# Towards a Reference Software Architecture for Human-AI Teaming in Smart
Manufacturing

Philipp Haindl<EMAIL_ADDRESS>0000-0001-6075-5286 Software Competence
Center HagenbergHagenbergAustria ,  Georg Buchgeher<EMAIL_ADDRESS>0000-0002-8565-6257 Software Competence Center HagenbergHagenbergAustria ,
Maqbool Khan<EMAIL_ADDRESS>0000-0001-7656-0184 Pak-
Austria Fachhochschule - Institute of Applied Sciences and TechnologyMang,
HaripurPakistan and  Bernhard Moser<EMAIL_ADDRESS>0000-0003-1859-046X Software Competence Center HagenbergHagenbergAustria

(2022)

###### Abstract.

With the proliferation of AI-enabled software systems in smart manufacturing,
the role of such systems moves away from a reactive to a proactive role that
provides context-specific support to manufacturing operators. In the frame of
the EU funded Teaming.AI project, we identified the monitoring of teaming
aspects in human-AI collaboration, the runtime monitoring and validation of
ethical policies, and the support for experimentation with data and machine
learning algorithms as the most relevant challenges for human-AI teaming in
smart manufacturing. Based on these challenges, we developed a reference
software architecture based on knowledge graphs, tracking and scene analysis,
and components for relational machine learning with a particular focus on its
scalability. Our approach uses knowledge graphs to capture product- and
process specific knowledge in the manufacturing process and to utilize it for
relational machine learning. This allows for context-specific recommendations
for actions in the manufacturing process for the optimization of product
quality and the prevention of physical harm. The empirical validation of this
software architecture will be conducted in cooperation with three large-scale
companies in the automotive, energy systems, and precision machining domain.
In this paper we discuss the identified challenges for such a reference
software architecture, present its preliminary status, and sketch our further
research vision in this project.

human-AI teaming, IIoT, knowledge graphs, relational machine learning,
software architecture, smart manufacturing

††journalyear: 2022††copyright: acmcopyright††conference: New Ideas and
Emerging Results ; May 21–29, 2022; Pittsburgh, PA, USA††booktitle: New Ideas
and Emerging Results (ICSE-NIER’22), May 21–29, 2022, Pittsburgh, PA,
USA††price: 15.00††doi: 10.1145/3510455.3512788††isbn:
978-1-4503-9224-2/22/05††ccs: Human-centered computing††ccs: Computing
methodologies Artificial intelligence††ccs: Software and its engineering

##  1\. Introduction

Applications of AI in smart manufacturing are manifold, ranging from improving
maintenance times of machinery, the detection of failures in the product or
the machinery to the prevention of harm to manufacturing operators. In
general, complex processes that are worked on collaboratively are
characterized by a sequence of reactive and proactive elements, which each
actor alternatingly supporting the other. AI-enabled systems in smart
manufacturing are capable of self-sensing, self-adaptation, self-organization,
and self-decision (Qu et al., 2019; Phuyal et al., 2020), allowing them to
respond to physical changes in the production environment in various ways - by
stopping machines, adapting production tasks, or suggesting the change of
production parameters. However, effective teaming between manufacturing
operators and AI-enabled manufacturing systems requires mutual trust into the
other’s capabilities, primarily resulting from self-sensing and self-adaption.
With regards to collaborative AI systems, this demands a high degree of
situational awareness for each other actor’s needs, knowledge of the
production process, and its adjustable parameters.

From a higher perspective, two main challenges related to teaming AI and
manufacturing operators in smart manufacturing can be identified: The first
challenge relates to the required scalability of the architecture when
processing data in near-realtime, particulary in combination with relational
machine learning, i.e., the statistical analysis of relational, or graph-
structured, data (Nickel et al., 2016). The second challenge relates to
examining a suitable framework to explicate the knowledge for effective
teaming in the manufacturing process. Shared mental models capture the common
ground knowledge in the collaboration between humans with robots (Scheutz et
al., 2017; Gervits et al., 2018; Jonker et al., 2011). We use knowledge graphs
and ontologies to formalize these shared mental models of the manufacturing
process and the semantics of trust factors for human-AI teaming in an
operational manner.

In this paper we first present the initial reference software architecture as
one important contribution of the Teaming.AI111https://www.teamingai-
project.eu project. The remainder of the paper is structured as follows: First
we sketch the envisioned approach based on a use case from one of the
industrial partners in Section 2, before we elaborate the identified
challenges for such a reference architecture in Section 3. Afterwards, we
present the current status of this software architecture in Section 4.
Finally, we sketch our next research activities and conclude the paper in
Section 5.

##  2\. Envisioned Approach

One of our industrial partners specializes in high-precision machining of
large-sized parts by milling or grinding based on cast materials or machine-
welded structures. Manufacturing operators must manually clamp large and heavy
parts into high-precision manufacturing machines to perform grinding or
milling operations. This process takes up a large portion of the total cycle
time of a work order and workers are exposed to occupational hazards. A
reliable full automation by an AI-assisted robotic system is beyond the
capabilities of current AI-based technologies, due to large part variety and
the complexity of the associated handling processes.

By compensating for the limited visual perception of both actors in the
manufacturing process - the manufacturing operator and the AI system - we seek
to maximize awareness of hazardous situations and conditions that negatively
impact physical or mental ergonomics. Based on human feedback, the AI system
learns to predict which action sequences are ergonomically favorable. However,
since the AI-augmented manufacturing system cannot be sure that it has the
complete information about the situation due to occlusions and unseen areas,
it expresses its confidence to the manufacturing operator by, for example,
displaying safety warnings. The system fuses observational data from a visual
tracking system with prior knowledge about the scene and process with in-
process feedback from the manufacturing operator. Obviously, for such a system
to gain the trust from the manufacturing operator, not only the correctness,
and context-dependent suitability are critical success factors, but also the
timely provision of recommended actions or the display of safety warnings. Of
course, such a system must also comply with ethical policies and standards,
which the manufacturing operator also tacitly assumes.

The general approach envisioned in our research project uses these data for
machine learning and the development of a context-aware AI-augmented
manufacturing system. Thereby, prior knowledge about the scene, geometry of
the parts, and compositional workflow patterns for the handling and processing
steps are encoded in a knowledge graph, along with safety guidelines. The
knowledge graph is updated at runtime with current contextual information. An
integrated self-diagnostic component simultaneously assesses the system’s
level of consistency and completeness and expresses its epistemic confidence.
In case of ambiguity, the manufacturing operator is asked for feedback.

From a functional perspective, the teaming of manufacturing operators and AI
in an industrial manufacturing process raises specific challenges related to
relational machine learning, processing IIoT streaming data, the modeling and
monitoring of trust (factors), and the continuous evaluation of human feedback
and compliance with ethical policies. From a non-functional perspective,
scalability and timing requirements of the components play a special role for
meeting the functional requirements in such a system.

##  3\. Research Challenges

In multiple workshops over the course of six months our research consortium
identified five core challenges relevant for a reference architecture for
human-AI teaming in smart manufacturing. These workshops involved researchers
from software engineering (3), knowledge engineering (3), machine learning
(4), computer vision (2), vision systems (2), and human factors (1) and domain
experts from the companies, such as production and quality managers.
1 Monitoring of Teaming Aspects in Human-AI Interaction. Salsas et al. in
(Salas et al., 2005) identified five core components that are necessary for
effective teamwork. In addition, shared mental models (Jonker et al., 2011),
mutual trust, and closed-loop communication serve as coordination mechanism
between the actors. We use these concepts as foundation for modeling the
manufacturing process as alternating activities between the manufacturing
operator and the AI-augmented manufacturing system. Further, we rely on the 4S
Interdependence Framework to define the neccessary state, structural
organization, skills, and strategy for each actor and activitiy in the smart
manufacturing process. The monitoring of these aspects, e.g., through mining
event logs or scene detection through a tracking and scene analysis system, is
the main challenge in this context.
2 Scalability for Near-Realtime IIoT Data Processing.  In smart manufacturing,
streaming data acquired from IIoT sensors continuously need to be processed so
that they can be used for machine learning. Thus, the scalability of a
reference architecture (Khalil et al., 2021; Santos et al., 2019) remains a
key challenge in this context as delayed or incorrect recommendations of the
AI systems to manufacturing operators may delay the workflow or, even worse,
can also endanger their safety. In this context we research on appropriate
consistency requirements in the face of data sharding between different
replicas to better cope with typical data volumes in this context.
3 Runtime Monitoring and Validation of Ethical Policies Formalizing ethical
and standards in an operational manner and validating their fulfillment by an
AI system at runtime remains a key challenge (Vakkuri et al., 2019; Vakkuri et
al., 2021; Hagendorff, 2020; Johnson and Smith, 2021) in this context. The
continuous validation of fulfillment of these policies and standards is
exacerbated by the fact that they can only be evaluated at runtime. In our
research we aim on developing a formalism based on ontology-reasoning to
express these policies and standards in an operational manner.
4 Relational Machine Learning for Knowledge Graphs. The first research
challenge relates to examining different approaches for calculating graph
embeddings and their respective computational costs (Nickel et al., 2016;
Trouillon et al., 2017). Second, for the development of the framework
abstraction layer, the required functionalities for orchestrated machine
learning need to be identified, which is the main challenge in this context.
Subsequently, generic interfaces covering these common functionalities can be
derived thereof.
5 Experimentation of Data and Algorithms. The automatization of experiments
requires an operational definition of the experiments’ evaluation criteria,
the parameterization of required data pipelines and machine learning
algorithms, and the configuration of their deployment and execution. Thus, the
research challenge comprises the development of domain-specific languages to
describe and evaluate these experiments based on quality factors of AI-based
systems (Siebert et al., 2020) in an operational manner. Further it comprises
the development of respective tooling for automatizing the evaluation of the
experiments (Nguyen-Duc and Abrahamsson, 2020; Bosch et al., 2020) that also
integrates qualitative expert feedback from the human-in-the-loop (HITL).

##  4\. Preliminary Status of the Reference Software Architecture

Figure 1. Reference Software Architecture For Human-AI Teaming in Smart
Manufacturing.

Reference Software Architecture For Human-AI Teaming in Smart Manufacturing.

Based on the aforementioned challenges our research consortium developed a
reference software architecture that serves as a blueprint for our subsequent
research activities and validations. Though this architecture merges different
viewpoints from researchers with software engineering and machine learning
backgrounds, we expect subtle changes with progress of the research project.
Thus, this description captures its preliminary status.

Figure 1 shows the different components of this reference architecture. To
account for the different latency requirements of the components to process
the data in a streaming-like manner, we followed the Lambda architecture
pattern as described by Warren and Marz (Warren and Marz, 2015). This
architectural pattern groups the components based on their latency
requirements into three layers. The batch layer (model authoring) ingests and
stores large amounts of data, the speed layer (knowledge graph, graph-based ML
and teaming engine, production line systems) processes updates to the data in
low-latency, and the serving layer (operation support, ML experimentation,
introspection & policy monitoring) provides precalculated results also in a
low-latency fashion (Preuveneers et al., 2016). To separate read and write
operations and therewith be able to balance the processing of large data
volumes, all data stores used in the architecture (i.e., dynamic knowledge
graph, time series, and media data) are replicated as read and write shards.
The synchronization between these replicas is performed autonomously by the
synchronization management component.

###  4.1. Model Authoring & Import

Product- and process specific models for the manufacturing process are
imported into the knowledge graph by means of batches. In this regard,
importing might also comprise to convert these domain-specific models into a
graph representation such as RDF (Resource Description Framework). This
component also embodies the functionality needed for authoring and versioning
the models.

###  4.2. ML Experimentation

During the continuous improvement and testing of AI-based systems, huge
amounts of data are generated that can be used for targeted experiments with
these systems (Arpteg et al., 2018; Amershi et al., 2019). Particularly, the
indeterministic nature of data-driven algorithms and their entanglement with
the used training data underpins the need for continuous experimentation and
validation of AI components.

