arXiv:1801.03996v1 [quant-ph] 11 Jan 2018

Noisy Feedback and Loss Unlimited
Private Communication
Dawei Ding

Saikat Guha

Stanford Institute for Theoretical Physics
Stanford University
Stanford, CA 94305, USA
Email: dding@stanford.edu

College of Optical Sciences
University of Arizona
Tucson, AZ 85721, USA
Email: saikat@optics.arizona.edu

Abstract—Alice is transmitting a private message to Bob
across a bosonic wiretap channel with the help of a public
feedback channel to which all parties, including the fullyquantum equipped Eve, have completely noiseless access. We
find that by altering the model such that Eve’s copy of the
initial round of feedback is corrupted by an iota of noise, one
step towards physical relevance, the capacity can be increased
dramatically. It is known that the private capacity with respect
to the original model for a pure-loss bosonic channel is at most
− log(1 − η) bits per mode, where η is the transmissivity, in the
limit of infinite input photon number. This is a very pessimistic
result as there is a finite rate limit even with an arbitrarily large
number of input photons. We refer to this as a loss limited rate.
However, in our altered model we find that we can achieve a rate
of (1/2) log(1 + 4ηNS ) bits per mode, where NS is the input
photon number. This rate diverges with NS , in sharp contrast
to the result for the original model. This suggests that physical
considerations behind the eavesdropping model should be taken
more seriously, as they can create strong dependencies of the
achievable rates on the model. For by a seemingly inconsequential
weakening of Eve, we obtain a loss-unlimited rate. Our protocol
also works verbatim for arbitrary i.i.d. noise (not even necessarily
Gaussian) injected by Eve in every round, and even if Eve is given
access to copies of the initial transmission and noise. The error
probability of the protocol decays super-exponentially with the
blocklength.

I. I NTRODUCTION
We consider the task of continuous variable (CV) private
communication over a lossy bosonic channel with additive
noise, with a quantum-limited adversary. We consider a forward wiretap channel from Alice to Bob with an eavesdropper
Eve. There is also a backward public side channel from Bob to
Alice. All parties, including Eve, have perfectly noiseless access to communication on this side channel. This immediately
presents a problem. All communication channels in reality
have a non-zero level of noise. With error-correction the noise
can be reduced, but never completely removed. Therefore this
model is clearly unphysical. Indeed, most of the information
theoretic capacity analyses of private communication and
secret-key generation have traditionally assumed such a zeroerror feedback. Admittedly, the process of abstraction that
allows a problem to be mathematically analyzed inevitably
causes such unphysical features to emerge. However, we will
find in this paper that this particular feature can be problematic

in that ameliorating it can create a significant difference in
achievable rates.
More explicitly, we propose a protocol over a lossy bosonic
channel and consider an alteration of the feedback-assisted private communication model in which Eve’s copy of the public
communication sent by Bob to Alice on just the initial round of
the protocol is corrupted by a small amount of noise, a small
step towards physical relevance. Eve obtains the remainder
of the public communication noiselessly, and is otherwise
quantum equipped, i.e., has perfect quantum memories and the
ability to make arbitrary collective quantum measurements. We
show that with such a seemingly inconsequential weakening
of the eavesdropper, Alice and Bob can achieve a rate of
1
1
2 log(1 + 4ηNS ) secure bits per mode using a simple laserlight modulation and homodyne detection, NS being the mean
input photon number per mode. This is a loss unlimited rate,
in sharp contrast to the loss limited upper bound known for the
original model: − log(1 − η) [1], [2]. The exact same protocol
also works if the channel has noise in addition to loss. We
will argue that the noise can even be non-Gaussian.
A closely related classical result 2 was proven in [4].
However, their altered communication model assumes Eve’s
copy of the feedback is corrupted by Gaussian additive noise
and on every round. Thus this is a more specialized and
significant departure from the usual model. They do consider
more general correlated noise between the different channels
involved, but this can be integrated into our model as well. In
addition to the difference in model alteration, in the discussion
section we will see that we can slightly strengthen Eve from
what is discussed above, by giving her copies of the initial
transmission and noise, and still obtain our main result with
the same protocol. Note that our results trivially apply to a
classical additive white Gaussian noise (AWGN) channel and
since adding more noise to Eve’s feedback can only increase
the achievable rate, implies the result in [4].

