{'fraction_non_alphanumeric': 0.047509051293392966, 'fraction_numerical': 0.019855506954342163, 'mean_word_length': 3.908886208283072, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 34, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Secure Lossy Source Coding for Some Classes of Helper and Gray-Wyner Models

In this work, we investigate two source coding models, a \emph{Helper} problem and a \emph{Gray-Wyner} problem, under equivocation constraints. Specifically, in the Helper problem, an encoder communicates with a legitimate receiver through noise-free rate-limited public and private links; and an external passive eavesdropper intercepts every information that is sent on the public link. We study two classes of this model: i) when a pair of arbitrarily correlated discrete memoryless sources is to be encoded such that one component has to be recovered lossily at the legitimate receiver while the equivocation about both components at the eavesdropper must be maintained no smaller than some prescribed level; and ii) when the legitimate receiver reproduces both components, one of which, that is recovered losslessly, has to be concealed from the eavesdropper to some equivocation level. For both classes problems, we establish single-letter characterizations of optimal rate-distortion-equivocation tradeoffs in the discrete memoryless case. Next, we extend our results to the case of two legitimate receivers, i.e., Gray-Wyner network with equivocation constraints. Here, two legitimate receivers are connected to the encoder each through a dedicated error-free private link as well as a common error-free public link; and an external passive eavesdropper overhears on the public link. We study two classes of this model that are extensions of the aforementioned instances of Helper problems to the case of two receivers. For each of the two classes, we establish a single-letter characterization of the optimal rate-distortion-equivocation region. Throughout the paper, the analysis sheds light on the role of the private links, and we illustrate the results by computing them for some binary examples. Also, we make some meaningful connections, e.g., with problems of secret-sharing and encryption.

and numerous extensions of these works to vector wiretap channels [3]- [6] as well as various multiterminal settings such as the multiple access wiretap channel [7]- [10], the relay channel [11], the interference channel [12] and X networks [13], [14] (the reader may refer to [15] for a review of many other related contributions). Secrecy-oriented source coding models, however, have attracted less interest comparatively, and are way less well understood in general. Perhaps, this is due to the source-channel coding separation which is often applied, though generally suboptimal; or the folklore interpretation that information secrecy is generally facilitated by injecting additional "noise" on the channels to eavesdroppers.
One important source coding model with secrecy constraints, which was studied by Yamamoto in [16], is shown in Figure 1. In this model, an encoder observes a pair of arbitrarily correlated discretememoryless (DM) sources (S n 1 , S n 2 ), and communicates with a receiver over a noise-free rate-limited public communication channel of capacity R. An external eavesdropper intercepts all information on the public link. The goal of the communication is to allow the legitimate receiver to reproduce the source component S n 1 lossily, i.e., to within some desired average fidelity level D, while maintaining the equivocation at the eavesdropper about the source component S n 2 no smaller than some prescribed level ∆. Yamamoto characterized in [16] the region of optimal tradeoff among compression ratio R, average distortion D and equivocation ∆. From a practical viewpoint, the model of Figure 1 can be useful to model scenarios in which some critical information (e.g., medical information about a patient) or specific feature of a source needs to be kept secret from adversarial interceptions. In Yamamoto's setting, since the entire information that is transmitted to the legitimate receiver gets intercepted by the eavesdropper, perfect secrecy sometimes comes at the price of no transmission at all (e.g., think about the case in which S n 1 = S n 2 = S n and S n is to be recovered losslessly at the legitimate receiver). In this work, we investigate two related models in which legitimate receivers also have dedicated links on which they communicate with the encoder, and that cannot be intercepted by the eavesdropper. This is in accordance with the observation that secrecy is generally obtained by creating some advantage for legitimate receivers over eavesdroppers or adversaries. Specifically, we study a Helper problem and a Gray-Wyner model, both with equivocation constraints. The two models are described in the following two sections, together with our main contributions for each of them.

A. Helper Model and Contributions
Consider the model shown in Figure 2. In this model, an encoder observes a pair of arbitrarily correlated memoryless sources (S n 0 , S n 1 ) and communicates with a legitimate receiver through a noise-free rate-limited public link as well as a noise-free rate-limited private link, in the presence of an external passive eavesdropper which intercepts every information that is sent on the public link. For convenience, and with some abuse in the terminology, we interpret the transmission on the private link as being enabled by a Helper node that observes the same sources and whose role is to facilitate the communication between the legitimate transmitter-receiver pair. (Formally, this is then an instance of the more general Helper problem in which the helper node observes a distinct, possibly correlated, source).
We study two classes of this model. In the first class, shown in Figure 2a, the communication should allow the legitimate receiver to reproduce only the source component S n 1 lossily, to within some desired average distortion D 1 , while maintaining the equivocation at the eavesdropper about both sources (S n 0 , S n 1 ) no smaller than some prescribed level ∆. In this model, the encoder sends descriptions of the pair (S n 0 , S n 1 ) on both links. Let R denote the rate of the compression index (or message) that the encoder sends on the public link, and R 1 that on the private link. Depending on the values of D 1 and ∆, the communication strikes a good balance among revealing enough information to the legitimate receiver using both links and leaking only minimum information to the eavesdropper on the public link (about the sources themselves, not the compression indices).
In the second class, shown in Figure 2b, the legitimate receiver wants to reproduce both sources -the source component S n 0 is reconstructed in a lossless manner and the source component S n 1 is reconstructed in a lossy manner, to within some average distortion D 1 . However, in this model, only the source S n 0 represents sensitive information, and the communication is required to maintain the equivocation about it at the eavesdropper bounded from below by some prescribed level ∆. 1 that leak only minimum information about S n 0 can still be transmitted on the public link. However, in the investigation of both models, equally important is the understanding of the role of the private link. We will show that the two models require different ways of using this link optimally. In fact, by January 13, 2017 DRAFT opposition to Yamamoto's setting of Figure 1, the presence of this link in the models that we study makes the derivation of optimal results (in terms of rate-distortion-equivocation) rather challenging.
For both classes of Helper problems, we establish single-letter characterizations of optimal ratedistortion-equivocation tradeoffs in the discrete memoryless case. For the model of Figure 2a, the optimal coding scheme is one in which the encoder sends a description of the pair (S n 0 , S n 1 ) on the public link, which is then utilized as side information at both encoder and decoder to send another description of (S n 0 , S n 1 ) on the private link. It is important to note that, in doing so, although the source component S n 0 is not required by the legitimate receiver and is to be kept secret (to some level) at the eavesdropper, the description that is sent on the public link is arbitrarily correlated with S n 0 , an aspect that appears also in Yamamoto's optimal coding [16,Theorem 1] for the model of Figure 1 and is useful to enabling smaller equivocations at the eavesdropper.
For the model of Figure 2b, an optimal coding scheme is one in which the encoder describes the entire S n 0 through the private link and uses the remaining of the capacity of this link, as well as the public link, to describe the source component S n 1 to the legitimate receiver. In doing so, it takes into account S n 0 as side information that is available at both encoder and decoder. Recalling that the source S n 1 is arbitrarily correlated with the source S n 0 which is to be kept secret from the eavesdropper, the analysis of the equivocation of this scheme requires showing that the compression index of S n 1 that is sent on the public link leaks no information about S n 0 , which we prove through a here established new counting lemma. Furthermore, we establish some meaningful connections with the problem of secretsharing and encryption, by showing that the private link can be utilized optimally in, essentially, two different ways, i) revealing the part of the sources that is to be kept secret to the legitimate receiver, or ii) enabling the encoder and legitimate receiver to share a common secret key which they then utilize to encrypt the part of the source that is to be secured on the public link, using a one time-pad approach which is reminiscent of encryption in conventional cryptosystems [17]. Finally, for both classes of models, we illustrate the results by computing the established regions for some binary examples.

