Discrete-modulated continuous-variable quantum key distribution secure against general attacks
Ignatius William Primaatmaja Wen Yu Kon Charles Lim



















backgrounds

















backgrounds















































































thmTheorem
dfDefinition
lemmaLemma
corollaryCorollary


protcounter
prot

protcounter

Protocol :







Department of Electrical & Computer Engineering, National University of Singapore, Singapore
Squareroot8 Technologies Pte Ltd, Singapore


Department of Electrical & Computer Engineering, National University of Singapore, Singapore
Global Technology Applied Research, JPMorgan Chase & Co, Singapore


Department of Electrical & Computer Engineering, National University of Singapore, Singapore
Global Technology Applied Research, JPMorgan Chase & Co, Singapore


§ ABSTRACT 
In recent years, discrete-modulated continuous-variable quantum key distribution (DM-CV-QKD) has gained traction due to its practical advantages: cost-effectiveness, simple state preparation, and compatibility with existing communication technologies. This work presents a security analysis of DM-CV-QKD against general sequential attacks, including finite-size effects. Remarkably, our proof considers attacks that are neither independent nor identical, and makes no assumptions about the Hilbert space dimension of the receiver. To analyse the security, we leverage the recent generalised entropy accumulation theorem and the numerical methods based on quasi-relative entropy. We also develop a novel dimension reduction technique which is compatible with the entropy accumulation framework. While our analysis reveals significant finite-size corrections to the key rate, the protocol might still offer advantages in specific scenarios due to its practical merits. Our work also offers some insights on how future security proofs can improve the security bounds derived in this work.


Discrete-modulated continuous-variable quantum key distribution 

secure against general attacks
    Charles Lim
    September 9, 2024
================================================================================================



§ INTRODUCTION
 
Quantum key distribution (QKD) is amongst the most mature quantum technologies, with some companies pushing for its commercial applications. Since its inception in 1984 <cit.>, QKD has undergone a rapid development in both theoretical and experimental aspects. Novel QKD protocols have been proposed and demonstrated, typically with an

emphasis on improving the secret key rate and/or the range of the protocol. 
However, for QKD to be widely deployed, it is also crucial to take into account the

simplicity of the setup as well as the cost of the hardware.

Broadly speaking, based on how classical information is being encoded into quantum information, QKD protocols can be distinguished into two major categories: discrete-variable (DV) and continuous-variable (CV). DV-QKD protocols encode discrete classical information into optical modes (e.g., polarisation, time-bins, etc) of a light source, typically a laser. To decode the classical information, photon counting techniques are used, usually using threshold single-photon detectors. DV-QKD typically has good secret key rates and range (e.g.,  <cit.>), but the single-photon detectors required are less mature, more expensive and sometimes require cooling.

On the other hand, CV-QKD protocols typically encode continuous classical information into the optical phase space <cit.> (i.e., the X and P quadratures). To decode the information, coherent detection techniques, such as homodyne and heterodyne detection, are typically employed. Remarkably, these detectors are also used in the classical communication infrastructure, thus homodyne and heterodyne detectors are commercially more mature than single-photon detectors. Furthermore, they are also typically more cost-effective than the single-photon detectors counterparts and they can operate at room-temperature. Moreover, these detectors are readily integrated on chips <cit.>. Therefore, the use of coherent detection techniques provide an edge for practical applications, especially over metropolitan distances and last-mile key exchanges <cit.>. 

However, the requirement that classical information has to be continuous (often Gaussian distributed <cit.>) affects the practicality of CV-QKD protocols. Real optical modulators have finite precision which means that continuous modulation is only a theoretical idealisation, which does not correspond to the practical implementation. Such theory-experiment gap can open up security loopholes for QKD and it may be exploited by a sufficiently advanced adversary. To ease this requirement, two solutions has been proposed 
in the literature. Firstly, one can encode discrete information into optical modes, like in DV-QKD, and use coherent detection techniques to perform photon counting <cit.>. This method has the additional benefit of removing the requirement of sharing a global phase reference between the two communicating parties at the price of shorter distances. Another alternative is to simply encode discrete classical information into a discrete constellation in the phase space. This approach is known as discrete-modulated CV-QKD (DM-CV-QKD). While this solution requires the two honest parties to share a global phase reference, protocols with this feature typically have longer ranges and higher secret key rate. In this work, we shall focus our attention to the latter.






For practical implementations, the quantum communication phase in QKD is performed round-by-round. Attacks on QKD can be classified based on what the adversary can do in the quantum channel in each round <cit.>. For the most general attack (also known as coherent attacks), the adversary is allowed to execute any strategy that is allowed by quantum mechanics (e.g., adjusting her attack based on a measurement result in the preceding rounds, entangle multiple states together before sending them to the receiver, etc). Analysing the security of a QKD protocol against general attack may require multi-round analyses, would be intractable to parameterise as QKD protocols typically involve a large number of rounds.

Nevertheless, techniques have been developed for protocols that exhibit certain structures (e.g., permutation symmetry <cit.>, Markov condition in sequential protocols <cit.>, non-signalling condition in sequential protocols <cit.>, etc). In these special cases, the techniques reduce the problem to single-round analyses. Interestingly, many of these techniques use the conditional von Neumann entropy of the secret bit, given the adversary's quantum side information and the classical announcements for a single round, as the quantity of interest. This is the same quantity of interest for security under collective attacks, where an adversary acts independently and identically in each round, allowing the security of the protocol to be analyzed by only looking at a single round of the protocol. This causes many of the works that are tailored to analysing the security against collective attacks to be relevant to the security analysis against general attacks.







One of these techniques is the generalised entropy accumulation theorem (GEAT) <cit.>. It is a technique that is applicable to any QKD protocols that has the so-called no-signalling structure. Informally, the no-signalling structure requires that classical and quantum information leaked in a given round does not leak additional information about the secret bits generated in preceding rounds. Fortunately, many QKD protocols exhibit this feature which makes the GEAT a versatile tool to prove the security of a QKD protocol. Another important feature of the GEAT is that it naturally incorporates the finite-size effects into the security analysis. As any practical QKD protocol is executed within a finite duration, finite-size effects such as statistical fluctuations, have to be accounted for carefully.

DM-CV-QKD protocols have enjoyed a significant progress in their security analysis in recent years. First, the security of the protocol is analysed under restricted attacks <cit.>. Then, Ghorai et al <cit.> has proven its security in the asymptotic limit (i.e., when there are infinite number of rounds). The security proof relies on the extremality of Gaussian states, a technique that is commonly used in Gaussian modulated CV-QKD. However, for DM-CV-QKD, it turns out that the bound is too pessimistic, which leads to sub-optimal secret key rate. The asymptotic bound was then improved by Lin et al <cit.> under the so-called photon number cutoff assumption. This assumption effectively assumes that the adversary sends a state that lives in a finite-dimensional Hilbert space (corresponding to the low photon number subspace of the Fock space). While this assumption may be a good approximation which greatly simplifies the computation, it is hardly justifiable. However, the work of Lin et al <cit.> showed that DM-CV-QKD could potentially allow the exchange of secret keys at relatively high key rate and over reasonably long distances.

Following their initial work in Ref. <cit.>, Lin-Lütkenhaus also analysed the security of the DM-CV-QKD protocol under the trusted detector noise scenario <cit.>. This refers to the scenario where the limitations of the detectors, such as imperfect quantum efficiency and electrical noise, are characterised and known to the users. In the normal circumstances, these imperfections are attributed to the adversary. Ref. <cit.> showed that by characterising these imperfections, the performance of the protocol can be greatly improved. Another important milestone is presented in Ref. <cit.>, which removes the need for photon number cutoff assumption. The work of Ref. <cit.> offered the so-called dimension reduction technique, which effectively gives a correction term to the computation of the conditional von Neumann entropy with the photon number cutoff. Remarkably, Ref. <cit.> showed that the correction term is relatively small and DM-CV-QKD can still offer practical advantages even after accounting for this correction.

Given the potential of DM-CV-QKD shown from the studies of the protocol's security in the asymptotic regime, in recent years, researchers have tried to study the finite-size security of the protocol. Notably, Kanitschar et al <cit.> studied the finite-size security of the protocol under the assumption that the adversary performs collective attacks. On the other hand, Bauml et al <cit.> studied the finite-size security of the protocol against general attacks but under the photon number cutoff assumption.

Remarkably, while these works focused on protocols with quadrature phase-shift keying (QPSK) encoding, DM-CV-QKD protocols with different constellations have also been studied. The two-state protocol has been analysed by Ref. <cit.> in the asymptotic limit and by Ref. <cit.> in the finite-key regime. On the other hand, the three-state protocol was analysed in Ref. <cit.>. Recently, the variant of the protocol with large constellation size has also been analysed <cit.>.

At the time of writing, the security of DM-CV-QKD protocols against general attacks have not been performed without the photon number cutoff assumptions (except for the two-state case <cit.>). Unfortunately, it is not straightforward to remove the collective attack assumption using Ref. <cit.>'s framework since techniques that relies on permutation symmetry has a correction term that depends on the Hilbert space dimension, which is infinite for DM-CV-QKD.
Moreover, entropy accumulation frameworks require the parameter estimation to be based on frequency distributions while Ref. <cit.> estimates moments. On the other hand, it is also difficult to remove the photon number cutoff assumption in Ref. <cit.> as the dimension reduction technique requires the estimate of the mean photon number of the incoming states, which is again incompatible with the entropy accumulation framework. 

In this work, we successfully remove these two assumptions simultaneously by employing the entropy accumulation framework (in particular, the GEAT version <cit.>) and developing a novel dimension reduction technique that only requires estimation of probability distributions. However, our work reveals that when both the collective attack and photon number cutoff assumptions are removed, DM-CV-QKD protocols suffer from a significant finite-size penalty.

The paper is organised as follows. We first introduce some preliminary notions in Section <ref>, such as the notation that we use in this paper, how security is defined for QKD and the GEAT framework which will be used in this paper. In Section <ref>, we define the DM-CV-QKD protocol that we will analyse. We will present the security analysis of the protocol in Section <ref>. Following which, we present a simulation of the protocol's performance in Section <ref>. Lastly, we will discuss the results that we obtain, some potential future works, and we conclude our paper in Section <ref>.




§ PRELIMINARIES
 


 §.§ Notations and definitions
 


  §.§.§ Basic notations



We will first introduce the notations that we use in this paper. The capital letters A, B, and E are typically associated to the parties Alice, Bob and Eve, respectively. 

The other capital letters from the Latin alphabet typically refer to random variables, unless explicitly stated. In particular, we denote N as the total number of rounds in the QKD protocol. Many of the random variables in this work are indexed in the subscripts to indicate the round associated to the particular random variable. For example, we use the letter Z to denote Bob's measurement outcome. Then, Z_j denotes Bob's measurement outcome in the j-th round. On the other hand, when we index a random variable in the superscript, this refers to a sequence of random variables up to that particular round. For example, the random variable Z^j refers to the sequence Z_1, Z_2 , ..., Z_j. When referring to an entire sequence, we will write the particular letter in boldface. For example, when writing Z, we refer to the sequence Z_1, Z_2 ,..., Z_N. When referring to a key of length ℓ, we will also use the boldface letter K = K_1, K_2, ... , K_ℓ where K_j refers to the j-th bit of the key. For any positive integer j, we write [j] to denote the set {1, 2, ..., j}.

