{'fraction_non_alphanumeric': 0.039732024409657736, 'fraction_numerical': 0.004974794375165827, 'mean_word_length': 4.316290550070522, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 1, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
An Improved Correction Term for Dimension Reduction in Quantum Key Distribution

The dimension reduction method enables security proofs of quantum key distribution (QKD) protocols that are originally formulated in infinite dimensions via reduction to a tractable finite-dimensional optimization. The reduction of dimensions is associated with a correction term in the secret key rate calculation. The previously derived correction term is loose when the protocol measurements are nearly block-diagonal with respect to the projection onto the reduced finite-dimensional subspace. Here, we provide a tighter correction term. It interpolates between the two extreme cases where all measurement operators are block-diagonal, and where at least one has maximally large off-diagonal blocks. This new correction term can reduce the computational overhead of applying the dimension reduction method by reducing the required dimension of the chosen subspace.


I. INTRODUCTION
Quantum key distribution (QKD) is a promising quantum technology, enabling two parties to communicate securely, even if an eavesdropper has unlimited computational power [2][3][4].
A security analysis of a QKD protocol derives the rate at which a secret key can be generated at the specified security level. Recently, numerical tools have been introduced to perform these key rate calculations, by reliably solving an optimization over the joint state of Alice and Bob [5,6]. These tools are useful for practical QKD security proofs as they enable modelling of imperfect devices, encapsulate extended side channel models, and take advantage of specific details of the observed data to get an increased key generation rate.
As most QKD protocols are implemented optically, the underlying Hilbert space is infinite-dimensional. The relevant optimization is then over infinite-dimensional states, so the aforementioned numerical tools cannot be applied directly. For discrete-variable (DV) protocols, techniques such as squashing maps or the more general flag-state squasher can be used to map the problem to an effective finite-dimensional optimization [7,8]. These tools, however, are not straightforwardly applicable to continuous-variable (CV) protocols. This is because they rely on all the protocol's measurement operators commuting with a projector on an underlying low-dimensional subspace, a subspace which essentially captures the protocol's behaviour.
Recently, we have extended the numerical framework to encompass both CV and DV protocols in infinitedimensional Hilbert spaces via the dimension reduction method [1]. This method provides a tight lower bound on the infinite-dimensional key rate optimization by op- * twesh.upadhyaya@uwaterloo.ca timizing a specified finite-dimensional problem, and subtracting a correction term that bounds the difference between the original infinite-dimensional problem and the finite-dimensional one. The correction term bounds how much the key rate can increase under projection. In our previous work, we found an analytic form for the correction term that was applicable to any QKD protocol, but loose in certain cases. We also found that the correction term is zero when all the POVMs commute with the same projector. We conjectured that a tighter correction term exists which interpolates between these two cases; becoming smaller when the measurements are closer to block-diagonal. In this work, we find such a correction term. Practically, this is relevant for improving the performance of the dimension reduction method, and enabling its applications to more computationally demanding scenarios. It may also be of independent interest to better understand how the key rate changes under projection.

II. BACKGROUND
In this section we briefly review the formulation of the asymptotic key rate as a convex minimization and the dimension reduction method; focusing in particular on the correction term. For a more detailed discussion, we refer the reader to Ref. [1].

A. Key Rate Optimization and Dimension Reduction Method
In each key generation round of a QKD protocol, Alice and Bob establish a quantum state ρ AB ; and Eve holds its purification in her register E. Alice and Bob measure their respective subsystems and perform classical data processing, which may involve public announcements, to generate a raw key, which is the key before error correc-tion and privacy amplification. The raw key is stored in the register Z, and any public announcements are stored in the register C. These measurement and postprocessing steps can be represented as a quantum-to-classical channel Φ : AB → ZC. We use the notation [E] = EC for the composite register containing all information accessible to Eve. The asymptotic key rate per signal sent under collective attacks is given by the Devetak-Winter formula [9], which can be expressed as a convex optimization [6], The convex feasible set S ∞ is constrained by the parameter estimation Alice and Bob perform, as well as the reduced density matrix constraint for prepare-and-measure protocols [6]. The error-correction cost δ leak EC can be observed directly and does not need to be optimized over.
Using the shorthand f for the convex objective function, our goal is to compute tight lower bounds on the following minimization, min ρ∈S∞ f (ρ). ( Tractable lower bounds on this infinite-dimensional optimization can be computed via the dimension reduction method [1]. There are four steps to apply this method; we briefly summarize them here and give references to the relevant sections of Ref. [1]. First choose a finitedimensional subspace, represented by a projector Π (Sec. IV A). Next, find a bound W on the weight of ρ outside this subspace (Sec. IV B). Third, determine a correction term ∆ for the objective function f (Sec. IV C). Finally, construct a finite-dimensional set S N satisfying certain properties (Sec. IV D). The desired lower bound is then where the finite-dimensional optimization can be solved numerically and the correction term is computed analytically. Tildes denote operators that are subnormalized.

