Fundamental limits of quantum-secure covert communication over bosonic channels

TL;DR

This paper establishes the fundamental limits of quantum-secure covert communication over bosonic channels, deriving the square root law constant and demonstrating optimal modulation schemes for achieving covert capacity.

Contribution

It derives the expression for the square root law constant in bosonic channels and proves the optimality of QPSK modulation for covert communication.

Findings

The square root law governs covert communication over bosonic channels.

QPSK modulation achieves the optimal covert capacity constant.

BPSK is sub-optimal for covert communication despite being optimal in non-covert scenarios.

Abstract

We investigate the fundamental limit of quantum-secure covert communication over the lossy thermal noise bosonic channel, the quantum-mechanical model underlying many practical channels. We assume that the adversary has unlimited quantum information processing capabilities as well as access to all transmitted photons that do not reach the legitimate receiver. Given existence of noise that is uncontrolled by the adversary, the square root law (SRL) governs covert communication: up to c*sqrt{n} covert bits can be transmitted reliably in n channel uses. Attempting to surpass this limit results in detection with unity probability as n approaches infinity. Here we present the expression for c, characterizing the SRL for the bosonic channel. We also prove that discrete-valued coherent state quadrature phase shift keying (QPSK) constellation achieves the optimal c, which is the same as that achieved by a circularly-symmetric complex-valued Gaussian prior on coherent state amplitude. Finally, while binary phase shift keying (BPSK) achieves the Holevo capacity for non-covert bosonic channels in the low received signal-to-noise ratio regime, we show that it is strictly sub-optimal for covert communication.

Equations

$$M$$

$$c_{\mathrm{cov}}$$

$${\hat{\rho }}_{{\bar{n}}_{\mathrm{B}}}$$

$$t_k=\frac{{\bar{n}}_{\mathrm{B}}^k}{(1+{\bar{n}}_{\mathrm{B}}{)}^{k+1}}$$

$$D\left({\bar{\rho }}_1^{W^n}\Vert {\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}^{\otimes n}\right)$$

$${\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}^{\otimes n}$$

$$D\left({\bar{\rho }}_1^{W^n}\Vert {\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}^{\otimes n}\right)$$

$$=-S\left({\bar{\rho }}_1^{W^n}\right)-\mathrm{Tr}\left[{\bar{\rho }}_1^{W^n}\sum _{k=1}^n\log \left[\frac{1}{\eta {\bar{n}}_{\mathrm{B}}+1}{\left(\frac{\eta {\bar{n}}_{\mathrm{B}}}{\eta {\bar{n}}_{\mathrm{B}}+1}\right)}^{{\hat{N}}_k}\right]\right]$$

$$=-S\left({\bar{\rho }}_1^{W^n}\right)-\mathrm{Tr}\left[{\bar{\rho }}_1^{W^n}n\log \left[\frac{1}{\eta {\bar{n}}_{\mathrm{B}}+1}\right]+\log \left[\frac{\eta {\bar{n}}_{\mathrm{B}}}{\eta {\bar{n}}_{\mathrm{B}}+1}\right]\sum _{k=1}^n{\bar{\rho }}_1^{W^n}{\hat{N}}_k\right]$$

$$=-S\left({\bar{\rho }}_1^{W^n}\right)+n\log [\eta {\bar{n}}_{\mathrm{B}}+1]-n[(1-\eta ){\bar{n}}_{\mathrm{S}}+\eta {\bar{n}}_{\mathrm{B}}]\log \left[\frac{\eta {\bar{n}}_{\mathrm{B}}}{\eta {\bar{n}}_{\mathrm{B}}+1}\right],$$

$$S\left({\bar{\rho }}_1^{W^n}\right)$$

$$D\left({\bar{\rho }}_1^{W^n}\Vert {\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}^{\otimes n}\right)$$

$$\displaystyle\phantom{\geq n\bigg{(}\bigg{.}}-\left.(1+(1-\eta)\bar{n}_{\rm S}+\eta\bar{n}_{\rm B})\log\left[1+\frac{(1-\eta)\bar{n}_{\rm S}}{1+\eta\bar{n}_{\rm B}}\right]\right).$$

$$D\left({\bar{\rho }}_1^{W^n}\Vert {\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}^{\otimes n}\right)$$

$${\hat{\rho }}_{{\bar{n}}_{\mathrm{B}}}(a)$$

$$D\left({\hat{\rho }}_{1,L}^{W^n}\Vert {\hat{\rho }}_0^{W^n}\right)$$

$$D\left({\hat{\rho }}_{1,L}^W\Vert {\hat{\rho }}_{\eta {\bar{n}}_{\mathrm{B}}}\right)\le \frac{{\delta }_{\mathrm{QRE}}}{n}.$$

$$\frac{\mathrm{d}{\hat{\rho }}_{00}}{\mathrm{d}u}$$

$$\frac{\mathrm{d}{\hat{\rho }}_{01}}{\mathrm{d}u}$$

$$\frac{\mathrm{d}{\hat{\rho }}_{10}}{\mathrm{d}u}$$

$$\frac{\mathrm{d}{\hat{\rho }}_{11}}{\mathrm{d}u}$$

$$\displaystyle\frac{\mathrm{d}\hat{\rho}_{1,\rm{q}}}{{\mathrm{d}}u}\big{\rvert}_{u=0}$$

$$\displaystyle\frac{\mathrm{d}^{2}\hat{\rho}_{1,\rm{q}}}{{\mathrm{d}}u^{2}}\big{\rvert}_{u=0}$$

$$\displaystyle\frac{\mathrm{d}^{4}\hat{\rho}_{1,\rm{q}}}{{\mathrm{d}}u^{4}}\big{\rvert}_{u=0}$$

$$\frac{\mathrm{d}{\hat{K}}_{\mathrm{q}}}{\mathrm{d}u}$$

$${\frac{\mathrm{d}{\hat{K}}_{\mathrm{q}}}{\mathrm{d}u}|}_{u=0}$$

$$={\hat{\rho }}_0{\int }_0^1\mathrm{d}s{\hat{\sigma }}_0^{-1}(s){\frac{\mathrm{d}{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}u}|}_{u=0}{\hat{\sigma }}_0^{-1}(s),$$

$$\frac{{\mathrm{d}}^2{\hat{K}}_{\mathrm{q}}}{\mathrm{d}{u}^2}$$

$$+{\hat{\rho }}_{1,\mathrm{q}}{\int }_0^1\mathrm{d}s{\hat{\sigma }}_1^{-1}(s)\frac{{\mathrm{d}}^2{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}{u}^2}{\hat{\sigma }}_1^{-1}(s)+\frac{{\mathrm{d}}^2{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}{u}^2}\log {\hat{\rho }}_{1,\mathrm{q}}-\frac{{\mathrm{d}}^2{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}{u}^2}\log {\hat{\rho }}_0.$$

