11institutetext: School of Data Science, The Chinese University of Hong Kong,
Shenzhen, Longgang 518172, China 22institutetext: International Quantum
Academy (SIQA), Futian, Shenzhen 518048, China 33institutetext: Graduate
School of Mathematics, Nagoya University, Chikusa-ku, Nagoya 464-8602, Japan
33email<EMAIL_ADDRESS>
# Secure network coding with adaptive and active attack††thanks: Supported in
part by the National Natural Science Foundation of China under Grant 62171212.

Masahito Hayashi 112233 0000-0003-3104-1000

###### Abstract

Ning Cai and the author jointly studied secure network codes over adaptive and
active attacks, which were rarely studied until these seminal papers. This
paper reviews the result for secure network code over adaptive and active
attacks. We focus on two typical network models, a one-hop relay network and a
unicast relay network.

###### Keywords:

one-hop relay network unicast relay network non-linear code anti-Latin square.

##  1 Introduction

Network coding is a key technology for communication over a network. Secure
network coding protects our communication from various attacks. However, the
majority of existing studies addressed deterministic and passive attacks, and
did not care about the effect of adaptive changes on attacked edges and active
modification on the information on attacked edge [1, 2, 3, 4, 5, 6, 7, 8, 9,
10, 11, 12, 13, 14]. The communication over a network has a risk that an
adversary, Eve, can improve her ability by using adaptive and active
operations. In several joint papers [15, 16, 17, 18, 19], Ning Cai and the
author jointly studied how adaptive and active operations can improve Eve’s
performance. This paper reviews these joint studies. Since the original paper
[19] contains complicated descriptions and a certain error, this paper
presents the corrected contents based on its correction [20]. In addition, the
paper [19] discussed the difference between the existence and the non-
existence of random number at intermediate nodes. Also, the paper [19] treated
the correctness and the secrecy in an asymmetric way. In this paper, we adopt
the base $2$ of the logarithm.

The outline of this paper is the following. This paper explains why such an
asymmetric treatment is reasonable by citing the recent paper [21] in Section
2. Then, Section 2 introduces these two kinds of formulations based on the
existence and the non-existence of random number at intermediate nodes.
Section 3 analyzes $r$-wiretap network based on the above mentioned
formulations. Section 4 introduces two kinds of unconventional attack models,
adaptive attack and active attack. Section 5 explains that secure
communication is impossible in one-hop relay network under the non-existence
of random number at intermediate nodes even when neither adaptive attack nor
active attack is allowed for Eve. Section 6 introduces non-linear codes to
resolve this problem. Section 8 shows adaptive attacks the above non-linear
codes over one-hop relay network. Section 7 shows active attacks the above
non-linear codes over one-hop relay network. Section 9 presents the usage of
vector-linear code over one-hop relay network. Section 10 derives the
capacities under adaptive and active attacks over unicast relay network.
Section 11 makes conclusion.

##  2 Security model and coding model

Secure network coding has two kinds of security measures. One is the
correctness of the decoding message, and the other is the secrecy of the
transmitted message. Also, secure network coding considers the set of possible
attacks. The usual setting requires the correctness and the secrecy when one
of possible attack is done. However, when this requirement is imposed to our
code, it is often difficult to realize a larger transmission rate. To realize
a better transmission rate, it is possible to discount the requirement as
follows. The discounted setting requires the secrecy when one of possible
attack is done, but it requires the correctness only when no attack is made.
This requirement is useful when the sender, Alice, and the receiver, Bob,
share a small size of secret random number and they can use public channel due
to the following reason.

As explained in [21], this discounted setting is reasonable as follows even
for the message transmission. In this case, after the communication, Alice and
Bob can apply error verification by using a small size of secret random number
and public channel [21, Section VI], [22, Section VIII], [23, Section
III-C-2)]. If an error is detected, they abort the protocol. Since the attack
is limited to an element of the set of possible attacks, the requirement
guarantees that the secrecy of the message is kept even in this case. Once the
error verification is passed, the error verification guarantees the
correctness. As explained in [21, Section VI], [22, Section VIII], [23,
Section III-C-2)], when the size of the transmitted message is $n$ bits, the
error verification consumes a polynomial amount of resources with respect to
$\log n$. Thus, the error verification does not affect the transmission rate
of the whole protocol. Due to this reason, this paper focuses on the
discounted setting.

This paper adopts two kinds of formulations for our codes depending on the
resources on intermediate nodes. In the first formulation, an arbitrary node
including an intermediate node can generate an arbitrary random number. In the
second formulation, only the source node and the destination node can generate
an arbitrary random number so that an intermediate node cannot. This paper
adopts both formulations for our codes.

This paper considers two kinds of linear codes. When transmitted information
on each edge in a code is given as a single element, i.e., a scalar, of a
finite field $\mathbb{F}_{q}$ or a quotient ring $\mathbb{Z}_{d}$ and a coding
operation on each node is given as linear operations over input or incoming
information, the code is called a scalar-linear code. When transmitted
information on each edge in a code is given as a vector on a finite field
$\mathbb{F}_{q}$ or a quotient ring $\mathbb{Z}_{d}$ and a coding operation on
each node is given as linear operations over input or incoming information,
the code is called a vector-linear code. The paper [18] showed the following
lemma.

##  3 Two kinds of formulations over single source and single terminal network
model

To consider the relation between two kinds of formulations for our codes, we
consider an acyclic network with a single source and a single terminal, where
Eve is allowed to select an arbitrary $r$-subset channels to access, which is
called $r$-wiretap network [1, 2, 24, 25]. We define the first capacity
$C_{1}$ as the maximum transmission rate when random number generation is
allowed in an arbitrary intermediate node. We define the second capacity
$C_{2}$ as the maximum transmission rate when random number generation is not
allowed in an arbitrary intermediate node. For our analysis on the capacities
of the given network, we introduce two kinds of minimum cuts. A node is called
a pseudo source node when the node has only outgoing edges but has no original
message to be transmitted. Since a pseudo source node is not the source node
nor the terminal node, it is classified as an intermediate node. The first
kind of minimum cut $\mathop{\rm mincut}\nolimits_{1}$ is the minimum number
of edges crossing a line separating the source and terminal nodes. The second
kind of minimum cut $\mathop{\rm mincut}\nolimits_{2}$ is the minimum number
of edges crossing a line separating the source and terminal nodes when we
remove all edges outgoing from pseudo source nodes. Edges out-going from
pseudo source nodes are counted in $\mathop{\rm mincut}\nolimits_{1}$, but are
not counted in $\mathop{\rm mincut}\nolimits_{2}$.

######  Lemma 1 ([19, (35), (36), and Example 1])

For $r$-wiretap network, we have

$\displaystyle C_{2}=$ $\displaystyle\mathop{\rm mincut}\nolimits_{2}-r,$ (1)
$\displaystyle\mathop{\rm mincut}\nolimits_{2}-r\leq C_{1}\leq$
$\displaystyle\mathop{\rm mincut}\nolimits_{1}-r.$ (2)

$\square$

As a special case analysis, we have the following corollary.

######  Corollary 1 ([19, Example 1])

When an $r$-wiretap network has no pseudo source node, we have

$\displaystyle C_{2}=C_{1}=\mathop{\rm mincut}\nolimits_{1}-r.$ (3)

$\square$

The network given in Fig. 1 shows that a network has different rates
$\mathop{\rm mincut}\nolimits_{1}$ and $\mathop{\rm mincut}\nolimits_{2}$.
This network has a linear code to realize $\mathop{\rm mincut}\nolimits_{1}-r$
when $r=2$, which implies the equality of the second inequality in (2). Since
$C_{1}=1$ and $C_{2}=0$, $C_{1}$ is strictly larger $C_{2}$.

Figure 1: $r$-wiretap network with equality of the second inequality in (2).
Node 1 is the source node and Node 6 is the terminal node. Node 5 is a pseudo
source node. Thus, $\mathop{\rm mincut}\nolimits_{2}=2$ and $\mathop{\rm
mincut}\nolimits_{1}=3$. When intermediate nodes are allowed to generate
random variables, the presented code achieves $\mathop{\rm
mincut}\nolimits_{1}-r$ when $r=2$. The source node (Node 1) has the message
$M$ and two scramble variables $L_{1},L_{2}$. The pseudo source node (Node 5)
has another scramble variable $L_{3}$. Even when Eve wiretaps arbitrary two
edges, she cannot get arbitrary information for the message $M$.

##  4 Unconventional attack models

This paper aims to discuss two unconventional types of attacks when the
network model has a multiple-layer structure, like a one-hop relay network.
When a one-hop relay network is given, a conventional type of attack is given
as Fig. 4. One is an active attack as Fig. 4. In order to get more
information, the eavesdropper changes the information on attacked edges. That
is, after the above modification on the first attacked edge, the eavesdropper,
Eve, may have a possibility to get more information via the second attack.
Such an attack is called an active attack. If the attack is not an active
attack, it is called a passive attack.

To discuss an active attack, we need to be careful for the causality and the
time-ordering. The paper [18] carefully handled this problem, and showed the
following theorem, which guarantees that an arbitrary active attack cannot
improve Eve’s information when the code is linear.

