{'fraction_non_alphanumeric': 0.043328479596547925, 'fraction_numerical': 0.01924920978797457, 'mean_word_length': 4.042621776504298, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 10, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Improved one-way rates for BB84 and 6-state protocols

We study the advantages to be gained in quantum key distribution (QKD) protocols by combining the techniques of local randomization, or noisy preprocessing, and structured (nonrandom) block codes. Extending the results of [Smith, Renes, and Smolin, quant-ph/0607018] pertaining to BB84, we improve the best-known lower bound on the error rate for the 6-state protocol from 14.11% for local randomization alone to at least 14.59%. Additionally, we also study the effects of iterating the combined preprocessing scheme and find further improvements to the BB84 protocol already at small block lengths.


Introduction
Using a quantum channel to create a secret key between two parties is closely related to using the channel to send quantum information, with many results found in one area applicable in the other. For instance, by treating the steps in a quantum key distribution (QKD) protocol coherently and viewing the entire process as an entanglement distillation scheme, one can use properties of random quantum error-correcting codes to prove the security of the BB84 [1] and 6-state [2] protocols up to bit error rates of p max = 11.0028% [3] and p max = 12.6193% [4], respectively. Conversely, the formula for the quantum channel capacity can be obtained by importing the key rate resulting from a general approach to secret key generation over a known channel [5,6,7].
One of the surprising results related to quantum capacity is the non-optimality of random codes, in contrast to the classical case. The classical capacity of a channel can be achieved by using randomly-constructed block codes, and the independence of one input to the channel from the next results in a so-called single-letter formula for the capacity. Random coding can be used to create quantum error-correcting codes as well, but these do not always achieve the capacity. Better performance can be achieved by structured codes which exploit the ability of quantum error-correcting codes to correct errors without precisely identifying them, a property called degeneracy. Initial results on rates achievable with degenerate codes displayed only modest gains [8,9], but recent analysis shows that degeneracy is crucial to the behavior of optimal codes [10].
By appealing to the coherent formulation of the protocol, degenerate codes should also 1 be useful in QKD. This was shown to be the case in the original security proof of the 6state protocol [4], as the results of [9] were used to improve the error rate threshold to p max = 12.6904%. More striking threshold improvements are possible, if counterintuitive, by simply adding noise to the raw key bits before they are processed into the final key, a procedure known as local randomization [11,12]. This improves the error rate thresholds for the two protocols to p max = 12.4120% and p max = 14.1119%, respectively. At first glance, these results make no sense in the coherent picture of QKD, since adding more noise to already noisy entangled pairs only decreases the amount of pure entanglement which can be extracted. The entanglement/secret-key analogy does not hold perfectly, however; entangled states are sufficient, but not necessary, for creation of secret keys. A broader class of states, called private states, lead to secret keys when measured [13], and these should properly be the target output of the coherent version of the QKD protocol. Indeed, the exact error thresholds are recovered in the coherent picture when the QKD protocols with local randomization are analyzed in these terms [14].
With a systematic understanding of how degenerate codes and local randomization boost the key rate, it becomes sensible to combine the two methods to look for even higher thresholds. Recently it was shown in [15] that doing so improves the error threshold of the BB84 protocol up to at least p max ≈ 12.92% by using the same type of structured code studied in [8,9,10]. These specific codes consist of the concatenation of two codes, the first a simple repetition code and the second a random code. The repetition code, sometimes called a cat code in the context of quantum information theory since the codewords are |0 ⊗m and |1 ⊗m , induces degeneracy in the overall code since a phase flip on any of the physical qubits leads to the same logical error, and is corrected in the same way. In particular, blocklength m = 400 corresponds to the threshold stated above. Since the random code portion of the protocol corresponds to information reconciliation and privacy amplification in the classical view, the local randomization and the repetition code together become a type of preprocessing performed before these "usual" steps. In this paper we show that the same preprocessing protocol as used in [15] can also be used to improve the maximum tolerable bit error rate for the 6-state protocol, up to at least p max = 14.5930% for a blocksize of m = 300. This is already quite close to the upper bound of 14.6447% [16,11,17] on the tolerable error rate for the BB84 protocol, and since the error threshold grows with blocklength, the bound is presumably exceeded at larger blocklengths, indicating the higher robustness of the 6-state protocol. In addition we investigate iterating the preprocessing scheme in the BB84 protocol, and show an improvement both in rate and error threshold over single-round preprocessing for even modest blocklengths. Our calculations are facilitated by a closer look at the representation theory relevant to describing the quantum states resulting from the preprocessing, enabling us to continue the investigation started in [15] to the 6-state protocol and iterated versions of the preprocessing for BB84.
