1

Covert Communication with Channel-State
Information at the Transmitter

arXiv:1708.02501v1 [cs.IT] 8 Aug 2017

Si-Hyeon Lee, Ligong Wang, Ashish Khisti, and Gregory W. Wornell

Abstract
We consider the problem of covert communication over a state-dependent channel, where the transmitter has causal or noncausal knowledge of the channel states. Here, “covert” means that a warden on
the channel should observe similar statistics when the transmitter is sending a message and when it is
not. When a sufficiently long secret key is shared between the transmitter and the receiver, we derive
closed-form formulas for the maximum achievable covert communication rate (“covert capacity”) for
discrete memoryless channels and, when the transmitter’s channel-state information (CSI) is noncausal,
for additive white Gaussian noise (AWGN) channels. For certain channel models, including the AWGN
channel, we show that the covert capacity is positive with CSI at the transmitter, but is zero without
CSI. We also derive lower bounds on the rate of the secret key that is needed for the transmitter and the
receiver to achieve the covert capacity.

I. I NTRODUCTION
Covert communication [1]–[4] refers to scenarios where the transmitter and the receiver must keep
the warden (eavesdropper) from discovering the fact that they are using the channel to communicate.
Specifically, the signals observed by the warden must be statistically close to the signals when the
transmitter is switched off. For additive white Gaussian noise (AWGN) channels, the transmitter being
switched off is usually modeled by it always sending zero; for discrete memoryless channels (DMCs),
this is modeled by it sending a specially designated “no input” symbol x0 . For a DMC, if the output
distribution at the warden generated by x0 is a convex combination of the output distributions generated by
S.-H. Lee is with the Department of Electrical Engineering, Pohang University of Science and Technology (POSTECH),
Pohang, South Korea 37673 (e-mail: sihyeon@postech.ac.kr). L. Wang is with ETIS–Université Paris Seine, Université de
Cergy-Pontoise, ENSEA, CNRS, France (e-mail: ligong.wang@ensea.fr). A. Khisti is with the Department of Electrical and
Computer Engineering, University of Toronto, Toronto, ON M5S, Canada (e-mail: akhisti@comm.utoronto.ca). G. W. Wornell is
with the Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology (MIT), Cambridge,
MA, USA (e-mail: gww@mit.edu). The material in this paper was presented in part at IEEE ISIT 2017.

August 9, 2017

DRAFT

2

the other input symbols, then a positive covert communication rate is achievable; otherwise the maximum
amount of information that can be covertly communicated scales like the square root of the total number
of channel uses [3]. For the AWGN channel, the latter situation applies [1], [3].
The role played by channel uncertainties in covert communications has been studied in some recent
works. In particular, [5]–[7] consider the situation where the noise level (or cross-over probability) of
the channel is random, remains constant throughout the entire communication duration, and is unknown
to the warden. In this case, it is difficult for the warden to tell whether what it observes is signal or
noise. As a consequence, positive covert communication rates are achievable on certain channel models
(binary symmetric channels are considered in [5] and AWGN channels in [6], [7]) which, without the
unknown-noise-level assumption, only allow square-root scaling for covert communication.
The current work studies the benefit of channel uncertainties for covert communications in a different
context. We consider channels with a random state that is independent and identically distributed (IID)
across different channel uses. Clearly, if a channel state sequence is not known to any terminal, then it
can be treated as part of the channel statistics, reducing the problem to the one studied in previous works.
Hence, in general, an IID unknown parameter cannot help the communicating parties to communicate
covertly. In the current work, we assume that the state sequence is known to the transmitter, either causally
or noncausally, as channel-state information (CSI), but unknown to the receiver and the warden. As one
motivating application consider a scenario where a noise source or jammer continuously emits IID random
noise. If the jammer is friendly and reveals the predetermined noise symbols to the transmitter, then the
transmitter can use this knowledge as CSI. Another scenario is when the path delay from the jammer to
the receiver and the warden is larger than the total path delay from the jammer to the transmitter and
from the transmitter to the receiver and the warden so that the transmitter knows the jammer’s signal in
advance and utilizes it as CSI. In the literature, such difference in path delays has motivated the study
of lookahead relay channels [8], [9], [10, Chapter 16.9].
We study the maximum achievable rate for covert communication, which we call the “covert capacity,”
in this case. We derive closed-form formulas for the covert capacity, when the transmitter and the receiver
share a sufficiently long secret key. We also derive upper bounds on the minimum length of the secret key
needed to achieve the covert capacity. We do not have a good lower bound on this minimum secret-key
length; we briefly comment on this in the concluding section. Our converse proofs are based on classical
techniques, while covertness is accounted for with help of continuity properties of certain information
quantities. Our achievability proof for the noncausal case is based on “likelihood encoding” employed
in [11] rather than standard Gelfand-Pinsker coding [12], because the former admits easier covertness
analysis. For the binary symmetric channel (BSC) and the AWGN channel, in certain parameter ranges,

August 9, 2017

DRAFT

3

K
Y
M

Transmitter

X

Receiver

M̂

p(y, z|s, x)
Z

Warden

S
Figure 1. State-dependent discrete memoryless channel

we show the covert capacity to be positive with CSI at the transmitter. (Recall that, without channel state,
the covert capacity is zero for both channels in all parameter ranges.)
Our work is closely related to some works in steganography [13]–[15]. In steganography, the transmitter
is given some data, called the “cover text,” and attempts to embed its message by modifying the cover text.
As pointed out in [15], the cover text can be seen as CSI that is noncausally known to the transmitter. The
main difference between such problems and our setting is the following. In steganography it is normally
assumed that no noise is imposed on the “stegotext”—the data after modification by the transmitter,
hence, conditional on the states (i.e., the cover text), the channel is noiseless. In our setting, the channel
has both states and noise.
The rest of this paper is arranged as follows: Section II formally defines the covert communication
problem; Section III states the main results for DMCs; Sections IV and V prove the converse and
achievability parts of the main results, respectively; Section VI applies the results to BSCs and AWGN
channels; and Section VII concludes the paper with some remarks.
II. P ROBLEM F ORMULATION
A state-dependent DMC in Fig. 1
(X , S, Y, Z, PS , PY,Z|S,X )

