# Continuous-variable Quantum Position Verification secure against entangled
attackers

Rene Allerstorfer  QuSoft & CWI Amsterdam, The Netherlands  Llorenç Escolà-
Farràs  QuSoft & Informatics Institute, University of Amsterdam, The
Netherlands  Arpan Akash Ray  TU Eindhoven, The Netherlands  Boris Škorić  TU
Eindhoven, The Netherlands  Florian Speelman  QuSoft & Informatics Institute,
University of Amsterdam, The Netherlands

###### Abstract

Motivated by the fact that coherent states may offer practical advantages it
was recently shown that a continuous-variable (CV) quantum position
verification (QPV) protocol using coherent states could be securely
implemented if and only if attackers do not pre-share any entanglement. In the
discrete-variable (DV) analogue of that protocol it was shown that modifying
how the classical input information is sent from the verifiers to the prover
leads to a favourable scaling in the resource requirements for a quantum
attack. In this work, we show that similar conclusions can be drawn for CV-
QPV. By adding extra classical information of size $n$ to a CV-QPV protocol,
we show that the protocol, which uses a coherent state and classical
information, remains secure, even if the quantum information travels
arbitrarily slow, against attackers who pre-share CV (entangled) states with a
linear (in $n$) cutoff at the photon number. We show that the protocol remains
secure for certain attenuation and excess noise.

###### Contents

  1. 1 Introduction
  2. 2 Preliminaries
  3. 3 The $\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol
  4. 4 Security against bounded entanglement
    1. 4.1 Bounding attack success probability after repeated i.i.d. rounds
  5. 5 Concrete linear bounds for given experimental parameters
    1. 5.1 Perfect channel
    2. 5.2 Imperfect channel
  6. 6 Open problems

##  1 Introduction

Position-based cryptography utilises the geographic location of a party as the
only cryptographic credential to authenticate it, without further assumptions.
For instance, to authenticate a website or online media one could verify that
the server is located where it should be or that the media was recorded where
it claims to have been (instead of being created by a powerful AI or untrusted
parties, for example). Part of position-based cryptography is the task of
position verification, where an untrusted prover aims to convince verifiers
that he is present at a certain position $P$.

This primitive was first introduced by Chandran, Goyal, Moriarty, and
Ostrovsky [CGMO09], and it has been shown that no classical position-
verification protocol can exist, due to a universal attack based on cloning
input information. This attack fails in the quantum setting because of the no-
cloning theorem [WZ82]. Quantum position verification (QPV) has been
studied111under the name of ‘quantum tagging’ since the early 2000s by several
authors [KMSB06, Mal10a, Mal10b, LL11]. Proposed QPV protocols rely on both
relativistic constraints (in a $d$-dimensional Minkowski space-time
$M^{(d,1)}$) and the laws of quantum mechanics. In the literature, usually the
case $d=1$ studied for simplicity, i.e. verifying the position of $P$ in a
line (by two verifiers $V_{0}$ and $V_{1}$ who are placed on the left and
right of $P$, respectively), since it makes the analysis easier and the main
ideas generalize to higher dimensions. Despite the failure of the classical
universal attack, a universal quantum attack has been found [BCF+14, BK11].
However, this attack consumes an amount of entanglement exponential in the
input size and is therefore not practically feasible. Thus, we may still find
secure QPV protocols in the bounded-entanglement model.

The analysis of the entanglement resources needed turns out to be a deep
question in its own right [BFSS13, Spe16, DC22, BCS22, CM23, ABM+23, ACH+24,
ACM24, ACCM24]. Many protocols have since been proposed [CL15, ABSL22b, GC19,
LLQ22, AEFR+23, ABB+23] and different security models have been studied
[Unr14, GLW16, Dol22, ABSL22a]. Recent work has focused on the practicality of
implementing position-verification protocols. Aspects such as channel loss and
error tolerance of certain QPV protocols must be taken into account [ABSL22a,
EFS23, ABB+23].

Most previous QPV protocols have been based on finite-dimensional quantum
systems, with the exception of [QS15, AEFR+23].

Continuous-variable quantum systems are relevant for quantum communication and
quantum-limited detection and imaging techniques because they provide a
quantum description of the propagating electromagnetic field. Of particular
relevance are the eigenstates of the annihilation operator, also known as
coherent states, and their quadrature squeezed counterparts known as squeezed
coherent states. Much research regarding continuous-variable quantum key
distribution (QKD) has been conducted. Firstly proposed with discrete [Ral99,
Hil00, Rei00] and Gaussian [CLA01] encoding of squeezed states, soon a variety
of protocols were published on Gaussian-modulated CV-QKD with coherent states
[GG02, GAW+03, GCW+03, WLB+04]. In this paper, we employ many techniques that
are common in CV-QKD. Theoretical reviews with practical considerations of CV-
QKD can be found in [GPS07, Lev09].

CV systems are much simpler to handle in practice and leverage several decades
of experience in coherent optical communication technology. One particular
advantage is that no true single-photon preparation or detection is necessary.
Clean creation and detection of single photons is still expensive and
technically challenging, especially if photon number resolution is desired. In
contrast, homodyne and heterodyne measurements are easy to implement and much
existing infrastructure is geared towards handling light at low-loss telecom
wavelengths (1310nm, 1550nm), whereas an ideal single photon source in these
wavelength bands still has to be discovered and frequency up-conversion is
challenging and introduces new losses and errors.

In [AEFR+23], the CV analogue of the $\mathrm{QPV}_{\mathrm{BB84}}$ protocol,
first introduced and studied in [KMS11, BCF+14, LL11], was defined and
analysed. In this article, we extend the CV-QPV literature by considering the
CV version of the practically interesting protocol
$\mathrm{QPV}_{\mathrm{BB84}}^{f}$ [BCS22, EFS23], where the classical input
information is split up (into, say, $x,y$) and each verifier sends out one
part of it. The prover then applies the appropriate measurement based on the
value $f(x,y)$ for the chosen protocol function $f$. The advantage of this is
that the required quantum resources for a successful attack become larger and
scale linearly in the size $n$ of the classical input strings $x,y$. Thus,
increasing the classical input size makes the quantum attack harder – a very
favourable property of $\mathrm{QPV}_{\mathrm{BB84}}^{f}$. It is
theoretically, and also potentially practically, interesting whether this
property holds the same way in the CV case, which is why we study it.

Employing previous results from [BCS22] and [AEFR+23], the main take-away of
this work is that, indeed, the CV protocol shares the desired characteristics
regarding entanglement attacks of the discrete variable version. However, it
was shown in [QS15] that a simple generic attack exists as long as the
transmission is $t\leq 1/2$ for this type of CV-QPV protocol.

More concretely, we show that, for a random function $f$, the protocol remains
secure against attackers who pre-share a quantum resource state with dimension
linear in $n$. Moreover, the protocol remains secure even if the quantum
information is sent arbitrarily slowly. We also consider attenuation and
excess noise in the CV channel in our analysis. The underlying technique is to
lower bound the attackers’ entropy about the quadrature value $R$ that the
protocol asks for. To do so, we employ the continuity of the conditional
entropy for continuous variables in terms of the energy as shown in [Win16].
This then implies that the sample the attackers respond with will necessarily
have a higher variance than the honest sample, which allows the verifiers to
distinguish between an honest and a dishonest sample.

##  2 Preliminaries

Let $\mathcal{H}$, $\mathcal{H^{\prime}}$ be finite-dimensional Hilbert
spaces, we denote by $\mathcal{B}(\mathcal{H},\mathcal{H^{\prime}})$ the set
of bounded operators from $\mathcal{H}$ to $\mathcal{H^{\prime}}$ and
$\mathcal{B}(\mathcal{H})=\mathcal{B}(\mathcal{H},\mathcal{H})$. Denote by
$\mathcal{S}(\mathcal{H})$ the set of quantum states on $\mathcal{H}$, i.e.
$\mathcal{S}(\mathcal{H})=\\{\rho\in\mathcal{B}(\mathcal{H})\mid\rho\geq
0,\mathrm{Tr}\left[\rho\right]=1)\\}$. A pure state will be denoted by a ket
$\left|\psi\right\rangle\in\mathcal{H}$. The trace distance between two
quantum states $\rho$ and $\sigma$ is given by

$\frac{1}{2}\|\rho-\sigma\|_{1}.$ (1)

We will write
$\frac{1}{2}\|\left|\psi_{1}\right\rangle-\left|\psi_{2}\right\rangle\|_{1}$
for pure states $\left|\psi_{1}\right\rangle,\left|\psi_{2}\right\rangle$. The
fidelity bewteen two quantum states $\rho$ and $\sigma$ is defined as

$F(\rho,\sigma):=\mathrm{Tr}\left[\sqrt{\sqrt{\sigma}\rho\sqrt{\sigma}}\right],$
(2)

in particular, for pure states
$\left|\psi_{1}\right\rangle,\left|\psi_{2}\right\rangle$,
$F(\left|\psi_{1}\right\rangle,\left|\psi_{2}\right\rangle)=\lvert\left\langle\psi_{1}\lvert\psi_{2}\right\rangle\rvert$.
The purified distance for quantum states $\rho$ and $\sigma$ is defined as

$\mathcal{P}(\rho,\sigma):=\sqrt{1-F(\rho,\sigma)^{2}}.$ (3)

######  Definition 2.1.

Let $X$ be a continuous random variable with probability density function
$f(x)$, and let $\mathcal{X}$ be its support set. The _differential Shannon
entropy_ $h(X)$ is defined as

$h(X)=-\int_{\mathcal{X}}f(x)\log f(x)\,\mathrm{d}x,$ (4)

where, if not otherwise mentioned, we use $log$ in base 2.

######  Lemma 2.2.

Let $\beta>0$ and $X\in\mathbb{R}$. It holds that $h(\beta X)=h(X)+\log\beta$.

As introduced in [FBT+14], let $\rho_{AB}$ be a bipartite state on systems $A$
and $B$, which correspond to a system to be measured and a system held by an
observer. Let $X$ be a continuous random variable, $\alpha=2^{-n}$ for some
$n\in\mathbb{N}$, and consider the intervals
$\mathcal{I}_{k;\alpha}:=(k\alpha,(k+1)\alpha]$ for $k\in\mathbb{Z}$. Here
$\rho_{B}^{k;\alpha}$ denotes the sub-normalized density matrix in $B$ when
$x$ is measured in $\mathcal{I}_{k;\alpha}$, $\rho_{B}^{x}$ denotes the
conditional reduced density matrix in $B$ so that
$\int_{\mathcal{I}_{k;\alpha}}\rho_{B}^{x}dx=\rho_{B}^{k;\alpha}$, and
$Q_{\alpha}$ denotes the random variable that indicates which interval $x$
belongs to. These notions are used in the continuous version of the
conditional entropy.

######  Definition 2.3.

The _quantum conditional von Neumann entropy_ is defined as

$H(Q_{\alpha}|B)_{\rho}:=-\sum_{k\in\mathbb{Z}}D(\rho^{k;\alpha}_{B}||\rho_{B}).$
(5)

######  Definition 2.4.

The _differential quantum conditional von Neumann entropy_ is defined as

$h(X|B)_{\rho}:=-\int_{\mathbb{R}}D(\rho_{B}^{x}||\rho_{B})\,\mathrm{d}x.$ (6)

The basis of our security proofs is the quantum-mechanical uncertainty
principle. We use the following form for the differential entropy in a
tripartite setting of a guessing game, as is often useful in the context of
quantum cryptography.

######  Lemma 2.5.

[FBT+14] Let $\rho_{ABC}$ be a tripartite density matrix on systems $A$, $B$
and $C$. Let $Q$ and $P$ denote the random variables of position and momentum
respectively, resulting from a homodyne measurement on the $A$ system and let
the following hold: $h(Q|B)_{\rho},h(P|C)_{\rho}>-\infty$ and
$H(Q_{\alpha}|B)_{\rho},H(P_{\alpha}|C)_{\rho}<\infty$ for any $\alpha>0$.
Then

$h(Q|B)_{\rho}+h(P|C)_{\rho}\geq\log(2\pi).$ (7)

We will make use of a type of Alicki-Fannes [AF04] inequality for continuity
of the conditional entropy for continuous variables in terms of the energy as
shown in [Win16]. Consider the Hamiltonian on a system $A$ being the harmonic
oscillator with

$H=\hbar\omega\hat{N},$ (8)

with the unusual energy convention that the ground state has energy $0$
instead of $\frac{1}{2}\hbar\omega$. Throughout the paper, we will consider
units such that $\hbar\omega=1$ (note that we will consider a fixed wavelength
for an input state, see below).

######  Lemma 2.6.

(Lemma 18, [Win16]) Let $\alpha\in[0,\frac{1}{2}]$. Consider a Hamiltonian
$H=H_{A}\otimes\mathbb{I}_{B}$, with system $A$ composed of one harmonic
oscillator and arbitrary system $B$. Let there be states $\rho$ and $\sigma$
on the bipartite system $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$ with
$\mathrm{Tr}\left[\rho H\right],\mathrm{Tr}\left[\sigma H\right]\leq E$. If
$\frac{1}{2}\|\rho-\sigma\|_{1}\leq\tilde{\varepsilon}$, then

$\lvert
h(A|B)_{\rho}-h(A|B)_{\sigma}\rvert\leq\left(\frac{1+\alpha}{1-\alpha}+2\alpha\right)\left[2\tilde{\varepsilon}\left(\log({E}+1)+\log\frac{e}{\alpha(1-\tilde{\varepsilon})}\right)+6\tilde{h}\left(\frac{1+\alpha}{1-\alpha}\tilde{\varepsilon}\right)\right],$
(9)

where

$\tilde{h}(x):=\begin{cases}-x\log x-(1-x)\log(1-x)&\text{ if
}x\leq\frac{1}{2}\\\ 1&\text{ if }x\geq\frac{1}{2}.\end{cases}$ (10)

Furthermore, we will make use of the following estimation inequality.

