Capacity of Quantum Private Information Retrieval with Collusion of All But One of Servers

TL;DR

This paper determines the maximum efficiency of quantum private information retrieval protocols that remain secure even if all but one server collude, showing quantum advantages over classical methods.

Contribution

It derives the capacity of $(n-1)$-private QSPIR with collusion among all but one server, providing explicit capacity formulas and protocols for even number of servers.

Findings

Capacity of $(n-1)$-private QSPIR is $2/n$ for even $n$ with entanglement.

Constructed a protocol with rate $rac{1}{ ext{ceil}(n/2)}$ matching the capacity upper bound.

Quantum QSPIR capacity exceeds classical counterparts.

Abstract

Quantum private information retrieval (QPIR) is a protocol in which a user retrieves one of multiple classical files by downloading quantum systems from non-communicating $\mathsf{n}$ servers each of which contains a copy of all files, while the identity of the retrieved file is unknown to each server. Symmetric QPIR (QSPIR) is QPIR in which the user only obtains the queried file but no other information of the other files. In this paper, we consider the $(\mathsf{n} - 1)$-private QSPIR in which the identity of the retrieved file is secret even if any $\mathsf{n} - 1$ servers collude, and derive the QSPIR capacity for this problem which is defined as the maximum ratio of the retrieved file size to the total size of the downloaded quantum systems. For an even number n of servers, we show that the capacity of the $(\mathsf{n}-1)$-private QSPIR is $2/\mathsf{n}$, when we assume that there are prior entanglements among the servers. We construct an $(\mathsf{n} - 1)$-private QSPIR protocol of rate $\lceil\mathsf{n}/2\rceil^{-1}$ and prove that the capacity is upper bounded by $2/\mathsf{n}$ even if any error probability is allowed. The $(\mathsf{n} - 1)$-private QSPIR capacity is strictly greater than the classical counterpart.

Tables

Table 1. TABLE I: Classical and quantum PIR capacities

	Classical PIR	Quantum PIR
PIR	$\frac{1-1/𝗇}{1-{\left(1/𝗇\right)}^{𝖿}}$ [14]	$1$ [27]
SPIR	$\frac{𝗇-1}{𝗇}$ [14]	$1$ [27]
$𝗍$-private SPIR	$\frac{𝗇-𝗍}{𝗇}$ [24]	$\frac{2}{𝗇}$ $‡$
$\ast$ $𝗇$, $𝖿$, and $𝗍$: the number of servers, files, and colluding servers, respectively.
$‡$ This paper derives the capacity for any even number $𝗇$ and the number $𝗍=$
$𝗇-1$.

Equations

$${\mathsf{Enc}}_{\mathrm{user}}(K,R_{\mathrm{user}})=Q=(Q_1,\dots ,Q_{\mathsf{n}})\in {\mathcal{Q}}_1\times \cdots \times {\mathcal{Q}}_{\mathsf{n}},$$

$${\mathsf{Enc}}_{{\mathrm{serv}}_t}(Q_t,W)={\Lambda }_t$$

$${\rho }^{W,Q}:={\Lambda }_1\otimes \cdots \otimes {\Lambda }_{\mathsf{n}}({\rho }_{\mathrm{prev}})$$

$${\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})}:=({\rho }_{\mathrm{prev}},{\mathsf{Enc}}_{\mathrm{user}},{\mathsf{Enc}}_{\mathrm{serv}},\mathsf{Dec}),$$

$$U({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})=\prod _{t=1}^{\mathsf{n}}|{\mathcal{Q}}_t|,D({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})=\dim \underset{t=1}{\overset{\mathsf{n}}{⨂}}{A}_t,$$

$$R({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})=\frac{\log \mathsf{m}}{\log D({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})}.$$

$$\alpha ({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})}):=P_{\mathrm{err}}({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})={\mathbb{E}}_{W,K,Q}(1-\mathrm{Tr}{\rho }^{W,Q}{\mathsf{Y}}_{W_K}),$$

$$\beta ({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})$$

$$\gamma ({\Psi }_{\mathrm{QPIR}}^{(\mathsf{m})})$$

$$C_{\mathrm{asymp}}^{\alpha ,\beta ,\gamma ,\theta }$$

$$C_{\mathrm{exact}}^{\alpha ,\beta ,\gamma ,\theta }$$

$$\begin{array}{rl}\underset{\ell \to \infty }{\mathrm{limsup}}\alpha ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \alpha ,,& \underset{\ell \to \infty }{\mathrm{limsup}}\beta ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \beta ,\\ \underset{\ell \to \infty }{\mathrm{limsup}}\gamma ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \gamma ,,& \underset{\ell \to \infty }{\mathrm{limsup}}\frac{\log U({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})}{\log D({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})}\le \theta ,\end{array}$$

$$\begin{array}{rl}\alpha ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \alpha ,& \beta ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \beta ,\\ \gamma ({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})\le \gamma ,& \underset{\ell \to \infty }{\mathrm{limsup}}\frac{\log U({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})}{\log D({\Psi }_{\mathrm{QPIR}}^{({\mathsf{m}}_{\ell })})}\le \theta .\end{array}$$

$$C_{\mathrm{asymp}}^{\alpha ,\beta ,\gamma ,\theta }\ge C_{\mathrm{exact}}^{\alpha ,\beta ,\gamma ,\theta }\ge C_{\mathrm{exact}}^{0,0,0,0}$$

$$C_{\mathrm{asymp}}^{\alpha ,0,0,\theta }$$

$$|\Phi ⟩:=\frac{1}{\sqrt{2}}\sum _{i=0}^1|i⟩\otimes |i⟩.$$

$$\mathsf{X}:=\sum _{i=0}^1|i+1⟩⟨i|,\mathsf{Z}:=\sum _{i=0}^1(-1{)}^i|i⟩⟨i|,\mathsf{W}(a,b):={\mathsf{X}}^a{\mathsf{Z}}^b.$$

$${\mathsf{Z}}^b{\mathsf{X}}^a$$

$$\mathsf{W}(a,b{)}^{†}$$

$$\mathsf{W}(a_1,b_1)\mathsf{W}(a_2,b_2)$$

$$=(-1{)}^{b_1{a}_2+a_1{b}_2}\mathsf{W}(a_2,b_2)\mathsf{W}(a_1,b_1).$$

$$|\mathsf{T}⟩:=\sum _{i,j=0}^1{t}_{ij}|i⟩\otimes |j⟩.$$

$$(\mathsf{U}\otimes \mathsf{V})|\mathsf{T}⟩$$

$$(\mathsf{U}\otimes \overline{\mathsf{U}})|\mathsf{I}⟩$$

$$(\mathsf{I}\otimes \mathsf{W}(a,b))|\Phi ⟩=(\mathsf{W}(a,b{)}^{\top }\otimes \mathsf{I})|\Phi ⟩$$

$$=(\mathsf{W}(a,b{)}^{†}\otimes \mathsf{I})|\Phi ⟩=(-1{)}^{ab}(\mathsf{W}(a,b)\otimes \mathsf{I})|\Phi ⟩.$$

$$\left\{(\mathsf{I}\otimes\mathsf{W}(a,b))|\Phi\rangle=\frac{1}{\sqrt{2}}\sum_{r=0}^{1}(-1)^{rb}|r,r+a\rangle\ \Bigg{|}\ a,b\in\mathbb{Z}_{2}\right\}$$

$${\mathbf{M}}_{{\mathbb{Z}}_2^2}$$

$$|z⟩:=\frac{1}{\sqrt{2}}\sum _{i,j,r=0}^1{y}_{ij}|i,j,r,r⟩.$$

$$2({\mathsf{I}}_{A_0}\otimes [⟨\Phi |({\mathsf{I}}_{A_1}\otimes \mathsf{W}(a,b){)}^{†}]\otimes \mathsf{W}(c,d))|z⟩$$

$$=2({\mathsf{I}}_{A_0}\otimes ⟨\Phi |\otimes {\mathsf{I}}_{A_3})$$

$$\cdot ({\mathsf{I}}_{A_0}\otimes {\mathsf{I}}_{A_1}\otimes \mathsf{W}(a,b{)}^{†}\otimes \mathsf{W}(c,d))|z⟩$$

$$=2(-1{)}^{ab}({\mathsf{I}}_{A_0}\otimes ⟨\Phi |\otimes {\mathsf{I}}_{A_3})$$

$$\cdot ({\mathsf{I}}_{A_0}\otimes {\mathsf{I}}_{A_1}\otimes \mathsf{W}(a,b)\otimes \mathsf{W}(c,d))|z⟩$$

$$=\sum _{i,j=0}^1{y}_{ij}(-1{)}^{jb+jd+ad}|i,j+a+c⟩$$

$$=(-1{)}^{ad}\sum _{i,j=0}^1{y}_{ij}(-1{)}^{j(b+d)}|i,j+a+c⟩$$

$$=(-1{)}^{ad}({\mathsf{I}}_{A_0}\otimes \mathsf{W}(a+c,b+d))|y⟩$$

Full text

I Introduction

A private information retrieval (PIR) protocol is a protocol in which a user retrieves a file from servers without revealing the identity of the retrieved file. Since it was first proposed by the paper [1], it has been studied in classical settings [2, 3, 4, 5, 6] and quantum settings [7, 8, 9, 10, 11]. Especially, in the last few years, the classical PIR capacity has been extensively studied, which is the maximum rate of the retrieved file size over the download size when the file size is arbitrarily large and the upload size, i.e., the total size of queries, is negligible to the download size. The paper [14] derived the PIR capacity for the most trivial setting in which each server contains the replicated file set. Several PIR capacities have been derived, e.g., when some servers may collude [16], when the user is also prohibited to obtain any information about the non-queried files [15] (symmetric PIR, SPIR), and when the file set is coded and distributed to the servers [17]. Moreover, many other papers [18, 19, 20, 21, 22, 23, 24, 26, 25] have studied the PIR capacity and the capacity-achieving protocols.

