Quantum Data Hiding in the Presence of Noise

The MIT Faculty has made this article openly available. Please share how this access benefits you. Your story matters.

Citation Lupo, Cosmo, Mark M. Wilde, and Seth Lloyd. “Quantum Data Hiding in the Presence of Noise.” IEEE Transactions on Information Theory 62.6 (2016): 3745–3756.

As Published http://dx.doi.org/10.1109/TIT.2016.2552547

Publisher Institute of Electrical and Electronics Engineers (IEEE)

Version Author's final manuscript

Citable link http://hdl.handle.net/1721.1/107780

Terms of Use Creative Commons Attribution-Noncommercial-Share Alike

Detailed Terms http://creativecommons.org/licenses/by-nc-sa/4.0/ arXiv:1507.06038v2 [quant-ph] 7 Apr 2016 abig,Msahsts019 S eal [email protected] (email: USA 02139, Instit Massachusetts Massachusetts Cambridge, Engineering, Mechanical of partment oiin tt nvriy ao og,Lusaa70803, Te Louisiana and Rouge, Computation Baton for [email protected]). University, Center Astronomy, State and Louisiana Physics of ment nttt fTcnlg,Cmrde ascuet 02139, Massachusetts Cambridge, Technology, [email protected]). of Institute aahdn losfrteecdn fifrainsc that such information of encoding the for Arguing allows decoded. th quant hiding mechanics, be in quantum data of thus located principle uncertainty can subsequently the and from is entir laboratory it the physical sending that message same for such classical allows system, other a the classical of to classic laboratory exchange the one in the from impossible because is excha simply task separated to world, a spatially allowed Such in are messages. laboratories located in classical the are located if systems even are the laboratories, cann systems if information the decoded the the whereas be laboratory, if that physical decoded such same the system be commu- two-party classical can a of a information is encoding into the hiding information for data quantum allows Quantum that [10]. protocol [9], nication [8], on. [7], so and effect [6], locking data Bell quantum commun achieved: [5], [4], complexity [ coding been cation super-dense communication [3], already secure teleportation have quantum unconditionally grand the spirit [1], Many between this inequalities information. separations of in theories significant successes quantum identify and to classical is science xedti on ognrccanl n omr hntwo than more to and channels generic an how input to argue the receivers. and bound isomorphic) when this necessarily channels extend not unital are of spaces ca generalization output “mictodiactic”—they a channels maximal as capacity these the hidin hiding seen call to data state data (we mixed the state their maximally on mixed the on bound map that lower limitation channels a of prove strong coherent then a that We prove we rates. have we capac classical notion, encodings and hiding channel, data this state hiding broadcast the quantum Using on for any bound channel. of upper capacity regularized quantum a data-hiding establish a scenar o the practical using aim in define the information effect With we hiding systems. data encoded here quantum the assumpti the the affect under not applying studied does been noise can has quantu that hitherto as they and known hiding is but data per phenomenon and This together communication, systems measurement. their performi collective bring classical when they if it reliably and recover decode en cannot operations the receivers encrypt the local that that codes such exist data there receivers, separate to .Lodi ihteRsac aoaoyo lcrnc n t and Electronics of Laboratory Research the with is Lloyd S. .M id swt h ereIsiuefrTertclPhys Theoretical for Institute Hearne the with is Wilde M. M. .Lp swt h eerhLbrtr fEetois Mass Electronics, of Laboratory Research the with is Lupo C. nte uhntbeeapei h unu aahiding data quantum the is example notable such Another information quantum theoretical of goals primary the of One Abstract unu aahdn ntepeec fnoise of presence the in hiding data Quantum We lsia rqatmifraini broadcast is information quantum or classical —When .I I. NTRODUCTION om uo akM id,adSt Lloyd Seth and Wilde, M. Mark Lupo, Cosmo t fTechnology, of ute du). S (email: USA S (email: USA c,Depart- ics, chnology, achusetts oma form eDe- he coded be n nge ios, um 2], ity ng on or ot to m al ly i- d e e g f - tt nteiptsaeit h aial ie tt nthe in state channels mixed mixed these maximally maximally called the We the into those space. space mapping are output input us of the in to property state interest the [14], sam the primary have [13], in of advance which noise another channels of for The [18] presence also direction). (see the [17] in [16], [15], quant protocols established and locking have theory data that Shannon so, techniques quantum if developed of and recently language loss, the to and using yet performance? question noise has its of aware) presence is are the what we in as possible Is question: far hiding practical application (as pertinent of most one variety the consider no a and known, literature now the are in now years some oe on ntedt iigcpct famictodiactic be a can a of scheme this capacity establish that argue hiding next and high We data channel offer broadcast the [13]). not quantum on locking do given they bound data that expected, lower quantum showed be for we of to light which rates in perhaps in and work is “pseudo-classical” high prior are (this a states hiding offer coherent that cannot data we protocols and of channel, coherent-state rate broadcast that any bound of show upper capacity then regularized hiding broadcast a data quantum the establish a on we of there, capacity From hiding channel. data the of definition they same because analyze. the mainly to have channels simple space relatively these output are on and focus input We wit the dimension. the coincide if preserve channels channels they Mictodiactic unital as state. through”) mixed passing maximally “mixtures for Greek rcie hs cee eeltretne otecs of case the [12]. to in parties extended multiple application from later their information noise were exclude hiding or schemes which loss These systems, no practice. encoded required the still schemes in proposed unitary invokin measu newly of data, random concentration The quantum the collective as and such of classical techniques mathematical both use hide the to The operations upon [11]. of relied which schemes research, high-rate schemes the further in prompted culminated eventually Neverthele phenomenon sys regards. the several striking in in noise impractical this or a thus loss was and any and being hiding, tem not of there rate th on However, rested low suggested. proposal a was has implementation communi [7] optical classical quantum quantum from and joint scheme a operations The by local recovered cation. by be not can but it informat that operation hide such to states being Bell in idea the [7], observation impressive “hidden be can information way). (i.e., classica this states the and measuremen distinguish global measurements a to requires local instead one by and communication indistinguishable is it h andvlpeto hspprbgn ihaformal a with begins paper this of development main The vntog hsfsiaigpooo a endsusdfo discussed been has protocol fascinating this though Even an was hiding data quantum for proposal original The ee eadesti fundamental this address we Here, mictodiactic unu data quantum (literally, in ” our um ion re. ss, se h g e e s 1 - r - l t 2 extended to generic channels and to a multipartite scenario. communication. Every LOCC channel can be written in the The scheme involves random coding arguments, and we invoke following form (as a separability preserving channel): concentration of measure bounds in order to establish security (ρ )= (Cx Dx ) ρ (Cx Dx )† , (3) of the scheme. LAB AB A ⊗ B AB A ⊗ B x X † II. PRELIMINARIES such that (Cx Dx ) (Cx Dx )= I . However, not x A ⊗ B A ⊗ B AB Here we recall some basic facts before beginning the main every channel of the form above is an LOCC channel [22]. The traceP norm of an operator A is defined as A development. A quantum state is represented by a density k k1 ≡ operator, which is a positive semi-definite operator acting on Tr[√A†A], and it induces the trace distance ρ σ as a k − k1 a Hilbert space and with trace equal to one. A multipartite measure of distinguishability between two quantum states ρ quantum state actsH on a tensor product of Hilbert spaces. A and σ. The von Neumann entropy of a state ρ on system A is classical-quantum state has the following form: equal to S(A)ρ S(ρ) Tr[ρ log ρ]. The quantum mutual ρXB ≡ ≡− information of a bipartite state ρAB is defined as ρ p (x) x x ρx , (1) XB ≡ X | ih |X ⊗ B x I(A; B)ρ S(A)ρ + S(B)ρ S(AB)ρ. (4) X ≡ − where pX is a probability distribution, x X is an orthonor- The LOCC accessible information of a classical-quantum- x {| i } mal basis, and ρB is a set of quantum states. A quantum quantum state ρMBC is as follows: channel is modeled{ } as a completely positive, trace-preserving ˆ linear map, taking operators acting on one Hilbert space to Iacc,LOCC(M; BC)ρ max I(M; M)ω, (5) ≡ LBC→Mˆ ∈LOCC operators acting on another one. A is unital where the mutual information on the RHS is with respect to if it preserves the identity operator (note that the input and the following classical-classical state: output space of such a channel must have the same dimension).

