# Refined finite-size analysis of binary-modulation continuous-variable
quantum key distribution

Takaya Matsuura<EMAIL_ADDRESS>Department of Applied Physics,
Graduate School of Engineering, The University of Tokyo, 7-3-1 Hongo, Bunkyo-
ku, Tokyo 113-8656, Japan  Centre for Quantum Computation & Communication
Technology, School of Science, RMIT University, Melbourne VIC 3000, Australia
Shinichiro Yamano  Department of Applied Physics, Graduate School of
Engineering, The University of Tokyo, 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-8656,
Japan  Yui Kuramochi  Department of Physics, Faculty of Science, Kyushu
University, 744 Motooka, Nishi-ku, Fukuoka, Japan  Toshihiko Sasaki
Department of Applied Physics, Graduate School of Engineering, The University
of Tokyo, 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-8656, Japan  Photon Science
Center, Graduate School of Engineering, The University of Tokyo, 7-3-1 Hongo,
Bunkyo-ku, Tokyo 113-8656, Japan  Masato Koashi  Department of Applied
Physics, Graduate School of Engineering, The University of Tokyo, 7-3-1 Hongo,
Bunkyo-ku, Tokyo 113-8656, Japan  Photon Science Center, Graduate School of
Engineering, The University of Tokyo, 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-8656,
Japan

###### Abstract

Recent studies showed the finite-size security of binary-modulation CV-QKD
protocols against general attacks. However, they gave poor key-rate scaling
against transmission distance. Here, we extend the security proof based on the
complementarity, which is used in the discrete-variable QKD, to the previously
developed binary-modulation CV-QKD protocols with the reverse reconciliation
under the finite-size regime and obtain large improvements in the key rates.
Notably, the key rate in the asymptotic limit scales linearly against the
attenuation rate, which is known to be optimal scaling but is not achieved in
previous finite-size analyses. This refined security approach may offer full-
fledged security proofs for other discrete-modulation CV-QKD protocols.

##  1 Introduction

Quantum key distribution (QKD) [1] enables two remote parties to share
identical secret bits that are secure against arbitrary eavesdropping allowed
in the law of quantum mechanics. QKD combined with the one-time pad [2] can
thus realize the information-theoretic security of bipartite communication.
Nowadays, there is increasing interest in implementing QKD in the real world.
Among other things, continuous-variable (CV) QKD [3, 4, 5, 6, 7, 8, 9] has
advantages over short-distance high-bit-rate QKD due to the low cost of its
implementation and the affinity to the wavelength division multiplexing. This
is because homodyne and heterodyne detectors used in CV-QKD protocols do not
require a low-temperature environment and have good wavelength selectivity.
The (single-)photon detectors used in discrete-variable (DV) QKD, on the other
hand, typically require a low-temperature environment for stable operation and
a high-quality frequency filter for the wavelength division multiplexing.

The main problems of CV-QKD protocols are difficulties in their complete
security proofs. Compared to the DV-QKD protocols, most of which have complete
security proofs even in the finite-size regime, almost all the CV-QKD
protocols only have asymptotic security proofs [10, 11, 12, 13, 14, 15, 16,
17, 18, 19] or security proofs against collective attacks [20, 21, 22, 23, 24,
25]. There are, however, some results for the composable finite-size security
against general attacks. One is for the protocol using the two-mode squeezed
vacuum state [26, 27], whose security proof is based on the entropic
uncertainty relation on the infinite dimension [28]. Unfortunately, this
protocol has difficulty in its implementation and poor key-rate scaling
against the transmission distance. Another is for the $U(N)$-symmetric
protocol that uses coherent states with their complex amplitudes modulated
according to a Gaussian distribution [29, 21, 30]. The security proof for this
type of protocol utilizes the de Finetti reduction theorem [31, 32] to the
i.i.d. case. This methodology has proved the security of several
$U(N)$-invariant CV-QKD protocols [33, 34]. However, in practice, ideal
Gaussian modulation cannot be implemented and should be approximated by a
finite number of coherent states. It turns out that an overwhelming number of
coherent states is needed to directly approximate the Gaussian ensemble for
the security condition to be satisfied [35, 36]. If we try to mitigate the
required number, additional assumptions are needed, which makes it difficult
to apply it in the finite-size regime [15]. The other completely different
approach [37, 38] is targeted at the discrete-modulation CV QKD from the
beginning. Refs. [37, 38] show the finite-size security against general
attacks for a binary-modulation protocol. It also takes into account the
discretization of the signal processing, such as binned homodyne and
heterodyne measurements (see also [39] for this topic). Although it has a nice
feature, the obtained key rate has very poor scaling against transmission
distance. A possible reason for this bad performance is the fact that its
security proof is based on the entanglement distillation [40, 41]. It is known
that the security proof based on the entanglement distillation is too
stringent in general for secure key distribution. There are alternative types
of security proofs [42, 43, 44] that can be applied to general cases. In
particular, for CV-QKD protocols, the security proof based on the reverse
reconciliation often provides better performance than that based on the direct
reconciliation [10], which may be unattainable by a security proof based on
the entanglement distillation due to its symmetric nature between the sender
and the receiver in the security proof.

Contributions of this paper. In this article, we aim to develop another
approach to carry out the finite-size security proof for the discrete-
modulation CV QKD against general attacks. The approach should be able to
exploit the benefit of the reverse reconciliation. To do it concretely, we
develop refined security proofs based on the reverse reconciliation for the
binary-modulation CV-QKD protocols proposed in Refs. [37, 38], i.e., the
protocol in which the sender Alice performs BPSK-type modulation according to
her randomly generated bit and the receiver Bob performs homodyne measurement,
heterodyne measurement, and trash randomly [37], or performs heterodyne
measurement followed by a random selection of the post-processing of the
outcome [38]. We use the same apparatuses and setups as those in Refs. [37,
38] but slightly change the protocols. To refine the security proofs, we use
an approach based on the complementarity [43, 45] under the reverse
reconciliation, which is more general than the one based on the entanglement
distillation [46] and treats Alice and Bob asymmetrically in the security
proof. In these refined security proofs, we have degrees of freedom that did
not appear in the previous analyses. By setting these degrees of freedom to be
optimal in the pure-loss channel [47], we obtain a significant improvement in
the key gain rates; in fact, the asymptotic key rates of the protocols scale
linearly with regards to the attenuation rate of the pure-loss channel, which
is known to be the optimal scaling for the one-way QKD [47]. This shows that
we can exploit the benefit of using the reverse reconciliation in the approach
based on complementarity. Although the protocols are still fragile against the
excess noise, this approach itself may be a step towards the full-fledged
security proofs for discrete-modulation CV QKD.

Organization of this paper. The article is organized as follows. In Section 2,
we provide the refined security proofs based on the complementarity [43] for
protocols that use the same experimental setups as proposed in Refs. [37, 38].
The section is further divided into three parts. The first part 2.1 defines
the actual protocols, which are almost the same as the ones in Refs. [37, 38],
and develops virtual protocols for the complementarity approach [43]. In the
second part 2.2, we derive an explicit form of the phase error operator
defined by the virtual procedure of the previous part. In the third part 2.3,
we finish the finite-size security proof by developing operator inequalities.
In Section 3, we numerically demonstrate the improved performance of the
protocols with our refined security proof. Finally, in Section 4, we wrap up
our article by discussing future work and open problems.

##  2 Security proof

###  2.1 Actual, virtual, and estimation protocols

In this section, we define two binary-modulation CV-QKD protocols that are
closely related to the ones proposed in Refs. [37, 38], and present their
security proofs based on the reverse reconciliation. The definition of the
(composable) security is the same as that in Ref. [37]. The setups of the
protocols are illustrated in Fig. 1. In the following, a random number is
denoted with a hat such as $\hat{\cdot}$. For the places where the slash “/”
is used, one can adopt either its left-hand side or right-hand side depending
on which of “Homodyne protocol” or “Heterodyne protocol” defined in Fig. 1 one
chooses. Note that Homodyne protocol is the same as the protocol proposed in
Ref. [37] except for the definition of $f_{\rm suc}(x)$ as well as the way of
bit error correction, and Heterodyne protocol is the same as the protocol
proposed in Ref. [38] except for the additional trash round as well as the way
of bit error correction.

Figure 1: Setups of the protocols. In both protocols, the sender Alice
modulates the optical phase of a laser pulse prepared in a coherent state
$\ket{\mu}$ with $0$ or $\pi$ according to her random bit $\hat{a}=0$ or $1$.
(a) “Homodyne protocol”, which is similar to the protocol proposed in Ref.
[37]. In this protocol, the receiver Bob randomly switches three types of
measurements according to probability $p_{\rm sig}$, $p_{\rm test}$, and
$p_{\rm trash}$, respectively. In “Signal”, Bob performs homodyne measurement
and obtains the outcome $\hat{x}\in\mathbb{R}$. Then he obtains
$\hat{b}\in\\{0,1\\}$ with probability $f_{\rm
suc}\bigl{(}(-1)^{\hat{b}}\hat{x}\bigr{)}$, respectively, or announces
“Failure” with probability $1-f_{\rm suc}(\hat{x})-f_{\rm suc}(-\hat{x})$. In
“Test”, Bob performs heterodyne measurement and obtains the outcome
$\hat{\omega}\in\mathbb{C}$. Then he computes
$\Lambda_{m,r}\bigl{(}|\hat{\omega}-(-1)^{\hat{a}}|^{2}\bigr{)}$ with Alice’s
bit $\hat{a}$ announced. In “Trash”, Bob discards the received optical pulse
and produces no outcome. (b) “Heterodyne protocol”, which is similar to the
protocol proposed in Ref. [38]. In this protocol, the receiver Bob performs
heterodyne measurement, obtains the outcome $\hat{\omega}$, and randomly
switches three types of post-processings according to probability $p_{\rm
sig}$, $p_{\rm test}$, and $p_{\rm trash}$, respectively. In “Signal”, Bob
defines $\hat{x}=\mathrm{Re}[\hat{\omega}]$ and follows the same procedure of
obtaining the bit $b$ or “Failure” as in Homodyne protocol. In “Test”, Bob
follows the same procedure of computing
$\Lambda_{m,r}\bigl{(}|\hat{\omega}-(-1)^{\hat{a}}|^{2}\bigr{)}$ as in
Homodyne protocol. In “Trash”, Bob discards the outcome $\hat{\omega}$.

Prior to the protocol, Alice and Bob determine the number $N$ of total rounds,
the acceptance probability function $f_{\rm suc}(x)\ (x\in\mathbb{R})$ of the
homodyne/heterodyne measurement satisfying $f_{\rm suc}(x)+f_{\rm suc}(-x)\leq
1$, an odd integer $m$ and a real $r$ for the test function
$\Lambda_{m,r}(\nu)\coloneqq e^{-r\nu}(1+r)L_{m}^{(1)}((1+r)\nu)$ with
$L_{m}^{(1)}$ being the associated Laguerre polynomial [37], and the protocol
parameters $(\mu,p_{\rm sig},p_{\rm test},p_{\rm
trash},\beta,s,\kappa,\gamma)$ satisfying $p_{\rm sig}+p_{\rm test}+p_{\rm
trash}=1$ and $\beta<\sqrt{\mu}$, where all the parameters are positive. Alice
and Bob then run the protocol described in Box 1. Unless aborted, the protocol
generates a shared final key of length

$\hat{N}^{\rm fin}=\max\left\\{\hat{N}^{\rm suc}-\Bigl{\lceil}\hat{N}^{\rm
suc}h\\!\left(U(\hat{F},\hat{N}^{\rm trash})/\hat{N}^{\rm
suc}\right)\Bigr{\rceil}-s,0\right\\},$ (1)

where $\lceil\cdot\rceil$ is the ceiling function, the function $h(x)$ is
defined as

$h(x)\coloneqq\begin{cases}-x\log_{2}(x)-(1-x)\log_{2}(1-x)&(x\leq 1/2)\\\
1&(x>1/2)\end{cases},$ (2)

and the function $U(\hat{F},\hat{N}^{\rm trash})$ will be specified later.

Box 1: Actual protocol

  1. 1.

Alice generates a random bit $\hat{a}\in\\{0,1\\}$ and sends an optical pulse
$\tilde{C}$ in a coherent state with amplitude $(-1)^{\hat{a}}\sqrt{\mu}$ to
Bob. She repeats it for $N$ rounds. Bob receives an optical pulse $C$ for each
of the $N$ rounds.

  2. 2.

For the received pulse $C$ in each round, Bob chooses a label from
$\rm\\{signal,test,trash\\}$ with probabilities $p_{\rm sig},p_{\rm test}$,
and $p_{\rm trash}$, respectively, and announces it. According to the label,
Alice and Bob do one of the following procedures.

     * [signal]

Bob performs a homodyne/heterodyne measurement on the received optical pulse
$C$ and obtains an outcome $\hat{x}\in\mathbb{R}$. (For the heterodyne
measurement, $\hat{x}$ is defined as the real part of the outcome
$\hat{\omega}\in\mathbb{C}$.) Bob defines a sifted-key bit $\hat{b}$ as
$\hat{b}=0$ with a probability $f_{\rm suc}(\hat{x})$ and $\hat{b}=1$ with a
probability $f_{\rm suc}(-\hat{x})$. When Bob has defined his sifted key bit,
he announces “success”, and otherwise, he announces “failure”. In the case of
a success, Alice (resp. Bob) records a bit $\hat{a}$ $(\hat{b})$.

     * [test]

Bob performs a heterodyne measurement on the received optical pulse $C$ and
obtains an outcome $\hat{\omega}$. Alice announces her bit $a$. Bob calculates
the value of $\Lambda_{m,r}(|\hat{\omega}-(-1)^{\hat{a}}\beta|^{2})$.

     * [trash]

Alice and Bob produce no outcomes.

  3. 3.

We refer to the numbers of “success” and “failure” signal rounds, test rounds,
and trash rounds as $\hat{N}^{\rm suc},\hat{N}^{\rm fail},\hat{N}^{\rm test}$,
and $\hat{N}^{\rm trash}$, respectively. ($N=\hat{N}^{\rm suc}+\hat{N}^{\rm
fail}+\hat{N}^{\rm test}+\hat{N}^{\rm trash}$ holds by definition.) Bob
calculates the sum of $\Lambda_{m,r}(|\hat{\omega}-(-1)^{\hat{a}}\beta|^{2})$
obtained in the $\hat{N}^{\rm test}$ test rounds, which is denoted by
$\hat{F}$.

  4. 4.

For error correction, they use $H_{\rm EC}$-bits of encrypted communication
consuming a pre-shared secret key to do the following. According to (the upper
bound on) the bit error rate $e_{\rm qber}$, Bob randomly chooses an error-
correcting code and sends it with the $H_{\rm EC}$-bits syndrome to Alice.
Alice reconciles her sifted key accordingly.

  5. 5.

Bob computes and announces the final key length $\hat{N}^{\rm fin}$ according
to Eq. (1). Alice and Bob apply privacy amplification to obtain the final key.

For simplicity, we omitted the bit-error-sampling rounds in the above
protocol. To satisfy the required correctness $\varepsilon_{\rm cor}$ for the
final key, Alice and Bob randomly insert $N_{\rm smp}$ sampling rounds among
$N$ rounds in which Bob performs the same measurement as that of the signal
round and estimate an upper bound $e_{\rm qber}$ on the bit error rate. Let
$\hat{N}_{\rm smp}^{\rm suc}$ be the number of “success” in $N_{\rm smp}$
sampling rounds, and let $\hat{E}_{\rm obs}$ be the number of discrepancies
between Alice’s and Bob’s bits observed in the “success” sampling rounds.
Then, Bob sets $e_{\rm qber}$ to

$e_{\rm qber}=\left.\left(\tilde{M}_{\hat{N}^{\rm suc}+\hat{N}_{\rm smp}^{\rm
suc},\hat{N}_{\rm smp}^{\rm suc},\varepsilon_{\rm cor}/2}(\hat{E}_{\rm
obs})-\hat{E}_{\rm obs}\right)\right/\hat{N}^{\rm suc},$ (3)

where the function $\tilde{M}_{N,n,\epsilon}$ is defined in Eq. (101) in
Appendix A. The proof that this definition of $e_{\rm qber}$ upper-bounds the
actual bit error rate with probability no smaller than $1-\varepsilon_{\rm
cor}/2$ is also shown in Appendix A. The required amount $H_{\rm EC}$ of the
error syndrome Bob sends to Alice in the bit error correction depends on the
error correction method; here we assume

$H_{\rm EC}=\hat{N}^{\rm suc}\left[f\,h(e_{\rm qber})+(1-f)\right],$ (4)

where $f\in[0,1]$ denotes an error correction efficiency [48, 49, 16, 17, 18,
50] for the error correction to succeed with the probability no smaller than
$1-\varepsilon_{\rm cor}/2$. The net key gain $\hat{G}$ per pulse is thus
given by

$\hat{G}=(\hat{N}^{\rm fin}-H_{\rm EC})/(N+N_{\rm smp}).$ (5)

Here, we do not use verification in the post-processing, unlike Refs. [37,
38], due to the subtleties to incorporate it in our security proof. The
acceptance probability $f_{\rm suc}(x)$ should be chosen to post-select the
rounds with larger values of $x$, for which the bit error probability is
expected to be lower. The definition of $f_{\rm suc}(x)$ in this article
follows Ref. [38] and is slightly more general than that of Ref. [37]. (Note
that Ref. [37] can also use this definition of $f_{\rm suc}(x)$.) It is
ideally a step function with a threshold $x_{\mathrm{th}}(>0)$, but our
security proof applies to any form of $f_{\rm suc}(x)$. The test function
$\Lambda_{m,r}(\nu)$ is the same as the one defined in Ref. [37] where it is
shown to satisfy

$\mathbb{E}_{\rho}[\Lambda_{m,r}(|\hat{\omega}-\beta|^{2})]\leq\bra{\beta}\rho\ket{\beta}$
(6)

for any odd integer $m$, positive real $r$, and density operator $\rho$ (see
Corollary 1 in Ref. [37]). The parameter $\beta$ is typically chosen to be
$\sqrt{\eta\mu}$ with $\eta$ being a nominal transmissivity of the quantum
channel, while the security proof itself holds for any choice of $\beta$. The
parameter $s$ is related to the overall security parameter in the security
proof below.

We determine a sufficient amount of the privacy amplification according to the
complementarity, or in other words, the phase error correction [43, 45], which
has been widely used for the DV-QKD protocols. We aim at showing the secrecy
of Bob’s final key against the adversary Eve. To do so, we consider a virtual
protocol in which Bob has a qubit for each success signal round such that the
outcome of the $Z$-basis measurement on it is equivalent to his sifted key bit
$b$. Alice can do arbitrary quantum operations in the virtual protocol as long
as all the statistics and available information to the adversary Eve are the
same as those in the actual protocol. Then, after Bob’s $Z$-basis measurement
on the qubit, the reduced classical-quantum state between Bob and Eve in the
virtual protocol is the same as that in the actual protocol.