1 Throughout

this paper, logarithms are base 2.
that in the classical case the feedback-assisted private capacity of
the Gaussian wiretap channel also has a loss limited capacity. This can be
seen for instance by upper bounding it by the secret key capacity and upper
bounding that via Theorem 4 of [3].
2 Note

II. M AIN R ESULT
Alice is to send a message to Bob over a bosonic (quantum)
wiretap channel N , which is to be kept private from Eve,
by transmitting bosonic states on the forward channel N and
using a backward noiseless classical feedback channel. Eve
obtains the quantum output of the complement of the isometric
extension of N , and can eavesdrop on the feedback channel,
but she obtains a noisy version of the classical feedback for
the initial round. Denoting the classical feedback system as
Y , for this round Eve obtains the output of a classical noisy
channel W (Y ). Furthermore, we assume that the capacity of
the noisy channel W (Y ) from Bob to Eve, is finite for a finite
input power, that is,
C(W, P ) ≡

max

Y :E[Y 2 ]≤P

I(Y ; W )

is finite for finite 3 P . Note that this condition is very mild.
For instance, if W (Y ) = Y + S, with S ∼ Gaussian(0, N0 ),
is AWGN, N0 can be arbitrarily small as long as it is
nonzero. Hence, we only need an iota of noise. We shall
refer to this setting as asymmetric feedback-assisted private
communication. We say asymmetric because the feedback is
noiseless to Alice but noisy to Eve on the initial round. A
diagram of the communication model for the initial round is
shown in fig. 1. B 0 is some leftover system that Bob keeps.
For subsequent rounds no noise is applied to Eve’s copy of
Y.
E

W

A

B

Y
B0

Y
Y

of the message to vanish. We leave open whether we can obtain
our result with this stronger privacy criterion.
We will consider the case where the forward channel is
a single mode thermal bosonic wiretap channel: denoting
Alice’s, Bob’s and Eve’s optical modes as â, b̂, and ê, respectively, the channel is described by the Heisenberg evolutions:
b̂ =

√

ηâ +

p

1 − η fˆ;

ê =

p

1 − ηâ −

√ ˆ
η f,

(1)

where fˆ is the optical mode of the environment, which is in
a thermal state ρth (0, nth ) with thermal number nth , and η
is the transmissivity. A thermal state is given by ρth (α, n̄) ≡
´ d2 β −|β|2 /n̄
e
|α + βi hα + β|. We enforce an average photon
C π n̄
number
constraint
on Alice’s input over the i ∈ [0 : n] rounds:
Pn
1
†
tr[â
âρ
A
i ] ≤ NS . We now state our main theorem.
i=0
n+1
Theorem 1. The rate
PH =



1
NS
log 1 + 2 ,
2
σ

(2)

1
+ 1−η
where σ 2 ≡ 4η
2η nth , is achievable with mean photon
per mode NS for asymmetric feedback-assisted private communication over the thermal bosonic wiretap channel, under
the aforesaid model.

Proof. The rate is achieved by generalizing the SchalkwijkKailath protocol [8] to the quantum setting.
√
√
Codebook: Divide the interval [− NS , NS ] into 2nR
equal length intervals for some R ∈ R+ . Given a message
m ∈ [2nR ], let θ(m) be the midpoint of the m-th interval.
The codebook is then given by the coherent states |θ(m)i.
Encoding and Decoding: When we say Alice transmits a
random variable X on R, we mean she sends the mixed state
ˆ
ρX ≡
dxpX (x)|xi hx|,
R

Fig. 1: A diagram of the asymmetric feedback-assisted private
communication model for the initial round of communication.
The privacy criterion we use is the same as the one used
in definitions of private communication in various classic
papers [5], [6], [3] and in the classical result [4]; i.e., we
assume the message M is uniformly distributed and require:
lim

k→∞

1
I(M ; E) = 0,
k

where k is the number of rounds and E is the aggregation of
Eve’s systems after all k rounds. Note that this is in general
weaker than the privacy criterion used in quantum Shannon
theory analyses, for instance [7], which requires the trace
distance between Eve’s states and a constant state independent
3 Note that the capacity is finite at all finite cost constraints iff it is finite
at some finite cost constraint. The forward direction is trivial. For the reverse
direction, assume for contradiction that there is some finite cost constraint at
which the capacity is infinite. Then, by time-sharing we can conclude that is
infinite at all finite cost constraints, a contradiction.