B. Gray-Wyner Model and Contributions
Next, we study generalizations of the aforementioned models to the case of two legitimate receivers, i.e., a Gray-Wyner network [18] with equivocation constraints, as shown in Figure 3. Here, the transmitter communicates with two legitimate receivers, each over a dedicated noise-free ratelimited private link as well as a common noise-free rate-limited public link; while an external passive eavesdropper overhears the public link. We study two classes of models. In the first class, shown in Figure 3a, the encoder observes a pair of arbitrarily correlated memoryless sources (S n 1 , S n 2 ) and wishes to describe the source S n 1 to the first receiver and the source S n 2 to the second receiver. Both reconstructions are performed in a lossy manner, to within some desired average distortions D 1 and D 2 respectively; and the communication should maintain the equivocation at the eavesdropper about both sources no smaller than some prescribed level ∆. In this model, the imposed secrecy constraint may lead (depending on the value of ∆) to rate redundancy on the private links; and the communication should strike a good balance among the compression rate R 1 on the private link to the first receiver, the compression rate R 2 on the private link to the second receiver, the compression rate R on the public link, the desired distortion pair (D 1 , D 2 ) and the prescribed equivocation level ∆.
In the second class of the models that we study, shown in Figure 3b, we introduce a third source component, S n 0 , that may represent the common information between S n 1 and S n 2 -the source triple (S n 0 , S n 1 , S n 2 ) are arbitrarily correlated, however, and S n 1 and S n 2 need not be independent conditionally on S n 0 . Also, we restrict the secrecy constraint to be only about S n 0 . Specifically, both receivers want to reproduce S n 0 in a lossless manner; and the equivocation at the eavesdropper about this component should be no smaller than some desired level ∆. In addition, Receiver 1 wants to reconstruct the source S n 1 lossily to within average distortion D 1 , and the second receiver wants to reconstruct the source S n 2 lossily to within average distortion D 2 . Recalling that for the original Gray-Wyner network without secrecy constraints [18] optimal coding necessitates that the source component S n 0 , and also any common information of the sources S n 1 and S n 2 conditionally on S n 0 , should be transmitted on the public link, it is clear that the imposed secrecy constraint changes drastically the problem. In fact, depending on the desired equivocation level, there is a tension among saving rate by sending S n 0 on the public link and revealing only minimum information about it to the eavesdropper. For both classes of Gray-Wyner problems, we establish single-letter characterizations of optimal rate-distortion-equivocation tradeoffs in the discrete memoryless case. For the model of Figure 3b, perhaps non-intuitively, the analysis shows that the price of the imposed secrecy constraint is to send the source component S n 0 on both private links, even though this entails some rate redundancy that otherwise could be saved if there were no eavesdropper.
The models of Figure 2 and of Figure 3 may be useful to model communication scenarios in which adversaries cannot intercept data on certain communication resources, e.g., time or frequency bands. For example, in the context of on-line caching, caching phases may be designed by the system operator on resources (time, frequency, code) that users cannot know apriori. Conversely, delivery phases usually happen during large traffic periods; and, so, transmission during this phase is more likely to be intercepted comparatively. Another driving problem, of interest in this setting, is a sensor network setting in which multiple sensors observe an underlying phenomenon that needs to be reconstructed at some access point. While some of the network connections may be secured (possibly wired), others might be wireless and so subjected to eavesdropping.

C. Related Work
Most related to this contribution are works on secure transmission from a source coding perspective.
A pioneering line of work in this aspect targets exploiting correlation among observations or sources at multiple terminals to generate secret common randomness which then may be utilized to encrypt data that is independent from the observations. The reader may refer to Maurer [19], Ahlswede-Csiszár [20] and Csiszár-Narayan [21] seminal papers for more on this line of work. In [22], Prabhakaran and Ramchandran study a setup in which the correlated observations or sources are themselves the data that needs to be communicated. Specifically, they study a Slepian-Wolf setting [23] in the presence of an eavesdropper with a correlated observation in which the goal is to convey the transmitter's source observation losslessly to the receiver while revealing the least amount of information about it to an eavesdropper that overhears the transmission. They characterize the optimal (minimum) leakage rate in this case. Perhaps of some importance is the observation, revealed therein through a simple example, that, unlike the setting without secrecy constraints, i.e., the standard Slepian-Wolf model [23], knowledge of decoder's side information at the transmitter is generally beneficial to enable higher equivocation at the eavesdropper. Also, Prabhakaran and Ramchandran consider a variation of the model in which the transmitter and receiver are allowed to interact over multiple rounds and they establish a lower bound on the leakage rate through connection with secret-sharing. In [22], no communication rate constraints are imposed on the sources. In [24] (see also [25]), Gunduz et al. study a related setting in which communication rate constraints are put on the sources. They consider both cases of coded and non-coded side information at the legitimate receiver. In the case of uncoded side information at the legitimate receiver, a complete characterization of the rate-equivocation region is established; and in the case of coded side information, bounds on this region, that do not match in general, are provided. In [26], Tandon et al. study a secure lossless source coding problem with a rate-limited Helper. In this work, they also consider a variation of the model in which the encoder has access to the coded output of the Helper. For both cases, they characterize the optimal rateequivocation region. Other related works can be found in [27]- [30].

D. Outline and Notation
An outline of the remainder of this paper is as follows. Section II is dedicated to the Helper models with equivocation constraints of Figure 2. After some formal definitions of the studied system models in Section II-A, we characterize the associated optimal rate-distortion equivocation regions in subsection II-B and subsection II-C respectively. Section III is devoted to the Gray-Wyner models with equivocation constraints of Figure 3. We define the two models formally in Section III-A, and then we characterize the associated rate-distortion-equivocation regions in Section III-B and Section III-C respectively. Sections II and III also contain some binary examples, as well as some useful discussions.
The proofs are relegated to the appendices.
Throughout the paper we use the following notations. The term p.m.f. stands for probability mass function. Upper case letters are used to denote random variables, e.g., X; lower case letters are used to denote realizations of random variables, e.g., x; and calligraphic letters designate alphabets, i.e., X. Vectors of length n are denoted by X n = (X 1 , . . . , X n ), and X j i is used to denote the sequence (X i , . . . , X j ). The probability distribution of a random variable X is denoted by P X (x) P(X = x).
Sometimes, for convenience, we write it as P X . We use the notation E X [·] to denote the expectation of random variable X. A probability distribution of a random variable Y given X is denoted by P Y|X .
The set of probability distributions defined on an alphabet X is denoted by P(X). The cardinality of a set X is denoted by X . For random variables X, Y and Z, the notation X − − Y − − Z indicates that X, Y and Z, in this order, form a Markov Chain, i.e., P XYZ (x, y, z) = P Y (y)P X|Y (x|y)P Z|Y (z|y). The set T (n) [X] denotes the set of sequences strongly typical with respect to the probability distribution P X and the set T (n) [X|y n ] denotes the set of sequences x n jointly typical with y n with respect to the joint p.m.f. P XY . Throughout this paper, we use h 2 (α) to denote the entropy of a Bernoulli (α) source, i.e., . Also, the indicator function is denoted by 1(·). For real-valued scalars a and b, with a ≤ b, the notation [a, b] means the set of reals that are larger or equal than a and smaller or equal b. For integers i ≤ j, [i : j] denotes the set of integers comprised between i and j, i.e., [i : j] = {i, i + 1, . . . , j}. Finally, throughout the paper, logarithms are taken to base 2.