######  Theorem 2.7.

[Cov99] Let $X$ be a random variable and $\hat{X}(Y)$ an estimator of $X$
given side information $Y$, then

$\mathbb{E}\left[\left(X-\hat{X}(Y)\right)^{2}\right]\geq\frac{1}{2\pi
e}e^{2h_{\mathrm{nats}}(X|Y)},$ (11)

where $h_{\mathrm{nats}}(X|Y)$ is the conditional entropy in natural units.
Moreover, if $X$ is Gaussian and $\hat{X}(Y)$ is its mean, then equality
holds.

##  3 The $\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol

Based on the ideas in [BFSS13, Unr14, BCS22], we introduce a variation of the
quantum position verification protocol studied in [AEFR+23]. Instead of only a
single verifier sending classical information, both verifiers send classical
information that, combined, determine the action of the prover. When sent
through a channel, a continuous-variable state gets attenuated and acquires
excess noise. We will denote by $t\in[0,1]$ the attenuation parameter, and by
$u\geq 0$ the excess noise power of the quantum channel connecting $V_{0}$ and
$P$. Then, the protocol is described as follows:

######  Definition 3.1.

Let $n\in\mathbb{N}$ and consider a $2n$-bit boolean function
$f:\\{0,1\\}^{n}\times\\{0,1\\}^{n}\to\\{0,1\\}$. A round of the
$\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol is described as follows.

  1. 1.

The verifiers $V_{0}$ and $V_{1}$ randomly choose bit strings
$x,y\in\\{0,1\\}^{n}$, respectively. They draw two random variables
$(r,r^{\perp})$ from the Gaussian distribution ${\cal N}_{0,\sigma^{2}}$, for
$\sigma\gg 1$, and compute $f(x,y)$. Verifier $V_{0}$ prepares a coherent
state $\left|\psi\right\rangle$ with quadratures
$(x_{0},p_{0})=(r\cos\theta+r^{\perp}\sin\theta,\;r\sin\theta-r^{\perp}\cos\theta)$,
where $\theta=0$ if $f(x,y)=0$ and $\theta=\frac{\pi}{2}$ if $f(x,y)=1$.

  2. 2.

The verifier $V_{0}$ sends $\left|\psi\right\rangle$ and $x$ to $P$, and the
verifier $V_{1}$ sends $y$ to $P$ such that all information arrives at $P$
simultaneously. The classical information is required to travel at the speed
of light whereas the quantum information can be arbitrarily slow.

  3. 3.

Immediately, $P$ computes $f(x,y)$ and performs a homodyne measurement on
$\left|\psi\right\rangle$ in the direction $\theta=0$ if $f(x,y)=0$ or
$\theta=\frac{\pi}{2}$ if $f(x,y)=1$, resulting in a value
$r^{\prime}\in{\mathbb{R}}$. The prover broadcasts $r^{\prime}$ to both
verifiers at the speed of light.

After $N$ rounds, the verifiers have received a sample of responses, which we
denote as $(r_{i}^{\prime})_{i=1}^{N}$. The verifiers check whether all prover
responses arrived at the correct time, and whether the reported values
$(r_{i}^{\prime})_{i=1}^{N}$ satisfy

$\frac{1}{N}\sum_{i=1}^{N}\frac{\left(r_{i}^{\prime}-r_{i}\sqrt{t}\right)^{2}}{\frac{1}{2}+u}<\gamma,\quad\mbox{
with }\quad\gamma\stackrel{{\scriptstyle\rm
def}}{{=}}1+\frac{2}{\sqrt{N}}\sqrt{\ln\frac{1}{\varepsilon_{\rm
hon}}}+\frac{2}{N}\ln\frac{1}{\varepsilon_{\rm hon}}.$ (12)

Here $\varepsilon_{\rm hon}$ is an upper bound on the honest prover’s failure
probability (as a parameter of the protocol). See Fig. 1 for a schematic
representation of the $\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol.

$V_{0}$$V_{1}$P$V_{0}$$V_{1}$

$\cdot$

$r^{\prime}$time$\left|\psi\right\rangle$$x\in\\{0,1\\}^{n}$$y\in\\{0,1\\}^{n}$$r^{\prime}$
Figure 1: One round of the $\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol. The
coherent state $\left|\psi\right\rangle$ originates from $V_{0}$ in the past.

The excess noise can be modeled as $u=u_{0}\sigma^{2}$, with, for instance, a
reasonable $u_{0}=0.01$, due to the prevalence of phase noise [LPF+18]. The
protocol becomes insecure for $u>0.25$, and thus the constant $u_{0}$ places a
practical upper limit on the modulation variance $\sigma$.

The protocol in [AEFR+23] is as in Definition 3.1 but instead of sending $x$
and $y$, $V_{1}$ directly sends $\theta$. For the honest party, the only
difference is that he has to compute $f(x,y)$ to determine $\theta$. We will
use the following notation, for $\theta\in\\{0,\frac{\pi}{2}\\}$ we will
denote by $\bar{\theta}$ the remaining value, i.e. if $\theta=0$, then
$\bar{\theta}=\frac{\pi}{2}$ and if $\theta=\frac{\pi}{2}$, then
$\bar{\theta}=0$.

The honest prover’s uncertainty about the displacements $r$, drawn by the
random variable denoted by $R$ in each round, conditioned on his measurement
outcomes $r^{\prime}$, drawn from the random variable denoted by $R^{\prime}$
in each round, is the same as in the protocol where $\theta$ is sent directly
from $V_{1}$, since the only change for $P$ is to compute $f(x,y)$ to
determine $\theta$. This uncertainty was calculated in [AEFR+23] to be

$h(R|R^{\prime})_{\psi}=\frac{1}{2}\log 2\pi e\Sigma^{2},$ (13)

where

$\Sigma^{2}=\left(\frac{1}{\sigma^{2}}+\frac{t}{1/2+u}\right)^{-1}.$ (14)

It is well known that the preparation of a coherent state with Gaussian
distributed displacements $x_{0},p_{0}\sim{\cal N}_{0,\sigma^{2}}$ is
equivalent to preparing a two-mode squeezed state with squeezing parameter
$\sinh^{-1}\sigma$ and then performing a heterodyne $(\hat{x},\hat{p})$
measurement on one mode, with measurement outcome
$\frac{(x_{0},-p_{0})}{\sqrt{2}\tanh\sinh^{-1}\sigma}$. For notational
brevity, we set $\lambda=\tanh\sinh^{-1}\sigma$.

In the purified version of $\mathrm{QPV}_{\mathrm{coh}}^{f}$, the verifier
$V_{0}$ prepares the two-mode squeezed state
$\left|\Psi\right\rangle_{V_{0}P}$ with the above mentioned
$\lambda$-dependent squeezing, which is given by

$\left|\Psi\right\rangle=\sqrt{1-\lambda^{2}}\sum_{m=0}^{\infty}\lambda^{m}\left|mm\right\rangle,$
(15)

in the Fock space. Notice that $\lambda<1$. The verifier $V_{0}$ performs a
heterodyne measurement with quadratures rotated by an angle $\theta$ on their
register. The measurement outcomes are $r/(\sqrt{2}\lambda)$ and
$-r^{\perp}/(\sqrt{2}\lambda)$, resulting in displacement $(r,r^{\perp})$ in
the state sent to the prover $P$. $P$ then performs a homodyne measurement
under angle $\theta$ to recover $r$, as in the original protocol.

$V_{0}$’s heterodyne measurement can be described as a double-homodyne
measurement. First $V_{0}$ mixes its own mode with the vacuum using a
beamsplitter, resulting in a two-mode state. On one of these modes, $V_{0}$
then performs a homodyne measurement in the $\theta$-direction, on the other
mode in the $\theta+\frac{\pi}{2}$ direction.

In [AEFR+23] it is shown that the honest prover’s uncertainty about $R$
evaluates to

$h(R|P)_{\Psi}=\frac{1}{2}\log\frac{\pi
e(1+2u)}{t}+O\left(\frac{1}{\sigma}\right).$ (16)

Let $U=R/(\lambda\sqrt{2})$ be the displacement in the $\theta$ direction as
measured by $V_{0}$.

Then

$\begin{split}h(U|P)_{\Psi}&=h\left(\frac{R}{\sqrt{2}\lambda}\Big{|}P\right)_{\Psi}=h(R|P)_{\Psi}-\log(\sqrt{2}\lambda)\\\
&=\frac{1}{2}\log\frac{\pi
e(1+2u)}{t}+O\left(\frac{1}{\sigma}\right)-\log(\sqrt{2}\lambda).\end{split}$
(17)

In the regime $\sigma\gg 1$ (i.e. $\lambda\to 1$),

$h(U|P)_{\Psi}\rightarrow h(U|P)_{\psi}=\frac{1}{2}\log\frac{\pi
e(1+2u)}{2t}.$ (18)

Unless stated otherwise, we will work in the regime $\sigma\gg 1$. Recall that
$\sigma$ is in control of the verifiers.

##  4 Security against bounded entanglement

In this section, we prove security of the $\mathrm{QPV}_{\mathrm{coh}}^{f}$
protocol, showing that with high probability, attackers who possess CV
entangled states with a cutoff at photon number linear in $n$ will not be able
to attack the protocol.

To do so, we consider an ‘imaginary world’ where the
$\mathrm{QPV}_{\mathrm{coh}}^{f}$ protocol, instead of using the state
$\left|\Psi\right\rangle$, is executed with a cutoff at photon number
$2^{m_{0}}$ using the state $\left|\Psi_{m_{0}}\right\rangle$, given by

$\left|\Psi_{m_{0}}\right\rangle=\sqrt{\frac{1-\lambda^{2}}{1-(\lambda^{2})^{2^{m_{0}}}}}\sum_{m=0}^{2^{m_{0}}-1}\lambda^{m}\left|mm\right\rangle.$
(19)

We will denote this variation of the protocol by
$\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$. The state
$\left|\Psi_{m_{0}}\right\rangle$ is an approximation of the state
$\left|\Psi\right\rangle$ and can be made arbitrary close to it by increasing
$m_{0}$. Note that

$\mathcal{P}(\left|\Psi\right\rangle,\left|\Psi_{m_{0}}\right\rangle)=\lambda^{2^{m_{0}}},$
(20)

i.e. $\left|\Psi_{m_{0}}\right\rangle$ is double exponentially close (in
$m_{0}$) to $\left|\Psi\right\rangle$ (recall that $\lambda<1$). If one
replaces the state $\left|\Psi\right\rangle$ by
$\left|\Psi_{m_{0}}\right\rangle$, the probability that the verifiers accept
the action of an honest party will change with probability at most
$O(\lambda^{2^{m_{0}}})$. The cutoff reduces the dimension of the Hilbert
space from infinite to $2^{m_{0}}$, which is the dimension of an $m_{0}$-qubit
state space.

The energy of the $V_{0}$ subsystem is given by

$\left\langle\Psi_{m_{0}}\right|H_{V_{0}}\left|\Psi_{m_{0}}\right\rangle_{V_{0}P}=\frac{\lambda^{2}+\left(2^{m_{0}}-1\right)\lambda^{2^{m_{0}+1}+2}-2^{m_{0}}\lambda^{2^{m_{0}+1}}}{\left(\lambda^{2}-1\right)\left(\lambda^{2^{m_{0}+1}}-1\right)}=\frac{2^{m_{0}}\left(\frac{\sigma^{2}}{\sigma^{2}+1}\right)^{2^{m_{0}}}}{\left(\frac{\sigma^{2}}{\sigma^{2}+1}\right)^{2^{m_{0}}}-1}+\sigma^{2},$
(21)

which tends to $\sigma^{2}$ (the expected energy of the challenge state chosen
by the verifiers) as $m_{0}$ tends to infinity.

The most general attack to $\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$ for
adversaries with a photon-number cutoff such that their Hilbert space is
isomorphic to a multi-qubit Hilbert space, consists of an adversary Alice
between $V_{0}$ and $P$, and an adversary Bob between $V_{1}$ and $P$. They
proceed as follows:

  1. 1.

_Preparing:_ The attackers prepare a joint (possibly entangled) CV state with
a cutoff at the photon number of $q$ qubits each.

  2. 2.

_Intercepting:_ Alice intercepts the quantum information sent from $V_{0}$. At
this stage, $V_{0}$, Alice and Bob share a state
$\left|\chi\right\rangle_{VPAA_{c}BB_{c}}$ of dimension $2^{2q+2m_{0}}$. Here
$V$ is the register kept by $V_{0}$, and $P$ is the challenge register that
$V_{0}$ sends. Alice controls the registers $P$, $A$ and $A_{c}$, and Bob
possesses the registers $B$ and $B_{c}$. Moreover, Alice and Bob intercept $x$
and $y$ and perform arbitrary quantum channels depending on the intercepted
classical information: $U^{x}_{PAA_{c}}$ and $V^{y}_{BB_{c}}$, respectively,
ending up with the state $\left|\phi\right\rangle_{VPAA_{c}BB_{c}}$.

  3. 3.

_Communicating:_ Alice and Bob send a copy of $x$ and $y$ to the other
attacker, respectively. Alice keeps registers $P$ and $A$ and sends register
$A_{c}$ to Bob, and Bob keeps register $B$ and sends $B_{c}$ to Alice.

  4. 4.