A quantum measurement is a special kind of quantum channel ωMMˆ BC→Mˆ (ρMBC ), (6) which accepts a quantum input system and outputs a classical ≡ L and is an LOCC measurement channel. system. That is, it can be described as follows: LBC→Mˆ (ρ)= Tr Λyρ y y , (2) III. QUANTUM DATA HIDING CAPACITY M { } | ih | y X In a quantum data-hiding protocol, the sender Alice com- y y municates classical or to two spatially where Λ 0 for all y, y Λ = I, and y is some known orthonormal≥ basis. The collection Λy {|isi} called a positive separated receivers Bob and Charlie via a quantum broadcast P { } operator-valued measure (POVM). A quantum instrument is a channel A→BC . The protocol satisfies the “correctness prop- N quantum channel that accepts a quantum input and outputs a erty” if Bob and Charlie can decode reliably when allowed quantum system and a classical system. to apply a joint quantum measurement (i.e., if they are A quantum broadcast channel is defined as a quantum located in the same laboratory). On the other hand, the “data- channel that accepts one input quantum system A and has hiding/security property” is that the transmitted information two output quantum systems B and C [19]. Formally, it is cannot be accessed by Bob and Charlie when they are re- a completely positive trace preserving linear map from the stricted to performing local operations and classical communi- space of operators that act on the Hilbert space for system A cation (i.e., if they are in different laboratories connected by a to the space of operators acting on the tensor-product Hilbert classical communication channel). When Alice sends classical space for systems B and C. An important example of such information, we call this a bit-hiding protocol and define it as a channel is one that mixes an input mode with two vacuum follows: states at two beamsplitters such that the two receivers obtain Definition 1 (Bit-hiding protocol): An (n,M,δ,ε) bit- two of the beamsplitter outputs while the environment obtains hiding protocol for a quantum broadcast channel A→BC N the other mode [20], [21]. One could incorporate noise effects consists of a collection of input states ρ(x) x=1,...,M , and a { } in addition to loss by mixing with thermal states instead of decoding measurement satisfying the following properties: vacuum states. • (Correctness) It is possible to decode with high average The class of local operations and classical communication success probability, that is, (LOCC) consists of compositions of the following operations: 1 x ⊗n Tr Λ n n (ρ(x)) 1 δ , (7) 1) Alice performs a quantum instrument, which has both a M B C NA→BC ≥ − x quantum and classical output. She forwards the classical X x   output to Bob, who then performs a quantum channel where Λ n n is the POVM associated to the decoding { B C } conditioned on the classical data received. measurement. 2) The situation is reversed, with Bob performing the initial • (Security) For all LOCC measurements LOCC on the n n M instrument, who forwards the classical data to Alice, bipartite system B C , there exists a state σBnCn such who then performs a quantum channel conditioned on that the classical data. 1 ⊗n ( (ρ(x)) σ n n ) ε . An LOCC measurement is a measurement channel that can M MLOCC NA→BC − B C 1 ≤ x be implemented by means of local operations and classical X (8)

3

Remark 1: Due to the convexity of the trace norm, it is inequality is a consequence of the Holevo bound [24], where sufficient to prove the security property against rank-one we have denoted the state after the channel (but before the LOCC measurements. decoding measurement) again by ω. As a consequence of the We can now define the bit-hiding capacity of a quantum security criterion in (8) and the Alicki-Fannes inequality, we broadcast channel : can conclude that NA→BC Definition 2 (Bit-hiding capacity): A bit-hiding rate R is n n Iacc,LOCC(M; B C ) g(n,ε), (17) achievable for a quantum broadcast channel A→BC if for ≤ N 1 all δ, ε, ζ (0, 1) and sufficiently large n, there exists an with g(n,ε) a function such that limε→0 limn→∞ g(n,ε)= ∈ 1 n (n,M,δ,ε) bit-hiding protocol such that n log M R ζ. 0. So this gives The bit-hiding capacity κ( ) of is equal to the supremum≥ − N N of all achievable bit-hiding rates. log M I(M; BnCn) I (M; BnCn) ≤ − acc,LOCC In this paper we focus on bit-hiding protocols. One can + f(n,δ)+ g(n,ε). (18) also define -hiding protocols, aimed at hiding quantum information (see [11]). Similarly, one could define a notion We finally optimize over all possible channel inputs, divide by of qubit-hiding capacity of a quantum channel. Additionally, n, take the limit as n and then as ε,δ 0 to establish → ∞ → these definitions immediately generalize to the case of a the statement of the theorem. channel with one sender and an arbitrary number of receivers. V. UPPERBOUNDFORCOHERENT-STATE DATA-HIDING IV. REGULARIZED UPPER BOUND ON QUANTUM DATA PROTOCOLS HIDING CAPACITY Here we show that data-hiding schemes making use of We begin by establishing a regularized upper bound on the coherent-state encodings are highly limited in terms of the bit-hiding capacity of any channel: rate at which they can hide information. We assume that Theorem 1: The bit-hiding capacity κ( ) of a quantum the mean input photon number is less than N (0, ) N S channel is bounded from above as follows: and Alice is connected to Bob and Charlie by a∈ bosonic∞ N 1 broadcast channel [20], in which Alice has access to one κ( ) lim κ(u)( ⊗n), (9) N ≤ n→∞ n N input port of a beamsplitter, the vacuum is injected into the where other input port, and Bob and Charlie have access to the outputs of the beamsplitter. The main idea behind the bound (u) κ ( ) max [I(X; BC)ρ Iacc,LOCC(X; BC)ρ] , that we prove here is that the of the pure- N ≡ {pX (x),ρx} − loss bosonic channel is limited from above by g(NS) [25], ρXBC pX (x) x x X A→BC (ρx). (10) ≡ | ih | ⊗ N where g(x) (x + 1) log2 (x + 1) x log2 x. At the same x ≡ − X time, if Bob and Charlie perform heterodyne detection on their Proof: This upper bound follows by using the definition outputs and coordinate their results, the rate at which they can of a bit-hiding protocol and a few well known facts. Let decode information is equal to log2(1+NS). Our proof of the us consider an (n,M,δ,ε) bit hiding protocol. By a simple following theorem makes this intuition rigorous. Notably, this reduction (see Appendix A), the correctness criterion in (7) bound is the same as that found in [13] for the strong locking translates to the following criterion: capacity when using coherent-state encodings. 1 Theorem 2: The quantum data-hiding capacity of a bosonic Φ ′ ω ′ δ, (11) 2 MM − MM 1 ≤ broadcast channel when restricting to coherent-state encodings with mean photon number NS is bounded from above by where ΦMM ′ is a maximally correlated state, defined as g(NS) log2(1 + NS) log2(e) 1.45. 1 Proof:− Consider a quantum≤ data-hiding≈ scheme consisting ΦMM ′ x x M x x M ′ , (12) ≡ M | ih | ⊗ | ih | of coherent-state codewords: αn(x, k) , where αn x {| i}x,k | i ≡ X α1 α2 αn and such that the mean photon number and ω ′ is defined from the probability distribution on the MM |of thei⊗| schemei⊗· · ·⊗|is lessi than N (0, ). Then the quantum LHS of (7) as S codeword transmitted for message∈ x is∞ as follows: 1 x′ ⊗n ′ ′ ′ Tr ΛBnCn A→BC (ρ(x)) x x M x x M . 1 n n ′ M N | ih | ⊗ | ih | ρ(x) α (x, k) α (x, k) . (19) Xx,x h i ≡ K | ih | (13) Xk Then So the classical-quantum state corresponding to the transmitted ′ state is as follows: log M = I(M; M )Φ (14) ′ I(M; M )ω + f(n,δ) (15) ωMKBnCn ≤ n n ≡ I(M; B C )ω + f(n,δ). (16) 1 n n ≤ x x k k √ηα (x, k) √ηα (x, k) n MK | ih |M ⊗ | ih |K ⊗ | i h |B The first inequality is an application of the Alicki-Fannes x,k X continuity of entropy inequality [23], with f(n,δ) a func- n n 1 1 ηα (x, k) 1 ηα (x, k) , (20) tion such that limδ→0 limn→∞ f(n,δ) = 0. The second ⊗ − − Cn n ED p p

