Section e, p.4 — averaged over transcripts, Alice's cheating probability lies between $\mathbb E_\gamma F'(\gamma)$ and 1

Fix one value of the security parameter. Let $\Gamma$ be the finite set of transcripts, $p$ their law when Alice commits to $0$ (nonnegative, summing to $1$) and $q$ their law when she commits to $1$. For each $\gamma$ let $\psi'_{0,\gamma}, \psi'_{1,\gamma}$ be unit vectors of $A \otimes B$ (the states after commit′; $A$ is Alice's side, $B$ Bob's) and let $\Pi_\gamma$ be an effect ("the honest unveil of $1$ returns $1$") with $\langle \psi'_{1,\gamma}|\Pi_\gamma|\psi'_{1,\gamma}\rangle = 1$ whenever $q(\gamma) \ne 0$ (correctness). Then there are unitaries $U_\gamma$ on Alice's side such that

where $\mathbb E_\gamma F'(\gamma)$ is the expected fidelity of Bob's reduced states (with $F'(\gamma) = 0$ when $q(\gamma) = 0$) and the middle term is Alice's probability of unveiling $1$ after an honest commitment to $0$ (definitions expectedFidelity and cheatProb).

This is the quantitative content of the paper's sentence "Alice can change the bit $b$ that she unveils to Bob from $0$ to $1$ with a probability that goes to $1$ as the expected value of $F'(\gamma)$ goes to $1$" at a single parameter value; the upper bound $1$ makes the lower bound a squeeze.

Formalization Note Alice's side is the first tensor factor, so her unitaries act as Matrix.kronecker (U γ) 1; $F'$ is Jozsa's fidelity, rootFidelity ^ 2.

Differences from the source:

• generalization: the cheating probability goes to 1 as the expected value of F′(γ) goes to 1 → at each parameter value, E_γ F′(γ) ≤ cheating probability ≤ 1; reason: the explicit two-sided bound implies the limit statement by squeezing
• generalization: one quantum bit commitment protocol in the model of section b → arbitrary finite types Γ, A, B, any transcript laws p, q, any unit vectors ψ0 γ, ψ1 γ and any effects acc γ; reason: every protocol of the model yields such data (finite register spaces, a finite transcript set, the honest unveil of 1 composed with Bob's verdict is an effect for each transcript), so the protocol is a special case
• generalization: q is the law of the transcript under commit(1) → q is any real function; only its zero set is used; reason: the transcript law under commit(1) is one such function
• encoding: F′(γ) = 0 when γ determines a single value of the bit b (section c) → the term of γ is 0 when q γ = 0; reason: a transcript with p γ > 0 determines b exactly when it cannot occur under commit(1), i.e. q γ = 0; a transcript with p γ = 0 carries weight 0
• encoding: registers whose number differs between transcripts, in linear superposition → fixed finite types A, B for all transcripts; reason: unused registers are padded in the fixed state |0⟩; this changes no probability
• reading: correctness: "unveil always return b on |ψb⟩ when both participants are honest" (section c), used on the purified states ψ′1,γ ("then continue with the honest unveil") → hypothesis: the effect acc γ accepts ψ1 γ with probability 1 whenever q γ ≠ 0; reason: honest Alice's unveil acts on her own registers, so keeping her private registers (commit′) instead of decohering them does not change Bob's verdict; correctness is meaningful only for transcripts that can occur under commit(1)
• reading: the expected value of F′(γ) under commit′ → the expectation under the transcript law p of a commitment to 0; reason: in commit′ Alice chooses b = 0, and the transcript law of commit′ equals that of the honest commitment to 0 ("formally identical"); this is also the bound needed for the cheating probability, which is an expectation under the same law
• encoding: the fidelity [9] (Jozsa) F(ρ, σ) = (Tr √(√ρ σ √ρ))² → QAlgorithms.rootFidelity ρ σ ^ 2; reason: rootFidelity is Tr √(√ρ σ √ρ); its square is Jozsa's fidelity, the one the paper cites
• encoding: H_A ⊗ H_B with Alice's side H_A → EuclideanSpace ℂ (A × B) with Alice's side the first factor A; traceLeft gives Bob's reduced state and Alice acts by Matrix.kronecker U 1; reason: fixed ordering convention of the published traceLeft; it changes no instance