To begin, section II describes the preprocessing scheme in more depth and then derives secret key rate expressions for the BB84 and the 6-state protocols. Numerical calculations for blocklengths into the hundreds are then presented for the two protocols. Section III examines the advantages of iterating the preprocessing protocol to achieve higher rates and thresholds for the same amount of effort in noise addition and block coding. The appendix explains how representation theory is helpful for the numerical evaluation of such key rates in both cases. 2 Secure key rates using the preprocessing protocol The preprocessing protocol proposed in [15] begins after Bob has received the quantum signals from Alice and they have sifted their raw keys to throw out mismatches between the preparation and measurement basis. Alice then flips each of her sifted key bits (x 1 , . . . , x n ) with probability q, resulting in new bits (x 1 , . . . ,x n ). These are partitioned into blocks of size m, and for each block she computes the syndrome (x 1 ⊕x 2 ,x 1 ⊕x 3 , . . . ,x 1 ⊕x m ) and sends this information to Bob. He computes the relative syndrome of their blocks by adding his corresponding syndrome to Alice's, modulo two. Alice's message is public knowledge, but the first bit of each block is still secret, so it is kept as a potential key bit. The protocol then proceeds with the usual error correction and privacy amplification steps to transform these kept bits into a secret key, now aided by the relative syndrome of each block and knowledge of the probability q of local randomization. Without local randomization, it turns out that m = 5 is the optimal blocklength for improving the error threshold in the 6-state protocollonger blocklengths have worse thresholds [4]. However, the results in [15] indicate that with the addition of noise, the highest tolerable bit error rate of BB84 grows with the blocksize m, and we find a similar result in the 6-state case (see figure 1).
We determine the secure key rates of the BB84 and 6-state one-way key distillation protocols involving the preprocessing protocol described above using the security proof of Renner [18]. This proof states that the key rate of such a protocol is given by where the minimum ranges over the set of states Γ of all density operators on the 2 × 2 dimensional Hilbert space H A ⊗ H B such that the measurement performed during the parameter estimation phase of the protocol leads to a certain bit error rate p. The conditional von Neumann entropies in (1) are calculated for the states which describe the processing of each block, including local randomization and syndrome calculation, and eventual measurement of the output qubits of the repetition code. That is, the preprocessing is treated quantum-mechanically or coherently, but the usual processing classically. Here X denotes Alice's key outcome when measuring the output bits and Y Bob's key and syndrome outcomes. For the BB84 protocol the set Γ contains the states where In the 6-state protocol, meanwhile, parameter estimation assures us that Γ contains only the single state σ AB with {p uv } = {1 − 3 2 p, p 2 , p 2 , p 2 }. Using Renner's proof allows us to include the preprocessing but still only minimize over the quantum states σ corresponding to individual signals. The crucial simplification is that the quantum state of the block can be taken to be the product σ ⊗m without loss of generality. Other proof techniques would require minimization over all possible (potentially-entangled) block states, or an additional step in the parameter estimation procedure to ensure that the state does have this power form.

Computation of the secure key rate
To compute the secure key rates we make use of the fact that the difference of entropies in (1) can also be written as difference of corresponding quantum mutual informations, i. e. S(X|E)− S(X|Y ) = I(X : Y ) − I(X : E). In order to calculate these quantities, we need to determine the states σ XY E defined in (2). Start with an m-fold tensor product of a purification of σ AB , where u, v ∈ {0, 1} m = m so that X u = X u1 ⊗ X u2 ⊗ · · · , and similarly for Z v and p u, v . We now need to calculate the state resulting from noisy preprocessing followed by a blockwise stabilizer code measurement in which the stabilizers contain Pauli ½ and Z operators only.
