Monte Carlo approach to the evaluation of the security of device-independent quantum key distribution

Let us assume the measurements used in the security proof be projective ones. To justify the use, note that if one uses the positive-operator-valued measures (POVMs) to perform measurements, they can readily be transformed to projectors by the Naimark theorem. Obviously, projective measurements become POVMs when undetected events are taken into account (see, e.g., Eq. (4) below ). In general scenarios, the projectors are not necessary to be of rank one. By requiring that measurement must produce, for instance, two distinct outcomes, the projectors could be of rank two or higher (see, e.g., Eq. (23) below).

Consider bipartite Hilbert spaces of dimension $d\times d$ and a measurement set $M=\{1,2,...,m\}$. Given projectors

respectively for Alice and Bob, the joint correlation is computed as $P(a,b|i,j)={\rm tr}(\hat{p}^{(a)}_{u_{i}}\otimes\hat{p}^{(b)}_{v_{j}}\rho_{AB})$ quantum mechanically, where Alice chooses her $i$-th measurement, getting result $a$, Bob chooses his $j$-th measurement, getting result $b$, $\rho_{AB}$ denotes the state shared by Alice and Bob, and $u_{i},v_{j}$ are unitary transformations in $SU(d)$ group. Let us tacitly assume, when $u_{i},v_{j}$ take unit identity $\openone$, that one can have $\hat{p}^{(a)}_{\openone}=|a\rangle\langle a|$ and $\hat{p}^{(b)}_{\openone}=|b\rangle\langle b|$ where $\{|k\rangle|k=0,1,...,d-1\}$ span a set of computational bases.

An $m$-setting $d$-dimensional Bell inequality, denoted by $I_{mmdd}$, can be expressed as

with $\omega^{ab}_{ij}$’s coefficients properly chosen to make the inequality nontrivial, i.e., violated in quantum mechanics. The inequality holds for all local-hidden variable models Bell64 . Let us denote quantum violation as

with respect to some $\rho_{AB}$. It should be noted that a large family of Bell inequalities reach their maximum quantum violations under very particular sets of measurements (e.g., Bell multi-port measurements ZZH97 ) but for the sake of generality we maintain $u_{i},v_{j}$ as arbitrary unitary transformations.

To model undetected events in experiment outputting dichotomic results $0$ and $1$, let us assign the undetected with $0$, and so with an $\eta$ detection efficiency the projectors become non-ideal, reading actually

with $\tau=u_{i},v_{j}$. The term $(1-\eta)$ is due to the undetected events $0$ and $1$, both of which happen with probability $1-\eta$ and according to the model should then be assigned $0$, contributing to the actual $\hat{p}^{(0)}$. Applying (4) to joint correlations $P(a,b|i,j)$ of Alice and Bob yields (see also G-UPC21 )

where $\delta$ denotes the Kronecker function, and $P_{A,B}$ are marginals.

We choose to take the information-theoretic key rate to analyze the security. One needs to first evaluate the eavesdropping information $I_{E}$ and the mutual information $I_{AB}$, and then attain in the infinite-length limit the key rate $\mathcal{R}=I_{AB}-I_{E}$ DW05 . Let us stress, however, that the use of Bell diagonal states in what follows is a strong assumption on the security, and that in our approach finding optimal states that maximize Eve’s information may not be guaranteed for more-than-two-input scenarios in general. Hence the $\mathcal{R}$’s evaluated below serves as upper bounds on the key rates.

To compute $I_{E}$, one needs to optimize the Holevo quantity $\chi=S(\rho_{E})-\left[S(\rho_{E|0})+S(\rho_{E|1})\right]\big{/}2$, where $S(\rho)$ is the von Neumann entropy, $\rho_{E}$ denotes Eve’s reduced state, and $\rho_{E|a}$ denotes Eve’s normalized conditional state upon Alice’s measurement $\hat{p}_{u}^{(a)}$. Since there exists an overall distilled pure state $|\psi\rangle_{ABE}$ from which $\rho_{E}$ and $\rho_{AB}$ can be attained in a reduction way, one has $S(\rho_{E})=S(\rho_{AB})$. The fact that instead of all possible bipartite states it suffices to consider the Bell-diagonal state ABG+07 ; PAB+09 , reading $\rho_{AB}=\sum_{i=0}^{3}\Lambda_{i}|\Phi_{i}\rangle\langle\Phi_{i}|$ with $|\Phi_{0}\rangle=(|00\rangle+|11\rangle)/\sqrt{2}$, $|\Phi_{1}\rangle=(|00\rangle-|11\rangle)/\sqrt{2}$, $|\Phi_{2}\rangle=(|01\rangle+|10\rangle)/\sqrt{2}$, $|\Phi_{3}\rangle=(|01\rangle-|10\rangle)/\sqrt{2}$, and $\sum_{i}\Lambda_{i}=1$, leads to $S(\rho_{E|0})=S(\rho_{E|1})$.

