Covert Capacity of Bosonic Channels

Christos N. Gagatsos, Michael S. Bullock, and Boulat A. Bash C. N. Gagatsos is with the College of Optical Sciences, University of Arizona, Tucson, AZ. M. S. Bullock is with the Electrical and Computer Engineering Department, University of Arizona, Tucson, AZ. B. A. Bash is with the Electrical and Computer Engineering Department, and the College of Optical Sciences, University of Arizona, Tucson, AZ.CNG acknowledges the Office of Naval Research (ONR) MURI program on Optical Computing under grant no. N00014-14-1-0505. MSB and BAB were sponsored by the Army Research Office under Grant Number W911NF-19-1-0412. This material is based upon work supported in part by the National Science Foundation under Grant No. CCF-2006679. The authors also acknowledge General Dynamics Mission Systems for supporting this research.

Abstract

We investigate the quantum-secure covert-communication capabilities of lossy thermal-noise bosonic channels, the quantum-mechanical model for many practical channels. We determine the expressions for the covert capacity of these channels: $L_{\text{no-EA}}$ , when Alice and Bob share only a classical secret, and $L_{\text{EA}}$ , when they benefit from entanglement assistance. We find that entanglement assistance alters the fundamental scaling law for covert communication. Instead of $L_{\text{no-EA}}\sqrt{n}-r_{\text{no-EA}}(n)$ , $r_{\text{no-EA}}(n)=o(\sqrt{n})$ , entanglement assistance allows $L_{\text{EA}}\sqrt{n}\log n-r_{\text{EA}}(n)$ , $r_{\text{EA}}(n)=o(\sqrt{n}\log n)$ , covert bits to be transmitted reliably over $n$ channel uses.

I Introduction

In contrast to standard information security methods (e.g., encryption, information-theoretic secrecy, and quantum key distribution (QKD)) that protect the transmission’s content from unauthorized access, covert or low probability of detection/intercept (LPD/LPI) communication [1, 2, 3] prevents adversarial detection of transmissions in the first place. The covertness requirement constrains the transmission power averaged over the blocklength $n$ to $\propto 1/\sqrt{n}$ , where the power is either measured directly in watts [1, 2] and mean photon number [4, 5] output by a physical transmitter, or indirectly, as the frequency of non-zero symbol transmission over the discrete classical [6, 7] and quantum [8, 9] channels.

For many channels, including classical additive white Gaussian noise (AWGN) [1, 2], and discrete memoryless channels (DMCs) [6, 7], the power constraint prescribed by the covertness requirement imposes the square root law (SRL): no more than $L\sqrt{n}$ covert bits can be transmitted reliably in $n$ channel uses. We call constant $L$ the covert capacity of a channel, since it only depends on the channel parameters and captures a fundamental limit. Attempting to transmit more results in either detection by the adversary with high probability as $n\rightarrow\infty$ , or unreliable transmission. Even though the Shannon capacity [10] of such channels is zero (since $\lim_{n\rightarrow\infty}\frac{L\sqrt{n}}{n}=0$ ), the SRL allows reliable transmission of a significant number of covert bits for large $n$ .

To date, the focus has been on classical covert communication. However, quantum mechanics governs the fundamental laws of nature, and quantum information theory [11, 12] is required to determine the ultimate limits of any communications system. Here we focus on the lossy thermal noise bosonic channel depicted in Fig. 1, called the bosonic channel for brevity, and formally described in Section II-B. The bosonic channel is a quantum-mechanical model of many practical channels (including optical, microwave, and radio frequency (RF)). This channel is parametrized by the power coupling (transmissivity) $\eta$ between the transmitter Alice and the intended receiver Bob, and the mean photon number $\bar{n}_{\rm B}$ per mode injected by the thermal environment, where a single spatial-temporal-polarization mode is our fundamental transmission unit. We call a covert communication system quantum secure when it is robust against an adversary Willie who not only knows the transmission parameters (including the start time, center frequency, duration, and bandwidth), but also has access to all the transmitted photons that are not captured by Bob, as well as arbitrary quantum information processing resources (e.g., joint detection measurement, quantum memory, and quantum computing). While our approach is motivated by the security standards from the QKD literature, covertness demands a different set of assumptions. We require excess noise that is not under Willie’s control (e.g., the unavoidable thermal noise from the blackbody radiation at the center wavelength of transmission and the receiver operating temperature). This assumption is not only well-grounded in practice, but also necessary for covertness, as the transmissions cannot be hidden from quantum-capable Willie that fully controls noise on the channel [4, Th. 1],[13]. Finally, we assume that Alice and Bob share a resource that is inaccessible by Willie. This enables covertness irrespective of channel conditions, as well as substantially increases the number of reliably-transmissible covert bits when the resource is an entangled quantum state.

Refer to caption — Figure 1: Single-mode bosonic channel $\mathcal{E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}$ modeled by a beamsplitter with transmissivity $\eta$ and an environment injecting a thermal state $\hat{\rho}_{\bar{n}_{\rm B}}$ with mean photon number $\bar{n}_{\rm B}$ . $\hat{a}$ , $\hat{e}$ , $\hat{b}$ , and $\hat{w}$ label input/output modal annihilation operators.

In [5] we develop an expression for the maximum mean photon number $\bar{n}_{\rm S}$ that Alice can transmit under the aforementioned quantum-secure covertness conditions. We also present the expression for the covert capacity $L$ for the bosonic channel and argue that it is achievable using a random coding scheme. However, [5] focuses on the prescription for maintaining covertness of a transmission, with the capacity proofs left out. Here, we fill in this gap by rigorously examining the coding limits for covert communication over the bosonic channels.

Our main contribution is the analysis of the covert communication system depicted in Fig. 2 and formally described in Sec. II-C, with and without an entangled resource state shared by Alice and Bob. Since entanglement assistance gain manifests only when $\bar{n}_{\rm S}\to 0$ and $\bar{n}_{\rm B}>0$ , we expect it to benefit covert communication. We find that entanglement assistance, in fact, alters the fundamental scaling law of covert communication. Using the asymptotic notation defined in Sec. II-A:

1.

We show that without entanglement assistance, the SRL has a standard form: $M_{\text{no-EA}}=L_{\text{no-EA}}\sqrt{n}-r_{\text{no-EA}}(n)$ , $r_{\text{no-EA}}(n)=o(\sqrt{n})$ , covert bits transmissible reliably over $n$ channel uses. Our second-order bound is similar to classical [14]: $M_{\text{no-EA}}\geq L_{\text{no-EA}}\delta\sqrt{n}+K_{\text{no-EA}}\Phi^{-1}(\epsilon)n^{1/4}+\mathcal{O}(n^{n/8})$ , where $\epsilon$ is the average decoding error probability and $\Phi^{-1}(x)$ is the inverse-Gaussian cumulative distribution function.¹¹1Note that $\Phi^{-1}(x)<0$ for $0<x<\frac{1}{2}$ . We also show that quadrature phase shift keying (QPSK) modulation achieves the same constants $L_{\text{no-EA}}$ and $K_{\text{no-EA}}$ as the optimal Gaussian modulation.
2.

We show that with entanglement assistance, the scaling law becomes $M_{\text{EA}}=L_{\text{EA}}\sqrt{n}\log n-r_{\text{EA}}(n)$ , $r_{\text{EA}}(n)=o(\sqrt{n}\log n)$ . We derive the expression for the optimal constant $L_{\text{EA}}$ and the second-order bound.²²2Our fundamental information unit is a bit and $\log x$ indicates the binary logarithm, while $\ln x$ is the natural logarithm. While a practical-receiver structure that achieves $L_{\text{EA}}$ is an open problem, we discuss a design [15] that achieves the $\mathcal{O}(\sqrt{n}\log n)$ scaling law, albeit with a constant $\approx\frac{L_{\text{EA}}}{2}$ .

Next, we present the mathematical prerequisites, including the asymptotic notation, the channel and system models, the formal definitions of covertness and reliability, and the bounds we need. We state and prove our results in Sec. III. We conclude with the discussion of future work in Sec. IV, including investigating the shared resource state size, the entanglement-assisted receiver design for covert communication, and the possible relationship of the scaling law for entanglement-assisted covert communication to a corner case in classical and non-entanglement assisted classical-quantum covert communication.

II Prerequisites

II-A Asymptotic notation

We use the standard asymptotic notation [16, Ch. 3.1], where $f(n)=\mathcal{O}(g(n))$ denotes an asymptotic upper bound on $f(n)$ (i.e. there exist constants $m,n_{0}>0$ such that $0\leq f(n)\leq mg(n)$ for all $n\geq n_{0}$ ) and $f(n)=o(g(n))$ denotes an upper bound on $f(n)$ that is not asymptotically tight (i.e. for any constant $m>0$ , there exists constant $n_{0}>0$ such that $0\leq f(n)<mg(n)$ for all $n\geq n_{0}$ ). We note that $f(n)=\mathcal{O}(g(n))$ is equivalent to $\limsup_{n\to\infty}\left|\frac{f(n)}{g(n)}\right|<\infty$ and $f(n)=o(g(n))$ is equivalent to $\lim_{n\to\infty}\frac{f(n)}{g(n)}=0$ .

II-B Channel model

We focus on a single-mode lossy thermal noise bosonic channel ${\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}$ in Fig. 1. It quantum-mechanically describes the transmission of a single (spatio-temporal-polarization) mode of the electromagnetic field at a given transmission wavelength (such as optical or microwave) over linear loss and additive Gaussian noise (such as noise stemming from blackbody radiation). Here, we introduce the bosonic channel briefly, deferring the details to [17, 18, 19, 20]. The attenuation in the Alice-to-Bob channel is modeled by a beamsplitter with transmissivity (fractional power coupling) $\eta$ . The input-output relationship between the bosonic modal annihilation operators of the beamsplitter, ${\hat{b}}=\sqrt{\eta}{\hat{a}}+{\sqrt{1-\eta}}{\hat{e}}$ , requires the “environment” mode ${\hat{e}}$ to ensure that the commutator $\left[{\hat{b}},{\hat{b}}^{\dagger}\right]=1$ , and to preserve the Heisenberg uncertainty law of quantum mechanics. On the contrary, classical power attenuation is described by $b={\sqrt{\eta}}a$ , where $a$ and $b$ are complex amplitudes of input and output mode functions. Bob captures a fraction $\eta$ of Alice’s transmitted photons, while Willie has access to the remaining $1-\eta$ fraction. We model noise by mode $\hat{e}$ being in a zero-mean thermal state $\hat{\rho}_{\bar{n}_{\rm B}}$ , respectively expressed in the coherent state (quantum description of ideal laser light) and Fock (photon number) bases as follows:

\displaystyle\hat{\rho}_{\bar{n}_{\rm B}}

\displaystyle=\frac{1}{\pi\bar{n}_{\rm B}}\int_{\mathbb{C}}\exp\left[-\frac{|\alpha|^{2}}{\bar{n}_{\rm B}}\right]\mathop{}\!\mathrm{d}^{2}\alpha\left|\alpha\right>\left<\alpha\right|=\sum_{k=0}^{\infty}t_{k}(\bar{n}_{\rm B})\left|k\right>\left<k\right|,

(1)

where

\displaystyle t_{k}(\bar{n})

\displaystyle=\frac{\bar{n}^{k}}{(1+\bar{n})^{k+1}}

(2)

and $\bar{n}_{\rm B}$ is the mean photon number per mode injected by the environment.

II-C System model

The covert communication framework is depicted in Fig. 2. Our fundamental transmission unit is the field mode described above. We assume a discrete-time model with $n=2TW$ modes available to Alice and Bob. $TW$ is the number of orthogonal temporal modes, which is the product of the transmission duration $T$ (in seconds) and the optical bandwidth $W$ (in Hz) of the source around its center frequency, and the factor of two corresponds to the use of both orthogonal polarizations. The orthogonality of the available modes results in the bosonic channel ${\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}$ being memoryless. Alice and Bob have access to a bipartite resource state $\hat{\rho}^{S^{m}R^{m}}$ occupying $m$ systems $S$ at Alice and $R$ at Bob. Correlations between parts of $\hat{\rho}^{S^{m}R^{m}}$ in systems $S$ and $R$ can either be classical or quantum, resulting in either a classical-quantum or an entangled state $\hat{\rho}^{S^{m}R^{m}}$ . The latter allows entanglement-assisted communication.