######  Theorem 4.1 ([18, Theorem 1])

Suppose that coding operations on all nodes are linear. The information that
Eve gets via an active attack on edges can be simulated by Eve by using the
information that Eve gets via a passive attack on the same edges. $\square$

Although the paper [26] addressed a part of active attacks, its treatment is
limited to a limited class of active attacks. The paper [16] covers a more
general class of active attacks.

The second is an adaptive attack as Fig. 4. In order to get more information,
Eve changes what edge is to be attacked according the information on the
previous attacks. Such an attack is called an adaptive attack. If the attack
is not an adaptive attack, it is called a deterministic attack. That is, a
conventional attack is called a deterministic and passive attack.

Figure 2: Deterministic and passive attack over one-hop relay network
---
Figure 3: Active attack over one-hop relay network
Figure 4: Adaptive attack over one-hop relay network

##  5 Problem over one-hop relay network

First, we consider a one-hop relay network as Fig. 4. This network has only
one intermediate node in addition to the source node and the destination node.
The intermediate node connects with the source node via two edges, i.e., two
channels, $e(1)$ and $e(2)$. Also, the intermediate node connects with the
destination node via two edges, i.e., two channels, $e(3)$ and $e(4)$. The aim
of this network is the following. Alice intends to her message from the source
node to Bob at the destination node. Here, we consider two types of attacks by
an adversary, Eve. In the passive attack, Eve can eavesdrop on two edges in
total, i.e., she can eavesdrop on one edge among $e(1)$ and $e(2)$, and can
another edge among $e(3)$ and $e(4)$. In the active attack, Eve is allowed to
change it to get more information.

Here, for the secrecy, we adopt imperfect secrecy as follows. When $M$ is the
message and Eve’s information $Z_{E}$ satisfies the condition $I(M;Z_{E})=0$
for all of Eve’s possible attacks, the code is called perfectly secret. When
the condition $I(M;Z_{E})<\log d$ holds for all of Eve’s possible attacks, the
code is called imperfectly secret [27] (or weakly secret). Otherwise, it is
called insecure. In other words, our code is imperfectly secret, when there
exists no function $\tilde{\psi}$ such that $\tilde{\psi}(Z_{E})=M$. Also, we
say that the code is perfectly secret, when $Z_{E}$ is Eve’s information and
$I(M;Z_{E})=0$ for all Eve’s possible attacks.

We choose $L\in\mathbb{Z}_{d}$ as the uniform scramble random variable
generated at the source node. Suppose that the intermediate node generates
another uniform scramble random variable $L^{\prime}\in\mathbb{Z}_{p}$. We
introduce a scalar-linear code as follows.

$\displaystyle Y_{1}:=L,\quad Y_{2}:=M+L.$ (4)

Then, the intermediate node applies the code $\varphi$ as

$\displaystyle{Y}_{3}:=L^{\prime},\quad{Y}_{4}:=Y_{2}-Y_{1}+L^{\prime}.$ (5)

The decoder $\psi$ is written as $\psi({Y}_{3},{Y}_{4}):={Y}_{4}-{Y}_{3}$,
which equals
$Y_{2}-Y_{1}+L^{\prime}-L^{\prime}=M+L-L+L^{\prime}-L^{\prime}=M$. This code
satisfies the correctness. The pair $(Y_{1},Y_{3})$ is independent of $M$.
Similarly, the pairs $(Y_{1},Y_{4})$, $(Y_{2},Y_{3})$, and $(Y_{2},Y_{4})$ are
independent of $M$. Thus, this code is perfectly secret for passive attacks,
and has the transmission rate $\log d$.

Even when Eve selects the attacked edge $e(3)$ or $e(4)$ based on the
observation on the first attack, Eve gets no information for the message $M$.
Hence, this code is secret even for an adaptive attack. Due to the linearity,
even when Eve changes the information on the first attacked edge, Eve cannot
improve her performance due to Theorem 4.1. Thus, this code is secret even for
an adaptive and active attack.

However, when the intermediate node cannot generate a uniform scramble random
variable, no scalar-linear code is imperfectly secret over a quotient ring
$\mathbb{Z}_{d}$ for passive attacks, as shown in [17, Theorem 1]. In other
words, for an arbitrary scalar-linear code over a quotient ring
$\mathbb{Z}_{d}$, Eve has a passive attack to recover the message $M$
perfectly.

##  6 Non-linear codes over one-hop relay network

To realize imperfect secrecy without random number generation on the
intermediate node, we introduce the following non-linear code. For simplicity,
it is assumed that Alice transmits only the message $M\in\mathbb{Z}_{d}$ and
an arbitrary edge can transmit only one binary information. We consider the
following code, which requires the binary uniform scramble random variable
$L\in\mathbb{Z}_{d}$ at the source node.

The encoder $\phi$ is given in the same way as (4). Then, our non-linear code
$\varphi$ in the intermediate node is given as

$\displaystyle{Y}_{3}:={Y}_{1}({Y}_{2}-{Y}_{1}),\quad{Y}_{4}:=({Y}_{1}+1)({Y}_{2}-{Y}_{1}).$
(6)

The decoder $\psi$ is given as $\psi({Y}_{3},{Y}_{4}):={Y}_{3}+{Y}_{4}$. In
this code, ${Y}_{3}$ and ${Y}_{4}$ have the following form;

$\displaystyle{Y}_{3}=LM,\quad{Y}_{4}=LM+M.$ (7)

Thus, the decoder recovers $M$ as $Y_{4}-Y_{3}$ nevertheless the value of $L$.
We call the above code the standard non-linear code.

Consider the case when Eve eavesdrops $Y_{1}=L$ in the first step. Suppose
that Eve eavesdrops $Y_{3}$ in the second step. When $L$ is invertible, she
can recover $M$ by $Y_{1}^{-1}Y_{3}$. But, when $L$ is not invertible, she
cannot recover $M$ because the map $M\mapsto LM$ is not one-to-one. Suppose
that Eve eavesdrops $Y_{4}$ in the second step When $L+1$ is invertible, she
can recover $M$ by $(Y_{1}+1)^{-1}Y_{4}$. But, when $L+1$ is not invertible,
she cannot recover $M$ because the map $M\mapsto(L+1)M$ is not one-to-one.

Consider the case when Eve eavesdrops $Y_{2}=M+L$ in the first step. Suppose
that Eve eavesdrops $Y_{3}$ in the second step. To recover $M$, she needs to
find $M$ to satisfy $Y_{3}=Y_{2}M-M^{2}$. However, the map $M\mapsto
Y_{2}M-M^{2}$ is not always one-to-one. For example, when $d=2$ and $Y_{2}=1$,
$Y_{2}M-M^{2}$ is always zero. Also, when $d>2$ and $Y_{2}=0$, $Y_{2}M-M^{2}$
has the same value with $M=1,-1$. Thus, Eve cannot recover the original
information $M$. Suppose that Eve eavesdrops $Y_{4}$ in the second step. To
recover $M$, she needs to find $M$ to satisfy $Y_{4}=Y_{2}M+M-M^{2}$.
Similarly, the map $M\mapsto Y_{2}M+M-M^{2}$ is not always one-to-one. For
example, when $d=2$ and $Y_{2}=0$, $Y_{2}M+M-M^{2}$ is always zero. Also, when
$d>2$ and $Y_{2}=-1$, $Y_{2}M+M-M^{2}$ has the same value with $M=1,-1$. In
this way, we find that this code is imperfectly secret for deterministic and
passive attacks. That is, there exists a secret code over deterministic and
passive attacks.

When $d=2$, The reference [17, Appendix] calculated the mutual information,
i.e., the amount of information leakage as follows.

$\displaystyle
I(M;{Y}_{1},{Y}_{3})=I(M;{Y}_{1},{Y}_{4})=I(M;{Y}_{2},{Y}_{3})=I(M;{Y}_{2},{Y}_{4})=\frac{1}{2},$
(8)

Further, as shown in Lemma 2 with $d=2$, when Eve cannot recover the message
$M$ perfectly with an arbitrary deterministic and passive attack in the code,
the network code is limited to the standard non-linear code or a code
equivalent to the standard non-linear code.

######  Lemma 2 ([17, Lemma 1])

Suppose that $d=2$ and a code $(\phi,\varphi,\psi)$ satisfies the following
conditions. Let $Y_{1}$ and $Y_{2}$ be the random variables generated by the
encoder $\phi$ when $M$ is subject to the uniform distribution. We assume that
the random variables $(Y_{3},Y_{4}):=\varphi(Y_{1},Y_{2})$ satisfies the
following conditions.

(C1)

The relation $\psi(Y_{3},Y_{4})=M$ holds.

(C2)

There is no deterministic function $\tilde{\psi}$ from $\mathbb{Z}_{2}^{2}$ to
$\mathbb{Z}_{2}$ satisfying one of the following conditions.

