Capacities of classical compound quantum wiretap and classical quantum compound wiretap channels

We determine the capacity of the classical compound quantum wiretapper channel with channel state information at the transmitter. Moreover we derive a lower bound on the capacity of this channel without channel state information and determine the capacity of the classical quantum compound wiretap channel with channel state information at the transmitter.


I. INTRODUCTION
The compound channel models transmission over a channel that may take a number of states, its capacity was determined by [6]. A compound channel with an eavesdropper is called a compound wiretap channel. It is defined as a family of pairs of channels {(W t , V t ) : t = 1, · · · , T } with common input alphabet and possibly different output alphabets, connecting a sender with two receivers, one legal and one wiretapper, where t is called a state of the channel pair (W t , V t ). The legitimate receiver accesses the output of the first channel W t in the pair (W t , V t ), and the wiretapper observes the output of the second part V t in the pair (W t , V t ), respectively, when a state t governs the channel. A code for the channel conveys information to the legal receiver such that the wiretapper knows nothing about the transmitted information. This is a generalization of Wyner's wiretap channel [15] to the case of multiple channel states.
We will be dealing with two communication scenarios. In the first one only the transmitter is informed about the index t (channel state information (CSI) at the transmitter), while in the second, the legitimate users have no information about that index at all (no CSI).
The compound wiretap channels were recently introduced in [9]. A upper bound on the capacity under the condition that the average error goes to zero and the sender has no knowledge about CSI is obtained. The result of [9] was improved in [5] by using the stronger condition that the maximal error should go to zero. Furthermore, the secrecy capacity for the case with CSI was calculated. This paper is organized as follows.
In Section II we present some known results for classical compound wiretap channel which we will use for our result's proof.
In Section III we derive the capacity of the classical compound quantum wiretap channel with CSI and give a lower bound of the capacity without CSI. In this channel model the wiretapper uses classical quantum channels.
In Section IV we derive the capacity of the classical quantum compound wiretap channel with CSI. In this model both the receiver and the wiretapper use classical quantum channels, and the set of the states can be both finite or infinite. Here we will use an idea which is similar to the one used in [2].

