# Trusted detector noise analysis for discrete modulation schemes of
continuous-variable quantum key distribution

Jie Lin  Institute for Quantum Computing and Department of Physics and
Astronomy, University of Waterloo, Waterloo, Ontario, Canada N2L 3G1  Norbert
Lütkenhaus  Institute for Quantum Computing and Department of Physics and
Astronomy, University of Waterloo, Waterloo, Ontario, Canada N2L 3G1

###### Abstract

Discrete-modulated continuous-variable quantum key distribution protocols are
promising candidates for large-scale deployment due to the large technological
overlap with deployed modern optical communication devices. The security of
discrete modulation schemes has previously analyzed in the ideal detector
scenario in the asymptotic limit. In this work, we calculate asymptotic key
rates against collective attacks in the trusted detector noise scenario. Our
results show that we can thus cut out most of the effect of detector noise and
obtain asymptotic key rates similar to those had we access to ideal detectors.

##  I Introduction

Quantum key distribution (QKD) [Bennett1984, Ekert1991] is a key establishment
protocol with the provable information-theoretic security. Various QKD
protocols with different advantages have been proposed, analyzed and
implemented. See e.g. Refs. [Scarani2009, Diamanti2015, Xu2020, Pirandola2019]
for reviews. Continuous-variable (CV) QKD protocols [Grosshans2002,
Silberhorn2002, Grosshans2003a, Weedbrook2004] have competitive advantages in
terms of massive deployment due to a significant overlap of devices used with
those in the optical classical communications. Many experiments of CVQKD on
both Gaussian modulation schemes such as Refs. [Lodewyck2007, Jouguet2013,
Qi2015, Soh2015, Huang2015, Huang2016, Zhang2020l] and discrete modulation
schemes like Refs. [Wittmann2010, Wang2013, Heim2014, Hirano2017,
Laudenbach2019a] have been demonstrated.

On one hand, Gaussian modulation schemes are simpler to analyze theoretically
than discrete modulation schemes, and they give secret key rates close to the
theoretical limits [Takeoka2014, Pirandola2017]. On the other hand, continuous
modulation itself is usually only approximated by a (relatively large) set of
discrete modulation settings. This approximation needs to be taken into
account during the full security analysis (see e.g. [Furrer2012, Jouguet2012,
Kaur2019]). Moreover, as Gaussian modulation schemes often require more
resources in terms of randomness and classical postprocessing resources,
discrete modulation schemes thus offer further simplification of
implementation. However, in previous experimental demonstrations of discrete
modulation schemes, either only effective entanglement has been verified
[Wittmann2010, Heim2014], which is a necessary precondition for QKD, or the
security has been established only against a restricted subset of collective
attacks [Wang2013, Hirano2017]. By now, there are asymptotic security proofs
against arbitrary collective attacks for binary [Zhao2009], ternary
[Bradler2018] as well as quaternary modulation schemes and beyond [Ghorai2019,
Lin2019]. Previous proofs for a general discrete modulation scheme
[Ghorai2019, Lin2019] investigate the untrusted detector noise scenario where
the imperfection of detectors can be controlled by Eve (and thus one can treat
detectors as ideal). In reality, the amount of electronic noise of an off-the-
shelf homodyne detector in a CVQKD experiment can be much higher than the
channel excess noise. As a result, the key rate in the untrusted detector
noise scenario drops very quickly to zero as the transmission distance
increases. However, since detectors are securely located in Bob’s laboratory
where Eve is unable to access, it is reasonable to assume that Eve does not
control detector imperfections especially those noise sources that are on the
electronic circuitry, which is more remote from the quantum mechanical part of
the signal detection.

In this work, we extend our previous analysis [Lin2019] to the trusted
detector noise scenario where detector imperfections (detector inefficiency
and electronic noise) are not accessible to Eve. We remark that Gaussian
modulation schemes have been analyzed in the trusted detector noise scenario
[Lodewyck2007, Fossier2009, Usenko2016, Laudenbach2019b] and it is known that
the effects of electronic noise and detector inefficiency on the key rates are
not very significant in the trusted detector noise scenario compared to the
ideal detector scenario under realistic experimental conditions. As we show in
this work, this observation also holds for discrete modulation schemes.
However, we emphasize that our analysis is not a trivial application of the
method used for Gaussian modulation protocols and instead we adopt a different
approach. The reason is that the previous method used in the Gaussian
modulation protocols relies on the fact [Navascues2006, Garcia-Patron2006]
that Eve’s optimal attacks for Gaussian modulation schemes correspond to
Gaussian channels, which make it easy to decouple the trusted detector noise
from the channel noise when one looks at the covariance matrix. However, we
cannot assume Gaussian channels here since Gaussian attacks are not expected
to be optimal for discrete modulation schemes. In our analysis, based on a
(commonly used) quantum optical model of the imperfect detector, we find its
corresponding mathematical description in terms of positive operator-valued
measure (POVM) and then use this POVM to construct observables corresponding
to quantities that are measured experimentally. These observables are then
used in our security proof. We also point out the crucial difference between
our analysis and Ref. [Namiki2018] for discrete modulation schemes: Our
asymptotic analysis is valid against arbitrary collective attacks while Ref.
[Namiki2018] uses the Gaussian channel assumption and thus its security
analysis [Namiki2018] is restricted to Gaussian collective attacks.