The calligraphic capital letters (e.g., , , , etc) are typically reserved for quantum channels. There are certain exceptions for this rule, which we will explicitly state when we first introduce the notation in the relevant section. Notable exceptions for this rule is  which denotes the range of the random variable C, and  which we generally reserve to denote Hilbert spaces.


We use ℕ, ℤ and ℝ to denote the sets of natural numbers, integers and real numbers, respectively. We write 𝖫() to denote the set of linear operators acting on the Hilbert space , 𝖡() denotes the set of bounded operators acting on the Hilbert space , 𝖣() denotes the set of sub-normalised quantum states living in the Hilbert space .




  §.§.§ Distance measures

In QKD, we often consider how close a quantum state to another quantum state. This is made precise using distance measures. In this paper, there are two distance measures that we use. Firstly, we use Δ to denote the trace distance, which is defined as

    Δ(ρ, σ) = 1/2ρ - σ_1,

for some ρ, σ∈𝖣() and some Hilbert space . For some operator M, the trace norm is defined as

    M_1 = [√(M^† M)],

where M^† denotes the adjoint of M. The trace distance is used in defining the security of QKD.

The second distance measure that we use is the purified distance, denoted by Δ_P. It is defined as

    Δ_P(ρ,σ) = √(1 - F(ρ, σ)^2),

for some ρ, σ∈𝖣() and some Hilbert space . The generalised fidelity F(ρ,σ) is defined as
    F(ρ,σ) = √(ρ)√(σ)_1 + √((1 - [ρ])(1-[σ]))

In this work, the purified distance is used to define the conditional smooth min-entropy.



  §.§.§ Entropic quantities
 

The quantum communication phase of a QKD protocol can be thought of as a weak random source – it generates random strings that may not be uniformly distributed nor independent of the adversary's side information. To characterise the quality of a weak random source, it is customary to consider its “entropy”. There are many entropic quantities in the literature, each appropriate to a particular information processing task. We shall introduce some of these entropic quantities that we will use in this work.

We recall that the relevant scenario for QKD is one where there is a classical register held by the honest parties and a quantum register held by the adversary. In this section, we shall denote the classical register by A and the quantum register by B. Let ρ_AB∈𝖣(_A ⊗_B) be a classical-quantum state. We can write ρ_AB = ∑_a p(a) |a⟩⟨a|⊗ρ_B^a, for some probability distribution {p(a)}_a. We will define the entropic quantities with respect to this state.

The first entropic quantity that we consider is the conditional min-entropy, which is relevant for the task of privacy amplification. This quantity is a measure of the probability of guessing the value of the register A, given the quantum side information stored in register B. The conditional min-entropy is defined as

    H_min(A|B)_ρ = - log_2 max_{Π_a}_a∑_a p(a) [ρ_B^a Π_a].

Here, the maximisation is taken over all possible measurement operators {Π_a}_a acting on _B.

However, when allowing the output of a QKD protocol to slightly deviate from an ideal key, we can consider smoothing on the conditional min-entropy. In this case, given the classical-quantum state ρ_AB, we do not actually evaluate the conditional min-entropy on the state ρ_AB, but on another state that is close to ρ_AB. Now, let ∈ (0,1).  is the so-called smoothing parameter, which measures how close the state in which the conditional min-entropy is evaluated to the state under consideration, i.e., ρ_AB. In this work, the distance measure that we use for the smoothing is the purified distance. We define the -ball around the state ρ_AB, which we denote as _(ρ_AB)

    ℬ_(ρ_AB) = {σ_AB:  σ_AB∈𝖣(_A ⊗_B), 
    Δ_P(ρ_AB, σ_AB) ≤}.

Given the smoothing parameter  and state ρ_AB, the conditional smooth min-entropy is defined as

    H_min^(A|B)_ρ = max_σ_AB∈_(ρ_AB) H_min(A|B)_σ.

In general, there exists a state that is -close to ρ_AB (in purified distance) but has significantly higher conditional min-entropy than ρ_AB. This means that in general, the conditional smooth min-entropy can be significantly higher than its non-smoothed counterpart. Therefore, the conditional smooth min-entropy gives a more optimal characterisation of randomness of a weak random source

The next entropic quantity that we consider is the conditional von Neumann entropy, defined as

    H(A|B)_ρ = H(AB)_ρ - H(B)_ρ

where H denotes the von Neumann entropy, defined as

    H(AB)_ρ   = - [ρ_ABlog_2(ρ_AB)]
    
        H(B)_ρ   = - [ρ_B log_2(ρ_B)].

The conditional von Neumann entropy is a relevant quantity when using the generalised entropy accumulation theorem.

Finally, we also introduce the quantum relative entropy. Given a quantum state ρ and positive semi-definite operator σ, the quantum relative entropy is given by

    D(ρ||σ) = 
        [ρ (log_2(ρ) - log_2(σ))]    if supp(ρ) ⊆supp(σ)
    
            +∞   otherwise,

where for an operator M ∈𝖫(), supp is defined as

    supp(M) = {|ψ⟩∈: M|ψ⟩≠ 0}


Given a classical-quantum state ρ_AB, the conditional von Neumann entropy is related to the quantum relative entropy

    H(A|B)_ρ = D(ρ_AB||_A ⊗ρ_B).




 §.§ Security definition
 
The goal of a QKD protocol is to allow two distant parties, whom we call Alice and Bob, to share a pair of identical keys that is random from the point of view of the adversary, whom we call Eve. In the literature, this is often formalised in terms of the “real-versus-ideal-world” paradigm. Under this paradigm, we consider two protocols – the real QKD protocol, which outputs the state ρ_K_A K_B L E (where K_A stores Alice's key, K_B stores Bob's key, L stores Eve's classical side information and E  stores Eve's quantum side information), and a hypothetical ideal protocol, which outputs a pair of perfect keys whenever the protocol is not aborted – we denote the event in which the protocol is not aborted by Ω. In particular, this perfect pair of keys are always identical, uniformly distributed and independent from the adversary's side information E and L.

In practice, when proving the security of a QKD protocol, we usually consider the following criteria

    
  * Correctness:

    For a fixed ∈ (0,1), a QKD protocol is said to be -correct if it satisfies 
    
    [K_A ≠K_B ∧Ω] ≤.

    
    
    
    
  * Completeness:
    For a fixed ∈ (0,1), a QKD protocol protocol is said to be -complete if
    
    [Ω]_honest≥ 1 - .

    The subscript “honest” specifies that the probability is evaluated based on the honest implementation. This refers to the scenario where the implementation might be noisy, but the adversary does not introduce more noise than expected.
    
    
  * Secrecy:

    For a fixed ∈ (0,1) and ℓ∈ℕ, a QKD protocol is said to be -secret (with respect to Bob's key) if
    
    [Ω] ·Δ(ρ_K_B L E|Ω, τ_ℓ⊗ρ_L E|Ω)≤,

    where ℓ denotes the output length of the QKD protocol and τ_ℓ = 2^-ℓ∑_k ∈{0,1}^ℓ|k⟩⟨k|.

    
    Specifically for secrecy, the conditional smooth min-entropy is central in the security analysis of QKD, due to the so-called leftover hash lemma. Let _PA be the quantum channel that describes the privacy amplification step of a QKD protocol. We write ρ_K_B L E|Ω = _PA[ρ_ZLE|Ω]. The leftover hash lemma states that if two-universal hashing is used, then we have <cit.>
    
    Δ(ρ_K_B L E|Ω, τ_ℓ⊗ρ_L E|Ω) 
    ≤ 2^-1/2( H_min^(Z|L,E)_ρ_ZLE|Ω - ℓ + 2) + 2 .

    In other words, the distance between the state describing the output of the real QKD protocol and the output of the ideal protocol is related to the conditional smooth min-entropy of the raw key Z (i.e., the string that is obtained before the privacy amplification step). This reduces the problem of proving the secrecy of a QKD protocol to deriving a lower bound on the conditional smooth min-entropy of the raw key. In turn, this can be solved using GEAT.




 §.§ Generalised entropy accumulation
 
Generalised entropy accumulation theorem (GEAT) <cit.> is a technique for lower bounding the conditional smooth min-entropy H_min^(Z|L, E_N) of a string Z = Z_1 ... Z_N given the classical side information L = L_1 ... L_N and quantum side-information E_N that are generated from a certain class of N-step sequential processes. GEAT formalises this class of processes in terms of the so-called GEAT channels, which we define below [The definition we use in this work is slightly less general than the definition of GEAT channels used in Refs. <cit.>. In particular, we do not consider any memory registers since we focus on the device-dependent framework in this paper].


[GEAT channels]
The quantum channels {_j}_j=1^N where _j: E_j-1 L^j-1→ Z_j C_j E_j L^j (registers Z_j, L_j and C_j are classical registers) are called GEAT channels if each _j satisfies the following two conditions

    
  * Non-signalling condition: There exists a quantum channel _j: E_j-1 L^j-1→ E_j L^j such that
    
    _Z_j C_j∘_j = _j

    
  * For all j ∈ [N], C_j has a common alphabet  and is a deterministic function of Z_j and L_j.


In the context of QKD, the non-signalling condition requires that in any given round, Eve is capable to update her side-information without Bob's private information that has been generated in the preceding rounds. This is indeed the case for many QKD protocols, including the DM-CV-QKD protocol that we will analyse. 


Roughly speaking, the GEAT states that

    H_min^(Z|L, E) ≥ N h - O(√(N)),

where the constant h can be obtained by analysing a single round of the protocol, rather than analysing the entire protocol directly. In fact, the constant h is related to the so-called min-tradeoff function which we define below.

[Min-tradeoff functions]
Let {_j}_j=1^N be a sequence of GEAT channels and let _ be the set of probability distributions over . An affine function f: _→ℝ is called a min-tradeoff function for the GEAT channels {_j}_j=1^N if it satisfies
    
    f(q) ≤inf_σ∈Σ(q) H(Z_j|E_j L^jẼ_j-1)_σ,

    where
    
    Σ(q) = {σ_Z_j C_j L^j E_j Ẽ_j-1 = (_j ⊗𝕀_Ẽ_j-1)[ω_L^j-1E_j-1Ẽ_j-1]: 
    σ_C_j = ∑_c ∈ q(c) |c⟩⟨c|_C_j}.



The constant h is the value of the min-tradeoff function evaluated at the worst probability distribution that is accepted in the parameter estimation step of the protocol. To calculate the second order terms O(√(N)), it is useful to define some properties of the min-tradeoff functions

    [f]    = max_q ∈_ f[q],
    [f]    = min_q ∈_ f[q],
    _Σ[f]    = min_q:  Σ(q) ≠∅ f[q],
    [f]    = max_q:  Σ(q) ≠∅∑_c q(c) f(ê_c)^2 - (∑_c q(c) f(ê_c))^2.

Having introduced these properties of the min-tradeoff function, we can now present the lower bound on the conditional smooth min-entropy
 
    Let ∈ (0,1), β∈ (0, 1/2). Let ρ_E_0 be an initial state and ρ_ZCL E_N = _N ∘ ... ∘_1[ρ_E_0] be the final state after applying the GEAT channel N times. Let f be a min-tradeoff function and Ω⊆^N be an event such that h = min_c∈Ω f(_c). Then,
    
    H_min^(Z|L, E_N)_ρ_ZL E_N |Ω
    ≥ N h - β/1 - βln 2/2 V^2- N (β/1 - β)^2 K_β
    
            - log_2(1 - √(1 - ^2)) - (1+β) log_2 [Ω]/β,

    where
    
    V    = log_2(2d_Z^2 + 1) + √(2 + [f])
    
            K_β   = (1 - β)^3/6(1 - 2 β)^3 ln 2 2^β/1 - β(2 log_2 d_Z + [f] - _Σ[f])
         ×ln^3 (2^2 log_2 d_Z + [f] - _Σ[f] + e^2 ).