$\displaystyle\tilde{\psi}(Y_{1},Y_{3})=M,\quad\tilde{\psi}(Y_{1},Y_{4})=M,$
(9)
$\displaystyle\tilde{\psi}(Y_{2},Y_{3})=M,\quad\tilde{\psi}(Y_{2},Y_{4})=M.$
(10)

Then, there exist single-input functions $f_{1},f_{2},f_{3},f_{4},f_{5}$ on
$\mathbb{Z}_{2}$ such that $\bar{Y}_{i}:=f_{i}(Y_{i})$ and $\bar{M}:=f_{5}(M)$
satisfy (6) and (4) with a scramble random variable $L$ while the variable $L$
might be correlated with $M$. $\square$

However, the above theorem does not holds when $d>2$. In this case, the paper
[17] proposed another non-linear code. For this aim, the paper [17] introduced
an anti-Latin square. A matrix $(a_{i,j})$ on $\mathbb{Z}_{d}$ is called an
anti-Latin square when each row and each column have duplicate elements, which
is the opposite requirement to a Latin square. For example, the following
shows $3\times 3$ and $4\times 4$ anti-Latin square matrices.

$\displaystyle\left(\begin{array}[]{ccc}0&1&0\\\ 1&1&2\\\
0&2&2\end{array}\right),\quad\left(\begin{array}[]{ccc}0&2&2\\\ 0&1&0\\\
1&1&2\end{array}\right),\quad\left(\begin{array}[]{cccc}0&1&3&3\\\ 0&1&2&0\\\
1&1&2&3\\\
0&2&2&3\end{array}\right),\quad\left(\begin{array}[]{cccc}0&0&1&0\\\
1&1&1&2\\\ 3&2&2&2\\\ 3&0&3&3\end{array}\right).$ (25)

Using a pair of $d\times d$ anti-Latin square matrices $(a_{i,j})$ and
$(b_{i,j})$, the paper [17] proposed a non-linear code as follows. The encoder
$\phi$ is given in the same way as (4). Then, our non-linear code $\varphi$ in
the intermediate node is given as

$\displaystyle{Y}_{3}:=a_{Y_{1},Y_{2}},\quad{Y}_{4}:=b_{Y_{1},Y_{2}}.$ (26)

We call the above code the anti-Latin code of the pair of anti-Latin square
matrices $(a_{i,j})$ and $(b_{i,j})$.

For example, when the pair $(a_{i,j})$ and $(b_{i,j})$ is chosen by the first
and second matrices (or the the third and fourth matrices) in (25), the map
$(Y_{1},Y_{2})\mapsto(a_{Y_{1},Y_{2}},b_{Y_{1},Y_{2}})$ is one-to-one. So, the
anti-Latin code is uniquely decodable. To see the equivalent condition to the
unique decodability, we define the set

$\displaystyle\Xi_{z,m}(\varphi^{(3)},\varphi^{(4)}):=\varphi^{(4)}(\\{(l,l+m)|\varphi^{(3)}(l,l+m)=z\\})\hbox{
for }z,m\in\mathbb{Z}_{d}.$ (27)

When $Y_{4}=z$ and $M=m$, the set $\Xi_{z,m}(\varphi^{(3)},\varphi^{(4)})$
expresses the possible values of $Y_{4}$. Hence, the unique decodability is
equivalent to the relation

$\displaystyle\Xi_{z,m}(\varphi^{(3)},\varphi^{(4)})\cap\Xi_{z,m^{\prime}}(\varphi^{(3)},\varphi^{(4)})=\emptyset\hbox{
for }m\neq m^{\prime}\in\mathbb{Z}_{d},~{}z\in\mathbb{Z}_{d}.$ (28)

Although there is no decodable anti-Latin code for $d=2$, a decodable anti-
Latin code exists for $d>2$ as follows.

######  Lemma 3 ([17, Section V])

For $d>2$, there exists a pair of $d\times d$ anti-Latin square matrices
$(a_{i,j})$ and $(b_{i,j})$ such that its anti-Latin code is decodable.
$\square$

##  7 Active attack to non-linear code over one-hop relay network

Next, we consider active attacks over a one-hop relay network, as Fig. 4. Eve
has the following two active attacks for the standard non-linear code.

(i)

When Eve attacks on $e(1),e(3)$ and replaces $Y_{1}$ by $1$, we have
$Y_{3}+1-Y_{1}=M$.

(ii)

When Eve attacks on $e(1),e(4)$ and replaces $Y_{1}$ by $0$, we have
$Y_{4}-Y_{1}=M$.

Therefore, the code presented in Section 8 is insecure under active attacks.

Since Lemma 2 guarantees the non-existence of another imperfectly secret code
over deterministic and passive attacks for $d=2$, the above discussion shows
the non-existence of an imperfectly secret code over active attacks for $d=2$.

However, Lemma 2 does not hold for $d\neq 2$. In fact, any anti-Latin code is
imperfectly secret even under active attacks as follows. Assume that Eve
eavesdrops $e(1)$ and $e(3)$. Even when Eve replaces $Y_{1}$ by any value, any
row vector of $a_{i,j}$ has duplicate elements. Hence, Eve has a possibility
that she cannot recover the message from $Y_{1}$ and $Y_{3}$. The same
discussion can be applied to other pairs of edges eavesdropped by Eve.

##  8 Adaptive attack to non-linear code over one-hop relay network

Next, we discuss adaptive attacks over one-hop relay network even when active
modification is not allowed. Eve has the following adaptive attack to recover
the message $M$, as Fig. 4.

(i)

First, Eve eavesdrops $e(1)$. When ${Y}_{1}=1$, she eavesdrops $e(3)$, and
recovers $M$ as ${Y}_{3}+1={Y}_{2}-1+1=M$. When ${Y}_{1}=0$, she eavesdrops
$e(4)$, and recovers $M$ as ${Y}_{4}={Y}_{2}=M$.

Thus, the non-linear code given in Section 6 is not imperfectly secret for
adaptive attacks. Since Lemma 2 guarantees the non-existence of another
imperfectly secret code over deterministic and passive attacks for $d=2$,
there exists no imperfectly secure code over adaptive attacks in this network
model with $d=2$. This fact shows that an adaptive attack is powerful for this
kind of non-linear code with $d=2$ even when it has no active modification. In
fact, when $d=2$, Eve also has the following adaptive attack to recover the
message $M$.

(ii)

First, Eve eavesdrops $e(2)$. When ${Y}_{2}=1$, she eavesdrops $e(4)$ and
recovers $M$ as ${Y}_{4}={Y}_{1}+1=M$. When ${Y}_{2}=0$, she eavesdrops $e(3)$
and recovers $M$ as ${Y}_{3}={Y}_{1}=M$.

However, Lemma 2 does not hold for $d\neq 2$. In fact, any anti-Latin code is
imperfectly secret even under adaptive and active attacks as follows. Assume
that Eve eavesdrops $e(1)$ at the first step. Even when Eve replaces $Y_{1}$
by any value, any row vector of $(a_{i,j})$ and any row vector of $(b_{i,j})$
have duplicate elements. When Eve observes such duplicate elements in the
second observation, she cannot recover the message $M$. Hence, whichever
$e(3)$ or $e(4)$ Eve eavesdrops in the second step, she has a possibility that
she cannot recover the message $M$ from her observed information. The same
discussion can be applied to the case when Eve eavesdrops $e(2)$ by
considering column vectors of $(a_{i,j})$ and $(b_{i,j})$. Therefore, there
exists an imperfectly secret code for under adaptive and active attacks when
$d>2$.

The discussion of this section is based on the paper [19]. But, it did not
discuss adaptive attacks for anti-Latin codes.

##  9 Vector-linear codes over one-hop relay network

To resolve this problem, we employ a vector-linear code. A vector-linear code
can be realized when the network of Fig. 4 is used at least twice. Suppose
that the source node generates three uniform scramble random variables
$L_{1},L_{2},L_{3}\in\mathbb{Z}_{d}$. Using these variables, we define a
vector-linear code as follows. The first transmission sends the following;

$\displaystyle{Y}_{1}:=L_{1},\quad{Y}_{2}:=M+L_{1},$ (29)

and the second transmission sends the following;

$\displaystyle{Y}_{1}^{\prime}:=L_{2},\quad{Y}_{2}^{\prime}:=L_{3}+L_{2},$
(30)

Then, the intermediate node applies the code $\varphi$ as

$\displaystyle{Y}_{3}:=Y_{2}^{\prime}-Y_{1}^{\prime},\quad{Y}_{4}:=Y_{2}-Y_{1}+Y_{2}^{\prime}-Y_{1}^{\prime}.$
(31)

In this code, nothing is transmitted in the second layer at the second
transmission. The decoder $\psi$ is given as
$\psi({Y}_{3},{Y}_{4}):={Y}_{4}-{Y}_{3}$, which equals
$Y_{2}-Y_{1}+Y_{2}^{\prime}-Y_{1}^{\prime}-(Y_{2}^{\prime}-Y_{1}^{\prime})=M+L_{1}-L_{1}=M$.
Then, the pair $(Y_{1},Y_{3})$ is independent of $M$. Similarly, the pairs
$(Y_{1},Y_{4})$, $(Y_{2},Y_{3})$, and $(Y_{2},Y_{4})$ are independent of $M$.
Thus, this code is perfectly secret for deterministic attacks, and has the
transmission rate $\frac{1}{2}\log d$. In the same reason as the above, this
code is secret for adaptive attack. Then, due to the linearity, it is secure
even for active and adaptive attacks.

The discussion until this section is summarized as Table 1.

