⚛️ quantum physics

Marginal-constrained entropy accumulation theorem

This paper establishes a novel chain rule for channel conditional entropies that proves their additivity and enables a generalized, fully adaptive entropy accumulation theorem for cryptography by imposing marginal-state constraints on input states.

Original author: Amir Arqand, Ernest Y. -Z. Tan

Published 2026-11-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original author: Amir Arqand, Ernest Y. -Z. Tan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the author. For technical accuracy, refer to the original paper. Read full disclaimer

In the realm of quantum cryptography, the goal is to create communication channels that are fundamentally secure, protected by the laws of physics rather than just mathematical complexity. A central challenge in this field is determining how much secret information two people, traditionally called Alice and Bob, can extract from a quantum exchange while ensuring a potential eavesdropper, Eve, has learned nothing useful. To do this, scientists rely on a concept called entropy, which in this context measures the amount of uncertainty or randomness in a system. The more uncertainty an eavesdropper has about the data, the more secure the communication is. For years, researchers have used a powerful tool known as the entropy accumulation theorem to estimate this security. This tool works by breaking a long communication session into many small, sequential steps, calculating the uncertainty for each step, and then adding them up to get a total security guarantee. However, this method has historically struggled with a specific type of quantum protocol called prepare-and-measure, which is widely used in real-world networks. The old method required that these protocols run at a slow, fixed pace, preventing the rapid repetition of signals that modern technology demands.

A team of researchers at the University of Waterloo has now developed a new mathematical framework that removes this speed limit. They derived a fresh set of rules, which they call the marginal-constrained entropy accumulation theorem, designed to handle the specific quirks of prepare-and-measure protocols without forcing them to slow down. The core of their work involves a new way of calculating the uncertainty of quantum channels, which are the devices that transmit quantum information. They proved that when these channels are used in sequence, the total uncertainty can be accurately estimated by looking at the individual steps, provided that certain constraints on the input states are respected. This might sound abstract, but it translates to a very practical capability: the ability to analyze security in protocols where the sender can change their strategy or the nature of the signals being sent from round to round, and where the timing of events can be flexible.

The researchers achieved this by first establishing a new chain rule for a family of entropy measures. In simple terms, a chain rule allows one to calculate the total complexity of a system by understanding how its parts fit together. They showed that for a specific type of entropy, the total value for a sequence of operations is at least as large as the sum of the values for each operation performed individually. This property, known as strong additivity, had been suspected but not rigorously proven for the specific conditions required by these cryptographic protocols. By proving this, they created a solid foundation for the new theorem. The result is a method that allows security analysts to impose specific constraints on the input states of each channel, reflecting the reality that in a prepare-and-measure protocol, the sender does not send a single, unchanging state every time, but rather a sequence of states that must adhere to certain physical limits.

This new approach is particularly significant because it enables what the authors call "fully adaptive" protocols. In the past, security proofs for these fast-paced protocols were often restricted to scenarios where the adversary could only interact with one signal at a time, effectively capping the speed of the network. The new theorem allows for a more dynamic analysis where the estimation of security can be updated as the protocol runs, similar to how a driver might adjust their speed based on changing road conditions. This flexibility means that the security of a quantum key distribution system can be guaranteed even if the signals are sent in rapid succession, without the need for the rigid timing constraints that previously limited these systems. The researchers demonstrated that their method yields tighter security bounds, meaning it can certify that more secret key can be safely extracted than was previously possible under the old rules.

The work also clarifies the relationship between different mathematical approaches to quantum security. While the new theorem is more powerful for prepare-and-measure protocols, the authors note that it is not strictly superior to all existing methods in every possible scenario. Specifically, it does not yet accommodate a certain type of internal memory that some other frameworks allow, where a system can store secret information between rounds without it being visible to an eavesdropper. However, for the vast majority of practical, high-speed quantum communication networks that rely on prepare-and-measure techniques, this new framework offers a more accurate and less restrictive path to proving security. By removing the artificial speed limits on these protocols, the research opens the door for quantum networks to operate at the high repetition rates required for real-world applications, ensuring that the promise of unhackable communication can be delivered at the speed of modern data transmission.

Technical Summary: Marginal-Constrained Entropy Accumulation Theorem

Problem Statement
The paper addresses fundamental questions in quantum information theory regarding the additivity of entropic quantities associated with quantum channels, specifically within the context of quantum cryptography. A central challenge in the security analysis of Quantum Key Distribution (QKD) protocols is relating the entropy of a final state (generated by $n$ rounds of operations) to simpler, single-round quantities. While the Entropy Accumulation Theorem (EAT) and its generalization (GEAT) provide such bounds, they face limitations:

Repetition Rate Restrictions: Existing GEAT-based proofs for prepare-and-measure (PM) QKD protocols often require the adversary to interact with only a single quantum register at a time, effectively limiting the protocol's repetition rate.
Marginal Constraints: PM protocols, when analyzed via the source-replacement technique, impose specific constraints on the marginal state of the sender (Alice). Previous chain rules and accumulation theorems did not naturally accommodate these marginal constraints while allowing for adaptive protocols where side-information updates depend on previous rounds.
Optimality: Key rates derived from EAT/GEAT were sometimes suboptimal compared to methods using entropic uncertainty relations or quantum probability estimation (QPE).

