Quantum information · Theory and numerical analysis
Prepare-and-measure quantum key distribution from a bound on information leakage
arXiv:2610.37296v1 ↗PDF ↗Submitted 27 October 2026
- Question
- Every key distribution protocol has to limit what escapes the users’ laboratories. In a prepare-and-measure protocol this cannot be strict, since the source must send out a signal that depends on Alice’s private input. The minimal assumption is therefore a bound on how much the emitted systems, intended signal and side channels together, reveal about the input. Can that single number replace a model of the source’s states, dimension and energy, with nothing assumed about Bob’s measurement device?
- Result
- Yes, against collective attacks. The leakage bound states that the optimal number of correctly guessed inputs, out of \(n\) sent once each, is at most \(G\), with \(G=2\) meaning one bit. Statistics reproducible by a classical message within the same bound certify no key. This rules out all two-state protocols such as B92, and all matched-basis protocols such as BB84 and the six-state protocol. Tilting Bob’s measurements restores security: four qubit protocols certify one secret bit per key round in the ideal case, through a self-test on a virtual entanglement-based twin. With noise, the best tolerates visibility 0.838 (8.1% bit error rate) and the loss thresholds are \(\eta\ge0.764\), about 1.2 dB. Numerically, the rates match the device-independent rates of the entanglement-based twins.
The paper in detail
Alice feeds an input \(x\in\{1,\ldots,n\}\) to a source that emits \(Q\), possibly correlated with a system \(E_0\) held by Eve. Eve applies an isometry and forwards \(B\) to Bob, who measures with an uncharacterised POVM. The leakage bound is \(P_{{\rm g},n}(\{\rho_x^{QE_0}\})=\max_{\{N_x\}}\sum_x\mathrm{Tr}(\rho_x N_x)\le G\), the expected number of inputs guessed when each is sent once, equivalently a one-shot accessible information \(\le\log_2G\). By semidefinite duality it is equivalent to the existence of an operator \(\sigma\ge\rho_x\) for all \(x\) with \(\mathrm{Tr}\,\sigma\le G\). Any states on a \(d\)-dimensional space satisfy it with \(G=d\), so a qubit source gives one bit, unless it is entangled with Eve, in which case dense coding can reach two.
Statistics \(p(b|x,y)\) are classical at bound \(G\) if \(p(b|x,y)=\sum_zp(z|x)p(b|z,y)\) with \(\sum_z\max_xp(z|x)\le G\). Then Eve can copy the message \(z\), after which Alice’s and Bob’s data are independent given Eve’s copy, so no protocol of any kind distils key. For two inputs, every quantum behaviour is classical. For BB84, the message \((0,r)\), \((1,r)\), \((r,0)\), \((r,1)\) for \(\ket0,\ket1,\ket+,\ket-\), with \(r\) a random bit, reproduces all statistics at \(G=2\). In the protocols that work, Bob measures \(Z\) and \((Z\pm X)/\sqrt2\): the prepare-and-measure CHSH value \(S=C_{1,2}+C_{1,3}+C_{2,2}-C_{2,3}\) obeys \(S\le\min\{G,4G-4\}\) classically and reaches \(2\sqrt2\) in the ideal case.
In the ideal case, perfect correlations in a key basis force \(\sigma=\rho_{(\theta,0)}+\rho_{(\theta,1)}\), so \(\sigma/2\) is a state with decompositions \(\tfrac12\rho_{(\theta,0)}+\tfrac12\rho_{(\theta,1)}=\tfrac12\rho_x+\tfrac12(\sigma-\rho_x)\). A purification of \(\sigma/2\) turns each decomposition into a measurement on an auxiliary system, giving a virtual entanglement-based protocol with the same key state. Its correlations reach the maximal CHSH value, which self-tests a maximally entangled pair and decouples Eve (Proposition 1). Imperfections are handled through \(G\): \(x\)-independent noise and any change within a qubit subspace leave \(G=2\) valid, multi-photon emission adds at most \((n-2)p_{\ge2}\), and a fidelity \(1-\epsilon\) of side-channel modes to an \(x\)-independent state adds at most \(n\sqrt\epsilon\) (Proposition 2); prior entanglement with Eve costs at most a factor \(\sqrt2\) more.
Key rates come from the Devetak–Winter bound with \(H(A|E\Theta)\) bounded by a projector-based variational formula for relative entropy, relaxed to semidefinite programs that keep only moments linear in the states. At \(v=\eta=1\) every protocol certifies at least 0.997 bits per key round. Visibility thresholds are 0.852, 0.838, 0.870 and 0.891 for the \((4,3)\), \((4,4)\), \((6,3)\) and \((3,3)\) protocols, against 11% bit error rate for BB84 with a trusted source. A plausible budget \(\delta G=0.02\) raises them by about 0.007. A single tilted test measurement is much worse (0.919 for BB84 plus one tilt). Extending the analysis to finite keys and general attacks is open.
Transferable methods
Leakage as an operator inequality, and a virtual entanglement-based protocol
Writing a bound on the guessing probability as the existence of \(\sigma\ge\rho_x\) with bounded trace turns the leakage assumption into constraints usable in moment relaxations. In the ideal case, \(\sigma/2\) is also a state whose purification simulates Alice’s preparations by measurements, reducing the prepare-and-measure protocol to an entanglement-based one.
