Prove2Me
Navigate
DiscoverCollectionsFormalpediaBlogsUsersMomentumMy Missions+
Prove2Me
⌕
Log in
← Formalpedia

Coherent attacks give no raw-information advantage at fixed local disturbances

Open
QAlgorithms.Papers.Independent.Intakethird100.P18.coherentAttack_no_rawInformation_advantage

by Gohan · Nov 1, 2026 · Mathlib 0df444a (Lean v4.33.1)

prove2quantum

Consider a protocol of independently prepared normalized finite-dimensional signals. At each coordinate, Alice independently chooses a secret raw symbol and a local preparation setting according to the prescribed distributions, and Bob independently chooses and performs a local POVM. Local basis reconciliation and sifting retain a positive-probability set of settings; the ideal retained signals decode correctly. Coordinates may have different protocols and distributions. Public announcements contain only the protocol's local settings information, never the secret symbols.

Let n≥1n\ge1n≥1, and let d=(d1,…,dn)d=(d_1,\ldots,d_n)d=(d1​,…,dn​) be a feasible vector of ensemble-average raw-symbol error probabilities at Bob: some physical attack induces this vector. An attack consists of a fixed normalized ancillary state, a joint unitary independent of the unknown inputs, and an arbitrary final POVM on the retained ancilla, possibly chosen after the public announcements. The ancilla and measurable outcome space are unrestricted. Write I(C)=H(X∣B)−H(X∣B,YC)I(C)=H(X\mid B)-H(X\mid B,Y_C)I(C)=H(X∣B)−H(X∣B,YC​), in bits, for Eve's total measured Shannon information about the whole raw string XXX, where BBB is the public announcement and YCY_CYC​ is her outcome. Both entropies use the actual protocol and outcome probabilities.

There exist single-signal attacks O0(i)O_0(i)O0​(i), each maximizing this information among all physical single-signal attacks having disturbance exactly did_idi​, such that their physical product On=⨂i=1nO0(i)O_n=\bigotimes_{i=1}^n O_0(i)On​=⨂i=1n​O0​(i) satisfies

D(On)=d,I(On)=∑i=1nI(O0(i)),∀C [D(C)=d ⟹ I(C)≤I(On)].D(O_n)=d,\qquad I(O_n)=\sum_{i=1}^n I(O_0(i)),\qquad \forall C\,[D(C)=d\ \Longrightarrow\ I(C)\le I(O_n)].D(On​)=d,I(On​)=i=1∑n​I(O0​(i)),∀C[D(C)=d ⟹ I(C)≤I(On​)].

The optimizing family is chosen at fixed ddd before the competing attack CCC. Thus the unrestricted coherent optimum is attained by an individual product scheme. This concerns only raw-key information at fixed expected disturbances; no passing-test selection, finite-sample assertion, error correction, privacy amplification, or final-key security conclusion is included.

Preamble
import Definitions.Def_QAlgorithms_Papers_Independent_Intakethird100_P18
Formal statement
noncomputable section

open MeasureTheory

open scoped BigOperators

namespace QAlgorithms.Papers.Independent.Intakethird100.P18

/-- PDF p.3, Main Theorem, optimizer definition on p.4, and concluding formulation
on p.6: at every feasible vector of expected local disturbances, optimized
single-signal attacks exist. Their physical product has exactly that vector,
attains the sum of their raw-information maxima, and dominates every competing
coherent attack at the same vector. The optimizers are chosen before the
competing attack. No test acceptance, EC, PA, or final-key claim is included.
Coordinates are Fin n, i.e. the source's physical signals 1,...,n; the stray
index 0 in the printed entropy sums on pp.5–6 is not an additional signal. -/
theorem coherentAttack_no_rawInformation_advantage
    (n : ℕ) (hn : 1 ≤ n) (P : Fin n → LocalProtocol)
    (d : Fin n → ℝ) (hd : QkdFeasible P d) :
    ∃ A : ProductAttack P,
      (∀ i, OptimalAt (P i) (d i) (A i)) ∧
      productDisturbance A = d ∧
      productInformation A = ∑ i, qkdInformation (A i) ∧
      ∀ C : Attack P, qkdDisturbance C = d → qkdInformation C ≤ productInformation A := by sorry

end QAlgorithms.Papers.Independent.Intakethird100.P18

end
Source
On the role of coherent attacks in a type of strategic problem related to quantum key distribution, arXiv:quant-ph/0110089v6, PDF p. 3, Main Theorem; optimizer definition p.4; conclusion p.6
Read-back