_Measuring:_ Upon receiving the information sent by the other party, Alice and
Bob locally apply arbitrary POVMs $\\{A^{xy}_{PAB_{c}}\\}$ and
$\\{B^{xy}_{A_{c}B}\\}$ to obtain classical answers, which will be sent to
their closest verifier, respectively.

Due to the Stinespring dilation, we can consider the quantum channels to be
unitaries.

AliceBob$U^{x}_{PAA_{c}}$$A^{xy}_{PAB_{c}}$$\left|\chi\right\rangle_{VPAA_{c}BB_{c}}$$\left|\phi\right\rangle_{VPAA_{c}BB_{c}}$$V^{y}_{BB_{c}}$$B^{xy}_{A_{c}B}$time
Figure 2: Schematic depiction of a generic attack on
$\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$.

######  Definition 4.1.

The tuple
$\\{\left|\chi\right\rangle_{VPAA_{c}BB_{c}},U^{x}_{PAA_{c}},V^{y}_{BB_{c}},A^{xy}_{PAB_{c}},B^{xy}_{A_{c}B}\\}_{xy}$
is a _$q$ -qubit strategy for $\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$_.
Moreover, we say that a $q$-qubit strategy for
$\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$ is $(\varepsilon,l)$-perfect if for
$l$ pairs of strings $(x,y)$, for $\theta\in\\{0,\frac{\pi}{2}\\}$,

$h(U_{\theta}|PAB_{c})_{\phi}\leq
h(U|P)_{\psi}+\varepsilon\quad\text{and}\quad h(U_{\theta}|A_{c}B)_{\phi}\leq
h(U|P)_{\psi}+\varepsilon.$ (22)

Notice that there is no $\theta$-dependence on the right-hand side of the
inequality since $h(U|P)_{\psi}$ does not depend on $\theta$. The parameter
$\varepsilon$, see analysis below, will quantify the difference between the
uncertainty of the honest prover and attackers. It will have to be picked
depending on the number of rounds that the protocol is run sequentially. Next,
we define ‘good’ states to attack the protocol for either $\theta=0$ or
$\theta=\pi/2$. We will see that a good state for the $\theta=0$ case cannot
be too close (in trace distance) to a good state for the $\theta=\pi/2$ case.
This restricts the attackers.

######  Remark 4.2.

Notice that we consider strategies starting with the state
$\left|\chi\right\rangle_{VPAA_{c}BB_{c}}$ instead of
$\left|\Psi_{m_{0}}\right\rangle_{VP}\otimes\left|\chi\right\rangle_{AA_{c}BB_{c}}$.
This will give more power to the attackers, but it will include the fact that
the quantum information sent from $V_{0}$ can travel arbitrarily slow, and the
attackers are allowed to modify
$\left|\Psi_{m_{0}}\right\rangle_{VP}\otimes\left|\chi\right\rangle_{AA_{c}BB_{c}}$
to end up with any arbitrary state $\left|\chi\right\rangle_{VPAA_{c}BB_{c}}$.

######  Definition 4.3.

Let $\varepsilon\geq 0$, and let $q$ be the number of qubits that Alice and
Bob each hold at the _preparing_ stage of a multi-qubit attack on
$\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$. We define
$\mathcal{S}_{\theta}^{\varepsilon}$ as

$\begin{split}\mathcal{S}_{\theta}^{\varepsilon}:=\\{\left|\phi\right\rangle_{VPAA_{c}BB_{c}}\in\mathbb{C}^{2q+2m_{0}}\mid\exists\textrm{
POVMs }\\{A^{xy}_{PAB_{c}}\\},\\{B^{xy}_{A_{c}B}\\}\text{ s.t.
\eqref{eq:epsilon-perfect_strategy} holds}\\}.\end{split}$ (23)

######  Proposition 4.4.

Let $\varepsilon>0$, and
$\left|\phi_{0}\right\rangle_{VPAA_{c}BB_{c}}\in\mathcal{S}_{0}^{\varepsilon}$,
and
$\left|\phi_{\frac{\pi}{2}}\right\rangle_{VPAA_{c}BB_{c}}\in\mathcal{S}_{\frac{\pi}{2}}^{\varepsilon}$,
with bounded energies
$\mathrm{Tr}\left[\rho^{0}H\right],\mathrm{Tr}\left[\rho^{1}H\right]\leq E$,
where $\rho^{0}$ and $\rho^{1}$ are the respective density matrices of
$\left|\phi_{0}\right\rangle$ and $\left|\phi_{\frac{\pi}{2}}\right\rangle$.
The corresponding Hamiltonian is the harmonic oscillator on system $V$ and
identity on the other systems. Let $\frac{1}{2}\geq\alpha\geq 0$ and
$\tilde{\varepsilon}>0$ be such that

$\varepsilon<\frac{1}{2}\log\frac{4t}{e(1+2u)}-\left(\frac{1+\alpha}{2(1-\alpha)}+\alpha\right)\left[2\tilde{\varepsilon}\left(\log(E+1)+\log\frac{e}{\alpha(1-\tilde{\varepsilon})}\right)+6\tilde{h}\left(\frac{1+\alpha}{1-\alpha}\tilde{\varepsilon}\right)\right].$
(24)

Then,

$\frac{1}{2}\lVert\left|\phi_{0}\right\rangle-\left|\phi_{\frac{\pi}{2}}\right\rangle\rVert_{1}>\tilde{\varepsilon}.$
(25)

Notice that the energy bound $E$ is the energy given by the Hamiltonian
corresponding to one harmonic oscillator in the $V$ system (21), which
approaches $\sigma^{2}$ from below. Moreover, from (24), we see that the
$\varepsilon$ will need to be picked taking a value at most
$\frac{1}{2}\log\frac{4t}{e(1+2u)}$. In order to have non-negative
$\tilde{\varepsilon}$, we need

$4t>e(1+2u),$ (26)

see Fig. 3. The maximum value of ${\varepsilon}$ will be upper bounded by

$\varepsilon<\frac{1}{2}\log\frac{4t}{e(1+2u)}\leq\frac{1}{2}\log\frac{4}{e}\simeq
0.278652,$ (27)

since the maximum value is reached by $t=1$ and $u=0$.

Figure 3: Necessary condition for $u$ and $t$ so that (24) is fulfilled (gray
region). The blue dots are specific $(u,t)$ for which we do numerical analysis
in Section 5.

###### Proof.

Let $\rho^{\theta}$ and $\rho^{\bar{\theta}}$ be the density matrices of
$\left|\phi_{\theta}\right\rangle_{VPAA_{c}BB_{c}}$ and
$\left|\phi_{\bar{\theta}}\right\rangle_{VPAA_{c}BB_{c}}$, respectively. By
hypothesis,

$h(U_{\theta}|PAB_{c})_{\rho^{\theta}}\leq h(U|P)_{\psi}+\varepsilon,\text{
and }h(U_{\bar{\theta}}|PAB_{c})_{\rho^{\bar{\theta}}}\leq
h(U|P)_{\psi}+\varepsilon.$ (28)

By Lemma 2.5,

$h(U_{\theta}|PAB_{c})_{\rho^{\theta}}+h(U_{\bar{\theta}}|A_{c}B)_{\rho^{\theta}}\geq\log
2\pi.$ (29)

Then,

$h(U_{\bar{\theta}}|A_{c}B)_{\rho^{\theta}}\geq\log
2\pi-h(U_{\theta}|PAB_{c})_{\rho^{\theta}}\geq\log
2\pi-h(U|P)_{\psi}-\varepsilon,$ (30)

where in the last inequality we used (28). Therefore,

$h(U_{\bar{\theta}}|A_{c}B)_{\rho^{\theta}}-h(U_{\bar{\theta}}|PAB_{c})_{\rho^{\bar{\theta}}}\geq\log
2\pi-2h(U|P)_{\psi}-2\varepsilon.$ (31)

In the regime $\sigma\gg 1$, $h(U|P)_{\psi}\rightarrow\frac{1}{2}\log\frac{\pi
e(1+2u)}{2t}$, and thus,

$h(U_{\bar{\theta}}|A_{c}B)_{\rho^{\theta}}-h(U_{\bar{\theta}}|PAB_{c})_{\rho^{\bar{\theta}}}\geq\log\frac{4t}{e(1+2u)}-2\varepsilon>0,$
(32)

where the last inequality comes from the fact that, by hypothesis,
$\frac{1}{2}\log\frac{4t}{e(1+2u)}>\varepsilon$. This leads to

$\lvert
h(U_{\bar{\theta}}|A_{c}B)_{\rho^{\theta}}-h(U_{\bar{\theta}}|PAB_{c})_{\rho^{\bar{\theta}}}\rvert\geq\log\frac{4t}{e(1+2u)}-2\varepsilon,$
(33)

By hypothesis,
$\log\frac{4t}{e(1+2u)}-2\varepsilon>\left(\frac{1+\alpha}{1-\alpha}+2\alpha\right)\left[2\tilde{\varepsilon}\left(\log(E+1)+\log\frac{e}{\alpha(1-\tilde{\varepsilon})}\right)+6\tilde{h}\left(\frac{1+\alpha}{1-\alpha}\tilde{\varepsilon}\right)\right]$.
Thus, by the contrapositive of Lemma 2.6,

$\frac{1}{2}\lVert\rho^{\theta}-\rho^{\bar{\theta}}\rVert_{1}>\tilde{\varepsilon}.$
(34)

∎

######  Definition 4.5.

[BCS22] Let $q,k,n\in\mathbb{N}$, $\varepsilon>0$. Then,
$g:\\{0,1\\}^{3k}\rightarrow\\{0,1\\}$ is an $(\varepsilon,1)$-classical
rounding of size $k$ if for all $f:\\{0,1\\}^{2n}\rightarrow\\{0,1\\}$, for
all states $\left|\psi\right\rangle$ on $2q+2m_{0}$ qubits, for all
$l\in\\{1,...,2^{2n}\\}$ and for all $(\varepsilon,l)$-perfect $q$-qubit
strategies for $\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$, there are functions
$f_{A}:\\{0,1\\}^{n}\rightarrow\\{0,1\\}^{k}$,
$f_{B}:\\{0,1\\}^{n}\rightarrow\\{0,1\\}^{k}$ and $\gamma\in\\{0,1\\}^{k}$
such that $g(f_{A}(x),f_{B}(y),\gamma)=f(x,y)$ on at least $l$ pairs $(x,y)$.

######  Lemma 4.6.

[LT91] Let $|||*|||$ be any norm on $\mathbb{R}^{n_{0}}$, for
$n_{0}\in\mathbb{N}$. There is a $\delta$-net $S$ of the unit sphere of
$(\mathbb{R}^{n_{0}},|||*|||)$ of cardinality at most $(1+2/\delta)^{n_{0}}$.

######  Lemma 4.7.

[BCS22] Let $\left|x\right\rangle,\left|y\right\rangle\in\mathbb{C}^{d}$, for
$d\in\mathbb{N}$, be two unit vectors. Then,
$\mathcal{P}(\left|x\right\rangle,\left|y\right\rangle)\leq\|\left|x\right\rangle-\left|y\right\rangle\|_{2}$.

######  Proposition 4.8.

Let $\varepsilon$, $\tilde{\varepsilon}$ be such that if
$\left|\varphi_{\theta}\right\rangle\in\mathcal{S}^{\varepsilon}_{\theta}$ and
$\left|\varphi_{\bar{\theta}}\right\rangle\in\mathcal{S}^{\varepsilon}_{\bar{\theta}}$
implies
$\mathcal{P}(\left|\varphi_{\theta}\right\rangle,\left|\varphi_{\bar{\theta}}\right\rangle)>\tilde{\varepsilon}$,
then there is an $(\varepsilon,q)$-classical rounding of size
$k=2^{2q+2m_{0}}\log\big{(}1+\frac{4}{\sqrt[3]{4(2+\tilde{\varepsilon})}-2}\big{)}$.

###### Proof.

We follow the same techniques as in the proof of Lemma 3.12 in [BCS22]. Let
$\delta<\sqrt[3]{\frac{2+\tilde{\varepsilon}}{2}}-1$, and consider
$\delta$-nets $\mathcal{N}_{S}$, $\mathcal{N}_{A}$ and $\mathcal{N}_{B}$,
where the first is for the set of pure states on $2q+2m_{0}$ qubits in
Euclidean norm and the other nets are for the set of unitaries in dimension
$2^{q}$ in operator norm. They are such that $\lvert\mathcal{N}_{S}\rvert$,
$\lvert\mathcal{N}_{A}\rvert$, $\lvert\mathcal{N}_{B}\rvert\leq 2^{k}$, with
$k$ to be set later. Let $\left|\varphi\right\rangle\in\mathcal{N}_{S}$,
$U_{A}\in\mathcal{N}_{A}$, and $U_{B}\in\mathcal{N}_{B}$ be the elements with
indices $x^{\prime}\in\\{0,1\\}^{k}$, $y^{\prime}\in\\{0,1\\}^{k}$ and
$\gamma\in\\{0,1\\}^{k}$, respectively. We define $g$ as $g(x,y,\gamma)=0$ if
$U\otimes V\left|\varphi\right\rangle$ is closer to
$\mathcal{S}^{\varepsilon}_{\theta}$ than to
$\mathcal{S}^{\varepsilon}_{\bar{\theta}}$ in purified distance and
$g(x,y,\gamma)=1$ if $U\otimes V\left|\varphi\right\rangle$ is closer to
$\mathcal{S}^{\varepsilon}_{\bar{\theta}}$ than to
$\mathcal{S}^{\varepsilon}_{\theta}$ in purified distance. If neither is the
case, we make the arbitrary choice $g(x,y,\gamma)=1$. By the assumption on
$\varepsilon$,
$\mathcal{S}^{\varepsilon}_{\theta}\cap\mathcal{S}^{\varepsilon}_{\theta}=\emptyset$,
and thus $g$ is well-defined.