II. Secure Lossy Helper Problems
In this section, we study the model of Figure 2. It is assumed that the alphabets S 0 , S 1 and S 2 are finite.

A. System Models and Definitions
Consider the two classes of Helper problems with equivocations constraints shown in Figure 2. For brevity, we provide full formal definitions for the model of Figure 2a; and only outline the differences for the model of Figure 2b.
The lossy Helper problem with equivocation constraint of Figure 2a is defined by a source alphabet (S 0 , S 1 ), a joint input p.m.f. P S 0 ,S 1 , a reconstruction alphabetŜ 1 and a distortion measure defined as: (1) iii) A decoding functions g defined as:

(4)
The average distortion and equivocation of a code are defined respectively as A rate-distortion-equivocation quadruple (R, R 1 , D 1 , ∆) is said to be achievable if there exists a sequence of (n, M n , M 1,n ) codes such that lim sup The rate-distortion-equivocation region is the set of all achievable quadruples (R, R 1 , D 1 , ∆).
A rate-distortion-equivocation quadruple (R, R 1 , D, ∆) is said to be achievable if, similarly, (5a)-(5c) are satisfied, along with a distinct equivocation constraint lim inf and where the probability of error, defined as is such that

B. Helper Model with Equivocation on Both Sources
Consider the Helper problem with equivocation constraint imposed on both sources of Figure 2a. In what follows, we provide a single-letter characterization of the optimal rate-distortion-equivocation region of this model, discuss the role of the private link and illustrate the result through a binary example.
The following theorem states the optimal rate-distortion-equivocation region of the model of Figure 2a.

Proof.
A detailed proof of the direct part, as well as of the converse part, of Theorem 1 are reported in Appendix A. Hereafter, we provide a brief outline of the achievability proof. The encoder finds a description U n that is strongly jointly typical with the pair (S n 0 , S n 1 ) and transmits it on the public link. It can do so as long as n is large and R ≥ I(U; S 0 , S 1 ). Then, accounting for that this description U n is available as a side information sequence at both encoder and decoder, it finds another descriptionŜ n 1 (superimposed on U n ) that is strongly jointly typical with (S n 0 , S n 1 ) conditionally on U n , and transmits it on the private link. Again, it can do so as long as n is large and R 1 ≥ I(Ŝ 1 ; S 0 , S 1 |U). The analysis of the equivocation of this scheme, detailed in Appendix A, shows that it is given by the conditional entropy H(S 0 , S 1 |U).
The following corollary specializes the result of Theorem 1 to the case of lossless reconstruction of the source S n 1 at the legitimate receiver.
Proof. The proof of Corollary 1 appears in Appendix B.

Remark 1.
Although the legitimate receiver requires only the source component S n 1 in the model of Figure 2a, and the source component S n 0 is to be kept secret (to some level) from the eavesdropper, the description U n that is sent on the public link depends not only on S n 1 but also on S n 0 (the a.r.v. U is arbitrarily correlated with (S 0 , S 1 ) in Theorem 1). This aspect, which appears here only due to the imposed equivocation constraint, is reminiscent of Yamamoto's result [16] that a strictly smaller equivocation level is achieved if the encoder does not observe the source S n 2 to keep secret in the model of Figure 1.

Remark 2.
Investigating the proof of Corollary 1 in Appendix B it can be noted that the optimal choice of the auxiliary random variable U in Theorem 1 satisfies the Markov chain U − − S 1 − − S 0 . This means that by opposition to the lossy case, encoder side information S n 0 does not enable strictly higher equivocation levels at the eavesdropper in the case of lossless reconstruction of the source S n 1 .
Remark 3. The model of Figure 1, in the case in which S 2 = (S 0 , S 1 ), can be obtained as a special case of that of Figure 2a by setting R 1 = 0. Thus, in this case, the result of Theorem 1 generalizes that of [16,Theorem 1] to the case in which the legitimate receiver also has a noise-free rate-limited private link.

Remark 4.
In [26], Tandon et al. study a model in which an encoder transmits a memoryless source X n to the legitimate receiver losslessly, over a noise-free rate-limited public link on which listens an external passive eavesdropper. The receiver is assisted with a rate-limited helper that observes an arbitrarily correlated source Y n . They characterize the optimal rate-equivocation region of this model. In the case in which the encoder and helper observe the same source, our result of Theorem 1 generalizes that of [26] to the lossy reproduction setting.
The following corollary specializes the result of Theorem 1 to the case of a single source, i.e.,

Corollary 2 (Single Source).
In the case of one source, i.e., S 0 = S 1 = S in the model of Figure 2a, the rate-distortion-equivocation region is given by the set of quadruples (R, R 1 , D, ∆) such that for some joint distribution P USŜ that satisfies Ed 1 (S,Ŝ) ≤ D 1 . In the case of lossless reconstruction of the source S n , the rate-equivocation region of Corollary 2 can also be obtained from Corollary 1 by setting S 0 = S 1 = S therein. As expected in this case, in order to guarantee full equivocation at the eavesdropper, i.e., ∆ = H(S), information has to transit through the private link which then should have capacity no smaller than H(S) -the public link can carry independent information, but not any useful information about S. (A useful connection with secret-sharing and encryption based schemes, in which even the public link can carry an encrypted version of the source, will be made in the next section). In the case in which R 1 < H(S), perfect secrecy is not possible, and the equivocation at the eavesdropper is given by the amount of information that it does not intercept, i.e., R 1 precisely.

