referee chooses questions $(x,y)\in\mathcal{X}\times\mathcal{Y}$ and the players need to reply with answers $(a,b)\in\mathcal{A}\times\mathcal{B}$. The fact that the players are not allowed to communicate during the game means that, at the least, the box $\mathrm{P}_{AB|XY}$ is constrained by non-signalling conditions between Alice and Bob, i.e., $\mathrm{P}_{AB|XY}$ belongs to the non-signalling polytope $\mathcal{NS}$.777Depending on the context, one can further restrict the allowed strategies by considering classical or quantum boxes. The winning probability of a box $\mathrm{P}_{AB|XY}$ in the game $\mathrm{G}$ is given by

[TABLE]

When the discussed box $\mathrm{P}_{AB|XY}$ is clear from the context we simple write $\omega$ to denote its winning probability.888Notice the notation: $w$ denotes a winning condition (function) while $\omega$ is the winning probability (a number). $W$ will be used to denote the random variable describing whether a game is won or lost. In any case, the difference between these three objects is always clear from the text.

In the context of device-independent information processing we interpret a Bell inequality as a special type of game. What makes the game special is that it is designed so that any classical box used by the players leads to a winning probability of at most $\omega_{c}<1$, while there exists a quantum box that can be used by the players to achieve a greater winning probability, $\omega_{q}>\omega_{c}$. Instead of a Bell inequality as in Equation (3.5) we have

[TABLE]

Violating a Bell inequality then translates to violating Equation (3.6) by winning the respective game with probability greater than $\omega_{c}$. In both cases, the conclusion is the same; if $\mathrm{P}_{AB|XY}$ violates Equation (3.6) then $\mathrm{P}_{AB|XY}\notin\mathcal{C}$.

Before discussing an explicit example of a non-local game, one remark is in order. Above, we thought of Alice and Bob as the ones preparing the box, according to their strategy in the game, and the referee was asking them questions to test their winning probability. Alternatively, we can think of Alice and Bob as holding an uncharacterised box and they are the ones testing the box, by choosing the questions themselves. In that case, Alice and Bob basically take the role of the referee (while the box takes the role of Alice and Bob). (In the showcase of non-signalling parallel repetition, in Chapter 10, we use the first terminology, while the showcase of device-independent quantum cryptography, in Chapter 11, the second is terminology is the more appropriate one).

3.2.2 The CHSH game

We now present an explicit non-local game that will be of use in the thesis. The Clauser-Horne-Shimony-Holt (CHSH) game [Clauser et al., 1969] is probably the most famous non-local game. In the game, Alice’s and Bob’s inputs and outputs are bits, $a,b,x,y\in\{0,1\}$ and the inputs are distributed uniformly at random, i.e., $\mathrm{Q}_{XY}(x,y)=1/4$ for all $x$ and $y$. The winning conditions is given by:

[TABLE]

The optimal classical box, or strategy, achieves a winning probability of $0.75$. An example for such a strategy is one in which the outputs are always $(a,b)=(0,0)$.

An optimal quantum strategy consists in measuring the maximally entangled state $\ket{\Phi^{+}}=\left(\ket{00}+\ket{11}\right)/\sqrt{2}$ with the following measurements: Alice’s measurements $x=0$ and $x=1$ correspond to the Pauli operators $\sigma_{z}$ and $\sigma_{x}$ respectively and Bob’s measurements $y=0$ and $y=1$ to $\left(\sigma_{z}+\sigma_{x}\right)/\sqrt{2}$ and $\left(\sigma_{z}-\sigma_{x}\right)/\sqrt{2}$ respectively. A box implementing the above achieves winning probability $\omega=\frac{2+\sqrt{2}}{4}\approx 0.85$. Perhaps surprisingly, any box that achieves the optimal quantum winning probability (or close to it) must be implementing a strategy identical to the above up to local isometries (or close to such a strategy) [Popescu and Rohrlich, 1992, Mayers and Yao, 2003, McKague et al., 2012].

The CHSH game can also phrased in the form of a Bell inequality. The most common way of writing the CHSH inequality is as follows. Given $\mathrm{P}_{AB|XY}$, for any pair of inputs $(x,y)$, let

[TABLE]

and denote the CHSH value by

[TABLE]

The CHSH inequality reads

[TABLE]

The interesting regime is $\beta\in[2,2\sqrt{2}]$, where $\beta=2$ is the optimal classical violation while $\beta=2\sqrt{2}$ is the quantum one. The relation between the winning probability in the CHSH game and the CHSH value is given by $\omega=1/2+\beta/8$ and we have $\omega\in\left[\frac{3}{4},\frac{2+\sqrt{2}}{4}\right]$.

When discussing device-independent quantum cryptography in Chapter 11, we use a variant of the CHSH game previously used in [Pironio et al., 2009, Vazirani and Vidick, 2014]. In this game Alice has two inputs $\mathcal{X}=\{0,1\}$ while Bob has three possible inputs $\mathcal{Y}=\{0,1,2\}$. The output sets are $\mathcal{A}=\mathcal{B}=\{0,1\}$. The winning condition is the following:999For the inputs $(x,y)=(1,2)$ one can set either $w_{\text{CHSH}}=1$ or [math] (it is not relevant later on); for completeness we choose $w_{\text{CHSH}}=1$ in this case, following previous works.

[TABLE]

The optimal quantum strategy for this game is the same as in the standard CHSH game, except that if Bob’s input is a $y=2$ he applies the same measurement as Alice’s measurement for input [math]. Since the underlying state is maximally entangled this ensures that their outputs always match when $(x,y)=(0,2)$.

Conditioned on Bob’s input not being $2$, the game played is the CHSH game and the optimal classical and quantum winning probabilities are as above.

3.3 Untrusted devices

Formally defining an untrusted device, or untrusted box, is essential when analysing device-independent information processing tasks. The current section is devoted to explaining what is meant by this term and what are the assumptions regarding an untrusted device. To understand the definition of an untrusted device, it is perhaps best to consider a cryptographic scenario in which the device may be manufactured by the malicious party, the adversary, and hence is not to be trusted. The same definition of a device is used also when we do not have an explicit adversary in mind; the device itself is still uncharacterised (in the sense explained below) but we are free to ignore the additional subsystem given to the adversary in what follows. We therefore employ below the terminology used in the cryptographic setting.

As before, we consider the case of two honest parties. A device $D$ is modelled by a bipartite box $\mathrm{P}_{AB|XY}$, shared between the honest parties, Alice and Bob, who try to accomplish a certain task. We think of the box as being prepared by the adversary Eve and hence we call it untrusted. Since Eve is the one manufacturing the device it allows her, in particular, to keep an extension of Alice and Bob’s device. Formally, we consider a non-signalling extension of $\mathrm{P}_{AB|XY}$ to a tripartite box $\mathrm{P}_{ABC|XYZ}$ (recall Definition 3.1.1): we have

[TABLE]

and Eve “holds” the marginal $\mathrm{P}_{C|Z}$. Eve can use her component $\mathrm{P}_{C|Z}$ as she wishes. For example, in a cryptographic protocol, Eve can eavesdrop on all the classical communication between the honest parties during the run of the protocol and only later choose to use her box with input $z$ that depends on all other information available to her.

When considering non-signalling (super-quantum) boxes, the only constraint on the extension $\mathrm{P}_{ABC|XYZ}$ is that it is non-signalling between the three parties and that the marginal of Alice and Bob is equal to the box $\mathrm{P}_{AB|XY}$. In the quantum case, $\mathrm{P}_{AB|XY}$ describes both the state shared between Alice and Bob $\rho_{Q_{A}Q_{B}}$ and measurements devices used to measure $\rho_{Q_{A}Q_{B}}$. Eve then holds a purification101010A purification $\rho_{Q_{A}Q_{B}E}$ is the most general extension of a quantum state $\rho_{Q_{A}Q_{B}}$, in the sense that it gives Eve the maximal amount of information regarding Alice and Bob’s marginal state. Hence, in the cryptographic setting we always say that Eve holds the purifying system $E$, without loss of generality — any adversary holding a system $E^{\prime}$ which is not the purifying system $E$ can only be weaker than that holding $E$. of Alice and Bob’s quantum state in a quantum register in her possession. The tripartite box $\mathrm{P}_{ABC|XYZ}$ describes the pure state $\rho_{Q_{A}Q_{B}E}$ together with the measurements of Alice and Bob as well as the measurements that can be used by Eve to measure her marginal $\rho_{E}$.111111We emphasise again that Eve is not required to measure her quantum state at any particular point.

Although the device is untrusted, we always assume that the following requirements hold.

Alice and Bob can interact with the device as expected.

In any considered scenario, the type of interaction with the device $D$ is defined explicitly. In particular, every protocol clearly states how the users should interact with the device utilised to run the protocol; for example, a protocol may require the users to play $n$ games with the device (by pressing buttons and recording the outputs) one after the other. The different types of interactions and the resulting conditions on the untrusted device are discussed in Chapter 6. Note that this requirement can be verified – if the honest parties try to use the device in the specified way and the device does not react as expected (e.g., it does not produce outputs or produces outputs from a different alphabet) then it is clear that something is wrong. In this sense, the requirement that it is possible to interact with the device as expected is not really an assumption regarding the device, but rather a formality that allows us to be explicit when talking about untrusted devices.

Communication (signalling) between the components of the device.

The communication between Alice, Bob, and Eve’s components of the device is restricted in the following way:

Alice and Bob’s components of $D$ cannot signal to Eve’s component. 2. 2.

Alice and Bob can decide when to allow communication (if any) between their components. 3. 3.

Alice and Bob can decide when to receive communication (if any) from Eve’s component.

The requirement given in Item 1 is necessary for device-independent cryptography; without it the device could directly send to Eve all the raw data it generated.

Item 2 implies that Alice and Bob’s component must be (at least) bipartite. This is necessary to assure that the violation of the considered Bell inequality is meaningful. In the quantum case, this requirement is identified with the “assumption” that we can write Alice and Bob’s quantum state as a bipartite state $\rho_{Q_{A}Q_{B}}$ and that the measurements made in Alice’s and Bob’s components of the device are in tensor product with one another.

Items 2 and 3 give Alice, Bob, and Eve’s components the possibility to communicate in certain stages of the protocol (see Section 4.2.5 for an explicit example). This is not a restrictive nor necessary assumption. This possibility to communicate is added since it is advantageous to actual implementations of certain protocols. For instance, allowing the different components of the device to communicate in certain stages of some protocols opens the possibility of distributing resources, such as entanglement, “on the fly” for each round of the protocol, instead of maintaining large quantum memories.

Other assumptions.

Apart from the above description of the untrusted device, the following list includes the standard assumptions used in device-independent information processing tasks (in particular, device-independent cryptography):

The honest parties have a trusted random number generator (that can be used to choose the inputs for playing the games, for example). 2. 2.

The honest parties have a trusted classical post-processing units to make the necessary (classical) calculations during the considered task. 3. 3.

There is a public, but authenticated, classical channel connecting the honest parties (if the considered task requires that the parties communicate classically with one another). 4. 4.

In cryptographic scenarios — the honest parties’ physical locations are secure and can be isolated if needed (unwanted information cannot leak outside to Eve or between their devices). 5. 5.

Depending on the considered scenario — the actions of the device can be described within the non-signalling or quantum formalism.

In contrast to an untrusted device, we sometimes use the terminology honest device or honest implementation. A device is said to be honest if it implements the considered protocol by using a certain pre-specified strategy. In that case, the actions of the device are known and fixed. See Section 4.2.4 for an example.

Chapter 4 Introduction to the showcases

4.1 Introduction to non-signalling parallel repetition

Non-local games, introduced in Section 3.2.1, are relevant in many areas of both theoretical physics and theoretical computer science. In the context of parallel repetition, we think of a game $\mathrm{G}$ as follows. A referee asks each of the cooperating parties, also called players, a question chosen according to a given probability distribution. The players then need to supply answers which fulfil a pre-determined requirement according to which the referee accepts or rejects the answers. In order to do so, they can agree on a strategy beforehand, but once the game begins communication between the players is not allowed. If the referee accepts their answers the players win. The goal of the players is, naturally, to maximise their winning probability in the game.

According to the field of interest, one can analyse any non-local game under different restrictions on the players (in addition to not being allowed to communicate). In classical computer science the players are usually assumed to have only classical resources, or strategies. That is, they can use only local operations and shared randomness. In contrast, one can also consider quantum strategies: before the game starts the players create a multipartite quantum state that can be shared among them. When the game begins each player locally measures their own part of the state and bases the answer on their measurement result. Another, more general, type of strategies are those where the players can use any type of correlations that do not allow them to communicate, i.e., non-signalling strategies.

One of the most interesting questions regarding non-local games is the question of parallel repetition. Given a game $\mathrm{G}$ with optimal winning probability $1-\alpha$ (using either classical, quantum, or non-signalling strategies), we are interested in analysing the winning probability in the repeated game, denoted by $\mathrm{G}^{n}$. In $\mathrm{G}^{n}$ the referee gives the players $n$ independent tuples of questions at once, to which the players should reply. The players win $\mathrm{G}^{n}$ if they win all of the $n$ games. Another, more general and natural, winning criterion is that the players answer a certain fraction $1-\alpha+\beta$ of the $n$ game instances correctly. One can then ask what is the probability that the players succeed in the repeated game, as the number of repetitions $n$ increases and whether, in particular, this probability decreases exponentially fast with $n$, similarly to what happens when playing each of the games independently. While the question of parallel repetition is easy to phrase, its answer is far from trivial (and, in fact, up to date there is no general answer that holds for all games).

The device-independent framework fits perfectly to the study of the parallel repetition question: We can think of a box, i.e., a conditional probability distribution, as describing a strategy of the players. The requirement that the players are not allowed to communicate easily translates to non-signalling conditions between the parties holding the box. Furthermore, the claims that we wish to make regarding the probability of winning the repeated game are oblivious of the exact description of the strategy and hence treating the strategy as a black box makes sense. In particular, studying the behaviour of the strategy without having an explicit description of it is necessary in order to be able to use parallel repetition results to, e.g., analyse experiments that aim at ruling-out local realism while performing several Bell violation experiments in parallel or for hardness amplification [Hstad, 2001] in complexity theory and cryptography.

We define and explain the question of parallel repetition below. Our showcase, presented in Chapter 10, focuses on the case of non-signalling parallel repetition. Note, however, that all statements made in the following two sections are general and applicable to any type of strategies. (One only needs to interchange the words non-signalling and quantum or classical).

4.1.1 Parallel repeated games

For simplicity and as in the rest of the thesis, we consider two player non-local games. All of the statements below can be extended to an arbitrary number of players.

We define a two-player game, with the players named Alice and Bob, similarly to a non-local game.111Multi-player games and non-local games are one and the same; we define a two-player game here just to set the terminology used when discussing the showcase of parallel repetition.

Definition \thedefn (Two-player game).

A two-player game $\mathrm{G}=(\mathcal{X},\mathcal{Y},\mathcal{A},\mathcal{B},\mathrm{Q}_{XY},R)$ is defined by:

A set of possible questions for each player: $\mathcal{X}$ for Alice and $\mathcal{Y}$ for Bob. 2. 2.

A probability distribution $\mathrm{Q}_{XY}$ over the questions, according to which the referee choses the questions. 3. 3.

A set of possible answers for each player: $\mathcal{A}$ for Alice and $\mathcal{B}$ for Bob. 4. 4.

A winning condition $R:\mathcal{A}\times\mathcal{B}\times\mathcal{X}\times\mathcal{Y}\rightarrow\{0,1\}$.

In the repeated game, denoted by $\mathrm{G}^{n}$, the referee asks Alice and Bob $n$ questions, all at once. The questions are chosen independently for each game and the answers are checked independently. In most works dealing with parallel repetition, the winning condition of the repeated game is defined such that Alice and Bob win $\mathrm{G}^{n}$ if and only if they win all $n$ repetitions of $\mathrm{G}$ (hence the name). We will use a more general winning condition in which only a certain fraction of the games needs to be won. We call such games threshold games.

Definition \thedefn (Threshold game).

Any two-player game $\mathrm{G}=(\mathcal{X},\mathcal{Y},\mathcal{A},\mathcal{B},\mathrm{Q}_{XY},R)$ induces a two-player threshold game $\mathrm{G}_{1-\gamma}^{n}=(\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n},\mathrm{Q}_{XY}^{\otimes n},R_{1-\gamma}^{n})$, for $0\leq\gamma\leq 1$, where the winning criterion $R_{1-\gamma}^{n}$ is defined by:

[TABLE]

A strategy for a game is simply a box, i.e., a conditional probability distribution, defining the input-output behaviour of the players. Throughout the thesis, a strategy for a single game $\mathrm{G}$ is denoted by $\mathrm{O}_{AB|XY}$. The winning probability of a strategy $\mathrm{O}_{AB|XY}$ in game $\mathrm{G}$ is given by

[TABLE]

When we say that the optimal non-signalling winning probability in a game $\mathrm{G}$ is $1-\alpha$ we mean that

[TABLE]

where the maximisation is over all non-signalling strategies $\mathrm{O}_{AB|XY}$.

A strategy for the threshold game $\mathrm{G}_{1-\gamma}^{n}$ is denoted by $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$’s winning probability in the threshold game is given by

[TABLE]

4.1.2 Threshold theorems

The parallel repetition question is the following. Let $\mathrm{G}$ be a non-local game whose optimal non-signalling winning probability is $1-\alpha$ and let $\mathrm{G}_{1-\gamma}^{n}$ be the threshold game defined by $\mathrm{G}$ (Definition 4.1.1). We then ask — what is the probability that a non-signalling strategy $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ wins $\mathrm{G}_{1-\gamma}^{n}$? The more “standard” parallel repetition question is retrieved by setting $\gamma=0$. The interesting scenario to consider is the one in which $1-\gamma=1-\alpha+\beta$ for $\beta>0$.

The players can always use the trivial independent and identically distributed (IID) strategy for $\mathrm{G}_{1-\alpha+\beta}^{n}$: they simply answer each of the $n$ questions independently according to the optimal non-signalling strategy for $\mathrm{G}$. In this case, the fraction of successful answers is highly concentrated around $1-\alpha$ and the probability to win all games simultaneously is $\left(1-\alpha\right)^{n}$. Thus, for any $\beta>0$, the winning probability in $\mathrm{G}_{1-\alpha+\beta}^{n}$ decreases exponentially fast with $n$.

Can the players do better when using a correlated, i.e., a non-IID, strategy? There are many examples showing that the answer is yes for certain games. One of the most interesting examples to a person studying non-locality is that of two repetitions of the CHSH game. As mentioned in Section 3.2.2, the optimal classical strategy in the CHSH game achieves a winning probability of $3/4$. If the players play two CHSH games in parallel and use the optimal classical strategy of a single game twice, the probability that they win both games is $9/16$. However, there exists a better classical strategy [Barrett et al., 2002]:

[TABLE]

One can easily check that this strategy wins both games with probability $10/16$ and, hence, is better than playing the two games independently. More examples are known for classical games, e.g., [Feige, 1991, Raz, 2011], as well as for quantum and non-signalling games [Kempe and Regev, 2010].

Still, one may ask whether the players can achieve a significantly higher winning probability compared to the IID strategy as $n$ increases. In the IID case the probability of winning more than a fraction $1-\alpha+\beta$ of the games decreases exponentially fast with $n$ and $\beta^{2}$; see Section 7.3.1 for the simple analysis. Does this type of decrease also hold when considering strategies $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ that may correlate the different rounds? If correlated strategies for $\mathrm{G}_{1-\alpha+\beta}^{n}$ are not substantially better than independent ones, even in an asymptotic manner, we learn that “one cannot fight independence with correlations”. As long as the questions are asked, and the answers are verified, in an independent way, creating correlations between the different answers using a correlated strategy cannot help much.

The first exponential parallel repetition theorem was derived for classical two-player games and appeared in [Raz, 1998]: it was shown that if the classical optimal winning probability in a game $\mathrm{G}$ is smaller than 1, then the probability to win all the games in the repeated game, using a classical strategy, decreases exponentially with the number of repetitions $n$. This was improved and adapted to the non-signalling case in [Holenstein, 2007]. Another improvement was made in [Rao, 2011], where a threshold theorem for the classical two-player case was proven: the probability to win more than a fraction $1-\alpha+\beta$ of the games for any $\beta>0$ is exponentially small in $n$.

Following the same proof technique as [Raz, 1998, Holenstein, 2007, Rao, 2011],  [Buhrman et al., 2013] gave a threshold theorem for multi-player non-signalling complete-support games. Their threshold theorem was the first result where more than two players were considered. In [Arnon-Friedman et al., 2016b, Lancien and Winter, 2016] a completely different proof technique, based on de Finetti reductions, was used to derive similar (improved in some respects) results as [Holenstein, 2007, Buhrman et al., 2013].222The de Finetti reduction used in these proofs is the topic of Chapter 8; the non-signalling threshold theorem of [Arnon-Friedman et al., 2016b] acts as one of our showcases and is discussed in Chapter 10.  [Holmgren and Yang, 2017] gave a counter example to a general non-signalling parallel repetition — they show that for a certain three-player game without complete-support the probability of winning$\leavevmode\nobreak\ n$ instances of the game played in parallel remains constant. This implies that the results of [Buhrman et al., 2013, Arnon-Friedman et al., 2016b, Lancien and Winter, 2016] cannot be extended to games without complete-support (as they hold for any number of parties).

The question of parallel repetition in the quantum case is less well understood than its classical and non-signalling versions. The only results applicable to all two-player games is that of [Yuen, 2016], which states that the probability of winning all $n$ instances of the game decreases inverse polynomially with $n$. Exponential decrease is known for different classes of two-player games [Cleve et al., 2008, Kempe et al., 2010, Dinur et al., 2015, Chung et al., 2015] or modifications thereof [Kempe and Vidick, 2011, Bavarian et al., 2017a, Bavarian et al., 2017b].

4.2 Introduction to device-independent quantum cryptography

Classical cryptography relies on computational assumptions, such as the hardness of factoring, to deliver a wide range of functionalities. The advent of quantum information brought forward a completely different possibility: security based only on the fundamental laws of physics. For example, the quantum key distribution (QKD) protocols by Bennett and Brassard [Bennett and Brassard, 1984] and Ekert [Ekert, 1991] allow mutually trustful users connected only by an authenticated classical channel, and an arbitrary quantum channel, to establish a private key whose security is guaranteed by the laws of quantum mechanics. With their private key, the users can communicate with perfect security using, e.g., a one-time pad.

The security of cryptographic protocols such as QKD relies on certain assumptions regarding the physical implementation, such as the quantum states and measurements used in the apparatus implementing the protocol. In real life, however, the manufacturer of the device can have limited technological abilities (and hence cannot guarantee that the device’s actions are exact and non-faulty) or even be malicious. Furthermore, the quantum device may be far too complex for the honest parties running the protocol to open and assess whether it works as alleged. In the cryptographic setting, imperfections in the physical apparatus are of a real concern, even when the manufacture himself is honest and has good intentions. Indeed, when trying to implement quantum devices we find that creating perfect states and measurements is practically impossible. In the presence of an adversary, imperfections and noise in the implementation can and are being exploited to gain information on the outputs of the cryptographic protocols [Fung et al., 2007, Lydersen et al., 2010, Weier et al., 2011, Gerhardt et al., 2011]. This means that if one does not trust that the quantum devices are exactly as supposed to be, due to a potentially incompetent or malicious manufacture, then the security of the protocols no longer holds.

To solve this issue the quantum cryptography community took one step further. In contrast to “standard” quantum cryptographic protocols that are proven to be secure only for specific implementations of the used devices, device-independent quantum cryptographic protocols achieve an unprecedented level of security with guarantees that hold (almost) irrespective of the quality, or trustworthiness, of the physical devices used to implement them and hence count as the “gold standard” of quantum cryptography [Ekert and Renner, 2014]. In device-independent cryptography we let the adversary, called Eve, prepare the quantum devices used in the protocol. The honest parties, Alice and Bob, must therefore treat the possibly faulty or malicious device as an untrusted device (as defined in Section 3.3) with which they can only interact according to the protocol. The protocol must allow them to test the untrusted device and decide whether using it to run the considered cryptographic protocol poses any security risk. The protocol guarantees that by interacting with the device according to the specified steps the honest parties will either abort, if they detect a fault, or produce secure outputs (with high probability). Clearly, the security proof cannot rely on the inner-workings of the device as it may be malicious. Hence, if we are able to prove that the produced outcomes are secure to use, then the statement is inherently independent of the implementation of the physical device (hence the name “device-independent security”).

At first sight, it seems impossible to prove that the outputs of a cryptographic protocol are secure to use when the adversary is the one to manufacture the device. As known for quite some time now, the solution is to base device-independent protocols on the violation of Bell inequalities [Ekert, 1991, Mayers and Yao, 1998, Barrett et al., 2005]. As explained in Section 3.2.1, a Bell inequality can be thought of as a game played by the honest parties using the device they hold. Different devices lead to different winning probabilities when playing the game. The game has a special property – there exists a quantum device which achieves a winning probability $\omega$ greater than all classical, local, devices. Hence, if the honest parties observe that their device wins the game with probability $\omega$ they conclude it must be non-local.333A recent sequence of breakthrough experiments have verified the quantum advantage in non-local games in a loophole-free way [Hensen et al., 2015, Shalm et al., 2015, Giustina et al., 2015]. In the context of device-independent cryptography, the fact that the experiments are “loophole-free” means that the experiments were executed without making assumptions that could otherwise be exploited by Eve to compromise the security of a cryptographic protocol. A non-local game therefore acts as a “test for quantumness”. The idea of basing the security of cryptographic protocols (QKD especially) on the violation of Bell inequalities originates in the celebrated work of Ekert [Ekert, 1991]. Later, Mayers and Yao [Mayers and Yao, 1998] recognised that devices that maximally violate a certain Bell inequality could be fully characterised, up to local degrees of freedom, and thus need not be trusted a priori.

Device-independent security relies on the following deep but well-established facts. High winning probability in a non-local game not only implies that the measured system is non-local but, more importantly, that the kind of non-local correlations it exhibits are “private” – the higher the winning probability, the less information any adversary can have about the devices’ outcomes. The amount of entropy, or secrecy, generated in a single round of the protocol can therefore be calculated from the winning probability in the game. Let us gain some intuition regarding the relation between the winning probability in a non-local game and the knowledge of the adversary about, e.g., Alice’s output in the game by considering two extreme cases – the optimal classical and quantum strategies for the CHSH game.

If the device is classical its local strategy used to win the game can be written as (recall Definition 3.1.3):

[TABLE]

where $\lambda$ describes the “hidden variable” (or shared randomness). $\Pr\left[\Lambda=\lambda\right]$ as well as $\mathrm{P}_{A|X\Lambda}$ and $\mathrm{P}_{B|Y\Lambda}$ are chosen by the adversary and, in particular, $\mathrm{P}_{A|X\Lambda}$ and $\mathrm{P}_{B|Y\Lambda}$ may be deterministic. It is easy to see that in such a case Eve may simply keep a copy of $\lambda$ for herself by extending $\mathrm{P}_{AB|XY}$ to include her system $E$ in the following way:

[TABLE]

where $\mathrm{P}_{E|\Lambda}(e|\lambda)=1$ if $e=\lambda$ and $\mathrm{P}_{E|\Lambda}(e|\lambda)=0$ otherwise. Since $\mathrm{P}_{A|X\Lambda}$ is deterministic, $\lambda$ (and $x$, which is considered to be known to the adversary in most cryptographic protocols) reveals all the information about Alice’s outcome $a$. Hence, Eve has full information about Alice’s outcome.

However, if the device is implementing the optimal quantum strategy then the underlying quantum state and measurements are fully characterised (recall Section 3.2.2). In particular, the state shared between Alice and Bob must be the maximally entangled state. As such, any quantum state held by Eve must be completely uncorrelated with Alice and Bob’s state, i.e., it is of the form

[TABLE]

and hence is uncorrelated with Alice’s measurement outcome. Furthermore, measuring the maximally entangled state using the optimal measurements employed by the device results in a uniformly distributed bit on Alice’s side. In total we get that Alice’s output is completely random from Eve’s perspective. In Section 5.2 we will see a quantitive relation between the knowledge of any adversary and the winning probability in the CHSH game which goes beyond the above two extreme cases.

We use the task of device-independent QKD (DIQKD) as one of the showcases considered in this thesis. In DIQKD the goal of the honest parties, called Alice and Bob, is to create a shared key, unknown to everybody else but them. To execute the protocol they hold a device consisting of two parts: each part belongs to one of the parties and is kept in their laboratories. Ideally, the device performs measurements on some entangled quantum states it contains. The basic structure of a DIQKD protocol was presented as Protocol 1.1. The protocol consists of playing $n$ non-local games with the given untrusted device and calculating the average winning probability from the observed data (i.e., Alice and Bob’s inputs and outputs). If the average winning probability is below the expected winning probability $\omega_{\mathrm{exp}}$ defined by the protocol, Alice and Bob conclude that something is wrong and abort the protocol. Otherwise, they apply classical post-processing steps that allow them to create identical and uniformly distributed keys. (The full description of the DIQKD protocol considered in the analysis performed in the following chapters is given in Section 4.2.2 below).

[Barrett et al., 2005] were the first to derive a “proof of concept”444The protocol of [Barrett et al., 2005] could not tolerate any amount of noise and produced just one secret bit when using the device many times (i.e. the key rate is zero); we therefore consider it to be a “proof of concept” showing that device-independent security is possible to achieve. of the security of DIQKD. Following that an extended line of research has explored the application of the device-independence paradigm to multiple cryptographic tasks. A partial list includes QKD [Barrett et al., 2005, Pironio et al., 2009, Vazirani and Vidick, 2014, Reichardt et al., 2013, Miller and Shi, 2014], randomness expansion [Colbeck, 2006, Pironio et al., 2010, Vazirani and Vidick, 2012, Coudron and Yuen, 2013, Miller and Shi, 2014] and amplification [Colbeck and Renner, 2012, Gallego et al., 2013a, Chung et al., 2014, Brandão et al., 2016, Kessler and Arnon-Friedman, 2017], verified quantum computation [Reichardt et al., 2013, Gheorghiu et al., 2015, Hajdušek et al., 2015, Coladangelo et al., 2017], bit commitment [Aharon et al., 2015] and weak string erasure [Kaniewski and Wehner, 2016].

The following sections present the preliminary knowledge needed when considering our showcase of device-independent quantum cryptography in the upcoming chapters. Specifically, in Section 4.2.1 we explain what is meant when talking about the security of DIQKD and present the formal security definitions. Sections 4.2.2 and 4.2.3 describe our DIQKD protocol and explain what is the main challenge in any security proof. Section 4.2.4 includes a possible implementation of the protocol in the honest (i.e., non-adversarial) case while Section 4.2.5 describes the assumptions made regarding a potentially malicious device. The security analysis itself is presented as a showcase in later chapters. In particular, the full security proof, which previously appeared in [Arnon-Friedman et al., 2016c], is given in Chapter 11.

4.2.1 DIQKD security definitions

A DIQKD protocol consists of an interaction between two trusted parties, Alice and Bob, and an untrusted device as defined in Section 3.3. At the end of the protocol each party outputs a key of length $\ell$, $\tilde{K}_{A}$ for Alice and $\tilde{K}_{B}$ for Bob. The goal of the adversary, Eve, is to gain as much information as possible about Alice and Bob’s keys without being detected (i.e., in the case where the protocol is not being aborted).

Correctness, secrecy, and overall security of a DIQKD protocol are defined as follows (see also [Portmann and Renner, 2014, Beaudry, 2015]):

Definition \thedefn (Correctness).

A DIQKD protocol is said to be $\varepsilon_{corr}$-correct, when implemented using a device $D$, if Alice and Bob’s keys, $\tilde{K}_{A}$ and $\tilde{K}_{B}$ respectively, are identical with probability at least $1-\varepsilon_{corr}$. That is, $\Pr(\tilde{K}_{A}\neq\tilde{K}_{B})\leq\varepsilon_{corr}$.555We use the convention that when the protocol aborts, $\tilde{K}_{A}=\tilde{K}_{B}=\perp$.

Definition \thedefn (Secrecy).

A DIQKD protocol is said to be $\varepsilon_{sec}$-secret, when implemented using a device $D$, if for a key of length $\ell$,666$\ell$ can be thought of as a parameter of the protocol. In what follows, we set $\ell$ in terms of the other parameters of the protocol, such that secrecy holds for the protocol.

[TABLE]

where $\Pr[\text{abort}]$ is the probability that the protocol aborts when running using device $D$ and $\rho_{\tilde{K}_{A}E}$ is Alice and Eve’s quantum state in the end of the protocol, conditioned on not aborting, with $E$ a quantum register holding Eve’s state that may initially be correlated with $D$.

$\varepsilon_{sec}$ in the above definition can be understood as the probability that some non-trivial information leaks to the adversary [Portmann and Renner, 2014].

If a protocol is $\varepsilon_{corr}$-correct and $\varepsilon_{sec}$-secret (for a given $D$), then it is $\varepsilon_{\mathrm{QKD}}^{s}$-correct-and-secret for any $\varepsilon_{\mathrm{QKD}}^{s}\geq\varepsilon_{corr}+\varepsilon_{sec}$.

Definition \thedefn (Security).

A DIQKD protocol is said to be $(\varepsilon_{\mathrm{QKD}}^{s},\varepsilon_{\mathrm{QKD}}^{c})$-secure if:

(Completeness) There exists an honest implementation of the device $D$ such that the protocol does not abort with probability greater than $1-\varepsilon_{\mathrm{QKD}}^{c}$. 2. 2.

(Soundness) For any implementation of the device $D$, the protocol is $\varepsilon_{\mathrm{QKD}}^{s}$-correct-and-secret.

The protocols that we consider below take into account possible noise in the honest implementation. That is, even when there is no adversary at all, the actual implementation of the devices might not be perfect. This should be taken into account when proving the completeness of the protocol – completeness must be proven for noisy but honest devices (as otherwise the protocol is of no real use). By doing so we get that the completeness of the protocol implies its robustness to the desired amount of noise.

Lastly, a remark regarding the composability of this security definition is in order. A security definition is said to be composable [Canetti, 2001, Ben-Or and Mayers, 2004, Portmann and Renner, 2014] if it implies that the protocol can be used arbitrarily and composed with other protocols (proven secure by themselves), without compromising security. Obviously, if Alice and Bob wish to use the keys they produced in a DIQKD protocol in some other cryptographic protocol (i.e., they compose the two protocols), it is necessary for them to use protocols which were proven to have composable security.

For the case of (device-dependent) QKD, Definition 4.2.1 was rigorously proven to be composable [Portmann and Renner, 2014]. This suggests that the same security definition should also be the relevant one in the device-independent context and, indeed, as far as we are aware, it is the sole definition used in works on DI cryptography. Nevertheless, the claim that Definition 4.2.1 is composable for device-independent protocols as well has never been rigorously proven. Even worse, there is some evidence indicating that the definition is not composable when the same devices are being reused in the composition. Let us briefly explain that.

[Barrett et al., 2013] highlighted a simple fact: A malicious device may store the raw data used to create the key in a first execution of the DIQKD protocol and then, when reusing the device to execute the protocol for the second time (or any other protocol for that matter), leak the raw data from the first run.777This should not be confused with “reusing” the device in a given execution of the protocol, i.e., playing many non-local games with the same physical device. Our security definition, Definition 4.2.1, deals only with a single execution of the protocol and, hence, does not address this type of attack. In other words, even when proving that the considered protocol is secure according to Definition 4.2.1, the above attack can still be performed by a malicious device when composing two protocols that utilise the same device. This implies that, as is, the security definition is not composable. Note that the same issue does not arise when considering device-dependent protocols; there, by assumption, the devices do not keep any information in their memory after the end of the execution of the protocol.

Even given the above, Definition 4.2.1 seems like the most promising security definition to date. We therefore stick to it here. This implies that, as in all other works, after the end of the protocol the device cannot be used again in an arbitrary way.

4.2.2 DIQKD protocol

Our protocol for DIQKD is described as Protocol 4.1. An honest implementation of a device that can be used to run the protocol is described in Section 4.2.4.

In the first part of the protocol Alice and Bob use their devices to produce the raw data by playing $n$ CHSH games one after the other. Specifically, in each round Alice and Bob randomly choose whether the round is going to be a test round or a generation round ($T_{i}=1$ or $T_{i}=0$, respectively, in Protocol 4.1). This can be done using classical communication or shared public randomness. In both cases, this information becomes available to Eve during the execution of the protocol. (Crucially, she does not know in advance, i.e., before supplying the devices to Alice and Bob, which rounds are going to be test rounds). The inputs used by Alice and Bob in each round depend on whether it is a test or generation round; see Protocol 4.1.

In the second part of the protocol Alice and Bob apply classical post-processing steps to produce their final keys. We choose classical post-processing steps that optimise the key rate but may not be optimal in other aspects, e.g., computation time. The protocol and the analysis presented in Chapter 11 can easily be adapted for other choices of classical post-processing.

We now describe the three post-processing steps, error correction, parameter estimation, and privacy amplification in detail.888In many QKD protocols there is an additional step called “sifting”; in the sifting step Alice and Bob announce their choice of measurements in the different rounds so that they can ignore the rounds that do not contribute to parameter estimation or the generation of the key (for example, in protocols like BB84 [Bennett and Brassard, 1984] Alice and Bob ignore the rounds in which they chose non-identical measurements). Sifting is not necessary in our case since in Step 11 of Protocol 4.1 Alice and Bob choose $T_{i}$ together (or exchange its value between them) in every round of the protocol and choose their inputs accordingly. This is in contrast to choosing Alice and Bob’s inputs from a product distribution and then adding a sifting step. It follows from our proof technique that making $T_{i}$ public as we do does not compromise the security of the protocol.

Error correction

An essential property of any QKD protocol is its correctness – Alice and Bob should hold identical keys in the end of the protocol (see Definition 4.2.1). Since the raw data of the two parties may differ in parts, Alice and Bob need to run an error correction protocol (also termed an “information reconciliation protocol” in the literature). An error correction protocol999Note that we are discussing classical error correction protocols, not to be confused with the task of quantum error correction [Gottesman, 2010]. starts by the exchange of classical information between Alice and Bob that should help the parties agree on the final key. When the communication is only from one party to the other, the protocol is said to be a “one-way error correction protocol”. By sending classical information about the raw data over a public classical channel the uncertainty of the adversary regarding the key decreases. A good error correction protocol therefore needs to minimise the amount of communication, or leakage, while still allowing to correct the errors with high probability.

In the considered DIQKD protocol, Alice and Bob use an error correction protocol $\mathrm{EC}$ to obtain identical raw keys $K_{A}$ and $K_{B}$ from their raw data $\mathbold{A},\tilde{\mathbold{B}}$.101010It will become clear in Section 11.3 why we use here $\tilde{B}_{i}$ rather than $B_{i}$. Although it is not relevant at the moment, we keep it like this for the sake of consistency. We use a one-way error correction protocol, based on universal hashing, which minimises the amount of leakage to the adversary [Brassard and Salvail, 1993, Renner and Wolf, 2005] (see also [Beaudry, 2015, Section 3.3.2] for more details). To implement $\mathrm{EC}$ Alice chooses an hash function and sends the chosen function and the hashed value of her bits to Bob. We denote this classical communication by $O$ and the number of bits of $O$ by $\mathrm{leak_{EC}}$. Bob uses $O$, together with all his prior knowledge $\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T}$, to compute a guess $\hat{\mathbold{A}}$ for Alice’s bits $\mathbold{A}$.111111The idea is basically the following – given the output of the hash function, there is a small set of possible strings (from the domain of the function) compatible with it; Bob then chooses the one which is most compatible to his prior knowledge about Alice’s key [Brassard and Salvail, 1993, Section 4]. If $\mathrm{EC}$ fails to produce a good guess the protocol aborts; in an honest implementation this happens with probability at most $\varepsilon_{\mathrm{EC}}^{c}$. The probability of Alice and Bob not aborting and while holding non-identical keys is at most $\varepsilon_{\mathrm{EC}}$.

The following guarantee holds for the described protocol [Renner and Wolf, 2005, Renner, 2008]:

[TABLE]

for any $\varepsilon_{\mathrm{EC}}^{c},\;\varepsilon^{\prime}_{\mathrm{EC}},\;\varepsilon_{\mathrm{EC}}\in[0,1]$ such that $\varepsilon^{\prime}_{\mathrm{EC}}=\varepsilon_{\mathrm{EC}}^{c}-\varepsilon_{\mathrm{EC}}$ and where $H_{0}^{\varepsilon^{\prime}_{\mathrm{EC}}}(\mathbold{A}|\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T})_{\rho^{\text{honest}}}$ is the smooth zero-entropy (Definition 2.5.2) evaluated on the state $\rho^{\text{honest}}$ used in an honest implementation of the protocol.121212For quantum channels with an IID noise model $H_{0}^{\varepsilon^{\prime}_{\mathrm{EC}}}\left(\mathbold{A}|\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T}\right)_{\rho^{\text{honest}}}$ can be bounded by above using the asymptotic equipartition property, discussed in Section 7.2.2. The explicit calculation is done in Section 11.3.3. Equation (4.2) presents the tradeoff between the probability of having non-identical keys after the end of the protocol ($\varepsilon_{\mathrm{EC}}$), the probability of the protocol not succeeding in the honest case ($\varepsilon_{\mathrm{EC}}^{c}$), and the number of bits leaked to the adversary in the process ($\mathrm{leak_{EC}}$). The amount of communication during the error correction protocol is chosen, before running the DIQKD protocol, such that Equation (4.2) holds. If more errors than expected in the honest implementation occur when running the DIQKD protocol (due to the use of adversarial or too noisy devices), then Bob may not have a sufficient amount of information to obtain a good guess of Alice’s bits and hence will not be able to correct the errors. If so, this will be detected with probability at least $1-\varepsilon_{\mathrm{EC}}$ and the protocol will abort.