II-D Coding and reliability

Alice desires to transmit one of $2^{M}$ equally-likely $M$ -bit messages $x\in\left\{1,\ldots,2^{M}\right\}$ covertly to Bob using $n$ available modes of the bosonic channel ${\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}$ and her share of the resource state $\hat{\rho}^{S^{m}R^{m}}$ . Her encoder is a set of encoding channels $\left\{\mathcal{M}^{(x)}_{S^{m}\to A^{n}}\right\}$ . Alice encodes message $x$ by acting on $m$ systems $S$ of $\hat{\rho}^{S^{m}R^{m}}$ with $\mathcal{M}^{(x)}_{S^{m}\to A^{n}}$ , transforming $\hat{\rho}^{S^{m}R^{m}}$ to $\hat{\rho}^{A^{n}R^{m}}_{x}=\mathcal{M}^{(x)}_{S^{m}\to A^{n}}(\hat{\rho}^{S^{m}R^{m}})$ . Transmission of the resulting $n$ systems $A$ over $n$ uses of ${\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}$ results in Bob receiving the state $\hat{\rho}^{B^{n}R^{m}}_{x}=\operatorname{Tr}_{W^{n}}\left[\left[{\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}\right]^{\otimes n}\left(\mathcal{M}^{(x)}_{S^{m}\to A^{n}}(\hat{\rho}^{S^{m}R^{m}})\right)\right]$ , where $\hat{\rho}^{A}=\operatorname{Tr}_{B}\left[\hat{\rho}^{AB}\right]$ denotes the partial trace over system $B$ . Bob decodes $x$ by applying a positive operator-valued measure (POVM) $\left\{\Lambda^{(x)}_{B^{n}R^{m}}\right\}$ to $\hat{\rho}^{B^{n}R^{m}}_{x}$ . Denoting by $X$ and $\check{X}$ the respective random variables corresponding to Alice’s message and Bob’s estimate of it, the average decoding error probability is:

\displaystyle P_{\rm e}=\frac{1}{2^{M}}\sum_{x=1}^{2^{M}}P(\check{X}\neq x|X=x),

(3)

where $P(\check{X}\neq x|X=x)=\operatorname{Tr}\left[\left(\hat{I}-\Lambda^{(x)}_{B^{n}R^{m}}\right)\hat{\rho}^{B^{n}R^{m}}_{x}\right]$ . We call the communication system reliable if, for any $\epsilon\in(0,1)$ , there exists $n$ large enough with a corresponding resource state $\hat{\rho}^{S^{m}R^{m}}$ , encoder $\left\{\mathcal{M}^{(x)}_{S^{m}\to A^{n}}\right\}$ , and decoder POVM $\left\{\Lambda^{(x)}_{B^{n}R^{m}}\right\}$ , such that $P_{\rm e}\leq\epsilon$ .

II-E Quantum-secure covertness

As is standard in information theory of covert communication, we assume that Willie cannot access $\hat{\rho}^{S^{m}R^{m}}$ , although he knows how it is generated. To be quantum secure, a covert communication system has to prevent the detection of Alice’s transmission by Willie, who has access to all transmitted photons that are not received by Bob and arbitrary quantum resources. Thus, the quantum state $\hat{\rho}^{W^{n}}_{1}=\sum_{x=1}^{2^{M}}\frac{1}{2^{M}}\operatorname{Tr}_{B^{n}R^{m}}\left[\left[{\cal E}^{(\eta,\bar{n}_{\rm B})}_{A\to BW}\right]^{\otimes n}\left(\mathcal{M}^{(x)}_{S^{m}\to A^{n}}(\hat{\rho}^{S^{m}R^{m}})\right)\right]$ , observed by Willie when Alice is transmitting, has to be sufficiently similar to the product thermal state $\hat{\rho}_{\eta\bar{n}_{\rm B}}^{\otimes n}$ that describes the noise observed when she is not. We call a system covert if, for any $\delta>0$ and $n$ large enough, $D\left(\hat{\rho}^{W^{n}}_{1}\|\hat{\rho}_{\eta\bar{n}_{\rm B}}^{\otimes n}\right)\leq\frac{\delta}{\log e}$ . Arbitrarily small $\delta>0$ implies that the performance of a quantum-optimal detection scheme is arbitrarily close to that of a random coin flip through quantum Pinsker’s inequality [12, Th. 10.8.1]. The properties of both classical and quantum relative entropy are highly attractive for mathematical proofs, and were used to analyze covert communication [1, 2, 3, 4, 5, 6, 7, 8, 9]. We discuss the significance of the quantum relative entropy in [5, Sec. II.B]. The maximum mean photon number per mode $\bar{n}_{\rm S}$ that Alice can transmit under the covertness constraint is [5]:

\displaystyle\bar{n}_{\rm S}

\displaystyle=\frac{\sqrt{\delta}c_{\rm cov}}{\sqrt{n}},

(4)

where

\displaystyle c_{\rm cov}

\displaystyle=\frac{\sqrt{2\eta\bar{n}_{\rm B}(1+\eta\bar{n}_{\rm B})}}{1-\eta}.

(5)

When the exact values for the environment mean photon number per mode $\bar{n}_{\rm B}$ and the transmissivity $\eta$ are unknown, Planck’s law and the diffraction-limited propagation model provide a useful lower bound. Coherent-state modulation using the continuous-valued complex Gaussian distribution [4, Th. 2] and practical QPSK scheme [5, Th. 2] achieve the constant (5).

While quantum resources, such as entanglement shared between Alice and Bob, or quantum states lacking a semiclassical description (e.g., squeezed light) do not improve signal covertness, the quantum methodology allows covertness without assumptions of adversary’s limits, other than the laws of physics. However, the square root scaling in (4) holds even when Willie uses readily-available devices such as noisy photon counters [4, Th. 5], with a constant larger than $c_{\rm cov}$ . Nevertheless, here we show that quantum resources—specifically, entanglement assistance—allow the transmission of significantly more covert bits. Next, we discuss the finite blocklength capacity bounds that we use in our proofs.

II-F Finite blocklength capacity bounds for bosonic channels

One can obtain the converse results for covert communication using the standard channel coding theorems. However, covertness introduces the dependence of the mean photon number per mode $\bar{n}_{\rm S}$ on the blocklength $n$ in (4). This complicates both classical and quantum achievability proofs by rendering invalid the conditions for employing standard results such as the asymptotic equipartition property. Classical results [6, 7] overcome this issue using the information spectrum methods [21, 22, 23]. However, until recently, quantum information spectrum approaches [24, 25] have been limited to channels with output quantum states living in the finite-dimensional Hilbert space, which is not the case for bosonic channels. We now rehash a lower bound on the second-order coding rate from [26, 27] that is based on the new quantum union bound [26].

Define quantum relative entropy $D(\hat{\rho}\|\hat{\sigma})$ between states $\hat{\rho}$ and $\hat{\sigma}$ , and its second, third, and fourth absolute central moments as follows:

$\displaystyle D(\hat{\rho}\\|\hat{\sigma})$	$\displaystyle=\operatorname{Tr}\left[\hat{\rho}\log\hat{\rho}-\hat{\rho}\log\hat{\sigma}\right]$	(6)
$\displaystyle V(\hat{\rho}\\|\hat{\sigma})$	$\displaystyle=\operatorname{Tr}\left[\hat{\rho}\left\|\log\hat{\rho}-\log\hat{\sigma}-D(\hat{\rho}\\|\hat{\sigma})\right\|^{2}\right]$	(7)
$\displaystyle T(\hat{\rho}\\|\hat{\sigma})$	$\displaystyle=\operatorname{Tr}\left[\hat{\rho}\left\|\log\hat{\rho}-\log\hat{\sigma}-D(\hat{\rho}\\|\hat{\sigma})\right\|^{3}\right]$	(8)
$\displaystyle Q(\hat{\rho}\\|\hat{\sigma})$	$\displaystyle=\operatorname{Tr}\left[\hat{\rho}\left\|\log\hat{\rho}-\log\hat{\sigma}-D(\hat{\rho}\\|\hat{\sigma})\right\|^{4}\right],$	(9)

where $V(\hat{\rho}\|\hat{\sigma})$ is quantum relative entropy variance. The finite blocklength capacity of a memoryless classical-quantum channel described in Sec. II-C is characterized as follows:

Lemma 1.

Suppose that the channel from Alice to Bob is memoryless, such that over $n$ uses $\mathcal{N}_{A^{n}\to B^{n}}=\left(\mathcal{N}_{A\to B}\right)^{\otimes n}$ . There exists a coding scheme that employs a shared resource state $\rho^{S^{m}R^{m}}$ to transmit $M$ bits over $n$ uses of $\mathcal{N}_{A\to B}$ with arbitrary decoding error probability $\epsilon$ for a sufficiently large $n$ and $m$ , such that:

\displaystyle M

\displaystyle\geq nD\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)+\sqrt{nV\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}\Phi^{-1}(\epsilon)-C_{n},

(10)

where $C_{n}=\frac{C_{\text{B-E}}}{\sqrt{2\pi}}\frac{\left[Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)\right]^{3/4}}{V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}+\frac{\sqrt{V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}}{\sqrt{2\pi}}+\log(4\epsilon n)$ , $C_{\text{B-E}}$ is the Berry-Esseen constant satisfying $0.40973\leq C_{\text{B-E}}\leq 0.4784$ , $\hat{\rho}^{BR}$ is Bob’s marginal state for the output of a single channel use, and $\Phi^{-1}(x)$ is the inverse-Gaussian distribution function.

Proof:

Suppose Alice and Bob have access to $m=n2^{M}$ bipartite systems $SR$ containing $m$ copies of the resource state $\hat{\rho}^{SR}$ , with Alice restricted to system $S$ and Bob to system $R$ . Denote by $\hat{\rho}^{S_{k}R_{k}}$ the state $\hat{\rho}^{SR}$ in the $k^{\text{th}}$ bipartite system $S_{k}R_{k}$ , $k=1,\ldots,m$ . Alice and Bob agree to divide these $m$ systems into $2^{M}$ non-overlapping $n$ -system subsets, each mapping to a message $x\in\left\{1,\ldots,2^{M}\right\}$ . Denote the corresponding subsets of system indexes by $\mathcal{X}(x)$ . The encoding channel is thus $\mathcal{M}^{(x)}_{S^{m}\to A^{n}}\left(\left(\hat{\rho}^{SR}\right)^{\otimes m}\right)=\operatorname{Tr}_{S_{k},k\notin\mathcal{X}(x)}\left[\left(\hat{\rho}^{SR}\right)^{\otimes m}\right]$ . Alice sends $x$ to Bob by transmitting the corresponding codeword over $n$ uses of $\mathcal{N}_{A\to B}$ . The authors of [26, 27] call this scheme position-based coding. Bob’s received state is $\hat{\rho}^{B^{n}R^{m}}=\bigotimes_{k\in\mathcal{X}(x)}\hat{\rho}^{B_{k}R_{k}}\bigotimes_{k\notin\mathcal{X}(x)}\operatorname{Tr}_{S_{k}}\left[\hat{\rho}^{S_{k}R_{k}}\right]$ , where $\hat{\rho}^{B_{k}R_{k}}=\mathcal{N}_{A\to B}\left(\hat{\rho}^{S_{k}R_{k}}\right)$ . Bob constructs $2^{M}$ binary projective measurements corresponding to each message, and applies them sequentially to $\hat{\rho}^{B^{n}R^{m}}$ . This operation, resembling a matched filter from classical communication, is called sequential decoding in [26, 27]. Its analysis in [26, Sec. 5] proves that

\displaystyle M

\displaystyle\geq D_{\rm H}^{\epsilon-\zeta}\left(\left(\hat{\rho}^{BR}\right)^{\otimes n}\middle\|\left(\hat{\rho}^{B}\right)^{\otimes n}\otimes\left(\hat{\rho}^{R}\right)^{\otimes n}\right)-\log\left(4\epsilon/\zeta^{2}\right),

(11)

where $D_{\rm H}^{\epsilon}\left(\hat{\rho}\middle\|\hat{\sigma}\right)$ is the hypothesis testing relative entropy [28, 29] defined in [26, Eq. (5.2)] and $\zeta\in(0,\epsilon)$ . Specifically, [26, Corr. 8] yields (11) when $\hat{\rho}^{SR}$ is classical-quantum and [26, Th. 6] when it is entangled. The standard steps for deriving the second-order rate bounds in the proof of [26, Prop. 13] up to [26, Eq. (A.24)] yield:

\displaystyle D_{\rm H}^{\epsilon-\zeta}\left(\left(\hat{\rho}^{BR}\right)^{\otimes n}\middle\|\left(\hat{\rho}^{B}\right)^{\otimes n}\otimes\left(\hat{\rho}^{R}\right)^{\otimes n}\right)

\displaystyle\geq nD\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)+\sqrt{nV\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}\Phi^{-1}\left(\epsilon-C_{n}^{\prime}\right),

(12)

where $C_{n}^{\prime}=\zeta+\frac{C_{\text{B-E}}T\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}{\sqrt{n\left[V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)\right]^{3}}}$ . Substituting (12) in (11), setting $\zeta=1/\sqrt{n}$ , expanding $\Phi^{-1}\left(\epsilon-C_{n}^{\prime}\right)$ at $\epsilon$ using Lagrange’s mean value theorem [30, Th. 2.3], upperbounding $e^{-x^{2}}\leq 1$ , and employing the convexity argument in [31, Eq. (D.3)] completes the proof. ∎

In contrast to [26], Lemma 1 does not absorb the remainder terms of $C_{n}$ in asymptotic notation, making (10) exact. This is done to account for the dependence of $\bar{n}_{\rm S}$ on $n$ imposed by the covertness constraint (4). Finally, note that skipping the convexity argument concluding the proof yields a tighter but analytically inconvenient bound using (8) instead of (9).

III Results

III-A Covert channel capacity

In classical and quantum information theory [10, 11, 12], the channel capacity is measured in bits per channel use and is expressed as $C=\liminf_{n\to\infty}\frac{M}{n}$ , where $M$ is the total number of reliably-transmissible bits in $n$ channel uses. On the other hand, the power constraint (4) imposed by covert communication implies that $M=o(n)$ and that the capacity of the covert channel is zero. Inspired by [7], we regularize the number of covert bits that are transmitted reliably without entanglement assistance by $\sqrt{n}$ and with entanglement assistance $\sqrt{n}\log n$ , instead of $n$ . This approach allows us to state Definitions 1 and 2 of covert channel capacity and derive the results that follow. For consistency with [7], we also normalize the capacity by the covertness parameter $\delta$ , which we discuss in Section II-E.

