Steganography Protocols for Quantum Channels

TL;DR

This paper explores quantum steganography protocols where two parties hide information within quantum channels, considering various cover and cypher tasks, and demonstrates improved methods under less restrictive assumptions.

Contribution

It introduces new quantum steganography schemes for different cover and cypher task combinations, relaxing previous assumptions and enhancing security models.

Findings

Quantum steganography protocols for classical and quantum cover tasks.

Relaxed assumptions on shared keys and cover communication codes.

Enhanced security and concealment in quantum channels.

Abstract

We study several versions of a quantum steganography problem, in which two legitimate parties attempt to conceal a cypher in a quantum cover transmitted over a quantum channel without arising suspicion from a warden who intercepts the cover. In all our models, we assume that the warden has an inaccurate knowledge of the quantum channel and we formulate several variations of the steganography problem depending on the tasks used as the cover and the cypher task. In particular, when the cover task is classical communication, we show that the cypher task can be classical communication or entanglement sharing; when the cover task is entanglement sharing and the main channel is noiseless, we show that the cypher task can be randomness sharing; when the cover task is quantum communication and the main channel is noiseless, we show that the cypher task can be classical communication. In the latter case, our results improve earlier ones by relaxing the need for a shared key between the transmitter and the receiver and hold under milder assumptions on the cover quantum communication code.

Tables

Table 1. TABLE I: ✓ noisy main channel  ✓ noiseless main channel

	CC	ES	QC
CC	✓		✓
CRS		✓
ES	✓

Equations

$${\aleph }^a{\left(X;B\right)}_{\rho }$$

$${\beth }^a{\left(X;B\right)}_{\rho }$$

$$|{\Phi }^{(M)}⟩$$

$${\overline{\Phi }}^{(M)}$$

$$\underset{{\rho }_W\in \mathcal{D}({\mathcal{H}}_W)}{\min }F({\rho }_W,({\mathcal{D}}_{B^n\to W}\circ {\mathcal{N}}_{A\to B}^{\text{scalebox}0.7\otimes }\circ {\mathcal{E}}_{W\to A^n})({\rho }_W))⩾1-ϵ.$$

$$\frac{1}{\overline{M}}\sum _{\overline{w}}\text{tr}\left(|\overline{w}⟩⟨\overline{w}|({\mathcal{D}}_{B^n\to \overline{W}}\circ {\mathcal{N}}_{A\to B}^{\text{scalebox}0.7\otimes }\circ {\mathcal{E}}_{W\to A^n}^{\overline{w}})({\rho }_W)\right)⩾1-ϵ,$$

$$\frac{1}{M}\sum _w⟨w|{\mathcal{D}}_{B^n\to W}\circ {\mathcal{N}}_{A\to B}^{\text{scalebox}0.7\otimes }({\mathrm{tr}}_{\tilde{A}}\left(f(w)\right))|w⟩⩾1-ϵ,$$

$${\Vert \frac{1}{M}\sum _w({\mathrm{id}}_{\tilde{A}}\otimes ({\mathcal{D}}_{B^n\to \tilde{B}}\circ {\mathcal{N}}_{A\to B}^{\text{scalebox}0.7\otimes }))(f(w))-{\Phi }^{(\overline{M})}\Vert }_1⩽ϵ.$$

$$\log \overline{M}⩽\underset{w\in [[1,M]]}{\min }\underset{a\in ]0,1[}{\sup }{H}^a({\rho }_{B^n}^w)-\frac{4}{a}\log \frac{2}{\zeta }.$$

$$\log {\overline{M}}_w\triangleq \underset{a\in ]0,1[}{\sup }\left[{\aleph }^a{\left(X;B^n\right)}_{{\sigma }^w}-\frac{1}{a}\log \nu ({\sigma }_X^w\otimes {\sigma }_{B^n}^w)-\frac{4}{a}\log \frac{12}{\zeta }\right]$$

$$\log \overline{K}⩾\underset{w}{\max }\left\{\underset{a<0}{\inf }\left[{\beth }^a{\left(X;B^n\right)}_{{\sigma }^w}+\log \nu ({\rho }_{B^n}^w)+\left(2-\frac{2}{a}\right)\log \frac{12}{\xi }\right]-\log {\overline{M}}_w+1\right\}.$$

$${\Vert ({\mathrm{id}}_{\tilde{A}}\otimes {\mathcal{D}}_{CB\to \tilde{B}})\circ ({\mathcal{E}}_{A\to C\tilde{A}}\otimes {\mathrm{id}}_B)({\rho }_{AB})-{\Phi }^{(M)}\Vert }_1⩽ϵ.$$

$$\log \overline{M}⩽\underset{a\in ]0,1[}{\sup }\left(H^a(({\mathrm{id}}_{\tilde{A}}\otimes {\mathcal{M}}_{A\to A}^{\text{scalebox}0.7\otimes })({\rho }_{\tilde{A}{A}^n}))-\frac{4}{a}\log \frac{2}{\zeta }\right).$$

$$\log \overline{M}⩽\underset{a\in ]0,1[}{\sup }{H}^a\left({{\mathcal{M}}_{A\to A}^c}^{\text{scalebox}0.7\otimes }\left({\mathcal{E}}_{W\to A^n}\left(\frac{1}{\overline{M}}{1}_W\right)\right)\right)-\frac{4}{a}\log \frac{2}{\zeta /2-2\sqrt{ϵ}},$$

$$\log \overline{M}=\underset{w\in [[1,M]]}{\min }\underset{a\in ]0,1[}{\sup }-\frac{{\sum }_{i=1}^n\log \left({\eta }_{1+a}({\nu }_i^w)\right)}{a}-\frac{4}{a}\log \frac{2}{\zeta }.$$

$$\log \overline{M}=\underset{a\in ]0,1[}{\sup }-\frac{(n-r)\log \left({\eta }_{1+a}({\nu }^0)\right)+r\log \left({\eta }_{1+a}({\nu }^1)\right)}{a}-\frac{4}{a}\log \frac{2}{\zeta }.$$

$$\underset{a\in ]0,1[}{\sup }{H}^a\left({{\mathcal{M}}_{A\to A}^c}^{\text{scalebox}0.7\otimes }\left({\mathcal{E}}_{W\to A^n}\left(\frac{1}{\overline{M}}{1}_W\right)\right)\right)⩾n\left(-\sum _j{p}_j\log p_j-\delta \right).$$

$${\mathbb{E}}_{\mathcal{S}}\left(\underset{a\in ]0,1[}{\sup }{H}^a\left({{\mathcal{M}}_{A\to A}^c}^{\text{scalebox}0.7\otimes }\left(\frac{\Pi }{M}\right)\right)\right)⩾n\left(\log \min (\text{rank}\left({\text{tr}}_A(V{V}^{†})\right),\text{rank}\left({\text{tr}}_E(V{V}^{†}))\right)-\delta \right)$$

$${\mathbb{E}}_{\mathcal{S}}\left(H^a\left({{\mathcal{M}}_{A\to A}^c}^{\text{scalebox}0.7\otimes }\left(\frac{\Pi }{M}\right)\right)\right)$$

$$⩾\frac{1}{M}\sum _{j=1}^M{\mathbb{E}}_{\mathcal{S}}\left(H^a\left({{\mathcal{M}}_{A\to A}^c}^{\text{scalebox}0.7\otimes }\left(|{\varphi }^j⟩⟨{\varphi }^j|\right)\right)\right)$$

$$=\frac{1}{M}\sum _{j=1}^M{\mathbb{E}}_{\mathcal{S}}\left(H^a\left({\psi }_{E^n}^j\right)\right)$$

$$\stackrel{(b)}{⩾}n\log \text{rank}\left({\text{tr}}_A(V{V}^{†})\right)+n\log \text{rank}\left({\text{tr}}_E(V{V}^{†})\right)$$

$$-2\log \left(\sqrt{\text{rank}{\left({\text{tr}}_A(V{V}^{†})\right)}^n}+\sqrt{\text{rank}{\left({\text{tr}}_E(V{V}^{†})\right)}^n}\right)$$

$$⩾n\log \min (\text{rank}\left({\text{tr}}_A(V{V}^{†})\right),\text{rank}\left({\text{tr}}_E(V{V}^{†}))\right)-\log 2,$$

$$\frac{1}{MK}\sum _{s=1}^K\sum _{w=1}^M\text{tr}\left({\Gamma }_s^w{\rho }_B^{g_s(w)}\right)⩾1-ϵ,\text{ and }{\Vert \frac{1}{MK}\sum _{s=1}^K\sum _{w=1}^M{\rho }_B^{g_s(w)}-{\rho }_B\Vert }_1⩽\delta ,$$

$$\log M⩽\underset{a\in ]0,1[}{\sup }\left[{\aleph }^a{\left(X;B\right)}_{\rho }-\frac{1}{a}\log \nu ({\rho }_X\otimes {\rho }_B)-\frac{4}{a}\log \frac{12}{ϵ}\right],$$

$$\log MK⩾\underset{a<0}{\inf }\left[{\beth }^a{\left(X;B\right)}_{\rho }+\log \nu ({\rho }_B)+\left(2-\frac{2}{a}\right)\log \frac{12}{\delta }\right].$$

$${\mathbb{E}}_{G_s}\left(\frac{1}{M}\sum _{w=1}^M\text{tr}\left({\Gamma }_s^w{\rho }_B^{G_s(w)}\right)\right)⩾1-ϵ,$$

$$\text{tr}\left(Q({\rho }_X\otimes {\rho }_B)\right)$$

$$\text{tr}\left((1_{XB}-Q){\rho }_{XB}\right)$$

$$D_H^{ϵ/2}({\rho }_{XB}\Vert {\rho }_X\otimes {\rho }_B)-\log \frac{1}{ϵ}-4$$

$$⩾{\aleph }^a{\left(X;B\right)}_{\rho }-\frac{1}{a}\log \nu ({\rho }_X\otimes {\rho }_B)-\frac{4}{a}\log \frac{4}{ϵ}.$$

$${\mathbb{E}}_{G_1,\cdots ,G_K}\left({\Vert \frac{1}{MK}\sum _{s=1}^K\sum _{w=1}^M{\rho }_B^{G_s(w)}-{\rho }_B\Vert }_1\right)$$

$${\Vert Q_X-P_X\Vert }_1$$

Full text

I Introduction

In steganography, two parties seek to embed information within an innocent looking message without being detected by an unwanted party. The well-known example is that of two prisoners, Alice and Bob, who aim at developing an escape plan (cyphertext) through a permissible communication (covertext). The resulting message (stegotext), which is a combination of cyphertext, covertext, and possibly of a shared secret key, shall be made available to a warden Willie and should be almost indistinguishable from the covertext. While this fictional example illustrates the main motivation behind the problem, the advent of the digital age has opened several real opportunities to conceal information, including the embedding of messages in digital images and texts as well as telecommunication networks. Applications of modern steganography are now numerous and range from copyright protection to malicious activities. The importance of such applications has led to the formalization of steganography using sound cryptographic principles and the development of both steganography methods and their countermeasures [1].