Table 1: Summary for one hop relay network (Figs. 4-4) with single shot setting Code | deterministic | active | adaptive
---|---|---|---
and passive | attack | attack
attack
scalar-linear code over $\mathbb{Z}_{d}$ | insecure | insecure | insecure
scalar-non-linear code over $\mathbb{Z}_{2}$ | imperfectly | insecure | insecure
secret
scalar-non-linear code | imperfectly | imperfectly | imperfectly
over $\mathbb{Z}_{d}$ with $d>2$ | secret | secret | secret
vector-linear code over $\mathbb{Z}_{d}$ | perfectly | perfectly | perfectly
secret | secret | secret

##  10 Non-local linear codes over unicast relay network

###  10.1 Capacity formula

The above type of codes can be generalized over unicast relay network. Before
the detailed discussions, we remark on the relation between two kinds of
linear codes over multiple uses of a given network. When coding operations on
intermediate nodes are fixed to linear operations, such a model is called a
linear network model. In this case, we have the freedom to design only coding
operations in the source and destination nodes. Such coding operations are
called an encoder and a decoder. Thus, operations at intermediate nodes are
not designed. Such a code is called a local code, and was studied in the
papers [19]. However, the code presented in Section 7 is not classified to
this class of codes. In contrast, when all operations at intermediate nodes
are designed to achieve a higher transmission rate, such a code is called a
non-local code.

Figure 5: Unicast relay network

In the following, we consider non-local codes over a unicast relay network
given as Fig. 5. But, for simple discussion, we assume that each edge sends
one element of a finite field $\mathbb{F}_{q}$ instead of an element of
$\mathbb{Z}_{d}$ for a single channel use. A unicast relay network is composed
of the following group structure of the intermediate nodes. This network has
$c-1$ intermediate nodes, which are labeled from the first intermediate node
to the $c-1$-th intermediate node. It has only one source node and one
terminal node, which are regarded as the $0$-th node and the $c$-th node,
respectively. Each intermediate node has incoming edges and outgoing edges.
For $i=1,\ldots,c$, this network has $k_{i}$ edges between the $i-1$ and
$i$-th nodes. At one channel use, each edge $e(i,j)$ transmits the information
${Y}_{i,j}$ for $i=1,\ldots,c$ and $j=1,\ldots,k_{i}$ that takes values on
$\\{1,\ldots,d\\}$.

In this model, it is assumed that Eve eavesdrops $r_{i}$ edges
$\vec{Y}_{i,s_{i}}:=({Y}_{i,s_{i}(1)},\ldots,{Y}_{i,s_{i}(r_{i})})$ among
$k_{i}$ edges $\overline{Y}_{i}:=({Y}_{i,j})_{j=1,\ldots,k_{i}}$ between the
$i-1$ and $i$-th nodes. Under this notation, the function $s_{i}$ expresses
the edges eavesdropped by Eve. In other words, she can eavesdrop
$\sum_{i=1}^{c}r_{i}$ edges totally. Eve is allowed to make adaptive and
active attacks, which are stronger attacks than conventional attacks.

The first capacity $C_{1}$ is defined as the maximum transmission rate when
random number generation is allowed in an arbitrary intermediate node. The
second capacity $C_{2}$ is defined as the maximum transmission rate when
random number generation is not allowed in an arbitrary intermediate node.
Then, we have the following capacity theorem.

######  Theorem 10.1 ([19, Theorem 3])

We have the capacity formulas

$\displaystyle C_{1}=$ $\displaystyle\log q\min_{1\leq j\leq c}(k_{j}-r_{j}),$
(32) $\displaystyle C_{2}=$ $\displaystyle\log q\min_{1\leq j\leq
c}(k_{j}-r_{j})\frac{(k_{j+1}-r_{j+1})\cdots(k_{c}-r_{c})}{k_{j+1}\cdots
k_{c}}.$ (33)

Further, these capacities can be attained by non-local linear codes under the
respective classes of non-local codes. $\square$

Further, the paper [19] showed that these capacities cannot be improved even
when the attack is limited to deterministic and passive attacks. This fact
shows that adaptive and active attacks cannot improve Eve’s ability in this
network when we use the proposed code.

Here, we discuss the relation to existing results with respect to the
difference between two capacities $C_{1}$ and $C_{2}$. A larger part of
preceding studies discuss the capacity $C_{1}$, i.e., the capacity (or
capacity region) with no restriction of randomness generated at intermediate
nodes. For example, as stated in Corollary 1, the equation $C_{1}=C_{2}$ holds
in $r$-wiretap network when $\mathop{\rm mincut}\nolimits_{1}=\mathop{\rm
mincut}\nolimits_{2}$. However, the paper [28] showed an example for network
such that the capacity can be improved by randomness generated at intermediate
nodes. In the example, only one edge connects the source node. This example
seems natural because usually, the secure transmission can be done by use of
the difference among information on different edges connected to the same
node.

The papers [29, 30] addressed the difference between the existence and non-
existence of randomness generated at intermediate nodes in another network
only for deterministic attacks. But, these papers did not derive the
capacities $C_{1}$ and $C_{2}$ exactly. because their analysis depends on
special codes. Therefore, the analysis in [19] can be considered as the first
derivation of the difference between the capacities $C_{1}$ and $C_{2}$ except
for the case when only one edge connects the source node.

###  10.2 Ideas for proof

Since the proof of this theorem is too complicated, we omit the proof. Here,
we simply explain what technical lemmas are employed for the proof. The
converse part was shown by using the following lemma.

We denote the set $\\{1,\ldots,k\\}$ by $[k]$, and denote the collection of
subsets $S\subset[k]$ with cardinality $r$ by ${[k]\choose r}$. Now, we
consider the random variables $X,\vec{Y}_{1},\ldots,\vec{Y}_{k}$. For an
arbitrary subset $S\subset[k]$, we denote the tuple of random variables
$(\vec{Y}_{s})_{s\in S}$ by $\vec{Y}_{S}$. We can show the following two
lemmas.

######  Lemma 4 ([20, (59)’])

We have

$\displaystyle\sum_{S\in{[k]\choose r}}H(\vec{Y}_{S}|X)\geq$
$\displaystyle{k-1\choose r-1}H(\vec{Y}_{[k]}|X)=\frac{r}{k}{k\choose
k-r}H(\vec{Y}_{[k]}|X).$ (34)

$\square$

Originally, the paper [19] stated a statement different from the above as
Lemma 4. However, its derivation is not correct and was not used for the
converse proof, as explained in [20]. Lemma 4 is the correct version, and is
used in Eq. (47) in the converse part in [19]. Although Lemma 4 has been
already known as Han’s inequality [31], it can be shown by Lemma 5 shown in
[19], in the following way.

Here, we show Lemma 4 by using Lemma 5. Any element $a\in[k]$ is contained in
exactly ${k-1\choose r-1}$ members of ${[k]\choose r}$. So, we apply Lemma 5
to the case with ${\cal S}_{h}={[k]\choose r}$ and $h={k-1\choose r-1}$. Thus,
we have Eq. (34).

######  Lemma 5 ([19, Lemma 5])

Let ${\cal S}_{h}$ be a collection of subsets of $[k]$. When an arbitrary
element of $[k]$ is contained in exactly $h$ members of ${\cal S}_{h}$, we
have

$\sum_{S\in{\cal S}_{h}}H(\vec{Y}_{S}|X)\geq hH(\vec{Y}_{[k]}|X).$ (35)

$\square$

In contrast, the direct part was shown by using the following technical lemma.

###### Lemma 6

For an arbitrary prime power $q$, arbitrary two natural numbers $k>r$, there
exist a natural integer $n_{k,r}$ and $r$ vectors
$v_{1},\ldots,v_{r}\in\mathbb{Z}_{q^{n_{k,r}}}^{k}$ such that
$v_{i,j}=\delta_{i,j}$ for $j=1,\ldots,m$ and the $r\times r$ matrix
$(v_{i,s(j)})_{i,j}$ is invertible for an arbitrary injective function $s$
from $\\{1,\ldots,r\\}$ to $\\{1,\ldots,k\\}$. $\square$

Lemma 6 has been shown in various topics, the wiretap channel II introduced by
Ozarow and Wyner [32] and secret sharing [33, 34], etc. In the wiretap channel
II model, a secret message is encoded to a codeword in an $n_{k,r}$-length
code. A wiretapper can eavesdrop on arbitrary $r$ components out of $k$
parallel channels, but may have no information about the message. A linear
code, e.g., a Reed-Solomon code can serve as the code. It is called a $(k,r)$
code for wiretap channel II, and satisfies the condition for Lemma 6. Also,
such a code is called a maximum distance separable (MDS) code [35]. This lemma
also can be regarded as a very simple and special case of the code in [2,
Section III].

Since the network coding with local codes [26, 16] includes the wiretap
channel II model as the case with parallel channels [36], it can be considered
that the analysis [26, 16] contains a more general statement than Lemma 6.

Recently, this lemma was generalized to its symplectic version as Lemma 2 of
[37]. The symplectic version is useful for analyzing the quantum version of
private information retrieval. Also, the recent paper [38] generalized this
lemma to various ways by using the concept of multi-target monotone span
program (MMSP) to discuss various types of quantum extension of MDS codes.