Parameter estimation

The goal of the parameter estimation step is to check whether the device $D$, used to run the protocol, is sufficiently good in order to produce a secret key. In the case of device-independent protocols the quantity to be considered is the number of games won during the run of the protocol. If the number of games won is not large enough, the honest parties conclude that the device cannot be used to produce a secure key (an adversary may be present). Specifically, we require that the number of games won, $\sum_{j:T_{j}=1}W_{j}$, fulfils

[TABLE]

where $\omega_{\mathrm{exp}}$, $\gamma$, and $\delta_{\mathrm{est}}$ are parameters of the protocol. $\gamma$ is the probability of a test round while $\omega_{\mathrm{exp}}$ is the expected winning probability (of an honest device). Thus, the multiplication $\omega_{\mathrm{exp}}\gamma$ gives the expected fraction of games won out of all rounds of the protocol. $\delta_{\mathrm{est}}$ describes the desired confidence interval (which cannot be zero since we consider a finite number of rounds $n$).

After the error correction step described above, Bob has all of the relevant information to perform parameter estimation from his data alone, without any further communication with Alice.131313In many QKD protocols error correction is performed after the parameter estimation step. In such cases, Alice and Bob reveal the data collected in the test rounds and use it for parameter estimation. Further information is then communicated during the error correction step. Using his raw data $\tilde{\mathbold{B}}$ and his guess of Alice’s key $K_{B}$, Bob sets

[TABLE]

where $w_{\text{CHSH}}$ is the CHSH winning condition given in Equation (3.8). Bob aborts if the fraction of successful game rounds is too low, that is, if Equation (4.3) is not fulfilled.

As Bob does the estimation using his guess of Alice’s bits, the probability of aborting in this step in an honest implementation, $\varepsilon_{\mathrm{PE}}^{c}$, is bounded by

[TABLE]

Privacy amplification

The final classical post-processing step is that of privacy amplification. The goal of privacy amplification is to take Alice’s raw key141414Note that Alice’s and Bob’s raw keys, $\mathbold{A}$ and $\hat{\mathbold{A}}$ respectively, are identical with high probability, due to the error correction step. As we now explain, in the privacy amplification step Alice and Bob can perform the exact same actions so that they end with identical final keys (assuming that the error correction step was successful). Thus, we describe here only Alice’s actions, while keeping in mind that Bob is going to perform the same steps on his raw key. $\mathbold{A}$, on which the adversary may have partial information, and transform it to a secret final key, as required by the secrecy definition of the protocol (Definition 4.2.1). To this end, Alice applies a quantum-proof randomness extractor, defined as follows.

Definition \thedefn (quantum-proof strong extractor).

A function $\mathrm{Ext}:\{0,1\}^{n}\times\{0,1\}^{d}\rightarrow\{0,1\}^{\ell}$ that takes as an input a string $\mathbold{A}\in\{0,1\}^{n}$ together with a seed $S\in\{0,1\}^{d}$ and outputs a string $\tilde{K}_{A}\in\{0,1\}^{\ell}$ (for $\ell\leq n$) is called a quantum-proof $(m,\varepsilon_{\mathrm{PA}})$-strong extractor if for any $\rho_{\mathbold{A}E}$ with $H_{\min}(\mathbold{A}|E)_{\rho}\geq m$ and uniformly distributed seed $S$ we have

[TABLE]

Several constructions of extractors have been shown to be fulfil the above definition, among them [Renner and König, 2005, Konig and Terhal, 2008, Fehr and Schaffner, 2008, De et al., 2012]. Different constructions are used in different scenarios; for example, some constructions minimise the length $d$ of the seed while others maximise the output length $\ell$ or the computation time needed to apply the extractor.

Before continuing, an important (though somewhat technical) remark is in order. An extractor, as above, is defined with respect to the min-entropy. However, it is the smooth min-entropy $H_{\min}^{\varepsilon_{\mathrm{s}}}(\mathbold{A}|E)_{\rho}$, rather than the min-entropy, that is known to give a tight bound on the maximum amount of uniform randomness that can be extracted from $\mathbold{A}$ while being independent from $E$ [Konig et al., 2009]. If one is interested in using an extractor when starting with a lower bound on the smooth min-entropy, then some parameters should be adapted. In particular, $\varepsilon_{\mathrm{PA}}$ appearing in Equation (4.5) is the error probability of the extractor when it is applied on a normalised state satisfying the relevant min-entropy condition. For universal hashing [Renner and König, 2005] for example, when only a bound on the smooth min-entropy is supplied the smoothing parameter $\varepsilon_{\mathrm{s}}$ should be added to the error $\varepsilon_{\mathrm{PA}}$ (as done below). When working with other extractors one should adapt the parameters accordingly; see [Arnon-Friedman et al., 2016a, Section 4.3].

For simplicity we use universal hashing [Renner and König, 2005, Tomamichel et al., 2010b] as our privacy amplification protocol $\mathrm{PA}$.151515Any other quantum-proof strong extractor, e.g., Trevisan’s extractor [De et al., 2012], can be used for this task and the analysis done in Chapter 11 can be easily adapted. The secrecy of the final key $\tilde{K}_{A}=\mathrm{Ext}(\mathbold{A},S)$ depends only on the privacy amplification protocol used and the value of $H^{\varepsilon_{\mathrm{s}}}_{\min}(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}OE)$, evaluated on the state at the end of the protocol, conditioned on not aborting. For universal hashing, for any $\varepsilon_{\mathrm{PA}},\varepsilon_{\mathrm{s}}\in(0,1)$ a secure key of maximal length [Tomamichel et al., 2010b]

[TABLE]

is produced with probability at least $1-\varepsilon_{\mathrm{PA}}-\varepsilon_{\mathrm{s}}$.

4.2.3 Main task of a security proof

After presenting the DIQKD protocol and the relevant security definition we are equipped with the necessary information needed to explain what the main task is when proving security of a DIQKD protocol. First, note that in order to prove security one needs to prove both the correctness (Definition 4.2.1) and the secrecy (Definition 4.2.1) of the protocol. Correctness follows almost directly from the error correction step performed in the protocol. We therefore focus below on the secrecy of the protocol.

Returning to the secrecy requirement of a DIQKD protocol given in Definition 4.2.1 and the definition of a quantum-proof extractor as in Definition 4.2.2, we see that by applying the extractor we assure that the output of the extractor $\tilde{K}_{A}=\mathrm{Ext}(\mathbold{A},S)$ is $\varepsilon_{\mathrm{PA}}$-close to an ideal key, i.e., a uniform key of $m$ bits that is completely independent of the overall side-information $SE$161616We include the seed $S$ as part of the side-information and ask that the output of the extractor is close to uniform even conditioned on the seed $S$. Extractors that fulfil this requirement are called “strong extractors” (while those that fulfil the weaker condition $\|\rho_{\mathrm{Ext}(\mathbold{A},S)E}-\rho_{U_{\ell}}\otimes\rho_{E}\|_{1}\leq\varepsilon_{\mathrm{PA}}$ are termed “weak extractors”). When considering QKD protocols, one needs to use a strong extractor since the seed $S$ is to be communicated between Alice and Bob and hence should be considered as information which leaks to the adversary. and hence the protocol is secret.

For the extractor to work, the raw data $\mathbold{A}$ must exhibit a sufficient amount of min-entropy (by definition). Relations for specific extractor, such as the one given in Equation (4.6), determine the length of the key that can be extracted for a given amount of (smooth) min-entropy. Therefore, the main task of any security proof of a protocol applying an extractor boils down to computing a lower bound on the (smooth) min-entropy. Indeed, the security proofs presented in Section 7.3.2 and Chapter 11 are focused on deriving such bounds.

4.2.4 The honest implementation

The honest implementation of the device $D$ describes the way the device acts when an adversary is not present. In other words, this is the device Alice and Bob expect to share when the manufacture of the device is not malicious and “everything goes according to the plan”. In the analysis of DIQKD the description of the honest implementation is used in two places. Firstly, the completeness of the protocol (recall Definition 4.2.1) is proven with respect to the chosen honest implementation. Secondly, it is used to set the amount of communication between Alice and Bob during the error correction step, according to the relation presented in Equation (4.2). We remark that these are the only two places in the proof where the choice of honest implementation is taken into account and both are used solely for choosing the parameters of the protocol. Critically, the soundness proof does not depend in any way on the choice of honest implementation.

The chosen honest implementation may also be noisy. In fact, in an experiment, the mathematical description of the honest device, or honest boxes, should be chosen to fit the behaviour of the physical systems as accurately as possible. An accurate description allows us carefully choose the parameters of the DIQKD protocol (e.g., $\omega_{\mathrm{exp}}$) such that the produced key rate is maximised while keeping the probability of the protocol aborting, when utilising the honest device, small. That is, an accurate description allows us to construct a protocol which is useful in practice.

Most commonly, one chooses the honest implementation to be an IID one. That is, that device $D$ acts in an IID manner: in every round $i\in[n]$ of the protocol $D$ performs the measurements $\mathcal{M}_{x_{i}}^{a_{i}}\otimes\mathcal{M}_{y_{i}}^{b_{i}}$ on Alice and Bob’s state $\sigma_{Q_{A}Q_{B}}$. That is, the device is initialised with an IID bipartite state, $\sigma_{Q_{A}Q_{B}}^{\otimes n}$, on which the device makes IID measurements. The state $\sigma_{Q_{A}Q_{B}}$ and measurements are such that the winning probability achieved in the CHSH game in a single round is $\omega_{\mathrm{exp}}$.171717Note that in our notation, the noise that affects the winning probability in the CHSH game is already included in $\omega_{\mathrm{exp}}$.

As a concrete example, one possible realisation of such an implementation is the following. Alice and Bob share the two-qubit Werner state

[TABLE]

for $\ket{\Phi^{+}}=1/\sqrt{2}\left(\ket{00}+\ket{11}\right)$ and $\nu\in[0,1]$. The state $\sigma_{Q_{A}Q_{B}}$ arises, e.g., from the state $\ket{\Phi^{+}}$ after going through a depolarisation channel. We can therefore think of the over all state $\sigma_{Q_{A}Q_{B}}^{\otimes n}$ as resulting from the transmission of $\ket{\Phi^{+}}^{\otimes n}$ using an IID noisy channel. For every $i\in[n]$, Alice’s measurements $X_{i}=0$ and $X_{i}=1$ correspond to the Pauli operators181818Even though both are denoted by $\sigma$, do not confuse our bipartite state $\sigma_{Q_{A}Q_{B}}$ describing the honest state with the Pauli operators $\sigma_{x}$ and $\sigma_{z}$ defined in Equation (2.4). $\sigma_{z}$ and $\sigma_{x}$ respectively and Bob’s measurements $Y_{i}=0$, $Y_{i}=1$, and $Y_{i}=2$ to the Pauli operators $\frac{\sigma_{z}+\sigma_{x}}{\sqrt{2}}$, $\frac{\sigma_{z}-\sigma_{x}}{\sqrt{2}}$ and $\sigma_{z}$ respectively. The winning probability in the CHSH game (restricted to $X_{i},Y_{i}\in\{0,1\}$) using these measurements on $\sigma_{Q_{A}Q_{B}}$ is

[TABLE]

and the quantum bit error rate is given by

[TABLE]

4.2.5 Model of an arbitrary device

As previously mentioned, Alice and Bob’s device is considered to be an untrusted device, as defined in Section 3.3.

On top of the general statements made in Section 3.3, we can further describe the untrusted device in the case of DIQKD as follows. Alice and Bob interact with $D$ according to Protocol 4.1. Alice and Bob’s components of $D$ implement the protocol by making sequential measurements on quantum states. In each round of the protocol, we say that the device is implementing some strategy for the CHSH game. The device may have memory, and thus apply a different strategy each time the game is played, depending on the previous rounds. Therefore, the measurement operators may change in each round, and the state on which the measurements are performed may be the post-measurement state from the previous round, a new state, or any combination of these two.

To be specific, we consider the following scenario. In-between different rounds of the protocol, Alice and Bob’s components of the device are allowed to communicate freely. During the execution of a single round, however, no communication is allowed. In particular, when the game is being played, there is no communication between the components once the honest parties’ inputs are chosen and until the outputs are supplied by the device. That is, communication is allowed in every round $i$ right after Step 13 is done, and until the beginning of round $i+1$, i.e., before $T_{i+1}$ is chosen in Step 11. Furthermore, in-between rounds Eve may send information to the device, but not receive any from it. In actual implementations this implies that entanglement can be distributed “on the fly” for each round of the protocol, instead of maintaining large quantum memories.

Section 3.3 includes a list of standard assumptions made when working with device-independent protocols. The following list includes the assumptions that are made when proving the security of DIQKD:

Alice and Bob have a trusted random number generator. 2. 2.

Alice and Bob have trusted classical post-processing units. 3. 3.

There is a public, but authenticated, classical channel connecting the honest parties. 4. 4.

Alice’s and Bob’s physical locations are secure (unwanted information cannot leak outside to Eve. 5. 5.

Quantum physics is correct.

Chapter 5 Single-round box

In the device-independent framework we use “boxes” to describe the physical devices, or resources, of interest. A box, formally modelled as a conditional probability distribution (recall Section 3.1), is always defined with respect to a specific task or protocol. More specifically, note the following:

To define a box $\mathrm{P}_{AB|XY}$ we need to fix the sets of the inputs $\mathcal{X},\mathcal{Y}$ and the outputs $\mathcal{A},\mathcal{B}$ of the box. These sets are chosen according to the task in which the box is being used. For example, if a box is used to play a single CHSH game then the sets are all chosen to be $\{0,1\}$. The box’s action is undefined when it is used with, e.g., the input $x=2$. 2. 2.

The location of the used devices in space (or space-time) also sets the conditions that the box describing the devices must fulfil. For example, if a protocol demands two devices, separated in space, that cannot communicate during the execution of the protocol then the defined box should fulfil certain non-signalling conditions.111Interestingly, if one considers protocols with more than two parties in which the devices can only be used in specific space-time coordinates and merely assumes that the box modelling the devices respects relativistic causality (in the sense that it cannot lead to casual loops) then the conditions defining the box are different than the non-signalling ones [Horodecki and Ramanathan, 2016]. This acts as another example for how the specific use of the devices effects the mathematical model of the box. 3. 3.

When considering boxes that are used to execute a complex protocol, in which many games are being played with the box (as done in the succeeding chapters), we also need to take into account the type of interaction when defining the box. For example, some protocols require boxes with which we can interact sequentially – in each round of the protocol we give one input to the box, wait for the output, and only then give the next input. Other protocols involve boxes which accepts all the inputs and only then produces all the outputs. If we only give one input to such a box we do not expect it to output anything and its action is undefined. Thus, these differences in the behaviour of the boxes depend on the way we intend to use it in the task of interest and effect the mathematical model of the considered boxes.

To grasp the dependence of the box on the considered task, as described above, one can contrast it with the standard formalism used to define quantum states and measurements. For example, the definition of a quantum state in terms of a density operator is completely independent of the way we might want to measure it. Consider, for example, a quantum state used to play the CHSH game with the measurements $\sigma_{x}$ and $\sigma_{z}$ for one of the parties. Even though we only intend to perform these measurements, the formalism also tells us what will happen if we choose to measure $\sigma_{y}$ instead. This stands in contrast to Item 1 above.222One can rightfully say that this property of boxes, among several other properties, renders them an “unphysical description” of real systems and resources. With this respect, the formalism of the so called “generalised probabilistic theories” [Barrett, 2007, Chiribella et al., 2010] is a more appropriate mathematical setting to discuss physical theories which extend, or abstract, quantum physics. In contrast, boxes are merely a simplified mathematical model sufficient for certain analyses.

The current chapter as well as Chapter 6 are devoted to the way one models the different boxes used in device-independent information processing, depending on the considered setting and interaction with the boxes. In Chapter 6 we will be interested in boxes, or devices, which can be used to implement certain protocols. Before we explain how such boxes can be described let us focus on a simpler object – the “single-round box”.

We think of a single-round box as a small device that can be used to play a single round of a Bell game. That is, in the case of the CHSH game, for example, Alice and Bob can input their bits $x,y\in\{0,1\}$ to the box and receive the outcomes $a,b\in\{0,1\}$. After that the box can no longer be used (i.e., Alice and Bob cannot play another game with it). Mathematically, such a box can be described by a non-signalling conditional probability distribution $\mathrm{P}_{AB|XY}$ as explained in Section 3.1. Physically, an example of a single-round box is a single EPR pair together with a set of possible measurements for each party.

A single-round box is not a useful resource in the operational sense. Since our starting point in the device-independent setting is that we do not know how the device operates, we must interact with it to test it. However, since a single-round box allows us to play just a single game we can hardly conclude anything regarding its inner-working. One can imagine Alice and Bob playing the CHSH game with their box and observing $(a,b,x,y)=(0,0,0,0)$. Then what? It can always be the case that they are sharing a classical device that always outputs $(a,b)=(0,0)$ for the inputs $(x,y)=(0,0)$. Thus, Alice and Bob cannot learn anything regarding, e.g., the randomness of their outputs, from this single game. As the information collected in a single game is not sufficient to test the box we start, instead, with an assumption regarding the box, e.g., that it can be used to win the CHSH game with winning probability $\omega$. As will be shown below, various fundamental properties can be concluded by starting with such an assumption.

Although a single-round box is not a valuable resource in practice, it is useful as a simple abstract object that allows us to study the fundamental implications of violating a Bell inequality (while putting aside many technical details that arise when considering the complex devices used in protocols). Furthermore, it is the goal of this thesis to explain how “single-round box statements” can be lifted to operational statements regarding more complex scenarios such as the analysis of device-independent protocols.

5.1 The model

Mathematically, we model a single-round black box by a non-signalling conditional probability distribution $\mathrm{P}_{AB|XY}$ that can be used to play a single Bell game $\mathrm{G}$ defined over the sets of inputs $\mathcal{X},\mathcal{Y}$ and outputs $\mathcal{A},\mathcal{B}$ for Alice and Bob (see Section 3.2.1 for complete definitions). $\mathrm{P}_{AB|XY}$ is also sometimes referred to as a strategy for $\mathrm{G}$.

As mentioned above, when considering single-round boxes one usually assumes that the box $\mathrm{P}_{AB|XY}$ can be used to win the game with a certain winning probability $\omega$. That is, $\mathrm{P}_{AB|XY}$ is such that

[TABLE]

where the expectation $\mathbb{E}_{x,y}$ is defined with respect to the input distribution of the considered game and $w:\mathcal{A}\times\mathcal{B}\times\mathcal{X}\times\mathcal{Y}\rightarrow\{0,1\}$ is the winning function of the game.

Depending on the context, one can consider quantum single-round boxes or non-signalling ones.

Quantum single-round boxes

When we say that a single-round box is quantum we mean that its inner-working can be described within the quantum formalism. Specifically:

Definition \thedefn (Quantum single-round box).

Given a Bell game $\mathrm{G}$, a quantum single-round box is a quantum box $\mathrm{P}_{AB|XY}$, as in Definition 3.1.2, defined for the inputs and outputs of the game $\mathrm{G}$ – $\mathcal{X},\mathcal{Y},\mathcal{A},\mathcal{B}$. That is, there exist a bipartite state $\rho_{Q_{A}Q_{B}}$ and measurements $\{M^{x}_{a}\}$ and $\{M^{y}_{b}\}$ such that

[TABLE]

The quantum single-round box is said to win $\mathrm{G}$ with winning probability $\omega$ when the state and measurements are such that Equation (5.1) holds.

Note that mathematically a quantum single-round box is merely a quantum box (Definition 3.1.2). What makes it single-round is that $\mathrm{P}_{AB|XY}$ is defined for the inputs and outputs of a single game $\mathrm{G}$.

When considering cryptographic applications where a quantum adversary is present we extend the box to the adversary. That is, we let $\rho_{Q_{A}Q_{B}E}$ be the purification of $\rho_{Q_{A}Q_{B}}$ where $E$ is a quantum register belonging the the adversary and $\rho_{Q_{A}Q_{B}}=\mathrm{Tr}_{E}\left(\rho_{Q_{A}Q_{B}E}\right)$ is Alice and Bob’s marginal satisfying Equations (5.1) and (5.2).

Non-signalling single-round boxes

Instead of restricting our attention to quantum boxes we can also consider non-signalling single-round boxes. These are defined in a similar way to their quantum counterparts.

Definition \thedefn (Non-signalling single-round box).

Given a Bell game $\mathrm{G}$, a non-signalling single-round box is a non-signalling box $\mathrm{P}_{AB|XY}$, as in Definition 3.1.1, defined for the inputs and outputs of the game $\mathrm{G}$ – $\mathcal{X},\mathcal{Y},\mathcal{A},\mathcal{B}$. That is, for all $a\in\mathcal{A}$, $b\in\mathcal{B}$, $x,x^{\prime}\in\mathcal{X}$ and $y,y^{\prime}\in\mathcal{Y}$,

[TABLE]

The non-signalling single-round box is said to win $\mathrm{G}$ with winning probability $\omega$ when $\mathrm{P}_{AB|XY}$ is such that Equation (5.1) holds.

Here as well one can consider an extension of the single-round box to an additional party describing a non-signalling (super-quantum) adversary. This will not be needed in this thesis so we do not explain how this is done. The interested reader is referred to [Hänggi, 2010, Section 3.2].

5.2 Showcase: device-independent quantum cryptography

As mentioned above, a single-round box is useful as a simple abstract object that allows us to study the fundamental implications of violating a Bell inequality. More specifically, certain properties of the box can be concluded if we assume to know the probability of winning a Bell game using a single-round box described by $\mathrm{P}_{AB|XY}$. We consider out showcase of device-independent cryptography as an example.

The most crucial observation when considering device-independent cryptographic protocols is the fact that high winning probability in a Bell game not only implies that the measured system is non-local, but more importantly that the kind of non-locality it exhibits cannot be shared: the higher the winning probability, the less information any eavesdropper can have about the outcomes produced by the box.

There are different ways of making such a statement quantitive. One possible way (that will also be of relevance later on) is to consider the conditional von Neumann entropy $H(A|XYE)$ where $A$ is the random variable describing Alice’s outcome bit, $X$ and $Y$ are the random variables describing the inputs of Alice and Bob and $E$ is a quantum register holding the quantum side information belonging to the adversary. If the adversary is completely oblivious to the value of a bit $A$ even given $X$, $Y\;$ and $E$ then takes its maximal value $H(A|XYE)=1$.

A tight trade-off between the winning probability of a single-round box $\omega$ and the entropy $H(A|XYE)$ generated by the box was derived in [Pironio et al., 2010, Acín et al., 2012] and is stated in the following lemma.

Lemma \thelem ([Pironio et al., 2010, Acín et al., 2012]333Lemma 5.2 is stated in the form appearing in [Arnon-Friedman et al., 2016c]. To see how the original results of [Pironio et al., 2010] can be used to derive the lemma as we state it, follow the proof given in Appendix C.1.).

For any quantum single-round box $\mathrm{P}_{AB|XY}$ with winning probability $\omega\in\left[\frac{3}{4},\frac{2+\sqrt{2}}{4}\right]$ in the CHSH game,

[TABLE]

where $E$ denotes the quantum side-information belonging to the adversary and $h(\cdot)$ is the binary entropy function.

The relation stated in Equation (5.3) is plotted in Figure 5.2. One can see that the entropy increases as the winning probability $\omega$ increases. That is, the amount of secret randomness in Alice’s outcome is directly related to the winning probability of the single-round box. In particular, we observe that $H(A|XYE)=0$ (i.e., the adversary knows the value of $A$) for the optimal classical winning probability and $H(A|XYE)=1$ (i.e., $A$ looks completely random to the adversary) for the optimal quantum winning probability. 444These two extreme cases are easy to understand. When the box employs a classical strategy the adversary can simply hold a copy of $A$. When the box employs the optimal quantum strategy the used state is the maximally entangled state. Then, due to monogamy of entanglement, the adversary is completely decoupled from the Alice and Bob’s state. For more details see Section 4.2. Note that there can be many different boxes $\mathrm{P}_{AB|XY}$ (and hence extensions to the adversary) with the same winning probability $\omega$. That is, the assumption regarding the winning probability of the box does not pin down the full probability distribution. The bound given in Equation (5.3) is thus very strong – it says that for any single-round box with winning probability $\omega$ and any purification to the adversary the stated lower bound holds.

Instead of considering the von Neumann entropy as above, one can also study lower-bounds on the conditional min-entropy $H_{\min}(A|XYE)$ as a function of the winning probability of a single-round box – as was done in [Masanes et al., 2011]. We plot the resulting bound in Figure 5.2. As can be seen in the figure, for non-optimal Bell violation the min-entropy can be significantly lower than the von Neumann entropy. Indeed, the min-entropy is always upper-bounded by the von Neumann entropy (hence the name). Still, in some cases a bound on the min-entropy, rather than the von Neumann entropy, is needed or, at the least, is easier to derive. In particular, lower-bounds on the min-entropy for single-round boxes can be found using general techniques based on the semidefinite programming hierarchies of [Navascués et al., 2008] while, up to date, there is no general technique to derive (or even estimate) such bounds on the von Neumann entropy.

Similar bounds were derived also for other Bell inequalities. For example, lower-bounds on the min-entropy produced by a single-round box were found as a function of the violation of the Mermin inequality [Gallego et al., 2013b, Equation (6)] and the tilted-CHSH inequality [Bamps et al., 2017, Lemma 2]. Another result in the same spirit is that of [Nieto-Silleras et al., 2016, Section 5], where a bound on the min-entropy is derived as a function of several Bell inequalities all at once.555That is, instead of assuming that we know just the winning probability of the single-round box in a specific game, we assume we know its winning probabilities in several different games. In the context of single-round boxes this is a stronger assumption regarding the device. However, in actual application this is not an issue, as will be mentioned later on. Lower-bounds on the von Neumann entropy were derived as a function of the violation of the MDL inequalities [Kessler and Arnon-Friedman, 2017, Section 3] and the MABK inequality [Ribeiro et al., 2017, Lemma S5].

Before continuing to the next chapter, we emphasise once again that single-round statements as mentioned above should not be understood as operational statements. If we are given a single-round box but we do not assume to know its winning probability $\omega$ then we cannot conclude anything about its properties (e.g., the entropy of the outputs). When considering, for example, device-independent cryptographic protocols one must test the device in order to estimate whether it can violate a Bell inequality or not. This is done by playing several games with the device and collecting statistic regarding its input-output behaviour. For this purpose we need to consider multi-rounds boxes, as done in the following sections.

Chapter 6 Multi-round box

In the previous chapter we discussed the single-round box, which can be seen as a simple abstract object that allows us to study the fundamental aspects of non-locality. When studying actual device-independent information processing tasks, however, one must consider more complex objects that describe the behaviour of the devices while performing the task of interest. More concretely, in actual applications we usually interact with a device by playing many games. Even in the simplest setting where one would like to merely verify the violation of a Bell inequality, as in experiments performing loophole-free Bell tests, a Bell game is played many times so that sufficient amount of data can be collected to estimate the violation in a satisfactory statistical manner. Playing just a single game is clearly not enough. Another example is device-independent protocols, such as quantum key distribution. All protocols include a phase in which the users (or honest parties) are playing many games with their device in order to decide whether it can be used for the considered task. Hence, considering boxes that can be used to play just a single game is not enough. Instead, we need to work with multi-round boxes.

Multi-round boxes can be described using a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ over the inputs and outputs of many rounds of a game. That is, for $n$ the number of games which one would like to play with the box (e.g., the number of rounds of a protocol), $\mathbold{A}=A_{1}A_{2}\dots A_{n}$ is a random variable over $\mathcal{A}^{n}$ and $\mathbold{B},\mathbold{X}$, and $\mathbold{Y}$ are similarly defined.

As explained in the beginning of Chapter 5, the way we model a box, and in particular a multi-round box, depends on the type of interaction that we would like to perform with it. We consider two different forms of interactions: parallel and sequential interactions. Different tasks require different types of boxes. Parallel boxes are used, for example, in self-testing [Natarajan and Vidick, 2017], parallel quantum key distribution [Jain et al., 2017], and certification of entanglement [Arnon-Friedman and Yuen, 2018]. Some examples for settings in which sequential boxes are considered are delegated computation [Reichardt et al., 2013] and randomness amplification [Kessler and Arnon-Friedman, 2017]. In the scope of this thesis, Chapters 8 and 10 deal with parallel boxes while Chapters 9 and 11 focus on sequential boxes.

6.1 Parallel interaction

The simplest to describe form of interaction is the “parallel interaction”. In such an interaction the box is “expecting” to get the $n$ inputs of all the rounds, $\mathbold{x}$ and $\mathbold{y}$, at the same time and is expected to give all the outputs, $\mathbold{a}$ and $\mathbold{b}$, together; see Figure 6.1. If the box is only given inputs of a single game, e.g., $x_{1},y_{1}$, it is not expected to return any output. This behaviour of the box will present itself in the mathematical model of the box, as we explain below.

For a given a game $\mathrm{G}$, a parallel multi-round box is a device with which Alice and Bob can play $n$ instances of $\mathrm{G}$ in parallel (i.e., at the same time). Mathematically this translates to a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, non-signalling between Alice and Bob, defined over the inputs and outputs of $n$ games. For example, when considering the CHSH game, $\mathbold{A},\mathbold{B},\mathbold{X},$ and $\mathbold{Y}$ are all random variables over $\{0,1\}^{n}$.

As explained in Section 3.1.1, the non-signalling conditions between Alice and Bob imply that Alice and Bob’s marginals, $\mathrm{P}_{\mathbold{A}|\mathbold{X}}$ and $\mathrm{P}_{\mathbold{B}|\mathbold{Y}}$ respectively, are well-defined. The fact that we are talking about a parallel multi-round box means that no further structure can be assumed. In particular, other marginals, e.g., $\mathrm{P}_{A_{1}|X_{1}}$ or $\mathrm{P}_{A_{2}B_{2}|X_{2}B_{2}}$, are not necessarily well-defined. Intuitively this stands for the fact that the box is expecting to get all the inputs together and only then it produces the outputs; the output for $A_{1}$ can therefore depend, for example, on the value of $X_{5}$ and not on just that of $X_{1}$. Hence the conditional probability distribution $\mathrm{P}_{A_{1}|X_{1}}$ is not properly defined.

Non-signalling parallel boxes

One can consider a parallel multi-round box which is only restricted by the non-signalling conditions. We then get the following definition.

Definition \thedefn (Non-signalling parallel multi-round box).

Given a Bell game $\mathrm{G}$, a non-signalling parallel multi-round box is a non-signalling box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, as in Definition 3.1.1, defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$ – $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$. That is, for all $\mathbold{a}\in\mathcal{A}^{n}$, $\mathbold{b}\in\mathcal{B}^{n}$, $\mathbold{x},\mathbold{x}^{\prime}\in\mathcal{X}^{n}$ and $\mathbold{y},\mathbold{y}^{\prime}\in\mathcal{Y}^{n}$,

[TABLE]

As mentioned above, the only non-signalling conditions restricting the parallel box, are those between Alice and Bob appearing in Definition 6.1; we do not set any other assumptions regarding the box apart from that.

Quantum parallel boxes

Similarly to a quantum single-round box, as in Definition 5.1, a quantum parallel multi-round box is just a quantum box (Definition 3.1.2) defined for the inputs and outputs of $n$ rounds of $\mathrm{G}$.

Definition \thedefn (Quantum parallel multi-round box).

Given a Bell game $\mathrm{G}$, a quantum parallel multi-round box is a quantum box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, as in Definition 3.1.2, defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$ – $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$. That is, there exist a bipartite state $\rho_{Q_{A}Q_{B}}$ and measurements $\{M^{\mathbold{x}}_{\mathbold{a}}\}$ and $\{M^{\mathbold{y}}_{\mathbold{b}}\}$ such that

[TABLE]

The non-signalling conditions in Equation (6.1) are automatically fulfilled by quantum parallel boxes defined above. We remark again that there are no further assumptions regarding the structure of the state and measurements apart from what appears in Equation (6.2). Specifically, $\rho_{Q_{A}}$ and $\rho_{Q_{B}}$ are not assumed to have some further subsystem structure and the measurements need not have a tensor product form such as $M^{x_{1}}_{a_{1}}\otimes\dots\otimes M^{x_{n}}_{a_{n}}$.

6.2 Sequential interaction

In the previous section we discussed parallel multi-rounds boxes. These are boxes that allow (and “expect”) to be interacted with in a parallel way, i.e., by giving all the inputs to the box at the same time. As the parallel multi-round box receives all the inputs at once, the output for, e.g., the first game, $A_{1}$, can depend on the inputs for all games $X_{1},X_{2},\dots,X_{n}$.

In this section we consider a different type of multi-round boxes – sequential multi-round boxes. Such boxes are, in some sense, more structured than parallel multi-round boxes and accurately model the devices used in many device-independent scenarios. As such, sequential multi-round boxes are of relevance for applications. Furthermore, the additional structure of sequential multi-round boxes will allow us to derive stronger results than those derived for their parallel counterparts.

As mentioned above, the way we model a multi-round box depends on how we would like to interact with it. Most device-independent protocols proceed in rounds which are performed one after the other: Alice and Bob use their box in the first round of the protocol and only once they receive the outputs from the box they proceed to the second round, and so on; See Protocol 1.1 for an example. We call such an interaction with the box “sequential interaction”. This is illustrated in Figure 6.2 (the reader may compare Figure 6.2 to the single-round box in Figure 5.1 and the parallel multi-round box in Figure 6.1).

The chronological order which is implied by the sequential interaction enforces certain constraints on the behaviour of the box. In particular, while past events can influence future ones, the future cannot change the past. For example, the first output $A_{1}$ can depend on the first input $X_{1}$ but not on the inputs of the next rounds $X_{2},\dots,X_{n}$. The second output $A_{2}$ can depend both on $X_{2}$ and past events, such as the values assigned to $A_{1}$ and $X_{1}$, but not on the following inputs $X_{3},\dots,X_{n}$.

We define two different types of sequential boxes – one which allows for communication between the rounds of interactions and one which does not. A box that allows for communication between the rounds is a box in which Alice and Bob’s devices can exchange classical or quantum information after finishing playing a game and before starting the next one. Such boxes should be considered when entanglement is to be distributed “on the fly”, e.g., in protocols where Alice is expected to send half of an entangled state to Bob in each round, or when the devices are located far enough so they cannot communicate during a single game but too close to make sure signals from one round cannot arrive to the other device until the end of all games. A box that does not allow for communication can be considered, e.g., in cryptographic settings in which any communication between the devices implies that all information can leak to the adversary. We remark that parallel boxes and sequential boxes that allow for communications are incomparable to one another, while both are more general than sequential boxes without communication; see Figure 6.3. This is explained in more detail after formally defining the two types of sequential boxes.

6.2.1 Without communication between the rounds

As in the case of a parallel multi-round box, a sequential multi-round box is described by a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined over the inputs and outputs of $n$ rounds of the game $\mathrm{G}$ – $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$. The special thing about a sequential box is that the marginals describing the individual rounds of the game are well-defined and non-signalling between Alice and Bob. That is, they are boxes by themselves.

In this section we consider a model of sequential boxes in which Alice’s and Bob’s components are not allowed to communicate between the rounds of the game. For short, we call such boxes non-communicating sequential boxes. Formally, to define a non-communicating sequential box we consider the marginals of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ describing a round $i\in[n]$. The relevant marginals are

[TABLE]

where $H^{i,\text{Alice}}=\mathbold{X}_{1,\dots,i-1}\mathbold{A}_{1,\dots,i-1}$ and $H^{i,\text{Bob}}=\mathbold{Y}_{1,\dots,i-1}\mathbold{B}_{1,\dots,i-1}$ denote the “histories” of Alice and Bob’s boxes in round $i$. These histories basically describe all the information that can be kept by the boxes from the previous rounds (we can think of such boxes as devices which record past events in their memory). The history may include more information111For example, in device-independent quantum key distribution protocols the parties randomly choose in each round whether the round is used for testing the device or for generating key bits. This information can also be included in the history $H^{i}$. than past inputs and outputs; for simplicity we stick to the above choice.

A first requirement on a sequential box is that the marginals (6.3) are well-defined. This can be mathematically described by a set of non-signalling conditions. Explicitly, for every $i\in[n]$, we denote:

$\mathcal{P}=[i-1]$, $\mathbold{a}_{\mathcal{P}}=a_{1},\dots,a_{i-1}$, and similarly for $\mathbold{b}_{\mathcal{P}}$, $\mathbold{x}_{\mathcal{P}}$, and $\mathbold{y}_{\mathcal{P}}$. 2. 2.

$\mathcal{F}=\{i+1,\dots,n\}$, $\mathbold{a}_{\mathcal{F}}=a_{i+1},\dots,a_{n}$, and similarly for $\mathbold{b}_{\mathcal{F}}$, $\mathbold{x}_{\mathcal{F}}$, and $\mathbold{y}_{\mathcal{F}}$. 3. 3.

For any $\mathbold{x}_{\mathcal{P}}$, $\mathbold{y}_{\mathcal{P}}$, $x_{i}$, $y_{i}$, $\mathbold{x}_{\mathcal{F}}$, $\mathbold{y}_{\mathcal{F}}$, $\mathbold{x}^{\prime}_{\mathcal{F}}$, and $\mathbold{y}^{\prime}_{\mathcal{F}}$,

1. (a)

$\mathbold{x}=\mathbold{x}_{\mathcal{P}},x_{i},\mathbold{x}_{\mathcal{F}}$ 2. (b)

$\mathbold{x}^{\prime}=\mathbold{x}_{\mathcal{P}},x_{i},\mathbold{x}^{\prime}_{\mathcal{F}}$

and similarly for $\mathbold{y}$ and $\mathbold{y}^{\prime}$.

Then, we require that the following non-signalling conditions hold for all $\mathbold{a}_{\mathcal{P}}$, $\mathbold{b}_{\mathcal{P}}$, $\mathbold{x}_{\mathcal{P}}$, $\mathbold{y}_{\mathcal{P}}$, $a_{i}$, $b_{i}$, $x_{i}$, $y_{i}$, $\mathbold{x}_{\mathcal{F}}$, $\mathbold{x}^{\prime}_{\mathcal{F}}$, $\mathbold{y}_{\mathcal{F}}$, and $\mathbold{y}^{\prime}_{\mathcal{F}}$,

[TABLE]

Now that the marginals $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i,\text{Alice}}H^{i,\text{Bob}}}$ are well-defined for all $i\in[n]$, we further ask that they are non-signalling between Alice and Bob, when each party holds only its own history. That is, $\mathrm{P}_{A_{i}|X_{i}H^{i,\text{Alice}}}$ and $\mathrm{P}_{B_{i}|Y_{i}H^{i,\text{Bob}}}$ need to be well-defined as well. Explicitly, for each round $i\in[n]$, for all $a\in\mathcal{A}$, $b\in\mathcal{B}$, $x,x^{\prime}\in\mathcal{X},\;y,y^{\prime}\in\mathcal{Y}$ and histories $h^{i,\text{Alice}},h^{i,\text{Alice}^{\prime}}\in\mathcal{X}^{i-1}\times\mathcal{A}^{i-1}$ and $h^{i,\text{Bob}},h^{i,\text{Bob}^{\prime}}\in\mathcal{Y}^{i-1}\times\mathcal{B}^{i-1}$,

[TABLE]

The fact that the boxes cannot communicate between the rounds presents itself by having two different histories, one for Alice and one for Bob. The above equations then imply that the actions of Alice’s box in round $i$ depend only on Alice’s history, i.e., on what happened in the previous rounds on Alice’s side (while she is oblivious to Bob’s history), and similarly for Bob.222This should be compared to the next section, where we will have just a single history $H^{i}$ for Alice and Bob together.

Note that we only ask the marginals $\mathrm{P}_{A_{i}|X_{i}H^{i,\text{Alice}}}$ and $\mathrm{P}_{B_{i}|Y_{i}H^{i,\text{Bob}}}$ to be well-defined. $\mathrm{P}_{A_{i}|X_{i}}$, on the other hand, are not necessarily valid boxes.

Non-signalling non-communicating sequential boxes

A non-signalling non-communicating sequential multi-round box is simply a box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ fulfilling the above non-signalling constraints; there are no further requirements.

Definition \thedefn (Non-signalling non-communicating sequential multi-round box).

Given a Bell game $\mathrm{G}$, a non-signalling non-communicating sequential multi-round box is a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$ – $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$ fulfilling the non-signalling conditions given in Equations (6.4) and (6.5).

Quantum non-communicating sequential boxes

The simplest way of defining a quantum non-communicating sequential box is to consider the initial state shared by Alice and Bob and the sequence of measurements that they perform.