As a quantum extension of the PIR capacity in [14] and the SPIR capacity in [15], the paper [27] proved that the quantum PIR (QPIR) capacity and the QSPIR capacity are both $1$ for the replicated servers. The above QPIR capacity is strictly greater than the classical counterparts [14] and [15]. However, it still needs to be clarified whether QPIRs in other settings have advantages over the classical counterparts in the sense of the PIR capacities. For instance, in the PIR for $\mathsf{n}$ replicated servers where each server contains $\mathsf{f}$ files and any $\mathsf{t}$ servers may collude ($\mathsf{t}$-private PIR), the PIR capacity is \left(1-\mathsf{t}/\mathsf{n}\right)/\big{(}1-\left(\mathsf{t}/\mathsf{n}\right)^{\mathsf{f}}\big{)} [16] and the $\mathsf{t}$-private SPIR capacity is $(\mathsf{n}-\mathsf{t})/\mathsf{n}$, but the QPIR capacity is unknown.

In this paper, we prove the $(\mathsf{n}-1)$-private QSPIR capacity is $2/\mathsf{n}$ for any even number $\mathsf{n}$. For any number of servers $\mathsf{n}\geq 2$, we construct an $(\mathsf{n}-1)$-private QSPIR protocol with the rate $\lceil\mathsf{n}/2\rceil^{-1}$, no error, and the perfect secrecy. We also prove the strong converse bound in which the $(\mathsf{n}-1)$-private QSPIR capacity is upper bounded by $2/\mathsf{n}$ even if we allow any asymptotic error probability less than $1$. Since the $(\mathsf{n}-1)$-private PIR capacity for the infinite number of files and the $(\mathsf{n}-1)$-private SPIR capacity are $1/\mathsf{n}$, our QSPIR capacity implies the quantum advantage in PIR with colluding servers.

Our capacity-achieving protocol is a generalization of the QSPIR protocol in [27]. The protocol in [27] extended the classical PIR protocol [1] by the idea of the superdense coding [30]. Similarly, our protocol extends a classical $(\mathsf{n}-1)$-private PIR protocol explained below by the idea of the superdense coding [30] and the quantum teleportation [31]. The classical PIR protocol we extend is described as follows. Let $(\log\mathsf{m})$-bit files $W_{1},\ldots,W_{\mathsf{f}}$ be contained in each of $\mathsf{n}$ servers and the queries $Q_{1},\ldots,Q_{\mathsf{n}-1}$ be independently and uniformly chosen subsets of $\{1,\ldots,\mathsf{f}\}$. To retrieve the $K$-th file, the user chooses $Q_{\mathsf{n}}$ which satisfies $\bigoplus_{t=1}^{\mathsf{n}}Q_{t}=\{K\}$, where $\bigoplus$ is the symmetric difference, and sends the queries $Q_{1},\ldots,Q_{\mathsf{n}}$ to each server. For each $t\in\{1,\ldots,\mathsf{n}\}$, the $t$-th server returns $H_{t}\coloneqq\sum_{i\in Q_{t}}W_{i}$ to the user and then the user can retrieve $W_{K}=\sum_{t=1}^{\mathsf{n}}H_{t}$, where both summations are with respect to the addition modulo $2$. The protocol is private because the collection of any $\mathsf{n}-1$ variables in $Q_{1},\ldots,Q_{\mathsf{n}}$ is independent of the query index $K$.

Our capacity-achieving protocol has several remarkable properties. First, our protocol is a symmetric QPIR protocol, i.e., it guarantees the server secrecy in which no file information other than the queried one is transmitted to the user. Second, the upload cost of our protocol is $\mathsf{n}\mathsf{f}$ bits, which is linear for the number of servers $\mathsf{n}$ and the number of files $\mathsf{f}$ but independent of the file size $\mathsf{m}$. Third, our protocol requires the file size $\mathsf{m}=2^{2\ell}$, i.e., $2\ell$ bits, for any positive integer $\ell$, whereas the $(\mathsf{n}-1)$-private PIR protocol in [16] requires the file size $\mathsf{m}=q^{\mathsf{n}^{\mathsf{f}}}$ depending on $\mathsf{n}$ and $\mathsf{f}$ for a sufficiently large prime power $q$.

Following the conference version of this work, the paper [13] proposed a QSPIR protocol for coded and colluding servers which works for any $[\mathsf{n},k]$-MDS code and secure against $\mathsf{t}$-collusion with $\mathsf{t}=\mathsf{n}-k$. Their protocol is an extension of the protocol of this paper by combination with the classical PIR protocol [18], and it achieves better rates than the classical counterparts [18, 24]. The paper [29] improved the capacity result of this paper for any number of colluding servers: For any $1<\mathsf{t}<\mathsf{n}$, the $\mathsf{t}$-private QSPIR capacity is $\min\{1,2(\mathsf{n}-\mathsf{t})/\mathsf{n}\}$. Even though the capacity of [29] generalizes that of this paper, our protocol and converse proof have the following advantages compared to [29]. First, whereas the protocol of [29] requires multipartite entanglement as prior entanglement, our protocol only requires multiple copies of bipartite entangled states. Since the bipartite entanglement is more reliably generated with current technology, our construction is more suitable for the implementation on near-term quantum devices than that of [29]. Second, our protocol is more constructive and easier to understand than the protocol of [29]. Our protocol is a combination of two simple protocols: quantum teleportation [31] and superdense coding [30], which have been experimentally realized in [34, 35] and [36, 37], respectively. On the other hand, the protocol in [29] is constructed with the sophisticated method of stabilizer formalism. Thus, our protocol is more accessible to the experimentalists and the theorists who are not familiar with the stabilizer formalism. Lastly, the converse proof of our paper is much simpler than that of [29] because we only prove for the case of $\mathsf{t}=\mathsf{n}-1$.

The rest of the paper is organized as follows. Section II defines the QPIR protocol and presents our main theorems for the $(\mathsf{n}-1)$-private QSPIR capacity. Section III is preliminaries for the protocol construction and Section IV constructs the QSPIR protocol with $\mathsf{n}-1$ colluding servers. Section V proves the strong converse bound when the perfect secrecy is guaranteed.

Terms and Notations

*We summarized the basic notions of quantum information theory in Appendix A. For two sets $A$ and $B$, define $A\oplus B\coloneqq(A\backslash B)\cup(B\backslash A)$. The identity operator on any space $\operatorname{{\mathcal{A}}}$ is denoted by $\mathsf{I}_{\operatorname{{\mathcal{A}}}}$, or simply by $\mathsf{I}$ if there is no confusion. For a state $\rho$ on a composite system $\operatorname{{\mathcal{A}}}\otimes\mathcal{B}$, denote the quantum mutual information between the systems $\mathcal{A}$ and $\mathcal{B}$ by $I(\mathcal{A};\mathcal{B})_{\rho}$. The classical mutual information is denoted as $I(X;Y)$ without subscript. For states $\rho_{r}$ on a system $\operatorname{{\mathcal{A}}}$ which depend on the value $r$ of a random variable $R$, we denote $I(R;\mathcal{A})_{\rho_{R}}\coloneqq I(R;\mathcal{A})_{\sum_{r}p_{r}|r\rangle\langle r|\otimes\rho_{r}}$. For a matrix $A$, we denote the transpose of $A$ by $A^{\top}$ and the conjugate transpose of $A$ by $A^{\dagger}$. *

II Problem Statement and Main Results

In this section, we review the QPIR protocol given in the paper [27], which is defined in the same way for the $(\mathsf{n}-1)$-private QPIR except for the security measures. Then, we present two main theorems for the $(\mathsf{n}-1)$-private QSPIR capacity.