The classical information-theoretic limits of information-hiding and steganography have been studied using different measures of “hiding.” The measures include average distortion between the covertext and the stegotext [2, 3] as well as relative entropy between the distributions of the covertext and stegotext [4, 5], which essentially controls the performance of the warden’s optimal detector. More recently, these ideas have also been applied in the context of covert and stealth communications [6, 7]. The main insight derived from these works is the precise characterization of the number of covert bits that can be embedded in the covertext while remaining undetectable by Willie and of the number of secret key bits required by Alice and Bob to achieve this goal. The number of covert bits is sensitive to modeling assumptions, in particular to whether Willie knows the covertext or whether there is noise in the system. The authors of [8] have shown that reliable and covert transmission of $O(n)$ bits of information is possible in $n$ uses of an Additive White Gaussian Noise (AWGN) channel when the warden has uncertainty about the noise power of the channel. The authors of [9, 10] have moreover considered covert communication when friendly nodes transmit artificial noise and have proved that covert transmission of positive rates is possible. Another situation in which covert communication with positive rate was shown to be possible is the transmission from a relay node to a destination when the source is uncertain regarding the forwarding strategy of the relay node [11].

Concurrently, the quantum description of physical devices used in information processing tasks has made us re-think communication and computation problems from two perspectives. First, one can use the limits imposed by quantum mechanics to devise enhanced solutions to hard problems in the classical world. For example, quantum key distribution offers unconditional security for classical communication while most classical solutions rely on assumptions regarding the computational power of the adversary. Second, one often encounters new challenging problems in a quantum setting, such as entanglement generation, which plays a role in intriguing applications such as quantum teleportation and super dense coding. Returning to the problem of steganography, one can extend the classical formulation to encompass both these aspects. That is, in addition to leveraging the quantum nature of the communication channel to perform classical steganography, one can ask for new paradigms to hide various quantum information processing tasks. Alice and Bob could for instance conceal a classical message within a quantum error correcting code used to mitigate the quantum noise of a quantum computer. Because of the unique nature of quantum states and channels, quantum steganography is in principle richer than classical steganography [12], and much efforts have been devoted to characterize how much information can be embedded into various quantum channels with or without noise [13, 14, 15, 16, 17, 18], and to assess how much key is required to achieve the task.

We revisit here the model of quantum steganography put forward in [18, 16], which assumes that the warden has inaccurate knowledge of what the channel is. Specifically, we assume that the warden’s knowledge of the channel is a degraded version of the real channel, which can be achieved by intentionally cascading another channel at the transmitter. We develop and analyze several quantum steganography protocols and obtain the following four results summarized in Table I.111Please note that item 1, 3, and 4 are included in the conference version [19] without detailed proofs.

When the cover protocol consists in communicating classically over a quantum channel, we show that, in addition to the cover classical message, a cypher classical message can be transmitted (Theorem 1). 2. 2.

When the cover protocol consists in communicating classically over a quantum channel, we show that, in addition to the cover classical message, entangled qubits can be generated. (Theorem 2). 3. 3.

When the cover protocol consists in sharing entanglement and the channel is noiseless, we show that legitimate parties can share entanglement as well as classical randomness (Theorem 3). 4. 4.

When the cover protocol consist of a quantum communication and the channel is noiseless, we show that, in addition to the cover quantum message, a cypher classical message can be transmitted (Theorem 4).

In all aforementioned results, the observed channel output state when the stego protocol is executed over the true channel resembles the observed state when the cover protocol is executed over the channel expected by the warden. Unlike earlier results [14, 18, 16], we show that no shared key is required to run the stego protocol when the channel is noiseless. This is achieved through the use of a random encoder obtained from privacy amplification and source coding with side information techniques similar to [20, 21]. Furthermore, we relax the assumption on the cover code in [18] that “on a valid codeword in the QECC, the typical errors all have distinct error syndromes, and act as unitaries that move the state to a distinct, orthogonal subspace,” by relying on one-shot coding results. Our main results are not single-letterized because of the arbitrary structure of the cover code; however, we specialize our results to certain classes of codes and obtain single-letter expression for those examples.

The remainder of the paper is organized as follows. We introduce our notation in Section II. We formulate different information process protocols over a quantum channel and define our problem in Section III. We state our main theorems in Section IV. We next calculate the rate of the cypher protocol for specific instances of cover protocols in Section V. We finally prove the main theorems in Section VI.

II Notation

We assume that all systems (e.g., $A$) are described by finite-dimensional Hilbert spaces (e.g., ${\mathcal{H}}_{A}$). Let $\mathbf{1}_{A}$ be the identity map on ${\mathcal{H}}_{A}$. ${\mathcal{B}}({\mathcal{H}}_{A})$ denotes the set of all bounded linear operators from ${\mathcal{H}}_{A}$ to ${\mathcal{H}}_{A}$, ${\mathcal{P}}({\mathcal{H}}_{A})$ denotes the set of all positive operators in ${\mathcal{B}}({\mathcal{H}}_{A})$, and ${\mathcal{D}}({\mathcal{H}}_{A})$ denotes the set of all density operators on ${\mathcal{H}}_{A}$. For $X\in{\mathcal{B}}({\mathcal{H}}_{A})$, the trace norm of $X$ is ${{\left\|{X}\right\|}}_{1}\triangleq\text{{tr}}\left(\sqrt{X^{\dagger}X}\right)$, and $\nu(X)$ denotes the number of distinct eigenvalues of $X$. The fidelity between two density operators $\rho_{A}$ and $\sigma_{A}$ is defined as $F(\rho_{A},\sigma_{A})\triangleq{{\left\|{\sqrt{\rho_{A}}\sqrt{\sigma_{A}}}\right\|}}_{1}^{2}$. A quantum channel ${\mathcal{N}}_{A\to B}$ is a linear trace-preserving completely positive map from ${\mathcal{B}}({\mathcal{H}}_{A})$ to ${\mathcal{B}}({\mathcal{H}}_{B})$. Let $\mathrm{id}_{A}$ be the identity channel on ${\mathcal{B}}({\mathcal{H}}_{A})$ and $\emptyset_{A}$ be the channel that maps all states in ${\mathcal{D}}({\mathcal{H}}_{A})$ to the trivial state in a one-dimensional state.

Suppose that $\rho_{XB}=\sum_{x}P_{X}(x)|x\rangle\langle x|\otimes\rho_{B}^{x}$ is a classical-quantum (cq) state. We recall two versions of Rényi quantum mutual information [22] for $a\neq 0$,

[TABLE]

We also define the Rényi quantum entropy as $H^{a}(\rho)\triangleq-\frac{1}{a}\log\text{{tr}}\left(\rho^{a+1}\right)$ [22]. These quantities are approximated by the Holevo information when $\rho$ and ${\mathcal{N}}$ have a product structure and are useful to express the coding theorems for cq channels [22, 23, 24].

For a positive integer $M$, let ${\mathcal{H}}^{(M)}$ denote the $M$-dimensional space spanned by the orthonormal basis ${\left\{|1\rangle,\cdots,|M\rangle\right\}}$. We also define $\mathrm{id}^{(M)}(\rho)\triangleq\rho$ and $\overline{\mathrm{id}}^{(M)}(\rho)\triangleq\sum_{i=1}^{M}{|i\rangle\langle i|}\rho{|i\rangle\langle i|}$ for $\rho\in{\mathcal{D}}{\left({\mathcal{H}}^{(M)}\right)}$. Furthermore, we define the perfectly entangled and the perfectly classically correlated states

[TABLE]

III Problem Formulation

Suppose that Alice and Bob are connected by a quantum channel ${\mathcal{N}}_{A\to B}:{\mathcal{B}}({\mathcal{H}}_{A})\to{\mathcal{B}}({\mathcal{H}}_{B})$ and use the channel $n$ times to run a protocol, which could be a combination of four primary tasks (classical communication, quantum communication, randomness sharing, and entanglement sharing), as defined next.

• •

Classical Communication: Alice wishes to reliably transmit a classical message $W$ uniformly distributed over $\llbracket{1},{M}\rrbracket$. A code consists of a function f:\llbracket{1},{M}\rrbracket\to{\mathcal{D}}({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}) for Alice to encode message $w$ into an input state $\rho_{A^{n}}^{w}\triangleq f(w)$ and a POVM $\mathbf{\Lambda}=\{\Lambda^{w}\}_{w\in\llbracket{1},{M}\rrbracket}$ for Bob to decode $W$. We call the code an $(M,\epsilon)^{\textnormal{CC}}$ classical communication code, if we have \frac{1}{M}\sum_{w=1}^{M}\text{{tr}}\left(\Lambda^{w}{\mathcal{N}}^{{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}}_{A\to B}(f(w))\right)\geqslant 1-\epsilon. The induced output state is \frac{1}{M}\sum_{w=1}^{M}{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(f(w)).