III-B Covert communication without entanglement assistance

We define the capacity of covert communication over the bosonic channel when Alice and Bob do not have access to a shared entanglement source as follows:

Definition 1.

The capacity of covert communication without entanglement assistance is:

\displaystyle L_{\rm{no\mathchar 45\relax EA}}

\displaystyle\triangleq\liminf_{n\to\infty}\frac{M_{\rm{no\mathchar 45\relax EA}}}{\sqrt{\delta n}},

(13)

where $M_{\rm{no\mathchar 45\relax EA}}$ is the number of covert bits that are reliably transmissible in $n$ channel uses (modes), and $\delta$ parametrizes the desired covertness.

The following theorem provides the expression for $L_{\text{no-EA}}$ :

Theorem 1.

The covert capacity of the bosonic channel without entanglement assistance is $L_{\rm{no\mathchar 45\relax EA}}=c_{\rm cov}c_{\rm{rel,no\mathchar 45\relax EA}}$ , where $c_{\rm cov}$ is defined in (5) and $c_{\rm{rel,no\mathchar 45\relax EA}}=\eta\log\left(1+\frac{1}{(1-\eta)\bar{n}_{\rm B}}\right)$ .

In order to prove Theorem 1, we prove the following lemma:

Lemma 2.

There exists a sequence of codes with covertness parameter $\delta$ , blocklength $n$ , size $2^{M}$ , and average error probability $\epsilon$ that satisfies:

\displaystyle M_{\rm{no\mathchar 45\relax EA}}

\displaystyle\geq L_{\rm{no\mathchar 45\relax EA}}\sqrt{\delta n}+K_{\rm{no\mathchar 45\relax EA}}\Phi^{-1}(\epsilon)n^{1/4}+\mathcal{O}\left(n^{1/8}\right),

(14)

where $K_{\rm{no\mathchar 45\relax EA}}=\sqrt{c_{\rm{cov}}\sqrt{\delta}(1+2(1-\eta)\bar{n}_{\rm B})}c_{\rm{rel,no\mathchar 45\relax EA}}$ .

Proof:

Alice and Bob follow the construction in the proof of Lemma 1 and generate a random codebook $\mathcal{C}=\{\mathbf{c}(x),x=1,\ldots,2^{M}\}$ mapping $M$ -bit input blocks to $n$ -symbol codewords. Each $\mathbf{c}(x)\in\mathcal{Q}^{n}$ is generated according to $p(\mathbf{c})=\prod_{k=1}^{n}p_{\rm q}(c_{k})$ , where $\mathcal{Q}=\{a,ja,-a,-ja\}$ is the QPSK alphabet and $p_{\rm q}(y)=\frac{1}{4}$ is the uniform distribution over it. We set $a=\sqrt{\bar{n}_{\rm S}}$ , where $\bar{n}_{\rm S}$ is defined in (4). We assume that $\mathcal{C}$ is shared between Alice and Bob before transmission, and is kept secret from Willie. Product coherent states are modulated with amplitudes corresponding to the symbols in each codeword $\mathbf{c}(x)$ : $\hat{\rho}^{A^{n}}_{x}=\bigotimes_{k=1}^{n}\left|c_{k}(x)\right>\left<c_{k}(x)\right|^{A}$ . Thus, Alice transmits the maximum mean photon number that maintains covertness [5, Th. 2].

The shared resource state $\hat{\rho}^{S^{m}R^{m}}=\left(\hat{\rho}^{SR}\right)^{\otimes m}$ is the random codebook $\mathcal{C}$ modulated by coherent states. Thus, $\hat{\rho}^{SR}=\sum_{y\in\mathcal{Q}}p_{\rm q}(y)\left|y\right>\left<y\right|^{A}\otimes\left|y\right>\left<y\right|^{R}$ is a classical-quantum state, system $A$ is in a coherent state $\left|y\right>^{A}$ , and system $R$ is in one of the orthonormal states $\left|y\right>^{R}$ corresponding to QPSK symbol index. Alice’s position-based encoder then selects the systems $S$ corresponding to the $n$ -symbol codeword for message $x$ , and discards the rest. Bob employs the sequential decoding strategy described in [26, Sec. 5] and [27, Sec. 3].

Since the propagation of a coherent state $\left|\alpha\right>$ through the bosonic channel ${\cal E}_{A\to B}^{(\eta,\bar{n}_{\rm B})}$ induces a displaced thermal state $\hat{\rho}_{(1-\eta)\bar{n}_{\rm B}}(\eta\alpha)\equiv\hat{\rho}_{\rm T}(\alpha)$ in Bob’s output port, the received state is $\hat{\rho}^{BR}=\sum_{y\in\mathcal{Q}}p_{\rm q}(y)\hat{\rho}^{B}_{\rm T}(y)\otimes\left|y\right>\left<y\right|^{R}$ , where displaced thermal states $\left\{\hat{\rho}^{B}_{\rm T}(y),y\in\mathcal{Q}\right\}$ form an ensemble corresponding to the transmission of QPSK symbols. Letting $\hat{\bar{\rho}}^{B}\equiv\sum_{y\in\mathcal{Q}}p_{\rm q}(y)\hat{\rho}^{B}_{\rm T}(y)$ ,

$\displaystyle D\left(\hat{\rho}^{BR}\middle\\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)$	$\displaystyle=\chi\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)=S\left(\hat{\bar{\rho}}^{B}\right)-\sum_{y\in\mathcal{Q}}p_{\rm q}(y)S\left(\hat{\rho}^{B}_{\rm T}(y)\right)$	(15)
$\displaystyle V\left(\hat{\rho}^{BR}\middle\\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)$	$\displaystyle=V_{\chi}\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)$
	$\displaystyle=\sum_{y\in\mathcal{Q}}p_{\rm q}(y)\left[V\left(\hat{\rho}^{B}_{\rm T}(y)\middle\\|\hat{\bar{\rho}}^{B}\right)+\left[D\left(\hat{\rho}^{B}_{\rm T}(y)\middle\\|\hat{\bar{\rho}}^{B}\right)\right]^{2}\right]-\left[\chi\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)\right]^{2},$	(16)

where the von Neumann entropy is

\displaystyle S(\hat{\rho})

\displaystyle=-\operatorname{Tr}[\hat{\rho}\log\hat{\rho}],

(17)

while $\chi\left(\left\{p(x),\hat{\rho}_{x}\right\}\right)$ and $V_{\chi}\left(\left\{p(x),\hat{\rho}_{x}\right\}\right)$ are the Holevo information and its variance for ensemble $\left\{p(x),\hat{\rho}_{x}\right\}$ . The closed-form expressions for $\chi\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)$ and $V_{\chi}\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)$ are unknown, and we derive the Taylor series expansions at $\bar{n}_{\rm S}=0$ in Appendices A-2 and A-3:

	$\displaystyle\chi\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)$	$\displaystyle=\bar{n}_{\rm S}c_{\mathrm{rel},\text{no-EA}}+\mathcal{O}(\bar{n}_{\rm S}^{2})$		(18)
	$\displaystyle V_{\chi}\left(\left\{p_{\rm q}(y),\hat{\rho}^{B}_{\rm T}(y)\right\}\right)$	$\displaystyle=\bar{n}_{\rm S}(1+2(1-\eta)\bar{n}_{\rm B})c_{\mathrm{rel},\text{no-EA}}+\mathcal{O}(\bar{n}_{\rm S}^{2}).$		(19)

In Appendix A-4 we show that $Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)=\mathcal{O}\left(\bar{n}_{\rm S}\right)$ . We complete the proof by substituting $\bar{n}_{\rm S}$ from (4) and observing that $\frac{\left[Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)\right]^{3/4}}{V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}=\mathcal{O}\left(n^{1/8}\right)$ dominates the remainder $C_{n}$ in Lemma 1. ∎

We are now ready to prove Theorem 1.

Proof:

Achievability: Dividing both sides of (14) by $\sqrt{n\delta}$ and taking the limit yields the achievable lower bound.

Converse: Let Alice and Bob have access to respective systems $S$ and $R$ of shared infinite-dimensional bipartite classically-correlated resource state $\hat{\rho}^{S^{m}R^{m}}$ , with $m$ arbitrary. Consider a sequence of codes such that the decoding error probability $\epsilon_{n}\to 0$ as $n\to\infty$ . Then:

	$\displaystyle M_{\text{no-EA}}(1-\epsilon_{n})-1$	$\displaystyle\leq I\left(X^{(n)};\check{X}^{(n)}\right)$		(20)
		$\displaystyle\leq nC_{\chi}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B}),$		(21)

where $I\left(X^{(n)};\check{X}^{(n)}\right)$ is the mutual information between random variables $X^{(n)}$ and $\check{X}^{(n)}$ corresponding to Alice’s message and Bob’s decoding of it, (20) follows from Fano’s inequality [10, Th. 2.10.1], (21) is the Holevo bound [11, Th. 12.1], [32] and $C_{\chi}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})=g(\eta\bar{n}_{\rm S}+(1-\eta)\bar{n}_{\rm B})-g((1-\eta)\bar{n}_{\rm B})$ is the Holevo capacity of the bosonic channel from Alice to Bob $\mathcal{E}^{(\eta,\bar{n}_{\rm B})}_{A\to B}$ [33] with

\displaystyle g(x)

\displaystyle\equiv(1+x)\log(1+x)-x\log x.

(22)

The Taylor series expansion of $C_{\chi}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$ around $\bar{n}_{\rm S}=0$ in (21) yields:

	$\displaystyle C_{\chi}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$	$\displaystyle=\eta\bar{n}_{\rm S}\log\left(1+\frac{1}{(1-\eta)\bar{n}_{\rm B}}\right)-\frac{\eta^{2}\bar{n}_{\rm S}^{2}}{(2\ln 2)((1-\eta)\bar{n}_{\rm B}(1+(1-\eta)\bar{n}_{\rm B})}+o(\bar{n}_{\rm S}^{3})$		(23)
		$\displaystyle\leq\eta\bar{n}_{\rm S}\log\left(1+\frac{1}{(1-\eta)\bar{n}_{\rm B}}\right),$		(24)

where (24) follows from Taylor’s theorem with the remainder [30, Ch. V.3]. Substituting (24) and (4) in (21) yields:

\displaystyle M_{\text{no-EA}}(1-\epsilon_{n})-1

\displaystyle\leq\sqrt{n\delta}c_{\rm cov}\eta\log\left(1+\frac{1}{(1-\eta)\bar{n}_{\rm B}}\right).

(25)

Dividing both sides of (25) by $\sqrt{n\delta}$ and taking the limit yields the converse. ∎

Remark: Since, to our knowledge, [26, Corr. 8] was proven only for the discrete inputs, Lemma 1 does not apply to the Gaussian ensemble of coherent states $\mathcal{G}=\left\{\frac{1}{\pi\bar{n}_{\rm S}}\exp\left[-\frac{|\alpha|^{2}}{\bar{n}_{\rm S}}\right],\left|\alpha\right>\right\}$ directly. However, since $\mathcal{G}$ achieves the Holevo capacity of the bosonic channel, we compare the information quantities for QPSK modulation in (18) and (19) to the corresponding ones for $\mathcal{G}$ . Comparison of (18) and (24) confirms the well-known fact [34] that QPSK modulation achieves the Holevo capacity in the low signal-to-noise ratio (SNR) regime. We calculate the Holevo information variance for $\mathcal{G}$ in Appendix B-2 and note that (19) and (86) have the same first term. Thus, the QPSK modulation has the same finite blocklength performance as $\mathcal{G}$ in the low SNR regime.

III-C Entanglement-assisted covert communication

Entanglement assistance increases the communication channel capacity [35, 36]. However, in most practical settings (including optical communication where noise level is low $\bar{n}_{\rm B}\ll 1$ and microwave/RF communication where signal power is high $\bar{n}_{\rm S}\gg 1$ ), the gain over the Holevo capacity without entanglement assistance is at most a factor of two. The only scenario with a significant gain is when $\bar{n}_{\rm S}\to 0$ while $\bar{n}_{\rm B}>0$ [15, App. A]. This is precisely the covert communication setting. In fact, entanglement assistance alters the fundamental square root scaling law for covert communication, changing the normalization from $\sqrt{n}\log n$ to $\sqrt{n}$ :

Definition 2.

The capacity of covert communication with entanglement assistance is:

\displaystyle L_{\rm{EA}}

\displaystyle\triangleq\liminf_{n\to\infty}\frac{M_{\rm{EA}}}{\sqrt{\delta n}\log{n}},

(26)

where $M_{\rm{EA}}$ is the number of covert bits that are reliably transmissible in $n$ channel uses (modes), and $\delta$ parametrizes the desired covertness.

The following theorem provides the expression for $L_{\rm{EA}}$ :

Theorem 2.

The covert capacity of the bosonic channel with entanglement assistance is $L_{\rm{EA}}=c_{\rm cov}c_{\rm{rel,EA}}$ , where $c_{\rm cov}$ is defined in (5) and $c_{\rm{rel,EA}}=\frac{\eta}{2(1+(1-\eta)\bar{n}_{\rm B})}$ .

Thus, while quantum resources such as shared entanglement and joint detection receivers do not affect $\bar{n}_{\rm S}$ , they dramatically impact the amount of information that can be covertly conveyed. As in the proof of Theorem 1, in order to prove Theorem 2, we prove the following lemma:

Lemma 3.