B. Correction Term
Intuitively, the correction term limits how much the function f can increase under projection. Formally, it satisfies the following property, (4) In this case, we say that f is uniformly close to decreasing under projection (UCDUP) on S ∞ , with correction term ∆. The correction term we derive will apply on the set of all density operators,D(H ∞ ), and for any choice of projection Π, so it can be applied to any QKD protocol.

C. Postprocessing Map
As we have noted, the postprocessing map Φ is a quantum-to-classical channel from AB to ZC. It follows that Φ can be realized by a measurement. That is, Φ has the form is some positive operator-valued measure (POVM), over the alphabet of key symbols S Z and public announcements S C [10]. For simplicity, we reindex the POVM by k ∈ S K ≡ S Z × S C .

III. RESULTS
We first introduce three lemmas which will be needed to prove our main theorem, which is a tight correction term. The first lemma is a continuity bound for conditional entropy in terms of trace distance. The second lemma lets us consider the dephased state instead of the projected one; dephased means the off-diagonal blocks with respect to the projector and its complement are zeroed out. The third lemma provides a bound on the trace norm of a specific form of operator, which arises in the proof of the main theorem and is related to Eve's conditional states.
where h(x) is the binary entropy function.
Define Ξ AB to be a dephasing channel associated with the projector Π and its complementΠ as Proof. Expanding definitions, we have that = H(Z|[E]) Φ(Ξ(ρ ABE )) .
Line (9) follows because the second term is the conditional entropy of a classical-quantum state and thus nonnegative, (10) follows because conditional entropy is concave, and (11) follows simply because the map Φ is linear.
Lemma 3. Let P be a POVM element. With respect to a projection Π and its complementΠ, write P as a block matrix Define H = 0 B B † 0 as the off-diagonal portion of P .
Let ρ be a state, and define two new states corresponding to the normalized on-diagonal blocks of ρ: ρ Π = ΠρΠ Tr(ρΠ) and ρΠ =Π ρΠ Tr(ρΠ) . Define the measurement probabilities r = Tr ρ Π P and s = Tr ρΠP . Let Here · p denotes the Schatten p-norm and (·) g the generalized inverse. Of particular importance to us will be the trace norm (p = 1) and the spectral norm (p = ∞). The generalized inverse is defined as the inverse of an operator on its support, so that A g A = Π supp(A) .
Proof. The trace norm can be expressed as a semidefinite program (SDP) in the following manner [11], √ ρH √ ρ 1 = minimize: For any feasible X, Π im(ρ) XΠ im(ρ) is still feasible, and can only decrease the value of the objective function (Π im(ρ) is the projection onto the image of ρ). We can thus assume WLOG that X = Π im(ρ) XΠ im(ρ) .
Then, X can be expressed as √ ρR √ ρ for some R. This lets us rewrite the SDP in Eq. (16) as √ ρH √ ρ 1 = minimize: As this is a minimization, any feasible guess leads to an upper bound. To show R is feasible, it suffices to show R is positive and satisfies R ≥ ±H. The remainder of the proof consists of three steps. We first make a guess for a feasible R. We then prove that it is indeed feasible. Finally, we calculate the corresponding value of the objective function.
Recall that P is positive as it is a POVM element. In terms of the block matrix characterization with respect to the projectors Π andΠ, we have that By Theorem IX.5.9 of Ref. [12], the above holds if and only if [13]. Note K ∞ ranges from 0 to 1 and quantifies how close to block-diagonal the POVM element is. In particular, K ∞ = 0 when the POVM is exactly blockdiagonal, since then B = 0. We now specify our guess to be with the constants a = K ∞ √ W and b = K ∞ √ W (assuming W = 0, as the lemma follows immediately for W = 0).
Let us verify that this guess is feasible. Since R is manifestly positive, it suffices to show R ± H ≥ 0. Written in terms of block matrices, this condition is equivalent to Again by Theorem IX.5.9 of Ref. [12], this condition is satisfied if and only if √ aA g (±B) √ bD g is a contraction. Noting that √ ab = K ∞ , this simplifies as The operator on the last line clearly has unit norm so is a contraction. Thus, it follows that R ± H ≥ 0 and R is a feasible guess. The objective function value is Recall the measurement probabilities r = Tr ρ Π P and s = Tr ρΠP introduced above. The first term can be upper bounded as a Tr(ρΠP Π) = a Tr(ΠρΠ ΠP Π) (23) = a Tr(ΠρΠ) Tr ρ Π P (24) ≤ a Tr ρ Π P (25) where in the second line we pull out the normalization of ρ Π .