We are going to show that $g$ is an $(\varepsilon,q)$-classical rounding.
Consider an arbitrary $f:\\{0,1\\}^{2n}\rightarrow\\{0,1\\}$ and an arbitrary
state $\left|\chi\right\rangle$ on $2q+2m_{0}$ qubits. Let
$\left|\chi\right\rangle$, $\\{U_{A}^{x},U_{B}^{y}\\}_{xy}$ be from a
$q$-qubit strategy for $\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$, and choose
$\gamma$, $f_{A}(x)$ and $f_{B}(y)$ to be the closest elements to
$\left|\chi\right\rangle$, $U_{A}^{x}$ and $U_{B}^{y}$, respectively, in their
corresponding $\delta$-nets in the Euclidean and operator norm, respectively,
(if not unique, make an arbitrary choice) and let
$\left|\varphi\right\rangle,U_{A},U_{B}$ be their corresponding elements.
Assume $U_{A}^{x}\otimes
U_{B}^{y}\left|\chi\right\rangle\in\mathcal{S}_{\theta}^{\varepsilon}$. Then,

$\begin{split}\mathcal{P}(&U_{A}^{x}\otimes
U_{B}^{y}\left|\chi\right\rangle,U_{A}\otimes
U_{B}\left|\varphi\right\rangle)\leq\|U_{A}^{x}\otimes
U_{B}^{y}\left|\chi\right\rangle-U_{A}\otimes
U_{B}\left|\varphi\right\rangle\|_{2}\\\
&\leq\|(U_{A}+U_{A}^{x}-U_{A})\otimes(U_{B}+U_{B}^{y}-U_{B})(\left|\varphi\right\rangle+\left|\chi\right\rangle-\left|\varphi\right\rangle)-U_{A}\otimes
U_{B}\left|\varphi\right\rangle\|_{2}\\\ &\leq
3\delta+3\delta^{2}+\delta^{3}<\frac{\tilde{\varepsilon}}{2},\end{split}$ (35)

where in the first inequality, we have used Lemma 4.7, in the second, we have
used the triangle inequality and the inequality $\|X\otimes
Y\left|x\right\rangle\|_{2}\leq\|X\|_{\infty}\|Y\|_{\infty}\|\left|x\right\rangle\|_{2}$,
together with
$\|U_{A}^{x}-U_{A}\|_{\infty},{\|U_{B}^{y}-U_{B}\|_{\infty}},\|\left|\chi\right\rangle-\left|\varphi\right\rangle\|\leq\delta$.
Thus, $U_{A}\otimes U_{B}\left|\varphi\right\rangle$ is closer to
$\mathcal{S}_{\theta}^{\varepsilon}$ than to
$\mathcal{S}_{\bar{\theta}}^{\varepsilon}$.
Consider an $(\varepsilon,l)$-perfect strategy for
$\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$ and let $(x,y)$ be such that
$h(U_{\theta}|PAB_{c})_{\varphi},h(U_{\theta}|A_{c}B)_{\varphi}\leq
h(U|P)_{\psi}+\varepsilon$ for $f(x,y)=0$. In particular, we have that
$U_{A}^{x}\otimes
U_{B}^{y}\left|\chi\right\rangle\in\mathcal{S}_{i}^{\varepsilon}$, and because
of (35), $f(x,y)=g(f_{A}(x),f_{B}(y),\gamma)$. Since there are at least $l$
pairs $(x,y)$ fulfilling it, $f(x,y)=g(f_{A}(x),f_{B}(y),\gamma)$ holds on at
least $l$ pairs $(x,y)$ and therefore $g$ is an $(\varepsilon,q)$-classical
rounding. The size of $k$ follows from Lemma 4.6. ∎

######  Lemma 4.9.

Let $\varepsilon\in[0,1]$, $E,t,u>0$ be such that there exist
$\tilde{\varepsilon}>0$ and $\alpha$ such that (24) holds. Let $k$,
$q\in\mathbb{N}$, $n=\Omega(m_{0})$. Moreover, fix an
$(\varepsilon,q)$-classical rounding $g$ of size $k$ with
$k=2^{2q+2m_{0}}\log\big{(}1+\frac{4}{\sqrt[3]{4(2+\tilde{\varepsilon})}-2}\big{)}$.
Let $q=O(n-m_{0})$. Then, with probability $1-O(\lambda^{2^{m_{0}}})$

the following holds:

A uniformly random $f:\\{0,1\\}^{2n}\to\\{0,1\\}$ fulfills the following with
probability at least ${1-O(2^{-2^{n}})}:$

For any $f_{A}:\\{0,1\\}^{n}\to\\{0,1\\}^{k}$,
$f_{B}:\\{0,1\\}^{n}\to\\{0,1\\}^{k}$, $\gamma\in\\{0,1\\}^{k}$, the equality
$g(f_{A}(x),f_{B}(y),\gamma)=f(x,y)$ holds on less than $3/4$ of all pairs
$(x,y)$.

###### Proof.

We want to estimate the probability that for a randomly chosen $f$, we can
find $f_{A}$ and $f_{B}$ such that the corresponding function $g$ fulfils
$\mathbb{P}_{x,y}[f(x,y)=g(f_{A}(x),f_{B}(y),\gamma)]\geq 3/4$. In a similar
manner as in [BCS22], we have that

$\mathbb{P}[f:\exists f_{A},f_{B},\gamma\textrm{ s.t.
}\mathbb{P}_{x,y}[f(x,y)=g(f_{A}(x),f_{B}(y),\gamma)]]\leq
2^{(2^{n+1}+1)k}2^{2^{2n}h(1/4)}2^{-2^{2n}},$ (36)

where $h$ denotes the binary entropy function. If $q=O(n-m_{0})$ and
$k=2^{2q+2m_{0}}\log\big{(}1+\frac{4}{\sqrt[3]{4(2+\tilde{\varepsilon})}-2}\big{)}$,
the above expression is strictly upper bounded by $O(2^{-2^{n}})$. ∎

In order to have explicit expressions instead of $n=\Theta(m_{0})$ and
$q=O(n-m_{0})$, we have to fix the value of $\tilde{\varepsilon}$. To obtain
better bounds, we are interested in picking $\tilde{\varepsilon}$ as large as
possible. Given parameters $E,t,u$ and $\varepsilon$, known by the verifiers,
we will be interested in picking values of $\alpha$ such that (24) holds for
$\tilde{\varepsilon}$ as large as possible. This needs to be done numerically,
since (24) leads to a transcendental equation, see Section 5 for this
analysis. This applies as well for the below theorem, which in short states
that if the number of qubits the attackers pre-share at the beginning of the
protocol, with high probability at least one of them will have a finite gap to
the uncertainty of the honest prover regarding the value of the random
variable $U$. That is, at least one attacker will have strictly larger
uncertainty than the prover.

######  Theorem 4.10.

Let $\varepsilon\in[0,1]$, $E,t,u>0$ (under the control of the verifiers) be
such that there exists $\tilde{\varepsilon}>0$ and $\alpha$ such that (24)
holds. Let $n=\Theta(m_{0})$. Let the number of qubits that Alice and Bob each
control at the beginning of the protocol be

$q=O(n-m_{0}).$ (37)

Then, with probability $1-O(\lambda^{2^{m_{0}}})$ the following holds. A
random function $f$ fulfills the following with probability at least
${1-O(2^{-2^{n}})}:$ the uncertainties for Alice and Bob when attacking the
protocol $\mathrm{QPV}_{\mathrm{coh}}^{f}$ are such that

$\max\\{h(U_{\theta}|PAB_{c})_{\phi},h(U_{\theta}|A_{c}B)_{\phi}\\}\geq
h(U|P)_{\psi}+\frac{\varepsilon}{4},$ (38)

for every state $\left|\phi\right\rangle\in\mathbb{C}^{2q+2m_{0}}$, for
$\theta\in\\{0,\frac{\pi}{2}\\}$.

###### Proof.

By Lemma 4.9, with probability at least $1-O(2^{-2^{n}})$, the function $f$ is
such that there are no $(\varepsilon,\frac{3}{4}2^{2n})$-perfect $q$-qubit
strategies for $\mathrm{QPV}_{\mathrm{coh}_{m_{0}}}^{f}$. That means that for
every strategy, on a fraction at least $\frac{1}{4}$ of $(x,y)$, either
$h(U_{\theta}|PAB_{c})_{\phi}\geq h(U|P)_{\psi}+\frac{\varepsilon}{4}$ or
$h(U_{\theta}|A_{c}B)_{\phi}\\}\geq h(U|P)_{\psi}+\frac{\varepsilon}{4}$. ∎

###  4.1 Bounding attack success probability after repeated i.i.d. rounds

For the following, remember that $\sigma\gg 1$, equivalently
$\lambda\rightarrow 1$. To estimate the number of (independent) rounds $N$ we
have to run for the attack success probability to become vanishingly small, we
cannot assume a specific attack distribution, and we have to assume the
attackers have access to an ideal channel. By eq. (38) we know that

$\displaystyle h(U_{\theta}|E)_{\phi}$
$\displaystyle\coloneqq\max\\{h(U_{\theta}|PAB_{c})_{\phi},h(U_{\theta}|A_{c}B)_{\phi}\\}\geq
h(U|P)_{\psi}+\frac{\varepsilon}{4}$ (39)
$\displaystyle=\frac{1}{2}\log\left(\pi
e\frac{1/2+u}{t}\right)+\frac{\varepsilon}{4}.$ (40)

Now re-substituting $R=\sqrt{2}\lambda U$ yields

$\displaystyle h(R|E)_{\phi}$ $\displaystyle\geq
h(R|P)_{\psi}+\frac{\varepsilon}{4}$ (41)
$\displaystyle=\frac{1}{2}\log\left(2\pi
e\frac{1/2+u}{t}\right)+\frac{\varepsilon}{4}$ (42)
$\displaystyle\geq\frac{1}{2}\log\left(\pi e\right)+\frac{\varepsilon}{4},$
(43)

where the last equation follows from eq. (18) and the lower bound is smallest
for the ideal channel with $t=1$ and $u=0$, which we assume attackers can use.
Via the continuous variable version of Fano’s inequality, Theorem 2.7, we can
straightforwardly convert this into a lower bound for the estimation error of
the attackers. We obtain

$\displaystyle\mathbb{E}\left[\left(R-r^{\prime}\right)^{2}\right]\geq\frac{1}{2\pi
e}e^{2h_{\mathrm{nats}}(R|E)_{\phi}}=\frac{1}{2}e^{\varepsilon/2}.$ (44)

Thus $\mathbb{E}(\sqrt{t}R-r^{\prime})^{2}\geq\frac{1}{2}e^{\varepsilon/2}$
for any transmission $t$. The probability that the attackers’ score falls
below the threshold $\gamma$ is at most the probability that the score differs
from $\mathbb{E}(\sqrt{t}R-r^{\prime})^{2}/(1/2+u)$ by more than the
difference $\Delta\coloneqq\frac{1/2}{1/2+u}e^{\varepsilon/2}-\gamma$. Let
$(r^{\prime\mathrm{att}}_{i})_{i=1}^{N}$ be the sample of the attackers after
$N$ i.i.d. rounds. Then we can then use the Chebyshev inequality for the
random variable of the score to get

$\displaystyle\mathbb{P}\left[\left|\frac{1}{N}\sum_{i=1}^{N}\frac{(\sqrt{t}r_{i}-r^{\prime\mathrm{att}}_{i})^{2}}{1/2+u}-\frac{\mathbb{E}(\sqrt{t}R-r^{\prime})^{2}}{1/2+u}\right|\geq\Delta\right]\leq\frac{\tilde{\sigma}^{2}}{N\Delta^{2}}=O\left(\frac{1}{N\Delta^{2}}\right),$
(45)

where
$\tilde{\sigma}^{2}=\mathbb{V}\left[\frac{\left(\sqrt{t}R-r^{\prime}\right)^{2}}{1/2+u}\right]$
is the variance. We set the tolerance for the attack success probability to
$\varepsilon_{\mathrm{att}}=\varepsilon_{\mathrm{hon}}$ for simplicity. If we
then set
$N\Delta^{2}=\Omega\left(\frac{1}{\varepsilon_{\mathrm{hon}}}\right)$, we get

$\displaystyle\mathbb{P}\left[\frac{1}{N}\sum_{i=1}^{N}\frac{(\sqrt{t}R_{i}-r_{i}^{\prime})^{2}}{1/2+u}\leq\gamma\right]\leq
O(\varepsilon_{\mathrm{hon}}).$ (46)

The required number of rounds $N$ can be obtained by first setting the
tolerated $\varepsilon_{\mathrm{hon}}$ and then solving
$N\Delta^{2}=\Omega\left(\frac{1}{\varepsilon_{\mathrm{hon}}}\right)$ for $N$.
This means we accept the honest prover with probability at least
$1-\varepsilon_{\mathrm{hon}}$, while accepting attackers with probability at
most $\varepsilon_{\mathrm{hon}}$ after $N$ i.i.d. rounds.

##  5 Concrete linear bounds for given experimental parameters

In the above section, we proved that, if $V_{0}$ prepares a two-mode squeezed
state with squeezing parameter $\zeta$ and $\lambda=\tanh\zeta$, with
probability $1-O(\lambda^{2^{m_{0}}})$ attackers who pre-share $q=O(n-m_{0})$
qubits will not be able to mimic arbitrarily close an honest prover. For that,
we need that $\varepsilon,$ $E,t$ and $u$ are such that exists
$\tilde{\varepsilon}>0$ and $\alpha$ for which (24) holds. In order to have
parameters fulfilling (24) for $\varepsilon>0$ we need that the attenuation
parameter $t$ and the excess noise power $u$ of the quantum channel connecting
$V_{0}$ and $P$ fulfill the relation (26). In the section we analyze perfect
and imperfect channels.