4

n where √ηα is a shorthand for √ηα1 √ηα2 We now evaluate the quantity Ihet,LO(Y ; BC)σ. Consider that ⊗ ⊗···⊗ √ηαn . the output for Bob is a random variable √ηα + zB, where α

In order to obtain our upper bound, we suppose that Bob is a zero-mean Gaussian random variable (RV) with variance performs heterodyne detection, forwards the results to Charlie, NS and zB is a zero-mean Gaussian RV with variance 1. The who also performs heterodyne detection and coordinates the output for Charlie is a RV √1 ηα + z , where α is the − C results to decode. Now begin from the upper bound in (18): same Gaussian RV as above and zC is a zero-mean Gaussian

n n n n RV with variance 1 (note that α, zB, and zC are independent I(M; B C )ω Iacc,LOCC(M; B C )ω RVs). The covariance matrix for the real part of these RVs is n n− n n I(M; B C )ω Ihet,LO(M; B C )ω (21) as follows: ≤ n n − n n = I(MK; B C )ω I(K; B C M)ω ηNS/2+1/2 η (1 η)NS/2 −n n | n n − , (30) [Ihet,LO(MK; B C )ω Ihet,LO(K; B C M)ω] (22) η (1 η)N /2 (1 η) N /2+1/2 − − |  − S p− S  = I(MK; BnCn) I (MK; BnCn) ω het,LO ω with determinantp equal to n n − n n [I(K; B C M)ω Ihet,LO(K; B C M)ω] (23) − n n | − n n | 1 I(MK; B C ) I (MK; B C ) (24) (NS + 1). (31) ω het,LO ω 4 ≤ n n− n n max [I(Y ; B C )τ Ihet,LO(Y ; B C )τ ] (25) ≤ pY (y) − The determinant of the covariance matrix of the real parts of the RVs z and z is equal to 1/4. By modeling the real and n max [I(Y ; BC)σ Ihet,LO(Y ; BC)σ] . (26) B C ≤ pY (y) − imaginary components as two independent parallel channels The first inequality follows by picking the LOCC measure- and plugging into the Shannon formula for the capacity of a ment to be the classically coordinated heterodyne detection Gaussian channel, we find that mentioned above. The first equality follows from the chain I (Y ; BC) = log(N + 1). (32) rule for conditional mutual information, and the second equal- het,LO σ S ity is a rewriting. The second inequality follows because So we can finally conclude the upper bound on the data hiding n n n n I(K; B C M)ω Ihet,LO (K; B C M)ω 0, which is capacity of coherent-state schemes. a consequence| of− data processing: the| classical≥ heterodyne detection measurement outcomes are from measuring systems VI. LOWER BOUND ON QUANTUM DATA HIDING CAPACITY BnCn. The second-to-last inequality follows by optimizing over all input distributions and the information quantities are Here we prove a lower bound for the bit-hiding capacity evaluated with respect to a state of the following form: of mictodiactic quantum broadcast channels. We consider a channel A→BC from an input quantum system of dimensions n n N τ n n p (y) y y √ηα (y) √ηα (y) n dim A = dA to the output systems with dimensions dim B = Y B C ≡ Y | ih |Y ⊗ | i h |B y d and dim C = d . A mictodiactic channel is defined from X B C the following property: 1 ηαn(y) 1 ηαn(y) . (27) ⊗ − − Cn ED A→BC (IA/dA)= IBC /(dBdC ), (33) The last inequality p follows by realizingp that the difference N between the mutual informations can be understood as be- where IA and IBC denote the identity operators acting on the ing equal to the private information of a quantum wiretap input and output spaces, respectively. channel in which the state is prepared for the receiver while Theorem 3: The bit-hiding capacity κ( ) of a mictodiactic the heterodyned version of this state (a classical variable) broadcast channel , with dim A N= d , dim B = d NA→BC A B is prepared for the eavesdropper. Such a quantum wiretap and dim C = dC is bounded from below as follows: channel has pure product input states (they are coherent states) (l) and it is degraded. Thus, we can apply Theorem 35 from [13] κ( ) κ ( ) χ( ) log d+ log γ . (34) N ≥ N ≡ N − − to conclude that this private information is subadditive. The where information quantities in the last line are with respect to a state of the following form: χ( )= S dψ (ψ) dψ S( (ψ)) (35) N N − N   σ p (y) y y √ηα (y) √ηα(y) Z Z YBC ≡ Y | ih |Y ⊗ | i h |B is the Holevo information of the channel computed for a uni- y X form ensemble of input states (dψ denotes the uniform mea- 1 ηα(y) 1 ηα(y) . (28) sure on the sphere of unit vectors), and d = max d , d . ⊗ − − C + { B C } ED The parameter γ is given by Now by a development p nearly identicalp to that given in 2 2 Eqs. (34)-(42) of [13], we can conclude that a circularly 2dBdC γ = ( )(Psym) ∞ , (36) symmetric, Gaussian mixture of coherent states with variance dA(dA + 1) k N ⊗ N k N optimizes the quantity in (26). For such a distribution, the S where is the -norm and is the projector onto quantity I(Y ; BC) evaluates to ∞ Psym σ the symmetrick·k subspace.∞ I(Y ; BC)σ = g(NS). (29) A proof is given in the next section. 5