##  11 Conclusion

We have reviewed several results under adaptive and active attacks over a one-
hop relay network and unicast relay network. Also, we have reviewed the recent
result for the difference between the existence and the non-existence of
random number at intermediate nodes. These results show how to handle such
unconventional attacks. Although the papers [17, 19] did not discuss the
imperfect secrecy for an anti-Latin code under adaptive attacks, we have
proved it in this paper. The paper [19] also generalized the result presented
in Section 10 to a homogeneous multicast rely network. Although the review of
this extension is omitted, the paper [19] presented a network code that works
even with adaptive and active attack in these networks. However, the analysis
on such unconventional attacks over a network is still limited. Further, it is
desired to develop network codes for such unconventional attacks.

The paper [17] proposed the concept of an anti-Latin square, no other paper
discussed it. Based on Latin squares, the famous puzzle, Sudoku, has been
invented and it has been enjoyed among many people. Since generating a pair of
anti-Latin squares is not so trivial and is an interesting combinatorics
problem, it can be expected to be developed into another puzzle. Also, it is
expected that a more complicated combination of anti-Latin squares generates
useful non-linear codes for more complicated network models. Although the
decodability of an anti-Latin code is equivalent to (28), it is not clear
whether this condition is equivalent to the condition that the map
$(Y_{1},Y_{2})\mapsto(a_{Y_{1},Y_{2}},b_{Y_{1},Y_{2}})$ is one-to-one. That
is, while the latter condition is its sufficient condition, its necessity is
not clear. This problem is also an interesting open problem.

Finally, we propose another open problem. A subset $S$ of the set ${\cal
L}(d)$ of $d\times d$ anti-Latin matrices is called pairwise-decodable when
any two elements of $S$ form a decodable anti-Latin code. A subset
$S\subset{\cal L}(d)$ is called pairwise-one-to-one when the map
$(Y_{1},Y_{2})\mapsto(a_{Y_{1},Y_{2}},b_{Y_{1},Y_{2}})$ is one-to-one for any
two elements $(a_{i,j})$ and $(b_{i,j})$ of $S$. Then, we define two numbers
$A(d)$ and $B(d)$ as

$\displaystyle A(d)$ $\displaystyle:=\max_{S:\subset{\cal L}(d)}\\{|S|:S\hbox{
is pairwise-decodable.}\\}$ (36) $\displaystyle B(d)$
$\displaystyle:=\max_{S:\subset{\cal L}(d)}\\{|S|:S\hbox{ is pairwise-one-to-
one.}\\}$ (37)

The calculations of these values are another interesting open problem.

Indeed, a pairwise-decodable subset $S$ can be used to modify the one-hop
relay network as follows. That is, the calculation of $A(d)$ has the following
operational meaning. We modify the one-hop relay network by putting $|S|$
channels in the second step, and the code in the second step is defined by
$|S|$ anti-Latin matrices. In this case, we assume the following. Eve is
allowed to eavesdrop one edge in the first group and another edge in the
second group, adaptively. The receiver accesses only two edges in the second
group and the two edges are selected randomly. In this situation, the above
code based on a pairwise-decodable subset $S$ is imperfectly secret and
decodable.

## References

  * [1] N. Cai and R. Yeung, “Secure network coding,” Proc. 2002 IEEE Int. Symp. Information Theory (ISIT 2002), Lausanne, Swiss, July 2002, p. 323.
  * [2] N. Cai and R. W. Yeung, “Secure Network Coding on a Wiretap Network,” _IEEE Trans. Inform. Theory_ , vol. 57, no. 1, 424 – 435 (2011).
  * [3] R. W. Yeung and N. Cai, “On the optimality of a construction of secure network codes,” Proc. 2008 IEEE Int. Symp. Information Theory (ISIT 2008), Toronto, ON, Canada, Jul. 6 – 11, 2008, pp. 166 – 170.
  * [4] T. Chan and A. Grant, “Capacity bounds for secure network coding,” Proc. Australian Commun. Theory Workshop, Christchurch, NZ, Jan. 30 – Feb. 1, 2008, pp. 95 – 100.
  * [5] S. El Rouayheb, E. Soljanin, and A. Sprintson, “Secure network coding for wiretap, networks of type II,” _IEEE Trans. Inform. Theory_ , vol. 58, no. 3, pp. 1361 – 1371 (2012).
  * [6] J. Feldman, T. Malkin, C. Stein, and R. A. Servedio, “On the capacity of secure network coding,” Proc. 42nd Annu. Allerton Conf. Commun. Control Comput., Monticello, IL, Sep. 29 – Oct. 1, 2004.
  * [7] C.-K. Ngai, R. W. Yeung, and Z. Zhang, “Network generalized hamming weight,” Proc. Workshop Network Coding Theory Appl., Lausanne, Switzerland, 2009, pp. 48 – 53.
  * [8] K. Harada and H. Yamamoto, “Strongly secure linear network coding,” IEICE Trans. Fund., vol. E91-A, no. 10, pp. 2720 – 2728 (2008).
  * [9] N. Cai, “Valuable messages and random outputs of channels in linear network coding,” Proc. 2009 IEEE Int. Symp. Information Theory (ISIT 2009), Seoul, Korea, Jun. 28 – Jul. 3, 2009, pp. 413 – 417.
  * [10] N. Cai and T. Chan, “Theory of Secure Network Coding,” Proceedings of the IEEE, vol. 99, no. 3, 421 – 437 (2011).
  * [11] D. Silva and F. R. Kschischang, “Universal Secure Network Coding via Rank-Metric Codes,” _IEEE Trans. Inform. Theory_ , vol. 57, no. 2, 1124 – 1135 (2011).
  * [12] J. Kurihara, R. Matsumoto, and T. Uyematsu, “Relative generalized rank weight of linear codes and its applications to network coding,” _IEEE Trans. Inform. Theory_ , vol. 61, no. 7, pp. 3912 – 3936 (2013).
  * [13] R. Matsumoto and M. Hayashi, “Secure Multiplex Network Coding,” 2011 International Symposium on Networking Coding (2011): DOI: 10.1109/ISNETCOD.2011.5979076.
  * [14] R. Matsumoto and M. Hayashi, “Universal Secure Multiplex Network Coding with Dependent and Non-Uniform Messages,” _IEEE Trans. Inform. Theory_ , vol. 63, no. 6, pp. 3773 – 3782 (2017).
  * [15] M. Hayashi, M. Owari, G. Kato, and N. Cai, “Secrecy and Robustness for Active Attack in Secure Network Coding,” Proc. 2017 IEEE Int. Symp. Information Theory (ISIT 2017), Aachen, Germany, June, 25 – 30, 2017, pp. 1172 – 1177.
  * [16] M. Hayashi and N. Cai, “Asymptotically Secure Network Code for Active Attacks” IEEE Transactions on Communications, vol. 69, no. 5, pp. 3245 – 3259 (2021).
  * [17] M. Hayashi and N. Cai, “Secure non-linear network code over one-hop relay network,” IEEE Journal on Selected Areas in Information Theory vol. 2, no. 1, pp. 296 – 305 (2021).
  * [18] M. Hayashi, M. Owari, G. Kato, and N. Cai, “Reduction Theorem for Secrecy over Linear Network Code for Active Attacks,” Entropy, Information Theory, Probability and Statistics Section, Special Issue: Multiuser Information Theory III, 22 (9), 1053 (2020).
  * [19] N. Cai and M. Hayashi, “Secure Network Code for Adaptive and Active Attacks with No-Randomness in Intermediate Nodes,” _IEEE Trans. Inform. Theory_ , vol. 66, no. 3, pp. 1428 – 1448 (2020).
  * [20] N. Cai and M. Hayashi, “Corrections to “Secure Network Code for Adaptive and Active Attacks With No-Randomness in Intermediate Nodes” [Mar 20 1428-1448],” _IEEE Trans. Inform. Theory_ , vol. 66, no. 6, pp. 3954 – 3954 (2020).
  * [21] J. Wu, G.-L. Long, and M. Hayashi, “Quantum secure direct communication with private dense coding using a general preshared quantum state,” Physical Review Applied, vol. 17, 064011 (2022).
  * [22] Chi-Hang Fred Fung, Xiongfeng Ma, and H. F. Chau, “Practical issues in quantum-key-distribution postprocessing,” Phys. Rev. A, vol. 81, 012318 (2010).
  * [23] M. Hayashi, “Quantum-inspired secure wireless communication protocol under spatial and local Gaussian noise assumptions,” IEEE Access, vol. 10, 29040-29068 (2022).
  * [24] R. Ahlswede, N. Cai, S.-Y. R. Li, and R. W. Yeung, “Network Information Flow,” _IEEE Trans. Inform. Theory_ , vol. 46, no. 4, 1204 – 1216, (2000).
  * [25] S.-Y. R. Li, R. W. Yeung, and N. Cai, “Linear network coding,” _IEEE Trans. Inform. Theory_ , vol. 49, pp. 371 – 381, 2003.
  * [26] H. Yao, D. Silva, S. Jaggi, and M. Langberg, “Network Codes Resilient to Jamming and Eavesdropping,” IEEE/ACM Transactions on Networking, vol. 22, no. 6, 1978 - 1987 (2014).
  * [27] K. Bhattad, and K. R. Narayanan, “Weakly secure network coding,” 1st Workshop on Network Coding, Theory, and App., April 2005.
  * [28] N. Cai and R. W. Yeung, “A Security Condition for Multi-Source Linear Network Coding,” Proc. 2007 IEEE Int. Symp. Information Theory (ISIT 2007), Nice, France, June 2007, p. 561 – 565.
  * [29] T. Cui, T. Ho, and J. Kliewer, “Achievable strategies for general secure network coding,” Information Theory and Applications Workshop (ITA), 2010.
  * [30] T. Cui, T. Ho, and J. Kliewer, “On Secure Network Coding With Nonuniform or Restricted Wiretap Sets,” _IEEE Trans. Inform. Theory_ , vol. 59, pp. 166 – 176, (2013).
  * [31] T. S. Han, “Nonnegative entropy measures of multivariate symmetric correlations,” Inform. Contr., vol. 36, no. 2, pp. 133 – 156, 1978.
  * [32] L. H. Ozarow and A. D. Wyner, “Wire-tap channel II,” AT& T Bell Labs. Tech. J., vol. 63, pp. 2135 – 2157, 1984.
  * [33] A. Shamir, “How to share a secret,” Commun. ACM, vol. 22, no. 11, pp. 612 -– 613, 1979.
  * [34] G. R. Blakley, “Safeguarding cryptographic keys,” Proc. Int. Workshop Manag. Requirement Knowl. (MARK), Jun. 1979, pp. 313–317.
  * [35] G. R. Blakley and G. A. Kabatianski, “Ideal perfect threshold schemes and MDS codes,” Proc. 1995 IEEE Int. Symp. Information Theory (ISIT 1995), Whistler, BC, Canada, September, 17 – 22, 1995, pp. 77843.
  * [36] Q. Zhang, S. Kadhe, M. Bakshi, S. Jaggi, and A. Sprintson, “Coding against a limited-view adversary: The effect of causality and feedback,” Proc. 2015 IEEE Int. Symp. Information Theory (ISIT 2015), Hong Kong, Jun. 2015, pp. 2530 -– 2534.
  * [37] S. Song and M. Hayashi, “Capacity of Quantum Private Information Retrieval with Colluding Servers,” _IEEE Trans. Inform. Theory_ , vol. 67, no. 7, pp. 5491 – 5508 (2021).
  * [38] M. Hayashi and S. Song, “Unified Approach to Secret Sharing and Symmetric Private Information Retrieval With Colluding Servers in Quantum Systems,” _IEEE Trans. Inform. Theory_ , vol. 69, no. 10, pp. 6537 – 6563 (2023).