$${\frac{{\mathrm{d}}^2{\hat{K}}_{\mathrm{q}}}{\mathrm{d}{u}^2}|}_{u=0}$$

$$\displaystyle\frac{\mathrm{d}^{2}\hat{K}_{\rm{q}}(u)}{\mathrm{d}u^{2}}\bigg{\rvert}_{u=0}$$

$${\hat{\sigma }}_0^{-1}(s)$$

$${\int }_0^1\mathrm{d}s{\hat{\sigma }}_0^{-1}(s){\hat{\rho }}_0{\hat{\sigma }}_0^{-1}(s)$$

$${\int }_0^1\mathrm{d}s{\hat{\sigma }}_0^{-1}(s)\hat{a}{\hat{\rho }}_0{\hat{a}}^{†}{\hat{\sigma }}_0^{-1}(s)$$

$$=\frac{{\bar{n}}_{\mathrm{T}}}{1+{\bar{n}}_{\mathrm{T}}}\sum _{k=0}^{\infty }(k+1)|k⟩⟨n|,$$

$$\frac{{\mathrm{d}}^3{\hat{K}}_{\mathrm{q}}}{\mathrm{d}{u}^3}$$

$$+3\frac{\mathrm{d}{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}u}{\int }_0^1\mathrm{d}s{\hat{\sigma }}_1^{-1}(s)\frac{{\mathrm{d}}^2{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}{u}^2}{\hat{\sigma }}_1^{-1}(s)-3{\hat{\rho }}_{1,\mathrm{q}}{\int }_0^{1}s\mathrm{d}s{\hat{\sigma }}_1^{-1}(s)\frac{{\mathrm{d}}^2{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}{u}^2}{\hat{\sigma }}_1^{-1}(s)\frac{\mathrm{d}{\hat{\rho }}_{1,\mathrm{q}}}{\mathrm{d}u}{\hat{\sigma }}_1^{-1}(s)$$

Full text

I Introduction

Covert, or low probability of detection/intercept (LPD/LPI), communication prevents transmission’s detection by an adversary. This is a stricter security requirement than protection of transmission’s content from unauthorized access provided by the standard methods, e.g., encryption and quantum key distribution (QKD). While covert communication has many practical applications, its fundamental limits were underexplored until [1, 2] proved that square root law (SRL) governs covert communication over additive white Gaussian noise (AWGN) channel: no more than $c\sqrt{n}$ covert bits can be transmitted with arbitrarily small decoding error probability to the intended receiver in $n$ uses of the channel, where $c$ is a constant and $n=TW$ is the product of the transmission duration $T$ (in seconds) and the bandwidth $W$ (in Hz) of the source around its center frequency. Attempting to transmit more results in either detection by the adversary with high probability as $n\rightarrow\infty$, or unreliable transmission. Even though the capacity of the covert channel is zero (since $\lim_{n\rightarrow\infty}\frac{c\sqrt{n}}{n}=0$), as $n$ increases, SRL allows transmission of a significant number of covert bits for large $n$. Subsequent work extended [1, 2] by characterizing $c$ [3, 4], showing the SRL for discrete memoryless channels (DMCs) [5, 3, 4], and determining it up to the second order [6]. A tutorial explanation of the SRL and its implications is offered in [7]. Consider an optical channel with additive thermal noise. The use of laser light modulation at the transmitter and coherent detection (homodyne or heterodyne) at the receiver induces an AWGN channel, with covert communication governed by the SRL in [1, 2]. Fundamentally, however, electromagnetic waves are quantum mechanical: they are boson fields. Currently, noises of quantum-mechanical origin limit the performance of advanced high-sensitivity photodetection systems [8, 9, 10]. Therefore, analysis of the ultimate limits of any communications system requires quantum information theory [11]. This led to the development of the SRL for covert communication over the lossy thermal noise bosonic channel, which is the underlying quantum-mechanical description of many practical channels, including optical, microwave, and radio-frequency (RF) [12].

The single-mode bosonic channel, depicted in Fig. 1 and formally defined in Section II-A, is parametrized by the power coupling (transmissivity) $\eta$ between the transmitter Alice and the intended receiver Bob, and the mean photon number $\bar{n}_{\rm B}$ per mode injected by the environment, where a single spatial-temporal-polarization mode is our fundamental transmission unit. In our analysis (as in [12]) we do not assume a specific receiver structure for the adversary Willie. Willie has access to all transmitted photons that are not captured by Bob, on which he can perform arbitrary quantum information processing, including joint detection measurement, and use of unlimited quantum memory and computing resources. This makes our system quantum-secure. Furthermore, we assume that Willie has knowledge of all communication system details (including the start time, center frequency, duration, and bandwidth of the transmission), except for a secret shared between Alice and Bob before communication begins. We use this secret to enable covertness irrespective of channel conditions111While this assumption seems onerous, in many scenarios the cost of having transmission detected greatly exceeds that of sharing a secret. Furthermore, classical results [5, 3] suggest that the secret is unnecessary if Alice has a better channel to Bob than to Willie, however, ensuring this in practice may be harder than exchanging a secret. and note that this meets the “best practices” of secure system design as the security of the system only depends on the shared secret [13]. Finally, we assume existence of noise that is not under Willie’s control. Not only is this well-grounded, but also is necessary for covertness, as otherwise, transmissions cannot be hidden [12, Th. 1]. We use standard asymptotic notation [14, Ch. 3.1], where $f(n)=\mathcal{O}(g(n))$ and $f(n)=o(h(n))$ denote $g(n)$ and $h(n)$ as asymptotically tight and loose upper bounds on $f(n)$, respectively. The SRL implies that the number $M$ of reliably transmissible covert bits using $n$ modes is:

[TABLE]

where $\delta$ parametrizes the desired level of covertness (formally defined in Section II-B), $c_{\rm cov}$ characterizes the mean transmitted photon number per mode $\bar{n}_{\rm S}=\delta c_{\rm cov}/\sqrt{n}$ that is covert given both the channel and the modulation scheme, while $c_{\rm rel}$ captures the amount of information that can be transmitted reliably (i.e., with arbitrarily small decoding error probability) by encoding it in $\bar{n}_{\rm S}$ photons/mode. Our main focus is $c_{\rm cov}$, which determines the number of covertly-transmissible photons. We show that the optimal $c_{\rm cov}$ is:

[TABLE]

and note that $c_{\rm cov}$ does not depend on Bob’s receiver. We then prove that it is achievable using quadrature phase shift keying (QPSK) modulation over coherent states (which describe ideal laser light quantum-mechanically). Since binary phase shift keying (BPSK) is known to achieve the Holevo capacity of (non-covert) communication over lossy thermal noise bosonic channel in the low received signal-to-noise ratio (SNR) regime [15], we evaluate its covertness properties. We find that it is strictly suboptimal to QPSK, which further underscores the differences between covert and non-covert communications. However, the optimality of QPSK modulation leads to exact characterization of the optimal coding strategy and $c_{\rm rel}$. We show how QPSK is combined with any channel code while maintaining covertness and describe how optimal $c_{\rm rel}$ is achieved in expectation. We also discuss a promising approach to solving the general coding problem for covert communications over bosonic channels, leaving the full treatment to future work. The work presented in this paper allows construction of communications systems for many practical channels (including optical, microwave, RF, and others) that are provably covert against the most powerful adversaries allowed by the laws of physics. As such, these systems are future-proof. Our results also have far-reaching implications beyond covert communication. At the heart of our proof lies a new result on quantum state discrimination of a discrete set of displaced thermal states, which would lead to fundamental insights into optical state discrimination in loss and noise. This has applications to optical communications and sensing, as well as structured designs for optimal receivers for these tasks—a topic wide open for future research. This paper is organized as follows: next we present formally the lossy thermal noise bosonic channel model and the mathematical criteria for covertness. In Section III we prove the converse by showing that our covertness criterion does not allow $c_{\rm cov}$ to exceed the right hand side (RHS) of (2). In Section IV we investigate discrete coherent state constellations, focusing on QPSK and BPSK, and show that QPSK achieves the RHS of (2) while BPSK does not. In Section V we discuss the characterization of $c_{\rm rel}$ and the coding strategies for covert communication.

II Prerequisites

II-A Channel model

Consider a single mode lossy thermal noise channel ${\cal E}_{\eta}^{\bar{n}_{\rm B}}$ in Fig. 1. This is the quantum mechanical description of the transmission of a single (spatio-temporal-polarization) mode of the electromagnetic field at a given transmission wavelength (such as optical or microwave) over linear loss and additive Gaussian noise (such as noise stemming from blackbody radiation). A beamsplitter with transmissivity (fractional power coupling) $\eta$ models loss. The input-output relationship between the bosonic mode operators of the single-mode Alice-to-Bob channel, ${\hat{b}}=\sqrt{\eta}{\hat{a}}+{\sqrt{1-\eta}}{\hat{e}}$, requires the “environment” mode ${\hat{e}}$ to ensure $\left[{\hat{b}},{\hat{b}}^{\dagger}\right]=1$, and preserve the Heisenberg uncertainty law of quantum mechanics. Contrarily, power attenuation in a classical channel is captured by the relationship $b={\sqrt{\eta}}a$, where $a$ and $b$ are complex amplitudes of input and output mode functions. Bob captures a fraction $\eta$ of Alice’s transmitted photons, while Willie is assumed to have access to the remaining $1-\eta$ fraction. Noise is modeled by mode $\hat{e}$ being in a zero-mean thermal state $\hat{\rho}_{\bar{n}_{\rm B}}$, which is expressed in the coherent state and Fock (photon number) bases as follows:

[TABLE]

where

[TABLE]

and $\bar{n}_{\rm B}$ is the mean photon number per mode injected by the environment.

Our covert communication framework is depicted in Fig. 2. We treat each mode as the fundamental transmission unit and assume that $n=2TW$ modes are available to Alice and Bob. $TW$ is the number of orthogonal temporal modes, which is the product of the transmission duration $T$ (in seconds) and the optical bandwidth $W$ (in Hz) of the source around its center frequency. The factor of two corresponds to the use of both orthogonal polarizations. Alice attempts to communicate reliably to Bob without detection by Willie as depicted. She uses a secret shared with Bob prior to the start of communication. If she decides to transmit message $x$, she modulates an $n$-mode state $\hat{\rho}^{A^{n}}_{x}$ using the shared secret. While we assume that the bosonic channel acts on each input mode independently, $\hat{\rho}^{A^{n}}_{x}$ may be entangled across $n$ modes. Alice and Bob desire reliability: for any $\epsilon>0$, Bob’s decoding error probability $P^{\mathrm{(b)}}_{\rm e}\leq\epsilon$ for $n$ sufficiently large. Bob may employ joint detection (entangling) measurement across $n$ modes. Willie performs a quantum-optimal hypothesis test to determine whether Alice transmitted, which we discuss next.

II-B Hypothesis testing and covertness criteria

As described in Fig. 2, Willie observes a product thermal state $\hat{\rho}^{W^{n}}_{0}=\hat{\rho}_{\eta\bar{n}_{\rm B}}^{\otimes n}$ when Alice does not transmit and some other state $\hat{\rho}^{W^{n}}_{1}$ when she does. Hypothesis $H_{0}$ corresponds to no transmission, and $H_{1}$ to transmission. Willie can err in raising a false alarm or missing Alice’s transmission. We denote Willie’s probability of false alarm by $P_{\mathrm{FA}}=P(\text{choose~{}}H_{1}|H_{0})$ and his probability of missed detection by $P_{\mathrm{MD}}=P(\text{choose~{}}H_{0}|H_{1})$. Assuming equally likely hypotheses $P(H_{0})=P(H_{1})=\frac{1}{2}$, Willie’s detection error probability is $P^{\mathrm{(w)}}_{\rm e}=\frac{P_{\mathrm{FA}}+P_{\mathrm{MD}}}{2}$, which gives rise to the following covertness criterion:

Criterion 1**.**

A system is covert if, for any $\delta_{\rm P}>0$, $P^{\mathrm{(w)}}_{\rm e}\geq\frac{1}{2}-\delta_{\rm P}$ for $n$ large enough.

Subscript “P” refers to “probability of detection error” limit: since random decision results in $P^{\mathrm{(w)}}_{\rm e}=\frac{1}{2}$, small $\delta_{\rm P}$ ensures that any detector that Willie constructs is similarly ineffective. Criterion 1 applies even when the hypotheses are not equally likely [16]. A quantum-optimal receiver yields $\min P^{\rm(w)}_{\rm e}=\frac{1}{2}-\frac{1}{4}\|\hat{\rho}^{W^{n}}_{0}-\hat{\rho}^{W^{n}}_{1}\|_{1}$, where $\|\hat{\rho}-\hat{\sigma}\|_{1}$ is the trace distance between quantum states $\hat{\rho}$ and $\hat{\sigma}$ [11, Section 9.1.4]. Thus, Criterion 1 is satisfied if $\frac{1}{4}\|\hat{\rho}^{W^{n}}_{0}-\hat{\rho}^{W^{n}}_{1}\|_{1}\leq\delta_{\rm P}$. However, quantum relative entropy (QRE) $D(\hat{\rho}\|\hat{\sigma})=\operatorname{Tr}\left[\hat{\rho}\log\hat{\rho}-\hat{\rho}\log\hat{\sigma}\right]$ is a more convenient measure of covertness because it is additive over product states: $D\left(\hat{\rho}_{1}\otimes\hat{\rho}_{2}\|\hat{\sigma}_{1}\otimes\hat{\sigma}_{2}\right)=D\left(\hat{\rho}_{1}\|\hat{\sigma}_{1}\right)+D\left(\hat{\rho}_{2}\|\hat{\sigma}_{2}\right)$. It is related to performance of optimal hypothesis test by the quantum Chernoff-Stein lemma [17] and Pinsker’s inequality $\|\hat{\rho}-\hat{\sigma}\|_{1}\leq\sqrt{2D(\hat{\rho}\|\hat{\sigma})}$ [11, Th. 10.8.1]. Therefore, instead of Criterion 1, in the analysis that follows we use the following:

Criterion 2**.**

A system is covert if, for any $\delta_{\rm QRE}>0$, $D\left(\hat{\rho}^{W^{n}}_{1}\|\hat{\rho}^{W^{n}}_{0}\right)\leq\delta_{\mathrm{QRE}}$ for $n$ large enough.

By Pinsker’s inequality, setting $\delta_{\rm QRE}=2\delta_{\rm P}^{2}$, Alice maintains a slightly higher level of covertness. Classical version of Criterion 2 has been used in covert communication proofs over standard classical channels [4, 3]; we follow the same methodology here, setting $\delta=\sqrt{\delta_{\rm QRE}}$ in (1).

III Ultimate limit of covert communication over bosonic channel

Criterion 2 imposes a constraint on Alice’s transmitted mean photon number per mode $\bar{n}_{\rm S}$:

Theorem 1** (Converse).**

$D\left(\hat{\rho}^{W^{n}}_{1}\|\hat{\rho}^{W^{n}}_{0}\right)\leq\delta_{\mathrm{RE}}$* implies that $\bar{n}_{\rm S}\leq\frac{\sqrt{2\eta\bar{n}_{\rm B}(1+\eta\bar{n}_{\rm B})}}{1-\eta}\sqrt{\frac{\delta_{\rm QRE}}{n}}$.*

Proof:

Alice transmits one of $2^{M}$ equally-likely $M$-bit messages by choosing an element from an arbitrary codebook $\mathcal{C}=\{\hat{\rho}^{A^{n}}_{x},x=1,\ldots,2^{M}\}$, where a state $\hat{\rho}^{A^{n}}_{x}=\left|\psi_{x}\right>^{A^{n}A^{n}}\left<\psi_{x}\right|$ encodes an $M$-bit message $x$, and $\mathcal{C}$ is kept secret from Willie. $\left|\psi_{x}\right>^{A^{n}}=\sum_{\mathbf{m}\in\mathbb{N}_{0}^{n}}a_{\mathbf{m}}(x)\left|\mathbf{m}\right>$ is a general $n$-mode pure state, where $\left|\mathbf{m}\right>\equiv\left|m_{1}\right>\otimes\left|m_{2}\right>\otimes\cdots\otimes\left|m_{n}\right>$ is a tensor product of $n$ Fock states. The mean photon number of an $n$-mode codeword $\hat{\rho}^{A^{n}}_{x}$ is $\bar{N}_{\mathrm{S},n}(x)=\sum_{\mathbf{m}\in\mathbb{N}_{0}^{n}}(\sum_{k=1}^{n}m_{i})|a_{\mathbf{m}}(x)|^{2}$. We limit our analysis to pure input states since, by convexity, using mixed states as inputs can only deteriorate the performance (it is equivalent to transmitting a randomly chosen pure state from an ensemble and discarding the knowledge of that choice). When Alice transmits $\hat{\rho}^{A^{n}}_{x}$, Willie receives a mixed state $\hat{\rho}^{W^{n}}_{x}$ with the mean photon number $(1-\eta)\bar{N}_{\mathrm{S},n}(x)+\eta n\bar{n}_{\rm B}$. Willie does not have the codebook and must run a hypothesis test between a product thermal state $\hat{\rho}^{W^{n}}_{0}=\hat{\rho}_{\eta\bar{n}_{\rm B}}^{\otimes n}$ and a mixed state $\bar{\rho}^{W^{n}}_{1}=\frac{1}{2^{M}}\sum_{x=1}^{2^{M}}\hat{\rho}^{W^{n}}_{x}$. The QRE is:

[TABLE]

where $S(\rho)=-\operatorname{Tr}[\rho\log\rho]$ is the von Neumann entropy. Denote Willie’s photon number operator associated with the $k^{\text{th}}$ mode by $\hat{N}_{k}=\hat{w}_{k}^{\dagger}\hat{w}_{k}$, where $\hat{w}_{k}$ is Willie’s annihilation operator associated with the $k^{\text{th}}$ mode. Since $\hat{N}_{k}$ is diagonal in Fock basis, by the properties of operator exponential,

[TABLE]

Substitution of (6) into (5) yields:

[TABLE]

where (10) is because $\bar{n}_{\rm S}=\frac{1}{n2^{M}}\sum_{x=1}^{2^{M}}\bar{N}_{\mathrm{S},n}(x)$. Now, denote by $\bar{\rho}^{W}_{1,k}$ the state of the $k^{\text{th}}$ mode of $\bar{\rho}^{W^{n}}_{1}$ that is obtained by tracing out the $n-1$ other modes. Let $\bar{n}_{k}$ be the mean photon number of $\bar{\rho}^{W}_{1,k}$. We upper-bound $S\left(\bar{\rho}^{W^{n}}_{1}\right)$ by:

[TABLE]

where (a) follows from the sub-additivity of the von Neumann entropy, (b) is because the maximum von Neumann entropy of a single-mode state with mean photon number constraint $\bar{n}$ is $g(\bar{n})$, where $g(x)=(1+x)\log_{2}(1+x)-x\log_{2}x$ [18], and (c) follows from Jensen’s inequality. Substituting (11) into (10), expanding $g(x)$, and re-arranging terms yields:

[TABLE]

Since $x-\frac{x^{2}}{2}\leq\log(1+x)\leq x-\frac{x^{2}}{2}+\frac{x^{3}}{3}$ for $x\geq 0$, we obtain:

[TABLE]

Discarding low-order terms, and solving (13) for $\bar{n}_{\rm S}$ yields the proof. ∎

The equality (2) is implied by matching upper and lower bounds on $\bar{n}_{\rm S}$ in Theorem 1 and [12, Th. 2], respectively. However, the lower bound in [12, Th. 2] is developed from a random coding argument which uses an isotropic complex-valued Gaussian modulation of coherent states. While such arguments are useful in mathematical proofs, they are a poor choice in practice because of 1) exponential complexity of random codes, 2) unbounded storage required for complex numbers, and, 3) lack of peak power constraint. Discrete modulation of coherent states is not only practical, but also achieves the Holevo capacity for the low received SNR [15]. Discrete constellations also simplify coding: a polar code can be used over a discrete alphabet to achieve the channel capacity afforded by that alphabet. Since covert communication naturally operates in the low SNR regime, we consider the discrete modulation of coherent states next.