As an example consider the d-dimensional depolarizing We then pick Kn qudit unitaries Ukj i.i.d. from the Haar channel, with d = dA = dBdC : measure on SU(d). The inputs to the channel have the following form: (X)= pX + (1 p) Tr(X)I/d. (37) N − K Let us first compute the Holevo information for the uni- 1 † ρ(x)= Uk ψ(x) Uk , (47) form distribution of input states. A straightforward calculation K Xk=1 yields where n 1 p 1 p U = U . (48) χ( ) = log d + p + − log p + − k kj N d d j=1     O 1 p 1 p We introduce the notation V to denote + (d 1) − log − . (38) = (V1,...,VM ) − d d the M-tuple of n-local qudit unitaries and the notation U =     (U ,...,U ) to denote the K-tuple of n-local qudit unitaries, Then consider the Psym = 2 Psym , which 1 K Tr(Psym) d(d+1) and we further define U as follows: is mapped by ( ) into R N ⊗ N K 1 † Psym Psym I I 2 2 (39) U(σ)= Uk σUk . (49) ( ) = p +(1 p ) ⊗2 , R K N ⊗N Tr(P ) Tr(P ) − d k=1  sym  sym X V U where we have used the fact that the partial trace of Psym We also define the random variables and , taking values Tr(Psym) on the set of M-tuples V = (V ,...,V ) and K-tuples is the maximally mixed state I/d. We hence have 1 M U = (U1,...,UK ), respectively, where each qudit unitary is ( )(P ) statistically independent and uniformly distributed according k N ⊗ N sym k∞ P to the distribution induced by the Haar measure on SU(d). = Tr(P ) ( ) sym (40) sym N ⊗ N Tr(P ) Given the input codewords in (47), the state at the output  sym  ∞ 2 2 of n channel uses is as follows: d(d + 1) 2p 1 p = + − (41) ⊗n ⊗n 2 d(d + 1) d2 (ρ(x)) = ( U(ψ(x))) (50)   N N ⊗n R d +1 d +1 = ( U(V 0 0 V )) . (51) = + p2 1 . (42) N R x| ih | x 2d − 2d   We split the proof into two parts: first we prove the Finally, from (36), putting dBdC = d we obtain correctness property and then the security property. 2d 1) Correctness: The proof of the correctness property has γ =1+ p2 1 . (43) a rather standard form, but we provide it for completeness. Let d +1 − n,δ0   Π denote the δ0-weakly typical projection for the tensor- For the case of unital channels, which are contrac- N (π) power state [ (π)]⊗n, where π denotes the maximally mixed tive with respect to the Schatten norms [26], we have state and δ >N0 (see, e.g., [27] for a definition and properties). ( )(P ) P =1, from which we obtain 0 sym ∞ sym ∞ This projector has the following properties which hold for all thek N following ⊗ N looserk bound:≤k k ε (0, 1) and sufficiently large n: 0 ∈ (l) 2d n,δ ⊗n κ ( ) χ( ) log d+ log . (44) Tr(Π 0 [ (π)] ) 1 ε , (52) N ≥ N − − d +1 N (π) N ≥ − 0 Πn,δ0 [ (π)]⊗n Πn,δ0 2−[S(N (π))−δ0]Πn,δ0 . (53) A. Proof of Theorem 3 N (π) N N (π) ≤ N (π) Let a spectral decomposition of the state ⊗n(U ψ(x) U †) We now provide a proof for Theorem 3. We generate a N k k bit-hiding code for n uses of the quantum broadcast channel be as follows: A→BC , by employing the well known method of random ⊗n(U ψ(x) U †)= p (yn k, x) yn yn , (54) N N k k | k,x k,x coding. For x = 1,...,M, pick a collection of M pure yn quantum states at random, each having the following form: X where the eigenvalues p (yn k, x) form a product distribution n | n,δ1 because the state is tensor product. Let Π denote the δ - ψ(x) = ψ (x) . (45) k,x 1 | i | j i weak conditionally typical projection corresponding to the j=1 ⊗n † O state (Uk ψ(x) Uk ), defined as the projection onto the These random unit vectors are each generated by sampling followingN subspace: ψj (x) independently from the uniform distribution over the |unit spherei in Cd. A simple way of doing so is to single out a n 1 n span yk,x : log p (y k, x) S∗ δ1 . (55) Cd −n | − ≤ fiducial unit vector 0 and pick a unitary Vxj at random   | i ∈ according to the Haar measure on SU(d), in order to generate where δ1 > 0 and S∗ = dψ S( (ψ)) (see, e.g., [27] for N ψj (x) = Vxj 0 . Let more details). These projectors have the following property, | i | i R n which holds for all ε (0, 1) and sufficiently large n: 1 ∈ Vx = Vxj . (46) E n,δ1 ⊗n † (56) j=1 Uk ,Vx Tr Πk,x (Ukψ(x)Uk ) 1 ε1. O N ≥ − n  o 6

(In fact, both ε0 and ε1 can be taken to be exponentially By picking decreasing in n, following from an application of the Chernoff 1 1 bound.) So this means that we can build a reliable decoding log M + log K = S ( (π)) S∗ 2δ0 2δ1, (72) n n N − − − measurement from the set Πk,x of projectors. Another property of the conditionally typical{ } projector is the following we can ensure that bound on the size of each projector: −n(δ0+δ1) EV U [¯p ] 2 [2√ε + ε ]+4 2 . (73) , err ≤ 0 1 · Tr(Πn,δ1 ) 2n[S∗+δ1]. (57) k,x ≤ Eventually, we will derandomize the random bit-hiding code We then consider a “square-root” decoding measurement in order to conclude the existence of one with this error defined by the following POVM elements: probability bound. −1/2 −1/2 2) Security: To simplify the notation we set d = dBdC . To prove the security of the protocol against an LOCC Λk,x Γk′,x′ Γk,x Γk′,x′ , (58) measurement we show that ≡     k′,x′ k′ ,x′ X X 1 ⊗n ⊗n n n,δ n,δ n,δ  0 1  0   LOCC A→BC (ρ(x)) I /d 1 ε2 , Γk,x Π Πk,x Π . (59) M M N − ≤ ≡ N (π) N (π) x X  (74) The average probability of an error when decoding both x and k is as follows: for an arbitrarily small ε2 (0, 1) and for all LOCC mea- surements. In fact, what we∈ show is an even stronger bound 1 p¯ =1 Tr(Λ ⊗n(ψ (x))), (60) by proving that the protocol is secure against all separable err − MK k,xN k k,x measurements . X Msep For a given codeword ψ(x) and a separable measurement where we have introduced the shorthand ψ (x) U ψ(x)U †. k k k (with POVM elements By Cy ), we define the con- Recall the Hayashi-Nagoaka operator inequality≡ [28] sep ditionalM random variable Y U{from⊗ the following} distribution: −1/2 −1/2 | I (P + Q) P (P + Q) 2 (I P )+4Q, (61) y y ⊗n − ≤ − pY |U(y) = Tr[(B C ) ( U(ψ(x)))] . (75) ⊗ N R which holds for 0 P I and Q 0. Picking ≤ ≤ ≥ We then consider the mutual information of the random P =Γk,x,Q = Γk′,x′ , (62) variables Y and U, given that codeword ψ(x) was transmitted: (k′,x′)6=(k,x) X I(Y ; U)= H(Y ) H(Y U) . (76) we can apply this to (60) to bound it from above as − | We first consider the case of separable projective mea- 2 ⊗n surements , which have separable POVM elements p¯err Tr([I Γk,x] (ψk(x))) pro-sep ≤ MK − N y y My y y y k,x B C = φB φC , where φB and φC are rank-one projectors X acting⊗ on Bob and⊗ Charlie’s systems, respectively. By applying 4 ⊗n + Tr(Γ ′ ′ (ψ (x))). (63) MK k ,x N k concentration inequalities to the conditional probability distri- k,x (k′,x′)6=(k,x) X X bution pY |U(y), we show that (see Appendix B for details) Now taking an expectation over a random choice of both V for K K(n, dB, dC ,δ2) ≫ and U, by (52) and (56) and the gentle measurement lemma n sup I(Y ; U)= O(δ2 log d ) , (77) [29], [30] (see also [27]), it follows that x,Mpro-sep ⊗n EV,U Tr([I Γk,x] (ψk(x))) 2√ε0 + ε1. (64) where δ (0, 1) and − N ≤ 2 ∈ Recalling that each unitary is independent of another, for 10dn K(n, d , d ,δ )=8dn γnδ−2 log , (78) (k′, x′) = (k, x), we find that B C 2 + 2 δ 6 2 ⊗n EV U Tr(Γ ′ ′ (ψ (x))) with d+ = max dB, dC . , k ,x N k { } ⊗n The Pinsker inequality (see, e.g., [31]) states that = Tr(EV U [Γ ′ ′ ] EV U (ψ (x)) ) (65)  , k ,x , N  k E ⊗n = Tr( V,U [Γk′,x′ ][ (π)] ) (66) U N   pY,U pY pU 1 = d pY |U(y) pY (y) E n,δ1 n,δ0 ⊗n n,δ0 k − k − = V,U Tr(Π ′ ′ Π [ (π)] Π ) (67) Z y k ,x N (π) N N (π) X −[S(N (π))−δ0] n,δ1 n,δ0 2 ln 2I(Y ; U) . (79) 2 Tr(Π ′ ′ Π ) (68) ≤ k ,x N (π) ≤ −[S(N (π))−δ0] n,δ1 Using (77) and the Pinskerp inequality we then obtain that for 2 Tr(Πk′ ,x′ ) (69) ≤ all M codewords ψ(x) and 2−[S(N (π))−δ0]2n[S∗+δ1]. (70) Mpro-sep ≤ ⊗n n Putting everything together, we find that dU ( U(ψ(x))) I /d Mpro-sep N R − 1 Z E V,U [¯perr] 2 [2√ε0 + ε1] U  n ≤ = d pY |U(y) pY (y) O( δ2 log d ) . (80) −[S(N (π))−δ0] n[S∗+δ1] − ≤ +4KM2 2 . (71) Z y X p