More specifically, in each round Alice and Bob’s boxes can perform a measurement on the post-measurement state of the previous round. We denote the state in the beginning of round $i\in[n]$ (i.e., before performing the measurements of the $i$’th round) by $\rho^{i,h^{i,\text{Alice}},h^{i,\text{Bob}}}_{Q_{A}Q_{B}}$. As clear from the notation, this state depends on the histories $h^{i,\text{Alice}},h^{i,\text{Bob}}$. We identify $\rho^{1}_{Q_{A}Q_{B}}=\rho_{Q_{A}Q_{B}}$ as the initial state of the box.

Furthermore, we denote the (Kraus) measurements performed in each round by $\{K^{x}_{a}\}$ and $\{K^{y}_{b}\}$.333Note that in contrast to the previous definitions, the measurement operators $K$ are now written as Kraus operators and not POVMs, since we are interested in the post-measurement state. See Section 2.3 for more details. One can think of the measurements $\{K^{x}_{a}\}$ as depending on the history $h^{i,\text{Alice}}$ and similarly for Bob. Alternatively, we can imagine that the history is already kept in some classical registers within the quantum state $\rho^{i,h^{i,\text{Alice}},h^{i,\text{Bob}}}_{Q_{A}Q_{B}}$, i.e., $\rho_{Q_{A}}$ includes also the information $h^{i,\text{Alice}}$ and similarly for Bob. The measurements can thus be defined as first reading the history and then applying the relevant measurement depending on the history. This allows us to use the shorter notation in which the operators do not depend on the histories explicitly.

Using the above notation, the relation between the state in round $i$ to that of round $i-1$ is simply (up to normalisation of the state)

[TABLE]

where $h^{i,\text{Alice}}$ and $h^{i,\text{Bob}}$ uniquely determine $x_{i-1},a_{i-1},h^{i-1,\text{Alice}}$ and $y_{i-1},b_{i-1},h^{i-1,\text{Bob}}$, respectively (i.e., the values on the righthand-side of Equation (6.6) should be consistent with the histories on the lefthand-side). The conditions stated in Equation (6.5) follow directly.

Definition \thedefn (Quantum non-communicating sequential multi-round box).

Given a Bell game $\mathrm{G}$, a quantum non-communicating sequential multi-round box is a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$, $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, such that there exist a bipartite state $\rho_{Q_{A}Q_{B}}$ and measurements $\{K^{x}_{a}\}$ and $\{K^{y}_{b}\}$ defining a sequence of bipartite states for $i\in[n]$ as in Equation (6.6).

As mentioned before, a non-communicating sequential box is also a parallel one. Indeed, it is easy to see that a parallel box can always simulate the behaviour of a non-communicating sequential box.

6.2.2 With communication between the rounds

In the previous section we considered sequential boxes in which Alice’s and Bob’s components are not allowed to communicate between the rounds. This implies that Alice’s and Bob’s components evolve separately in time and each of them has their own “history”: $h^{i,\text{Alice}}$ for Alice and $h^{i,\text{Bob}}$ for Bob. Now, we consider a scenario in which Alice’s and Bob’s components are allowed to communicate between the different games, i.e., after the outputs of round $i-1$ were supplied by the box and before the $i$’th inputs are given.444In Protocol 1.1, for example, “between the different games” refers to the time after Step 3 of round $i-1$ and before Step 2 of round $i$, for all $i\in[n]$. Considering boxes that are allowed to communicate is, in particular, relevant when considering realistic application of, e.g., device-independent cryptography. There, one would like to allow the experimentalists to distribute entanglement “on the fly” during the protocol. To send a new quantum state in each round the communication channels need to be open and an adversarial box may use this opportunity to communicate.

Mathematically this setting can be formalised by allowing Alice and Bob to keep a common history register that includes the classical information of all past events on both sides. More specifically, the marginal describing the $i$’th round of the game, for $i\in[n]$, is given by $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i}}$, where $H^{i}$ denotes the history defined by the previous rounds. $H^{i}$ includes $\mathbold{X}_{1,\dots,i-1}\mathbold{Y}_{1,\dots,i-1}\mathbold{A}_{1,\dots,i-1}\mathbold{B}_{1,\dots,i-1}$ as well as any other information available to Alice’s and Bob’s component. For simplicity we assume that $H^{i}=\mathbold{X}_{1,\dots,i-1}\mathbold{Y}_{1,\dots,i-1}\mathbold{A}_{1,\dots,i-1}\mathbold{B}_{1,\dots,i-1}$ similarly to what was done before. The only non-trivial communication to consider is one which depends on the history, since any other information could have been included as part of the box to begin with. Therefore, we can assume without loss of generality that the communicated information is simply the entire history.

As before, we first require that $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i}}$ are well-defined, i.e., Equation (6.4) is fulfilled. In addition, $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i}}$ needs to be non-signalling between Alice and Bob, when they both hold their common history. That is, $\mathrm{P}_{A_{i}|X_{i}H^{i}}$ and $\mathrm{P}_{B_{i}|Y_{i}H^{i}}$ are well-defined. Formally: for each round $i\in[n]$, for all $a\in\mathcal{A}$, $b\in\mathcal{B}$, $x,x^{\prime}\in\mathcal{X},\;y,y^{\prime}\in\mathcal{Y}$ and $h^{i}\in\mathcal{A}^{i-1}\times\mathcal{B}^{i-1}\times\mathcal{X}^{i-1}\times\mathcal{Y}^{i-1}$,

[TABLE]

In contrast to Equation (6.5), in the above equations the behaviour of Alice’s component in the $i$’th round may depend also on past events on Bob’s side, as $H^{i}$ includes also $\mathbold{Y}_{1,\dots,i-1}\mathbold{B}_{1,\dots,i-1}$, and similarly for Bob’s part of the box.

Non-signalling communicating sequential boxes

A non-signalling communicating sequential multi-round box is a box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ fulfilling the above non-signalling constraints.

Definition \thedefn (Non-signalling communicating sequential multi-round box).

Given a Bell game $\mathrm{G}$, a non-signalling communicating sequential multi-round box is a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$ – $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$ fulfilling the non-signalling conditions given in Equations (6.4) and (6.7).

It is perhaps instructive to note that $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ itself is not a non-signalling box.; communication (i.e., signalling) between the rounds may be necessary in order to implement the box. We give a trivial example in the end of the section.

Quantum communicating sequential boxes

When we say that a communicating sequential multi-round box is quantum we mean that in each round the behaviour of the box can be described within the formalism of quantum physics.

Definition \thedefn (Quantum communicating sequential multi-round box).

Given a Bell game $\mathrm{G}$, a quantum sequential multi-round box is a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$, $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, such that for all $i\in[n]$ the marginal $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i}}$, for $H^{i}=\mathbold{X}_{1,\dots,i-1}\mathbold{Y}_{1,\dots,i-1}\mathbold{A}_{1,\dots,i-1}\mathbold{B}_{1,\dots,i-1}$, is a quantum box as in Definition 3.1.2. That is, there exist a bipartite state $\rho^{h^{i}}_{Q_{A}Q_{B}}$ and measurements $\{M^{h^{i},x}_{a}\}$ and $\{M^{h^{i},y}_{b}\}$ such that

[TABLE]

The box in Equation (6.8) is written as $\mathrm{P}_{A_{i}B_{i}|X_{i}Y_{i}H^{i}}$ so it is mathematically clear which marginals of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ are being discussed. On the level of the state and measurements one thinks of $\rho^{h^{i}}_{Q_{A}Q_{B}}$, $\{M^{h^{i},x}_{a}\}$, and $\{M^{h^{i},y}_{b}\}$ as depending on the history $h^{i}$, which allows the actions in each round to depend on the past. As in Section 6.2.1, we may also consider a state $\rho^{h^{i}}_{Q_{A}Q_{B}}$ that keeps $h^{i}$ in one of its registers and measurements that first read the history and then apply the relevant operations; in such a case we may think of $\{M^{x}_{a}\}$, and $\{M^{y}_{b}\}$ independent of the history.

It may seem from Definition 6.2.2 that only the individual rounds are considered. The sequential nature of the box is concealed in the relations between the different rounds. It becomes apparent when noting that all the marginals describing the individual rounds should be consistent with the same overall box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Alternatively, one can consider an equivalent definition of a quantum communicating sequential multi-round box that is perhaps more intuitive (but mathematically more complex): Similarly to the evolution described in Equation (6.6), we start with some initial quantum state and make sequential measurements. In contrast to Equation (6.6), however, we allow for an additional general operation, which may depend on the history, to be performed on the post-measurement state of each round. The general operation between the rounds is what models the communication between the two parts of the box.

Before concluding this section, let us mention the relations between the different types of multi-round boxes. The relations are shown in Figure 6.3. It is obvious to see that communicating sequential boxes are more general than non-communicating sequential boxes. In contrast to non-communicating sequential boxes, parallel boxes cannot simulate a general communicating sequential box. A trivial example is a communicating sequential box that always outputs $b_{2}=x_{1}$. Clearly, since a parallel box must, in particular, fulfil Equation (6.1), it cannot simulate such a box. On the other hand, communicating sequential boxes cannot simulate a general parallel box. For example, a communicating sequential box cannot simulate a parallel box for which $a_{1}=x_{2}$. Thus, the two types of boxes are incomparable.

Chapter 7 Working under the IID assumption

In this thesis, we are interested in analysing the behaviour of multi-round boxes when such boxes are used to play many non-local games, e.g., while running a cryptographic protocol. In the previous chapter we discussed the different models of multi-round boxes (the parallel and sequential ones). As we saw, their behaviour can be quite complex. As a consequence, the analysis of protocols which use such boxes is (a priori) tedious in the good case and infeasible in the worst.

In this chapter we discuss an assumption that can make the analysis of the scenarios of interest much simpler – the so called “independent and identically distributed” (IID) assumption. The assumption states that the boxes behave independently and identically when playing the $n$ games. The IID assumption is commonly made in the literature as it significantly simplifies the behaviour of the considered boxes and allows us to gain better intuition and understanding of the problem at hand. As we explain below, there is no reason to believe that the IID assumption can be enforced in the device-independent setting; we use it just as a first stage before moving on to the general analysis. In Chapters 8-9 we will see that, in certain scenarios, some techniques can be used to reduce the general analysis to the one made under the IID assumption.

We start by explaining the assumption itself. Following that, we present a mathematical tool, namely the “quantum asymptotic equipartition property”, which is of great use when considering IID random variables and quantum systems. Finally, we discuss the analysis of our showcases under the IID assumption.

7.1 The IID assumption

As in the previous chapter, we consider multi-round boxes. An IID box, as the name suggests, is a multi-round box which behaves identically and independently in each game played with it. Pictorially, we can think of an IID box as $n$ identical and independent copies of a single-round box, as shown in Figure 7.1. Comparing this to Figures 6.1 and 6.2, one sees that an IID box has more structure than the other, more general, multi-round boxes. In particular, in the case of an IID box we can talk about a subsystem structure of the box. In the quantum case, for example, if $\sigma$ denotes the state of a single-round box in Figure 7.1 then the overall state of the IID box is $\sigma^{\otimes n}$. A similar tensor product structure also holds for the measurements describing the box. Mathematically, an IID box is defined as follows.

Definition \thedefn (IID box).

Given a non-local game $\mathrm{G}$, an IID box is a conditional probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ defined for the inputs and outputs of $n$ rounds of the game $\mathrm{G}$, $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, such that

[TABLE]

for some single-round box $\mathrm{P}_{AB|XY}$. An IID box is said to be quantum or non-signalling if the single round box $\mathrm{P}_{AB|XY}$ is quantum (Definition 5.1) or non-signalling (Definition 5.1), respectively.

Note that the single-round box $\mathrm{P}_{AB|XY}$ in Equation (7.1) is the same for every round $i\in[n]$. This means that the behaviour of the box is identical in each round and independent of all other rounds.111As always, a box is a conditional probability distribution and its definition is therefore independent of the distribution of the inputs, $\mathbold{x}$ and $\mathbold{y}$, which can be arbitrary (depending on how the box is being used). It is perhaps helpful to note that the idea here is that, while the inputs of the different rounds may be correlated in general (i.e., not IID), the box itself does not “create” further correlations between the rounds (in contrast to parallel and sequential boxes). In any case, in most scenarios the inputs are usually taken to be IID random variables as well. Hence, the behaviour of an IID box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is solely characterised by the single-round box $\mathrm{P}_{AB|XY}$ and, thus, the substance of any analysis done for the IID box is the study of the single-round box. This also implies that the box behaves exactly the same whether we give it all the inputs at once (parallel interaction) or one after the other (sequential interaction). An IID box is therefore both a parallel multi-round box and a sequential multi-round box; see Figure 7.2. Given all of the above, it indeed makes sense that any analysis done solely for IID boxes can be much simpler than the general analysis in which one needs to deal with parallel or sequential multi-round boxes.

When considering device-independent protocols one usually encounters IID boxes in two different contexts – the so called “completeness” and “soundness” of the protocols (recall, e.g., Section 4.2). When proving the completeness of a protocol one shows that an “honest implementation” of the box does not cause the protocol to abort (with high probability). The honest implementation is the implementation of the box that one would like to have if the manufacture of the device is to be trusted and, most commonly, it is described as an IID box. Thus, investigating the behaviour of the protocol when an IID box is being used allows us to see what happens in the honest scenario when “everything goes according to the plan”.

The second context to discuss IID boxes is that of the soundness proof. There, one ought to show that the protocol acts as required for any box, i.e., even for adversarial ones.222Recall that in the device-independent setting we assume that the adversary is the one constructing the box. Device-independent protocols are expected to abort, with high probability, when an adversarial device is detected. Clearly, not all boxes are IID boxes and hence analysing the situation only for IID boxes is not sufficient. That is, by assuming that all boxes behave in an IID manner we weaken the final statement. Still, working under the IID assumption allows us to gain better understanding of the full question at hand.

It is important to remark that, even though quite convenient for the soundness analysis, the IID assumption cannot be justified a priori. Assuming that the box behaves in an IID way goes against the spirit of device-independence by imposing severe restrictions on the implementation of the box. In particular, the assumption implies that the multi-round box does not include any, classical or quantum, internal memory (i.e., its actions when playing one game cannot depend on the other games) and cannot display time-dependent behaviour. We therefore emphasise that working under the IID assumption is only a first step in the process of proving full soundness (as will be shown in the proceeding chapters).

7.2 Asymptotic equipartition property

When analysing IID processes a useful mathematical tool is the so called “asymptotic equipartition property” (AEP). The entropic formulation of the AEP used in this thesis basically asserts that when considering IID RV $\mathbold{A}=A_{1},A_{2},\dotsc,A_{n}$, all identical copies of the RV $A$, the smooth min- and max-entropies rates, $H^{\varepsilon}_{\min}(\mathbold{A})/n$ and $H^{\varepsilon}_{\max}(\mathbold{A})/n$, converge to $H(A)$ [Holenstein and Renner, 2011]. Similarly, the quantum version of the AEP asserts that the same is true for IID quantum states $\left(\sigma_{A}\right)^{\otimes n}$ and, even more, it holds also when considering conditional entropies [Renner, 2008, Tomamichel et al., 2009, Tomamichel, 2012].

In many information theoretic tasks one needs to bound the smooth min- and max-entropies, as they describe operational quantities. In particular, this will be the case in one of the showcases investigated in the thesis. When considering IID processes, as done in this chapter, the AEP allows us to reduce the analysis of the smooth entropies for IID boxes to the analysis of the von Neumann entropy for a single-round box.333An example of the analysis of the von Neumann entropy for single-round boxes was presented in Section 5.2. The AEP motivates the analysis done in that section when working under the IID assumption. This explains why the AEP is a useful tool when working under the IID assumption.

To comprehend the statement of the AEP and its significance we start by presenting and explaining the classical AEP. The quantum variant is then presented as an extension of the classical one.

7.2.1 Classical asymptotic equipartition property

The (classical) AEP can be seen as the “information theoretic version” of the law of large numbers. Given IID RV $A_{1},A_{2},\dotsc,A_{n}$ the law of large numbers states that for large enough number of samples $n$, the average is close to the expected value in probability. Formally this can be written as

[TABLE]

for $A=A_{1}=\dots=A_{n}$ a single copy of the RV. Similarly, the AEP, which is a direct consequence of the law of large numbers,444To see this, one can define a new RV, $\tilde{A_{i}}$, which, for all $a\in\mathcal{A}$ takes the value $\log\left(\Pr[a]\right)$ with probability $\Pr[a]$. Applying Equation (7.2) for the new IID RV $\tilde{A_{1}},\dots,\tilde{A_{n}}$, Equation (7.3) follows. states that for IID RV

[TABLE]

where we denoted $\mathbold{A}=A_{1}A_{2}\dots A_{n}$.

Assume that we sample a sequence $\mathbold{a}$. What can we say about its probability $\mathrm{P}_{\mathbold{A}}[\mathbold{a}]$? We learn from Equation (7.3) that, for large enough $n$,

[TABLE]

with high probability. This allows us to talk about “typical sequences” and “typical sets”. A typical sequence is a sequence $\mathbold{A}$ for which Equation (7.4) holds and the typical set includes all typical sequences. Denote by $1-\varepsilon$ the probability that Equation (7.4) holds or, in other words, the probability of the typical set. In the limit $n\rightarrow\infty$, $\varepsilon\rightarrow 0$, the typical set has probability approximately 1, all elements of it appear with approximately $2^{-nH(A)}$ probability, and, hence, it includes approximately $2^{nH(A)}$ elements. (For formal proofs see [Cover and Thomas, 2012, Chapter 3]). Thus, the AEP implies that when analysing probabilistic statements regarding a sequence of IID RV, one can focus on the typical events (and ignore the non-typical ones) without introducing much of an error.

Equation (7.4) can be used to state the AEP in terms of the smooth min- and max-entropies; this form of the AEP is the one used in this thesis.

Theorem 7.1** (AEP555Note that this theorem is actually a non-asymptotic version of the AEP, as it describes also the convergence rate for finite $n$ (i.e., it includes also the second order term). The limit, stated as Equation (7.5) below, follows trivially from the presented theorem. (direct part)).**

Let $\mathbold{A}=A_{1}A_{2}\dots A_{n}$ be a sequence of IID RV. Then, for any $\varepsilon\in(0,1)$ and $n$ large enough,

[TABLE]

where $\delta$ depends on $\varepsilon$ and $A$.666For the time being we are not interested in the explicit form of $\delta$; this will be discussed when relevant.

To gain some intuition of how the smooth entropies enter to the above theorem we sketch the main arguments here in a somewhat hand-waving way. For the more accurate analysis we refer the interested reader to [Renner, 2008, Holenstein and Renner, 2011, Tomamichel, 2012]. Recall that

[TABLE]

Thus, when considering only typical events, it follows from Equation (7.4) that

[TABLE]

To account for non-typical events we need to incorporate their probability $\varepsilon$. We do so by switching to the smooth versions of the entropies while using $\varepsilon$ as the smoothing parameter.777The above only (roughly) explains why the smooth entropies are considered, without addressing the second order term of the AEP. The second order term does not come from the law of large numbers but its refinement — the central limit theorem.

Theorem 7.1, in combination with a converse bound888The converse bound roughly follows from the monotonicity of the so called $\alpha$-entropies. For details see [Tomamichel, 2015, Section 6.4]., implies that when $n$ goes to infinity both smooth entropies converge to the Shannon entropy:

[TABLE]

This explains why the Shannon entropy is so important in information theory — the smooth entropies, which describe operational tasks (recall, for example, Section 4.2), converge to the Shannon entropy when considering a large number of independent repetitions of the relevant task. A commonly used example is that of “data compression”. There, one would like to encode an $n$ bit string using less bits. If we allow for some small error when decoding the data, roughly $H^{\varepsilon}_{\max}(\mathbold{A})$ bits are needed [Renner and Wolf, 2004]. For a large enough IID sequence $A_{1},A_{2},\dotsc,A_{n}$, however, $nH(A)$ bits suffices [Shannon, 1948].

A final important comment about the entropic formulation of the AEP is with regards to the so called “chain rules”. The Shannon entropy respects the chain rule $H(\mathbold{A})=\sum_{i}H(A_{i}|\mathbold{A}_{<i})$, where $\mathbold{A}_{<i}$ denotes the sequence of all RV $A_{j}$ with $j<i$. In the case of IID RV this is reduced to $H(\mathbold{A})=nH(A)$. That is, the total amount of entropy of $\mathbold{A}$ is $n$ times the entropy of a single copy of $A$. Thus, in order to calculate $H(\mathbold{A})$ we only need to know $H(A)$. In contrast to the Shannon entropy, the smooth min- and max-entropies do not fulfil a similar chain rule. Theorem 7.1 tells us that, to first order in $n$, $H^{\varepsilon}_{\min}(\mathbold{A})=H^{\varepsilon}_{\max}(\mathbold{A})=nH(A)$. Therefore, for sufficiently large $n$, the total amount of the smooth min- and max- entropies of $\mathbold{A}$ are $n$ times the Shannon entropy of a single copy of $A$ and, here as well, we only need to know $H(A)$ to calculate $H^{\varepsilon}_{\min}(\mathbold{A})$ and $H^{\varepsilon}_{\max}(\mathbold{A})$.

7.2.2 Quantum asymptotic equipartition property

As the name suggests, the quantum AEP is an extended version of the AEP that applies to IID quantum states $\rho=\left(\sigma_{AB}\right)^{\otimes n}$ (the classical variant is then a special case of the quantum one). The following theorem, developed in [Tomamichel, 2012, Result 5] (see also [Tomamichel et al., 2009, Theorem 9]), acts as the generalisation of Theorem 7.1 above; it extends the theorem to quantum states and, at the same time, incorporates conditioning on quantum systems.999The classical AEP, given as Theorem 7.1, can be easily written also in terms of conditional entropies if the conditioning is done on classical systems (then one can directly define the probability distribution of $A$ as the conditional one). This is not the case when conditioning on quantum systems. That is to say that the statement of the theorem which includes conditional entropies does not follow directly from a “non-conditional” variant.

Theorem 7.2** (Quantum AEP (direct part) [Tomamichel, 2012]).**

Let $\rho=\left(\sigma_{AB}\right)^{\otimes n}$ be an IID quantum state. Then, for any $\varepsilon\in(0,1)$ and $n$ large enough,

[TABLE]

where $\delta(\varepsilon,\nu)=4\log\nu\sqrt{\log(2/\varepsilon^{2})}$ for $\nu=2\sqrt{2^{H_{\max}(A|B)}}+1$.

In combination with a converse bound [Tomamichel, 2015, Corollary 6.3], we get the asymptotic equality of the conditional entropies:

[TABLE]

For the proofs of the quantum AEP the reader is directed to [Tomamichel, 2015, Section 6.4].

The quantum AEP reveals the same important facts as its classical counterpart when considering IID quantum states – it justifies the use of the von Neumann entropy in quantum information processing and tell us that, for sufficiently large $n$, the total amount of the conditional smooth entropies, $H^{\varepsilon}_{\min}(\mathbold{A}|\mathbold{B})_{\rho}$ and $H^{\varepsilon}_{\max}(\mathbold{A}|\mathbold{B})_{\rho}$, are $n$ times the von Neumann entropy $H(A|B)_{\sigma}$ of a single copy of $\sigma$. That is, instead of calculating the entropies of the full state $\rho$ one only needs to analyse the von Neumann entropy for a single copy of $\sigma$.

When considering applications in which the analysis should be done for a finite number of repetitions $n$, it is not sufficient to know that the smooth entropies converge to the von Neumann entropy; we also need to know how fast they converge. The second order terms appearing in Equations (7.6) and (7.7), i.e., the terms that scale with $1/\sqrt{n}$, account for the “finite-size effects”. While the $1/\sqrt{n}$ dependency is optimal, the constant $\delta$ is not tight.101010To see that the $1/\sqrt{n}$ dependency is optimal follow, e.g., the proof of [Renner, 2008, Theorem 3.3.3]. Second order terms with constants better than $\delta$ can be derived from [Tomamichel and Hayashi, 2013].

7.3 Using the IID assumption

In this section we discuss the analysis of our showcases when working under the IID assumption. The analysis of the parallel repetition question, presented in Section 7.3.1, is somewhat trivial. Our showcase of device-independent cryptography, considered in Section 7.3.2, demonstrates the use of the quantum AEP in device-independent information processing tasks.

7.3.1 Showcase: non-signalling parallel repetition

In our terminology, parallel repetition results aim to upper-bound the probability that a parallel multi-round box can simultaneously win all the $n$ games played with it; recall Section 4.1. The discussion below holds for classical, quantum, and non-signalling strategies. The word “optimal” then refers to the considered type of players.

One simple strategy for the parallel repeated game is the IID strategy. This strategy takes the form of an IID box, which plays each of the $n$ games independently and identically, as in Definition 7.1. That is, the box does not take advantage of the fact that it gets all the inputs at the same time. For an optimal IID strategy, i.e., the strategy which achieves the maximal probability of winning all games out of all IID strategies, the single-round box $\mathrm{P}_{AB|XY}$ appearing in Equation (7.1) is the optimal single-game strategy, that is, the one achieving winning probability of $1-\alpha$.

It is easy to see that the probability that an IID box wins all the $n$ games simultaneously decreases exponentially fast with $n$. Specifically, consider an IID box (or strategy) $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ with

[TABLE]

for some single-round box $\mathrm{P}_{AB|XY}$. Let $W_{i}$ denote the RV describing whether the $i$’th game is won ($W_{i}=1$) or not ($W_{i}=0$) and denote by $1-\alpha=\Pr\left[W_{i}=1\right]$ the winning probability of the single-round box $\mathrm{P}_{AB|XY}(a_{i}b_{i}|x_{i}y_{i})$ in a single game (as in Equation (5.1)). Due to the IID assumption, all the RV $W_{i}$ are independent and identically distributed. Thus, the probability that all the $n$ games are won is given by

[TABLE]

Clearly, for any $1-\alpha<1$, $(1-\alpha)^{n}$ decreases exponentially fast in $n$.

It is easy to show that also a concentration bound holds for any IID box: for any $0\leq\beta\leq\alpha$, Hoeffding’s inequality tells us that111111Hoeffding’s inequality tells us even more; it says that when using the optimal IID strategy the probability of winning less than $1-\alpha-\beta$ fraction of the games is also decreasing exponentially fast.

[TABLE]

which decreases exponentially fast in $n$ as well. The answer to the parallel repetition question, under the IID assumption, is therefore almost trivial.

7.3.2 Showcase: device-independent quantum cryptography

Following the first proof of concept of the security of device-independent quantum key distribution derived in [Barrett et al., 2005], a long line of works [Acín et al., 2006a, Acín et al., 2006b, Scarani et al., 2006, Acín et al., 2007, Masanes, 2009, Pironio et al., 2009, Hänggi et al., 2010a, Hänggi and Renner, 2010, Masanes et al., 2011, Masanes et al., 2014] considered the security of device-independent quantum and non-signalling cryptography under the IID assumption. In this section we explain how the IID assumption is used when analysing device-independent quantum cryptographic protocols. Specifically, we consider here the task of device-independent randomness certification in the presence of a quantum adversary, which acts as the main building block of many device-independent cryptographic protocols, e.g., device-independent quantum key distribution. We focus only on the parts of the security proof in which the IID assumption plays a crucial role and present them in a slightly simplified form. In particular, we consider large enough number of rounds $n$ and neglect finite-size effects for the moment. In Chapter 11 we give full security proofs (which do not rely on the IID assumption) and contrast the relevant parts with the analysis done here.

When dealing with device-independent cryptography we first need to model the box used by the honest parties, Alice and Bob, and the adversary’s knowledge about it. Under the IID assumption, the state of Alice and Bob has an IID structure $\rho_{\mathbold{Q_{A}}\mathbold{Q_{B}}}=\left(\sigma_{Q_{A}Q_{B}}\right)^{\otimes n}$ where each copy of $\sigma_{Q_{A}Q_{B}}$ is a bipartite state shared between Alice and Bob. Moreover, we assume that the measurements performed in each round of the protocol are all identical and independent of one another, i.e., for all $\mathbold{a},\mathbold{x}$, $M_{\mathbold{a}}^{\mathbold{x}}=\left(M_{a}^{x}\right)^{\otimes n}$ and similarly for Bob’s measurements. The most general quantum adversary holds a purification of Alice and Bob’s state. As all purifications are equivalent up to local unitaries on Eve’s state, we can assume without loss of generality that the overall state of Alice, Bob, and Eve takes the IID form121212It is the equivalence of all purifications that allows us to go from an IID assumption regarding Alice and Bob’s state $\rho_{\mathbold{Q_{A}}\mathbold{Q_{B}}}$ to an IID assumption regarding the state $\rho_{\mathbold{Q_{A}}\mathbold{Q_{B}}\mathbold{E}}$, which also includes Eve. Interestingly, the same thing cannot be done when considering non-signalling boxes and adversaries. It follows from [Arnon-Friedman and Ta-Shma, 2012] that the extension of a non-signalling IID box to the adversary does not necessarily have an IID structure as well. (See also [Masanes et al., 2014], where the box itself is assumed to have a subsystem structure similar to that of an IID box while the structure of the adversary’s system is unrestricted).

[TABLE]

We remark that while we assume that $\rho$ has the above IID structure, the state $\sigma_{Q_{A}Q_{B}E}$ is unknown.

Equation (7.8), together with the IID form of the quantum measurements describing the device, indeed leads to an IID box $P_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ as in Equation (7.1). In particular, this implies that $A_{1},A_{2},\dots,A_{n}$ are IID RV. Furthermore, it follows from Equation (7.8) that, for all $i\in[n]$, the quantum system $E_{i}$ holds information only regarding the output $A_{i}$ of the same round (that is, $A_{1}$ and $E_{2}$, for example, are independent of one another).

Recall from Section 4.2.3 that the central task when proving security of quantum cryptographic protocols is to bound the amount of information that Eve may obtain about certain values generated by the protocol, which are supposed to be unknown to her. In the case of randomness certification the main technical step of all soundness proofs is to lower-bound the smooth min-entropy of Alice’s outputs $\mathbold{A}=A_{1},A_{2},\dots,A_{n}$ (see, e.g., Protocol 1.1). Our goal is therefore to lower-bound $H^{\varepsilon}_{\min}(\mathbold{A}|\mathbold{E})$, where $\mathbold{E}=E_{1},E_{2},\dots,E_{n}$ are Eve’s IID quantum systems appearing in Equation (7.8).

The rough idea behind a security proof under the IID assumption is illustrated in Figure 7.3 and is rather simple. The first step is the estimation of the winning probability $\omega$ of the single-round box defining the IID box, i.e., the unknown state $\sigma_{Q_{A}Q_{B}}$. Alice and Bob play the $n$ games with each of their independent quantum boxes and collect the statistics. Denoting by $W_{i}$ the RV describing whether the $i$’th game is won or not, the IID assumption implies that $W_{1},W_{2},\dots,W_{n}$ are, as well, IID RV. Thus, it follows from Chernoff’s bound that the average $\frac{1}{n}\sum_{i}W_{i}$ is close to the expected winning probability $\mathbb{E}[W]$, which is no other than the winning probability $\omega$ of a single copy of the state (see Equation (5.1)). That is,

[TABLE]

The second step is to lower-bound the conditional smooth min-entropy $H^{\varepsilon}_{\min}(\mathbold{A}|\mathbold{E})$ as a function of $\omega$. Due to the IID assumption, we can do so using the quantum AEP presented as Theorem 7.2 above. Specifically, for large enough $n$ we have

[TABLE]

where $f(\omega)$ is some function of $\omega$ that lower-bounds the conditional von Neumann entropy $H(A|E)_{\sigma}$ for any state $\sigma$ with the estimated winning probability $\omega$.131313We previously wrote $\sigma$ as the tripartite state $\sigma_{Q_{A}Q_{B}E}$ while here we are referring also to the classical register $A$. What is meant by this notation is that $\sigma$ is a state which can lead to winning probability $\omega$ when measured with some given measurements $\left\{M_{a}^{x}\right\}$ and $\left\{M_{b}^{y}\right\}$. The result of measuring $Q_{A}$ with $\left\{M_{a}^{x}\right\}$ defines the RV $A$. For the CHSH game, such a function $f(\omega)$ was given in Lemma 5.2 as part of the discussion of single-round boxes.

In certain protocols one would like to use different copies of the boxes in different ways. For example, in device-independent quantum key distribution the protocol includes “test rounds” and “generation rounds”. Alice’s usage of the box in a test round may be different than her usage in a generation round. The winning probability $\omega$ is estimated from the statistics collected in the test rounds, as discussed above. Using the IID assumption we can conclude that the other boxes, utilised in the generation rounds, could have also been used to win the game with probability $\omega$, even though Alice and Bob do not test these boxes.

Clearly, the IID assumption plays a crucial role in the above proof sketch; it allows us to talk about a single-round box, estimate its winning probability in a meaningful way, and, furthermore, to bound the total amount of smooth min-entropy of the outputs as the number of games played times the von Neumann entropy of the output of a single game. In total, the IID assumption allows us to reduce the analysis of the multi-round box to that of a single-round box – the “physics” enters the analysis only in the single-round statement (e.g., Lemma 5.2) while the rest is done using standard mathematical tools such as Chernoff’s bound and the AEP.

Quantum key distribution key rates

The main fundamental difference between device-independent randomness certification and device-independent quantum key distribution is that in the latter Alice and Bob should share identical secret keys in the end of the protocol. To this end, they need to apply an additional classical post-processing step, namely, error correction. The goal of the error correction step is to reconcile the differences between Alice’s and Bob’s keys so they share the same final key with high probability.

In classical error correction protocols utilising one-way communication, Alice sends some classical information about her key to Bob. This information, together with all of Bob’s prior information, helps Bob conclude which key Alice is most likely to hold. If the information sent is not sufficient in order for Bob to derive a conclusion, the parties abort the protocol. Since Alice sends the additional information to Bob over a public (but authenticated) classical channel, this information also leaks to the adversary and hence increases her knowledge about Alice’s key. In other words, the leakage reduces the conditional smooth min-entropy – we now need to consider $H^{\varepsilon}_{\min}(\mathbold{A}|\mathbold{E}O)$, where $O$ denotes the leaked information, instead of $H^{\varepsilon}_{\min}(\mathbold{A}|\mathbold{E})$ appearing in Equation (7.9).

Notice the resulting tradeoff. To get good key rates, we wish to leak as little information as possible to the adversary (so we do not reduce the min-entropy by too much). On the other hand, we want the error correction step to succeed when Alice and Bob use the honest box141414If the box is malicious or simply noisier than we wished for, we anyhow expect the protocol to abort. Thus, we only ask that the error correction protocol does not abort with high probability when the honest implementation of the devices is used since, otherwise, it will affect the completeness of the protocol. and, thus, Alice needs to send a sufficient amount of information that will allow Bob to correct the errors. We therefore wish to minimise the amount of leakage needed for successful error correction. As explained in Section 4.2, this turns out to be quantified by the conditional smooth zero-entropy $H^{\varepsilon}_{0}(\mathbold{A}|\mathbold{B})$ [Renner and Wolf, 2005], which is closely related to the conditional smooth max-entropy $H^{\varepsilon}_{\max}(\mathbold{A}|\mathbold{B})$.

In many cases the honest box, which also incorporates the considered honest noise model, is chosen to be an IID box. (For example, a common choice is a box describing $n$ independent pairs of maximally entangled states which are being distributed over an IID noisy quantum channel.) Hence, one can use the AEP to get

[TABLE]

and by this upper-bound the amount of leakage due to error correction. All and all, under the IID assumption and for sufficiently large $n$, the key rate is governed by

[TABLE]

Equation (7.12) is usually referred to as the DW-formula since it first appeared in [Devetak and Winter, 2005, Theorem 2.1]. In [Renner and Wolf, 2005], the smooth entropies where used to describe the optimal key rates without employing the IID assumption and, by the use of the AEP, the results of [Renner and Wolf, 2005] imply Equation (7.12) (as we sketched above). Interestingly, [Devetak and Winter, 2005, Theorem 2.8] states that, up to some possible classical post-processing, Equation (7.12) is tight for any protocol utilising error correction with one-way communication.

Two last remarks are in order. Firstly, we would like to emphasise that Equation (7.10) does not rely on the IID assumption that we are making in order to simplify the soundness analysis. Here we are allowed to use the AEP since we choose to consider an IID box as our honest box. Other choices can also be made (if one, for example, wishes to analyse the protocol under a different honest noise model) and then the AEP might no longer be relevant. In Chapter 11 we will drop the IID assumption used for the soundness analysis but will still choose an IID honest implementation for the completeness analysis.

Secondly, since an adversary limited to preparing IID boxes is weaker than one that can make general multi-round boxes, tight key rates achieved under the IID assumption act as upper-bounds on the achievable key rates in the general setting. Thus, by calculating key rates using Equation (7.12) we usually already get a feeling of what is the best we can hope for when performing the general analysis. Indeed, [Pironio et al., 2009] used Equation (7.12) to derive tight key rates for device-independent quantum key distribution under the IID assumption for $n\rightarrow\infty$. These will act as an upper-bound when considering the most powerful quantum adversary in Chapter 11.

7.4 Beyond IID

In this chapter we studied the behaviour of IID boxes and saw how the main ingredient in an analysis of IID boxes is the analysis of a single-round box. In a way, one can say that once we understand the behaviour of a single-round box, we understand the “physics”, or the essence, of the problem at hand. Unfortunately, IID boxes are far from being the most general ones and so we are enforced to go beyond the IID analysis and consider more complicated objects, namely, the different types of multi-round boxes that we encountered in Chapter 6.

As explained in Chapter 1, it is the goal of this thesis to show that the analysis of IID boxes can be almost directly extended, at least in some cases, to the analysis of multi-round boxes via a reduction to IID. In the following chapters we present two techniques that can be used to reduce the analysis of parallel and sequential boxes to that of IID boxes; see Figure 7.4. Specifically, Chapter 8 deals with a technique called “de Finetti reduction” that relates permutation invariant parallel boxes to IID boxes [Arnon-Friedman and Renner, 2015]. Chapter 9 presents the so called “entropy accumulation theorem” that relates sequential boxes, fulfilling certain Markov-chain conditions, to IID ones [Dupuis et al., 2016].

With the help of those techniques one can show that, in certain scenarios, the analysis of IID boxes is sufficient without loss of generality. This is not to say that all multi-round boxes are IID boxes; clearly this is not the case. Instead, we claim that even though there exist multi-round boxes that can not be described as IID boxes, one can sometimes restrict the attention solely to IID boxes and the rest will follow. This will be clarified with the aid of our showcases in Chapters 10 and 11.

Chapter 8 Reductions to IID: parallel interaction

Multi-round parallel boxes, discussed in Section 6.1, can display an almost arbitrary behaviour and hence are complicated to analyse. However, some additional structure of the boxes can be assumed when certain types of symmetries are present in the considered information processing task. In this chapter we focus on the analysis of parallel boxes that are permutation invariant. Permutation invariance is an inherent symmetry in many information processing tasks, device-independent tasks among them. Thus, analysing permutation invariant boxes (as defined below) is of special interest.

A well known family of tools used to study permutation invariant systems111Depending on the context, the term system may refer to a probability distribution, a quantum state, or a box. is the family of “de Finetti-type theorems”. A de Finetti-type theorem is any theorem that relates (in one way or another) permutation invariant systems to a more structured system, having the form of a convex combination of IID systems, called a de Finetti system (or state). The relation given by the theorem can be used, in certain cases, to argue that instead of analysing permutation invariant systems one can restrict the attention to the simpler to analyse (convex combination of) IID systems. A de Finetti theorem therefore acts as a reduction to IID.

The first de Finetti theorem [de Finetti, 1969] established that the collection of infinitely exchangeable sequences, i.e., distributions on infinite strings that are invariant under all permutations, exactly coincides with the collection of all convex combinations of IID distributions. Subsequent results gave quantitative bounds of different forms [Diaconis and Freedman, 1980a, Raggio and Werner, 1989, Caves et al., 2002, Renner, 2007, Christandl et al., 2007, Christandl et al., 2009, Christandl and Toner, 2009, Brandao and Harrow, 2013]. de Finetti-type theorems had proven to be useful in various proofs. The quantum de Finetti theorems, for example, enable a substantially simplified analysis of many quantum information tasks such as quantum cryptography [Christandl et al., 2009, Leverrier, 2014], tomography [Christandl and Renner, 2012], channel capacities [Berta et al., 2011] and complexity [Brandao and Harrow, 2013].

The de Finetti theorems listed above cannot be used in the device-independent setting for various reasons.222The mentioned theorems rely on some initial subsystem structure and/or a bound on the dimension of the subsystems. In the device-independent setting one cannot start with such assumptions regarding the considered boxes in general. In this chapter we present a de Finetti-type theorem, which was introduced in [Arnon-Friedman and Renner, 2015], that is applicable when working with parallel boxes. Our de Finetti theorem, termed “de Finetti reduction for correlations”, is then used in the analysis of one of our showcases, namely, non-signalling parallel repetition, in Chapter 10.

The chapter is arranged as follows. We start by explaining the notion of permutation invariance in the device-independent context in Section 8.1. The de Finetti reduction is presented and proven in Section 8.2. Section 8.3 exemplifies how the reductions can be used in two different general ways (while Chapter 10 deals with a specific application). The theorems proven in Section 8.3 clarify in what sense we think of a de Finetti reduction as a reduction to IID in the device-independent setting.