To get further simplification, note that $\rho_{E|a}$ is of rank two, with eigenvalues (which are derived in the $\hat{x}\hat{z}$-plane in PAB+09 ; see also Su22 )

with respect to Alice’s measurements $\hat{p}_{u}^{(0,1)}=|\pm\hat{n}\rangle\langle\pm\hat{n}|$, where $\mu_{\pm}=\Lambda_{0}\pm\Lambda_{1}$, $\nu_{\pm}=\Lambda_{2}\pm\Lambda_{3}$, and

With all these combined, the Holevo quantity becomes $\chi=H(\vec{\Lambda})-h(\Lambda_{\pm})$, with the classical Shannon entropy $H(\vec{x}):=-\sum_{i}x_{i}\log_{2}x_{i}$ and the binary entropy $h(y):=-y\log_{2}y-(1-y)\log_{2}(1-y)$.

Because the measurements may not be faithfully performed, the Holevo quantity should be presumed to be maximized, or equivalently, taking into account the monotonicity of $h(y)$, the $\Lambda_{-}$ (or $\Lambda_{+}$) should be presume to be minimized (or maximized). Let

and we find

It follows that $\chi$ has three extrema:

where

Let $\mathbb{B}$ be the set of all parameters in Bell-diagonal states, and $\mathbb{B}_{\mathsf{Q}}\subseteq\mathbb{B}$ be a subset that corresponds to some particular value of quantum violation $\mathsf{Q}$. The eavesdropping information is found to be

In other words, one can thus have a $\mathsf{Q}$-dependent $I_{E}$.

To compute $I_{AB}$, one needs first to get the quantum bit error rate (QBER) $\varepsilon:={\rm tr}[(\hat{p}_{\openone}^{(0)}\otimes\hat{p}_{\openone}^{(1)}+\hat{p}_{\openone}^{(1)}\otimes\hat{p}_{\openone}^{(0)})\rho_{AB}]$. Taking undetected events into account, it becomes

with $\varepsilon=\Lambda_{2}+\Lambda_{3}$ for the Bell-diagonal state. It is well acceptable that one can assume $\Lambda_{1}=\Lambda_{2}$ due to the preparation of states in practice, getting the QBER equal in the $\hat{z}$- and $\hat{x}$-axes. Hence one gets the mutual entropy $\Gamma=1-h(\varepsilon)$. Despite that the $\varepsilon$, or $\Gamma$, in general, is irrelevant to $\mathsf{Q}$, it is vital in our approach that one must define a $\mathsf{Q}$-dependent mutual information, in order to evaluate the key rate.

To the end, let $\mathbb{B}_{\Gamma}$ be a subset that corresponds to some particular value of mutual entropy $\Gamma$. As such, the states in $\mathbb{B}_{\Gamma}$ will yield a domain of quantum violation, namely,

Then some $\mathsf{Q}_{\Gamma}$ must exist in the domain such that $I_{E}$ reaches a local maximum:

For all pairs $(\mathsf{Q}_{\Gamma},\Gamma)$, there must be a mapping, namely,

which can thus be used as a $\mathsf{Q}$-dependent $I_{AB}$.

It is here remarked, for one thing, that in computing $I_{AB}$, non-ideal efficiencies (i.e., undetected events) should be taken into account; but in computing $I_{E}$ the efficiencies should be presumed ideal, because Eve gets the most information when Alice faithfully performs measurements in order to try with Bob to generate keys. For another, as derived above, one can have both $I_{E}$ and $I_{AB}$ dependent on $\mathsf{Q}$; however, the state $\vec{\Lambda}\in\mathbb{B}$ that yields $I_{E}(\mathsf{Q})$ is not required to be the same as the state $\vec{\Lambda}^{\prime}\in\mathbb{B}$ that yields $I_{AB}(\mathsf{Q})$. If, instead, one requires the states that yield $\mathsf{Q}$ to be the same in computing $I_{E}(\mathsf{Q})$ and $I_{AB}(\mathsf{Q})$, as well as specifying Alice’s measurements in evaluating Eve’s conditional states (i.e., replacing the maximization (12) with a Holevo quantity that corresponds to that Alice always measuring along the $\hat{z}$-axis), then the protocol reduces to a BB84 protocol in which the device-independent feature is lost (see the example below; also ABG+07 ; PAB+09 ).

The procedure is summarized in Table. 1. Once the key rate is attained, it is immediate to derive a number of critical values, e.g., the maximum QBER and the threshold efficiency for a selected protocol.

We illustrate our approach in two examples, alongside a reduction to the BB84 protocol.

To have more precise estimates of the key rate, i.e., to lower the upper bounds obtained in $2\times 2$ subspaces, one is required to consider arbitrarily high dimensional Hilbert spaces producing dichotomic outputs under unfaithful measurements with non-ideal efficiencies. It is then straightforward to generalize the Monte Carlo procedure in Table 1 to make it work for high dimensions. The steps are similar as those in Table 1, except for a few quantities which must be adapted for high-dimensional states. The relevant equations are listed below.