To construct the min-tradeoff function, it is customary to decompose the GEAT channel into two parts: the testing channel and the generation channel

    _j = (1-γ) _j^gen + γ_j^test,

where the C_j register of the output of _j^gen is always |⊥⟩⟨⊥|. On the other hand, _j^test never outputs |⊥⟩⟨⊥| on C_j. Then, consider another affine function g: _∖{⊥}→ℝ that satisfies the following property

    g(q) ≤   inf_σ H(Z_j|E_j, L^j Ẽ_j-1)__j[σ]
       s.t. _j^test[σ]_C_j = ∑_c ≠⊥ q(c) |c⟩⟨c|.

Intuitively, g is a lower bound on the conditional von Neumann entropy subject to the probability distribution of the test rounds. From g, we can construct the min-tradeoff function from the function g by using the following construction

    f(ê_c)    = [g] + g(ê_c) - [g]/γ,       c ∈∖{⊥},
    
        f(ê_⊥)    = [g].

This construction will lead to the following properties of the min-tradeoff function

    [f]    = [g],
    [f]    = (1 - 1/γ)[g] + 1/γ[g],
    _Σ[f]    ≥[g],
    [f]    ≤([g] - [g])^2/γ.

The explicit construction of the function g for DM-CV-QKD will be presented in Section <ref>.



§ PROTOCOL
 



We shall now give the description for the protocol that we consider. For the sake of concreteness, we consider a variant of the protocol with quadrature-phase-shift-keying (QPSK) encoding, heterodyne detection and reversed reconciliation for error-correction. However, our security analysis can be easily adapted to the case where another constellation is used for the encoding of the quantum states as we leverage on numerical methods that did not exploit any symmetry of the encoding scheme. The dimension reduction technique can also be modified to the protocol variant which uses homodyne detection rather than heterodyne detection.

We fix N ∈ℕ, α > 0, ^key > 0, 0 ≤ <, γ∈ (0, 1) and the parameter estimation scores f_PE and its tolerated range _.


    
  * State preparation: For every round j ∈ [N], Alice uniformly chooses X_j ∈{0,1,2,3}. Next, she prepares the coherent state |ψ_X_j⟩ = |α e^i (π X_j/2 + π/4)⟩ for some fixed α > 0 that is specified by the protocol. She sends the state to Bob via an untrusted quantum channel.
    
    
  * Measurement: Bob randomly assigns T_j ∈{0, 1} with probability {1-γ, γ}, respectively. Upon receiving the optical signal from the untrusted quantum channel, Bob performs a heterodyne detection to obtain an outcome Y_j ∈ℂ. 
    From the measurement outcome, he writes Y_j = √(W_j) e^i θ_j for some θ_j ∈ [0, 2π) and W_j = Y_j^2. 
    If T_j = 0, he applies the following discretisation map Y_j → Z_j (see Fig. <ref>b):
    
    Z_j = ∅    W_j < ^key, 
    
            0     W_j ≥^key∧θ_j ∈ [0 , π/2),
    
            1     W_j ≥^key∧θ_j ∈ [π/2 , π),
    
            2     W_j ≥^key∧θ_j ∈ [π , 3π/2),
    
            3     W_j ≥^key∧θ_j ∈ [3π/2 , 2π),

    If T_j = 1, he applies the following discretisation map instead (see Fig. <ref>a):
    
    Z_j = 
            (∅, 0)     W_j < ∧θ_j ∈ [0 , π/2), 
    
            (∅, 1)     W_j < ∧θ_j ∈ [π/2 , π), 
    
            (∅, 2)     W_j < ∧θ_j ∈ [π , 3π/2), 
    
            (∅, 3)     W_j < ∧θ_j ∈ [3π/2 , 2π), 
    
            0    ≤ W_j ≤∧θ_j ∈ [0 , π/2),
    
            1    ≤ W_j ≤∧θ_j ∈ [π/2 , π),
    
            2    ≤ W_j ≤∧θ_j ∈ [π , 3π/2),
    
            3    ≤ W_j ≤∧θ_j ∈ [3π/2 , 2π), 
    ⊤    W_j >

    Repeat step 1 to 2 for N times.
    
    
  * Parameter estimation: For each j ∈ [N], Bob announces T_j. If T_j = 0, Bob announces the rounds j in which Z_j = ∅. For each T_j = 1, Alice announces X_j. Bob computes C_j = f_PE(T_j, X_j, Z_j) for some deterministic function f_PE where C_j = ⊥ if and only if T_j = 0 and C_j = ∅ if and only if T_j = 1 and Z_j = ⊤. If _C∈_, they continue to the next step, else they abort.
    
    
  * Classical post-processing: Bob sends Alice a syndrome of his data. They apply error correction and error verification. If the error verification passes, then they apply privacy amplification on their data to obtain the final secret key.



§ SECURITY ANALYSIS
 
In this section, we shall present the security analysis of DM-CV-QKD protocols. As defined in Section <ref>, to prove the security of a QKD protocol, we need to show that it satisfies the completeness, correctness and secrecy criteria.



 §.§ Correctness

The proof of the correctness of the protocol is pretty straightforward. The correctness of the protocol is guaranteed by the error verification step, which is performed after the error correction step. In the error correction step, Bob sends the syndrome of his key so that Alice can produce a guess Ẑ of his key, Z. The purpose of the error verification step is to verify that the error correction step has successfully enables Alice to correctly guess Bob's key. If the error correction step fails (i.e., when Ẑ≠Z), we want the error verification step to detect this failure with high probability. This can be done using the property of two-universal hashing.

In the error verification step, Bob randomly picks a hash function f_EV from the two-universal family and calculate the hash of his key, f_EV(Z). He would then announce the hash function  that he chose and the corresponding hash value to Alice using the public but authenticated classical communication channel. Alice would then compute the hash value of her guess of Bob's key, f_EV(Ẑ). If f_EV(Ẑ) ≠ f_EV(Z), then they abort the protocol.

The correctness of the protocol is due to the property of the two-universal hash function. Let ℓ_EV be the length of the hash that Bob announced. Then, by the property of two-universal hash functions, we have

    [f_EV(Ẑ) ≠ f_EV(Z) | Ẑ≠Z] ≤1/2^ℓ_EV

Thus, by taking ℓ_EV≥log_2(1/), and noting that Ẑ≠Z implies K_A≠K_B, then

    [K_A≠K_BΩ]
    ≤[Ẑ≠Z][Ω | Ẑ≠Z] ≤,

which proves that the protocol is -correct.







 §.§ Completeness

To prove completeness, we recall that the protocol can be aborted in either the parameter estimation step or in the error verification step. Therefore, we can write

    [abort] ≤[abort in PE] + [abort in EV],

where [abort in PE] is the probability that the protocol is aborted in the parameter estimation step and [abort in EV] is the probability that the protocol is aborted in the error verification step. The latter can be upper bounded also

    [abort in EV] ≤[EC fail],

where [EC fail] is the probability that the error correction algorithm fails to make Alice's key identical to Bob's key.

Therefore, we can choose the completeness parameter  to be equal to

    = ^PE + ^EC,

where ^PE≥[abort in PE] and ^EC≥[EC fail].

While there is an information-theoretic bound on [EC fail] based on the error rate in the honest implementation, the error correction algorithm that saturates this bound is difficult to implement in practice <cit.>. On the other hand, it is typically difficult to prove an upper bound on the failure probability of practical error correction algorithms and one often relies on heuristics. Therefore, in this work, we shall focus on bounding the probability of aborting the protocol in the parameter estimation step.

To do that, we need to assume that the honest implementation produces a probability distribution p on the score C. Then, for each c ∈, we fix ζ_c, ζ'_c > 0 such that the protocol is accepted if and only if

    p(c) - ζ'_c ≤(c) ≤ p(c) + ζ_c

for all c ∈.

Now, we assume that for each c ∈, there exists ^PE,c > 0 such that

    [ p(c) - ζ'_c ≤freq(c) ≤ p(c) + ζ_c] ≥ 1 - ^PE,c.

We can construct such ^PE,c by taking the complement of the above event, and simplify using the union bound,

    ^PE, c≥[(c) ≥ p(c) - ζ'_c] 
    
        + [(c) ≤ p(c) + ζ_c].

In other words, we want to find an upper bound on the sum of the probabilities of the two extreme events. To obtain such upper bound, we can consider the following bound on the binomial distribution, which was derived in Ref. <cit.>
 
Let n ∈ℕ, p ∈ (0,1) and let X be a random variable distributed according to X ∼Binomial(n,p). Then, for any integer k such that 0 ≤ k < n, we have

    F(n,p,k) ≤[X ≤ k] ≤ F(n,p,k+1),

where

    D(q,p)    = q ln( q/p) + (1-q) ln( 1-q/1-p),
    Φ(a)    = 1/√(2π)∫_-∞^a d x   e^-x^2/2,
    
        F(n,p,k)    = Φ(sign(k/n - p ) √(2n D( k/n, p))).



To apply the above lemma, for each c ∈ and for each i ∈ [N], we set the random variable V_i^(c) as

    V_i^(c) =
        
            1    if C_i = c
    
            0    otherwise.

Then, V_tot^(c) = ∑_i = 1^N V_i^(c) is a binomial random variable which allows us to apply the lemma. For [(c) ≥ p(c) - ζ'_c], we can write

    [(c) ≥ p(c) - ζ'_c] 
       ≤[V_tot^(c)≥N (p(c) - ζ'_c)] 
       = 1 - [V_tot^(c)≤N (p(c) - ζ'_c) - 1] 
       ≤ 1 - F(N, p(c), N (p(c) - ζ'_c) - 1).

Similarly, for [(c) ≤ p(c) + ζ_c] we write

    [(c) ≤ p(c) + ζ_c] 
       ≤[V_tot^(c)≤N (p(c) + ζ_c)] 
       ≤ F(N, p(c), N (p(c) + ζ_c) + 1).

Therefore, we can choose ^PE,c as

    ^PE,c = 1 - F(N, p(c), N(p(c) - ζ'_c) - 1) 
     
        + F(N, p(c), N(p(c) + ζ_c) + 1).

Finally, one can vary the choice of ζ'_c, ζ_c > 0 to maximise the secret key rate subject to

    ∑_c ∈^PE, c≤^PE.

Thus, any choice of ζ'_c and ζ_c that satisfies the above constraint will automatically satisfy the completeness criterion for the parameter estimation.



 §.§ Secrecy



  §.§.§ Leftover hash lemma
 
To prove the secrecy of the DM-CV-QKD protocol, we shall leverage on the leftover hash lemma. Before we do that, for a fixed ∈ (0,1), we consider the following two distinct cases

    
  * [Ω] ≤

    In this case, we can choose the secrecy parameter = since the trace distance term Δ(ρ_K_B L E | Ω, τ_ℓ⊗ρ_L E|Ω) in the definition of secrecy is upper bounded by one.
    