There exists a sequence of codes with covertness parameter $\delta$ , blocklength $n$ , size $2^{M}$ , and average error probability $\epsilon$ that satisfy:

\displaystyle M_{\rm{EA}}

\displaystyle\geq L_{\rm{EA}}\sqrt{\delta n}\log n+K_{\rm{EA}}\Phi^{-1}(\epsilon)n^{1/4}\log n+\mathcal{O}\left(n^{1/8}\log n\right),

(27)

where $K_{\rm{EA}}=\sqrt{c_{\rm{cov}}\sqrt{\delta}c_{\rm{rel},\rm{EA}}}$ .

Proof:

Let the resource state be a tensor product $\left(\left|\psi\right>^{SR}\right)^{\otimes m}$ of a two-mode squeezed vacuum (TMSV) states such that $m=n2^{M}$ and $\left|\psi\right>^{SR}=\sum_{k=1}^{\infty}\sqrt{t_{k}(\bar{n}_{\rm S})}\left|k\right>^{S}\left|k\right>^{R}$ , where $t_{k}(\bar{n})$ and $\bar{n}_{\rm S}$ are defined in (2) and (4), respectively. Alice and Bob use the position-based code [26, Th. 6] as in the proof of Lemma 1 and assign each message to $n$ TMSV states. Alice transmits $n$ modes corresponding to message $x$ from her part of $\left(\left|\psi\right>^{SR}\right)^{\otimes m}$ , discarding the rest. Willie has no access to Bob’s system $R$ . Since $\operatorname{Tr}_{R}\left[\left|\psi\right>\left<\psi\right|^{SR}\right]=\hat{\rho}_{\bar{n}_{\rm S}}$ is a thermal state, setting $\bar{n}_{\rm S}$ as in (4) ensures covertness [4, Th. 2].

Bob uses the sequential decoding from [26, Th. 6], as in Lemma 1. In order to obtain the constants in (27), first we note that $D\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)=C_{\text{EA}}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$ [36], where

\displaystyle C_{\text{EA}}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})

\displaystyle=g(\bar{n}_{\rm S})+g(\eta\bar{n}_{\rm S}+(1-\eta)\bar{n}_{\rm B})-g(A_{+})-g(A_{-}),

(28)

$A_{\pm}=\frac{B-1\pm(1-\eta)(\bar{n}_{\rm B}-\bar{n}_{\rm S})}{2}$ , $B=\sqrt{(\bar{n}_{\rm S}+1+\eta\bar{n}_{\rm S}+(1-\eta)\bar{n}_{\rm B})^{2}-4\eta\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)}$ , and $g(x)$ is defined in (22). The following expansion of $C_{\text{EA}}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$ around $\bar{n}_{\rm S}=0$ :

	$\displaystyle C_{\text{EA}}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})$	$\displaystyle=-\frac{\eta\bar{n}_{\rm S}\log\bar{n}_{\rm S}}{1+(1-\eta)\bar{n}_{\rm B}}-\bar{n}_{\rm S}\left(\frac{1}{\ln 2}+\frac{\eta}{1+(1-\eta)\bar{n}_{\rm B}}\log\left[1-\frac{1}{1+(1-\eta)\bar{n}_{\rm B}}\right]\right)$
		$\displaystyle\phantom{=}+\mathcal{O}(\bar{n}_{\rm S}^{2}\log\bar{n}_{\rm S})$		(29)

yields $-\bar{n}_{\rm S}\log\bar{n}_{\rm S}$ as the dominant term in (28).

The expression for $L_{\rm EA}$ follows from the substitution of (4) in (28) and the limit:

\displaystyle\lim_{n\to\infty}\frac{nC_{\text{EA}}\left.(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B})\right|_{\bar{n}_{\rm S}=\sqrt{\delta}c_{\rm cov}/\sqrt{n}}}{\sqrt{n}\log n}

\displaystyle=c_{\rm cov}\sqrt{\delta}c_{\rm rel,EA}.

(30)

We derive the expression (116) for $V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)$ using the symplectic matrix formalism in Appendix B-3. Expansion of $V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)$ around $\bar{n}_{\rm S}=0$ in (127) yields the dominant term $\bar{n}_{\rm S}\log^{2}\bar{n}_{\rm S}$ . The constant $K_{\rm EA}$ follows from

\displaystyle\lim_{n\to\infty}\frac{\left.nV\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)\right|_{{\bar{n}_{\rm S}=\sqrt{\delta}c_{\rm cov}/\sqrt{n}}}}{\sqrt{n}\log^{2}n}

\displaystyle=c_{\rm cov}\sqrt{\delta}c_{\mathrm{rel},\text{EA}}.

(31)

In Appendix B-4 we show that $Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)=\mathcal{O}\left(\bar{n}_{\rm S}\log^{4}\bar{n}_{\rm S}\right)$ . We complete the proof by observing that $\frac{\left[Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)\right]^{3/4}}{V\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)}=\mathcal{O}\left(n^{1/8}\log n\right)$ dominates the remainder $C_{n}$ in Lemma 1. ∎

We are now ready to prove Theorem 2.

Proof:

Achievability: Dividing both sides of (27) by $\sqrt{n\delta}\log n$ and taking the limit yields the achievable lower bound.

Converse: Let Alice and Bob have access to respective systems $S$ and $R$ of shared infinite-dimensional bipartite entangled resource state $\hat{\rho}^{S^{m}R^{m}}$ , with $m$ arbitrary. Consider a sequence of codes such that the decoding error probability $\epsilon_{n}\to 0$ as $n\to\infty$ . Then:

	$\displaystyle M_{\text{EA}}(1-\epsilon_{n})-1$	$\displaystyle\leq I\left(X^{(n)};\check{X}^{(n)}\right)$		(32)
		$\displaystyle\leq nC_{\text{EA}}(\bar{n}_{\rm S};\eta,\bar{n}_{\rm B}),$		(33)

where $I\left(X^{(n)};\check{X}^{(n)}\right)$ is the mutual information between random variables $X^{(n)}$ and $\check{X}^{(n)}$ corresponding to Alice’s message and Bob’s decoding of it, (32) follows from Fano’s inequality [10, Th. 2.10.1], (33) is the entanglement-assisted capacity bound [36]. Substitution of (28) and (4) into (33), division of both sides by $\sqrt{n\delta}\log n$ , and the limit in (30) yields the converse. ∎

IV Discussion and conclusion

We derived the quantum-secure covert capacity for the bosonic channel with and without entanglement assistance, closing an important gap from [5]. Since entanglement assistance particularly benefits the low-SNR regime, it is expected to improve covert capacity. Surprisingly, it alters the fundamental scaling law for covert communication from $\mathcal{O}(\sqrt{n})$ to $\mathcal{O}(\sqrt{n}\log n)$ covert bits reliably transmissible in $n$ channel uses. Next, we outline follow-on questions.

IV-A Amount of shared resource

The resource state $\left(\hat{\rho}^{BR}\right)^{\otimes m}$ employed in the proofs of Lemmas 2 and 3 is quite large: $m=n2^{M}$ . This is especially onerous for the entanglement-assisted communications due to the massive costs associated with generating and storing such large entangled states. While the proofs in [26] rely on the state of size $m=n2^{M}$ , we note that our structured receiver design for entanglement-assisted communication [15] (discussed next) uses $m=n$ TMSV states. The quantum channel resolvability approach[24, 25] should be investigated for reducing $m$ to $\mathcal{O}(\sqrt{n})$ , as was done in [6] for classical covert communication.

IV-B Structured receiver for entanglement-assisted covert communication

The sequential decoding strategy from [27, 26] used by Bob in the proof of Lemma 3 does not correspond to any known receiver architecture. In fact, despite the entanglement-based enhancement of classical communication capacity being known for over two decades [35, 36], a strategy to achieve the full gain has been elusive until our recent work on the structured receiver for entanglement-assisted communication in [15]. The receiver in [15] combines insights from the sum-frequency generation receiver proposed for a quantum illumination radar [37, 38] and the Green Machine receiver proposed for attaining superadditive communication capacity over the bosonic channel [39]. The resulting structured receiver design realizes the logarithmic scaling gain from entanglement assistance at low SNR. Consider the approximation [15, App. A.2] of this receiver’s achievable rate (in bits/mode):

\displaystyle R_{\rm sr}

\displaystyle\approx\frac{\eta\bar{n}_{\rm S}\gamma}{2(1+(1-\eta)\bar{n}_{\rm B})}\left[\log\left[\frac{w}{\bar{n}_{\rm S}}\right]-\log\left[\ln\left[\frac{w}{\bar{n}_{\rm S}}e\right]\right]-g\left[\frac{2(1-\eta)\bar{n}_{\rm B}(1+(1-\eta)\bar{n}_{\rm B})}{v\eta\gamma}\right]\right],

(34)

where $\gamma=1-e^{-2\left(1+(1-\eta)\bar{n}_{\rm B}\right)}$ , $w=\frac{4(1+(1-\eta)\bar{n}_{\rm B})}{v\eta\gamma+4(1-\eta)\bar{n}_{\rm B}(1+(1-\eta)\bar{n}_{\rm B})}$ , $g(x)$ is defined in (22), and $v\geq 1$ is a receiver design parameter. Fixing Bob’s receiver makes the Alice-to-Bob channel a classical DMC, allowing us to follow the achievability approach in [7] almost exactly and obtain the following approximation to its entanglement-assisted covert capacity:

\displaystyle L_{\text{EA},\rm sr}

\displaystyle\approx\frac{\eta\gamma c_{\rm cov}}{4(1+(1-\eta)\bar{n}_{\rm B})}\approx\frac{L_{\rm EA}}{2},

(35)

where the second approximation is valid when $\bar{n}_{\rm B}\gg 1$ . Evolving the receiver [15] to achieve $L_{\rm EA}$ is an ongoing work.

IV-C Connection to the scaling law for a special case of covert communication without entanglement assistance

Finally, we describe a curious resemblance of the scaling law for entanglement-assisted covert communication presented here to that for a corner case of classical [6, Th. 7] and classical-quantum [8, Sec. VII] covert communication without entanglement assistance. Consider a simplified scenario where Alice has two fixed input states $\hat{\rho}^{A}_{0}$ and $\hat{\rho}^{A}_{1}$ , and $\hat{\rho}^{A}_{0}$ is the “innocent” state that is not suspicious to Willie (e.g., vacuum). Let $\hat{\rho}^{B}_{k}=\mathcal{N}_{A\to B}\left(\hat{\rho}^{A}_{k}\right)$ , $k=\{0,1\}$ , where $\mathcal{N}_{A\to B}$ is the Alice-to-Bob channel. Denote the support of $\hat{\rho}$ by $\operatorname{supp}(\hat{\rho})$ , and suppose that $\operatorname{supp}\left(\hat{\rho}^{B}_{1}\right)\nsubseteq\operatorname{supp}\left(\hat{\rho}^{B}_{0}\right)$ . This allows a measurement which perfectly identifies to Bob the transmission of $\hat{\rho}^{A}_{0}$ . If Alice is restricted by the SRL to sending $\hat{\rho}^{A}_{1}$ with probability $p_{1}=\mathcal{O}(1/\sqrt{n})$ , $\mathcal{O}(\sqrt{n}\log n)$ covert bits can be reliably transmitted in $n$ channel uses [8, Sec. VII]. This scaling law was observed prior to [8] in the classical covert DMCs with the analogous properties of the supports for corresponding Bob’s output probability distributions [6, Th. 7]. Exploring this connection could lead to new insights in entanglement-assisted communications.

Acknowledgement

The authors are grateful to Mark Wilde for pointing out references [26, 27] and answering our questions. The authors also benefited from discussions with Saikat Guha and Quntao Zhuang, as well as comments from Evan Anderson and the anonymous reviewer.

Appendix A Taylor series expansion of Holevo information and its variance for QPSK modulation

A-1 Preliminaries

In order to prove Theorem 1, we must characterize the behavior of the Holevo information and its variance as a function of the transmitted mean photon number per mode $\bar{n}_{\mathrm{S}}$ for QPSK. Since the closed-form expressions for (15) and (16) are unknown, we use Taylor’s theorem:

Lemma 4 (Taylor’s theorem).

If $f(x)$ is a function with $k+1$ continuous derivatives on the interval $[v,w]$ , then

\displaystyle f(w)=

\displaystyle f(v)+f^{\prime}(v)(w-v)+\ldots+\frac{f^{(k)}(v)}{k!}(w-v)^{k}+R_{k+1}(w)

where $f^{(k)}(x)$ denotes the $k^{\text{th}}$ derivative of $f(x)$ , and the Lagrange form of remainder is $R_{k+1}(w)=\frac{f^{(k+1)}(\xi)}{(k+1)!}(w-v)^{k+1}$ with $\xi$ satisfying $v\leq\xi\leq w$ .

To evaluate the Taylor series expansion, we use the following lemmas where $\hat{A}(t)$ and $\hat{B}(t)$ are non-singular operators parameterized by $t$ , and where $\hat{I}$ is the identity operator.

Lemma 5 ([40, Th. 6]).

$\frac{\mathrm{d}}{\mathrm{d}t}\ln\hat{A}(t)=\int_{0}^{1}\mathrm{d}s\left[s\hat{A}(t)+(1-s)\hat{I}\right]^{-1}\frac{\mathrm{d}\hat{A}(t)}{\mathrm{d}t}\left[s\hat{A}(t)+(1-s)\hat{I}\right]^{-1}$ .

Lemma 6 ([40, lemma in Sec. 4]).