IV Discrete modulation for covert communication over bosonic channels

IV-A Construction of transmitted sequence

Consider Alice transmitting an independent and identically distributed (i.i.d.) sequence $\mathbf{a}$ of $n$ symbols drawn from a discrete alphabet $\mathcal{A}=\{a_{l},l=1,\ldots,L,a_{l}\in\mathbb{C}\}$ with probability $p(l)$. This corresponds a transmission using either:

• •

Secret random code: Alice and Bob secretly create a random code that maps $M$-bit input blocks to $n$-symbol codewords from $\mathcal{A}^{n}$ by generating $2^{M}$ codeword sequences $\mathcal{C}=\{\mathbf{c}(x)\}$, $x=1,\ldots,2^{M}$ for messages $\{x\}$ according to $p(\mathbf{c})=\prod_{k=1}^{n}p(c_{k})$ where $p(c_{k}=a_{l})=p(l)$.

• •

Secret random sequence: Before communicating Alice and Bob secretly draw a sequence $\mathbf{r}\in\{1,\ldots,L\}^{n}$ of length $n$ where $p(\mathbf{r})=\prod_{k=1}^{n}p(r_{k})$. Message $x$ is mapped to an $n$-symbol codeword $\mathbf{c}(x)\in\{1,\ldots,L\}^{n}$ using a code that is known to Willie. Alice transmits a sequence from $\mathcal{A}^{n}$ corresponding to $\mathbf{a}=(\mathbf{c}(x)+\mathbf{r})\bmod L$, with element-wise modulo. Bob uses $\mathbf{r}$ to decode (e.g., by adding $\mathbf{r}$ modulo $L$ to the received transmission before decoding).

We consider binary and quadrature shift keying (BPSK and QPSK) modulation with corresponding alphabets $\mathcal{A}_{\rm b}=\{a,-ja\}$ and $\mathcal{A}_{\rm q}=\{a,ja,-a,-ja\}$. Probabilities are $p(a)=p(-a)=\frac{1}{2}$ for BPSK and $p(a)=p(ja)=p(-a)=p(-ja)=\frac{1}{4}$ for QPSK. On each mode, Alice transmits a coherent state with amplitudes corresponding to symbols from either $\mathcal{A}_{\rm b}$ or $\mathcal{A}_{\rm q}$, with the resulting constellations depicted in Fig. 3.

IV-B Willie’s received state

When Alice transmits $\left|a\right>$, Willie receives a displaced thermal state $\hat{\rho}_{\eta\bar{n}_{\rm B}}(\sqrt{1-\eta}a)$, where

[TABLE]

However, Alice’s scheme described in Section IV-A results in Willie observing a mixture $\hat{\rho}^{W}_{1,L}=\sum_{l=1}^{L}p(l)\hat{\rho}_{\eta\bar{n}_{\rm B}}(\sqrt{1-\eta}a_{l})$ of $L$ displaced thermal states in each of $n$ modes. This is because the secret random code has no structure of use to Willie, and the secret random sequence222This scheme resembles an application of a one-time pad that is typically used in cryptography to ensure absolute secrecy [19]. Its use for covert communication is described in [2, Remark after Th. 1.2]. destroys any structure in the public code that could be used by Willie. Note that neither the transmitted codeword from the random codebook nor the random sequence $\mathbf{r}$ can be re-used. Since Alice’s modulated sequence is i.i.d., Willie observes $\hat{\rho}^{W^{n}}_{1,L}=\left(\hat{\rho}^{W}_{1,L}\right)^{\otimes n}$. The QRE is thus:

[TABLE]

Thus, to maintain Criterion 2, Alice must employ a modulation scheme such that

[TABLE]

Next we prove that QPSK constellation achieves the fundamental limit of covert communication over the lossy thermal noise bosonic channel. This is because it allows the transmission of the maximal mean photon number characterized by (2) while maintaining Criterion 2. Since BPSK modulation achieves the Holevo capacity for the low received SNR regime [15], which is natural for covert communication, we analyze the performance of BPSK. We show that it is strictly suboptimal, and that maintaining covertness requires reducing the mean photon number over QPSK, further underscoring the differences between covert and non-covert communications. We conclude this section by showing how to make a constant amplitude QPSK constellation covert, and allow the use of practical channel codes. Before we continue, we state useful lemmas. Suppose $\hat{A}(t)$ and $\hat{B}(t)$ are non-singular operators parametrized by $t$, and $\hat{I}$ is the identity operator. Then the following two lemmas hold:

Lemma 1** ([20, Th. 6]).**

$\frac{\mathrm{d}}{\mathrm{d}t}\log\hat{A}(t)=\int_{0}^{1}\mathrm{d}s\left[s\hat{A}(t)+(1-s)\hat{I}\right]^{-1}\frac{\mathrm{d}\hat{A}(t)}{\mathrm{d}t}\left[s\hat{A}(t)+(1-s)\hat{I}\right]^{-1}$.

Lemma 2** ([20, lemma in Sec. 4]).**

$\frac{\mathrm{d}}{\mathrm{d}t}B^{-1}(t)=-B^{-1}(t)\frac{\mathrm{d}\hat{B}(t)}{\mathrm{d}t}B^{-1}(t)$.