###  5.1 Perfect channel

We start by considering a perfect channel connecting $V_{0}$ and $P$, given by
$t=1$ and $u=0$. We fix $\varepsilon=0.1$ and assume the protocol is played
enough rounds to statistically distinguish the honest party with an
uncertainty

$h(U|P)_{\psi}\rightarrow\frac{1}{2}\log\frac{\pi e}{2}\simeq 1.0471,$ (47)

from the uncertainty of at least one of the attackers being lower bounded by

$\frac{1}{2}\log\frac{\pi e}{2}+\frac{\varepsilon}{4}\simeq 1.0721.$ (48)

Fix an energy bound $E=10^{3}$ in units such that $\hbar\omega=1$. Then, the
largest $\tilde{\varepsilon}$ that fulfills (24) is

$\tilde{\varepsilon}\simeq 0.0037,$ (49)

for $\alpha\simeq 0.036$, see Fig. 4 for a representation of the inequality
(24) where the value of $\varepsilon$ is fixed and represented as the black
plane and the gray surface represents the right-hand side of the inequality.

Figure 4: Representation of the left (transparent black) and right (gray
surface) hand sides of the inequality (24) for $\varepsilon=0.1,E=10^{3},t=1$
and $u=0$. The region where the gray surface is above the black plain gives
the $(\alpha,\tilde{\varepsilon})$ such that the inequality (24) holds.

Notice that the energy term in (24) scales as $\tilde{\varepsilon}\log(E+1)$,
i.e. logarithmically in $E$ with a small factor $\tilde{\varepsilon}$ in
front. Therefore, the inequality remains very stable with respect to $E$. For
instance, if one picks $E=10,10^{2},10^{4}$, the values of the maximum
$\tilde{\varepsilon}$ remain almost unchanged.

For the values of $\varepsilon=0.1$ and $\tilde{\varepsilon}=0.004$, the size
of the $(\varepsilon,q)$-classical rounding in Proposition 4.8 is $k=12\cdot
2^{2q+2m_{0}}$. Then, (36) in the proof of Proposition 4.8 is strictly upper
bounded by $2^{-2^{n}}$ if $q\leq\frac{n}{2}-m_{0}-5$, for $n>2(m_{0}+5)$.
Then, for the above energies, Theorem 4.10 can be restated as follows.

######  Corollary 5.1.

Let $\varepsilon=0.1$, $t=1,u=0$. Let $n>2(m_{0}+5)$. Let the number of qubits
that each Alice and Bob control at the beginning of the protocol be

$q\leq\frac{n}{2}-m_{0}-5.$ (50)

Then, with probability $1-O(\lambda^{2^{m_{0}}})$ the following holds. A
random function $f$ fulfills the following with probability at least
$1-2^{-2^{n}}$: the uncertainties for Alice and Bob when attacking the
protocol $\mathrm{QPV}_{\mathrm{coh}}^{f}$ are such that

$\max\\{h(U_{\theta}|PAB_{c})_{\phi},h(U_{\theta}|A_{c}B)_{\phi}\\}\geq
h(U|P)_{\psi}+\frac{\varepsilon}{4},$ (51)

for every state $\left|\phi\right\rangle\in\mathbb{C}^{2q+2m_{0}}$, for
$\theta\in\\{0,\frac{\pi}{2}\\}$.

###  5.2 Imperfect channel

We do the analysis for an imperfect channel for some $(u,t)$ such that
condition (26) is fulfilled. We pick the parameters plotted in Fig. 3. For the
values of $\varepsilon$, $t$ and $u$ in Table 1, we find the maximum
$\tilde{\varepsilon}$ for $E=10^{3}$, and we have the same linear bounds as in
Corollary 5.1.

$\varepsilon$ | $t$ | $u$ | $\alpha$ | $\tilde{\varepsilon}$
---|---|---|---|---
0.03 | 0.8 | 0.05 | 0.013 | 0.00031
0.03 | 0.9 | 0.12 | 0.013 | 0.00029
0.07 | 0.95 | 0.075 | 0.025 | 0.00131
Table 1: Maximum value of $\tilde{\varepsilon}$ fulfilling (24) given
$\varepsilon,t$ and $u$ with its corresponding value of $\alpha$ that attains
it.

##  6 Open problems

In the discrete variable case [ABB+23] has recently found a way around the
problem of transmission loss. It’s an interesting open question whether the
idea in [ABB+23] also could work for CV-QPV to make the practical appeal of
studying these protocols higher.

#### Acknowledgments

We thank Philip Verduyn Lunel for valuable discussions. RA was supported by
the Dutch Research Council (NWO/OCW), as part of the Quantum Software
Consortium programme (project number 024.003.037). FS and LEF are supported by
the Dutch Ministry of Economic Affairs and Climate Policy (EZK), as part of
the Quantum Delta NL programme. BŠ and AAR acknowledge the support from
Groeifonds Quantum Delta NL KAT2.

## References

  * [ABB+23] Rene Allerstorfer, Andreas Bluhm, Harry Buhrman, Matthias Christandl, Llorenç Escolà-Farràs, Florian Speelman, and Philip Verduyn Lunel.  Making existing quantum position verification protocols secure against arbitrary transmission loss, 2023.  arXiv:2312.12614.
  * [ABM+23] Rene Allerstorfer, Harry Buhrman, Alex May, Florian Speelman, and Philip Verduyn Lunel.  Relating non-local quantum computation to information theoretic cryptography, 2023.  arXiv:2306.16462.
  * [ABSL22a] Rene Allerstorfer, Harry Buhrman, Florian Speelman, and Philip Verduyn Lunel.  On the role of quantum communication and loss in attacks on quantum position verification, 2022.  arXiv:2208.04341.
  * [ABSL22b] Rene Allerstorfer, Harry Buhrman, Florian Speelman, and Philip Verduyn Lunel.  Towards practical and error-robust quantum position verification, 2022.  arXiv:2106.12911.
  * [ACCM24] Vahid Asadi, Richard Cleve, Eric Culf, and Alex May.  Linear gate bounds against natural functions for position-verification, 2024.  arXiv:2402.18648.
  * [ACH+24] Harriet Apel, Toby Cubitt, Patrick Hayden, Tamara Kohler, and David Pérez-García.  Security of position-based quantum cryptography limits hamiltonian simulation via holography, 2024.  arXiv:2401.09058.
  * [ACM24] Vahid Asadi, Eric Culf, and Alex May.  Rank lower bounds on non-local quantum computation, 2024.  arXiv:2402.18647.
  * [AEFR+23] Rene Allerstorfer, Llorenç Escolà-Farràs, Arpan Akash Ray, Boris Škorić, Florian Speelman, and Philip Verduyn Lunel.  Security of a continuous-variable based quantum position verification protocol, 2023.  arXiv:2308.04166.
  * [AF04] R Alicki and M Fannes.  Continuity of quantum conditional information.  Journal of Physics A: Mathematical and General, 37(5):L55–L57, 2004.  doi:http://doi.org/10.1088/0305-4470/37/5/L01.
  * [BCF+14] Harry Buhrman, Nishanth Chandran, Serge Fehr, Ran Gelles, Vipul Goyal, Rafail Ostrovsky, and Christian Schaffner.  Position-based quantum cryptography: Impossibility and constructions.  SIAM Journal on Computing, 43(1):150–178, 2014.  doi:http://doi.org/10.1137/130913687.
  * [BCS22] Andreas Bluhm, Matthias Christandl, and Florian Speelman.  A single-qubit position verification protocol that is secure against multi-qubit attacks.  Nature Physics, 2022.  doi:http://doi.org/10.1038/s41567-022-01577-0.
  * [BFSS13] Harry Buhrman, Serge Fehr, Christian Schaffner, and Florian Speelman.  The garden-hose model.  In Proceedings of the 4th conference on Innovations in Theoretical Computer Science, ITCS ’13. ACM, 2013.  doi:http://doi.org/10.1145/2422436.2422455.
  * [BK11] Salman Beigi and Robert König.  Simplified instantaneous non-local quantum computation with applications to position-based cryptography.  New Journal of Physics, 13(9):093036, 2011.  doi:http://doi.org/10.1088/1367-2630/13/9/093036.
  * [CGMO09] Nishanth Chandran, Vipul Goyal, Ryan Moriarty, and Rafail Ostrovsky.  Position based cryptography.  In Advances in Cryptology - CRYPTO 2009, 29th Annual International Cryptology Conference, volume 5677 of Lecture Notes in Computer Science. Springer, 2009.  doi:http://doi.org/10.1137/100805005.
  * [CL15] Kaushik Chakraborty and Anthony Leverrier.  Practical position-based quantum cryptography.  Physical Review A, 92(5), 2015.  doi:http://doi.org/10.1103/PhysRevA.92.052304.
  * [CLA01] Nicolas J. Cerf, Mel Lévy, and Gilles Van Assche.  Quantum distribution of Gaussian keys using squeezed states.  Phys. Rev. A, 63:052311, 2001.  doi:http://doi.org/10.1103/PhysRevA.63.052311.
  * [CM23] Joy Cree and Alex May.  Code-routing: a new attack on position verification.  Quantum, 7, 2023.  doi:10.22331/q-2023-08-09-1079.
  * [Cov99] Thomas M. Cover.  Elements of information theory.  John Wiley & Sons, 1999.  doi:http://doi.org/10.1002/047174882X.
  * [DC22] Kfir Dolev and Sam Cree.  Non-local computation of quantum circuits with small light cones, 2022.  arXiv:2203.10106.
  * [Dol22] Kfir Dolev.  Constraining the doability of relativistic quantum tasks, 2022.  arXiv:1909.05403.
  * [EFS23] Llorenç Escolà-Farràs and Florian Speelman.  Single-qubit loss-tolerant quantum position verification protocol secure against entangled attackers.  Phys. Rev. Lett., 131:140802, 2023.  doi:http://doi.org/10.1103/PhysRevLett.131.140802.
  * [FBT+14] Fabian Furrer, Mario Berta, Marco Tomamichel, Volkher B. Scholz, and Matthias Christandl.  Position-momentum uncertainty relations in the presence of quantum memory.  Journal of Mathematical Physics, 55(12), 2014.  doi:http://doi.org/10.1063/1.4903989.
  * [GAW+03] Frédéric Grosshans, Gilles Assche, Jerome Wenger, Rosa Brouri, Nicolas J. Cerf, and Philippe Grangier.  Quantum key distribution using Gaussian-modulated coherent states.  Nature, 421:238–41, 02 2003.  doi:http://doi.org/10.1038/nature01289.
  * [GC19] Alvin Gonzales and Eric Chitambar.  Bounds on instantaneous nonlocal quantum computation.  IEEE Transactions on Information Theory, 66(5):2951–2963, 2019.  doi:http://doi.org/10.1109/TIT.2019.2950190.
  * [GCW+03] Frédéric Grosshans, Nicolas J. Cerf, Jérôme Wenger, Rosa Tualle-Brouri, and Philippe Grangier.  Virtual entanglement and reconciliation protocols for quantum cryptography with continuous variables.  Quantum Info. Comput., 3(7), 2003.  doi:http://doi.org/10.26421/QIC3.s-6.
  * [GG02] Frédéric Grosshans and Philippe Grangier.  Continuous variable quantum cryptography using coherent states.  Phys. Rev. Lett., 88:057902, 2002.  doi:http://doi.org/10.1103/PhysRevLett.88.057902.
  * [GLW16] Fei Gao, Bin Liu, and QiaoYan Wen.  Quantum position verification in bounded-attack-frequency model.  SCIENCE CHINA Physics, Mechanics & Astronomy, 59(11), 2016.  doi:http://doi.org/10.1007/s11433-016-0234-0.
  * [GPS07] Raul Garcia-Patron Sanchez.  Quantum information with optical continuous variables: from Bell tests to key distribution.  PhD thesis, Université libre de Bruxelles, 2007.
  * [Hil00] Mark Hillery.  Quantum cryptography with squeezed states.  Phys. Rev. A, 61:022309, 2000.  doi:http://doi.org/10.1103/PhysRevA.61.022309.
  * [KMS11] Adrian Kent, William J. Munro, and Timothy P. Spiller.  Quantum tagging: Authenticating location via quantum information and relativistic signaling constraints.  Physical Review A, 84(1), 2011.  doi:http://doi.org/10.1103/PhysRevA.84.012326.
  * [KMSB06] Adrian Kent, William Munro, Timothy Spiller, and Raymond Beausoleil.  Tagging systems. US patent nr. 2006/0022832, 2006.
  * [Lev09] Anthony Leverrier.  Theoretical study of continuous-variable quantum key distribution.  Phd thesis, Télécom ParisTech, 2009.
  * [LL11] Hoi-Kwan Lau and Hoi-Kwong Lo.  Insecurity of position-based quantum-cryptography protocols against entanglement attacks.  Physical Review A, 83(1), 2011.  doi:http://doi.org/10.1103/PhysRevA.83.012322.
  * [LLQ22] Jiahui Liu, Qipeng Liu, and Luowen Qian.  Beating Classical Impossibility of Position Verification.  In Mark Braverman, editor, 13th Innovations in Theoretical Computer Science Conference (ITCS 2022), volume 215 of Leibniz International Proceedings in Informatics (LIPIcs), pages 100:1–100:11, Dagstuhl, Germany, 2022. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.  doi:10.4230/LIPIcs.ITCS.2022.100.
  * [LPF+18] Fabian Laudenbach, Christoph Pacher, Chi-Hang Fred Fung, Andreas Poppe, Momtchil Peev, Bernhard Schrenk, Michael Hentschel, Philip Walther, and Hannes Hübel.  Continuous-variable quantum key distribution with gaussian modulation—the theory of practical implementations (adv. quantum technol. 1/2018).  Advanced Quantum Technologies, 1(1):1870011, 2018.  URL: https://onlinelibrary.wiley.com/doi/abs/10.1002/qute.201870011, arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/qute.201870011, doi:10.1002/qute.201870011.
  * [LT91] Michel Ledoux and Michel Talagrand.  Probability in Banach Spaces: Isoperimetry and Processes, volume 23 of A Series of Modern Surveys in Mathematics Series.  Springer, 1991.  doi:10.1007/978-3-642-20212-4.
  * [Mal10a] Robert A. Malaney.  Location-dependent communications using quantum entanglement.  Physical Review A, 81(4), 2010.  doi:http://doi.org/10.1103/PhysRevA.81.042319.
  * [Mal10b] Robert A. Malaney.  Quantum location verification in noisy channels.  In IEEE Global Telecommunications Conference GLOBECOM, 2010.  doi:http://doi.org/10.1109/GLOCOM.2010.5684009.
  * [QS15] Bing Qi and George Siopsis.  Loss-tolerant position-based quantum cryptography.  Physical Review A, 91(4):042337, 2015.  doi:http://doi.org/10.1103/PhysRevA.91.042337.
  * [Ral99] Timothy C. Ralph.  Continuous variable quantum cryptography.  Phys. Rev. A, 61:010303, 1999.  doi:http://doi.org/10.1103/PhysRevA.61.010303.
  * [Rei00] Margaret D. Reid.  Quantum cryptography with a predetermined key using continuous-variable Einstein-Podolsky-Rosen correlations.  Phys. Rev. A, 62:062308, 2000.  doi:http://doi.org/10.1103/PhysRevA.62.062308.
  * [Spe16] Florian Speelman.  Instantaneous Non-Local Computation of Low T-Depth Quantum Circuits.  In 11th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2016), volume 61 of Leibniz International Proceedings in Informatics (LIPIcs), pages 9:1–9:24. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2016.  doi:10.4230/LIPIcs.TQC.2016.9.
  * [Unr14] Dominique Unruh.  Quantum position verification in the random oracle model.  In Advances in Cryptology – CRYPTO 2014. Springer Berlin Heidelberg, 2014.  doi:http://doi.org/10.1007/978-3-662-44381-1_1.
  * [Win16] Andreas Winter.  Tight uniform continuity bounds for quantum entropies: Conditional entropy, relative entropy distance and energy constraints.  Communications in Mathematical Physics, 347(1), 2016.  doi:http://doi.org/10.1007/s00220-016-2609-8.
  * [WLB+04] Christian Weedbrook, Andrew M. Lance, Warwick P. Bowen, Thomas Symul, Timothy C. Ralph, and Ping Koy Lam.  Quantum cryptography without switching.  Phys. Rev. Lett., 93:170504, 2004.  doi:http://doi.org/10.1103/PhysRevLett.93.170504.
  * [WZ82] William K. Wootters and Wojciech Zurek.  A single quantum cannot be cloned.  Nature, 299:802–803, 1982.  doi:http://doi.org/10.1038/299802a0.