• •

Quantum Communication: Alice wants to transmit a quantum state $\rho_{W}$ acting on an $M$-dimensional Hilbert space ${\mathcal{H}}_{W}\triangleq{\mathcal{H}}^{(M)}$. Alice encodes $\rho_{W}$ using an encoder ${\mathcal{E}}_{W\to A^{n}}$ and transmits it over $n$ uses of ${\mathcal{N}}_{A\to B}$. Bob decodes $\rho_{W}$ by applying a decoder ${\mathcal{D}}_{B^{n}\to W}$ to his received state. A code $({\mathcal{E}}_{W\to A^{n}},{\mathcal{D}}_{B^{n}\to W})$ is an $(M,\epsilon)^{\textnormal{QC}}$ code if

[TABLE]

A more stringent notion of reliability is that the code recovers most of the error operators applied by the channel. Formally, we call a code $({\mathcal{E}}_{W\to A^{n}},{\mathcal{D}}_{B^{n}\to B})$ an $(M,\epsilon)^{\textnormal{QC}}_{\textnormal{R}}$ code, if there exists a decomposition {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}=\widetilde{{\mathcal{N}}}_{A^{n}\to B^{n}}+\widetilde{\widetilde{{\mathcal{N}}}}_{A^{n}\to B^{n}} such that ${\mathcal{D}}_{B^{n}\to W}\circ\widetilde{{\mathcal{N}}}_{A^{n}\to B^{n}}\circ{\mathcal{E}}_{W\to A^{n}}=c~{}\mathrm{id}_{W}$ for $c\geqslant 1-\epsilon$. The induced output state is {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}({\mathcal{E}}_{W\to A^{n}}(\rho_{W})) when the message is $\rho_{W}$.

• •

Randomness Sharing: Alice and Bob desire to share a classical random variable $\overline{\Phi}^{(M)}$. Let ${\mathcal{H}}_{{\widetilde{A}}}={\mathcal{H}}_{{\widetilde{B}}}\triangleq{\mathcal{H}}^{(M)}$. Alice prepares a state $\rho_{\widetilde{A}A^{n}}$ over the Hilbert space {\mathcal{H}}_{\widetilde{A}}\otimes{\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} and transmits $\rho_{A^{n}}$ to Bob over $n$ uses of the channel ${\mathcal{N}}_{A\to B}$. Bob applies a decoder ${\mathcal{D}}_{B^{n}\to\widetilde{B}}$ to his received state {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(\rho_{A^{n}}) to obtain the state $\rho_{\widetilde{B}}$ acting on the Hilbert space ${\mathcal{H}}_{\widetilde{B}}$. The joint state \rho_{{\widetilde{A}}{\widetilde{B}}}\triangleq(\mathrm{id}_{\widetilde{A}}\otimes({\mathcal{D}}_{B^{n}\to{\widetilde{B}}}\circ{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}))(\rho_{{\widetilde{A}}A^{n}}) is their final shared randomness. A code $(\rho_{{\widetilde{A}}A^{n}},{\mathcal{D}}_{B^{n}\to{\widetilde{B}}})$ is called an $(M,\epsilon)^{\textnormal{RS}}$ randomness sharing code if $F(\overline{\Phi}^{(M)},\rho_{{\widetilde{A}}{\widetilde{B}}})\geqslant 1-\epsilon$. The induced output state is {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(\rho_{A^{n}}).

• •

Entanglement Sharing: Alice and Bob want to share the entangled state $\Phi^{(M)}$. An $(M,\epsilon)^{\textnormal{ES}}$ code is defined in the same way as a randomness sharing protocol except that the final desired state is $\Phi^{(M)}$. The induced output state is defined similarly to that of randomness sharing.

In the resource framework formulated in [25], these four protocols correspond to the simulation of $\overline{\mathrm{id}}^{(M)}$, $\mathrm{id}^{(M)}$, $\overline{\Phi}^{(M)}$, and $\Phi^{(M)}$ with $n$ uses of ${\mathcal{N}}_{A\to B}$. Alice and Bob can in principle desire to perform any combination of these four protocols over $n$ uses of the channel ${\mathcal{N}}_{A\to B}$. We formalize only the combinations for which we develop results, i.e., classical communication / quantum communication, entanglement sharing / randomness sharing, and entanglement sharing / classical communication.

• •

Quantum and Classical Communication: Alice wants to transmit a quantum state $\rho_{W}$ over an $M$-dimensional space ${\mathcal{H}}_{W}\triangleq{\mathcal{H}}^{(M)}$ and an independent classical message $\overline{W}$ uniformly distributed over $\llbracket{1},{{\overline{M}}}\rrbracket$. When $\overline{W}={\overline{w}}$, she encodes $\rho_{W}$ using the encoder ${\mathcal{E}}^{{\overline{w}}}_{W\to A^{n}}$. Bob decodes the messages using a decoder ${\mathcal{D}}_{B^{n}\to W\overline{W}}$. The code is called an $(M,\overline{M},\epsilon)^{\textnormal{QC-CC}}$ code if for any $\rho_{W}$, we have

[TABLE]

and for all ${\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket$, $({\mathcal{E}}_{W\to A^{n}}^{\overline{w}},{\mathcal{D}}_{B^{n}\to W})$ is an $(M,\epsilon)^{\textnormal{QC}}_{R}$ code. The induced output state is \frac{1}{{\overline{M}}}\sum_{{\overline{w}}=1}^{\overline{M}}{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}({\mathcal{E}}^{\overline{w}}_{W\to A^{n}}(\rho_{W})) when the quantum message is $\rho_{W}$.

• •

Entanglement and Randomness Sharing: Alice and Bob want to share the state $\Phi^{(M)}\otimes\smash{\overline{\Phi}}^{(\overline{M})}$. An $(M,\overline{M},\epsilon)^{\textnormal{ES-RS}}$ code is defined in the same way as a randomness sharing protocol except that the final desired state is $\Phi^{(M)}\otimes\smash{\overline{\Phi}}^{(\overline{M})}$. The induced output state is defined similarly to that of randomness sharing.

• •

Classical Communication and Entanglement Sharing: Alice wants to transmit a classical message $W$ uniformly distributed over $\llbracket{1},{{M}}\rrbracket$ and share the entangled state $\Phi^{({\overline{M}})}$ with Bob. Let ${\mathcal{H}}_{{\widetilde{A}}}={\mathcal{H}}_{{\widetilde{B}}}\triangleq{\mathcal{H}}^{({\overline{M}})}$ and ${\mathcal{H}}_{W}\triangleq{\mathcal{H}}^{({M})}$. A code consists of an encoder $f:\llbracket{1},{{M}}\rrbracket\to{\mathcal{H}}_{{\widetilde{A}}}\otimes{\mathcal{H}}_{A^{n}}$ and a decoder ${\mathcal{D}}_{B^{n}\to W{\widetilde{B}}}$. Given the classical message $W=w$, Alice prepares $f(w)$ and sends the subsystem $A^{n}$ over $n$ uses of ${\mathcal{N}}_{A\to B}$. Bob applies ${\mathcal{D}}_{B^{n}\to W{\widetilde{B}}}$ to his received state. We call $(f,{\mathcal{D}}_{B^{n}\to W{\widetilde{B}}})$ an $({M},{\overline{M}},\epsilon)^{\mathrm{CC-ES}}$ code if

[TABLE]

The induced output state is \frac{1}{M}\sum_{w=1}^{M}{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(\mathrm{tr}_{{\widetilde{A}}}(f(w))).

All these protocols can be enhanced with a shared secret classical key $S$ uniformly distributed over $\llbracket{1},{K}\rrbracket$, which can help Alice and Bob induce a specific output state.

As depicted in Fig. 1, Willie expects Alice and Bob to execute a protocol ${\mathcal{P}}^{c}$, which is called the cover protocol and is known to Willie. However, Willie has an inaccurate estimation of the channel and believes that the channel between Alice and Bob is ${\mathcal{N}}_{A\to B}\circ{\mathcal{M}}_{A\to A}$, which is a degraded version of the true channel ${\mathcal{N}}_{A\to B}$. We assume that running the protocol ${\mathcal{P}}^{c}$ induces the quantum state $\rho_{B^{n}}^{c}$ at the output of {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\circ{\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}. The objective is for Alice and Bob to run a stego protocol ${\mathcal{P}}^{s}$, which performs the task of ${\mathcal{P}}^{c}$ together with another task and induces a state $\rho_{B^{n}}^{s}$ at the output of {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} such that ${{\left\|{\rho_{B^{n}}^{c}-\rho_{B^{n}}^{s}}\right\|}}_{1}$ is small. The added tasks can be any of the tasks listed earlier. We focus on four of these as summarized in Table I and detailed next.

IV Main Results

We state our main results in this section, and all proofs are relegated to Section VI. We first show that if the cover protocol is a classical communication code, the stego protocol could be a classical communication code with a higher rate, equivalent to sending a cypher classical message in addition to the cover classical message.

Theorem 1** (classical communication / classical communication).**

Let the cover protocol be an $({M},\epsilon)^{\textnormal{CC}}$ code $(f,\mathbf{\Lambda})$ for {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\circ{\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} inducing the output state $\rho_{B^{n}}^{c}$. We define \rho_{B^{n}}^{w}\triangleq{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\circ{\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}(f({w})) for ${w}\in\llbracket{1},{{M}}\rrbracket$.

• •

Suppose that ${\mathcal{H}}_{A}={\mathcal{H}}_{B}$ and ${\mathcal{N}}_{A\to B}=\mathrm{id}_{A}$, i.e., the true channel from Alice to Bob is noiseless. For any $\zeta>0$, there exists an $({M}{\overline{M}},\zeta+2\sqrt{\zeta+\epsilon})^{\textnormal{CC}}$ stego protocol inducing the output state $\rho_{B^{n}}^{s}$ such that ${{\left\|{\rho_{B^{n}}^{s}-\rho_{B^{n}}^{c}}\right\|}}_{1}\leqslant\zeta$ provided that

[TABLE]

• •

Suppose that the channel ${\mathcal{N}}_{A\to B}$ is noisy. Let $\sigma_{XA^{n}}^{1},\cdots,\sigma_{XA^{n}}^{M}$ be cq states such that upon defining \sigma_{XB^{n}}^{w}\triangleq(\mathrm{id}_{X}\otimes{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n})(\sigma_{XA^{n}}^{w}), we have $\textnormal{tr}_{X}(\sigma_{XB}^{w})=\rho_{B^{n}}^{w}$ for all ${w}\in\llbracket{1},{{M}}\rrbracket$. Let $\zeta,\xi\in]0,1[$ be fixed and ${\overline{M}}$ and ${\overline{K}}$ be positive integers such that $\log{\overline{M}}\leqslant\min_{{w}}\log{\overline{M}}_{w}$ where

[TABLE]

and

[TABLE]

There exists an $({M}{\overline{M}},\zeta+2\sqrt{\xi+\epsilon})^{\textnormal{CC}}$ code with $\log{\overline{K}}$ bits of required common randomness inducing the output state $\rho_{B^{n}}^{s}$ such that ${{\left\|{\rho_{B^{n}}^{s}-\rho_{B^{n}}^{c}}\right\|}}_{1}\leqslant\xi$.