  * [Ω] >

    In this case, we can use the leftover hash lemma to bound Δ(ρ_K_B L E | Ω, τ_ℓ⊗ρ_L E|Ω) in terms of the conditional smooth min-entropy H_min^(Z|L, E)_ρ_ZLE|Ω, which in turn can be lower bounded using GEAT while substituting [Ω] with  in Theorem <ref>.
    



  §.§.§ GEAT channels

For our purpose, we consider the following GEAT channel _j: E_j-1 L^j-1→ Z_j E_j L^j C_j for the j-th round, where the register L_j stores the classical information accessible to Eve in the j-th round.

    
  * Alice randomly generates X_j and then prepares the state |ψ_X_j⟩_Q_j.
    
    
  * Eve applies her attack, given by the CPTP map _j: E_j-1 Q_j → E_j B_j, where B_j is the quantum signal received by Bob in the j-th round.
    
    
  * Bob randomly generates T_j ∈{0,1} to decide whether a given round is a generation or test round. Bob measures the incoming signal using a heterodyne detection to obtain the outcome Y_j. He then performs the appropriate discretisation on Y_j based on T_j to obtain Z_j (refer to Section <ref>).
    
    
  * If Z_j = ∅ and T_j = 0, Bob sets V_j = 1, otherwise he sets V_j = 0. Next, Bob announces T_j and V_j. If T_j = 1, Alice announces X_j. If T_j = 1, set L^test_j = X_j. If T_j = 0, set L^test_j = ⊥. Finally, set L_j = (V_j, T_j, L^test_j). Note that L_j is accessible to Eve. We can compute C_j from Z_j and L_j. Finally, we trace out X_j.

The above channel satisfies the properties of GEAT channels in the sense that it satisfies the requirements that the register C_j is a deterministic function of Z_j and L_j and also the no-signalling condition. To see that this is indeed the case, note that since Alice and Bob do not have an internal memory register (since we are working in device dependent framework), we can consider a channel _j where Eve can simply simulate their actions (i.e., Alice's state preparation and Bob's measurement) and trace out their private registers in the end. By construction, such channel will always satisfy _j = _Z_j C_j∘_j. Thus, we can use these GEAT channels to apply the generalised EAT.



  §.§.§ Constructing min-tradeoff functions via dimension reduction

Next, we construct the min-tradeoff function. As discussed in Section <ref>, to construct the min-tradeoff function, it is customary to find a function g
that satisfies the property stated in Eq. (<ref>). We realise that function g(q) is essentially a lower bound on the conditional entropy subjected to the statistics from the test rounds. 

It is not easy to construct such function directly as the dimension of Bob's Hilbert space is infinite. Instead, it is more convenient to consider a virtual scenario where after Eve performs her attack (at the end of Step 2 of the GEAT channel), there is another completely positive, trace-non-increasing (CPTNI) map _j that truncates Bob's state into the space spanned by the Fock states {|0⟩, ..., |⟩}. More precisely, the map _j is given by

    _j[ρ_B_j E_j] = (N_0 ⊗_E_j) ρ_B_j E_j (N_0 ⊗_E_j),

where N_0 = ∑_n = 0^|n⟩⟨n| is the projector to the subspace spanned by {|0⟩, ..., |⟩}.

We want to find a function g(q) that has the following form:

    g(q) = g̃(q) - g_^(ν_c)(q_∅),

where the function g̃(q) has similar properties as the function g(q), except that it is evaluated on the output state of the truncated GEAT channel, where we applied the CPTNI map _j at the end of Step 2 (instead of the actual GEAT channel). In other words, the function g̃: _∖{⊥}→ℝ is an affine function that gives the lower bound on the conditional von Neumann entropy evaluated on the truncated state. The function g_^(ν_c)(q_∅) gives the appropriate correction term and it only depends on q_∅, which is the probability that C_j = ∅. Importantly, unlike the function g(q), the function g̃(q) can be computed using a finite-dimensional optimisation.

More precisely, to construct the function g(q), we can use the following dimension reduction theorem, which we prove in Appendix <ref>. 

     
    For a fixed ∈ℕ, we denote κ = Γ( + 2, 0) / Γ(+2, ), where Γ denotes the upper incomplete gamma function, and we denote N_0 = ∑_n = 0^|n⟩⟨n|. We let ρ_ABE∈𝖣(_A ⊗_B ⊗_E) be a normalised quantum state and ρ̃_ABE = (_A ⊗ N_0 ⊗_E) ρ_ABE (_A ⊗ N_0 ⊗_E) be the truncated version of the state. For each c ∈∖{⊥}, we let Π_c ∈𝖫(_A ⊗_B) be the projector that corresponds to the score c and Π̃_c = (_A ⊗ N_0) Π_c (_A ⊗ N_0) be its truncated version. We let ν_c ∈ (0, 2/3κ), ν_L ∈ (0, (5+√(5))/10κ], and ν_U ∈ (0, (5-√(5))/10κ] be given. Finally, we let ρ̃_ZLE be the state resulting from applying Bob's measurement on the truncated state ρ̃_ABE, storing the output on the classical register Z (with dimension d_Z), making the appropriate announcement L, and then tracing out Alice's subsystem. Then, we have
    
    g(q) = g̃(q) - g_^(ν_c)(q_∅),

    where g̃(q) is the linearisation of the dual g̃'(q)
    
    g̃'(q) ≤inf_ρ̃    H(Z|L,E)_ρ̃_ZLE
    s.t.    ρ̃_AB≽ 0
       [ρ̃_AB] ≤ 1,
       [ρ̃_AB] ≥ 1 - κ q_∅,
       Δ(ρ̃_A, _Q |Ψ⟩⟨Ψ|_AQ) ≤1/2κ q_∅
    
               [ρ̃_ABΠ̃_c] ≤ q_c - ξ_U(q_∅)   ∀ c ∈∖{⊥}, 
       [ρ̃_ABΠ̃_c] ≥ q_c - ξ_L(q_∅)   ∀ c ∈∖{⊥},

and where we define the following correction terms

    g^(ν_c)_(q_∅)    = m_ (q_∅ - ν_c) + c_,
    
        
        
        
        ξ_L(ν)    = κν + 2√(κν(1-κν))   if  ν< 5+ √(5)/10κ
    1+√(5)/2   if  ν≥5+ √(5)/10κ
    ξ_U(ν)    = κν - 2 √(κν(1-κν))   if  ν < 5 - √(5)/10κ
    1 - √(5)/2       if  ν≥5 - √(5)/10κ

with w_c = κν_c

    δ_c    = 1/2√(2)[√(w_c (2 - w_c) + w_c√(w_c (4 - 3 w_c))) + √(w_c (2 - w_c) - w_c √(w_c (4 - 3 w_c)))]
    
        m_   = [3 w_c + √(w_c (4 - 3 w_c))/√((2 - w_c) + √(w_c (4 - 3 w_c))) - 3w_c - √(w_c (4 - 3w_c))/√((2 - w_c) - √(w_c (4 - 3w_c)))] 
    
        c_   = δ_c log_2 d_Z + (1 + δ_c) h_2 (δ_c/1 + δ_c).

and linearised terms

    ξ_U(q_∅)    ≥ξ̂_U^(ν_U)(q_∅) = (1 - (1- 2 κν_U)/√(κν_U (1 - κν_U))) κ q_∅ - √(κν_U/1-κν_U),
    ξ_L(q_∅)    ≤ξ̂_L^(ν_L)(q_∅) = (1 + (1- 2 κν_L)/√(κν_L (1 - κν_L))) κ q_∅ + √(κν_L/1-κν_L),

replacing their respective terms in the dual.






    Refer to Appendix <ref>.




Theorem <ref> allows us to efficiently construct the function g(q) since constructing g̃(q) involves an optimisation over finite dimensional quantum states. This can be done using numerical techniques <cit.>. In particular, the above optimisation can be solved using SDP and since the constraints are linear in q, the dual solution of the SDP will readily provide us with an affine function. We shall show the explicit SDP and its corresponding dual solution in the next two subsections. This completes the min-tradeoff construction.



  §.§.§ SDP method to bound the conditional entropy

The minimisation of the conditional von Neumann entropy in Eq. (<ref>) involves non-linear objective function which can be difficult to solve using readily available numerical solvers. Thankfully, one can lower bound the conditional von Neumann entropy as SDP using the method proposed in Ref. <cit.> which is based on the bound in Ref. <cit.>. Before we use the bound, we first simplify the minimisation by only keeping the term corresponding to the generation rounds and the case in which the outcome is not discarded

    H(Z|L,E)_ρ̃   ≥ (1-γ) [Z ≠∅| T = 0] 
        H(Z|T = 0, Z ≠∅, E)_ρ̃
       =: H(Z|E)_ρ^*,

where ρ^*_ZE = _T[Π_ρ̃_ZTEΠ_], with Π_ = ∑_z ≠∅|z⟩⟨z|_Z ⊗|0⟩⟨0|_T ⊗_E, is the sub-normalised state corresponding to the case T = 0 and Z ≠∅.

We then convert the conditional von Neumann entropy into quantum relative entropy. Let ρ^*_ZE be a finite dimensional (sub-normalised) cq-state and ρ^*_E = _Z[ρ̃^*_ZE]. Then,

    H(Z|E)_ρ^* = -D(ρ^*_ZE|| _Z ⊗ρ^*_E)

Then, Ref. <cit.> formulated an upper bound on the quantum relative entropy (which gives a lower bound on the conditional von Neumann entropy) based on Gauss-Radau quadrature. Let m ≥ 2 be an integer and let (w_i, t_i) be weights and nodes of the Gauss-Radau quadrature with fixed node at t = 1. Let Λ_i ∈𝖡(_ZE) be an arbitrary bounded operator in the Hilbert space _ZE for all i ∈ [m]. The conditional von Neumann entropy is lower bounded by

    inf_{Λ_i}_i, ρ̃∑_i = 1^m w_i/t_i ln 2
    [ρ^*_Z E(_ZE + Λ_i + Λ_i^† + (1-t_i) Λ_i^†Λ_i)
     + t_i
        (_Z ⊗ρ^*_E) Λ_i Λ_i^†]

Since _Z is finite dimensional, the above bound can be simplified by writing Λ_i = ∑_z,z'|z⟩⟨z'|⊗Λ_i^(z,z'). Furthermore, we write

    ρ̃_ZTE = ∑_z, t[T = t]  |z⟩⟨z|_Z ⊗|t⟩⟨t|_T 
    ⊗_AB[ρ̃_ABE (_A ⊗ P_z|t⊗_E)]

where P_z|t is Bob's POVM element. From our definition of the state ρ^*_ZE, this results in 

    H(Z|E)_ρ^*≥ (1-γ) inf_ρ̃, {Λ_i,z}_i,z∑_i = 1^m w_i/t_i ln 2[ρ̃_ABE
    (P_PS⊗_E + ∑_z ≠∅ (_A ⊗ P_z|0) ⊗ (Λ_i,z + Λ_i,z^† + (1-t_i) Λ_i,z^†Λ_i,z) 
    + t_i  
        P_PS⊗Λ_i,zΛ_i,z^†)],

where P_PS = ∑_z ≠∅_A ⊗ P_z|0

Since the optimisation is over both ρ̃ and Λ, the problem is still non-linear. However, as shown in Ref. <cit.>, the problem can be linearised by defining the map Ξ[M] = _E[ρ̃_ABE· (_AB⊗ M^T)] for any operator M, which has the following properties