Our main contributions of this work are finding a suitable POVM description of
a noisy heterodyne detector and revising our previous analysis [Lin2019] by
using a new set of constraints from this POVM in the numerical key rate
optimization problem [Coles2016, Winick2018]. Similar to our previous
analysis, this method is applicable to both direct reconciliation and reverse
reconciliation schemes. Moreover, we study the postselection of data
[Silberhorn2002] in the trusted detector noise scenario. As a concrete
example, we apply our method to the quadrature phase-shift keying scheme with
heterodyne detection and focus on the reverse reconciliation scheme. Our
analysis here is still restricted to the asymptotic regime against collective
attacks and we make the same photon-number cutoff assumption as in the
previous works [Ghorai2019, Lin2019] to truncate the infinite-dimensional
Hilbert space in order to perform the numerical calculation. From the
numerical observation, we believe the results do not depend on the choice of
cutoff when it is appropriately chosen. We direct the discussion about this
assumption to Sec. III B of Ref. [Lin2019] and leave it for future work to
provide an analytical justification of this assumption beyond the numerical
evidences. To extend our analysis to the finite-key regime, we remark that we
have recently extended the numerical method of Ref. [Winick2018] on which our
analysis is based to include finite key analysis [George2020]. However, there
remain some technical challenges to solve before we can apply this method to
this protocol and thus we leave the finite key analysis for future work.

The rest of paper is outlined as follows. In Sec. II, we review the protocol
and proof method in Ref. [Lin2019]. We then present a trusted detector noise
model and the corresponding POVM description in Sec. III. In Sec. IV, we
modify the key rate optimization problem to take trusted detector noise into
account. We discuss our simulation method in Sec. V. We show the simulation
results without postselection in Sec. VI and with postselection in Sec. VII.
Finally, we summarize the results and provide insights for future directions
in Sec. VIII. We present technical details in the Appendices.

##  II Background

Our key rate calculation in the trusted detector noise scenario uses a similar
proof method as in our previous work [Lin2019]; that is, we numerically
perform the key rate optimization problem [Winick2018] with a modified set of
constraints. In particular, we discuss how to modify the key rate optimization
problem in Sec. IV based on the POVM description of a noisy heterodyne
detector in Sec. III. To help understand this modification, we first review
main ideas of the proof in Ref. [Lin2019].

For illustration, we focus on the quadrature phase-shift keying scheme with
heterodyne detection. We remark that since the previous proof can be
generalized to other discrete modulation schemes beyond four coherent states
at the cost of more computational resources, our modified analysis for the
trusted detector noise scenario can also be generalized in the same way.
Moreover, one can apply a similar idea presented in this paper to study the
homodyne detection scheme in the presence of trusted detector noise.

###  II.1 Quadrature phase-shift keying protocol

To begin with, we review the quadrature phase-shift keying (QPSK) scheme with
heterodyne detection. The quantum part of the protocol consists of many
repetitions of the following two steps: (1) Alice obtains a uniform random
number $x\in\\{0,1,2,3\\}$, selects the state $\ket{\alpha_{x}}=\ket{\alpha
e^{\frac{ix\pi}{2}}}$ from the set
$\\{\ket{\alpha},\ket{i\alpha},\ket{-\alpha},\ket{-i\alpha}\\}$ according to
the value of $x$, and sends it to Bob. (2) Bob applies the heterodyne
detection to the received state and obtains a measurement outcome
$y\in\mathbb{C}$.

After the quantum communication phase of the protocol, they proceed with the
classical postprocessing part of the protocol including announcement, sifting,
parameter estimation, key map (with discretization), error correction and
privacy amplification. In particular, the parameter estimation step is done
according to the key rate optimization problem in Eq. (22) discussed later. As
the classical part is similar to other CVQKD protocols and is not the focus of
our discussion, we highlight only the key map step below for our discussion
and skip the details of the remaining classical postprocessing procedures
here. We direct readers to Ref. [Lin2019] for a more detailed description.