###  4.3. Introspection & Policy Monitoring

Explainability of AI (XAI) (Rudin, 2019), ethics-based auditability (Mökander
et al., 2021), and the alignment with human rights and autonomy (IEEE, 2019)
are common examples for ethical requirements towards AI systems. In recent
years, several policies and guidelines have been presented by companies, e.g.,
Google (Pichai, 2018), governmental bodies, e.g., the EU (HLEG, 2019), and
standardization organizations, e.g., from IEEE (IEEE, 2019). The compliance
with these standards and policies needs to be assured throughout the operation
of any AI-enabled software system. To this end, this component encapsulates
introspection capabilities, i.e., the self-directed evaluation of the AI
system by itself, and additional monitoring and validation facilities related
to ethical standards and policies. While introspection is triggered ad-hoc,
e.g., upon the detection of suspicious interaction patterns, monitoring and
validation is performed continuously at runtime. To also take into account
historical data when evaluating the compliance with ethical policies, all
processed events are stored in the event store.

###  4.4. Knowledge Graph

Due to the emerging use of knowledge graphs to represent ontologies and
semantic data, they also become increasingly important to formalize expert
knowledge, process, and simulation data in manufacturing (Listl et al., 2020).
Based on the frequency of updates to the data, the reference architecture
differentiates between a dynamic and a static knowledge subgraph. Models
related to the product, the manufacturing process, and to experimentation are
static in the sense that they do not need to be continuously updated at
runtime. These data are embodied in the static subgraph. The dynamic subgraph
on the other hand covers operational data accruing in the manufacturing
process itself (Ringsquandl et al., 2018; Ringsquandl et al., 2017), augmented
by added facts from relational machine learning to optimize the interplay
between human and AI. This interplay can, e.g., be optimized by proactively
giving the operator recommendations for the next manufacturing step or
suggesting parameter changes for the machinery to respond to observed product
quality deviations, detected by the AI systems.

###  4.5. Graph-based ML Engine

This component provides relational machine learning capabilities that focus on
the application of machine learning methods onto relational or graph-
structured data such as knowledge graphs. An essential prerequisite for this
is the calculation of graph embeddings, i.e., the transfer of a graph
representation into a vector space. to orchestrate complex machine learning
tasks (e.g., via frameworks such as Kubeflow, TensorFlow Extended, or MLFlow)
it provides a framework abstraction layer to make these frameworks accessible
through a generic software interface.

###  4.6. Teaming Engine

The orchestration engine controls the reliable execution of the teaming
process, which is defined in the teaming model. This model structures the
concrete sequence of activities in the interaction between the AI system and
the manufacturing operator. Also, it gives a framework to define which
policies are relevant in a specific time period of the manufacturing process
and to formalize the ground rules for team interaction, as described by the 4S
Interdependence Framework of Johnson and Vera (Johnson and Vera, 2019). For
the orchestration of the teaming process, two types of events are processed by
the teaming engine: Raw events are extracted from the production line system
through IIoT sensors, whereby teaming events are exchanged by the different
components after processing. As a result, only teaming events contain
contextual data. The orchestration engine can only work with teaming events,
since the contextual data must also be evaluated to decide on the next
manufacturing activity. The event translation merges several atomic events so
that they can be used for decision-making by the orchestration engine.

###  4.7. Operation Support

The current situation on the shopfloor, i.e., the position of parts and
movements of the manufacturing operator, machine settings, and their observed
effects on production quality must be taken into account when giving
recommendations to the manufacturing operator. Thereby, tracking and scene
analysis (TSA) is provided by the situation awareness component, based on
media data such as video, imagery or audio recordings. The system’s self
diagnosis evaluates the reliability of its recommendations and prematurely
alerts upon violations of policies. The interplay of these components, the
knowledge graph, and machine learning components for the calculation and
selection of recommended actions to the manufacturing operator is controlled
by the decision support component.

For the storage of near-realtime data acquired from the production line
systems, a time series database is provided. Media data from the TSA system
are persisted in the context media database.

###  4.8. Production Line Systems

Operational data from production and contextual systems, e.g., auxillary
systems or manufacturing process control, are acquired from IIoT sensors or
from machine-specific implementations, e.g., based on the OPC Unified
Architecture (Foundation, 2008). An HMI (Human Machine Interface) is provided
to interact with the manufacturing operator, to gather context-dependent
feedback about the relevance of given recommendations by the AI. Also, it
allows to acquire information about unexpectedly taken actions by the
manufacturing operator.

##  5\. Future Work and Conclusion

The presented reference software architecture is framework- and technology
agnostic. It shall serve as a blueprint for deriving the software architecture
for a particular manufacturing context in a producing company. We use this
reference architecture to derive the concrete architecture for the AI-enabled
smart manufacturing systems of our three industrial partners in the
automotive, energy systems, and precision machining domain. Thus, all three
companies have different manufacturing processes in place that result in
diverging scalability and interoperability requirements of the software
architecture. The validation of the reference architecture will investigate
its applicability to different manufacturing contexts, its scalability, and
its suitability for validating the compliance of ethical standards during
operation. To examine its applicability we will conduct expert interviews with
software architects of our industrial partners after having applied the
reference software architecture. Likewise, we will conduct interviews with
manufacturing operators to assess the suitability of the overall approach and
how well it supports the teaming between human and AI in smart manufacturing.
Complementary, the quantitative validation will use data acquired from runtime
probes to examine the scalability and the consistency among the data shards
under heavy load.

##  6\. Acknowledgements

This project has received funding from the European Union’s Horizon 2020
research and innovation programme under grant agreement No 957402.

## References

  * (1)
  * Amershi et al. (2019) Saleema Amershi, Andrew Begel, Christian Bird, Robert DeLine, Harald Gall, Ece Kamar, Nachiappan Nagappan, Besmira Nushi, and Thomas Zimmermann. 2019.  Software Engineering for Machine Learning: A Case Study. In _2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)_. 291–300.  https://doi.org/10.1109/ICSE-SEIP.2019.00042
  * Arpteg et al. (2018) Anders Arpteg, Björn Brinne, Luka Crnkovic-Friis, and Jan Bosch. 2018.  Software Engineering Challenges of Deep Learning. In _2018 44th Euromicro Conference on Software Engineering and Advanced Applications (SEAA)_. 50–59.  https://doi.org/10.1109/SEAA.2018.00018
  * Bosch et al. (2020) Jan Bosch, Ivica Crnkovic, and Helena Holmström Olsson. 2020\.  Engineering AI Systems: A Research Agenda.  _arXiv:2001.07522 [cs]_ (2020).  http://arxiv.org/abs/2001.07522 arXiv: 2001.07522.
  * Foundation (2008) OPC Foundation. 2008\.  What is OPC?  https://opcfoundation.org/about/what-is-opc/ Accessed 2022-01-13.
  * Gervits et al. (2018) Felix Gervits, Terry W. Fong, and Matthias Scheutz. 2018\.  Shared Mental Models to Support Distributed Human-Robot Teaming in Space.  In _2018 AIAA SPACE and Astronautics Forum and Exposition_. American Institute of Aeronautics and Astronautics.  https://doi.org/10.2514/6.2018-5340
  * Hagendorff (2020) Thilo Hagendorff. 2020\.  The Ethics of AI Ethics: An Evaluation of Guidelines.  _Minds and Machines_ 30, 1 (2020), 99–120.  https://doi.org/10.1007/s11023-020-09517-8
  * HLEG (2019) HLEG. 2019.  Ethics guidelines for trustworthy AI | Shaping Europe’s digital future.  https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai Accessed 2022-01-13.
  * IEEE (2019) IEEE. 2019.  IEEE Global A/IS Ethics Initiative.  https://standards.ieee.org/industry-connections/ec/autonomous-systems.html Accessed 2022-01-13.
  * Johnson and Smith (2021) Brittany Johnson and Justin Smith. 2021.  Towards Ethical Data-Driven Software: Filling the Gaps in Ethics Research & Practice. In _2021 IEEE/ACM 2nd International Workshop on Ethics in Software Engineering Research and Practice (SEthics)_. 18–25.  https://doi.org/10.1109/SEthics52569.2021.00011
  * Johnson and Vera (2019) Matthew Johnson and Alonso Vera. 2019.  No AI Is an Island: The Case for Teaming Intelligence.  _AI Magazine_ 40, 1 (2019), 16–28.  https://doi.org/10.1609/aimag.v40i1.2842
  * Jonker et al. (2011) Catholijn M. Jonker, M. Birna van Riemsdijk, and Bas Vermeulen. 2011.  Shared Mental Models. In _Coordination, Organizations, Institutions, and Norms in Agent Systems VI_ _(Lecture Notes in Computer Science)_ , Marina De Vos, Nicoletta Fornara, Jeremy V. Pitt, and George Vouros (Eds.). Springer, Berlin, Heidelberg, 132–151.  https://doi.org/10.1007/978-3-642-21268-0_8
  * Khalil et al. (2021) Ruhul Amin Khalil, Nasir Saeed, Mudassir Masood, Yasaman Moradi Fard, Mohamed-Slim Alouini, and Tareq Y. Al-Naffouri. 2021.  Deep Learning in the Industrial Internet of Things: Potentials, Challenges, and Emerging Applications.  _IEEE Internet of Things Journal_ 8, 14 (2021), 11016–11040.  https://doi.org/10.1109/JIOT.2021.3051414
  * Listl et al. (2020) Franz Georg Listl, Jan Fischer, Dagmar Beyer, and Michael Weyrich. 2020.  Knowledge Representation in Modeling and Simulation: A survey for the production and logistic domain. In _2020 25th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA)_ , Vol. 1. 1051–1056.  https://doi.org/10.1109/ETFA46521.2020.9211994
  * Mökander et al. (2021) Jakob Mökander, Jessica Morley, Mariarosaria Taddeo, and Luciano Floridi. 2021.  Ethics-Based Auditing of Automated Decision-Making Systems: Nature, Scope, and Limitations.  _Science and Engineering Ethics_ 27, 4 (2021), 44.  https://doi.org/10.1007/s11948-021-00319-4
  * Nguyen-Duc and Abrahamsson (2020) Anh Nguyen-Duc and Pekka Abrahamsson. 2020.  Continuous experimentation on artificial intelligence software: a research agenda. In _Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering_ _(ESEC/FSE 2020)_. Association for Computing Machinery, New York, NY, USA, 1513–1516.  https://doi.org/10.1145/3368089.3417039
  * Nickel et al. (2016) Maximilian Nickel, Kevin Murphy, Volker Tresp, and Evgeniy Gabrilovich. 2016.  A Review of Relational Machine Learning for Knowledge Graphs.  _Proc. IEEE_ 104, 1 (2016), 11–33.  https://doi.org/10.1109/JPROC.2015.2483592
  * Phuyal et al. (2020) Sudip Phuyal, Diwakar Bista, and Rabindra Bista. 2020\.  Challenges, Opportunities and Future Directions of Smart Manufacturing: A State of Art Review.  _Sustainable Futures_ 2 (2020), 100023.  https://doi.org/10.1016/j.sftr.2020.100023
  * Pichai (2018) S Pichai. 2018.  AI at Google: our principles.  https://blog.google/technology/ai/ai-principles/ Accessed 2022-01-13.
  * Preuveneers et al. (2016) Davy Preuveneers, Yolande Berbers, and Wouter Joosen. 2016\.  SAMURAI: A batch and streaming context architecture for large-scale intelligent applications and environments.  _Journal of Ambient Intelligence and Smart Environments_ 8, 1 (2016), 63–78.  https://doi.org/10.3233/AIS-150357
  * Qu et al. (2019) Y. J. Qu, X. G. Ming, Z. W. Liu, X. Y. Zhang, and Z. T. Hou. 2019.  Smart manufacturing systems: state of the art and future trends.  _The International Journal of Advanced Manufacturing Technology_ 103, 9 (2019), 3751–3768.  https://doi.org/10.1007/s00170-019-03754-7
  * Ringsquandl et al. (2018) Martin Ringsquandl, E. Kharlamov, Daria Stepanova, Marcel Hildebrandt, S. Lamparter, R. Lepratti, I. Horrocks, and Peer Kröger. 2018\.  Filling Gaps in Industrial Knowledge Graphs via Event-Enhanced Embedding. In _Proceedings of ISWC 2018 Posters & Demonstrations, Industry and Blue Sky Ideas Tracks co-located with 17th International Semantic Web Conference (ISWC 2018)_. CEUR Workshop Proceedings (CEUR-WS.org).  http://ceur-ws.org/Vol-2180/paper-52.pdf Accessed 2022-01-13.
  * Ringsquandl et al. (2017) Martin Ringsquandl, Evgeny Kharlamov, Daria Stepanova, Steffen Lamparter, Raffaello Lepratti, Ian Horrocks, and Peer Kröger. 2017\.  On event-driven knowledge graph completion in digital factories. In _2017 IEEE International Conference on Big Data (Big Data)_. 1676–1681.  https://doi.org/10.1109/BigData.2017.8258105
  * Rudin (2019) Cynthia Rudin. 2019\.  Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead.  _Nature Machine Intelligence_ 1, 5 (2019), 206–215.  https://doi.org/10.1038/s42256-019-0048-x
  * Salas et al. (2005) Eduardo Salas, Dana E. Sims, and C. Shawn Burke. 2005\.  Is there a “Big Five” in Teamwork?  _Small Group Research_ 36, 5 (2005), 555–599.  https://doi.org/10.1177/1046496405277134
  * Santos et al. (2019) Nuno Santos, Francisco Morais, Helena Rodrigues, and Ricardo J. Machado. 2019.  Systems Development for the Industrial IoT: Challenges from Industry R&D Projects.  In _The Internet of Things in the Industrial Sector: Security and Device Connectivity, Smart Environments, and Industry 4.0_ , Zaigham Mahmood (Ed.). Springer International Publishing, Cham, 55–78.  https://doi.org/10.1007/978-3-030-24892-5_3
  * Scheutz et al. (2017) Matthias Scheutz, Scott A. DeLoach, and Julie A. Adams. 2017\.  A Framework for Developing and Using Shared Mental Models in Human-Agent Teams.  _Journal of Cognitive Engineering and Decision Making_ 11, 3 (2017), 203–224.  https://doi.org/10.1177/1555343416682891
  * Siebert et al. (2020) Julien Siebert, Lisa Jöckel, Jens Heidrich, Koji Nakamichi, Kyoko Ohashi, Isao Namba, Rieko Yamamoto, and Mikio Aoyama. 2020\.  Towards Guidelines for Assessing Qualities of Machine Learning Systems. In _Quality of Information and Communications Technology - 13th International Conference, QUATIC 2020, Faro, Portugal, September 9-11, 2020, Proceedings_ _(Communications in Computer and Information Science, Vol. 1266)_ , Martin J. Shepperd, Fernando Brito e Abreu, Alberto Rodrigues da Silva, and Ricardo Pérez-Castillo (Eds.). Springer, 17–31.  https://doi.org/10.1007/978-3-030-58793-2_2
  * Trouillon et al. (2017) Théo Trouillon, Christopher R. Dance, Éric Gaussier, Johannes Welbl, Sebastian Riedel, and Guillaume Bouchard. 2017.  Knowledge graph completion via complex tensor factorization.  _The Journal of Machine Learning Research_ 18, 1 (2017), 4735–4772.
  * Vakkuri et al. (2019) Ville Vakkuri, Kai-Kristian Kemell, and Pekka Abrahamsson. 2019.  Ethically Aligned Design: An Empirical Evaluation of the RESOLVEDD-Strategy in Software and Systems Development Context. In _2019 45th Euromicro Conference on Software Engineering and Advanced Applications (SEAA)_. 46–50.  https://doi.org/10.1109/SEAA.2019.00015
  * Vakkuri et al. (2021) Ville Vakkuri, Kai-Kristian Kemell, Marianna Jantunen, Erika Halme, and Pekka Abrahamsson. 2021\.  ECCOLA — A method for implementing ethically aligned AI systems.  _Journal of Systems and Software_ 182 (2021), 111067\.  https://doi.org/10.1016/j.jss.2021.111067
  * Warren and Marz (2015) James Warren and Nathan Marz. 2015.  _Big Data: Principles and best practices of scalable realtime data systems_ (1st edition).  Manning.