(1)

consists of channel input alphabet X , state alphabet S , channel output alphabets Y and Z at the receiver
and the warden, respectively, state probability mass function (PMF) PS , and channel law PY,Z|S,X . All
alphabets are finite. Let x0 ∈ X be a “no input” symbol that is sent when no communication takes place.
P
Define Q0 (·) = s∈S PS (s)PZ|S,X (·|s, x0 ) and let Q×n
0 (·) denote the n-fold product of Q0 . The state
sequence S n is assumed to be IID, hence the warden observes Z n distributed according to Q×n
0 (·) if
no communication takes place over n channel uses. We define a nonnegative cost b(x) for each input
P
symbol x ∈ X . The average input cost of xn ∈ X n is defined as b(xn ) = n1 ni=1 b(xi ).
The transmitter and the receiver are assumed to share a secret key K uniformly distributed over a set
K. The state sequence is assumed to be unknown to the receiver and the warden, but available to the

August 9, 2017

DRAFT

4

transmitter. We consider two cases, where the state sequence is known to the transmitter causally and
noncausally, respectively. For causal CSI, an (|M|, |K|, n) code consists of an encoder at the transmitter
that maps (M, K, S i ) to Xi ∈ X for i ∈ [1 : n], and a decoder at the receiver that maps (Y n , K) to
M̂ ∈ M. For noncausal CSI, an (|M|, |K|, n) code consists of an encoder at the transmitter that maps
(M, K, S n ) to X n ∈ X n , and a decoder at the receiver that maps (Y n , K) to M̂ ∈ M.

The transmitter and the receiver aim at constructing a code that is both reliable and covert. As usual,
(n)

their code is reliable if the probability of error Pe

= P (M̂ 6= M ) is negligible. Their code is covert if it

is hard for the warden to determine whether the transmitter is sending a message (hypothesis H1 ) or not
(hypothesis H0 ). Let α and β denote the probabilities of false alarm (accepting H1 when the transmitter is
not sending a message) and missed detection (accepting H0 when the transmitter is sending a message),
respectively. Note that a blind test satisfies α + β = 1. Let PbZ n denote the distribution observed by
the warden when the transmitter is sending a message.1 The warden’s optimal hypothesis test satisfies
q
×n
b
α+β ≥ 1− D(PbZ n kQ×n
0 ) (see [16]). Hence, covertness is guaranteed if D(PZ n kQ0 ) is negligible. At
this point, note that an input symbol x with supp(PZ (·|x)) ∈
/ supp(Q0 ), where supp denotes the support
set of a distribution, should not be transmitted with nonzero probability because otherwise D(PbZ n kQ×n
0 )
becomes infinity. Hence, by dropping such input symbols, we assume that
supp(Q0 ) = Z.

(2)

Let K = [1 : 2nRK ] and M = [1 : 2nR ] for RK ≥ 0 and R ≥ 0. For given RK ≥ 0 and B ≥ 0,
a covert rate of R is said to be achievable if there exists a sequence of (2nR , 2nRK , n) codes that
simultaneously satisfies the input cost constraint lim supn→∞ EM,K,S n [b(X n )] ≤ B , reliability constraint
(n)

limn→∞ Pe

= 0, and covertness constraint limn→∞ D(PbZ n kQ×n
0 ) = 0. The covert capacity is defined

as the supremum of all achievable covert rates and denoted by Cc and Cnc for the cases with causal CSI
and with noncausal CSI, respectively.
III. M AIN R ESULTS FOR DMC S
In this section, we present upper and lower bounds on the covert capacity of DMCs with causal and
with noncausal CSI at the transmitter. The proofs of the upper and lower bounds are provided in Sections
IV and V, respectively.
1

Note that PbZ n depends on the code used for the communication and is in general not IID.

August 9, 2017

DRAFT

5

A. Causal CSI at the Transmitter
Theorem 1. For RK ≥ 0 and B ≥ 0, the covert capacity with causal CSI at the transmitter is upperbounded as
Cc ≤ max I(V ; Y )

(3)

where the maximum is over PMF PV and function x(v, s) such that |V| ≤ min{|X |+|Y|+|Z|−2, (|X |−
1) · |S| + 1}, PZ = Q0 and E[b(X)] ≤ B .

Theorem 2. For RK ≥ 0 and B ≥ 0, the covert capacity with causal CSI at the transmitter is lowerbounded as
Cc ≥ max I(V ; Y )

(4)

where the maximum is over PMF PV and function x(v, s) such that |V| ≤ min{|X |+|Y|+|Z|−1, (|X |−
1) · |S| + 2}, PZ = Q0 , E[b(X)] ≤ B , and
I(V ; Z) − I(V ; Y ) < RK .

(5)

B. Noncausal CSI at the Transmitter
Theorem 3. For RK ≥ 0 and B ≥ 0, the covert capacity with noncausal CSI at the transmitter is
upper-bounded as
Cnc ≤ max(I(U ; Y ) − I(U ; S))

(6)

where the maximum is over conditional PMF PU |S and function x(u, s) such that |U| ≤ min{|X | + |Y| +
|Z| + |S| − 3, |X | · |S|}, PZ = Q0 and E[b(X)] ≤ B .

Theorem 4. For RK ≥ 0 and B ≥ 0, the covert capacity with noncausal CSI at the transmitter is
lower-bounded as
Cnc ≥ max(I(U ; Y ) − I(U ; S))

(7)

where the maximum is over conditional PMF PU |S and function x(u, s) such that |U| ≤ min{|X | + |Y| +
|Z| + |S| − 2, |X | · |S| + 1}, PZ = Q0 , E[b(X)] ≤ B , and
I(U ; Z) − I(U ; Y ) < RK .