In the case of reverse reconciliation, for each measurement outcome $y$
written as $y=\absolutevalue{y}e^{i\theta}$, where
$\theta\in[-\frac{\pi}{4},\frac{7\pi}{4})$, Bob obtains a discretized value
$z$ according to the following rule:

$z=\begin{cases}j,&\text{if
}\theta\in\Big{[}\frac{(2j-1)\pi}{4},\frac{(2j+1)\pi}{4}\Big{)}\ \ \text{and}\
\absolutevalue{y}\geq\Delta_{a}\\\ \perp,&\text{otherwise},\end{cases}$ (1)

where $j\in\\{0,1,2,3\\}$ and $\Delta_{a}$ is a postselection parameter that
needs to be optimized for the selected protocol and experimental parameters
111In our previous work [Lin2019], we also considered a postselection
parameter $\Delta_{p}$ related to the phase of the measurement outcome.
However, when we performed simulations with this postselection parameter, we
did not obtain any noticeable advantage. Thus, we omit the introduction of
this parameter in this work.. A protocol without postselection corresponds to
setting $\Delta_{a}=0$.

To perform the postselection of data in combination of reverse reconciliation,
Bob announces positions where he obtains the value $\perp$. After removing the
positions related to the value $\perp$, Alice’s string $\vec{\mathbf{X}}$
consists of her random number $x$’s in the remaining positions, and Bob’s raw
key string $\vec{\mathbf{Z}}$ consists of his discretized outcome $z$’s left.
(Alternatively, they may choose to announce and keep positions related to the
value $\perp$ and let the privacy amplification subprotocol effectively remove
those positions.) Alice and Bob may decide to recast their strings to binary
strings before or during the error correction step depending on their choice
of the error-correction code. For the consistency of our presentation, we use
the alphabet $\\{0,1,2,3\\}$ and let $\mathbf{X}$ and $\mathbf{Z}$ denote the
single-round version of $\vec{\mathbf{X}}$ and $\vec{\mathbf{Z}}$,
respectively.

Figure 1: Key map for quadrature phase-shift keying scheme in terms of Bob’s
measurement outcome $y\in\mathbb{C}$. Each colored region $\mathcal{A}_{j}$
corresponds to a discretized key value $j$. The measurement outcome in the
central disk with a radius $\Delta_{a}$ is discarded during the postselection
of data and is mapped to the symbol $\perp$.

###  II.2 Review of security proof method

####  II.2.1 Source-replacement scheme

The first step of our security proof is to apply the source-replacement scheme
[Bennett1992, Grosshans2003b, Curty2004, Ferenczi2012] to obtain an equivalent
entanglement-based scheme for the given prepare-and-measure protocol. Then we
proceed to prove the security of the entanglement-based scheme.

Given Alice’s state ensemble $\\{\ket{\alpha_{x}},p_{x}\\}$ (where
$p_{x}=\frac{1}{4}$ for this protocol) for her preparation in the prepare-and-
measure scheme, Alice effectively prepares a bipartite state
$\ket{\Psi}_{AA^{\prime}}$ in the source-replacement scheme, which is defined
as

$\ket{\Psi}_{AA^{\prime}}=\sum_{x=0}^{3}\sqrt{p_{x}}\ket{x}_{A}\ket{\alpha_{x}}_{A^{\prime}},$
(2)

where $\\{\ket{x}\\}$ is an orthonormal basis for register $A$. Then Alice
sends the register $A^{\prime}$ to Bob via an insecure quantum channel and
keeps register $A$ for her measurement described by the POVM
$M^{A}=\\{M^{A}_{x}=\outerproduct{x}{x}:x\in\\{0,1,2,3\\}\\}$. The quantum
channel that maps register $A^{\prime}$ to Bob’s register $B$ is described by
a completely positive (CP) trace-preserving (TP) map,
$\mathcal{E}_{A^{\prime}\rightarrow B}$ and is assumed to be under Eve’s
control. Thus, Alice and Bob’s joint state $\rho_{AB}$ before their
measurements is

$\displaystyle\rho_{AB}=(\operatorname{id}_{A}\otimes\mathcal{E}_{A^{\prime}\rightarrow
B})(\outerproduct{\Psi}{\Psi}_{AA^{\prime}}),$ (3)

where $\operatorname{id}_{A}$ is the identity channel on Alice’s system $A$.