# Glueball molecules

Alexey A. Petrov  Department of Physics and Astronomy, Wayne State University,
Detroit, MI 48201, USA  Theoretical Physics Department, Fermilab, P.O. Box
500, Batavia, IL 60510, USA  Excellence Cluster ORIGINS, Technische
Universität Mun̈chen, Boltzmannstr. 2, D-85748 Garching, Germany

###### Abstract

Experimental searches for pure glueball states have proven challenging and so
far yielded no results. This is believed to occur because glueballs mix with
the ordinary $q\bar{q}$ states with the same quantum numbers. We will discuss
an alternative mechanism, the formation of the glueball-meson molecular
states. We will argue that the wave functions of already observed excited
meson states may contain a significant part due to such molecular states. We
discuss the phenomenology of glueball molecules and comment on a possible
charmless component of the $XYZ$ states.

††preprint: WSU-HEP-2202,FERMILAB-PUB-22-353-T-V

##  I Introduction

The existence of glueballs, strongly interacting states supposedly made of the
pure glue degrees of freedom, is expected in Quantum Chromodynamics (QCD).
This follows from the non-abelian nature of the theory, where the force
carriers are also charged under the color gauge group. Various studies of the
properties of glueballs have been performed both in lattice QCD and in other,
more model-dependent approaches. Despite various predictions for their
properties, no candidates for the pure glueball states have been
experimentally observed, even in such glue-rich environments as nuclear
collisions. Comprehensive reviews of the current state of theoretical
calculations of glueball properties and their experimental searches can be
found in Ochs:2013gi ; Klempt:2007cp ; Chen:2022asf .

Spectroscopic studies of glueballs Ochs:2013gi  suggest that possible quantum
numbers of the pure glue states, such as $0^{++},0^{+-},1^{--}$, etc., match
with those of the ordinary mesons, i.e., states built out of $q\bar{q}$ pairs.
This fact alone implies quantum mechanical mixing of such states.

Phenomenological studies of the spectrum of states above one GeV reveal that
no resonance that has been experimentally discovered so far could be
unambiguously classified as a pure glueball state. A consensus appears to be
reached that the admixture of pure glue and $q\bar{q}$ states is not tiny,
i.e., glueball can only appear as part of the wavefunction of ordinary meson
states above 1 GeV. Several studies of such mixing have been performed
Klempt:2021wpg ; Janowski:2011gt ; Parganlija:2012fy ; Cheng:2015iaa ;
Frere:2015xxa .

In this paper, we propose another possibility. We will prove that the
glueballs could also manifest themselves differently as glueball-meson
molecular states. Depending on the coupling of the glueball and meson states,
such molecular states may or may not exhibit a universal behavior predicted
for the $X(3872)$ or deuterium states. The molecular nature makes these states
distinct from the hybrid meson states.

For simplicity, here we shall concentrate on the lightest glueball state $G$,
the state with the quantum numbers of a scalar, $0^{++}$. This is probably the
most-studied state with various predictions for its mass and mixing patterns
with other meson scalar states, all pointing that this is the lightest
glueball state with a mass between 1 and 2 GeV. To determine the properties of
the molecular states, we shall employ the so-called extended SU(2) Linear
Sigma Model (eLSM) Janowski:2011gt ; Parganlija:2012fy . In this model, the
standard SU(2) linear sigma model is complemented by the scalar dilaton field
$G$, representing the glueball’s interpolating field. The parameters of the
dilaton-pion interactions are fixed by fitting the decay widths of the scalar
fields, whose masses and mixing parameters are fitted to the masses of
$f_{0}(1710)$, $f_{0}(1500)$, and $f_{)}(1370)$ states. The resulting lowest-
energy molecular state will have quantum numbers of the pseudoscalar,
$0^{-+}$, so we will denote it as ${\cal P}$ in what follows.

Has such a state been observed? We will argue that a light quark state
$\pi(1800)$ could have a significant ${\cal P}$ molecular component, which
could explain its somewhat narrow width, which is rather unusual for such a
massive light-quark $q\bar{q}$ state EugenioTalk . We will discuss the decay
patterns of glueball molecular states. Finally, we will comment on the
possible implications of glueball molecules with other quantum numbers.

##  II Sigma model and a molecular state

To describe pion-glueball interactions, we need to specify a framework in
which the description of the system would be done. This is especially
important for the description of the glueball states. As it turns out, a
symmetry-inspired description of the scalar $0^{++}$ glueball field is
possible and follows from the definition of the QCD trace anomaly. The pure
glue sector of classical QCD is invariant under a dilatation symmetry, which
is broken by quantum corrections. This results in the non-zero value of the
trace of the energy-momentum tensor $T^{\mu}_{\mu}$. The vacuum expectation
value of this trace is proportional to the value of the gluon condensate,

$\langle
T^{\mu}_{\mu}\rangle=-\frac{11N_{c}}{48}\left\langle\frac{\alpha_{s}}{\pi}G_{\mu\nu}^{a}G_{a}^{\mu\nu}\right\rangle\equiv-\frac{11N_{c}}{48}C^{4},$
(1)

where $C^{4}=(300-600\ \mbox{MeV})^{4}$ Janowski:2011gt ; Parganlija:2012fy .
An effective field theory can be built for the scalar field $G$, describing
the trace anomaly, where $G$ can be used as an interpolating field for the
scalar glueball.

It is convenient to employ the extended linear sigma model, whose parameters
have already been fitted to describe scalar-glueball mixing and glueball
decays Janowski:2011gt ; Parganlija:2012fy . As we shall see, no new
interaction terms are needed to describe the molecular ${\cal P}$ states.
Additional details on the choice of the Lagrangian and the parameter-fitting
procedure can be found in Janowski:2011gt ; Parganlija:2012fy .

The effective Lagrangian of the eLSM is

${\cal L}={\cal L}_{\rm LSM}+{\cal L}_{\rm dilaton}+{\cal L}_{\rm int},$ (2)

where the first term, ${\cal L}_{\rm LSM}$, corresponds to the Lagrangian of
the ordinary SU(2) linear sigma model (a generalization to the SU(3) LSM is
straightforward Parganlija:2012fy ),

$\displaystyle{\cal L}_{\rm LSM}$ $\displaystyle=$
$\displaystyle\mbox{Tr}\left[\left(\partial^{\mu}\Phi\right)^{\dagger}\left(\partial_{\mu}\Phi\right)\right]-\lambda_{1}\left(\mbox{Tr}\left[\Phi^{\dagger}\Phi\right]\right)^{2}$
$\displaystyle-$ $\displaystyle\lambda_{2}\
\mbox{Tr}\left[\left(\Phi^{\dagger}\Phi\right)^{2}\right]+\mbox{Tr}\left[H\left(\Phi^{\dagger}+\Phi\right)\right]$
$\displaystyle+$ $\displaystyle
c\left(\det(\Phi^{\dagger})+\det(\Phi)\right),$

where $\Phi$ contains both scalar $\sigma$ and ${a_{0}}_{i}$ and pseudoscalar
$\eta_{N}$ and $\pi_{i}$ fields,

$\Phi=(\sigma+i\eta_{N})t^{0}+(\vec{a}_{0}+i\vec{\pi})\cdot\vec{t},$ (4)

where $t^{0}$ and $t_{i}$ are the generators of U(2). Note that
$\eta_{N}=(\bar{u}u+\bar{d}d)/\sqrt{2}$ only contains non-strange degrees of
freedom. The last two terms in Eq. (II) represent the explicit breaking of
chiral symmetry $\mbox{Tr}\left[H\left(\Phi^{\dagger}+\Phi\right)\right]\sim
h\sigma$, where $h\sim m_{q}^{2}$ Janowski:2011gt ; Parganlija:2012fy , and a
contribution due to the chiral anomaly. Those terms also explicitly break
dilaton symmetry.