II-A Description of QPIR Protocol

Let $W_{1},\ldots,W_{\mathsf{f}}$ be uniformly and independently distributed in $\{0,\ldots,\mathsf{m}-1\}$. Each of non-communicating $\mathsf{n}$ servers $\mathtt{serv}_{1},\ldots,\mathtt{serv}_{\mathsf{n}}$ contains the replicated $\mathsf{f}$-file set $W\coloneqq(W_{1},\ldots,W_{\mathsf{f}})$. In addition, each server $\mathtt{serv}_{t}$ contains a quantum system $\operatorname{{\mathcal{A}}}_{t}^{0}$ and the $\mathsf{n}$ servers share an arbitrary entangled state $\rho_{\mathrm{prev}}$ on $\operatorname{{\mathcal{A}}}_{1}^{0}\otimes\cdots\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{0}$. A user chooses the query index $K\in\{1,\ldots,\mathsf{f}\}$ uniformly at random. The aim of the QPIR protocol is for the user to retrieve the file $W_{K}$ from the servers.

For this purpose, the user and the servers perform the following process. First, the user chooses a random variable $R_{\mathrm{user}}$ from a set $\mathcal{R}_{\mathrm{user}}$ and encodes the queries $Q_{1},\ldots,Q_{\mathsf{n}}$ by the user encoder $\mathsf{Enc}_{\mathrm{user}}$ as follows:

[TABLE]

where $\mathcal{Q}_{t}$ for any $t\in\{1,\ldots,\mathsf{n}\}$ is a finite set for describing possible query indexes to the server $\mathtt{serv}_{t}$. Then, for any $t\in\{1,\ldots,\mathsf{n}\}$, each query $Q_{t}$ is sent to the server $\mathtt{serv}_{t}$. After receiving the query $Q_{t}$, each server $\mathtt{serv}_{t}$ prepares a trace-preserving and completely positive (TP-CP) map111 Server operations induced by $\mathsf{Enc}_{\mathrm{serv}}$ may contain random operations and measurements because TP-CP maps contain random operations and measurements. $\Lambda_{t}$ from $\operatorname{{\mathcal{A}}}_{t}^{0}$ to $\operatorname{{\mathcal{A}}}_{t}$ by the server encoder $\mathsf{Enc}_{\mathrm{serv}_{t}}$, i.e.,

[TABLE]

and the resultant state on $\operatorname{{\mathcal{A}}}\coloneqq\operatorname{{\mathcal{A}}}_{1}\otimes\ldots\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}$ is

[TABLE]

Then, each server $\mathtt{serv}_{t}$ sends $\operatorname{{\mathcal{A}}}_{t}$ to the user. Depending on $K$ and $Q$, the user chooses the decoder $\mathsf{Dec}(K,Q)$, which is a positive-operator valued measure (POVM) $\{\mathsf{Y}_{i}\mid i\in\{0,\ldots,\mathsf{m}\}\}$ on $\operatorname{{\mathcal{A}}}$. By performing the POVM measurement $\mathsf{Dec}(K,Q)$ on $\operatorname{{\mathcal{A}}}$, the user obtains the measurement outcome $\hat{W}_{K}\in\{0,\ldots,\mathsf{m}\}$ as the retrieval result, where the outcome $\mathsf{m}$ is considered as decoding failure. With probability $\operatorname*{\mathrm{Tr}}\rho^{W,Q}\mathsf{Y}_{W_{K}}$, the queried file is obtained, i.e., $\hat{W}_{K}=W_{K}$.

Given the number of servers $\mathsf{n}$ and the number of files $\mathsf{f}$, a QPIR protocol is described by the four-tuple

[TABLE]

where $\mathsf{Enc}_{\mathrm{serv}}\coloneqq(\mathsf{Enc}_{\mathrm{serv}_{1}},\ldots,\mathsf{Enc}_{\mathrm{serv}_{\mathsf{n}}})$. Note that the QPIR protocol $\Psi_{\mathrm{QPIR}}^{(\mathsf{m})}$ characterizes the process in the previous paragraph. The upload cost, download cost, and rate of a protocol $\Psi_{\mathrm{QPIR}}^{(\mathsf{m})}$ are defined by

[TABLE]

II-B Security Measures and $(\mathsf{n}-1)$-Private QPIR Capacity

We define security measures and the capacity of the $(\mathsf{n}-1)$-private QPIR.

II-B1 Security Measures

$(\mathsf{n}-1)$-Private QPIR is QPIR in which any $\mathsf{n}-1$ servers may collude to determine $K$ but it should not be leaked even if the user does not know which servers are colluding. Furthermore, we also consider the server secrecy in which the user only obtains the queried file $W_{K}$ but no information of other files. Thus, we evaluate the security of a protocol $\Psi_{\mathrm{QPIR}}^{(\mathsf{m})}$ by the error measure, the server secrecy measure, and the user secrecy measure. The error measure is defined by

[TABLE]

where $P_{\mathrm{err}}(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})$ is the average error probability of the protocol. The server and user secrecy measures $\beta(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})$ and $\gamma(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})$ are defined respectively as

[TABLE]

where $Q_{t}^{\prime}$ is the collection of queries to all servers other than $\mathtt{serv}_{t}$. If these measures are zero, the protocol $\Psi_{\mathrm{QPIR}}^{(\mathsf{m})}$ is called a $(\mathsf{n}-1)$-private QSPIR protocol, and if $\alpha(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=\gamma(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$, it is called a $(\mathsf{n}-1)$-private QPIR protocol.

II-B2 $(\mathsf{n}-1)$-private QPIR Capacity

The $(\mathsf{n}-1)$-private QPIR capacity is defined with the security and upload constraints. For any $\alpha$, $\beta$, $\gamma$, $\theta\geq 0$, the asymptotic and exact security-constrained $(\mathsf{n}-1)$-private QPIR capacities are defined by

[TABLE]

where the supremum is taken for sequences $\{\mathsf{m}_{\ell}\}_{\ell=1}^{\infty}$ such that $\lim_{\ell\to\infty}\mathsf{m}_{\ell}=\infty$ and sequences $\{\Psi_{\mathrm{QPIR}}^{(\mathsf{m}_{\ell})}\}_{\ell=1}^{\infty}$ of QPIR protocols to satisfy either (3) or (4) given by

[TABLE]

and

[TABLE]

The parameters $\alpha,\beta,\gamma,\theta$ are the upper bounds of the error, server secrecy, user secrecy, and upload cost, respectively, and the two capacities $C_{\mathrm{asymp}}^{\alpha,\beta,\gamma,\theta}$, $C_{\mathrm{exact}}^{\alpha,\beta,\gamma,\theta}$ are defined as the supremum of QPIR rates for all QPIR protocols satisfying the upper bounds asymptotically and exactly, respectively. Since any protocols satisfying the upper bounds $\alpha,\beta,\gamma,\theta$ exactly also satisfy the bounds asymptotically, we have the inequality $C_{\mathrm{asymp}}^{\alpha,\beta,\gamma,\theta}\geq C_{\mathrm{exact}}^{\alpha,\beta,\gamma,\theta}\geq C_{\mathrm{exact}}^{0,0,0,0}$.

II-C Main Results

Two main theorems of the paper are as follows.

Theorem II.1**.**

For any $\mathsf{n}\geq 2$ servers and $\mathsf{f}\geq 2$ files, there exists a $(\mathsf{n}-1)$-private QSPIR protocol with the rate $\left\lceil\mathsf{n}/2\right\rceil^{-1}$, zero security measures, $\mathsf{n}\mathsf{f}$-bit upload cost, and $2\ell$-bit files for any integer $\ell\geq 1$.

Section IV constructs the protocol that achieves the performance given in Theorem II.1. When $\mathsf{n}=2$, the protocol in Section IV corresponds to the protocol in [27].

Theorem II.2** (Capacity of $(\mathsf{n}-1)$-private QPIR).**

For any $\mathsf{n}\geq 2$ servers and $\mathsf{f}\geq 2$ files, the $(\mathsf{n}-1)$-private QPIR capacity satisfies

[TABLE]

for any $\alpha\in[0,1)$ and $\beta,\gamma,\theta\geq 0$.

The last inequality in (5) follows from Theorem II.1 and the inequality (6) will be proved in Section V. From Theorem II.2, we obtain the following corollary.

Corollary II.1**.**

For any even number of servers $\mathsf{n}$ and any number of files $\mathsf{f}\geq 2$, the $(\mathsf{n}-1)$-private QSPIR capacity is $2/\mathsf{n}$.

III Preliminaries for Protocol Construction

In this section, we prepare two simple protocols to describe our $(\mathsf{n}-1)$-private QSPIR protocol.