C. Helper Model with Reproduction of Both Sources
Consider the Helper problem of Figure 2b, with the equivocation constraint ∆ imposed only on the source component S n 0 and the legitimate receiver reproducing the source S n 0 losslessly and the source S n 1 lossily, to within average distortion D 1 . As it will become apparent from the discussion that will follow, the analysis of this model is less easy than that of the model of Figure for some conditional PŜ 1 |S 0 ,S 1 that satisfies Ed 1 (S 1 ,Ŝ 1 ) ≤ D 1 .
Proof. Detailed proofs of the direct and converse parts of Theorem 2 appear in Appendix C. Hereafter we provide a brief outline of the proof of achievability. The encoder uses both private and public links to describe the source S n 0 losslessly to the legitimate receiver. In doing so, the rate splitting of the required H(S 0 ) bits per sample among the two links is dictated by desired level of equivocation ∆ about the source S n 0 at the eavesdropper. Then, conditioned on S n 0 , the encoder describes the source S n 1 through both private and common links, accounting for S n 0 as a side information sequence that is available at both encoder and decoder. More specifically, the coding scheme that we use for the proof of Theorem 2 uses a careful combination of binning and rate-splitting. Let R 1 = R 1,1 + R 1,0 and R = R 0,0 + R 0,1 . Assign the set of typical S n 0 's to 2 n(R 0,0 +R 1,0 ) bins indexed with w 0,0 = 1, . . . , 2 nR 0,0 and w 1,0 = 1, . . . , 2 nR 1,0 . For every typical S n 0 , generate 2 n(R 1,1 +R 0,1 ) independent sequencesŜ n 1 (w 1,1 , w 0,1 ), each i.i.d. according to the product of PŜ 1 |S 0 , indexed with w 1,1 = 1, . . . , 2 nR 1,1 and w 0,1 = 1, . . . , 2 nR 0,1 . For every typical pair (S n 0 , S n 1 ), the encoder finds the indices (w 0,0 , w 1,0 ) of the bin in which lies S n 0 , and then finds a pair (w 1,1 , w 0,1 ) such thatŜ n (w 1,1 , w 0,1 ) is strongly jointly typical with S n 1 conditionally on S n 0 . It can do so as long as n is large, R 0,0 + R 1,0 ≥ H(S 0 ) and R 1,1 + R 0,1 ≥ I(Ŝ 1 ; S 1 |S 0 ). Next, the encoder transmits the indices w 0,0 and w 0,1 on the public link and the indices w 1,0 and w 1,1 on the private link. A block diagram of the indices and their transmission on the public and private links is shown in Figure 5. The legitimate receiver first recovers S n 0 and then reconstructs the description of S n 1 asŜ n 1 (w 1,1 , w 0,1 ). Recalling that the source S n 1 is arbitrarily correlated with the source S n 0 which to be kept secret to within equivocation level ∆ at the eavesdropper, the analysis of the equivocation of this scheme requires showing that the compression index w 0,1 of S n 1 that is sent on the public link leaks no additional information about S n 0 beyond what the transmission of the index w 0,0 of S n 0 on the public link leaks about this source, which we prove through a here established new counting lemma (see Lemma 1 in Appendix C or a different proof of a similar result in [31]). is achievable with perfect secrecy if and only if The following remarks help understanding better the result of Theorem 2. They also provide some useful connections with secret-sharing and encryption-based schemes, as well as results from related previous work.

Remark 5.
In the case of a single source S n 0 that is to be conveyed losslessly to the legitimate receiver and kept secret from the eavesdropper, i.e., S 1 = ∅ or, equivalently, D 1 = ∞, the result of Theorem 2 reduces, under perfect secrecy ,i.e. ∆ = H(S 0 ), to R 1 ≥ H(S 0 ), which is consistent with the observation that, in this case, secure transmission is possible only through the private link which then should have its capacity no smaller than H(S 0 ) in order for the encoder to describe S n 0 losslessly to the legitimate receiver. The result in this specific case can also be inferred from [26] and [27]. Also, without the secrecy constraint, i.e. ∆ = 0, the model of the rate region, which is symmetric in R and R 1 in this case, is described by the single constraint (15b).

Remark 6.
By opposition to the model of Figure 2a in which the constraint of perfect secrecy precludes the usage of the public link, for the model of Figure 2b this link can still be utilized, e.g., to transmit a description of the part of S n 1 that is not correlated with S n 0 (i.e., the innovation of S n 1 relative to S n 0 or S n 1 conditionally on S n 0 ). Recalling that the associated compression index can be shown to be independent of the source S n 0 (see Lemma 1 in Appendix C, or an alternate proof in [31, Section III]), this leaks no additional information about S n 0 to the eavesdropper as we already mentioned in the outline proof of achievability.

Remark 7.
In the above outlined coding scheme of Theorem 2, the uncertainty at the eavesdropper is induced only through appropriate binning. For instance, no encryption is utilized. The reader may wonder whether alternate coding schemes that rely on encryption and/or secret-sharing can be employed, since some common randomness can be shared through the private link and then utilized for the transmission on the public link.
In the next section we develop a coding scheme that is equally optimal and is based on secret-sharing and encryption. For example, in the case of perfect secrecy, i.e., ∆ = H(S 0 ), for coding schemes without encryption or secret sharing the constraint R 1 ≥ H(S 0 ) of the converse part of Corollary 3 simply means that the source S n 0 that is to be kept secret should be sent entirely only through the private link (so as not to be intercepted by the eavesdropper). Alternatively, for coding schemes that are based on encryption or secret sharing, this constraint expresses the fact that, for the source S n 0 to be transmitted directly over the public link without leaking any information about it to the eavesdropper, the key utilized for its encryption or that shared through secret-sharing approaches should be at least H(S 0 ) bits long.
2) Alternate Coding Scheme: Secret-Sharing and Encryption: In this section, we develop an alternate optimal coding scheme for the Helper model with equivocation constraint of Figure 2b. By opposition to the scheme of Theorem 2, this scheme utilizes the private link as a means of sharing secret between the transmitter and the legitimate receiver, in the form of all or part of the source S n 1 . The shared secret is then utilized as a key to encrypt all or part of the source S n 0 , depending on the desired level of equivocation and transmit it directly over the public link. The result is stated in the following theorem. Proof. A formal proof of Theorem 3 is given in Appendix E. The coding scheme is similar to that of Theorem 2; and so, hereafter, we only outline the main steps of it. Recall the rate splitting and the binning used in the coding scheme of Theorem 2. Also, recall the following important two elements therein: i) the index w 1,1 , which together with w 0,1 identify the sequenceŜ n 1 (w 1,1 , w 0,1 ) that is found jointly typical with S n 1 conditionally on S n 0 , is transmitted over the private link; and ii) the index w 1,0 , which together with w 0,0 identify the bin in which lies the source S n 0 , is transmitted over the private link. In the coding scheme that we use to show Theorem 3, the legitimate transmitter-receiver pair use the index w 1,1 of the description of the source S n 1 as a secret-key. Specifically, the encoder encrypts the message w 1,0 by taking the bit-wise modulo-2 sum of the binary expansion of w 1,0 and w 1,1 ; and transmits it over the public link. If the rate of the message w 1,1 that is utilized as a secret key does not suffice to encrypt all of w 1,0 , only part of the latter is encrypted.
3) Binary Example: Consider the Helper model with equivocation constraint of Figure 2b. Let Also, assume a Hamming distortion measure d H . In this case, it is easy to see that where the minimum is achieved with the choice of the test channelŜ 1 Bernoulli random variable with parameter p−2D 1 2p−1 . Thus, for this binary example, Theorem 2 reduces to the set of quadruples (R, R 1 , D 1 , ∆) that satisfy R secret : This region is shown in Figure 6 where we project over all possible equivocation levels. For comparison reasons, the figure also shows the rate-distortion region of this example if there were no secrecy constraint, i.e., the region defined by The shaded region in the figure delimits the region in which perfectly secure transmission is not possible.