where |xi is a coherent state. Note that E[X 2 ] = tr[â† âρX ].
Given message m, on round i = 0, Alice sends the
constant random variable X0 which takes the value θ(m).
√
Bob√receives ρth ( η θ(m), (1 − η)nth )B0 , and Eve receives
ρth ( 1 − η θ(m), ηnth )E0 . Bob then performs an x homodyne
measurement on his output, to obtain, with appropriate scaling, the output of an induced additive white Gaussian noise
(AWGN) channel with input X0 : Y0 ∼ N (θ(m), σ 2 ). Now, on
every round, Bob will simply send a copy of his measurement
result through the feedback channel. Via the feedback channel
Alice receives Y0 , while Eve receives W0 (Y0 ).
Denote the random noise that is added in the i-th induced
AWGN channel from Alice to Bob by Ni ≡ Yi −Xi . Note that
since Alice has access to both Yi and Xi , she can always explicitly compute Ni . For round i ≥ 1, Alice computes the conditional expectation E[N0 |Y i−1 ], where Y i−1 ≡ Y1 . . . Yi−1 ,
that is, Y0 is not included, and E[N0 |Y 0 ] ≡ E[N0 ] = 0. She
then transmits
Xi = γi (N0 − E[N0 |Y i−1 ]),

where γi are chosen such that E[Xi2 ] = NS . Note that this
guarantees that the photon number constraint is satisfied and
with equality. Bob receives the state
ˆ
√
dxpXi (x)ρth ( ηx, (1 − η)nth )Bi ,
R

on which he will do a homodyne x measurement to obtain Yi ,
while Eve receives
ˆ
p
dxpXi (x)ρth ( 1 − ηx, ηnth )Ei .
R

At the end of the protocol (i = n), Bob computes
Θn ≡ Y0 − E[N0 |Y n ] = θ(m) + (N0 − E[N0 |Y n ]).
His guess of the message will then be m̂, where θ(m̂) is
closest to Θn .
Error Analysis: Note that this protocol is simply the
Schalkwijk-Kailath protocol over an induced classical AWGN
channel with noise σ 2 . Therefore, by the analysis in [8], [9],
the probability of error of this protocol is upper bounded by
r


2
pe ≤
exp −22n(PH −R)−1 NS /σ 2 .
π
Hence, pe −−−−→ 0 if R < PH . For completeness, we
n→∞
reproduce this argument in Section A.
Privacy Analysis: For round i ≥ 1, the message is no
longer involved in the protocol as Alice is simply trying to
transmit the noise N0 , which is independent of the message
M , to Bob. Hence we can upper bound the mutual information
between the message and Eve’s systems as follows:

Bob then does a homodyne x measurement, which produces
the system Y0 , N0 (None of the parties have posession of N0 .):
r
ˆ
ˆ
2nR
1 X
d2 α −|α|2 /nth
2η
|mi hm|M ⊗
e
dy0
2nR m=1
πn
π
th
C
R
e

−2η(y0 −θ(m)−

= I(M ; E0 W0 N0 ) + I(M ; E W |E0 W0 N0 )
= I(M ; E0 W0 N0 ).

(3)

The inequality follows from monotonicity of mutual information. The last equality follows from our observation that the
subsequent transmissions are only about N0 and independent
of the message. We explicitly compute the state at the end of
round i = 0. We start with a uniformly distributed message:
nR

1
2nR

2
X

e

−2η(n0 −

ˆ

⊗
⊗|

R
p

Alice encodes the message into a coherent state:

q

1−η
2
η Re(α))

2nR

2
X

|mi hm|M ⊗ |θ(m)i hθ(m)|A0 .

m=1

A0 is then sent into the thermal bosonic wiretap channel:
ˆ
2nR
1 X
d2 α −|α|2 /nth
e
|mi
hm|
⊗
M
2nR m=1
C πnth
p
p
√
√
| ηθ(m) + 1 − ηαi h ηθ(m) + 1 − ηα|B0
p
p
√
√
⊗ | 1 − ηθ(m) − ηαi h 1 − ηθ(m) − ηα|E0 .