II. CLASSICAL COMPOUND WIRETAP CHANNELS
Let A,B, and C be finite sets, P (A), P (B), and P (C) be the sets of probability distributions on A, B and C, respectively. Let θ := {1, · · · , T }. For every t ∈ θ let W t be a channel A → P (B) and V t be a channel A → P (C). We call (V t , W t ) t∈θ a compound wiretap channel. W n t and V n t stand for the n-th memoryless extensions of stochastic matrices W t and V t .
Here the first family represents the communication link to the legitimate receiver while the output of the latter is under control of the wiretapper.
Let X be a discrete random variable on a finite set {x 1 , · · · , x n }, with probability distribution function p i := P r(x i ) for i = 1, · · · , n, then the Shannon entropy is defined as Let X be a discrete random variable on a finite set X with probability distribution function P X , let Y be a discrete random variable on a finite set Y with probability distribution function P Y , and let P XY be their joint probability distribution, then the mutual information between X and Y is defined as Let N (x|x n ) be the number of occurrences of the symbol x in the sequence X n . For a probability distribution P ∈ P (A) and δ ≥ 0 let typical sequences and conditional typical sequence be defined as : An (n, J n ) code for the compound wiretap channel (V t , W t ) t∈θ consists of stochastic encoders {E} : {1, · · · , J n } → P (A n ) and a collection of mutually disjoint sets {D j ⊂ B n : j ∈ {1, · · · , J n }} (decoding sets).
A non-negative number R is an achievable secrecy rate for the compound wiretap channel (W t , V t ) in the case with CSI if there is a collection of (n, J n ) codes ({E t : t ∈ θ}, {D j : j = 1, · · · , J n }) such that where J is an uniformly distributed random variable with value in {1, · · · , J n }, and Z n t are the resulting random variables at the output of wiretap channels V n t . A non-negative number R is an achievable secrecy rate for the compound wiretap channel (W t , V t ) in the case without CSI if there is a collection of (n, J n ) codes (E, {D j : j = 1, · · · , J n }) such that Remark 1: A weaker and widely used security criterion is obtained if we replace (2), respectively (4), with lim n→∞ max t∈θ 1 n I(J; Z n t ) = 0 .
In case with CSI, let p ′ t (x n ) := p n t (x n ) p n t (T n p t ,δ ) , if x n ∈ T n pt,δ 0 , else and X (t) := {X (t) j,l } j∈{1,··· ,Jn},l∈{1,··· ,Ln,t} be a family of random matrices whose entries are i.i.d. according to p ′ t . It was shown in [5] that for any ω > 0, if we set where µ is a positive constant which does not depend on j, t, and can be arbitrarily small when ω goes to 0, then there are such {D j : j = 1, · · · , J n } that for all t ∈ θ P r Since here only the error of the legitimate receiver is analyzed, so for the result above just the channels V t , but not those of the wiretapper, are regarded.
In view of (5), one has (see [5]) the largest achievable rate, called capacity, of the compound wiretap channel with CSI at the transmitter C S,CSI , is given by where B t are the resulting random variables at the output of legal receiver channels. Z t are the resulting random variables at the output of wiretap channels. Analogously, in case without CSI, the idea is similar to the case with CSI: Let p ′ (x n ) := if x n ∈ T n p,δ 0 else and X n := {X j,l } j∈{1,··· ,Jn},l∈{1,··· ,Ln} be a family of random matrices whose components are i.i.d. according to p ′ .
For any ω > 0, define where µ is a positive constant which does not depend on j, t, and can be arbitrarily small when ω goes to 0, then there are such {D j : j = 1, · · · , J n } that for all t ∈ θ P r Using (7) one can obtain (see [5]) that the secrecy capacity of the compound wiretap channel without CSI at the transmitter C S is lower bounded as follows,

III. CLASSICAL COMPOUND QUANTUM WIRETAP CHANNELS
Let A and B be finite sets, and let H be a finite-dimensional complex Hilbert space. Let P (A) and P (B) be the sets of probability distributions on A and B respectively, and S(H) be the space of self-adjoint, positive-semidefinite bounded linear operators with trace 1 on H. Let θ := {1, · · · , T } and for every t ∈ θ let W t be a channel A → P (B) and V t be a classical quantum channel, i.e., a map A → S(H): For a state ρ, the von Neumann entropy is defined as Let P be a probability distribution over a finite set J, and Φ := {ρ(x) : x ∈ J} be a set of states labeled by elements of J. Then the Holevo χ quantity is defined as ) .
A non-negative number R is an achievable secrecy rate for the classical compound quantum wiretap channel where J is an uniformly distributed random variable with value in {1, · · · , J n }. Z t are the sets of states such that the wiretapper will get. A non-negative number R is an achievable secrecy rate for the classical compound quantum wiretap channel Theorem 1: The largest achievable rate (secrecy capacity) of the classical compound quantum wiretap channel (W t , V t ) t∈θ in the case with CSI C S,CSI at the transmitter is given by Respectively, in the case without CSI, the secrecy capacity of the classical compound quantum wiretap channel (W t , V t ) t∈θ C S is lower bounded as follows where B t are the resulting random variables at the output of legal receiver channels, and Z t are the resulting random states at the output of wiretap channels. Proof: 1) Lower bound Let p ′ t , X (t) , and D j be defined like in classical case. Then (5) still holds since the sender transmits through a classical channel to the legitimate receiver. We abbreviate X := {X (t) : t ∈ θ}.
Analogously, in the case without CSI, let p ′ X n and D j be defined like in classical case, then (7) still holds.
For ρ ∈ S(H) and α > 0 there exists an orthogonal subspace projector Π ρ,α commuting with ρ ⊗n and satisfying where a := #{A}, and K is a constant which is in polynomial order of n.
For P ∈ P (A), α > 0 and x n ∈ T n P there exists an orthogonal subspace projector Π V,α (x n ) commuting with V ⊗n x n and satisfying: where a := #{A}, d := dim H, and K is a constant which is in polynomial order of n (see [13]).
where α will be defined later.
Lemma 1 (see [14]): Let ρ be a state and X be a positive operator with X ≤ id (the identity matrix) and With the Lemma 1, (11), (17), and the fact that Π P Vt,α √ a and Π Vt,α (x n ) are both projection matrices, for any t and x n it holds: We set Θ t := x n ∈T n p t ,δ p ′ n t (x n )Q t (x n ). For given z n and t, z n |Θ t |z n is the expected value of z n |Q t (x n )|z n under the condition x n ∈ T n pt,δ . Lemma 2 (see [3]): Let V be a finite dimensional Hilbert space, X 1 , · · · , X L be a sequence of i.i.d. random variables with values in S(V) such that X i ≤ µ · id V for all i ∈ {1, · · · , L}, and ǫ ∈]0, 1[. Let p be a probability distribution on {X 1 , · · · , X L }, ρ = i p(X i )X i be the expected value of X i , and Π ′ ρ,λ be the projector onto the subspace spanned by the eigenvectors of ρ whose corresponding eigenvalues are greater than λ dim V , then Let V be the image of Π P,α √ a . By (12), we have The first inequality follows from (16). The second inequality holds because Π Vt,α and Π P Vt,α √ a are projection matrices. The third inequality holds because Π P Vt,α √ a is a projection matrix onto V.
Let L n,t = 2 n(χ(P,Zt)+2ζ) and n be large enough, then by (22) for all j it holds where υ is some positive suitable constant which does not depend on j and t.
Analogously, in the case without CSI, let L n = 2 n maxt(χ(P,Zt)+δ) and n be large enough, then we can find some positive constant υ so that for all j.