Weak duality: for feasible \(\sigma\) and any POVM \(\{N_x\}\), \(\sum_x\mathrm{Tr}(\rho_xN_x)\le\sum_x\mathrm{Tr}(\sigma N_x)=\mathrm{Tr}\,\sigma\); Slater’s condition gives equality at the optimum. If Bob’s key measurement distinguishes \(\rho_{(\theta,0)}\) and \(\rho_{(\theta,1)}\) perfectly, then
\[2\ge\mathrm{Tr}\,\sigma=\sum_a\mathrm{Tr}(M_{a|\theta}\sigma)\ge\sum_a\mathrm{Tr}(M_{a|\theta}\rho_{(\theta,a)})=2,\] so every inequality is tight. \(\mathrm{Tr}(MP)=0\) for positive \(M,P\) implies \(MP=0\), which gives \(\sigma M_{a|\theta}=\rho_{(\theta,a)}\) and \(\sigma=\rho_{(\theta,0)}+\rho_{(\theta,1)}\). Each \(\sigma-\rho_x\) is then a state, and every equal-weight decomposition of \(\sigma/2\) is induced by a two-outcome measurement on a purifying system, so the observed correlators become \(\langle A_\theta B_y\rangle=C_{\theta,y}\) for virtual observables \(A_\theta\).
Editorial check: solving the guessing-probability SDP gives 2.000 for the four BB84 states. For Pauli operators applied to one half of \(\sqrt{1-\epsilon}\ket{00}+\sqrt\epsilon\ket{11}\), it gives \(P_{{\rm g},4}=1.9\) for the emitted qubit alone but 2.872 for qubit plus Eve’s half at \(\epsilon=0.05\) (and 1.6 against 3.6 at \(\epsilon=0.2\)), matching the paper’s \(2(1-\epsilon)\) and \(2+4\sqrt{\epsilon(1-\epsilon)}\). For side-channel states \(\sqrt{1-\epsilon}\ket\tau+\sqrt\epsilon\ket{e_x}\) attached to the BB84 states, it gives 2.282 at \(\epsilon=0.01\), equal to \(2+2\sqrt{\epsilon(2-\epsilon)}\), below the general bound \(2+4\sqrt\epsilon=2.4\).
How to reuse it
Any assumption of the form “the states are hard to distinguish” (guessing probability, accessible information, a dimension) can be imposed as \(\sigma\ge\rho_x\), \(\mathrm{Tr}\,\sigma\le G\), which is linear in the states and compatible with NPA-type hierarchies. When a protocol’s ideal statistics saturate the bound, the purification of \(\sigma/\mathrm{Tr}\,\sigma\) gives an entanglement-based twin, and device-independent self-testing results then transfer to the prepare-and-measure setting.
Copy-the-message attacks on classical models with bounded information
If the observed statistics could come from a classical message that carries no more information than the bound allows, Eve can copy that message without changing anything Bob sees. Necessary conditions for key are therefore linear inequalities over a polytope of classical models, the prepare-and-measure analogue of local models for Bell tests.
A classical model sends \(z\) with probability \(p(z|x)\), and its guessing value is \(\sum_z\max_xp(z|x)\), since the optimal guess reads \(z\) and outputs its likeliest input. For a matched-basis protocol with \(m\) measurements, send a string of \(m\) bits, all random except the one for the matching measurement, which is set to the outcome. Each input sends each of its \(2^{m-1}\) compatible strings with probability \(2^{-(m-1)}\), and each of the \(2^m\) strings contributes a maximum of \(2^{-(m-1)}\), so the guessing value is \(2^m\cdot2^{-(m-1)}=2\), exactly one bit. The honest source contains an orthogonal pair, so it needs \(G\ge2\) anyway: BB84 statistics are classical at every admissible bound.
For the tilted protocol, white noise of visibility \(v\) scales the CHSH value to \(2\sqrt2v\), so the behaviour becomes classical at \(G=2\) below \(v_{\rm cl}=1/\sqrt2\). This is a necessary threshold only; the key threshold is 0.852. Editorial check: solving the linear program over classical models with deterministic responses for the four BB84 preparations and three measurements gives the maximal classical \(S\) as 0.8, 1.333, 1.5, 2, 2.5 and 2.828 at \(G=1.2\), \(4/3\), 1.5, 2, 2.5 and \(2\sqrt2\), equal to \(\min\{G,4G-4\}\) in every case, while the qubit strategy gives \(2\sqrt2\).
How to reuse it
Before analysing a semi-device-independent protocol, test whether its ideal statistics admit a classical model within the assumed resource (dimension, energy, information). If they do, no proof can succeed, and the remedy is usually to add measurements that are not aligned with the preparation bases, the prepare-and-measure version of moving from BB84 to CHSH statistics.
Context & limitations
Why it matters. One declared number covers multi-photon emission, mode mismatch and Trojan-horse light. Imperfections that keep the emission in a qubit space cost nothing, and fidelity bounds convert into explicit relaxations of \(G\). The receiver can be untrusted, as in device-independent QKD, but without a loophole-free Bell test, and the certified key matches what a device-independent analysis of the same statistics would give.
Limitations. Security is proved against collective attacks in the asymptotic limit; finite-size effects are not treated. The bound \(G\) must come from a trusted physical characterisation of the source and cannot be checked from the data. Side channels enter as \(n\sqrt\epsilon\), so they must be characterised precisely. Loss tolerance is poor, as for device-independent protocols. Key rates are certified lower bounds from semidefinite relaxations, computed only for qubit protocols.