(4)

where pW0 |Y0 is the probability distribution of the output of
the noisy feedback channel given input Y0 and we made the
substitution n0 ≡ y0 − θ(m).
Using (4), we can bound
I(M ; E0 W0 N0 )
=

I(M ; E0 W0 |N0 ) + I(M ; N0 )

≤

I(M Y0 ; E0 W0 )

≤

I(M ; W0 |Y0 ) + I(Y0 ; W0 ) + S(E0 |W0 )

≤

I(Y0 ; W0 ) + S(E0 ),

(5)

where we used the facts that M and N0 are independent,
N0 = Y0 − X0 , M → Y0 → W0 form a Markov chain, and
that S(E0 |M Y0 W0 ) ≥ 0 since the conditioned systems are
classical. Now, the first term is simply the mutual information
between the input and output of the noisy channel to Eve on
the initial round. Hence, it is upper bounded by the capacity
C(W, NS + σ 2 ) of feedback channel from Bob to Eve with
cost constraint NS + σ 2 = E[(Y0 )2 ]:
I(Y0 ; W0 ) ≤ C(W, NS + σ 2 ).

(6)

This capacity is finite by assumption. We can bound the second
term in (5) by observing

nR

1

|n0 i hn0 |N0

dw0 pW0 |Y0 (w0 |θ(m) + n0 )|w0 i hw0 |W0
p
√
√
1 − ηθ(m) − ηαi h 1 − ηθ(m) − ηα|E0 ,

|mi hm|M .

m=1

|y0 i hy0 |Y0

Note that |y0 i hy0 |, |y0 − θ(m)i hy0 − θ(m)| are classical
states and are not coherent states. Bob sends a noisy copy
to Eve to obtain the state:
r
ˆ
ˆ
2nR
2η
1 X
d2 α −|α|2 /nth
|mi hm|M ⊗
e
dn0
nR
2 m=1
π
R
C πnth

≤ I(M ; E0n W0n N0 )
n

1−η
2
η Re(α))

⊗ |y0 − θ(m)i hy0 − θ(m)|N0
p
p
√
√
⊗ | 1 − ηθ(m) − ηαi h 1 − ηθ(m) − ηα|E0 .

I(M ; E0n W0n )
n

q

2nR ˆ
X

d2 α −|α|2 /nth
e
πnth
m=1 C


2
p
√
2
1 − ηθ(m) − η Re(α) + ηIm(α)
†

tr[(ê ê)ρE0 ] =

≤

1
2nR

2nR ˆ
X
m=1

C

1

2nR


d2 α −|α|2 /nth 
(1 − η)NS + η|α|2
e
πnth

= (1 − η)NS + ηnth ,

where in the inequality the term linear in Re(α) vanishes after
integrating over α. Hence, S(E0 ) ≤ g((1 − η)NS + ηnth )
where g(x) ≡ (x + 1) log(x + 1) − x log x [10], [11].
Since both terms of independent of n, we conclude
1
I(M ; E0n W0n )
n+1→∞ n + 1
1
≤ lim
I(M ; E0 W0 N0 )
n+1→∞ n + 1
1
≤ lim
(I(Y0 ; W0 ) + S(E0 ))
n+1→∞ n + 1
C(W, NS + σ 2 ) + g((1 − η)NS + ηnth )
≤ lim
n+1→∞
n+1
= 0,
lim

thereby establishing privacy.
III. D ISCUSSION
We have proven that with respect to the communication
model of asymmetric feedback where Eve obtains a slightly
noisy copy of the feedback on the initial round of the protocol, it is possible to achieve a much higher rate of private
communication over a lossy thermal-noise bosonic wiretap
channel, even one that is loss unlimited (2). It is worthwhile
to make some observations about this result, as well as discuss
its implications, limitations, and possible extensions.
A. Extensions
Eq. (2) is achievable with a probability of decoding error
that decays doubly exponentially with the number of channel
uses. That is, the rate is achievable with an infinite error
exponent. Indeed, this was the main thrust of the result in [8]
for the setting of feedback-assisted classical communication.
It was then extended by [12], where it was shown that
we can actually achieve a probability of error that goes as
an exponential tower with an order that increases linearly
with the blocklength. This was shown to be optimal by a
corresponding lower bound on the error probability. This lower
bound would also apply in our case since it only concerns the
part where Alice reliably sends a message to Bob. The only
essential difference between the protocol in [12] and that of
Schalkwijk and Kailath is that the former preserves the discrete
structure of the message. In particular, in both, only the initial
transmission contains information about the message. It is then
straightforward to make the same extension to our setting. That
is, we can achieve (2) with a block probability of error
pe ≤