In the following, we explicitly describe the virtual protocol. For Alice, we
introduce a qubit $A$ and assume that she entangles it with an optical pulse
$\tilde{C}$ in a state

$\ket{\Psi}_{A\tilde{C}}\coloneqq\frac{\ket{0}_{A}\ket{\sqrt{\mu}}_{\tilde{C}}+\ket{1}_{A}\ket{-\sqrt{\mu}}_{\tilde{C}}}{\sqrt{2}},$
(7)

where $\ket{\omega}_{\tilde{C}}$ with $\omega\in\mathbb{C}$ denotes the
coherent state with the amplitude $\omega$, which is defined as

$\ket{\omega}_{\tilde{C}}\coloneqq
e^{-\frac{|\omega|^{2}}{2}}\sum_{n=0}^{\infty}\frac{\omega^{n}}{\sqrt{n!}}\ket{n}_{\tilde{C}}.$
(8)

Then, the optical pulse $\tilde{C}$ emitted by Alice is in the same state as
that in the actual protocol. For Bob, we construct a process of
probabilistically converting the received optical pulse $C$ to a qubit $B$,
which can be regarded as a coherent version of Bob’s signal measurement. For
Homodyne protocol, consider a map $\mathcal{K}_{C\to B}^{\rm hom}$ defined as
[37]

$\mathcal{K}_{C\to B}^{\rm hom}(x)(\rho_{C})\coloneqq K^{\rm hom}_{\rm
suc}(x)\,\rho_{C}\,\bigl{(}K^{\rm hom}_{\rm suc}(x)\bigr{)}^{\dagger}$ (9)

with

$K^{\rm hom}_{\rm suc}(x)\coloneqq\sqrt{f_{\rm
suc}(x)}\bigl{(}\ket{0}_{B}\\!\bra{x}_{C}+\ket{1}_{B}\\!\bra{-x}_{C}\bigr{)},$
(10)

where $\bra{x}$ maps a state vector to the value of its wave function at $x$;
i.e., for a coherent state vector $\ket{\omega}$, $\bra{x}$ acts as

$\braket{x}{\omega}=\left(\frac{2}{\pi}\right)^{\frac{1}{4}}\exp\\!\left[-(x-\omega_{r})^{2}+2i\omega_{i}x-i\omega_{r}\omega_{i}\right],$
(11)

where $\omega=\omega_{r}+i\omega_{i}$ with
$\omega_{r},\omega_{i}\in\mathbb{R}$. Let $\Pi_{\rm ev(od)}$ denote a
projection operator onto the subspace of even(odd) photon numbers. Since
$\bra{x}(\Pi_{\rm ev}-\Pi_{\rm od})=\bra{-x}$ holds, we have

$\displaystyle K^{\rm hom}_{\rm suc}(x)=\sqrt{2f_{\rm
suc}(x)}\bigl{(}\ket{+}_{B}\\!\bra{x}_{C}\Pi_{\rm
ev}+\ket{-}_{B}\\!\bra{x}_{C}\Pi_{\rm od}\bigr{)}.$ (12)

This defines an instrument $\mathcal{I}_{C\to B}^{\rm hom}$ for the process of
producing the outcome $\hat{x}$ and leaving $C$ in a post-measurement state;
i.e., given a measurable set $\Delta\subseteq\mathbb{R}$, the unnormalized
post-measurement state is given by

$\mathcal{I}_{C\to B}^{\rm
hom}(\Delta)(\rho_{C})=\int_{\Delta}dx\;\mathcal{K}_{C\to B}^{\rm
hom}(x)(\rho_{C})$ (13)

with $\mathrm{Tr}[\mathcal{I}_{C\to B}^{\rm hom}(\Delta)(\rho_{C})]$ being a
probability of “success” signal event with the outcome $\hat{x}\in\Delta$.
Similarly, for Heterodyne protocol, consider a map $\mathcal{K}_{C\to B}^{\rm
het}$ defined as [38]

$\mathcal{K}_{C\to B}^{\rm het}(\omega)(\rho_{C})\coloneqq K^{\rm het}_{\rm
suc}(\omega)\,\rho_{C}\bigl{(}K^{\rm het}_{\rm suc}(\omega)\bigr{)}^{\dagger}$
(14)

with

$\begin{split}K^{\rm het}_{\rm suc}(\omega)&\coloneqq\sqrt{\frac{f_{\rm
suc}(\omega_{r})}{\pi}}\bigl{(}\ket{0}_{B}\\!\bra{\omega}_{C}+\ket{1}_{B}\\!\bra{-\omega}_{C}\bigr{)}\\\
&=\sqrt{\frac{2f_{\rm
suc}(\omega_{r})}{\pi}}\left(\ket{+}_{B}\\!\bra{\omega}_{C}\Pi_{\rm
ev}+\ket{-}_{B}\\!\bra{\omega}_{C}\Pi_{\rm od}\right),\end{split}$ (15)

where $\ket{\omega}$ denotes a coherent state vector and
$\omega=\omega_{r}+i\omega_{i}$ with $\omega_{r},\omega_{i}\in\mathbb{R}$.
Similarly to Homodyne protocol, we can define an instrument $\mathcal{I}_{C\to
B}^{\rm het}$ composed of the heterodyne outcome and the (unnormalized) post-
measurement state, which is given by

$\mathcal{I}_{C\to B}^{\rm
het}(\Delta^{\prime})(\rho_{C})=\int_{\Delta^{\prime}}d\omega_{r}d\omega_{i}\;\mathcal{K}_{C\to
B}^{\rm het}(\omega)(\rho_{C}),$ (16)

where $\Delta^{\prime}\subseteq\mathbb{R}^{2}$ is a measurable set. If Bob
measures the qubit $B$ on the $Z$ basis after the instrument (13) (resp.
(16)), he obtains the same sifted key bit with the same probability as in the
actual protocol when $\hat{x}\in\Delta$ (resp.
$\hat{\omega}\in\Delta^{\prime}$) [37, 38].

At this point, one has a degree of freedom to perform quantum operations on
the system $AB$ for each outcome $\hat{x}$ (resp. $\hat{\omega}$) as long as
it does not change the $Z$-basis value of the qubit $B$. This is because we
aim at showing the secrecy of Bob’s final key against the adversary Eve with
Alice’s system traced out. Thus, after applying the map ${\cal K}_{C\to
B}^{\rm hom}$ (resp. ${\cal K}_{C\to B}^{\rm het}$), we assume that Alice and
Bob perform a controlled isometry $V_{B;A\to R}^{\rm hom}(x)$ (resp.
$V_{B;A\to R}^{\rm het}(\omega)$) of the form

$\displaystyle V_{B;A\to R}^{\rm hom}(x)$
$\displaystyle\coloneqq\left[\ket{0}\\!\bra{0}_{B}\otimes V^{(0)}_{A\to
R}(x)+\ket{1}\\!\bra{1}_{B}\otimes V^{(1)}_{A\to R}(x)\right]\text{C-}X_{BA}$
(17) $\displaystyle V_{B;A\to R}^{\rm het}(\omega)$
$\displaystyle\coloneqq\left[\ket{0}\\!\bra{0}_{B}\otimes V^{\prime(0)}_{A\to
R}(\omega)+\ket{1}\\!\bra{1}_{B}\otimes V^{\prime(1)}_{A\to
R}(\omega)\right]\text{C-}X_{BA},$ (18)

where $\text{C-}X_{BA}\coloneqq\ket{0}\\!\bra{0}_{B}\otimes
I_{A}+\ket{1}\\!\bra{1}_{B}\otimes X_{A}$ denotes the Controlled-NOT gate and
$V^{(j)}_{A\to R}(x)$ (resp. $V^{\prime(j)}_{A\to R}(\omega)$) for $j=0,1$
denotes an isometry from the system $A$ to another system $R$ that is no
smaller than $A$ 111Here, a subtlety for using the verification comes in. In
order to know whether verification succeeds or not, Alice has to confirm the
syndrome bits for the verification. However, this procedure may not commute
with the action of $V_{B;A\to R}^{\rm hom}(x)$ (resp. $V_{B;A\to R}^{\rm
het}(\omega)$). We do not currently have a method to evaluate how much the
verification affects the secrecy condition.. If $V^{(j)}_{A\to R}(x)$ (resp.
$V^{\prime(j)}_{A\to R}(\omega)$) is an identity, then the analysis reduces to
the previous results [37, 38]. Let ${\cal V}_{B;A\to R}^{\rm hom}(x)$ (resp.
${\cal V}_{B;A\to R}^{\rm het}(\omega)$) be an adjoint action (i.e., a CPTP
map) for the isometry $V_{B;A\to R}^{\rm hom}(x)$ (resp. $V_{B;A\to R}^{\rm
het}(\omega)$). The composition of the map ${\cal V}_{B;A\to R}^{\rm hom}(x)$
and the map (9) (resp. the mad ${\cal V}_{B;A\to R}^{\rm het}(\omega)$ and the
map (14)) with Alice’s system traced out at the end defines a quantum
operation ${\cal F}^{\rm hom}_{AC\to B}$ (resp. ${\cal F}^{\rm het}_{AC\to
B}$) that (probabilistically) outputs Bob’s qubits for his sifted key as

$\displaystyle{\cal F}^{\rm hom}_{AC\to B}(\rho_{AC})$
$\displaystyle=\int_{-\infty}^{\infty}dx\;{\cal K}^{\prime\,\rm hom}_{AC\to
B}(x)(\rho_{AC}),$ (19) $\displaystyle{\cal F}^{\rm het}_{AC\to B}(\rho_{AC})$
$\displaystyle=\iint_{-\infty}^{\infty}d\omega_{r}d\omega_{i}\;{\cal
K}^{\prime\,\rm het}_{AC\to B}(x)(\rho_{AC}),$ (20)

with ${\cal K}^{\prime\,\rm hom}_{AC\to B}(x)$ (resp. ${\cal K}^{\prime\,\rm
het}_{AC\to B}(\omega)$) given by

$\displaystyle{\cal K}^{\prime\,\rm hom}_{AC\to B}(x)(\rho_{AC})$
$\displaystyle\coloneqq\mathrm{Tr}_{R}\left[{\cal V}_{B;A\to R}^{\rm
hom}(x)\circ\bigl{(}\mathrm{Id}_{A}\otimes{\cal K}^{\rm hom}_{C\to
B}(x)\bigr{)}(\rho_{AC})\right],$ (21) $\displaystyle{\cal K}^{\prime\,\rm
het}_{AC\to B}(\omega)(\rho_{AC})$
$\displaystyle\coloneqq\mathrm{Tr}_{R}\left[{\cal V}_{B;A\to R}^{\rm
het}(\omega)\circ\bigl{(}\mathrm{Id}_{A}\otimes{\cal K}^{\rm het}_{C\to
B}(\omega)\bigr{)}(\rho_{AC})\right],$ (22)

where $\mathrm{Id}$ denotes the identity map. Note that the idea of acting the
isometry $V_{B;A\to R}^{\rm hom}(x)$ or $V_{B;A\to R}^{\rm het}(\omega)$ is
closely related to the twisting operation on the shield system [51, 52, 53,
54, 55]. The difference is that in our case it acts on the system $A$ in a way
that is incompatible with the $Z$-basis measurement on $A$. This is allowed in
a security proof based on the complementarity since what we need to prove in
the virtual protocol is that the outcome of the $Z$-basis measurement on $B$
is secret to Eve when the system $A$ is traced out [43]; i.e., the system $A$
works as a shield system.

We then introduce a virtual protocol that explicitly incorporates the action
of ${\cal F}^{\rm hom}_{AC\to B}$ in Eq. (19) (resp. ${\cal F}^{\rm
het}_{AC\to B}$ in Eq. (20)) in Box 2.

Box 2: Virtual protocol

  1. $1^{\prime}$.

Alice prepares a qubit $A$ and an optical pulse $\tilde{C}$ in a state
$\ket{\Psi}_{A\tilde{C}}$ defined in (7) and sends the pulse $\tilde{C}$ to
Bob. She repeats it for $N$ rounds. Bob receives an optical pulse $C$ for each
of the $N$ rounds.

  2. $2^{\prime}$.

For the received pulse $C$ in each round, Bob announces a label in the same
way as that at Step 2. Alice and Bob do one of the following procedures
according to the label.

     * [signal]

Alice and Bob perform the quantum operation on the system $A$ and the received
pulse $C$ specified by the map ${\cal F}^{\rm hom}_{AC\to B}$ defined in Eq.
(19) (resp. ${\cal F}^{\rm het}_{AC\to B}$ defined in Eq. (20)) to determine
success or failure of detection, obtain the qubit $B$ upon success, and
perform the controlled isometry given in Eq. (17) (resp. Eq. (18)). Bob
announces the success or failure of the detection.

     * [test]

Bob performs a heterodyne measurement on the received optical pulse $C$, and
obtains an outcome $\hat{\omega}$. Alice measures her qubit $A$ on $Z$ basis
and announces the outcome $\hat{a}\in\\{0,1\\}$. Bob calculates the value of
$\Lambda_{m,r}(|\hat{\omega}-(-1)^{\hat{a}}\beta|^{2})$.

     * [trash]

Alice measures her qubit $A$ on $X$ basis to obtain
$\hat{a}^{\prime}\in\\{+,-\\}$.

  3. $3^{\prime}$.

$\hat{N}^{\rm suc},\hat{N}^{\rm fail},\hat{N}^{\rm test},\hat{N}^{\rm trash}$,
and $\hat{F}$ are defined in the same way as those at Step 3. Let
$\hat{Q}_{-}$ be the number of rounds with $\hat{a}^{\prime}=-$ among the
$\hat{N}^{\rm trash}$ trash rounds.

  4. $4^{\prime}$.

According to (the upper bound on) the bit error rate $e_{\rm qber}$, Bob
performs $H_{\rm EC}$ bits of encrypted communication consuming a pre-shared
secret key to send a dummy message.

  5. $5^{\prime}$.

Bob computes and announces the final key length $\hat{N}^{\rm fin}$ according
to Eq. (1). Bob performs a randomly chosen unitary on his qubits (see the main
text), and measures the first $\hat{N}^{\rm fin}$ qubits on the $Z$ bases.

In the last line of Step $5^{\prime}$, the random choice of a unitary is
constructed so that, along with the subsequent $\hat{N}^{\rm fin}$-qubit
measurement on the $Z$ bases, it is equivalent to the privacy amplification.
This is possible because for any $n\times n$ linear transformation $C$ on the
$n$-bit sequence, there always exists a corresponding unitary $U(C)$ that
satisfies $U(C)\ket{\bm{z}}=\ket{C\bm{z}}$ on the $Z$ basis. As has already
been claimed, if Eve performs the same attacks as those in the actual
protocol, the resulting classical-quantum state between Bob and Eve is the
same as that in the actual protocol.

The complementarity argument [43] in a reverse reconciliation scenario relates
the amount of privacy amplification to the so-called phase error patterns of
Bob’s qubits. Suppose that, just before the $Z$-basis measurement at Step
$5^{\prime}$ of the virtual protocol, Bob’s quantum state on the first
$\hat{N}^{\rm fin}$ qubits is arbitrarily close to
$\ket{+}\\!\bra{+}^{\otimes\hat{N}^{\rm fin}}$. Then, the secrecy condition of
the final key is satisfied [43, 45, 56]. For this to be true, the errors on
the $X$ bases (i.e., the phase errors) on Bob’s qubits should be corrected by
the procedure at Step $5^{\prime}$ of the virtual protocol. To see the
correctability of the phase errors at Step $5^{\prime}$, suppose that Bob
measured his $\hat{N}^{\rm suc}$ qubits on the $X$ basis
$\\{\ket{+},\ket{-}\\}$ at the end of Step $3^{\prime}$, and obtained a
sequence of $+$ and $-$. The minuses in the sequence are regarded as phase
errors. It has already been known that, if we can find an upper bound on the
number of possible phase-error patterns, then we can prove the security [43].
To make the argument more precise, we introduce the estimation protocol in Box
3.

Box 3: Estimation protocol

  1. $1^{\prime\prime}$.

Alice prepares a qubit $A$ and an optical pulse $\tilde{C}$ in a state
$\ket{\Psi}_{A\tilde{C}}$ defined in (7) and sends the pulse $\tilde{C}$ to
Bob. She repeats it for $N$ rounds. Bob receives an optical pulse $C$ for each
of the $N$ rounds.

  2. $2^{\prime\prime}$.

For the received pulse $C$ in the $i$th round ($i=1,\ldots,N$), Bob announces
a label in the same way as that at Step 2. Alice and Bob do one of the
following procedures according to the label and obtain the values of random
variables $\hat{N}^{{\rm suc}\,(i)}_{\rm ph}$, $\hat{F}^{(i)}$, and
$\hat{Q}_{-}^{(i)}$. Unless explicitly written, these random variables are set
to be zeros.

     * [signal]

Alice and Bob do the same procedure as that at “signal” of Step $2^{\prime}$.
Upon “success”, Bob performs the $X$-basis measurement on qubit $B$ and
obtains $\hat{b}^{\prime}\in\\{+,-\\}$. When $\hat{b}^{\prime}=-$,
$\hat{N}^{{\rm suc}\,(i)}_{\rm ph}$ is set to be unity.

     * [test]

Alice and Bob do the same procedure as that at “test” of Step $2^{\prime}$.
Then $\hat{F}^{(i)}$ is set to be
$\Lambda_{m,r}(|\hat{\omega}-(-1)^{\hat{a}}\beta|^{2})$.

     * [trash]

Alice does the same procedure as that at “trash” of Step $2^{\prime}$. When
$\hat{a}^{\prime}=-$, $\hat{Q}_{-}^{(i)}$ is set to be unity.

  3. $3^{\prime\prime}$.

Same as Steps $3^{\prime}$ of the virtual protocol. Note that
$\hat{F}=\sum_{i=1}^{N}\hat{F}^{(i)}$ and
$\hat{Q}_{-}=\sum_{i=1}^{N}\hat{Q}_{-}^{(i)}$ hold.

  4. $4^{\prime\prime}$.

Regarding $+$ as zero and $-$ as unity for each $\hat{b}^{\prime}$ in success
signal round, define the $\hat{N}^{\rm suc}$-bit sequence $\hat{\bm{x}}_{\rm
ph}$. Let $\hat{N}^{\rm suc}_{\rm ph}$ be the Hamming weight of
$\hat{\bm{x}}_{\rm ph}$, i.e., $\hat{N}^{\rm suc}_{\rm
ph}=\sum_{i=1}^{N}\hat{N}^{{\rm suc}\,(i)}_{\rm ph}$.