(8)

Remark 1. If we restrict U and S to be independent in Theorems 3 and 4, the bounds fall back to those
in Theorems 1 and 2.
Remark 2. For the case with causal CSI (resp. noncausal CSI), if RK is large enough so that (5) (resp.
(8)) holds under the joint distribution that achieves the maximum on the right-hand side of (3) (resp. (6)),
then Theorems 1 and 2 (resp. Theorems 3 and 4) establish the covert capacity as the right-hand side of (3)

August 9, 2017

DRAFT

6

(resp. (6)). Furthermore, if under this joint distribution I(V ; Z) < I(V ; Y ) (resp. I(U ; Z) < I(U ; Y )),
then no secret key is needed to achieve the covert capacity.
Remark 3. Let us consider the special case of Y = Z as in [3]. Then, in the absence of CSI, the covert
capacity can be positive if and only if x0 is redundant [3], i.e., PZ|X (·|x0 ) ∈ conv{PZ|X (·|x0 ) : x0 ∈
X , x0 6= x0 } where conv denotes the convex hull. In the presence of CSI, the covert capacity can be positive

even though x0 is not redundant. Examples include channels with additive state where some fraction of
state can be subtracted through appropriate precoding so that the transmitter can send message symbol
(corresponding to V for the causal case and to U for the noncausal case) generated by taking into
account the effect of subtracted state. In Section VI, we show such examples.
IV. P ROOF OF U PPER B OUNDS
In this section, we prove the converse part of our main results, i.e., Theorems 1 and 3. Let us first
define the following functions of nonnegative A and B :
Cc (A, B) =

Cnc (A, B) =

max

I(V ; Y )

PV , x(v,s) :
E[b(X)]≤B, D(PZ kQ0 )≤A

max

PU |S , PX|U,S :
E[b(X)]≤B, D(PZ kQ0 )≤A

(I(U ; Y ) − I(U ; S)).

In the proof of Theorems 1 and 3, we use the following lemma, which is proven at the end of this section.
Lemma 5. The functions Cc (A, B) and Cnc (A, B) are non-decreasing in each of A and B , and concave
and continuous in (A, B).
Now we are ready to prove Theorems 1 and 3.
Proof of Theorem 1. For RK ≥ 0 and B ≥ 0, consider any sequence of (2nR , 2nRK , n) codes that
simultaneously satisfies the input cost constraint lim supn→∞ EM,K,S n [b(X n )] ≤ B , reliability constraint
(n)

limn→∞ Pe

= 0, and covertness constraint limn→∞ D(PbZ n kQ×n
0 ) = 0.

Let us start with the proof steps used for channels with causal CSI [10] without a covertness constraint:
(a)

nR ≤ I(M ; Y n |K) + nn
=
≤
≤

n
X
i=1
n
X
i=1
n
X

(9)

I(M ; Yi |K, Y i−1 ) + nn

(10)

I(M, K, Y i−1 ; Yi ) + nn

(11)

I(M, K, Y i−1 , S i−1 ; Yi ) + nn

(12)

i=1

August 9, 2017

DRAFT

7

(b)

=

n
X

I(M, K, Y i−1 , S i−1 , X i−1 ; Yi ) + nn

(13)

i=1
n
(c) X
=
I(M, K, S i−1 , X i−1 ; Yi ) + nn

(d)

=

for n → 0 and Vi :=

i=1
n
X

I(Vi ; Yi ) + nn

i=1
(M, K, S i−1 ).

(14)

(15)

Here, (a) follows by applying Fano’s inequality from the re-

liability constraint; (b) and (d) because X i−1 is a function of (M, K, S i−1 ); and (c) since Y i−1 −
(M, K, S i−1 , X i−1 ) − Yi forms a Markov chain.

Now we utilize the definition and the property of Cc (A, B) to further bound the right-hand side of (15):
n
X
nR ≤
I(Vi ; Yi ) + nn
(16)
(a)

≤

i=1
n
X

Cc (D(PbZi kQ0 ), E[b(Xi )]) + nn

(17)

i=1

!
n
n
X
1X
1
≤ nCc
D(PbZi kQ0 ),
E[b(Xi )] + nn
(18)
n
n
i=1
i=1
where (a) is because Xi is a function of Vi and Si and the Markov chain Vi −(Xi , Si )−(Yi , Zi ) holds and
(b)

(b) is due to the concavity of Cc (A, B). Recall from Lemma 5 that Cc (A, B) is non-decreasing in each of
P
A and B . According to the input cost constraint, there exists δn → 0 such that n1 ni=1 E[b(Xi )] ≤ B +δn .
0
On the other hand, from the covertness constraint, there exists δn0 → 0 such that D(PbZ n kQ×n
0 ) ≤ δn ,

while as in [3] we have
D(PbZ n kQ×n
0 )


1
= −H(Z ) + EPbZ n
n
Q×n
0 (Z )


n
X
1
i−1
=−
H(Zi |Z ) + EPbZ n log
Q0 (Zi )
i=1


n
X
1
i−1
=−
H(Zi |Z ) + EPbZ log
i
Q0 (Zi )
i=1


n
X
1
≥−
H(Zi ) + EPbZ log
i
Q0 (Zi )

log

n

(19)
(20)

(21)

(22)

i=1

=

n
X

D(PbZi kQ0 ).

(23)

i=1

Hence, (18) implies

δn0
R ≤ Cc
, B + δn + n .
(24)
n
Note that the right-hand side of (24) approaches Cc (0, B) as n tends to infinity due to the continuity of


August 9, 2017

DRAFT

8

Cc (A, B), from which follows the condition PZ = Q0 . Finally, the cardinality bound on U follows by

applying the support lemma [10].
Proof of Theorem 3. For RK ≥ 0 and B ≥ 0, consider any sequence of (2nR , 2nRK , n) codes that
simultaneously satisfies the input cost constraint lim supn→∞ EM,K,S n [b(X n )] ≤ B , reliability constraint
(n)

limn→∞ Pe

= 0, and covertness constraint limn→∞ D(PbZ n kQ×n
0 ) = 0.

We start with the proof steps used for channels with noncausal CSI [12] without a covertness constraint:
(a)

nR ≤ I(M ; Y n |K) + nn
=
≤

n
X
i=1
n
X

(25)

I(M ; Yi |K, Y i−1 ) + nn

(26)

I(M, K, Y i−1 ; Yi ) + nn

(27)

i=1

=

n
X

n
I(M, K, Y i−1 , Si+1
; Yi )

i=1

−

n
X

n
I(Yi ; Si+1
|M, K, Y i−1 ) + nn

(28)

i=1
(b)

=

n
X

n
I(M, K, Y i−1 , Si+1
; Yi )

i=1

−

n
X

n
I(Y i−1 ; Si |M, K, Si+1
) + nn

(29)

i=1
(c)

=

n
X

n
I(M, K, Y i−1 , Si+1
; Yi )

i=1

−

n
X

n
I(M, K, Y i−1 , Si+1
; Si ) + nn

(30)

i=1

for n → 0 and Ui := (M, K, Y

n
X

(I(Ui ; Yi ) − I(Ui ; Si )) + nn
i=1
i−1 , S n ). Here, (a) follows by applying
i+1

=

(31)
Fano’s inequality from the

n ) are independent.
reliability constraint; (b) by Csiszár’s sum identity; and (c) because Si and (M, K, Si+1