$\frac{\mathrm{d}}{\mathrm{d}t}\hat{B}^{-1}(t)=-\hat{B}^{-1}(t)\frac{\mathrm{d}\hat{B}(t)}{\mathrm{d}t}\hat{B}^{-1}(t)$ .

A-2 Holevo information for quadrature phase shift keying

Here, we derive the Taylor series expansion of the Holevo information defined in (15) for QPSK at the displacement $u=0$ . Setting $u=0$ in (15) yields

\displaystyle\left.\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right|_{u=0}=\hat{\rho}_{\bar{n}_{\rm T}}\log\hat{\rho}_{\bar{n}_{\rm T}}-\hat{\rho}_{\bar{n}_{\rm T}}\log\hat{\rho}_{\bar{n}_{\rm T}}=0,

(36)

where $\hat{\rho}_{\bar{n}_{\rm T}}$ is the zero mean thermal state defined in (1), with $\bar{n}_{\rm T}=(1-\eta)\bar{n}_{\rm B}$ .

Von Neumann entropy is invariant under unitary transformations. Since displacement is a unitary, $S(\hat{\rho}^{B}_{\rm T}(y))=S(\hat{\rho}_{\bar{n}_{\rm T}})$ , implying that $\frac{\mathrm{d}S(\hat{\rho}^{B}_{\rm T}(y))}{\mathrm{d}u}=\frac{\mathrm{d}S(\hat{\rho}_{\bar{n}_{\rm T}})}{\mathrm{d}u}=0$ . We now evaluate the derivatives of $S(\hat{\bar{\rho}}^{B})$ using Lemma 5:

\displaystyle\frac{\mathrm{d}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u}=\mathrm{Tr}\left[-\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\log\hat{\bar{\rho}}^{B}-\frac{\hat{\bar{\rho}}^{B}}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\hat{\sigma}_{1}^{-1}(s)\right],

(37)

where $\hat{\sigma}_{1}(s)=s\hat{\bar{\rho}}^{B}+(1-s)\hat{I}$ . The derivatives of $\hat{\rho}^{B}_{\rm T}(u)$ , $\hat{\rho}^{B}_{\rm T}(ju)$ , $\hat{\rho}^{B}_{\rm T}(-u)$ , and $\hat{\rho}^{B}_{\rm T}(-ju)$ are as follows [41, Ch. VI, Eq. (1.31)]:

$\displaystyle\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(u)}{{\mathrm{d}}u}$	$\displaystyle=\bar{n}_{\rm T}^{-1}\left((\hat{a}-u)\hat{\rho}^{B}_{\rm T}(u)\ +\hat{\rho}^{B}_{\rm T}(u)(\hat{a}^{\dagger}-u)\right),$	(38)
$\displaystyle\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(ju)}{{\mathrm{d}}u}$	$\displaystyle=-\bar{n}_{\rm T}^{-1}\left((j\hat{a}+u)\hat{\rho}^{B}_{\rm T}(ju)\ -\hat{\rho}^{B}_{\rm T}(ju)(j\hat{a}^{\dagger}-u)\right),$	(39)
$\displaystyle\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(-u)}{{\mathrm{d}}u}$	$\displaystyle=-\bar{n}_{\rm T}^{-1}\left((\hat{a}+u)\hat{\rho}^{B}_{\rm T}(-u)\ +\hat{\rho}^{B}_{\rm T}(-u)(\hat{a}^{\dagger}+u)\right),$	(40)
$\displaystyle\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(-ju)}{{\mathrm{d}}u}$	$\displaystyle=\bar{n}_{\rm T}^{-1}\left((j\hat{a}-u)\hat{\rho}^{B}_{\rm T}(-ju)\ -\hat{\rho}^{B}_{\rm T}(-ju)(j\hat{a}^{\dagger}+u)\right),$	(41)

where $\hat{a}^{\dagger}$ and $\hat{a}$ denote the creation and annihilation operators, respectively. Thus,

\displaystyle\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}=\sum_{y\in\mathcal{Q}}p_{q}(y)\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}u}=\frac{1}{4}\left(\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(u)}{{\mathrm{d}}u}+\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(ju)}{{\mathrm{d}}u}+\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(-u)}{{\mathrm{d}}u}+\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(-ju)}{{\mathrm{d}}u}\right).

(42)

Setting $u=0$ in (42) yields $\left.\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\right\rvert_{u=0}=0$ . Since both terms in (37) are zero when $u=0$ , $\left.\frac{\mathrm{d}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u}\right\rvert_{u=0}=0$ . Using Lemma 6, the second derivative of $S(\hat{\bar{\rho}}^{B})$ with respect to $u$ is as follows:

$\displaystyle\frac{\mathrm{d}^{2}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}=$	$\displaystyle\mathrm{Tr}\left[-2\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\frac{1}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\hat{\sigma}_{1}^{-1}(s)\right.$
	$\displaystyle\phantom{\mathrm{Tr}}+2\frac{\hat{\bar{\rho}}^{B}}{\ln 2}\int_{0}^{1}s\mathrm{d}s\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\hat{\sigma}_{1}^{-1}(s)$
	$\displaystyle\left.\phantom{\mathrm{Tr}}-\frac{\hat{\bar{\rho}}^{B}}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}\hat{\sigma}_{1}^{-1}(s)-\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}\log\hat{\bar{\rho}}^{B}\right].$	(43)

Setting $u=0$ in (43) and removing terms containing $\left.\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}u}\right\rvert_{u=0}$ yields

\displaystyle\left.\frac{\mathrm{d}^{2}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}\right\rvert_{u=0}=\mathrm{Tr}\left[-\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{0}^{-1}(s)\left.\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}\right|_{u=0}\hat{\sigma}_{0}^{-1}(s)-\left.\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}\right\rvert_{u=0}\log\hat{\bar{\rho}}^{B}\right],

(44)

where $\hat{\sigma}_{0}(s)=s\hat{\rho}_{\bar{n}_{\rm T}}+(1-s)\hat{I}$ . Setting $u=0$ in $\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}$ yields

\displaystyle\left.\frac{\mathrm{d}^{2}\hat{\bar{\rho}}^{B}}{\mathrm{d}u^{2}}\right\rvert_{u=0}=\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)-\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right).

(45)

Substitution of (45) into (44) yields

	$\displaystyle\left.\frac{\mathrm{d}^{2}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}\right\rvert_{u=0}=\mathrm{Tr}\left[\vphantom{\left(\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)-\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right)\right)}\right.$	$\displaystyle-\frac{2}{\bar{n}_{\rm T}^{2}}\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{0}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\hat{\sigma}_{0}^{-1}(s)+\frac{2}{\bar{n}_{\rm T}}\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\ln 2}\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{0}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{\sigma}_{0}^{-1}(s)$
		$\displaystyle-\left.\left(\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)-\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right)\right)\left(\log\hat{\rho}_{\bar{n}_{\rm T}}\right)\right].$		(46)

Since $\hat{\sigma}_{0}(s)$ is diagonal in the Fock state basis, $\hat{\sigma}_{0}^{-1}(s)=\sum_{k=0}^{\infty}(s\tau_{k}+(1-s))^{-1}\left|k\right>\left<k\right|$ , where $\tau_{k}=t_{k}(\bar{n}_{\rm T})$ , defined in (2). Now,

$\displaystyle\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{0}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{\sigma}_{0}^{-1}(s)=$	$\displaystyle\int_{0}^{1}\mathrm{d}s\sum_{k=0}^{\infty}\tau_{k}(s\tau_{k}+(1-s))^{-2}\left\|k\right>\left<k\right\|=\hat{I},$
$\displaystyle\int_{0}^{1}\mathrm{d}s\hat{\sigma}_{0}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\hat{\sigma}_{0}^{-1}(s)=$	$\displaystyle\int_{0}^{1}\mathrm{d}s\sum_{k=0}^{\infty}(k+1)\tau_{k+1}(s\tau_{k}+(1-s))^{-2}\left\|k\right>\left<k\right\|$	(47)
$\displaystyle=$	$\displaystyle\frac{\bar{n}_{\rm T}}{1+\bar{n}_{\rm T}}\sum_{k=0}^{\infty}(k+1)\left\|k\right>\left<k\right\|,$	(48)

since $\int_{0}^{1}\mathrm{d}s(sq+(1-s))^{-2}=\frac{1}{q}$ for $q>0$ . Thus, the traces of the first two terms in (46) cancel and we are left with

\displaystyle\left.\frac{\mathrm{d}^{2}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}\right\rvert_{u=0}=\mathrm{Tr}\left[-\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}+\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}\right].

(49)

The first term in (49) is written in the Fock state basis as

$\displaystyle-\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}$	$\displaystyle=-\frac{2}{nt^{2}}\sum_{k=0}^{\infty}(k+1)\tau_{k+1}\log\tau_{k}\left\|k\right>\left<k\right\|$	(50)
	$\displaystyle=-\frac{2}{\bar{n}_{\rm T}^{2}}\left[\log\bar{n}_{\rm T}\sum_{k=0}^{\infty}k(k+1)\tau_{k+1}\left\|k\right>\left<k\right\|\right.$	(51)
	$\displaystyle\phantom{=-\frac{2}{\bar{n}_{\rm T}^{2}}\left[\right.}\left.-\log(1+\bar{n}_{\rm T})\sum_{l=0}^{\infty}(l+1)^{2}\tau_{l+1}\left\|l\right>\left<l\right\|\right].$	(52)

Taking the trace and evaluating the sums yields

	$\displaystyle\mathrm{Tr}\left[-\frac{2}{\bar{n}_{\rm T}^{2}}\left(\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}\right]$	$\displaystyle=-\frac{2}{\bar{n}_{\rm T}^{2}}\left[2\bar{n}_{\rm T}^{2}\log\bar{n}_{\rm T}-2\bar{n}_{\rm T}^{2}\log(1+\bar{n}_{\rm T})-\bar{n}_{\rm T}\log(1+\bar{n}_{\rm T})\right]$		(53)
		$\displaystyle=-\frac{2}{\bar{n}_{\rm T}}\left[2\bar{n}_{\rm T}\log\left(\frac{\bar{n}_{\rm T}}{1+\bar{n}_{\rm T}}\right)-\log(1+\bar{n}_{\rm T})\right].$		(54)

The second term in (49) can be written in the Fock state basis as

	$\displaystyle\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}$	$\displaystyle=\frac{2}{\bar{n}_{\rm T}}\left[\sum_{k=0}^{\infty}\tau_{k}\log\tau_{k}\left\|k\right>\left<k\right\|\right]$		(55)
		$\displaystyle=\frac{2}{\bar{n}_{\rm T}}\left[\log\bar{n}_{\rm T}\sum_{k=0}^{\infty}k\tau_{k}\left\|k\right>\left<k\right\|-\log(1+\bar{n}_{\rm T})\sum_{l=0}^{\infty}(l+1)\tau_{l}\left\|l\right>\left<l\right\|\right].$		(56)

Taking the trace and evaluating the sums yields

	$\displaystyle\mathrm{Tr}\left[\frac{2}{\bar{n}_{\rm T}}\left(\hat{\rho}_{\bar{n}_{\rm T}}\right)\log\hat{\rho}_{\bar{n}_{\rm T}}\right]$	$\displaystyle=\frac{2}{\bar{n}_{\rm T}}\left[\bar{n}_{\rm T}\log\bar{n}_{\rm T}-\bar{n}_{\rm T}\log(1+\bar{n}_{\rm T})-\log(1+\bar{n}_{\rm T})\right]$		(57)
		$\displaystyle=\frac{2}{\bar{n}_{\rm T}}\left[\bar{n}_{\rm T}\log\left(\frac{\bar{n}_{\rm T}}{1+\bar{n}_{\rm T}}\right)-\log(1+\bar{n}_{\rm T})\right].$		(58)

Summing (54) and (58) yields $\left.\frac{\mathrm{d}^{2}S(\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}\right\rvert_{u=0}=2\log\left(1+\frac{1}{\bar{n}_{\rm T}}\right)$ . Thus, the first non-zero term in the Taylor series expansion of the Holevo information is

\displaystyle\left.\frac{1}{2!}\frac{\mathrm{d}^{2}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)}{\mathrm{d}u^{2}}\right\rvert_{u=0}=\log\left(1+\frac{1}{\bar{n}_{\rm T}}\right).

(59)

A-3 Holevo information variance for quadrature phase shift keying

Now we derive the Taylor series expansion of Holevo information variance defined in (16) for QPSK at the displacement $u=0$ . The first two derivatives of $\left[D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})\right]^{2}$ are:

	$\displaystyle\frac{\mathrm{d}\left(D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u}$	$\displaystyle=2\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B}),$		(60)
	$\displaystyle\frac{\mathrm{d}^{2}\left(D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u^{2}}$	$\displaystyle=2\frac{\mathrm{d}^{2}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})+2\left(\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u}\right)^{2}.$		(61)

Since $\left.\frac{\mathrm{d}\left(D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u}\right\rvert_{u=0}=\left.\frac{\mathrm{d}^{2}\left(D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u^{2}}\right\rvert_{u=0}=0$ , $\left[D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})\right]^{2}$ contributes nothing to the first two terms of the Taylor series. The first two derivatives of $\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}$ are:

$\displaystyle\frac{\mathrm{d}\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}}{\mathrm{d}u}=$	$\displaystyle 2\frac{\mathrm{d}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)}{\mathrm{d}u}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right),$	(62)
$\displaystyle\frac{\mathrm{d}^{2}\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}}{\mathrm{d}u^{2}}=$	$\displaystyle 2\frac{\mathrm{d}^{2}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)}{\mathrm{d}u^{2}}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)$
	$\displaystyle+2\left(\frac{\mathrm{d}\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)}{\mathrm{d}u}\right)^{2}.$	(63)

Note that $\left.\frac{\mathrm{d}\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}}{\mathrm{d}u}\right\rvert_{u=0}=\left.\frac{\mathrm{d}^{2}\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}}{\mathrm{d}u^{2}}\right\rvert_{u=0}=0$ . Thus, $\left[\chi\left(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\}\right)\right]^{2}$ does not contribute to the first two terms of the Taylor series. Next, we evaluate the derivatives of $V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})$ . Let $\hat{R}=\log{\hat{\rho}^{B}_{\rm T}(y)}-\log{\hat{\bar{\rho}}^{B}}-D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})$ be the term inside the square in $V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})$ . Note that $\left.\hat{R}\right\rvert_{u=0}=0$ . The derivative of $V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})$ with respect to $u$ is:

\displaystyle\frac{\mathrm{d}V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}{u}}=

\displaystyle{\rm{Tr}}\left[\hat{\rho}^{B}_{\rm T}(y)\left[\hat{R}\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}+\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}\hat{R}\right]+\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}u}\hat{R}^{2}\right].