The task of proving the security of the actual protocol is then reduced to
constructing a function $U(\hat{F},\hat{N}^{\rm trash})$ that satisfies

${\rm Pr}\left[\hat{N}_{\rm ph}^{\rm suc}\leq U(\hat{F},\hat{N}^{\rm
trash})\right]\geq 1-\epsilon$ (23)

for any attack in the estimation protocol and setting the final-key length to
$\hat{N}^{\rm fin}=\hat{N}^{\rm suc}-H_{\rm PA}-s$, where $H_{\rm PA}$ is
defined as

$H_{\rm PA}\coloneqq\Bigl{\lceil}\hat{N}^{\rm
suc}h\\!\left(U(\hat{F},\hat{N}^{\rm trash})/\hat{N}^{\rm
suc}\right)\Bigr{\rceil}.$ (24)

In fact, if the condition (23) is satisfied, then the number of possible
phase-error patterns can be bounded from above by $2^{H_{\rm PA}}$ [57].
Therefore, by extracting the $(H_{\rm PA}+s)$-bit error syndrome of
$\hat{\bm{x}}_{\rm ph}$ using the universal2 hash function, Bob could uniquely
identify $\hat{\bm{x}}_{\rm ph}$ with a failure probability no smaller than
$1-2^{-s}$ [43, 58, 46, 44]. In the virtual protocol, the quantum operations
at Step $5^{\prime}$ can be made equivalent to the $(\hat{N}^{\rm
suc}-\hat{N}^{\rm fin})$-bit syndrome extraction via the universal2 hash
function and the error correction on the $X$ bases of $\hat{N}^{\rm fin}$
qubits. Since a unitary $U(C^{-1})$ that acts as the matrix $C^{-1}$ on the
$Z$ bases acts as $C^{\top}$ on the $X$ bases, i.e.,
$U(C^{-1})\ket{\bm{x}_{X}}=\ket{C^{\top}\bm{x}_{X}}$ where ${\cdot}_{X}$
denotes the $X$ basis, this procedure corresponds to the privacy amplification
via the dual universal2 hashing on the $Z$ bases [58, 44] (i.e., in the actual
protocol). Combining these, the condition (23) implies that the actual
protocol with the final key length given in Eq. (1) is
$\epsilon_{\mathrm{sec}}$-secure with a security parameter
$\epsilon_{\mathrm{sec}}=\sqrt{2}\sqrt{\epsilon+2^{-s}}+\epsilon_{\rm cor}$
[43, 45, 56]. From now on, we thus focus on the estimation protocol for
finding a function $U(\hat{F},\hat{N}^{\rm trash})$ to satisfy Eq. (23).

###  2.2 Phase error operator

In this section, we explain how our new security analysis can be reduced to
the previous analyses carried out in Refs. [37, 38] with a tighter operator
inequality. The number of phase errors depends on the choice of the controlled
isometry $V_{B;A\to R}^{\rm hom}(x)$ (resp. $V_{B;A\to R}^{\rm het}(\omega)$)
in the virtual and the estimation protocol. We here take a suboptimal
strategy; fix $V_{B;A\to R}^{\rm hom}(x)$ (resp. $V_{B;A\to R}^{\rm
het}(\omega)$) so that the probability of the phase error event
$\hat{b}^{\prime}=-$ in the estimation protocol is minimized for an ideal
pure-loss channel [47] with transmission $\eta=\beta^{2}/\mu$. When the state
$\ket{\Psi}_{A\tilde{C}}$ in Eq. (7) is put into a pure-loss channel with the
channel output being $\ket{\pm\beta}_{C}$, the resulting state
$\ket{\Phi}_{ACE}$ on systems $A,C$, and an adversary’s system $E$ (i.e., an
environment of the pure-loss channel) is given by

$\ket{\Phi}_{ACE}=\frac{1}{\sqrt{2}}\left(\ket{0}_{A}\Ket{\beta}_{C}\Ket{\sqrt{\mu-\beta^{2}}}_{E}+\ket{1}_{A}\Ket{-\beta}_{C}\Ket{-\sqrt{\mu-\beta^{2}}}_{E}\right).$
(25)

Tracing out the system $E$, the reduced state $\Phi_{AC}$ is given by

$\Phi_{AC}=(1-q_{\mu,\beta})\ket{\phi_{+}}\\!\bra{\phi_{+}}_{AC}+q_{\mu,\beta}\ket{\phi_{-}}\\!\bra{\phi_{-}}_{AC},$
(26)

where

$\displaystyle\ket{\phi_{+}}_{AC}$
$\displaystyle\coloneqq\frac{1}{\sqrt{2}}(\ket{0}\ket{\beta}+\ket{1}\ket{-\beta})=\ket{+}_{A}\otimes\Pi_{\rm
ev}\ket{\beta}_{C}+\ket{-}_{A}\otimes\Pi_{\rm od}\ket{\beta}_{C},$ (27)
$\displaystyle\ket{\phi_{-}}_{AC}$
$\displaystyle\coloneqq\frac{1}{\sqrt{2}}(\ket{0}\ket{\beta}-\ket{1}\ket{-\beta})=\ket{+}_{A}\otimes\Pi_{\rm
od}\ket{\beta}_{C}+\ket{-}_{A}\otimes\Pi_{\rm ev}\ket{\beta}_{C}=(Z_{A}\otimes
I_{C})\ket{\phi_{+}}_{AC},$ (28)

and

$q_{\mu,\beta}\coloneqq\frac{1-e^{-2(\mu-\beta^{2})}}{2}(>0).$ (29)

For Homodyne protocol, we observe that

$\displaystyle\text{C-}X_{BA}\,\bigl{(}{\rm Id}_{A}\otimes\mathcal{K}_{C\to
B}^{\rm hom}(x)\bigr{)}(\Phi_{AC})\,\text{C-}X_{BA}$ (30)
$\displaystyle\begin{split}&=2f_{\rm
suc}(x)\,\text{C-}X_{BA}\left[(1-q_{\mu,\beta})\,\hat{P}\bigl{(}\bra{x}\Pi_{\rm
ev}\ket{\beta}\ket{++}_{AB}+\bra{x}\Pi_{\rm
od}\ket{\beta}\ket{--}_{AB}\bigr{)}\right.\\\ &\hskip
99.58464pt\left.+q_{\mu,\beta}\,\hat{P}\bigl{(}\bra{x}\Pi_{\rm
od}\ket{\beta}\ket{+-}_{AB}+\bra{x}\Pi_{\rm
ev}\ket{\beta}\ket{-+}_{AB}\bigr{)}\right]\text{C-}X_{BA}\end{split}$ (31)
$\displaystyle\begin{split}&=2f_{\rm
suc}(x)\left[(1-q_{\mu,\beta})\,\hat{P}\bigl{(}\bra{x}\Pi_{\rm
ev}\ket{\beta}\ket{+}_{A}+\bra{x}\Pi_{\rm
od}\ket{\beta}\ket{-}_{A}\bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\right.\\\
&\hskip 99.58464pt\left.+q_{\mu,\beta}\,\hat{P}\bigl{(}\bra{x}\Pi_{\rm
od}\ket{\beta}\ket{+}_{A}+\bra{x}\Pi_{\rm
ev}\ket{\beta}\ket{-}_{A}\bigr{)}\otimes\ket{-}\\!\bra{-}_{B}\right]\end{split}$
(32) $\displaystyle\begin{split}&=f_{\rm
suc}(x)\left[(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}+\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\right.\\\
&\hskip
99.58464pt\left.+q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}-\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\otimes\ket{-}\\!\bra{-}_{B}\right],\end{split}$
(33)

where $\hat{P}(\psi)\coloneqq\psi\psi^{\dagger}$ (and thus
$\hat{P}(\ket{\psi})=\ket{\psi}\\!\bra{\psi}$), and $g_{m,V}$ is the normal
distribution with the mean $m$ and the variance $V$, i.e.,

$g_{m,V}(x)\coloneqq\frac{1}{\sqrt{2\pi
V}}\exp\left[-\frac{(x-m)^{2}}{2V}\right].$ (34)

We define $\tau_{AB}^{\rm hom}(x)$ as

$\begin{split}\tau_{AB}^{\rm
hom}(x)\coloneqq&(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}+\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\\\
&\hskip
99.58464pt+q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}-\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\otimes\ket{-}\\!\bra{-}_{B}.\end{split}$
(35)

From Eqs. (17), (21), (33), and (35), the probability density of an outcome
$x$ with occurrence of the phase error is given by

$\displaystyle\mathrm{Tr}\Bigl{[}\ket{-}\\!\bra{-}_{B}\,{\cal K}^{\prime\,\rm
hom}_{AC\to B}(x)(\Phi_{AC})\Bigr{]}$
$\displaystyle\begin{split}&=\frac{f_{\rm
suc}(x)}{2}\,\mathrm{Tr}\Bigl{[}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{0}_{B}+\bra{1}_{B}\tau_{AB}^{\rm hom}(x)\ket{1}_{B}\\\
&\qquad-\left(V_{A\to R}^{(1)}(x)\right)^{\dagger}V_{A\to
R}^{(0)}(x)\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}-\bra{1}_{B}\tau_{AB}^{\rm hom}(x)\ket{0}_{B}\left(V_{A\to
R}^{(0)}(x)\right)^{\dagger}V_{A\to R}^{(1)}(x)\Bigr{]}\end{split}$ (36)
$\displaystyle=f_{\rm
suc}(x)\left[\frac{1}{2}\;\mathrm{Tr}\left(\tau_{AB}^{\rm
hom}(x)\right)-\mathrm{Re}\left(\mathrm{Tr}\left[\left(V_{A\to
R}^{(1)}(x)\right)^{\dagger}V_{A\to R}^{(0)}(x)\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\right]\right)\right]$ (37) $\displaystyle\geq f_{\rm
suc}(x)\left[\frac{1}{2}\;\mathrm{Tr}\left(\tau_{AB}^{\rm
hom}(x)\right)-\left\|\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\right\|_{1}\right],$ (38)

where the last inequality follows from the matrix Hölder inequality. If we
write the polar decomposition of $\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}$ by $W_{A}^{\rm hom}(x)\bigl{|}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\bigr{|}$, the equality in (38) can be achieved by setting

$\left(V_{A\to R}^{(1)}(x)\right)^{\dagger}V_{A\to R}^{(0)}=\left(W_{A}^{{\rm
hom}}(x)\right)^{\dagger}.$ (39)

From Eq. (35), $\bra{0}_{B}\tau_{AB}^{\rm hom}(x)\ket{1}_{B}$ is given by

$\begin{split}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}&=\frac{1}{2}\left[(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}+\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\right.\\\
&\hskip
85.35826pt\left.-q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/4}(x)}\ket{0}_{A}-\sqrt{g_{-\beta,1/4}(x)}\ket{1}_{A}\Bigr{)}\right],\end{split}$
(40)

which is hermitian with two eigenvalues having opposite signs. Let
$\ket{u_{+}^{\rm hom}(x)}_{A}$ and $\ket{u_{-}^{\rm hom}(x)}_{A}$ be
eigenvectors of $\bra{0}_{B}\tau_{AB}^{\rm hom}(x)\ket{1}_{B}$ with positive
and negative eigenvalues, respectively. Then, $W_{A}^{\rm hom}(x)$ is given by

$W_{A}^{\rm hom}(x)=\ket{u_{+}^{\rm hom}(x)}\\!\bra{u_{+}^{\rm
hom}(x)}_{A}-\ket{u_{-}^{\rm hom}(x)}\\!\bra{u_{-}^{\rm hom}(x)}_{A}.$ (41)

The explicit form of $\ket{u_{\pm}^{\rm hom}(x)}_{A}$ is given in Eq. (151) in
Appendix B. The choice of the isometry $V_{A\to R}^{(j)}(x)$ to satisfy Eq.
(39) is not unique; one of the reasons is the arbitrariness of the dimension
of the system $R$. Here, we set $R=A$ and set

$\begin{split}V_{A\to R}^{(0)}(x)&=I_{A},\\\ V_{A\to R}^{(1)}(x)&=W_{A}^{\rm
hom}(x),\end{split}$ (42)

which, with Eqs. (17) and (41), leads to

$V^{\rm hom}_{B;A\to A}(x)=\left[\ket{u_{+}^{\rm hom}(x)}\\!\bra{u_{+}^{\rm
hom}(x)}_{A}\otimes I_{B}+\ket{u_{-}^{\rm hom}(x)}\\!\bra{u_{-}^{\rm
hom}(x)}_{A}\otimes Z_{B}\right]\text{C-}X_{BA}.$ (43)

For Heterodyne protocol, the calculation similar to Eqs. (30)–(35) leads to

$\displaystyle\text{C-}X_{BA}\,\bigl{(}{\rm Id}_{A}\otimes\mathcal{K}_{C\to
B}^{\rm het}(\omega)\bigr{)}(\Phi_{AC})\,\text{C-}X_{BA}$ (44)
$\displaystyle\begin{split}&=\frac{2f_{\rm
suc}(\omega_{r})}{\pi}\,\text{C-}X_{BA}\left[(1-q_{\mu,\beta})\,\hat{P}\bigl{(}\bra{\omega}\Pi_{\rm
ev}\ket{\beta}\ket{++}_{AB}+\bra{\omega}\Pi_{\rm
od}\ket{\beta}\ket{--}_{AB}\bigr{)}\right.\\\ &\hskip
113.81102pt\left.+q_{\mu,\beta}\,\hat{P}\bigl{(}\bra{\omega}\Pi_{\rm
od}\ket{\beta}\ket{+-}_{AB}+\bra{\omega}\Pi_{\rm
ev}\ket{\beta}\ket{-+}_{AB}\bigr{)}\right]\text{C-}X_{BA}\end{split}$ (45)
$\displaystyle\begin{split}&=\frac{f_{\rm
suc}(\omega_{r})}{\pi}\left[(1-q_{\mu,\beta})\,\hat{P}\bigl{(}\braket{\omega}{\beta}\ket{0}_{A}+\braket{-\omega}{\beta}\ket{1}_{A}\bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\right.\\\
&\hskip
113.81102pt\left.+q_{\mu,\beta}\,\hat{P}\bigl{(}\braket{\omega}{\beta}\ket{0}_{A}-\braket{-\omega}{\beta}\ket{1}_{A}\bigr{)}\otimes\ket{-}\\!\bra{-}_{B}\right],\end{split}$
(46)

Since
$\braket{\omega}{\beta}=e^{-\frac{1}{2}[(\omega_{r}-\beta)^{2}+\omega_{i}^{2}+2i\omega_{i}\beta]}$
is not real in general, we insert a $\theta$-rotation around the $Z$ basis

$R^{Z}_{A}(\theta)\coloneqq\exp(-i\theta Z_{A}/2)$ (47)

in order to have

$\displaystyle\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger}\text{C-}X_{BA}\,\bigl{(}{\rm
Id}_{A}\otimes\mathcal{K}_{C\to B}^{\rm
het}(\omega)\bigr{)}(\Phi_{AC})\,\text{C-}X_{BA}\,R^{Z}_{A}(2\omega_{i}\beta)$
(48) $\displaystyle\begin{split}&=\frac{e^{-\omega_{i}^{2}}f_{\rm
suc}(\omega_{r})}{\sqrt{\pi}}\left[(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}+\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\right.\\\
&\hskip
99.58464pt\left.+q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}-\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\otimes\ket{-}\\!\bra{-}_{B}\right].\end{split}$
(49)

We define $\tau_{AB}^{\rm het}(\omega_{r})$ as

$\begin{split}\tau_{AB}^{\rm
het}(\omega_{r})&\coloneqq(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}+\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\otimes\ket{+}\\!\bra{+}_{B}\\\
&\hskip
99.58464pt+q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}-\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\otimes\ket{-}\\!\bra{-}_{B}.\end{split}$
(50)

Thus, the structure of the matrix $\tau_{AB}^{\rm het}(\omega_{r})$ is
essentially the same as $\tau_{AB}^{\rm hom}(x)$ of Homodyne protocol. In the
same way as Homodyne protocol, the probability density of outcome $\omega$
with the occurrence of a phase error is given by

$\displaystyle\mathrm{Tr}\Bigl{[}\ket{-}\\!\bra{-}_{B}\,{\cal K}^{\prime\,\rm
het}_{AC\to B}(\omega)(\Phi_{AC})\Bigr{]}$
$\displaystyle=\frac{e^{-\omega_{i}^{2}}f_{\rm
suc}(\omega_{r})}{\sqrt{\pi}}\left[\frac{1}{2}\;\mathrm{Tr}\left(\tau_{AB}^{\rm
het}(\omega_{r})\right)\right.$ (51) $\displaystyle\hskip
85.35826pt\left.-\mathrm{Re}\left(\mathrm{Tr}\left[\bigl{(}V^{\prime(1)}_{A\to
R}(\omega_{r})\bigr{)}^{\dagger}V^{\prime(0)}_{A\to
R}(\omega_{r})R^{Z}_{A}(2\omega_{i}\beta)\bra{0}_{B}\tau_{AB}^{\rm
het}(\omega_{r})\ket{1}_{B}\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger}\right]\right)\right]$
(52) $\displaystyle\geq\frac{e^{-\omega_{i}^{2}}f_{\rm
suc}(\omega_{r})}{\sqrt{\pi}}\left[\frac{1}{2}\;\mathrm{Tr}\left(\tau_{AB}^{\rm
het}(\omega_{r})\right)-\left\|\bra{0}_{B}\tau_{AB}^{\rm
het}(\omega_{r})\,\ket{1}_{B}\right\|_{1}\right].$ (53)

If we write the polar decomposition of $\bra{0}_{B}\tau_{AB}^{\rm
het}(\omega_{r})\,\ket{1}_{B}$ by $W_{A}^{\rm
het}(\omega_{r})\bigl{|}\bra{0}_{B}\tau_{AB}^{\rm
het}(\omega_{r})\,\ket{1}_{B}\bigr{|}$, then the equality of Eq. (53) can be
achieved by setting

$\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger}\left(V^{\prime(1)}_{A\to
R}(\omega)\right)^{\dagger}V^{\prime(0)}_{A\to
R}(\omega)R^{Z}_{A}(2\omega_{i}\beta)=\left(W_{A}^{\rm
het}(\omega_{r})\right)^{\dagger}.$ (54)

From Eq. (50), $\bra{0}_{B}\tau_{AB}^{\rm het}(\omega_{r})\,\ket{1}_{B}$ is
given by

$\begin{split}\bra{0}_{B}\tau_{AB}^{\rm
het}(\omega_{r})\,\ket{1}_{B}&=\frac{1}{2}\left[(1-q_{\mu,\beta})\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}+\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\right.\\\
&\hskip
85.35826pt\left.-q_{\mu,\beta}\,\hat{P}\Bigl{(}\sqrt{g_{\beta,1/2}(\omega_{r})}\ket{0}_{A}-\sqrt{g_{-\beta,1/2}(\omega_{r})}\ket{1}_{A}\Bigr{)}\right],\end{split}$
(55)

which is hermitian. Let $\ket{u_{+}^{\rm het}(\omega_{r})}_{A}$ and
$\ket{u_{-}^{\rm het}(\omega_{r})}_{A}$ be eigenvectors of
$\bra{0}_{B}\tau_{AB}^{\rm het}(\omega_{r})\,\ket{1}_{B}$ with positive and
negative eigenvalues, respectively. Then, $W_{A}^{\rm het}(\omega_{r})$ is
given by