When Alice performs a local measurement using her POVM $\\{M^{A}_{x}\\}$ on
register $A$ and obtains an outcome $x$, she effectively sends the coherent
state $\ket{\alpha_{x}}$ to Bob. Bob’s received state $\rho_{B}^{x}$
conditioned on Alice’s choice of $x$ is

$\rho_{B}^{x}=\frac{1}{p_{x}}\Tr_{A}[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\mathds{1}_{B})].$
(4)

Bob applies his POVM $M^{B}=\\{M^{B}_{y}\\}$ to register $B$ to obtain his
measurement outcomes. In the case of untrusted detector noise (or ideal
heterodyne detector), the POVM of the heterodyne detection is
$\\{E_{y}=\frac{1}{\pi}\outerproduct{y}{y}:y\in\mathbb{C}\\},$ where $\ket{y}$
denotes a coherent state with complex amplitude $y$.

####  II.2.2 Key rate optimization

The next step is to formulate the key rate optimization problem for the
entanglement-based scheme. One can rewrite the well-known Devetak-Winter
formula [Devetak2005] into the following form [Coles2016, Winick2018]

$\displaystyle
R^{\infty}=\min_{\rho_{AB}\in\mathbf{S}}D\Big{(}\mathcal{G}(\rho_{AB})||\mathcal{Z}[\mathcal{G}(\rho_{AB})]\Big{)}-p_{\text{pass}}\delta_{EC},$
(5)

where $\delta_{EC}$ is the actual amount of information leakage per signal
pulse in the error-correction step,
$D(\rho||\sigma)=\Tr(\rho\log_{2}\rho)-\Tr(\rho\log_{2}\sigma)$ is the quantum
relative entropy between two (subnormalized) density operators $\rho$ and
$\sigma$, $\mathcal{G}$ is a CP, trace nonincreasing map for postprocessing
and $\mathcal{Z}$ is a pinching quantum channel for accessing results of the
key map. The set $\mathbf{S}$ contains all density operators compatible with
experimental observations. A more detailed discussion about the map
$\mathcal{G}$ can be found in Appendix A of Ref. [Lin2019]. For the reverse
reconciliation scheme, we can express the cost of error correction
$\delta_{EC}$ by

$\displaystyle\delta_{\text{EC}}$
$\displaystyle=\operatorname{H}(\mathbf{Z})-\beta\operatorname{I}(\mathbf{X};\mathbf{Z}),$
(6)

where $\operatorname{H}(\mathbf{Z})$ is the Shannon entropy of the raw key
$\mathbf{Z}$, $\beta$ is the reconciliation efficiency of the chosen error-
correction code, and $\operatorname{I}(\mathbf{X};\mathbf{Z})$ is the
classical mutual information between $\mathbf{X}$ and $\mathbf{Z}$.

Before we review the set of constraints as well as $\mathcal{G}$ and
$\mathcal{Z}$ maps for the quadrature phase-shift keying scheme, we start with
basic definitions. Given the annihilation operator $\hat{a}$ and creation
operator $\hat{a}^{\dagger}$ of a single-mode state with the usual commutation
relation $[\hat{a},\hat{a}^{\dagger}]=\mathds{1}$, we define the quadrature
operators $\hat{q}$ and $\hat{p}$, respectively, as

$\displaystyle\hat{q}$
$\displaystyle=\frac{1}{\sqrt{2}}(\hat{a}^{\dagger}+\hat{a}),\;\;\;\hat{p}=\frac{i}{\sqrt{2}}(\hat{a}^{\dagger}-\hat{a}).$
(7)

They obey the commutation relation $[\hat{q},\hat{p}]=i\mathds{1}$. To utilize
the second-moment observations $\langle\hat{q}^{2}\rangle$ and
$\langle\hat{p}^{2}\rangle$ to constrain $\rho_{AB}$, we previously defined
the following two operators
$\hat{n}=\frac{1}{2}(\hat{q}^{2}+\hat{p}^{2}-\mathds{1})=\hat{a}^{\dagger}\hat{a}$
and $\hat{d}=\hat{q}^{2}-\hat{p}^{2}=\hat{a}^{2}+(\hat{a}^{\dagger})^{2}$
[Lin2019]. The relation between these observables and the heterodyne detection
POVM is highlighted in Sec. IV.1.