IV-C Quadrature phase shift keying

Theorem 2**.**

*QPSK modulation achieves $\bar{n}_{\rm S}\leq\frac{\sqrt{2\eta\bar{n}_{\rm B}(1+\eta\bar{n}_{\rm B})}}{1-\eta}\sqrt{\frac{\delta_{\rm QRE}}{n}}$ while maintaining

$D\left(\hat{\rho}^{W^{n}}_{1}\|\hat{\rho}^{W^{n}}_{0}\right)=nD\left(\hat{\rho}^{W}_{1,m}\|\hat{\rho}_{\eta\bar{n}_{\rm B}}\right)$.*

Proof:

Consider $\hat{\rho}_{1,\rm{q}}=\frac{1}{4}\left(\hat{\rho}_{00}+\hat{\rho}_{01}+\hat{\rho}_{10}+\hat{\rho}_{11}\right)$, as the equal-weighted mixture of displaced thermal states where $\hat{\rho}_{00}\equiv\hat{\rho}_{\bar{n}_{\rm T}}(u)$, $\hat{\rho}_{01}\equiv\hat{\rho}_{\bar{n}_{\rm T}}(ju)$, $\hat{\rho}_{10}\equiv\hat{\rho}_{\bar{n}_{\rm T}}(-u)$, and $\hat{\rho}_{11}\equiv\hat{\rho}_{\bar{n}_{\rm T}}(-ju)$ with $\hat{\rho}_{\bar{n}_{\rm T}}(\beta)$ defined in (14). Subscript “q” stands for QPSK, since setting $u=\sqrt{1-\eta}b$ and $\bar{n}_{\rm T}=\eta\bar{n}_{\rm B}$ yields $\hat{\rho}_{00}$, $\hat{\rho}_{01}$, $\hat{\rho}_{10}$, and $\hat{\rho}_{11}$ as the displaced thermal states observed by Willie when Alice transmits $\left|b\right>$, $\left|{j}b\right>$, $\left|-b\right>$, and $\left|-{j}b\right>$, respectively, and zero-mean thermal state $\hat{\rho}_{0}\equiv\hat{\rho}_{\bar{n}_{\rm T}}(0)$ when she does not transmit. Thus, setting $\hat{\rho}_{1,m}^{W}=\hat{\rho}_{1,\rm{q}}$ and dropping $W$ from superscript for brevity yields $D\left(\hat{\rho}_{1,\rm{q}}\|\hat{\rho}_{0}\right)$ as the left hand side of (16). There are no known closed form expressions for $D\left(\hat{\rho}_{1,\rm{q}}\|\hat{\rho}_{0}\right)$, therefore, we evaluate its Taylor series expansion. To do so, we must find the first four derivatives of $\hat{\rho}_{1,\rm{q}}$ with respect to displacement $u$, and set $u=0$. The derivatives of $\hat{\rho}_{00}$, $\hat{\rho}_{01}$, $\hat{\rho}_{10}$, and $\hat{\rho}_{11}$ are as follows [21, Ch. VI, Eq. (1.31)]:

[TABLE]

where $\hat{a}^{\dagger}$ and $\hat{a}$ denote Alice’s creation and annihilation operators, respectively. These allow us to differentiate $\hat{\rho}_{1,\rm{q}}$ with respect to displacement $u$. For each, setting $u=0$ yields:

[TABLE]

Denote by $\hat{K}_{\rm{q}}=\hat{\rho}_{1,\rm{q}}\log\hat{\rho}_{1,\rm{q}}-\hat{\rho}_{1,\rm{q}}\log\hat{\rho}_{0}$ the term inside the trace in the definition of QRE $D\left(\hat{\rho}_{1,\rm{q}}\|\hat{\rho}_{0}\right)$. Now, let’s evaluate each term of the Taylor series expansion of $D\left(\hat{\rho}_{1,\rm{q}}\|\hat{\rho}_{0}\right)$.

IV-C1 First term

Using Lemma 1, the first derivative of $\hat{K}_{\rm{q}}$ with respect to $u$ is as follows:

[TABLE]

where $\hat{\sigma}_{1}(s)=s\hat{\rho}_{1,\rm{q}}+(1-s)\hat{I}$. Setting $u=0$ yields:

[TABLE]

where $\hat{\sigma}_{0}(s)=s\hat{\rho}_{0}+(1-s)\hat{I}$. Since $\left.\frac{\mathrm{d}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u}\right|_{u=0}=0$ by (21), $\left.\frac{\mathrm{d}\hat{K}_{\rm{q}}}{\mathrm{d}u}\right|_{u=0}=0$. Thus, \operatorname{Tr}\left[\frac{\mathrm{d}\hat{K}_{\rm{q}}}{\mathrm{d}u}\big{|}_{u=0}\right].

IV-C2 Second term

Using Lemma 2, the second derivative of $\hat{K}_{\rm{q}}$ with respect to $u$ is as follows:

[TABLE]

Setting $u=0$ in (27), discarding terms containing $\left.\frac{\mathrm{d}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u}\right|_{u=0}=0$, and canceling the positive and negative $\left.\frac{\mathrm{d}^{2}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u^{2}}\right|_{u=0}\log\hat{\rho}_{0}$, we have:

[TABLE]

Substitution of (22) into (28) yields the following:

[TABLE]

Now note that $\hat{\sigma}_{0}(s)$ is diagonal in the Fock state basis, implying:

[TABLE]

where we implicitly substitute $\bar{n}_{\rm T}$ for $\bar{n}_{\rm B}$ in (4). Now,

[TABLE]

since $\int_{0}^{1}\mathrm{d}s(sq+(1-s))^{-2}=\frac{1}{q}$ for $q>0$. Here, the traces of the two terms in (29) cancel. Thus, $\operatorname{Tr}\left[\left.\frac{\mathrm{d}^{2}\hat{K}_{\rm{q}}}{\mathrm{d}u^{2}}\right|_{u=0}\right]=0$.

IV-C3 Third term

Again using Lemma 2, the third derivative of $\hat{K}_{\rm{q}}$ with respect to $u$ is:

[TABLE]

Since $\left.\frac{\mathrm{d}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u}\right|_{u=0}=0$ and $\left.\frac{\mathrm{d}^{3}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u^{3}}\right|_{u=0}=0$ by (21), $\left.\frac{\mathrm{d}^{3}\hat{K}_{\rm{q}}}{\mathrm{d}u^{3}}\right|_{u=0}=0$.

IV-C4 Fourth term

We use Lemma 2 once again, however, for brevity we omit writing terms containing $\frac{\mathrm{d}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u}$ and $\frac{\mathrm{d}^{3}\hat{\rho}_{1,\rm{q}}}{\mathrm{d}u^{3}}$, as these are zero operators when $u=0$. Therefore, we have:

[TABLE]

Setting $u=0$ yields:

[TABLE]

Substitution of (22) in the first term of (35) and taking the trace yields:

[TABLE]

The four terms in (36) are evaluated using (31) and (32):

[TABLE]

Summing (37)-(40) yields the first term of (35):

[TABLE]

Substitution of (22) in the second term of (35) and taking the trace yields:

[TABLE]

Since $\int_{0}^{1}s\mathrm{d}s(sq+(1-s))^{-3}=\frac{1}{2q^{2}}$ for $q>0$,

[TABLE]

Thus, the first term of (42) is:

[TABLE]

Using a similar approach, we obtain the other terms:

[TABLE]

Summing (44)-(47) yields the second term of (35):

[TABLE]