Similarly for the second term, and the proof is complete.
We now state the theorem for the improved correction term. (5)). With respect to an arbitrary projection Π, write each P k as a block matrix For this projection Π, the QKD objective function f is UCDUP on D(H ∞ ) with correction term where |Z| = |S Z | is the dimension of the key map register and c = max (34) Proof of Theorem 1. As per the definition of UCDUP, let ρ AB ∈ D(H ∞ ) be a state satisfying Tr ρ ABΠ ≤ W . We first bound the trace distance between Φ(Ξ(ρ ABE )) and Φ(ρ ABE ). We have since the dephasing channel Ξ is self-adjoint. Note that {Ξ(P k )} is also a POVM, as the channel is positive and unital. In writing Φ(Ξ(ρ ABE )) in this manner, we are comparing the effect of two different channels on the same input state, instead of the same channel on two different inputs.
Since the trace norm is additive over blocks corresponding to orthogonal subspaces, we have To proceed, we find a more useful form for Eve's conditional states. Recall that Eve's register E purifies ρ AB . We can thus assume that Eve's register has the same dimension as Alice and Bob's. That is, H E = H AB . There then exists a bijective isometry V : H AB → H E . (To construct such an isometry, simply choose a basis |i AB for H AB and a basis |i E for H E , and define V |i AB = |i E .) Via the vectorization mapping, it can easily be shown that and similarly for Ξ(P k AB ). Applying this identity to Eq. (39), we have In keeping with our previous notation, we define ρ Π = ΠρΠ Tr(ρΠ) and ρΠ =Π ρΠ Tr(ρΠ) , as well as the probability distributions r(k) = Tr ρ Π P k and s(k) = Tr ρΠP k . By Lemma 3 we have where in Eq. (48) we used the fact that the sums over r(k) and over s(k) are both convex combinations of √ A k g B k √ D k g ∞ , and hence upper-bounded by the largest of these terms. Re-inserting this bound in Eq. (44), we have Letting , by the continuity bound in Lemma 1, we have By Lemma 2, and the definition of UCDUP (Eq. (4)), the theorem statement follows.
Note that c is zero when all the POVM elements are block-diagonal, and increases to a maximum of 1 as the off-diagonal blocks of any POVM element get larger. It can be interpreted as a normalized measure of how well the POVM elements commute with the projection. This also indicates that a good choice of projection is one for which all POVM elements are close to block-diagonal.
In Figure 1, we plot the improved correction term as a function of c, compared to the two cases we had before, for |Z| = 4. The new term smoothly interpolates between the commuting and maximally non-commuting cases. We see that if c is small, the improved correction term reaches smaller values at larger W than the old correction term. This in turn reduces the computational overhead, as it allows us to further reduce the dimension of the finite-dimensional subspace in our key rate calculation, even though this comes with an increase in the weight W outside that subspace.
To calculate the improved correction term for a specific protocol, c needs to be upper-bounded. If the POVM elements are rank-one, then c can be calculated. For more complicated POVM elements, analytic tools to bound c would be an important area for future research. To estimate c numerically, we can calculate where Π C is a projector onto a subspace containing Π. By increasing the dimension of Π C until the approximations to c seem to converge, we can estimate c [14].

IV. CONCLUSION
In summary, we have determined a tighter form for the correction term in the dimension reduction method. This new correction term is applicable to general QKD protocols, and is small when the protocol has POVM elements which are close to block-diagonal. This result is conceptually interesting because it provides a unified perspective, interpolating between the cases of zero and maximal off-diagonal blocks. It is also practically relevant, because having a smaller correction term allows one to achieve the same key rate with a larger value of W , which corresponds to solving the finite-dimensional optimization in fewer dimensions. Due to the computational limitations of numerical SDP solvers, this can provide a significant numerical advantage.
Interesting directions for future work include applying this correction term to specific protocols and finding regimes where it gives the most significant improvement.