The first step, local randomization, can be described in a coherent way by adding a classical register A ′ (such systems will be denoted with boldface type) in the state ((1 − q)|0 0| + q|1 1|) ⊗m and then applying controlled not gates from the individual register states to the bits A. This leads to where f ∈ m and q f = q f (1 − q) m−f for f = | f |, the number of 1s in f , a notation we shall use throughout. Here we have used the fact that X A |Φ + AB = X B |Φ + AB to simplify the expression; this move is responsible for the Z f operation applied to E 2 .
In the second step, Alice and Bob both measure the m − 1 (generators of the) stabilizers of a ½/Z-only stabilizer code which encodes one logical qubit into m physical qubits. Using a public (authenticated) channel, Alice sends her syndrome to Bob who calculates the relative syndrome s by adding Alice's string to his measurement outcome modulo two. Afterwards both decode their encoded state. Such a stabilizer code together with an encoding can be fully specified by defining two bases ..m both spanning m with the property that ξ i · η j = δ ij (see e. g. [19]). In this case the stabilizers are given by and (ii) that any m fold Pauli operator can be decomposed as where ξ m · u and η m · v are the logical bit and phase flip errors resulting when this Pauli operator is applied to an encoded state like (6). In other words, the maximally-entangled state of m physical qubits is the equal superposition of a logical maximally-entangled state in all the possible encodings, which can be seen using the completeness of η i . Meanwhile, the formulation of physical X and Z operators in terms of their logical versions follows from using the orthogonality of the η i and ξ j . Using these two facts we find that, after Bob's calculation of the relative syndrome s, the tripartite state can be expressed as (up to a local unitary acting only on Eve's systems) . While the registers A and B in equation (5) have been m-qubit registers, here they contain only a single qubit each. Alice missing (m − 1)qubits have been traced out since they contained only classical information about her absolute syndrome (accessible to all parties). The rest of Bob's m-qubit register now contains classical information about the relative syndrome s and is labeled B ′ . We now restrict ourselves to the cat code, which is given by ( figure 2). The name comes from the fact that α|θ( 0, 0) + β|θ( 0, 1) = α|00 . . . 0 + β|11 . . . 1 , a Schrödinger cat state when Finally, Alice and Bob both measure their key bit. Alice forgets about which bits she flipped by tracing out the A ′ register. The correlations between Alice, Bob, and Eve are described by the following semiclassical state: where (9), i = m became classical after the key bit measurements by Alice and Bob. The ..m span m thereby completely fixing the string u + f .
To calculate the quantum mutual information between Alice and Bob we trace out Eve and obtain In the last step we used u = l x η m + i s i η i to write the sum over u as a sum over l x and s, where l x is the logical X error, i.e. X error on the first qubit in the block. This immediately yields using the binary entropy . Note that I(X : Y ) does not depend on the particular values {p uv } in σ AB (see (3)), but only depends on the bit error rate p = p 10 + p 11 . The form of the mutual information indicates the advantage provided by the syndrome. If Alice did not send any information, Bob's state would be averaged over the possible syndromes, and the mutual information would involve the entropy of the average of theP (l x | s) rather than the average of the entropies. By concavity of entropy, the latter rate is larger.
To calculate the quantum mutual information between Alice and Eve, we trace out Bob's systems and obtain with We proceed with the computation of the secure key rate for the BB84 and the 6-state protocol separately in the following two subsections.