1
f (n) e

for sufficiently large n, where n a denotes the tetration operation,


5(1 − ϕ−1 (R))
−1
f (n) ≡ n[1 − ϕ (R)] −
,
PH − R
and



ν
NS
ϕ(ν) ≡ log 1 + 2
.
2
σ ν

Note that this expression has minor differences compared to
the bound in [12] because we use bits instead of nats. Some
simplifications were also made for presentation.
Another possible extension follows from observing that the
achieved rate (2) is not optimal. This is because it is known
that squeezed state encoding can achieve higher rates over
the thermal noise lossy bosonic channel with a homodyne
receiver [13]. However, the induced classical channel with
squeezed states encoding is AWGN, so our argument trivially
applies to this case. With optimal squeezed-state encoding, we
can achieve a rate [13]:


4NS + 2 − f (η, NS ) + f (η, NS )−1
1
,
Psq = log 1 +
2
((1 − η)/η) + f (η, NS )−1
(7)
where



1/2
2(1−η) 1+η
η 1+ η
−1
2η + 2NS
f (η, NS ) ≡
.
1−η
When Bob uses a homodyne detection receiver, a squeezed
state encoding is conjectured to be the optimal encoding for
any Gaussian bosonic channel. If this conjecture is proven true,
Eq. (7) would be optimal for asymmetric feedback-assisted
private communication assuming that Bob makes a homodyne
detection since the private capacity is trivially upper bounded
by the classical capacity.
B. Non-Gaussian Channels
An apparent limitation of our result is that it strongly relies
on the induced classical channel from Alice to Bob being an
AWGN channel. This fact was heavily used in for instance the
error analysis of the Schalkwijk-Kailath protocol. However,
as noted in Remark 17.3 of [9], this exact protocol, that is,
the protocol with the conditional expectations E[N0 |Y i−1 ]
realized in the AWGN case, can be applied for channels with
non-Gaussian additive noise. In fact, it would work for any
affine channel whose output is given by
a(X + N ),

(8)

where X is the input, N is some general additive noise
independent of X, and a 6= 0 is some scaling. The error
analysis follows by observing that the estimate Θn is linear
in X0 , N0n as shown in [9]. Hence, in the affine channel
case the variance of Θn /a has the exact same expression in
terms of X0 , N0n as in the AWGN case, and so Var[Θn ] =
a2 Var[N ]2−2nC(Var[N ],NS ) , where


1
NS
C(Var[N ], NS ) ≡ log 1 +
(9)
2
Var[N ]
is the capacity of the AWGN channel with the corresponding
noise statistics. Then, by Chebyshev’s inequality,
n
o
p
pe ≤ Prob |Θn − θ(m)| > NS 2−nR
≤ a2 2−2n(C(Var[N ],NS )−R)

Var[N ]
.
NS

This works for general affine channels, albeit at the cost of
losing the doubly exponential decay. The privacy analysis
can also be generalized since the argument did not make
use of Gaussianity. Note that (9) is in general less than the
actual capacity of the channel, but it is still loss unlimited. In
particular, our result applies to a general lossy bosonic wiretap
channel where the additive noise (state of the fˆ mode) can be
any state, that is, it does not even need to be Gaussian. This
is shown in fig. 2. It is simple to see that the induced classical

𝜌%

𝜌"