$W_{A}^{\rm het}(\omega_{r})=\ket{u_{+}^{\rm
het}(\omega_{r})}\\!\bra{u_{+}^{\rm het}(\omega_{r})}_{A}-\ket{u_{-}^{\rm
het}(\omega_{r})}\\!\bra{u_{-}^{\rm het}(\omega_{r})}_{A}.$ (56)

We can choose $V^{\prime(j)}_{A\to R}(\omega)$ to satisfy Eq. (54) in the same
way as Homodyne protocol. We set $R=A$ and set

$\begin{split}V^{\prime(0)}_{A\to
R}(\omega)&=\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger},\\\
V^{\prime(1)}_{A\to R}(\omega)&=W_{A}^{\rm
het}(\omega_{r})\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger},\end{split}$
(57)

which, with Eqs. (18) and (56), leads to

$V^{\rm het}_{B;A\to A}(\omega)=\left[\ket{u_{+}^{\rm
het}(\omega_{r})}\\!\bra{u_{+}^{\rm het}(\omega_{r})}_{A}\otimes
I_{B}+\ket{u_{-}^{\rm het}(\omega_{r})}\\!\bra{u_{-}^{\rm
het}(\omega_{r})}_{A}\otimes
Z_{B}\right]\left(R^{Z}_{A}(2\omega_{i}\beta)\right)^{\dagger}\text{C-}X_{BA}.$
(58)

As explained previously, we set $V_{A\to R}^{(j)}(x)$ to the one in Eq. (42)
(resp. $V^{\prime(j)}_{A\to R}(\omega)$ to the one in Eq. (57)) also for
arbitrary channels, i.e., arbitrary coherent attacks by Eve. This choice is
suboptimal for general channels but is expected to be close to optimal for
channels that are close to the pure-loss one. Now that the controlled isometry
$V_{B;A\to A}^{\rm hom}(x)$ (resp. $V_{B;A\to A}^{\rm het}(\omega)$) is fixed,
we can interpret the event that Bob announces “success” and obtains
$\hat{b}^{\prime}=-$ (i.e., the phase error) at the signal round of Estimation
protocol as the outcome of a generalized measurement on Alice’s qubit $A$ and
the optical pulse $C$ and define the corresponding POVM element $M_{\rm
ph}^{\rm hom/het}$ through Eq. (19) (resp. Eq. (20)) as

$\displaystyle M^{\rm hom}_{\rm ph}$ $\displaystyle\coloneqq{\cal F}^{{\rm
hom}\;\ddagger}_{AC\to
B}\bigl{(}\ket{-}\\!\bra{-}_{B}\bigr{)}=\int_{-\infty}^{\infty}dx\,\left({\cal
K}^{\prime\,\rm hom}_{AC\to
B}(x)\right)^{\ddagger}\bigl{(}\ket{-}\\!\bra{-}_{B}\bigr{)},$ (59)
$\displaystyle M^{\rm het}_{\rm ph}$ $\displaystyle\coloneqq{\cal F}^{{\rm
het}\;\ddagger}_{AC\to
B}\bigl{(}\ket{-}\\!\bra{-}_{B}\bigr{)}=\iint_{-\infty}^{\infty}d\omega_{r}\,d\omega_{i}\,\left({\cal
K}^{\prime\,\rm het}_{AC\to
B}(\omega)\right)^{\ddagger}\bigl{(}\ket{-}\\!\bra{-}_{B}\bigr{)},$ (60)

where $\ddagger$ denotes the adjoint map. Then, for any density operator
$\rho$ on the joint system $AC$, $M_{\rm ph}^{\rm hom}$ (resp. $M_{\rm
ph}^{\rm het}$) satisfies

$\mathbb{E}_{\rho}\left[\hat{N}^{{\rm suc}\,(i)}_{\rm ph}\right]=p_{\rm
sig}\mathrm{Tr}\\!\left[\rho\,M_{\rm ph}^{\rm hom/het}\right]$ (61)

in Homodyne (resp. Heterodyne) protocol. For Homodyne protocol, by using Eqs.
(9), (21), and (43), we have

$\displaystyle M^{\rm hom}_{\rm ph}$
$\displaystyle=\int_{-\infty}^{\infty}dx\,\left[I_{A}\otimes\bigl{(}K^{\rm
hom}_{\rm suc}(x)\bigr{)}^{\dagger}\right]\bigl{(}V^{\rm hom}_{B;A\to
A}(x)\bigr{)}^{\dagger}\bigl{(}I_{A}\otimes\ket{-}\\!\bra{-}_{B}\bigr{)}V^{\rm
hom}_{B;A\to A}(x)\left[I_{A}\otimes K^{\rm hom}_{\rm suc}(x)\right]$ (62)
$\displaystyle\begin{split}&=\int_{-\infty}^{\infty}dx\left[\hat{P}\\!\left(\bigl{[}I_{A}\otimes\bigl{(}K^{\rm
hom}_{\rm suc}(x)\bigr{)}^{\dagger}\bigr{]}\,\text{C-}X_{BA}\ket{u_{+}^{\rm
hom}(x)}_{A}\otimes\ket{-}_{B}\right)\right.\\\ &\hskip
85.35826pt\left.+\hat{P}\left(\bigl{[}I_{A}\otimes\bigl{(}K^{\rm hom}_{\rm
suc}(x)\bigr{)}^{\dagger}\bigr{]}\,\text{C-}X_{BA}\ket{u_{-}^{\rm
hom}(x)}_{A}\otimes\ket{+}_{B}\right)\right],\end{split}$ (63)

where we used the fact that the adjoint map of the tracing-out
$\mathrm{Tr}_{A}$ is taking the tensor product with $I_{A}$. Using the
relation $\text{C-}X_{BA}=\ket{+}\\!\bra{+}_{A}\otimes
I_{B}+\ket{-}\\!\bra{-}_{A}\otimes Z_{B}$ as well as Eq. (12), we have

$\begin{split}M^{\rm hom}_{\rm ph}&=\int_{-\infty}^{\infty}2f_{\rm
suc}(x)dx\left[\hat{P}\\!\left(\Pi^{(+,{\rm od}),(-,{\rm
ev})}_{AC}\ket{u_{+}^{\rm hom}(x)}_{A}\otimes\ket{x}_{C}\right)\right.\\\
&\hskip 113.81102pt\left.+\hat{P}\\!\left(\Pi^{(-,{\rm od}),(+,{\rm
ev})}_{AC}\ket{u_{-}^{\rm
hom}(x)}_{A}\otimes\ket{x}_{C}\right)\right],\end{split}$ (64)

where two orthogonal projections $\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$
and $\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$ are defined as

$\displaystyle\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$
$\displaystyle\coloneqq\ket{+}\\!\bra{+}_{A}\otimes\Pi_{\rm
od}+\ket{-}\\!\bra{-}_{A}\otimes\Pi_{\rm ev},$ (65)
$\displaystyle\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$
$\displaystyle\coloneqq\ket{-}\\!\bra{-}_{A}\otimes\Pi_{\rm
od}+\ket{+}\\!\bra{+}_{A}\otimes\Pi_{\rm ev}.$ (66)

A similar relation holds for Heterodyne protocol by replacing $K^{\rm
hom}_{\rm suc}(x)$ with $K^{\rm het}_{\rm suc}(\omega)$ and $V_{B;A\to A}^{\rm
hom}(x)$ with $V_{B;A\to A}^{\rm het}(\omega)$ as well as using Eqs. (15),
(58), (65), and (66):

$\displaystyle\begin{split}M^{\rm het}_{\rm
ph}&=\iint_{-\infty}^{\infty}d\omega_{r}d\omega_{i}\left[\hat{P}\\!\left(\left[I_{A}\otimes\bigl{(}K^{\rm
het}_{\rm
suc}(\omega)\bigr{)}^{\dagger}\right]\text{C-}X_{BA}\,R^{Z}_{A}(2\omega_{i}\beta)\ket{u_{+}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{-}_{B}\right)\right.\\\ &\hskip
99.58464pt\left.+\hat{P}\\!\left(\left[I_{A}\otimes\bigl{(}K^{\rm het}_{\rm
suc}(\omega)\bigr{)}^{\dagger}\right]\text{C-}X_{BA}\,R^{Z}_{A}(2\omega_{i}\beta)\ket{u_{-}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{+}_{B}\right)\right]\end{split}$ (67)
$\displaystyle\begin{split}&=\iint_{-\infty}^{\infty}\frac{2f_{\rm
suc}(\omega_{r})}{\pi}d\omega_{r}d\omega_{i}\left[\hat{P}\\!\left(\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}R^{Z}_{A}(2\omega_{i}\beta)\ket{u_{+}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{\omega}_{C}\right)\right.\\\ &\hskip
142.26378pt\left.+\hat{P}\\!\left(\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}R^{Z}_{A}(2\omega_{i}\beta)\ket{u_{-}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{\omega}_{C}\right)\right].\end{split}$ (68)

Using Eq. (11), we observe that

$\displaystyle\frac{1}{\pi}\int d\omega_{i}\exp(\pm
2i\omega_{i}\beta)\ket{\omega}\\!\bra{\omega}$
$\displaystyle=\frac{1}{\pi}\iiint
d\omega_{i}dxdx^{\prime}\sqrt{\frac{2}{\pi}}e^{\pm
2i\omega_{i}\beta-(x-\omega_{r})^{2}+2i\omega_{i}x-(x^{\prime}-\omega_{r})^{2}-2i\omega_{i}x^{\prime}}\ket{x}\\!\bra{x^{\prime}}$
(69) $\displaystyle=2\iint
dxdx^{\prime}\,\delta(2(x\pm\beta-x^{\prime}))\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x^{\prime}}\\!\bra{x^{\prime}}$
(70) $\displaystyle=\int
dx\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x\pm\beta}\\!\bra{x\pm\beta}.$
(71)

Applying this to Eq. (68) and changing the integration variable appropriately,
we have

$\begin{split}M^{\rm het}_{\rm ph}&=\iint_{-\infty}^{\infty}2f_{\rm
suc}(\omega_{r})d\omega_{r}dx\left[\hat{P}\left(\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}O_{AC}^{\beta}(x)\ket{u_{+}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{\omega_{r}}_{C}\right)\right.\\\ &\hskip
142.26378pt\left.+\hat{P}\left(\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}O_{AC}^{\beta}(x)\ket{u_{-}^{\rm
het}(\omega_{r})}_{A}\otimes\ket{\omega_{r}}_{C}\right)\right],\end{split}$
(72)

where the operator $O_{AC}^{\beta}(x)$ is defined as

$O_{AC}^{\beta}(x)\coloneqq\ket{0}\\!\bra{0}_{A}\otimes\ket{x}\\!\bra{x}_{C}+\ket{1}\\!\bra{1}_{A}\otimes\ket{x-\beta}\\!\bra{x-\beta}_{C}.$
(73)

###  2.3 Finite-size analysis

Since the phase error operator was defined on systems $A$ and $C$, we can
follow essentially the same analysis as that in Ref. [37]. Let us define the
following operators:

$\displaystyle\Pi^{\rm fid}$
$\displaystyle\coloneqq\ket{0}\\!\bra{0}_{A}\otimes\ket{\beta}\\!\bra{\beta}_{C}+\ket{1}\\!\bra{1}_{A}\otimes\ket{-\beta}\\!\bra{-\beta}_{C}$
(74)
$\displaystyle=\ket{\phi_{-}}\\!\bra{\phi_{-}}_{AC}+\ket{\phi_{+}}\\!\bra{\phi_{+}}_{AC},$
(75) $\displaystyle\Pi^{\rm trash}_{-}$
$\displaystyle\coloneqq\ket{-}\\!\bra{-}_{A}\otimes I_{C},$ (76)

where $\ket{\phi_{\pm}}_{AC}$ are defined in Eqs. (27) and (28). For any
density operator $\rho$ on the joint system $AC$, these operators satisfy

$\displaystyle\mathbb{E}_{\rho}\left[\hat{F}^{(i)}\right]$ $\displaystyle\leq
p_{\rm test}\mathrm{Tr}\\!\left[\rho\,\Pi^{\rm fid}\right],$ (77)
$\displaystyle\mathbb{E}_{\rho}\left[\hat{Q}_{-}^{(i)}\right]$
$\displaystyle=p_{\rm trash}\mathrm{Tr}\\!\left[\rho\,\Pi^{\rm
trash}_{-}\right],$ (78)

where the first inequality follows from Theorem 1 in Ref. [37] as well as the
definition of $\hat{F}^{(i)}$. Let $M^{\rm hom/het}[\kappa,\gamma]$ for
positive numbers $\kappa$ and $\gamma$ determined prior to the protocol be
defined as

$M^{\rm hom/het}[\kappa,\gamma]\coloneqq M^{\rm hom/het}_{\rm
ph}+\kappa\Pi^{\rm fid}-\gamma\Pi^{\rm trash}_{-}.$ (79)

In Corollaries 2 and 3 in Appendix B, we show an inequality

$M^{\rm hom/het}[\kappa,\gamma]\leq B^{\rm hom/het}(\kappa,\gamma)\,I_{AC}$
(80)

with a computable convex function $B^{\rm hom/het}(\kappa,\gamma)$. Let
$\hat{T}^{(i)}[\kappa,\gamma]$ be a linear combination of random variables at
$i$th round in Estimation protocol given by

$\hat{T}^{(i)}[\kappa,\gamma]\coloneqq p_{\rm sig}^{-1}\hat{N}_{\rm ph}^{{\rm
suc}\,(i)}+p_{\rm test}^{-1}\kappa\hat{F}^{(i)}-p_{\rm
trash}^{-1}\gamma\hat{Q}_{-}^{(i)}.$ (81)

Furthermore, let $\hat{T}^{(0)}[\kappa,\gamma]$ be zero. Then, by applying
Azuma’s inequality [59, 60, 61] with Doob decomposition to
$\\{\hat{T}^{(k)}[\kappa,\gamma]\\}_{k=0,\ldots,N}$ and using Eqs. (61), (77),
(78), and (80), we observe that

$\sum_{k=1}^{N}\hat{T}^{(k)}[\kappa,\gamma]=p_{\rm sig}^{-1}\hat{N}_{\rm
ph}^{\rm suc}+p_{\rm test}^{-1}\kappa\hat{F}-p_{\rm
trash}^{-1}\gamma\hat{Q}_{-}\leq NB^{\rm
hom/het}(\kappa,\gamma)+\delta_{1}(\epsilon/2),$ (82)

holds with a probability no smaller than $1-\epsilon/2$. (See Proposition 1 as
well as Eqs. (92)–(105) in Ref. [37].) Here, $\delta_{1}(\epsilon)$ is defined
as [37]

$\delta_{1}(\epsilon)\coloneqq\left(\max\Bigl{\\{}p_{\rm sig}^{-1},p_{\rm
test}^{-1}\kappa\,\max_{\nu\geq
0}\Lambda_{m,r}(\nu)\Bigr{\\}}-\min\Bigl{\\{}p_{\rm
test}^{-1}\kappa\,\min_{\nu\geq 0}\Lambda_{m,r}(\nu),-p_{\rm
trash}^{-1}\gamma\Bigr{\\}}\right)\sqrt{\frac{N}{2}\ln\\!\left(\frac{1}{\epsilon}\right)}.$
(83)

Since $\hat{Q}_{-}$ is determined solely by Alice’s qubits, each in the state
$\mathrm{Tr}_{\tilde{C}}(\ket{\Phi}\\!\bra{\Phi}_{A\tilde{C}})$ with
$\ket{\Phi}_{A\tilde{C}}$ given in Eq. (7), it follows the same statistics as
a tally of $\hat{N}^{\rm trash}$ Bernoulli trials with a probability
$q_{-}\coloneqq\|\bra{-}_{A}\ket{\Psi}_{A\tilde{C}}\|^{2}=(1-e^{-2\mu})/2$.
Hence we observe that

$\hat{Q}_{-}\leq q_{-}\hat{N}^{\rm trash}+\delta_{2}(\epsilon/2;\hat{N}^{\rm
trash})$ (84)

holds with a probability no smaller than $1-\epsilon/2$. (See Eq. (31) in Ref.
[37].) Here, $\delta_{2}(\epsilon;n)$ is defined as [37]

$\begin{cases}D(q_{-}+\delta_{2}(\epsilon;n)/n\|q_{-})=-\frac{1}{n}\log_{2}(\epsilon)&(\epsilon>q_{-}^{n})\\\
\delta_{2}(\epsilon;n)=(1-q_{-})n&(\epsilon\leq q_{-}^{n})\end{cases},$ (85)

where

$D(x\|y)\coloneqq x\log_{2}\frac{x}{y}+(1-x)\log_{2}\frac{1-x}{1-y}$ (86)

is the Kullback-Leibler divergence. Combining Eqs. (81), (82), and (84), by
setting

$U(\hat{F},\hat{N}^{\rm trash})=p_{\rm sig}\bigl{(}NB^{\rm
hom/het}(\kappa,\gamma)+\delta_{1}(\epsilon/2)\bigr{)}-\frac{p_{\rm
sig}}{p_{\rm test}}\kappa\hat{F}+\frac{p_{\rm sig}}{p_{\rm
trash}}\gamma\bigl{(}q_{-}\hat{N}^{\rm
trash}+\delta_{2}(\epsilon/2;\hat{N}^{\rm trash})\bigr{)},$ (87)

we observe that Eq. (23) holds from the union bound.

##  3 Numerical simulations

We compute (the lower bound on) the net key gain per pulse (i.e., key rate
$\hat{G}$) against the transmission distance with various values of excess
noise at the channel output. In this model, Bob receives Gaussian states
$\rho_{\rm model}^{(\hat{a})}$ obtained by randomly displacing attenuated
coherent states $\ket{(-1)^{\hat{a}}\sqrt{\eta\mu}}$ with attenuation rate
$\eta$ to increase their variances via factor of $(1+\xi)$, i.e.,

$\rho_{\rm
model}^{(\hat{a})}\coloneqq\frac{2}{\pi\xi}\int_{\mathbb{C}}e^{-2|\gamma|^{2}/\xi}\ket{(-1)^{\hat{a}}\sqrt{\eta\mu}+\gamma}\\!\bra{(-1)^{\hat{a}}\sqrt{\eta\mu}+\gamma}d^{2}\gamma.$
(88)

For simplicity, the number $N_{\rm smp}$ of the sampling rounds is set to be
$N/100$, and the bit error correction efficiency $f$ in Eq. (4) is to be
$0.95$ 222Currently, this level of efficiency may be too optimistic because
the bit error correction in our protocol must succeed with probability no
smaller than $1-\varepsilon_{\rm cor}/2$ without the use of the verification..
The acceptance probability $f_{\rm suc}(x)$ is assumed to be a step function
$\Theta(x-x_{\rm th})$ with a threshold $x_{\rm th}(>0)$, where $\Theta(x)$
denotes the Heaviside step function. The expected amplitude of the coherent
state $\beta$ is chosen to be $\sqrt{\eta\mu}$. We set the security parameter
$\epsilon_{\rm sec}=2^{-50}$, and set $\epsilon_{\rm cor}=\epsilon_{\rm
sec}/2$ and $\epsilon=2^{-s}=\epsilon_{\rm sec}^{2}/16$.