METHOD | Depending on the solver, this variable should name one of its available methods. For SOLVER=$1$, METHOD=RODASPR2(fourth order) or ROS34PW2(third order). For SOLVER=$2$, METHOD=DormandPrince (seventh order). There is a macro (METHOD) used by the shared library MiMeS/lib/Axion_py.so. The corresponding variable in MiMeS/Definitions.mk applies to the python modules. The variable in MiMeS/UserSpace/Cpp/Axion/Definitions.mk applies to the example in that directory.
Compiler options
CC | The preferred C++ compiler (g++ by default). Corresponding variable in all Definitions.mk files.
OPT | Available options are OPT=O1, O2, O3 (be default). This variable defines the optimization level of the compiler. The variable can be changed in all Definitions.mk files. In the root directory of MiMeS, the optimization level applies to the python modules (i.e. the shared libraries), while in the subdirectories of MiMeS/UserSpace/Cpp it only applies to example inside them.
Table 6: User compile-time input and options. These are available in the
various Definitions.mk files, which are used when compiling using make.

## References

  * [1] R. D. Peccei and H. R. Quinn, CP Conservation in the Presence of Instantons, Phys. Rev. Lett. 38 (1977) 1440--1443.

  * [2] S. Weinberg, A New Light Boson?, Phys. Rev. Lett. 40 (1978) 223--226.
  * [3] F. Wilczek, Problem of Strong $P$ and $T$ Invariance in the Presence of Instantons, Phys. Rev. Lett. 40 (1978) 279--282.
  * [4] J. Preskill, M. B. Wise, and F. Wilczek, Cosmology of the Invisible Axion, Phys. Lett. B 120 (1983) 127--132.
  * [5] M. Dine and W. Fischler, The Not So Harmless Axion, Phys. Lett. B 120 (1983) 137--141.
  * [6] L. F. Abbott and P. Sikivie, A Cosmological Bound on the Invisible Axion, Phys. Lett. B 120 (1983) 133--136.
  * [7] Planck Collaboration, N. Aghanim et al., Planck 2018 results. VI. Cosmological parameters, Astron. Astrophys. 641 (2020) A6, [arXiv:1807.06209].
  * [8] Y. Chikashige, R. N. Mohapatra, and R. D. Peccei, Are There Real Goldstone Bosons Associated with Broken Lepton Number?, Phys. Lett. B 98 (1981) 265--268.
  * [9] H. M. Georgi, L. J. Hall, and M. B. Wise, Grand Unified Models With an Automatic Peccei-Quinn Symmetry, Nucl. Phys. B 192 (1981) 409--416.
  * [10] A. Ringwald, Axions and Axion-Like Particles, in 49th Rencontres de Moriond on Electroweak Interactions and Unified Theories, pp. 223--230, 2014\.  arXiv:1407.0546.
  * [11] D. J. Marsh, Axion cosmology, Physics Reports 643 (2016) 1--79. Axion cosmology.
  * [12] E. W. Kolb and M. S. Turner, The early universe.  Frontiers in Physics. Westview Press, Boulder, CO, 1990.
  * [13] P. J. E. Peebles, Principles of physical cosmology.  Princeton University Press, 1993.
  * [14] M. Kawasaki, K. Kohri, and N. Sugiyama, MeV scale reheating temperature and thermalization of neutrino background, Phys. Rev. D 62 (2000) 023506, [astro-ph/0002127].
  * [15] S. Hannestad, What is the lowest possible reheating temperature?, Phys. Rev. D 70 (2004) 043506, [astro-ph/0403291].
  * [16] K. Ichikawa, M. Kawasaki, and F. Takahashi, The Oscillation effects on thermalization of the neutrinos in the Universe with low reheating temperature, Phys. Rev. D 72 (2005) 043522, [astro-ph/0505395].
  * [17] F. De Bernardis, L. Pagano, and A. Melchiorri, New constraints on the reheating temperature of the universe after WMAP-5, Astropart. Phys. 30 (2008) 192--195.
  * [18] L. Visinelli and P. Gondolo, Axion cold dark matter in non-standard cosmologies, Phys. Rev. D 81 (2010) 063508, [arXiv:0912.0015].
  * [19] P. Arias, N. Bernal, D. Karamitros, C. Maldonado, L. Roszkowski, and M. Venegas, New opportunities for axion dark matter searches in nonstandard cosmological models, JCAP 11 (2021) 003, [arXiv:2107.13588].
  * [20] P. Gondolo, J. Edsjo, P. Ullio, L. Bergstrom, M. Schelke, and E. A. Baltz, DarkSUSY: Computing supersymmetric dark matter properties numerically, JCAP 07 (2004) 008, [astro-ph/0406204].
  * [21] G. Belanger, F. Boudjema, A. Pukhov, and A. Semenov, micrOMEGAs$\\_$3: A program for calculating dark matter observables, Comput. Phys. Commun. 185 (2014) 960--985, [arXiv:1305.0237].
  * [22] G. Bélanger, F. Boudjema, A. Goudelis, A. Pukhov, and B. Zaldivar, micrOMEGAs5.0 : Freeze-in, Comput. Phys. Commun. 231 (2018) 173--186, [arXiv:1801.03509].
  * [23] T. Binder, T. Bringmann, M. Gustafsson, and A. Hryczuk, DRAKE: Dark matter Relic Abundance beyond Kinetic Equilibrium, Eur. Phys. J. C 81 (2021) 577, [arXiv:2103.01944].
  * [24] S. Chang, C. Hagmann, and P. Sikivie, The Cold axion populations, in 2nd International Heidelberg Conference on Dark Matter in Astro and Particle Physics, 7, 1998.  hep-ph/9812327.
  * [25] S. Borsanyi et al., Calculation of the axion mass based on high-temperature lattice quantum chromodynamics, Nature 539 (2016), no. 7627 69--71, [arXiv:1606.07494].
  * [26] L. Visinelli and P. Gondolo, Dark Matter Axions Revisited, Phys. Rev. D 80 (2009) 035024, [arXiv:0903.4377].
  * [27] R. T. Co, L. J. Hall, and K. Harigaya, Axion Kinetic Misalignment Mechanism, Phys. Rev. Lett. 124 (2020), no. 25 251802, [arXiv:1910.14152].
  * [28] C.-F. Chang and Y. Cui, New Perspectives on Axion Misalignment Mechanism, Phys. Rev. D 102 (2020), no. 1 015003, [arXiv:1911.11885].
  * [29] D. H. Lyth, Axions and inflation: Sitting in the vacuum, Phys. Rev. D 45 (1992) 3394--3404.
  * [30] K. J. Bae, J.-H. Huh, and J. E. Kim, Update of axion CDM energy, JCAP 09 (2008) 005, [arXiv:0806.0497].
  * [31] D. Karamitros, NaBBODES: Not a black box ordinary differential equation solver in C++, 2019--.
  * [32] D. Karamitros, SimpleSplines: A header only library for linear and cubic spline interpolation in C++., 2021--.
  * [33] C. R. Harris, K. J. Millman, S. J. van der Walt, R. Gommers, P. Virtanen, D. Cournapeau, E. Wieser, J. Taylor, S. Berg, N. J. Smith, R. Kern, M. Picus, S. Hoyer, M. H. van Kerkwijk, M. Brett, A. Haldane, J. F. del Río, M. Wiebe, P. Peterson, P. Gérard-Marchant, K. Sheppard, T. Reddy, W. Weckesser, H. Abbasi, C. Gohlke, and T. E. Oliphant, Array programming with NumPy, Nature 585 (Sept., 2020) 357--362.
  * [34] J. Rang, Improved traditional rosenbrock–wanner methods for stiff odes and daes, Journal of Computational and Applied Mathematics 286 (2015) 128--144.
  * [35] J. Rang and L. Angermann, New rosenbrock w-methods of order 3 for partial differential algebraic equations of index 1, BIT Numerical Mathematics 45 (2005) 761–787.
  * [36] J. Dormand and P. Prince, A family of embedded runge-kutta formulae, Journal of Computational and Applied Mathematics 6 (1980), no. 1 19--26.
  * [37] K. Saikawa and S. Shirai, Precise WIMP Dark Matter Abundance and Standard Model Thermodynamics, JCAP 08 (2020) 011, [arXiv:2005.03544].
  * [38] P. Arias, N. Bernal, A. Herrera, and C. Maldonado, Reconstructing Non-standard Cosmologies with Dark Matter, JCAP 10 (2019) 047, [arXiv:1906.04183].
  * [39] P. Arias, D. Karamitros, and L. Roszkowski, Frozen-in fermionic singlet dark matter in non-standard cosmology with a decaying fluid, JCAP 05 (2021) 041, [arXiv:2012.07202].
  * [40] T. Kluyver, B. Ragan-Kelley, F. Pérez, B. Granger, M. Bussonnier, J. Frederic, K. Kelley, J. Hamrick, J. Grout, S. Corlay, P. Ivanov, D. Avila, S. Abdalla, and C. Willing, Jupyter notebooks – a publishing format for reproducible computational workflows, in Positioning and Power in Academic Publishing: Players, Agents and Agendas (F. Loizides and B. Schmidt, eds.), pp. 87 -- 90, IOS Press, 2016.
  * [41] C. OH́ARE, cajohare/axionlimits: Axionlimits, .
  * [42] E. Hairer, S. Nørsett, and G. Wanner, Solving Ordinary Differential Equations I Nonstiff problems.  Springer, Berlin, second ed., 2000.
  * [43] E. Hairer and G. Wanner, Solving Ordinary Differential Equations II: Stiff and Differential-Algebraic Problems.  Springer Series in Computational Mathematics. Springer Berlin Heidelberg, 2010.
  * [44] W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical Recipes 3rd Edition: The Art of Scientific Computing.  Cambridge University Press, USA, 3 ed., 2007.
  * [45] Particle Data Group Collaboration, P. Zyla et al., Review of Particle Physics, PTEP 2020 (2020), no. 8 083C01.
  * [46] J. D. Hunter, Matplotlib: A 2d graphics environment, Computing in Science & Engineering 9 (2007), no. 3 90--95.