The effective Lagrangian for the dilaton field can be written as
Salomone:1980sp ; Migdal:1982jp

$\displaystyle{\cal L}_{\rm dilaton}$ $\displaystyle=$
$\displaystyle\frac{1}{2}\left(\partial_{\mu}\tilde{G}\right)^{2}-\frac{1}{4}\frac{m_{G}^{2}}{\Lambda^{2}}\left[\tilde{G}^{4}\log\left|\frac{\tilde{G}}{\Lambda}\right|-\frac{1}{4}\tilde{G}^{4}\right]$
(5) $\displaystyle=$
$\displaystyle\frac{1}{2}\left(\partial_{\mu}\tilde{G}\right)^{2}-V(\tilde{G}).$

The minimum of the dilaton potential $V(G)$ is at $\tilde{G}=G_{0}=\Lambda$.
Expanding around the minimum of the potential $\tilde{G}\to\Lambda+G$ we
obtain the effective Lagrangian for the field glueball field $G$ with the mass
parameter $m_{G}\sim 1.6$ GeV obtained from the lattice computations. It can
be related to the trace of the energy-momentum tensor, implying that
Janowski:2011gt ; Parganlija:2012fy

$\Lambda^{2}=\frac{11C^{4}}{4m_{G}^{2}}.$ (6)

The glueball-pion interaction piece ${\cal L}_{\rm int}$ can be written as

${\cal L}_{\rm int}=-m_{0}^{2}\
\mbox{Tr}\left[\left(\frac{\tilde{G}}{\Lambda}\right)^{2}\Phi^{\dagger}\Phi\right].$
(7)

This Lagrangian contains both glueball-pion and glueball-sigma interaction
terms, which are relevant for computing the properties of the molecular state
${\cal P}$. The $\pi\pi G^{2}$ interaction term can be directly read off Eq.
(7), while the $\sigma$-exchange interaction can be obtained from the
following procedure. Setting all fields but $\sigma$ and $G$ in Eq. (7) to
zero and shifting the remaining fields by their vacuum expectation values
(VEVs) $\tilde{G}\to G+G_{0}$ and $\sigma\to\sigma+\langle\sigma\rangle$ we
obtain the $\sigma GG$ interaction term,

${\cal L}_{\sigma
G}=-\frac{m_{0}^{2}\langle\sigma\rangle}{\Lambda^{2}}G^{2}\sigma+...$ (8)

The ellipses in Eq. (8) represent terms that are not relevant for building a
molecular state. However, they contain terms responsible for mixing glueballs
and $q\bar{q}$ states in this model. The terms generating the $\pi\pi\sigma$
vertex can also be obtained from Eq. (II) by shifting
$\sigma\to\sigma+\langle\sigma\rangle$, as in the usual LSM.

The local effective Lagrangian relevant for the scales $\mu<m_{\pi}$ can be
obtained by matching the $\pi G$ scattering amplitude and integrating out the
$\sigma$ field,

${\cal L}_{\rm\pi G}=-\lambda\pi^{2}G^{2},$ (9)

where the effective coupling $\lambda$ is given by

$\lambda=\frac{m_{0}^{2}}{2\Lambda^{2}}\left[1-\frac{\langle\sigma\rangle^{2}}{m_{\sigma}^{2}}\left(2\lambda_{1}+\lambda_{2}\right)\right].$
(10)

The numerical values of the parameters in Eq. (10) can be obtained from
Parganlija:2012fy . To compute the properties of the molecular states ${\cal
P}$, we will use the formalism employed in describing the properties of
deuterium Weinberg:1990rz  or $X(3872)$ state AlFiky:2005jd . In particular,
we will consider non-perturbative scattering amplitude for the scattering $\pi
G\to\pi G$. The pole of this amplitude, if exists, corresponds to the bound
state in the $\pi G$ channel, i.e., the molecular ${\cal P}$ state. The
transition amplitude can be obtained from the Lippmann-Schwinger equation (see
Fig. 1),

$iT_{\rm\pi G}=-i\lambda+\int\frac{d^{4}q}{(2\pi)^{4}}\left(iT_{\rm\pi
G}\right)G_{\rm\pi G}\left(-i\lambda\right)$ (11)

where $G_{\rm\pi G}$ is given by

$\displaystyle G_{\rm\pi G}=$ $\displaystyle-$
$\displaystyle\frac{1}{4m_{G}m_{\pi}}\frac{1}{E/2+q_{0}-\vec{q}^{2}/2m_{G}+i\epsilon}$
(12) $\displaystyle\times$
$\displaystyle\frac{1}{E/2-q_{0}-\vec{q}^{2}/2m_{\pi}+i\epsilon}.$

Here $E$ is the energy of the mesons in the center-of-mass frame. The solution
of Eq. (11) is

$T_{\rm\pi G}=\frac{\lambda}{1+i\lambda\widetilde{A}},$ (13)

$\widetilde{A}$ is the (divergent) integral given by

$\widetilde{A}=-\frac{i}{2}\frac{\mu_{\pi
G}}{m_{G}m_{\pi}}\int\frac{d^{3}q}{(2\pi)^{3}}\frac{1}{\vec{q}^{2}-2\mu_{\pi
G}E-i\epsilon},$ (14)

Figure 1: Transition amplitude for the $\pi G$ scattering written in the form
of a Lippmann-Schwinger equation.

where $\mu_{\pi G}$ is the reduced mass of the $\pi G$ system, and we have
used the residue theorem to evaluate the integral over $q_{0}$.

The integral in Eq. (14) diverges, so its divergence needs to be removed by
renormalizing the coupling $\lambda$. Following S. Weinberg Weinberg:1990rz ;
Weinberg:1991um , we choose to define the renormalized $\lambda_{R}$ in the MS
subtraction scheme in dimensional regularization AlFiky:2005jd . Computing the
integral of Eq. (14) in $d-1$ dimensions yields

$\widetilde{A}\to\widetilde{A}_{R}=\frac{ip}{8\pi}\frac{\mu_{\pi
G}}{m_{\pi}m_{G}},$ (15)

where $E=p^{2}/2\mu_{\pi G}$. This implies that the scattering amplitude
$T_{\pi G}$ which solves the Lippmann-Schwinger equation of Eq. (11) is

$T_{\pi G}=\frac{\lambda_{R}}{1+\frac{i\lambda_{R}}{8\pi}\frac{\mu_{\pi
G}}{m_{\pi}m_{G}}p}.$ (16)

The scattering amplitude of Eq. (16) has a pole, which corresponds to the
bound state with the energy

$E_{b}=\frac{32\pi^{2}m_{\pi}^{2}m_{G}^{2}}{\lambda_{R}^{2}\mu^{3}_{\pi G}}.$
(17)

Assuming a nonrelativistic bound state implies that the binding energy is
small. The mass of the molecular state ${\cal P}$ would then be

$m_{\cal P}=m_{G}+m_{\pi}-E_{b}.$ (18)

Since the bulk of theoretical predictions points to the glueball mass values
of $m_{G}\sim 1.6-1.7$ GeV Ochs:2013gi ; Klempt:2007cp ; Chen:2022asf , it is
natural to assume that the mass of the molecular state should be around
$m_{\cal P}\approx 1.8$ GeV. Interestingly, the state $\pi(1800)$ has the
correct quantum numbers and could be seen as a candidate for the glueball
molecular state.

##  III Phenomenology

In the previous section, we predicted the existence of the pseudoscalar
glueball molecular state ${\cal P}$ by identifying a pole in a $\pi G$
scattering amplitude. Yet, both $\pi$ and $G$ are not asymptotically stable
states. While the small width of the $\pi$, which only decays via weak
interactions, can be neglected, little is known about glueballs’ widths. With
the glueball decaying strongly, one can legitimately ask if the molecular
bound state has enough time to form at all. In general, one can argue that in
the large $N_{c}$ limit, the glueball widths scale like $1/N_{c}^{2}$, while
the $q\bar{q}$ meson widths scale only as $1/N_{c}$ Nussinov:2009tq . This
gives us confidence that the glueball molecular states can be formed. It must
be noted that the scalar glueball considered in this paper is uniquely linked
to trace anomaly, so its width could be computed Janowski:2011gt ;
Parganlija:2012fy .