We assume that the number of “success” signal rounds $\hat{N}^{\rm suc}$ is
equal to its expectation, i.e.,

$\displaystyle\mathbb{E}[\hat{N}^{\rm suc}]$ $\displaystyle=p_{\rm
sig}N\int_{-\infty}^{\infty}(f_{\rm suc}(x)+f_{\rm
suc}(-x))\bra{x}\frac{1}{2}\sum_{a\in\\{0,1\\}}\rho_{\rm
model}^{(a)}\ket{x}dx$ (89) $\displaystyle=p_{\rm sig}N(P^{+}_{\rm
hom}+P^{-}_{\rm hom}),$ (90)

where

$\displaystyle P^{\pm}_{\rm hom}$
$\displaystyle\coloneqq\int_{-\infty}^{\infty}\frac{f_{\rm suc}(\pm
x)}{2}\sum_{a\in\\{0,1\\}}\bra{(-1)^{a}x}\rho_{\rm
model}^{(a)}\ket{(-1)^{a}x}dx$ (91) $\displaystyle=\frac{1}{2}{\rm
erfc}\biggl{(}(x_{\rm th}\mp\sqrt{\eta\mu})\sqrt{\frac{2}{1+\xi}}\biggr{)},$
(92)

for Homodyne protocol [37]. For Heterodyne protocol [38], it is given by

$\displaystyle\mathbb{E}[\hat{N}^{\rm suc}]$ $\displaystyle=p_{\rm
sig}N(P^{+}_{\rm het}+P^{-}_{\rm het}),$ (93) $\displaystyle P^{\pm}_{\rm
het}$ $\displaystyle\coloneqq\iint_{-\infty}^{\infty}\frac{f_{\rm
suc}(\pm\omega_{r})}{2\pi}\sum_{a\in\\{0,1\\}}\bra{(-1)^{a}\omega}\rho_{\rm
model}^{(a)}\ket{(-1)^{a}\omega}d\omega_{r}d\omega_{i}$ (94)
$\displaystyle=\frac{1}{2}{\rm erfc}\biggl{(}(x_{\rm
th}\mp\sqrt{\eta\mu})\sqrt{\frac{2}{2+\xi}}\biggr{)}.$ (95)

We also assume that the number of “success” sampling rounds is equal to
$(P^{+}_{\rm hom/het}+P^{-}_{\rm hom/het})N_{\rm smp}$, the number of test
rounds $\hat{N}^{\rm test}$ is equal to $p_{\rm test}N$, and the number of
trash rounds $\hat{N}^{\rm trash}$ is equal to $p_{\rm trash}N$. The test
outcome $\hat{F}$ is assume to be equal to its expectation given by [37]

$\displaystyle\mathbb{E}[\hat{F}]$ $\displaystyle=p_{\rm
test}N\,\frac{1}{2}\sum_{a\in\\{0,1\\}}\mathbb{E}_{\rho_{\rm
model}^{(a)}}[\Lambda_{m,r}(|\hat{\omega}-(-1)^{a}\sqrt{\eta\mu}|^{2})]$ (96)
$\displaystyle=\frac{p_{\rm
test}N}{1+\xi/2}\left[1-(-1)^{m+1}\left(\frac{\xi/2}{1+r(1+\xi/2)}\right)^{m+1}\right].$
(97)

For the test function $\Lambda_{m,r}$ in the above, we adopt $m=1$ and
$r=0.4120$, which leads to $(\max_{\nu\geq 0}\Lambda_{m,r}(\nu),\min_{\nu\geq
0}\Lambda_{m,r}(\nu))=(2.824,-0.9932)$. We assume that the number
$\hat{E}_{\rm obs}$ of bit errors observed in the “success” sampling rounds is
equal to its expectation $\hat{E}_{\rm obs}=P^{-}_{\rm hom/het}N_{\rm smp}$.
The upper-bound $e_{\rm qber}$ on the bit error rate is thus given by Eq. (3)
with the parameters $\hat{N}^{\rm suc}$, $\hat{N}^{\rm suc}_{\rm smp}$, and
$\hat{E}_{\rm obs}$ given above. Under these assumptions, the remaining
parameters to be determined are six parameters $(\mu,x_{\rm th},p_{\rm
sig},p_{\rm test},\kappa,\gamma)$. We determined $(\kappa,\gamma)$ via a
convex optimization using CVXPY 1.2.1 and $(\mu,x_{\rm th},p_{\rm sig},p_{\rm
test})$ via the Nelder-Mead in the scipy.minimize library in Python, for each
transmission distance $L$ with the attenuation rate $\eta$ assumed to be
$10^{-0.02L}$.

Figure 2: Key rates of the Homodyne protocol against transmission distance
over an optical fiber. The attenuation rate of the optical fiber is assumed to
be $10^{-0.02L}$ with transmission distance $L$ km, an error correction
efficiency $f$ in Eq. (4) is set to be $0.95$, and the number of sampling
rounds $N_{\rm smp}$ is set to be $N/100$. a) Key rates when the excess noise
$\xi$ at the channel output is zero; that is, the channel is pure loss. The
bold solid lines show the key rates with our refined analysis developed here,
the broken lines show those with the previous analysis [37], and the black
thin line shows the PLOB bound, which is the ultimate limit of the key rate of
one-way QKD [47]. One can see that the logarithm of the asymptotic key rate
decreases in parallel to the PLOB bound with our refined analysis against the
transmission distance ($\gg 1$ km) as opposed to the previous results [37].
Improvement in the key rate is sustained in the finite-size case. b) Key rates
when $N=10^{12}$ with various values of excess noise parameter $\xi$. (The
detail of the noise model is given in the main text.) The solid lines show the
key rates with our refined analysis, and the broken lines show those with the
previous results [37]. One can see that, although the key rate significantly
improves for the pure-loss channel, the excess noise as high as
$\xi=10^{-3}$–$10^{-2}$ degrades the performance to almost the same level as
that of the previous results.

Figure 2 shows the key rates of Homodyne protocol for the channel model
explained above. Figures show that under the condition of low excess noise,
our refined analysis results in significantly higher key rates and longer
transmission distance than that of the previous results [37] even in the
finite-key case. Furthermore, the logarithm of the asymptotic key rate in the
pure-loss case (i.e., $\xi=0$) is in parallel to the PLOB bound [47] against
the transmission distance; that is, it achieves a linear scaling against the
channel transmission, which is known to be optimal for one-way QKD in the
pure-loss channel. When the excess noise $\xi$ is around
$10^{-3.0}$–$10^{-2.0}$, however, the improvements in our refined analysis are
lost. The result of the parameter optimization implies that our refined
analysis generates the key with relatively small intensity $\mu$ of the input
coherent states compared to the previous analyses; e.g., the optimized input
intensity $\mu$ of Homodyne protocol is $\sim 0.04$ in our refined analysis
compared to $\sim 0.2$ in the previous analysis [37] at $\eta=0.1$ (i.e., 50
km) for the asymptotic pure-loss case.

The key rate of Heterodyne protocol has a similar behavior. Figure 3 shows the
key rates of Heterodyne protocol with the same noise model as above. Figures
show that our refined analysis significantly improves the key rate against the
pure-loss channel, but is fragile against excess noise. One can see, however,
that, while the key rate of Heterodyne protocol is still low compared to that
of Homodyne protocol, the achievable distance (i.e., the distance with a non-
zero key rate) now becomes comparable with our refined analysis. This implies
that our refined analysis based on the reverse reconciliation is more
effective for Heterodyne protocol.

Figure 3: Key rates of the Heterodyne protocol against transmission distance
over an optical fiber. The noise models are the same as those of Homodyne
protocol. a) Key rates when the excess noise $\xi$ at the channel output is
zero; that is, the channel is pure loss. The bold solid lines show the key
rates with our refined analysis developed here, the broken lines show those
with the previous analysis [38], and the black thin line shows the PLOB bound,
which is the ultimate limit of the key rate of one-way QKD [47]. One can see
that the logarithm of the asymptotic key rate is in parallel to the PLOB bound
when the transmission distance is large in the same way as that of Homodyne
protocol. The key rate is still less (about half) than that of Homodyne
protocol. b) Key rates when $N=10^{12}$ with various values of excess noise
parameter $\xi$. The solid lines show the key rates with our refined analysis,
and the broken lines show those with the previous result [38].

##  4 Discussion

We propose a refined security analysis for the protocol proposed in Ref. [37]
based on the reverse reconciliation. The motivating ideas of our refinement
come from the facts that the distillability of a secret key from a quantum
state is a looser condition than the distillability of an entanglement from it
[51, 52, 53, 42, 54, 43] and the reverse reconciliation can increase the key
rate for CV QKD protocols [10]. To exploit the ideas, we developed the
procedure of “twisting” Alice’s system with $V^{\rm hom}_{B;A\to R}(x)$ (resp.
$V^{\rm het}_{B;A\to R}(\omega)$) controlled by Bob’s qubit, while the similar
techniques have already appeared in previous works [51, 42, 53, 54, 43, 55].
Our finding is that by using the twisting operation that minimizes the phase
error probability for the pure-loss channel, the protocol has asymptotically
optimal scaling in the key rates both for Homodyne and Heterodyne protocols.
This is a clear distinction from the previous results [37, 38]; there, the
asymptotic key rate non-linearly decreases against the channel transmission.
The improvement in the performance remains in the finite-key case but is lost
under the existence of excess noise as high as $\xi=10^{-3}\text{--}10^{-2}$
at the channel output. This may limit the feasibility of our binary-modulation
protocol, but current theoretical progress in CV QKD reveals that the
discrete-modulation CV-QKD protocols with four types of modulation have more
tolerance against excess noise than those with binary modulation [16, 17, 18].
What is important is that our security proof can be extended to the four-state
protocols with binary outcomes, such as Protocol 2 in Ref. [17] and a protocol
in Ref. [18], by replacing the bit-extracting measurements of these protocols
with the qubit-extracting maps as shown in Eq. (9) and constructing the
corresponding phase error operator. This is, however, much more complicated
than the previous analysis, and we leave the problem as future work.

There are several remaining questions with our present results. The first and
foremost is whether we can obtain higher tolerance against excess noise by
extending our analysis to the four-state protocols. As explained above, our
analysis can be extended to the four-state protocols with binary outputs [17,
18], i.e., protocols that use homodyne measurement to distinguish signals.
With the same type of argument based on the phase error estimation, we can
carry out the finite-size security proof for these protocols in principle.
However, developing the analyses that preserve the robustness against excess
noise for these protocols still has non-triviality. A more challenging problem
is to apply our finite-size security proof to the four-state protocols with
more than two outputs, such as a protocol in Ref. [16] and Protocol 1 in Ref.
[17]. In this case, the definition of phase errors is already non-trivial as
opposed to those with binary outputs, and we have to develop more elaborated
finite-size security proof. Whether we can extend our techniques to these
protocols or protocols with even more constellations [19] is still open.

Another important theoretical question is whether the trusted-noise model can
be applied to our security analysis. In practice, even the excess noise of
$\xi=10^{-3}$ at the channel output is difficult to realize if all the noises
are untrusted. Recently, efforts have been made in the field of CV QKD on how
to incorporate noises that are intrinsic to apparatuses and thus inaccessible
to Eve into the security proof as trusted noises. This effectively eases the
requirement on the experimental apparatuses. In the present security analysis
as well as ones in Refs. [37, 38], the fidelity test measures the fidelity to
a pure coherent state, which cannot be naively generalized to the fidelity to
a mixed state. Whether we can incorporate trusted noises into the fidelity
test may be crucial in this direction.

From the viewpoint of the feasibility of the protocol, the total number of
$10^{12}$ of rounds to obtain a tolerable finite-size performance may be
demanding. The finite-size performance may be improved by applying recently
developed refinement [62] of the Azuma’s inequality [59] that utilizes
unconfirmed knowledge. What is non-trivial for the application of this is that
the random variable in our application of Azuma’s inequality can not directly
be observed even at the end of the protocol. Whether we can apply the refined
concentration inequality [62] with the information accessible in our protocol
(in a similar fashion to Ref. [63]) may be an interesting problem.

This work was supported by the Ministry of Internal Affairs and Communications
(MIC) under the initiative Research and Development for Construction of a
Global Quantum Cryptography Network (grant number JPMI00316); Cross-
ministerial Strategic Innovation Promotion Program (SIP) (Council for Science,
Technology and Innovation (CSTI)); JSPS KAKENHI Grant Number JP22K13977.

##  Appendix A Bit error sampling

In this section, we summarize how to determine an upper bound on the bit error
rate from the given sample. As explained in the main text, $N_{\rm smp}$
sampling rounds are randomly inserted in the actual protocol in which Alice
and Bob announce their bit values if Bob’s detection succeeds (in the same way
as in the signal round). The number of “success” sampling rounds is denoted by
$\hat{N}_{\rm smp}^{\rm suc}$, and the observed number of discrepancies
between Alice and Bob is denoted by $\hat{E}_{\rm obs}$.

Let us first introduce a Chernoff-type bound for the hypergeometric
distribution.

######  Lemma 1 (Tail bound for the hypergeometric distribution [64]).

Let $X_{1},\ldots,X_{N}$ be a binary sequence, and $M$ be the number of
elements with $X_{i}=1$, i.e, $M\coloneqq\sum_{i=1}^{N}X_{i}$. Let
$\hat{Y}_{1},\ldots,\hat{Y}_{n}$ $(n\leq N)$ be randomly sampled from
$X_{1},\ldots,X_{N}$ without replacement. Let
$\hat{m}\coloneqq\sum_{i=1}^{n}\hat{Y}_{i}$ be the number of ones in
$\hat{Y}_{1},\ldots,\hat{Y}_{n}$. Then, for any $\delta\in[0,M/N]$, the
following inequality holds:

$\mathrm{Pr}\left(\frac{\hat{m}}{n}\leq\frac{M}{N}-\delta\right)\leq
2^{-nD\left(\frac{M}{N}-\delta\middle\|\frac{M}{N}\right)},$ (98)

where $D(\cdot\|\cdot)$ is defined in Eq. (86).

Then, the following corollary is essential for the bit error sampling.

######  Corollary 1 (Estimation by the simple random sampling without
replacement).

Let $X_{1},\ldots,X_{N}$ be a binary sequence with
$M\coloneqq\sum_{i=1}^{N}X_{i}$. Let $\hat{Y}_{1},\ldots,\hat{Y}_{n}$ $(n\leq
N)$ be randomly sampled from $X_{1},\ldots,X_{N}$ without replacement, and
define $\hat{m}\coloneqq\sum_{i=1}^{n}\hat{Y}_{i}$. Then, for any
$\epsilon\in(0,1)$, the following inequality holds:

$\mathrm{Pr}\left(\tilde{M}_{N,n,\epsilon}(\hat{m})<M\right)\leq\epsilon,$
(99)

where the function $\tilde{M}_{N,n,\epsilon}(m)$ is defined to satisfy

$\frac{m}{n}\leq\frac{\tilde{M}_{N,n,\epsilon}(m)}{N}\leq 1$ (100)

and for $0\leq m<n$,

$D\left(m/n\middle\|\tilde{M}_{N,n,\epsilon}(m)/N\right)=-\frac{1}{n}\log\epsilon.$
(101)

###### Proof.

Let $f(M)$ be a function of $M$ satisfying $0\leq f(M)/n\leq M/N$. Then, from
Lemma 1, we have

$\mathrm{Pr}\left(\frac{\hat{m}}{n}\leq\frac{M}{N}-\left(\frac{M}{N}-\frac{f(M)}{n}\right)\right)\leq
2^{-nD\left(\frac{f(M)}{n}\middle\|\frac{M}{N}\right)}.$ (102)

We set the function $f(M)$ to the restriction of the function
$f_{N,n,\epsilon}(\bar{M})$ of the real number $\bar{M}$ that satisfies

$D\left(f_{N,n,\epsilon}(\bar{M})/n\|\bar{M}/N\right)=-\frac{1}{n}\log\epsilon,$
(103)

for $\bar{M}\in[(1-\sqrt[n]{\epsilon})N,N)$. The function
$f_{N,n,\epsilon}(\bar{M})$ increases monotonically with increasing $\bar{M}$
in $[(1-\sqrt[n]{\epsilon})N,N)$, and its image lies in $[0,n)$. Thus, from
Eq. (102), we have

$\mathrm{Pr}\left(f^{-1}_{N,n,\epsilon}(\hat{m})\leq M\right)\leq\epsilon$
(104)

for any $\hat{m}\in[0,n)$. We define the function
$\tilde{M}_{N,n,\epsilon}(m)\coloneqq f^{-1}_{N,n,\epsilon}(m)$ for
$m\in[0,n)$. To incorporate the case $\hat{m}=n$, we use the following weaker
condition that trivially follows from Eq. (104):

$\mathrm{Pr}\left(\tilde{M}_{N,n,\epsilon}(\hat{m})<M\right)\leq\epsilon,$
(105)

and define $\tilde{M}_{N,n,\epsilon}(n)=N$ so that the above holds also for
$\hat{m}=n$. These show that Eq. (99) holds while
$\tilde{M}_{N,n,\epsilon}(m)$ satisfies Eqs. (100) and (101) by construction
in Eq. (103). ∎

With Corollary 1, we can bound the number of total bit-error events from the
sample under the given failure probability $\varepsilon_{\rm cor}/2$ by
setting $N=\hat{N}^{\rm suc}+\hat{N}^{\rm suc}_{\rm smp}$, $n=\hat{N}^{\rm
suc}_{\rm smp}$, and $\epsilon=\varepsilon_{\rm cor}/2$ for
$\tilde{M}_{N,n,\epsilon}$. As a result, we have the following statement; the
number $E$ of bit errors in $\hat{N}^{\rm suc}$-bit sifted key is bounded from
above by

$\mathrm{Pr}\left(E\leq\tilde{M}_{\hat{N}^{\rm suc}+\hat{N}^{\rm suc}_{\rm
smp},\hat{N}^{\rm suc}_{\rm smp},\varepsilon_{\rm cor}/2}(\hat{E}_{\rm
obs})-\hat{E}_{\rm obs}\right)\geq 1-\varepsilon_{\rm cor}/2.$ (106)

Thus, we can define an upper bound $e_{\rm qber}$ of the bit error rate as in
Eq. (3), which holds with probability no smaller than $1-\varepsilon_{\rm
cor}/2$.

##  Appendix B Proof of the operator inequality

In this section, we prove the inequality (80) used in the security proof in
the main text. We first prove the following lemma.