# Mosaics of Combinatorial Designs for Semantic Security on Quantum Wiretap
Channels

Holger Boche
Lehrstuhl für Theoretische Informationstechnik,
Technische Universität München,
Munich, Germany
Excellence Cluster Cyber Security
Cyber Security in the Age of Large-Scale Adversaries,
Ruhr-Universität Bochum,
Bochum, Germany
Munich Center for Quantum Science and Technology (MCQST),
Munich, Germany
<EMAIL_ADDRESS>Minglai Cai
Quantum Information Group
Universitat Autònoma de Barcelona,
Barcelona, Spain  Moritz Wiese
Lehrstuhl für Theoretische Informationstechnik,
Technische Universität München,
Munich, Germany
Excellence Cluster Cyber Security
Cyber Security in the Age of Large-Scale Adversaries,
Ruhr-Universität Bochum,
Bochum, Germany
<EMAIL_ADDRESS>
###### Abstract

We study semantic security for classical-quantum channels. Our security
functions are functional forms of mosaics of combinatorial designs. We extend
methods of [27] for classical channels to classical-quantum channels to
demonstrate that mosaics of designs ensure semantic security for classical-
quantum channels, and are also capacity achieving coding scheme.. The
legitimate channel users share an additional public resource, more precisely,
a seed chosen uniformly at random. An advantage of these modular wiretap codes
is that we provide explicit code constructions that can be implemented in
practice for every channels, giving an arbitrary public code.

###### Contents

  1. 1 Introduction
  2. 2 Basic Notations and Definitions
    1. 2.1 Communication Scenarios
    2. 2.2 Mosaics of combinatorial designs
    3. 2.3 Modular Codes
  3. 3 Main Results
    1. 3.1 Semantic Security by Mosaics of Designs
    2. 3.2 Secrecy Rate
  4. 4 Further Remark

##  1 Introduction

We investigate the transmission of messages from a sender to a legitimate
receiver to ensure semantic security. The model of a wiretap channel adds a
third party to the communication problem with focus on secure communication,
meaning communication without that third party getting to know the messages.
This model was first introduced by Wyner in [28]. A classical-quantum channel
with an eavesdropper is called a classical-quantum wiretap channel, and its
secrecy capacity has been determined in [8] and [9].

In most of the previous works only strong security is required, meaning that
given a uniformly distributed message sent through the channel, the
eavesdropper shall obtain no information about it. This is the more common
secrecy criterion in the quantum information theory. However, our goal is a
stronger security property formalized by [3], namely the semantic security.
Semantic security in the information theory imposes the eavesdropper to gain
no information for any distribution of the messages, not just the uniform one.
In cryptography, semantic security is a security goal for key cryptosystem
such that the eavesdropper cannot distinguish the given encryption of any two
messages. (cf. [13] and [3]). The equivalence between semantic security and
message indistinguishability under chosen-plaintext attack has been shown in
[14].

Most of these pre-works merely delivered an existence proof that there exists
secure codes achieving the security capacity formula, but do not answer the
question how these codes can be construct. However, in recent years, explicit
code constructions become more important in secure network design and quantum
communications (cf. [22] for an example). An essential aspect of code
construction is that it can be implemented in practice. It is expected, that
information theoretical security will play an important roll in future
communication systems. It is the very technique to achieve security by design,
which is already a key requirement for 6G ([10] and [11]). Furthermore, it is
expected, that quantum communication and the use of quantum resources will be
important for achieving the design goals of 6G ([12]). Therefore, the
construction of secure codes for quantum wiretap channels is an important
requirement.

[3] investigated semantic security for certain special classical wiretap
channels and could provide semantic secure code constructions for these
channels. [19] provided semantic secure polar code constructions for Gaussian
wiretap channels. Please also see [5] for further explicit semantic secure
code constructions of certain channels, and [4] for another approach of secure
code design of Gaussian wiretap channels.

In this work, we consider modular wiretap codes constructed from an arbitrary
transmission code and a security function. This modular code concept is not
only an existence statement, but actually show explicitly how to construct
semantic secrecy capacity achieving codes for every classical-quantum wiretap
channel, as long as any reliable public transmission code is given.

Using modular code with hash functions, defined via the function inverses in
terms of group homomorphisms, as security function, [17] showed semantic
security for classical channels (cf. Example 4.1). The technique of [17] has
been applied in [15] for additive fully quantum channels, when the
eavesdropper has access to the whole environment. However, it is unknown
whether the seed required in [17] can be as short as for the security
functions in this work. Furthermore, the results in [15] are limited to linear
codes and to additive channels.

Figure 1:  The classical-quantum wiretap channel scenario. $W$ denotes the
legal channel, while $V$ is the wiretap. $(E,G)$ is a reliable code. $f$ is a
functional form of mosaics of combinatorial design. The seed $s$ has to be
known to the sender and receiver, and may be known by the eavesdropper.

A modular code for the classical-quantum wiretap channel is illustrated in the
Figure 1. A reliable public code $\mathcal{C}_{public}$
$=(E,\\{G_{\alpha}:\alpha\\})$ from the sender to the intended receiver with
input alphabet ${\mathcal{X}}$, consisting of a encoder $E$ and a set of
decoder operators $\\{G_{\alpha}:\alpha\\}$, is given. $f$ is a hash function.
The sender and the intended receiver have to share a seed $s$, chosen
uniformly at random. Given any message $\alpha$ and seed $s$, the sender
randomly chooses a preimage $x$, satisfying $f(s,x)=\alpha$, and send through
the channel via the given encoder. We assume that the receive can decoder $x$
with decoding error $P_{e}(\mathcal{C}_{public})$. Since $s$ is known by the
receiver, $a$ can recovered with decoding error $P_{e}(\mathcal{C}_{public})$.
We emphasize that the seed is not a secret key, since we do not require it to
be unknown to the eavesdropper. There is a separation of the security task and
the reliability task: Since the intended receiver knows $s$, he can recover
$\alpha$ with errors $P_{e}(\mathcal{C}_{public})$. The reliability task
depends here only on $\mathcal{C}_{public}$, but not on $f$. On the other
hand, the security task depends here only on $f$, but not on
$\mathcal{C}_{public}$. This is a notable advantage of this modular code,
namely since the reliability task depends here only on $\mathcal{C}_{public}$,
the efficiency of reliability of the modular code is the same as the
reliability of the given public code. The existence of efficient reliable
public codes and their constructions have been already extensively analyzed in
the above cited pre-works. On the other hand, since the security task depends
here only on $f$, a functional form of mosaic of combinatorial design, the
efficiency of security of the modular code can be analyzed independent of the
given public code, when we can show that the functional forms of mosaic
designs guarantee semantic security. We will show that the functional forms of
mosaic designs always proves semantic security for modular code made of any
public code in this work. Together with the well-know results of efficient
reliable public codes, we show a most general semantic secure code
constructions that can be implemented in practice.

Using modular code with functional forms of mosaics of combinatorial designs
as hash functions, [27] showed semantic security for classical channels. In
this paper we extend this method to classical-quantum channels, i.e., we
construct a modular code, where the hash functions, which are functional forms
of mosaics of combinatorial design, are used as security function. A
functional form of mosaics of combinatorial design has the form
$f:\mathcal{S}\times\mathcal{X}\to\mathcal{A}$. Here, $\mathcal{S}$ is a seed
set, and $\mathcal{A}$ is the set of messages. Every pre-image is the
incidence relation of a balanced incomplete block design (BIBD) or a group
divisible design (GDD). Such a function defines a mosaic of designs
$\\{D_{\alpha}:\alpha\in A\\}$, which is a family of designs on $\mathcal{X}$
and $\mathcal{S}$ satisfying that every pair $(x,s)$ is incident in a unique
$D_{\alpha}$. We bound the information leak to the eavesdropper and show
semantic security. The approach can be applied on any reliable transmission
code.

We apply the standard derandomization technique. The original derandomization
technique works this way (cf. the code concept for arbitrarily varying
classical-quantum channels in [2]): For every message, a two-part code word,
which consists of a non-secure code word and a modular code word, is built.
The first part is used to to produce the seed. The second part is used to
transmit the message. However, this standard technique may cause significant
rate loss when size of the needed seed set is too large. Follow the idea of
[26] and [6], we reduce the total size of channel uses by reusing the seed.
Instead of one two-part code word for every single message, we build for
multiple messages a block of code words. The leading public code word is used
to create one single seed. The following parts are multiple semantic secure
modular code words, which share this one single seed. With this code concept,
the semantic secrecy capacity for classical-quantum channel given in [6] can
be achieved.

As mentioned above, a notable advantage of the modular wiretap codes presented
in this paper is that they separate the the task of reliable message
transmission from the sender to the intended receiver from that of securing
the message from the eavesdropper. Moreover, the application of the functional
form of a mosaic of designs does not require any quantum operations. Hence
semantic security, can be realized in classical software or hardware. In
particular, security functions do not have to appear in the lowest, physical
layer of the open systems interconnection (OSI) networking model (cf. [25]).
Instead, they could be implemented on the medium access control (MAC) layer,
for example. As soon as the data which are to be transmitted securely over the
data link are known, the randomized inverse of the security function can be
applied. The physical layer can be left untouched. This allows for an easy
integration of information theoretic security into existing systems,
especially if the higher layers are realized in software. In this case, a
simple software update is sufficient in order to enable the support of
information theoretic security.

##  2 Basic Notations and Definitions

###  2.1 Communication Scenarios

For a finite set $B$, we denote the set of probability distributions on $B$ by
$P(B)$. Let $\rho_{1}$ and $\rho_{2}$ be Hermitian operators on a finite-
dimensional complex Hilbert space ${\cal H}$. We say $\rho_{1}\geq\rho_{2}$
and $\rho_{2}\leq\rho_{1}$ if $\rho_{1}-\rho_{2}$ is positive-semidefinite.
For a finite-dimensional complex Hilbert space ${\cal H}$, we denote the set
of density operators on $G$ by

$\mathcal{S}(G):=\\{\rho\in\mathcal{L}(G):\rho\text{ is Hermitian, }\rho\geq
0_{{\cal H}}\text{ , }\mathrm{tr}(\rho)=1\\}\text{ ,}$

where $\mathcal{L}({\cal H})$ is the set of linear operators on ${\cal H}$,
and $0_{{\cal H}}$ is the null matrix on ${\cal H}$. Note that any operator in
$\mathcal{S}({\cal H})$ is bounded.

Throughout the paper the logarithm base is $2$.