Substitution of (23) in the third term of (35) and taking the trace yields a sum of five terms, however, the trace is zero for terms comprised of products of states that are diagonal in Fock basis and have unequal number of creation and annhihilation operators (e.g., $\operatorname{Tr}[\hat{\rho}_{0}\hat{\sigma}_{0}(s)\hat{a}^{2}\hat{\rho}_{0}\hat{\sigma}_{0}(s)]=0$). The terms with a non-zero trace are as follows:

[TABLE]

The first two terms of (49) can be evaluated using (31) and (32):

[TABLE]

Since

[TABLE]

the third term of (49) is:

[TABLE]

Summing (50), (51), and (53) yields the third term of (35):

[TABLE]

Summing (41), (48), and (54) yields the fourth term in the Taylor series $\frac{1}{4!}\frac{\mathrm{d}^{4}\hat{K}_{\rm{q}}}{\mathrm{d}u^{4}}=\frac{1}{2\bar{n}_{\rm T}(1+\bar{n}_{\rm T})}$. Since $u=\sqrt{1-\eta}b$ and $\bar{n}_{\rm T}=\eta\bar{n}_{\rm B}$, we have:

[TABLE]

Combining (55) with (16) (with $\hat{\rho}^{W}_{1,m}$ set to $\hat{\rho}_{1,\rm{q}}$), dropping low order terms, and solving for $\bar{n}_{\rm S}$ yields the proof. ∎

IV-D Binary phase shift keying

While BPSK is known to achieve the Holevo capacity of (non-covert) communication over lossy thermal noise bosonic channel in the low received SNR regime [15], here we argue that it is strictly suboptimal for achieving covertness. We use the definitions of $u$ and $\bar{n}_{\rm T}$ as in Section IV-C. We define $\hat{\rho}_{1,\rm{b}}=\frac{1}{2}(\hat{\rho}_{00}+\hat{\rho}_{10})$, where subscript “b” stands for BPSK. We evaluate the Taylor series expansion as we did for QPSK. The first and third derivatives of $\hat{\rho}_{1,\rm{b}}$ with respect to $u$ evaluated at $u=0$ are zero. The second and fourth derivatives are as follows:

[TABLE]

Here, $\hat{K}_{\rm{b}}=\hat{\rho}_{1,\rm{b}}\log\hat{\rho}_{1,\rm{b}}-\hat{\rho}_{1,\rm{b}}\log\hat{\rho}_{0}$. The first three terms of the Taylor series expansion are zero for the BPSK case as their form is similar to the QPSK ones. Let’s evaluate the fourth term. Using Lemma 2, the fourth derivative of $\hat{K}_{\rm{b}}$ with respect to $u$ evaluated at $u=0$ is:

[TABLE]

When evaluating the trace of (58), we use the fact that $\hat{\sigma}_{0}(s)$ is diagonal in Fock basis, and that the trace is zero for terms comprised of states that are diagonal in Fock basis and unequal numbers of creation and annihilation operators, just as we did in evaluating the trace of the third term of (49). Thus, substitution of (56) in the first term of (58) and taking the trace yields:

[TABLE]

Since $\int_{0}^{1}\mathrm{d}s(sq+(1-s))^{-1}(sr+(1-s))^{-1}=\frac{\log\left(\frac{q}{r}\right)}{q-r}$ for $q,r>0$ and $q\neq r$, we have:

[TABLE]

The second term is obtained similarly to (60). Thus, the first two terms of (59) are:

[TABLE]

Comparing (59) and (36) yields (61) and (62) as the only terms unique to (59) while the rest are shared. Thus, summing (61), (62), and the shared terms in (41) yields the first term of (58):

[TABLE]

Substitution of (56) in the second term of (58) and taking the trace yields:

[TABLE]

Since $\int_{0}^{1}s\mathrm{d}s(sq+(1-s))^{-2}(sr+(1-s))^{-1}=\frac{r-q+u\log\left(\frac{q}{r}\right)}{q(q-r)^{2}}$ for $q,r>0$ and $q\neq r$,

[TABLE]

The second term is evaluated similarly to (65). Thus, the first two terms of (64) are:

[TABLE]

Comparing (64) and (42) yields (66) and (67) as the only terms unique to (64) while the rest are shared. Summing (66), (67), and the shared terms in (48) yields the second term of (58):

[TABLE]

Substitution of (57) in the third term of (58) and taking the trace yields:

[TABLE]

Comparison of (69) and (49) shows that they are equal. Since (54) shows this term to be zero, the third term of (58) is zero. Summing (63) and (68) yields the fourth term in the Taylor series:

[TABLE]

The QRE for BPSK is as follows:

[TABLE]

This is strictly larger than $D\left(\hat{\rho}_{1,q}\|\hat{\rho}_{\eta\bar{n}_{\rm B}}\right)$ in (55). Therefore, to maintain Criterion 2, $\bar{n}_{\rm S}$ must be set strictly less than the optimal value in (2).

IV-E Use of practical transmitters and arbitrary codes

Typical optical transmitters operate at a constant mean photon number per mode $\bar{n}_{\rm S}$, and much of coding theory assumes that $\bar{n}_{\rm S}$ is independent from $n$. However, covertness requires $\bar{n}_{\rm S}$ to decay with $n$. We address this by modifying the construction of the secret random sequence described in Section IV-A. First, Alice and Bob secretly select a subset of modes $\mathcal{S}$ for communication by flipping a random coin $n$ times with probability of heads $\tau$. The $k^{\rm th}$ mode is chosen if the $k^{\rm th}$ flip is heads. They then generate the secret random sequence as described in Section IV-A, and use a public code on the modes in set $\mathcal{S}$ of expected size $E[|\mathcal{S}|]=\tau n$. Let Alice use the coherent state QPSK modulation. Since Willie does not have $\mathcal{S}$, when she transmits, he observes $\hat{\rho}_{1,\tau}=(1-\tau)\hat{\rho}_{0}+\tau\hat{\rho}_{1,\mathrm{q}}$ on each of $n$ modes, with $\hat{\rho}_{0}$ and $\hat{\rho}_{1,\mathrm{q}}$ defined in Section IV-C. Note that $\frac{\mathrm{d}^{n}\hat{\rho}_{1,\tau}}{\mathrm{d}u^{n}}=\tau\frac{\mathrm{d}^{n}\hat{\rho}_{1,\mathrm{q}}}{\mathrm{d}u^{n}}$. Replacing $\left.\frac{\mathrm{d}^{n}\hat{\rho}_{1,\mathrm{q}}}{\mathrm{d}u^{n}}\right|_{u=0}$ with $\left.\frac{\mathrm{d}^{n}\hat{\rho}_{1,\tau}}{\mathrm{d}u^{n}}\right|_{u=0}$ in (34) yields:

[TABLE]

We discard low order terms, fix $\bar{n}_{\rm S}$, and solve for $\tau$ that maintains Criterion 2:

[TABLE]

This method was used in a covert communication experiment described in [12]. When a Holevo-achieving code is used (with a constant $\bar{n}_{\rm S}$) it enables the achievability of the ultimate limit of covert communication over the bosonic channel in expectation, as described in Section V. We also note that it requires $\mathcal{O}(\sqrt{n}\log n)$ bits of shared secret [2, App.]. We conjecture, based on the results for classical channels [3], that at most $\mathcal{O}(\sqrt{n})$ shared secret bits are needed for reliable covert communication under any conditions on Alice’s channels to Bob and Willie. However, the perspective methods to achieve this scaling (e.g., extension of [22] to arbitrary channel conditions) are impractically complex. We offer simplicity and robustness of existing codes at a mere $\log n$ factor increase in shared secret size, which is an acceptable trade-off in many applications given significantly lower power consumption of flash memory vs. computers.

