to the unitary group $U(n)$), that is the transformations corresponding to linear passive transformations in phase-space. She informs Bob of her choice of transformation (over the authenticated classical channel), and both parties apply this transformation to their respective $2n$-vectors ${\bf x}$ and ${\bf y}$.

Equivalence between the EB and PM symmetrized protocols
=======================================================

In order to study the security of the symmetrized PM protocol, one needs to show that its equivalent EB protocol corresponds to the one symmetrized through the application of random conjugate passive transformations in phase-space. It is useful to introduce three different distributions that can be used to describe the two scenarios. In order to simplify the exposition, let us first consider the analysis of a generic CVQKD protocol in the case of collective attacks, meaning that the protocol is entirely described by a single use of the quantum channel. First, the PM protocol is naturally described by a joint probability distribution $P(x_1, x_{2}, y_1, y_{2})$ where $x_1,x_2$ (resp. $y_1,y_2$) refers to Alice’s (resp. Bob’s) measurement results. The EB scenario is characterized by the bipartite state $\rho$ shared by Alice and Bob before their respective measurements. In the context of a CV protocol, it is natural to 