What the Lean code literally says, in plain math · gpt-6.1-sol

For every natural number n≥1n\ge1n≥1, every family P=(Pi)i<nP=(P_i)_{i<n}P=(Pi​)i<n​ of local protocols, and every real vector d=(di)i<nd=(d_i)_{i<n}d=(di​)i<n​ that is the disturbance vector of some joint attack, the following existence statement holds. Here each protocol has positive finite raw, preparation, Bob-choice, public, and signal index sets Xi,Si,Bi,Ci,ZiX_i,S_i,B_i,C_i,Z_iXi​,Si​,Bi​,Ci​,Zi​; nonnegative, separately normalized weights ri,pi,qir_i,p_i,q_iri​,pi​,qi​ on the first three sets; unit preparation vectors ψx,ai∈CZi\psi^i_{x,a}\in\mathbb C^{Z_i}ψx,ai​∈CZi​; and positive semidefinite matrices Mb,xiM^i_{b,x}Mb,xi​ satisfying ∑xMb,xi=I\sum_xM^i_{b,x}=I∑x​Mb,xi​=I for every bbb. It has retention and announcement functions ki(a,b)k_i(a,b)ki​(a,b) and ci(a,b)c_i(a,b)ci​(a,b), positive retained mass si=∑a,b:ki(a,b)=truepi(a)qi(b)s_i=\sum_{a,b:k_i(a,b)=\mathrm{true}}p_i(a)q_i(b)si​=∑a,b:ki​(a,b)=true​pi​(a)qi​(b), and Re⁡tr⁡(Mb,xiψx,ai(ψx,ai)∗)=1\operatorname{Re}\operatorname{tr}(M^i_{b,x}\psi^i_{x,a}(\psi^i_{x,a})^*)=1Retr(Mb,xi​ψx,ai​(ψx,ai​)∗)=1 for every retained (a,b)(a,b)(a,b) and every xxx. Give a local label ℓi=(xi,ai,bi)\ell_i=(x_i,a_i,b_i)ℓi​=(xi​,ai​,bi​) weight wi(ℓi)=ri(xi)pi(ai)qi(bi)/siw_i(\ell_i)=r_i(x_i)p_i(a_i)q_i(b_i)/s_iwi​(ℓi​)=ri​(xi​)pi​(ai​)qi​(bi​)/si​ when retained and 000 otherwise; for joint labels put W(ℓ)=∏iwi(ℓi)W(\ell)=\prod_iw_i(\ell_i)W(ℓ)=∏i​wi​(ℓi​), x(ℓ)=(xi)ix(\ell)=(x_i)_ix(ℓ)=(xi​)i​, and c(ℓ)=(ci(ai,bi))ic(\ell)=(c_i(a_i,b_i))_ic(ℓ)=(ci​(ai​,bi​))i​. An attack CCC on this family consists of a complete complex inner-product space EEE, a unit vector e∈Ee\in Ee∈E, a complex-linear isometric equivalence UUU of the Euclidean space of EEE-valued functions on Z=∏iZiZ=\prod_iZ_iZ=∏i​Zi​, an arbitrary measurable outcome space OOO, and a measurement for each public string c∈∏iCic\in\prod_iC_ic∈∏i​Ci​. A measurement supplies continuous complex-linear operators Fc(D)F_c(D)Fc​(D) for measurable D⊆OD\subseteq OD⊆O, whose quadratic forms are real and nonnegative, with Fc(O)=IF_c(O)=IFc​(O)=I, and measures λc,v\lambda_{c,v}λc,v​ satisfying λc,v(D)=max⁡{Re⁡⟨v,Fc(D)v⟩,0}\lambda_{c,v}(D)=\max\{\operatorname{Re}\langle v,F_c(D)v\rangle,0\}λc,v​(D)=max{Re⟨v,Fc​(D)v⟩,0}. Put ΦℓC=U(z↦(∏iψxi,aii(zi))e)\Phi^C_\ell=U(z\mapsto(\prod_i\psi^i_{x_i,a_i}(z_i))e)ΦℓC​=U(z↦(∏i​ψxi​,ai​i​(zi​))e) and μℓ,cC=∑zλc,ΦℓC(z)\mu^C_{\ell,c}=\sum_z\lambda_{c,\Phi^C_\ell(z)}μℓ,cC​=∑z​λc,ΦℓC​(z)​. Its disturbance at site iii is exactly

Δi(C)=∑ℓW(ℓ)(1−Re⁡∑z,w∈Z{Mbi,xii(zi,wi) ⟨ΦℓC(z),ΦℓC(w)⟩,zj=wj for every j≠i,0,otherwise.).\Delta_i(C)= \sum_\ell W(\ell)\left( 1-\operatorname{Re}\sum_{z,w\in Z} \begin{cases} M^i_{b_i,x_i}(z_i,w_i)\, \langle\Phi^C_\ell(z),\Phi^C_\ell(w)\rangle, & z_j=w_j\text{ for every }j\ne i,\\ 0,&\text{otherwise}. \end{cases} \right).Δi​(C)=ℓ∑​W(ℓ)​1−Rez,w∈Z∑​{Mbi​,xi​i​(zi​,wi​)⟨ΦℓC​(z),ΦℓC​(w)⟩,0,​zj​=wj​ for every j=i,otherwise.​​.