(64)

Setting $u=0$ , $\left.\frac{\mathrm{d}V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}{u}}\right\rvert_{u=0}=0$ , since $\left.\hat{R}\right\rvert_{u=0}=0$ . The second derivative with respect to $u$ is:

	$\displaystyle\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}=$	$\displaystyle{\rm{Tr}}\left[\hat{\rho}^{B}_{\rm T}(y)\left[2\left(\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}\right)^{2}+\hat{R}\frac{\mathrm{d}^{2}\hat{R}}{\mathrm{d}u^{2}}+\frac{\mathrm{d}^{2}\hat{R}}{\mathrm{d}u^{2}}\hat{R}\right]\right.$		(65)
		$\displaystyle\phantom{{\rm{Tr}}\left[\right.}\left.+2\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}u}\left[\hat{R}\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}+\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}\hat{R}\right]+\frac{\mathrm{d}^{2}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}u^{2}}\hat{R}^{2}\right].$		(66)

Setting $u=0$ ,

\displaystyle\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}\rvert_{u=0}=

\displaystyle{\rm{Tr}}\left[2\hat{\rho}^{B}_{\rm T}(y)\left(\left.\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}\right\rvert_{u=0}\right)^{2}\right].

(67)

Using Lemma 5, we find that the derivative of $\hat{R}$ with respect to $u$ is

\displaystyle\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}=

\displaystyle\frac{1}{\ln 2}\int_{0}^{1}\mathrm{d}{s}\hat{\sigma}_{x}^{-1}(s)\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}{u}}\hat{\sigma}_{x}^{-1}(s)-\frac{1}{\ln 2}\int_{0}^{1}\mathrm{d}{s}\hat{\sigma}_{1}^{-1}(s)\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}{u}}\hat{\sigma}_{1}^{-1}(s)-\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}u}.

(68)

Setting $u=0$ ,

\displaystyle\left.\frac{\mathrm{d}\hat{R}}{\mathrm{d}u}\right\rvert_{u=0}=

\displaystyle\frac{1}{\ln 2}\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\left.\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}{u}}\right\rvert_{u=0}{\hat{\sigma}_{0}}^{-1}(s),

(69)

since $\left.\frac{\mathrm{d}\hat{\bar{\rho}}^{B}}{\mathrm{d}{u}}\right\rvert_{u=0}=0$ and $\left.\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}u}\right\rvert_{u=0}=0$ . Substituting this term into (67) and expanding yields

	$\displaystyle\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}\left.\vphantom{\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}}\right\rvert_{u=0}$		(70)
	$\displaystyle\phantom{222222}=\rm{Tr}\left[2\hat{\rho}_{\bar{n}_{\rm T}}\frac{1}{\ln^{2}2}\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\left.\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}{u}}\right\rvert_{u=0}{\hat{\sigma}_{0}}^{-1}(s)\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\left.\frac{\mathrm{d}\hat{\rho}^{B}_{\rm T}(y)}{\mathrm{d}{u}}\right\rvert_{u=0}{\hat{\sigma}_{0}}^{-1}(s)\right].$		(71)

Summing over $\mathcal{Q}$ yields:

	$\displaystyle\sum_{y\in\mathcal{Q}}\left.\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}\right\rvert_{u=0}$	$\displaystyle=8\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\bar{n}_{\rm T}^{2}\ln^{2}2}\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}{\hat{\sigma}_{0}}^{-1}(s)\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}{\hat{\sigma}_{0}}^{-1}(s)$
		$\displaystyle\phantom{=}+8\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\bar{n}_{\rm T}^{2}\ln^{2}2}\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}{\hat{\sigma}_{0}}^{-1}(s)\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}{\hat{\sigma}_{0}}^{-1}(s).$		(72)

Since $\int_{0}^{1}\mathrm{d}s(sq+(1-s))^{-1}(sr+(1-s))^{-1}=\frac{\ln\left(\frac{q}{r}\right)}{q-r}$ for $q,r>0$ and $q\neq r$ ,

$\displaystyle\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}{\hat{\sigma}_{0}}^{-1}(s)$	$\displaystyle=\int_{0}^{1}\mathrm{d}{s}\sum_{k=0}^{\infty}\frac{\tau_{k}\sqrt{k}\left\|k\right>\left<k-1\right\|}{(s\tau_{k}+(1-s))(s\tau_{k-1}+(1-s))}$	(73)
	$\displaystyle=\bar{n}_{\rm T}\ln\left(1+\frac{1}{\bar{n}_{\rm T}}\right)\sum_{k=0}^{\infty}\sqrt{k}\left\|k\right>\left<k-1\right\|,$	(74)
$\displaystyle\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}{\hat{\sigma}_{0}}^{-1}(s)$	$\displaystyle=\int_{0}^{1}\mathrm{d}{s}\sum_{k=0}^{\infty}\frac{\tau_{k}\sqrt{k}\left\|k-1\right>\left<k\right\|}{(s\tau_{k-1}+(1-s))(s\tau_{k}+(1-s))}$	(75)
	$\displaystyle=\bar{n}_{\rm T}\ln\left(1+\frac{1}{\bar{n}_{\rm T}}\right)\sum_{k=0}^{\infty}\sqrt{k}\left\|k-1\right>\left<k\right\|.$	(76)

Using (74) and (76), we find the first term of (A-3) as:

$\displaystyle 8\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\bar{n}_{\rm T}^{2}\ln^{2}2}$	$\displaystyle\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}{\hat{\sigma}_{0}}^{-1}(s)\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}{\hat{\sigma}_{0}}^{-1}(s)$
	$\displaystyle=\frac{8}{\ln^{2}2}\ln^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right)\sum_{l=0}^{\infty}\tau_{l}\left\|l\right>\left<l\right\|\sum_{k=0}^{\infty}\sqrt{k}\left\|k\right>\left<k-1\right\|\sum_{m=0}^{\infty}\sqrt{m}\left\|m-1\right>\left<m\right\|$	(77)
	$\displaystyle=\frac{8}{\ln^{2}2}\ln^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right)\sum_{k=0}^{\infty}k\tau_{k}\left\|k\right>\left<k\right\|$	(78)
	$\displaystyle=\frac{8}{\ln^{2}2}\bar{n}_{\rm T}\ln^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right).$	(79)

Similarly, the second term of (A-3) is:

	$\displaystyle 8\frac{\hat{\rho}_{\bar{n}_{\rm T}}}{\bar{n}_{\rm T}^{2}\ln^{2}2}$	$\displaystyle\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{a}\hat{\rho}_{\bar{n}_{\rm T}}{\hat{\sigma}_{0}}^{-1}(s)\int_{0}^{1}\mathrm{d}{s}{\hat{\sigma}_{0}}^{-1}(s)\hat{\rho}_{\bar{n}_{\rm T}}\hat{a}^{\dagger}{\hat{\sigma}_{0}}^{-1}(s)$
		$\displaystyle=\frac{8}{\ln^{2}2}(1+\bar{n}_{\rm T})\ln^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right).$		(80)

Thus,

\displaystyle\sum_{y\in\mathcal{Q}}\left.\frac{\mathrm{d}^{2}V(\hat{\rho}^{B}_{\rm T}(y)||\hat{\bar{\rho}}^{B})}{\mathrm{d}{u^{2}}}\right\rvert_{u=0}

\displaystyle=8(1+2\bar{n}_{\rm T})\log^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right).

Normalizing by $p_{\rm q}(y)$ yields the first non-zero term in the Taylor series of (16):

\displaystyle\left.\frac{1}{2!}\frac{\mathrm{d}^{2}V_{\chi}(\{p_{q}(y),\hat{\rho}^{B}_{\rm T}(y)\})}{\mathrm{d}u}\right\rvert_{u=0}=(1+2\bar{n}_{\rm T})\log^{2}\left(1+\frac{1}{\bar{n}_{\rm T}}\right).

(81)

A-4 Fourth central moment of Holevo information for quadrature phase shift keying

The closed-form expression for the fourth central moment $Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)$ , defined in (9), is unknown for QPSK. One can obtain its Taylor series expansion at the displacement $u=0$ , using steps very similar to those in Appendices A-2 and A-3. Inspecting these steps reveals that $Q\left(\hat{\rho}^{BR}\middle\|\hat{\rho}^{B}\otimes\hat{\rho}^{R}\right)=\mathcal{O}\left(\bar{n}_{\rm S}\right)$ .

Appendix B Quantum relative entropy variance for Gaussian states

B-1 Preliminaries

Here we employ the symplectic formalism to derive the quantum relative entropy variance for Gaussian and TMSV-based modulation schemes and analyze its asymptotic behavior for small $\bar{n}_{\rm S}$ . The quantum relative entropy variance $V(\hat{\rho}\|\hat{\sigma})$ between quantum Gaussian states $\hat{\rho}$ , $\hat{\sigma}$ with respective first moments $\vec{\mu}_{\hat{\rho}},\ \vec{\mu}_{\hat{\sigma}}$ and covariance matrices (CMs) $\Sigma_{\hat{\rho}},\ \Sigma_{\hat{\sigma}}$ is [42, Th. 1]:

\displaystyle V(\hat{\rho}\|\hat{\sigma})

\displaystyle=\frac{1}{2}\operatorname{Tr}\left[\left(\Delta\Sigma_{\hat{\rho}}\right)^{2}\right]+\frac{1}{8}\operatorname{Tr}\left[\left(\Delta\Omega\right)^{2}\right]+\vec{\delta}^{T}G_{\hat{\sigma}}\Sigma_{\hat{\rho}}G_{\hat{\sigma}}\vec{\delta},

(82)

where $\Delta$ is the difference of the Gibbs matrices $\Delta=G_{\hat{\rho}}-G_{\hat{\sigma}}$ , $\vec{\delta}=\vec{\mu}_{\hat{\rho}}-\vec{\mu}_{\hat{\sigma}}$ , and $\Omega=\left[\begin{array}[]{cc}0_{n\times n}&I_{n\times n}\\ -I_{n\times n}&0_{n\times n}\end{array}\right]$ is the symplectic matrix in the $qqpp$ representation ( $n$ is the number of modes, $I_{n\times n}$ is the $n\times n$ identity matrix, and $0_{n\times n}$ is an $n\times n$ zero matrix). A Gibbs matrix is $G_{\hat{\rho}}=-2\Omega S_{\hat{\rho}}\left[\operatorname{arccoth}\left(2D_{\hat{\rho}}\right)\right]^{\oplus 2}S_{\hat{\rho}}^{T}\Omega,$ where $S_{\hat{\rho}}$ are the symplectic eigenvectors of $\Sigma_{\hat{\rho}}$ , $D_{\hat{\rho}}=\\ \text{diag}\left(\lambda_{1},\ldots,\lambda_{n},\lambda_{1},\ldots,\lambda_{n}\right)$ , $\lambda_{i}$ , $i=1,\ldots,n$ are the symplectic eigenvalues, and $\operatorname{arccoth}(x)=\frac{1}{2}\ln\left(\frac{x+1}{x-1}\right),\ x\in(-\infty,-1)\cup(1,+\infty)$ . A matrix $S$ is symplectic if it is real and satisfies $S\Omega S^{T}=S^{T}\Omega S=\Omega$ . The symplectic eigenvalues $\lambda_{i}$ , $i=1,\ldots,n$ , for a quantum-mechanical system’s CM satisfy $\lambda_{i}\geq 1/2$

We note that a phase shift does not play any role in calculating the quantum relative entropy variance when $\hat{\sigma}$ is a thermal product state and the rotation is applied in one of the modes of $\hat{\rho}$ . Taking into account the correspondence of the phase shift to an orthogonal symplectic matrix $S_{\phi}$ , the property of symplectic matrices $S_{\phi}^{T}\Omega S_{\phi}=\Omega$ , and the cyclic permutation property of trace, one can see that (82) remains the same if we used $\Sigma_{\hat{\rho}}$ or $\Sigma_{\hat{\rho}}(\phi)=S_{\phi}\Sigma_{\hat{\rho}}S_{\phi}^{T}$ .