# Polygon gluing and commuting bosonic operators

Aleksander Yu. Orlov Institute of Oceanology, Nahimovskii Prospekt 36,
Kurchatov Institue, Moscow, Russia, email<EMAIL_ADDRESS>
(June 30, 2020)

###### Abstract

Two families of commuting Hamiltonians are constructed, parametrized by a
constant matrix. The first series was guessed and is new, while the second is
known, and in our approach it follows from the first series. For proof, I used
the facts known from our previous consideration of the relationships between
random matrices and Hurwitz numbers, but the text is selfconsistent and does
not require reference to these works.

To Leonid Chekhov and Nikita Slavnov in connection with their 60th anniversary

Key words: Polygon gluing, commuting quantum Hamilonians

##  1 Introduction

The problem of finding a ring of commuting operators acting in an infinite-
dimensional space is one of the problems of mathematics and mathematical
physics. We found an example of such a ring. 111I was initiated by the
articles [8]-[11] which are researches on a slightly different topic. Modern
methods for obtaining such rings are described. in various works, in
particular, these are works on quantum integrable systems. We can’t even look
through the huge collection of articles on these topics. To search for links,
I present only articles [12],[27] with a wide list of references, and I must
be sorry for the incomplete bibliography. Here I present a family of operators
tested for commutation among themselves. The proof is simple, but I use some
facts that we know very well from the relationship between Ginibre multimatrix
ensembles and polygon gluing, see [15],[16]. In fact, the steps of the proof
are quite elementary. The text is consistent and it’s just a straight
calculation with a little trick to make it easier.

##  2 Commuting Hamiltonins I

Consider the following oscillator algebra:

$[\phi^{\dagger}_{i,j},\phi^{\dagger}_{i^{\prime},j^{\prime}}]=[\phi_{i,j},\phi_{i^{\prime},j^{\prime}}]=0,\quad
0\leq i,j,i^{\prime},j^{\prime}\leq N$ (1)
$[\phi^{\dagger}_{i,j},\phi_{j^{\prime},i^{\prime}}]=\delta_{i,i^{\prime}}\delta_{j,j^{\prime}},\quad
0\leq i,j,i^{\prime},j^{\prime}\leq N$ (2)

The Fock space is generated by the action of the creation operators
$\phi_{i,j},\,0\leq i,j\leq N$ on the vacuum vector $|0\rangle$, and

$\phi^{\dagger}_{i,j}|0\rangle=0,\quad 0\leq i,j\leq N.$ (3)

Matrices with entries $\phi_{i,j},\,0\leq i,j\leq N$ and
$\phi^{\dagger}_{i,j},\,0\leq i,j\leq N$ we denote $\phi$ and $\phi^{\dagger}$
respectively.

Introduce

$H_{n}(A)=\mathrm{tr}\left((\phi^{\dagger}\phi A)^{n}\right)$ (4)

If $A$ is a Hermitian matrix, then the operators $H_{n}(A)$ can be regarded as
the Hamiltonians of the system of bosonic particles. It can be noted that for
$A=I_{N}$ the operator $H_{2}(I_{N})$ can be associated with the Laplace-
Beltrami operator on the group $GL_{N}$ and with the Hamiltonian of the
quantum Calogero system at the special value of the coupling constant, when
the eigenfunctions of the Hamiltonian turn into Schur functions:

$H_{n}(I_{N})s_{\lambda}(\phi C)|0\rangle=E_{n}(\lambda)s_{\lambda}(\phi
C)|0\rangle,\quad C\in GL_{N}$ (5)

where $\lambda$ is a partition, $E_{n}(\lambda)$ is an eigenvalue, and $C$ is
independent of $\phi$.

######  Remark 1.

From the consideration in [16] it follows:

$H_{n}(A)s_{\lambda}(\phi C)|0\rangle=E_{n}(\lambda)s_{\lambda}(\phi
AC)|0\rangle,$ (6)

where $|\lambda|=n$. The relation (6) can be interpreted as an eigenvalue
problem in two cases (i) either $A=I_{N}$ or (ii) $A\neq I_{N},\,AC=C$, which
implies that both $A$ and $C$ degenerate. Case (i) is a specialization of the
”generalized cut and join equation” introduced in [9], and for this case (6)
is true without the restriction $|\lambda|=n$.

A remarkable property of the operators $H_{n}(A)$ is the fact that they
commute with each other:

######  Proposition 1.

We get

$[H_{n},H_{m}]=0$ (7)

for any pair of $n,m\in\mathbb{Z}_{\geq}$.

Proof. Consider the multicomponent analogue of the operators $\phi$ and
$\phi^{\dagger}$:

$[\phi^{(a){\dagger}}_{i,j},\phi^{(b)}{\dagger}_{i^{\prime},j^{\prime}}]=[\phi^{(a)}_{i,j},\phi^{(b)}_{i^{\prime},j^{\prime}}]=0,\quad
0\leq i,j,i^{\prime},j^{\prime}\leq N$ (8)
$[\phi^{(a){\dagger}}_{i,j},\phi^{(b)}_{j^{\prime},i^{\prime}}]=\delta_{i,i^{\prime}}\delta_{j,j^{\prime}},\quad
0\leq i,j,i^{\prime},j^{\prime}\leq N$ (9)
$\phi^{(a){\dagger}}_{i,j}|0\rangle=0,\quad 0\leq i,j\leq N.$ (10)

for $a,b=1,\dots,k$.

Let’s represent the creation operator $\phi^{(a)}_{i,j}$ as an arrow, the
beginning of which will be labeled $i$ and the end labeled $j$. Let’s draw it
as a white dotted arrow, and assign the number $a$ to the arrow itself. The
annihilation operator $\phi^{(a){\dagger}}_{i,j}$ will be represented by a
black dotted arrow with the same number $a$ , but now we assign the label $j$
to the beginning of the operator this arrow and the label $i$ to end.

Then each entry $B^{(a)}_{i,j}$ we depict by a solid black arrow with the
number $a$, we assign the label $i$ to its beginning, and we attribute the
label $j$ to the end. Similarly, each entry $C^{(a)}_{i,j}$ is depicted as a
solid white arrow with the number $a$, we attribute the label $i$ to its
beginning, and the label $j$ to the end.

The trace of the product of several matrices can be represented by a polygon
with directed edges with summation of labels at the vertices. We have two such
products: the first one comes from $H_{n}(A)$ and the second one comes from
$H_{m}(A)$ Which we call black and white polygons resectively. The edges of
the black polygon will be directed in the positive direction
(counterclockwise) and the edges of the white polygon will be directed
negatevely. That is, the transition counterclockwise from one black polygon
edge to another edge corresponds to reading the product under the trace sign
from left to right and the transition clockwise from one white polygon edge to
another edge also corresponds to reading the product under the trace sign from
left to right. If we draw a negatively oriented k-gon on a sphere, then its
complement is a positively oriented k-gon. In what follows, gluing $k$-gons
will be understood as gluing a black $k$-gon with a complement to a white
$k$-gon, see Fig. 1 with triangles for the visualization.

We consider two oppositely oriented $2k$-gonons: the black one generated by
$\mathrm{tr}\left(\phi^{(1){\dagger}}B_{1}\phi^{(2){\dagger}}B_{2}\cdots\phi^{(k){\dagger}}B_{k}\right)$
whose edges are alternating dotted and solid black arrows, and white one
generated by
$\mathrm{tr}\left(\phi^{(k)}C_{k}\phi^{(k-1)}C_{k-1}\cdots\phi^{(1)}C_{1}\right)$
whose edges are alternating dotted and solid white arrows.

In fact, it is more convenient to first consider the case when all matrices
$B_{i},C_{i},\,i=1,\dots,k$ are identical ones. In this case, all edges of
both polygons are shown as dotted arrows, see the see the top images in the
Fig.1. And only then add to this drawing the matrices
$B_{i},C_{i},\,i=1,\dots,k$ at the corners of the polygons as crossbars (solid
arrows) at the corners, see the second from the top of the image in the Fig.1.
Therefore, we will call the matrices $B_{i}$ and $C_{i}$ the black and white
corner matrices, respectively.

One can varify

$\langle
0|\mathrm{tr}\left(\phi^{(1){\dagger}}B_{1}\phi^{(2){\dagger}}B_{2}\cdots\phi^{(k){\dagger}}B_{k}\right)\mathrm{tr}\left(\phi^{(k)}C_{k}\phi^{(k-1)}C_{k-1}\cdots\phi^{(1)}C_{1}\right)|0\rangle=\mathrm{tr}(B_{1}C_{2})\mathrm{tr}(B_{2}C_{3})\cdots\mathrm{tr}(B_{k}C_{1})$
(11)

This relation can be interpreted as a gluing of two $2k$-gons as follows. Each
pair of oppositely directed dotted arrows (one black, one white) with number
$a$ ($a=1,\dots,k$) are glued according to the rule

$\langle
0|\phi^{(a){\dagger}_{i,j}}\phi^{(b)}_{j^{\prime},i^{\prime}}|0\rangle=\delta_{a,b}\delta_{i,i^{\prime}}\delta_{j,j^{\prime}}$

One can see that (11) describes the sphere glued from two polygons with $k$
vertices each is surrounded by negatively oriented 2-gones whose edges are
given by the arrows related to the matrices
$(B_{1},C_{2}),(B_{2},C_{3})\cdots,(B_{k},C_{1})$. Then, the right hand side
in (11) is obvious.

It can be seen that (11) describes a sphere glued from two polygons with $k$
vertices, each of which is surrounded by negatively oriented 2-gons, the edges
of which are given by arrows associated with the matrices
$(B_{1},C_{2}),(B_{2},C_{3})\cdots,(B_{k},C_{1})$. (This sphere can be thought
of as a globe glued together from two hemispheres, on the equator of which
there are $k$ vertices, each of which is surrounded by a digon, two edges of
which belong to the northern and southern hemispheres, respectively). Then the
right side in (11) is obvious.

However, which surface is obtained from the mathematical expectation depends
on which edges of the white polygon with which edges of the black polygon we
glue. If we renumber the edges white polygon like $(k,k-1,\dots,1)\to
i_{k},i_{k-1},\dots,i_{1}$ and glue the polygons again along the dotted arrows
with the same numbers, then another oriented surface can be obtained.