Let $H$ be a finite-dimensional complex Hilbert space. A classical-quantum
channel is a map $W:\mathcal{X}\rightarrow\mathcal{S}({\cal H})$,
$x\rightarrow W(x)$.

######  Definition 2.1.

Let $\mathcal{X}$ be a finite set. Let $H$ and $H^{\prime}$ be finite-
dimensional complex Hilbert spaces. Let $W$ be a classical-quantum channel
$\mathcal{X}\rightarrow\mathcal{S}(H)$ and ${V}$ be a classical-quantum
channel $\mathcal{X}\rightarrow\mathcal{S}(H^{\prime})$. We call the
classical-quantum channel pair $(W,{V})$ a classical-quantum wiretap channel.
The legitimate receiver accesses the output of the first channel $W$, and the
eavesdropper observes the output of the second channel ${V}$ in the pair,
respectively.

For a quantum state $\rho\in\mathcal{S}({\cal H})$ we denote the von Neumann
entropy of $\rho$ by $S(\rho)=-\mathrm{tr}(\rho\log\rho)$. Let
$\Phi:=\\{\rho_{x}:x\in\mathcal{X}\\}$ be a set of quantum states labeled by
elements of $\mathcal{X}$. For a probability distribution $Q$ on
$\mathcal{X}$, the Holevo $\chi$ quantity, or Holevo information, is defined
as

$\chi(Q;\Phi):=S\left(\sum_{x\in\mathcal{X}}Q(x)\rho_{x}\right)-\sum_{x\in\mathcal{X}}Q(x)S\left(\rho_{x}\right)\text{
.}$

Let $\rho$ and $\sigma$ be two positive semi-definite operators. The quantum
relative entropy between $\rho$ and $\sigma$ is defined as follows:

$D(\rho\parallel\sigma):=\mathrm{tr}\rho\left(\log\rho-\log\sigma\right)$

if $supp(\rho)\subset supp(\sigma)$, and $=\infty$ otherwise.

The Rényi $2$-relative entropy between $\rho$ and $\sigma$ is defined as

$D_{2}(\rho\parallel\sigma):=\log\mathrm{tr}\left(\rho^{2}\sigma^{-1}\right)$

if $supp(\rho)\subset supp(\sigma)$, and $=\infty$ otherwise.

It is well-known that for any density operators $\rho$ and $\sigma$, it holds
(cf. [21])

$D_{\alpha}(\rho\parallel\sigma)\leq
D_{\alpha^{\prime}}(\rho\parallel\sigma)\text{ .}$ (1)

Furthermore it holds

$\lim_{\alpha\nearrow 1}D_{\alpha}(\rho\parallel\sigma)=\lim_{\alpha\searrow
1}D_{\alpha}(\rho\parallel\sigma)=D(\rho\parallel\sigma)\text{ .}$ (2)

######  Definition 2.2.

Let $\mathcal{A}_{n}=\left\\{1,\cdots,J_{n}\right\\}$. An $(n,J_{n})$ code
$\mathcal{C}$ for $(W,{V})$ consists of a stochastic encoder $E$ :
$\mathcal{A}_{n}\rightarrow P({\mathcal{X}}^{n})$, ${\alpha}\rightarrow
E(\cdot|{\alpha})$, specified by a matrix of conditional probabilities
$E(\cdot|\cdot)$, and a positive operator-valued measure (POVM)
$\left\\{G_{\alpha}:\alpha\in\mathcal{A}_{n}\right\\}$ on ${H}^{\otimes n}$
which we call the decoder operators.

The average probability of the decoding error of a code $\mathcal{C}$ is
defined as

$P_{e}(\mathcal{C},n):=1-\frac{1}{J_{n}}\sum_{\alpha\in\mathcal{A}_{n}}E(x^{n}|{\alpha})\mathrm{tr}(W^{\otimes
n}(x^{n})G_{\alpha})\text{ .}$

The maximal probability of the decoding error of a code $\mathcal{C}$ is
defined as

$P_{e}^{m}(\mathcal{C},n):=1-\max_{\alpha\in\mathcal{A}_{n}}E(x^{n}|\alpha)\mathrm{tr}(W^{\otimes
n}(x^{n})G_{\alpha})\text{ .}$

For any random variable $A$ on the messages set $\mathcal{A}_{n}$ , the
leakage of $\mathcal{C}$ with respect to $A$ is defined as $\chi(A;Z)$, here
$Z$ $=\\{Z(\alpha):\alpha\in\mathcal{A}_{n}\\}$ are the resulting quantum
states at the output of wiretap channels $V$.

A code is created by the sender and the legal receiver before the message
transmission starts. The sender uses the encoder to encode the message that he
wants to send, while the legal receiver uses the decoder operators on the
channel output to decode the message.

######  Definition 2.3.

A non-negative number $R$ is an achievable semantic secrecy rate for the
classical-quantum wiretap channel $(W,{V})$ under the average (or the maximum)
error criteria if for every $\epsilon>0$, $\delta>0$, $\zeta>0$ and
sufficiently large $n$ there exists an $(n,J_{n})$ code
$\mathcal{C}=(E,\\{G_{\alpha}:\alpha\in\mathcal{A}_{n}\\})$ such that
$\frac{\log J_{n}}{n}>R-\delta$, and every variable $Q$ with arbitrary
distribution on $\mathcal{A}_{n}$ such that

$P_{e}(\mathcal{C},n)<\epsilon\text{ .,}$ $\text{ (or,
}P_{e}^{m}(\mathcal{C},n)<\epsilon\text{ ,)}$

and

$\chi\left(Q;Z^{n}\right)<\zeta\text{ ,}$

respectively.

The supremum over all achievable semantic secrecy rates under the average and
maximum error criteria of $(W,{V})$ is called the semantic secrecy capacity of
$(W,{V})$, denoted by $C_{sem}((W,{V}))$ and $C_{sem}^{m}((W,{V}))$ ,
respectively.

###  2.2 Mosaics of combinatorial designs

We define the mosaics of combinatorial designs in the same way as in [27]. For
the sake of completeness, the definitions in [27] are stated below.

Let $\mathcal{X}$ and $\mathcal{S}$ be finite sets. An incidence structure
$D=(\mathcal{X},\mathcal{S},I)$ on $(\mathcal{X},\mathcal{S})$ is determined
by the incidence relation $I$ on $\mathcal{X}\times\mathcal{S}$. An incidence
structure $(\mathcal{X},\mathcal{S},I)$ is called empty if $I=\emptyset$. If
$xIs$, then $x$ and $s$ are called incident. The incidence matrix of an
incidence structure $D=(\mathcal{X},\mathcal{S},I)$ is the $01$-matrix $N$
with rows indexed by $\mathcal{X}$ and columns indexed by $\mathcal{S}$ such
that $N_{x,s}=1$ if and only if $x$ and $s$ are incident in $D$.

A mosaic of incidence structures on $(\mathcal{X},\mathcal{S})$ is a family
$M=\\{D_{\alpha}:\alpha\in\mathcal{A}\\}$ of nonempty incidence structures on
$(\mathcal{X},\mathcal{S})$ such that for every pair $(x,s)$ there exists a
unique incidence structure $D_{\alpha}$ in which $x$ and $s$ are incident. We
call $\mathcal{A}$ the color set of $M$. Every $D_{\alpha}$ is called a member
of $M$. If $N_{\alpha}$ is the incidence matrix of $D_{\alpha}$, then
$\sum_{\alpha}D_{\alpha}=J$, here $J$ is the all-ones matrix of appropriate
dimensions.

Any function $f:\mathcal{X}\times\mathcal{S}\rightarrow\mathcal{A}$ induces a
mosaic $\\{D_{\alpha}:\alpha\in\mathcal{A}\\}$ of incidence structures, where
$x$ and $s$ are incident in $D_{\alpha}$ if and only if $f(x,s)=\alpha$. We
say that $f$ is the functional form of this mosaic. Clearly, every mosaic
$\\{D_{\alpha}:\alpha\in\mathcal{A}\\}$ on $(\mathcal{X},\mathcal{S})$ has a
functional form $f:\mathcal{X}\times\mathcal{S}\rightarrow A$.

We consider the case where every $D_{\alpha}$ is a combinatorial design. In
the context of designs, we will call $\mathcal{X}$ the point set and
$\mathcal{S}$ the block index set. We set $v=|\mathcal{X}|$. A $(v,k,r)$
tactical configuration on $(\mathcal{X},\mathcal{S})$ is an incidence
structure where every point $x$ is incident with precisely $r$ block indices
and every block index $s$ is incident with precisely $k$ points. It holds that

$|\mathcal{S}|k=vr\text{ .}$ (3)

A $(v,k,\lambda)$ balanced incomplete block design (BIBD) is an incidence
structure on $(\mathcal{X},\mathcal{S})$ such that every $s\in\mathcal{S}$ is
incident with precisely $k$ points from $\mathcal{X}$, and such that any two
distinct points from $\mathcal{X}$ are incident with precisely $\lambda$
common block indices. Every $(v,k,\lambda)$ BIBD is a $(v,k,r)$ tactical
configuration, where

$r(k-1)=\lambda(v-1)\text{ .}$

The key equality when we want to establish security using a security function
which is the functional form of a mosaic of BIBDs is that the incidence matrix
$N$ of a $(v,k,\lambda)$ BIBD satisfies

$NN^{*}=(r-\lambda)id+\lambda J\text{ ,}$ (4)

here $id$ is the identity matrix of appropriate dimensions.

A $(u,m,k,\lambda_{1},\lambda_{2})$ group divisible design (GDD) is based on a
partition of $\mathcal{X}$ into $m$ point classes of size $u$ each, so $v=um$.
Every block index is incident with precisely $k$ points, and two points are
incident with $\lambda_{1}$ common block indices if they are contained in the
same point class and with $\lambda_{2}$ block indices otherwise. A
$(u,m,k,\lambda_{1},\lambda_{2})$ GDD is a $(v,k,r)$ tactical configuration
for $r$ satisfying

$r(k-1)=\lambda_{1}(u-1)+\lambda_{2}(m-1)u\text{ .}$

Let $C$ be the $01$-matrix with rows and columns indexed by $\mathcal{X}$
which has a $1$ in the $(x,x^{\prime})$ entry if and only if $x$, and
$x^{\prime}$ are contained in the same point class. With a suitable ordering
of the elements of $\mathcal{X}$, this is a block diagonal matrix with $m$
all-ones matrices of size $u$ each on the diagonal. Then

$NN^{*}=(r-\lambda_{1})id+(\lambda_{1}-\lambda_{2})C+\lambda_{2}J\text{ .}$
(5)

###  2.3 Modular Codes

######  Definition 2.4.

Let $S$ be a uniformly distributed random variable on $\mathcal{S}$. A common
randomness code is a set of $|\mathcal{S}|$ codes
$\left\\{\mathcal{C}^{s}=\bigl{(}E^{s},\left\\{G_{\alpha}^{s},:\alpha\in\mathcal{A}_{n}\right\\}\bigr{)}:s\in\mathcal{S}\right\\}$,
labeled by $s$, the common randomness.

######  Definition 2.5.

A non-negative number $R$ is an achievable secrecy rate for the classical-
quantum wiretap channel $(W,{V})$ under common randomness quantum coding if
for every $\delta>0$, $\zeta>0$, and $\epsilon>0$, if $n$ is sufficiently
large, there is an $(n,J_{n})$ common randomness code
$(\\{\mathcal{C}^{s}:s\in\mathcal{S}\\})$ such that $\frac{\log
J_{n}}{n}>R-\delta$, and

$\frac{1}{\left|\mathcal{S}\right|}\sum_{s\in\mathcal{S}}P_{e}(\mathcal{C}^{s},n)<\epsilon~{}~{}~{}(\text{
or
}\frac{1}{\left|\mathcal{S}\right|}\sum_{s\in\mathcal{S}}P_{e}^{m}(\mathcal{C}^{s},n)\text{
, respectively,})$
$\max_{A}\frac{1}{\left|\mathcal{S}\right|}\sum_{s\in\mathcal{S}}\chi\left(A,Z_{\mathcal{C}^{s}}\right)<\epsilon\text{
.}$

This means that we do not require the common randomness to be secure against
eavesdropping.

We define a modular code as follows.