In accordance with the rest of the thesis, the chapter focuses only on the case of two parties. All the statements can be extended to any number of parties, as can be seen in [Arnon-Friedman and Renner, 2015].

8.1 Permutation invariance

As mentioned above, we are interested in considering permutation invariant parallel multi-round boxes. Let $n$ be the number of games that can be played with the parallel box of interest $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. A permutation $\pi$ is a bijective function $\pi:[n]\rightarrow[n]$. We denote $\pi(\mathbold{x})=x_{\pi^{-1}(1)},x_{\pi^{-1}(2)},\dots,x_{\pi^{-1}(n)}$ and similarly for $\pi(\mathbold{y})$, $\pi(\mathbold{a})$, and $\pi(\mathbold{b})$. A permutation invariant box333The definition and the derived theorem are independent of the nature of the box, i.e., if it is classical, quantum, non-signalling, or even signalling. This will be addressed in Section 8.2. is defined as follows.

Definition \thedefn (Permutation invariant box).

Given a parallel multi-round box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, defined over $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, and a permutation $\pi:[n]\rightarrow[n]$ we denote by $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\circ\pi$ the box defined by

[TABLE]

A parallel multi-round box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is said to be permutation invariant if and only if

[TABLE]

Figure 8.1 illustrate the action of permuting a parallel box. The action of the permuted box can be understood as follows: First, the box applies the permutation $\pi$ on the inputs. Second, it uses the initial box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ to produce the intermediate outputs. Lastly, it applies the inverse permutation $\pi^{-1}$ on the intermediate outputs and returns these final strings as the ultimate outputs. Note that only the inputs and the outputs of the box are being permuted, all using the same permutation $\pi$. In particular, we do not permute the parties, that is, Alice and Bob do not swap their inputs and outputs with one another.

As we are merely permuting the classical inputs and outputs, the box itself need not to have a subsystem structure. That is, we do not require, e.g., $\mathrm{P}_{A_{1}|X_{1}}$ to be a valid system (i.e., a conditional probability distribution). This is in contrast to, e.g., quantum de Finetti-type theorems such as [Renner, 2007, Christandl et al., 2009], where the permutation is applied on the quantum states themselves.444In a quantum de Finetti statement a permutation takes a state $\ket{\phi_{1}}\otimes\dots\ket{\phi_{n}}$ to $\ket{\phi_{\pi^{-1}(1)}}\otimes\dots\ket{\phi_{\pi^{-1}(n)}}$. That is, the quantum states themselves are being permuted.

This distinction is relevant when wishing to discuss general parallel boxes (recall Section 6.1).

In some applications (e.g., the showcase considered in Chapter 10) one can easily show that it is sufficient to consider permutation invariant boxes without loss of generality. If this is not the case, it is also possible to enforce permutation invariance. A protocol, for example, can be modified to enforce the symmetry by adding a step in which a random permutation is applied555Depending on the considered scenario, the application of the permutation may be a purely theoretical step or needs to be done in practice. on the box and by this make it permutation invariant. Precisely: given any parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, let

[TABLE]

be the result of applying a permutation $\pi$, chosen uniformly at random out of all permutations, on the original box. It can be easily verified that $\tilde{\mathrm{P}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is indeed a permutation invariant box.

8.2 de Finetti reductions for correlations

A de Finetti-type theorem is any theorem that relates a permutation invariant system to a much more structured system called a de Finetti system. In our context, we consider permutation invariant and de Finetti boxes. A de Finetti box is defined as follows.

Definition \thedefn (de Finetti box666As previously mentioned, we focus on the case of two parties. The definition extends to any number of parties trivially.).

A de Finetti box is any box of the form of a convex combination of IID boxes. That is, it is a box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, defined over $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, such that

[TABLE]

where $\mathrm{d}\mathrm{O}_{AB|XY}$ is some measure on the space of bipartite boxes over $\mathcal{A}$, $\mathcal{B}$, $\mathcal{X}$, and $\mathcal{Y}$ and $\mathrm{O}_{AB|XY}^{\otimes n}$ is the IID box defined by $\mathrm{O}_{AB|XY}$, i.e.,

[TABLE]

As seen from the above definition, by choosing different measures $\mathrm{d}\mathrm{O}_{AB|XY}$ we define different de Finetti boxes. Depending on the measure, $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ may be classical, quantum, non-signalling, or even signalling between the two parties. If the measure $\mathrm{d}\mathrm{O}_{AB|XY}$ assigns weight only to, e.g., non-signalling boxes $\mathrm{O}_{AB|XY}$, then the de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is non-signalling as well. The other direction does not necessarily hold – there are convex combinations of signalling boxes that result in over-all non-signalling boxes.

A de Finetti reduction is a de Finetti-type theorem of a specific form: it sets an inequality relation between any permutation invariant box to a certain de Finetti box. Specifically, the following theorem is a de Finetti reduction for any permutation invariant conditional probability distribution [Arnon-Friedman and Renner, 2015].777In [Arnon-Friedman and Renner, 2015], a more general version of Theorem 8.1 was proven, in which further symmetries of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ (on top of permutation invariance) can be exploited to construct more structured de Finetti boxes and prove de Finetti reductions with improved parameters. Theorem 8.1 was then derived as a corollary. To keep things (relatively) concise, we present in this thesis a direct proof of Theorem 8.1.

Theorem 8.1** (de Finetti reduction for conditional probability distributions).**

For any $\mathcal{X}$, $\mathcal{Y}$, $\mathcal{A}$, $\mathcal{B}$, and $n$ there exists a de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, defined over $\mathcal{X}^{n},\mathcal{Y}^{n},\mathcal{A}^{n},\mathcal{B}^{n}$, such that for every permutation invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$

[TABLE]

To see why Theorem 8.1 is not trivial and what needs to be done to prove it, let us first consider a “bad choice” of a de Finetti box, $\tau^{\text{bad}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Imagine that we choose our de Finetti box to be the uniform distribution over $\mathcal{A}^{n}\times\mathcal{B}^{n}$ for all $\mathbold{x}$ and $\mathbold{y}$. With this chocie, $\tau^{\text{bad}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}(\mathbold{a},\mathbold{b}|\mathbold{x},\mathbold{y})=\left(|\mathcal{A}||\mathcal{B}|\right)^{-n}$ for all $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$. Then, the only inequality relation that holds is

[TABLE]

i.e., a relation with a pre-factor exponential in $n$. By choosing a “good” de Finetti box, we are able to get a pre-factor polynomial in $n$ instead; this is crucial for applications of de Finetti reductions. In Section 8.3 we show how Theorem 8.1 can be utilised as a reduction to IID in certain scenarios.888A curious reader may already take a glimpse of Theorems 8.2 and 8.3.

The proof of the theorem proceeds in two steps. In the first, an explicit de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is constructed and a lower-bound on its entries is calculated. In the second step the permutation invariance of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is used to upper-bound its entries. The theorem follows by combining the two bounds.

In the proofs below we use the following notation.

$|\mathcal{X}||\mathcal{Y}|=l$ and we identify each pair $(x,y)\in\mathcal{X}\times\mathcal{Y}$ with a label $j\in[l]$ by writing $(x,y)=j$. 2. 2.

$|\mathcal{A}||\mathcal{B}|=m$ and we identify each pair $(a,b)\in\mathcal{A}\times\mathcal{B}$ with a label $k\in[m]$ by writing $(a,b)=k$. 3. 3.

For all $j\in[l]$ and $k\in[m]$, $p^{j}_{k}\in[0,1]$ such that $\sum_{k}p^{j}_{k}=1$. 4. 4.

For all $j\in[l]$ and $k\in[m]$, $c^{j}_{k}=1-\sum_{t<k}p^{j}_{t}$. 5. 5.

For all $\mathbold{x}$, $\mathbold{y}$, and $j\in[l]$, $n^{j}=|\left\{i:(x_{i},y_{i})=j\right\}|$, i.e., $n^{j}$ denotes the number of indices of $(\mathbold{x},\mathbold{y})$ in which the type of inputs is $(x,y)=j$. 6. 6.

For all $\mathbold{x}$, $\mathbold{y}$, $\mathbold{a}$, $\mathbold{b}$, $j\in[l]$, and $k\in[m]$, $n^{j}_{k}=|\left\{i:(x_{i},y_{i})=j\land(a_{i},b_{i})=k\right\}|$, i.e., $n^{j}_{k}$ denotes the number of indices of $(\mathbold{x},\mathbold{y},\mathbold{a},\mathbold{b})$ in which the type of inputs is $(x,y)=j$ and the type of outputs is $(a,b)=k$.

Note that by definition:

For all $j\in[l]$ and $k\in[m-1]$, $p^{j}_{k}\in[0,c^{j}_{k}]$ and $p^{j}_{m}=c^{j}_{m}$. 2. 2.

For all $j\in[l]$, $n^{j}_{m}=n^{j}-\sum_{k=1}^{m-1}n^{j}_{k}$.

According to Definition 8.2, a de Finetti box is defined via the choice of measure $\mathrm{d}\mathrm{O}_{AB|XY}$. We think of a bipartite box $\mathrm{O}_{AB|XY}$ as a set of probabilities $p^{j}_{k}$, with the identification $\mathrm{O}_{AB|XY}(a,b|x,y)=p^{j}_{k}$ for $(x,y)=j$ and $(a,b)=k$. Thus, we can define a measure over $\mathrm{O}_{AB|XY}$ by a measure over the probabilities $p^{j}_{k}$. Our chosen measure is

[TABLE]

where $\mathrm{d}p^{j}_{k}$ is the uniform measure over $[0,c^{j}_{k}]$ for $c^{j}_{k}$ defined above. The resulting de Finetti box is given by

[TABLE]

The measure $\mathrm{d}\mathrm{O}_{AB|XY}$ assigns some weight to all conditional probability distributions $\mathrm{O}_{AB|XY}$. As a result, the de Finetti box in Equation (8.3) is signalling. This is discussed in Section 8.4 below.

The following lower-bound on the entries of the above de Finetti box is proven in Appendix A.1:

Lemma \thelem.

For all $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$,

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is as in Equation (8.3).

Next, we exploit the permutation invariance of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ to prove the following upper-bound on it:

Lemma \thelem.

For every permutation invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, as in Definition 8.1, and for all $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$,

[TABLE]

Proof.

To prove the lemma we bound the value of a specific entry $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}(\mathbold{a},\mathbold{b}|\mathbold{x},\mathbold{y})$ by counting how many entries $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}(\tilde{\mathbold{a}},\tilde{\mathbold{b}}|\mathbold{x},\mathbold{y})$ must have the same value as $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}(\mathbold{a},\mathbold{b}|\mathbold{x},\mathbold{y})$ due to permutation invariance. The normalisation of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ then implies a bound on the value of the entries.

Denote

[TABLE]

The permutation invariance of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ implies that $\mathcal{N}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})$ is lower-bounded by the number permutations $\pi$ for which $\pi(\mathbold{x})=\mathbold{x}$, $\pi(\mathbold{y})=\mathbold{y}$. To keep $\pi(\mathbold{x})=\mathbold{x}$ and $\pi(\mathbold{y})=\mathbold{y}$, the relevant permutations $\pi$ are only allowed to permute indices with the same input type $(x,y)$. The number of such permutations is exactly $\prod_{j=1}^{l}{n^{j}\choose{n^{j}_{1},\dots,n^{j}_{m}}}$. Thus,

[TABLE]

and

[TABLE]

Proof of Theorem 8.1..

Using Lemmas 8.2 and 8.2 one can easily prove Theorem 8.1. For all $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$,

[TABLE]

To end this section let us give a last remark regarding Theorem 8.1. Notice the order of the quantifiers; there exists one de Finetti box for which Equation (8.2) holds for all permutation invariant box. For the purpose of applications, one could also imagine a different statement in which for each permutation invariant box a de Finetti box is constructed (i.e., different permutation invariant boxes may be related to different de Finetti boxes). Such a statement has the potential of improving the obtained parameters and simplifying the use of the reduction in applications (see also [Arnon-Friedman and Renner, 2015] for examples of such statements).

8.3 Ways of using the reductions

The main motivation for considering de Finetti reductions as in Theorem 8.1 is to allow us to simplify the analysis of device-independent information processing tasks. However, it is a priori not clear how one can bring an inequality as that in Equation (8.2) into work. The aim of this section is to exemplify the usage of the inequality in a mathematical way by considering two types of abstract applications. Chapter 10 discusses a more concrete application of the reduction to prove a non-signalling parallel repetition theorem.

To derive the results presented in this section we use an alternative, but equivalent, version of the de Finetti reduction; this is the topic of Section 8.3.1 below. Sections 8.3.2 and 8.3.3 present two ways of using the de Finetti reduction via the alternative formulation.

8.3.1 Post-selecting permutation invariant boxes

Lemma \thelem.

There exists a de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and a non-signalling extension999Note that $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ may be signalling, as in our previous statements. The fact that we are considering non-signalling extensions only means that the marginals $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and $\tau_{C|Z}$ of $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ are well defined. of it (Definition 3.1.1) to a larger box $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ such that for every permutation invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ there exists an input $z$ and an output of this input $c_{z}$ for which

[TABLE]

where $l=|\mathcal{X}||\mathcal{Y}|$ and $m=|\mathcal{A}||\mathcal{B}|$.

This lemma states that there exists a de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and a non-signalling extension of it $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ such that any permutation invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ can be post-selected from it with probability greater or equal to $\frac{1}{(n+1)^{l(m-1)}}$. When we say that $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ can be post-selected we mean that there exists an input $z$ to $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ and an output $c_{z}$ of this input such that with probability $\tau_{C|Z}(c_{z}|z)\geq\frac{1}{(n+1)^{l(m-1)}}$ the resulting box (the “post-measurement box”, using terminology borrowed from quantum physics) is $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ (see Figure 8.2). Note that we consider a single extension $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ of the box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, and by choosing different inputs $z$ we can post-select different boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$.

It is easy to see how to derive Lemma 8.3.1 from Theorem 8.1 by using the formalism introduced in [Hänggi et al., 2010b, Hänggi and Renner, 2010] of partitions of a conditional probability distribution. We repeat here the relevant statements.

Definition \thedefn.

A partition of a box $\mathrm{Q}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a family of pairs $\left\{\left(q_{c},\mathrm{Q}^{c}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)\right\}_{c}$ where $q_{c}\geq 0$, $\sum_{c}q_{c}=1$, and the boxes $\mathrm{Q}^{c}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ are such that

[TABLE]

Lemma \thelem (Lemma 9 in [Hänggi et al., 2010b]).

Given a box $\mathrm{Q}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, there exists a partition with element $\left(q_{c},\mathrm{Q}^{c}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)$ if and only if

[TABLE]

Lemma \thelem (Lemma 3.2 in [Hänggi and Renner, 2010]).

Given a box $\mathrm{Q}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, let $Z$ be the set of all partitions $\left\{\left(q_{c_{z}},\mathrm{Q}^{c_{z}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)\right\}_{c_{z}}$ of $\mathrm{Q}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Then, there exist a non-signalling extension $\mathrm{Q}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ of $\mathrm{Q}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, an input $z$, and an output $c_{z}$ such that

[TABLE]

Using the lemmas above and Theorem 8.1 we can now prove Lemma 8.3.1.

Proof of Lemma 8.3.1..

The above lemmas together with Theorem 8.1 imply that for any permutation invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, $\left(\frac{1}{(n+1)^{l(m-1)}},\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)$ is an element of a partition of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Moreover, there exists a box $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ and an input $z$ such that with probability $\frac{1}{(n+1)^{l(m-1)}}$ the resulting box is $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$:

[TABLE]

Lemma 8.3.1 is used in the following sections to illustrate two ways in which de Finetti reductions can be used in applications.

8.3.2 Failure probability of a test

We start by considering the following abstract application. Let $\mathcal{T}$ be a test which interacts with a box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and outputs “success” or “fail” with some probabilities. One can think about this test, which can be chosen according to the application being considered, as a way to quantify the success probability of a protocol when the box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is given as input. For example, if one considers an estimation, or a tomography, protocol a test can be chosen to output “success” when the estimated box is close to the actual box [Christandl et al., 2009]. Another type of test will be considered explicitly in Section 10.2.

A test $\mathcal{T}$ interacts with $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ by supplying it with inputs $\mathbold{x},\mathbold{y}$, according to some probability distribution $\mathrm{Pr}_{\mathcal{T}}(\mathbold{x},\mathbold{y})$ over $\mathcal{X}^{n}\times\mathcal{Y}^{n}$, and collecting its outputs $\mathbold{a},\mathbold{b}$. This is illustrated in Figure 8.3. The test then decides whether to output [math] or $1$ depending on $\mathbold{x}$, $\mathbold{y}$, $\mathbold{a}$, and $\mathbold{b}$. Given a test $\mathcal{T}$, we denote by $\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ the failure probability of the test, i.e., the probability that $\mathcal{T}$ outputs [math] after interacting with $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$:

[TABLE]

The event of failing the test can therefore be defined as an event over $\mathcal{X}^{n}\times\mathcal{Y}^{n}\times\mathcal{A}^{n}\times\mathcal{B}^{n}$.

We consider permutation invariant tests, defined as follows.

Definition \thedefn.

A test $\mathcal{T}$ is permutation invariant if and only if for all boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and all permutations $\pi$ we have

[TABLE]

Using the de Finetti reduction in Theorem 8.1 we can prove upper bounds of the following type:

Theorem 8.2**.**

Let $\mathcal{T}$ be a permutation invariant test. Then for every box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is the de Finetti box given in Equation (8.3).

The importance of de Finetti reductions is already obvious from Theorem 8.2 — if one wishes to prove an upper bound on the failure probability of the test $\mathcal{T}$, then instead of proving it for all boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, it is sufficient to prove it for the de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and “pay” for it with the additional polynomial pre-factor of $(n+1)^{l(m-1)}$. Since the de Finetti box can be written as a convex combination of IID boxes, this can highly simplify the calculations of the bound. In this sense the de Finetti reduction acts as a reduction to IID.

In many cases one finds that the bound on $\mathrm{Pr}_{\textup{fail}}(\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ is exponentially small in $n$. For an estimation protocol, the failure probability of the test, when interacting with an IID box, can be shown to be exponentially small in the number of boxes $n$ used for the estimation, using Chernoff bounds. This is also the case when dealing with security proofs – the failure probability of a protocol, when a de Finetti box is given as input, is usually exponentially small in the number of boxes $n$ used in the protocol. If this is indeed the case then the polynomial pre-factor of $(n+1)^{l(m-1)}$ becomes irrelevant in the asymptotic limit of large $n$. In other words, an exponentially small bound on $\mathrm{Pr}_{\textup{fail}}(\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ implies an exponentially small bound on $\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$.

Let us prove Theorem 8.2 using the de Finetti reduction given as Theorem 8.1.

Proof of Theorem 8.2..

We follow here a similar proof given in [Renner, 2010] for the quantum post-selection theorem [Christandl et al., 2009]. First, since the test $\mathcal{T}$ is permutation invariant it is sufficient to consider only permutation invariant boxes. To see this recall that for any box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and permutation $\pi$ we have $\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})=\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\circ\pi)$ according to Definition 8.3.2. Therefore we also have by linearity101010Linearity refers here to the linearity of the test in the box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, which follows from the fact that the test interacts only once with $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ (or, in other words, the test gets only a single copy of the box).

[TABLE]

The box $\frac{1}{n!}\sum_{\pi}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\circ\pi$ is permutation invariant and therefore we can consider only permutation invariant boxes without loss of generality.

Next we define the following probabilities. Let $\mathrm{Pr}_{\textup{fail}\land c_{z}}(\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})$ be the probability that the second part of the box, $\tau_{C|Z}$, is used with the input $z$ and the output is $c_{z}$ and that the first part of the box, $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, fails the test $\mathcal{T}$ at the same time. That is,

[TABLE]

In a similar way we define $\mathrm{Pr}_{\textup{fail}|c_{z}}(\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})$ to be the probability that $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ fails the test $\mathcal{T}$ given that $c_{z}$ is the output of $\tau_{C|Z}$ when used with the input $z$. We have

[TABLE]

since $\mathrm{Pr}_{\textup{fail}\land c_{z}}(\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})\leq\mathrm{Pr}_{\textup{fail}}(\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ always holds.

Lemma 8.3.1 implies that $\tau_{C|Z}(c_{z}|z)\geq\frac{1}{(n+1)^{l(m-1)}}$ and that $\mathrm{Pr}_{\textup{fail}|c_{z}}(\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})=\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ (given that the output was $c_{z}$, the resulting box is $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$). All together we get $\mathrm{Pr}_{\textup{fail}}(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})\leq(n+1)^{l(m-1)}\mathrm{Pr}_{\textup{fail}}(\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})$ as required. ∎

8.3.3 Diamond norm

Theorem 8.1 allows for a simple treatment of cases that can be analysed using the notation of a test. In some information processing tasks this is not possible and different ways of utilising the reductions are needed. In this section we consider the task of distinguishing two channels acting on boxes. The channels can describe, for example, a cryptographic protocol.111111Let us briefly explain why the notation of a test considered in Section 8.3.1 is not appropriate in the cryptographic setting. When considering tests, we were interested in events defined over $\mathcal{X}^{n}\times\mathcal{Y}^{n}\times\mathcal{A}^{n}\times\mathcal{B}^{n}$. Whether an output of a protocol (a key, for example) is secure to use cannot be defined as an event. Security depends on the process of producing the key rather on the specific data that was produced during the run of the protocol.

When considering quantum protocols the distinguishing advantage is given by the diamond norm [Kitaev, 1997]. The distance between two channels $\mathcal{E}$ and $\mathcal{F}$ which act on quantum states $\rho_{AB}$ is given by $\|\mathcal{E}-\mathcal{F}\|_{\diamond}=\underset{\rho_{ABC}}{\max}\|\left(\mathcal{E}-\mathcal{F}\right)\otimes\mathbb{I}\;\rho_{ABC}\|_{1}$ where $\rho_{ABC}$ is a purification of $\rho_{AB}$ and $\|\cdot\|_{1}$ is the trace distance. Informally, the idea is that in order to distinguish two channels we are not only allowed to choose the input state to the channels, $\rho_{AB}$, but also keep to ourselves a purifying state $\rho_{C}$.

Although the definition of the diamond norm includes a maximisation over all states $\rho_{ABC}$ it was proven, using the quantum post-selection theorem [Christandl et al., 2009], that when considering permutation invariant channels it is sufficient to calculate the distance for a specific quantum de Finetti state. Motivated by this, we give a similar bound on a distance analogous to the diamond norm for channels which act on boxes (instead of quantum states).

In the following, we denote by $\mathcal{P}$ the set of all boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and by $\mathcal{K}$ the set of all probability distributions $\mathrm{P}_{K}$ over $\{0,1\}^{t}$ for some $t\in\mathbb{N}$. We consider channels of the form $\mathcal{E}:\mathcal{P}\rightarrow\mathcal{K}$ which interact with boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and output a classical bit string $k\in\{0,1\}^{t}$ of some length $t\geq 0$ with some probability $\mathrm{P}_{K}(k)$. The connection between the channel and the box is illustrated in Figure 8.4.121212Figure 8.4 is almost identical to Figure 8.3, describing a test. The difference between the two scenarios lies in the quantity that we wish to bound; see the previous footnote.

The probability distribution of the output depends on the channel $\mathcal{E}$ itself and is given by the following definition.

Definition \thedefn.

The probability that a channel $\mathcal{E}$ outputs a string $k\in\{0,1\}^{t}$ when interacting with $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is

[TABLE]

where $\mathrm{Pr}_{\mathcal{E}}(x)$ is the probability that $\mathcal{E}$ inputs $\mathbold{x},\mathbold{y}$ to $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and $\mathcal{E}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})$ is the function according to which the output of the channel is determined. Analogously,

[TABLE]

Definition \thedefn.

The distance between two channels $\mathcal{E},\mathcal{F}:\mathcal{P}\rightarrow\mathcal{K}$ according to the diamond norm is

[TABLE]

where the maximisation is over all boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and all possible extensions of them and

[TABLE]

$\mathcal{F}\otimes\mathbb{I}(\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})$ is defined in a similar way.

Similarly to the concept of a permutation invariant test presented in Definition 8.3.2, we define a permutation invariant channel:

Definition \thedefn.

A channel $\mathcal{E}$ is permutation invariant if for all boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and all permutations $\pi$ we have

[TABLE]

Using the de Finetti reduction, Theorem 8.1, we prove the following theorem.

Theorem 8.3**.**

For any two permutation invariant channels $\mathcal{E},\mathcal{F}:\mathcal{P}\rightarrow\mathcal{K}$

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ is a non-signalling extension of the de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ where given in Equation (8.3).

Theorem 8.3 tells us that when looking to bound the diamond norm for permutation invariant channels, one does not need to optimise over all possible boxes (as in Definition 8.3.3) but can consider only extensions of de Finetti boxes131313Note, however, that the extension $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ itself cannot be written as a convex combination of IID boxes, only its marginal $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a de Finetti box. Furthermore, $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ may be signalling in general, as before. without loss of generality. This gives us another example as to why a de Finetti reduction is a reduction to IID technique. As in the case of Theorem 8.2 if one is able to find an exponentially small upper bound on $\|\left(\mathcal{E}-\mathcal{F}\right)\otimes\mathbb{I}(\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z})\|_{1}$, an exponentially small upper bound on $\|\mathcal{E}-\mathcal{F}\|_{\diamond}$ follows. That is, the polynomial pre-factor $(n+1)^{l(m-1)}$ does not affect the asymptotic behaviour.

The proof of Theorem 8.3 builds on the following lemma.

Lemma \thelem.

For every two permutation invariant channels $\mathcal{E},\mathcal{F}:\mathcal{P}\rightarrow\mathcal{K}$ where $\mathrm{P}_{K}$ is a probability distribution over $k\in\{0,1\}^{t}$ for some $t>0$, and all $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$,

[TABLE]

where $\tau^{\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ is a non-signalling extension of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ which depends on the specific box $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$.

The proof of the lemma follows by using Lemma 8.3.1 in order to construct a specific convex decomposition of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ from a convex decomposition of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. A detailed proof is given in Appendix A.2.

Theorem 8.3 now easily follows from Lemma 8.3.3:

Proof of Theorem 8.3.

Using Lemma 8.3.3,

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ is a non-signalling extension of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. ∎

8.4 Impossibility results

Before concluding this chapter, let us discuss the directions in which one could hope to further develop the technique of device-independent de Finetti reductions. We do so by presenting several impossibility results with regards to different variants of Theorem 8.1.

Restricted de Finetti box

First, as explained in the above sections, our de Finetti box, given in Equation (8.3), is a signalling box. Clearly, this raises some difficulties when coming to use the different theorems presented in this chapter.141414Though this does not make them useless; see Chapter 10. Ideally, we would have wished to have a de Finetti reduction in which the de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ can be quantum or non-signalling when starting with a quantum or non-signalling box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. That is, we wish to find reductions of the form (with some $c$ polynomial151515Weaker statements, e.g., with a pre-factor sub-exponential in $n$, may also be of interest in certain applications. in $n$):

[TABLE]

where $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}$ and $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}$ are quantum boxes and, similarly, $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{ns}}$ and $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{ns}}$ are non-signalling boxes.

Sadly, such reductions cannot be true when considering general permutation invariant boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}$ and $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{ns}}$. One way to see that this is the case is by considering the task of parallel repetition of games (which acts as one of our showcases; see Section 4.1). Reductions as those in Equation (8.5) will imply very strong parallel repetition results. Indeed, if, e.g., $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}\leq c\cdot\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}$ holds for any permutation invariant quantum box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{quant}}$, then it follows that, for any game,

[TABLE]

where $w\left(\circ\right)$ is the winning probability of the considered box in the repeated game, $\omega$ is the winning probability of the optimal quantum strategy in a single game, and $\mathrm{poly}(n)$ is some polynomial of $n$, possibly depending on the alphabet of the RVs $A$, $B$, $X$, and $Y$. However, there are examples of games (in the classical, quantum, and non-signalling case) for which a strong decrease in the winning probability with the number of games played $n$, as in Equation (8.6), does not hold; recall Section 4.1. Thus, reductions as in Equation (8.5) cannot be true.

Knowing that Equation (8.5) is not more than a wishful thinking, one could hope for the next best thing, i.e., an approximate version of the reduction. Concretely, we are interested in reductions of the form

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{approx-quant}}$ is an approximately-quantum de Finetti box and $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{approx-ns}}$ is an approximately-non-signalling one. By approximately-quantum (and analogously for the non-signalling case) we mean that the de Finetti box can be written as

[TABLE]

where $\mathrm{d}\mathrm{O}_{AB|XY}^{\text{quant}}$ and $\mathrm{d}\mathrm{O}_{AB|XY}^{\text{non-quant}}$ are measures over quantum and non-quantum single-round boxes, respectively, and $\int\mathrm{d}\mathrm{O}_{AB|XY}^{\text{non-quant}}$ is, say, exponentially small in $n$ and/or assigns weight only to boxes $\mathrm{O}_{AB|XY}^{\text{non-quant}}$ which are close to quantum boxes, under some distance measure.161616The hope here is that by adding the additional weight on non-quantum or signalling boxes one could account for the “gap” between Equation (8.6) and the known parallel repetition results.

Parallel repetition results can, again, be used to show that such reductions cannot hold in general, at least in the non-signalling case. Here the reason lies in the observation that the reductions in Equation (8.7) are independent of the choice of distribution over the inputs $\mathcal{X}^{n}$ and $\mathcal{Y}^{n}$ (while they may depend on the alphabet of the inputs). Thus, they would imply general parallel repetition results which hold for any distribution over the inputs to the parallel boxes. As there are games for which such non-signalling parallel repetition results do not hold [Holmgren and Yang, 2017], at best $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{ns}}\leq c\cdot\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}^{\text{approx-ns}}$ cannot be true in general.

By this we learn that we ought to consider reductions that also include the input distribution $\mathrm{P}_{\mathbold{X}\mathbold{Y}}$:

[TABLE]

The case of $\mathrm{P}_{\mathbold{X}\mathbold{Y}}=\mathrm{Q}_{XY}^{\otimes n}$ is of special interest. For such distributions, two results are known. In Section 10.2 we prove a result in the flavour of Equation (8.9) using the de Finetti reduction given as Theorem 8.1. The result, which originally appeared as part of [Arnon-Friedman et al., 2016b], is stated informally as Theorem 10.2. Roughly speaking, it says that observed data that is sampled using a permutation invariant non-signalling parallel box looks as if it was sampled using an approximately non-signalling IID box.

In [Lancien and Winter, 2016] a reduction similar to that of Equation (8.9) was proven by combining the de Finetti reduction in Theorem 8.1 together with another de Finetti-type theorem, presented in [Lancien and Winter, 2017]. Their theorem can be written as follows:171717We present only the bipartite case; [Lancien and Winter, 2016, Theorem 4.3] is stated for an arbitrary number of parties.

Theorem 8.4** (Theorem 4.3 in [Lancien and Winter, 2016]).**

For any non-signalling permutation invariant parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and distribution $\mathrm{Q}_{XY}$

[TABLE]

where

[TABLE]

for $\mathrm{F}$ the fidelity.

To see that Equation (8.10) is in the spirit of Equation (8.9) note that $\tilde{\mathrm{F}}\left(\mathrm{O}_{ABXY}\right)$ is some measure of how far $\mathrm{O}_{ABXY}$ is from $\mathrm{Q}_{XY}\tilde{\mathrm{O}}_{AB|XY}$ for a non-signalling box $\tilde{\mathrm{O}}_{AB|XY}$. Recall that the fidelity is small when the distributions are far from one another; thus, $\tilde{\mathrm{F}}\left(\mathrm{O}_{ABXY}\right)^{2n}$ assures that only negligible weight is assigned to distributions $\mathrm{O}_{ABXY}$ originating from highly signalling boxes (or with marginals $\mathrm{O}_{XY}$ far from $\mathrm{Q}_{XY}$).

We conjecture that reductions similar to Equation (8.8), relevant for quantum boxes, should also hold. Yet, up to date there are no proofs in this direction (the difficulty in deriving such a statement is discussed in Chapter 10).

Extension to an adversary

Another direction in which one may wish to extend our de Finetti reductions is relevant for device-independent cryptographic protocols. To explain what we aim for, let us first discuss the quantum variant of Theorem 8.3, also called the post-selection technique, developed in [Christandl et al., 2009].181818[Christandl et al., 2009] presented the first de Finetti reduction, i.e., an inequality relation between permutation invariant systems and de Finetti systems (all previous de Finetti-type theorems gave other types of relations between the two systems). The term “de Finetti reduction” was not used at that time and the authors chose the name “post-selection technique” as they first proved the quantum analogue of Lemma 8.3.1. The post-selection theorem implies that for any two permutation invariant quantum channels, $\mathcal{E}$ and $\mathcal{F}$, acting on quantum states $\rho_{\mathbold{Q_{A}}\mathbold{Q_{B}}}\in\mathcal{S}(\mathscr{H}_{Q_{A}Q_{B}}^{\otimes n})$ for some bipartite Hilbert space $\mathscr{H}_{Q_{A}Q_{B}}$ of dimension $d$,

[TABLE]

where $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E}$ is a purification of a given de Finetti state. Equation (8.11) should be compared to Equation (8.4); while Equation (8.4) includes a maximisation over all possible non-signalling extensions of the de Finetti box, in Equation (8.11) we consider only a single purification. The reason is simple – in the quantum case all purifications of a state are equivalent up to local unitaries. Furthermore (and crucially for applications), there exists a purification of a de Finetti state that has a very special form. To purify

[TABLE]

we can first purify the states $\sigma_{Q_{A}Q_{B}}$ to get

[TABLE]

and then purify the state $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E^{\prime}}$ using an additional system $E^{\prime\prime}$ to account for the convex combination of the pure states $\left(\sigma_{Q_{A}Q_{B}E^{\prime}}\right)^{\otimes n}$. This defines us the pure state $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E^{\prime}E^{\prime\prime}}$. Denoting $E=E^{\prime}E^{\prime\prime}$ we get our pure $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E}$.

In the cryptographic setting the quantum register $E$ is considered to belong to the adversary. Hence, any information about the structure of the system kept in it could be useful when analysing security. Equation (8.11) in combination with the observation regarding the structure of the purification, $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E^{\prime}E^{\prime\prime}}$, we learn that the main task when proving security is to analyse the IID case, as in Chapter 7 (see [Christandl et al., 2009, Renner, 2010] for the detailed explanation). That is, the quantum de Finetti reduction can be used as a reduction to IID in quantum cryptography.

In contrast, in general, it is impossible to prove a modified version of Theorem 8.3 in which the extension $\tau_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ of our de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ will be as structured as the quantum state $\tau_{\mathbold{Q_{A}}\mathbold{Q_{B}}E}$. In particular, even if we can start with a de Finetti reduction where both $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ are non-signalling,191919In the presence of certain types of symmetries (in addition to permutation invariance) one can derive such de Finetti reductions; see [Arnon-Friedman and Renner, 2015]. it is impossible to derive a theorem which would imply that the analysis of device-independent cryptography in the presence of a non-signalling adversary can be reduced to the analysis under the IID assumption. This is due to the impossibility result of [Arnon-Friedman and Ta-Shma, 2012], which asserts that, while exponential privacy amplification in the presence of a non-signalling adversary is possible under the IID assumption [Hänggi et al., 2009], it is impossible when the IID assumption is dropped.

Other de Finetti-type theorems

A final remark is with regards to the more common type of de Finetti theorem, in which one bounds the trace distance between an $n$-exchangeable system and a de Finetti one. More specifically, let us first consider the classical case, i.e., a system is a probability distribution. $\mathrm{P}_{A_{1},\dots,A_{k}}$ is permutation invariant if it is invariant under any permutation of $A_{1},\dots,A_{k}$ (as before). We say that $\mathrm{P}_{A_{1},\dots,A_{k}}$ is $n$-exchangeable, for $n\geq k$, if it is a marginal of some permutation invariant $\mathrm{P}_{A_{1},\dots,A_{n}}$. In [Diaconis and Freedman, 1980b] a bound on the distance between an $n$-exchangeable probability distribution and a de Finetti distribution was proven.202020In this language, the original result of de Finetti [de Finetti, 1969] stated that all infinitely-exchangeable distributions (i.e., distributions that are $n$-exchangeable for any $n\geq k$) are equal to distributions of the form of a convex combination of IID distributions. Results of this type were also proven for quantum states [König and Renner, 2005, Christandl et al., 2007] and non-signalling boxes [Christandl and Toner, 2009].

Let us focus on the non-signalling case [Christandl and Toner, 2009]. There, a conditional probability distribution $\mathrm{P}_{A_{1},\dots,A_{n}|X_{1},\dots,X_{n}}$ is said to be non-signalling if the box cannot be used to signal from any subset of parties $I\subset[n]$ to the rest of the parties $[n]\setminus I$. Permutation invariance is defined with respect to permutations $\pi:[n]\rightarrow[n]$. Similarly to the classical case described above, $\mathrm{P}_{A_{1},\dots,A_{k}|X_{1},\dots,X_{k}}$ is $n$-exchangeable, for $n\geq k$, when it is the marginal of a permutation invariant non-signalling box $\mathrm{P}_{A_{1},\dots,A_{n}|X_{1},\dots,X_{n}}$. We then have the following bound [Christandl and Toner, 2009, Theorem 3] (using the above notation):

Theorem 8.5** ([Christandl and Toner, 2009]).**

For any permutation invariant non-signalling box $\mathrm{P}_{A_{1},\dots,A_{n}|X_{1},\dots,X_{n}}$ and any $k<n$ there exists a de Finetti box $\tau_{A_{1},\dots,A_{k}|X_{1},\dots,X_{k}}$ such that

[TABLE]

The crucial thing to note here is that the boxes $\mathrm{P}_{A_{1},\dots,A_{k}|X_{1},\dots,X_{k}}$ and $\mathrm{P}_{A_{1},\dots,A_{n}|X_{1},\dots,X_{n}}$ are a very special type of parallel boxes: the non-signalling conditions must hold for any division of the indices in $[n]$. This implies that the for any $i,j\in[n]$, $A_{i}$ is independent of the inputs $X_{j}$ for $j\neq i$. Theorems such as Theorem 8.5 cannot be proven for general parallel boxes since they study exchangeable boxes, which inherently require the ability to consider the marginals of the boxes.

Chapter 9 Reductions to IID: sequential interaction

Many device-independent protocols proceed in rounds and, hence, require devices with which the honest parties can interact sequentially, i.e., one round after the other. A particular example for such protocols is our showcase dealing with device-independent quantum cryptography. When analysing the showcase under the IID assumption (Section 7.3.2), we observed that the quantum AEP, given as Theorem 7.2, plays a crucial role in the proof of soundness. Specifically, the quantum AEP allowed us to bound the total amount of the relevant smooth entropy using a bound on the von Neumann entropy calculated for a single round of the protocol.

The focus of this chapter is the so called “entropy accumulation theorem” (EAT) [Dupuis et al., 2016, Dupuis and Fawzi, 2018]. The EAT is a generalisation of the AEP to a scenario in which, instead of the raw data being produced by an IID process, it is produced by certain sequential quantum processes of interest.111We remark that the EAT, as the quantum AEP, is only relevant when assuming that everything can be described within the quantum formalism. In particular, it cannot be used when talking about, e.g., cryptographic protocols in the presence of a non-signalling (super-quantum) adversary. In particular, similarly to the AEP, the EAT allows one to bound the total amount of the considered smooth entropy using the same bound on the von Neumann entropy calculated for the IID analysis. In this sense, the EAT can be seen as a reduction to IID — with the aid of the EAT the analysis done under the IID assumption using the AEP is directly extended to the one relevant for multi-round sequential boxes.

Below, we motivate, present, and explain the EAT in the form relevant for device-independent quantum information processing [Arnon-Friedman et al., 2018]. The EAT is later used in the analysis of our showcase in Chapter 11. For the most general statement of the EAT and its proof the interested reader is referred to [Dupuis et al., 2016, Dupuis and Fawzi, 2018].

9.1 Sequential quantum processes

We are interested in multi-round quantum sequential boxes (with communication between the rounds; see Definition 6.2.2) fulfilling certain conditions. The simplest way of describing the relevant conditions is by looking at the sequential quantum process defining the boxes, i.e., the process that results in the input-output distribution of the boxes.

Consider a sequential process as illustrated in Figure 9.1. We start with some initial state $\rho^{\text{in}}_{R_{0}E}$; the distinction between $R_{0}$ and $E$ is such that $R_{0}$ is the part of the state which may change during the considered process while $E$ denotes the “environment” register, i.e., the part of the state not being modified. The marginal $\rho^{\text{in}}_{R_{0}}$ undergoes a sequence of operations in which a sequence of (non-IID) registers $\mathbold{O}=O_{1},\dots,O_{n}$ and $\mathbold{S}=S_{1},\dots,S_{n}$ are being created. We treat the registers $\mathbold{O}$ as the “output registers” while $\mathbold{S}$ are the “side-information registers”. Our ultimate objective is to bound the conditional smooth entropies $H^{\varepsilon}_{\min}(\mathbold{O}|\mathbold{S}E)$ and $H^{\varepsilon}_{\max}(\mathbold{O}|\mathbold{S}E)$.