Remark 1**.**

We assume for simplicity that the cover message is uniformly distributed, but the proof holds for all distributions on the cover message.

Remark 2**.**

The arbitrary choice of $\sigma_{XA^{n}}^{1},\cdots,\sigma_{XA^{n}}^{M}$ in the second part of Theorem 1 is an essential part of most of the channel coding results, for example the choice of the channel input state in the definition of the Holevo information of a quantum channel [26, Definition 13.3.1]. We need however an additional requirement $\textnormal{tr}_{X}(\sigma_{XB}^{w})=\rho_{B^{n}}^{w}$ to control the channel output statistics.

We next show that if the cover protocol is a classical communication code, we can use a stego protocol to share entanglement and communicate classically. We introduce the following two definitions to express our results. In the first definition we introduce a shorthand for the result of Theorem 1. It shall help us compactly state the next theorem as we use the stego protocol of Theorem 1 as a sub protocol in our stego protocol of Theorem 2.

Definition 1**.**

Let us fix $\xi=\zeta$ in the second part of Theorem 1. For an encoder $f$ and positive number $\zeta$, let $\log{\overline{M}}^{\mathrm{CC}}(f,\zeta)$ and $\log K^{\mathrm{CC}}(f,\zeta)$ be the number of bits of the cypher message and the number of required key bits, respectively, in the stego protocol of Theorem 1. Note that these quantities are well-defined, because the right hand side of (9), (10), and (11) only depends on $f$, $\zeta$, and $\xi$ when the channel is fixed.

We next introduce a notation for the maximum amount of entanglement that can be distilled from an arbitrary shared quantum state using local operations and classical communication, known as the entanglement distillation problem.

Definition 2**.**

Let Alice and Bob share $\rho_{AB}$ and ${\mathcal{H}}_{{\widetilde{A}}}={\mathcal{H}}_{{\widetilde{B}}}\triangleq{\mathcal{H}}^{(M)}$. An entanglement distillation protocol consists of an encoder ${\mathcal{E}}_{A\to C{\widetilde{A}}}$ and a decoder ${\mathcal{D}}_{BC\to{\widetilde{B}}}$ such that the output of ${\mathcal{E}}_{A\to C{\widetilde{A}}}$ is always a cq state. Alice applies ${\mathcal{E}}_{A\to C{\widetilde{A}}}$ to $\rho_{A}$ to obtain a cq state $\rho_{C{\widetilde{A}}}$ and transmits $C$ to Bob over a noiseless channel. Bob applies ${\mathcal{D}}_{CB\to{\widetilde{B}}}$ to his subsystem $B$ and the received classical message $C$. The code $({\mathcal{E}}_{A\to C{\widetilde{A}}},{\mathcal{D}}_{CB\to{\widetilde{B}}})$ is called an $(M,L,\rho_{AB},\epsilon)^{\mathrm{ED}}$ code if $\dim{{\mathcal{H}}_{C}}=L$ and

[TABLE]

We further define $E_{d}(\rho_{AB},L,\epsilon)\triangleq\max{\left\{M:\exists~{}(M,L,\rho_{AB},\epsilon)^{\mathrm{ED}}\mathrm{code}\right\}}$.

When $\rho_{AB}$ is pure, it is known [27] that \lim_{\epsilon\to 0}\lim_{n\to\infty}\frac{\log E_{d}(\rho_{AB}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n},2^{\Theta(\log n)},\epsilon)}{n}={\mathbb{H}}\!\left(A\right)_{\rho}.

Theorem 2** (classical communication / entanglement sharing).**

Let the cover protocol be an $({M},\epsilon)^{\textnormal{CC}}$ code $(f,\mathbf{\Lambda})$ for {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\circ{\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} inducing the output state $\rho_{B^{n}}^{c}$. Further assume that $f(w)=f_{1}(w)\otimes f_{2}(w)$ for two functions f_{1}:\llbracket{1},{{M}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}\right)} and f_{2}:\llbracket{1},{{M}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{2}}\right)} where $n=n_{1}+n_{2}$. Let $|\phi^{w}\rangle_{RA^{n_{1}}}$ be a purification of {\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}(f_{1}(w)) and \sigma_{RB^{n_{1}}}^{w}\triangleq\mathrm{id}_{R}\otimes{\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}({|\phi^{w}\rangle\langle\phi^{w}|}_{RA^{n_{1}}}). For any $\zeta>0$, there exists an $({M},{\overline{M}},2\zeta+2\sqrt{\epsilon+\zeta}+2\sqrt{\zeta+2\sqrt{\epsilon+\zeta}})^{\mathrm{CC-ES}}$ stego protocol inducing the output state $\rho_{B^{n}}^{s}$ such that ${{\left\|{\rho_{B^{n}}^{s}-\rho_{B^{n}}^{c}}\right\|}}_{1}\leqslant\zeta$ provided that ${\overline{M}}\leqslant\min_{w\in\llbracket{1},{{M}}\rrbracket}E_{s}(|\phi\rangle^{w}_{RB^{n_{1}}},{\overline{M}}^{\mathrm{CC}}(f_{2},\zeta),\zeta)$.

The stego protocol requires $\log{\overline{M}}^{\mathrm{CC}}(f_{2},\zeta)+\log K^{\mathrm{CC}}(f_{2},\zeta)$ bits of shared key.

Remark 3**.**

Our assumption that $f(w)$ decomposes as $f_{1}(w)\otimes f_{2}(w)$ for all $w$ holds for common codes for classical communication over quantum channels such as [29].

We next show that if the cover protocol is an entanglement sharing code, there exists a stego protocol that shares both entanglement and classical randomness.

Theorem 3** (entanglement sharing / classical randomness sharing).**

Let the cover protocol be an $({M},\epsilon)^{\textnormal{ES}}$ code $(\rho_{{\widetilde{A}}A^{n}},{\mathcal{D}}_{B^{n}\to{\widetilde{B}}})$ for {\mathcal{N}}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}_{A\to B}\circ{\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} inducing the output state $\rho_{B^{n}}^{c}$. If ${\mathcal{H}}_{A}={\mathcal{H}}_{B}$ and ${\mathcal{N}}_{A\to B}=\mathrm{id}_{A}$, for any $\zeta\geqslant 0$ and ${\overline{M}}$, there exists an $({M},{\overline{M}},(\sqrt{\epsilon}+\zeta)^{2})^{\textnormal{ES-RS}}$222We have claimed the existence of an $({M},{\overline{M}},(\sqrt{2\epsilon-\epsilon^{2}}+\zeta)^{\textnormal{ES-RS}}$ stego protocol in [19] because of an unfortunate mistake in our calculations. stego protocol inducing the output state $\rho_{B^{n}}^{c}$ such that $\rho_{B^{n}}^{s}=\rho_{B^{n}}^{s}$ if

[TABLE]

Finally we show that a cover protocol for quantum communication can be converted into a quantum and classical communication stego protocol.

Theorem 4** (quantum communication / classical communication).**

Let the cover protocol be an $({M},\epsilon)^{\textnormal{QC}}_{\textnormal{R}}$ code $({\mathcal{E}}_{W\to A^{n}},{\mathcal{D}}_{B^{n}\to W})$ inducing the output state $\rho_{B^{n}}^{c}$. Suppose that ${\mathcal{E}}_{W\to A^{n}}=V_{W\to A^{n}}\rho_{W}V_{W\to A^{n}}^{\dagger}$ where $V_{W\to A^{n}}$ is an isometry. If ${\mathcal{H}}_{A}={\mathcal{H}}_{B}$ and ${\mathcal{N}}_{A\to B}=\mathrm{id}_{A}$, for all $\zeta>4\sqrt{\epsilon}$, there exists an $({M},{\overline{M}},\max(\zeta,\epsilon))^{\textnormal{QC-CC}}_{\textnormal{R}}$ stego protocol inducing the output state $\rho_{B^{n}}^{s}$ such that ${{\left\|{\rho_{B^{n}}^{s}-\rho_{B^{n}}^{c}}\right\|}}_{1}\leqslant 2\epsilon+\zeta$,333Note that $\rho_{B^{n}}^{s}$ and $\rho_{B^{n}}^{c}$ depend on $\rho_{W}$, and this inequality should hold for all choices of $\rho_{W}$. provided that

[TABLE]

where ${\mathcal{M}}^{c}_{A\to A}$ is the complementary channel of ${\mathcal{M}}_{A\to A}$.

V Examples

V-A Classical Codes with Product Structure

Definition 3**.**

Let $k$ and $\ell$ be positive integers, and \rho_{A^{k}}^{1},\cdots,\rho_{A^{k}}^{\ell}\in{\mathcal{D}}({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}k}). We say that an encoder f:\llbracket{1},{M}\rrbracket\to{\mathcal{D}}({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}) has a product structure with respect to ${\mathcal{P}}_{k,\ell}\triangleq\{\rho_{A^{k}}^{1},\cdots,\rho_{A^{k}}^{\ell}\}$, if $n$ is divisible by $k$ and for all $w\in\llbracket{1},{M}\rrbracket$, we have $f(w)=\otimes_{i=1}^{n/k}\sigma^{i}$ where $\sigma^{1},\cdots,\sigma^{n/k}\in{\mathcal{P}}_{k,\ell}$.

Remark 4**.**

Definition 3 is useful when $n/k\gg 1$. Several explicit constructions of classical codes for quantum channels are in this regime [29]. Moreover, from the standard random coding arguments, codes with large $n/k$ achieve the classical capacity of any quantum channel.