For the untrusted detector noise (or ideal heterodyne detector) scenario, the
key rate optimization problem [Lin2019] is

minimize $\displaystyle
D\big{(}\mathcal{G}(\rho_{AB})||\mathcal{Z}[\mathcal{G}(\rho_{AB})]\big{)}$
(8) subject to
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{q})]=p_{x}\langle\hat{q}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{p})]=p_{x}\langle\hat{p}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{n})]=p_{x}\langle\hat{n}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{d})]=p_{x}\langle\hat{d}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}]=1,$
$\displaystyle\Tr_{B}[\rho_{AB}]=\sum_{i,j=0}^{3}\sqrt{p_{i}p_{j}}\bra{\alpha_{j}}\ket{\alpha_{i}}\outerproduct{i}{j}_{A},$
$\displaystyle\rho_{AB}\geq 0,$

where the index $x$ runs over the set $\\{0,1,2,3\\}$ and
$\langle\hat{q}\rangle_{x},\langle\hat{p}\rangle_{x},\langle\hat{n}\rangle_{x}$,
and $\langle\hat{d}\rangle_{x}$ denote the corresponding expectation values of
operators $\hat{q},\hat{p},\hat{n}$, and $\hat{d}$ for the conditional state
$\rho_{B}^{x}$, respectively.

As indicated in Fig. 1, the protocol can perform postselection of data. To
perform postselection, we defined the region operators in Ref. [Lin2019] as

$\displaystyle R_{j}$
$\displaystyle=\frac{1}{\pi}\int_{\Delta_{a}}^{\infty}\int_{\frac{(2j-1)\pi}{4}}^{\frac{(2j+1)\pi}{4}}r\outerproduct{re^{i\theta}}{re^{i\theta}}\;d\theta\;dr$
(9)

for $j\in\\{0,1,2,3\\}$. The area of integration for each operator corresponds
to a region shown in Fig. 1.

The postprocessing map $\mathcal{G}$ in the reverse reconciliation scheme is
given by $\mathcal{G}(\sigma)=K\sigma K^{\dagger}$ for any input state
$\sigma$, where the Kraus operator $K$ is

$\displaystyle
K=\sum_{z=0}^{3}\ket{z}_{R}\otimes\mathds{1}_{A}\otimes(\sqrt{R_{z}})_{B},$
(10)

where $\\{\ket{0}_{R},\ket{1}_{R},\ket{2}_{R},\ket{3}_{R}\\}$ is the standard
basis for register $R$. The pinching quantum channel $\mathcal{Z}$ is given by
projections
$\\{\outerproduct{j}{j}_{R}\otimes\mathds{1}_{AB}:j\in\\{0,1,2,3\\}\\}$ as

$\displaystyle\mathcal{Z}(\sigma)=\sum_{j=0}^{3}(\outerproduct{j}{j}_{R}\otimes\mathds{1}_{AB})\sigma(\outerproduct{j}{j}_{R}\otimes\mathds{1}_{AB}).$
(11)

##  III Noisy heterodyne detection

In this section, we present one physical model for a noisy heterodyne detector
and give the corresponding POVM description. We start with a slightly more
general model and then we make a simplification for the ease of calculation at
the end of this section. This simplified model then reduces to a model
commonly used in the literature.

###  III.1 Trusted detector noise model

As a heterodyne detector consists of two homodyne detectors and a beam-
splitter, we consider imperfections in each homodyne detector. A homodyne
detector may have nonunity detector efficiency and also have some amount of
electronic noise which is the additional noise introduced to the measured data
by its electronic components. In an experiment, one is able to measure the
amount of electronic noise and the value of detector efficiency by a
calibration routine. To model a realistic homodyne detector with nonunity
detector efficiency and some amount of electronic noise, we use a quantum
optical model which is used in Refs. [Lodewyck2007, Fossier2009, Usenko2016,
Namiki2018, Laudenbach2019b], although the source of this electronic noise is
in the actual electronics part of the detector. An alternative view of the
electronic noise is that we can think about the detector as being a perfect
detector followed by some classical postprocessing of the data, which adds
noise. One should note that in a trusted device scenario, the characterization
of the actual noise should be experimentally verified. Our physical model is
chosen for convenience of calculating the POVM of the actual measurement. We
depict this physical model of a noisy heterodyne detector in Fig. 2. In this
diagram, we consider a more general case where two homodyne detectors have
different imperfections. We label the efficiency of the homodyne detector used
for $q$ quadrature measurement as $\eta_{1}$ and its electronic noise as
$\nu_{1}$ (expressed in shot noise units). Similarly, the efficiency of the
homodyne detector used for $p$ quadrature measurement is labeled as $\eta_{2}$
and its electronic noise is labeled as $\nu_{2}$.