BB84
To calculate the secure key rate we must find the minimum over all σ AB of the difference between the quantum mutual information between Alice and Bob and Alice and Eve. Since I(X : Y ) does not depend on the particular structure of {p uv } = {1 − 2p + t, p − t, t, p − t}, t ∈ [0, p], in σ AB , but only depends on the bit error rate p = p 10 + p 11 , this corresponds to finding the maximum of I(X : E). Let us assume for a moment that this maximum is achieved for independent bit and phase errors, i. e. we consider the state σ AB with {p uv } = {1 − 2p + t, p − t, t, p − t} and t = p 2 . In this case |Ψ | u does not depend on u, and we get (14) are now completely decoupled. As it was shown in [15], the fact that E 1 is classical allows the corresponding state describing dependent errors to be reconstructed from this state: After tracing out the E 1 part, we add an ancilla [0] E3 , apply and eventually dephase the ancilla. Since quantum mutual information never increases under local operations, the maximum of I(X : E) is indeed achieved for independent errors and we get Subtraction of (18) from (12) gives the secure key rate for the BB84 protocol:  Omitting the maximization over q, the above formula gives the key rate r m,q (p) for some fixed values of m and q as a function of the bit error rate p. By setting r m,q (p) equal to zero, we find p max (m, q), the maximum tolerable bit error rate for given m and q. For very high levels of added noise, i. e. for q = 1 2 − ǫ, we find that for all values of m, the key rate becomes zero at the bit error rate p max (m, q = 1 2 − ǫ) = 12.4120%, but by adding less noise at higher values of m, secret keys can be generated for even larger bit error rates.
Without the use of the cat code (i. e. if we take m = 1) the rate reduces to [11,12] r(p) = max With neither local randomization (q = 0) nor use of the cat code (m = 1) the key rate (20) becomes even smaller [3], and secure key generation becomes impossible for bit error rates higher than p max = 11.0028%. Figure 3 shows plots of the key rates given by (21) and (20) (black) and the maximum over the key rates given by (19) (red) for values of m up to 250. The increase of the maximal tolerable bit error rate with the block length m is illustrated in figure 1. The highest value of m for which we maximized the tolerable bit error rate as function of the added noise q was m = 500 leading to p max (m = 500, q = 0.32656) = 12.9379%.
By far the most difficult part in the numerical evaluation of (19) is computing the von Neumann entropy, as it contains a sum of two m-fold tensor products of different one qubit density operators. Such an expression can be more efficiently calculated by taking into account its block diagonal structure which follows from permutation invariance, as detailed in the Appendix.

6-state
Since the set Γ only contains the single state {p uv } = {1 − 3 2 p, p 2 , p 2 , p 2 }, minimization over σ AB is unnecessary and the secure key rate is directly given by the difference of the quantum mutual informations between Alice and Bob (12) and Alice and Eve. Despite the simplicity of Γ, this calculation is more difficult than BB84 due to the correlation between bit and phase errors. The corresponding conditional probabilities are given by p v=1|u=0 = p 2(1−p) = p ′ , p v=0|u=0 = 1 − p ′ and p v|u=1 = 1 2 . Therefore, denoting the number of ones in u as u and by reordering the qubits in such a way that the first u qubits are the ones with u i = 1, we get Reordering the state in this manner does not change the entropy, and so will not alter the rate. Using these results the quantum mutual information between Alice and Eve can be expressed as Since σ and ZσZ are diagonal in the same basis we are able to write the von Neumann entropy as which is of the same form as the von Neumann entropy in (18). Therefore the same methods for evaluation can be applied; see the Appendix. The secure key rate is given by subtracting (24) from (12), As it is the case for the BB84 protocol, the key rate becomes zero for all values of m for q → 1 2 (this time at bit error rate p max (m, q = 1 2 − ǫ) = 14.1119%), but again adding less noise at higher values of m gives rise to secret keys for even higher bit error rates.
In figure 4 we show the key rates in these special cases as well as the general case for optimal noise and blocklengths up to m = 125. Included are q = 0, m = 1 (black), q = 0, m = 5 (dotted), and m = 1 for the optimal q (black). The maximum over the key rates given by (26) for values of m up to 125 is shown in red, along with the specific case of m = 125. The increase of the maximal tolerable bit error rate with the block length m is illustrated in figure  1. The highest value of m for which we maximized the tolerable bit error rate as function of the added noise q was m = 250 leading to p max (m = 250, q = 0.31210) = 14.5741%. Since the computation for larger blocksizes becomes rather slow, we extrapolated the value for the optimum noise leading to q ≈ 0.31650 for m = 300. By calculating the highest tolerable bit error for this value of noise we get the best lower bound p max (m = 300, q = 0.31650) = 14.5930%.