Considering the cover classical communication code described in Theorem 1, we simplify the expressions for the rate of the cypher message provided that the cover code has a product structure and $n/k$ is large enough. Let $\delta>0$ and let the classical communication code have a product structure with respect to ${\mathcal{P}}_{k,\ell}$. There exist an integer $m$ depending on ${\mathcal{P}}_{k,\ell}$, $\zeta,\delta>0$ such that if $n/k\geqslant m$ the following two propositions hold.

Proposition 1**.**

For a noiseless channel, the number of bits of the cypher message is at least \frac{n}{k}{\left(\min_{\rho\in{\mathcal{P}}_{k,\ell}}H({\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}k}(\rho))-\delta\right)}. For a noisy channel, the number of bits of the cypher message is at least $\frac{n}{k}{\left(\inf_{\rho\in{\mathcal{P}}_{k,\ell}}\sup_{\sigma_{XB^{k}}:\textnormal{tr}_{X}(\sigma_{XB^{k}})=\rho}{{\mathbb{I}}\!\left(X;B^{k}\right)}_{\sigma}-\delta\right)}$, using a shared secret key of $\delta n$ bits.

Proposition 2**.**

For a noiseless channel, the number of entangled qubits that the stego protocol of Theorem 2 would generate is at least \frac{n}{k}{\left(\min_{\rho\in{\mathcal{P}}_{k,\ell}}H({\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}k}(\rho))-\delta\right)}. The required number of shared secret key bits is $O(\log n)$.

V-B Gaussian States

Although we have assumed so far that all Hilbert spaces are finite dimensional, the proof of the first part of Theorem 1 carries over to infinite dimensional spaces since the leftover hash lemma still holds for such a setting. Gaussian channels form an important class of infinite dimensional channels, which models optical channels. Let $A$ and $B$ be single mode bosonic systems, ${\mathcal{N}}_{A\to B}$ be noiseless, ${\mathcal{M}}_{A\to A}$ be a Gaussian channel, and $f(w)$ be a Gaussian state for all $w$. Denoting the symplectic spectra of $\rho_{B^{n}}$ by $(\nu_{1}^{w},\cdots,\nu_{n}^{w})$, we have [30, Eq. (108)] $H^{a}(\rho_{B^{n}}^{w})=-\frac{\sum_{i=1}^{n}\log{\left(\eta_{1+a}(\nu_{i}^{w})\right)}}{a}$, where $\eta_{\alpha}(x)\triangleq 2^{\alpha}/((x+1)^{\alpha}-(x-1)^{\alpha})$. The number of bits of the cypher message would then be

[TABLE]

We now suppose that the cover code uses a binary modulation, i.e., for two states $\rho_{A}^{0}$ and $\rho_{A}^{1}$, we have $f(w)=\otimes_{i=1}^{n}\rho_{A}^{x_{w,i}}$ for all ${w}\in\llbracket{1},{{M}}\rrbracket$. Let $\nu^{0}$ and $\nu^{1}$ be the symplectic eigenvalue of ${\mathcal{M}}_{A\to A}(\rho_{A}^{0})$ and ${\mathcal{M}}_{A\to A}(\rho_{A}^{1})$, respectively, with $\nu^{0}\leqslant\nu^{1}$. Upon defining $r\triangleq\min_{w\in\llbracket{1},{{M}}\rrbracket}\sum_{i=1}^{n}x_{w,i}$, we have

[TABLE]

We plot the rate of the cypher message for $n=10^{6}$, $r=n/2$, $\zeta=10^{-3}$ in Fig. 2.

V-C Quantum Codes of [18]

Consider a Kraus representation $\{F_{j}\}_{j\in{\mathcal{J}}}$ of ${\mathcal{M}}_{A\to A}$ such that $\text{{tr}}\left(F_{j}^{\dagger}F_{j^{\prime}}\right)=\mathds{1}\!\left\{j=j^{\prime}\right\}d_{j}$. This defines a Kraus representation $\{\mathbf{F}_{\mathbf{j}}\}_{\mathbf{j}\in{\mathcal{J}}^{n}}$ for {\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}, where $\mathbf{F}_{\mathbf{j}}\triangleq F_{j_{1}}\otimes\cdots\otimes F_{j_{n}}$. Let ${\mathcal{T}}_{\epsilon}$ be the typical subset of $\mathbf{F}_{\mathbf{j}}\triangleq F_{j_{1}}\otimes\cdots\otimes F_{j_{n}}$ as defined in [31]. If $\Pi$ is the projector onto the sub-space of inputs defined by the code, we assume that for all $\mathbf{F}_{\mathbf{j}}\in{\mathcal{T}}_{\epsilon}$, we have $\mathbf{F}_{\mathbf{j}}\Pi=p_{\mathbf{j}}\mathbf{U}_{\mathbf{j}}\Pi$, where $p_{\mathbf{j}}=p_{j_{1}}\times\cdots\times p_{j_{n}}$ for a probability distribution $\{p_{j}\}$ on ${\mathcal{J}}$, and $\mathbf{U}_{\mathbf{j}}=U_{j_{1}}\otimes\cdots\otimes U_{j_{n}}$ for unitaries $\{U_{j}\}$ on ${\mathcal{H}}_{A}$.

Proposition 3**.**

For all $\delta>0$ and $n$ large enough, we have

[TABLE]

V-D Random Quantum Codes

Proposition 4**.**

Let ${\mathcal{S}}$ be a random $M$-dimensional subspace of {\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} distributed according to the Haar measure, and $\Pi$ denote the projector onto ${\mathcal{S}}$. Let ${\mathcal{M}}_{A\to A}$ be a quantum channel with an isometric extension $V_{A\to AE}$. For all $\delta>0$, there exists $n$ large enough such that

[TABLE]

Proof:

Let $|g^{1}\rangle,\cdots,|g^{M}\rangle$ be $M$ random independent Gaussian vectors in {\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n} as defined in [32]. Since the distribution of $\textnormal{span}(|g^{1}\rangle,\cdots,|g^{M}\rangle)$ is the same as the distribution of ${\mathcal{S}}$ by [32], we take ${\mathcal{S}}=\textnormal{span}(|g^{1}\rangle,\cdots,|g^{M}\rangle)$. Defining $G\triangleq\sum_{j=1}^{M}|g^{j}\rangle\langle g^{j}|$, the vectors $\{|\phi^{j}\rangle_{A^{n}}\triangleq G^{-\frac{1}{2}}|g^{j}\rangle\}_{j\in\llbracket{1},{M}\rrbracket}$ form an orthonormal basis for ${\mathcal{S}}$. One can check that $|\psi^{j}\rangle_{A^{n}E^{n}}\triangleq V_{A\to AE}|\phi^{j}\rangle$ has a uniform distribution over all unit vectors in (\textnormal{range}VV^{\dagger})^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}. Therefore, we have

[TABLE]

where $(a)$ follows from the concavity of Rényi entropy, and $(b)$ follows from the bound in the proof of [33, Lemma III.1]. ∎

VI Proofs

VI-A One-shot Results

In this section, we develop one-shot coding results stated in terms of Rényi mutual information. We shall specialize them to prove our main results in Section VI-B. We first derive an achievability result stating that there exists a classical communication code for a cq channel inducing a pre-specified state at the output. Our proof is based on combining quantum channel coding and channel resolvability results.

Lemma 1**.**

Let $\rho_{XB}=\sum_{x\in{\mathcal{X}}}P_{X}(x)|x\rangle\langle x|\otimes\rho_{B}^{x}$ be a cq state. Let $M$ and $K$ be positive integers. For each $s\in\llbracket{1},{K}\rrbracket$, there exist an encoding function $g_{s}:\llbracket{1},{M}\rrbracket\to{\mathcal{X}}$ and a POVM $\mathbf{\Gamma}_{s}=\{\Gamma_{s}^{w}\}_{w\in\llbracket{1},{M}\rrbracket}$ such that

[TABLE]

provided that

[TABLE]

and

[TABLE]

Proof:

We consider $K$ independently generated random encoders $G_{s}:\llbracket{1},{M}\rrbracket\to{\mathcal{X}}$ where $G_{s}(1),\cdots,G_{s}(M)$ are independent and identically distributed (i.i.d.) according to $P_{X}$. By [24, Theorem 1], for all $\epsilon>0$, there exists a POVM such that

[TABLE]

if $\log M\leqslant D_{H}^{\epsilon/2}(\rho_{XB}\|\rho_{X}\otimes\rho_{B})-\log\frac{1}{\epsilon}-4$ where $D_{H}^{\epsilon}(\rho\|\sigma)\triangleq-\log\inf_{Q:0\leqslant Q\leqslant\mathbf{1},\text{{tr}}\left(Q\rho\right)\geqslant 1-\epsilon}\text{{tr}}\left(Q\sigma\right)$. By [34, Theorem 2], for all $\gamma>0$, there exists an operator $0\leqslant Q\leqslant\mathbf{1}_{XB}$ such that for all $a\in]0,1[$,

[TABLE]

Choosing $\gamma={\aleph^{a}{\left(X;B\right)}_{\rho}}-a^{-1}(\log\nu(\rho_{X}\otimes\rho_{B})+\log 2/\epsilon)$ yields that

[TABLE]

To obtain (24), note that by [22, Lemma 9.2], we have for all $a<0$

[TABLE]

Choosing $\log\lambda={\beth^{a}{\left(X;B\right)}_{\rho}}+\frac{2}{a}\log\delta/4$ and $\log MK\geqslant-2\log\frac{\delta}{2}+\log\lambda+\log\nu(\rho_{B})$, we obtain that

[TABLE]

Finally, Markov’s inequality and the bounds on the expected values imply the existence of the desired code. ∎

We now prove the existence of a code for transmission of a classical message over a noiseless classical channel while a pre-specified distribution is induced at the output of the channel. We show that no key is required in this case. The idea of the proof is similar to [20, Lemma 2].