D. Digression
Consider again the Helper model with equivocation constraint of Figure 2. A more general setting, not treated in this paper, is one in which the role of the encoder is to convey (only) the source component S n 1 to the legitimate receiver lossily, i.e., to within some desired fidelity level D 1 , while maintaining the equivocation about (only) the source component S n 0 at the eavesdropper no smaller than some prescribed level ∆. This problem was solved by Yamamoto in [16] in the specific case in which there is no private link to the legitimate receiver, i.e., R 1 = 0. However, solving it in the general case seems to hinge upon characterizing the common information [33], [34] of the two dependent random variables S 0 and S 1 . To see this, consider for example the case of perfect secrecy and lossless reconstruction, i.e., D 1 = 0 and ∆ = H(S 0 ). In this case, intuitively, every information that S 1 can give about S 0 should not be transmitted over the public link, so as not to be intercepted by the eavesdropper.

III. Secure Lossy Gray-Wyner Problems
In this section, we study the Gray-Wyner model of Figure 3. It is assumed that the alphabets S 0 , S 1 and S 2 are finite.

A. System Models and Definitions
Consider the two classes of Gray-Wyner problems with equivocations constraints shown in Figure 3.
For convenience, first we provide full formal definitions for the model of Figure 3b; and then only highlight the differences for the model of Figure 3a.
The lossy Gray-Wyner problem of Figure 3b is defined by a product source alphabet S 0 × S 1 × S 2 , a joint input p.m.f. P S 0 ,S 1 ,S 2 , a reconstruction product alphabetŜ 1 ×Ŝ 2 and two distortion measures defined, for j = 1, 2, as and, for j = 1, 2, iii) Two decoding functions g 1 and g 2 defined, for j = 1, 2, as The average distortions and equivocation achieved by such a code are given by 2 (S n 2 ,Ŝ n 2 ) and 1 n H(S n 0 |W) ; (24) and the probability of error about the source S n 0 is defined as A rate-distortion-equivocation tuple (R, R 1 , R 2 , D 1 , D 2 , ∆) is said to be achievable for the model of Figure 3b if there exists a sequence of codes (n, M n , M 1,n , M 2,n ) such that lim sup lim sup lim inf The rate-distortion-equivocation region for the model of Figure 3b is the set of all achievable tuples (R, R 1 , R 2 , D 1 , D 2 , ∆).
lim sup lim inf The rate-distortion-equivocation region for the model of Figure 3a is the set of all achievable tuples (R, R 1 , R 2 , D 1 , D 2 , ∆).

B. Gray-Wyner Model with Equivocation on Both Sources
Consider the lossy Gray-Wyner model with equivocation constraint imposed on both sources of Figure 3a. In what follows, we provide a single-letter characterization of the region of optimal tradeoffs among rate triples (R, R 1 , R 2 ), average distortion pairs (D 1 , D 2 ) and equivocation level ∆. Also, we discuss the implications of the imposed secrecy constraint on Gray-Wyner's original network [18], and illustrate the result through a binary example.

1) Rate-Distortion-Equivocation Region:
The following theorem states the optimal rate-distortionequivocation region of the Gray-Wyner model of Figure 3a. .
Proof. A detailed proof of Theorem 4 appears in Appendix F. In this case, the encoder should send no information on the common link, even if the two sources are correlated and/or exhibit some "common information". In the extreme case in which S 1 = S 2 = S, a full description of S is sent twice, on the two private links, even if this entails some redundancy which could be saved had there been no secrecy constraint.
Without an equivocation constraint, i.e. ∆ = 0, the optimal rate region is obtained by specializing the result of [18, Theorem 1] to this binary example. However, the optimal choice of the auxiliary random variable involved in [18, Theorem 1] is still not known in general for the binary sources case; and the best explicit inner bound on the region (R, R 1 ), also provided in [18], is shown in Figure 7 G : and correspond respectively to the following choices of the auxiliary random variable U, U = U A (S 1 , S 2 ), U = U B ∅, U = U F is obtained through time-sharing between U = S 1 and U = S 2 , and Conversely, in the case of perfect secrecy, i.e., ∆ = H(S 1 , S 2 ) = 1 + h 2 (p), it is easy to see that, for this binary example and under the constraint that R 1 = R 2 , the region of Theorem 4 reduces the set of rates satisfying Thus, in this case, it is optimal to transmit the source S n 1 entirely on the first private link and the source S n 2 entirely on the second private link; and not use the public link at all. Observe that this incurs some rate-redundancy, which is reflected, e.g., through the inequality R + 2R 1 = 2 > H(S 1 , S 2 ).
Furthermore, observe that the transmit strategies described by U F and U G yield levels of equivocation given respectively by h 2 (p) and 2h 2 (p 1 ). The associated rate-equivocation points are represented in Figure 7 respectively as the pointsF andG with coordinates