Now we utilize the definition and the property of Cnc (A, B) to further bound the right-hand side of
(31):
nR ≤
≤

n
X
i=1
n
X

(I(Ui ; Yi ) − I(Ui ; Si )) + nn

(32)

Cnc (D(PbZi kQ0 ), E[b(Xi )]) + nn

(33)

i=1

August 9, 2017

DRAFT

9

!
n
n
X
1X
1
≤ nCnc
D(PbZi kQ0 ),
E[b(Xi )] + nn
(34)
n
n
i=1
i=1
where (a) is due to the concavity of Cnc (A, B). Recall from Lemma 5 that Cnc (A, B) is non-decreasing in
P
each of A and B . According to the input cost constraint, there exists δn → 0 such that n1 ni=1 E[b(Xi )] ≤
(a)

B + δn . On the other hand, due to the chain of inequalities (19)-(23) from the covertness constraint, there
P
0
exists δn0 → 0 such that ni=1 D(PbZi kQ0 ) ≤ δ
n . Hence, (34)
 implies
0
δn
R ≤ Cnc
, B + δn + n .
(35)
n
Note that the right-hand side of (35) approaches C(0, B) as n tends to infinity due to the continuity of
Cnc (A, B), from which follows the condition PZ = Q0 . Further, because I(U ; Y ) − I(U ; S) is convex

in the conditional distribution PX|U,S , it suffices to maximize it over functions x(u, s) instead of PX|S,U .
Finally, the cardinality bound on U follows by applying the support lemma [10].
Proof of Lemma 5. Let us show that Cnc (A, B) is non-decreasing in each of A and B , and concave and
continuous in (A, B). It can be proved in a similar manner that the same statement holds for Cc (A, B).
First, Cnc (A, B) is non-decreasing in each of A and B since increasing A or B can only enlarge the
set of feasible PU |S PX|U,S .
Second, to show the concavity, fix arbitrary (A1 , B1 ) and (A2 , B2 ) and let PU1 |S PX1 |U1 ,S and PU2 |S
PX2 |U2 ,S denote the corresponding conditional PMFs that achieve the maxima of Cnc (A1 , B1 ) and
Cnc (A2 , B2 ), respectively. Let Y1 and Z1 (resp. Y2 and Z2 ) denote the channel outputs at the receiver and

the warden, respectively, corresponding to PU1 |S PX1 |U1 ,S (resp. PU2 |S PX2 |U2 ,S ). Let Q denote a random
variable independent of U1 , U2 , and S , which takes value 1 with probability λ and value 2 with probability
1 − λ.

Define U 0 = (Q, UQ ). Let X 0 , Y 0 , and Z 0 denote the channel input at the transmitter and the channel
outputs at the receiver and the warden, respectively, corresponding to PX 0 |U 0 ,S = PXQ |UQ ,S . Note that
PX 0 = λPX1 + (1 − λ)PX2 and PZ 0 = λPZ1 + (1 − λ)PZ2 . Then,
X
E[b(X 0 )] =
PX 0 (x)b(x)
x∈X

=λ

X

PX1 (x)b(x) + (1 − λ)

x∈X

X

PX2 (x)b(x)

x∈X

≤ λB1 + (1 − λ)B2

(36)

and
D(PZ 0 kQ0 ) ≤ λD(PZ1 kQ0 ) + (1 − λ)D(PZ2 kQ0 )
≤ λA1 + (1 − λ)A2

August 9, 2017

(37)

DRAFT

10

because the relative entropy is convex in the first argument. Hence, it follows that
Cnc (λ(A1 , B1 ) + (1 − λ)(A2 , B2 )) ≥ I(U 0 ; Y 0 ) − I(U 0 ; S)

(38)

≥ I(UQ , Q; Y 0 ) − I(UQ , Q; S)

(39)

(a)

≥ I(UQ ; Y 0 |Q) − I(UQ ; S|Q)

(40)

= λI(U1 ; Y1 ) + (1 − λ)I(U2 ; Y2 )
− λI(U1 ; S) − (1 − λ)I(U2 ; S)

(41)

= λCnc (A1 , B1 ) + (1 − λ)Cnc (A2 , B2 ),

(42)

where (a) is because Q and S are independent. Hence, we conclude that Cnc (A, B) is concave.
Lastly, Cnc (A, B) is continuous in (A, B) since both the objective function I(U ; Y ) − I(U ; S) and the
constraint functions E[b(X)] and D(PZ kQ0 ) are continuous in PU |S PX|U,S as long as (2) is satisfied.
V. P ROOF OF L OWER B OUNDS
In this section, we prove the achievability parts of our main results, i.e., Theorems 2 and 4. To prove the
achievability part for the case with causal CSI at the transmitter, we employ the Shannon’s strategy [17]
and use the soft covering theorem [18, Theorem 4], [19, Corollary VII.4] for the covertness analysis. For
the case with noncausal CSI at the transmitter, our scheme is based on multicoding [10], [12], but instead
of performing the joint-typicality check to find a codeword that seemingly follows a joint distribution
with the state sequence, we use likelihood encoding employed in [11] since it admits easier covertness
analysis.
Proof of Theorem 2. Fix  > 0. Further fix PV and x(v, s) such that PZ = Q0 and E[b(X)] ≤

B
1+ .

1) Codebook generation: For each k ∈ [1 : 2nRK ] and m ∈ [1 : 2nR ], randomly and independently
Q
generate a v n (k, m) according to ni=1 PV (vi ). These constitute the codebook C .
2) Encoding at the transmitter: Given state sequence sn , secret key k , and message m, the encoder
transmits xn where xi = x(vi (k, m), si ).
3) Decoding at the receiver: Upon receiving y n , with access to the secret key k , the decoder declares
that m̂ is sent if it is the unique message such that
(v n (k, m̂), y n ) ∈ T(n) .

Otherwise it declares an error. Here

(n)
T

(43)

denotes the (strongly) typical set [20].

4) Covertness analysis: By the soft covering theorem [18, Theorem 4], [19, Corollary VII.4], we have
n→∞
EC [D(PbZ n kQ×n
0 )] −→ 0 if

R + RK > I(V ; Z).

August 9, 2017

(44)

DRAFT

11

5) Reliability and input cost analysis: By the standard error analysis, it can be shown that the
probability of error averaged over the random codebook C tends to zero as n tends to infinity if
R < I(V ; Y ).