III-A Preliminaries on States, Operations, and Measurements

A qubit $\operatorname{{\mathcal{A}}}$ is a two-dimensional complex Hilbert space spanned by an orthonormal basis $\{|0\rangle,|1\rangle\}$. Define the maximally entangled state $|\Phi\rangle$ on two qubits $\operatorname{{\mathcal{A}}}\otimes\operatorname{{\mathcal{A}}}$ by

[TABLE]

For any $a,b\in\mathbb{Z}_{2}$, define Pauli operations on $\operatorname{{\mathcal{A}}}\otimes\operatorname{{\mathcal{A}}}$ by

[TABLE]

It can be easily checked that these operations satisfy the relations

[TABLE]

Applying (9) twice, we also have

[TABLE]

For any matrix $\mathsf{T}=\sum_{i,j=0}^{1}t_{ij}|i\rangle\langle j|$ on $\operatorname{{\mathcal{A}}}$, we define the vector $|\mathsf{T}\rangle$ in $\operatorname{{\mathcal{A}}}\otimes\operatorname{{\mathcal{A}}}$ by

[TABLE]

With this notation, the maximally entangled state is written as $|\Phi\rangle=(1/\sqrt{2})|\mathsf{I}\rangle$. Since $\mathsf{T}^{\top}=\sum_{i,j=0}^{1}t_{ij}|j\rangle\langle i|$, it holds $|\mathsf{T}\rangle=(\mathsf{T}\otimes\mathsf{I})|\mathsf{I}\rangle=(\mathsf{I}\otimes\mathsf{T}^{\top})|\mathsf{I}\rangle$. Moreover, for any unitaries $\mathsf{U},\mathsf{V}$ on $\operatorname{{\mathcal{A}}}$,

[TABLE]

For the maximally entangled state $|\Phi\rangle$ on $\operatorname{{\mathcal{A}}}\otimes\operatorname{{\mathcal{A}}}$, the Pauli operation $\mathsf{W}(a,b)$ on the first (second) qubit can be translated to the operation $\mathsf{W}(a,b)$ on the second (first) qubit because

[TABLE]

The following proposition is a case of [27, Proposition III.1] for qubits.

Proposition III.1**.**

The set

[TABLE]

is an orthonormal basis of $\operatorname{{\mathcal{A}}}\otimes\operatorname{{\mathcal{A}}}$.

From Proposition III.1, we can define the projection-valued measure (PVM)

[TABLE]

where $M_{(a,b)}\coloneqq(\mathsf{I}\otimes\mathsf{W}(a,b))|\Phi\rangle\langle\Phi|(\mathsf{I}\otimes\mathsf{W}(a,b)^{\dagger})$.

III-B Quantum Teleportation with an Operation

First, we give a modified version of the quantum teleportation protocol [31], where an operation $\mathsf{W}(c,d)$ is performed on $\operatorname{{\mathcal{A}}}_{3}$ before the quantum teleportation protocol starts.

Protocol III.1**.**

*Suppose that Alice possesses two qubits $\operatorname{{\mathcal{A}}}_{1}$ and $\operatorname{{\mathcal{A}}}_{2}$, Bob possesses a qubit $\operatorname{{\mathcal{A}}}_{3}$. The state on $\operatorname{{\mathcal{A}}}_{1}$ is $\rho$ and Alice and Bob share $|\Phi\rangle\in\operatorname{{\mathcal{A}}}_{2}\otimes\operatorname{{\mathcal{A}}}_{3}$. Quantum teleportation protocol with an operation is given as follows. *

1. Step 1

Bob applies the unitary operation $\mathsf{W}(c,d)$ on $\operatorname{{\mathcal{A}}}_{3}$. 2. Step 2

Alice applies PVM $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$ and sends the measurement outcome $(a,b)$ to Bob. 3. Step 3

Bob applies the unitary $\mathsf{W}(a,b)$ on $\operatorname{{\mathcal{A}}}_{3}$.

The resultant state on $\operatorname{{\mathcal{A}}}_{3}$ is $\mathsf{W}(c,d)\rho\mathsf{W}(c,d)^{\dagger}$ and it preserves the entanglement. Note that Protocol III.1 requires two-bit transmission from Alice to Bob. The protocol without Step 1 in Protocol III.1 is the quantum teleportation protocol [31].

III-B1 Analysis of Protocol III.1

We show that the resultant state on $\operatorname{{\mathcal{A}}}_{3}$ is $\mathsf{W}(c,d)\rho\mathsf{W}(c,d)^{\dagger}$ and it preserves the entanglement (see Fig. 2).

Let $\operatorname{{\mathcal{A}}}_{0}$ be a qubit and $|y\rangle=\sum_{i,j=0}^{1}y_{ij}|i,j\rangle\in\operatorname{{\mathcal{A}}}_{0}\otimes\operatorname{{\mathcal{A}}}_{1}$ be a purification of the state $\rho$. Before the protocol starts, the state on $\operatorname{{\mathcal{A}}}_{0}\otimes\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}\otimes\operatorname{{\mathcal{A}}}_{3}$ is

[TABLE]

If the measurement outcome is $(a,b)$ in Step 2, the state on $\operatorname{{\mathcal{A}}}_{0}\otimes\operatorname{{\mathcal{A}}}_{3}$ at the end of Step 2 is

[TABLE]

where the multiplicand $2$ in (17) is the normalizing multiplicand, (18) is from (8), and (19) is from (9). At the end of Step 3, the state on $\operatorname{{\mathcal{A}}}_{0}\otimes\operatorname{{\mathcal{A}}}_{3}$ is

[TABLE]

where (20) is from (10) and (21) is from (9). Eq. (22) is an identical state to $(\mathsf{I}_{\operatorname{{\mathcal{A}}}_{0}}\otimes\mathsf{W}(c,d))|y\rangle$. Therefore, the resultant state on $\operatorname{{\mathcal{A}}}_{3}$ is $\mathsf{W}(c,d)\rho\mathsf{W}(c,d)^{\dagger}$ and it preserves the entanglement.

Remark III.1**.**

Even in case that the order of Step 1 and Step 2 is reversed, the state before and after the operation $\mathsf{W}(a,b)$ is identical to (19) and (22).

III-C Two-Sum Transmission Protocol

Consider there are three parties Alice, Bob, and Carol. By the following protocol, Carol receives the sum of Alice’s information $(a,b)\in\mathbb{Z}_{2}^{2}$ and Bob’s information $(c,d)\in\mathbb{Z}_{2}^{2}$.

Protocol III.2**.**

Suppose that the joint state of two qubits $\operatorname{{\mathcal{A}}}_{1}$ and $\operatorname{{\mathcal{A}}}_{2}$ is the maximally entangled state $|\Phi\rangle$ and Alice and Bob possess $\operatorname{{\mathcal{A}}}_{1}$ and $\operatorname{{\mathcal{A}}}_{2}$, respectively. The two-sum transmission protocol is given as follows.

1. Step 1

Alice and Bob apply ${\mathsf{W}(a,b)}$ on $\operatorname{{\mathcal{A}}}_{1}$ and $\mathsf{W}(c,d)$ on $\operatorname{{\mathcal{A}}}_{2}$, respectively. 2. Step 2

Alice and Bob send the quantum systems $\operatorname{{\mathcal{A}}}_{1}$ and $\operatorname{{\mathcal{A}}}_{2}$ to Carol, respectively. 3. Step 3

Carol performs the PVM $\mathbf{M}_{\mathbb{Z}_{\ell}^{2}}$ and obtains the measurement outcome $(e,f)$ as the protocol output.

In Protocol III.2, the output $(e,f)$ is $(a+c,b+d)$, which can be proved trivially from (9) and (14). The protocol requires two-qubit transmission each from Alice and Bob.

IV Symmetric QPIR Protocol with $\mathsf{n}-1$ Colluding Servers

In this section, we propose a $(\mathsf{n}-1)$-private QSPIR protocol that achieves the performance given in Theorem II.1 for any $\mathsf{n}\geq 2$ servers. In our protocol, each server contains the following file set. Given two arbitrary integers $\ell\geq 1$ and $\mathsf{f}\geq 2$, the file set is given by the collection of $2\ell$-bit files $W_{1},\ldots,W_{\mathsf{f}}\in\mathbb{Z}_{2}^{2\ell}$. Each file $W_{i}$ is denoted by

[TABLE]

Section IV-A presents our $(\mathsf{n}-1)$-private QSPIR protocol with three servers ($\mathsf{n}=3$) and $\ell=1$ as the simplest case. Then, by using Protocol III.2 and the idea of the protocol in Section IV-A, Section IV-B presents our protocol for any $\mathsf{n}$ servers and any $\ell$.

IV-A Construction of Protocol for $\mathsf{n}=3$ and $\ell=1$

IV-A1 Protocol

Our protocol for three servers each containing the file set $W_{1},\ldots,W_{\mathsf{f}}\in\mathbb{Z}_{2}^{2}$ is described as follows (see Fig. 3).