For instance, see the top part of Fig.1. We have

$\langle
0|\mathrm{tr}\left(\phi^{(1){\dagger}}B_{1}\phi^{(2){\dagger}}B_{2}\phi^{(3){\dagger}}B_{3}\right)\mathrm{tr}\left(\phi^{(2)}C_{2}\phi^{(1)}C_{1}\phi^{(3)}C_{3}\right)|0\rangle=\mathrm{tr}(B_{1}C_{2})\mathrm{tr}(B_{2}C_{3})\mathrm{tr}(B_{3}C_{1})$
(12)

since it turns out a sphere obtained from two triangles (two hemispheres:
southern (black) and northern (white)). Here are the faces of the black
triangle are numbered $1,2,3$ if we go around it in a positive direction
relative to the North Pole. The edges of the white triangle are numbered in
the same way if we go around it in a positive direction relative to the South
Pole. We get 3 vertices, each of which has two corners and monodromy of each
the vertex is the product of one black and one white corner matrix.

The expression

$\langle
0|\mathrm{tr}\left(\phi^{(1){\dagger}}B_{1}\phi^{(2){\dagger}}B_{2}\phi^{(3){\dagger}}B_{3}\right)\mathrm{tr}\left(\phi^{(1)}C_{1}\phi^{(2)}C_{2}\phi^{(3)}C_{3}\right)|0\rangle=\mathrm{tr}(B_{1}C_{2}B_{3}C_{1}B_{2}C_{3})$
(13)

describes the gluing of two triangles with edges numbered $1,2,3$ and $2,1,3$,
resulting in a torus with one 6-valent vertex and 6 neighboring corners of
alternating colors, see the bottom half of the figure 1.

Figure 1: Gluing black and white triangles

We get

######  Lemma 1.

$\langle
0|\mathrm{tr}\left(\phi^{(1){\dagger}}B_{1}\phi^{(2){\dagger}}B_{2}\cdots\phi^{(k){\dagger}}B_{k}\right)\mathrm{tr}\left(\phi^{(i_{k})}C_{i_{k}}\cdots\phi^{i_{1}}C_{i_{k}}\right)|0\rangle=\mathrm{tr}(W_{1})\cdots\mathrm{tr}(W_{V})$
(14)

where $V$ is the number of vertices, and each $W_{\alpha}$ is a monodromy
obtained as the product of corner matrices around the vertex $\alpha$ while
traversing it clockwise.

######  Remark 2.

An important statement is that the corner matrices associated with each vertex
alternate between black and white as you go around the vertex. The vertex
$\alpha$ of valence $2v$ has a monodromy of the form
$W_{\alpha}=(B_{i_{1}}C_{j_{1}})\cdots(B_{i_{v}}C_{j_{v}})$, where the numbers
of the corner matrices $i_{1},\dots,i_{v}$ and $j_{1},\dots,j_{v}$ belong to
the set $1,\dots,k$. For example, see the right hand sides of the equations
(11), (12), (13), see figure 1 for a pair of examples.

Now, one can write

$:\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{n}\right):\,:\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{m}\right):=\sum_{k=0}^{\min(n,m)}:Q_{k}:$ (15)

where $k$ is the number of couplings $\langle 0|\phi^{\dagger}\phi|0\rangle$
according to the Wick rule. Each $:Q_{k}:$ is the sum which includes (i) the
sum over the choice of samples of $k$ operators $\phi^{\dagger}$ in the first
multiplier in (15) and the sum over the choice of samples $\phi$ in the second
multiplier in the left hand side of (15) (ii) the sum over the choice of
pairing in the chosen samples which is the sum over elements of the
permutation group $S_{k}$.

where $k$ is the number of pairings $\langle 0|\phi^{\dagger}\phi|0\rangle$
according to Wick’s rule. Each $:Q_{k}:$ is the sum including (i) the sum over
the choice of samples from $k$ $\phi^{\dagger}$ operators in the first factor
in (15) and the sum over the choice of $\phi$ samples in the second factor on
the left hand side (15) (ii) the sum over the choice of pairing in the
selected samples, which is the sum over the elements of the permutation group
$S_{k}$.

######  Remark 3.

To describe different pairings we number the chosen $\phi^{\dagger}$ with the
numbers $1,\dots,k$ in

$\underbrace{(\phi^{\dagger}\phi A)\cdots(\phi^{\dagger}\phi A)}_{n}$ (16)

in the order from the left to the right. In the product

$\underbrace{(\phi^{\dagger}\phi A)\cdots(\phi^{\dagger}\phi A)}_{m}$ (17)

we number the chosen $\phi$ with the numbers $\sigma(1),\dots,\sigma(k)$ from
the left to the right. We couple the $\phi^{\dagger}$ to $\phi$ with the same
number.

One should have in mind that under the sign of the trace the product a cyclic
permutation does cange the trace. Then we can place the of the
$\phi^{\dagger}_{1}$ and $\phi_{1}$ on the leftmost place resepctively in (16)
and (17).

Symbolically one can write

$:Q_{k}:=\sum_{\rm samples}\sum_{\sigma\in S_{k}}:q_{\sigma}(k\times k\,{\rm
samples}):$ (18)

The terms $:Q_{0}:,:Q_{1}:$ and $:Q_{2}:$ are the easiest ones:

$:Q_{0}:=:\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{n}\right)\,\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{m}\right):$ $:Q_{1}:=nm:\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n+m-1}\right):$ $:Q_{2}:=nm\sum_{n_{1},n_{2},m_{1},m_{2}\atop
n_{1}+n_{2}=n-2,\,m_{1}+m_{2}=m-2}:\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{1}+m_{2}-1}\right)\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{2}+m_{1}-1}\right):$

For $k=3$ we use (12) and (13):

$:Q_{3}:=$ $nm\sum_{n_{1},n_{2},n_{3},\,n_{1}+n_{2}+n_{3}=n-3\atop
m_{1},m_{2},m_{3},\,m_{1}+m_{2}+m_{3}=m-3}:\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{1}+m_{2}-1}\right)\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{2}+m_{3}-1}\right)\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{3}+m_{1}-1}\right):$
$+nm\sum_{n_{1},n_{2},n_{3},\,n_{1}+n_{2}+n_{3}=n-3\atop
m_{1},m_{2},m_{3},\,m_{1}+m_{2}+m_{3}=m-3}:\mathrm{tr}\left(A\left(\phi^{\dagger}\phi
A\right)^{n_{1}+m_{2}-1}A\left(\phi^{\dagger}\phi
A\right)^{n_{3}+m_{1}-1}A\left(\phi^{\dagger}\phi
A\right)^{n_{2}+m_{3}-1}\right):$

For each $k$ we have

$:Q_{k}:=n\sum^{\prime}_{n_{1},\dots,n_{k}\atop
m_{1},\dots,m_{k}}\sum_{\sigma\in S_{k}}:q_{\sigma}(k):$ (19)

where $\sigma$ enumerates different ways of couplings of each $\phi$ among
chosen $k$ samples from the left hand side to the chosen $k$ samples of
$\phi^{\dagger}$ from the left hand side. There are $\left(n\atop k\right)$
and $\left(m\atop k\right)$ ways to choose the samples and there are
$|S_{k}|=k!$ different pairings (in fact $(k-1)!$ different pairings because
of the cyclic permutations). Actually these numbers are not important for us.

When the choice of samples and the numbering are fixed one can write the left
side of (15) in form (14) where

$B_{i}=\phi A\left(\phi^{\dagger}\phi A\right)^{n_{i}},\quad
C_{i}=A\left(\phi^{\dagger}\phi A\right)^{m_{i}}\phi^{\dagger}$ (20)

where the numbers $n_{1},\dots,n_{k}$ measure a ’distance’ between neiboring
$\phi^{\dagger}$ chosen in (16). There are the following equalities

$\sum_{a=1}^{v}n_{i_{a}}=n-k$ (21) $\sum_{a=1}^{v}m_{j_{a}}=m-k$ (22)

Each way of pairing yields a certain embedded graph. Each graph gives rise to
a product of traces of the monodromies around the vertices, see Lemma 1 where
the structure of each monodromy is clarified by the Remark 2, therefore the
trace of each monodromy $W_{\alpha}$ has a form

$\mathrm{tr}W_{\alpha}=\mathrm{tr}\left((B_{i_{1}}C_{j_{1}})\cdots(B_{i_{v}}C_{j_{v}})\right)=\mathrm{tr}\left(A(\phi^{\dagger}\phi
A)^{n_{i_{1}}+m_{j_{1}}+1}\cdots A(\phi^{\dagger}\phi
A)^{n_{i_{v}}+m_{j_{v}}+1}\right)$ (23)

with some $i_{1},j_{1},\dots,i_{v},j_{v}$ where $2v$ is the valence of a
vertex $\alpha$. Thus each trace of monodrome is completely characterized by
the ordered set

$n_{i_{1}}+m_{j_{1}},\dots,n_{i_{v}}+m_{j_{v}}$ (24)

given up to a cyclic permutation. Let us call it the spectrum of the vertex
$\alpha$.

Now we will compare these spectra.

Similarly for the second term in the commutator we write

$:\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{m}\right)::\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{n}\right):\,=\sum_{k=0}^{\min(n,m)}:Q^{*}_{k}:$ (25)

and

$:Q^{*}_{k}:=\sum_{{\rm samples}^{*}}\sum_{\sigma\in
S_{k}}:q^{*}_{\sigma}(k\times k\,{\rm samples}^{*}):$ (26)

We will compare terms $:q_{\sigma}(k\times k\,{\rm samples}):$ and
$:q^{*}_{\sigma}(k\times k\,{\rm samples}^{*}):$ for a given $\sigma$. We also
relates the samples as follows: to each chosen $\phi^{\dagger}$ from a sample
in (18) we choose the nearest right neiboring $\phi$ for the sample in (26)
and to each chosen $\phi$ of a sample in (18) we choose the nearest left
neiboring $\phi^{\dagger}$ for the associated sample in (26). Such pairs of
samples we will call dual ones.

where $k$ is the number of pairings and for each $k$ we have

$:Q^{*}_{k}:=\sum_{\sigma\in S_{k}}:q^{*}_{\sigma}(k):$ (27)

$\mathrm{tr}W^{*}_{\alpha}=\mathrm{tr}\left((B_{i_{1}}C_{j_{1}})\cdots(B_{i_{v}}C_{j_{v}})\right)=\mathrm{tr}\left(A(\phi^{\dagger}\phi
A)^{n_{i_{1}}+m_{j_{2}}+1}\cdots A(\phi^{\dagger}\phi
A)^{n_{i_{v}}+m_{j_{1}}+1}\right)$ (28)

which is characterized by the spectrum

$n_{i_{1}}+m_{j_{2}},\dots,n_{i_{v}}+m_{1}$ (29)

Now one compare this dual spectrum with the spectrum (24). Spectrums (24) and
(29) can be one-to one related by the cyclic permutation of the numbers
$n_{i_{a}},\,a=1,\dots,v$ related to the vertex $\alpha$ under consideration.
Namely, by

$n_{i_{1}}\to n_{i_{2}},\dots,n_{i_{v}}\to n_{i_{1}}$ (30)

and all $m_{j_{a}},\,a=1,\dots,v$ in (29) are the same as in (24). These
replacements do not violate conditions (21) and (22).

The same correspondences between terms resulting from (15) and from (25) we
get for all vertices of the resulting graph, and one gets it for all graphs.
The proof is complete.

For a given partition $\mu=(\mu_{1},\dots,\mu_{\ell}$, $\ell=1,2,\dots$ we
introduce

$H_{\mu}(A)=:\prod_{i=1}^{\ell}\mathrm{tr}\left(\left(\phi^{\dagger}\phi
A\right)^{\mu_{i}}\right):$ (31)

In the same way as we prove Proposition 1 one can prove that

$[H_{n}(A)\,,\,H_{\mu}(A)]=0$ (32)

for $n=1,2,\dots$ and any partition $\mu=(\mu_{1},\mu_{2},\dots)$.

In this case for each given $k$ we glue a single black $k$-gon related to the
picking out the discribed samples in
$\mathrm{tr}\left(\left(\phi^{\dagger}\phi A\right)^{n}\right)$ to the set of
white polygones obtained as picking out of the bosonic operators from the
product $h_{\mu}(A)$. In this case we use the same cyclic permutation of the
numbers $n_{i}$ described above.

##  3 Commuting Hamiltonins II

Suppose $A=1+\epsilon\textsc{a}$, where $\textsc{a}\in{\rm Mat}_{N\times N}$,
$\epsilon$ is a parameter.

Let us introduce

$h_{n}(A)=:\mathrm{tr}\left(a\left(\phi^{\dagger}\phi\right)^{n}\right)$ (33)

and

$h_{\lambda}(A)=:\prod_{i=1}^{\ell}\mathrm{tr}\left(a\left(\phi^{\dagger}\phi\right)^{\lambda_{i}}\right):$
(34)

where $\lambda=(\lambda_{1},\dots,\lambda_{\ell}$ is a partition. Then from
Proposition 1 and from

######  Lemma 2.

$\left[H_{n}(I_{N}),H_{m}(I_{N})\right]=0,$ (35)

from

######  Lemma 3.

$\left[H_{n}(I_{N}),h_{\lambda}(a)\right]=0$ (36)

it follows

######  Corollary 1.

Let $\textsc{a}\in{\rm Mat}_{N\times N}$

$\left[h_{n}(a),h_{\lambda}(a)\right]=0$ (37)

Each of Lemmas (2),(3) and actually (37) is proven in the same way as
Proposition 1. We omit the details.

Being written in the form of differential operators and without the sign of
normal ordering Lemmas (2),(3) and also (37) are quite known, for example see
[3].