Since our treatment for each homodyne detector in this heterodyne setup is the
same, we take one homodyne detector (shown in each dashed box in Fig. 2) as an
example and treat the other one similarly by using its corresponding
efficiency and electronic noise. An imperfect homodyne detector with its
efficiency $\eta_{j}<1$ and electronic noise $\nu_{j}\geq 0$ (for $j=1$ or
$2$) can be modeled by a beam-splitter placed before a perfect homodyne
detector with the following specification. (1) The ratio of transmission to
reflection of this beam-splitter is $\eta_{j}:1-\eta_{j}$. (2) One input port
of this beam-splitter is the signal pulse and the other input port is a
thermal state used to model electronic noise, which is equivalent to sending
one mode of a two-mode squeezed vacuum state (EPR state) to the beam-splitter.
Each quadrature’s variance of this ancillary thermal state is related to the
value of electronic noise $\nu_{j}$. More specifically, it is
$[1+\nu_{j}/(1-\eta_{j})]N_{0}$ [Lodewyck2007], where $N_{0}=1/2$ denotes the
shot-noise variance. In Fig. 2, we choose to parametrize the thermal state in
terms of its mean photon number as $\bar{n}_{j}=\frac{\nu_{j}}{2(1-\eta_{j})}$
instead of the variance of each quadrature, which is convenient for writing of
expressions in later sections 222The electronic noise $\nu_{j}$ is the thermal
noise added by the detection electronics. In the quantum mechanical model of
the detector shown in each dashed box of Fig. 2 , the electronic noise is
modeled by an ancillary thermal state added to the second input port of the
beam-splitter that models the detector efficiency. Since the value of
electronic noise is unaffected by the detector efficiency, to simulate the
desired amount of noise before this beam-splitter, one then needs to scale it
by the reflectance of the beam-splitter which is $1-\eta_{j}$. As the variance
of a thermal state with a mean photon number $\bar{n}$ is $(1+2\bar{n})N_{0}$,
one can easily see that the mean photon number of this ancillary thermal state
is $\bar{n}_{j}=\frac{\nu_{j}}{2(1-\eta_{j})}$. . We note that this way of
modeling electronic noise is valid when $\eta_{j}\neq 1$. Furthermore, we
assume $\eta_{j}\neq 0$. That is, we consider the case $\eta_{j}\in(0,1)$,
which is the case of a realistic detector of our interest.

Figure 2: Physical model for a noisy heterodyne detector. The homodyne
detector for the $q$ quadrature measurement has detector efficiency $\eta_{1}$
and electronic noise $\nu_{1}$. The homodyne detector for the $p$ quadrature
measurement has detector efficiency $\eta_{2}$ and electronic noise $\nu_{2}$.
The notation $\rho_{th}(\bar{n})$ stands for a thermal state with a mean
photon number $\bar{n}$. In particular,
$\bar{n}_{1}=\frac{\nu_{1}}{2(1-\eta_{1})}$ and
$\bar{n}_{2}=\frac{\nu_{2}}{2(1-\eta_{2})}$ (see main text for more
explanations). beam-splitters are 50:50 unless specified otherwise. Each
homodyne detector inside a gray box is ideal. Each dashed box encloses the
physical model for a noisy homodyne detector. LO stands for local oscillator.

In the next section, we derive the POVM corresponding to this detector model.
We then choose to consider a simplified scenario where these two homodyne
detectors are identical for the purpose of illustration and the ease of
numerical calculation. That is, we later assume they both have the same
detector efficiency $\eta_{1}=\eta_{2}=:\eta_{d}$ and the same electronic
noise $\nu_{1}=\nu_{2}=:\nu_{\text{el}}$.

###  III.2 POVM description

We use the Wigner function formulation to find the POVM
$\\{G_{y}:y\in\mathbb{C}\\}$ corresponding to this noisy heterodyne detector
model. When two homodyne detectors give two real numbers $q_{s}$ and $p_{s}$
for $q$ and $p$ quadrature measurements, we label the outcome as
$y=q_{s}+ip_{s}$. By considering $\Tr(\rho G_{y})$ for an arbitrary input
density operator $\rho$ to the noisy heterodyne detector, we are able to find
the Wigner function $W_{G_{y}}$ of the POVM element $G_{y}$ as

$\displaystyle W_{G_{y}}(\gamma)=$
$\displaystyle\frac{1}{\sqrt{\eta_{1}\eta_{2}}\pi}\frac{2}{\pi}\frac{1}{\sqrt{1+\frac{2(1-\eta_{1}+\nu_{1})}{\eta_{1}}}}\frac{1}{\sqrt{1+\frac{2(1-\eta_{2}+\nu_{2})}{\eta_{2}}}}$
(12)
$\displaystyle\times\exp(\frac{-2[\real(\gamma)-\frac{1}{\sqrt{\eta_{1}}}\real(y)]^{2}}{1+\frac{2(1-\eta_{1}+\nu_{1})}{\eta_{1}}})$
$\displaystyle\times\exp(\frac{-2[\imaginary(\gamma)-\frac{1}{\sqrt{\eta_{2}}}\imaginary(y)]^{2}}{1+\frac{2(1-\eta_{2}+\nu_{2})}{\eta_{2}}}).$