    Ξ[M^†]    = Ξ[M]^†
    [ρ̃_ABE· (K_AB⊗ M^T)]    = [K_AB·Ξ(M)]

for any operator K_AB. We then define the matrices

    σ   = Ξ[]
    ω_i, z   = Ξ[Λ_i,z]
    η_i, z   = Ξ[Λ_i,z^
            †Λ_i,z]
    θ_i,z   = Ξ [Λ_i,zΛ_i,z^†]

and consider block moment matrices. The resulting lower bound of the conditional entropy is given by



    inf_σ, {ω_i,z, η_i,z, θ_i,z}_i,z, ζ_1, ζ_2    (1-γ) ∑_i = 1^m w_i/t_i ln 2[σ  P_PS + ∑_z ≠∅  (_A ⊗ P_z|0) (ω_i,z + ω_i,z^† + (1-t_i) η_i,z) + t_i θ_i,z  P_PS] 
    s.t.       [σ] ≤ 1
       [σ] ≥ 1 - κ q_∅
       [ζ_1 + ζ_2] ≤κ q_∅
    
           [σΠ̃_c] ≤ q_c - ξ_U(q_∅)   ∀ c ∈∖{⊥}, 
       [σΠ̃_c] ≥ q_c - ξ_L(q_∅)   ∀ c ∈∖{⊥},
       [        σ   ω_i, z; ω_i, z^†   η_i, z ]≽ 0   ∀ i, z
       [        σ ω_i, z^†;   ω_i, z   θ_i, z ]≽ 0   ∀ i, z
       [                 ζ_1 _B[σ] - _Q [|Ψ⟩⟨Ψ|];  _B[σ] - _Q[|Ψ⟩⟨Ψ|]                 ζ_2 ]≽ 0





  §.§.§ Dual solution

We take the optimisation (<ref>) and associate to each constraint that depends on q with a dual variable λ

    λ_norm:       1 - [σ] ≤κ q_∅
    λ_dist :      [ζ_1 + ζ_2] ≤κ q_∅
    
        λ_c^U:      [σΠ̃_c] ≤ q_c - ξ_U(q_∅)
    
        λ^L_c:      [σΠ̃_c] ≥ q_c - ξ_L(q_∅)


Then, the dual solution of the SDP (<ref>) will have the form






    g̃'(q) ≥φ - λ_normκ q_∅ - λ_distκ q_∅
    
        + ∑_c ≠⊥, ∅(- λ_c^U(q_c - ξ_U(q_∅)) + λ_c^L(q_c - ξ_L(q_∅)) ) 
    - λ_∅^U (q_∅ - ξ_U(q_∅)) + λ_∅^L ( q_∅ - ξ_L(q_∅)),

where φ contains all the dual variables that are associated to the non-statistical constraints and the forms are chosen such that all dual λ≥0.
The dual solution is linearised by replacing the terms δ, ξ_L and ξ_U with linear terms

    ξ_U(q_∅)    ≥ m_U q_∅ + c_U
    ξ_L(q_∅)    ≤ m_L q_∅ + c_L,

as presented in Eq. (<ref>) and Eq. (<ref>) respectively.
Then, we have

    g̃(q) ≥φ' + ∑_c ≠⊥, ∅ (-λ^U_c + λ_c^L) q_c 
    
        + q_∅( -κλ_norm - κλ_dist - λ^U_∅ + λ^L_∅
    + ∑_c ≠⊥ (λ_c^U m_U - λ_c^L m_L)),

with

    φ' = φ + ∑_c ≠⊥ (λ_c^U c_U - λ_c^L c_L).

Finally, considering the g_ term, we have

    g(q) ≥Φ + ∑_c ≠⊥λ'_c   q_c

where

    Φ   = φ' - c_ + m_ν_c 
       = φ + ∑_c ≠⊥ (λ_c^U c_U + λ_c^L c_L)  - c_ + m_ν_c ,

and

    
    λ'_c =
        λ_c^L - λ_c^U    if c ≠⊥, ∅,
    
            -λ_∅^U + λ_∅^L - κλ_norm - κλ_dist + ∑_c ≠⊥ (-λ_c^L m_L + λ_c^U m_U) - m_   if c = ∅.


Denote λ'_max := max_cλ'_c and λ'_min := min_c λ'_c. We have the following min-tradeoff function

    f(ê_c)    = Φ -  (1-γ)/γλ'_max + λ'_c/γ,       c ∈∖{⊥},
    
        f(ê_⊥)    = Φ + λ'_max.

The min-tradeoff function f has the following properties

    [f]    = Φ + λ'_max
    _Σ[f]    ≥Φ + λ'_min
    [f]    ≤(λ'_max - λ'_min)^2/γ


Having constructed the min-tradeoff function f and calculate the its corresponding , _Σ, and , we can then apply the GEAT to bound the conditional smooth min-entropy H_min^(Z|L, E)_ρ_ZLE|Ω. Combined with the argument in Sec <ref>, this completes the proof for the secrecy of the protocol.


§ SIMULATION
 

To study the performance of the protocol which is secure against coherent attacks, we simulated the key generation rate of the protocol with different number of signals, N, sent.
For simplicity, an ideal error correcting code is utilised, which is assumed to correct errors by communicating information at the Shannon limit, with information loss NH(X_j|Z_j)_ρ^* and without failure, ^EC=0.
We consider a protocol run with Bob performing ideal heterodyne detection with zero excess noise, χ=0, and unit detection efficiency.
More details of the model can be found in Appendix <ref>.
Based on preliminary optimisation, we choose the discretisation τ_min^key=0.6, τ_min=1.5 and τ_max=√(20).
Furthermore, we fix the completeness parameter for parameter estimation as ^PE= 1e-10, correctness parameter as = 1e-15, secrecy parameter as = 1e-6, and n_max= 12.
The correctness parameter results in l_EV= 50 bits error verification string. 

To obtain the dual g̃(q), i.e. values for φ, and dual parameters λ, one can solve the SDP in Eqn. (<ref>) with any set of trial parameters q_dual.
The dual parameters and φ obtained can compute a valid dual function g̃^(q_dual)(q) of the form in Eqn. (<ref>).
Importantly, this dual function is a lower bound of the dual function with trial parameters matching the actual parameters, g̃^(q_dual)(q)≤g̃^(q)(q), by definition of the dual.
In general, we are free to choose the trial parameters q_dual to optimise the key rate (note that q_dual=q may not be the optimal choice for EAT).
However, to simplify, we would consider only the set of parameters q_dual that can be generated from a run of the protocol with the same model as described in the previous paragraph, except that the excess noise can be χ_dual≠χ.



The key rate, ℓ/N, where ℓ is the length of the key, is then optimised over the amplitude α, the EAT parameter β, the linearisation parameters ν_c, ν_L, and ν_U, the trial parameter χ_dual, and the various components of the completeness parameter, ^PE,c.
Fig. <ref> shows the optimised key rate for N= 1e14 to 1e16, and the asymptotic key rate.
There is a significant penalty from finite size effect, with the key rate for finite block size being much lower than the asymptotic key rate.



§ DISCUSSION AND CONCLUSION
 

The results show a significant gap between the finite size key rate and asymptotic key rates, even for large N= 1e16. This may be the consequence of the linearisation terms. In general, the probability of exceeding τ_max is small, indicating a low probability of having large energy. As such, the choice of linearisation parameters ν_U and ν_L would be correspondingly small as well to have a small gap between the actual value (e.g. ξ_L) and linearised value (e.g. ξ̂_L^(ν_L)). Since this term is present in the denominator of the gradient, it leads to a large gradient and causes the penalty from GEAT to be significant. As the finite-size penalty in both EAT and GEAT are very sensitive to the gradient of the min-tradeoff function, we expect that the huge finite-size penalty is a feature of the DM-CV-QKD protocol which estimates the dimension reduction correction using the probability of exceeding τ_max. Therefore, to improve the finite-size penalty, we may require a new technique that is less sensitive to the gradient of the min-tradeoff function. Alternatively, we may require another method to estimate the dimension reduction corrections. Another potential room for improvement is to find corrections to the statistical constraints that have gentler gradients at q_∅≈ 0. Recently, Ref. <cit.> proposed the Rényi entropy version of the GEAT. Interestingly, this version of entropy accumulation theorem does not require the usual analysis via affine min-tradeoff functions, which removes the necessity of linearising the correction terms. This might potentially reduce the minimum block size N.

The asymptotic key rate also appears to be significantly worse than in Refs. <cit.>, where the loss tolerance is over 40 (>200 km with perfect detector) compared to around 4 here. This is likely attributable to both the number of nodes  m (for the Gauss-Radau quadrature approximation) selected in SDP optimisation, and the dimension reduction penalty (we note that the asymptotic key rate evaluated in Ref. <cit.> does not account for the dimension reduction penalty). The low value of m=4 chosen here to reduce the computation time may not be tight in the estimation of the conditional entropy and thus lead to loss of key rate. Besides the penalty term g_corr^(ν_c)(q_∅), the bounds in the SDP may not be tight either. As such, both would result in a lower key rate by directly reducing the conditional von Neumann entropy and increasing the set of feasible states in the SDP minimisation.

Comparing our work with that of Ref. <cit.>, the protocol that is being considered in both Ref. <cit.> and ours is very similar, with the exception that we allow post-selection in the key generation rounds. Indeed, the discretisation that we use in the test rounds is almost identical to the one considered in Ref. <cit.>. Since the asymptotic key rates obtained in Ref. <cit.> are close to the one obtained when considering the dimension reduction penalty <cit.>, we suspect that either a very large number of nodes m is required for a tight bound on the conditional von Neumann entropy, or the protocol variant that monitors probability distribution instead of moments will incur higher dimension reduction penalty. This can be investigated by computing the conditional von Neumann entropy using the methods in Refs. <cit.>.
Alternative methods of bounding the relative entropy can also be explored, such as that in Ref. <cit.>.

To summarise, we presented a complete security analysis of a variant of the DM-CV-QKD protocol using four coherent-states and heterodyne detection. Unlike previous works, our security analysis accounts for both finite-size effects as well as dimension reduction. To achieve this, we apply the newly proposed GEAT and we modify the dimension reduction theorem presented in Ref. <cit.> to suit the technical requirements of GEAT. Additionally, we also applied the Gauss-Radau quadrature approximation to the conditional von Neumann entropy to construct the min-tradeoff function, which we need to apply GEAT. Our method is versatile as it can be easily extended to other variants of DM-CV-QKD protocols, and it is also applicable to the scenario where the detector imperfection is characterised and trusted (similar to the one considered in Ref. <cit.>). Unfortunately, our result suggests that DM-CV-QKD protocols may suffer from severe finite-size effects when analysed using EAT or GEAT due to the large gradient of the min-tradeoff function. While our bounds can potentially be improved, we leave this investigation for future works.



§ NOTE ADDED

While preparing this manuscript, Ref. <cit.> independently published an improved finite-size analysis of DM-CV-QKD based on the GEAT. In that work, the authors claimed that the four-state DM-CV-QKD protocol (similar to the one analysed in this work) only requires the minimum block size of the order N ∼ 10^8, which is much smaller than what we have shown in this work. However, the result of Ref. <cit.> also assumes the photon number cutoff without properly accounting for the dimension reduction penalties – which we have shown to be non-negligible. Indeed, the authors remarked that they have not successfully obtained a positive key rate while accounting for the dimension reduction penalties.