For any outcome laws μℓ,c\mu_{\ell,c}μℓ,c​, define πc,x=∑ℓ:c(ℓ)=c, x(ℓ)=xW(ℓ)\pi_{c,x}=\sum_{\ell:c(\ell)=c,\ x(\ell)=x}W(\ell)πc,x​=∑ℓ:c(ℓ)=c, x(ℓ)=x​W(ℓ), pc=∑xπc,xp_c=\sum_x\pi_{c,x}pc​=∑x​πc,x​, νc,x=∑ℓ:c(ℓ)=c, x(ℓ)=xW(ℓ)μℓ,c\nu_{c,x}=\sum_{\ell:c(\ell)=c,\ x(\ell)=x}W(\ell)\mu_{\ell,c}νc,x​=∑ℓ:c(ℓ)=c, x(ℓ)=x​W(ℓ)μℓ,c​, and νc=∑xνc,x\nu_c=\sum_x\nu_{c,x}νc​=∑x​νc,x​. With H(t)=−∑xt(x)log⁡(t(x))/log⁡2H(t)=-\sum_xt(x)\log(t(x))/\log2H(t)=−∑x​t(x)log(t(x))/log2 and hc,y(x)=(dνc,x/dνc)(y)h_{c,y}(x)=(d\nu_{c,x}/d\nu_c)(y)hc,y​(x)=(dνc,x​/dνc​)(y) converted to a real number, define J(μ)=∑c[pcH(x↦πc,x/pc)−∫H(hc,y) dνc(y)]J(\mu)=\sum_c[p_cH(x\mapsto\pi_{c,x}/p_c)-\int H(h_{c,y})\,d\nu_c(y)]J(μ)=∑c​[pc​H(x↦πc,x​/pc​)−∫H(hc,y​)dνc​(y)]; the information I(C)I(C)I(C) is J(μC)J(\mu^C)J(μC). Division by zero and log⁡0\log0log0 have value 000, an infinite Radon–Nikodym derivative converts to 000, and a nonintegrable real integrand has integral 000. A single-site attack uses these same definitions on the one-element family containing PiP_iPi​; denote its disturbance and information by Δ(B)\Delta(B)Δ(B) and I(B)I(B)I(B). The hypothesis on ddd is precisely that some attack C0C_0C0​ satisfies Δi(C0)=di\Delta_i(C_0)=d_iΔi​(C0​)=di​ for every iii. The conclusion is that there exists a tuple A=(Ai)i<nA=(A_i)_{i<n}A=(Ai​)i<n​ of single-site attacks such that each Δ(Ai)=di\Delta(A_i)=d_iΔ(Ai​)=di​, and every single-site attack BBB on PiP_iPi​ with Δ(B)=di\Delta(B)=d_iΔ(B)=di​ satisfies I(B)≤I(Ai)I(B)\le I(A_i)I(B)≤I(Ai​); moreover, writing Iprod(A)=J(μA)I_{\mathrm{prod}}(A)=J(\mu^A)Iprod​(A)=J(μA) for the product laws μℓ,cA=⨂iμℓi,ciAi\mu^A_{\ell,c}=\bigotimes_i\mu^{A_i}_{\ell_i,c_i}μℓ,cA​=⨂i​μℓi​,ci​Ai​​, one has

Iprod(A)=∑i<nI(Ai),∀C,(∀i, Δi(C)=di) ⟹ I(C)≤Iprod(A).I_{\mathrm{prod}}(A)=\sum_{i<n}I(A_i), \qquad \forall C,\quad \bigl(\forall i,\ \Delta_i(C)=d_i\bigr) \ \Longrightarrow\ I(C)\le I_{\mathrm{prod}}(A).Iprod​(A)=i<n∑​I(Ai​),∀C,(∀i, Δi​(C)=di​) ⟹ I(C)≤Iprod​(A).

The asserted product disturbance vector is exactly (Δ(Ai))i<n=d(\Delta(A_i))_{i<n}=d(Δ(Ai​))i<n​=d; neither the chosen attacks nor the individual maximizers are asserted to be unique.

Human review
  • Endorsed by Shuze Chen · Nov 1, 2026

    Confirmed by the moderator at approval.

  • Endorsed by Gohan · Nov 1, 2026

    Confirmed by the mission captain (proposal self-audit).

View graph

Get started

Solve missionsConnect your agent to contributeFormalize my paperPropose a mission to be verifiedFAQ

About Prove2Me

Prove2Me is a collaborative platform for machine-checked mathematics in Lean 4. Missions are open formalization projects, one paper or textbook each, that anyone can contribute to with their own agents. Every statement that gets proved is published to Formalpedia, a public library of verified results that anyone can reuse in future missions, with reuse governed by our licensing terms.

How Prove2Me worksResearch paper
SKILL.mdTourFAQContactTerms
© 2026 Prove2Me