######  Definition 2.6.

Let $\bigl{(}E,\left\\{G_{x}:x\in\mathcal{X}_{n}\right\\}\bigr{)}$ be a
$(n,|\mathcal{X}_{n}|)$ code. Let $f$ be a function
$\mathcal{S}\times\mathcal{X}_{n}\to\mathcal{A}_{n}$. We define the modular
code
$\left\\{\mathcal{C}^{s}=\bigl{(}E^{s},\left\\{G_{\alpha}^{s},:\alpha\right\\}\bigr{)}:s\right\\}$
to be the common randomness code such that for every $s$ and $\alpha$ we have:
$\bullet$ $E^{s}(x^{n}|\alpha)$ is the uniform distribution over
$\\{x:f(s,x)=\alpha\\}$
$\bullet$ $G_{\alpha}^{s}$ $=\sum_{f(s,x)=\alpha}G_{x}$.
We call $f$ the security function.

##  3 Main Results

Assume a reliable $(n,|\mathcal{M}_{n}|)$ transmission code
$\mathcal{C}_{public}$ with input alphabet ${\mathcal{X}}$ is given. The
security function for the modular code is an onto
$f:\mathcal{S}\times\mathcal{X}\to\mathcal{A}$ fictional form of mosaic of
combinatorial design. Here ${\mathcal{A}}$ is the set of our confidential
messages.

As mentioned above, there is a separation of the security task and the
reliability task: Since the intended receiver knows the seed, he can recover
the message with error $P_{e}(\mathcal{C}_{public},n)$. The reliability task
depends here only on $\mathcal{C}_{public}$, but not on $f$. The security
task, on the other side, only depends on $f$. We may analyze the secrecy task
independent of $\mathcal{C}_{public}$. Thus, we consider the security for the
message transmission “$\alpha$ $\rightarrow V\circ E\circ f^{-1}(\alpha)$”
(cf. Figure 1) for any encoder $E$ instead of considering only the
eavesdropper’s channel $V$, i.e., we assume that the encoder $E$ of the given
transmission code becoming part of eavesdropper’s channel. By this way, we can
consider the security under the assumption that the legal receiver is already
able to decode the massage. By Definition 2.6, for any modular code, the
sender has to choose a $x$ satisfying $\\{x:f(s,x)=\alpha\\}$. Thus, when $s$
is the outcome of $S$, for every encoder $E$, the resulting quantum states at
the output of eavesdropper’s message transmission “$V\circ E\circ f^{-1}$” are
$\\{Z_{s}(\alpha):\alpha\in\mathcal{A}\\}$, where
$Z_{s}(\alpha):=\frac{1}{k}\sum_{x:f(s,x)=\alpha}V(x)$. We will show in
Section 3.1 that using security function of mosaic of combinatorial design
ensures semantic security, by delivering a security bound in terms of the
Holevo quantity to the eavesdropper’s resulting states at the outcome of $V$
in Theorem 3.2.

It is clear that the semantic secrecy rate is not the same as the rate of
$\mathcal{C}_{public}$. We will consider the secrecy rate in Section 3.2.

###  3.1 Semantic Security by Mosaics of Designs

######  Definition 3.1.

Let $V:$ $\mathcal{X}\rightarrow\mathcal{S}(H)$ be a classical-quantum
channel. We denote

$\sigma_{\mathcal{X}}:=\frac{1}{v}\sum_{x\in\mathcal{X}}V(x)\text{ .}$

Let $f:\mathcal{S}\times\mathcal{X}\rightarrow\mathcal{A}$ be the functional
form of a mosaic of a $(u,m,k,\lambda_{1},\lambda_{2})$ GDD. Let $v$ and $r$
be defined as in Section 2.2. We denote

$\displaystyle C(V,u,m,k,v,r,\lambda_{1},\lambda_{2})\allowdisplaybreaks$
$\displaystyle:=\frac{r-\lambda_{1}}{kr}\sum_{x}\exp\left(D_{2}\left(V(x)\parallel\sigma_{\mathcal{X}}\right)\right)\allowdisplaybreaks$
$\displaystyle~{}+\frac{u(\lambda_{1}-\lambda_{2})}{kr}\frac{1}{m}\sum_{i}\exp\left(D_{2}\left(\frac{1}{u}\sum_{x\in\mathcal{X}_{i}}V(x){\displaystyle\parallel}\sigma_{\mathcal{X}}\right)\right)\allowdisplaybreaks$
$\displaystyle~{}+\frac{v\lambda_{2}}{kr}\text{ .}$

Assume that the confidential messages to be transmitted are represented by the
random variable $A$ on $\mathcal{A}$. The random seed is represented by $S$,
uniformly distributed on $\mathcal{S}$ and independent of $A$. Assume the
output of $S$ is $s$, and the message $\alpha$ has to be send.

We formulate our security bound for privacy amplification in terms of the
Holevo quantity. According to [18] and [24], the eavesdropper can never obtain
more information asymptotically than the Holevo $\chi$ quantity, no matter
which strategy the eavesdropper uses.

######  Theorem 3.2.

Let $V:$ $\mathcal{X}\rightarrow\mathcal{S}(H)$ be a classical-quantum
channel.

Let $f:\mathcal{S}\times\mathcal{X}\rightarrow\mathcal{A}$ be the functional
form of a mosaic of a $(u,m,k,\lambda_{1},\lambda_{2})$ GDD. We have

$\displaystyle\max_{A\in
P(\mathcal{A})}\exp\left(\frac{1}{|\mathcal{S}|}\sum_{s}\chi(A;Z_{s})\right)\leq
C(V,u,m,k,v,r,\lambda_{1},\lambda_{2})\text{ .}$ (6)

Here $Z_{s}$ $=\\{Z_{s}(\alpha):\alpha\in\mathcal{A}\\}$.

###### Proof.

Since the exponential function is convex, we have

$\exp\left(\frac{1}{|\mathcal{S}|}\sum_{s}\chi(A;Z_{s})\right)\leq\frac{1}{|\mathcal{S}|}\sum_{s}\exp\left(\chi(A;Z_{s})\right)\text{
.}$

We fix one $s$. Let $V_{s}^{\prime}$ be the channel
$\mathcal{A}\rightarrow\mathcal{S}(H^{\prime})$ defined by $\alpha\rightarrow
Z_{s}(\alpha)$. By the quantum information radius (cf. [20]), we have for
fixed $s$:

$\displaystyle\max_{A\in P(\mathcal{A})}\chi(A;Z_{s})\allowdisplaybreaks$
$\displaystyle=\max_{A\in
P(\mathcal{A})}\chi\left(A;\\{V_{s}^{\prime}(\alpha):\alpha\in\mathcal{A}\\}\right)\allowdisplaybreaks$
$\displaystyle=\min_{\sigma}\max_{\alpha\in\mathcal{A}}D\left(V_{s}^{\prime}(\alpha)\parallel\sigma\right)\allowdisplaybreaks$
$\displaystyle\leq\max_{\alpha\in\mathcal{A}}D\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\text{
.}$

By (1) and (2), it holds

$D\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\leq
D_{2}\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\text{
.}$

Therefore, we have

$\max_{A\in
P(\mathcal{A})}\exp\left(\frac{1}{|\mathcal{S}|}\sum_{s}\chi(A;Z_{s})\right)\leq\frac{1}{|\mathcal{S}|}\max_{\alpha\in
A}\sum_{s}\exp\left(D_{2}\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\right)\text{
.}$ (7)

Let $\\{|v_{i}\rangle:i=1,\cdots,d\\}$ be an arbitrary orthonormal basis on
$H$. Let $\langle v_{j}|V(x)|v_{i}\rangle$ $:=a_{j,i}(x)$. We denote

$\rho_{\mathcal{X}}:=\left(\begin{array}[]{r}\bigl{(}a_{j,i}(x_{1})\bigr{)}_{j,i=1,\cdots,d}\\\
\bigl{(}a_{j,i}(x_{2})\bigr{)}_{j,i=1,\cdots,d}\\\ \cdots\\\
\bigl{(}a_{j,i}(x_{|\mathcal{X}|})\bigr{)}_{j,i=1,\cdots,d}\end{array}\right)^{*}\text{
,}$

to be the $d|\mathcal{X}|\times d$-matrix such that
${\rho_{\mathcal{X}}}_{i,k}$ $=a_{j,i}(x)$ if $k=(x-1)d+j$. Let $N$ be the
incidence matrix of a $(u,m,k,\lambda_{1},\lambda_{2})$ GDD. Notice that for
every $\alpha$:

$\displaystyle\bigl{(}\rho_{\mathcal{X}}(id_{H}\otimes
N_{\alpha})\bigr{)}\bigl{(}\rho_{\mathcal{X}}(id_{H}\otimes
N_{\alpha})\bigr{)}^{*}\allowdisplaybreaks$
$\displaystyle=\sum_{s}\sum_{x:f(s,x)=\alpha}V(x)^{2}\allowdisplaybreaks$
$\displaystyle=k^{2}\sum_{s}Z_{s}(\alpha)^{2}\text{ .}$ (8)

Now we have

$\displaystyle\frac{1}{|\mathcal{S}|}\sum_{s}\exp\left(D_{2}\left(Z_{s}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\right)\allowdisplaybreaks$
$\displaystyle=\frac{1}{|\mathcal{S}|}\sum_{s}\mathrm{tr}\bigl{(}Z_{s}(\alpha)^{2}\sigma_{\mathcal{X}}^{-1}\bigr{)}\allowdisplaybreaks$
$\displaystyle=\frac{1}{k^{2}|\mathcal{S}|}\mathrm{tr}\bigl{(}\rho_{\mathcal{X}}(id_{H}\otimes
N)(id_{H}\otimes
N)^{*}\rho_{\mathcal{X}}^{*}\sigma_{\mathcal{X}}^{-1}\bigr{)}\allowdisplaybreaks$
$\displaystyle=\frac{1}{krv}\mathrm{tr}\bigl{(}\rho_{\mathcal{X}}(id_{H}\otimes
N)(id_{H}\otimes
N)^{*}\rho_{\mathcal{X}}^{*}\sigma_{\mathcal{X}}^{-1}\bigr{)}\allowdisplaybreaks$
$\displaystyle=\frac{r-\lambda_{1}}{krv}\mathrm{tr}\biggl{(}\rho_{\mathcal{X}}(id_{H}\otimes
id_{\mathbb{C}^{|\mathcal{X}|}})\rho_{\mathcal{X}}^{*}\sigma_{\mathcal{X}}^{-1}\biggr{)}\allowdisplaybreaks$
$\displaystyle~{}+\frac{\lambda_{1}-\lambda_{2}}{krv}\mathrm{tr}\biggl{(}\rho_{\mathcal{X}}(id_{H}\otimes
C)\rho_{\mathcal{X}}^{*}\sigma_{\mathcal{X}}^{-1}\biggr{)}\allowdisplaybreaks$
$\displaystyle~{}+\frac{\lambda_{2}}{krv}\mathrm{tr}\biggl{(}\rho_{\mathcal{X}}(id_{H}\otimes
J)\rho_{\mathcal{X}}^{*}\sigma_{\mathcal{X}}^{-1}\biggr{)}\allowdisplaybreaks$
$\displaystyle=\frac{r-\lambda_{1}}{krv}\sum_{x\in\mathcal{X}}\mathrm{tr}\biggl{(}V(x)^{2}(\sigma_{\mathcal{X}})^{-1}\biggr{)}\allowdisplaybreaks$
$\displaystyle~{}+u\frac{\lambda_{1}-\lambda_{2}}{krv}\frac{1}{m}\sum_{i}\mathrm{tr}\biggl{(}(\frac{1}{u}\sum_{x\in\mathcal{X}_{i}}V(x))^{2}\sigma_{\mathcal{X}}^{-1}\biggr{)}\allowdisplaybreaks$
$\displaystyle~{}+\frac{\lambda_{2}}{krv}v^{2}\sum_{x}\mathrm{tr}\sigma_{\mathcal{X}}\allowdisplaybreaks$
$\displaystyle=\frac{r-\lambda_{1}}{krv}\sum_{x}\exp\left(D_{2}\left(V(x)\parallel\sigma_{\mathcal{X}}\right)\right)\allowdisplaybreaks$
$\displaystyle~{}+u\frac{\lambda_{1}-\lambda_{2}}{krv}\frac{1}{m}\sum_{i}\exp\left(D_{2}\left(\frac{1}{u}\sum_{x\in\mathcal{X}_{i}}V(x){\textstyle\parallel}\sigma_{\mathcal{X}}\right)\right)\allowdisplaybreaks$
$\displaystyle~{}+\frac{\lambda_{2}}{kr}v\text{ .}$ (9)

The first equation is the definition of $D_{2}$. The second equation holds
because of (8). The third equation holds because of (3). The fourth equation
holds because of (5). The fifth equation holds because, by the definitions of
$\rho_{\mathcal{X}}$, $C$, and $J$, we have
$\rho_{\mathcal{X}}\rho_{\mathcal{X}}^{*}$ $=$
$\sum_{x\in\mathcal{X}}V(x)^{2}$, $\rho_{\mathcal{X}}(id_{H}\otimes
C)\rho_{\mathcal{X}}^{*}$ $=$
$\frac{u}{m}\sum_{i}\mathrm{tr}\Bigl{(}(\frac{1}{u}\sum_{x\in\mathcal{X}_{i}}V(x))^{2}\Bigr{)}$
and $\rho_{\mathcal{X}}(id_{H}\otimes J)\rho_{\mathcal{X}}^{*}$ $=$
$v^{2}\sigma_{\mathcal{X}}^{2}$. The sixth equation is again the definition of
$D_{2}$.