Remark 2:
Since exp(−2 nζ ) converges to zero double exponentially faster, the inequality (24) remains true even if T depends on n and is exponentially large over n, i.e., we can still achieve exponentially small error.
From (5) and (24), it follows: For any ǫ > 0, if n is large enough then the event has a positive probability. This means that we can find a realization x j,l with a positive probability such that for all t ∈ θ, we have where E t is the random output of (X (t) j,l ) l . Choose a sufficiently large but fixed α in (19) so that for all j it holds V ⊗n j,l ) < ǫ . In this case, for any given j ′ ∈ {1, · · · , J n } we have and E j Ln,t l=1 1 j,l ) − Θ t ≤ ǫ for any probability distribution uniformly distributed on {1, · · · , J n }. [14]): Let X and Y be two states in a d-dimensional complex Hilbert space and X − Y ≤ µ < 1 e , then

Lemma 3 (Fannes inequality
If J is a probability distribution uniformly distributed on {1, · · · , J n }, then from the inequality (28) and Lemma 3 we have We have lim Analogously, in the case without CSI, we can find a realization x n j,l of X (t) j,l with a positive probability such that: For all t ∈ θ, we have For any γ > 0 let for any probability distribution J uniformly distributed on {1, · · · , J n } in the case without CSI.

2) Upper bound for case with CSI
Considering (C n ) is a sequence of (n, J n ) code such that where lim n→∞ ǫ 1,n = 0 and lim n→∞ ǫ 2,n = 0, J denotes the random variable which is uniformly distributed on the message set {1, . . . , J n }. Let C(V t , W t ) denote the secretey capacity of the wiretap channel (V t , W t ) in the sense of [13]. Choose t ′ ∈ θ such that It is well-known, in information theory, that even in the case without wiretapper (we have only one classical channel W t ′ ), the capacity cannot exceed I(J; B t ′ )+ξ for any constant ξ > 0. So the capacity of a quantum wiretap channel (V t ′ , W t ′ ) cannot be greater than for any ǫ > 0.
Since we cannot exceed the secrecy capacity of the worst wiretap channel, we have