Lemma 2**.**

Let $P_{X}$ be a Probability Mass Function (PMF) over ${\mathcal{X}}$, and $Q_{W}$ be uniform distribution over $\llbracket{1},{M}\rrbracket$ for $M\in\mathbb{N}^{+}$. Let $(W,X,\widehat{W})$ be distributed according to $Q_{WX\widehat{W}}(w,{x},\widehat{w})\triangleq Q_{W}(w)Q_{{X}|W}(x|w)\mathds{1}\!\left\{f({x})=\widehat{w}\right\}$ for a conditional PMF $Q_{X|W}$ and a function $f:{\mathcal{X}}\to\llbracket{1},{M}\rrbracket$. For all $\epsilon>0$, there exists $Q_{{X}|W}$ and $f$ such that

[TABLE]

provided that $\log M\leqslant\sup_{a\in]0,1[}H^{a}(P_{X})-\frac{4}{a}\log\frac{2}{\epsilon}$.

Proof:

Let $P_{WX\widehat{W}}$ be another distribution for $({W},X,\widehat{{W}})$ defined as

[TABLE]

for a function $g:{\mathcal{X}}\to\llbracket{1},{M}\rrbracket$. Using a privacy amplification result [35, Corollary 5.6.1] and a bound on smooth min-entropy in terms of Rényi entropy [36, Theorem 7], there exists $g$ such that ${{\left\|{P_{W}-Q_{W}}\right\|}}_{1}\leqslant\epsilon$ when $\log M\leqslant\sup_{a\in]0,1[}H^{a}(P_{X})-\frac{4}{a}\log\frac{2}{\epsilon}$. It is enough to show that (33) and (34) hold for $f\triangleq g$ and

[TABLE]

Note that $P_{\widehat{W}|XW}(\widehat{w}|x,w)=\mathds{1}\!\left\{f(x)=\widehat{w}\right\}$ and we have $P_{XW}(x,w)=P_{W}(w)Q_{X|W}(x|w)$ for all $w,x$. We thus have

[TABLE]

By the data processing inequality, (33) holds. Since for any two distributions $P$ and $Q$, we have ${{\left\|{P-Q}\right\|}}_{1}=2\sup_{{\mathcal{A}}}P({\mathcal{A}})-Q({\mathcal{A}})$, we have

[TABLE]

∎

We extend Lemma 2 to the quantum setting in the following corollary.

Corollary 1**.**

Let $M\in\mathbb{N}^{+}$, $\epsilon>0$, ${\mathcal{H}}$ be a finite dimensional Hilbert space, and $\rho$ be a density operator on ${\mathcal{H}}$. Suppose that $\log M\leqslant\sup_{a\in]0,1[}H^{a}(\rho)-\frac{4}{a}\log\frac{2}{\epsilon}.$ There exist a function $g:\llbracket{1},{M}\rrbracket\to{\mathcal{D}}({\mathcal{H}})$ and a POVM $\mathbf{\Lambda}=\{\Lambda^{w}\}_{w\in\llbracket{1},{M}\rrbracket}$ such that

[TABLE]

Proof:

Considering an eigen-decomposition of $\rho$ as $\sum_{i=1}^{d}P_{X}(x_{i})|x_{i}\rangle\langle x_{i}|$ and defining ${\mathcal{X}}\triangleq\{x_{1},\cdots,x_{d}\}$, we apply Lemma 2 to $P_{X}$ to obtain a conditional PMF $Q_{X|W}$ and a function $f:{\mathcal{X}}\to\llbracket{1},{M}\rrbracket$ satisfying (33) and (34). Let $Q_{WX\widehat{W}}$ be as defined in Lemma 2. We then define

[TABLE]

Substituting (42) in (40), we obtain

[TABLE]

Moreover,

[TABLE]

∎

VI-B Proof of Main Results

Proof:

We separately prove the two parts of the theorem. Let the code $(f,\mathbf{\Lambda})$ be the cover protocol, and the main channel be noiseless. By Corollary 1, for every $\zeta\geqslant 0$, provided that

[TABLE]

there exist a function g_{w}:\llbracket{1},{{\overline{M}}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\right)} and a POVM $\mathbf{\Gamma}_{w}=\{{\Gamma}^{{\overline{w}}}_{w}\}_{{\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket}$ such that

[TABLE]

We define the stego protocol as follows. Let \overline{f}:\llbracket{1},{{M}{\overline{M}}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}\right)} be defined as $\overline{f}({w}({\overline{M}}-1)+{\overline{w}})\triangleq g_{w}({\overline{w}})$. We define a POVM $\{\sqrt{{\Lambda}^{w}}\Gamma_{w}^{\overline{w}}\sqrt{{\Lambda}^{w}}\}_{w\in\llbracket{1},{M}\rrbracket,{\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket}$, which is equivalent to first measuring $\mathbf{\Lambda}$ and then measuring $\mathbf{\Gamma}_{{w}}$. This is a valid POVM, since every $\sqrt{{\Lambda}^{w}}\Gamma_{w}^{\overline{w}}\sqrt{{\Lambda}^{w}}$ is a positive operator and $\sum_{{w}{\overline{w}}}\sqrt{{\Lambda}^{w}}\Gamma_{w}^{\overline{w}}\sqrt{{\Lambda}^{w}}\stackrel{{\scriptstyle(a)}}{{=}}\sum_{w}\Lambda^{w}\stackrel{{\scriptstyle(b)}}{{=}}\mathbf{1}_{B},$ where $(a)$ follows since $\mathbf{\Gamma}_{w}$ is a valid POVM, and $(b)$ follows since $\mathbf{\Lambda}$ is a valid POVM. Note next that

[TABLE]

where $(a)$ follows from the convexity of the trace norm. The probability of correct decoding is also

[TABLE]

We also have $\frac{1}{{M}{\overline{M}}}\sum_{{w}{\overline{w}}}\text{{tr}}\left(\Gamma_{w}^{\overline{w}}g_{w}({\overline{w}})\right)\geqslant 1-\zeta$ by (54). To lower-bound the second term in (58), we have

[TABLE]

where $(a)$ follows from the gentle operator lemma [37], and $(b)$ follows from Jensen’s inequality and the concavity of $x\mapsto\sqrt{1-x}$. We also lower-bound

[TABLE]

Let $\zeta$, $\xi$, $\rho_{B^{n}}^{w}$, ${\overline{M}}_{w}$, ${\overline{M}}$, and ${\overline{K}}$ be defined as in the statement of Theorem 1, and the main channel be noisy. We assume without loss of generality that ${\overline{M}}_{w}$ is divisible by ${\overline{M}}$ for all $w$, otherwise we define ${\overline{M}}_{w}^{\prime}\triangleq\lfloor{\overline{M}}_{w}/{\overline{M}}\rfloor{\overline{M}}$, and $|\log{\overline{M}}_{w}-\log{\overline{M}}_{w}^{\prime}|\leqslant 1$. By Lemma 1, for each ${w}$, there exist ${\overline{K}}$ encoding functions g_{s,{w}}:\llbracket{1},{{\overline{M}}_{w}}\rrbracket\to{\mathcal{D}}({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}) and ${\overline{K}}$ POVMs $\mathbf{\Gamma}_{s,{w}}=\{\Gamma_{s,{w}}^{\overline{w}}\}_{{\overline{w}}\in\llbracket{1},{{\overline{M}}_{w}}\rrbracket}$ such that $\frac{1}{{\overline{M}}_{w}K}\sum_{s{\overline{w}}}\text{{tr}}\left(\Gamma_{s,{w}}^{\overline{w}}\rho_{B^{n}}^{w}\right)\geqslant 1-\zeta$, and

[TABLE]

We define the stego protocol as follows. For $s\in\llbracket{1},{K}\rrbracket$, ${w}\in\llbracket{1},{{M}}\rrbracket$, and ${\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket$, we define $\mu_{w}\triangleq\frac{{\overline{M}}_{w}}{{\overline{M}}}$, $\overline{f}_{s}(({w}-1){\overline{M}}+{\overline{w}})\triangleq\frac{1}{\mu_{w}}\sum_{i=1}^{\mu_{w}}g_{s,{w}}(({\overline{w}}-1)\mu_{w}+i)$, and $\overline{\Lambda}_{s}^{({w}-1){\overline{M}}+{\overline{w}}}\triangleq\sum_{j=1}^{\mu_{w}}\sqrt{\Lambda^{w}}\Gamma_{s,{w}}^{({\overline{w}}-1)\mu_{w}+j}\sqrt{\Lambda^{w}}$. As done previously, one can show that for each $s\in\llbracket{1},{K}\rrbracket$, $\overline{\mathbf{\Lambda}}_{s}=\{\overline{\Lambda}_{s}\}$ is a valid POVM. Note also that

[TABLE]

where $(a)$ follows since the index $({\overline{w}}-1)\mu_{w}+i$ is changing from $1$ to ${\overline{M}}_{w}$. Repeating calculations similar to (57)-(67), we obtain that

[TABLE]

Furthermore, we have

[TABLE]

where $(a)$ follows from the convexity of the trace norm.

∎

Proof:

Intuitively, Alice splits the transmission into two part. Alice generates a purification of the state supposed to be transmitted in the first part, keeps the reference system for herself, and transmits the state over the channel, which results in a shared entangled state between Alice and Bob. Alice and Bob use an entanglement distillation protocol to distill perfect entanglement in the second part of the transmission. This might require classical communication, which can be achieved by using the result of Theorem 1. To formally state our protocol, we first need a generalization of the gentle measurement lemma.