Contrary to Ref. <cit.>, this work presented a full security proof, which includes the analysis on the dimension reduction penalty. Our analysis is also applicable to the DM-CV-QKD protocol that employs post-selection, while Ref. <cit.> focused on the class of protocols without post-selection.



Wen Yu Kon and Charles Lim, in their present role at JPMorgan Chase & Co contributed to this work for information purposes. This paper is not a product of the Research Department of J.P. Morgan, Singapore, or its affiliates. Neither J.P. Morgan, Singapore nor any of its affiliates make any explicit or implied representation or warranty and none of them accept any liability in connection with this paper, including, but limited to, the completeness, accuracy, reliability of information contained herein and the potential legal, compliance, tax or accounting effects thereof. This document is not intended as investment research or investment advice, or a recommendation, offer or solicitation for the purchase or sale of any security, financial instrument, financial product or service, or to be used in any way for evaluating the merits of participating in any transaction.










§ PROOF OF DIMENSION REDUCTION THEOREM
 
The goal of dimension reduction theorem is to reduce the original problem of constructing a min-tradeoff function which involves optimisation over infinite-dimensional quantum states into a simpler problem which only involves optimisation over finite-dimensional quantum states. The idea is similar to a similar dimension reduction theorem presented in Ref. <cit.>: we perform a truncation on Bob's quantum state and calculate the correction terms attributed to this truncation. Before calculating these correction terms, we first present the original, untruncated optimisation problem.



 §.§ The original optimisation problem

To derive a lower bound on the conditional von Neumann entropy, it is easier to consider a virtual entanglement-based scenario that is equivalent to the actual protocol from the adversary's point-of-view. More precisely, in the virtual scenario, the adversary will have the same classical and quantum-side information and the honest parties will obtain the same classical registers at the end of the procedure.

The virtual entanglement-based protocol that we consider is as follows:

    
  * Alice prepares the state
    
    |Ψ⟩_AQ = 1/2∑_x = 0^3|x⟩_A ⊗|ψ_x⟩_Q

    inside her secure lab. 
    
  * Alice measures the register A in the computational basis and stores the outcome in the classical register X.
    
  * Alice sends the quantum register Q to Bob via the untrusted quantum channel. We assigns the output of the quantum channel that Bob receives to the quantum register B.
    
  * Upon receiving the quantum register B from the untrusted quantum channel, Bob randomly assigns T ∈{0,1} with probability {1-γ, γ}. He then applies heterodyne measurement on the quantum state and, depending on T, he applies the appropriate discretisation to obtain the discretised outcome Z.


It is easy to see that the above procedure is equivalent to the quantum communication phase of the DM-CV-QKD protocol that we consider in this work. Step 1–2 is equivalent to uniformly choosing a classical information x and encoding it to the quantum state |ψ_x⟩. On the other hand, step 3–4 is identical to the one performed in the actual protocol. Therefore, the above virtual scenario is indeed equivalent to the actual protocol that we are analysing.

The advantage of considering the entanglement-based scenario is that it allows us to delay Step 2 (Alice's measurement) since local measurements on different subsystems commute. With this delayed measurement, we can consider the quantum state ρ_AB, shared between Alice and Bob, just before their respective measurement. In general, the Hilbert space _B, associated with the register B is infinite-dimensional as we do not restrict what Eve can do in the quantum channel. On the other hand, as the quantum register A is generated and stored in Alice's secure lab, we have the constraint on Alice's marginal state:

    ρ_A = _B[ρ_AB] = _Q[|Ψ⟩⟨Ψ|_AQ].

On top of this constraint, we have the constraint on the normalisation of the quantum state ρ_AB

    [ρ_AB] = 1,

the positive-semidefiniteness of the state

    ρ_AB≽ 0,

and the constraints due to the statistics that are being monitored in the test rounds of the protocol

    [ρ_ABΠ_c] = q_c,     ∀ c ∈∖{⊥}.

where Π_c is the POVM element associated to the score C = c.

Putting all these things together, we have the following optimisation problem

    g(q) = inf_ρ_AB      H(Z|L,E)_[ρ_AB]
    s.t.     ρ_AB≽ 0,
       [ρ_AB] = 1,
       _B[ρ_AB] = _Q[|Ψ⟩⟨Ψ|_AQ]
       [ρ_ABΠ_c] = q_c,     ∀ c ∈∖{⊥}.

Here,  is the quantum channel that describes Bob's measurement (which converts the register B to Z), the announcement of register L (which depends on T and Z), and lastly, tracing out Alice's register A. Without loss of generality, we assume that the quantum side-information E that is available to Eve is the purification of the state ρ_AB. As mentioned earlier, the above optimisation involves an optimisation over infinite-dimensional quantum state ρ_AB since _B is infinite-dimensional. Our strategy is to truncate the Hilbert space dimension by projecting ρ_AB into a finite-dimensional subspace of the full Hilbert space, and calculate the correction terms due to this truncation. The rest of Appendix <ref> is dedicated to these calculations.



 §.§ Bounding the trace distance between truncated and original state

The most important ingredient to obtain the correction terms due to the Hilbert truncation is an upper bound on the trace distance between the truncated state and the original state. We let ρ_ABE be the state shared between Alice, Bob and Eve. Without loss of generality, we can assume ρ_ABE to be a pure state: there exists a normalised vector |ψ⟩_ABE such that ρ_ABE = |ψ⟩⟨ψ|_ABE. Just like in the main text, we fix ∈ℕ and denote

    N_0 = ∑_n = 0^|n⟩⟨n|

as the projection to the “low energy subspace” . Let N_1 =  - N_0. Our goal is to find some small δ such that

    Δ(ρ_ABE, (_A ⊗ N_0 ⊗_E) ρ_ABE (_A ⊗ N_0 ⊗_E)) ≤δ,

where Δ denotes the trace distance.

For a fix , let

    V_1 = ∫_β^2 > ^2 β|β⟩⟨β|/π

be the POVM element corresponding to the “large heterodyne outcome”. From Appendix A Eq. (A3) of Ref. <cit.>, the following operator inequality holds.

    N_1 ≼Γ( + 2, 0)/Γ( + 2,) V_1.

Here Γ denotes the upper incomplete Gamma function.

    Γ(n, x) = ∫_x^∞ t   t^n-1 e^-t.

Consequently, for any state σ, we have

    [σ N_1] ≤Γ(+2, 0)/Γ(+2,)[σ V_1]

In passing, we note that there is a slight difference in how we define N_0 and N_1 as compared to the corresponding quantities in Ref. <cit.>. In Ref. <cit.>, the cut-off photon number is defined as n_c =  + 1.

Now, the trace distance can be upper bounded in terms of the weight of the state in the “high energy space” using the gentle measurement lemma (Lemma 9 of Ref. <cit.>)

    Δ(ρ_ABE, (_A ⊗ N_0 ⊗_E) ρ_ABE (_A ⊗ N_0 ⊗_E))
           ≤√(2 [ρ_ABE (_A ⊗ N_1 ⊗_E)])
       ≤√(2Γ(+2, 0)/Γ( +2,)[ρ_B V_1])
       = √(2Γ(+2, 0)/Γ(+2,)[W > ])

where the last term can be monitored in the test rounds as (C = ∅). Let us introduce the shorthand [W > ] = ν, and κ = Γ( + 2, 0)/Γ( + 2,). We can write δ = √(2κν).

The gentle measurement lemma given in Ref. <cit.> applies to any state and measurement. However, for our case, we can tighten the bound as we are dealing with a special case of gentle measurement. First, notice that |ψ⟩_ABE can be further decomposed as

    |ψ⟩_ABE = √(1-w)|ψ_0⟩ + √(w)|ψ_1⟩,

where w = ⟨ψ| (⊗ N_1 ⊗) |ψ⟩ is the weight of the and

    (⊗ N_0 ⊗) |ψ⟩⟨ψ|_ABE (⊗ N_0 ⊗)    = (1-w) |ψ_0⟩⟨ψ_0|,
    
             (⊗ N_1 ⊗) |ψ⟩⟨ψ|_ABE (⊗ N_1 ⊗)    = w |ψ_1⟩⟨ψ_1|.

Since N_0 and N_1 are orthogonal, |ψ_0⟩ and |ψ_1⟩ are also orthogonal. They are also normalised. Then, the trace distance between the truncated state and the original state is given by

    Δ(|ψ⟩⟨ψ|_ABE, (1-w) |ψ_0⟩⟨ψ_0|) = 1/2[√((|ψ⟩⟨ψ| - (1-w) |ψ_0⟩⟨ψ_0|)^†(|ψ⟩⟨ψ| - (1-w) |ψ_0⟩⟨ψ_0|))]

To compute the trace distance, we first compute

    M = |ψ⟩⟨ψ| - (1-w) |ψ_0⟩⟨ψ_0| =
        [         0 √(w(1-w)); √(w(1-w))         w ],

then M^† M is given by

    M^† M =
        [       w(1-w)   w√(w(1-w));   w√(w(1-w)) w^2 + w(1-w) ]

The eigenvalues of M^† M are given by

    eig_±[M^† M] =  w(2-w) ± w√(w(4-3w))/2

Therefore, the trace distance is given by

    Δ(|ψ⟩⟨ψ|_ABE, (1-w) |ψ_0⟩⟨ψ_0|) = [√(M^† M)] = ∑_j = +,-√(eig_j[M^† M])
       = 1/2√(2)[√(w(2-w) + w√(w(4-3w))) + √(w(2-w) - w√(w(4-3w)))] =: δ(w)

The behaviour of the trace distance δ against the weight for the high energy subspace w is given in Fig. <ref>.


However, we cannot access the value of w directly since we only have an upper bound w ≤κν. Since our bound is not monotonously non-decreasing, we need to convert it to a bound that have this monotonicity property. First, we take the first derivative

    δ/ w = (1-w)/2√(2)w√(4-3w)[3w + √(w(4-3w))/√((2-w) + √(w(4-3w))) - 3w - √(w(4-3w))/√((2-w) - √(w(4-3w)))]

The pre-factor is non-negative for 0 ≤ w ≤ 1. We want the term in the square bracket to be non-negative. From Mathematica, this condition is satisfied if w ≤ 2/3. Thus, the maximum trace distance is given by δ(2/3) = 1/√(3). Therefore, as a function of ν, we have

    δ = 1/2√(2)[√(κν (2-κν) + κν√(κν(4-3κν))) + √(κν(2-κν) - κν√(κν(4-3κν)))]    if κν≤ 2/3
    1/√(3)   otherwise.


To construct the min-tradeoff function, we want to linearise the upper bound on the trace distance. First, we check that the function δ is concave in w, so that we can simply take a tangent line. We take the second derivative

    ^2 δ/ w^2 = - (√(w) + √(4-3w))√((2-w) - √(w(4-3w))) - (√(w) - √(4-3w))√((2-w) + √(w(4-3w)))/2√(2)(1-w) [w(4-3w)]^3/2

Since √(w) < √(4-3w) for any 0 ≤ w ≤ 1, both the numerator and denominator (excluding the negative sign outside) are positive. Thus, we have ^2 δ /  w^2 < 0 which means that δ is concave in the interval 0 ≤ w ≤ 1. Since w = κν is linear in ν, the trace distance δ is also concave in ν. 