(45)

Furthermore, by the typical average lemma [10],
h
i
EC,M,K,S n [b(X n )] = P (X n ∈
/ T(n) ) EC,M,K,S n b(X n )|X n ∈
/ T(n)
h
i
+ P (X n ∈ T(n) ) EC,M,K,S n b(X n )|X n ∈ T(n)

(46)

≤ P (X n ∈
/ T(n) )Bmax + B,

where Bmax := maxx∈X b(x). Note that P (X n ∈
/

(n)
T )

(47)

→ 0 as n tends to infinity. Hence, we have

lim sup EC,M,K,S n [b(X n )] ≤ B.

(48)

n→∞

In summary, if (44) and (45) are satisfied, then there must exist a sequence of codes such that
(n)

limn→∞ Pe

= 0, limn→∞ EM,K,S n [b(X n )] ≤ B , and limn→∞ D(PZ n kQ×n
0 ) = 0. By applying the

Fourier-Mozkin elimination [10] to (44) and (45), we complete the proof.
Proof of Theorem 4. Fix  > 0 > 0. Further fix PU |S and x(u, s) such that PZ = Q0 and E[b(X)] ≤

B
1+0 .

1) Codebook generation: For each k ∈ [1 : 2nRK ] and m ∈ [1 : 2nR ], randomly and independently
Q
0
0
generate 2nR codewords un (k, m, l), l ∈ [1 : 2nR ] according to ni=1 PU (ui ). These constitute the
codebook C .
2) Encoding at the transmitter: Given state sequence sn , secret key k , and message m, evaluate the
likelihood
n

.
×n n n
0
l0 ∈[1:2nR0 ] PS|U (s |u (k, m, l ))
to (49) and transmits xn where xi

g(l|s , k, m) = P

The encoder randomly generates l according

×n n n
PS|U
(s |u (k, m, l))

(49)
= x(ui (k, m, l), si ).

3) Decoding at the receiver: Upon receiving y n , with access to the secret key k , the decoder declares
that m̂ is sent if it is the unique message such that
(un (k, m̂, l), y n ) ∈ T(n)

(50)

0

for some l ∈ [1 : 2nR ]; if no such unique m̂ can be found, it declares an error.
4) Covertness analysis: For covertness analysis, we use the following lemma, which is proven at the
end of this section.
Lemma 6. For the codebook generation and encoding procedure described above, if R0 > I(U ; S) and
R + RK + R0 > I(U ; Z), then

h
i
n→∞
EC D(PbZ n kPZ×n ) −→ 0.

(51)

Now, let
R0 > I(U ; S)

August 9, 2017

(52)

DRAFT

12

R + RK + R0 > I(U ; Z).

(53)

Because PU |S and x(u, s) are chosen to satisfy PZ = Q0 , Lemma 6 implies that
n→∞
EC [D(PbZ n kQ×n
0 )] −→ 0.

(54)

5) Reliability analysis: Consider the probability of error averaged over the randomly generated codebook C . Let M and M̂ denote the transmitted and decoded messages, respectively, and let L denote the
index generated according to (49) at the encoder. The error event {M̂ 6= M } occurs only if at least one
of the following events occurs:
(n)

E1 := {(U n (K, M, L), S n ) ∈
/ T0 }

(55)

E2 := {(U n (K, M, L), Y n ) ∈
/ T(n) }

(56)
0

E3 := {(U n (K, m, l), Y n ) ∈ T(n) for some m 6= M and l ∈ [1 : 2nR ]}.

(57)

Hence, the probability of error is bounded as
P (M̂ 6= M ) ≤ P (E1 ) + P (E1c ∩ E2 ) + P (E3 ).

(58)

Now we bound each term on the right-hand side of (58). The first term P (E1 ) tends to zero as n tends
to infinity due to [11, Lemma 2], as long as (52) is satisfied. Next, note that
(n)

E1c = {(U n (K, M, L), S n ) ∈ T0 }.

(59)

By the conditional typicality lemma [10], P (E1c ∩ E2 ) tends to zero as n tends to infinity. Lastly, P (E3 )
tends to zero as n tends to infinity by the packing lemma [10] provided
R + R0 < I(U ; Y ).

(60)

In summary, the probability of error averaged over the random codebook C tends to zero as n tends to
infinity if (52), (53), and (60) are satisfied.
6) Input cost analysis: In the reliability analysis, it is shown that
(n)

P (E1 ) = P {(U n (K, M, L), S n ) ∈
/ T0 }

(61)
(n) n→∞

= P ((U n (K, M, L), X n , S n ) ∈
/ T0 ) −→ 0.

Note that if xn ∈

(n)
T0 ,

(62)

then b(xn ) ≤ B by the typical average lemma [10]. Hence,
EC,M,K,S n [b(X n )]
= P (E1 ) EC,M,K,S n [b(X n )|E1 ]
+ P (E1c ) EC,M,K,S n [b(X n )|E1c ]
≤ P (E1 )Bmax + P (E1c )B,

August 9, 2017

(63)
(64)

DRAFT

13

where Bmax := maxx∈X b(x). By (62), the right-hand side of (64) approaches B as n tends to infinity.
Hence, we have
lim sup EC,M,K,S n [b(X n )] ≤ B.

(65)

n→∞

In summary, if (52), (53), and (60) are satisfied, then there must exist a sequence of codes such that
(n)

limn→∞ Pe

= 0, limn→∞ EM,K,S n [b(X n )] ≤ B , and limn→∞ D(PZ n kQ×n
0 ) = 0. By applying the

Fourier-Mozkin elimination [10] to (52), (53), and (60), we complete the proof.
Remark 4. We note that our scheme for the case with noncausal CSI at the transmitter is similar to
that in [21] for wiretap channels with noncausal CSI at the transmitter under the semantic-security
metric requiring negligible information leakage for all message distributions. The coding scheme in [21]
incorporates superposition coding; the inner codebook is for a random index and the outer codebook is
for the message and another random index. To compare that scheme with ours, let us consider the special
case of the scheme in [21] where the rate of the inner codebook is set to zero and let R and R0 denote
the rates of the message and the random index in the outer codebook. For our scheme, let us consider
the special case of RK = 0 and sufficiently large B , i.e., no secret key and no input cost constraint.
Then the codebook generation and the encoding procedure of the scheme [21] become the same as our
scheme. As shown in the proof of Theorem 4, reliability at the receiver is satisfied if R0 > I(U ; S) and
R + R0 < I(U ; Y ), but covertness requires R + R0 > I(U ; Z) and PZ = Q0 while semantic security

requires R0 > I(U ; Z).
Proof of Lemma 6: The proof follows similar lines to [11, Section VII-A]. As in [11, Section
VII-A], it can be checked that, to prove (51), it suffices to show that the total variation (TV) distance
approaches zero:
n→∞

EC kPbZ n − PZ×n kTV −→ 0.