To be able to bound the above entropies, some statistical data must be collected during the protocol. Specifically, we consider additional classical registers $\mathbold{C}=C_{1},\dots,C_{2}$ holding the information relevant for the estimation phase performed in the protocol. For every round $i\in[n]$, $C_{i}$ is derived by performing some action on the registers $O_{i}$ and $S_{i}$. For example, the value of $C_{i}$ can be the result of applying a function on some classical information included in $O_{i}$ and $S_{i}$.

To gain a bit of intuition regarding all the different registers, let us quickly consider the cryptographic setting (a more precise discussion can be found in Chapter 11). When analysing cryptographic protocols one may make the following choices: $E$ acts as the register belonging to the adversary, $\mathbold{O}$ as the raw data which is supposed to be secret, $\mathbold{S}$ as the side-information leaked during the protocol (e.g., all classical information which is communicated between Alice and Bob), and $\mathbold{C}$ – the indicators of whether the test rounds were successful or not (e.g., $C_{i}=1$ when the $i$’th game was won). The goal is then to lower bound $H^{\varepsilon}_{\min}(\mathbold{O}|\mathbold{S}E)$ and this should be done by using the statistics kept in $\mathbold{C}$.

The sequential process itself is formally defined by a sequence of quantum channels, namely, CPTP maps (Definition 2.3.4),

[TABLE]

for all $i\in[n]$. As seen from Equation (9.1), when we say that a process is sequential we not only mean that the maps act one after the other, but also that, in each round $i\in[n]$, the output $O_{i}$, the side information $S_{i}$, and the estimation data $C_{i}$ are being created by the map $\mathcal{M}_{i}$ applied in that round. That is, $\mathbold{O}$ denotes a sequence of registers created one after the other and similarly for $\mathbold{S}$ and $\mathbold{C}$.222The reader may be concerned by the distinction between, e.g., $O_{1}$ and $O_{2}$ – clearly, we can also consider a situation in which $\mathcal{M}_{1}$ does not output $O_{1}$ but transfers it to $\mathcal{M}_{2}$ that later outputs $O_{1}O_{2}$. We will soon assume that the different registers fulfil certain conditions and then the distinction will become clear. The state of interest in the end of the process is given by333We will be interested below in bounding the smooth entropies evaluated on a state closely related to the final state $\rho_{\mathbold{O}\mathbold{S}\mathbold{C}E}$, namely, the final state conditioned on the event of not aborting the considered protocol; see Section 9.2.3.

[TABLE]

We remark that in the device-independent setting the initial state $\rho^{\text{in}}_{R_{0}E}$, the maps $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$, and the final state $\rho_{\mathbold{O}\mathbold{S}\mathbold{C}E}$ are unknown; we merely require that some quantum states and maps $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$, describing the overall process, exist. In particular, this implies that we do not restrict the content of the registers $\left\{R_{i}\right\}_{i\in[n]}$ and, thus, they may include information which is being passed from previous rounds to the next ones. That is, we can think of these registers as holding some quantum memory. This is in stark contrast to what happens when working under the IID assumption.

9.2 Entropy accumulation theorem

As mentioned above, the EAT [Dupuis et al., 2016] acts as a generalisation of the quantum AEP to scenarios in which certain sequential processes are considered, rather than IID ones. The EAT, as the name suggests, quantifies the amount of entropy accumulated during the considered quantum processes. Moreover, as in the case of the AEP, the total amount of smooth entropies can be bounded by calculating certain von Neumann entropies (the precise statements are given below). By this, the EAT justifies the use of the von Neumann entropy in quantum information processing even outside of the IID regime. While we discuss the EAT in the context of device-independent quantum information processing, we remark that the EAT is a general information-theoretic tool, which can also be applied in other contexts.

9.2.1 Conceptual difficulties to overcome

Before stating the theorem itself, let us explain the conceptual difficulties that arise when seeking for an “AEP-style” theorem in non-IID scenarios. Specifically, we would like to understand what is the form of the theorem we are aiming for and what is non-trivial about it. To keep this section concise we focus on the smooth min-entropy; the same statements are relevant for the smooth max-entropy as well.

Our goal is to have a theorem resembling the quantum AEP appearing as Theorem 7.2. That is, we look for a statement of the form

[TABLE]

for some $t$ and $\mu$ (independent of $n$ but otherwise unrestricted).

The EAT aims at providing a lower-bound on $H^{\varepsilon}_{\min}(\mathbold{O}|\mathbold{S}E)$ which scales linearly with the number of rounds $n$ (to first order in $n$, i.e., up to finite statistic effects, as in the AEP). As $\mathbold{O}=O_{1},\dots,O_{n}$ and $\mathbold{S}=S_{1},\dots,S_{n}$ are being created in a sequential manner, we intuitively wish to say that in each round $i\in[n]$ we accumulate an additional constant amount of entropy due to the production of $O_{i}$ (while taking into account $S_{i}$ and $E$) until, in the end of the process, the total amount of entropy is linear in $n$. Consider, however, a sequential process in which $S_{1},\dots,S_{n-1}$ are all empty (i.e., do not reveal any information about the outputs) while the side-information $S_{n}$ produced by the last map $\mathcal{M}_{n}$ includes all of the outputs $O_{1},\dots,O_{n}$. Clearly, even though we may have accumulated entropy in the rounds $i\in[n-1]$, all of it is lost after $S_{n}$ is leaked in the last round $n$. This implies that we can only hope to prove a statement like the one given in Equation (9.3) under some restrictions on the considered sequential processes.

A more fundamental difficulty to overcome is the following. In the case of the AEP, i.e., when considering IID processes, or boxes, it is clear what $t$, appearing in Equation (9.3), is – it is a quantity describing the single-round box defining the IID box. (And, as it turns out, this quantity is the relevant conditional von Neumann entropy evaluated on a single-round box; recall Section 7.2.2).

Moving to the sequential processes, or multi-round boxes, it is not obvious at all which quantity $t$ should describe. We would like to find a quantity related to some “single-round property”, but how can we even define such a thing in a meaningful way? Since the behaviour of the box in each round may depend on everything that happened in previous rounds (see Definition 6.2.2), we cannot directly define a multi-round box in terms of single-round ones. To put it differently, when holding a multi-round device, there is no physical system that we can point to and treat as an isolated subsystem. Thus, $t$ cannot refer to such a system as in the IID case.

Keeping in mind the conceptual difficulties that one needs to overcome when phrasing the theorem, we are now ready to discuss the EAT on a more concrete level. In particular, the following section unveils the resolutions of the issues presented above.

9.2.2 Prerequisites of the theorem

Before presenting the EAT, we need to define two objects to which the theorem refers – EAT channels and tradeoff functions. The “correct” definition of these objects is what allows us to overcome the conceptual difficulties discussed above. Furthermore, when coming to use the EAT, the choice, or construction, of these objects is what allows one to derive a strong bound on the considered entropy. Thus, understanding the prerequisites of the theorem is of great importance.

EAT channels

As mentioned in the previous section, entropy does not accumulate in any general sequential process. Therefore, we must restrict our attention to processes which fulfil certain conditions. Specifically, we work with processes defined via the following type of maps, called “EAT channels”:

Definition \thedefn (EAT channels).

Quantum channels $\left\{\mathcal{M}_{i}:R_{i-1}\rightarrow R_{i}O_{i}S_{i}C_{i}\right\}_{i\in[n]}$ are said to be EAT channels if the following requirements hold:

$\left\{O_{i}\right\}_{i\in[n]}$ are finite dimensional quantum systems of dimension $d_{O}$ and $\left\{C_{i}\right\}_{i\in[n]}$ are finite-dimensional classical systems (RV). $\left\{S_{i}\right\}_{i\in[n]}$ and $\left\{R_{i}\right\}_{i\in[n]}$ are arbitrary quantum systems. 2. 2.

For any $i\in[n]$ and any input state $\sigma_{R_{i-1}}$, the output state $\sigma_{R_{i}O_{i}S_{i}}=\mathcal{M}_{i}\left(\sigma_{R_{i-1}}\right)$ has the property that the classical value $C_{i}$ can be measured from the marginal $\sigma_{O_{i}S_{i}}$ without changing the state. That is, for the map $\mathcal{T}_{i}:O_{i}S_{i}\rightarrow O_{i}S_{i}C_{i}$ describing the process of deriving $C_{i}$ from $O_{i}$ and $S_{i}$, it holds that $\mathrm{Tr}_{C_{i}}\circ\mathcal{T}_{i}\left(\sigma_{O_{i}S_{i}}\right)=\sigma_{O_{i}S_{i}}$. 3. 3.

For any initial state $\rho_{R_{0}E}^{\text{in}}$, the final state $\rho_{\mathbold{O}\mathbold{S}\mathbold{C}E}=\left(\mathrm{Tr}_{R_{n}}\circ\mathcal{M}_{n}\circ\dots\circ\mathcal{M}_{1}\right)\otimes\mathbb{I}_{E}\;\rho^{\text{in}}_{R_{0}E}$ fulfils the Markov-chain conditions (Defintion 2.5.1)

[TABLE]

for all $i\in[n]$.

In words, Equation (9.4) states that in each round, the previous outcomes $O_{1},\dotsc,O_{i-1}$ are independent of the future side-information $S_{i}$ given all the past side information $S_{1},\dotsc,S_{i-1},E$. That is, the side-information of any given round does not reveal new information about previous outcomes. When coming to use the EAT, one is free to choose the different systems as one wishes. By choosing $O_{i}$ and $S_{i}$ properly the required Markov chain condition can be satisfied by sequential protocols such as device-independent quantum key distribution, as will be shown in Chapter 11.444In some cases the obvious choices for $O_{i}$ and $S_{i}$ are such that Equation (9.4) does not hold. Still, sometimes, one can overcome the problem by considering related protocols in which the Markov-chain conditions are “enforced”. This is done, for example, in [Arnon-Friedman and Bancal, 2017].

Equation (9.4) acts as the additional constraint on the sequential process which allows us to avoid processes in which entropy does not accumulate.555One can easily verify that the problematic process described in Section 9.2.1 does not fulfil the Markov-chain conditions. We remark that the above requirements, and Equation (9.4) in particular, give sufficient, but perhaps not necessary, conditions for the entropy to accumulate. That is, there might be sets of weaker or incomparable conditions that can also be used to show that entropy accumulates.

Tradeoff functions

As explained in Section 9.2.1, since we cannot directly define a multi-round box in terms of single-round ones, it is not clear what quantity should replace $t$ in Equation (9.3). The tradeoff functions, defined below, give an adequate way to quantify the amount of entropy which is accumulated in a single step of the process, i.e., in an application of just one channel, and by this allow us to define $t$ in a meaningful way. We first present the formal definition of the functions and then explain.

Definition \thedefn (Tradeoff functions).

Let $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$ be a family of EAT channels and $\mathcal{C}$ denote the common alphabet of $C_{1},\dots,C_{n}$. A differentiable and convex function $f_{\min}$ from the set of probability distributions $p$ over $\mathcal{C}$ to the real numbers is called a min-tradeoff function for $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$ if it satisfies666The infimum and supremum over the empty set are defined as plus and minus infinity, respectively.

[TABLE]

for all $i\in[n]$, where the infimum is taken over all purifications of input states of $\mathcal{M}_{i}$ for which the marginal on $C_{i}$ of the output state is the probability distribution $p$.

Similarly, a differentiable and concave function $f_{\max}$ from the set of probability distributions $p$ over $\mathcal{C}$ to the real numbers is called a max-tradeoff function for $\{\mathcal{M}_{i}\}$ if it satisfies

[TABLE]

for all $i\in[n]$, where the supremum is taken over all purifications of input states of $\mathcal{M}_{i}$ for which the marginal on $C_{i}$ of the output state is the probability distribution $p$.

Figure 9.2 illustrates the considered scenario – a single step in the sequential process (compare to Figure 9.1). For any possible input state $\sigma_{R_{i-1}}\in\mathcal{S}(\mathscr{H}_{R_{i-1}})$ of the map $\mathcal{M}_{i}$, we denote by $\sigma_{R_{i-1}R^{\prime}}\in\mathcal{S}(\mathscr{H}_{R_{i-1}}\otimes\mathscr{H}_{R^{\prime}})$ its purification. Note that the register $R^{\prime}$ is not being affected by the map (similarly to $E$ in Figure 9.1). $O_{i}$ and $S_{i}$ denote the output and side-information registers of the output state $\mathcal{M}_{i}(\sigma)$. $C_{i}$ can be inferred from $O_{i}$ and $S_{i}$ as before.

To comprehend these so called tradeoff functions, let us first discuss the set over which we perform the optimisations in Equations (9.5) and (9.6):

[TABLE]

$\mathcal{M}_{i}(\sigma_{R_{i-1}})$ is the output state of the map and $\mathcal{M}_{i}(\sigma)_{C_{i}}$ is its marginal over $C_{i}$. Recall that the classical registers $C_{i}$ are used to collect statistics during the run of the considered protocol. Hence, $\mathcal{M}_{i}(\sigma)_{C_{i}}$ can be seen as a probability distribution over $\mathcal{C}$. The condition $\mathcal{M}_{i}(\sigma)_{C_{i}}=p$ therefore restricts the set of considered states – $\Sigma(p)$ only includes states $\sigma$ that exhibit the statistics defined by the probability distribution $p$. If there are no such states then $\Sigma(p)$ is empty.

As an example, consider a protocol in which the CHSH game is being played in each round and $C_{i}$ records whether the game was won ($C_{i}=1$) or lost ($C_{i}=0$). Denoting by $\omega$ the probability that $\sigma$ wins the game, we can write

[TABLE]

$\Sigma(p)$ then includes all of the states for which $\omega=p(1)$. For a probability distribution with $p(1)=1$, for example, the set $\Sigma(p)$ is empty, since there are no quantum states which can be used to play the CHSH game with probability $\omega=1$.

Given the above, the infimum/supremum of $H\left(O_{i}|S_{i}R^{\prime}\right)_{\mathcal{M}_{i}(\sigma)}$ over the set $\Sigma(p)$ describes the worst-case777By “worst-case” we mean lowest or largest, depending on whether we are working with min- or max- tradeoff functions. This will become clearer when discussing the EAT itself. conditional von Neumann entropy in a single round, restricted to states with the correct marginal over $C_{i}$.

To get some intuition as to why the tradeoff functions in Definition 9.2.2 give an adequate way of quantifying the amount of entropy accumulated in a single step of the process, let us present two “alternative” definitions that one could try to use and refute them with the help of simple classical examples.

In both examples we consider classical processes in which each channel $\mathcal{M}_{i}$ outputs a single bit $O_{i}$ without any side information $S_{i}$ about it; the system $E$ is empty as well. Every bit $O_{i}$ may depend on the ones produced previously. We would like to extract randomness out of $\mathbold{O}$ and thus aim to calculate $H_{\min}^{\varepsilon}\left(\mathbold{O}\right)$, which tightly describes the amount of extractable randomness [Renner, 2008, Tomamichel and Hayashi, 2013]. How much randomness does a single round contribute to the extractable randomness given that we already accounted for the randomness of the previous rounds?

One possible guess is the conditional von-Neumann entropy:

[TABLE]

The von Neumann entropy fulfils the chain rule and so we have $\sum_{i}H(O_{i}|O_{1},\dots,\mathrm{O}_{i-1})=H(\mathbold{O})$. Unfortunately, the smooth min-entropy $H_{\min}^{\varepsilon}\left(\mathbold{O}\right)$ can be arbitrarily lower than $H(\mathbold{O})$. An example for a sequential process in which this is the case is as follows: $O_{1}$ is uniform while, for all $i\in[n]\setminus\{1\}$,

[TABLE]

Direct calculation of $H(\mathbold{O})$ gives $H(\mathbold{O})=1+(n-1)/2$. The min-entropy, however, depends on the most probable value of $\mathbold{O}$ rather than its expected value. One can easily check that $H_{\min}(\mathbold{O})=1$, which implies that the extractable randomness is independent of $n$. Thus, $H(\mathbold{O})$ is too optimistic — it suggests that one can get arbitrarily more randomness than we can possibly extract from this process.

Let us try a worst-case version of the min-entropy instead:

[TABLE]

While this option at least does not result in a contradiction (in contrast to the one above), it is too pessimistic. To see this, consider IID RVs $\mathbold{O}$, where each $O_{i}$ is a Bernoulli random variable with expectation $p<1/2$. Then, Equation (9.10) tells us that we can extract $-\log(1-p)$ randomness per round. However, it follows from the EAP that $h(p)>-\log(1-p)$ randomness can be extracted per round, for sufficiently large $n$.

The following quantity lies between those given in Equations (9.9) and (9.10):

[TABLE]

This quantity describes the von Neumann entropy of $O_{i}$, evaluated for the worst case values of $O_{1},\dots,O_{i-1}$. Going back to the two processes considered above, one can easily verify that this choice gives the “correct” amount of extractable randomness in both cases. The min-tradeoff function defined above is the quantum analogue of this.

The tradeoff functions are not uniquely defined by Equations (9.5) and (9.6). The equations merely pose a constraint on the functions. That is, a min-tradeoff function can be chosen to be any differentiable convex function satisfying the condition888The value of the functions at points $p$ for which $\Sigma(p)$ is the empty set is unconstrained and can be chosen freely (while keeping the function differentiable and convex). given in Equation (9.5), i.e., it is upper-bounded by $\inf_{\Sigma(p)}H\left(O_{i}|S_{i}R^{\prime}\right)_{\mathcal{M}_{i}(\sigma)}$. Similarly, a max-tradeoff function is any differentiable concave function lower-bounded by $\sup_{\Sigma(p)}H\left(O_{i}|S_{i}R^{\prime}\right)_{\mathcal{M}_{i}(\sigma)}$. To get the tightest bounds on the smooth entropies using the EAT one should construct tradeoff functions in the tightest way possible, ideally matching the exact value of the worst-case von Neumann entropy given in Equations (9.5) and (9.6). In device-independent cryptographic protocols based on the CHSH game, for example, Lemma 5.2 can be used to construct a tight min-tradeoff function; this will be done in Chapter 11.

9.2.3 Statement of the theorem

After presenting the prerequisites of the EAT, we are now ready to discuss the statement of the theorem.

Conditioning on not aborting

Consider a sequential protocol, i.e., one which proceeds in rounds; the development of the quantum state throughout the protocol can be described by a sequential process. In the end of the protocol, the honest parties can choose whether to abort the protocol or not. For example, if Alice and Bob run a device-independent cryptographic protocols and observe that the device does not win the game in sufficiently many games, they conclude that the device might be malicious and abort the protocol. Our goal is to bound the smooth entropies of the outputs when the protocol does not abort.

Whether the protocol aborts or not depends on the observed data produced during the execution of the protocol and, specifically, on the value assigned to $\mathbold{C}$. Thus, the event of not aborting the protocol, denoted by $\Omega$, is defined to be a subset of $\mathcal{C}^{n}$. The most common way of choosing the set $\Omega$ is such that whether $\mathbold{c}=c_{1},\dotsc,c_{n}\in\mathcal{C}^{n}$ belongs to $\Omega$ or not depends on its “frequencies”. Formally, for any $\mathbold{c}\in\mathcal{C}^{n}$, denote by $\mathrm{freq}_{\mathbold{c}}$ the probability distribution over $\mathcal{C}$ defined by

[TABLE]

for $\tilde{c}\in\mathcal{C}$. We define a set $\hat{\Omega}$ that includes all the probability distributions approved by the protocol, i.e., the desired frequencies $\mathrm{freq}_{\mathbold{c}}$ for which the protocol does not abort. Then, we can write the event of not aborting in terns of the desired frequencies:

[TABLE]

Note that one can also start by choosing the set $\Omega$ describing the event of not aborting the protocol. Then, $\hat{\Omega}$ can be chosen to be any set fulfilling999It will become clear from the statement of the EAT that one should choose a minimal convex set $\hat{\Omega}$ that includes the frequencies considered in $\Omega$. It is perhaps instructive to observe that, for a finite $n$, $\Omega$ is a finite set; $\hat{\Omega}$, on the other hand, includes infinitely many probability distributions.

[TABLE]

Focusing on permutation invariant sets $\Omega$, in the sense that $\mathbold{c}\in\Omega$ if and only if $\pi(\mathbold{c})\in\Omega$ for all permutations $\pi$ of the $n$ indices, defining $\hat{\Omega}$ via $\Omega$ is practically the same as defining $\Omega$ via $\hat{\Omega}$.

Let us present a simple example of the above definitions and sets. Let $\mathcal{C}=\{0,1\}$ and consider, e.g.,

[TABLE]

To write $\mathrm{freq}_{\mathbold{c}}$ we count the number of zeros and ones in the above string and get, according to Equation (9.11), the probability distribution over $\{0,1\}$ defined by

[TABLE]

We can now consider a protocol which does not abort whenever the observed statistics are such that the fraction of ones is greater than half. This leads to

[TABLE]

and, in particular, for $\mathbold{c}$ appearing in Equation (9.12), $\mathbold{c}\in\Omega$.

The theorem

We first give the formal statement of the EAT and then explain.

Theorem 9.1** (EAT).**

Let $\mathcal{M}_{i}:R_{i-1}\rightarrow R_{i}O_{i}S_{i}C_{i}$ for $i\in[n]$ be EAT channels, $\rho$ be the final state, $\Omega$ an event defined over $\mathcal{C}^{n}$, $p_{\Omega}$ the probability of $\Omega$ in $\rho$, and $\rho_{|\Omega}$ the final state conditioned on $\Omega$. Let $\varepsilon\in(0,1)$.

For $\hat{\Omega}=\{\mathrm{freq}_{\mathbold{c}}:\mathbold{c}\in\Omega\}$ convex,101010We consider only convex sets $\hat{\Omega}$ (as was done in [Arnon-Friedman et al., 2018]). One can convince oneself that choosing a convex $\hat{\Omega}$ is the sensible thing to do. For example, a set $\hat{\Omega}$ including all frequencies, or probability distributions, for which $p(1)\in[a,b]$ for some constants $0\leq a,b\leq 1$ is convex. If, nevertheless, one wishes to consider arbitrary sets $\Omega$, which are not defined via a convex $\hat{\Omega}$, then this comes at the cost of considering only affine tradeoff functions (instead of convex/concave functions as in Definition 9.2.2); see [Dupuis et al., 2016] for the original claim. It is not clear that there are scenarios in which $\Omega$ cannot be defined with an underlying convex set $\hat{\Omega}$ and, at the same time, applying the EAT with adequate affine tradeoff functions does not result in a trivial statement. Hence, the convexity of $\hat{\Omega}$ should not be seen as a restriction. $f_{\min}$ a min-tradeoff function for $\{\mathcal{M}_{i}\}_{i\in[n]}$, and any $t\in\mathbb{R}$ such that $f_{\min}\left(\mathrm{freq}_{\mathbold{c}}\right)\geq t$ for any $\mathrm{freq}_{\mathbold{c}}\in\hat{\Omega}$,

[TABLE]

where

[TABLE]

$d_{O}$* the dimension of the systems $O_{i}$, and $\|\triangledown f_{\min}\|_{\infty}$ is the infinity norm of the gradient of $f_{\min}$.*

Similarly, for $\hat{\Omega}=\{\mathrm{freq}_{\mathbold{c}}:\mathbold{c}\in\Omega\}$ convex, $f_{\max}$ a max-tradeoff function and any $t\in\mathbb{R}$ such that $f_{\max}\left(\mathrm{freq}_{\mathbold{c}}\right)\leq t$ for any $\mathrm{freq}_{\mathbold{c}}\in\hat{\Omega}$,

[TABLE]

with

[TABLE]

Let us parse the statement of the theorem while focusing on the smooth min-entropy for the moment. Equation (9.13) has exactly the form that we were aiming for: it gives a lower-bound on the conditional smooth min-entropy, evaluated on the state $\rho_{|\Omega}$ in the end of the protocol and conditioned on not aborting, where the first order term is linear in $n$ and the second, describing finite statistic effects, scales like $\sqrt{n}$.

The constant $t$, governing the entropy rate $H_{\min}^{\varepsilon}\left(\mathbold{O}|\mathbold{S}E\right)_{\rho_{|\Omega}}/n$ when $n\rightarrow\infty$, is defined via the min-tradeoff function in the following way. The min-tradeoff function $f_{\min}$ assigns to each probability distribution $p$, or frequency, a number describing the minimal amount of conditional von Neumann entropy which is compatible with the probability distribution $p$ (recall Definition 9.5). We now consider all frequencies $\mathrm{freq}_{\mathbold{c}}$ (i.e., probability distributions) which are accepted by the protocol. The theorem asserts that $t$ should be chosen as the minimal value of $f_{\min}$ over this set of accepted frequencies. That is,111111The reader may be concerned that for finite $n$ all frequencies belonging to $\mathrm{freq}_{\mathbold{c}}\in\hat{\Omega}$ actually lead to empty sets $\Sigma(\mathrm{freq}_{\mathbold{c}})$, defined in Equation (9.7) and hence $t$ can be arbitrary. Note however that the tradeoff functions are defined over the set of all probability distributions, not only over the possible frequencies. Since the tradeoff functions must be differential convex/concave functions with a finite gradient, the points in which the functions are constrained by Equations (9.5) and (9.6) also constrain the values of the functions at the points $\mathrm{freq}_{\mathbold{c}}\in\hat{\Omega}$.

[TABLE]

Since the min-tradeoff function is practically the worst-case conditional von Neumann entropy, we get that, asymptotically, $H_{\min}^{\varepsilon}\left(\mathbold{O}|\mathbold{S}E\right)_{\rho_{|\Omega}}/n$ is equal to the lowest von Neumann entropy of a single-round (in the sense defined by the min-tradeoff function) that is compatible with the statistics observed in the protocol.

As an example, consider a device-independent protocol that assigns $C_{i}=1$ when the $i$’th game is won and $C_{i}=0$ otherwise and which does not abort as long as the fraction of games won $(\sum_{i}C_{i})/n$ is above some threshold $\omega_{T}$. The min-tradeoff function is defined over probability distributions $p$ over $\mathcal{C}=\{0,1\}$. Thus, we can also think of it as a function over winning probabilities $\omega$ via the relation $p(1)=\omega$ and $p(0)=1-\omega$ (see Equation (11.4)). Assuming that the min-tradeoff function is increasing with $\omega$ (as expected to be; see Lemma 5.2), the lowest value that $f_{\min}$ assigns to accepted frequencies is $f_{\min}(\omega_{T})$ and hence this should be the value of $t$; this is illustrated in Figure 9.3.

The above discussion refers to the first order term in Equation (9.13). Let us now briefly discuss the second order term. Similarly to the AEP, the second order term scales like $\sqrt{n}$, which is the optimal scaling. The constant $\mu$, defined in Equation (9.14), depends on the different parameters and constants. In particular, it depends on the dimension of the output systems $O_{i}$ and the gradient of the tradeoff functions. To get a good second order term one should therefore choose the possible values that can be assigned to the registers $O_{i}$ and the tradeoff functions such that the quantities of interest can be bounded in a good manner. In particular, to control the gradient of the tradeoff function one can “cut” when the gradient becomes too large and linearise the function at that point. An example is given in Section 11.2.2. Improved second order terms for the EAT were derived in [Dupuis and Fawzi, 2018].

A last remark is with regards to the statement of the EAT for the smooth max-entropy. When interested in the smooth max-entropy, the registers describing the environment, i.e., $E$ in Equations (9.4) and (9.15) as well as $R^{\prime}$ in Equation (9.6), can be dropped. The fact that $R^{\prime}$ can be dropped from Equation (9.6) was already noted in [Dupuis et al., 2016, Remark 4.2]; the reason is that for the calculation of the supremum one can always assume that the system on $R^{\prime}$ is in product with the rest of the systems. To see that $E$ can be dropped from Equations (2.5.1) and (9.15) note that the EAT must hold for any initial state $\rho_{R_{0}E}^{\text{in}}$ and, hence, in particular to a tensor product state $\rho_{R_{0}E}^{\text{in}}=\rho_{R_{0}}\otimes\rho_{E}$, for which the conditional smooth max-entropy is maximal.

To conclude this chapter, we summarise the reasons for why the EAT can be seen as an extension of the AEP for non-IID processes:

Similarly to the AEP, the EAT tells us that for large enough $n$ the smooth entropies are equal to the von Neumann entropy of a single-round times the number of rounds. 2. 2.

The observed frequencies from the entire process are used when calculating the entropy accumulated in a single step of the process, as if all steps contribute equally and independently of each other. This is analogous to the analysis done in the IID case, as we saw in Section 7.3. 3. 3.

The asymptotic bounds on the smooth entropies derived using the EAT are equal to those derived using the AEP under the IID assumption. As a result, the bounds resulting form the application of the EAT are tight (assuming that the constructed tradeoff functions are tight). The second order terms of both theorems are also similar, as the scaling of both is $\sqrt{n}$.

All the above justifies the use of the EAT as a “reduction to IID” technique.

Chapter 10 Showcase: non-signalling parallel repetition

In this chapter we consider the showcase of non-signalling parallel repetition, introduced in Section 4.1, and show how threshold theorems derived under the IID assumption can be extended to threshold theorems for general strategies, using a reduction to IID.

We focus on the case of non-signalling players.111Most steps of our proof can be used as is when considering classical and quantum players as well. There is one lemma, however, which we do not know how to modify so it can capture the classical and quantum case. We explain the difficulty later on. That is, the only restriction on the players is that they are not allowed to communicate. Considering the non-signalling case is interesting for several reasons. A first reason is to minimise the set of assumptions to the mere necessary. Minimising the set of assumptions can be useful in cryptography when one wishes to get the strongest result possible, i.e., one where the attack strategies of malicious parties are only restricted minimally (as in [Hänggi et al., 2010b, Masanes, 2009, Masanes et al., 2014] for example). In theoretical physics, non-signalling correlations enable the study of generalised theories possibly beyond quantum theory. It is also important to mention that, due to their linearity, the non-signalling constraints are often easier to analyse than the quantum or the classical constraints. Therefore, even if additional constraints hold, focusing on the non-signalling ones serves as a way to get first insights into a given problem.

Our theorem deals with complete-support games; these are game in which the distribution $\mathrm{Q}_{XY}$ over the questions has complete support, i.e., for all $x,y$, $\mathrm{Q}_{XY}(x,y)>0$.222When considering games with only two players, the requirement for complete support can be dropped but, even though we focus on two-player games, we do not discuss this here; see [Arnon-Friedman et al., 2016b] for the details. The main result presented in this chapter can be informally stated as follows.333See Theorem 10.4 for the formal statement.

Theorem 10.1** (Informal).**

For any complete-support game, a threshold theorem for general non-signalling strategies follows from a threshold theorem for non-signalling IID strategies. Furthermore, given a game with optimal non-signalling winning probability $1-\alpha$, the resulting threshold theorem states that, for any $\beta>0$, the probability to win more than a fraction $1-\alpha+\beta$ of $n$ games is exponentially small in $n\beta^{2}$, as in the IID case.

The result previously appeared in [Arnon-Friedman et al., 2016b]. We remark that while the non-signalling threshold theorem of [Buhrman et al., 2013] was known prior to [Arnon-Friedman et al., 2016b], the dependence on $\beta$ did not match that of the IID case, which is optimal (as follows from the optimal formulation of the Chernoff bound). Following [Arnon-Friedman et al., 2016b], the work of [Holmgren and Yang, 2017] showed that parallel repetition does not hold for general games without complete-support in the non-signalling case. Thus, Theorem 10.1 is as general as it gets.

Proving parallel repetition via a reduction to IID has the advantage that, as in the IID case, the proof is oblivious to the number of players and structure of the considered game. This leads to a general theorem applicable to all games (with complete support) that is, arguably, simpler than other proof techniques.

When considering a strategy for the repeated game there is one type of symmetry which one can take advantage of – since the repeated game is permutation invariant the same symmetry can be assumed to hold for the optimal strategies, without loss of generality. Permutation-invariant strategies are strategies which are indifferent to the ordering of the questions given by the referee. That is, the probability of answering a specific set of questions correctly does not depend on the ordering of the questions (see Section 10.3 below for the formal definitions). Once we restrict our attention to permutation-invariant strategies, de Finetti theorems presents themselves as a natural tool to leverage for the analysis. Indeed, our proof builds on the de Finetti reduction discusses in Chapter 8, which acts as a reduction to IID in our analysis of parallel repetition.

The chapter is arranged as follows. In Section 10.1 we explain the main challenge when proving parallel repetition and threshold theorems using techniques employed by works predating [Arnon-Friedman et al., 2016b] and why de Finetti theorems were not used in the context of parallel repetition before [Arnon-Friedman et al., 2016b]. In Section 10.2 we give the main technical statements needed to prove our non-signalling threshold theorem. The different observations and lemmas of Section 10.2 may be of independent interest when analysing non-signalling parallel boxes and therefore we perform the analysis without referring to multi-player games. The explicit threshold theorem and its proof are given in Section 10.3. As in the rest of the thesis, we focus on the case of two parties for simplicity; we refer to [Arnon-Friedman et al., 2016b] for the proofs in the case of more than two players as well as a couple of extensions of our theorem to games without complete support.

10.1 Main challenge and goal

The main difficulty in proving a parallel repetition result comes from the, almost arbitrary, correlations between the different questions-answers pairs in the players’ strategy for the repeated $\mathrm{G}_{1-\alpha+\beta}^{n}$: as the players get all the $n$ questions together they can answer them in a correlated way. In most of the known parallel repetition results (e.g., [Raz, 1998, Holenstein, 2007, Rao, 2011, Buhrman et al., 2013]) the main idea of the proof is to bound the winning probability for some of the questions, conditioned on winning the game in several other coordinates. However, as the strategy itself introduces correlations between the different tuples of questions, a large amount of technical work is devoted to dealing with the effect of conditioning on the event of winning the previous questions.

As mentioned above (and formally stated in Section 10.3), due to the permutation invariance of $\mathrm{G}_{1-\alpha+\beta}^{n}$ one can study only permutation invariant strategies without loss of generality. Once we restrict our attention to permutation-invariant strategies, de Finetti theorems seem like a natural tool to leverage for the analysis. In the context of games and strategies, de Finetti theorems suggest one may be able to reduce the analysis of general permutation-invariant strategies to the analysis of a de Finetti strategy, i.e., a convex combination of IID strategies; recall Chapter 8. As presented in Section 7.3.1, the behaviour of IID strategies is trivial under parallel repetition. Hence, a reduction to IID using a de Finetti-type theorem could significantly simplify the analysis of parallel repetition theorems and threshold theorems.

Yet, de Finetti theorems were not used in this context prior to [Arnon-Friedman et al., 2016b], and for a good reason. The many versions of quantum de Finetti theorems (e.g., [Renner, 2007, Christandl et al., 2009]) could not have been used as they depend on the dimension of the underlying quantum strategies, while in the quantum multi-player game setting one does not wish to restrict the dimension. Non-signalling de Finetti theorems, as in [Barrett and Leifer, 2009, Christandl and Toner, 2009], were also not applicable for non-signalling parallel repetition theorems, as they restrict almost completely the type of allowed correlations in the strategies for the repeated game by assuming very strict non-signalling constraints between the different repetitions, i.e., between the different questions-answers pairs.

In the proof presented in the next sections, we use the de Finetti reduction presented in Chapter 8, which imposes no assumptions at all regarding the structure of the strategies (apart from permutation invariance), and is therefore applicable in the context of parallel repetition. This allows us to devise a proof technique which is completely different from the proofs of parallel repetition results predating [Arnon-Friedman et al., 2016b].444Following [Arnon-Friedman et al., 2016b], [Lancien and Winter, 2016] presented another, conceptually similar but technically different, proof of non-signalling parallel repetition based on de Finetti reductions. In particular, at least in the non-signalling case presented here, the conditioning problem described above disappears completely and the number of players does not play a role in the proof structure.

As explained in Section 8.2, the de Finetti strategy that one ought to consider when using our de Finetti reduction assigns some weight to signalling IID strategies.555As discussed in Section 8.4, this is inevitable. Most of the effort is therefore directed to, informally, showing that when starting with a permutation-invariant non-signalling strategy the de Finetti strategy must assign only a small weight to signalling IID strategies. Formally, a similar in spirit but somewhat different statement is proven; see Theorem 10.2 below. Without further ado, let us get into the proof of the exact statements in the following section.

10.2 Approximately non-signalling marginals

Consider a parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ (as defined in Section 6.1) and some complete-support distribution $\mathrm{Q}_{XY}$, i.e., for all $\tilde{x}\in\mathcal{X}$ and $\tilde{y}\in\mathcal{Y}$, $\mathrm{Q}(\tilde{x},\tilde{y})\neq 0$. Sample $\mathbold{x}$, $\mathbold{y}$, $\mathbold{a}$, and $\mathbold{b}$ according to $\mathrm{Q}_{\mathbold{X}\mathbold{Y}}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. We assume in this section that all possible inputs $\tilde{x},\tilde{y}$ appear in the observed data $\mathbold{x}$ and $\mathbold{y}$ (that is, there exists $i\in[n]$ for which $(x_{i},y_{i})=(\tilde{x},\tilde{y})$. For a complete-support distribution $\mathrm{Q}_{XY}$, the probability that this is not the case is exponentially small in $n$ and we will account for it later.

Next, let $\mathrm{O}_{ABXY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ be the distribution derived from the frequencies in the observed data via

[TABLE]

and define

[TABLE]

Without the complete-support requirement on $\mathrm{Q}_{XY}$ it does not even make sense to talk about a fully defined $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$, i.e., a conditional probability distribution which is defined for all $x\in\mathcal{X}$ and $y\in\mathcal{Y}$. Indeed, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ can only be defined for $x\in\mathrm{Supp}(\mathcal{X})$ and $y\in\mathrm{Supp}(\mathcal{Y})$ due to the estimation process (at least when assuming that all inputs appear in the observed data, which happens with high probability for large enough $n$). If one is willing to consider conditional probability distributions which are allowed to not assign values to certain inputs then $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ regains its meaning. In the context of non-signalling boxes, these conditional probability distributions were termed “sub-non-signalling” boxes in [Lancien and Winter, 2016]; sub-non-signalling boxes fulfil the subset of the non-signalling conditions which apply for the defined inputs. In the case of two parties, it is known that there is always a way to “complete” a sub-non-signalling box to a non-signalling box, defined over all inputs [Ito, 2010, Lancien and Winter, 2016].

The current section deals with the following question: given that we start with a non-signalling box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, what is the probability that the single-round box $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is signalling? Under the IID assumption, i.e., when $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}=\mathrm{O}_{AB|XY}^{\otimes n}$, this question is natural and can be easily answered. In that case, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ can simply be seen as an estimation of the “real box”, or marginal, $\mathrm{O}_{AB|XY}$. In particular, according to Sanov’s theorem (Lemma 2.2.2), as $n\rightarrow\infty$, we have $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}=\mathrm{O}_{AB|XY}$ almost surely. Thus, for a non-signalling IID box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ must be non-signalling as  $n\rightarrow\infty$.

Our goal is to show that roughly the same is true for permutation invariant non-signalling parallel boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ when boxes such as $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ take the role of the marginals, which are not properly defined for parallel boxes. The theorem can be stated informally as follows:666For the formal statement see Theorem 10.3.

Theorem 10.2** (Informal).**

Let $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ be a permutation invariant non-signalling parallel box and $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ be the single-round box defined via the observed data sampled using $\mathrm{Q}_{XY}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, as in Equation (10.1). Then, for sufficiently large $n$, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is close to a non-signalling single-round box with high probability. This also implies that the observed data can be seen as if, with high probability, it was sampled using an IID box $\mathrm{O}_{AB|XY}^{\otimes n}$ with $\mathrm{O}_{AB|XY}$ close to a non-signalling single-round box.

To prove the theorem we utilise the concept of a test, discussed in Section 8.3.2. Roughly speaking, we define a signalling test $\mathcal{T}$, interacting with a parallel box, which accepts whenever the box $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y})}$ is highly signalling and rejects whenever the box is close to a non-signalling box. With the aid of the variant of the de Finetti reduction phrased as Theorem 8.2 and a rather simple signalling game (defined in Section 10.2.3) we prove that the probability that the test accepts when interacting with a permutation invariant non-signalling parallel box is small. We follow this proof idea in the succeeding sections.

10.2.1 Single-round boxes from frequencies

To ease notation we denote $\mathsf{data}=\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y}$ when it is clear from the context which $\mathbold{a},\mathbold{b},\mathbold{x},\mathbold{y}$ are considered. Every observed $\mathsf{data}$ is split into two non-overlapping parts, $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$. Specifically, let777For simplicity we assume $n$ is even; otherwise replace $n/2$ by $\lceil n/2\rceil$ and modify everything else accordingly.

[TABLE]

$\mathsf{data}$ (and hence also $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$) is sampled according to $\mathrm{Q}_{\mathbold{X}\mathbold{Y}}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, where $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a non-signalling permutation invariant parallel box. Note the following:

$\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ may be signalling between the different rounds $i\in[n]$ (i.e., for a given party, the output of one round may depend on the input of other rounds). Therefore, even though $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$ are each defined only by part of the observed data, they may depend on the entire data. 2. 2.