We would like to elaborate now. Some steps in Table 1 remain unchanged, except the following ones. For step 2, one needs to consider a high-dimensional state $\rho_{AB}=\sum_{i,j,m,n}C_{ij;mn}|i\rangle\langle j|_{A}\otimes|m\rangle\langle n|_{B}$. The coefficients $C_{ij;mn}$ must satisfy constraints such that the generated key, obtained by measurements in the basis of key generation, is random. A possible example could be $\rho_{AB}=|\psi\rangle\langle\psi|_{AB}$, with $|\psi\rangle_{AB}=\sum_{i=0}^{d-1}\frac{1}{\sqrt{d}}|i\rangle\otimes|i\rangle$. Due to the two-output feature of the protocol, some measuring results for the key should be denoted as 0 and the others as 1 (indexed by $\xi$ in (22); see the remarks below for detail). Other examples could be $|\psi\rangle_{AB}=\frac{1}{\sqrt{2}}(|0\rangle\otimes|0\rangle+|d-1\rangle\otimes|d-1\rangle)$, $|\psi\rangle_{AB}=\frac{1}{\sqrt{2}}(|0\rangle\otimes|0\rangle+|1\rangle\otimes|d-1\rangle)$, etc., or their convex combinations. The Holevo quantity can then be computed via (29).

For step 3, to compute $\mathsf{Q}$ of a two-output Bell inequality $\mathsf{P}$, the projectors with respect to a certain $\xi$ are constructed in (23). With the above high-dimensional $\rho_{AB}$, one can have the quantum violation, i.e., (24). For step 5, the eavesdropping information is attained in (30) by numerating all possible $q_{a}$’s. The constraints $\sum_{a=0}^{\xi-1}q_{a}=\sum_{a=\xi}^{d-1}q_{a}=1/2$ correspond to the requirement of randomness upon the key.

For steps 6 and 7, similarly, one considers a high-dimensional $\rho^{\prime}_{AB}$ and compute the error rate in (25) from which to get the mutual entropy under non-ideal efficiencies, i.e., (27). The quantum violation is computed with $\rho^{\prime}_{AB}$. After collecting sufficient data, one can have the mutual information (31) in step 9.

Finally, for step 10, one have attained a set of key rates (32) with various $\xi$’s and $d$’s. An efficient upper bound of the key rate in the protocol is then taken as the minimum.

Further remarks are in order. First, equations (22)-(23) are defined so because the dimensions of the systems used should be presumed unknown while in measurements dichotomic results $\pm 1$ should always be attained. One thus needs to numerate all possible divisions, here indicated by $\xi$’s, each of which denotes that the first $\xi$ dimensions yield result $0$ and the remaining dimensions yield result $1$ (or equivalently, through(23), the first $\xi$ dimensions yield result $+1$ and the remaining dimensions yield result $-1$). The divisions have included all possible reordering of results $\pm 1$ since swap operations are among the unitary transformations. Bell inequalities of probabilistic form $\mathsf{P}$, because of (23), can be equivalent to inequalities of correlation form in which measurements of each party produce $\pm 1$. For instance, the $I_{4422}^{(4)}$ inequality holds quantum mechanically with any $2\times 2$-dimensional entangled states but can be violated with a $3\times 3$- or $4\times 4$-dimensional entangled state. Going beyond the $2\times 2$-dimensional subspaces in the security analysis is henceforth very nontrivial (see also G-UPC21 ).

Second, it is similar, as with the $2\times 2$ subspaces, to model undetected events and to compute the error rates and mutual entropy, which are all associated with outputs $\pm 1$. In computing the Holevo quantity, however, it is essential to distinguish each dimension, in order to have the eavesdropping maximized whereby to pin down the $I_{AB}^{(\xi)}\left(\mathsf{Q}^{(\xi)}\right)$. In analogy to considering Bell-diagonal states $\mathbb{B}$ and $\mathbb{B}_{\mathsf{Q}}$ in the previous section, the $\mathbb{S}$ in (31) represents a set of high-dimensional states shared between Alice and Bob and the $\mathbb{S}_{\mathsf{Q}^{(\vec{\zeta})}}$ represents a subset of $\mathbb{S}$ that leads to some particular $\mathsf{Q}^{(\xi)}$ in the BT, with $\vec{\zeta}$ the parameters in the state in analogy to $\vec{\Lambda}$ in Bell-diagonal states. After pinning down a $\mathsf{Q}$-dependent $I_{AB}^{(\xi)}\left(\mathsf{Q}^{(\xi)}\right)$ in (31), which follows the definition (16), one can get a provisional upper bound on the key rate with respect to certain $\xi$ and $d$.