(66)

To evaluate the TV distance, define the ideal PMF for codebook C as follows:
Γ(C) (k, m, l, un , sn , z n ) =
×n n n
×n
2−n(RK +R+R ) 1un (k,m,l)=un PS|U
(s |u )PZ|U,S
(z n |un , sn ).
0

Using the triangle inequality for the TV distance, we upper-bound the left-hand side of (66) as
(C)

(C)

EC kPbZ n − PZ×n kTV ≤ EC kPbZ n − ΓZ n kTV + EC kΓZ n − PZ×n kTV .

(67)

From the soft covering theorem [18, Theorem 4], [19, Corollary VII.4], the second term on the right-hand
side of (67) decays to zero as n → ∞ if RK + R + R0 > I(U ; Z). For the first term on the right-hand
side of (67), note that
(C)

(C)

EC kPbZ n − ΓZ n kTV ≤ EC kPbS n ,Z n − ΓS n ,Z n kTV .

August 9, 2017

(68)

DRAFT

14

S ∼ Bern(p)
X

Y =Z

Figure 2. Binary symmetric channel with CSI at the transmitter

By applying the same analysis as in [11, Section VII-A], the right-hand side of (68) decays to zero as
n → ∞ if R0 > I(U ; S).

VI. E XAMPLES
In this section, we show two examples where the covert capacity of a channel is zero in the absence
of CSI at the transmitter, but is positive with CSI.

A. The Binary Symmetric Channel
Consider a channel in Fig. 2 where X , Y , Z , and S are all binary, and where PS is the Bernoulli
distribution of parameter p ∈ (0, 0.5). The channel law is
Y = Z = X ⊕ S.

(69)

Assume that x0 = 0 and RK > 0.
Using Theorems 1 and 2 one can check that, with causal CSI, the optimal choice is V = Y = Z
having the Bernoulli distribution of parameter p. This gives
1
1
Cc = Hb (p) = p log + (1 − p) log
.
(70)
p
1−p
Furthermore, it can be checked that Cnc = Cc . Note that, without CSI, covert communication cannot
have a positive rate [2], [3] on this channel.

B. The AWGN Channel
Consider an AWGN channel in Fig. 3 where the channel outputs at the receiver and the warden are
given as
Y = X + S + NY

(71)

Z = X + S + NZ ,

(72)

respectively, where X is the channel input from the transmitter, S ∼ N (0, T ) is the external interference
that is known to the transmitter causally or noncausally but unknown to the receiver and the warden, and
NY ∼ N (0, 1) and NZ ∼ N (0, σ 2 ), σ 2 > 0, are additive Gaussian noises. Let P denote the input power

constraint at the transmitter, so the input must satisfy E[X 2 ] ≤ P . The “no input” symbol is 0, hence the
2
warden observes Z n distributed according to Q×n
0 , where Q0 = N (0, T + σ ), when no communication

August 9, 2017

DRAFT

15

NY ∼ N (0, 1)
Y
S ∼ N (0, T )

X
2

E[X ] ≤ P
Z
NZ ∼ N (0, σ 2 )
Figure 3. AWGN channel with CSI at the transmitter

takes place over n channel uses. The transmitter and the receiver are assumed to share a secret key of
rate RK . The covertness constraint is again given by limn→∞ D(PbZ n kQ×n
0 ) = 0. The covert capacity
of this channel is defined in the same way as in Section II and denoted by Cc and Cnc for causal and
noncausal CSI cases, respectively.
The following theorems show that the covert capacity can be positive for the AWGN channel both
with causal CSI and with noncausal CSI at the transmitter.
In
 the following, we define

P
γ ∗ := min 1,
2T

(73a)

T ∗ := (1 − γ ∗ )2 T

(73b)

P ∗ := T − T ∗ .

(73c)

Theorem 7. If




1
P∗
1
P∗
RK > log 1 + ∗
− log 1 + ∗
,
2
T + σ2
2
T +1
the covert capacity with causal CSI at the transmitter
as
 is lower-bounded

∗
1
P
Cc ≥ log 1 + ∗
.
2
T +1
Theorem 8. If
RK

∗

(P ∗ + PP∗ +1 T ∗ )2
1
> log 1 +
∗
2
(P ∗ + ( PP∗ +1 )2 T ∗ )(P ∗ + T ∗ + σ 2 ) − (P ∗ +

(74)

(75)

!
P∗
∗ 2
P ∗ +1 T )

∗

(P ∗ + PP∗ +1 T ∗ )2
1
− log 1 +
∗
2
(P ∗ + ( PP∗ +1 )2 T ∗ )(P ∗ + T ∗ + 1) − (P ∗ +
the covert capacity is given by
1
Cnc = log (1 + P ∗ ) .
2

!
P∗
∗ 2
P ∗ +1 T )

,

(76)

(77)

Remark 5. If the warden’s channel is degraded, i.e., σ 2 > 1, a secret key is not needed to achieve the
rates (75) and (77) for the cases with causal CSI and with noncausal CSI at the transmitter, respectively.

August 9, 2017

DRAFT

16

Remark 6. Let us assume that RK is sufficiently large so that (74) and (76) are satisfied. If T ∗ = 0,
i.e., T ≤
1
2

P
2,

then Cc = Cnc . On the other hand, if T → ∞, it follows P ∗ → P . Then, Cnc approaches

log(1 + P ), which is the capacity of the channel (71) with noncausal CSI at the transmitter and without

a covertness constraint.
We prove Theorems 7 and 8 by adapting our DMC results in Theorems 2, 3, and 4. In the achievability
proofs of Theorems 7 and 8, we reduce the interference power to make room for message transmission.
We set the channel input to have the form of X = X ∗ − γ ∗ S where X ∗ is independent of S , so that
γ ∗ S is subtracted from S when X is sent. Then, we regard X ∗ as the input for the channel with reduced

interference power of (1 − γ ∗ )2 T , i.e., T ∗ . To satisfy the covertness constraint, X ∗ must have power
T − T ∗ = P ∗ . Note that the choice of γ ∗ in (73a) ensures that the power constraint of X is satisfied,

i.e.,
E[X 2 ] = E[X ∗2 ] + γ ∗2 T = T − (1 − γ ∗ )2 T + γ ∗2 T = 2γ ∗ T ≤ P.