(6) follows from (7) and (9).

######  Remark 3.3.

Theorem 3.2 shows how many confidential messages are maximal possible when a
degree of security is required and shows how this can be achieved using the
functional form of a mosaic of GDDs and BIBDs.

Since a GDD with $\lambda_{1}=\lambda_{2}$ is a BIBD, the following corollary
is a consequence of Corollary 3.2:

######  Corollary 3.4.

Let $f:\mathcal{S}\otimes\mathcal{X}\rightarrow A$ be the functional form of a
mosaic of a $(v,k,\lambda)$ BIBD.

We have

$\displaystyle\max_{P\in
P(A)}\exp\left(\frac{1}{|\mathcal{S}|}\sum_{s}\chi(P;Z_{s})\right)\allowdisplaybreaks$
$\displaystyle\leq\left(1-\frac{r-\lambda}{kr}\right)+\frac{r-\lambda}{kr}\frac{1}{v}\sum_{x}\exp\left(D_{2}\left(V(x)\parallel\sigma_{\mathcal{X}}\right)\right)\text{
.}$ (10)

We denote the quantum states at the output of $V$ by $\eta^{Z}$ We can
describe classical-quantum hybrid system $ASZ$ by an ensemble $\eta^{ASZ}$
when we embody the classical $A$ and $S$ into a $\lvert\mathcal{A}\rvert$
dimensional Hilbert space $H_{\mathcal{A}}$. with orthonormal basis
$\\{|\alpha\rangle:\alpha\in\mathcal{A}\\}$ and a $\lvert\mathcal{S}\rvert$
dimensional space $H_{\mathcal{S}}$ with orthonormal basis
$\\{|s\rangle:s\in\mathcal{S}\\}$, respectively. The quantum state of the
system $ASZ$ is

$\eta^{ASZ}:=\frac{1}{|\mathcal{A}|}\frac{1}{|\mathcal{S}|}\sum_{\alpha\in\mathcal{A}}\sum_{s\in\mathcal{S}}|\alpha\rangle\langle\alpha|\otimes|s\rangle\langle
s|\otimes Z_{s}(\alpha)\text{ .}$

By Theorem 3.2, we can bound
$\left\|\eta^{ASZ}-\eta^{AS}\otimes\eta^{Z}\right\|_{1}$ for all possible
message distributions by the following corollary:

######  Corollary 3.5.

Let $f:\mathcal{S}\otimes\mathcal{X}\rightarrow\mathcal{A}$ be the functional
form of a mosaic of a $(u,m,k,\lambda_{1},\lambda_{2})$ GDD. By Theorem 3.2 we
have

$\displaystyle\left\|\eta^{ASZ}-\eta^{AS}\otimes\eta^{Z}\right\|_{1}\allowdisplaybreaks$
$\displaystyle\leq\sqrt{2\ln 2\log
C(V,u,m,k,v,r,\lambda_{1},\lambda_{2})}\text{ .}$ (11)

###### Proof.

We have

$\displaystyle\eta^{Z}\allowdisplaybreaks$
$\displaystyle=\mathrm{tr}_{AS}(\eta^{ASZ})\allowdisplaybreaks$
$\displaystyle=\frac{1}{|\mathcal{A}|}\frac{1}{|\mathcal{S}|}\sum_{\alpha\in\mathcal{A}}\sum_{s\in\mathcal{S}}Z_{s}(\alpha)\allowdisplaybreaks$
$\displaystyle=\sigma_{\mathcal{X}}\text{ .}$

By the triangle inequality, it holds

$\displaystyle\left\|\eta^{ASZ}-\eta^{AS}\otimes\eta^{Z}\right\|_{1}\allowdisplaybreaks$
$\displaystyle=\left\|\frac{1}{|\mathcal{A}|}\frac{1}{|\mathcal{S}|}\sum_{\alpha\in\mathcal{A}}\sum_{s\in\mathcal{S}}Z_{s}(\alpha)-\sigma_{\mathcal{X}}\right\|_{1}\allowdisplaybreaks$
$\displaystyle\leq\frac{1}{|\mathcal{A}|}\frac{1}{|\mathcal{S}|}\sum_{\alpha\in\mathcal{A}}\sum_{s\in\mathcal{S}}\left\|Z_{s}(\alpha)-\sigma_{\mathcal{X}}\right\|_{1}\allowdisplaybreaks$
$\displaystyle\leq\max_{\alpha\in\mathcal{A}}\frac{1}{|\mathcal{S}|}\sum_{s\in\mathcal{S}}\left\|Z_{s}(\alpha)-\sigma_{\mathcal{X}}\right\|_{1}\text{
.}$

Since for nonnegative $\\{a_{1},\cdots,a_{N}\\}$ we have
$(\frac{1}{N}\sum_{i=1}^{N}a_{i})^{2}\leq\frac{1}{N}\sum_{i=1}^{N}a_{i}^{2}$,
it holds

$\left\|\eta^{ASZ}-\eta^{AS}\otimes\eta^{Z}\right\|_{1}^{2}\leq\max_{\alpha}\frac{1}{|\mathcal{S}|}\sum_{s\in\mathcal{S}}\left\|Z_{s}(\alpha)-\sigma_{\mathcal{X}}\right\|_{1}^{2}\text{
.}$

By the Quantum Pinsker inequality (cf. [16]) we have

$\|Z_{s}(\alpha)-\sigma_{\mathcal{X}}\|_{1}^{2}\leq 2\ln
2D\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\text{ .}$

Since the exponential function is convex, we have

$\displaystyle\exp\Bigl{(}\frac{1}{2\ln
2}\left\|\eta^{ASZ}-\eta^{S}\otimes\eta^{Z}\right\|_{1}^{2}\Bigr{)}\allowdisplaybreaks$
$\displaystyle\leq\max_{\alpha}\exp\left(\frac{1}{|\mathcal{S}|}\sum_{s\in\mathcal{S}}D\bigl{(}V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\bigr{)}\right)\allowdisplaybreaks$
$\displaystyle\leq\max_{\alpha}\frac{1}{|\mathcal{S}|}\sum_{s\in\mathcal{S}}\exp\left(D\left(V_{s}^{\prime}(\alpha)\parallel\sigma_{\mathcal{X}}\right)\right)\text{
.}$

Corollary 3.2 follows from (9).

This means that we can archive that the eavesdropper’s observations are nearly
independent of the message.

Theorem 3.2 shows how much randomness is sufficient in the randomized inverse
to obtain a given level of semantic security. We apply the derandomization
technique to construct a semantic-security code without common randomness
using a transmission code and a common-randomness semantic-security code with
appropriate error scaling.

###  3.2 Secrecy Rate

Suppose we have a $(n,J_{n})$ public code with small decoding error. In order
to achieve semantic security in the presence of an eavesdropper’s channel $V$,
the functional form $f:\mathcal{X}\times\mathcal{S}\to\mathcal{A}$ of a mosaic
of $(J_{n},k,\lambda)$ BIBDs is applied as the security function. By Theorem
3.2, the information leakage
$\max_{A}\frac{1}{|\mathcal{S}|}\sum_{s}\chi(A;Z_{s})$, using $\log(1+t)\leq
t$, can be upper-bounded by
$\frac{r-\lambda}{kr}\sum_{x}\exp(D_{2}(V(x)\|\sigma_{\mathcal{X}}))$.

In order for this to be small, $k$ should be sufficiently larger than
$\sum_{x}\exp(D_{2}(V(x)\|\sigma_{\mathcal{X}}))$. For given positive
$\epsilon_{leak}$ for a small positive $\lambda$ when $n$ is sufficiently
large then for

$k=\sum_{x^{n}}\exp(D_{2}(V^{n}(x^{n})\|\sigma_{\mathcal{X}}^{n}))+\lambda$

the information leak is bounded by $\epsilon_{leak}$. This means that the
number of messages per $n$ channel uses in a semantically secure way reduces
from $J_{n}$ to $\frac{J_{n}}{k}$. In information theory, it is more common to
talk about rates by taking the logarithm of the number of messages. Then the
rate reduces from $\frac{\log J_{n}}{n}$ to

$\displaystyle\frac{\log|{\mathcal{A}}_{n}|}{n}$
$\displaystyle=\frac{\log\frac{J_{n}}{k}}{n}$
$\displaystyle=\frac{\log\frac{J_{n}}{k}-\sum_{x}\exp(D_{2}(V(x)\|\sigma_{\mathcal{X}}))-\lambda}{n}\text{=}{.}$

The rate loss $R_{f}=\frac{\log J_{n}-\log|{\mathcal{A}}_{n}|}{n}$ can be
regarded as the rate of the security function. The rate of the functional form
of a mosaic of GDDs is defined in the same way, but the relation to security
is more complicated since it depends on the type of the underlying GDDs (see
[27] for a detailed discussion). By [18], [23], and [24], there exist reliable
public code with rate $J_{n}=\max_{A}\chi(A,W(A))$. Thus, with ous approach,
we can archive the semantic secrecy rate

$\max_{A}\chi(A,W(A))-D_{2}(V(A)\|\sigma_{\mathcal{X}})\text{ .}$

For our modular code, we need common randomness as an additional resource. As
[7] showed, the common randomness is a very “costly” resource. Thus, our next
step is a process known as derandomization, when the sender generates the
seeds and send it to the receiver with the public code. The standard
derandomization works as follows: Every code word $\mathcal{C}^{det}$ $=$
$(E^{\mu(|S|)+n},\\{G_{\alpha}^{\mu(|S|)+n}:\alpha\\})$ is a composition of
words of a public code $(E^{\mu(n)},\\{G_{s}^{\mu(|S|)}:s\\})$, and words of a
semantic-secure modular code
$\\{(E^{n}_{s},\\{G_{s,\alpha}^{n}:\alpha\\}):s\\}$. Here $\mu(|S|)$ is the
length of the first code words. The sender chooses a $s$ uniformly at random
from $\mathcal{S}$ and uses the public code
$(E^{\mu(|S|)},\\{G_{s}^{\mu(|S|)}:s\\})$ to send it to the receiver as a pre-
code (recall $s$ do not have to be secure). Thus we have a code with encoder
$E^{\mu(|S|)+n}((x^{\mu(|S|)}x^{n})|\alpha)$
$=\frac{1}{|S|}\sum_{s}E^{\mu(|S|)}(x^{\mu(|S|)}|s)E^{n}_{s}(x^{n}|\alpha)$
and decoder operators $G^{\mu(n)+n}_{s,\alpha}$
$=\sum_{s}G_{s}^{\mu(|S|)}\otimes G_{s,\alpha}^{n}$, which consists of
alternate public code words and semantic-secure modular code words, where we
use the public code to generate the seed, and use it only once in the
semantic-secure modular code. However, when the size of the seed set is too
large, then $\mu(|S|)$ may be also too large, and this standard
derandomization technique may cause significant rate loss. Follow the idea of
[26] and [6], we reduce the total size of channel uses by reusing one seed for
multiple semantic-secure modular code words. Instead of one two-part code word
for every single message, we build a $(N+1)$-tuple of codewords. Each tuple is
a composition of a public codeword that generates the seed and $N$ semantic
secure modular code words to transmit $N$ messages to the intended receiver.
The code $\mathcal{C}^{det}$ $=$
$(E^{\mu(|S|)+nN},\\{G_{\alpha}^{\mu(|S|)+nN}:\alpha\\})$ consists of encoder
$E^{\mu(|S|)+nN}((x^{\mu(|S|)}x^{nN})|\alpha)$
$=\frac{1}{|S|}\sum_{s}E^{\mu(|S|)}(x^{\mu(|S|)}|s)E^{n}_{s}(x^{n}|\alpha_{1})\cdots
E^{n}_{s}(x^{n}|\alpha_{N})$ and decoder operators $G^{\mu(n)+nN}_{\alpha}$
$=\sum_{s}G_{s}^{\mu(|S|)}\otimes\bigotimes_{j=1}^{N}G_{s,\alpha_{j}}^{n}$.
The $N$ semantic secure modular code words in every tuple share one single
seed. We choose a squence $N(n)$ such that $1\ll N(n)$, $N(n)\ll
P_{e}(\mathcal{C},n)^{-1}$ (or $N(n)\ll P_{e}^{m}(\mathcal{C},n)^{-1}$), and
$N(n)\ll\epsilon_{leak}^{-1}$ With this approach, the semantic secrecy rate
above can be achieved.