7

Taking an average over all messages and exchanging this statements. We notice that the mictodiactic condition is used average with the expectation over unitaries, we find that only to obtain (111), that is,

E 1 1 ⊗n n U (Xk)= . (86) EV U ( U(ψ(x))) I /d dn , M Mpro-sep N R − 1 ( x ) X where n  y ⊗n † O( δ2 log d ). (81) X = Tr φ (U ψ(x)U ) . (87) ≤ k N k k Then, in Appendix C we show howp this result can be The vector φy corresponds to one of the POVM elements of extended to the case of generic separable measurements by a decoding measurement. applying some techniques developed in [32]. The first unproven statement is that, for n large, φy belongs Finally, by choosing ⊗n E † to the typical subspace associated to ( U (Ukψ(x)Uk )) = ⊗n ⊗n ⊗n N 1 log n (πA ) = (πA) , where πA = IA/dA denotes N N n,δ log K = log d+ + log γ + λ , (82) the maximally mixed state on system A. Let Π then n n N (πA) y where λ > 0 is a positive constant, the condition K > denote the projector onto the typical subspace. Putting φ = Πn,δ φyΠn,δ , we have K(n, dB, dC ,δ2) is satisfied and implies that the LHS of (81) N (πA) N (πA) decreases sub-exponentially in n. y n,δ ⊗n n,δ EU (Xk) = Tr φ Π (πA)Π . (88) N (πA)N N (πA) To conclude the proof we combine the conditions (72) and The equipartition property of the typical subspace (see e.g. (82) to obtain that as long as the rate satisfies the following [27]) yields condition −n(S+δ) n,δ n,δ ⊗n n,δ 2 Π Π (πA)Π 1 N (πA) ≤ N (πA)N N (πA) log M = S ( (π)) S∗ log d+ −n(S−δ) n,δ n N − − 2 ΠN (π ) , (89) log n ≤ A log γ λ 2δ0 2δ1, (83) with S = S( (π )). This in turn implies − − n − − N A then (73) and (81) are satisfied. This in turn implies that there −n(S+δ) −n(S+δ) y n,δ E 2 =2 Tr φ ΠN (π ) U (Xk) exist choices of the unitaries (U1,...,UK ) and (V1,...,VM ) A ≤  n,δ  such that these conditions are satisfied and thus there exists 2−n(S−δ) Tr φyΠ =2−n(S−δ) . (90) an (n,M,δ,ε) bit-hiding code such that δ and ε are vanishing ≤ N (πA)   with increasing n. The asymptotic rate of the generated These bounds generalize the condition (111), where 2S re- sequence of codes is then as given in the statement of the places dBdC and plays the role of the effective dimension of theorem. the output system. Similarly, consider the second moment, see (115),

B. Multipartite Generalization ⊗n E 2 y⊗2 ⊗2 Psym The result of Theorem 3 is readily generalized to a multipar- U (Xk ) = Tr φ . (91) N Tr(Psym) tite setting. Suppose for instance that Alice sends information "    # from a system of dimension dA through a mictodiactic channel The second unproven statement is that the measurement y⊗2 n,δ y⊗2 n,δ to ℓ receivers, B1,...,Bℓ, with Hilbert space dimensions vectors are of the form φ = Π ⊗2 φ Π ⊗2 , N N (Psym) N (Psym) d = dim B , and we require security against LOCC measure- n,δ j j where Π ⊗2 is the typical projector associated to the ments. In this case we would obtain the following achievable N (Psym) state ⊗2 Psym . The equipartition property implies bit-hiding rate: N TrPsym   χ( ) log d+ log γ , (84) ⊗n N − − y⊗2 n,δ ⊗2 Psym n,δ Tr φ Π ⊗2 Π ⊗2 N (Psym) N (Psym) with d = max d and N TrPsym + j j "    # 2 d2 2−n(S2−δ) , (92) j j ⊗2 (85) ≤ γ = (Psym) ∞ . dA(dA + 1) N ⊗2 Psym Q where S2 = S( ( )). N TrPsym In conclusion, by modifying (116), it could be possible VII. DISCUSSION to extend Theorem 3 to non-mictodiactic (and non-unital) The main contribution of this paper is to provide a formal channels with γ redefined as definition of the data hiding capacity of a quantum channel 1 1 2 n −n(S −δ) n and upper and lower bounds on this operational quantity. Our EU (X ) 2 2 k =22S−S2+3δ =: γ . work thus initiates the study of “noisy data hiding,” and we 2 −2n(S+δ) EU (Xk) ≤ 2 now suggest several directions for future study.     (93) It could be possible to generalize Theorem 3 such that it Notice that this extension of Theorem 3 also improves the applies to generic, non-mictodiactic, channels. Now we show bound for mictodiactic channels. We leave a full development how this generalization is obtained assuming two unproven of the above observations for future work. 8

There are several ways in which the lower bound of Theo- Consider also that rem 3 could be further improved. Let us recall that a map R p ′ q ′ is said to be an approximately randomizing map with respect k MM − MM k1 ′ to a given norm , if for all states ψ, = pM (m)δm,m′ pM (m)q ′ (m m) (101) k·k∗ − M |M | m,m′ X ′ (ψ) π ∗ ε , (94) = p (m) δ ′ q ′ (m m) (102) kR − k ≤ M m,m − M |M | m,m′ X ′ where π is the maximally mixed state. There exists a close = p (m) q ′ (m m) M M |M | relation between data-hiding protocols and approximately ran- ′ mX6=m domizing maps. For instance, the data-hiding protocol of [11] + pM (m) 1 q ′ (m m) (103) was obtained by modifying a related approximately random- − M |M | m X izing map with respect to the operator norm ∞. Several  ′  =2 p (m)q ′ (m m). (104) constructions of approximately randomizing mapsk·k with respect M M |M ′ | to the operator norm and the trace norm were discussed in [33], mX6=m [34], [35], [36]. It could indeed be possible that these maps So the equality in (98) follows from (99)–(100) and (101)– can be used to develop quantum data hiding protocols robust (104). to noise and achieving higher rates. If this is true, it might be possible to achieve a bit-hiding rate of APPENDIX B CONCENTRATION INEQUALITIES