B-2 Quantum relative entropy variance without entanglement assistance

Consider the ensemble of Gaussian single-mode thermal states $\{\hat{\rho}^{E}(\vec{y})\}$ , $\vec{y}\in\mathbb{R}^{2}$ , with CM $\Sigma_{\text{th}}=\left(\bar{n}_{\rm B}+\frac{1}{2}\right)I_{2\times 2}$ , and first moments $\vec{d}=W\vec{y}+\vec{\nu}$ , where $\bar{n}_{\rm B}$ is the mean number of thermal photons, $W$ is a $2\times 2$ matrix, and $\vec{y}$ , $\vec{\nu}$ are $2$ -dimensional vectors. The prior classical distribution $p_{\vec{Y}}(\vec{y})$ of this ensemble is Gaussian with the first moments $\vec{\mu}$ and the CM $\Sigma=\bar{n}_{\rm S}I_{2\times 2}$ :

\displaystyle p_{\vec{Y}}(\vec{y})=\frac{\exp\left(-\frac{1}{2}(\vec{y}-\vec{\mu})^{T}\Sigma^{-1}(\vec{y}-\vec{\mu})\right)}{2\pi\sqrt{\det\Sigma}}.

(83)

The expression for the quantum relative entropy variance $V\left(\{p_{\vec{Y}}(\vec{y}),\hat{\rho}^{E}(\vec{y})\}\right)$ of the ensemble $\{p_{\vec{Y}}(\vec{y}),\hat{\rho}^{E}(\vec{y})\}$ has been derived in [43, Def. 1, Prop. 2],

	$\displaystyle V\left(\{p_{\vec{Y}}(\vec{y}),\hat{\rho}^{E}(\vec{y})\}\right)$	$\displaystyle=\frac{1}{2}\operatorname{Tr}\left[(\Delta\Sigma_{\text{th}})^{2}\right]+\frac{1}{8}\operatorname{Tr}\left[(\Delta\omega)^{2}\right]$
		$\displaystyle\phantom{=}+\frac{1}{2}\operatorname{Tr}\left[W\Sigma W^{T}G_{E}\Sigma_{\text{th}}G_{E}\right]+\frac{1}{2}\operatorname{Tr}\left[\left(W\Sigma W^{T}G_{E}\right)^{2}\right]$		(84)

where, $\omega=\left[\begin{array}[]{cc}0&1\\ -1&0\end{array}\right]$ , $G=-2\omega\operatorname{arccoth}(2\Sigma_{\text{th}})\omega$ , $\Sigma_{E}=\Sigma_{\text{th}}+2W\Sigma W^{T}$ , $G_{E}=-2\omega\operatorname{arccoth}\left(2\Sigma_{E}\right)\omega$ , $\Delta=G_{E}-G$ . For $W=I_{2\times 2}$ (and $\vec{\nu}=0$ ), i.e., we assume that the first moments of the Gaussian states are equal to the random vector $\vec{y}$ :

$\displaystyle V\left(\{p_{\vec{Y}}(\vec{y}),\hat{\rho}^{E}(\vec{y})\}\right)$	$\displaystyle=\bar{n}_{\rm B}(\bar{n}_{\rm B}+1)\ln^{2}\frac{\bar{n}_{\rm B}+1}{\bar{n}_{\rm B}}-2\bar{n}_{\rm B}(\bar{n}_{\rm B}+1)\ln\left(\frac{\bar{n}_{\rm B}+1}{\bar{n}_{\rm B}}\right)\ln\frac{\bar{n}_{\rm B}+\bar{n}_{\rm S}+1}{\bar{n}_{\rm B}+\bar{n}_{\rm S}}$
	$\displaystyle\phantom{=}+\bar{n}_{\rm B}(\bar{n}_{\rm B}+1)\ln^{2}\frac{\bar{n}_{\rm B}+\bar{n}_{\rm S}+1}{\bar{n}_{\rm B}+\bar{n}_{\rm S}}+\bar{n}_{\rm S}\left(\bar{n}_{\rm B}+\frac{1}{2}\right)\ln^{2}\frac{\bar{n}_{\rm B}+\bar{n}_{\rm S}+1}{\bar{n}_{\rm B}+\bar{n}_{\rm S}}$
	$\displaystyle\phantom{=}+\bar{n}_{\rm S}^{2}\ln^{2}\frac{\bar{n}_{\rm B}+\bar{n}_{\rm S}+1}{\bar{n}_{\rm B}+\bar{n}_{\rm S}}.$	(85)

The Taylor series expansion of (85) at $\bar{n}_{\rm S}=0$ yields:

\displaystyle V\left(\{p_{\vec{Y}}(\vec{y}),\hat{\rho}^{E}(\vec{y})\}\right)

\displaystyle=\bar{n}_{\rm S}\left(\bar{n}_{\rm B}+\frac{1}{2}\right)\ln^{2}\frac{\bar{n}_{\rm B}+1}{\bar{n}_{\rm B}}+\mathcal{O}(\bar{n}_{\rm S}^{2})

(86)

B-3 Quantum relative entropy variance with entanglement assistance

Here, the upper mode of a TMSV state may be phase-modulated (which we need not consider per the discussion in App. B-1) and sent through a bosonic channel of transitivity $\eta$ and mean thermal photon number $\bar{n}_{\rm B}$ . The lower mode does not change. The mean photon number per mode of the TMSV is $\bar{n}_{\rm S}$ . The two-mode output state $\hat{\rho}$ is not displaced (i.e., $\vec{\mu}_{\hat{\rho}}=0$ as no displacements are involved in the TMSV nor the evolution of the state) and its CM is:

\displaystyle\Sigma_{\hat{\rho}}

\displaystyle=\left[\begin{array}[]{cccc}w_{11}&w_{12}&0&0\\ w_{12}&w_{22}&0&0\\ 0&0&w_{11}&-w_{12}\\ 0&0&-w_{12}&w_{22}\end{array}\right],

(91)

where

$\displaystyle w_{11}$	$\displaystyle=\left(\bar{n}_{\rm B}+\frac{1}{2}\right)(1-\eta)+\left(\bar{n}_{\rm S}+\frac{1}{2}\right)\eta,$	(92)
$\displaystyle w_{12}$	$\displaystyle=\sqrt{\eta\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)},$	(93)
$\displaystyle w_{22}$	$\displaystyle=\bar{n}_{\rm S}+\frac{1}{2}.$	(94)

The CM (91) is determined from the CM of the TMSV,

\displaystyle\Sigma_{\text{TMSV}}

\displaystyle=\left[\begin{array}[]{cccc}\bar{n}_{\rm S}+\frac{1}{2}&\sqrt{\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)}&0&0\\ \sqrt{\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)}&\bar{n}_{\rm S}+\frac{1}{2}&0&0\\ 0&0&\bar{n}_{\rm S}+\frac{1}{2}&-\sqrt{\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)}\\ 0&0&-\sqrt{\bar{n}_{\rm S}(\bar{n}_{\rm S}+1)}&\bar{n}_{\rm S}+\frac{1}{2}\end{array}\right],

(99)

by applying $X\Sigma_{\text{TMSV}}X^{T}+Y=\Sigma_{\hat{\rho}}$ , where the matrices $X,Y$ describe the thermal loss channel which is applied to the upper mode of the TMSV,

	$\displaystyle X$	$\displaystyle=\text{diag}\left(\sqrt{\eta},1,\sqrt{\eta},1\right),$		(100)
	$\displaystyle Y$	$\displaystyle=\text{diag}\left((1-\eta)\left(\bar{n}_{\rm B}+\frac{1}{2}\right),0,(1-\eta)\left(\bar{n}_{\rm B}+\frac{1}{2}\right),0\right).$		(101)

We seek the expression for the quantum relative entropy variance $V(\hat{\rho}\|\hat{\sigma})$ , where $\hat{\rho}$ is a non-displaced Gaussian state with the CM in (91) and $\hat{\sigma}$ is the product of two non-displaced thermal states with $\hat{\rho}$ ’s CM from (91) where all correlations (off-diagonal elements) are set to zero:

\displaystyle\Sigma_{\hat{\sigma}}

\displaystyle=\left[\begin{array}[]{cccc}w_{11}&0&0&0\\ 0&w_{22}&0&0\\ 0&0&w_{11}&0\\ 0&0&0&w_{22}\end{array}\right].

(106)

To this end we need the symplectic spectrum of $\Sigma_{\hat{\rho}}$ and $\Sigma_{\hat{\sigma}}$ , that is, the symplectic matrices $S_{\hat{\rho}},\ S_{\hat{\sigma}}$ and the diagonal matrices $D_{\hat{\rho}},\ D_{\hat{\sigma}}$ , such that $\Sigma_{\hat{\rho},\hat{\sigma}}=S_{\hat{\rho},\hat{\sigma}}\left(D_{\hat{\rho},\hat{\sigma}}\oplus D_{\hat{\rho},\hat{\sigma}}\right)S_{\hat{\rho},\hat{\sigma}}^{T}$ . The CM $\Sigma_{\hat{\sigma}}$ is already in the symplectic diagonal form, with $S_{\hat{\sigma}}=I$ and the symplectic eigenvalues $w_{11},w_{22}\geq 1/2$ . For $\Sigma_{\hat{\rho}}$ , the symplectic eigenvalues are:

	$\displaystyle\lambda_{1}$	$\displaystyle=\frac{1}{2}\left(\sqrt{(w_{11}+w_{22})^{2}-4w_{12}^{2}}+(w_{11}-w_{22})\right),$		(107)
	$\displaystyle\lambda_{2}$	$\displaystyle=\frac{1}{2}\left(\sqrt{(w_{11}+w_{22})^{2}-4w_{12}^{2}}-(w_{11}-w_{22})\right)$		(108)

and the symplectic eigenvectors (organized into a symplectic matrix),

\displaystyle S_{\hat{\rho}}

\displaystyle=\left[\begin{array}[]{cccc}s_{+}&s_{-}&0&0\\ -s_{-}&-s_{+}&0&0\\ 0&0&s_{+}&-s_{-}\\ 0&0&s_{-}&-s_{+}\\ \end{array}\right],

(113)

where,

	$\displaystyle s_{\pm}$	$\displaystyle=\frac{1}{2}\left(w\pm\frac{1}{w}\right),$		(114)
	$\displaystyle w$	$\displaystyle=\frac{\sqrt{w_{11}-2w_{12}+w_{22}}}{\sqrt[4]{(w_{11}+w_{22})^{2}-4w_{12}^{2}}}.$		(115)

Using (107), (108), (114), and (115), one can verify that $D_{\hat{\rho}}=\operatorname{diag}\left(\lambda_{1},\lambda_{2},\lambda_{1},\lambda_{2}\right)$ is the symplectic diagonal form of $\Sigma_{\hat{\rho}}$ : since $S_{\hat{\rho}}\Omega S_{\hat{\rho}}^{T}=S_{\hat{\rho}}^{T}\Omega S_{\hat{\rho}}=\Omega$ , $S_{\hat{\rho}}$ is symplectic, and $S_{\hat{\rho}}D_{\hat{\rho}}S_{\hat{\rho}}^{T}=\Sigma_{\hat{\rho}}$ .

We are now ready to apply (82) and find the quantum relative entropy variance:

\displaystyle V(\hat{\rho}\|\hat{\sigma})

\displaystyle=\sum_{i=1}^{9}r_{i},

(116)

where,

$\displaystyle r_{1}$	$\displaystyle=\left(4w_{11}^{2}-1\right)\operatorname{arccoth}^{2}(2w_{11})$	(117)
$\displaystyle r_{2}$	$\displaystyle=\left(4w_{22}^{2}-1\right)\operatorname{arccoth}^{2}(2w_{22})$	(118)
$\displaystyle r_{3}$	$\displaystyle=\left(2w_{11}^{2}+2(w_{11}-w_{22})\sqrt{(w_{11}+w_{22})^{2}-4w_{12}^{2}}-4w_{12}^{2}+2w_{22}^{2}-1\right)\operatorname{arccoth}^{2}(2\lambda_{1})$	(119)
$\displaystyle r_{4}$	$\displaystyle=\left(2w_{11}^{2}-2(w_{11}-w_{22})\sqrt{(w_{11}+w_{22})^{2}-4w_{12}^{2}}-4w_{12}^{2}+2w_{22}^{2}-1\right)\operatorname{arccoth}^{2}(2\lambda_{2})$	(120)
$\displaystyle r_{5}$	$\displaystyle=8w_{12}^{2}\operatorname{arccoth}(2w_{11})\operatorname{arccoth}(2w_{22})$	(121)
$\displaystyle r_{6}$	$\displaystyle=A(w_{11},w_{12},w_{22})\operatorname{arccoth}(2w_{11})\operatorname{arccoth}(2\lambda_{1})\$	(122)
$\displaystyle r_{7}$	$\displaystyle=\left(A(w_{11},w_{12},w_{22})-2+8w_{11}^{2}-8w_{12}^{2}\right)\operatorname{arccoth}(2w_{11})\operatorname{arccoth}(2\lambda_{2})$	(123)
$\displaystyle r_{8}$	$\displaystyle=\left(A(w_{22},w_{12},w_{11})-2+8w_{22}^{2}-8w_{12}^{2}\right)\operatorname{arccoth}(2w_{22})\operatorname{arccoth}(2\lambda_{1})$	(124)
$\displaystyle r_{9}$	$\displaystyle=A(w_{22},w_{12},w_{11})\operatorname{arccoth}(2w_{22})\operatorname{arccoth}(2\lambda_{2}),$	(125)

with,

\displaystyle A(w_{11},w_{12},w_{22})

\displaystyle=1-4(w_{11}^{2}-w_{12}^{2})+\frac{w_{11}+w_{22}-4w_{11}(w_{11}^{2}-3w_{12}^{2})-4w_{22}(w_{11}^{2}+w_{12}^{2})}{\sqrt{(w_{11}+w_{22})^{2}-4w_{12}^{2}}}

(126)

and $A(w_{22},w_{12},w_{11})$ given by (126) with swapped $w_{11}$ and $w_{22}$ .