V Coding for covert communication over bosonic channel

Constant $c_{\rm rel}$ determines the number of covert bits that are reliably transmissible over the bosonic channel. Here we provide the lower and upper bounds, show how the latter can be met in expectation, and offer a roadmap to the complete characterization of $c_{\rm rel}$ in the future work. The lower bound $c_{\rm rel}$ is straightforward: restrict Bob to a heterodyne receiver, yielding a classical AWGN channel that is characterized in [23, Eq. 1.3]. We then employ the known results [3, 4] to obtain $c_{\rm rel}\geq\eta((1-\eta)\bar{n}_{\rm B})^{-1}$. For the upper bound, observe that the Holevo capacity of the bosonic channel is additive. Thus, the number of covert bits that can be transmitted reliably over such channel with transmissivity $\eta$ and mean thermal noise photon number $\bar{n}_{\rm B}$ is $M=nB(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$, where $B(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$ is the number of transmissible bits using $\bar{n}_{\rm S}$ photons per mode. The Holevo capacity of the lossy thermal noise bosonic channel upper bounds $B(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})\leq\chi(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$, and has been characterized for non-covert scenarios [24]. Since $\bar{n}_{\rm S}$ is small for large $n$, we can upper-bound $c_{\rm rel}\leq c_{\rm rel,\chi}$ by the first Taylor series term of $\chi(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$ [24, Eq. (10)] expanded at $\bar{n}_{\rm S}=0$: $c_{\rm rel,\chi}=\eta\log\left(1+((1-\eta)\bar{n}_{\rm B})^{-1}\right)$. This bound can be achieved in expectation using the coin flip method described in Section IV-E by setting $\bar{n}_{\rm S}$ to a constant and employing a Holevo capacity achieving code. Holevo–Schumacher–Westmoreland (HSW) theorem [11, Sec. 20.3.1] allows the construction of such code over the subset of modes chosen by the coin flip process since $\bar{n}_{\rm S}$ is constant. A polar code [25, 26] over QPSK constellation achieves the Holevo capacity at low signal to noise ratio (SNR) [15]. Thus $\mathrm{E}[M]=\sqrt{n}\delta c_{\rm cov}c_{\mathrm{rel},\chi}$, with the expectation taken over the binomial random variable $\mathcal{B}(\tau,n)$, where $\tau$ is defined in (73). However, we conjecture that the $c_{\rm rel,\chi}$ is achievable in general. In covert communication $\bar{n}_{\rm S}=\delta c_{\rm cov}/\sqrt{n}$, and this dependence of $\bar{n}_{\rm S}$ on $n$ complicates the application of HSW theorem. Classical results [3, 4] overcome this problem using information spectrum methods and resolvability. The quantum predecessors of these classical methods have been used to strengthen the capacity results for classical-quantum channels [27, 28]. Unfortunately, their use in bosonic channel setting has been limited because of their dependence on the finite dimensionality of the Hilbert space for the output quantum states, while the output of the lossy thermal noise bosonic channel lives in an infinitely-dimensional Hilbert space. That being said, one could conceivably adapt the proofs in [27, 28] to the special case of finite output state constellation, which is indeed what we showed to be optimal under the covertness constraint.

VI Conclusion

Our main objective was to establish the theoretical groundwork necessary for implementation of quantum-secure covert communication over practical channels. Hence we focused on the bosonic channel model, which is the underlying quantum-mechanical description of many significant communication channels (including optical, microwave, and RF). We have characterized the constant $c_{\rm cov}$ in the expression for mean photon number per mode $\bar{n}_{\rm S}=\delta c_{\rm cov}/\sqrt{n}$ in the SRL for the lossy thermal noise bosonic channel by proving the converse that matched a previous achievability result [12, Th. 2]. We proved that coherent state QPSK modulation carries the maximum mean photon number that covertness requirement allows, and showed that it yields optimal covert throughput over the bosonic channel in expectation, provided that QPSK modulation achieves Holevo capacity (which it does at low SNR [15]). While we left the full characterization of covert channel code for future work, we believe that our result opens a clear path to use polar codes for quantum-secure covert communications, as the explicit successive cancellation decoder structure is known for discrete constellations [25, 26]. More importantly, we showed that we can ensure quantum-secure covertness using practical systems that employ constant-amplitude lasers and coherent receivers. There are many avenues for future research. Here we assume that the adversary knows when the transmission may start and end, as well as its center frequency and bandwidth. Asynchronous covert communication lifts these assumptions. It has been shown that the number of reliable covert bits increases substantially in classical AWGN scenario [29, 30]. This result was later extended to discrete memoryless channels (DMCs) [31]. Bosonic channel is a natural setting for further exploration of this topic. While QRE is mathematically convenient, the trace distance carries more operational significance from its direct relationship to the minimum detection error probability. Extension of [6] to quantum systems would enable analysis of covert communication that is quantum-secure under Criterion 1. It might also reveal a path to the evaluation of second-order constants for covert communications over the bosonic channel. Also, the characterization of covert communication over arbitrary quantum channels has been elusive. While the achievability was proven in [32] by extending the techniques of [3] to finite-dimensional memoryless quantum channels (modeled by trace-preserving completely positive maps), the known converse is restricted to product state transmission. Recent result [33] on covert QKD opens a new perspective on this problem. Finally, optical receiver designs for quantum-optimal state discrimination are not known beyond binary pure state discrimination [34]. For discriminating a constellation of size $m>2$, the same physical resources that achieve optimal $m=2$ state discrimination (linear optics, laser local oscillator, photon detector, and electro-optical feedback) do not suffice [35]. For mixed states such as displaced thermal states, the optimal receiver design is not known even for the binary case. We expect a similar quantum resource divide in this case as in the pure state case, and the separation in discriminability between BPSK and QPSK that we showed may lead to new insights into this problem.