1. Step 1

The servers $\mathtt{serv}_{1}$, $\mathtt{serv}_{2}$, $\mathtt{serv}_{3}$ possess one qubit $\operatorname{{\mathcal{A}}}_{1}$, two qubits $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}$, $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R}}$, and one qubit $\operatorname{{\mathcal{A}}}_{3}$, respectively. The initial states on both of $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}$ and $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R}}\otimes\operatorname{{\mathcal{A}}}_{3}$ are the maximally entangled state $|\Phi\rangle$. 2. Step 2

Let $K$ be the index of the file to be retrieved. Choose two subsets $Q_{1}$ and $Q_{2}$ of $\{1,\ldots,\mathsf{f}\}$ independently and uniformly at random. Define $Q_{3}$ by

[TABLE]

For each $t\in\{1,2,3\}$, the user sends the query $Q_{t}$ to $\mathtt{serv}_{t}$. 3. Step 3

For each $t\in\{1,2,3\}$, the server $\mathtt{serv}_{t}$ calculates

[TABLE]

The server $\mathtt{serv}_{1}$ ($\mathtt{serv}_{3}$) applies ${\mathsf{W}(H_{1})}$ to $\operatorname{{\mathcal{A}}}_{1}$ ($\mathsf{W}(H_{3})$ to $\operatorname{{\mathcal{A}}}_{3}$) and transmits $\operatorname{{\mathcal{A}}}_{1}$ ($\operatorname{{\mathcal{A}}}_{3}$) to the user. The server $\mathtt{serv}_{2}$ applies $\mathsf{W}(H_{2})$ on $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}$, performs the PVM $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ on $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R}}$, and transmits the measurement outcome $(a,b)\in\mathbb{Z}_{2}^{2}$ to the user. 4. Step 4

The user applies $\mathsf{W}(a,b)$ on $\operatorname{{\mathcal{A}}}_{3}$ and performs the PVM $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{3}$, and the output of the protocol is the measurement outcome $\hat{W}_{K}\in\mathbb{Z}_{2}^{2}$.

IV-A2 Analysis

First, we show the correctness of the protocol. The state of $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R}}\otimes\operatorname{{\mathcal{A}}}_{3}$ before the PVM at Step 3 is

[TABLE]

by (9), where $\phi_{0}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}$ and $H_{2}$. After the PVM at Step 3 with the measurement outcome $(a,b)$, the state on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{3}$ is

[TABLE]

where $\phi_{0}^{\prime},\phi_{0}^{\prime\prime}\in\mathbb{Z}_{2}$ are determined by $(a,b),H_{1},H_{2},H_{3}$. Thus, after the user’s operation at Step 4, the state on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{3}$ is

[TABLE]

(Alternatively, we can also obtain the same result (27) by considering the servers and the user apply Protocol III.1 for $(c,d)\coloneqq H_{3}$ and $|y\rangle\coloneqq({\mathsf{W}(H_{1})}\otimes\mathsf{W}(H_{2}))|\Phi\rangle=(-1)^{\phi_{0}}(\mathsf{I}\otimes\mathsf{W}(H_{1}+H_{2}))|\Phi\rangle$.) Therefore, the user obtains the measurement outcome $\hat{W}_{K}=\sum_{t=1}^{3}H_{t}=W_{K}$, which implies the correctness of our protocol.

The user secrecy follows from the fact that any two of $H_{1},H_{2},H_{3}$ are independent of the query index $K$. The server secrecy is proved as follows. The information the user obtains is the measurement outcome $(a,b)$ and the state (26). The measurement outcome $(a,b)$ is uniformly at random because the state on $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L}}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R}}$ is the completely mixed state before the measurement $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ at Step 3. Since the state (26) only depends on $W_{K}$ and $(a,b)$, which are jointly independent of the files other than $W_{K}$, the user obtains no information of the files other than $W_{K}$.

The upload cost is $\mathsf{n}\mathsf{f}=3\mathsf{f}$ bits because each of $Q_{1},Q_{2},Q_{3}$ is written by $\mathsf{f}$ bits. In the protocol, the user downloads $2$ qubits and $2$ bits but we count the download cost as $4$ qubits since we only count quantum communication in our QPIR model (Section II) and one qubit can convey one bit at most. The file size is $2\ell=2$ bits. Therefore, the QPIR rate is $2/(\mathsf{n}+1)=2/4$.

IV-B Construction of Protocol for $\mathsf{n}$ Servers

In this subsection, we present our protocol for any $\mathsf{n}\geq 2$ servers and any $\ell\geq 1$. The idea of our protocol construction is described as follows. The number of servers $\mathsf{n}$ are generalized to be arbitrary by using the idea of the three-server protocol in Section IV-A. In this generalization, it is necessary for servers to transmit the sum of measurement outcomes to the user, and it is performed efficiently by using the two-sum transmission protocol (Protocol III.2). The index $\ell$ is increased by using the same query repetitively until the protocol retrieves the entire file information.

Our protocol for $\mathsf{n}$ servers is described as follows (see Fig. 4).

IV-B1 Preparation

For each $p\in\{1,\ldots,\ell\}$, prepare the following quantum systems and states. The servers $\mathtt{serv}_{1}$ and $\mathtt{serv}_{\mathsf{n}}$ have qubits $\operatorname{{\mathcal{A}}}_{1}^{(p)}$ and $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$, respectively. For each $t\in\{2,\ldots,\mathsf{n}-1\}$, the server $\mathtt{serv}_{t}$ has three qubits $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{L},(p)}$, $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{R},(p)}$, $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{M},(p)}$. If $\mathsf{n}$ is odd, we consider the server $\mathtt{serv}_{\mathsf{n}-1}$ has only two qubits $\operatorname{{\mathcal{A}}}_{\mathsf{n}-1}^{\mathrm{L},(p)}$, $\operatorname{{\mathcal{A}}}_{\mathsf{n}-1}^{\mathrm{R},(p)}$. The maximally entangled state $|\Phi\rangle$ is shared between each of pairs $(\operatorname{{\mathcal{A}}}_{1},\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L},(p)})$, $(\operatorname{{\mathcal{A}}}_{2}^{\mathrm{R},(p)},\operatorname{{\mathcal{A}}}_{3}^{\mathrm{L},(p)})$, $(\operatorname{{\mathcal{A}}}_{3}^{\mathrm{R},(p)},\operatorname{{\mathcal{A}}}_{4}^{\mathrm{L},(p)})$, … , $(\operatorname{{\mathcal{A}}}_{\mathsf{n}-2}^{\mathrm{R},(p)},\operatorname{{\mathcal{A}}}_{\mathsf{n}-1}^{\mathrm{L},(p)})$, $(\operatorname{{\mathcal{A}}}_{\mathsf{n}-1}^{\mathrm{R},(p)},\operatorname{{\mathcal{A}}}_{\mathsf{n}})$ and $(\operatorname{{\mathcal{A}}}_{2j}^{\mathrm{M},(p)},\operatorname{{\mathcal{A}}}_{2j+1}^{\mathrm{M},(p)})$ for any $j\in\{1,\ldots,\lfloor\mathsf{n}/2\rfloor-1\}$.

IV-B2 Upload Step

Let $K$ be the index of the file to be retrieved. Choose subsets $Q_{1},\ldots,Q_{\mathsf{n}-1}$ of $\{1,\ldots,\mathsf{f}\}$ independently and uniformly at random. Define $Q_{\mathsf{n}}$ by

[TABLE]

The user sends the query $Q_{t}$ to $\mathtt{serv}_{t}$ for each $t\in\{1,\ldots,\mathsf{n}\}$.

IV-B3 Download Step

For each $t\in\{1,\ldots,\mathsf{n}\}$, depending on the query $Q_{t}$, the server $\mathtt{serv}_{t}$ calculates

[TABLE]

Then, for each $p\in\{1,\ldots,\ell\}$, the servers perform the following process.

1. a)

The server $\mathtt{serv}_{1}$ ($\mathtt{serv}_{\mathsf{n}}$) applies ${\mathsf{W}(H_{1}^{(p)})}$ to $\operatorname{{\mathcal{A}}}_{1}$ ($\mathsf{W}(H_{\mathsf{n}}^{(p)})$ to $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$) and transmits $\operatorname{{\mathcal{A}}}_{1}^{(p)}$ ($\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$) to the user. 2. b)

For each $t\in\{2,\ldots,\mathsf{n}-1\}$, the server $\mathtt{serv}_{t}$ applies $\mathsf{W}(H_{t}^{(p)})$ on $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{L},(p)}$ and performs the PVM $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ on $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{L},(p)}\otimes\operatorname{{\mathcal{A}}}_{t}^{\mathrm{R},(p)}$ whose measurement outcome is denoted by $G_{t}^{(p)}\in\mathbb{Z}_{2}^{2}$. 3. c)

For each $j\in\{1,\ldots,\lfloor\mathsf{n}/2\rfloor-1\}$, the servers $\mathtt{serv}_{2j}$ and $\mathtt{serv}_{2j+1}$ transmit the sum $G_{2j}^{(p)}+G_{2j+1}^{(p)}$ to the user by the two-sum transmission protocol (Protocol III.2) with qubits $\operatorname{{\mathcal{A}}}_{2j}^{\mathrm{M},(p)}$ and $\operatorname{{\mathcal{A}}}_{2j+1}^{\mathrm{M},(p)}$. 4. d)

If $\mathsf{n}$ is odd, $\mathtt{serv}_{\mathsf{n}-1}$ transmits $G_{\mathsf{n}-1}^{(p)}\in\mathbb{Z}_{2}^{2}$ to the user.