Using (92)-(94), and (117)-(125) we find that $\lim_{\bar{n}_{\rm S}\rightarrow 0}V(\hat{\rho}\|\hat{\sigma})=0$ as expected (the quantum relative entropy between two identical states is always zero). By inspection, the leading terms of $V(\hat{\rho}\|\hat{\sigma})$ scale as $\bar{n}_{\rm S}\ln^{2}\bar{n}_{\rm S}$ . Expansion of $V(\hat{\rho}\|\hat{\sigma})$ around $\bar{n}_{\rm S}=0$ yields:

$\displaystyle V(\hat{\rho}\\|\hat{\sigma})$	$\displaystyle=\bar{n}_{\rm S}\ln^{2}\bar{n}_{\rm S}+\frac{\eta}{(1-\eta)\bar{n}_{\rm B}+1}\bar{n}_{\rm S}\ln^{2}\frac{(1-\eta)\bar{n}_{\rm B}+1}{(1-\eta)\bar{n}_{\rm B}}$
	$\displaystyle\phantom{=}-\frac{2\eta}{(1-\eta)\bar{n}_{\rm B}+1}\left(\ln\bar{n}_{\rm S}\right)\ln\frac{\left((1-\eta)\bar{n}_{\rm B}+1\right)\bar{n}_{\rm S}}{(1-\eta)\bar{n}_{\rm B}}$
	$\displaystyle\phantom{=}-\frac{2(1-\eta)(\bar{n}_{\rm B}+1)}{(1-\eta)\bar{n}_{\rm B}+1}\bar{n}_{\rm S}\left(\ln\bar{n}_{\rm S}\right)\ln\frac{(1-\eta)(\bar{n}_{\rm B}+1)\bar{n}_{\rm S}}{(1-\eta)\bar{n}_{\rm B}+1}$
	$\displaystyle\phantom{=}+\frac{(1-\eta)(\bar{n}_{\rm B}+1)}{(1-\eta)\bar{n}_{\rm B}+1}\bar{n}_{\rm S}\ln^{2}\frac{(1-\eta)(\bar{n}_{\rm B}+1)\bar{n}_{\rm S}}{(1-\eta)\bar{n}_{\rm B}+1}+\mathcal{O}\left(\left(\bar{n}_{\rm S}\ln\bar{n}_{\rm S}\right)^{2}\right).$	(127)

B-4 Fourth central moment of quantum relative entropy for Gaussian states

Consider zero-mean quantum Gaussian states $\hat{\rho}$ , $\hat{\sigma}$ with $\vec{\mu}_{\hat{\rho}}=\vec{\mu}_{\hat{\sigma}}=0$ and CMs $\Sigma_{\hat{\rho}},\ \Sigma_{\hat{\sigma}}$ . The steps in the derivation of the fourth central moment $Q\left(\hat{\rho}\middle\|\hat{\sigma}\right)$ are similar to those leading to (82) in the proof of [42, Th. 1]. Inspection of [42, App. B] yields:

\displaystyle Q(\hat{\rho}\|\hat{\sigma})

\displaystyle=\sum_{k=1}^{5}c_{k}\operatorname{Tr}\left[\left(\Delta\Sigma_{\hat{\rho}}\right)^{5-k}\left(\Delta\Omega\right)^{k-1}\right],

(128)

where obtaining numerical constants $c_{k}$ , $k=1,\ldots,5$ involves applying the commutation relationships of the quadrature operators and Isselsis’ theorem [44], as is done to derive $V(\hat{\rho}\|\hat{\sigma})$ in [42, App. B]. We omit this calculation, as we are interested only in how $Q(\hat{\rho}\|\hat{\sigma})$ scales with $\bar{n}_{\rm S}$ when $\Sigma_{\hat{\rho}}$ and $\Sigma_{\hat{\sigma}}$ are defined in (91) and (106), respectively. The first-order expansion of $Q(\hat{\rho}\|\hat{\sigma})$ around $\bar{n}_{\rm S}$ yields $Q(\hat{\rho}\|\hat{\sigma})=\mathcal{O}\left(\bar{n}_{\rm S}\ln^{4}\bar{n}_{\rm S}\right)$ . The logarithm is taken to the fourth power, since it enters through $\Delta$ , which is multiplied at most four times in (128).

References

[1] B. A. Bash, D. Goeckel, and D. Towsley, “Square root law for communication with low probability of detection on AWGN channels,” in Proc. IEEE Int. Symp. Inform. Theory (ISIT), Cambridge, MA, Jul. 2012.
[2] ——, “Limits of reliable communication with low probability of detection on AWGN channels,” IEEE J. Select. Areas Commun., vol. 31, no. 9, pp. 1921–1930, 2013.
[3] B. A. Bash, D. Goeckel, S. Guha, and D. Towsley, “Hiding information in noise: Fundamental limits of covert wireless communication,” IEEE Commun. Mag., vol. 53, no. 12, 2015.
[4] B. A. Bash, A. H. Gheorghe, M. Patel, J. L. Habif, D. Goeckel, D. Towsley, and S. Guha, “Quantum-secure covert communication on bosonic channels,” Nat. Commun., vol. 6, Oct. 2015.
[5] M. S. Bullock, C. N. Gagatsos, S. Guha, and B. A. Bash, “Fundamental limits of quantum-secure covert communication over bosonic channels,” IEEE J. Select. Areas Commun., vol. 38, no. 3, pp. 471–482, Mar. 2020.
[6] M. R. Bloch, “Covert communication over noisy channels: A resolvability perspective,” IEEE Trans. Inf. Theory, vol. 62, no. 5, pp. 2334–2354, May 2016.
[7] L. Wang, G. W. Wornell, and L. Zheng, “Fundamental limits of communication with low probability of detection,” IEEE Trans. Inf. Theory, vol. 62, no. 6, pp. 3493–3503, Jun. 2016.
[8] A. Sheikholeslami, B. A. Bash, D. Towsley, D. Goeckel, and S. Guha, “Covert communication over classical-quantum channels,” in Proc. IEEE Int. Symp. Inform. Theory (ISIT), Barcelona, Spain, Jul. 2016, arXiv:1601.06826 [quant-ph].
[9] L. Wang, “Optimal throughput for covert communication over a classical-quantum channel,” in Proc. Inform. Theory Workshop (ITW), Cambridge, UK, Sep. 2016, pp. 364–368, arXiv:1603.05823 [cs.IT].
[10] T. M. Cover and J. A. Thomas, Elements of Information Theory, 2nd ed. John Wiley & Sons, Hoboken, NJ, 2002.
[11] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information. New York, NY, USA: Cambridge University Press, 2000.
[12] M. Wilde, Quantum Information Theory, 2nd ed. Cambridge University Press, 2016, arXiv:1106.1445v7.
[13] M. Tahmasbi and M. R. Bloch, “Framework for covert and secret key expansion over classical-quantum channels,” Phys. Rev. A, vol. 99, p. 052329, May 2019.
[14] ——, “First and second order asymptotics in covert communication,” IEEE Trans. Inf. Theory, vol. 65, no. 4, pp. 2190–2212, Apr. 2019.
[15] S. Guha, Q. Zhuang, and B. A. Bash, “Infinite-fold enhancement in communications capacity using pre-shared entanglement,” in Proc. IEEE Int. Symp. Inform. Theory (ISIT), Jun. 2020, arXiv:2001.03934 [quant-ph].
[16] T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 2nd ed. Cambridge, Massachusetts: MIT Press, 2001.
[17] G. S. Agarwal, Quantum Optics. Cambridge, UK: Cambridge University Press, 2012.
[18] M. O. Scully and M. S. Zubairy, Quantum Optics. Cambridge, UK: Cambridge University Press, 1997.
[19] M. Orszag, Quantum Optics, 3rd ed. Berlin, Germany: Springer, 2016.
[20] J. H. Shapiro, “6.453 Quantum Optical Communication,” Massachusetts Institute of Technology: MIT OpenCouseWare, Fall 2016, http://ocw.mit.edu.
[21] T. S. Han and S. Verdu, “Approximation theory of output statistics,” IEEE Trans. Inf. Theory, vol. 39, no. 3, pp. 752–772, May 1993.
[22] T. S. Han, Information-Spectrum Methods in Information Theory. Berlin, Germany: Springer Verlag, 2003.
[23] Y. Polyanskiy, H. V. Poor, and S. Verdu, “Channel coding rate in the finite blocklength regime,” IEEE Trans. Inf. Theory, vol. 56, no. 5, pp. 2307–2359, May 2010.
[24] M. Hayashi and H. Nagaoka, “General formulas for capacity of classical-quantum channels,” IEEE Trans. Inf. Theory, vol. 49, no. 7, pp. 1753–1768, Jul. 2003.
[25] H. Nagaoka and M. Hayashi, “An information-spectrum approach to classical and quantum hypothesis testing for simple hypotheses,” IEEE Trans. Inf. Theory, vol. 53, no. 2, pp. 534–549, Feb. 2007.
[26] S. K. Oskouei, S. Mancini, and M. M. Wilde, “Union bound for quantum information processing,” Proc. Roy. Soc. A, vol. 475, no. 2221, p. 20180612, 2019.
[27] M. M. Wilde, “Position-based coding and convex splitting for private communication over quantum channels,” Quantum Inf. Process., vol. 16, no. 10, p. 264, Sep. 2017.
[28] F. Buscemi and N. Datta, “The quantum capacity of channels with arbitrarily correlated noise,” IEEE Trans. Inf. Theory, vol. 56, no. 3, pp. 1447–1460, 2010.
[29] L. Wang and R. Renner, “One-shot classical-quantum capacity and hypothesis testing,” Phys. Rev. Lett., vol. 108, p. 200501, May 2012.
[30] S. Lang, Undergraduate Analysis, 2nd ed. New York, NY: Springer-Verlag, 1997.
[31] E. Kaur and M. M. Wilde, “Upper bounds on secret-key agreement over lossy thermal bosonic channels,” Phys. Rev. A, vol. 96, p. 062318, Dec. 2017.
[32] A. S. Holevo, “Bounds for the quantity of information transmitted by a quantum communication channel,” Problems Inf. Transmiss., vol. 9, pp. 177–183, 1973.
[33] V. Giovannetti, R. García-Patrón, N. Cerf, and A. Holevo, “Ultimate classical communication rates of quantum optical channels,” Nat. Photon., vol. 8, no. 10, pp. 796–800, 2014.
[34] F. Lacerda, J. M. Renes, and V. B. Scholz, “Coherent-state constellations and polar codes for thermal gaussian channels,” Phys. Rev. A, vol. 95, p. 062343, Jun. 2017.
[35] C. H. Bennett, P. W. Shor, J. A. Smolin, and A. V. Thapliyal, “Entanglement-assisted capacity of a quantum channel and the reverse shannon theorem,” IEEE Trans. Inform. Theory, vol. 48, no. 10, pp. 2637–2655, Oct. 2002.
[36] V. Giovannetti, S. Lloyd, L. Maccone, and P. W. Shor, “Broadband channel capacities,” Phys. Rev. A, vol. 68, p. 062323, Dec. 2003.
[37] Q. Zhuang, Z. Zhang, and J. H. Shapiro, “Optimum mixed-state discrimination for noisy entanglement-enhanced sensing,” Phys. Rev. Lett., vol. 118, p. 040801, Jan. 2017.
[38] H. Shi, Z. Zhang, and Q. Zhuang, “Practical route to entanglement-assisted communication over noisy bosonic channels,” Phys. Rev. Applied, vol. 13, p. 034029, Mar. 2020.
[39] S. Guha, “Structured optical receivers to attain superadditive capacity and the holevo limit,” Phys. Rev. Lett., vol. 106, no. 24, p. 240502, Jun. 2011.
[40] H. E. Haber, “Notes on the matrix exponential and logarithm,” http://scipp.ucsc.edu/~haber/webpage/MatrixExpLog.pdf, accessed Dec. 14, 2019, May 2019.
[41] C. W. Helstrom, Quantum Detection and Estimation Theory. New York, NY, USA: Academic Press, Inc., 1976.
[42] M. M. Wilde, M. Tomamichel, S. Lloyd, and M. Berta, “Gaussian hypothesis testing and quantum illumination,” Phys. Rev. Lett., vol. 119, p. 120501, Sep. 2017.
[43] M. M. Wilde, S. Khatri, E. Kaur, and S. Guha, “Second-order coding rates for key distillation in quantum key distribution,” arXiv:1910.03883 [quant-ph], 2019.
[44] L. Isserlis, “On a formula for the product-moment coefficient of any order of a normal frequency distribution in any number of variables,” Biometrika, vol. 12, no. 1/2, pp. 134–139, 1918.

	$\displaystyle\frac{\mathrm{d}\left(D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u}$	$\displaystyle=2\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B}),$		(60)
	$\displaystyle\frac{\mathrm{d}^{2}\left(D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})\right)^{2}}{\mathrm{d}u^{2}}$	$\displaystyle=2\frac{\mathrm{d}^{2}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u^{2}}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})+2\left(\frac{\mathrm{d}D(\hat{\rho}^{B}_{\rm T}(y)\|\|\hat{\bar{\rho}}^{B})}{\mathrm{d}u}\right)^{2}.$		(61)