Due to permutation invariance, it does not matter which indices $i\in[n]$ belong to each part of the data. We could as well define $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$ by splitting the data according to whether the index $i$ is even or odd (for example). For any partition of the data, $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$ are distributed in the same way. Hence, the choice of partition made in Equation (10.2) is arbitrary and all other choices give rise to the same results.

We define two single-round boxes from the observed data, similarly to what was done in Equation (10.1):

[TABLE]

and, for $t\in\{0,1\}$,

[TABLE]

As mentioned above, for $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ and $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$ to be defined for all inputs we assume that all inputs $(x,y)$ appear in both $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$.

10.2.2 Signalling test

Below we consider distributions $\mathrm{O}_{ABXY}=\mathrm{Q}_{XY}\mathrm{O}_{AB|XY}$. One can then consider different marginals of $\mathrm{O}_{ABXY}$. For example, $\mathrm{O}_{BY}$ is simply defined by $\mathrm{O}_{BY}(b,y)=\sum_{a,x}\mathrm{O}_{ABXY}(a,b,x,y)$. Note that the marginals of $\mathrm{O}_{ABXY}$ are all well-defined even if $\mathrm{O}_{AB|XY}$ itself is signalling.

We wish to define a signalling test. To this end, let us first define a signalling measure over single-round boxes:

Definition \thedefn.

Let $\mathrm{O}_{AB|XY}$ be a single-round box defined over $\mathcal{A}$, $\mathcal{B}$, $\mathcal{X}$, and $\mathcal{Y}$, $\mathrm{Q}_{XY}$ a distribution over the inputs of the single-round box, and $\mathrm{O}_{ABXY}=\mathrm{Q}_{XY}\mathrm{O}_{AB|XY}$. The amount of signalling from Alice to Bob using the inputs $(x,y)$ and Bob’s output $b$ is given by

[TABLE]

Similarly, the amount of signalling from Bob to Alice using the inputs $(x,y)$, distributed according to $\mathrm{Q}_{XY}$, and Alice’s output $a$, distributed according to $\mathrm{O}_{A|X=x,Y=y}$, is given by

[TABLE]

The box $\mathrm{O}_{AB|XY}$ is non-signalling if and only if

[TABLE]

To see that the above definition makes sense as a signalling measure first notice that, when positive, $\mathrm{O}_{X|BY}(x|b,y)-\mathrm{Q}_{X|Y}(x|y)$ can be understood as quantifying Bob’s advantage in guessing Alice’s input $x$ when observing $b$, compared to his prior information $\mathrm{Q}_{X|Y}(x|y)$ about her input. For a uniform distribution over $\mathcal{X}\times\mathcal{Y}$, $\mathrm{Q}_{X|Y}(x|y)=0$ for all $x$ and $y$. Then, the non-signalling requirement means that Bob cannot infer Alice’s input from his output (as otherwise Alice could signal Bob), that is, $\mathrm{O}_{X|BY}(x|b,y)=0$ as well. The above is a generalisation of this requirement to non-uniform distributions $\mathrm{Q}_{XY}$. On the more technical level — the non-signalling conditions (Definition 3.1.1) can be equivalently written as

[TABLE]

One can verify that, for complete support $\mathrm{Q}_{XY}$, these conditions are equivalent to Equation (10.5).

All statements proven below regarding our signalling measure hold for signalling in both directions, i.e., from Alice to Bob and from Bob to Alice. We present all the statements and proofs in terms of signalling from Alice to Bob; to derive the same statements for signalling from Bob to Alice one can simply replace the parties (their inputs and outputs) with one another.

We use the following definition to measure the distance between two single-round boxes.888 More commonly in the literature, one considers a definition in which $\mathbb{E}_{(x,y)}$ is replaced by $\max_{x,y}$. We use Definition 10.2.2 since it allows us to apply Sanov’s theorem later on.

Definition \thedefn.

The distance between $\mathrm{K}_{AB|XY}$ and $\mathrm{R}_{AB|XY}$ is defined as

[TABLE]

The following lemma shows that our measure of signalling is continuous. That is, if two strategies are close to one another according to Definition 10.2.2 then their signalling values are also close. The proof is given in Appendix B.1.

Lemma \thelem.

Let $\mathrm{O}_{AB|XY}^{1}$ and $\mathrm{O}_{AB|XY}^{2}$ be two single-round boxes such that

[TABLE]

Then, for all $a$, $b$, $x$, and $y$,

[TABLE]

We can now define our signalling test. The test interacts with the parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ by sampling $\mathsf{data}$ according to $\mathrm{Q}_{XY}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and then checking whether $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$ is sufficiently signalling. Formally:

Definition \thedefn.

Let $\zeta,\epsilon>0$ be parameters satisfying $\zeta\geq 7\epsilon$. For any $x$, $y$, and $b$, a signalling test is defined by999If $\mathsf{data}_{1}$ does not include an index in which the inputs are $(x,y)$ then the test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ rejects by definition (recall Definition 10.2.2).

[TABLE]

where $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$ is defined as in Equation (10.4).

Let $T$ denote the event that the signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ passes. The probability of the test passing when interacting with $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is given by

[TABLE]

The signalling test above is defined with $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}\right)$, rather than its absolute value, since this will be the only case relevant for our analysis; see Appendix B.2.

When considering IID boxes $\mathrm{O}_{AB|XY}^{\otimes n}$, the signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ is reliable — if $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}\right)\geq\zeta$ the test will detect it with high probability, i.e. the test will accept with high probability, and if $\mathrm{O}_{AB|XY}$ is non-signalling then the test will reject with high probability. It follows, in particular, that if signalling is detected by the test in $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$, $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ is also signalling with high probability. This holds also when considering the de Finetti box as in Definition 8.2.

To make the statement precise, let us define two sets of single-round boxes for every signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$. The first set is given by

[TABLE]

Using the continuity of the signalling measure, Lemma 10.2.2, we observe that

[TABLE]

The second set is defined to be

[TABLE]

where $\delta=\delta\left(\frac{n}{2},\epsilon\right)=\left(\frac{n}{2}+1\right)^{|\mathcal{A}||\mathcal{B}||\mathcal{X}||\mathcal{Y}|-1}e^{-n\epsilon^{2}/4}$. Since the signalling test is reliable when acting on IID boxes, one can easily show that

[TABLE]

for any $0<\nu<\zeta-6\epsilon$. This is stated and proven as Lemma B.1 in Appendix B.1. The sets and the relevant constants are illustrated in Figure 10.1.

We use below the following notation:

• •

$in^{\sigma}$ denotes the event that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}\in\sigma^{(A\rightarrow B,x,y,b)}$.

• •

$in^{\Sigma}$ denotes the event that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}\in\Sigma^{(A\rightarrow B,x,y,b)}$.

• •

“For all signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$…” should be understood as “for all $x$, $y$, and $b$, defining a signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$,…" and similarly for other quantifiers.

Furthermore, to avoid confusion, we explicitly denote the probability distributions on which we evaluate the probability of the above events.

As shown in Appendix B.1, the following lemma holds for a de Finetti box:

Lemma \thelem.

Let $\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}=\mathrm{Q}_{XY}^{\otimes n}\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a de Finetti box. For every signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$,

$\mathrm{Pr}_{\mathsf{data}\sim\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[\lnot in^{\Sigma}\land T\right]\leq\delta$** 2. 2.

$\mathrm{Pr}_{\mathsf{data}\sim\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[in^{\sigma}\land\lnot T\right]\leq\delta$,

where $\delta=\delta\left(\frac{n}{2},\epsilon\right)=\left(\frac{n}{2}+1\right)^{|\mathcal{A}||\mathcal{B}||\mathcal{X}||\mathcal{Y}|-1}e^{-n\epsilon^{2}/4}$.

A similar lemma can be proven for permutation invariant parallel boxes, using the de Finetti reduction of Theorem 8.1:

Lemma \thelem.

Given a parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ let $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}=\mathrm{Q}_{XY}^{\otimes n}\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. For every permutation-invariant box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ and every $\mathcal{T}^{(A\rightarrow B,x,y,b)}$:

$\mathrm{Pr}_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[\lnot in^{\Sigma}\land T\right]\leq c\delta$** 2. 2.

$\mathrm{Pr}_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[in^{\sigma}\land\lnot T\right]\leq c\delta$* ,*

where $c=(n+1)^{|\mathcal{X}||\mathcal{Y}|\left(|\mathcal{A}||\mathcal{B}|-1\right)}$ and $\delta$ is as in Lemma 10.2.2.

Proof.

We prove both of the claims together. Denote the relevant event by $E(\mathsf{data})$ and note that for both events we can write

[TABLE]

From Theorem 8.1 we get $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}(\mathsf{data})\leq c\cdot\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}(\mathsf{data})$ and therefore

[TABLE]

Combining this with Lemma 10.2.2 proves the lemma. ∎

10.2.3 Guessing game

The previous section discussed the relations between $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ and $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$ in terms of the probabilities of certain events which depend on these averaged single-round boxes. All statements made so far were general, in the sense that they hold for any permutation-invariant parallel box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. In the current section we focus on permutation-invariant non-signalling parallel boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Our goal is to show that for non-signalling boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, the averaged boxes $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ and $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$ cannot be too signalling as we were set to prove.

To this end, we construct a guessing game for every signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$. In the game, a referee gives Alice and Bob $n/2$ questions, distributed according to $\mathrm{Q}_{XY}^{\otimes n/2}$. Bob’s goal is to output an index $j\in\left[n/2\right]$ for which $(x_{j},y_{j})=(x,y)$ (while Alice does not need to output anything). Alice and Bob are allowed to use any non-signalling box to win the game. Clearly, a non-signalling box should not allow Bob to learn anything about Alice’s input from his outputs. Bob’s best strategy is thus to guess an index $j$ for which $y_{j}=y$. The probability that his guess is correct is $\mathrm{Q}_{X|Y}(x|y)$. If Alice and Bob are able to win the game with higher probability then the used box must be signalling.101010This motivates our signalling measure given in Definition 10.2.2.

The following lemma asserts that, for non-signalling $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, conditioned on the signalling test detecting a lot of signalling in $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{2})}$, the probability that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ is highly signalling is bounded away from 1. Intuitively, we would have expected that if signalling is detected in $\mathsf{data}_{2}$ then $\mathsf{data}_{1}$ should exhibit signalling practically with certainty. The lemma (roughly) shows that, when starting with non-signalling boxes, this is not the case.

Before starting, we remind the reader that we assume in this section that all pairs of questions appear in $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$. For the lemmas and proofs below it is important to remember that all the probabilities are conditioned on $\mathsf{data}_{1}$. To ease notation we do not explicitly write it.

Lemma \thelem.

Let $\epsilon\in[0,1]$ and $n$ be such that

[TABLE]

and $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ a non-signalling parallel box. For any signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ denote by $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}|\mathcal{T}=1}$ the probability distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}$ conditioned on the event $\mathcal{T}^{(A\rightarrow B,x,y,b)}\left(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)=1$, whenever such a conditional probability distribution is defined. Then,

[TABLE]

for $c$ and $\delta$ as in Lemma 10.2.2.

Proof.

We denote $\mathbold{x}_{\mathsf{data}_{1}}=x_{1},\dots,x_{n/2}$ and $\mathbold{y}_{\mathsf{data}_{1}}=y_{1},\dots,y_{n/2}$.

For every signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ and inputs for Bob $\mathbold{y}_{\mathsf{data}_{1}}$ such that $\Pr_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[T|\mathbold{y}_{\mathsf{data}_{1}}\right]\neq 0$ we construct a guessing game. Our goal is to derive a contradiction by showing that if Equation (10.11) is not true, then the guessing game can be won with probability higher than the optimal non-signalling winning probability.

The guessing game is as explained above. A referee gives Bob the inputs $\mathbold{y}_{\mathsf{data}_{1}}$ and Alice gets $\mathbold{x}_{\mathsf{data}_{1}}$ distributed according to $\mathrm{Q}_{XY}(x|y)$. Bob’s goal is to guess an index $j\in[n/2]$ such that $(x_{j},y_{j})=(x,y)$ (we assume that such exists).

If the parties share a non-signalling box $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ then Bob’s marginals are the same for all $\mathbold{x}_{\mathsf{data}_{1}}$. Therefore, his outputs do not give him any information about the inputs that Alice got from the referee. The best non-signalling strategy for the guessing game is therefore to choose, uniformly at random, an index $j$ for which $y_{j}=y$. The winning probability is then given by $W_{\mathrm{ns}}=\mathrm{Q}_{X|Y}(x|y)<1$.111111Note that while Bob’s inputs, $\mathbold{y}_{\mathsf{data}_{1}}=y_{1},\dots,y_{n/2}$, are fixed in a specific instance of the guessing game, Alice’s inputs are still distributed according to the prior $\mathrm{Q}_{XY}(x|y)$.

We now show that if the parties share $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ for which

[TABLE]

then they can win the above guessing game with probability higher than the optimal non-signalling winning probability $W_{\mathrm{ns}}$.

The idea is as follows. The parties share many identical copies of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. They use the inputs given by the referee as $\mathbold{x}_{\mathsf{data}_{1}}$ and $\mathbold{y}_{\mathsf{data}_{1}}$ in all of the copies and choose, using shared randomness, the rest of the inputs, associated with $\mathsf{data}_{2}$, in each copy (i.e., there are different inputs for $\mathsf{data}_{2}$ for each copy). They use the copies of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ with the described inputs. Bob then looks for the first copy of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ in which the event $T$ holds – such a copy exists as long as121212To see this note that since the box is non-signalling between Alice and Bob, Bob can check in which copy the test passes even before Alice uses her input. Therefore, the probability to pass the test is independent of Alice’s inputs and hence must be non-zero for any of them. $\mathrm{Pr}_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[T|\mathbold{y}_{\mathsf{data}_{1}}\right]\neq 0$; he can find it since he knows all the inputs in $\mathsf{data}_{2}$ (as they were chosen using shared randomness).131313Recalling Definitions 10.2.2 and 10.2.2, we see that only $\mathrm{O}_{BXY}^{\textup{freq}(\mathsf{data}_{2})}$ is needed in order to check whether the signalling test passes or not. Thus, Bob indeed has all the relevant information and he can locally check whether the test passes or not. Alice does not need to know in which copy the test holds. Using the chosen copy, Bob chooses a random index $j\in[n/2]$ such that $y_{j}=y$ and $b_{j}=b$.

Let us show that, as long as $\mathrm{Pr}_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[T|\mathbold{y}_{\mathsf{data}_{1}}\right]\neq 0$, this box achieves a winning probability which is higher than $W_{\mathrm{ns}}$. For the chosen copy, the event $T$ holds and hence $\mathsf{data}_{1}$ can be seen as data distributed according to $n/2$ identical copies of $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$, which is with high probability in $\Sigma_{(i,b,x,y)}$ according to Equation (10.12). Using Equation (10.9) this implies

[TABLE]

where $\nu>0$ is any parameter satisfying $\nu<\zeta-6\epsilon$ (recall Equation (10.9)).

Using Definition 10.2.2 we know that if indeed

[TABLE]

then $\mathrm{O}_{BY}^{\textup{freq}(\mathsf{data}_{1})}(b,y)>0$ and

[TABLE]

That is, by choosing an index for which $b_{j}=b$ Bob increase the winning probability.

On the other hand, if $\mathrm{Sig}^{(A\rightarrow B,b,x,y)}(\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})})\leq\nu$, which can happen with probability $\sqrt{c\delta}$, then Bob may decrease his winning probability. In the worst case the winning probability is 0. Therefore, for the chosen copy (for which the test passed) we get the following winning probability

[TABLE]

Thus, $W>W_{\mathrm{ns}}$ for

[TABLE]

Using $W_{\mathrm{ns}}\cdot\mathrm{O}_{BY}^{\textup{freq}(\mathsf{data}_{1})}(b,y)\leq 1$ and $\sqrt{c\delta}\leq(n+1)^{|\mathcal{X}||\mathcal{Y}||\mathcal{A}||\mathcal{B}|}e^{-n\epsilon^{2}/8}$, we see that as long as $n/\ln(n)>20|\mathcal{X}||\mathcal{Y}||\mathcal{A}||\mathcal{B}|\epsilon^{-2}\ln(2/\epsilon)$ we have

[TABLE]

Assuming $\zeta\geq 7\epsilon$, there is a choice of $\nu$ that satisfies both Equation (10.16) and the earlier condition that $\nu<\zeta-6\epsilon$.

We get that Equation (10.12) must not hold for any $\mathbold{y}_{\mathsf{data}_{1}}$ and hence cannot hold also when we omit the conditioning on $\mathbold{y}_{\mathsf{data}_{1}}$. The lemma therefore follows. ∎

The bound given in Equation (10.11) is weak for two reasons. First, $\mathsf{data}$ is distributed according to the conditional distribution $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}|\mathcal{T}=1}$ and not according to $\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}$ itself. Second, it only tells us that \mathrm{Pr}_{\mathsf{data}\sim\mathrm{P}_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}|\mathcal{T}=1}}\big{[}\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}\notin\Sigma^{(A\rightarrow B,x,y,b)}\big{]}\geq\sqrt{c\delta}, i.e., the probability that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data}_{1})}$ has a small value of signalling is higher than $\sqrt{c\delta}$. We show how the statement can be amplified using Lemma 10.2.2, which utilised our de Finetti reduction.

Theorem 10.3**.**

Let $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ be a permutation-invariant non-signalling parallel box and $n$ such that Equation (10.16) is satisfied. Then for any signalling test $\mathcal{T}^{(A\rightarrow B,x,y,b)}$ such that $\mathrm{Q}_{XY}(x,y)\neq 0$ and $\mathrm{Q}_{X|Y}(x|y)\neq 1$ and conditioned on the event of all questions $(x,y)$ appearing in $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$,

[TABLE]

Similarly, for any signalling test $\mathcal{T}^{(B\rightarrow A,x,y,a)}$,

[TABLE]

Proof.

From Lemma 10.2.2 part 1 we get

[TABLE]

and this can be rewritten as

[TABLE]

According to Lemma 10.2.3, this implies

[TABLE]

Therefore it must be that

[TABLE]

or alternatively,

[TABLE]

Next, combining Lemma 10.2.2 part 2 with Equation (10.20) we get

[TABLE]

Using Equation (10.19) we get

[TABLE]

Using the definition of the set $\sigma^{(A\rightarrow B,x,y,b)}$ and Equation (10.8) we get that

[TABLE]

Permutation invariance implies that $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$ are distributed in the same way. Therefore, we also have

[TABLE]

By definition,

[TABLE]

and, thus, using the linearity of the signalling measure, for any fixed observed data

[TABLE]

Equation (10.17) follows by combining the above equations. Switching Alice and Bob in all lemmas above, Equation (10.18) follows in the exact same way. ∎

Theorem 10.3 tells us that if $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a permutation-invariant non-signalling parallel box then the probability that $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$ is highly signalling (in any direction and using any inputs and outputs) is exponentially small in the number of games. De facto, this means that we can think of the observed data sampled from a non-signalling parallel box as if it came from an IID box defined via a single-round box that is approximately non-signalling, with high probability. This can be used to infer properties of non-signalling parallel boxes. In Section 10.3 we show that Theorem 10.3 implies a threshold theorem almost directly.

Apart from the applications of Theorem 10.3, we see it as an abstract mathematical statement about the observed data produced by non-signalling parallel boxes. Deriving a similar statement for quantum boxes is also of interest (and, in particular, will imply a threshold theorem for all quantum games). The main difficulty in deriving a quantum analogue of Theorem 10.3 lies in finding a “non-quantumness” measure which, ideally, can be performed locally by one of the parties (as in our guessing game in the proof of Lemma 10.2.3).

10.3 Threshold theorem

This section is devoted to deriving the following threshold theorem:

Theorem 10.4**.**

For any complete-support two-player game $\mathrm{G}$ whose optimal non-signalling winning probability is $w_{\mathrm{ns}}=1-\alpha$, there exist $\mathcal{C}(\mathrm{G})$ such that for every $0<\beta\leq\alpha$ and large enough $n$, the probability that non-signalling players win more than a fraction $1-\alpha+\beta$ of the $n$ questions in the threshold game $\mathrm{G}^{n}_{1-\alpha+\beta}$ is at most $\exp\left[-\mathcal{C}(\mathrm{G})n\beta^{2}\right]$.

That is, for sufficiently many repetitions the probability to win more than a fraction $1-\alpha+\beta$ of the $n$ games is exponentially small. A sufficient condition on the number of repetitions for the bound in the theorem to hold is stated in Equation (10.10), and a choice of constants made around Equation (10.28), for a more precise bound.

The proof builds on Theorem 10.3 and is rather simple. If $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$ is not too signalling (for any signalling test), then its winning probability in a single game cannot be much higher than the winning probability of the optimal non-signalling strategy for $\mathrm{G}$. Furthermore, the number of games won in any given observed data can be read directly from the winning probability of $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$. Thus, by analysing $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$ we are actually analysing the number of games won. The combination of these two observations gives the final theorem. We follow these steps below.

10.3.1 Winning probability of approximately non-signalling strategies

The linearity of the non-signalling conditions (Definition 3.1.1) and the winning probability in a game (Equation (4.1)) allow us to phrase the optimisation problem of finding the optimal non-signalling winning probability in any game $\mathrm{G}$ as a linear program [Schrijver, 1998]. For complete-support game we can use the following linear program over the variables $\mathrm{O}_{AB|XY}(a,b|x,y)$:

[TABLE]

The objective function, Equation (10.21a), is exactly the winning probability in the game when using strategy $\mathrm{O}_{AB|XY}$. Equations (10.21d) and (10.21e) are the normalisation and positivity constraints on the strategy $\mathrm{O}_{AB|XY}$. In Equations (B.5a) and (B.5a) all the non-signalling constraints are listed, as follows for complete-support games from Equation (10.5).141414[Arnon-Friedman et al., 2016b] includes an explanation of the implications of the linear program (10.21) to games with incomplete support.

Our goal is to upper-bound the winning probability of $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$, which may be slightly signalling. The optimal winning probability of strategies which are slightly signalling can be written as a linear program similar to the one above, by relaxing the constraint in Equations (B.5a) and (B.5b) so that it allows for some signalling. Specifically, keeping in mind Equation (10.17), we are interested in the following program:

[TABLE]

Program (10.22) can be seen as a perturbation of Program (10.21). Their optimal values are therefore related to one another; the exact relation can be derived by studying how sensitive the objective function is to small modifications of the constraints. This process is called “sensitivity analysis of linear programs” and we follow it in Appendix B.2 for the programs of interest. As a result, we get that strategies $\mathrm{O}_{AB|XY}$ with

[TABLE]

for all $x$, $y$, $a$, and $b$ achieve winning probability $w\left(\mathrm{O}_{AB|XY}\right)$ such that

[TABLE]

where $1-\alpha$ is the optimal winning probability of a non-signalling strategy, i.e., it is the solution of Program (10.21), and $d=|\mathcal{X}||\mathcal{Y}|\left(|\mathcal{A}|+|\mathcal{B}|\right)$ is the number of the non-signalling constraints in the linear programs above.

10.3.2 Final result

The results of Section 10.2 are applicable when considering permutation invariant strategies $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ (recall Definition 8.1). As the repeated game $\mathrm{G}^{n}_{1-\alpha+\beta}$ is by itself permutation invariant we can restrict the strategies of the players to be permutation invariant without loss of generality.151515This is not to say that all strategies are permutation invariant but only that the optimal strategy can be assumed to be permutation invariant. It is perhaps interesting to note that, more commonly, the optimal strategies are taken to be, without loss of generality, deterministic in proofs of classical parallel repetition and pure in proofs of quantum parallel repetition. Here we are choosing to focus on permutation invariant strategies instead. This is shown in the next lemma.

Lemma \thelem.

For every strategy $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ for the repeated game $\mathrm{G}^{n}_{1-\alpha+\beta}$ there exists a permutation-invariant strategy $\tilde{\mathrm{P}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ such that $w\left(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)=w\left(\tilde{\mathrm{P}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)$.

Proof.

Given $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ define its permutation-invariant version to be

[TABLE]

The winning probability of the game is linear in the strategy, therefore we have

[TABLE]

Since the questions in the repeated game are chosen in an IID manner and the winning condition is checked for each game separately, the winning probability is indifferent to the ordering of the questions-answers pairs. As $\pi$ permutes the questions and answers together we have $w\left(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\circ\pi\right)=w\left(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)$. Thus, we get $w\left(\tilde{\mathrm{P}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)=w\left(\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}\right)$. ∎

We can now combine everything we have learned in the previous sections in order to derive the final results. As before, we denote by $d$ the number of non-signalling conditions appearing in the linear programs above, i.e., $d=|\mathcal{X}||\mathcal{Y}|\left(|\mathcal{A}|+|\mathcal{B}|\right)$.

Lemma \thelem.

Let $w(G)=1-\alpha$ be the optimal winning probability of a non-signalling strategy in $\mathrm{G}$. Let $0<\beta\leq\alpha$ be some constant and $n$ a sufficiently large integer such that Equation (10.16) is satisfied. Then for any non-signalling strategy $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ of the threshold game $\mathrm{G}^{n}_{1-\alpha-\beta}$,

[TABLE]

Proof.

We denote the event of all inputs appearing in $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$ by $aid$. Furthermore, let $\zeta,\epsilon>0$ be such that $d(\zeta+2\epsilon)\leq\beta$, $\epsilon\leq\min_{x,y}\mathrm{Q}_{XY}(xy)$ and $7\epsilon\leq\zeta\leq 1$.

If all questions $(x,y)$ appear at least once in $\mathsf{data}_{1}$ and $\mathsf{data}_{2}$, i.e., the event $aid$ holds, then we can use Equation (10.23) in combination with Theorem 10.3 and get

[TABLE]

The probability that the event $aid$ does not hold is upper bounded by

[TABLE]

and therefore all together we have

[TABLE]

Our threshold theorem, Theorem 10.4, follows from Lemma 10.3.2:

Proof of Theorem 10.4.

Let $f$ denote the fraction of coordinates in which the players win the game in the observed data. Note that $f$ is equals exactly $w\left(\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}\right)$ by the definition of $\mathrm{O}_{AB|XY}^{\textup{freq}(\mathsf{data})}$. Lemma 10.3.2 therefore implies

[TABLE]

Plugging the values of the parameters $d$, $c$, and $\delta$, we see that Equation (10.25) can be written, for an appropriately defined $\hat{C}(\mathrm{G},n)$, as

[TABLE]

Our goal now is to show that, actually, it must be possible to replace $\hat{C}(\mathrm{G},n)$ with a constant smaller than 1 and by this drop the polynomial pre-factor. We do this using a step that appeared in [Lancien and Winter, 2016, Proof of Theorem 3.1].161616The part of the proof starting at this point onward did not appear in the proof of the threshold theorem of [Arnon-Friedman et al., 2016b]. We follow here the last part of the proof of the threshold theorem presented in [Lancien and Winter, 2016], which appeared after [Arnon-Friedman et al., 2016b], and can be used to improve the result of [Arnon-Friedman et al., 2016b].

To this end, denote by $\omega_{\text{opt}}(\mathrm{G}^{n}_{1-\alpha+\beta})$ the optimal winning probability in the threshold game $\mathrm{G}^{n}_{1-\alpha+\beta}$. For any $n$, let $\tilde{C}_{n}$ be the constant for which the tight bound

[TABLE]

holds. In particular, this means that there exists a strategy $\mathrm{P}_{n}$ that achieves the above winning probability.

Assume by contradiction that there exists $N_{0}$ such that $\tilde{C}_{N_{0}}>1$. Thus, there exists a strategy $\mathrm{P}_{N_{0}}$ achieving $\tilde{C}_{N_{0}}\exp[-N_{0}\epsilon^{2}/8]$, with $\tilde{C}_{N_{0}}>1$, in the game $\mathrm{G}^{N_{0}}_{1-\alpha+\beta}$.

Let $N_{1}$ be sufficiently large, so that Equation (10.10) holds for $n=N_{0}N_{1}$ and consider the threshold game $\mathrm{G}^{N_{0}N_{1}}_{1-\alpha+\beta}$. On the one hand, using $N_{1}$ independent copies of $\mathrm{P}_{N_{0}}$ achieves winning probability of $\left(\tilde{C}_{N_{0}}\right)^{N_{1}}\exp[-N_{0}N_{1}\epsilon^{2}/8]$ and thus

[TABLE]

On the other hand, Equation (10.26) must hold for $n=N_{0}N_{1}$:

[TABLE]

To reconcile both bounds, we must have $\left(\tilde{C}_{N_{0}}\right)^{N_{1}}\leq\mathrm{poly}\left(N_{0}N_{1}\right)$ for all sufficiently large $N_{1}$. Thus, $\tilde{C}_{N_{0}}\leq 1$, which leads to a contradiction.

We get that for all sufficiently large $n$, $\tilde{C}_{n}\leq 1$. In combination with Equation (10.27) we therefore have

[TABLE]

To get a better feeling of the result, without trying to optimise it, one can make the following choices. Let $\epsilon=\frac{\beta}{10d}$, $\zeta=8\epsilon$ and $\nu=\epsilon$ (assuming $\min_{x,y}\mathrm{Q}_{XY}(x,y)>\frac{\beta}{10d}$). Using these choices, our proof holds for $n$ and $\beta$ such that

[TABLE]

with the following constants in Theorem 10.4:

[TABLE]

The theorem then reads

[TABLE]

A different choice of parameters can improve the dependence of the constants on the game $\mathrm{G}$.

10.4 Open questions

In this chapter we considered the question of parallel repetition of games when the players are allowed to use any non-signalling strategy. The most interesting direction for future work is the development of a similar proof technique, based on de Finetti reductions or other forms of reductions to IID, for classical and quantum parallel repetition. In the case of classical games, parallel repetition results for general games with more than two parties are unknown. For quantum games, even the case of two-player games is not completely solved. (Recall Section 4.1.2 for further information). Since our proof captures all types of games and any number of players (see [Arnon-Friedman et al., 2016b]), a similar proof technique for classical and quantum games will solve some open questions.

To understand what is the main challenge when trying to extend the proof to classical and quantum case, note the following. In the standard proofs of parallel repetition theorems, i.e., proofs following the approach of [Raz, 1998] most of the difficulties arise due to the effect of conditioning on the event of winning some of the game repetitions. As this event is one that depends on the structure of the game and strategy and we have no control over them, conditioning can introduce arbitrary correlations between the questions used in different repetitions of the game, a major source of difficulty for the remainder of the argument. In our proof we also need to analyse the effect of conditioning on a certain event, the event of the non-signalling test accepting, and this is done in Lemma 10.2.3. However, the key advantage of our approach is that the test has a very specific structure, and in particular conditioning on the test passing can be done locally by the players in a way that respects the non-signalling constraints. As a result it is almost trivial to deal with the conditioning in the remainder of the proof. This shift from conditioning on an uncontrolled event, success in the game, to a highly controlled one, a non-signalling test that we design ourselves, is a key simplification that we expect to play an important role in any extension of our method to classical or quantum strategies.

By finding appropriate “non-classicality” and “non-quantumness” measures which can replace our signalling measure in Definition 10.2.2 one may be able to adapt the proof to the multi-player classical and quantum cases as well. Unfortunately, it is not clear which measure can be used by the players, preferably locally, to determine if their systems are classical or quantum. In other words, the main difficulty is finding a measure for which Lemma 10.2.3 can be proven. The rest of the proofs should follow easily for most “non-classicality” and “non-quantumness” measures of one-game strategies.

Chapter 11 Showcase: device-independent quantum cryptography

In this chapter we consider the showcase of device-independent quantum cryptography and show how the security proof of device-independent cryptographic protocols can be performed via a reduction to IID. We introduce a general framework for obtaining proofs of device-independent security for a broad range of cryptographic tasks. For the sake of explicitness, we focus in this chapter on the task of device-independent quantum key distribution (DIQKD).111Since the initial announcement of our work [Arnon-Friedman et al., 2016c], our framework has already been applied to a variety of additional tasks, including conference key agreement [Ribeiro et al., 2017], randomness expansion [Arnon-Friedman et al., 2016c] and privatization [Kessler and Arnon-Friedman, 2017], as well as randomness generation with sub-linear quantum resources [Bamps et al., 2017].

The main result that we present can be phrased in the following informal way (the formal theorem is stated as Theorem 11.4):

Theorem 11.1** (Informal).**

Security of DIQKD in the most general case follows from security under the IID assumption. Moreover, the dependence of the key rate on the number of rounds, $n$, is the same as the one in the IID case, up to terms that scale like $1/\sqrt{n}$.

The theorem establishes the a priori surprising fact that general quantum adversaries are no stronger than an adversary restricted to IID attacks, even in the device-independent setting. This allows us to give simple and modular security proofs of DIQKD and to extend tight results known for DIQKD under the IID assumption to the most general setting thus deriving essentially optimal key rates and noise tolerance.222This is crucial for experimental implementations of device-independent protocols. Our quantitive results have been applied to the analysis of the first experimental implementation of a protocol for randomness generation in the fully device-independent framework [Liu et al., 2017].

Our technique takes advantage of the sequential nature of the protocol, as well as the specific way in which classical statistics are collected by users of the protocol, and makes use of the entropy accumulation theorem (EAT), discussed as part of Chapter 9. The analysis and results of this chapter previously appeared in [Arnon-Friedman et al., 2016c, Arnon-Friedman et al., 2018].

The chapter is arranged as follows. We first explain in Section 11.1 what is the main challenge when proving the security of device-independent quantum cryptographic protocols, such as DIQKD. Section 11.2 deals with the analysis of the main subroutine of most device-independent protocols. Then, the security proof of DIQKD is given in Section 11.3. As we are about to encounter many parameters and variables throughout the proofs, we list them in Appendix C.3 for convenience.

11.1 Main challenge and goal

The central task when proving security of cryptographic protocols consists in bounding the information that an adversary, called Eve, may obtain about certain values generated by the protocol, which are supposed to be secret. In the case of QKD, for example, the relevant output of the protocol is the raw data $K$, and proving security is essentially equivalent333From that point onward standard classical post-processing steps, e.g., error correction and privacy amplification, suffice to prove the security of the protocol; recall Section 4.2.3. to establishing a lower bound on the smooth conditional min-entropy $H_{\min}^{\varepsilon}(K|E)$, where $E$ is Eve’s quantum system, which can be initially correlated to the device producing $K$. The quantity $H_{\min}^{\varepsilon}(K|E)$ determines the maximal length of the secret key that can be created by the protocol. Hence, proving security amounts to establishing a lower bound on $H_{\min}^{\varepsilon}(K|E)$. Evaluating the smooth min-entropy $H_{\min}^{\varepsilon}(K|E)$ of a large system is often difficult, especially in the device-independent setting where not much is known about the way $K$ is produced and the system $E$ is out of our control.

The IID assumption, discussed in Chapter 7, is commonly used to simplify the task of calculating $H_{\min}^{\varepsilon}(K|E)$. The analysis of the smooth min-entropy under the IID assumption was sketched in Section 7.3.2; in that case the total smooth min-entropy can be easily related to the sum of the von Neumann entropies in each round separately, using the quantum asymptotic equipartition property (Section 7.2.2). A bound on the entropy accumulated in one round can usually be derived using the expected winning probability in the game played in that round (as appeared in Section 5.2), which in turn can be easily estimated during the protocol in the IID case using standard Chernoff-type bounds. A long line of works [Acín et al., 2006a, Acín et al., 2006b, Scarani et al., 2006, Acín et al., 2007, Masanes, 2009, Pironio et al., 2009, Hänggi et al., 2010a, Hänggi and Renner, 2010, Masanes et al., 2011, Masanes et al., 2014] considered the security of device-independent quantum and non-signalling cryptography under the IID assumption. Most relevant for our work are the results of [Pironio et al., 2009], where security of a DIQKD protocol was proven in the asymptotic limit, i.e., when the device is used $n\rightarrow\infty$ times, and under the IID assumption. Their protocol is based on the CHSH inequality [Clauser et al., 1969], and their analysis shows that it achieves the best possible rates under these assumptions.

Unfortunately, even though quite convenient for the analysis, the IID assumption is a very strong one in the DI scenario. In particular, under such an assumption the device cannot use any internal memory (i.e., its actions in one round cannot depend on the previous rounds) or even display time-dependent behaviour (due to inevitable imperfections for example). Without this assumption, however, very little is known about the structure of the untrusted device and hence also about its output (as the device might correlate the different rounds in an almost arbitrary way). As a consequence, DIQKD security proofs [Reichardt et al., 2013, Vazirani and Vidick, 2014, Miller and Shi, 2014] that estimated $H_{\min}^{\varepsilon}(K|E)$ directly for the most general case had to use complicated techniques and statistical analysis compared to the IID case. This led to security statements which are of limited relevance for practical experimental implementations; they are applicable only in an unrealistic regime of parameters, e.g., small amount of tolerable noise and large number of signals.

To overcome the above difficulty we take the approach of reductions to IID in the analysis presented in the following sections. In particular, we leverage the sequential nature of our DIQKD protocol to prove its security by reducing the analysis of multi-round sequential boxes to that of IID boxes as discussed in Chapter 9. Specifically, we use the EAT presented in Section 9.2.3 to establish that entropy accumulates additively throughout the multiple rounds of the protocol and use it to bound the total amount of smooth min-entropy $H_{\min}^{\varepsilon}(K|E)$.444The security proof presented in [Miller and Shi, 2014] is similar in spirit (but technically very different) to the one presented here. It bounds the total amount of smooth min-entropy generated in the protocol in a round-by-round fashion but the entropy accumulated in a single round is not the von Neumann entropy.

This results in a proof technique with several benefits. Firstly, since the analysis of the IID case is rather simple and modular (as it builds mainly on the analysis of a single-round box) a security proof via a reduction to IID ends up being simple and modular by itself. For example, if one wishes to consider a DIQKD protocol based on a game other than the CHSH game, the sole significant modification of the security proof is the analysis of a single-round box (see Sections 5.2 and 11.2.2). Secondly, due to the optimality of the EAT (at least to first order in $n$), we are able to extend tight results known for, e.g., DIQKD, under the IID assumption, to the most general setting. This yields the best rates known for any protocol for a device-independent cryptographic task. Thirdly, performing a finite-size analysis is no harder than performing the asymptotic one as all dependency on $n$ is either trivial or already incorporated in the EAT.

We are now ready to embark on the mission of proving the security of our DIQKD protocol, described in Section 4.2.2 (see also Protocol 11.2 below).

11.2 Device-independent entropy accumulation

The current section is devoted to the analysis of the entropy accumulation protocol presented as Protocol 11.1. The entropy accumulation protocol acts as the main building block of many device-independent cryptographic protocols. It is used to generate the raw data for Alice and Bob by playing a non-local game $n$ times in sequence using an untrusted device $D$. We remark that even though we call the entropy accumulation protocol a “protocol”, one should see it more as a mathematical tool which allows us to use the machinery of the EAT rather than an actual protocol to be implemented.555In particular, in a setting with two distinct parties, Alice and Bob, communication is required to actually implement Protocol 11.1. We ignore this as it is not relevant for the analysis. The relevance of the protocol stems from the fact that the final state at the end of the protocol, on which a smooth min-entropy is evaluated, is closely related to the final state in the actual protocol to be executed (e.g., our DIQKD protocol).

Our primary task is to lower-bound the amount of smooth min-entropy generated by playing the $n$ games. This lower-bound can then be used as the starting point of security proofs of device-independent cryptographic protocols, such as DIQKD. The informal statement is given below (for the explicit formulation see Theorem 11.3):

Theorem 11.2** (Informal).**

Fix a choice of parameters for Protocol 11.1. Then there exist constants $c_{1},c_{2}>0$ such that the following holds. Let $D$ be any device and $\rho_{|\Omega}$ the state generated using Protocol 11.1, conditioned on the protocol not aborting. Then for any $\varepsilon_{1},\varepsilon_{2}\in(0,1)$, either the protocol aborts with probability greater than $1-\varepsilon_{1}$ or

[TABLE]

The registers $\mathbold{A}\mathbold{B}$ in Equation (11.1) contain the classical outputs generated by the device during the protocol. The registers $\mathbold{X}\mathbold{Y}\mathbold{T}$ hold the classical information exchanged during the protocol, that may be leaked to the adversary. $E$ is a quantum register that describes the adversary’s quantum system. Thus, Equation (11.1) gives a precise bound on the amount of the smooth min-entropy present in the users’ outputs at the end of the protocol, conditioned on all information available to the adversary.

We give below explicit formulas for computing the constants $c_{1}$ and $c_{2}$ that appear in Equation (11.1) as a function of the parameters of the protocol. Importantly, the constant $c_{1}$ that governs the leading-order term equals the optimal constant, i.e., the same leading constant that would be obtained under the IID assumption, which by the asymptotic equipartition property (Theorem 7.2) is the von Neumann entropy accumulated in one round of the protocol. Furthermore, our analysis provides control over the constant $c_{2}$ in front of the second-order term. Such control is necessary for any application where finite values of $n$ need to be considered, such as in quantum cryptography, where the values of $n$ achieved in practice remain relatively small.666See e.g. Figure 11.4, where one can see that finite-size effects can play an important role up to even moderately large values of $n\approx 10^{10}$.

As we show below, Theorem 11.2 can be proven by reducing the general sequential scenario to the IID one using the EAT. To use the EAT, we first need to construct the relevant objects, i.e., the EAT-channels and the min-tradeoff functions defined in Section 9.2.2. This is done in the following two sections. A lower-bound on the smooth min-entropy is then proven in Section 11.2.3.