IV-B4 Retrieval Step

For each $p\in\{1,\ldots,\ell\}$, the user performs the following process.

1. a)

For any $j\in\{1,\ldots,\lfloor\mathsf{n}/2\rfloor-1\}$, the user receives the sum $G_{2j}^{(p)}+G_{2j+1}^{(p)}$ by Download Step c). If $\mathsf{n}$ is odd, the user receives $G_{\mathsf{n}-1}^{(p)}$ additionally. 2. b)

The user applies $\mathsf{W}(\sum_{t=2}^{\mathsf{n}-1}G_{t}^{(p)})$ on $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$. 3. c)

The user performs the PVM $\mathbf{M}_{\mathbb{Z}_{2}^{2}}$ on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ whose measurement outcome is denoted by $\hat{W}_{K}^{(p)}\in\mathbb{Z}_{2}^{2}$.

The protocol output is $\hat{W}_{K}=(\hat{W}_{K}^{(1)},\ldots,\hat{W}_{K}^{(\ell)})\in(\mathbb{Z}_{2}^{2})^{\times\ell}$.

IV-C Analysis of Protocol for $\mathsf{n}$ servers

In this subsection, we prove the correctness and the secrecy of the protocol, and analyze the costs and rate of the protocol.

IV-C1 Correctness

Let $p$ be any element of $\{1,\ldots,\ell\}$. As shown in the next paragraph, at the end of Download Step, the state on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ is

[TABLE]

where $\phi_{\mathsf{n}}^{(p)}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}^{(p)}$, … , $H_{\mathsf{n}}^{(p)}$, $G_{2}^{(p)}$, … , $G_{\mathsf{n}-1}^{(p)}$. Then, at the end of Retrieval Step b), the state on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ is

[TABLE]

where $\widetilde{\phi}_{\mathsf{n}}^{(p)}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}^{(p)}$, … , $H_{\mathsf{n}}^{(p)}$, $G_{2}^{(p)}$, … , $G_{\mathsf{n}-1}^{(p)}$. Thus, at Retrieval Step c), the measurement outcome is $\hat{W}_{K}^{(p)}=\sum_{t=1}^{\mathsf{n}}H_{t}^{(p)}=W_{K}^{(p)}\in\mathbb{Z}_{2}^{2}$. which implies that our protocol correctly retrieves $W_{K}^{(p)}$. Since $W_{K}^{(p)}$ is retrieved correctly for any $p$, the queried file $W_{K}=(W_{K}^{(1)},\ldots,W_{K}^{(\ell)})$ is retrieved correctly.

Now, we prove (29). Since the operations of different servers are applied on different quantum systems, the order of the servers’ operations can be arbitrary. Therefore, in the following, we consider that the servers $\mathtt{serv}_{1},\ldots,\mathtt{serv}_{\mathsf{n}}$ apply the operations sequentially. At the end of the operation of $\mathtt{serv}_{1}$, the state on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{2}^{\mathrm{L},(p)}$ is

[TABLE]

where $\phi_{1}^{(p)}$ is determined depending on $H_{1}^{(p)}$. Suppose that at the end of the operations of $\mathtt{serv}_{k}$ for any $k\in\{1,\ldots,\mathsf{n}-2\}$, the state on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{k+1}^{\mathrm{L},(p)}$ is

[TABLE]

where $\phi_{k}^{(p)}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}^{(p)}$, … , $H_{k}^{(p)}$, $G_{2}^{(p)}$, … , $G_{k}^{(p)}$. Note that the operations of $\mathtt{serv}_{k+1}$ corresponds to the steps 0 and 1 of Protocol III.1 for $|y\rangle\coloneqq|y_{k}\rangle$, $(a,b)\coloneqq G_{k+1}^{(p)}$, and $(c,d)\coloneqq H_{k+1}^{(p)}$. Therefore, after the operations of $\mathtt{serv}_{k+1}$, the state on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{k+2}^{\mathrm{L},(p)}$ is

[TABLE]

where $\phi_{k+1}^{(p)}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}^{(p)}$, … , $H_{k+1}^{(p)}$, $G_{2}^{(p)}$, …, $G_{k}^{(p)}$ and the system $\operatorname{{\mathcal{A}}}_{k+2}^{\mathrm{L},(p)}$ denotes $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ for the case $k=\mathsf{n}-2$. By the mathematical induction, the state on $\operatorname{{\mathcal{A}}}_{1}^{(p)}\otimes\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ after the operations of $\mathtt{serv}_{\mathsf{n}-1}$ is

[TABLE]

and after the operation of $\mathtt{serv}_{\mathsf{n}}$, the state is

[TABLE]

where $\phi_{\mathsf{n}}^{(p)}\in\mathbb{Z}_{2}$ is determined depending on $H_{1}^{(p)}$, … , $H_{\mathsf{n}}^{(p)}$, $G_{2}^{(p)}$, … , $G_{\mathsf{n}-1}^{(p)}$. Thus, we have Eq. (29).

IV-C2 Secrecy

The user secrecy is obtained because the collection of any $\mathsf{n}-1$ variables in $Q_{1},\ldots,Q_{\mathsf{n}}$ is independent of the query index $K$. Next, we consider the server secrecy. The user obtains $W_{K}$ and $G_{2j}^{(p)}+G_{2j+1}^{(p)}$ for any $j\in\{1,\ldots,\lfloor\mathsf{n}/2\rfloor-1\}$ and any $p\in\{1,\ldots,\ell\}$. If $\mathsf{n}$ is odd, the user obtains $G_{\mathsf{n}-1}^{(p)}$ additionally. Note that before the measurement of the qubits possessed by the server $\mathtt{serv}_{t}$ ($t\in\{2,\ldots,\mathsf{n}-1\}$), the states on $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{L},(p)}$ and $\operatorname{{\mathcal{A}}}_{t}^{\mathrm{R},(p)}$ are the completely mixed states, which implies that the measurement outcomes $G_{t}^{(p)}$ for all $t$ are independent of any file. Therefore, the user obtains no file information other than $W_{K}$.

IV-C3 Costs and Rate

The upload cost is $\mathsf{n}\mathsf{f}$ bits because each subset $Q_{1},\ldots,Q_{\mathsf{n}}$ of $\{1,\ldots,\mathsf{f}\}$ is written by $\mathsf{f}$ bits. For each $p\in\{1,\ldots,\ell\}$, the user downloads $\mathsf{n}$ qubits $\operatorname{{\mathcal{A}}}_{1}^{(p)}$, $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{M},(p)}$, … , $\operatorname{{\mathcal{A}}}_{\mathsf{n}-1}^{\mathrm{M},(p)}$, $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ if $\mathsf{n}$ is even, and downloads $\mathsf{n}-1$ qubits $\operatorname{{\mathcal{A}}}_{1}^{(p)}$, $\operatorname{{\mathcal{A}}}_{2}^{\mathrm{M},(p)}$, … , $\operatorname{{\mathcal{A}}}_{\mathsf{n}-2}^{\mathrm{M},(p)}$, $\operatorname{{\mathcal{A}}}_{\mathsf{n}}^{(p)}$ and two bits $G_{\mathsf{n}-1}^{(p)}\in\mathbb{Z}_{2}^{2}$ if $\mathsf{n}$ is odd. Since we only count quantum communication in our QPIR model and one qubit can convey one bit at most, the total download cost is $\mathsf{n}\ell$ qubits when $\mathsf{n}$ is even and $(\mathsf{n}+1)\ell$ qubits when $\mathsf{n}$ is odd. The file size is $2\ell$ bits, i.e., $\mathsf{m}=2^{2\ell}$. Therefore, the QPIR rate is

[TABLE]

Moreover, the sequence $\{\Psi_{\mathrm{QPIR}}^{(\mathsf{m}_{\ell})}\}_{\ell=1}^{\infty}$ of our protocols for $\mathsf{m}_{\ell}\coloneqq 2^{2\ell}$ achieves the negligible upload cost with respect to the download cost, i.e.,

[TABLE]

V Converse

In this section, we prove the converse bound (6)

[TABLE]

for any $\alpha\in[0,1)$, $\theta\geq 0$.