C. Gray-Wyner Model with Reproduction of Both Sources
Consider now the Gray-Wyner model with equivocation constraint of Figure 3b, in which the legitimate receivers also reproduce the source S n 0 losslessly and the secrecy constraint is imposed only on S n 0 . As we already mentioned, the component S n 0 here may represent, e.g., some common information of the sources S n 1 and S n 2 -the sources S n 1 and S n 2 need not be independent conditionally on S n 0 , however. Recalling that in the original Gray-Wyner network without secrecy constraints [18], the common component of the sources that are to be conveyed the two receivers should be transmitted over the common link, the imposed secrecy constraint creates a tension among reducing rate by sending S n 0 on the common public link and concealing it from the eavesdropper that overhears on this link.  is achievable if and only if: for some joint distribution P U,S 0 ,S 1 ,S 2 ,Ŝ 1 ,Ŝ 2 that satisfies Proof. The proof of Theorem 5 appears in Appendix G. Hereafter, we provide a brief outline of the proof of achievability. The encoder generates a lossless description of the source component S n 0 , with rate H(S 0 ), and uses rate splitting to transmit it on both private and common links -the rate of the part of S n 0 that is transmitted on the public link is chosen so as to leak (H(S 0 )−∆) bits per sample about S n 0 to the eavesdropper. Superimposed on this description, the encoder generates a description U n of the pair (S n 1 , S n 2 ) that it transmits only on the public link. Also, superimposed on both descriptions, it sends a private descriptionŜ n 1 of the pair (S n 1 , S n 2 ) on the private link to the first legitimate receiver, and a private descriptionŜ n 2 of the pair (S n 1 , S n 2 ) on the private link to the second legitimate receiver.
Each legitimate receiver first recovers S n 0 losslessly from both links, and then it recovers the common description U n from the common link. Finally, it recovers its dedicated description from its private link. The analysis of the equivocation of this scheme shows that, although the description U n which is sent on the public link is arbitrarily correlated with the source component to be kept secure S n 0 , it reveals no additional information about S n 0 to the eavesdropper beyond what the part of this source that is transmitted on the public link reveals about itself. Thus, the equivocation about the source S n 0 that is allowed by this scheme is precisely ∆.
The following Corollary specializes the result of Theorem 5 to the case of perfect security, i.e., ∆ = H(S 0 ).
for some joint distribution P U,S 0 ,S 1 ,S 2 ,Ŝ 1 ,Ŝ 2 that satisfies Remark 9. It is insightful to observe that the region of Corollary 4 can be written equivalently as the set of rate triples (R, R 1 , R 2 ) that satisfy for some joint P U,S 0 ,S 1 ,S 2 ,Ŝ 1 ,Ŝ 2 that satisfies (35). This region can be interpreted as that of a standard Gray-Wyner network without secrecy constraint [18] but with side information S n 0 available at the encoder and both decoders. qed 2) Binary Example: Consider the Gray-Wyner model of Figure 3b with the following choice of the sources S 0 , S 1 and S 2 . All the sources are binary valued, (S 0 , S 1 ) ∼ DSBS(p) and (S 0 , S 2 ) ∼ DSBS(p) such that S 1 − − S 0 − − S 2 forms a Markov chain, as shown in Figure 8. Also, let d 1 and d 2 be Hamming distortion measures. For simplicity, we concentrate on the case of lossless reconstruction of the sources S 1 and S 2 at the legitimate receivers, i.e., D 1 = D 2 ; and we investigate the symmetric rate case, i.e., Using Corollary 4, it is easy to see that the region R secret of rate triples (R, R 1 , R 2 ) with R 1 = R 2 such that the first receiver reconstruct the pair (S 0 , S 1 ) losslessly, the second receiver reconstructs the pair This region is represented in Figure 9  For comparison, we also investigate the region of optimal triples (R, R 1 , R 2 ) for this same setting without secrecy constraints at all. This region can be shown easily to be given by the set of rates It is represented in Figure 9  encoder; and g the decoding function at the legitimate receiver. That is, with H(S n 0 , S n 1 |W) ≥ n∆.
Let, for i = 1, . . . , n, the auxiliary random variable U i defined as First, we bound the rate of message W on the public link as follows, where (a) holds since the sources are memoryless and (b) follows using (48).
Similarly, the rate of message W 1 on the private link can be bounded as where (a) holds sinceŜ n 1 = g(W, W 1 ) and (b) follows using (48). We now bound the the equivocation as, where the last equality follows by substituting using (48).
Let Q be an integer-valued random variable, ranging from 1 to n, uniformly distributed over [1 : n] and independent of all other variables (S 0 , U, S 1 ). We have where (a) holds since the sources are i.i.d, and (b) holds since Q is independent from all other variables.
Let us now define U (Q, U Q ). LettingŜ 1 = (Q,Ŝ 1,Q ), we can easily show that This completes the proof of converse of Theorem 1.

B. Proof of Achievability
We describe briefly the codebook generation, encoding and decoding operations. The analysis of the allowed equivocation will follow.
Codebook Generation: i) Generate 2 nR independent n-sequences u n (w) indexed by w = 1, . . . , 2 nR , each with i.i.d. elements drawn according to ii) For each index w, generate 2 nR 1 independent n-sequencesŝ n 1 (w, w 1 ) indexed by w 1 = 1, . . . , 2 nR 1 , each with elements drawn i.i.d. according to Encoding: Upon observing the source pair (s n 0 , s n 1 ), the encoder finds a pair of sequences u n (w),ŝ n 1 (w, w 1 ) such that u n (w),ŝ n 1 (w, w 1 ) and (s n 0 , s n 1 ) are jointly typical, i.e., If no such sequence u n (w) exists, set w = 2 nR + 1; and if no such sequenceŝ n 1 (w, w 1 ) exists, set w 1 = 2 nR 1 + 1. The encoder then transmits the message w on the public link and the message w 1 on the private link.

Estimation at Legitimate Receiver:
Upon receiving the pair of indices (w, w 1 ), the decoder setŝ s n 1 (w, w 1 ) as the reconstructed version of the sequence S n 1 . Analysis of Equivocation: Le C denotes the used codebook, assumed to be known to the encoder, legitimate receiver and eavesdropper. We lower-bound the conditional entropy H(S n 0 , S n 1 |W) as follows.
P S n 0 = s n 0 , S n 1 = s n 1 |U n = u n (w) × log 2 P S n 0 = s n 0 , S n 1 = s n 1 |U n = u n (w) (56f) where (a) follows by noticing that if w 2 nR + 1, then the sequences u n (w), s n 0 and s n 1 are jointly typical, i.e., (s n 0 , s n 1 , u n (w)) ∈ T First, note that, in the case of lossless reconstruction of the source S n 1 at the legitimate receiver, Theorem 1 reduces to the set of triples (R, R 1 , ∆) that satisfy for some conditional p.m.f. P U|S 0 ,S 1 . Let R(P U|S 0 ,S 1 ) denote such region, and Also, let R denote the region described by (12), i.e., R is the set of triples (R, R 1 , ∆) that satisfy We want to show that It is easy to see that R ⊆ R . Let (R, R 1 , ∆) ∈ R , it remains to show that (R, R 1 , ∆) ∈ R for some choice of P U|S 0 ,S 1 . If R 1 ≥ H(S 1 ), then the triple (R, R 1 , ∆) satisfies (57) with the choice U = ∅, i.e., (R, R 1 , ∆) ∈ R.
If R 1 < H(S 1 ), there exists α ∈ [0, 1] such that R 1 = αH(S 1 ). Let T be a Bernoulli-α random variable that is independent of S 1 . Also, let U = (T, U T ), where It is easy to see that Similarly, since R + R 1 ≥ H(S 1 ), then we have where the last equality holds since the so-defined U is such that U − − S 1 − − S 0 is a Markov chain.

Appendix C
Proof of Theorem 2

A. Proof of Converse
Let (R, R 1 , D 1 , ∆) be an achievable rate-distortion-equivocation quadruple for the Lossy Helper model of Figure 2b. Let f and f 1 denote then the associated encoding functions and g the decoding function at the legitimate receiver. That is, where Ed (n) 1 (S n 1 ,Ŝ n 1 ) ≤ D 1 . Using Fano's inequality, the lossless reconstruction of the source S n 0 at the legitimate receiver yields that there exists a sequence n , with lim n→∞ n = 0, such that: Besides, one has by definition that: First, the sum-rate (R + R 1 ) can be lower-bounded as ≥ I(WW 1 ; S n 0 ) + I(WW 1 ; S n 1 |S n 0 ) (70c) ≥ nH(S 0 ) + I(Ŝ n 1 ; S n 1 |S n 0 ) − n n (70f) where (a) follows from thatŜ n 1 = g(W, W 1 ), (b) follows from (68), while (c) is a consequence of the following Markov chain, which holds since the sources (S n 0 , S n 1 ) are memoryless. Finally, the rate R 1 on the private link can be lower-bounded as where (a) follows by using (68) and (b) using (69).
The rest of the proof of converse follows by using standard single-letterization techniques, which we omit here for brevity. This completes the proof of the converse of Theorem 2.