𝜌#

𝜌$
Fig. 2: A non-Gaussian channel corresponding to a bosonic
wiretap channel where the additive noise ρN is not Gaussian.
channel in this case is an affine channel. This subsumes a large
class of physical optical channels.
However, it would be interesting to extend our result to
a general quantum wiretap channel. Unfortunately, there are
channels for which it is not possible to induce a classical
affine channel via a particular encoding and decoding. A
trivial example is the constant channel which outputs a state
regardless of the input. Admittedly, such a channel is useless
for communication, so it is not surprising that our protocol
fails there. For the specific case of coherent encoding and
homodyne detection, we can find explicit nontrivial channels
for which we do not induce an affine channel. For instance,
consider the channel, a unitary self-Kerr interaction, which
maps a coherent state to a cat state: |αi 7→ √12 (|αi + |−αi). It
is not difficult to see that a homodyne measurement of a cat
state will always have an expected value of zero. If the channel
is affine: X 7→ a(X + N ), then given E[a(X + N )] = 0,
either a = 0 or E[N ] = −E[X]. If a = 0, then the
measurement result is always zero, which is clearly wrong.
The latter possibility is also impossible since additive noise
must be independent of the message. The conclusion follows.
Thus, it is not clear whether our protocol can be extended to
general quantum channels.
C. Communication Model
We assumed that Eve can eavesdrop on both the (noisy,
quantum) forward and (classical) backward channels, but that
her copy of the initial round of classical feedback has some
noise. From a physical standpoint, this is a natural assumption
since there is always some noise in the physical layer. It might
appear unnatural that the feedback error happens on the initial
round, but this could be realized by Alice and Bob somehow

knowing the time window in which the feedback noise might
occur and starting the protocol during that window. Our
constraint on feedback noise is reasonable as well, that any
physical Eve-to-Bob channel should not have infinite capacity.
One might say that in order to make the model more
physically relevant, there should be noise in the feedback
channel to Alice as well. Indeed, it is this very noiselessness
that is key to the result that we obtain. The channel to Alice is a
noiseless CV classical channel, which has an infinite capacity,
while we constrained the channel to Eve to have finite capacity.
It is this infinite difference that allows us to get a loss unlimited
rate 4 . Hence, it is unlikely that we can achieve loss unlimited
rates if we allow noise in the channel to Alice as well. Indeed,
it is known that linear schemes such as Schalkwijk-Kailath
cannot achieve any positive rates in this regime [14]. However,
this does not undermine our thesis that (2) indicates issues
with the usual assumption of noiselessness of the public side
channel. The fact that a classical noiseless CV channel has
infinite capacity introduces significant unphysical features to
the model and makes achievable rates strongly dependent on
the model. For by just adding an infinitesimal amount of noise
to the eavesdropper’s copy of the initial round, one single step
towards physical relevance, we obtain a loss unlimited rate
instead of a loss limited one.
Now, it is somewhat queer that we can achieve a markedly
different rate even if we allow Eve to have noiseless access to
the feedback after the initial round. For an intuition for why
this works, we observe that the Schalkwijk-Kailath protocol
can be summarized as follows: Bob on the initial round
receives the message with additive noise N0 and subsequently
learns the value of N0 to exquisite precision. Since Eve has
additional noise to what Bob received on the initial round,
even if Eve can also learn N0 to exquisite precision, the
accuracy with which she can recover the message is still
limited by the additional noise. Indeed, we can even further
alter our communication model so as to give Eve N0 exactly
as done by (3), thereby allowing her to completely simulate
the protocol for rounds i > 0, and our result would still hold.
We can also give her a copy X00 of the quantum system 5 X0
that Alice sends on round i = 0. This would simply replace
E0 in the privacy analysis by X00 E0 , whose entropy we can
again bound via subadditivity and then by bounds on photon
number. Thus, we can alter our communication model so that
Eve is strengthened, and our result still holds. This reflects
again that our protocol essentially depends on that initial round
of feedback where there is an infinite difference in capacities.
At first glance the fact that we only need noise on the initial
round appears to have implausibly strong implications. One
might think our result holds in the usual feedback-assisted
private communication model but where Alice and Bob have
4 Note that this is an infinite difference in capacity between the channels
from Bob to Alice and Eve, and we are trying to achieve forward private
communication from Alice to Bob. Thus it is not clear a priori that this
should be possible.
5 Note that this is not the classical random variable that is encoded into the
quantum system, but the encoded quantum system itself.