χ( ) log d+ . (95) In a crucial passage in the proof of Theorem 3 we have N − applied the bound Acknowledgements. We thank Jonathan Olson, Graeme I(Y ; U)= O(δ log dn) , (105) Smith, and Andreas Winter for discussions about quantum data holding for any separable measurement. Here and in Appendix hiding capacity. MMW acknowledges support from startup C we prove that this bound holds true provided funds from the Department of Physics and Astronomy at LSU n and the NSF under Award No. CCF-1350397. All authors ac- n n −2 10d K K(n, dB, dC ,δ)=8d γ δ log , (106) knowledge support from the DARPA Quiness Program through ≫ + δ US Army Research Office award W31P4Q-12-1-0019. with γ as in (36). We do so by first showing that (105) holds for separable pro- jective measurements pro-sep, which have separable POVM elements φy φy , whereM φy and φy are rank-one projectors APPENDIX A B C B C acting on Bob⊗ and Charlie’s systems, respectively. This is done in Proposition 1, where we apply techniques analogous Let M be a random variable. Let pMM ′ denote the distri- to those applied in [15], [16]. In Appendix C we show how ′ bution in which M is a copy of M, so that this result can be extended to the case of generic separable measurements by applying some techniques developed in [32]. ′ pMM ′ (m,m )= pM (m)δm,m′ . (96) We will make use of two concentration inequalities. The first one is Maurer’s tail bound [37]: Theorem 4: Let X be K i.i.d. non-negative Let qMM ′ denote the distribution that results from sending { k}k=1,...,K ′ ′ real-valued random variables, with X X and finite first random variable M through a channel qM ′|M (m m), so that k | and second moments: E[X], E[X2] < .∼ Then, for any τ > 0 ∞ ′ ′ we have that qMM ′ (m,m )= pM (m)qM ′|M (m m). (97) K | 1 Kτ 2 Pr Xk < E[X] τ exp . (107) ′ E 2 Then the probability that M = M under qMM ′ is equal to (K − ) ≤ −2 [X ] 6 k=1   the normalized trace distance between p ′ and q ′ : X MM MM The second one is the Chernoff bound [38]: Theorem 5: Let Xk k=1,...,K be K i.i.d. random vari- ′ 1 { } ′ ′ ables, , with and E . Then, Pr M = M = pMM qMM 1 . (98) Xk X 0 X 1 [X] = µ q { 6 } 2 k − k for any τ >∼0 such that (1≤ + τ)µ≤ 1 we have that ≤ K Consider that 1 Kτ 2µ Pr Xk > (1 + τ)µ exp . (108) (K ) ≤ − 4 ln 2 ′′ ′ k=1   Pr M = M = qMM ′ (m,m ) (99) X q { 6 } For given states ψ(x) and φy = φy φy , we apply these m′6=m B C X bounds to the quantity ⊗ ′ = pM (m)qM ′ |M (m m). (100) | y ⊗n † m′6=m X = Tr φ (U ψ(x)U ) . (109) X k N k k   9

This quantity is a random variable if the unitary U is chosen Finally, we consider the function η( )= ( ) log ( ). Using k · − · · randomly. Taking the average over the random unitaries Uk the inequality η(r) η(s) η( r s ) (which holds for we obtain r s < 1/2)| we obtain− | ≤ | − | ⊗n | − | E † I U (Ukψ(x)Uk )= n , (110) η(pY |U(y)) η(˜pY |U(y)) η(2ε) . (122) dA − ≤ which for mictodiactic channels implies From now on, to make notation lighter, we put d := dBdC . E 1 We are now ready to prove the following: U (Xk)= n n . (111) dBdC Proposition 1: For any δ (0, 1) and K > ∈ We also consider the second moment K(n, dB, dC ,δ), n ⊗2 sup I(Y ; U)= O(δ log d ) , (123) 2 y ⊗n † EU (X )= dU Tr φ (U ψ(x)U ) x,Mpro-sep k k N k k Z    where the sup is over separable projective measurements n ⊗2 pro-sep. = Tr φy⊗2 ⊗2 dU U ⊗2ψ (x)⊗2U † . M  N kj kj j kj  First of all, we notice that for a projective measurement j=1 Z  y y y O with associated POVM elements φ = φB φC y=1,...,dn  (112) the mutual information (76) reads{ ⊗ } For any two-qudit pure state ρ we have I(Y ; U) = log dn H(Y U) , (124) − | ⊗2 2 dU U ⊗2ρ⊗2U † = P , (113) where we have also used the condition (111). d (d + 1) sym Z A A For a given vector ψ(x) and separable projective measure- ment we consider the quantity where Psym is the projector onto the symmetric subspace (see, Mpro-sep e.g., [39]). We then obtain H(Y )U = p U(y) log p U(y) (125) − Y | Y | n y E 2 2 y⊗2 ⊗2 ⊗n X U (Xk )= Tr φ (Psym) d (d + 1) N = η[p U(y)] . (126)  A A  Y | h  i y (114) X n For a given y, we want to bound the probability that 2 ⊗2 n n (Psym) ∞ (115) H(Y )U (1 δ) log d . In order to do that we bound the ≤ dA(dA + 1) kN k ≤ − 1−δ   probability that η[pY |U(y)] η[ dn ]. Notice that η[x] is a ≤ 1−δ (where we have used the fact that the expectation value of an concave function and the equation η[x] = η[ dn ] has two 1−δ 1−δ 1−δ operator on a vector is upper bounded by the -norm), from roots: x− = dn , and x+ = 1 η[ dn ]+ O(η[ dn ]), where ∞ n − 1−δ which it follows for d large enough x 1 2η[ n ]. Therefore we have + ≥ − d 1 E 2 n 2 2 U (Xk ) 2dBdC ⊗2 1 δ n (P ) = γ . U U 2 sym ∞ Pr η[pY | (y)] −n log d EU (Xk) ≤ dA(dA + 1)kN k ≤ d   (116)   PrU p U(y) x + PrU p U(y) x We will also make use of the notion of a net of unit vectors ≤ Y | ≤ − Y | ≥ + 1 δ [11]. Let us recall that an ε-net is a finite set of unit vectors  PrU p U (y) − ˜ ≤ Y | ≤ dn Nε = φ in a D-dimensional Hilbert space such that for any   { } ′ unit vector φ there exists φ N for which + PrU pY |U(y) 1 δ , (127) ∈ ε ≥ − ′ 1−δ where δ 2η[ n ]. φ φ 1 ε . (117) d  k e− k ≤ For given≡ x and y, we now apply the Maurer tail bound 2D As discussed in [11] there existe ε-nets with less than (5/ε) (Theorem 4) to the random variables elements. Let us consider a pair of vectors φB, φC and the y y ⊗n † Xk := Tr φ φ (Ukψ(x)U ) , (128) corresponding vectors φB, φC in the net such that B ⊗ C N k whose first and second moments are given by (111) and (112) φ φ , φ φ ε . (118) k B − eB k1 ek C − C k1 ≤ and obey the inequality in (116). We remark that We consider the quantitye defined ine (75): 1 Xk = pY |U(y) . (129) y y ⊗n K p U(y) = Tr[(φ φ ) ( U(ψ(x)))] , (119) k Y | B ⊗ C N R X Hence, applying (107) with E n, we obtain and τ = δ [X]= δ/d 1 δ Kδ2E[X]2 y y ⊗n p˜ U(y) = Tr[ φ˜ φ˜ ( U(ψ(x)))] . (120) PrU pY |U(y) < − exp (130) Y | B C dn ≤ − 2E[X2] ⊗ N R       Kδ2 We have (131) exp n . p U(y) p˜ U(y) 2ε . (121) ≤ − 2γ Y | − Y | ≤  