The idea of the converse proof is described as follows. The converse bound (6) is for the case where the QPIR protocol satisfies the user and server secrecy conditions perfectly, i.e., $\beta(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$ and $\gamma(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$. From these perfect secrecies, we prove a lemma that the joint state of colluding servers is independent of the queried file $W_{K}$. Then, using the lemma, the state from colluding servers can be used as shared entanglement between the honest server and the user, i.e., the honest server can communicate at most $2c$ bits to the user by sending $c$ qubits, which follows from the entanglement-assisted classical capacity [38]. Since the user downloads $c\mathsf{n}$ qubits from $\mathsf{n}$ servers, the QPIR rate is upper bounded by $2/\mathsf{n}$, which implies the converse bound (6). Based on this idea, we give the converse proof in the remainder of this section.

First, we prepare the following lemma. Recall that $Q_{t}^{\prime}$ is the collection of queries to all servers other than $\mathtt{serv}_{t}$ for any $t\in\{1,\ldots,\mathsf{n}\}$. We denote by $\operatorname{{\mathcal{A}}}_{t}^{\prime}$ the composite system of all servers other than $\mathtt{serv}_{t}$ and by $d_{t}$ the dimensions of $\operatorname{{\mathcal{A}}}_{t}$.

Lemma V.1**.**

*Suppose that $\beta(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$ and $\gamma(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$. Let $\rho_{t|k}^{\prime}$ be the state on $\operatorname{{\mathcal{A}}}_{t}^{\prime}$ after the server encoder. Then, the relation $I(W_{k};\operatorname{{\mathcal{A}}}_{t}^{\prime})_{\rho_{t|k}^{\prime}}=0$ holds for any $k\in\{1,\ldots,\mathsf{f}\}$ after the application of the server encoder. That is, the state on the system $\operatorname{{\mathcal{A}}}_{t}^{\prime}$ does not depend on the file information $W_{k}$. *

Proof.

Due to the condition (2), the uploaded information $Q_{t}^{\prime}$ is independent of $K$. Since the $\rho_{t|k}^{\prime}$ is determined by $Q_{t}^{\prime}$, we have $\rho_{t|k}^{\prime}=\rho_{t|i}^{\prime}$, which implies that $I(W_{k};\operatorname{{\mathcal{A}}}_{t}^{\prime})_{\rho_{t|k}^{\prime}}=I(W_{k};\operatorname{{\mathcal{A}}}_{t}^{\prime})_{\rho_{t|i}^{\prime}}$ for $i\neq k\in\{1,\ldots,\mathsf{f}\}$. Since server secrecy (Eq.(1)) implies

[TABLE]

we have $I(W_{k};\operatorname{{\mathcal{A}}}_{t}^{\prime})_{\rho_{t|k}^{\prime}}=0$ for any $k\in\{1,\ldots,\mathsf{f}\}$. ∎

We also prepare the following propositions.

Proposition V.1** ([39, (4.66)]).**

Consider $x\in\{0,\ldots,m-1\}$ is encoded to a quantum state $\rho_{x}$ on $\operatorname{{\mathcal{A}}}$ and decoded by a POVM $\mathsf{Y}=\{\mathsf{Y}_{x}\mid x\in\{0,\ldots,m\}\}$ on $\operatorname{{\mathcal{A}}}$, where the measurement outcome $m$ denotes decoding failure. Define the error probability by $\varepsilon\coloneqq 1-(1/m)\sum_{x=0}^{m-1}\operatorname*{\mathrm{Tr}}\rho_{x}\mathsf{Y}_{x}$. Then, for any $\sigma$ on $\operatorname{{\mathcal{A}}}$ and any $r\in(0,1)$, we have

[TABLE]

Proposition V.2** ([39, (5.53)]).**

For any states $\rho$ and $\sigma$, TP-CP map $\kappa$ and $r\in(0,1)$, we have

[TABLE]

Proposition V.3**.**

For a pure state $|\psi\rangle$ in a system $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$, let $\rho_{1}$ be the reduced state of $|\psi\rangle$ on $\operatorname{{\mathcal{A}}}_{1}$ and $d_{\mathrm{min}}=\min\{\dim\operatorname{{\mathcal{A}}}_{1},\dim\operatorname{{\mathcal{A}}}_{2}\}$. For any $s\in(0,1)$, we have

[TABLE]

The proof of Proposition V.3 is given in Appendix B.

Now, we prove the converse bound by three steps with the assumption that $\beta(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$ and $\gamma(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})=0$.

Step 1: In this step, we introduce several notations for simplicity. We denote the queried file, the collection of non-queried $\mathsf{f}-1$ files, the collection of queries by $w$, $w^{c}$, $q$, respectively, and we also denote $z\coloneqq(w^{c},q)$. Then, $\rho_{w,z}$ denotes the quantum state on $\operatorname{{\mathcal{A}}}=\bigotimes_{i=1}^{\mathsf{n}}\operatorname{{\mathcal{A}}}_{i}$. We consider the entire quantum systems $\operatorname{{\mathcal{A}}}$ as a bipartite system $\operatorname{{\mathcal{A}}}=\operatorname{{\mathcal{A}}}_{t}\otimes\operatorname{{\mathcal{A}}}_{t}^{\prime}$. We also denote by $\rho_{z}^{\prime}$ the reduced state of $\rho_{w,z}$ on $\operatorname{{\mathcal{A}}}_{t}^{\prime}$ since the reduced state does not depend on $w$ from Lemma V.1.

Step 2: In this step, we prove the inequality

[TABLE]

Applying Proposition V.1 to the choice

[TABLE]

for any $r\in(0,1)$, we obtain

[TABLE]

where $P_{\mathrm{err},z}(\Psi_{\mathrm{QPIR}}^{(\mathsf{m})})$ is the error probability when $z$ is fixed. By averaging with respect to $z$ and from the convexity of $x^{1+r}$, we have

[TABLE]

for any $t\in\{1,\ldots,\mathsf{n}\}$.

Let $t^{*}=\operatorname*{\arg\!\min}_{t}d_{t}$. We choose orthonormal vectors $\{|\psi_{w,z,x}\rangle\}_{x}$ such that $\rho_{w,z}=\sum_{x}p_{w,z,x}|\psi_{w,z,x}\rangle\langle\psi_{w,z,x}|$ with $\sum_{x}p_{w,z,x}=1$. We denote by $\sigma_{z,x}^{\prime}$ the reduced state of $|\psi_{w,z,x}\rangle\langle\psi_{w,z,x}|$ on $\operatorname{{\mathcal{A}}}_{t^{*}}^{\prime}$, i.e., $\rho_{z}^{\prime}=\sum_{x}p_{w,z,x}\sigma_{z,x}^{\prime}$. With this decomposition, we can upper bound the RHS of (40) as

[TABLE]

Here, Eq. (41) is obtained by applying Proposition V.2 for the choice

[TABLE]

since $\phi(-r|\rho\|\sigma)$ is the RHS of (41) and $\phi(-r|\kappa(\rho)\|\kappa(\sigma))$ is the LHS of (41) from

[TABLE]

Eq. (42) follows from $\operatorname*{\mathrm{Tr}}|\psi_{w,z,x}\rangle\langle\psi_{w,z,x}|=\sigma_{z,x}^{\prime}$. Eq. (43) is obtained by applying Proposition V.3 for $(|\psi\rangle,\rho_{1},s,d_{\mathrm{min}})\coloneqq(|\psi_{w,z,x}\rangle,\sigma_{z,x}^{\prime},1-r,\dim\operatorname{{\mathcal{A}}}_{t^{*}})$. Combining (40) for $t\coloneqq t^{*}$ and (43), we have the desired inequality (37).

Step 3: In this step, we prove the converse bound by contradiction. Suppose that there exists a sequence of QPIR protocols $\{\Psi_{\mathrm{QPIR}}^{(\mathsf{m}_{\ell})}\}_{\ell=1}^{\infty}$ such that

[TABLE]

This inequality is also written as

[TABLE]

which implies

[TABLE]

Furthermore, since

[TABLE]

we have

[TABLE]

Combining (37) and (46), the probability of correctness $1-P_{\mathrm{err}}(\Psi_{\mathrm{QPIR}}^{(\mathsf{m}_{\ell})})$ approaches [math], which contradicts with (44). Thus, any QPIR protocol with asymptotic error probability less than $1$ has QPIR rate at most $2/\mathsf{n}$, which implies (6).

VI Conclusion

We have presented the $(\mathsf{n}-1)$-private QSPIR capacity for even number $\mathsf{n}$ of servers when any $\mathsf{n}-1$ servers collude. We constructed a $(\mathsf{n}-1)$-private QSPIR protocol of rate $\lceil\mathsf{n}/2\rceil^{-1}$, and proved that $\mathsf{n}/2$ is the strong converse bound with the perfect server and user secrecy. Our protocol is constructed by using the quantum teleportation and the two-sum transmission protocol repetitively. The converse bound used the fact that the state of any $\mathsf{n}-1$ servers is independent of the retrieved file, which follows from the perfect secrecy of the server and the user.