By comparing this Wigner function with that of a displaced squeezed thermal
state, we can identify that the POVM element $G_{y}$ is a projection onto a
displaced squeezed thermal state up to a prefactor
$\frac{1}{\sqrt{\eta_{1}\eta_{2}}\pi}$. We give a full derivation of this
Wigner function and the explicit parameters for displacement, squeezing and
thermal state mean photon number in terms of detector parameters
$\eta_{1},\eta_{2},\nu_{1}$ and $\nu_{2}$ in Appendix A.

For the rest of the paper, we restrict our discussion to a simpler scenario
where we assume both homodyne detectors have the same imperfection for the
ease of numerical calculation and for the purpose of illustration. We discuss
how to perform the calculation in the general case in Appendix
LABEL:app:representation. In this simple case, we set
$\eta_{1}=\eta_{2}=\eta_{d}$ and $\nu_{1}=\nu_{2}=\nu_{\text{el}}$ in Eq.
(12). This equation is simplified to be

$\displaystyle W_{G_{y}}(\gamma)$
$\displaystyle=\frac{1}{\eta_{d}\pi}\frac{2}{\pi}\frac{1}{1+\frac{2(1-\eta_{d}+\nu_{\text{el}})}{\eta_{d}}}\exp(\frac{-2\absolutevalue{\gamma-\frac{y}{\sqrt{\eta_{d}}}}^{2}}{1+\frac{2(1-\eta_{d}+\nu_{\text{el}})}{\eta_{d}}}).$
(13)

One can observe that it is the Wigner function of a displaced thermal state
apart from the prefactor $1/(\eta_{d}\pi)$. Therefore, the POVM element
$G_{y}$ in this case is a scaled projection onto a displaced thermal state.
More precisely,

$\displaystyle
G_{y}=\frac{1}{\eta_{d}\pi}\hat{D}(\frac{y}{\sqrt{\eta_{d}}})\rho_{\text{th}}(\frac{1-\eta_{d}+\nu_{\text{el}}}{\eta_{d}})\hat{D}^{\dagger}(\frac{y}{\sqrt{\eta_{d}}}),$
(14)

where $\hat{D}(\frac{y}{\sqrt{\eta_{d}}})$ is the displacement operator with
the amount of displacement $y/\sqrt{\eta_{d}}$ and
$\rho_{\text{th}}(\frac{1-\eta_{d}+\nu_{\text{el}}}{\eta_{d}})$ is a thermal
state with the mean photon number $(1-\eta_{d}+\nu_{\text{el}})/\eta_{d}$,
which can be expressed in the photon-number basis as

$\displaystyle\rho_{\text{th}}(\bar{n})=\sum_{n=0}^{\infty}\frac{\bar{n}^{n}}{(1+\bar{n})^{n+1}}\outerproduct{n}{n}.$
(15)

Later in Sec. IV, we need to express operators defined in terms of POVM
elements $G_{y}$’s in the photon-number basis for the numerical key rate
calculation. Analytical expressions of matrix elements $\bra{m}G_{y}\ket{n}$
are known in the literature [Mollow1967] and shown in Appendix
LABEL:app:representation.

Let us end this section with a few remarks about the simplification considered
here. Firstly, as we later define operators involving integrals of POVM
elements $G_{y}$’s and need to find their matrix representations in the
photon-number basis for the numerical key rate calculation, we are able to
find efficiently computable analytical expressions for these operators under
this simplification. Without this simplification, one may need to perform some
numerical integrations. We emphasize that the principles presented in this
work also hold for the general case and we choose to present results based on
this simplified case for the ease of calculation. Secondly, with this
simplification, our detector model is then optically equivalent to the
detector model used in other works [Fossier2009, Laudenbach2019b]. Thirdly, if
two homodyne detectors in the heterodyne detection scheme do not have the same
imperfection, one can instead use the POVM in the general case by following
the procedure outlined in Appendix LABEL:app_sec:general_case despite being
more numerically challenging.