Therefore, we can simply take a tangent line at any ν such that κν≤ 2/3 to derive a linear upper bound on δ. Suppose we take the tangent at ν = ν_0 with ν_0 ∈ (0, 2/3κ), we use the shorthand w_0 = κν_0

    δ≤(1-w_0)/2√(2)√(4-3w_0)[3w_0 + √(w_0(4-3w_0))/√((2-w_0) + √(w_0(4-3w_0))) - 3w_0 - √(w_0(4-3w_0))/√((2-w_0) - √(w_0(4-3w_0)))] (ν - ν_0)/ν_0
    
        + 1/2√(2)[√(w_0(2-w_0) + w_0√(w_0(4-3w_0))) + √(w_0(2-w_0) - w_0√(w_0(4-3w_0)))].

Therefore,

    δ≤ m_0 (ν - ν_0) + c_0,

with

    m_0    =(1-w_0)/2√(2)ν_0 √(4-3w_0)[3w_0 + √(w_0(4-3w_0))/√((2-w_0) + √(w_0(4-3w_0))) - 3w_0 - √(w_0(4-3w_0))/√((2-w_0) - √(w_0(4-3w_0)))], 
    
        c_0    = 1/2√(2)[√(w_0(2-w_0) + w_0√(w_0(4-3w_0))) + √(w_0(2-w_0) - w_0√(w_0(4-3w_0)))] .




 §.§ Continuity of conditional von Neumann entropy

Now that we have an upper bound on the trace distance between the truncated and the original state, we can use the continuity bound for the von Neumann entropy to prove that the truncation does not significantly reduce the entropy. We use the following Lemma 1 from Ref. <cit.>
 
    Let _Z and _E be two Hilbert spaces, where dim(_Z) = d_Z while _E can be infinite dimensional. Let ρ, σ∈𝖣(_Z ⊗_E) be subnormalised states with [ρ] ≥[σ]. If Δ(ρ, σ) ≤δ, then
    
    H(Z|E)_ρ≥ H(Z|E)_σ - δlog_2 d_Z - (1 + δ) h_2(δ/1+δ),

    where h_2(x) = -x log_2(x) - (1-x) log_2(1-x) is the binary entropy function.

Now, let : ABE → ZE be the quantum channel that corresponds to Bob's measurement (and tracing out Alice). In this context, the state ρ in the above lemma corresponds to ρ = [ρ_ABE] and σ = [(_A ⊗ N_0 ⊗_E) ρ_ABE (_A ⊗ N_0 ⊗_E)]. Because of the monotonicity property of trace distance, we can also re-use the upper bound on the trace distance that we have derived in the previous subsection.

The correction term for the conditional entropy is given by

    v(δ) = δlog_2 d_Z + (1 + δ) h_2 (δ/1 + δ)

Again, for the purpose of constructing min-tradeoff functions, we want to obtain a bound that is affine in ν. We adopt a similar strategy of taking an upper bound by taking a tangent line at ν = ν_c where ν_c ∈ (0, 2/3κ). We need to calculate the gradient of v against ν. To that end, we calculate the gradient of v against δ 

    v/δ = log_2 d_Z + log_2 (1 + δ/δ).

On the other hand, from Eq. (<ref>), the gradient of δ against ν is given by

    δ/ν = δ/ w w/ν = (1-w)/2√(2)w√(4-3w)[3w + √(w(4-3w))/√((2-w) + √(w(4-3w))) - 3w - √(w(4-3w))/√((2-w) - √(w(4-3w)))] ·κ,

where w = κν depends implicitly on ν. We introduce the shorthand 

    w_c    = κν_c
    δ_c    = 1/2√(2)[√(w_c (2 - w_c) + w_c√(w_c (4 - 3 w_c))) + √(w_c (2 - w_c) - w_c √(w_c (4 - 3 w_c)))]

Then,

    m_ =  v/ν|_ν = ν_c   = ( v/δ·δ/ν) |_ν = ν_c
       = (1-w_c) κ/2√(2)w_c √(4 - 3w_c)[log_2 d_Z + log_2 (1 + δ_c/δ_c)] 
           ×[3 w_c + √(w_c (4 - 3 w_c))/√((2 - w_c) + √(w_c (4 - 3 w_c))) - 3w_c - √(w_c (4 - 3w_c))/√((2 - w_c) - √(w_c (4 - 3w_c)))]

and

    c_ = v(δ_c) = δ_c log_2 d_Z + (1 + δ_c) h_2 (δ_c/1 + δ_c).

This gives a linear correction term to the conditional entropy 

    g^(ν_c)_(ν) = m_(ν - ν_c) + c_.




 §.§ Correction to the constraints

The projection to the low energy subspace does not only affect the conditional entropy but also the constraints. We consider the entanglement based picture before Bob's measurement and denote the entangled state between Alice and Bob by ρ_AB and σ_AB = (⊗ N_0) ρ_AB (⊗ N_0).



  §.§.§ Normalisation constraint

The first constraint is the normalisation, this modification is straightforward, we have

    1 - κν≤[σ_AB] ≤ 1.




  §.§.§ Constraint on Alice's marginal state

Next, we have the constraint on Alice's marginal states. Originally, we have the constraint

    ρ_A = _Q [|Ψ⟩⟨Ψ|_AQ].

However, due to the cut-off, we instead have to constrain the state

    σ_A=(1-w)_BE[|ψ_0⟩⟨ψ_0|_ABE].

Let us expand the original state ρ_A, 

    ρ_A    = _BE[|ψ⟩⟨ψ|_ABE]
       = w_BE[|ψ_1⟩⟨ψ_1|_ABE] + √(w(1-w))_BE[|ψ_0⟩⟨ψ_1|_ABE] + √(w(1-w))_BE[|ψ_1⟩⟨ψ_0|_ABE] +  σ_A

By expanding |ψ⟩_ABE=∑_ac_a|a⟩_A⊗|ϕ_a⟩_BE, the cross-terms can be shown to be

    _BE[|ψ_0⟩⟨ψ_1|_ABE]    = _BE[(⊗ N_0 ⊗)|ψ⟩⟨ψ|_ABE(⊗ N_1 ⊗)]
       = ∑_aa'c_a(c_a')^*[(N_0 ⊗)|ϕ_a⟩⟨ϕ_a|_BE(N_1 ⊗)]
       = 0,

where the final equality notes that the projectors N_0 and N_1 are orthogonal.
As such, we have the following constraint,

    Δ(σ_A,_Q |Ψ⟩⟨Ψ|_AQ)    = Δ(σ_A,ρ_A)
       = 1/2w_BE[|ψ_1⟩⟨ψ_1|_ABE]_1
       ≤1/2w,

where the second line invokes the definition of trace distance, and the third line utilise the fact that the trace norm of a quantum state is bounded by 1.

The trace distance constraint can be re-cast as SDP constraints (Example 1.20 of Ref. <cit.>) by defining the matrix M

    M = [             ζ_1 σ_A - _Q |Ψ⟩⟨Ψ|; σ_A - _Q |Ψ⟩⟨Ψ|             ζ_2 ]

then imposing that [M] ≤κν  and M ≽ 0.


























  §.§.§ Statistical constraints

Finally, the most challenging correction is to the statistical constraints. To do this,
we can write the original state ρ as 

    ρ = [   ρ_0   ρ_c; ρ_c^†   ρ_h ].

Similarly, we can write the measurement operator as

    Π = [ Π_0   Λ; Λ^† Π_h ].

Let ρ_0 and Π_0 be linear operators in the low-energy subspace _low. We shall truncate the subspace outside of _low. The constraint involves terms of the form

    [ρΠ]    = [ρ_0 Π_0] + [ρ_h Π_h] + [ρ_c Λ^†] + [ρ_c^†Λ] 
       = [ρ_0 Π_0] + [ρ_h Π_h] + 2 [ρ_c Λ^†].

The LHS is simply the original constraint which is related to the statistics that we see in the experiment. The second inequality is due to the fact that [X] = [X^†] and the cyclic permutation symmetry of trace. Bounding the [ρ_h Π_h] is easy:

    0 ≤[ρ_h Π_h] ≤κν,

since 0 ≼Π_h ≼. Next, we need to bound [ρ_c Λ^†]. To do that we need the following lemmas
 
Let A ≽ 0, B ≽ 0 and

    [   A   X; X^†   B ]≽ 0

be positive semidefinite. Then, we have

    B - X^† A^-1 X ≽ 0



 
    Let A ≽ 0, B ≽ 0 and

    [   A   X; X^†   B ]≽ 0

be positive semidefinite. Then, there exists some matrix K such that

    X = A^1/2 K B^1/2

and

    K^† K ≼.



Based on Lemma <ref>, we have

    B ≽ X^† A^-1 X.

Hence, by multiplying both sides with B^-1/2 to the left and to the right, we have

    ≽ B^-1/2 X^† A^-1 X B^-1/2 = ( A^-1/2 X B^-1/2)^†( A^-1/2 X B^-1/2)

We define

    K := A^-1/2 X B^-1/2.

It is straightforward to see that this implies the two claims.


 
Let A and B be matrices. Then,

    [A^† B]^2 ≤[A^† A] ·[B^† B]




Let ρ and Π be given by Eqs. (<ref>) and (<ref>), respectively. Then, we have

    -√([ρ_0 Π_0] [ρ_h Π_h])≤[ρ_c Λ^†] ≤√([ρ_0 Π_0] [ρ_h Π_h])



Based on Corollary <ref>, we can write

    ρ_c    = ρ_0^1/2 K_1 ρ_h^1/2
    Λ   = Π_0^1/2 K_2 Π_h^1/2,

for some K_1, K_2 such that K_1^† K_1 ≼ and K_2^† K_2 ≼.

Then, we can write

    [ρ_c Λ^†]    = [(ρ_0^1/2 K_1 ρ_h^1/2)·(Π_h^1/2 K_2^†Π_0^1/2) ] 
       = [ (Π_0^1/2ρ_0^1/2) ·(K_1 ρ_h^1/2Π_h^1/2 K_2^†) ]
       ≤√([ Π_0 ρ_0 ] ·[(K_1 ρ_h^1/2Π_h^1/2 K_2^†) ·(K_2 Π_h^1/2ρ_h^1/2 K_1^†)])
       ≤√([ Π_0 ρ_0 ] ·[ρ_hΠ_h])

where in the first line, we substitute ρ_c and Λ^† with their identities which involved K_1 and K_2. In the second line, we use the cyclic permutation symmetry of trace and group the terms accordingly. In the third line, we apply Lemma <ref>. In the fourth line, we use the fact that K_1^† K_1 ≼, K_2^† K_2 ≼ and the monotonicity of trace. This proves the upper bound claim. The lower bound claim can be obtained similarly by modifying the third line where we consider the negative square root of Lemma <ref> instead.



    Let ρ and Π be given by Eqs. (<ref>) and (<ref>), respectively. Let p = [ρΠ] and w ≥[ρ_h]. Then, we have
    
    p - ξ_L ≤[ρ_0 Π_0] ≤ p - ξ_U

    where
    
    ξ_L    = 
                w + 2√(w(1-w))   if   w < 5+ √(5)/10
    1+√(5)/2   if   w ≥5+ √(5)/10
    ξ_U    = 
                w - 2 √(w(1-w))   if   w < 5 - √(5)/10
    1 - √(5)/2       if   w ≥5 - √(5)/10



First, we write

    [ρ_0 Π_0] = [ρΠ] - [ρ_h Π_h] - 2 [ρ_c Λ^†]

Thus, the correction term ξ is given by

    ξ = [ρ_h Π_h] + 2 [ρ_c Λ^†]

We assume that [ρ_h] = ω≤ w. We remark that ω is not observable in practice and we can only bound it with w which is a function of ν.