IV. CLASSICAL QUANTUM COMPOUND WIRETAP CHANNEL WITH CSI
Let H be a finite-dimensional complex Hilbert space. Let S(H) be the space of self-adjoint, positive-semidefinite bounded linear operators on H with trace 1. For every t ∈ θ let W t respectively V t be quantum channels, i.e., completely positive trace preserving maps S(H) → S(H).
An (n, J n , λ) code for the classical quantum compound wiretap channel (W t , V t ) t∈θ consists of a family of vectors w := {w(j) : j = 1, · · · , J n } ⊂ S(H ⊗n ) and a collection of positive semi-definite operators {D j : j ∈ {1, · · · , J n }} ⊂ S(H ⊗n ) which is a partition of the identity, i.e.
A non-negative number R is an achievable secrecy rate for the classical quantum compound wiretap channel (W t , V t ) t∈θ with CSI if there is an (n, J n , λ) code ( w t := {w t (j) : j} : t , {D j : j}) such that where J is a uniformly distributed random variable with value in {1, · · · , J n }, and Z t are the sets of states such that the wiretapper will get. Theorem 2: The largest achievable rate (secrecy capacity) of the classical quantum compound wiretap channel in the case with CSI is given by where B t are the resulting random states at the output of legal receiver channels, and Z t are the resulting random states at the output of wiretap channels. Proof: Our idea is to send the information in two parts, firstly, we send the state information with finite blocks of finite bits with a code C 1 to the receiver, and then, depending on t, we send the message with a code C (t) 2 in the second part.

1) Sending channel state information with finite bits
For the first part, we don't require that the first part should be secure against the wiretapper, since we assume that the wiretapper already has the full knowledge of the CSI.
By ignoring the security against the wiretapper, we have only to look at the compound channel (W t ) t∈θ . Let W = (W t ) t be an arbitrary compound classical quantum channel. Then by [4], for each λ ∈ (0, 1) the λ-capacity C(W, λ) equals If min t max p χ(p, W t ) > 0 holds, then the sender can build a code C 1 such that the CSI can be sent to the legal receiver with a block with length l ≤ log T mint maxp χ(p,Wt) . We need to do nothing because in this case the right hand side of (38) is zero.
Let c = 1 − λ, then for any required upper bound δ = 2 −c ′ , with given c ′ > 0, the sender can repeat sending this block log c · c ′ times, and the legal receiver simply picks out the state that he receives most frequently to find out t with a error probability ≤ δ.
The first part is of length l · log c · c ′ = O(1), which is negligible compared to the second part.

2) Message transformation when both the sender and the legal receiver Know CSI
If both the sender and the legal receiver have the full knowledge of t, then we only have to look at the single wiretap channel (W t , V t ).
In [7] and [8], it is shown that there exists an (n, J n , λ) code for the quantum wiretap channel (W, V ) with log J n = max P,w (χ(P, B ⊗n ) − χ(P, Z ⊗n )) − ǫ , for any ǫ > 0, where B is the resulting random variable at the output of legal receiver's channel and Z the output of the wiretap channel.
When the sender and the legal receiver both know t, they can build an (n, J n,t , λ) code C Thus, Remark 3: For the construction of the second part of our code, we use random coding and request that the randomization can be sent (see [7]). However, it is shown in [5] that the randomization could not always be sent if we require that we use one unique code which is secure against the wiretapper and suitable for every channel state, i.e., it does not depend on t. This is not a counterexample to our results above, neither to the construction of C 1 nor to the construction of C (t) 2 , because of following facts.
The first part of our code does not need to be secure. For our second part, the legal transmitters can use the following strategy: At first they bulid a code C 1 = (E, {D j : j = 1, · · · , J n }) and a code C for every t ∈ θ. If the sender wants to send the CSI t ′ ∈ θ and the message j, he encodes t ′ with E and j with E (t ′ ) , then he sends both parts together through the channel. After receiving both parts, the legal receiver decodes the first part with {D j : j}, and chooses the right decoders {D j : j} : t ∈ θ to decode the second part. With this strategy, we can avoid using one unique code which is suitable for every channel state.