Iterated Preprocessing
By combining local randomization with the cat-code of size m, Alice and Bob gain an advantage over Eve and intuitively it seems this advantage might be even bigger by performing the procedure twice. In this section we discuss such a twofold iterated protocol where Alice adds noise at a rate q to m 2 blocks of size m 1 each, and then after measuring the syndromes of these blocks, adds further noise at another rate Q to the m 2 'key' bits of these blocks. Then the syndrome of these m 2 bits is measured and the remainder of the protocol proceeds as usual. We restrict ourselves to the BB84 protocol for simplicity. Using essentially the same argument as in section 2.1.1, we find that we only need to consider independent bit and phase errors described by the state σ AB with {p uv } = {1 − 2p + t, p − t, t, p − t} and t = p 2 : (i) I(X : Y ) depends only on the bit error rate p = p 10 + p 11 , (ii) therefore we have to find the maximum of I(X : E), (iii) which is achieved for independent errors. The proof of (iii) works as in section 2.1.1, since, as we will see, E 1 of σ XE is again classical.
a Note that in [8,9] the quantity under consideration was the capacity of the quantum depolarizing channel with {puv} = {1 − p, p 3 , p 3 , p 3 } therefore leading to pmax = 3 2 × 12.6904% Secure key rate r of the 6-state protocol for various types of preprocessing versus bit error rate p. No preprocessing corresponds to r Lo , noisy preprocessing to r m=1 , and the maximum achievable rate over all blocklengths m ≤ 125, to rmax, shown in red. For the rates achieved by the blocklengths m = 1 and m = 125, the corresponding rate of the added noise is shown on the right y-axis. The dotted rate with pmax = 12.6904% is due to Lo, corresponding to use of a repetition code of blocklength m = 5 and no noisy preprocessing.

Rate Calculation
We start with (9), now denoting m as m 1 . Adding additional noise at rate Q to the key bit the state is described as with classical registers B, A ′ and A ′′ and the same relationship s = ( ξ 1 · ( u + f ), . . . , ξ m1−1 · ( u + f )) as before. Now we consider the m 2 -fold tensor product |σ ′ ⊗m2 ABE and define the abbreviations U = ( ξ m1 · ( u 1 + f 1 ), . . . , ξ m1 · ( u m2 + f m2 )) and V = ( η m1 · v 1 , . . . , η m1 · v m2 ). Again Alice and Bob both measure their stabilizers, Alice sends her result to Bob, who calculates the relative syndrome S = ( ξ 1 · ( U + F ), . . . , ξ m2−1 · ( U + F )). Both then measure their key bit. The tripartite semiclassical state describing the correlations is now given by To calculate the quantum mutual information between Alice and Bob we trace out Eve's systems and obtain Since Alice's additional noise f is now combined with Eve's noise u, f no longer appears in the the syndromes s i and S: ). The mutual information can therefore be written as where the probability distributionP ′ only depends on the number of ones in each of the syndromes s i and S (we assume that the zeros and ones in S are ordered such that the syndromes s i , i ∈ {1, . . . , m 2 − S}, correspond to S i = 0): In addition we see from (34) that for a given value of S only the frequency distribution of the s i , i ∈ {1, . . . , m 2 − S}, and the s j , j ∈ {m 2 − S + 1, . . . , m 2 }, matters. This fact can be used to speed up the calculation of the sum over the syndromes in (33). Since ρ x , the mutual information between Alice and Eve can be seen to be Once more the secure key rate is given by the difference of these mutual informations, Again the hardest part in the numerical evaluation of (36) comes from the von Neumann entropies. One contains a sum of two m 2 -fold tensor products of different density operators, but this time these density operators are m 1 -qubit density operators. Such an expression can also be calculated more efficiently by taking into account its permutation invariance. For more details see the Appendix.
We compare the resulting key rate of the m 1 × m 2 = 3 × 3 iterated code with the key rates of the non-iterated codes of blocksizes m ∈ {9, 10, 11} in figure 5.