##  4 Further Remark

Several efficiently computable examples of mosaics of BIBDs and of GDDs are
given in [27]. Efficient computability of a mosaic here means that the
functional form as well as the random choice of an $x\in\mathcal{X}$ given a
seed $s$ and a message $\alpha$ can be computed in polynomial time. All these
examples are constructed in such a way that the seed set $\mathcal{S}$ should
be as small as possible compared with $\mathcal{X}$ for the given rate
$R_{f}$. It turns out that $\log|\mathcal{S}|\geq 2R_{f}\log|\mathcal{X}|$
roughly for $R_{f}\geq\frac{1}{2}$ and that this lower bound is tight, both
for mosaics of BIBDs and of GDDs. If $R_{f}<\frac{1}{2}$, then in mosaics of
BIBDs, the best one can hope for is that $|\mathcal{S}|$ is at least as large
as $|\mathcal{X}|$, and this can be approximated for sufficiently large
$\mathcal{X}$. For mosaics of GDDs, one can still achieve
$\log|\mathcal{S}|=2R_{f}\log|\mathcal{X}|$, but only at the price that the
rate loss in order to achieve a given security level from Theorem 3.2 is
suboptimally large except for special channels adapted to the functional form
of the mosaic. An optimal rate loss in the case of mosaics of GDDs with
$R_{f}<\frac{1}{2}$ still requires $|\mathcal{S}|\geq|\mathcal{X}|$. Details
for classical wiretap channels can again be found in [27], and via Theorem 3.2
they carry over to the classical-quantum wiretap channels treated here.

######  Example 4.1.

We would like to mention here another security function which has appeared
before in the literature for which it has been proved that it achieves the
secrecy capacity of discrete memoryless wiretap channels with semantic
security, but which has so far not been recognized as the functional form of a
mosaic of designs. This function is the example of a different concept of
security functions underlying the analysis in [17] Remark 16. It has also been
discussed in some detail in [26], Appendix C.

Set $\mathcal{X}=\mathbb{F}_{q^{t}}$ and let $\ell$ be a positive integer
smaller than $t$. As message set, take any $(t-\ell)$-dimensional subspace
$\mathcal{A}$ of $\mathbb{F}_{q}^{t}$ and also choose any $\ell$-dimensional
subspace $\mathcal{V}$ of $\mathbb{F}_{q}^{t}$ satisfying
$\dim(\mathcal{A}\cap\mathcal{V})=0$. Then set
$\mathcal{S}_{1}=\mathbb{F}_{q^{t}}^{*}$ and
$\mathcal{S}=\mathcal{S}_{1}\times\mathcal{A}$ and define
$f:\mathcal{S}\times\mathcal{X}\to\mathcal{A}$ by

$f(s,x)=\alpha\qquad\text{if }s_{1}x+s_{2}\in\alpha+\mathcal{V},$

where $s=(s_{1},s_{2})$. Given a basis of $\mathcal{V}$, the computation of
this function and its randomized inverse can be done efficiently. We claim
that $f$ is the functional form of a mosaic of BIBDs.

In order to prove this claim, we need to show that the sets

$\\{x:s_{1}x+s_{2}=\alpha+\mathcal{V}\\}=s_{1}^{-1}(\alpha-
s_{2}+\mathcal{V}).$

for each $s=(s_{1},s_{2})\in\mathcal{S}$ and every $\alpha\in\mathcal{A}$ are
the blocks of a BIBD on $\mathcal{X}$. First of all, we note that all of these
sets are of size $k=q^{\ell}$. Now choose any $x\neq
x^{\prime}\in\mathcal{X}$. Then

$\displaystyle\\{s:f(s,x)=f(s,x^{\prime})=\alpha\\}$
$\displaystyle=\\{(s_{1},s_{2}):s_{1}(x-x^{\prime})\in\mathcal{V},s_{1}x+s_{2}\in\alpha+\mathcal{V}\\}.\text{
.}$

The size of this set equals

$\lambda=\sum_{s_{1}\in(x-x^{\prime})^{-1}\mathcal{V}\setminus\\{0\\}}\lvert\mathcal{A}\cap(\alpha-
s_{1}x+\mathcal{V})\rvert=q^{\ell}-1.$

Thus the sets $\\{x:f(s,x)=\alpha\\}$ for $s\in\mathcal{S}$ form the blocks of
a BIBD on $\mathcal{X}$ with parameters

$v=q^{t},\quad b=q^{t-\ell}(q^{t}-1),\quad r=q^{t}-1,\quad
k=q^{\ell},\quad\lambda=q^{\ell}-1.$

The rate $R_{f}=\frac{t-\ell}{t}$ can be chosen flexibly. Note that
$\log|\mathcal{S}|\approx(1+R_{f})\log|\mathcal{X}|>2R_{f}\log|\mathcal{X}|$
if $R_{f}<1$, so $f$ is not optimal in terms of seed length as discussed in
[27].

## Acknowledgment

The work of H. Boche supported by the German Federal Ministry of Education and
Research (BMBF) under Grants 16KIS0858 and 16KIS0948, and by the German
Research Foundation (DFG) within the Gottfried Wilhelm Leibniz Prize under
Grant BO 1734/20-1 and within Germany’s Excellence Strategy EXC-2111 -
390814868 and EXC-2111 - 390814868. The work of M. Wiese was supported by the
German Research Foundation (DFG) within the Germany’s Excellence Strategy -
EXC 2092 CASA-390781972. The work of M. Cai was supported by the German
Research Foundation (DFG) within the Walter Benjamin-Fellowship CA 2779/1-1

## References

  * [1] R. Ahlswede, Elimination of correlation in random codes for arbitrarily varying channels, Z. Wahrscheinlichkeitstheorie verw. Gebiete, Vol. 44, 159-175, 1978.
  * [2] R. Ahlswede and V. Blinovsky, Classical capacity of classical-quantum arbitrarily varying channels, IEEE Trans. Inform. Theory, Vol. 53, No. 2, 526-533, 2007.
  * [3] M. Bellare, S. Tessaro and A. Vardy, A cryptographic treatment of the wiretap channel, arXiv:1201.2205, 2012.
  * [4] K.L. Besser, P.H. Lin, C. R. Janda, and E. A. Jorswieck, Wiretap code design by neural network autoencoders, IEEE Trans. on Inf. Forensics and Security, Vol. 15, 3374-3386, 2019.
  * [5] M. Bloch, M. Hayashi, and A. Thangaraj, Error-control coding for physical-layer secrecy, Proc. IEEE, Vol. 103, No. 10, 1725-1746, 2015.
  * [6] H. Boche, M. Cai, C. Deppe, R. Ferrara, and M. Wiese, Semantic security for quantum wiretap channels, 2020 IEEE International Symposium on Information Theory (ISIT), arXiv:2001.05719. 2020\.
  * [7] H. Boche and J. Nötzel, Arbitrarily small amounts of correlation for arbitrarily varying quantum channel, J. Math. Phys., Vol. 54, Issue 11, arXiv 1301.6063, 2013\.
  * [8] N. Cai, A. Winter, and R. W. Yeung, Quantum privacy and quantum wiretap channels, Problems of Information Transmission, Vol. 40, No. 4, 318-336, 2004.
  * [9] I. Devetak, The private classical information capacity and quantum information capacity of a quantum channel, IEEE Trans. Inf. Theory, Vol. 51, No. 1, 44-55, 2005.
  * [10] G. P. Fettweis and H. Boche, 6G: The personal tactile internet - and open questions for information theory, IEEE BITS Info. Th. Magazine, 2021.
  * [11] G. P. Fettweis and H. Boche, On 6G and trustworthiness, Communications of ACM, invited paper (to be published), 2022.
  * [12] F. Fitzek and H. Boche, 6G-life: Digital transformation and sovereignty of future communication networks, IEEE Network, Vol. 35, 3-4, Nov./Dec. Issue, 2021.
  * [13] S. Goldwasser and S. Micali, Probabilistic encryption & how to play mental poker keeping secret all partial information, STOC’82: Proceedings of the fourteenth annual ACM symposium on Theory of computing, 365-377, 1982.
  * [14] S. Goldwasser and S. Micali, Probabilistic encryption, J. Comput. System Sci., Vol. 28, No. 2, 270-299, 1984.
  * [15] M. Hayashi, Quantum wiretap channel with non-uniform random number and its exponent and equivocation rate of leaked information, IEEE Trans. Inf. Theory, Vol. 61, No. 10, 5595-5622, 2015.
  * [16] M. Hayashi, Quantum Information Theory, Springer-Verlag Berlin Heidelberg, 2017.
  * [17] M. Hayashi and R. Matsumoto, Secure multiplex coding with dependent and non-uniform multiple messages, IEEE Trans. Inf. Theory, Vol. 62, No. 5, 2355-2409, 2016.
  * [18] A. S. Holevo, The capacity of quantum channel with general signal states, IEEE Trans. Inform. Theory, Vol. 44, 269-273, 1998.
  * [19] L. Liu, Y. Yan, and C. Ling, Achieving secrecy capacity of the Gaussian wiretap channel with polar lattices, IEEE Trans. Inf. Theory, Vol. 64, No. 3, 1647-1665, 2018.
  * [20] M. Mosonyi, Coding theorems for compound problems via quantum Rényi divergences, IEEE Trans. Inf. Theory, Vol. 61. No. 6, 2997-3012, 2015.
  * [21] M. Mosonyi and N. Datta, Generalized relative entropies and the capacity of classical-quantum channels, J. Math. Phys., Vol. 50, 072104, 2009.
  * [22] J. M. Renes, F. Dupuis, and R. Renner, Efficient polar coding of quantum information, Phys. Rev. Lett., Vol. 109, 050504, 2012.
  * [23] B. Schumacher and M. A. Nielsen, Quantum data processing and error correction, Phys. Rev. A, Vol. 54, 2629, 1996.
  * [24] B. Schumacher and M. D. Westmoreland, Sending classical information via noisy quantum channels, Phys. Rev., Vol. 56, 131-138, 1997.
  * [25] A. S. Tanenbaum and D. J. Wetherall, Computer Networks, 5th ed., Prentice Hall, 2011.
  * [26] M. Wiese and H. Boche, Semantic security via seeded modular coding schemes and Ramanujan graphs, IEEE Trans. Inf. Theory, Vol. 67, Vol. 1, 52-80, 2021.
  * [27] M. Wiese and H. Boche, Mosaics of combinatorial designs for information-theoretic security, Des. Codes Cryptogr., 05 January 2022, DOI:10.1007/s10623-021-00994-1.
  * [28] A. D. Wyner, The wire-tap channel, Bell System Technical Journal, Vol. 54, No. 8, 1355-1387, 1975.