Proposition 5**.**

Suppose that $\rho^{x}\in{\mathcal{D}}({\mathcal{H}})$ is a density operator, ${\mathcal{N}}^{x}:{\mathcal{D}}({\mathcal{H}})\to{\mathcal{D}}({\mathcal{H}}^{\prime})$ is a quantum channel for all $x\in{\mathcal{X}}$, and $\mathbf{\Lambda}=\{\Lambda^{x}\}_{x\in{\mathcal{X}}}$ is a POVM. Suppose that $P_{X}$ is a PMF over ${\mathcal{X}}$ such that $\sum_{x}P_{X}(x)\text{{tr}}\left(\rho^{x}\Lambda^{x}\right)\geqslant 1-\epsilon$. It then holds that

[TABLE]

Proof:

See Appendix A. ∎

Let $(f,\mathbf{\Lambda})$ be the $({M},\epsilon)^{\mathrm{CC}}$ satisfying $f({w})=f_{1}({w})\otimes f_{2}({w})$ for all ${w}\in\llbracket{1},{{M}}\rrbracket$, where f_{1}:\llbracket{1},{{M}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}\right)}, f_{2}:\llbracket{1},{{M}}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{2}}\right)}, and $n_{1}+n_{2}=n$. Let ${\overline{M}}^{\mathrm{CC}}\triangleq{\overline{M}}^{\mathrm{CC}}(f_{2},\zeta)$ and $K\triangleq K^{\mathrm{CC}}(f_{2},\zeta)$. Using the same argument as in the proof of Theorem 1, there exist an encoder function g_{{w}}:\llbracket{1},{{\overline{M}}^{\mathrm{CC}}}\rrbracket\times\llbracket{1},{K}\rrbracket\to{\mathcal{D}}{\left({\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{2}}\right)} and a POVM $\mathbf{\Gamma}_{{w},s}=\{\Gamma_{{w},s}^{\overline{w}}\}_{{\overline{w}}\in\llbracket{1},{{\overline{M}}^{\mathrm{CC}}}\rrbracket}$ for each message ${w}\in\llbracket{1},{{M}}\rrbracket$ such that

[TABLE]

Let $|\phi^{w}\rangle_{RA^{n_{1}}}$ and $\sigma^{w}_{RB^{n_{1}}}$ be defined as in Theorem 2. We define ${\overline{M}}^{w}\triangleq E_{d}(\rho_{RB^{n_{1}}}^{w},{\overline{M}}^{\mathrm{CC}},\zeta)$ and fix an $({\overline{M}}^{w},{\overline{M}}^{\mathrm{CC}},\rho_{RB^{n_{1}}}^{w},\zeta)^{\mathrm{ED}}$ protocol $({\mathcal{E}}^{w}_{R\to C{\widetilde{A}}},{\mathcal{D}}^{w}_{CB^{n_{1}}\to{\widetilde{B}}})$. Let $S_{1}$ and $S_{2}$ be two shared secret keys between Alice and Bob uniformly distributed over $\llbracket{1},{{\overline{M}}^{\mathrm{CC}}}\rrbracket$ and $\llbracket{1},{K}\rrbracket$, respectively. We define a POVM $\overline{\mathbf{\Lambda}}_{s_{2}}=\{\overline{\Lambda}^{{w},{\overline{w}}}_{s_{2}}\}_{{w},{\overline{w}}}$ with $\overline{\Lambda}^{{w},{\overline{w}}}_{s_{2}}\triangleq\sqrt{\Lambda^{w}}(\mathbf{1}_{B^{n_{1}}}\otimes\Gamma_{{w},s_{2}}^{\overline{w}})\sqrt{\Lambda^{w}}$. The stego protocol would operate as follows when $W={w}$.

Alice prepares $|\phi^{w}\rangle_{RA^{n_{1}}}$ and sends $\phi^{w}_{A^{n_{1}}}$ over $n_{1}$ uses of ${\mathcal{N}}_{A\to B}$. Alice then applies ${\mathcal{E}}^{w}_{R\to C{\widetilde{A}}}$ to $\phi^{w}_{R}$ and sends $g_{w}(C\oplus S_{1},S_{2})$ over $n_{2}$ uses of ${\mathcal{N}}_{A\to B}$. Bob performs the POVM $\overline{\mathbf{\Lambda}}_{S_{2}}$ to decode $W$ and $C$ with the help of $S_{1}$. Bob finally applies ${\mathcal{D}}^{w}_{CB^{n_{1}}\to{\widetilde{B}}}$ to his first $n_{1}$ received subsystem to obtain the entangled state.

Let $\rho_{B^{n}}^{w}$ denote the state received by Bob when $W={w}$ and the cover protocol is executed over $n$ uses of ${\mathcal{N}}_{A\to B}\circ{\mathcal{M}}_{A\to B}$. Let $\overline{\rho}_{B^{n}}^{w}$ denote the state received by Bob when $W={w}$ and the stego protocol is executed over $n$ uses of ${\mathcal{N}}_{A\to B}$. Note that both $\rho_{B^{n}}^{w}$ and $\overline{\rho}_{B^{n}}^{w}$ decompose as

[TABLE]

We have ({\mathcal{N}}_{A\to B}\circ{\mathcal{M}}_{A\to A})^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}(f_{1}(w))={\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}(\phi^{w}_{A^{n_{1}}}) because $|\phi^{w}\rangle_{RA^{n_{1}}}$ is a purification of {\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n_{1}}(f_{1}(w)). We therefore have

[TABLE]

which is less than $\zeta$ by (79). By the convexity of trace norm, it holds that ${{\left\|{\rho_{B^{n}}^{c}-\rho_{B^{n}}^{s}}\right\|}}_{1}\leqslant\zeta$. Following the same reasoning of the proof of Theorem 1, we conclude that

[TABLE]

In other words, Bob correctly decodes $W$ and $C$ with probability at least $1-\zeta-2\sqrt{\epsilon+\zeta}$.

We fix $W={w}$, $S_{1}=s_{1}$, and $S_{2}=s_{2}$ and denote

[TABLE]

Fixing a value $C=c$ and setting ${\overline{w}}\triangleq c\oplus s_{1}$, Alice transmits the subsystem $A^{n}$ of $\phi_{{\widetilde{A}}A^{n_{1}}}^{{w},c}\otimes g_{w}({\overline{w}},s_{2})$ over {\mathcal{N}}_{A\to B}^{{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}}, which results in the state $\phi_{{\widetilde{A}}B^{n}}^{{w},c}$.

The shared entangled state would be

[TABLE]

By (85) and Proposition 5, we obtain that

[TABLE]

By the definition of an entanglement distillation code, we have

[TABLE]

Using the triangle inequality completes the proof.

∎

Proof:

Let $|\phi\rangle_{R{\widetilde{A}}A^{n}}$ be a purification of $\rho_{{\widetilde{A}}A^{n}}$. Let $V_{A\to BE}$ and $W_{B^{n}\to{\widetilde{B}}H}$ be isometric extensions of ${\mathcal{N}}_{A\to B}\circ{\mathcal{M}}_{A\to A}={\mathcal{M}}_{A\to A}$ and ${\mathcal{D}}_{B^{n}\to{\widetilde{B}}}$, respectively. The stego protocol will be as follows. Alice prepares a pure state |\omega\rangle_{R{\widetilde{A}}B^{n}E^{n}}\triangleq\mathbf{1}_{R{\widetilde{A}}}\otimes V_{A\to BE}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}|\phi\rangle_{R{\widetilde{A}}A^{n}} and sends $\omega_{B^{n}}$ over {\mathcal{N}}_{A\to B}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}. Bob applies $W_{B^{n}\to{\widetilde{B}}H}$ on $\omega_{B^{n}}$, which results in the overall state

[TABLE]

Note that $F(\Phi^{(M)},\psi_{{\widetilde{A}}{\widetilde{B}}})\geqslant 1-\epsilon$ from our assumption on the code. We now follow a standard application of Uhlmann’s theorem to show that Bob can indeed decode $\psi_{RE}$. Note that $|\psi\rangle_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}$ is a purification of $\psi_{{\widetilde{A}}{\widetilde{B}}}$. The state $\Phi^{(M)}$ also has a purification over ${\mathcal{H}}_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}$. Uhlmann’s theorem therefore implies the existence of a purification $|\tau\rangle_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}$ of $\Phi^{(M)}$ over ${\mathcal{H}}_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}$ such that $|\langle\tau|\psi\rangle_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}|^{2}=F(\Phi^{(M)},\psi_{{\widetilde{A}}{\widetilde{B}}})$. The vector $|\Phi^{(M)}\rangle\otimes|0\rangle$ is another purification of $\Phi^{(M)}$ for every unit vector $|0\rangle\in{\mathcal{H}}_{RE^{n}H}$. By [26], there exists a unitary $T_{RE^{n}H\to RE^{n}H}$ on ${\mathcal{H}}_{RE^{n}H}$ such that

[TABLE]

We thus have $\langle\tau|\psi\rangle_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}=(\langle\Phi^{(M)}|\otimes\langle\tau|_{RE^{n}H})|\psi\rangle_{R{\widetilde{A}}E^{n}{\widetilde{B}}H}.$ We consider a Schmidt decomposition of $|\tau^{\prime}\rangle_{RE^{n}H}$ such as $|\tau^{\prime}\rangle_{RE^{n}H}=\sum_{x\in{\mathcal{X}}}\sqrt{P_{X}(x)}|\alpha_{x}\rangle_{RE^{n}}\otimes|\beta_{x}\rangle_{H}$, where $P_{X}$ is a PMF over ${\mathcal{X}}$, and $|\alpha_{x}\rangle_{RE^{n}}$ and $|\beta_{x}\rangle_{H}$ are orthonormal in $RE^{n}$ and $H$, respectively. Let $X$ be a random variable distributed according to $P_{X}$, $f:{\mathcal{X}}\to\llbracket{1},{{\overline{M}}}\rrbracket$, and $Q$ and $P_{f(X)}$ be the uniform distribution and the distribution of $f(X)$, respectively. By [35, Corollary 5.6.1] and [36, Theorem 7], when $\log{\overline{M}}\leqslant\sup_{a\in]0,1[}H^{a}(P_{X})-\frac{4}{a}\log\frac{2}{\zeta}$, there exists a function $f$ such that ${{\left\|{Q-P_{f(X)}}\right\|}}_{1}\leqslant\zeta$. Alice measures $\{\Lambda^{\overline{w}}_{A}\triangleq\sum_{x:f(x)={\overline{w}}}|\alpha_{x}\rangle\langle\alpha_{x}|_{RE^{n}}\}_{{\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket}$ on $\psi_{RE^{n}}$ and Bob measures $\{\Lambda^{\overline{w}}_{B}\triangleq\sum_{x:f(x)={\overline{w}}}|\beta_{x}\rangle\langle\beta_{x}|_{H}\}_{{\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket}$ on $\psi_{H}$. Let $W_{A}$ and $W_{B}$ denote the output of the Alice’s and Bob’s measurement, respectively and ${\mathcal{A}}_{RE^{n}\to W_{A}}$ and ${\mathcal{B}}_{H\to W_{B}}$ denote the corresponding quantum channels to these measurements. We have