##  4 Discussion

(i) We found a series of commuting Hermitian operators, this means that these
is a quantum integrable system. We mark that the eigenfunctions for the
Hamiltonians $h_{n}(A)$ are yet unknown in case of general Hermitian matrices.
This is a problem to be solved together with a number of problems, say, solved
in [26] for a number of quantum integrable problems.

(ii) It will be interesting to compare these results to the results obtained
in [19],[20],[17],[18],[12],[13],[14],[24],[25],[2],[3].

(iii) Links with the quantum Calogero model is the other interesting direction
to work out. In this relation the following works should be pointed out
[8]-[11],[22],[23],[4]

## Acknowledgements

The author is grateful to George Shurygin for important discussions and to
A.D.Mironov, D.Gurevich and A.Zheglov for inspirating talks on the related
subjects. I also thank A.E.Mironov and I.A.Taimanov for the invitations to
Novosibirsk where this work was finalized. The work was supported by the
Russian Science Foundation (Grant No.20-12-00195).

## References

  * [1] J. Ambjorn and L. Chekhov “The matrix model for hypergeometric Hurwitz number”, Theoret. and Math. Phys., 1 81:3 (2014), 1486-1498; arXiv:1409.3553
  * [2] D.Gurevich, P.Pyatov, P.Saponov, “Braided Weyl algebras and differential calculus on $U(u(2))$”, J. Geom. Physics 62:5 (2012) 1175-1188; arXiv:1112.6258
  * [3] D. Gurevich, P. Saponov, D. Talalaev, “KZ equations and Bethe subalgebras in generalized Yangians related to compatible R-matrices”, Journal of Integrable Systems, Volume 4, Issue 1, 2019, xyz005.
  * [4] D. Gurevich, V. Petrova, P. Saponov, “q-Casimir and q-cut-and-join operators related to Reflection Equation Algebras”, arXiv:2110.04354
  * [5] Y. Ikeda, “Quasidifferential operator and the quantum invariant shifting method”, Theoretical and Mthematical physics, 212 vol 1 (2022) pp 925-931
  * [6] S. K. Lando, A. K. Zvonkin  Graphs on Surfaces and their Applications, Encyclopaedia of Mathematical Sciences, Volume 141, with appendix by D. Zagier, Springer, N.Y., 2004.
  * [7] I.G. Macdonald, Symmetric Functions and Hall Polynomials, Clarendon Press, Oxford, New York, 2nd ed., 1995.
  * [8] A. D. Mironov, A. Yu. Morozov and S. M. Natanzon, ”Complect set of cut-and-join operators in the Hurwitz-Kontsevich theory”, Theor. and Math.Phys. 166:1,(2011), pp.1-22; arXiv:0904.4227
  * [9] A. D. Mironov, A. Yu. Morozov and S. M. Natanzon, ”Universal Algebras of Hurwitz Numbers“, arXiv:0909.1164
  * [10] A. D. Mironov, A. Yu. Morozov and S. M. Natanzon, Algebra of differential operators associated with Young diagramms, J. Geom. and Phys. n.62 (2012), 148-155; arXiv:1012.0433
  * [11] A. D. Mironov, A. Yu. Morozov and S. M. Natanzon, Integrability properties of Hurwitz partition functions. II. Multiplication of cut-and-join operators and WDVV equations JHEP 11 (2011) 097; arXiv:1108.0885
  * [12] Molev A., Nazarov M., Olshanski G., Yangians and classical Lie algebras, Russian Math. Surveys 51 (1996), 205-282, arXiv:hep-th/9409025.
  * [13] M.Nazarov, G.Olshanski, ”Bethe Subalgebras in Twisted Yangians“, Comm Math Phys 178 (1996) pp 483-506
  * [14] M. Nazarov, E. Sklyanin Integrable Hierarchy of the Quantum Benjamin-Ono Equation, SIGMA 9 (2013) 078
  * [15] S. M. Natanzon and A. Yu. Orlov, Hurwitz numbers from matrix integrals over Gaussian measure, Proc.Symposium in Pure Math. 103 1 (2021) Integrability, Quantization and Geometry, pp 337-377; arXiv:2002.00466.
  * [16] S. M. Natanzon and A. Yu. Orlov,“Hurwitz numbers from Feynman diagrams”, Theoretical and Mathematical Physics 204 (3), (2020) 1166-1194; arXiv:2006.07396
  * [17] A. Okounkov, Quantum Immanants and Higher Capelli Identities, Transformation Groups, 1 (1996), 99-126
  * [18] A. Okounkov, Young Basis, Wick Formula, and Higher Capelli Identities, Internat. Math. Res. Notices, 17 (1996), 817-839
  * [19] G. I. Olshanski, Yangians and universal enveloping algebras. Zapiski Nauchn. Semin. LOMI,vol. 164 (1987), 142-150 (Russian); English translation: J. Soviet Math. 47, no. 2(1989), 2466-2473.
  * [20] G. I. Olshanski  Representations of infinite-dimensional classical groups, limits of envelopingalgebras, and Yangians. In:Topics in Representation Theory (A. A. Kirillov, ed.).Advances in Soviet Math., vol. 2. Amer. Math. Soc., Providence, R.I., 1991, 1-66.
  * [21] A. M. Perelomov, V. S. Popov, Casimir operators for classical groups Doklady AN SSSR 174 N 2 (1967) 287-290 in Russian
  * [22] N.Reshetikhin, “Spin Calogero-Moser periodic chains and two dimensional Yang-Mills theory with corners”, arXiv:2303.10579
  * [23] A.N. Sergeev, A.P. Veselov, Dunkl Operators at Infinity and Calogero-Moser Systems, November 2013 International Mathematics Research Notices 2015(21)
  * [24] G.I.Sharygin, “$L_{\infty}$-derivations and the argument shift method for deformation quantization algebras”, Acta Mathematica Spalatensia Vol.1 (2021) 61-86 https://doi.org/10.32817/ams.1.1.6; arXiv:1912.00586
  * [25] G.I.Sharygin, “Deformation quantization and the action of Poisson vector fields”, Lobachevskii J Math 38, 1093-1107 (2017), https://doi.org/10.1134/S1995080217060129; arXiv:1612.02673
  * [26] N.A.Slavnov, “Algebraic Bethe anzats” 2007 Russ. Math. Surv. 62 727 DOI 10.1070/RM2007v062n04ABEH004430
  * [27] A.B.Zheglov, “Algebraic geometric properties of spectral surfaces of quantum integrable systems and their isospectral deformations,” in Geometric Methods in Physics XXXVIII: Workshop, Bialoweiza, Poland, 2019 (Birkhauser, Cham, 2020), Trends Math., pp. 313-331; A.B.Zheglov, “Schur-Sato theory for quasi-elliptic rings“ Steklov Institute 2023 (in Russian)
  * [28] D.P.Zhelobenko, Compact Lie groups and their representations In Russian

##  Appendix A Partitions and Schur functions

Let us recall that the characters of the unitary group $\mathbb{U}(N)$ are
labeled by partitions and coincide with the so-called Schur functions [7]. A
partition $\lambda=(\lambda_{1},\dots,\lambda_{n})$ is a set of nonnegative
integers $\lambda_{i}$ which are called parts of $\lambda$ and which are
ordered as $\lambda_{i}\geq\lambda_{i+1}$. The number of non-vanishing parts
of $\lambda$ is called the length of the partition $\lambda$, and will be
denoted by $\ell(\lambda)$. The number $|\lambda|=\sum_{i}\lambda_{i}$ is
called the weight of $\lambda$. The set of all partitions will be denoted by
$\mathbb{P}$.

The Schur function labelled by $\lambda$ may be defined as the following
function in variables $x=(x_{1},\dots,x_{N})$ :

$s_{\lambda}(x)=\frac{\mathrm{det}\left[x_{j}^{\lambda_{i}-i+N}\right]_{i,j}}{\mathrm{det}\left[x_{j}^{-i+N}\right]_{i,j}}$
(38)

in case $\ell(\lambda)\leq N$ and vanishes otherwise. One can see that
$s_{\lambda}(x)$ is a symmetric homogeneous polynomial of degree $|\lambda|$
in the variables $x_{1},\dots,x_{N}$, and $\deg x_{i}=1,\,i=1,\dots,N$.

######  Remark 4.

In case the set $x$ is the set of eigenvalues of a matrix $X$, we also write
$s_{\lambda}(X)$ instead of $s_{\lambda}(x)$.

There is a different definition of the Schur function as quasi-homogeneous
non-symmetric polynomial of degree $|\lambda|$ in other variables, the so-
called power sums, $\mathbf{p}=(p_{1},p_{2},\dots)$, where $\deg p_{m}=m$.

For this purpose let us introduce

$s_{\\{h\\}}(\mathbf{p})=\mathrm{det}[s_{(H_{i}+j-N)}(\mathbf{p})]_{i,j},$

where $\\{h\\}$ is any set of $N$ integers, and where the Schur functions
$s_{(i)}$ are defined by $e^{\sum_{m>0}\frac{1}{m}p_{m}z^{m}}=\sum_{m\geq
0}s_{(i)}(\mathbf{p})z^{i}$. If we put $H_{i}=\lambda_{i}-i+N$, where $N$ is
not less than the length of the partition $\lambda$, then

$s_{\lambda}(\mathbf{p})=s_{\\{h\\}}(\mathbf{p}).$ (39)

The Schur functions defined by (38) and by (39) are equal,
$s_{\lambda}(\mathbf{p})=s_{\lambda}(x)$, provided the variables $\mathbf{p}$
and $x$ are related by the power sums relation

$p_{m}=\sum_{i}x_{i}^{m}$ (40)

In case the argument of $s_{\lambda}$ is written as a non-capital fat letter
the definition (39), and we imply the definition (38) in case the argument is
not fat and non-capital letter, and in case the argument is capital letter
which denotes a matrix, then it implies the definition (38) with
$x=(x_{1},\dots,x_{N})$ being the eigenvalues.

Relation (39) relates polynomials $s_{\lambda}$ and $\mathbf{p}_{\Delta}$ of
the same degree $d=|\lambda|=|\Delta|$. Explicitly one can write

$\mathbf{p}_{\Delta}=\sum_{\lambda\in\Upsilon_{d}}\frac{{\rm
dim}\lambda}{d!}\zeta_{\Delta}\varphi_{\lambda}(\Delta)s_{\lambda}(\mathbf{p})$
(41)

and

$s_{\lambda}(\mathbf{p})=\frac{{\rm
dim}\lambda}{d!}\sum_{\Delta\in\Upsilon_{d}}\varphi_{\lambda}(\Delta)\mathbf{p}_{\Delta}.$
(42)

The last relation is called the character map relation. Here

$\frac{{\rm dim}\lambda}{d!}:=\frac{\prod_{i<j\leq
N}(\lambda_{i}-\lambda_{j}-i+j)}{\prod_{i=1}^{N}(\lambda_{i}-i+N)!}$ (43)

(see example 1 in sect 1 and example 5 in sect 3 of chapt I in [7]), where
$N\geq\ell(\lambda)$. As one can check, the right hand side does not depend on
$N$. (We recall that $\lambda_{i}=0$ in case $i>\ell(\lambda)$. The number
${\rm dim}\lambda$ is an integer.

The factors $\varphi_{\lambda}(\Delta)$ satisfy the following orthogonality
relations

$\zeta_{\Delta}\sum_{\lambda\in\Upsilon_{d}}\left(\frac{{\rm\dim}\lambda}{d!}\right)^{2}\varphi_{\lambda}(\mu)\varphi_{\lambda}(\Delta)=\delta_{\Delta,\mu}$
(44)

and

$\left(\frac{{\rm\dim}\lambda}{d!}\right)^{2}\sum_{\Delta\in\Upsilon_{d}}\zeta_{\Delta}\varphi_{\lambda}(\Delta)\varphi_{\mu}(\Delta)=\delta_{\lambda,\mu}.$
(45)

##  Appendix B Operators $H_{\lambda}(A)$ and Hurwitz numbers

The consideration of multimatrix models (like considered in [1]) and Hurwitz
numbers in [15],[16] can be naturaly reformulated as the relations of the
bosonic Hamiltonians $H_{\lambda}(A)$ and Hurwitz numbers ${\cal H}()$ which
enumerate coverings of Riemann sphere with three branch points yields

$H_{\lambda}(A)\prod_{i}\mathrm{tr}\left(\left(\phi
C\right)^{\mu_{i}}\right)|0\rangle=\sum_{\nu_{i}}{\cal{H}}\left(\lambda,\mu,\nu\right)\mathrm{tr}\left(\left(\phi
AC\right)^{\nu_{i}}\right)|0\rangle$ (46)

where $\lambda,\mu,\nu$ are partitions conditioned by $|\lambda|=|\mu|=|\nu|$
which define ramification profiles in the branch points and
${\cal{H}}\left(\lambda,\mu,\nu\right)$ is the Hurwitz number. It has the
meaning of the structural constant in a Frobenius algebra related to Hurwitz
numbers.

By the characteristic map relations (42) and by (44),(45) it can be rewritten
in form

$H_{\lambda}(A)s_{\mu}\left(\left(\phi
C\right)\right)|0\rangle=\frac{|\mu|!}{\dim\mu}\chi_{\mu}(\lambda)s_{\mu}\left((\phi
AC\right)|0\rangle$ (47)

where $\chi_{\mu}(\lambda)$ is the character of the irreducable representation
$\mu$ of the symmetric group $S_{d},\,d=|\mu|$ evaluated on the cycle class
$\lambda$. In case $A=C=I_{N}$ it is a particular form of Mironov-Morozov-
Natanzon cute-and-join greneralized relation [8]. Related problems were
discussed in [21], see also [28] for some links.