11.2.1 EAT channels

Protocol 11.1 proceeds in rounds and can therefore be presented by an application of a sequence of quantum channels (recall Section 9.1). In this section we define the considered channels and prove that they are EAT-channels, according to Definition 9.2.2. Note that one has some freedom in choosing the channels to work with (i.e., the channels are not completely defined by the protocol itself). We choose our particular channels so that all the prerequisites of the EAT are fulfilled and, at the same time, the final bound on the smooth min-entropy can be converted to a bound on the smooth min-entropy in our DIQKD protocol (see Section 11.3.2, and Lemma 11.3.2 in particular, for details).

Every EAT channel $\mathcal{M}_{i}$ describes one round of the protocol, where one round includes Steps 9-12 of Protocol 11.1. For every $i\in\{0\}\cup[n]$, the (unknown) quantum state of the device $D$ shared by Alice and Bob after round $i$ of the protocol is denoted by $\rho_{Q_{A}Q_{B}}^{i}$. We denote the register holding this state by $R_{i}$. In particular, $R_{0}=Q_{A}Q_{B}$ at the start of the protocol. At Step 11 in Protocol 11.1, the quantum state of the devices is changed from $\rho_{Q_{A}Q_{B}}^{i-1}$ in $R_{i-1}$ to $\rho_{Q_{A}Q_{B}}^{i}$ in $R_{i}$ by the use of the device. To be a bit more precise, the quantum state is changed in two stages. First, the relevant measurement of Step 11 is done (where it is assumed that the measurements of the different components are in tensor product). Then, after $A_{i}$ and $B_{i}$ are recorded, the different components of the device are allowed to communicate. Thus, some further changes can be made to the post-measurement state even based on the memory of all components together (recall Section 6.2.2).

In the notation of Chapter 9, we make the following choices:

[TABLE]

Our EAT channels are then

[TABLE]

defined by the CPTP map describing the $i$-th round of Protocol 11.1, as implemented by the untrusted device $D$. That is, the channel describes the random choices of $T_{i}$, $X_{i}$, and $Y_{i}$, the quantum operations made by the device, and the production of $A_{i}$, $B_{i}$, and $W_{i}$.

Since the operations of $D$ are unknown, our EAT channels are not completely explicit. The important thing is merely that we know that some quantum channels describing the operation of the device exist. The lack of knowledge regarding the channels does not raise any problems when applying the EAT but it does make the task of deriving good min-tradeoff functions more challenging (compared to the scenario of a characterised device). This difficulty, however, is inherent to device-independent information processing tasks and has nothing to do with the proof technique; see Section 11.2.2 below for further details.

We prove that the described channels can act as our EAT channels.

Lemma \thelem.

The channels $\left\{\mathcal{M}_{i}:R_{i-1}\rightarrow R_{i}A_{i}B_{i}X_{i}Y_{i}T_{i}W_{i}\right\}_{i\in[n]}$ defined by the CPTP map describing the $i$-th round of Protocol 11.1, as implemented by the untrusted device $D$ are EAT channels according to Definition 9.2.2 and the identification made in Equation (11.2).

Proof.

To prove that the constructed channels $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$ are EAT channels we need to show that the three conditions stated in Definition 9.2.2 are fulfiled.

$\left\{O_{i}\right\}_{i\in[n]}=\left\{A_{i}B_{i}\right\}_{i\in[n]}$, $\left\{S_{i}\right\}_{i\in[n]}=\left\{X_{i}Y_{i}T_{i}\right\}_{i\in[n]}$, and $\left\{C_{i}\right\}_{i\in[n]}=\left\{W_{i}\right\}_{i\in[n]}$ are all finite-dimensional classical systems. $\left\{R_{i}\right\}_{i\in[n]}$ are arbitrary quantum systems. Finally, we have $d_{O}=d_{A_{i}}\cdot d_{B_{i}}=2\cdot 3=6$. 2. 2.

For any $i\in[n]$ and any input state $\sigma_{R_{i-1}}$, $W_{i}$ is a function of the classical values $A_{i}$, $B_{i}$, $X_{i}$, and $Y_{i}$. Hence, the marginal $\sigma_{O_{i}S_{i}}=\sigma_{A_{i}B_{i}X_{i}Y_{i}T_{i}}$ of the output state is unchanged when deriving $W_{i}$ from it. (In other words, we can “measure” $\sigma_{A_{i}B_{i}X_{i}Y_{i}T_{i}}$ to get the value of $W_{i}$ repeatedly without disturbing $\sigma_{A_{i}B_{i}X_{i}Y_{i}T_{i}}$). 3. 3.

For any initial state $\rho_{R_{0}E}^{\text{in}}$ and the resulting final state $\rho_{\mathbold{O}\mathbold{S}\mathbold{C}E}=\rho_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}\mathbold{T}\mathbold{W}E}$, the Markov-chain conditions

[TABLE]

trivially hold for all $i\in[n]$ since, according to Protocol 11.1, $X_{i}$, $Y_{i}$, and $T_{i}$ are chosen independently from everything else. ∎

When defining the EAT channels we identified $O_{i}$ with $A_{i}B_{i}$. Looking ahead, this means that we are about to derive a bound on $H_{\min}^{\varepsilon}(\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}\mathbold{T}E)$. For the analysis of DIQKD, however, a bound on $H_{\min}^{\varepsilon}(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}E)$ is needed. Why not set $O_{i}=A_{i}$ instead of $O_{i}=A_{i}B_{i}$? The reason is that the definition of an EAT channel requires that $C_{i}$ can be derived from $O_{i}S_{i}$ alone. Thus, choosing $O_{i}=A_{i}$, $S_{i}=X_{i}Y_{i}T_{i}$, and $C_{i}=W_{i}$ would render the above lemma wrong. The reader may then ask – why not choose $O_{i}=A_{i}$ and $S_{i}=B_{i}X_{i}Y_{i}T_{i}$? With this choice, however, the required Markov-chain conditions read

[TABLE]

and these do not hold for an arbitrary initial states since nothing restricts $B_{i}$ from being correlated to, e.g., $A_{i-1}$, when considering untrusted devices.777Consider for example a device in which the initial state $\rho_{Q_{A_{1}}Q_{B_{1}}Q_{A_{2}}Q_{B_{2}}}=\ket{\Phi}\bra{\Phi}_{Q_{A_{1}}Q_{B_{2}}}\otimes\ket{\Phi}\bra{\Phi}_{Q_{A_{2}}Q_{B_{1}}}$, i.e., the systems over $Q_{A_{1}}$ and $Q_{B_{2}}$ are entangled. Thus, $A_{1}$ and $B_{2}$ may be correlated even given $B_{1}X_{1}Y_{1}T_{1}$. In this case the Markov-chain conditions do not hold since the side-information $B_{2}$ reveals information regarding the past output $A_{1}$. Hence, the lemma would not hold for this choice as well. We therefore stick with the choices made in Equation (11.2) and relate $H_{\min}^{\varepsilon}(\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}\mathbold{T}E)$ to $H_{\min}^{\varepsilon}(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}E)$ in Section 11.3.2.

Now that our EAT channels are defined, the next step is to construct a min-tradeoff function for them. This is done in the next section.

11.2.2 Min-tradeoff function

When working with the EAT the most important task is to devise a good tradeoff function, as defined in Definition 9.2.2. As mentioned in Section 9.2.3, this is where the “physics kicks in”. We are aiming for a lower-bound on the smooth min-entropy and hence in need of a min-tradeoff function $f_{\min}$. That is, we need to construct a convex differential function for which, for all $i\in[n]$,

[TABLE]

where $p$ is a probability distribution over $\mathcal{W}=\{\perp,0,1\}$ and $\left\{\mathcal{M}_{i}\right\}_{i\in[n]}$ are the EAT channels defined in the previous section.

To understand the task at hand, let us first focus on the set of states

[TABLE]

on which the infimum is evaluated. First observe that, due to the structure of our channels, the distributions over $X_{i}$, $Y_{i}$, and $T_{i}$ are fixed for any $\sigma\in\Sigma(p)$. That is, even though we take an infimum over many possible input states for the channels, and even though the actions of the untrusted device are not characterised, the values of $X_{i}$, $Y_{i}$, and $T_{i}$ are always chosen according to Protocol 11.1.888A different model for the sequential process could have been one in which the initial quantum state itself includes the registers $\mathbold{X}$ and $\mathbold{Y}$ and the channel is defined such that a measurement is performed on those registers to get the inputs (and then use the device in the protocol). When starting with maximally mixed states over $\mathbold{X}\mathbold{Y}$ the entire sequential process is exactly the same as the one described by our EAT channels. However, when coming to construct a min-tradeoff function with this (somewhat strange) alternative choice of channels, we see that the set $\Sigma(p)$ can include states in which, e.g., $X_{i}=0$ with probability 1 (since we need to consider all possible input states). In the context of Bell inequalities, this is similar to dropping the “free choice assumption”. Clearly, if this had been the case, the only min-tradeoff function one could construct is the constant function $f_{\min}(p)=0$ for all $p$, which is trivial and useless. This implies, in particular, that for probability distributions $p$ with $p(\perp)\neq 1-\gamma$ the set $\Sigma(p)$ is empty.

Given the above, for any $p$ over $\{\perp,0,1\}$, the set $\Sigma(p)$ includes only states $\sigma$ for which

[TABLE]

where we identify $\omega$ with the winning probability of the state $\sigma$ in the CHSH game (when using the measurements defining the channel $\mathcal{M}_{i}$). For this reason, we can, slightly informally,999Formally, we will need to extend the function to all probability distributions $p$ (even those with $p(\perp)\neq 1-\gamma$). We can extended the function in any way we wish, while keeping it convex and differentiable. see the function $f_{\min}$ as defined over a single variable $\omega\in[0,1]$.

In total, we can understand the set $\Sigma(p)=\Sigma(p(\omega))$ as the set including all states $\sigma$ that can be used to win the CHSH game with probability $\omega$. It is this information about the relevant input states $\sigma$ that allows us to construct a min-tradeoff function fulfilling Equation (11.3). In fact, given the above observation, the main ingredient needed to construct a valid (and tight) min-tradeoff function is Lemma 5.2, which was discussed in the context of single-round boxes (Chapter 5). This clarifies why the presented proof technique can be seen as a reduction to IID.

We are ready to embark on the construction of the min-tradeoff function.

Lemma \thelem.

Let101010We define the functions $g$ and $f_{min}$ only in the regime in which the protocol does not abort, i.e., $p(1)/\gamma\geq 3/4$.

[TABLE]

and

[TABLE]

Then, for any probability distribution $p_{\mathrm{cut}}$ over $\{\perp,0,1\}$, $f_{\min}\left(p,p_{\mathrm{cut}}\right)$ is a min-tradeoff functions for the EAT channels from Lemma 11.2.1.

Before proving the lemma, let us parse the above lengthy equations. The function $g$ is basically the single-round bound presented in Lemma 5.2, where we replace $\omega$ with$\leavevmode\nobreak\ \frac{p(1)}{\gamma}$ and trivially extend the function to the regime of winning probabilities above the optimal quantum winning probability $\frac{2+\sqrt{2}}{4}$. Notice that for an arbitrary $p$, the correct relation between $p$ and $\omega$ is given by $\omega=\frac{p(1)}{p(0)+p(1)}$. However, as explained above, due to the definition of the channels $\mathcal{M}_{i}$, the set $\Sigma(p)$ is empty for $p$ with $p(0)+p(1)\neq\gamma$. This implies that there are no constraints on the value of the min-tradeoff function for such $p$’s and we are free to define it as we wish in this regime. Thus, we are not going to run into problems even though the value of the function $g$ does not seem to have any “physical meaning” for $p$ with $p(0)+p(1)\neq\gamma$.111111Alternatively, one could replace $p(1)/\gamma$ with $p(1)/(p(0)+p(1))$, which is more meaningful, in the definition of the function $g$. However, since the $\mathrm{d}f_{\min}/\mathrm{d}p(1)$ will affect the final smooth min-entropy bound, using $p(1)/\gamma$ leads to better quantitive results.

The function $f_{\min}$ in Equation (11.10) is governed by $g$ and can be understood as follows. Fix a probability distribution $p_{\mathrm{cut}}\in[0,1]$. For $p$ with $p(1)\leq p_{\mathrm{cut}}(1)$, $f_{\min}$ is identical to $g$. Otherwise, $f_{\min}$ is a linear function (when restricting ourselves to a slice $p(0)+p(1)=\text{constant}$) defined via the value and the tangent of $g$ at the point $p_{\mathrm{cut}}(1)$. That is, we “cut and glue” the function at point $p_{\mathrm{cut}}$. By doing so, we make sure that $f_{\min}$ is a convex and differentiable function, as required by Definition 9.2.2 while restraining its gradient, which will later affect the bound on the smooth min-entropy (via Equation (9.14)). This construction of $f_{\min}$ is illustrated in Figure 11.1.

Proof of Lemma 11.2.2..

We start by using the chain rule of the von Neumann entropy,

[TABLE]

Due to the bipartite requirement on the untrusted device $D$ used to implement the protocol, the actions of Alice’s device are independent of Bob’s choice of $Y_{i}$ as well as of and $T_{i}$.121212We assume that the value of $T_{i}$ is exchanged over a classical authenticated channel to which the device $D$ does not have access. In particular, Alice’s part of the device is independent from the value of $T_{i}$ given $X_{i}$. We thus have

[TABLE]

Combined with Lemma 5.2 we get that for any state $\sigma$ with winning probability $\omega$ in the CHSH game,

[TABLE]

For probability distributions $p$ with $p(0)+p(1)\neq\gamma$, the set of states fulfilling $\mathcal{M}_{i}(\sigma)_{W_{i}}=p$ is empty and the condition on the min-tradeoff function given in Equation 11.3 becomes trivial. Hence, for the construction of the min-tradeoff function we can restrict our attention to $p$ with $p(0)+p(1)=\gamma$. For such $p$’s one can write $\omega=\frac{p(1)}{p(0)+p(1)}=\frac{p(1)}{\gamma}$. All together we learn that for all $p$ with $\frac{p(1)}{\gamma}\geq\frac{3}{4}$,

[TABLE]

Define a function $g$ by

[TABLE]

From Equation (11.7) it follows that any choice of $f_{\min}$ that is differentiable and satisfies $f_{\min}(p)\leq g(p)$ for all $p$ will satisfy Equation (11.3).

For $\frac{p(1)}{\gamma}=\frac{2+\sqrt{2}}{4}$ the derivative of $g$ is infinite. Looking ahead, for the final bound on the smooth min-entropy derived using the EAT to be meaningful, $f_{\min}$ should be chosen such that $\|\triangledown f_{\min}\|_{\infty}$ is finite. To assure that this is the case we choose $f_{\min}$ by “cutting” the function $g$ and “gluing” it to a linear function at some point $p_{\mathrm{cut}}$, while keeping the function differentiable. By doing this we ensure that the gradient of $f_{\min}$ is bounded, at the cost of losing a bit of entropy for $p$ with $p(1)>p_{\mathrm{cut}}(1)$.131313The point $p_{\mathrm{cut}}$ can later be chosen such that the derived smooth entropy bounds are optimised. Towards this, denote

[TABLE]

We then make the following choice for the min-tradeoff function $f_{\min}$ (see Figure 11.1):

[TABLE]

From the definition of $a$ and $b$ in Equation (11.9), this function is convex, differentiable, and fulfils the condition given in Equation (11.3). $f_{\min}$ can therefore be rightfully called a min-tradeoff function. Furthermore, by definition, for any choice of $p_{\mathrm{cut}}$ it holds that $\|\triangledown f_{\min}(\cdot,p_{\mathrm{cut}})\|_{\infty}\leq a(p_{\mathrm{cut}})$. ∎

11.2.3 Smooth min-entropy rate

After constructing the EAT channels and min-tradeoff function in the previous sections, we are ready to apply Theorem 9.1 to derive our lower-bound on the conditional smooth min-entropy generated by the entropy accumulation protocol, Protocol 11.1.

We use the following notation. The event of not aborting the protocol is given by

[TABLE]

For any initial state $\rho_{Q_{A}Q_{B}E}^{\text{in}}$, the final state in the end of the protocol is denoted by $\rho=\rho_{\mathbf{ABXYTW}E}$ and the final state conditioned on not aborting the entropy accumulation protocol is $\rho_{|\Omega}$.

As shown in Theorem 11.3 below, The smooth min-entropy rate is governed by the following functions, where $h$ is the binary entropy and $\gamma,p(1)\in(0,1]$:

[TABLE]

Theorem 11.3**.**

Let $D$ be any device, $\rho$ the state generated by running Protocol 11.1, $\Omega$ the event that the protocol does not abort (as defined in Equation (11.11)), and $\rho_{|\Omega}$ the state conditioned on $\Omega$. Then, for any $\varepsilon_{\mathrm{EA}},\varepsilon_{\mathrm{s}}\in(0,1)$, either the protocol aborts with probability greater than $1-\varepsilon_{\mathrm{EA}}$ or

[TABLE]

where $\mu_{\mathrm{opt}}$ is defined in Equation (11.12).

Proof.

We wish to apply the EAT, stated as Theorem 9.1. To this end, denote by $\mathrm{freq}_{\mathbold{w}}(\tilde{w})=\frac{|\left\{i|w_{i}=\tilde{w}\right\}|}{n}$ the frequency defined by the raw data $\mathbold{w}$ (recall Equation (9.11)) and observe the following:

The EAT channels $\{\mathcal{M}_{i}\}_{i\in[n]}$ constructed in Section 11.2.1 faithfully describe the protocol and the device $D$, in the sense that the final state of the protocol, $\rho$, can be written as

[TABLE] 2. 2.

The set $\hat{\Omega}=\{p:p(1)\geq\omega_{\mathrm{exp}}\gamma-\delta_{\mathrm{est}}\}$ is convex and $\{\mathrm{freq}_{\mathbold{w}}:\mathbold{w}\in\Omega\}\subseteq\hat{\Omega}$ (recall Section 9.2.3). 3. 3.

According to Lemma 11.2.2, $f_{\min}\left(p,p_{\mathrm{cut}}\right)$ is a min-tradeoff function for the considered EAT channels, for any $p_{\mathrm{cut}}$ with $\frac{3}{4}<\frac{p_{\mathrm{cut}}(1)}{\gamma}<\frac{2+\sqrt{2}}{4}$. 4. 4.

For any $p_{\mathrm{cut}}$ with $\frac{3}{4}<\frac{p_{\mathrm{cut}}(1)}{\gamma}<\frac{2+\sqrt{2}}{4}$, the value $t=f_{\min}\left(\omega_{\mathrm{exp}}\gamma-\delta_{\mathrm{est}},p_{\mathrm{cut}}\right)$ satisfies $f_{\min}\left(\mathrm{freq}_{\mathbold{w}},p_{\mathrm{cut}}\right)\geq t$ for any $\mathrm{freq}_{\mathbold{w}}\in\hat{\Omega}$. 5. 5.

$d_{O}=d_{A_{i}B_{i}}=6$ and $\|\triangledown f_{\min}(\cdot,p_{\mathrm{cut}})\|_{\infty}=a(p_{\mathrm{cut}})$ for any $p_{\mathrm{cut}}$ with $\frac{3}{4}<\frac{p_{\mathrm{cut}}(1)}{\gamma}<\frac{2+\sqrt{2}}{4}$.

Using the EAT (Theorem 9.1) in combination with the above observations we conclude that for any $p_{\mathrm{cut}}$ with $\frac{3}{4}<\frac{p_{\mathrm{cut}}(1)}{\gamma}<\frac{2+\sqrt{2}}{4}$, either the protocol aborts with probability greater than $1-\varepsilon_{\mathrm{EA}}$, or

[TABLE]

for $\zeta(p_{\mathrm{cut}},\varepsilon_{\mathrm{s}},\varepsilon_{\mathrm{EA}})=2\left(\log 13+a(p_{\mathrm{cut}})\right)\sqrt{1-2\log(\varepsilon_{\mathrm{s}}\cdot\varepsilon_{\mathrm{EA}})}$. To obtain the optimal rate we maximise $H^{\varepsilon_{\mathrm{s}}}_{\min}\left(\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}\mathbold{T}E\right)_{\rho_{|\Omega}}$ over $p_{\mathrm{cut}}$. Denote $\mu(p,p_{\mathrm{cut}},\varepsilon_{\mathrm{s}},\varepsilon_{\mathrm{EA}})=f_{\min}\left(p,p_{\mathrm{cut}}\right)-\frac{1}{\sqrt{n}}\zeta(p_{\mathrm{cut}},\varepsilon_{\mathrm{s}},\varepsilon_{\mathrm{EA}})$ and let

[TABLE]

Plugging this into Equation (11.15) the theorem follows. ∎

Importantly, the theorem tells us that the first order term of the smooth min-entropy is linear in $n$. Moreover, asymptotically, the entropy rate is simply given by the min-tradeoff function $f_{\min}\left(p,p_{\mathrm{cut}}\right)$. This is why it was crucial to construct an optimal min-tradeoff function in Section 11.2.2.

The rate $\mu_{\mathrm{opt}}$ is plotted in Figure 11.2 as a function of the expected winning probability $\omega_{\mathrm{exp}}$ in the CHSH game for $\gamma=1$ and several choices of values for the parameters $\varepsilon_{\mathrm{EA}}$, $\delta_{\mathrm{est}}$, and $n$ (while optimising over all other parameters). For comparison, we also plot in Figure 11.2 the asymptotic rate ($n\rightarrow\infty$) under the IID assumption. In this case, the quantum asymptotic equipartition property implies that the optimal rate is the Shannon entropy accumulated in one round of the protocol (recall Section 7.2.2). This rate, appearing as the dashed line in Figure 11.2, is an upper bound on the smooth min-entropy that can be accumulated. One can see that as the number of rounds in the protocol increases the rate $\mu_{\mathrm{opt}}$ approaches this optimal rate.

11.3 Device-independent quantum key distribution

Our DIQKD protocol is stated as Protocol 11.2. In the first part of the protocol Alice and Bob use their devices to produce the raw data, similarly to what is done in the entropy accumulation protocol, Protocol 11.1, analysed in the previous section. In the second part of the protocol Alice and Bob apply classical post-processing steps to produce their final keys from the raw data. The classical post-processing consists of error correction, parameter estimation, and privacy amplification; all discussed in detail in Section 4.2.2.

Apart from the classical post-processing, the main difference between the entropy accumulation protocol and the DIQKD protocol is the way we set Bob’s outputs. In Protocol 11.1, Bob’s outputs are being set to $\perp$ in all rounds for which $T_{i}=0$, i.e., in the generation rounds. In contrast, when dealing with QKD Bob needs to keep the outputs produced in the generation rounds so that he could create a key identical to Alice’s key. To make the distinction explicit we denote Bob’s outputs in Protocol 11.2 with a tilde, $\tilde{\mathbold{B}}$. We will get back to this point later and explain why the distinction is relevant for our analysis.

Our main goal in the following sections is to prove the security (according to Definition 4.2.1) of Protocol 11.2:

Theorem 11.4**.**

For any choice of parameters, the DIQKD protocol given in Protocol 11.2 is $(\varepsilon_{\mathrm{QKD}}^{s},\varepsilon_{\mathrm{QKD}}^{c},)$-secure according to Definition 4.2.1, with $\varepsilon^{s}_{\mathrm{QKD}}\leq 2\varepsilon_{\mathrm{EC}}+\varepsilon_{\mathrm{PA}}+\varepsilon_{\mathrm{s}}+\varepsilon_{\mathrm{EA}}$, $\varepsilon^{c}_{\mathrm{QKD}}\leq\varepsilon^{c}_{EC}+\varepsilon_{\mathrm{EA}}^{c}+\varepsilon_{\mathrm{EC}}$, and for key length

[TABLE]

where $\mu_{\mathrm{opt}}$ is specified in Equation (11.12).

The resulting key rates, $\ell/n$, are discussed and plotted in Section 11.3.3 for different choices of parameters.

In the following sections we are set to prove Theorem 11.4. The theorem follows from the completeness of the protocol, stated as Lemmas 11.3.1, and its soundness, stated as Lemma 11.3.2.

11.3.1 Completeness

We seek to prove that Protocol 11.2 is complete, i.e., that there exists an honest implementation of the device $D$ that leads to a negligible probability of the protocol aborting. We remark that in order for the protocol to be relevant in practice, completeness has to be proven with respect to a realistic honest implementation that can be realised in experiments (or, at the least, believed to be feasible in the future). The honest implementation that we consider is the standard one and is described in Section 4.2.4. In short, the honest device makes IID measurements on an IID quantum state $\rho=\sigma^{\otimes n}$. The state and measurements are such that the winning probability achieved in the CHSH game in a single round is $\omega_{\mathrm{exp}}$ that can be chosen freely.141414 For any $\omega_{\mathrm{exp}}$ there are many devices that fit this description; an explicit example can be found in Section 4.2.4.

The following lemma gives the relation between the probability $\varepsilon^{c}_{\mathrm{QKD}}$ that the protocol aborts for an honest implementation of the device $D$ and the other parameters of the protocol.

Lemma \thelem.

Protocol 11.2 is complete with completeness error

[TABLE]

where $\varepsilon^{c}_{EA}\leq\exp(-2n\delta_{\mathrm{est}}^{2})$ and $\varepsilon^{c}_{EC}$ and $\varepsilon_{\mathrm{EC}}$ are two independent parameters of the error correction protocol.

Proof.

We wish to upper-bound the probability that Protocol 11.2 aborts when running using the honest implementation. There are two steps in which Alice and Bob can abort Protocol 11.2:

The protocol may abort after the error correction step (Step 15). This happens with probability $\varepsilon^{c}_{EC}$. 2. 2.

Assuming the protocol did not abort in Step 15, it may abort after the parameter estimation step (Step 16). Recall that Bob performs parameter estimation using $K_{B}$ and $\tilde{\mathbold{B}}$, i.e., he checks whether sufficiently many games were won when looking at his data $K_{B}$ and $\tilde{\mathbold{B}}$. There are two scenarios which lead to the protocol aborting after parameter estimation:

1. (a)

Error correction was successful, i.e., $K_{B}=K_{A}$, but not sufficiently many games were won when comparing $K_{A}$ and $\tilde{\mathbold{B}}$. When utilising the honest implementation, $W_{i}$ are IID RVs with $\mathbb{E}\left[W_{i}\right]=\omega_{\mathrm{exp}}\gamma$. Therefore, we can use Hoeffding’s inequality to bound the probability of such an event:

[TABLE] 2. (b)

Error correction was not successful, i.e., $K_{B}\neq K_{A}$ (but $\mathrm{EC}$ did not abort) and not sufficiently many games were won when comparing at $K_{B}$ and $\tilde{\mathbold{B}}$. This happens with probability at most $\varepsilon_{EC}$.

The lemma follows by using the above in combination with the union bound. ∎

11.3.2 Soundness

To establish soundness first note that, by definition, as long as Protocol 11.2 does not abort it produces a key of length $\ell$. Therefore it remains to verify correctness (Definition 4.2.1), which depends on the error correction step, and security (Definition 4.2.1), which is based on the privacy amplification step.

To prove security we start by assuming that the error correction step is successful and lower-bound the smooth min-entropy of the quantum state shared between Alice and Bob right before the privacy amplification step. The main ingredient in the proof is the lower-bound on the smooth min-entropy established in Theorem 11.3. Most effort in proving security is devoted to relating the state considered in the entropy accumulation protocol (to which Theorem 11.3 refers) and the state in the end of the DIQKD protocol.

To be more precise, let $\overset{\approx}{\Omega}$ denote the event of Protocol 11.2 not aborting and the $\mathrm{EC}$ protocol being successful, and let $\tilde{\rho}_{\mathbold{A}\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T}OE|\overset{\approx}{\Omega}}$ be the state at the end of the protocol,151515$O$ denotes the classical information sent from Alice to Bob during error correction; see Section 4.2.2. conditioned on this event. Success of the privacy amplification step relies on the smooth min-entropy $H^{\varepsilon_{\mathrm{s}}}_{\min}(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}OE)_{\tilde{\rho}_{|\overset{\approx}{\Omega}}}$ being sufficiently large. Lemma 11.3.2 connects this quantity to $H^{\frac{\varepsilon_{\mathrm{s}}}{4}}_{\min}(\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}\mathbold{T}E)_{\rho_{|\Omega}}$, on which a lower bound is provided by Theorem 11.3.

Lemma \thelem.

For any device $D$, let $\tilde{\rho}$ be the state generated in Protocol 11.2 right before the privacy amplification step, Step 17. Let $\tilde{\rho}_{|\overset{\approx}{\Omega}}$ be the state conditioned on not aborting the protocol and success of the $\mathrm{EC}$ protocol. Then, for any $\varepsilon_{\mathrm{EA}},\varepsilon_{\mathrm{EC}},\varepsilon_{\mathrm{s}}\in(0,1)$, either the protocol aborts with probability greater than $1-\varepsilon_{\mathrm{EA}}-\varepsilon_{\mathrm{EC}}$ or

[TABLE]

Proof.

Consider the following events:

$\Omega$: the event of not aborting in the entropy accumulation protocol, Protocol 11.1. This happens when the Bell violation, calculated using Alice and Bob’s outputs and inputs, is sufficiently high. 2. 2.

$\widetilde{\Omega}$: Suppose Alice and Bob run Protocol 11.1, and then execute the $\mathrm{EC}$ protocol. The event $\widetilde{\Omega}$ is defined by $\Omega$ and $K_{B}=\mathbf{A}$. 3. 3.

$\overset{\approx}{\Omega}$: the event of not aborting the DIQKD protocol, Protocol 11.2, and $K_{B}=\mathbf{A}$.

The state $\rho_{|\widetilde{\Omega}}$ then denotes the state at the end of Protocol 11.1 conditioned on $\widetilde{\Omega}$.

As we are only interested in the case where the $\mathrm{EC}$ protocol outputs the correct guess of Alice’s bits, that is $K_{B}=\mathbf{A}$ (which happens with probability $1-\varepsilon_{\mathrm{EC}}$), we have $\tilde{\rho}_{\mathbold{A}\mathbold{X}\mathbold{Y}\mathbold{T}E|\overset{\approx}{\Omega}}=\rho_{\mathbold{A}\mathbold{X}\mathbold{Y}\mathbold{T}E|\widetilde{\Omega}}$ (note that $\tilde{\mathbold{B}}$ and $\mathbold{B}$ were traced out from $\tilde{\rho}$ and $\rho$ respectively). Hence,

[TABLE]

Using the chain rule given in [Tomamichel, 2015, Lemma 6.8] together with Equation (11.19) we get that

[TABLE]

where $\mathrm{leak_{EC}}$ denotes the amount of information leaked during error correction.

To apply Theorem 11.3 it remains to relate $H^{\varepsilon_{\mathrm{s}}}_{\min}\left(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}E\right)_{\rho_{|\widetilde{\Omega}}}$ to $H^{\varepsilon^{\prime}_{\mathrm{s}}}_{\min}\left(\mathbold{AB}|\mathbold{X}\mathbold{Y}\mathbold{T}E\right)_{\rho_{|\widetilde{\Omega}}}$ for some $\varepsilon^{\prime}_{\mathrm{s}}$. For this we first write

[TABLE]

where the first inequality is due to the chain rule [Tomamichel, 2015, Equation (6.57)] and the second is due to strong sub-additivity of the smooth max-entropy.

One can now apply the EAT to upper bound $H^{\frac{\varepsilon_{\mathrm{s}}}{4}}_{\max}\left(\mathbold{B}|\mathbold{T}E\right)_{\rho_{|\widetilde{\Omega}}}$ in the following way. We use Theorem 9.1 with the replacements $\mathbold{O}\rightarrow\mathbold{B},\;\mathbold{S}\rightarrow\mathbold{T},\;E\rightarrow E$. The Markov conditions $B_{1,\dotsc,i-1}\leftrightarrow T_{1,\dotsc,i-1}E\leftrightarrow T_{i}$ then trivially hold and the condition on the max-tradeoff function reads

[TABLE]

By the definition of the EAT channels $\{\mathcal{M}_{i}\}_{i\in[n]}$, $B_{i}\neq\perp$ only for $T_{i}=1$, which happens with probability $\gamma$.161616This is why we made the distinction between $B_{i}$ in the entropy accumulation protocol and $\tilde{B}_{i}$ in the DIQKD protocol. Hence, for any state $\sigma_{R_{i-1}R^{\prime}}$ we have,

[TABLE]

and the max-tradeoff function is simply $f_{\max}(p)=\gamma$ for any $p$ (and thus $\|\triangledown f_{\max}\|_{\infty}=0$). Applying171717Here a slightly more general version of the EAT than the one given in Section 9.2.3 is needed, in which the event $\Omega$ can be defined via $A,B,X,Y$ and not only $C$; see [Dupuis et al., 2016] for the details. Theorem 9.1 with this choice of $f_{\max}$ we get

[TABLE]

Combing the equations above we get that

[TABLE]

Finally, note that by applying the EAT on $\rho_{|\widetilde{\Omega}}$, as in Theorem 11.3, we have that either $1-\Pr(\widetilde{\Omega})\geq 1-\varepsilon_{\mathrm{EA}}-\varepsilon_{\mathrm{EC}}$, or

[TABLE]

The last two equations together give us the desired bound on $H^{\varepsilon_{\mathrm{s}}}_{\min}\left(\mathbold{A}|\mathbold{X}\mathbold{Y}\mathbold{T}OE\right)_{\tilde{\rho}_{|\overset{\approx}{\Omega}}}$: either the protocol aborts with probability greater than $1-\varepsilon_{\mathrm{EA}}-\varepsilon_{\mathrm{EC}}$ or

[TABLE]

Using Lemma 11.3.2, we prove that Protocol 11.2 is sound.

Lemma \thelem.

For any device $D$ let $\tilde{\rho}$ be the state generated using Protocol 11.2. Then either the protocol aborts with probability greater than $1-\varepsilon_{EA}-\varepsilon_{EC}$ or it is $(\varepsilon_{\mathrm{EC}}+\varepsilon_{\mathrm{PA}}+\varepsilon_{\mathrm{s}})$-correct-and-secret while producing keys of length $\ell$, as defined in Equation (11.16).

Proof.

Denote all the classical public communication during the protocol by $J=\mathbold{X}\mathbold{Y}\mathbold{T}OS$ where $S$ is the seed used in the privacy amplification protocol $\mathrm{PA}$. Denote the final state of Alice, Bob, and Eve at the end of Protocol 11.2, conditioned on not aborting, by $\tilde{\rho}_{\tilde{K}_{A}\tilde{K}_{B}JE|\dot{\Omega}}$.

We consider two cases. First assume that the $\mathrm{EC}$ protocol was not successful (but did not abort). Then Alice and Bob’s final keys might not be identical. This happens with probability at most $\varepsilon_{\mathrm{EC}}$.

Otherwise, assume the $\mathrm{EC}$ protocol was successful, i.e., $K_{B}=\mathbold{A}$. In that case, Alice and Bob’s keys must be identical also after the final privacy amplification step. That is, conditioned on $K_{B}=\mathbold{A}$, $\tilde{K}_{A}=\tilde{K}_{B}$.

We continue to show that in this case the key is also secret. The secrecy depends only on the privacy amplification step, and for universal hashing a secure key is produced as long as

[TABLE]

holds (recall Section 4.2.2). Hence, a uniform and independent key of length $\ell$ as in Equation (11.16) is produced by the privacy amplification step unless the smooth min-entropy is not high enough (i.e., the bound in Equation (11.18) does not hold) or the privacy amplification protocol was not successful, which happens with probability at most $\varepsilon_{\mathrm{PA}}+\varepsilon_{\mathrm{s}}$.

According to Lemma 11.3.2, either the protocol aborts with probability greater than $1-\varepsilon_{\mathrm{EA}}-\varepsilon_{\mathrm{EC}}$, or the entropy is sufficiently high for us to have (recall Definition 4.2.2)

[TABLE]

Combining both cases above the lemma follows. ∎

11.3.3 Key rate analysis

Theorem 11.4 establishes a relation between the length $\ell$ of the secure key produced by our protocol and the different error terms. As this relation, given in Equation (11.16), is somewhat hard to visualise, we analyse the key rate $r=\ell/n$ for some specific choices of parameters and compare it to the key rates achieved in device-dependent QKD with finite resources [Scarani and Renner, 2008a, Scarani and Renner, 2008b] and DIQKD with infinite resources and a restricted set of attacks [Pironio et al., 2009].

The key rate depends on the amount of leakage of information due to the error correction step, which in turn depends on the honest implementation of the protocol (recall Section 4.2.2). We use the honest IID implementation described in Section 4.2.4 and choose the honest state of each round to be the two-qubit Werner state $\rho_{Q_{A}Q_{B}}=(1-\nu)\ket{\phi^{+}}\bra{\phi^{+}}+\nu\mathbb{I}/4$ (and the measurements are as described in Section 4.2.4). The quantum bit error rate is then $Q=\frac{\nu}{2}$ and the expected winning probability is $\omega_{\mathrm{exp}}=\frac{2+\sqrt{2}(1-2Q)}{4}$.

We emphasise that this is only a choice of the honest implementation and it does not in any way restrict the actions of the adversary (and, in particular, the types of imperfections in the device). Furthermore, the analysis done below can be adapted to any other honest implementation of interest.

Leakage due to error correction

To calculate the rates we first need to explicitly upper bound the leakage of information due to the error correction protocol, $\mathrm{leak_{EC}}\;$. As shown in Equation (4.2), this can be done by evaluating $H_{0}^{\varepsilon^{\prime}_{\mathrm{EC}}}(\mathbold{A}|\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T})$ on Alice and Bob’s state in an honest IID implementation of the protocol, described in Section 4.2.4.

For this we first use the following relation between $H_{0}^{\varepsilon}$ and $H_{\max}^{\varepsilon^{\prime}}$ [Tomamichel et al., 2011, Lemma 18]:

[TABLE]

The quantum asymptotic equipartition property, given as Theorem 7.2, tells us that

[TABLE]

for $\tau=2\sqrt{2^{H_{\max}(A_{i}|\tilde{B}_{i}X_{i}Y_{i}T_{i})}}+1$ and $\delta(\varepsilon^{\prime}_{\mathrm{EC}},\tau)=4\log\tau\sqrt{2\log\left(8/{\varepsilon^{\prime}}^{2}_{\mathrm{EC}}\right)}$.

For the honest implementation of Protocol 11.2 $H_{\max}(A_{i}|\tilde{B}_{i}X_{i}Y_{i}T_{i})=1$ and

[TABLE]

where the first equality follows from the definition of conditional entropy and the second from the way $T_{i}$ is chosen in Protocol 11.2. The last equality holds since for the generation rounds the error rate (i.e., the probability that $A_{i}$ and $\tilde{B}_{i}$ differ) in the honest case is $Q$ and for the test rounds Bob can guess $A_{i}$ with probability $\omega_{\mathrm{exp}}$ given $\tilde{B}_{i}$, $X_{i}$, and $Y_{i}$.

We thus have

[TABLE]

Plugging this into Equation (4.2) we get

[TABLE]

Key rate curves

In Appendix C.2 a slightly modified protocol is considered in which, instead of fixing the number of rounds in the protocol, only the expected number of rounds is fixed. The completeness and soundness proofs follow the same lines as the proofs above, as detailed in Appendix C.2 and do not include additional crucial insights. The modification of the protocol improves the dependency of the key rate on the probability of a test round $\gamma$181818The second order term of the smooth min-entropy rate given in Lemma 11.3.2 scales with $\gamma$, roughly, as $1/\gamma$, while in Appendix C.2 the dependency is roughly $1/\sqrt{\gamma}$. The modified analysis can be seen as a “patch” used to overcome the non-optimal dependency of the EAT given in Theorem 9.1 on the testing probability in the considered protocols. This issue was overcome in a more recent version of the EAT [Dupuis and Fawzi, 2018]. The analysis presented in the appendix leads to the key rates for the modified protocol and these are the rates presented here. Putting the technical details aside, the reader may simply think of $\bar{n}$ below as taking the place of the number of rounds $n$ used so far.

In an asymptotic analysis ($\bar{n}\rightarrow\infty$) it is well understood that the soundness and completeness errors $\varepsilon_{\mathrm{QKD}}^{s},\varepsilon_{\mathrm{QKD}}^{c}$ should tend to zero as $\bar{n}$ increases. However, in the non-asymptotic scenario considered here these errors are always finite. We therefore fix some values for them which are considered to be realistic and relevant for actual applications. We choose the parameters such that the security parameters are at least as good (and in general even better) as in [Scarani and Renner, 2008a], such that a fair comparison can be made. All other parameters are chosen in a consistent way while (roughly) optimising the key rate.

In Figure 11.3 the expected key rate $r=\ell/\bar{n}$ is plotted as a function of the quantum bit error rate $Q$ for several values of the expected number of rounds $\bar{n}$. For $\bar{n}=10^{15}$ the curve essentially coincides with the rate achieved in the asymptotic IID case [Pironio et al., 2009]. Since the latter was shown to be optimal [Pironio et al., 2009] it provides an upper bound on the key rate and the amount of tolerable noise. Hence, for large enough $\bar{n}$ our rates become optimal and the protocol can tolerate up to the maximal error rate $Q=7.1\%$. For comparison, the previously established explicit rates [Vazirani and Vidick, 2014] are well below the lowest curve presented in Figure 11.3, even when the number of signals goes to infinity, with a maximal noise tolerance of 1.6%.