######  Lemma 2.

Let $\Pi_{\pm}$ be orthogonal projections that have the rank no smaller than
three or infinite. Let $M$ be a self-adjoint operator satisfying
$M=(\Pi_{+}+\Pi_{-})M(\Pi_{+}+\Pi_{-})\leq\alpha(\Pi_{+}+\Pi_{-})$, where
$\alpha$ is a real constant. Let $\ket{\psi}$ be a vector satisfying
$(\Pi_{+}+\Pi_{-})\ket{\psi}=\ket{\psi}$ and $\Pi_{\pm}\ket{\psi}\neq 0$.
Assume $\Pi_{\pm}\ket{\psi}$ are not proportional to eigenvectors of
$\Pi_{\pm}M\Pi_{+}$ (if they have). Define the following quantities with
respect to $\ket{\psi}$:

$\displaystyle C_{\pm}$
$\displaystyle\coloneqq\bra{\psi}\Pi_{\pm}\ket{\psi}\,(>0),$ (107)
$\displaystyle\lambda_{\pm\pm}$ $\displaystyle\coloneqq
C_{\pm}^{-1}\bra{\psi}M_{\pm\pm}\ket{\psi},$ (108) $\displaystyle\lambda_{+-}$
$\displaystyle\coloneqq(C_{+}C_{-})^{-\frac{1}{2}}\bra{\psi}M_{+-}\ket{\psi},\qquad\lambda_{-+}\coloneqq\lambda_{+-}^{*},$
(109) $\displaystyle\sigma_{\pm+}$
$\displaystyle\coloneqq\left(C_{+}^{-1}\|M_{\pm+}\ket{\psi}\|^{2}-|\lambda_{\pm+}|^{2}\right)^{\frac{1}{2}},$
(110) $\displaystyle\sigma_{\pm-}$
$\displaystyle\coloneqq\sigma_{\pm+}^{-1}\left((C_{+}C_{-})^{-\frac{1}{2}}\bra{\psi}M_{+\pm}M_{\pm-}\ket{\psi}-\lambda_{+-}\lambda_{\pm\pm}\right),$
(111) $\displaystyle\Delta_{\pm-}$
$\displaystyle\coloneqq\left(C_{-}^{-1}\|M_{\pm-}\ket{\psi}\|^{2}-|\lambda_{\pm-}|^{2}-|\sigma_{\pm-}|^{2}\right)^{\frac{1}{2}},$
(112)

where $M_{++},M_{--},M_{+-},$ and $M_{-+}$ are given respectively by

$M_{\pm\pm}\coloneqq\Pi_{\pm}M\Pi_{\pm},\quad
M_{+-}\coloneqq\Pi_{+}M\Pi_{-},\quad M_{-+}\coloneqq M_{+-}^{\dagger}.$ (113)

Then, for any real numbers $\gamma_{\pm}$, we have

$\sigma_{\rm
sup}(M+\ket{\psi}\\!\bra{\psi}-\gamma_{+}\Pi_{+}-\gamma_{-}\Pi_{-})\leq\sigma_{\rm
sup}(M_{\rm 6d}),$ (114)

where $\sigma_{\rm sup}(X)$ denotes the supremum of the spectrum of the
operator $X$, and $M_{\rm 6d}$ is given by

$M_{\rm 6d}\coloneqq\begin{pmatrix}\alpha-\gamma_{+}&0&0&\Delta_{+-}&0&0\\\
0&\alpha-\gamma_{+}&\sigma_{++}&\sigma_{+-}&0&0\\\
0&\sigma_{++}&C_{+}+\lambda_{++}-\gamma_{+}&\sqrt{C_{+}C_{-}}+\lambda_{+-}&\sigma_{-+}&0\\\
\Delta_{+-}&\sigma_{+-}^{*}&\sqrt{C_{+}C_{-}}+\lambda_{-+}&C_{-}+\lambda_{--}-\gamma_{-}&\sigma_{--}^{*}&\Delta_{--}\\\
0&0&\sigma_{-+}&\sigma_{--}&\alpha-\gamma_{-}&0\\\
0&0&0&\Delta_{--}&0&\alpha-\gamma_{-}\end{pmatrix}.$ (115)

###### Proof.

We choose orthonormal vectors
$\\{\ket{e^{(1)}_{\pm}},\ket{e^{(2)}_{\pm}},\ket{e^{(3)}_{\pm}}\\}$ in the
domains of $\Pi_{\pm}$, respectively, to satisfy

$\displaystyle\sqrt{C_{\pm}}\Ket{e^{(1)}_{\pm}}$
$\displaystyle=\Pi_{\pm}\ket{\psi},$ (116) $\displaystyle
M\Ket{e^{(1)}_{+}}=(M_{++}+M_{-+})\Ket{e^{(1)}_{+}}$
$\displaystyle=\lambda_{++}\Ket{e^{(1)}_{+}}+\sigma_{++}\Ket{e^{(2)}_{+}}+\lambda_{-+}\Ket{e^{(1)}_{-}}+\sigma_{-+}\Ket{e^{(2)}_{-}},$
(117) $\displaystyle M\Ket{e^{(1)}_{-}}=(M_{+-}+M_{--})\Ket{e^{(1)}_{-}}$
$\displaystyle=\lambda_{+-}\Ket{e^{(1)}_{+}}+\sigma_{+-}\Ket{e^{(2)}_{+}}+\Delta_{+-}\Ket{e^{(3)}_{+}}$
(118)
$\displaystyle\qquad+\lambda_{--}\Ket{e^{(1)}_{-}}+\sigma_{--}\Ket{e^{(2)}_{-}}+\Delta_{--}\Ket{e^{(3)}_{-}},$
(119)

which is well-defined due to Eqs. (107)–(113) and
$M=(\Pi_{+}+\Pi_{-})M(\Pi_{+}+\Pi_{-})$. Actually, Eqs. (110)–(112) are
derived by taking inner product of appropriate pairs among
$M_{\pm\pm}\ket{\psi}$ and $M_{\pm\mp}\ket{\psi}$. Overall phases of
$\ket{e^{(2)}_{\pm}}$ and $\ket{e^{(3)}_{\pm}}$ are taken so that
$\sigma_{\pm+}$ and $\Delta_{\pm-}$ are positive. From
$(\Pi_{+}+\Pi_{-})\ket{\psi}=\ket{\psi}$, we have

$\ket{\psi}=\sqrt{C_{+}}\Ket{e^{(1)}_{+}}+\sqrt{C_{-}}\Ket{e^{(1)}_{-}}.$
(120)

Let us now define the following projection operators:

$\displaystyle\Pi_{\pm}^{(j)}$
$\displaystyle\coloneqq\Ket{e^{(j)}_{\pm}}\\!\Bra{e^{(j)}_{\pm}}\quad(j=1,2,3),$
(121) $\displaystyle\Pi_{\pm}^{(\geq 2)}$
$\displaystyle\coloneqq\Pi_{\pm}-\Pi_{\pm}^{(1)},$ (122)
$\displaystyle\Pi_{\pm}^{(\geq 4)}$ $\displaystyle\coloneqq\Pi_{\pm}^{(\geq
2)}-\Pi_{\pm}^{(2)}-\Pi_{\pm}^{(3)}.$ (123)

Since Eqs. (117) and (119) imply $(\Pi_{+}^{(\geq 4)}+\Pi_{-}^{(\geq
4)})M(\Pi_{+}^{(1)}+\Pi_{-}^{(1)})=0$, we have

$\displaystyle M$ $\displaystyle=(\Pi_{+}+\Pi_{-})M(\Pi_{+}+\Pi_{-})$ (124)
$\displaystyle\begin{split}&=(\Pi_{+}^{(1)}+\Pi_{-}^{(1)})M(\Pi_{+}^{(1)}+\Pi_{-}^{(1)})+(\Pi_{+}^{(2)}+\Pi_{+}^{(3)}+\Pi_{-}^{(2)}+\Pi_{-}^{(3)})M(\Pi_{+}^{(1)}+\Pi_{-}^{(1)})\\\
&\qquad+(\Pi_{+}^{(1)}+\Pi_{-}^{(1)})M(\Pi_{+}^{(2)}+\Pi_{+}^{(3)}+\Pi_{-}^{(2)}+\Pi_{-}^{(3)})+(\Pi_{+}^{(\geq
2)}+\Pi_{-}^{(\geq 2)})M(\Pi_{+}^{(\geq 2)}+\Pi_{-}^{(\geq 2)})\end{split}$
(125)
$\displaystyle\begin{split}&\leq\lambda_{++}\Pi_{+}^{(1)}+\lambda_{--}\Pi_{-}^{(1)}+\lambda_{+-}\Ket{e_{+}^{(1)}}\\!\Bra{e_{-}^{(1)}}+\lambda_{-+}\Ket{e_{-}^{(1)}}\\!\Bra{e_{+}^{(1)}}\\\
&\qquad+\left(\sigma_{++}\Ket{e_{+}^{(2)}}\\!\Bra{e_{+}^{(1)}}+\sigma_{-+}\Ket{e_{-}^{(2)}}\\!\Bra{e_{+}^{(1)}}+\sigma_{+-}\Ket{e_{+}^{(2)}}\\!\Bra{e_{-}^{(1)}}\right.\\\
&\qquad\qquad\left.+\Delta_{+-}\Ket{e_{+}^{(3)}}\\!\Bra{e_{-}^{(1)}}+\sigma_{--}\Ket{e_{-}^{(2)}}\\!\Bra{e_{-}^{(1)}}+\Delta_{--}\Ket{e_{-}^{(3)}}\\!\Bra{e_{-}^{(1)}}\right)+(\quad\text{h.c.}\quad)\\\
&\qquad\ \ +\alpha(\Pi_{+}^{(\geq 2)}+\Pi_{-}^{(\geq 2)}),\end{split}$ (126)

where h.c. denotes the hermitian conjugate of the terms in the preceding
parenthesis. The last inequality comes from $M\leq\alpha(\Pi_{+}+\Pi_{-})$.
Using Eq. (126), we have

$M+\ket{\psi}\\!\bra{\psi}-\gamma_{+}\Pi_{+}-\gamma_{-}\Pi_{-}\leq M_{\rm
6d}\oplus(\alpha-\gamma_{+})\Pi_{+}^{(\geq
4)}\oplus(\alpha-\gamma_{-})\Pi_{-}^{(\geq 4)},$ (127)

where $M_{\rm 6d}$ is given in Eq. (115) with the basis
$\\{\ket{e_{+}^{(3)}},\ket{e_{+}^{(2)}},\ket{e_{+}^{(1)}},\ket{e_{-}^{(1)}},\ket{e_{-}^{(2)}},\ket{e_{-}^{(3)}}\\}$.
Since $\alpha-\gamma_{\pm}=\bra{e_{\pm}^{(3)}}M_{\rm
6d}\ket{e_{\pm}^{(3)}}\leq\sigma_{\rm sup}(M_{\rm 6d})$, the supremum of the
spectrum of the right-hand side of Eq. (127) is equal to the maximum
eigenvalue of the six-dimensional matrix $M_{\rm 6d}$. We then obtain Eq.
(114). ∎

As a corollary of this lemma, we obtain the followings. First, we consider
Homodyne protocol.

######  Corollary 2.

Let $\ket{\beta}$ be a coherent state and $\theta_{\mu,\beta}^{\rm hom}(x)$ be
defined to satisfy

$|\theta_{\mu,\beta}^{\rm
hom}(x)|\leq\frac{\pi}{2},\qquad\tan\theta_{\mu,\beta}^{\rm
hom}(x)=e^{-2(\mu-\beta^{2})}\sinh(4\beta x).$ (128)

Let $\Pi_{\rm ev(od)}$ and $M^{\rm hom}[\kappa,\gamma]$ be as defined in the
main text, and let $M^{\rm hom}_{\rm oo}$, $M^{\rm hom}_{\rm ee}$, $M^{\rm
hom}_{\rm(\pm,o)(\mp,e)}$, and $M^{\rm hom}_{\rm(\mp,e)(\pm,o)}$ be defined as
follows:

$\displaystyle M^{\rm hom}_{\rm oo}$
$\displaystyle\coloneqq\int_{-\infty}^{\infty}f_{\rm
suc}(x)[1+\cos\theta_{\mu,\beta}^{\rm hom}(x)]dx\;\Pi_{\rm
od}\ket{x}\\!\bra{x}\Pi_{\rm od},$ (129) $\displaystyle M^{\rm hom}_{\rm ee}$
$\displaystyle\coloneqq\int_{-\infty}^{\infty}f_{\rm
suc}(x)[1-\cos\theta_{\mu,\beta}^{\rm hom}(x)]dx\;\Pi_{\rm
ev}\ket{x}\\!\bra{x}\Pi_{\rm ev},$ (130) $\displaystyle M^{\rm
hom}_{\rm(+,o)(-,e)}$ $\displaystyle\coloneqq\int_{-\infty}^{\infty}f_{\rm
suc}(x)\sin\theta_{\mu,\beta}^{\rm hom}(x)\,dx\;\Pi_{\rm
od}\ket{x}\\!\bra{x}\Pi_{\rm ev},$ (131) $\displaystyle M^{\rm
hom}_{\rm(-,e)(+,o)}$ $\displaystyle\coloneqq\left(M^{\rm
hom}_{\rm(+,o)(-,e)}\right)^{\dagger},$ (132) $\displaystyle M^{\rm
hom}_{\rm(-,o)(+,e)}$ $\displaystyle\coloneqq\int_{-\infty}^{\infty}-f_{\rm
suc}(x)\,\sin\theta_{\mu,\beta}^{\rm hom}(x)\,dx\;\Pi_{\rm
od}\ket{x}\\!\bra{x}\Pi_{\rm ev}=-M^{\rm hom}_{\rm(+,o)(-,e)},$ (133)
$\displaystyle M^{\rm hom}_{\rm(+,e)(-,o)}$
$\displaystyle\coloneqq\left(M^{\rm
hom}_{\rm(-,o)(+,e)}\right)^{\dagger}=-\left(M^{\rm
hom}_{\rm(+,o)(-,e)}\right)^{\dagger}.$ (134)

Define the following (real) parameters:

$\displaystyle C_{\rm o}\coloneqq\bra{\beta}\Pi_{\rm
od}\ket{\beta}=e^{-|\beta|^{2}}\sinh|\beta|^{2},\quad C_{\rm
e}\coloneqq\bra{\beta}\Pi_{\rm
ev}\ket{\beta}=e^{-|\beta|^{2}}\cosh|\beta|^{2},$ (135)
$\displaystyle\lambda_{\rm oo}^{\rm hom}\coloneqq C_{\rm
o}^{-1}\bra{\beta}M^{\rm hom}_{\rm oo}\ket{\beta},\quad\lambda_{\rm ee}^{\rm
hom}\coloneqq C_{\rm e}^{-1}\bra{\beta}M^{\rm hom}_{\rm ee}\ket{\beta},$ (136)
$\displaystyle\lambda_{\rm(+,o)(-,e)}^{\rm hom}\coloneqq\left(C_{\rm o}C_{\rm
e}\right)^{-\frac{1}{2}}\bra{\beta}M^{\rm
hom}_{\rm(+,o)(-,e)}\ket{\beta}=(\lambda_{\rm(+,o)(-,e)}^{\rm hom})^{*},$
(137) $\displaystyle\sigma_{\rm oo}^{\rm hom}\coloneqq\left(C_{\rm
o}^{-1}\|M^{\rm hom}_{\rm oo}\ket{\beta}\|^{2}-(\lambda_{\rm oo}^{\rm
hom})^{2}\right)^{\frac{1}{2}},$ (138) $\displaystyle\sigma_{\rm eo}^{\rm
hom}\coloneqq\left(C_{\rm o}^{-1}\|M^{\rm
hom}_{\rm(-,e)(+,o)}\ket{\beta}\|^{2}-|\lambda_{\rm(+,o)(-,e)}^{\rm
hom}|^{2}\right)^{\frac{1}{2}},$ (139)
$\displaystyle\sigma_{\rm(+,o)(-,e)}^{\rm hom}\coloneqq(\sigma_{\rm oo}^{\rm
hom})^{-1}\left(\left(C_{\rm o}C_{\rm
e}\right)^{-\frac{1}{2}}\bra{\beta}M^{\rm hom}_{\rm oo}M^{\rm
hom}_{\rm(+,o)(-,e)}\ket{\beta}-\lambda_{\rm oo}^{\rm
hom}\lambda_{\rm(+,o)(-,e)}^{\rm hom}\right)=(\sigma_{\rm(+,o)(-,e)}^{\rm
hom})^{*},$ (140) $\displaystyle\sigma_{\rm(-,e)(-,e)}^{\rm
hom}\coloneqq(\sigma_{\rm(-,e)(+,o)}^{\rm hom})^{-1}\left(\left(C_{\rm
o}C_{\rm e}\right)^{-\frac{1}{2}}\bra{\beta}M^{\rm hom}_{\rm(+,o)(-,e)}M^{\rm
hom}_{\rm ee}\ket{\beta}-\lambda_{\rm(+,o)(-,e)}^{\rm hom}\lambda_{\rm
ee}^{\rm hom}\right)=(\sigma_{\rm(-,e)(-,e)}^{\rm hom})^{*},$ (141)
$\displaystyle\Delta_{\rm oe}^{\rm hom}\coloneqq\left(C_{\rm e}^{-1}\|M^{\rm
hom}_{\rm(+,o)(-,e)}\ket{\beta}\|^{2}-|\lambda_{\rm(+,o)(-,e)}^{\rm
hom}|^{2}-|\sigma_{\rm(+,o)(-,e)}^{\rm hom}|^{2}\right)^{\frac{1}{2}},$ (142)
$\displaystyle\Delta_{\rm ee}^{\rm hom}\coloneqq\left(C_{\rm e}^{-1}\|M^{\rm
hom}_{\rm ee}\ket{\beta}\|^{2}-(\lambda_{\rm ee}^{\rm
hom})^{2}-|\sigma_{\rm(-,e)(-,e)}^{\rm hom}|^{2}\right)^{\frac{1}{2}}.$ (143)

Define the following two matrices $M_{\rm 6d}^{(0)}$ and $M_{\rm 6d}^{(1)}$.