[TABLE]

We can also write

[TABLE]

Hence,

[TABLE]

∎

Proof:

We start the proof by a technical lemma that helps us simplify the expression of the rate of the cypher message. Let $({\mathcal{E}}_{W\to A},{\mathcal{D}}_{A\to W})$ be an $(M,\epsilon)_{\textnormal{R}}^{\textnormal{QC}}$ code for one use of the channel ${\mathcal{M}}_{A\to A}$. Suppose that ${\mathcal{E}}_{W\to A}(\rho_{W})=V_{W\to A}\rho_{W}V_{W\to A}^{\dagger}$ where $V_{W\to A}$ is an isometry, and $\Pi=V_{W\to A}V_{W\to A}^{\dagger}$ is the projector on to the range of $V_{W\to A}$. Consider a decomposition, ${\mathcal{M}}_{A\to A}=\widetilde{{\mathcal{M}}}_{A\to A}+\widetilde{\widetilde{{\mathcal{M}}}}_{A\to A}$ such that ${\mathcal{D}}_{B\to W}\circ\widetilde{{\mathcal{M}}}_{A\to A}\circ{\mathcal{E}}_{W\to A}=c~{}\mathrm{id}_{W}$ for $c\geqslant 1-\epsilon$. There exists a Kraus representation $\{F_{j}\}_{j\in{\mathcal{J}}}$ for $\widetilde{{\mathcal{M}}}_{A\to A}$ such that $\Pi F_{j}^{\dagger}F_{j^{\prime}}\Pi=\mathds{1}\!\left\{j=j^{\prime}\right\}d_{j}\Pi$ for real positive numbers $\{d_{j}:j\in{\mathcal{J}}\}$. Define a PMF $P_{J}$ over ${\mathcal{J}}$ as $P_{J}(j)\triangleq\frac{d_{j}}{\sum_{j^{\prime}}d_{j^{\prime}}}$.

Lemma 3**.**

For all $\delta>2\sqrt{\epsilon}$, we have $H_{\min}^{\delta}(P_{J})\geqslant H_{\min}^{\delta-2\sqrt{\epsilon}}{\left({\mathcal{M}}^{c}_{A\to A}{\left(\frac{1}{M}\Pi\right)}\right)}$, where ${\mathcal{M}}^{c}_{A\to A}$ is the complementary channel of ${\mathcal{M}}_{A\to A}$.

Proof:

See Appendix B ∎

Consider the $(M,\epsilon)^{\textnormal{QC}}_{\textnormal{R}}$ cover protocol $({\mathcal{E}}_{W\to A^{n}},{\mathcal{D}}_{B^{n}\to W})$ for the channel {\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}. Let ${\mathcal{E}}_{W\to A^{n}}(\rho)=V_{W\to A^{n}}\rho V_{W\to A^{n}}^{\dagger}$ where $V_{W\to A^{n}}$ is an isometry, and $\Pi$ denote the projector onto the range of $V_{W\to A^{n}}$. By definition, there exists a decomposition {\mathcal{M}}_{A\to A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}=\widetilde{{\mathcal{M}}}_{A^{n}\to A^{n}}+\widetilde{\widetilde{{\mathcal{M}}}}_{A^{n}\to A^{n}} such that ${\mathcal{D}}_{B^{n}\to W}\circ\widetilde{{\mathcal{M}}}_{A^{n}\to A^{n}}\circ{\mathcal{E}}_{W\to A^{n}}=c~{}\mathrm{id}_{W}$ with $c\geqslant 1-\epsilon$. By the same argument as in the proof of [38, Theorem 10.1], there exists a Kraus representation $\{F_{j}\}_{j\in{\mathcal{J}}}$ for $\widetilde{{\mathcal{M}}}_{A^{n}\to A^{n}}$ such that $\Pi F_{j}^{\dagger}F_{j^{\prime}}\Pi=\mathds{1}\!\left\{j=j^{\prime}\right\}d_{j}\Pi$. By polar decomposition, we therefore have $F_{j}\Pi\triangleq U_{j}\sqrt{\Pi F_{j}^{\dagger}F_{j}\Pi}=\sqrt{d_{j}}U_{j}\Pi$ for some unitary $U_{j}$ on {\mathcal{H}}_{A}^{\mathchoice{\raisebox{1.0pt}{\displaystyle\otimes}}{\raisebox{1.0pt}{\otimes}}{\raisebox{0.5pt}{\scalebox{0.7}{\scriptstyle\otimes}}}{\raisebox{0.4pt}{\scalebox{0.6}{\scriptscriptstyle\otimes}}}n}.

Let $J$ be distributed according to $P_{J}(j)\triangleq\frac{d_{j}}{\sum_{j^{\prime}}d_{j^{\prime}}}$, and $Q$ denote the uniform distribution over $\llbracket{1},{{\overline{M}}}\rrbracket$. By [35, Corollary 5.6.1], there exists a function $g:{{\mathcal{J}}}\to\llbracket{1},{{\overline{M}}}\rrbracket$ such that ${{\left\|{P_{g({J})}-Q}\right\|}}_{1}\leqslant\zeta$, provided that

[TABLE]

where $(a)$ follows from Lemma 3, and $(b)$ follows from [36, Theorem 7].

Let $\mu_{\overline{w}}\triangleq\sum_{j\in\widetilde{{\mathcal{J}}}}\mathds{1}\!\left\{g(j)={\overline{w}}\right\}$. We then define $\overline{{\mathcal{E}}}^{\overline{w}}_{W\to A^{n}}(\rho)\triangleq\frac{1}{\mu_{\overline{w}}}\sum_{j:g(j)={\overline{w}}}U_{j}{\mathcal{E}}_{W\to A^{n}}(\rho)U_{j}^{\dagger}$ (for $\mu_{\overline{w}}=0$ take $\overline{{\mathcal{E}}}^{\overline{w}}_{W\to A^{n}}={\mathcal{E}}_{W\to A^{n}}$). We define the decoder for Bob as

[TABLE]

where the term $E\rho_{B^{n}}^{\dagger}E^{\dagger}$ is added to ensure that $\overline{{\mathcal{D}}}_{B^{n}\to W\overline{W}}$ is trace-preserving. By the argument in the proof of [38, Theorem 10.1], $\overline{{\mathcal{D}}}_{B^{n}\to W\overline{W}}$ is a valid quantum channel. The partial channels are

[TABLE]

Furthermore, for any $\rho_{W}\in{\mathcal{D}}({\mathcal{H}}_{W})$, we have

[TABLE]

For a ${\overline{w}}\in\llbracket{1},{{\overline{M}}}\rrbracket$ we have

[TABLE]

We can write

[TABLE]

Hence, it holds that $\overline{{\mathcal{D}}}_{B^{n}\to W}\circ\widetilde{{\mathcal{M}}}_{A^{n}\to A^{n}}\circ{\mathcal{E}}_{W\to A^{n}}^{\overline{w}}={\mathcal{D}}_{B^{n}\to W}\circ\widetilde{{\mathcal{M}}}_{A^{n}\to A^{n}}\circ\overline{{\mathcal{E}}}_{W\to A^{n}}=c\mathrm{id}_{W}$ for $c\geqslant 1-\epsilon$. Finally for all $\rho_{W}$, we have

[TABLE]

For the first term, we have

[TABLE]

where $(a)$ follows since by the definition of ${\mathcal{E}}_{W\to A^{n}}$, $\Pi{\mathcal{E}}_{W\to A^{n}}(\rho_{W})\Pi={\mathcal{E}}_{W\to A^{n}}(\rho_{W})$, and $F_{j}\Pi=\sqrt{d_{j}}U_{j}\Pi$. Furthermore,

[TABLE]

∎

Appendix A Proof of Proposition 5

By the triangle inequality, we have

[TABLE]

Since ${\mathcal{N}}^{x^{\prime}}(\sqrt{\Lambda^{x^{\prime}}}\rho^{x}\sqrt{\Lambda^{x^{\prime}}})$ is positive semi-definite, the second term would simplify as

[TABLE]

Furthermore, by the gentle measurement lemma, we have

[TABLE]

where $(a)$ follows from the date processing inequality (which holds for non-normalized states), and $(b)$ follows from the concavity of the mapping $x\mapsto\sqrt{1-x}$.

Appendix B Proof of Lemma 3

We extend $\{F_{j}\}_{j\in{\mathcal{J}}}$ to a Kraus representation $\{F_{j}\}_{j\in{\mathcal{K}}}$ for the channel ${\mathcal{M}}_{A\to A}$ with ${\mathcal{J}}\subset{\mathcal{K}}$. By [26], $U_{A\to AE}\triangleq\sum_{j\in{\mathcal{K}}}F_{j}\otimes|j\rangle_{E}$ is an isometric extension of ${\mathcal{M}}_{A\to A}$ where $\{|j\rangle_{E}\}_{j\in{\mathcal{K}}}$ is an orthonormal basis for the environment space ${\mathcal{H}}_{E}$. Let $\rho_{A}\triangleq{\mathcal{E}}_{W\to A}{\left(\frac{1}{M}\mathbf{1}_{W}\right)}=\frac{1}{M}\Pi$, and

[TABLE]

For the projector $\Gamma\triangleq\sum_{j\in{\mathcal{J}}}|j\rangle\langle j|_{E}$, we have

[TABLE]

where $(a)$ follows since $\{F_{j}\}_{j\in{\mathcal{J}}}$ is a Kraus representation of $\widetilde{{\mathcal{M}}}_{A\to A}$, $(b)$ follows since ${\mathcal{D}}_{A\to W}$ is trace-preserving. By the gentle measurement lemma [37], we obtain that ${{\left\|{\frac{\Gamma\rho_{E}\Gamma}{\text{{tr}}\left(\Gamma\rho_{E}\right)}-\rho_{E}}\right\|}}_{1}\leqslant 2\sqrt{\epsilon}$. We can write

[TABLE]

Therefore, we have $H_{\min}^{\delta}(P_{J})\geqslant H_{\min}^{\delta-2\sqrt{\epsilon}}(\rho_{E})$