(78)

For the case with causal CSI, the right-hand side of (75) is achieved by letting V = X ∗ and treating
interference as noise at the receiver. For the case with noncausal CSI, the right-hand side of (77) is
achieved by choosing U as in “dirty paper coding” [22].
In the following we first prove Theorem 8.
Achievability proof of Theorem 8. We modify the proof of Theorem 4 so that it applies to the Gaussian
case with a power constraint. Roughly speaking, our idea is to “quantize” at the decoder but not at the
encoder. We choose a conditional probability density function (PDF) of U given S and a mapping from
(U, S) to X via the following:
X ∗ ∼ N (0, P ∗ ), independent of S

(79)

P∗
(1 − γ ∗ )S
(80)
P∗ + 1
P ∗ + γ∗
X=U− ∗
S = X ∗ − γ ∗ S.
(81)
P +1
We then employ the same encoding procedure as in Theorem 4, except that PMFs are now replaced by
U = X∗ +

PDFs. Next, as an additional step for the encoder, we fix some small positive  and check whether the
resulting input sequence xn satisfies the power constraint
n
X
x2i ≤ n(P + )

(82)

i=1

or not. Denote by E4 the event that (82) is not satisfied. When E4 occurs, we replace xn by the all-zero
sequence. By similar analysis as in [11] one can show that the probability of E4 tends to zero as n tends
to infinity for all positive . Clearly, in the limit where  approaches zero, our encoding scheme above
satisfies the given power constraint.

August 9, 2017

DRAFT

17

For covertness analysis, we adapt the proof for the DMC case as follows. Let PbZ n denote the distribution
at the warden generated by the above coding scheme, and let P̄Z n denote the distribution generated by this
scheme but without the additional step of replacing those codewords not satisfying (82) with the all-zero
sequence. It is clear from the proof of Lemma 6 that it can be applied to PDFs without a maximum-cost
constraint, so we can write, similarly to (66), that
n→∞

EC kP̄Z n − Q×n
0 kTV −→ 0.

(83)

Next fix a codebook C and let P1 denote the distribution resulting from conditioning the corresponding
P̄Z n on the event Ē4 , and P2 that on E4 . Then P̄Z n = (1 − P (E4 |C))P1 + P (E4 |C)P2 and PbZ n =
(1 − P (E4 |C))P1 + P (E4 |C)Q×n
0 . We have
×n
kPbZ n − Q×n
0 kTV = (1 − P (E4 |C))kP1 − Q0 kTV

≤ kP1 − Q×n
0 kTV .

(84)
(85)

On the other hand
×n
×n
kP̄Z n − Q×n
0 kTV ≥ (1 − P (E4 |C))kP1 − Q0 kTV − P (E4 |C)kP2 − Q0 kTV

≥ kP1 − Q×n
0 kTV − 2P (E4 |C).

(86)
(87)

Combining (85) and (87) we obtain
×n
EC kPbZ n − Q×n
0 kTV ≤ EC kP̄Z n − Q0 kTV + 2P (E4 ).

(88)

By (83), (88), and the fact that P (E4 ) tends to zero as n → ∞, we know that the left-hand side of (88)
tends to zero as n → ∞. Because PbZ n is absolutely continuous with respect to Q×n
0 , this further implies
that (see [11, Section VII-A])


n→∞
D PbZ n Q×n
−→ 0.
0

(89)

We next describe the decoder and analyze its probability of making an error. To this end, we first
quantize the random variables S , U , and Y . A partition P of U is a finite collection of disjoint sets Pi
such that ∪i Pi = U . The quantization
of U by P is denoted as[U ]P and defined by


sup Pi if sup Pi < ∞


P [U ]P =
 = P (U ∈ Pi ).

inf Pi otherwise

(90)

Similarly, S (resp. Y ) is quantized by partition P̃ (resp. P 0 ) and its quantization is denoted by [S]P̃ (resp.
[Y ]P 0 ). The decoder considers the above quantizations of the received sequence y n and every un in the

codebook, and performs typicality decoding as in the proof of Theorem 4. The event E4 defined above,
which has vanishing probability as n → ∞, can be taken into account as an additional error event. Then
the conditions (52) and (60) become
R0 > I([U ]P ; [S]P̃ )

August 9, 2017

(91)

DRAFT

18

R + R0 < I([U ]P ; [Y ]P 0 ).

(92)

As we refine the partitions P , P̃ , and P 0 , I([U ]P ; [S]P̃ ) approaches I(U ; S) and I([U ]P ; [Y ]P 0 ) approaches I(U ; Y ) according to [23, Section 8.6].
We thus conclude that our coding scheme will succeed if (7) and (8) hold for the chosen PDFs.
Computing these expressions explicitly completes the achievability proof of Theorem 8.
Converse proof of Theorem 8. First, by examining the proof of Theorem 3, we see that it also applies
to the Gaussian channel. Fix the conditional distribution PU |S and the mapping x(u, s) that achieve the
maximum in (6). Recall that they satisfy PZ = Q0 and E[X 2 ] ≤ P . Let P̃ := Var(X) and Λ := E[XS].
It follows that
I(U ; Y ) − I(U ; S) ≤ I(U ; Y, S) − I(U ; S)

(93)

= I(U ; Y |S)

(94)

≤ I(X, U ; Y |S)

(95)

(a)

= I(X; Y |S)

(96)

= h(X + NY |S) − h(NY )
(97)


(b) 1
Λ2
≤ log 1 + P̃ −
,
(98)
2
T
where (a) is due to the Markov chain U − (X, S) − Y and (b) is from [10, Problem 2.7]. Recall the

condition PZ = Q0 , which implies
T + σ 2 = Var(X + S + NZ )

(99)

= P̃ + T + 2Λ + σ 2 ,

(100)

therefore we must have Λ = − P̃2 . Hence (98) implies
!
1
P̃ 2
I(U ; Y ) − I(U ; S) ≤ log 1 + P̃ −
.
2
4T
Note that P̃ ≤ P and
P̃ 2
arg max P̃ −
4T
0≤P̃ ≤P

(101)

!
= min{P, 2T }.