3) Upper bound
For any From [7] and [8], we know that the capacity of the quantum wiretap channel (W t ′ , V t ′ ) cannot be greater than Since we cannot exceed the capacity of the worst wiretap channel, we have This together with (42) completes the proof of Theorem 2.
Thus if for every t ∈ θ and n ∈ N, holds for all P ∈ P (A) and {w t (j) : j = 1, · · · , J n } ⊂ S(H ⊗n ), we have So far, we assumed that |θ|, the number of the channels, is < ∞. Now we look at the case where |θ| can be arbitrary. where · 1 stands for the trace norm. It is well known [11] that this norm is multiplicative, i.e. W ⊗ W ′ ♦ = W ♦ · W ′ ♦ . A τ -net in the space of the completely positive trace preserving maps is a finite set W (k) K k=1 with the property that for each W there is at least one k ∈ {1, · · · , K} with W − W (k) ♦ < τ . Lemma 4 (τ −net [10]): For any τ ∈ (0, 1] there is a τnet of quantum-channels W If |θ| is arbitrary, then for any ξ > 0 let τ = ξ − log ξ . By Lemma 4 there exists a finite set θ ′ with |θ ′ | ≤ ( 3 τ ) 2d 4 and τ -nets Since by [7], the error of the code C (t ′ ) 2 decreases exponentially to its length, we can find an N = O(− log ξ) such that for all t ′ ∈ θ ′ it holds Then, if the sender obtains the state information "t" , he can send with finite bits "t ′ " to the legal receiver in the first part, and then they build a code C (t ′ ) 2 that fulfills (46) and (47) to transmit the message.
N τ tends to zero when ξ goes to zero, since N = O(− log ξ).
By (48)  The bits that the sender uses to transform the CSI is large but constant, so it is still negligible compared to the second part. We obtain C CSI > lim n→∞ inf t∈θ max P,wt 1 n (χ(P, B ⊗n t ) − χ(P, Z ⊗n t )) . (50) The proof of the converse is similar to those given in the proof of Theorem 2, where we consider a worst t ′ .
Remark 5: For Theorem 2 and Theorem 3, we have only required that the probability that the legal receiver does not obtain the correct message tends to zero when the code length goes to infinity. We have not specified how fast it should tends to zero. If we analyze the relation between the error probability ε and the code length, then we have the following facts.
In the case of finite θ, let ε 1 denote the probability that the legal receiver does not obtain the correct CSI, and let ε 2 denote the probability that the legal receiver, having CSI, does not obtain the correct message. Since the length of first part of the code is l · log c · c ′ = O(log ε 1 ), as we defined in Section IV, we have ε −1 1 is O(exp(l · log c · c ′ )) = O(exp(n)), where n stands for the length of first part. And for the second part of the code, ε 2 decreased exponentially to the length of the second part, as proven in [7]. Thus, the error probability ε = max{ε 1 , ε 2 } decreases exponentially to the code length in the case of finite θ.
If θ is infinite, let ε 1 denote the probability that the legal receiver does not obtain the correct CSI. Then we have to build two τ -nets, each contains O(( − log ε1 ε1 ) −2d 4 ) channels. If we want to send the CSI of these τ -nets, l, as defined in Section IV, will be O(−2d 4 · log(ε 1 log ε 1 )), this means here ε −1 1 will be O(exp( n 4d 4 )) = O(exp(n)), where n stands for the length of first part. So we can still achieve that the error probability decreases exponentially to the code length in case of infinite θ.

ACKNOWLEDGMENT
We thank Igor Bjelakovic and Holger Boche for useful discussions. Support by the Bundesministerium für Bildung und Forschung (BMBF) via grant 01BQ1052 is gratefully acknowledged.