B. Proof of Achievability
The coding scheme that we use for the proof of the direct part of Theorem 2 uses a careful combination of binning and rate-splitting. Specifically, let R 1 = R 1,1 + R. The codebook generation, encoding and decoding operations are as follows.

Encoding:
Upon observing (s n 0 , s n 1 ), the encoder first recovers (w 0,0 , w 1,0 ) the bin indices of s n 0 . Then, it looks for a sequenceŝ n 1 (w, w 1 ) jointly typical with the sources (S n 0 , S n 1 ), i.e s n 0 , s n 1 ,ŝ n If no such sequence exists, the encoder sets w 1,0 = 2 nR 1,0 + 1 and w 1,1 = 2 nR 1,1 + 1; if more than one exists, it selects at random of them. The encoder sends then the messages w 1 = (w 1,0 , w 1,1 ) over the private link while the message w = (w 0,0 , w 0,1 ) is sent through the public link.
Decoding: Based on all received indices, the decoder first recovers the sequence S n 0 as the unique typical sequence in the bin indexed by (w 0,0 , w 1,0 ). Then, knowing s n 0 , it sets its description as beinĝ S n 1 (w 1,1 , w 0,1 ). The encoding and decoding are successful provided that n is large enough and Equivocation Analysis: Let (S n 0 , S n 1 ) be the observed sequence and W the message sent over the public link. For convenience let us define the indexW = (W 0,1 , W 1,1 ), of rateR = R 0,1 +R 1,1 . We start by writing that H(S n 0 |W) = H(S n 0 |W 0,0 , W 0,1 ) ≥ H(S n 0 |W 0,0 , W 0,1 , W 1,1 ) .
The proof if two-fold and consists in establishing two main inequalities.
i) The first inqueality which writes as amounts to stating that the indexW is independent of S n 0 . ii) The second inequality writes as and implies that the only secure part of S n 0 is the index transmitted over the private link. To prove the first inequality (76), we start by writing that The proof consists in proving that the difference term H(W|S n 0 ) − nR in the RHS of (78b) is arbitrary small. To this end, let us first denote E the event that an encoding error occurs and denote byĒ its error complement. First, observe that which is a consequence of that if an error occurs, thenW can take only one possible value, i.e. 2 nR + 1.
The conditional entropy H(W|S n 0 ,Ē) on the RHS of (79) is given by with, for given s n 0 andw ∈ [1 : 2 nR ], In what follows, we compute the conditional probability P(W =w|S n 1 = s n 1 , S n 0 = s n 0 ,Ē) for given (s n 0 , s n 1 ). Let, for a given s n 0 ,Ŝ n 1 (s n 0 ) denote the set of generated sequences {ŝ n 1 (w)} of the codebook, among all possible sequences in T . For a given pair (s n 0 , s n 1 ), if no error occurs during the encoding step, the encoder chooses at random one sequenceŝ n 1 (w) among all those that are strongly jointly typical with the pair (s n 0 , s n 1 ). That is, the sequenceŝ n 1 (w) is chosen at random in the following intersection set ∩Ŝ n 1 (s n 0 ) .
For given (s n 0 , s n 1 ), every sequence from this intersection set has probability P(W =w|S n 1 = s n 1 , S n 0 = s n 0 ,Ē) = ||T (n) [Ŝ 1 |s n 1 ,s n 0 ] ∩Ŝ n 1 (s n 0 )|| −1 ×1 ŝ n 1 (w), s n 0 , s n 1 ∈ T Key to the rest of the proof is a counting argument that we use to bound the cardinality of the set ∩Ŝ n 1 (s n 0 ). The result is stated in the following lemma, whose proof is relegated to Appendix D. At this stage, we mention that a different approach to computing a probability that is similar to (83) can be found in [35], and was also used later on in [36, Appendix A]. (Encoding set cardinality bound). IfR ≥ I(Ŝ 1 ; S 1 |S 0 ) + 2 n , the cardinality of the encoding set

Lemma 1
∩Ŝ n 1 (s n 0 ) satisfies Proof. The proof of Lemma 1 is given in Appendix D.
Finally, using (79) and (87c), we get that the conditional entropy H(S n 0 |W) satisfies Now that we have proved that the indexW is independent of S n 0 , we move to prove the second inequality (77). To this end, observe that: where (a) is a consequence of that, knowing the codebook, W 0,0 is a function of S n 0 , while (b) stems from (89). As for (c), it results from the fact that W 1,0 is a function of S n 0 , and (d) is a consequence of the random binning procedure.
The random variable C follows a Hyper-Geometric distribution; and the probability that it takes some value j, with 1 ≤ j ≤ min{B, K}, is given by The expectation and variance of this variable are given respectively by Next, using (98), the inequality (94) gives that, for all ≥ 0, we have The above means that, ifR ≥ I(Ŝ 1 ; S 1 |S 0 ) + 2 n , then for ≥ 0, the probability P |C − E(C)| < E(C) tends to unity as n −→ ∞. Finally using (98), this leads to the desired result; and completes the proof of Lemma 1.
Appendix E

Encryption-based coding scheme
In this section we show that, if the optimal rate-distortion region given in Theorem 2 suggests that the source S 0 be compressed over the private link of rate R 1 , one could equally optimally transmit the source S 0 on the common link, provided a key of rate at least equal to H(S 0 ) be used to encrypt it. Thus, the communication on the public link is not prevented, however, it has to be secured.
We describe hereafter the corresponding encryption-based coding scheme in which the private link is used as a private key to encrypt the common link transmission. The codebook generation, encoding and decoding are as follows.
Decoding: Based on the received indices, the decoder first recovers the sequence s n 0 and then, recovers s n 1 similarly. The decoding is successful if:R 0 + R 0,0 + R 1,0 ≥ H(S 0 ) (101a) Besides, in order for the encryption to be successful, we impose that: In the following, we analyse the resulting equivocation, or equivalently, the induced rate leakage, at the eavesdropper about the source s n 0 to be secured, Equivocation Analysis: The leakage at the eavesdropper could result from the three indices transmitted on the public link, i.e.W 0 ⊕W 1 , W 0,1 and W 0,0 .
In the following, we bound the leakage of each of the aforementioned indices.
We start the analysis by writing: To bound the three RHS terms of (103b), we will introduce four crucial results.
• The first result we will resort to consists in stating that, similarly to the equivocation analysis in the proof of Theorem 2 in Appendix C, (W 1 , W 0,1 , W 1,1 ) are asymptotically independent of s n 0 , i.e. there exists n such that: • Next, sinceW 1 is independent of S n 0 , and sinceW 0 is a function of S n 0 , then, following Shannon's one time-pad proof, there exists n such that: , then the two sub-indices appear as independent of each other • Finally, since s n 0 are assigned at random to their bin indices, then for all w 0 , w 0,0 , w 1,0 ∈ 1 : 2 nR 0 × 1 : 2 nR 0,0 × 1 : 2 nR 1,0 , which implies that: We proceed with the analysis as follows: where (a) is a result of (105) while (b) results from (104).
As for the second term of the RHS of (103b), note that: where (a) results from (104) and (b) stems from (106). Now, to bound the last term of the RHS of (103b), we can write that: where (a) follows from that (W 0,1 ,W 0 ⊕W 1 ) are almost independent of (S n 0 , W 0,0 ), and (b) is a result of that the pair of indices (W 1,0 ,W 0 ) are a function of S n 0 , while (c) is a consequence of (108). Combining thus the inequalities in (109f), (110d) and (111g), we can write: which implies that: which ends the equivocation analysis.