It is interesting to consider the phenomenology of the glueball molecular
states. One complicating factor, however, exists. As we pointed out, quantum
mechanics requires that the states of different nature but the same quantum
numbers mix. If the molecular state mixes with $q\bar{q}$ or other states, all
predictions for the decay patterns will depend on the value of the mixing
angle(s). We can make predictions for the ratios of various two-body decays
assuming that a given physical state is dominated by its glueball-molecular
component. If so, the decay patterns of the state would be driven by the decay
patterns of the glueball component. In particular, postulating that ${\cal P}$
is the dominant component of the $\pi(1800)$ wave-function, we can determine
the ratios of its two-body decays into the $f_{0}$ states.

Since the $0^{++}$ glueball’s quantum numbers coincide with those of the
$f_{0}$ states, they should contain various admixtures of the glue component.
The studies of glueball-meson mixing were performed by several authors by
studying decays and the production of those states. The results of these
studies could be summarized in the following matrix equation,

$\mathbb{F}=\mathbb{M}\ \mathbb{Q},$ (19)

where
$\mathbb{F}=\\{\left|f_{0}(1370)\right\rangle,\left|f_{0}(1500)\right\rangle,\left|f_{0}(1710)\right\rangle\\}$
and
$\mathbb{Q}=\\{\left|\eta_{N}\right\rangle,\left|\bar{s}s\right\rangle,\left|G\right\rangle\\}$
are the columns for the meson and quark/glueball states, respctively. Note
that $\eta_{N}$ was defined in the previous section.

There are several studies that extract the mixing matrix $\mathbb{M}$. One
study Cheng:2015iaa ; Frere:2015xxa  finds that

$\mathbb{M}_{1}=\left(\begin{array}[]{ccc}0.78&0.51&-0.36\\\
-0.54&0.84&-0.03\\\ 0.32&0.18&0.93\end{array}\right).$ (20)

Alternatively, Janowski:2011gt ; Parganlija:2012fy  give a result for the
mixing matrix $\mathbb{M}$ that is somewhat similar to the one given in Eq.
(20),

$\mathbb{M}_{2}=\left(\begin{array}[]{ccc}0.79&-0.54&0.29\\\ 0.49&0.84&0.22\\\
-0.37&0.023&0.93\end{array}\right).$ (21)

It is interesting to note that both studies agree that the only acceptable
scenario is that $f_{0}(1710)$ state is mostly gluonic, which we used to
justify our assumption that the $\pi(1800)$ state is primarily a glueball
molecule state.

If glueball-molecular component ${\cal P}$ dominates, the decay amplitude
${\cal A}(\pi(1800)\to\pi f_{0})$ can be written as

${\cal A}(\pi(1800)\to\pi f_{0})=\langle f_{0}|G\rangle\langle\pi G|{\cal
H}|\pi(1800)\rangle,$ (22)

where $\langle f_{0}|G\rangle$ parameterizes the glue component of the $f_{0}$
state for different $f_{0}$ states, which can be obtained by inverting the
relation in Eq. (19),

$\displaystyle|G\rangle$ $\displaystyle=$ $\displaystyle\langle
f_{0}(1370|G\rangle\left|f_{0}(1370)\right\rangle$ $\displaystyle+$
$\displaystyle\langle f_{0}(1500)|G\rangle\left|f_{0}(1500)\right\rangle$
$\displaystyle+$ $\displaystyle\langle
f_{0}(1710)|G\rangle\left|f_{0}(1710)\right\rangle.$

Then, the ratio of branching ratios for the decays into $\pi f_{0}(1500)$ and
$\pi f_{0}(1370)$ final states would be completely determined by the glue
components of the two $f_{0}$ states, and the difference in phase space
available in each decay,

$\frac{{\cal B}(\pi(1800)\to\pi f_{0}(1500))}{{\cal B}(\pi(1800)\to\pi
f_{0}(1370))}=\left|\frac{\langle f_{0}(1500)|G\rangle}{\langle
f_{0}(1370)|G\rangle}\right|^{2}r_{p},$ (24)

where $r_{p}=p_{f_{0}(1500)}/p_{f_{0}(1500)}$ is the ratio of the phase space
factors for the two-body decay, which is given by the three-momenta of the
final state particles,

$p_{f_{0}}=\frac{\sqrt{\left(M^{2}-\left(m_{\pi}+m_{f_{0}}\right)^{2}\right)\left(M^{2}-\left(m_{\pi}-m_{f_{0}}\right)^{2}\right)}}{2M}$
(25)

Numerically, the ratio in Eq. (24) differs slightly depending on whether the
matrix from Eq. (20) or (21) is used to obtain Eq. (III),

$\frac{{\cal B}(\pi(1800)\to\pi f_{0}(1500))}{{\cal B}(\pi(1800)\to\pi
f_{0}(1370))}=(4\div 7)\times 10^{-3},$ (26)

where the first result corresponds to inverting $\mathbb{M}_{1}$, while the
second - to inverting $\mathbb{M}_{2}$. The trend, however, is similar. That
is, assuming that the glueball molecule dominates the $\pi(1800)$ wave
function, the branching ratio of ${\cal B}(\pi(1800)\to\pi f_{0}(1500))$ is
suppressed compared to ${\cal B}(\pi(1800)\to\pi f_{0}(1370))$.

##  IV Conclusions

We proposed the existence of a new family of hadronic states, the glueball
molecules. The existence of such states was justified by showing that the $\pi
G$ scattering amplitude contains the pole, whose position identifies the mass
of the state.

Based on the hypothesis that $\pi(1800)$ state contains a dominant ${\cal P}$
glueball molecular component, we predicted the ratio of decay branching ratios
to $\pi f_{0}(1500)$ and $\pi f_{0}(1370)$ states. We should note that the
main decay channels of a glueball molecular state should be driven by the
decays of its glueball component. In particular, we would expect the ratios of
decay widths into $3\pi$, $K\bar{K}\pi$, and $2\eta\pi$ final states to mainly
follow the quark counting rules for the glueball decays Ochs:2013gi .

There are some intriguing implications of this proposal. For example, it
provides additional insights into the puzzle of heavy $XYZ$ states, especially
those that decay into charmed mesons. A possible (if small) mixture of a
vector $1^{--}$ glueball state $G_{V}$ with a vector $c\bar{c}$ state
Suzuki:2002bz  could provide a glueball molecular component $\pi G_{V}$ of the
$X(3872)$ state containing no charmed quarks at all. This follows if the mass
of the vector glueball is $m_{G_{V}}\approx 3.8$ GeV, as suggested by some
lattice QCD studies Chen:2022asf . Such molecular states would also be
different from the hybrid meson states, which can also be described in the
framework of effective field theory Chiladze:1998ti . Other implications would
include the existence of the glueball molecular states with heavy (charm or
bottom) quarks. We will address these implications in a forthcoming
publication.

## Acknowledgments

We would like to thank Eric Swanson for his valuable comments. This research
was supported in part by the U.S. Department of Energy under contract DE-
SC0007983 and by the Excellence Cluster ORIGINS, which is funded by the
Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under
Germany’s Excellence Strategy - EXC-2094 - 390783311. It was also supported by
the Visiting Scholars Award Program of the Universities Research Association.
Fermilab is managed and operated by Fermi Research Alliance, LLC under
Contract No. DE-AC02-07CH11359 with the U.S. Department of Energy.

## References

  * (1) W. Ochs, J. Phys. G 40, 043001 (2013)
  * (2) E. Klempt and A. Zaitsev, Phys. Rept. 454, 1-202 (2007)
  * (3) H. X. Chen, W. Chen, X. Liu, Y. R. Liu and S. L. Zhu, [arXiv:2204.02649 [hep-ph]].
  * (4) E. Klempt and A. V. Sarantsev, Phys. Lett. B 826, 136906 (2022)
  * (5) S. Janowski, D. Parganlija, F. Giacosa and D. H. Rischke, Phys. Rev. D 84, 054007 (2011)
  * (6) D. Parganlija, P. Kovacs, G. Wolf, F. Giacosa and D. H. Rischke, Phys. Rev. D 87, no.1, 014011 (2013)
  * (7) H. Y. Cheng, C. K. Chua and K. F. Liu, Phys. Rev. D 92, no.9, 094006 (2015)
  * (8) J. M. Frère and J. Heeck, Phys. Rev. D 92, no.11, 114035 (2015)
  * (9) P. Eugenio, talk at APS 2016 April meeting.
  * (10) A. Salomone, J. Schechter and T. Tudron, Phys. Rev. D 23, 1143 (1981)
  * (11) A. A. Migdal and M. A. Shifman, Phys. Lett. B 114, 445-449 (1982)
  * (12) S. Nussinov, R. Shrock, Phys. Rev. D 80, 054003 (2009)
  * (13) F. Giacosa, Acta Phys. Polon. Supp. 10, 1021 (2017) doi:10.5506/APhysPolBSupp.10.1021 [arXiv:1708.03755 [hep-ph]].
  * (14) S. Weinberg, Phys. Lett. B 251, 288-292 (1990)
  * (15) S. Weinberg, Nucl. Phys. B 363, 3-18 (1991)
  * (16) M. T. AlFiky, F. Gabbiani and A. A. Petrov, Phys. Lett. B 640, 238 (2006)
  * (17) M. Suzuki, Phys. Rev. D 65, 097507 (2002)
  * (18) G. Chiladze, A. F. Falk and A. A. Petrov, Phys. Rev. D 58, 034013 (1998)