In Figure 11.4, $r$ is plotted as a function of $\bar{n}$ for several values of $Q$. As can be seen from the figure, the achieved rates are significantly higher than those achieved in previous works. Moreover, they are practically comparable to the key rates achieved in device-dependent QKD (see Figure 1 in [Scarani and Renner, 2008a]). The main difference between the curves for the device-dependent case and the independent one is the minimal value of $\bar{n}$ which is required for a positive key rate. (That is, for the protocols considered in [Scarani and Renner, 2008a] one can get a positive key rate with less rounds.)

11.4 Open questions

To end the chapter, we list some future work directions and open questions specific for the showcase of quantum cryptography.

Experimental realistions

The results presented in this chapter provide the theoretical groundwork for experimental implementations of device-independent cryptographic protocols. The quantitive results imply that the first proof of principle experiments, with small distances and small rates, are within reach with today’s state-of-the-art technology, which recently enabled the violation of Bell inequalities in a loophole-free way [Hensen et al., 2015, Shalm et al., 2015, Giustina et al., 2015] (a necessity for device-independent cryptography). Indeed, Theorem 11.3 has already been applied to the analysis of the first experimental implementation of a protocol for randomness generation in the fully device-independent framework [Liu et al., 2017]. The next major challenge in experimental implementations is a field demonstration of a DIQKD protocol. This would provide the strongest cryptographic experiment ever realised.

As can be seen from Figures 11.2, 11.3, and 11.4, implementing a DIQKD protocol is more challenging than implementing a randomness generation protocol — positive key rates require higher number of signals and lower noise levels. It therefore becomes increasingly relevant to achieve the best possible dependence of the rate curves on the number of rounds $\bar{n}$, even for very small values of $\bar{n}$. As can be seen from the figures our rate curves approach (and essentially coincide) with the optimal curves as the number of rounds increases. This is the case since our first-order term of the key rate is tight.

However, one thing that can perhaps still be further optimised is the dependency on the number of rounds, or in other words, how fast the curves approach the optimal curve. Although this seems like a minor issue, it can make actual implementations more feasible. The explicit dependency on $\bar{n}$ given in Equation (11.16) is already close to optimal. Still:

The numerical analysis used to plot the curves can be made somewhat better for the range of $\bar{n}=10^{4}-10^{6}$. 2. 2.

Throughout the proof we made certain non-optimal choices that almost surely effect the second order term. For example, the use of the chain rules for the smooth entropies can be done in a tighter way (compare the general form of the chain rules [Tomamichel, 2015, Equation (6.57)] to the way it was applied here). A tighter analysis of similar steps was used in [Tomamichel and Leverrier, 2017] for the case of device-dependent QKD protocols and may be of use here as well.

Possible extensions

The optimality of our key rates is only with respect to the structure of the considered protocol, which is the standard (and only, as far as we are aware) DIQKD protocol studied in the literature. It is interesting to come up with new DIQKD protocols and see if they lead to key rates with higher first-order terms. Apart from the theoretical curiosity, protocols with better asymptotic key rates can, of course, help us reach an experimental implementation.

Due to the modularity of our analysis, it can at large be directly applied to the analysis of other protocols. The main challenge is to come up with interesting protocols. We discuss two possible directions to consider.

On the “quantum side” of the protocol, one may modify the protocol by considering different Bell inequalities. Even more, one can construct protocols in which more information than the violation of a single inequality is used: Alice and Bob may use the collected statistics to evaluate several quantities and decide accordingly whether to abort or not; see for example the related work [Nieto-Silleras et al., 2018]. To apply our proof to other Bell inequalities and additional statistical information one should find a good bound on the min-tradeoff function, as done in Equation (11.7) for the CHSH inequality. For many Bell inequalities such bounds are known, but for the min-entropy instead of the von Neumann entropy. In most cases using a bound on the min-entropy will result in far from optimal rate curves. Therefore, to adapt our protocol in this direction one should probably first bound the min-tradeoff function using the von Neumann entropy directly.191919This should not be dismissed as can be seen from the following state of affairs. [Nieto-Silleras et al., 2018] reports an advantage in terms of the min-entropy when considering the full statistics instead of merely the violation if the CHSH inequality. Comparing the bound on the min-entropy from the full statistics to the bound on the von Neumann entropy from the violation alone, both evaluated on the quantum states produced by the honest implementations, we find that it is still better to use the bound on the von Neumann entropy as we do here. Thus, to truly see if an advantage can be gained by considering the full statistics, one should aim to a direct bound on the von Neumann entropy.

On the “classical side” of the protocol, different classical post-processing steps can be considered. It is known that, asymptotically, considering protocols with other one-way classical post-processing cannot lead to an improvement over our protocol [Devetak and Winter, 2005]. Hence, the interesting to check is whether there are protocols with two-way classical post-processing protocols that lead to an improvement of the first-order term of the key rates.

Bounding the von Neumann entropy

As mentioned above, the main task to perform when modifying the protocol and the analysis is to lower-bound the min-tradeoff function. Getting a tight bound on the von Neumann entropy, and hence on the min-tradeoff function, does not seem to be an easy task. Is there a numerical technique that allows one to get good bounds on the von Neumann entropy for general Bell inequalities?

Interestingly, as it turns out, good numerical tools are known for a couple of similar quantities:

When considering the min-entropy instead of the von Neumann entropy one can use SDP hierarchies to get (not necessarily tight) lower-bounds [Navascués et al., 2008]. 2. 2.

In the device-dependent case, a recent development [Winick et al., 2017] presents a numerical technique to lower-bound the von Neumann entropy and by this derive better key rates for QKD.

We hope that it is possible to devise a general technique (numerical or analytical) to calculate good lower bounds on the von Neumann entropy relevant for our case. Such a technique, in combination with our work, will allow us to “enumerate” over all possible protocols and calculate their key rates when looking for better protocols. If it is not possible to devise a general tool, it will at least be interesting to understand why this is the case. Is there a fundamental mathematical reason behind the complexity of the problem?

Chapter 12 Outlook

The development and application of the concept of reductions to IID, taking the form of de Finetti theorems, flourished in “standard” quantum information processing in the last decade and more. The tools used, unfortunately, were not applicable when considering device-independent information processing tasks, where the devices being analysed are uncharacterised. The reductions presented in the thesis, namely the de Finetti reduction (Chapter 8) and the entropy accumulation theorem (Chapter 9), are the first to be applicable in the device-independent setting. As such, they have opened the possibility of a significantly simpler analysis of device-independent information processing tasks.

Among the advantages of applying the approach of reductions to IID in the device-independent setting, compared to directly analysing the most general case, are tighter quantitive results and modular proofs. The thesis’ showcases, used to exemplify the usage of the reductions, indeed report such benefits. Our proof of non-signalling parallel repetition (Chapter 10) is automatically valid for any complete-support game with any number of players and achieves an exponential decrease that matches that of IID strategies. Our security proof for device-independent quantum key distribution (Chapter 11) achieves tight key rates, as under the IID assumption, that are significantly better than all prior results and can be easily adapted to other related protocols.

With this in mind, it is interesting to investigate how the presented reductions or variants thereof can be used in the analysis of other tasks. Let us discuss a partial list of questions and possible future work that we find intriguing.111We list here questions that are not directly related to the showcases considered in the thesis. For concrete open questions regarding parallel repetition (e.g., extensions of the results) and device-independent quantum key distribution (such as possible improvements and experimental implementations) see Sections 10.4 and 11.4, respectively.

Two-party device-independent quantum cryptography

In the cryptographic protocols discussed in the thesis we considered two honest and cooperating parties, Alice and Bob. Two-party cryptography, on the other hand, refers to cryptographic protocols in which Alice and Bob do not trust each other. When considering device-independent two-party cryptography the dishonest party (which can be either Alice or Bob) takes the role of the adversary and hence is allowed to prepare the device used to implement the protocol.  [Fu and Miller, 2018] and [Ribeiro et al., 2018] present examples for such protocols.

The above mentioned works study the security of the protocols under the IID assumption (or a closely related assumption). Clearly, it is interesting to see if the analysis can be extended to capture the most general adversarial scenario, which, in the case of these protocols, includes the use of sequential boxes. Applying a reduction to IID can be beneficial here. Unfortunately, it is not clear whether the entropy accumulation theorem, in its current form, can be of use in such protocols. The reason is that the Markov-chain conditions stated in Equation (9.4) do not hold, at least when considering the most obvious choices of random variables.222In the case of two-party cryptography, the natural choice to make when trying to use the entropy accumulation theorem is one in which the $\mathbold{O}$ systems belong to the honest party and the $\mathbold{S}$ systems to the dishonest party. One can easily come up with boxes that do not fulfil Equation (9.4) with these choices.

In some cases, one can overcome the problem by considering “imaginary” protocols, closely related to the “real” protocol, in which the Markov-chain conditions do hold. The idea is then to reduce the problem of proving the security of the real protocol to that of the imaginary one and perform the analysis of the imaginary protocol using the entropy accumulation theorem.

Such a proof technique is used in [Arnon-Friedman and Bancal, 2017]. There, the protocol of interest is a device-independent entanglement certification protocol and its analysis requires an upper bound on the smooth max-entropy, rather than a lower bound on the smooth min-entropy as in cryptographic scenarios.333In the considered scenarios the two quantities are not dual to one another; see [Arnon-Friedman and Bancal, 2017] for the details. Thus, the steps used in [Arnon-Friedman and Bancal, 2017] are not directly applicable to two-party device-independent cryptography. It is interesting to see if similar ideas can be useful in cryptographic scenarios as well.

Alternatively, one could also try to prove a different variant of the entropy accumulation theorem in which the Markov-chain conditions are replaced by some other restrictions on the sequential process, which are fulfilled by two-party cryptographic protocols. (Finding such conditions is interesting by itself). As discussed in Section 9.2.1, some conditions on the process must appear in the theorem, since entropy does not accumulate in any sequential process. While the Markov-chain conditions are sufficient, we currently have no reason to believe that they are necessary; it might as well be that some weaker or incomparable conditions also suffice.

Parallel device-independent quantum cryptography

Another type of cryptographic protocols to which the presented reductions to IID are not applicable in a trivial manner are ones in which the most general analysis should be done with quantum parallel boxes. An example is the parallel device-independent quantum key distribution protocol of [Jain et al., 2017], in which all the non-local games are played in parallel with the device (as in the parallel repetition question). While [Jain et al., 2017] includes a security proof that goes beyond the IID scenario, it achieves quantitively weak results. This raises the fundamental question of whether parallel adversaries, i.e., adversaries that can create parallel boxes, are stronger than sequential and IID adversaries (which are proven to have the same strength by our work). To learn the answer to this question there is a need to supply tight key rates for parallel device-independent quantum key distribution protocols.

Utilising a reduction to IID instead of analysing the general case directly, as in [Jain et al., 2017], will almost surely lead to stronger, perhaps even tight, results. Alas, the known reductions are not directly applicable here. The entropy accumulation theorem is not useful in this case since it is restricted to sequential boxes and here one ought to analyse parallel boxes. The de Finetti reduction, while suitable for parallel boxes, is a priori not applicable here since the de Finetti box does not include the adversary and is not a quantum box; see Section 8.4. It is therefore interesting to investigate whether the analysis can somehow be manipulated so that the known techniques can be utilised to prove security of parallel device-independent quantum cryptography or, otherwise, whether other types of reductions, more adequate for such scenarios, can be developed.

Device-independent tomography

One of the applications of the “original” quantum de Finetti reduction (also called the post-selection technique) [Christandl et al., 2009] is a technique for a reliable quantum state tomography [Christandl and Renner, 2012]. The technique is said to be reliable since it reports not just an estimation of the quantum state but also a confidence region around the estimated state, which acts as a meaningful “error bar”. This is of crucial importance as the other more standard approaches, such as the maximum-likelihood optimisation and least-square-error estimation, suffer from systematic errors [Schwemmer et al., 2015].

Recently, the device-independent equivalents of the maximum-likelihood optimisation and least-square-error estimation were considered in [Lin et al., 2018]. The goal of such device-independent tomographic techniques is to report an estimated quantum box from the observed finite statistics. Apart from systematic errors, device-independent tomographic procedures as above are also at risk of providing a non-quantum box, since up to date it is unknown how to perform optimisation problems over the set of quantum boxes. In analogy to [Christandl and Renner, 2012], applying our de Finetti reductions to achieve reliable device-independent tomography can therefore be of interest.

Appendix A Additional proofs: de Finetti reductions

A.1 Bounding the de Finetti box

We use the notation used in Section 8.2:

$|\mathcal{X}||\mathcal{Y}|=l$ and we identify each pair $(x,y)\in\mathcal{X}\times\mathcal{Y}$ with a label $j\in[l]$ by writing $(x,y)=j$. 2. 2.

$|\mathcal{A}||\mathcal{B}|=m$ and we identify each pair $(a,b)\in\mathcal{A}\times\mathcal{B}$ with a label $k\in[m]$ by writing $(a,b)=k$. 3. 3.

For all $j\in[l]$ and $k\in[m]$, $p^{j}_{k}\in[0,1]$ such that $\sum_{k}p^{j}_{k}=1$ for all $j$. 4. 4.

For all $j\in[l]$ and $k\in[m]$, $c^{j}_{k}=1-\sum_{t<k}p^{j}_{t}$. 5. 5.

For all $\mathbold{x}$, $\mathbold{y}$, and $j\in[l]$, $n^{j}=|\left\{i:(x_{i},y_{i})=j\right\}|$, i.e., $n^{j}$ denotes the number of indices of $(\mathbold{x},\mathbold{y})$ in which the type of inputs is $(x,y)=j$. 6. 6.

For all $\mathbold{x}$, $\mathbold{y}$, $\mathbold{a}$, $\mathbold{b}$, $j\in[l]$, and $k\in[m]$, $n^{j}_{k}=|\left\{i:(x_{i},y_{i})=j\land(a_{i},b_{i})=k\right\}|$, i.e., $n^{j}_{k}$ denotes the number of indices of $(\mathbold{x},\mathbold{y},\mathbold{a},\mathbold{b})$ in which the type of inputs is $(x,y)=j$ and the type of outputs is $(a,b)=k$.

and notice that:

For all $j\in[l]$ and $k\in[m-1]$, $p^{j}_{k}\in[0,c^{j}_{k}]$ and $p^{j}_{m}=c^{j}_{m}$. 2. 2.

For all $j\in[l]$ and $k\in[m]$, $c^{j}_{k}=c^{j}_{k-1}-p^{j}_{k-1}$. 3. 3.

For all $j\in[l]$, $n^{j}_{m}=n^{j}-\sum_{k=1}^{m-1}n^{j}_{k}$.

Lemma 8.2.

For all $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$,

[TABLE]

where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is the de Finetti box defined by

[TABLE]

In the proof of the lemma we use the following formula:

[TABLE]

where $\mathrm{B}$ is the Beta function. We also need the following identity:

[TABLE]

Proof.

Abusing notation we denote below, for $t\in[2,m-1]$,111This is just a notation and $\prod_{k=1}^{t}$ should not be understood as the product operation. In particular, the order of terms is relevant since the different parameters are not independent of one another.

[TABLE]

We start by proving the following, for all $j\in[l]$, by induction:

[TABLE]

Base case, $m=2$:

[TABLE]

This follows from Equation (A.1) while noting that for the first index we have $c^{j}_{1}=1$ by definition.

Induction hypothesis for $m-2$:

[TABLE]

Inductive step:

[TABLE]

where we used Equation (A.1) to get from (A.5) to (A.6), $c^{j}_{m-1}=c^{j}_{m-2}-p^{j}_{m-2}$ to get from (A.6) to (A.7), the induction hypothesis (A.4) to get from (A.7) to (A.8) and Equation (A.2) as well as $n^{j}-\sum_{k}=1^{m-2}+1\geq n^{j}+1$ in the last line.

Finally, for any $\mathbold{a}$, $\mathbold{b}$, $\mathbold{x}$, and $\mathbold{y}$,

[TABLE]

where we used Equation (A.3) it the last step. ∎

A.2 Diamond norm reduction

We prove Lemma 8.3.3

Lemma 8.3.3.

For every two permutation invariant channels $\mathcal{E},\mathcal{F}:\mathcal{P}\rightarrow\mathcal{K}$ where $\mathrm{P}_{K}$ is a probability distribution over $k\in\{0,1\}^{t}$ for some $t>0$, and all $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$,

[TABLE]

where $\tau^{\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ is a non-signalling extension of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ which depends on the specific box $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$.

Proof.

First, as in the proof of Theorem 8.2, since the channels are permutation invariant it is sufficient to consider boxes $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ which are permutation invariant.

Given a specific box $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ we can see this extension as a set of convex decompositions of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, according to Lemma 8.3.1. That is, every possible input $z$ induces a specific decomposition $\{(p_{c_{z}},\mathrm{P}^{c_{z}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})\}_{c_{z}}$ such that $p_{c_{z}}=\mathrm{P}_{C|Z}(c_{z}|z)$ and $\mathrm{P}^{c_{z}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}(\mathbold{a},\mathbold{b}|\mathbold{x},\mathbold{y})=\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}(\mathbold{a},\mathbold{b},c_{z}|\mathbold{x},\mathbold{y},z)$. Since this is a convex decomposition of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ we also have

[TABLE]

We now use the set of decompositions of $\mathrm{P}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ to construct a set of decompositions of the de Finetti box $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. Combining Lemmas 8.3.1, 8.3.1 and 8.3.1 together, we know that there exists a non-signalling box $\mathrm{R}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ such that

[TABLE]

where the second equality is due to Equation (A.9). For every $z$ this defines a decomposition $\{(\frac{1}{(n+1)^{l(m-1)}}\cdot p_{c_{z}},\mathrm{P}^{c_{z}}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})\}_{c_{z}}\cup\{(1-\frac{1}{(n+1)^{l(m-1)}},\mathrm{R}_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}})\}$ of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$. That is, this defines an extension $\tau^{\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}}_{\mathbold{A}\mathbold{B}C^{\prime}|\mathbold{X}\mathbold{Y}Z}$ of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ where $C^{\prime}=C\cup\{c^{\prime}\}$.

This connection between the extensions $\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}$ and $\tau^{\mathrm{P}_{\mathbold{A}\mathbold{B}C|\mathbold{X}\mathbold{Y}Z}}_{\mathbold{A}\mathbold{B}C^{\prime}|\mathbold{X}\mathbold{Y}Z}$ allow us to get the following bound on the trace distance, from which the lemma follows:

[TABLE]

Equation (A.10) can be proven using the following sequence of steps. First, the diamond norm can be written in the following way.

[TABLE]

where the third equality is due to the explicit form of the trace distance previously given in [Masanes, 2009, Hänggi et al., 2010b].

This can then be used to write

[TABLE]

where in order to get the second equality we divide the sum over $C^{\prime}=C\cup\{c^{\prime}\}$ to the sum over $C$ and then additional part of the partition $c^{\prime}$. The next inequality is then correct since

[TABLE]

and the two last equalities are due to the specific decomposition of $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ that we defined and the definition of the trace distance. This proves the lemma.∎

Appendix B Additional proofs: non-signalling parallel repetition

B.1 Signalling measure and test

We present here proofs of lemmas relevant to Section 10.2. The proofs previously appeared in [Arnon-Friedman et al., 2016b].

Lemma 10.2.2.

Let $\mathrm{O}_{AB|XY}^{1}$ and $\mathrm{O}_{AB|XY}^{2}$ be two single-round boxes such that

[TABLE]

Then, for all $a$, $b$, $x$, and $y$,

[TABLE]

Proof.

We prove a stronger result from which the lemma follows. We prove

[TABLE]

To do so first note the following,

[TABLE]

therefore if \big{|}\mathrm{O}_{AB|XY}^{1}-\mathrm{O}_{AB|XY}^{2}\big{|}_{1}\leq\epsilon then

[TABLE]

Next, using Definition 10.2.2 and the discussion following it,

[TABLE]

where the last inequality follows from Equation (B.1). ∎

Lemma \thelem.

Let $\nu>0$ be any parameter such that $\nu<\zeta-6\epsilon$. Then for every $x$, $y$, and $b$,

[TABLE]

Proof.

Assume by contradiction that there exists $\mathrm{O}_{AB|XY}\in\Sigma^{(A\rightarrow B,x,y,b)}$ such that $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}\right)\leq\nu$. Since $\mathrm{O}_{AB|XY}\in\Sigma^{(A\rightarrow B,x,y,b)}$ there exists $\bar{\mathrm{O}}_{AB|XY}$ such that $|\mathrm{O}_{AB|XY}-\bar{\mathrm{O}}_{AB|XY}|_{1}\leq\epsilon$ and

[TABLE]

Using Lemma 10.2.2 we get $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\bar{\mathrm{O}}_{AB|XY}\right)\leq\nu+2\epsilon$. From Lemma 2.2.2 we know that $\mathrm{Pr}_{\textup{data}\sim\bar{\mathrm{O}}_{AB|XY}^{\otimes n}}\left[|\bar{\mathrm{O}}_{AB|XY}^{\textup{freq}(\textup{data}_{2})}-\bar{\mathrm{O}}_{AB|XY}|_{1}>\epsilon\right]\leq\delta$ and therefore, using Lemma 10.2.2 again,

[TABLE]

Since $\nu<\zeta-6\epsilon$ this implies

[TABLE]

and therefore, according to the definition of the test,

[TABLE]

which contradicts Equation (B.2). ∎

Next we would like to prove Lemma 10.2.2. To do so, we first prove the same statement but for IID boxes:

Lemma \thelem.

Assume the players share an IID box $\mathrm{O}_{AB|XY}^{\otimes n}$ and let $\zeta,\epsilon>0$ be the the parameters defined as in Equation (10.7). For every $\mathcal{T}^{(A\rightarrow B,x,y,b)}$,

If $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}\right)\geq\zeta$ then

[TABLE] 2. 2.

If $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}\right)=0$ then

[TABLE]

where $\delta=\delta\left(\frac{n}{2},\epsilon\right)=\left(\frac{n}{2}+1\right)^{|\mathcal{A}|\cdot|\mathcal{Q}|-1}e^{-n\epsilon^{2}/4}$.

Proof.

For the first part of the lemma assume that $\mathrm{Sig}^{(A\rightarrow B,x,y,b)}\left(\mathrm{O}_{AB|XY}\right)\geq\zeta$. Then

[TABLE]

where the first inequality is due to Lemma 10.2.2 and the second due to Lemma 2.2.2. This implies Equation (B.3). Equation (B.4) can be proven in an analogous way. ∎

Lemma 10.2.2.

Let $\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}=\mathrm{Q}_{XY}^{\otimes n}\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$, where $\tau_{\mathbold{A}\mathbold{B}|\mathbold{X}\mathbold{Y}}$ is a de Finetti box. For every $\mathcal{T}^{(A\rightarrow B,x,y,b)}$

$\mathrm{Pr}_{\textup{data}\sim\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[\lnot in^{\Sigma}\land T\right]\leq\delta$ 2. 2.

$\mathrm{Pr}_{\textup{data}\sim\tau_{\mathbold{A}\mathbold{B}\mathbold{X}\mathbold{Y}}}\left[in^{\sigma}\land\lnot T\right]\leq\delta$,

where $\delta=\delta\left(\frac{n}{2},\epsilon\right)=\left(\frac{n}{2}+1\right)^{|\mathcal{A}||\mathcal{B}||\mathcal{X}||\mathcal{Y}|-1}e^{-n\epsilon^{2}/4}$.

Proof.

Since a de Finetti box is a convex combination of IID boxes, it is sufficient to prove this for IID boxes $\mathrm{O}_{AB|XY}^{\otimes n}$ and the lemma will follow. We start by proving the first part of the lemma.

If $\mathrm{Pr}_{\textup{data}\sim\mathrm{O}_{AB|XY}^{\otimes n}}\left[T\right]\leq\delta$ then we are done. Consider therefore single-round boxes $\mathrm{O}_{AB|XY}$ such that

[TABLE]

For such boxes

[TABLE]

where the first inequality follows from the definition of $\Sigma^{(A\rightarrow B,x,y,b)}$ and the second from Lemma 2.2.2. All together we get $\mathrm{Pr}_{\textup{data}\sim\mathrm{O}_{AB|XY}^{\otimes n}}\left[\lnot in^{\Sigma}\land T\right]\leq\delta$ as required for the first part of the lemma.

We now proceed to the second part of the lemma. If $\mathrm{Pr}_{\textup{data}\sim\mathrm{O}_{AB|XY}^{\otimes n}}\left[in^{\sigma}\right]\leq\delta$ then we are done. Consider therefore boxes $\mathrm{O}_{AB|XY}$ such that

[TABLE]

Using Lemma 2.2.2 we know that there exists a state $\mathrm{O}_{AB|XY}^{\textup{freq}(\textup{data}_{1})}\in\Sigma^{(A\rightarrow B,x,y,b)}$ such that $|\mathrm{O}_{AB|XY}^{\textup{freq}(\textup{data}_{1})}-\mathrm{O}_{AB|XY}|_{1}\leq\epsilon$ and according to the definition of $\Sigma^{(A\rightarrow B,x,y,b)}$ this implies that $\mathrm{O}_{AB|XY}$ is $\zeta$ signalling or more. Therefore, according to Lemma B.1, $\mathrm{Pr}_{\textup{data}\sim\mathrm{O}_{AB|XY}^{\otimes n}}\left[\lnot T\right]\leq\delta$. All together we get

[TABLE]

B.2 Sensitivity analysis

Linear programs (see, e.g., [Schrijver, 1998]) are a useful tool when considering non-signalling games, as the non-signalling constraints are linear. The following general results regarding the sensitivity of linear programs will be of use for us.

Lemma \thelem (Sensitivity analysis of linear programs, [Schrijver, 1998] Section 10.4).

Let $\max\{c^{T}x|Ax\leq b\}$ be a primal linear program and $min\{b^{T}y|A^{T}y=c,y\geq 0\}$ its dual. Denote the optimal value of the programs by $w$ and the optimal dual solution by $y^{\star}$. Then the optimal value of the perturbed program $w_{e}=max\{c^{T}x|Ax\leq b+e\}$ for some perturbation $e$ is bounded by $w_{e}\leq w+e^{T}y^{\star}$.

Lemma \thelem (Dual optimal solution bound, [Schrijver, 1998] Section 10.4).

Let $A$ be an $r_{1}\times r_{2}$-matrix and let $\Delta$ be such that for each non-singular sub-matrix $B$ of $A$ all entries of $B^{-1}$ are at most $\Delta$ in absolute value. Let $c$ be a row vector of dimension $r_{2}$ and let $y^{\star}$ be the optimal dual solution of $min\{b^{T}y|A^{T}y=c,y\geq 0\}$. Then

[TABLE]

We start with the following program from Section 10.3.1:

[TABLE]

To apply Lemma B.2 we first need to write the program in the form $\max\{c^{T}x|Ax\leq b\}$. For this purpose, one can relax the linear program (B.5) to the following:

[TABLE]

To see that the relaxation of the non-signalling constraints (B.5a) and (B.5b) to the constraints (B.6a) and (B.6b) does not change the program, i.e., does not change the value of the optimal solution, recall Equation (10.6) and assume there exists $x,y,b$ for which

[TABLE]

That is, $\mathrm{O}_{B|XY}(b|x,y)$ is smaller than the average $\sum_{\tilde{x}}\mathrm{Q}_{X|Y}(\tilde{x}|y)\mathrm{O}_{B|XY}(b|\tilde{x},y)$, and therefore there must be some $x^{\prime}$ for which $\mathrm{O}_{B|XY}(b|x^{\prime},y)$ is larger than the average, meaning,

[TABLE]

but this contradicts the constraints (B.6a) and (B.6b).

The dual program of the primal (B.6) is given below.

[TABLE]

Lemma \thelem.

Let $\kappa=\sum_{j=1}^{d}|y^{\star}_{j}|$ where $d$ is the number of signalling tests and $y^{\star}$ is an optimal solution of the dual program (B.7). Let $\mathrm{O}_{AB|XY}$ be a strategy such that the following holds for all $a,b,x,y$

[TABLE]

Then $w\left(\mathrm{O}_{AB|XY}\right)\leq 1-\alpha+\left(\zeta+2\epsilon\right)d$.

Proof.

The fact that $\mathrm{O}_{AB|XY}$ is not “too signalling” in any direction can be used to bound its winning probability in the game $\mathrm{G}$.

The following linear program describes the optimal winning probability of a strategy $\mathrm{O}_{AB|XY}$ which fulfils Equation (B.8):

[TABLE]

Program (B.9) can be seen as a perturbation of the linear program (B.6), we can therefore bound its optimal value by using known tools for sensitivity analysis of linear programs, stated in Lemmas B.2 and B.2.

Denote by $y^{\star}$ an optimal solution of the dual program111We are only interested in the value of $y^{\star}$ as $z^{\star}$ will not affect the bound. (B.7) and let $\kappa=\sum_{j=1}^{d}|y^{\star}_{j}|$ where $d$ is the number of signalling tests. That is, $\kappa$ is the sum of all the dual variables which are associated to the non-signalling constraints.

According to Lemma B.2 the perturbed winning probability is then bounded by

[TABLE]

In the case of a game with two players, using [Ito, 2010, Section 4], one can show that $\kappa\leq d$ where $d$ is the number of different signalling tests, i.e., $d=|\mathcal{X}||\mathcal{Y}|(|\mathcal{A}|+|\mathcal{B}|)$). ∎

Appendix C Additional proofs: device-independent quantum cryptography

This appendix is devoted to presenting the technical proofs of the statements made in this thesis related to the device-independent cryptography. The proofs previously appeared in [Arnon-Friedman et al., 2016c].

C.1 Single-round statement

As mentioned in Section 5.2, Lemma 5.2 (restated below) follows, almost directly, from [Pironio et al., 2010, Acín et al., 2012]. We show here how the bound derived in these works can be manipulated in a simple way to get the bound used in this thesis.

Lemma 5.2.

For any quantum single-round box $\mathrm{P}_{AB|XY}$ with winning probability $\omega\in\left[\frac{3}{4},\frac{2+\sqrt{2}}{4}\right]$ in the CHSH game,

[TABLE]

where $E$ denotes the quantum side-information belonging to the adversary and $h(\cdot)$ is the binary entropy function.

Proof.

Our starting point is the result of [Pironio et al., 2009]. There, a quantum single-round box $\mathrm{P}_{\hat{A}\hat{B}|XY}$ with symmetric marginals on $\hat{A}$ and $\hat{B}$ was considered (i.e., $\hat{A}$ and $\hat{B}$ are uniformly distributed). To derive a bound which holds for any $\mathrm{P}_{AB|XY}$ we do the following:

Symmetrisation of $\mathrm{P}_{AB|XY}$ – Alice chooses a bit $F$ uniformly at random and communicates it to Bob. They then symmetrise their marginals by setting $\hat{A}=A\oplus F$ and $\hat{B}=B\oplus F$. 2. 2.

Use [Pironio et al., 2009] to lower-bound $H\left(\hat{A}|XYFE\right)$. 3. 3.

Derive a bound on $H\left(A|XYE\right)$ from $H\left(\hat{A}|XYFE\right)$.

Let us follow the above steps. After applying $\hat{A}=A\oplus F$ and $\hat{B}=B\oplus F$, with $F$ uniformly distributed, $A$ and $B$ are unbiased. In our notation, [Pironio et al., 2009] considered the following Holevo quantity

[TABLE]

and showed that for states leading to a CHSH violation of $\beta\in[2,2\sqrt{2}]$, related to the winning probability via $\omega=1/2+\beta/8$, the following tight bound holds [Pironio et al., 2009, Section 2.3]:

[TABLE]

Rewriting the bound in terms of the winning probability $\omega$ one gets that for all $\omega\in\left[\frac{3}{4},\frac{2+\sqrt{2}}{4}\right]$ (i.e. a winning probability in the quantum regime)

[TABLE]

We now wish to related the above Holevo quantities to our von Neumann entropy. Using the definition of the conditional von Neumann entropy one can rewrite $H\left(A|FE,X=0\right)(\sigma)$ as follows:

[TABLE]

where the last equality holds since $A$ is uniformly random due to the symmetrisation step (note that we do not condition on $F$ in $H\left(A|X=0\right)$). Furthermore,

[TABLE]

Combining Equations (C.1) and (C.2) while noting that, due to the symmetry between the cases $X=0$ and $X=1$, the same relations can be written for $X=1$ and plugging the bounds in Equation (C.3) we get

[TABLE]

The only think left to do is to use the above to get our bound for the original box $\mathrm{P}_{AB|XY}$. For this simply observe that

[TABLE]

where the first equality holds since $\hat{A}=A\oplus F$ and the second follows since $F$ is independent of $A$, $X$, $Y$, and $E$. The lemma therefore follows. ∎

C.2 An improved dependency on the test probability

In this section we show how the EAT can be used in a slightly different way than what was done in the main text. This results in an entropy rate which has a better dependency on the probability of a test round $\gamma$, compared to the entropy rate given in Equation (11.12). The improved entropy rate derived here is the one used for calculating the key rates of the DIQKD protocol is Section 11.3.3.

C.2.1 Modified entropy accumulation protocol

We use a different entropy accumulation protocol, given as Protocol C.1. In this modified protocol instead of considering each round separately we consider blocks of rounds. A block is defined by a sequence of rounds: in each round a test is carried out with probability $\gamma$ (and otherwise the round is a generation round). The block ends when a test round is being performed and then the next block begins. If for $s_{\max}$ rounds there was no test, the block ends without performing a test and the next begins. Thus, the blocks can be of different length, but they all consist at most $s_{\max}$ rounds.

In this setting, instead of fixing the number of rounds $n$ in the beginning of the protocol, we fix the number of blocks $m$. The expected length of block is

[TABLE]

The expected number of rounds is denoted by $\bar{n}=m\cdot\bar{s}$.

Compared to the main text, we now have a RV $\tilde{W}_{j}\in\{0,1,\perp\}$ for each block, instead of each round. Alice and Bob set $\tilde{W}_{j}$ to be [math] or $1$ depending on the result of the game in the block’s test round (i.e., the last round of the block), or $\tilde{W}_{j}=\perp$ if a test round was not carried out in the block. By the definition of the blocks we have $\Pr[\tilde{W}_{j}=\perp]=(1-\gamma)^{s_{\max}}$.

C.2.2 Modified min-tradeoff function

Below, we apply the EAT on blocks of outputs instead of single rounds directly. Let $\mathcal{M}_{j}$ denote the EAT channels defined by the actions of Steps 13-20 in Protocol C.1 together with the behaviour of the device. It is easy to verify that $\mathcal{M}_{j}$ fulfil the necessary conditions given in Definition 9.2.2.

We now construct a min-tradeoff function for $\mathcal{M}_{j}$. Let $\tilde{p}$ be a probability distribution over $\{0,1,\perp\}$. Our goal is to find $F_{\min}$ such that

[TABLE]

where $\vec{A_{j}}$ is a vector of varying length (but at most $s_{\max}$). We use $A_{j,i}$ to denote the $i$’th entry of $\vec{A_{j}}$ and $A_{j,1}^{j,i-1}=A_{j,1}\dotsc A_{j,i-1}$. Since we will only be interested in the entropy of $\vec{A_{j}}$ we can also describe it as a vector of length $s_{\max}$ which is initialised to be all $\perp$. For every actual round being performed in the block the value of $A_{j,i}$ is updated. Thus, the entries of $\vec{A_{j}}$ which correspond to rounds which were not performed do not contribute to the entropy. We use similar notation for the other vectors of RVs.

To lower-bound the right-hand side of Equation (C.6) we first use the chain rule

[TABLE]

Next, for every $i\in[s_{\max}]$,

[TABLE]

since the entropy is not zero only if the $i$’th round is being performed in the block, i.e., if a test was not performed before that round. Plugging this into Eq. (C.7) we get

[TABLE]

Each term in the sum can now be identified as the entropy of a single round. We can therefore use the bound derived in the main text, as given in Equation (11.6). For this we denote by $\omega_{i}$ the winning probability in the $i$’th round (given that a test was not performed before). Then it holds that

[TABLE]

where, by the actions of the EAT channel $\mathcal{M}_{j}$, the $\omega_{i}$’s must fulfil the constraint

[TABLE]

Note that, similarly to what was done in the main text, we only need to consider $\tilde{p}$ for which $\tilde{p}(1)+\tilde{p}(0)=1-(1-\gamma)^{s_{\max}}$ (otherwise the condition on the min-tradeoff function is trivial, as the infimum is over an empty set).

To find the min-tradeoff function $F_{\min}(\tilde{p})$ we therefore need to minimise Equation (C.8) under the constraint of Equation (C.9). The following lemma shows that the minimum is achieved when all $\omega_{i}$ are equal.

Lemma \thelem.

The minimum of the function given on the righthand-side of Equation (C.8) over $\omega_{i}$ constrained by Equation (C.9) is achieved for $\omega^{*}_{i}=\frac{\tilde{p}(1)}{1-(1-\gamma)^{s_{\max}}}$ for all $i\in[s_{\max}]$.

Proof.

Let $\vec{\omega}=\omega_{1},\dotsc,\omega_{s_{\max}}$ and

[TABLE]

Using the method of Lagrange multipliers, we should look for $\vec{\omega}^{*}$ such that $g(\vec{\omega}^{*})=0$ and $\nabla f(\vec{\omega}^{*})=-\lambda\nabla g(\vec{\omega}^{*})$ for some constant $\lambda$. $\nabla f(\vec{\omega}^{*})=-\lambda\nabla g(\vec{\omega}^{*})$ implies that for any $i$,

[TABLE]

and therefore

[TABLE]

The function on the left-hand side of the above equation is strictly increasing. Hence, it must be that all $\omega^{*}_{i}$ are equal to some constant $\omega^{*}$.

Lastly, we must have $g(\vec{\omega}^{*})=0$. Thus,

[TABLE]

which means

[TABLE]

Plugging the minimal values of $\omega_{i}$ into Equation (C.8) we get that

[TABLE]

where we used Equation (C.5) to get the last equality.

From this point we can follow the same steps as in Section 11.2.2 (cutting and gluing the function etc.). The resulting min-tradeoff function is given by

[TABLE]

The min-tradeoff function given above is effectively identical to the one derived in the main text; although it gives us a bound on the von Neumann entropy in a block, instead of a single round, this bound is exactly the expected length of a block, $\bar{s}$, times the entropy in one round. For $s_{\max}=1$ the min-tradeoff function constructed in the main text is retrieved.

C.2.3 Modified entropy rate

Since we apply the EAT on the blocks, the entropy rate is now defined to be the entropy per block. We therefore get

[TABLE]

and the total amount of entropy is given by

[TABLE]

By choosing $s_{\max}=\lceil\frac{1}{\gamma}\rceil$ the scaling of the entropy rate with $\gamma$ is better than the rate derived in the main text. In particular, a short calculation reveals that the second order term scales, roughly, as $\sqrt{\bar{n}/\gamma}$ instead of $\sqrt{n}/\gamma$.

C.2.4 Modified key rate

To get the final key rate we need to repeat the same steps from the main text, but this time applied to random variables of varying length.

For this we first observe that, with high probability, the actual number of rounds, $n$, cannot be much larger than the expected number of rounds $\bar{n}$. Let $S_{i}$ be the RV describing the length of block $i$, for $i\in[m]$, and $N$ the RV describing the total number of rounds. Then $N=S_{1}+\dots+S_{m}$. Since all the $S_{i}$ are independent, identical, and have values in $\left[1,\frac{1}{\gamma}\right]$ we have

[TABLE]

Let $\varepsilon_{t}=\exp\left[-\frac{2t^{2}\gamma^{2}}{m(1-\gamma)^{2}}\right]$ then

[TABLE]

The first step in the derivation of the key rate which needs to be changed is the one given in Equation (11.21). The quantity that needs to be upper bounded is $H^{\frac{\varepsilon_{\mathrm{s}}}{4}}_{\max}\left(\mathbold{B}|\mathbold{T}EN\right)_{\rho_{|\hat{\Omega}}}$; $N$ can be included in the entropy since its value is fixed by $\mathbf{T}$. By the definition of the smooth max-entropy we have

[TABLE]

Following the same steps as in the proof of Lemma 11.3.2 we have

[TABLE]

With this modification and the modified entropy rate given in Equation (C.11) we get

[TABLE]

Similarly, the amount of leakage due to the error correction step $\mathrm{leak_{EC}}$ should be modified as well. Following the steps in Section 11.3.3, the quantity to be upper bounded is $H_{\max}^{\frac{\varepsilon^{\prime}_{\mathrm{EC}}}{2}}\left(\mathbold{A}|\tilde{\mathbold{B}}\mathbold{X}\mathbold{Y}\mathbold{T}N\right)$. Here as well we have

[TABLE]

The asymptotic equipartition property can be used with the maximal length $\bar{n}+t$ to get

[TABLE]

for

[TABLE]

Continuing exactly as in Section 11.3.3 we get

[TABLE]

The parameter $\varepsilon_{t}$ should be chosen such that the key rate is optimised. The resulting key rates are shown in Figures 11.3 and 11.4 in the main text.

C.3 Summary of parameters and variables