Fourier-Motzkin Elimination:
We resort to Fourier-Motzkin Elimination on the set of inequalities and equalities given by: along with positivity constraints, to obtain the desired rate region: Proof of Theorem 4

A. Proof of Converse
Let (R, R 1 , D 1 , D 2 , ∆) be an achievable rate-distortion-equivocation tuple for the lossy Gray-Wyner model with equivocation constraint of Figure 3a. Let f , f 1 and f 2 be the associated encoding functions at the encoder; and g 1 and g 2 the decoding functions at the legitimate receivers. That is, with Ed (n) 2 (S n 2 ,Ŝ n 2 ) ≤ nD 2 and H(S n 1 , S n 2 |W) ≥ n∆.
Let, for i = 1, . . . , n, the auxiliary random variable U i defined as First, we lower bound the rate R of message W as follows, where the last equality follows by substituting using (122).
Similarly, for j = 1, 2, we lower bound the rate R j of message W j as where (a) holds sinceŜ n j = g j (W, W j ); and (b) follows by substituting using (122).
The equivocation can be upper-bounded easily, as where, similarly to the above, the last equality follows by substituting using (122).
The rest of the proof of converse follows using standard single-letterization techniques, and is omitted for brevity.

B. Proof of Achievability
The coding scheme that we use for the proof of the direct part of Theorem 4 is a straightforward extension of that of the Helper model with equivocation on both sources in Appendix A to the case of two legitimate receivers. For this reason, hereafter, we only outline the main steps, and omit the details.
Then, the encoder looks for a pair of sequencesŝ n 1 (w, w 1 ) andŝ n 2 (w, w 2 ) such that, for j = 1, 2,ŝ n j (w, w j ) is jointly typical with the triple (u n (w), s n 1 , s n 2 ), i.e., u n (w), s n 1 , s n 2 ,ŝ n j (w, w j ) ∈ T Similarly, the encoding at this step can be performed successfully as long as n is large and The encoder transmits the index w on the common public link, the index w 1 on the private link to the first legitimate receiver and the index w 2 on the private link to the second legitimate receiver.
Estimation: Both legitimate receivers get the index w on the common public link; and Legitimate Receiver j, j = 1, 2, also gets the index w j on its dedicated private link. Then, Legitimate Receiver j, j = 1, 2, sets its reconstruction of source s n j asŝ n j (w, w j ). Equivocation Analysis: The analysis of the equivocation level that is achieved by this coding scheme follows straightforwardly from that in Appendix A for the Helper problem with equivocation constraint of Figure 2a by simply substituting (S n 0 , S n 1 ) therein with (S n 1 , S n 2 ); and, hence, is omitted for brevity.
Appendix G Proof of Theorem 5 A. Proof of Converse: Let (R, R 1 , R 2 , D 1 , D 2 ) be an achievable rate-distortion tuple for the lossy Gray-Wyner model of Figure 3b. Let f , f 1 and f 2 denote the associated encoding functions at the encoder; and g 1 and g 2 the decoding functions at the legitimate receivers. That is, S n 2 = g 2 (W, W 2 ) , with Ed (n) 1 (S n 1 ,Ŝ n 1 ) ≤ nD 1 and Ed (n) 2 (S n 2 ,Ŝ n 2 ) ≤ nD 2 .
First, using Fano's inequality, the assumption of lossless reconstruction of the source component S n 0 at both legitimate receivers yield that there exists n with lim n→∞ n = 0 such that H(S n 0 |W, W 1 ) ≤ n n , H(S n 0 |W, W 2 ) ≤ n n , and, by definition, we have Let, for i = 1, . . . , n, the auxiliary random variable U i defined as where (a) holds since the sources are memoryless; and (b) follows by substituting using (138).
Similarly, for j ∈ [1 : 2], we write that where (a) holds sinceŜ n j is a function of (W, W j ), and (b) follows from that the sources are memoryless. Finally, a trivial bound on the equivocation can be written as follows: The rest of the proof of converse follows using standard single-letterization techniques; and is omitted for brevity.

B. Proof of Achievability:
The achievability proof can be outlined as follows. The first stage of the coding scheme consists in compressing the common source S n 0 to be secured through the private links and the common link as well, yielding thus a given leakage at the eavesdropper on this public link. Once S n 0 is decoded at both terminals, it serves as side information available at all terminals to apply a Gray-Wyner code conditioned on it. Such a code consists in compressing jointly the two sources (S n 1 , S n 2 ) on the common link with a common description U n , and then, transmitting individual descriptionsŜ n 1 andŜ n 2 , each on a private link, to refine the common description U n . Since this encoding is performed conditioned on S n 0 , a similar argument to the one used in the proof of Theorem 2 is called here, to show that no information is leaked in this second stage of the coding scheme. The codebook generation, encoding and decoding are detailed in the following. iii) For each s n 0 and u n (w), generate 2 n(R j −R 0 ) sequencesŝ n j (w, w j ) where w j ∈ [1 : 2 n(R j −R 0 ) ] following n i=1 PŜ j |US 0 (ŝ j,i (w, w j )|s 0,i , u i (w)).

Encoding:
Upon observing S n 0 , the encoder: • Finds the bin indices (w 0 ,w 0 ) of s n 0 . • Finds a sequence u n (w) jointly typical with the sources (s n 0 , s n 1 , s n 2 ), i.e. u n (w), s n 0 , s n 1 , s n 2 ∈ T (n) • Then, for j ∈ {1, 2}, finds a sequenceŝ n j (w, w j ) such that: u n (w),ŝ n j (w, w j ), s n 0 , s n 1 , s n 2 ∈ T (n) [UŜ j S 0 S 1 S 2 ] . (144) • Transmits the indices w 0 and w j on each of the private links, then transmit w and w¯0 on the common link.
Estimation: Each of the decoders first recovers the sequence s n 0 and the sequence u n (w). Upon decoding both sequences, they each set their reconstruction asŝ n j (w, w j ). The encoding and decoding are successful provided that n is large and the following set of constraints is verified: Equivocation Analysis: The analysis of the equivocation level that is achieved by this coding scheme follows straightforwardly from that in Appendix A for the Helper problem with equivocation constraint of Figure 2b by simply substituting S n 1 therein with (S n 1 , S n 2 ); and, hence, is omitted for brevity. The resulting bound on the equivocation level at the eavesdropper about the source s n 0 is given by: Fourier-Motzkin Elimination: Summarizing, the tuple (R, R 1 , R 2 , D 1 , D 2 , ∆) is achievable if there exists (R 0 ,R 1 ) such that R 0 +R 0 ≥ H(S 0 ) (147a) R −R 0 ≥ I(U; S 1 S 2 |S 0 ) (147b) Using Fourier-Motzkin elimination to successively project out R 0 , andR 0 , we complete the proof of Theorem 5.