$\displaystyle M_{\rm 6d}^{(0)}$
$\displaystyle\coloneqq\begin{pmatrix}1&0&0&\Delta_{\rm oe}^{\rm hom}&0&0\\\
0&1&\sigma_{\rm oo}^{\rm hom}&\sigma_{\rm(+,o)(-,e)}^{\rm hom}&0&0\\\
0&\sigma_{\rm oo}^{\rm hom}&\kappa C_{\rm o}+\lambda_{\rm oo}^{\rm
hom}&\kappa\sqrt{C_{\rm o}C_{\rm e}}+\lambda_{\rm(+,o)(-,e)}^{\rm
hom}&\sigma_{\rm eo}^{\rm hom}&0\\\ \Delta_{\rm oe}^{\rm
hom}&\sigma_{\rm(+,o)(-,e)}^{\rm hom}&\kappa\sqrt{C_{\rm o}C_{\rm
e}}+\lambda_{\rm(+,o)(-,e)}^{\rm hom}&\kappa C_{\rm e}+\lambda_{\rm ee}^{\rm
hom}-\gamma&\sigma_{\rm(-,e)(-,e)}^{\rm hom}&\Delta_{\rm ee}^{\rm hom}\\\
0&0&\sigma_{\rm eo}^{\rm hom}&\sigma_{\rm(-,e)(-,e)}^{\rm hom}&1-\gamma&0\\\
0&0&0&\Delta_{\rm ee}^{\rm hom}&0&1-\gamma\end{pmatrix},$ (144) $\displaystyle
M_{\rm 6d}^{(1)}$
$\displaystyle\coloneqq\begin{pmatrix}1-\gamma&0&0&\Delta_{\rm oe}^{\rm
hom}&0&0\\\ 0&1-\gamma&\sigma_{\rm oo}^{\rm hom}&-\sigma_{\rm(+,o)(-,e)}^{\rm
hom}&0&0\\\ 0&\sigma_{\rm oo}^{\rm hom}&\kappa C_{\rm o}+\lambda_{\rm oo}^{\rm
hom}-\gamma&\kappa\sqrt{C_{\rm o}C_{\rm e}}-\lambda_{\rm(+,o)(-,e)}^{\rm
hom}&\sigma_{\rm eo}^{\rm hom}&0\\\ \Delta_{\rm oe}^{\rm
hom}&-\sigma_{\rm(+,o)(-,e)}^{\rm hom}&\kappa\sqrt{C_{\rm o}C_{\rm
e}}-\lambda_{\rm(+,o)(-,e)}^{\rm hom}&\kappa C_{\rm e}+\lambda_{\rm ee}^{\rm
hom}&-\sigma_{\rm(-,e)(-,e)}^{\rm hom}&\Delta_{\rm ee}^{\rm hom}\\\
0&0&\sigma_{\rm eo}^{\rm hom}&-\sigma_{\rm(-,e)(-,e)}^{\rm hom}&1&0\\\
0&0&0&\Delta_{\rm ee}^{\rm hom}&0&1\end{pmatrix}.$ (145)

Define a convex function

$B^{\rm hom}(\kappa,\gamma)\coloneqq\max\\{\sigma_{\rm sup}(M_{\rm
6d}^{(0)}),\sigma_{\rm sup}(M_{\rm 6d}^{(1)})\\}.$ (146)

Then, for $\kappa,\gamma\geq 0$, we have

$M^{\rm hom}[\kappa,\gamma]\leq B^{\rm hom}(\kappa,\gamma)I_{AC}.$ (147)

###### Proof.

We first derive the explicit form of $\ket{u_{\pm}^{\rm hom}(x)}_{A}$
introduced in Eq. (41). Notice that

$\displaystyle 1-2q_{\mu,\beta}=e^{-2(\mu-\beta^{2})},$ (148)
$\displaystyle\sqrt{\frac{g_{\beta,1/4}(x)}{g_{-\beta,1/4}(x)}}=e^{4\beta x}.$
(149)

Let $\theta(x)$ be defined to satisfy

$|\theta(x)|<\frac{\pi}{2},\qquad\tan\theta(x)=\mathrm{Tr}\left(Z_{A}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\right)\Bigl{/}\mathrm{Tr}\left(X_{A}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\right).$ (150)

Noticing that $\mathrm{Tr}\left(Y_{A}\bra{0}_{B}\tau_{AB}^{\rm
hom}(x)\ket{1}_{B}\right)=0$, we have

$\ket{u_{\pm}^{\rm
hom}(x)}_{A}=\cos\frac{\theta(x)}{2}\ket{\pm}_{A}\pm\sin\frac{\theta(x)}{2}\ket{\mp}_{A}.$
(151)

From Eqs. (40), (148), (149), and (150), we can see that $\theta(x)$ coincides
with $\theta_{\mu,\beta}^{\rm hom}(x)$ defined in Eq. (128). We now observe
that

$\displaystyle|\braket{+}{u_{+}^{\rm hom}(x)}|^{2}=|\braket{-}{u_{-}^{\rm
hom}(x)}|^{2}=\cos^{2}\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
hom}(x)}{2}\biggr{)}=\frac{1+\cos\theta_{\mu,\beta}^{\rm hom}(x)}{2},$ (152)
$\displaystyle|\braket{-}{u_{+}^{\rm hom}(x)}|^{2}=|\braket{+}{u_{-}^{\rm
hom}(x)}|^{2}=\sin^{2}\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
hom}(x)}{2}\biggr{)}=\frac{1-\cos\theta_{\mu,\beta}^{\rm hom}(x)}{2},$ (153)
$\displaystyle\begin{split}&\braket{+}{u_{+}^{\rm
hom}(x)}\\!\braket{u_{+}^{\rm hom}(x)}{-}=\braket{-}{u_{+}^{\rm
hom}(x)}\\!\braket{u_{+}^{\rm
hom}(x)}{+}=\sin\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
hom}(x)}{2}\biggr{)}\cos\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
hom}(x)}{2}\biggr{)}\\\ &=-\braket{+}{u_{-}^{\rm hom}(x)}\\!\braket{u_{-}^{\rm
hom}(x)}{-}=-\braket{-}{u_{-}^{\rm hom}(x)}\\!\braket{u_{-}^{\rm
hom}(x)}{+}=\frac{\sin\theta_{\mu,\beta}^{\rm hom}(x)}{2}.\end{split}$ (154)

From Eq. (64) as well as Eqs. (74)–(79), it is obvious that

$M^{\rm hom}[\kappa,\gamma]=\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}+\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})},$ (155)

where the two orthogonal projections
$\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ and
$\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$ are defined in Eqs. (65) and
(66). Then we apply Lemma 2 respectively to the operators
$\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ and
$\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$. For
$\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$, we set, by
using Eqs. (152)–(154), that

$\displaystyle\Pi_{\pm}$
$\displaystyle=\ket{\pm}\\!\bra{\pm}_{A}\otimes\Pi_{\rm od(ev)},$ (156)
$\displaystyle M$
$\displaystyle=\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm hom}_{\rm
ph}\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ (157)
$\displaystyle=\ket{+}\\!\bra{+}_{A}\otimes M^{\rm hom}_{\rm
oo}+\ket{-}\\!\bra{-}_{A}\otimes M^{\rm hom}_{\rm
ee}+\left(\ket{+}\\!\bra{-}_{A}\otimes M^{\rm
hom}_{\rm(+,o)(-,e)}+\ket{-}\\!\bra{+}_{A}\otimes M^{\rm
hom}_{\rm(-,e)(+,o)}\right),$ (158) $\displaystyle\ket{\psi}$
$\displaystyle=\sqrt{\kappa}\ket{\phi_{-}}_{AC},$ (159) $\displaystyle\alpha$
$\displaystyle=1,\quad\gamma_{+}=0,\quad\gamma_{-}=\gamma,$ (160)

where $\ket{\phi_{-}}_{AC}$ is defined in Eq. (28). Since so-defined $M$ only
has continuous spectrum, we can apply Lemma 2 and obtain

$\sigma_{\rm sup}\\!\left(\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}\right)\leq\sigma_{\rm
sup}(M_{\rm 6d}^{(0)}).$ (161)

In the same way, we apply Lemma 2 to
$\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$. Using Eqs.
(152)–(154), we set

$\displaystyle\Pi_{\pm}$
$\displaystyle=\ket{\mp}\\!\bra{\mp}_{A}\otimes\Pi_{\rm od(ev)},$ (162)
$\displaystyle M$
$\displaystyle=\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm hom}_{\rm
ph}\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$ (163)
$\displaystyle=\ket{-}\\!\bra{-}_{A}\otimes M^{\rm hom}_{\rm
oo}+\ket{+}\\!\bra{+}_{A}\otimes M^{\rm hom}_{\rm
ee}+\left(\ket{-}\\!\bra{+}_{A}\otimes M^{\rm
hom}_{\rm(-,o)(+,e)}+\ket{+}\\!\bra{-}_{A}\otimes M^{\rm
hom}_{\rm(+,e)(-,o)}\right),$ (164)
$\displaystyle=\ket{-}\\!\bra{-}_{A}\otimes M^{\rm hom}_{\rm
oo}+\ket{+}\\!\bra{+}_{A}\otimes M^{\rm hom}_{\rm
ee}-\left(\ket{-}\\!\bra{+}_{A}\otimes M^{\rm
hom}_{\rm(+,o)(-,e)}+\ket{+}\\!\bra{-}_{A}\otimes M^{\rm
hom}_{\rm(-,e)(+,o)}\right),$ (165) $\displaystyle\ket{\psi}$
$\displaystyle=\sqrt{\kappa}\ket{\phi_{+}}_{AC},$ (166) $\displaystyle\alpha$
$\displaystyle=1,\quad\gamma_{+}=\gamma,\quad\gamma_{-}=0,$ (167)

where $\ket{\phi_{+}}_{AC}$ is defined in Eq. (27). Then, we observe

$\sigma_{\rm sup}\\!\left(\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
hom}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}\right)\leq\sigma_{\rm
sup}(M_{\rm 6d}^{(1)}).$ (168)

Combining inequalities (161) and (168) completes the proof. ∎

Next, we consider Heterodyne protocol.

######  Corollary 3.

Let $\ket{\beta}$ be a coherent state and $\theta_{\mu,\beta}^{\rm hom}(x)$ be
defined to satisfy

$|\theta_{\mu,\beta}^{\rm
het}(\omega_{r})|\leq\frac{\pi}{2},\qquad\tan\theta_{\mu,\beta}^{\rm
het}(\omega_{r})=e^{-2(\mu-\beta^{2})}\sinh(2\beta\omega_{r}).$ (169)

Let $\Pi_{\rm ev(od)}$ and $M^{\rm het}[\kappa,\gamma]$ be as defined in the
main text, and let $M^{\rm het}_{\rm oo}$, $M^{\rm het}_{\rm ee}$, $M^{\rm
het}_{\rm(\pm,o)(\mp,e)}$, and $M^{\rm het}_{\rm(\mp,e)(\pm,o)}$ be defined as
follows:

$\displaystyle\begin{split}M^{\rm het}_{\rm
oo}&\coloneqq\iint_{-\infty}^{\infty}f_{\rm
suc}(\omega_{r})d\omega_{r}dx\;\Pi_{\rm
od}\Bigl{[}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\\\
&\hskip 42.67912pt+\frac{\cos\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\bigl{(}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x-\beta}\\!\bra{x-\beta}+\ket{x-\beta}\\!\braket{x-\beta}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\bigr{)}\Bigr{]}\Pi_{\rm
od},\end{split}$ (170) $\displaystyle\begin{split}M^{\rm het}_{\rm
ee}&\coloneqq\iint_{-\infty}^{\infty}f_{\rm
suc}(\omega_{r})d\omega_{r}dx\;\Pi_{\rm
ev}\Bigl{[}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\\\
&\hskip 42.67912pt-\frac{\cos\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\bigl{(}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x-\beta}\\!\bra{x-\beta}+\ket{x-\beta}\\!\braket{x-\beta}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\bigr{)}\Bigr{]}\Pi_{\rm
ev},\end{split}$ (171) $\displaystyle\begin{split}M^{\rm
het}_{\rm(+,o)(-,e)}&\coloneqq\iint_{-\infty}^{\infty}f_{\rm
suc}(\omega_{r})d\omega_{r}dx\;\Pi_{\rm od}\Bigl{[}\sin\theta_{\mu,\beta}^{\rm
het}(\omega_{r})\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\\\
&\hskip 42.67912pt-\frac{\cos\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\bigl{(}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x-\beta}\\!\bra{x-\beta}-\ket{x-\beta}\\!\braket{x-\beta}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\bigr{)}\Bigr{]}\Pi_{\rm
ev},\end{split}$ (172) $\displaystyle M^{\rm het}_{\rm(-,e)(+,o)}$
$\displaystyle\coloneqq\left(M^{\rm het}_{\rm(+,o)(-,e)}\right)^{\dagger},$
(173) $\displaystyle\begin{split}M^{\rm
het}_{\rm(-,o)(+,e)}&\coloneqq\iint_{-\infty}^{\infty}f_{\rm
suc}(\omega_{r})d\omega_{r}dx\;\Pi_{\rm
od}\Bigl{[}-\sin\theta_{\mu,\beta}^{\rm
het}(\omega_{r})\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\\\
&\hskip 42.67912pt-\frac{\cos\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\bigl{(}\ket{x}\\!\braket{x}{\omega_{r}}\\!\braket{\omega_{r}}{x-\beta}\\!\bra{x-\beta}-\ket{x-\beta}\\!\braket{x-\beta}{\omega_{r}}\\!\braket{\omega_{r}}{x}\\!\bra{x}\bigr{)}\Bigr{]}\Pi_{\rm
ev},\end{split}$ (174) $\displaystyle M^{\rm het}_{\rm(+,e)(-,o)}$
$\displaystyle\coloneqq\left(M^{\rm het}_{\rm(-,o)(+,e)}\right)^{\dagger},$
(175)

Define the following parameters:

$\displaystyle C_{\rm o}\coloneqq\bra{\beta}\Pi_{\rm
od}\ket{\beta}=e^{-|\beta|^{2}}\sinh|\beta|^{2},\quad C_{\rm
e}\coloneqq\bra{\beta}\Pi_{\rm
ev}\ket{\beta}=e^{-|\beta|^{2}}\cosh|\beta|^{2},$ (176)
$\displaystyle\lambda_{\rm oo}^{\rm het}\coloneqq C_{\rm
o}^{-1}\bra{\beta}M^{\rm het}_{\rm oo}\ket{\beta},\quad\lambda_{\rm ee}^{\rm
het}\coloneqq C_{\rm e}^{-1}\bra{\beta}M^{\rm het}_{\rm ee}\ket{\beta},$ (177)
$\displaystyle\lambda_{\rm(+,o)(-,e)}^{\rm het}\coloneqq(C_{\rm o}C_{\rm
e})^{-\frac{1}{2}}\bra{\beta}M^{\rm
het}_{\rm(+,o)(-,e)}\ket{\beta}=(\lambda_{\rm(+,o)(-,e)}^{\rm het})^{*},$
(178) $\displaystyle\lambda_{\rm(-,o)(+,e)}^{\rm het}\coloneqq(C_{\rm o}C_{\rm
e})^{-\frac{1}{2}}\bra{\beta}M^{\rm
het}_{\rm(-,o)(+,e)}\ket{\beta}=(\lambda_{\rm(-,o)(+,e)}^{\rm het})^{*},$
(179) $\displaystyle\sigma_{\rm oo}^{\rm het}\coloneqq\left(C_{\rm
o}^{-1}\left\|M^{\rm het}_{\rm oo}\ket{\beta}\right\|^{2}-(\lambda_{\rm
oo}^{\rm het})^{2}\right)^{\frac{1}{2}},$ (180)
$\displaystyle\sigma_{\rm(-,e)(+,o)}^{\rm het}\coloneqq\left(C_{\rm
o}^{-1}\left\|M^{\rm
het}_{\rm(-,e)(+,o)}\ket{\beta}\right\|^{2}-|\lambda_{\rm(+,o)(-,e)}^{\rm
het}|^{2}\right)^{\frac{1}{2}},$ (181)
$\displaystyle\sigma_{\rm(+,e)(-,o)}^{\rm het}\coloneqq\left(C_{\rm
o}^{-1}\left\|M^{\rm
het}_{\rm(+,e)(-,o)}\ket{\beta}\right\|^{2}-|\lambda_{\rm(-,o)(+,e)}^{\rm
het}|^{2}\right)^{\frac{1}{2}},$ (182)
$\displaystyle\sigma_{\rm(+,o)(-,e)}^{\rm het}\coloneqq\sigma^{-1}_{\rm
oo}\left((C_{\rm o}C_{\rm e})^{-\frac{1}{2}}\bra{\beta}M^{\rm het}_{\rm
oo}M^{\rm het}_{\rm(+,o)(-,e)}\ket{\beta}-\lambda^{\rm het}_{\rm
oo}\lambda^{\rm het}_{\rm(+,o)(-,e)}\right)=(\sigma_{\rm(+,o)(-,e)}^{\rm
het})^{*},$ (183) $\displaystyle\sigma_{\rm(-,o)(+,e)}^{\rm
het}\coloneqq\sigma^{-1}_{\rm oo}\left((C_{\rm o}C_{\rm
e})^{-\frac{1}{2}}\bra{\beta}M^{\rm het}_{\rm oo}M^{\rm
het}_{\rm(-,o)(+,e)}\ket{\beta}-\lambda^{\rm het}_{\rm oo}\lambda^{\rm
het}_{\rm(-,o)(+,e)}\right)=(\sigma_{\rm(-,o)(+,e)}^{\rm het})^{*},$ (184)
$\displaystyle\sigma^{\rm
het}_{\rm(-,e)(-,e)}\coloneqq[\sigma_{\rm(-,e)(+,o)}^{\rm
het}]^{-1}\left((C_{\rm o}C_{\rm e})^{-\frac{1}{2}}\bra{\beta}M^{\rm
het}_{\rm(+,o)(-,e)}M^{\rm het}_{\rm ee}\ket{\beta}-\lambda^{\rm
het}_{\rm(+,o)(-,e)}\lambda^{\rm het}_{\rm ee}\right)=(\sigma^{\rm
het}_{\rm(-,e)(-,e)})^{*},$ (185) $\displaystyle\sigma^{\rm
het}_{\rm(+,e)(+,e)}\coloneqq[\sigma_{\rm(+,e)(-,o)}^{\rm
het}]^{-1}\left((C_{\rm o}C_{\rm e})^{-\frac{1}{2}}\bra{\beta}M^{\rm
het}_{\rm(-,o)(+,e)}M^{\rm het}_{\rm ee}\ket{\beta}-\lambda^{\rm
het}_{\rm(-,o)(+,e)}\lambda^{\rm het}_{\rm ee}\right)=(\sigma^{\rm
het}_{\rm(+,e)(+,e)})^{*},$ (186) $\displaystyle\Delta^{\rm
het}_{\rm(+,o)(-,e)}\coloneqq\left(C_{\rm e}^{-1}\left\|M^{\rm
het}_{\rm(+,o)(-,e)}\ket{\beta}\right\|^{2}-|\lambda^{\rm
het}_{\rm(+,o)(-,e)}|^{2}-|\sigma^{\rm
het}_{\rm(+,o)(-,e)}|^{2}\right)^{\frac{1}{2}},$ (187)
$\displaystyle\Delta^{\rm het}_{\rm(-,o)(+,e)}\coloneqq\left(C_{\rm
e}^{-1}\left\|M^{\rm het}_{\rm(-,o)(+,e)}\ket{\beta}\right\|^{2}-|\lambda^{\rm
het}_{\rm(-,o)(+,e)}|^{2}-|\sigma^{\rm
het}_{\rm(-,o)(+,e)}|^{2}\right)^{\frac{1}{2}},$ (188)
$\displaystyle\Delta_{\rm(-,e)(-,e)}^{\rm het}\coloneqq\left(C_{\rm
e}^{-1}\left\|M^{\rm het}_{\rm ee}\ket{\beta}\right\|^{2}-(\lambda^{\rm
het}_{\rm ee})^{2}-|\sigma^{\rm
het}_{\rm(-,e)(-,e)}|^{2}\right)^{\frac{1}{2}},$ (189)
$\displaystyle\Delta_{\rm(+,e)(+,e)}^{\rm het}\coloneqq\left(C_{\rm
e}^{-1}\left\|M^{\rm het}_{\rm ee}\ket{\beta}\right\|^{2}-(\lambda^{\rm
het}_{\rm ee})^{2}-|\sigma^{\rm
het}_{\rm(+,e)(+,e)}|^{2}\right)^{\frac{1}{2}}.$ (190)

Define the following two matrices $M^{\prime(0)}_{\rm 6d}$ and
$M^{\prime(1)}_{\rm 6d}$.