a pre-shared secret key which they can use to simulate the
noise. For instance, by performing bitwise addition with the
pre-shared key, they can simulate an additive noise channel
with noise S0 on the initial round of feedback. However, since
any reasonable pre-shared key has finite Shannon entropy, S0
is discrete. Then, the capacity of the feedback channel would
be infinite, which precludes us from bounding the information
leaked to Eve. Hence it does not seem sufficient to have preshared secret key to obtain our result.
Lastly, it is worth looking at the closely related communication models of two way private communication, secret key
agreement, and quantum key distribution. If we make the same
alteration, that is, introduce noise in the classical feedback
in the initial round, Bob can simply send an arbitrarily long
locally generated random bit string to Alice during that round.
Alice will then receive this key noiselessly, while Eve will
only receive a noisy copy whose mutual information with
the key is finite since the capacity of the noisy feedback
channel is finite. Hence, in these models the infinite difference
in capacities trivially leads to an infinite rate. This again
shows the dependence of the rates to the model considered
and suggests that in general we should more seriously address
blatant unphysical features in the communication model.
Acknowledgements. DD is supported by the Stanford Graduate Fellowship and the National Defense Science and Engineering Graduate Fellowship. SG was supported by the Communications and Networking with Quantum OperationallySecure Technology for Maritime Deployment (CONQUEST)
program funded by the Office of Naval Research (ONR) under
a Raytheon BBN Technologies prime contract # N00014-16C-2069. We would like to thank Patrick Hayden and Tsachy
Weissman for valuable discussions and feedback. DD would
like to thank God for all of His provisions.
R EFERENCES
[1] M. Takeoka, S. Guha, and M. M. Wilde, “Fundamental rate-loss tradeoff
for optical quantum key distribution,” Nature communications, vol. 5, p.
5235, 2014.
[2] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental
limits of repeaterless quantum communications,” Nature Communications, vol. 8, 2017.
[3] U. M. Maurer, “Secret key agreement by public discussion from common
information,” IEEE Transactions on Information Theory, vol. 39, no. 3,
pp. 733–742, 1993.
[4] D. Gunduz, D. R. Brown, and H. V. Poor, “Secret communication with
feedback,” in Information Theory and Its Applications, 2008. ISITA
2008. International Symposium on. IEEE, 2008, pp. 1–6.
[5] A. D. Wyner, “The wire-tap channel,” Bell Labs Technical Journal,
vol. 54, no. 8, pp. 1355–1387, 1975.
[6] I. Csiszár and J. Korner, “Broadcast channels with confidential messages,” IEEE Transactions on Information Theory, vol. 24, no. 3, pp.
339–348, 1978.
[7] M. M. Wilde, Quantum information theory. Cambridge University
Press, 2013.
[8] J. Schalkwijk and T. Kailath, “A coding scheme for additive noise
channels with feedback–i: No bandwidth constraint,” IEEE Transactions
on Information Theory, vol. 12, no. 2, pp. 172–182, 1966.
[9] A. El Gamal and Y.-H. Kim, Network information theory. Cambridge
University Press, 2011.
[10] C. M. Caves and P. D. Drummond, “Quantum limits on bosonic
communication rates,” Reviews of Modern Physics, vol. 66, no. 2, p.
481, 1994.

[11] J. D. Bekenstein, “Universal upper bound on the entropy-to-energy ratio
for bounded systems,” Physical Review D, vol. 23, no. 2, p. 287, 1981.
[12] R. G. Gallager and B. Nakiboglu, “Variations on a theme by schalkwijk
and kailath,” IEEE Transactions on Information Theory, vol. 56, no. 1,
pp. 6–17, 2010.
[13] S. Guha, “Classical capacity of the free-space quantum-optical channel,”
Master’s thesis, Massachusetts Institute of Technology, 2004.
[14] Y.-H. Kim, A. Lapidoth, and T. Weissman, “The gaussian channel
with noisy feedback,” in Information Theory, 2007. ISIT 2007. IEEE
International Symposium on. IEEE, 2007, pp. 1416–1420.
[15] R. Durrett, Probability: theory and examples. Cambridge University
Press, 2010.

A PPENDIX

the capacity of the AWGN channel with power NS and noise
σ 2 given in (2). The second way to calculate this gives

We reproduce for completeness the explicit error analysis
of the Schalkwijk-Kailath protocol [8] as given in [9] but with
our notation. Consider the vector N ≡ (N0 , . . . , Nn ). This is
clearly jointly Gaussian since Ni are independent and Gaussian. We claim that (N0 , Y1 , . . . , Yn ) is also jointly Gaussian
where Y n are mutually independent and Yi ∼ N (0, NS +σ 2 ).