Following the conference version of this paper, the paper [29] proved that both symmetric and non-symmetric $\mathsf{t}$-private QPIR capacity $1$ for $\mathsf{t}\leq\mathsf{n}/2$. However, for $\mathsf{t}>\mathsf{n}/2$, the $\mathsf{t}$-private QPIR capacity is derived only for the case where the server secrecy, i.e., leakage to the user, is negligible with respect to the size of files. Thus, it is an open problem to derive the (non-symmetric) $\mathsf{t}$-private QPIR capacity for $\mathsf{t}>\mathsf{n}/2$. For this problem, the converse proof of classical $\mathsf{t}$-private PIR [16] cannot be directly applied because the $\mathsf{t}$-private QPIR capacity for $\mathsf{t}\leq\mathsf{n}/2$ is $1$ and it is already greater than the classical capacity \left(1-\mathsf{t}/\mathsf{n}\right)/\big{(}1-\left(\mathsf{t}/\mathsf{n}\right)^{\mathsf{f}}\big{)} of [16]. Thus, we expect that the $\mathsf{t}$-private QPIR capacity for $\mathsf{t}>\mathsf{n}/2$ is also greater than its classical capacity of [16]. We leave this problem as an open problem.

Acknowledgement

The authors are grateful to Dr. Hsuan-Yin Lin and Dr. Eirik Rosnes for helpful discussions and comments for the comparison of classical PIRs to quantum PIRs [42].

Appendix A Fundamentals of Quantum Information Theory

In this appendix, we briefly introduce basic concepts of the quantum information theory. In the following, we give the mathematical definitions of quantum system, quantum state, quantum measurement, and quantum operation. For the physical motivations of these definitions and more detailed introduction of these definitions, we refer to [41, 39].

A quantum system, or simply system, is an object considered in quantum information theory and it is mathematically defined by a complex Hilbert space $\operatorname{{\mathcal{A}}}$. In this paper, we only consider finite-dimensional Hilbert spaces. A two-dimensional Hilbert space is called a qubit.

The state of a quantum system, also called quantum state, represents the the information in a quantum system. A quantum state of $\operatorname{{\mathcal{A}}}$ is mathematically described by a density matrix $\rho$ defined by a positive-semidefinite matrix on $\operatorname{{\mathcal{A}}}$ such that $\operatorname*{\mathrm{Tr}}\rho=1$. As a special case, the state $\rho=(1/\dim\operatorname{{\mathcal{A}}})\cdot\mathsf{I}_{\operatorname{{\mathcal{A}}}}$ is called the completely mixed state. When a density matrix $\rho$ is a rank-one matrix, we can denote $\rho=|\psi\rangle\langle\psi|$ with a unit vector $|\psi\rangle$ and thus, we sometimes represent the state by the unit vector $|\psi\rangle$, called a pure state. A quantum state is mapped to another state by quantum operations.

For two quantum systems $\operatorname{{\mathcal{A}}}_{1}$ and $\operatorname{{\mathcal{A}}}_{2}$, the composite quantum system is described by $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$. When the state of $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$ is $\rho$, the reduced state on $\operatorname{{\mathcal{A}}}_{1}$ is represented by $\rho_{1}\coloneqq\operatorname*{\mathrm{Tr}}_{\operatorname{{\mathcal{A}}}_{1}}\rho$, where $\operatorname*{\mathrm{Tr}}_{\operatorname{{\mathcal{A}}}_{1}}$ is the partial trace on $\operatorname{{\mathcal{A}}}_{1}$ defined by the unique linear map such that $\operatorname*{\mathrm{Tr}}_{\operatorname{{\mathcal{A}}}_{1}}X\otimes Y=(\operatorname*{\mathrm{Tr}}X)Y$ for any matrices $X$ on $\operatorname{{\mathcal{A}}}_{1}$ and $Y$ on $\operatorname{{\mathcal{A}}}_{2}$. The Schmidt decomposition is the decomposition theorem for any pure state $|\psi\rangle$ on a composite system $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$ as follows.

Proposition A.1** (Schmidt decomposition).**

For any pure state $|\psi\rangle$ on a composite system $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$, there exist orthonormal vectors $\{|x_{i}\rangle\}_{i}$ of $\operatorname{{\mathcal{A}}}_{1}$ and $\{|y_{i}\rangle\}_{i}$ of $\operatorname{{\mathcal{A}}}_{2}$ and a probability distribution $\{p_{i}\}_{i}$ such that $|\psi\rangle=\sum_{i}\sqrt{p_{i}}|x_{i}\rangle\otimes|y_{i}\rangle\in\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$.

A quantum operation is described by a trace-preserving and completely positive (TP-CP) map. A map $\kappa$ from a system $\operatorname{{\mathcal{A}}}$ to a system $\operatorname{{\mathcal{A}}}^{\prime}$ is called a TP-CP map if $\kappa$ is linear, $\operatorname*{\mathrm{Tr}}\kappa(\rho)=\rho$ for any state $\rho$ on $\operatorname{{\mathcal{A}}}$, and $\kappa\otimes\iota_{\mathbb{C}^{d}}(\rho)$ is a positive-semidefinite matrix for any state $\rho$ on $\operatorname{{\mathcal{A}}}\otimes\mathbb{C}^{d}$, where $\iota_{\mathbb{C}^{d}}$ is the identity map on the system $\mathbb{C}^{d}$. The simplest example of a TP-CP map is a unitary map $\rho\mapsto U\rho U^{\dagger}$ for a unitary matrix $U$. When a unitary map of a unitary matrix $U$ is applied to the system with pure state $|\psi\rangle$, the resultant state is the pure state $U|\psi\rangle$.

Classical information is extracted from a system $\operatorname{{\mathcal{A}}}$ by a quantum measurement. A quantum measurement on a system $\operatorname{{\mathcal{A}}}$ is described by a positive-operator valued measure (POVM). A POVM on $\operatorname{{\mathcal{A}}}$ is a set $\mathsf{Y}=\{\mathsf{Y}_{i}\mid i\in\mathcal{I}\}$ of positive-semidefinite matrices on $\operatorname{{\mathcal{A}}}$ such that $\mathsf{Y}_{i}=\mathsf{I}_{\operatorname{{\mathcal{A}}}}$. When the POVM measurement $\mathsf{Y}$ is performed on the system $\operatorname{{\mathcal{A}}}$ with state $\rho$, the measurement outcome $i\in\mathcal{I}$ is obtained with probability $\operatorname*{\mathrm{Tr}}\rho\mathsf{Y}_{i}\in[0,1]$. If all elements of POVM are projections, i.e., $\mathsf{Y}_{i}^{2}=\mathsf{Y}_{i}$ and $\mathsf{Y}_{i}^{\dagger}=\mathsf{Y}_{i}$, the POVM is also called a projection-valued measure (PVM). Sometimes an orthonormal basis $\{|e_{i}\rangle\}_{i}$ of $\operatorname{{\mathcal{A}}}$ is considered as a PVM $\{|e_{i}\rangle\langle e_{i}|\}_{i}$.

Appendix B Proof of Proposition V.3

By the Schmidt decomposition (Proposition A.1), the pure state $|\psi\rangle$ on $\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$ is decomposed as $|\psi\rangle=\sum_{i}\sqrt{p_{i}}|x_{i}\rangle\otimes|y_{i}\rangle\in\operatorname{{\mathcal{A}}}_{1}\otimes\operatorname{{\mathcal{A}}}_{2}$ for some orthonormal vectors $\{|x_{i}\rangle\}_{i}$ of $\operatorname{{\mathcal{A}}}_{1}$ and $\{|y_{i}\rangle\}_{i}$ of $\operatorname{{\mathcal{A}}}_{2}$ and some probability distribution $\{p_{i}\}_{i}$. Thus, the reduced states $\rho_{1}=\sum_{i}p_{i}|x_{i}\rangle\langle x_{i}|$ on $\operatorname{{\mathcal{A}}}_{1}$ and $\rho_{2}=\sum_{i}p_{i}|y_{i}\rangle\langle y_{i}|$ on $\operatorname{{\mathcal{A}}}_{2}$ have the same rank and therefore, $\operatorname*{\mathrm{rank}}\rho_{1}\leq\min\{\dim\operatorname{{\mathcal{A}}}_{1},\dim\operatorname{{\mathcal{A}}}_{2}\}=d_{\mathrm{min}}$. On the other hand, since the function $x^{s}$ for $s\in(0,1)$ is concave, the LHS of (36) $\operatorname*{\mathrm{Tr}}\rho_{1}^{s}=\sum_{i}p_{i}^{s}$ maximizes if $p_{i}$ have the same value for all $i$, i.e., $\{p_{i}\}_{i}$ is the uniform distribution, by Karamata’s inequality [40]. Thus, we have the desired inequality as

[TABLE]