10

Similarly we apply the Chernoff inequality, Theorem 5, and where Θ Θ[H(Y )U (1 δ) log dn + dnη(δd−n)] de- obtain notes the Heaviside≡ step function,− − which finally yields n ′ n 2 ′ Kd (1 δ 1/d ) n n −n PrU pY |U(y) 1 δ exp − − sup I(Y ; U) δ log d + d η(δd ) ≥ − ≤ − 4 ln 2 ≤   x,Mpro-sep  Kdn(1/2)2 n n −n exp , (132) + (1 δ) log d d η(δd ) p ≤ − 4 ln 2 − − n    = O (δ log d ) . (145) where the last inequality holds for sufficiently small δ′ and large dn. We then have APPENDIX C 1 δ n PrU η(p U(y)) − log d FROMPROJECTIVEMEASUREMENTSTOGENERIC Y | ≤ dn   SEPARABLE MEASUREMENTS Kδ2 Kdn(1/2)2 exp + exp (133) ≤ − 2γn − 4 ln 2 In this appendix we discuss how Proposition 1 can be     extended to include generic separable measurements via the Kδ2 2exp , (134) notion of separable quasi-measurements. In order to do that ≤ − 2γn   we apply a simple modification of Lemma 6.2 in [32]. where the last inequality holds for any dn > 8 ln 2γ−nδ2. The notion of quasi-measurement was defined in [32] : y y This is true for given x and vectors φB , φC . To account for Definition 3 (Quasi-Measurement [32]): We call (s,f) y all possible codewords ψ(x) and measurement vectors φB, quasi-measurement an incomplete measurement on a D- y −1 −n φC , we introduce a (δ2 d )-net for Bob’s system and a dimensional system such that the associated POVM elements −1 −n 2 (δ2 d )-net for Charlie’s one, containing in total no more are of the form D φy, where φy, for y = 1,...,s, are 2dn +2dn s than (10dn/δ) B C elements. Applying the union bound s D2 y rank-one projectors and y=1 s φ f I. We denote as on the net’s vectors and on the M codewords we obtain (s,f) the set of (s,f)-separable quasi-measurements.≤ L P 1 δ n Lemma 6.2 in [32] proves that quasi-measurements are Pr inf η(pY |U(y)) − log d ˜y ˜y dn almost as informative as generic measurements, that is, given (x,φB ,φC ≤ ) n n a bipartite quantum state ρUB we have 10dn 2dB+2dC Kδ2 2M exp (135) ≤ δ − 2γn sup (ρUB ρU ρB) 1   n   kM − ⊗ k 10dn 4d+ Kδ2 M (136) ′ 2M exp n sup (ρUB ρU ρB) 1 ≤ δ − 2γ ≤ M′∈L(s,f) kM − ⊗ k  2  n  Kδ 10d 2 −s(η−1)2/(D(2ln 2)) exp +4dn log + log (2M) (137) +4D e , (146) ≤ − 2γn + δ   =: p , (138) where the sup on left hand side is over generic measurements B→Y on the B system, and that on the right hand side is where d+ = max dB, dC . From this, we can extend the M { } over quasi-measurements ′ . infimum over all unit vectors by paying a small penalty given MB→Y To apply this result to our setting, we first define the notion by (122). In this way we obtain of separable quasi-measurements by adapting Definition 3 to

1 δ n −n the LOCC setting: Pr inf η(pY |U(y)) − log d η(δd ) p . φy ,φy n Definition 4: [Separable quasi-measurement] We say that ( B C ≤ d − ) ≤ (139) an incomplete measurement on a DB DC -dimensional bi- × The probability of such a bad event can be made arbitrarily partite system is an (s,f)-separable quasi-measurement if the n 2 n 10d (DB DC ) y y small provided (we are assuming log (2M) 4d+ log ) associated POVM elements have the form s φB φC , ≪ δ y y ⊗ n where φB , φC , for y = 1,...,s, are rank-one projectors, 10d 2 n n −2 s (DB DC ) y y K 8γ d+δ log . (140) such that φ φ f I . We denote as ≫ δ y=1 s B C BC (s,f) the set of (s,f)-separable⊗ ≤ quasi-measurements. Under this condition we then have that, up to a small proba- Lsep We noticeP that the proof in Appendix B, which considers bility p, for all separable projective measurements , Mpro-sep separable projective measurements, also applies to the case of n n −n H(Y )U (1 δ) log d d η(δd ) . (141) separable quasi-measurements. This implies that, by consider- ≥ − − ing the set of (s,f)-separable quasi-measurements, a modified This implies version of Proposition 1 will be obtained, i.e.,

H(Y U)= dU H(Y )U (142) | sup I(Y ; U)= O(δ log s). (147) Z x,M∈Lsep(s,f) dU H(Y )U Θ (143) ≥ Z To move from separable quasi-measurements to generic sep- (1 δ) log dn dnη(δd−n) (1 p) , (144) ≥ − − − arable measurements we apply a straightforward modification   11 of Lemma 6.2 in [32] in the LOCC setting, that is, [4] C. H. Bennett and S. J. Wiesner, “Communication via one- and two- particle operators on Einstein-Podolsky-Rosen states,” Physical Review sup (ρ ρ ρ ) Letters, vol. 69, no. 20, pp. 2881–2884, November 1992. UBC U BC 1 [5] R. Raz, “Exponential separation of quantum and classical communica- Msep kM − ⊗ k tion complexity,” Proceedings of the thirty-first annual ACM symposium ′ sup (ρUBC ρU ρBC ) 1 on Theory of computing, pp. 358–367, 1999. ′ ≤ M sep∈Lsep(s,f) kM − ⊗ k [6] D. P. DiVincenzo, M. Horodecki, D. W. Leung, J. A. Smolin, and B. M. 2 2 −s(η−1) /(DB DC (2ln 2)) Terhal, “Locking classical correlations in quantum states,” Physical + 4(DBDC) e , (148) Review Letters, vol. 92, no. 6, p. 067902, February 2004, arXiv:quant- ph/0303088. where the sup on the left hand side is over separable measure- [7] B. M. Terhal, D. P. DiVincenzo, and D. W. Leung, “Hiding bits in Bell ments sep , and the one on the right is over separable states,” Physical Review Letters, vol. 86, no. 25, pp. 5807–5810, June MB,C→Y quasi-measurements ′sep . 2001, arXiv:quant-ph/0011042. MB,C→Y [8] T. Eggeling and R. F. Werner, “Hiding classical data in multi-partite In conclusion, to extend Proposition 1 to generic separable quantum states,” Physical Review Letters, vol. 89, no. 9, p. 097905, measurements we proceed as follows. First recall that (see Eqs. 2002, arXiv:quant-ph/0203004. (79) and (80)) given a separable measurement , in our [9] D. P. DiVincenzo, D. W. Leung, and B. M. Terhal, “Quantum data Msep hiding,” IEEE Transactions on Information Theory, vol. 48, no. 3, pp. setting we have 580–598, 2002, arXiv:quant-ph/0103098. [10] D. P. DiVincenzo, P. Hayden, and B. M. Terhal, “Hiding quantum sep (ρUBC ρU ρBC) = data,” Foundations of Physics, vol. 33, no. 11, pp. 1629–1647, 2003, kM − ⊗ k1 arXiv:quant-ph/0207147. ⊗n n [11] P. Hayden, D. Leung, P. W. Shor, and A. Winter, “Randomizing quantum dU ( U(ψ(x))) I /d . (149) Msep N R − 1 states: Constructions and applications,” Communications in Mathemat- Z  ical Physics, vol. 250, no. 2, pp. 371–391, July 2004, arXiv:quant- Then consider that Proposition 1, together with (79), states ph/0307104. that [12] P. Hayden, D. Leung, and G. Smith, “Multiparty data hiding of quantum information,” Physical Review A, vol. 71, no. 6, p. 062339, June 2005, arXiv:quant-ph/0407152. sup pro−sep (ρUBC ρU ρBC ) 1 [13] S. Guha, P. Hayden, H. Krovi, S. Lloyd, C. Lupo, J. H. Shapiro, M kM − ⊗ k pro−sep M. Takeoka, and M. M. Wilde, “Quantum enigma machines and the O( δ log dn) , (150) locking capacity of a quantum channel,” Physical Review X, vol. 4, ≤ no. 1, p. 011016, January 2014, arXiv:1307.5368. where the sup is over projective separablep measurements. As [14] C. Lupo, M. M. Wilde, and S. Lloyd, “Robust quantum data locking from phase modulation,” Physical Review A, vol. 90, no. 2, p. 022326, noticed above, Proposition 1 is straightforwardly extended August 2014, arXiv:1311.5212. from projective separable measurements to separable quasi- [15] C. Lupo and S. Lloyd, “Quantum-locked key distribution at nearly the measurements, yielding classical capacity rate,” Physical Review Letters, vol. 113, no. 16, p. 160502, October 2014, arXiv:1406.4418. sup (ρ ρ ρ ) O( δ log s) . [16] ——, “Quantum data locking for high-rate private communication,” kM UBC − U ⊗ BC k1 ≤ New Journal of Physics, vol. 17, no. 3, p. 033022, March 2015, M∈Lsep(s,f) arXiv:1410.4748. p (151) [17] ——, “Continuous-variable quantum enigma machines for long-distance n n key distribution,” Physical Review A, vol. 92, no. 6, p. 062312, December Finally, using (148) with DB = dB, DC = dC , we obtain 2015, arXiv:1501.07212. [18] A. Winter, “Weak locking capacity of quantum channels can be much sup (ρUBC ρU ρBC ) 1 larger than private capacity,” Accepted in Journal of Cryptology, 2015, Msep kM − ⊗ k arXiv:1403.6361. 2n −s(η−1)2/(dn dn (2ln 2)) [19] J. Yard, P. Hayden, and I. Devetak, “Quantum broadcast channels,” IEEE O( δ log s)+4(dBdC ) e B C . Transactions on Information Theory, vol. 57, no. 10, pp. 7147–7162, ≤ (152) October 2011, arXiv:quant-ph/0603098. p [20] S. Guha, J. H. Shapiro, and B. I. Erkmen, “Classical capacity of Putting, for example, s = d2n and f =1/2, yields bosonic broadcast communication and a minimum output entropy con- jecture,” Physical Review A, vol. 76, no. 3, p. 032303, September 2007, sup (ρ ρ ρ ) arXiv:0706.3416. UBC U BC 1 [21] K. P. Seshadreesan, M. Takeoka, and M. M. Wilde, “Bounds on en- Msep kM − ⊗ k tanglement distillation and secret key agreement for quantum broadcast n d channels,” Accepted in IEEE Transactions on Information Theory, March O( δ log d2n)+4d2n exp . (153) ≤ −8 ln 2 2015, arXiv:1503.08139.   [22] C. H. Bennett, D. P. DiVincenzo, C. A. Fuchs, T. Mor, E. Rains, This result can thenp be used to extend the security to the case P. W. Shor, J. A. Smolin, and W. K. Wootters, “Quantum nonlocality of generic separable measurements by paying a small penalty without entanglement,” Physical Review A, vol. 59, no. 2, pp. 1070– 2n dn 1091, February 1999, arXiv:quant-ph/9804053. not larger than 4d exp 8ln2 . [23] R. Alicki and M. Fannes, “Continuity of quantum conditional informa- − tion,” Journal of Physics A: Mathematical and General, vol. 37, no. 5, REFERENCES pp. L55–L57, February 2004, arXiv:quant-ph/0312081. [24] A. S. Holevo, “Bounds for the quantity of information transmitted by a [1] J. S. Bell, “On the Einstein-Podolsky-Rosen paradox,” Physics, vol. 1, quantum communication channel,” Probl. Peredachi Inf., vol. 9, no. 3, pp. 195–200, 1964. pp. 3–11, 1973. [2] C. H. Bennett and G. Brassard, “: Public key [25] V. Giovannetti, S. Guha, S. Lloyd, L. Maccone, J. H. Shapiro, and distribution and coin tossing,” in Proceedings of IEEE International H. P. Yuen, “Classical capacity of the lossy bosonic channel: The exact Conference on Computers Systems and Signal Processing, Bangalore, solution,” Physical Review Letters, vol. 92, p. 027902, January 2004, India, December 1984, pp. 175–179. arXiv:quant-ph/0308012. [3] C. H. Bennett, G. Brassard, C. Cr´epeau, R. Jozsa, A. Peres, and W. K. [26] D. Perez-Garcia, M. M. Wolf, D. Petz, and M. B. Ruskai, “Contractivity Wootters, “Teleporting an unknown quantum state via dual classical and of positive and trace-preserving maps under lp norms,” Journal of Math- Einstein-Podolsky-Rosen channels,” Physical Review Letters, vol. 70, ematical Physics, vol. 47, no. 8, p. 083506, August 2006, arXiv:math- no. 13, pp. 1895–1899, March 1993. ph/0601063. 12