$\displaystyle M^{\prime(0)}_{\rm 6d}$
$\displaystyle\coloneqq\begin{pmatrix}1&0&0&\Delta^{\rm
het}_{\rm(+,o)(-,e)}&0&0\\\ 0&1&\sigma^{\rm het}_{\rm oo}&\sigma^{\rm
het}_{\rm(+,o)(-,e)}&0&0\\\ 0&\sigma^{\rm het}_{\rm oo}&\kappa C_{\rm
o}+\lambda^{\rm het}_{\rm oo}&\kappa\sqrt{C_{\rm o}C_{\rm e}}+\lambda^{\rm
het}_{\rm(+,o)(-,e)}&\sigma^{\rm het}_{\rm(-,e)(+,o)}&0\\\ \Delta^{\rm
het}_{\rm(+,o)(-,e)}&\sigma^{\rm het}_{\rm(+,o)(-,e)}&\kappa\sqrt{C_{\rm
o}C_{\rm e}}+\lambda^{\rm het}_{\rm(+,o)(-,e)}&\kappa C_{\rm e}+\lambda^{\rm
het}_{\rm(-,e)(-,e)}-\gamma&\sigma^{\rm het}_{\rm(-,e)(-,e)}&\Delta^{\rm
het}_{\rm(-,e)(-,e)}\\\ 0&0&\sigma^{\rm het}_{\rm(-,e)(+,o)}&\sigma^{\rm
het}_{\rm(-,e)(-,e)}&1-\gamma&0\\\ 0&0&0&\Delta^{\rm
het}_{\rm(-,e)(-,e)}&0&1-\gamma\end{pmatrix},$ (191) $\displaystyle
M^{\prime(1)}_{\rm 6d}$
$\displaystyle\coloneqq\begin{pmatrix}1-\gamma&0&0&\Delta^{\rm
het}_{\rm(-,o)(+,e)}&0&0\\\ 0&1-\gamma&\sigma^{\rm het}_{\rm oo}&\sigma^{\rm
het}_{\rm(-,o)(+,e)}&0&0\\\ 0&\sigma^{\rm het}_{\rm oo}&\kappa C_{\rm
o}+\lambda^{\rm het}_{\rm oo}-\gamma&\kappa\sqrt{C_{\rm o}C_{\rm
e}}+\lambda^{\rm het}_{\rm(-,o)(+,e)}&\sigma^{\rm het}_{\rm(+,e)(-,o)}&0\\\
\Delta^{\rm het}_{\rm(-,o)(+,e)}&\sigma^{\rm
het}_{\rm(-,o)(+,e)}&\kappa\sqrt{C_{\rm o}C_{\rm e}}+\lambda^{\rm
het}_{\rm(-,o)(+,e)}&\kappa C_{\rm e}+\lambda^{\rm het}_{\rm ee}&\sigma^{\rm
het}_{\rm(+,e)(+,e)}&\Delta^{\rm het}_{\rm(+,e)(+,e)}\\\ 0&0&\sigma^{\rm
het}_{\rm(+,e)(-,o)}&\sigma^{\rm het}_{\rm(+,e)(+,e)}&1&0\\\ 0&0&0&\Delta^{\rm
het}_{\rm(+,e)(+,e)}&0&1\end{pmatrix}.$ (192)

Define a convex function

$B^{\rm het}(\kappa,\gamma)\coloneqq\max\\{\sigma_{\rm sup}(M^{\prime(0)}_{\rm
6d}),\sigma_{\rm sup}(M^{\prime(1)}_{\rm 6d})\\}.$ (193)

Then, for $\kappa,\gamma\geq 0$, we have

$M^{\rm het}[\kappa,\gamma]\leq B^{\rm het}(\kappa,\gamma)I_{AC}.$ (194)

###### Proof.

In the same way as Homodyne protocol, we have from Eqs. (55) and (56) that

$\ket{u_{\pm}^{\rm
het}(\omega_{r})}_{A}=\cos\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\biggr{)}\ket{\pm}_{A}\pm\sin\biggl{(}\frac{\theta_{\mu,\beta}^{\rm
het}(\omega_{r})}{2}\biggr{)}\ket{\mp}_{A}.$ (195)

Combining this with Eqs. (72) and (73), we observe that

$\displaystyle(\bra{+}_{A}\otimes\Pi_{\rm od})M^{\rm het}_{\rm
ph}(\ket{+}_{A}\otimes\Pi_{\rm od})=(\bra{-}_{A}\otimes\Pi_{\rm od})M^{\rm
het}_{\rm ph}(\ket{-}_{A}\otimes\Pi_{\rm od})=M^{\rm het}_{\rm oo},$ (196)
$\displaystyle(\bra{-}_{A}\otimes\Pi_{\rm ev})M^{\rm het}_{\rm
ph}(\ket{-}_{A}\otimes\Pi_{\rm ev})=(\bra{+}_{A}\otimes\Pi_{\rm ev})M^{\rm
het}_{\rm ph}(\ket{+}_{A}\otimes\Pi_{\rm ev})=M^{\rm het}_{\rm ee}$ (197)
$\displaystyle(\bra{+}_{A}\otimes\Pi_{\rm od})M^{\rm het}_{\rm
ph}(\ket{-}_{A}\otimes\Pi_{\rm ev})=\bigl{[}(\bra{-}_{A}\otimes\Pi_{\rm
ev})M^{\rm het}_{\rm ph}(\ket{+}_{A}\otimes\Pi_{\rm
od})\bigr{]}^{\dagger}=M^{\rm het}_{\rm(+,o)(-,e)}$ (198)
$\displaystyle(\bra{-}_{A}\otimes\Pi_{\rm od})M^{\rm het}_{\rm
ph}(\ket{+}_{A}\otimes\Pi_{\rm ev})=\bigl{[}(\bra{+}_{A}\otimes\Pi_{\rm
ev})M^{\rm het}_{\rm ph}(\ket{-}_{A}\otimes\Pi_{\rm
od})\bigr{]}^{\dagger}=M^{\rm het}_{\rm(-,o)(+,e)}$ (199)

As can be seen from Eq. (72) as well as Eqs. (74)–(79), we have

$M^{\rm het}[\kappa,\gamma]=\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}+\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})},$ (200)

where $\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ and
$\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$ are defined in Eqs. (65) and
(66). Then we apply Lemma 2 to the operators
$\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ and
$\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$,
respectively. For $\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$, using Eqs.
(196), (197), and (198), we set

$\displaystyle\Pi_{\pm}$
$\displaystyle=\ket{\pm}\\!\bra{\pm}_{A}\otimes\Pi_{\rm od(ev)},$ (201)
$\displaystyle M$
$\displaystyle=\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm het}_{\rm
ph}\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}$ (202)
$\displaystyle=\ket{+}\\!\bra{+}_{A}\otimes M^{\rm het}_{\rm
oo}+\ket{-}\\!\bra{-}_{A}\otimes M^{\rm het}_{\rm
ee}+\ket{+}\\!\bra{-}_{A}\otimes M^{\rm
het}_{\rm(+,o)(-,e)}+\ket{-}\\!\bra{+}_{A}\otimes M^{\rm
het}_{\rm(-,e)(+,o)},$ (203) $\displaystyle\ket{\psi}$
$\displaystyle=\sqrt{\kappa}\ket{\phi_{-}}_{AC},$ (204) $\displaystyle\alpha$
$\displaystyle=1,\quad\gamma_{+}=0,\quad\gamma_{-}=\gamma,$ (205)

where $\ket{\phi_{-}}_{AC}$ is defined in Eq. (28). Since so-defined $M$ only
has continuous spectrum, we can apply Lemma 2 and obtain

$\sigma_{\rm sup}\\!\left(\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(+,\mathrm{od}),(-,\mathrm{ev})}\right)\leq\sigma_{\rm
sup}(M^{\prime(0)}_{\rm 6d}).$ (206)

We also apply Lemma 2 to $\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$. Using Eqs.
(196), (197), and (199), we set

$\displaystyle\Pi_{\pm}$
$\displaystyle=\ket{\mp}\\!\bra{\mp}_{A}\otimes\Pi_{\rm od(ev)},$ (207)
$\displaystyle M$
$\displaystyle=\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm het}_{\rm
ph}\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}$ (208)
$\displaystyle=\ket{-}\\!\bra{-}_{A}\otimes M^{\rm het}_{\rm
oo}+\ket{+}\\!\bra{+}_{A}\otimes M^{\rm het}_{\rm
ee}+\ket{-}\\!\bra{+}_{A}\otimes M^{\rm
het}_{\rm(-,o)(+,e)}+\ket{+}\\!\bra{-}_{A}\otimes M^{\rm
het}_{\rm(+,e)(-,o)},$ (209) $\displaystyle\ket{\psi}$
$\displaystyle=\sqrt{\kappa}\ket{\phi_{+}}_{AC},$ (210) $\displaystyle\alpha$
$\displaystyle=1,\quad\gamma_{+}=\gamma,\quad\gamma_{-}=0.$ (211)

where $\ket{\phi_{+}}_{AC}$ is defined in Eq. (27). Then, we observe

$\sigma_{\rm sup}\\!\left(\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}M^{\rm
het}[\kappa,\gamma]\,\Pi_{AC}^{(-,\mathrm{od}),(+,\mathrm{ev})}\right)\leq\sigma_{\rm
sup}(M^{\prime(1)}_{\rm 6d}).$ (212)

Combining inequalities (206) and (212) completes the proof. ∎

## References

  * Bennett and Brassard [1984] C. H. Bennett and G. Brassard, in  _Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing_ (India, 1984) p. 175.
  * Shannon [1949] C. E. Shannon, The Bell System Technical Journal 28, 656 (1949).
  * Ralph [1999] T. C. Ralph, Physical Review A 61, 010303 (1999).
  * Hillery [2000] M. Hillery, Physical Review A 61, 022309 (2000).
  * Gottesman and Preskill [2001] D. Gottesman and J. Preskill, Phys. Rev. A 63, 022309 (2001).
  * Cerf  _et al._ [2001] N. J. Cerf, M. Lévy, and G. V. Assche, Phys. Rev. A 63, 052311 (2001).
  * Grosshans and Grangier [2002] F. Grosshans and P. Grangier, Physical Review Letters 88, 057902 (2002).
  * Grosshans  _et al._ [2003] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, Nature 421, 238 (2003).
  * Weedbrook  _et al._ [2004] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, Physical Review Letters 93, 170504 (2004).
  * Silberhorn  _et al._ [2002] C. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, Physical Review Letters 89, 167901 (2002).
  * Zhao  _et al._ [2009] Y.-B. Zhao, M. Heid, J. Rigas, and N. Lütkenhaus, Physical Review A 79, 012307 (2009).
  * García-Patrón and Cerf [2009] R. García-Patrón and N. J. Cerf, Phys. Rev. Lett. 102, 130501 (2009).
  * Leverrier and Grangier [2009] A. Leverrier and P. Grangier, Physical Review Letters 102, 180504 (2009).
  * Leverrier and Grangier [2011] A. Leverrier and P. Grangier, Phys. Rev. Lett. 106, 259902 (2011).
  * Kaur  _et al._ [2021] E. Kaur, S. Guha, and M. M. Wilde, Phys. Rev. A 103, 012412 (2021).
  * Ghorai  _et al._ [2019a] S. Ghorai, P. Grangier, E. Diamanti, and A. Leverrier, Physical Review X 9, 021059 (2019a).
  * Lin  _et al._ [2019] J. Lin, T. Upadhyaya, and N. Lütkenhaus, Physical Review X 9, 041064 (2019).
  * Liu  _et al._ [2021] W.-B. Liu, C.-L. Li, Y.-M. Xie, C.-X. Weng, J. Gu, X.-Y. Cao, Y.-S. Lu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, PRX Quantum 2, 040334 (2021).
  * Denys  _et al._ [2021] A. Denys, P. Brown, and A. Leverrier, Quantum 5, 540 (2021).
  * Leverrier  _et al._ [2010] A. Leverrier, F. Grosshans, and P. Grangier, Phys. Rev. A 81, 062343 (2010).
  * Leverrier [2015] A. Leverrier, Phys. Rev. Lett. 114, 070501 (2015).
  * Samsonov  _et al._ [2020] E. Samsonov, R. Goncharov, A. Gaidash, A. Kozubov, V. Egorov, and A. Gleim, Scientific Reports 10, 1 (2020).
  * Papanastasiou and Pirandola [2021] P. Papanastasiou and S. Pirandola, Phys. Rev. Research 3, 013047 (2021).
  * Papanastasiou  _et al._ [2021] P. Papanastasiou, C. Ottaviani, and S. Pirandola, in  _2021 International Conference on Computer Communications and Networks (ICCCN)_ (2021) pp. 1–6.
  * Mountogiannakis  _et al._ [2022] A. G. Mountogiannakis, P. Papanastasiou, B. Braverman, and S. Pirandola, Phys. Rev. Research 4, 013099 (2022).
  * Furrer  _et al._ [2012] F. Furrer, T. Franz, M. Berta, A. Leverrier, V. B. Scholz, M. Tomamichel, and R. F. Werner, Phys. Rev. Lett. 109, 100502 (2012).
  * Furrer  _et al._ [2014] F. Furrer, T. Franz, M. Berta, A. Leverrier, V. B. Scholz, M. Tomamichel, and R. F. Werner, Phys. Rev. Lett. 112, 019902 (2014).
  * Berta  _et al._ [2016] M. Berta, F. Furrer, and V. B. Scholz, Journal of Mathematical Physics 57, 015213 (2016), https://doi.org/10.1063/1.4936405 .
  * Leverrier  _et al._ [2013] A. Leverrier, R. García-Patrón, R. Renner, and N. J. Cerf, Phys. Rev. Lett. 110, 030502 (2013).
  * Leverrier [2017] A. Leverrier, Physical Review Letters 118, 200501 (2017).
  * Leverrier  _et al._ [2009] A. Leverrier, E. Karpov, P. Grangier, and N. J. Cerf, New Journal of Physics 11, 115009 (2009).
  * Leverrier [2018] A. Leverrier, Journal of Mathematical Physics 59, 042202 (2018), https://doi.org/10.1063/1.5007334 .
  * Lupo  _et al._ [2018] C. Lupo, C. Ottaviani, P. Papanastasiou, and S. Pirandola, Phys. Rev. A 97, 052327 (2018).
  * Ghorai  _et al._ [2019b] S. Ghorai, E. Diamanti, and A. Leverrier, Phys. Rev. A 99, 012311 (2019b).
  * Jouguet  _et al._ [2012] P. Jouguet, S. Kunz-Jacques, E. Diamanti, and A. Leverrier, Physical Review A 86, 032309 (2012).
  * Lupo [2020] C. Lupo, Phys. Rev. A 102, 022623 (2020).
  * Matsuura  _et al._ [2021] T. Matsuura, K. Maeda, T. Sasaki, and M. Koashi, Nature Communications 12, 252 (2021).
  * Yamano  _et al._ [2022] S. Yamano, T. Matsuura, Y. Kuramochi, T. Sasaki, and M. Koashi, Finite-size security proof of binary-modulation continuous-variable quantum key distribution using only heterodyne measurement (2022).
  * Lupo and Ouyang [2022] C. Lupo and Y. Ouyang, PRX Quantum 3, 010341 (2022).
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Physical Review Letters 85, 441 (2000).
  * Lo and Chau [1999] H. K. Lo and H. F. Chau, Science 283, 2050 (1999).
  * Renner [2008] R. Renner, International Journal of Quantum Information 6, 1 (2008).
  * Koashi [2009] M. Koashi, New Journal of Physics 11, 045018 (2009).
  * Tsurumaru [2022] T. Tsurumaru, IEEE Transactions on Information Theory 68, 1016 (2022).
  * Hayashi and Tsurumaru [2012] M. Hayashi and T. Tsurumaru, New Journal of Physics 14, 093014 (2012).
  * Tsurumaru [2020] T. Tsurumaru, IEEE Transactions on Information Theory 66, 3465 (2020).
  * Pirandola  _et al._ [2017] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Nature communications 8, 1 (2017).
  * Lodewyck  _et al._ [2007] J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, S. W. McLaughlin, and P. Grangier, Phys. Rev. A 76, 042305 (2007).
  * Jouguet  _et al._ [2014] P. Jouguet, D. Elkouss, and S. Kunz-Jacques, Phys. Rev. A 90, 042329 (2014).
  * Wen  _et al._ [2021] X. Wen, Q. Li, H. Mao, X. Wen, and N. Chen, Rotation based slice error correction protocol for continuous-variable quantum key distribution and its implementation with polar codes (2021), arXiv:2106.06206 [quant-ph] .
  * Horodecki  _et al._ [2006] K. Horodecki, D. Leung, H.-K. Lo, and J. Oppenheim, Phys. Rev. Lett. 96, 070501 (2006).
  * Renes and Smith [2007] J. M. Renes and G. Smith, Phys. Rev. Lett. 98, 020502 (2007).
  * Horodecki  _et al._ [2008] K. Horodecki, M. Horodecki, P. Horodecki, D. Leung, and J. Oppenheim, Phys. Rev. Lett. 100, 110502 (2008).
  * Horodecki  _et al._ [2009] K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim, IEEE Transactions on Information Theory 55, 1898 (2009).
  * Bourassa  _et al._ [2020] J. E. Bourassa, I. W. Primaatmaja, C. C. W. Lim, and H.-K. Lo, Phys. Rev. A 102, 062607 (2020).
  * Matsuura  _et al._ [2019] T. Matsuura, T. Sasaki, and M. Koashi, Physical Review A 99, 042303 (2019).
  * Cover and Thomas [2012] T. M. Cover and J. A. Thomas,  _Elements of information theory_ (John Wiley & Sons, 2012).
  * Tsurumaru and Hayashi [2013] T. Tsurumaru and M. Hayashi, IEEE Transactions on Information Theory 59, 4700 (2013).
  * Azuma [1967] K. Azuma, Tohoku Mathematical Journal, Second Series 19, 357 (1967).
  * Raginsky and Sason [2018] M. Raginsky and I. Sason,  _Concentration of Measure Inequalities in Information Theory, Communications, and Coding: ThirdEdition_ (Now Foundations and Trends, 2018).
  * McDiarmid [1998] C. McDiarmid, Concentration (Springer, 1998) pp. 195–248.
  * Kato [2020] G. Kato, Concentration inequality using unconfirmed knowledge (2020), arXiv:2002.04357 [math.PR] .
  * Zhou  _et al._ [2021] H. Zhou, T. Sasaki, and M. Koashi, Numerical method for finite-size security analysis of quantum key distribution (2021).
  * Chvátal [1979] V. Chvátal, Discrete Mathematics 25, 285 (1979).