(102)

Thus, we have


1
(min{P, 2T })2
,
C ≤ log 1 + min{P, 2T } −
2
4T
which concludes the proof.

(103)

Proof of Theorem 7. We can adapt Theorem 2 to the Gaussian case with a power constraint through
a quantization argument that is similar to the one in the achievability proof of Theorem 8. By letting
V ∼ N (0, P ∗ ) and X = V − γ ∗ S in Theorem 2, Theorem 7 is proved.

August 9, 2017

DRAFT

19

VII. C ONCLUDING R EMARKS
We have shown that causal and noncausal CSI at the transmitter can sometimes help it to communicate
covertly at a postive rate over channels which, without CSI, obey the “square-root law” for covert
communications. Computable single-letter formulas for the maximum achievable covert-communication
rate (assuming that a sufficiently long key is available) have been derived. This work, from a different
perspective to that of recent works [5]–[7], shows that channel statistics unknown to the warden can help
the communicating parties to communicate covertly.
There are many channels over which, even with the help of CSI, covert communication cannot have a
positive rate (Remark 3 contains simple examples). For some of these channels, CSI may help to improve
the scaling constant of the maximum amount of information that can be covertly communicated with
respect to the square root of the total number of channel uses. We have not investigated this possibility
in the current paper.
So far, we have not been able to prove upper bounds on the minimum secret-key length required to
achieve the covert capacity that match the lower bounds (5) and (8), except when the warden has a weaker
channel than the intended receiver, in which case this length is zero. This key-length problem may be
related to the secrecy capacity of the wiretap channel with causal or noncausal CSI at the transmitter
[21], [24], which, to the best of our knowledge, is not yet completely solved.
R EFERENCES
[1] B. A. Bash, D. Goekel, and D. Towsley, “Limits of reliable communication with low probability of detection on AWGN
channels,” IEEE J. Select. Areas Commun., vol. 31, no. 9, pp. 1921–1930, Sept. 2013.
[2] P. H. Che, M. Bakshi, and S. Jaggi, “Reliable deniable communication: Hiding messages in noise,” in Proc. IEEE Int.
Symp. Inform. Theory, Istanbul, Turkey, July 10–15 2013.
[3] L. Wang, G. W. Wornell, and L. Zheng, “Fundamental limits of communication with low probability of detection,” IEEE
Trans. Inform. Theory, vol. 62, no. 6, pp. 3493–3503, June 2016.
[4] M. Bloch, “Covert communication over noisy channels: A resolvability perspective,” IEEE Trans. Inform. Theory, vol. 62,
no. 5, pp. 2334–2354, May 2016.
[5] P. H. Che, M. Bakshi, C. Chan, and S. Jaggi, “Reliable deniable communication with channel uncertainty,” in Proc. Inform.
Theory Workshop (ITW), Hobart, Australia, Nov. 2–5, 2014.
[6] S. Lee, R. J. Baxley, M. A. Weitnauer, and B. Walkenhorst, “Achieving undetectable communication,” IEEE Journal of
Selected Topics in Signal Processing, vol. 9, no. 7, pp. 1195–1205, Oct 2015.
[7] T. V. Sobers, B. A. Bash, D. Goeckel, S. Guha, and D. Towsley, “Covert communication in the presence of an uninformed
jammer,” [Online]. Available: http://arxiv.org/abs/1608.00698.
[8] A. El Gamal, N. Hassanpour, and J. Mammen, “Relay networks with delays,” IEEE Transactions on Information Theory,
vol. 53, no. 10, pp. 3413–3431, Oct 2007.
[9] H. Chang, S. Y. Chung, and S. Kim, “Interference channel with a causal relay under strong and very strong interference,”
IEEE Transactions on Information Theory, vol. 60, no. 2, pp. 859–865, Feb 2014.

August 9, 2017

DRAFT

20

[10] A. El Gamal and Y.-H. Kim, Network information theory.

Cambridge, U.K.: Cambridge Univ. Press, 2011.

[11] Z. Goldfeld, G. Kramer, H. H. Permuter, and P. Cuff, “Strong secrecy for cooperative broadcast channels,” IEEE
Transactions on Information Theory, vol. 63, no. 1, pp. 469–495, Jan 2017.
[12] S. I. Gelfand and M. S. Pinsker, “Coding for channel with random parameters,” Probl. Control Inf. Theory, vol. 9, pp.
19–31, 1980.
[13] J. Fridrich, Steganography in Digital Media: Principles, Algorithms, and Applications. Cambridge University Press, 2009.
[14] Y. Wang and P. Moulin, “Perfectly secure steganography: Capacity, error exponents, and code constructions,,” IEEE Trans.
Inform. Theory, vol. 54, no. 6, pp. 2706–2722, June 2008.
[15] I. Ezzeddine and P. Moulin, “Achievable rates for queue-based timing stegocodes,” in Proc. Inform. Theory Workshop
(ITW), 2009.
[16] E. L. Lehmann and J. P. Romano, Testing statistical hypotheses.

New York: Springer Verlag., 2005.

[17] C. E. Shannon, “Channels with side information at the transmitter,” IBM J. Res. Develop., vol. 2, pp. 289–293, 1958.
[18] T. S. Han and S. Verdú, “Approximation theory of output statistics,” IEEE Transactions on Information Theory, vol. 39,
no. 3, pp. 752–772, May 1993.
[19] P. Cuff, “Distributed channel synthesis,” IEEE Transactions on Information Theory, vol. 59, no. 11, pp. 7071–7096, Nov
2013.
[20] I. Csiszár and J. Körner, Information Theory: Coding Theorems for Discrete Memoryless Systems. Cambridge University
Press, 2011.
[21] Z. Goldfeld, P. Cuff, and H. H. Permuter, “Wiretap channels with random states non-causally available at the encoder,”
[Online]. Available: http://arxiv.org/abs/1608.00743.
[22] M. Costa, “Writing on dirty paper (corresp.),” IEEE Transactions on Information Theory, vol. 29, no. 3, pp. 439–441, May
1983.
[23] T. M. Cover and J. A. Thomas, Elements of information theory.

New York: Wiley, 1991.

[24] Y. K. Chia and A. E. Gamal, “Wiretap channel with causal state information,” IEEE Transactions on Information Theory,
vol. 58, no. 5, pp. 2838–2849, May 2012.

August 9, 2017

DRAFT