To prove the lower bound, this is easy because we simply have to maximise the correction term

    ξ≤[ρ_h Π_h] + 2 √([ρ_h Π_h]·[ρ_0 Π_0])≤ω + 2 √(ω(1-ω))

Differentiating the upper bound with respect to ω, we see that there is a critical ω at ω_c = (5 + √(5))/10 ≈ 0.724. Therefore, we have

    ξ≤ξ_L := 
            w + 2√(w(1-w))   if w < ω_c
    1 + √(5)/2   if w ≥ω_c


The proof for the upper bound is slightly more complicated.  We now have to minimise the correction term ξ.

    ξ≥[ρ_h Π_h] - 2 √([ρ_h Π_h] ·[ρ_0 Π_0]) = √([ρ_h Π_h])·(√([ρ_h Π_h]) - 2 √([ρ_0 Π_0]))

The minimisation over Π_0 is easy: we want ρ_0 and Π_0 to be perfectly overlapped and hence [ρ_0 Π_0] ≥ 1 - ω. We then parameterise [ρ_h Π_h] = ωλ for some λ∈ [0,1]. Thus, we have

    ξ≥√(ωλ)·(√(ωλ) - 2 √(1 - ω)) := F(ω, λ)

Differentiating with respect to λ, we have

    ∂ F/∂λ = ω(1- √(1-ω/ωλ))

For ω < 1/2, we have ∂ F/∂λ < 0. On the other hand, for ω≥ 1/2, we have ∂ F/∂λ = 0 when λ = (1-ω)/ω. We consider the case where ω < 1/2 first. In this case, it is optimal to take λ = 1 since the first derivative with respect to λ is negative. In the second case, we shall take λ = (1-ω)/ω. Therefore, our correction term is given by

    ξ≥ G(ω) :=ω - 2 √(ω(1-ω))   if ω < 1/2
    ω - 1    if ω≥ 1/2

Note that G(ω) ≤ 0 for all ω∈ [0,1], hence p - G(ω) ≥ p. Taking the first derivative of G with respect to ω:

    d G/dω =
        2ω + √(ω(1-ω))-1/√(ω(1-ω))   for ω < 1/2
    
            1    for ω≥ 1/2.

Thus, it is to see that the optimal ω must be within the [0, 1/2) interval. We solve for dG/dω = 0 in this interval and obtain the optimal ω_* = (5-√(5))/10 ≈ 0.276. Also, we have dG/dω < 0 for ω < ω_* and dG/dω > 0 for ω > ω_*, which implies the minimum ξ is given by

    ξ≥ξ_+ := 
            w - 2√(w(1-w))   if w < ω_*
    1-√(5)/2   if w ≥ω_*.

This concludes the proof of the upper bound, and hence the claim.


Corollary <ref> gives an upper and lower bound on the statistical constraints in terms of the actual probability p associated to the original state and the upper bound on the weight of the high photon number components w. However, these bounds are not linear in w (hence, not linear in ν) whereas for the purpose of constructing min-tradeoff functions, it is convenient to obtain correction terms that are linear in ν. This ensures that the dual solution obtained from our numerical methods can be readily used as min-tradeoff functions [Alternatively, we can keep the expressions for ξ_L and ξ_U as they are and linearise the min-tradeoff functions later.]

Fortunately, the correction terms ξ_L (and ξ_U) can be easily linearised since they are concave (and convex, respectively). By taking a tangent line at any point on the curve, we will obtain an upper bound on ξ_L (and lower bound on ξ_U), which relaxes the constraint in the right direction. We denote these bounds by ξ̂_L^(ν_L) and ξ̂_U^(ν_U), respectively. Here ν_L and ν_U denotes the point in which the tangent line is taken.

Let ν_L ∈ (0,(5+√(5))/10κ]. Then, ξ̂_L^(ν_L)(ν) is given by 

    ξ̂_L^(ν_L)(ν) = (1 + (1- 2 κν_L)/√(κν_L (1 - κν_L))) κν + √(κν_L/1-κν_L)

On the other hand, let ν_U ∈ (0, (5-√(5))/10κ]. Then, ξ̂_U^(ν_U)(ν) is given by

    ξ̂_U^(ν_U)(ν) = (1 - (1- 2 κν_U)/√(κν_U (1 - κν_U))) κν - √(κν_U/1-κν_U)




 §.§ Proof of dimension reduction theorem

Putting everything together, we can define the function g̃'(q)

    g̃'(q) = inf_σ_AB      H(Z|L,E)_[σ_AB]
    s.t.     σ_AB≽ 0,
       [σ_AB] ≤ 1,
       [σ_AB] ≥ 1 - κ q_∅,
       Δ(σ_A, _Q[|Ψ⟩⟨Ψ|_AQ]) ≤κ q_∅/2,
       [σ_ABΠ_c] ≤ q_c - ξ_U(q_∅), 
       [σ_ABΠ_c] ≥ q_c + ξ_L(q_∅)

Here, we use the notation σ_AB = (_A ⊗ N_0) ρ_AB (_A ⊗ N_0). We can define the function g̃(q) as the linearised version of the above function which can be obtained by replacing ξ_L and ξ_U with ξ̂_L and ξ̂_U, respectively. (Refer to Eqs. (<ref>) and (<ref>) for those expressions). Then, using Lemma <ref>, we have

    g(q)    = inf_ρ_AB∈_q H(Z|L,E)_[ρ_AB]
       ≥inf_σ_AB:  Δ(ρ_AB, σ_AB) ≤δ(q_∅),  ρ_AB∈_q H(Z|L,E)_[σ_AB]- δ(q_∅) log_2 d_Z - (1+δ(q_∅)) h_2 (δ(q_∅)/1 + δ(q_∅))_-v(δ)
       ≥g̃(q) - g_^(ν_c)(q_∅).

Here, we denote _q as a shorthand for the feasible set defined in Eq. (<ref>). The second line is due to Lemma <ref>. The last line can be deduced by identifying that the constraints Δ(ρ_AB, σ_AB) ≤δ(q_∅) and ρ_AB∈_q are equivalent to the one written in Eq. (<ref>). Additionally, we notice that the correction terms v(δ(q_∅)) is upper bounded by g_^(ν_c)(q_∅), as derived previously. This concludes the proof of Theorem <ref>.



§ NUMERICAL ANALYSIS
 



 §.§ Channel Model
 

For numerical simulation, we consider a channel with channel loss η along with excess noise χ. After the prepared state |ψ_X_j⟩ = |α e^i (π X_j/2 + π/4)⟩ passes through the channel, the probability that it would result in a heterodyne detection in some phase space region ℛ with Y_j^2∈[τ_1^2,τ_2^2] and θ∈[zπ/2,(z+1)π/2] is


    [Y_j∈ℛ]=1/π∫_τ_1^τ_2dβ∫_zπ/2^(z+1)π/2dθβ/1+ηζ/2 e^-β^2-ηα^2 + 2αβ√(η)cos(θ-(2X_j+1)π/4)/1+ηζ/2.

We can compute the integral analytically for Y_j from 0 to infinity when considering regions extending to ∞,

    [θ∈[zπ/2,(z+1)π/2]]=1/2π∫_zπ/2^(z+1)π/2dθ e^-φ^2{1+√(π)φ f(θ)e^φ^2f(θ)^2erf[φ f(θ)+ 1]},

where φ=√(ηα^2/1+ηζ/2) and f(θ)=cos(θ-(2X_j+1)π/4).




 §.§ Min-tradeoff Function


As discussed in Sec. <ref>, one could compute a lower bound on the conditional von Neumann entropy by solving the SDP in Eqn. (<ref>).
We first define the score C (excluding ⊥) determined by Alice's state preparation choice and the measurement outcome discretisation for T_j=1,

    C_j=⊤    Z_j=⊤
    
            0    ∩_k∈[0,3]{X_j=k Z_j=k (mod 4)}
    
            1    ∩_k∈[0,3]{X_j=k Z_j=k+1 (mod 4)}
    
            2    ∩_k∈[0,3]{X_j=k Z_j=k+2 (mod 4)}
    
            3    ∩_k∈[0,3]{X_j=k Z_j=k+3 (mod 4)}
    
            (∅,0)    ∩_k∈[0,3]{X_j=k Z_j=(∅,k) (mod 4)}
    
            (∅,1)    ∩_k∈[0,3]{X_j=k Z_j=(∅,k+1 (mod 4))}
    
            (∅,2)    ∩_k∈[0,3]{X_j=k Z_j=(∅,k+2 (mod 4))}
    
            (∅,3)    ∩_k∈[0,3]{X_j=k Z_j=(∅,k+3 (mod 4))}

Based on the protocol, we can model the projectors of the measurement operators, Π̃_c, when they are projected into the photon number subspace for n≤ n_max.
The POVM Π_c projects the state in phase space to a region ℛ_c^a (conditioned on A=a),

    Π_c=∑_a|a⟩⟨a|⊗1/π∫_ℛ^a_cdY_j |Y_j⟩⟨Y_j|.

The projected POVM is simply

    Π̃_c=   ∑_a|a⟩⟨a|⊗∑_n,n'≤ n_max1/π∫_ℛ^a_cdY_j ⟨n|Y_j⟩⟨Y_j|n'⟩|n⟩⟨n'|
    
        =   ∑_a|a⟩⟨a|⊗∑_n,n'≤ n_max1/π∫_ℛ^a_cdY_j e^-Y_j^2Y_j^n(Y_j^*)^n'/√(n!n'!)|n⟩⟨n'|,

where the second line notes ⟨n|Y_j⟩=e^-Y_j^2/2Y_j^n/√(n!).
We can compute the overlap

    _Q[|Ψ⟩⟨Ψ|_AQ]=1/4∑_X_jX_j'e^-α^2(1-i^X_j-X_j')|X_j⟩⟨X_j'|.

Having these terms allows us to solve the SDP numerically with mosek <cit.> in Matlab and obtain the dual solution.


Solving the SDP with any trial parameter q_dual with unit length provides a dual 

    g̃^(q_dual)(q_dual)=φ(λ_q_dual)+λ_q_dual·h(q_dual),

where g̃^(q_dual) explicitly indicates that the dual function is obtained, and h is some fixed function independent of the dual variables.
We note here that λ_q_dual refer to the optimal dual variable when the SDP is solved with q_dual, i.e.

    λ_q_dual=argmax_λφ(λ)+λ·h(q_dual).

Importantly, for any q, we can shown that g̃^(q_dual)(q) lower bounds g̃^(q)(q),

    g̃^(q)(q)=   max_λφ(λ)+λ·h(q)
    ≥   φ(λ_q_dual)+λ_q_dual·h(q)
    
        =   g̃^(q_dual)(q).

As such, we can always select one value of q_dual, and utilise g̃^(q_dual)(q) to construct the min-tradeoff function with the same linearisation method via Eq. (<ref>) and conversion via Eq. (<ref>).
Since this value always lower bounds the conditional von Neumann entropy for all q, the resulting function is a valid min-tradeoff function.
In the numerical optimisation, the choice of q_dual is optimised.
For simplicity, we optimise only over q_dual generated from the same probability distribution as the model, with the same channel loss η and amplitude α.
The only parameter that could differ from the actual channel is χ_dual, which we optimise over.