[27] M. M. Wilde, Quantum Information Theory. Cambridge University Press, 2013, arXiv:1106.1445. [28] M. Hayashi and H. Nagaoka, “General formulas for capacity of classical- quantum channels,” IEEE Transactions on Information Theory, vol. 49, no. 7, pp. 1753–1768, July 2003, arXiv:quant-ph/0206186. [29] A. Winter, “Coding theorem and strong converse for quantum channels,” IEEE Transactions on Information Theory, vol. 45, no. 7, pp. 2481– 2485, Nov. 1999, arXiv:1409.2536. [30] T. Ogawa and H. Nagaoka, “Making good codes for classical-quantum channel coding via quantum hypothesis testing,” IEEE Transactions on Information Theory, vol. 53, no. 6, pp. 2261–2266, June 2007, arXiv:quant-ph/9808063. [31] A. A. Fedotov, P. Harremoes, and F. Topsoe, “Refinements of Pinsker’s inequality,” IEEE Transactions on Information Theory, vol. 49, no. 6, pp. 1491–1498, June 2003. [32] F. Dupuis, J. Florjanczyk, P. Hayden, and D. Leung, “Locking classical information,” Proceedings of the Royal Society A, vol. 469, no. 2159, November 2013, arXiv:1011.1612. [33] A. Ambainis and A. Smith, “Small pseudo-random families of matrices: Derandomizing approximate quantum encryption,” Proceedings of RAN- DOM 2004, vol. LNCS 3122, pp. 249–260, August 2004, Cambridge, MA. arXiv:quant-ph/0404075. [34] I. Kerenidis and D. Nagaj, “On the optimality of quantum encryption schemes,” Journal of Mathematical Physics, vol. 47, no. 9, p. 092102, September 2006, arXiv:quant-ph/0509169. [35] P. A. Dickinson and A. Nayak, “Approximate randomization of quantum states with fewer bits of key,” AIP Conference Proceedings, vol. 864, pp. 18–36, March 2006, arXiv:quant-ph/0611033. [36] G. Aubrun, “On almost randomizing channels with a short Kraus decomposition,” Communications in Mathematical Physics, vol. 288, no. 3, pp. 1103–1116, June 2009, arXiv:0805.2900. [37] A. Maurer, “A bound on the deviation probability for sums of non- negative random variables,” Journal of Inequalities in Pure and Applied Mathematics, vol. 4, no. 1, p. 15, January 2003. [38] R. Ahlswede and A. Winter, “Strong converse for identification via quantum channels,” IEEE Transactions on Information Theory, vol. 48, no. 3, pp. 569–579, March 2002, arXiv:quant-ph/0012127. [39] A. W. Harrow, “The church of the symmetric subspace,” August 2013, arXiv:1308.6595.

Cosmo Lupo received the Ph.D. degree in Fundamental and Applied Physics from the University of Napoli “Federico II”. He has been a postdoctoral researcher at the University of Camerino and at the Massachusetts Institute of Technology. His research interests include quantum communication theory, quantum metrology, and .

Mark M. Wilde (M’99–SM’13) was born in Metairie, Louisiana, USA. He is an Assistant Professor in the Department of Physics and Astronomy and the Center for Computation and Technology at Louisiana State University. His current research interests are in quantum Shannon theory, quantum optical communication, quantum computational complexity theory, and .

Seth Lloyd is Nam P. Suh Professor of Mechanical Engineering and Professor of Physics at the Massachusetts Institute of Technology, and on the external faculty of the Santa Fe Institute. His work focuses on quantum information theory, including quantum communications, quantum algorithms, quantum metrology, and methods for building quantum computers.