I(N0 ; Y n ) = h(N0 ) − h(N0 |Y n )
1
1
= log(2πe Var[N0 ]) − log(2πe Var[N0 |Y n ])
2
2
1
Var[N0 |Y n ]
,
= − log
2
σ2
where the second equality follows from the fact that N0 |Y n =
y n is Gaussian with variance independent of y n by the joint
Gaussianity of (N0 , Y1 , . . . , Y n ). Note that Var[N0 |Y n ] is a
random variable, but since it does not depend on y n , we can
identify it with the value it takes on almost surely.
We conclude from the two ways to write the mutual
information that Var[N0 |Y n ] = σ 2 2−2nPH . Now, Θn = Y0 −
E(N0 |Y n ) is Gaussian since it’s linear in Y0n . Furthermore,

Proof. We proceed by induction. For the base case, we first
note that Y1 = γ1 N0 + N1 , so we obtain (N0 , Y1 , N2 , . . . Nn )
by a linear transformation, so it’s jointly Gaussian with
E[Y1 ] = 0. Furthermore, E[Y12 ] = γ12 + σ 2 = NS + σ 2 since
N0 , N1 are independent.
Now we consider the inductive case. Assume
(N0 , Y1 , . . . , Yk , Nk+1 , . . . , Nn ) is jointly Gaussian and
Y k are mutually independent and Yi ∼ N (0, NS + σ 2 ). Then,
(N0 , Y1 , . . . , Yk ) is jointly Gaussian, so E[N0 |Y k ], which
is also the minimum mean squared error (MMSE) estimate,
is affine in Y k . Since Y k and N0 both have mean zero, it
is actually linear. Thus, Xk+1 = γk+1 (N0 − E[N0 |Y k ]) is
linear in N0 , Y k . Hence, (Y1 , . . . , Yk+1 = Xk+1 + Nk+1 )
is jointly Gaussian. By the orthogonality principle for linear
MMSE estimates, Xk+1 is independent of Yi for i ∈ [1 : k].
Furthermore, Nk+1 is also independent of Yi . Since Y k
are mutually independent, we conclude that (Y1 , . . . , Yk+1 )
is jointly Gaussian and uncorrelated. Thus, they are
mutually independent. It is also clear that E[Yk+1 ] = 0.
2
2
Furthermore, E[Yk+1
] = NS + σ 2 since E[Xk+1
] = NS
by construction and Xk+1 , Nk+1 are independent. Finally,
(N0 , Y1 , . . . , Yk+1 , Nk+2 , . . . , Nn ) is jointly Gaussian, so
we’re done.

We next expand I(N0 ; Y n ) in two different ways. First,
I(N0 ; Y n ) =

n
X

I(N0 ; Yi |Y i−1 )

i=1

=

n
X

h(Yi |Y i−1 ) − h(Yi |N0 , Y i−1 )

i=1

=

n
X

h(Yi ) − h(Ni |N0 , Y i−1 )

i=1

=

n
X

h(Yi ) − h(Ni )

i=1



n
NS
= log 1 + 2
2
σ
= nPH
where the third equality holds because Y n are mutually
independent and Yi is a function of Y i−1 , N0 , and Ni . PH is

Var Θn = E[(N0 − E[N0 |Y n ])2 ]
= E[E[(N0 − E[N0 |Y n ])2 |Y n ]]
= Var[N0 |Y n ],
where the second equality follows by the law of iterated
expectation. Thus, Θn ∼ N (θ(m), σ 2 2−2nPH ).
make a decoding error only pif |Θn − θ(m)| >
√ We −nR
NS 2
. Hence, pe ≤ 2Q(2n(PH −R) NS /σ 2 ), where
ˆ ∞
2
1
√ e−t /2 dt.
Q(x) ≡
2π
x
2

Now, we know that for x ≥ 1, Q(x) ≤ √12π e−x /2 [15], so if
R < PH and n is large enough,
r
 2n(PH −R)

2
2
NS
pe ≤
exp −
π
2σ 2
Note that we used the channel n + 1 times, so the rate we
n
achieve is actually n+1
R.