Methodology
The authors develop a new theoretical framework combining techniques from variational characterizations of measured divergences and regularization arguments. The methodology proceeds in three main stages:

Channel Conditional Entropy and Additivity:
The authors define a family of marginal-constrained channel conditional entropies, $H^\uparrow_\alpha(M, B, [\psi_A])$ , based on sandwiched Rényi divergences. This quantity represents the minimum output conditional entropy of a channel $M$ given a constraint on the input marginal state $\psi_A$ .
- They prove that for $\alpha \ge 1$ , these entropies are strongly additive across tensor products of channels.
- Crucially, they derive a chain rule (superadditivity) for channel composition. For two channels $E_1$ and $E_2$ , the entropy of the composed channel $E_2 \circ E_1$ with a product input constraint is bounded below by the sum of the individual channel entropies.
- The proof utilizes a duality relation between channel conditional entropy and minimized channel divergence, followed by a regularization argument to convert results from measured Rényi divergences to sandwiched Rényi divergences.
f-Weighted Rényi Entropies:
To handle the accumulation of entropy over sequential rounds with varying constraints, the authors generalize the concept of $f$ -weighted Rényi entropies (introduced in [HB25]). They extend this definition to include a "secret" classical register $C$ on the left side of the conditioning, allowing for more flexible tradeoff functions that can depend on public values from previous rounds. They establish properties such as data-processing, monotonicity in $\alpha$ , and chain rules for these generalized entropies.
Derivation of the MEAT:
By combining the superadditivity of channel conditional entropy with the QPE-inspired statistical analysis methods from [HB25, AHT24], the authors derive the Marginal-Constrained Entropy Accumulation Theorem (MEAT). This theorem provides a lower bound on the smooth min-entropy (or Rényi entropy) of the final state conditioned on an acceptance event, expressed as a sum of single-round optimizations subject to marginal constraints.

Key Contributions and Results

Novel Chain Rule: The paper establishes a chain rule for channel conditional entropies (Theorem 3.1) that incorporates marginal constraints. This result implies strong additivity for tensor products (Corollary 3.3) and superadditivity for channel composition.
The MEAT (Theorem 4.2a/4.2b): The authors introduce the MEAT, a new variant of the entropy accumulation theorem.
- Marginal Constraints: Unlike the GEAT, MEAT explicitly allows for different marginal constraints $\sigma^{(j)}_{A_j}$ to be imposed on the input state of each channel $M_j$ .
- Fully Adaptive Protocols: The framework allows the tradeoff functions (used to bound entropy) to be updated adaptively based on the "public" classical values ( $\hat{c}^{j-1}_1$ ) from preceding rounds. This enables "fully adaptive" statistical estimation procedures similar to those in the QPE framework.
- Generality: The theorem applies to sequences of non-IID channels, covering a broader range of protocols than previous IID-based approaches.
Application to PM-QKD: The paper demonstrates how to apply MEAT to Prepare-and-Measure QKD protocols using the source-replacement technique.
- By modeling the protocol as a sequence of channels acting on a source-replaced state with marginal constraints, MEAT yields security proofs that do not impose repetition-rate restrictions.
- The analysis removes the limitation found in previous GEAT-based PM-QKD proofs where the adversary was restricted to interacting with a single register at a time.
- For protocols without secret memory registers, the paper claims a slightly tighter keyrate bound compared to previous works due to the use of the tighter conditional Rényi entropy $H^\uparrow_\alpha$ .

Significance and Claims
The authors position this work as a significant advancement for the security analysis of quantum cryptography, particularly for prepare-and-measure protocols.

Removal of Repetition-Rate Limits: The primary practical advantage claimed is the removal of the repetition-rate restriction when applying entropy accumulation to PM-QKD. This allows for high-speed implementations where multiple rounds can be processed without waiting for side-information updates.
Generalization of Security Proofs: The work generalizes the technique introduced in [HB25] to allow for fully adaptive protocols and varying marginal constraints per round, offering a more flexible tool for analyzing complex QKD scenarios.
Comparison with GEAT: The authors note that while MEAT handles marginal constraints (which GEAT does not), it does not currently accommodate "secret" internal memory registers that can be passed between rounds without signaling to the adversary (a feature of GEAT). Thus, the results are presented as complementary rather than strictly superior in all contexts, though they are strictly more suitable for the specific class of PM-QKD protocols discussed.
Tightness: The use of sandwiched Rényi entropies and the specific chain rule allows for tighter bounds on extractable key lengths compared to previous methods that relied on looser entropy measures or restrictive channel models.

The paper concludes by identifying the unification of the GEAT (handling secret memory) and MEAT (handling marginal constraints) as a direction for future work, noting that current techniques do not yet easily bridge these two frameworks.

More like this