Conclusions
Although sending quantum information and establishing a secret key are not equivalent uses of a quantum channel, their similarities are enough to ensure a fruitful exchange of techniques between the two problems. Here we have extended the application of structured codes to the problem of QKD given in [15] to the 6-state protocol, showing how preprocessing based on both structured codes and local randomization leads to higher tolerable error rates. Having one more unbiased basis implies correlation between bit and phase errors of the estimated quantum state, leading to increased robustness of the protocol. Indeed, it seems likely that for large blocklength (m ≈ 500) the threshold of the 6-state protocol exceeds the lowest known upper bound on the threshold for the BB84 protocol (14.6447%). This method of preprocessing does not close the gap between BB84 upper and lower bounds, however, as the available data suggests that the BB84 threshold never exceeds roughly 13% even for asymptotically-long blocks. For the 6-state protocol, more data is needed to draw even a partial conclusion on the asymptotic threshold. Additionally, we have shown that further performance gains are possible when iterating the preprocessing step. Although our results are confined to two rounds with small block sizes, we can nevertheless already observe some general properties. The entire rate curve shifts to higher values, so this type of processing might be useful in increasing the efficiency of protocols running over noisy channels. Intriguingly, the total amount of noise added to the sifted key bits is essentially the same as in the case of one round, showing that the improvement comes from making better use of the same amount of noise. More sophisticated representation-theoretic methods, in particular a Clebsch-Gordon decomposition of the states input to the second preprocessing round, should make analysis of more rounds and larger blocksizes tractable. number of Young tableaux N Y (λ) specifies degeneracy. Meanwhile, the dimension of the blocks is given by the corresponding number of Weyl tableaux N W (λ).
This structure is clearly helpful for the calculation of expressions like S(αρ ⊗m + βσ ⊗m ). The entropy of the state reduces to the sum of entropies of the blocks, which itself factors into the entropy for a block (λ, p λ ) with a fixed Young tableau p λ , say the first one, times the corresponding degeneracy N Y (λ).
For d > 2 we explicitly calculate both the ρ λ and the σ λ blocks using (A.1), e. g.
The Schur transform itself can be obtained using e. g. the eigenfunction method [20]. For the iterated protocol it may be possible to further streamline the calculation by taking into account the fact that the qudit inputs to the second round are themselves block-diagonal. Computations for much larger blocksizes m 1 × m 2 may then become feasible. For d = 2 things are simpler, as Young diagrams λ consist of at most two rows and can be labeled by an index j, where 2j is the number of columns consisting of one row only (j = 0 . . . m 2 if m is even, The dimension of an irreducible representation with label j is N W (j) = 2j + 1 and the Weyl tableaux are now labeled k = −j, . . . , j, whereas j + k denotes the number of ones in the first row of the Weyl tableaux: The corresponding degeneracy follows from Robinson's hook length formula, which in this case yields N Y (j) = m m/2 − j 2j + 1 m/2 + j + 1 . (A.4) We diagonalize ρ and σ, denoting the two eigenvalues of ρ [σ] as ρ 1 and ρ 2 [σ 1 and σ 2 ], and note that diagonal density operators like ̺ and ς can easily be expressed in the j-th representation, since they are diagonal in all these representations, too. The action of ̺ ⊗m on basis states (A.1) of the Schur basis becomes simply a multiplication by powers of the two eigenvalues because of the symmetry properties of these basis states: Each basis state of the Schur basis labeled by a certain Young diagram j and Weyl tableaux k consists of a superposition of computational basis states which are permutations of |01 ⊗(m/2−j) |0 ⊗(j−k) |1

⊗(j+k)
independently of the Young tableaux (specifying degeneracy). We obtain ̺ j = diag{ρ j−k and an analogous expression for ς j . To get the non-diagonal original block ρ j [σ j ] we have to apply the unitary U ρ [U σ ] in the irrep j which is given by the Wigner rotation matrices D j (U ρ ) [D j (U σ )]. In our case these Wigner matrices are given simply by matrix exponentiation, D j (U ρ ) = exp(− θ(ρ) 2 (J + −J − )), where θ(ρ) denotes a phase calculated from ρ, and J ± denotes the usual angular momentum ladder operators, J ± |jm = j(j + 1) + m(m ± 1)|jm ± 1 . In this way it becomes feasible to calculate expressions like S(ασ ⊗m + βρ ⊗m ) for values of m up to several hundreds.