##  IV Key rate optimization problem

We start with a reformulation of the optimization problem in Eq. (8) in the
untrusted detector noise scenario which serves as a basis for our modification
in the trusted detector noise scenario. The purpose of this reformulation is
that once we substitute the POVM of the noisy heterodyne detector in place of
the one for the ideal heterodyne detector, we can easily formulate the
optimization problem in the trusted detector noise scenario. Specifically, we
change Bob’s POVM $\\{M^{B}_{y}\\}$ from the ideal heterodyne detection
$\\{E_{y}=\frac{1}{\pi}\outerproduct{y}{y}\\}$ to the POVM description of the
noisy heterodyne detection $\\{G_{y}\\}$ found in Eq. (14). Moreover, compared
with our previous work [Lin2019], some constraints are modified to match with
how data are processed in a typical experiment.

###  IV.1 Reformulation of the optimization problem in the untrusted detector
noise scenario

We reconsider the key rate optimization problem in the untrusted detector
noise scenario by rewriting region operators in Eq. (9) and observables in Eq.
(8) in terms of the POVM of an ideal heterodyne detector $\\{E_{y}\\}$. In the
case of ideal heterodyne detection, the POVM description of Bob’s measurement
$\\{M^{B}_{y}\\}$ is $M^{B}_{y}=E_{y}=\frac{1}{\pi}\outerproduct{y}{y}$, the
projection onto a coherent state $\ket{y}$. By writing $y=re^{i\theta}$ in the
polar coordinate and integrating over the corresponding region
$\mathcal{A}_{j}$, we obtain Eq. (9). If we rewrite Eq. (9) in terms of
$M^{B}_{y}$, we see region operators $R_{j}$’s are defined by

$\displaystyle R_{j}=\int_{y\in\mathcal{A}_{j}}M^{B}_{y}d^{2}y,$ (16)

where the region of integration $\mathcal{A}_{j}$ in the complex plane is
shown in Fig. 1 and $d^{2}y=d\real(y)d\imaginary(y)$.

From the heterodyne detection, we obtain a probability density function $P(y)$
for the outcome $y\in\mathbb{C}$. (We obtain such a probability density
function for each conditional state $\rho_{B}^{x}$. While it is more proper to
denote this conditional probability density function as $P(y|x)$, for
simplicity of notation in this section, we use $P(y)$.) When the heterodyne
detector is ideal, this probability density function is the Husimi $Q$
function. In particular, as discussed in our previous work [Lin2019], the
expectation values of operators $\hat{q},\hat{p},\hat{n}$ and $\hat{d}$
defined in Sec. II.2 are related to the $Q$ function via

$\displaystyle\langle\hat{q}\rangle_{x}$
$\displaystyle=\frac{1}{\sqrt{2}}\int(y+y^{*})Q_{x}(y)d^{2}y,$ (17)
$\displaystyle\langle\hat{p}\rangle_{x}$
$\displaystyle=\frac{i}{\sqrt{2}}\int(y^{*}-y)Q_{x}(y)d^{2}y,$
$\displaystyle\langle\hat{n}\rangle_{x}$
$\displaystyle=\int(\absolutevalue{y}^{2}-1)Q_{x}(y)d^{2}y,$
$\displaystyle\langle\hat{d}\rangle_{x}$
$\displaystyle=\int[y^{2}+(y^{*})^{2}]Q_{x}(y)d^{2}y,$

where the subscript $x$ labels the conditional state $\rho_{B}^{x}$.

In general, one may be interested in a quantity like $\int
f(y,y^{*})P(y)d^{2}y$ where $f(y,y^{*})$ is a real-valued function on $y$ and
$y^{*}$ such that the integral converges. Such a quantity can be described as
the expectation value of an observable that is defined in the following way

$\hat{O}=\int f(y,y^{*})M^{B}_{y}d^{2}y$ (18)

since

$\displaystyle\Tr[\rho\;\hat{O}]$ $\displaystyle=\int
d^{2}y\;f(y,y^{*})\Tr(\rho M^{B}_{y})$ (19) $\displaystyle=\int
d^{2}y\;f(y,y^{*})P(y).$

In other words, operators constructed in this way correspond to expectation
values $\int f(y,y^{*})P(y)d^{2}y$ obtained in an experiment. By comparing Eq.
(19) to Eq. (17) and identifying $P(y)$ by $Q_{x}(y)$, we observe the
following choices of $f(y,y^{*})$ for $\hat{q}$, $\hat{p}$, $\hat{n}$ and
$\hat{d}$:

$\displaystyle\hat{q}\longleftrightarrow$
$\displaystyle\;f(y,y^{*})=\frac{y+y^{*}}{\sqrt{2}},$ (20)
$\displaystyle\hat{p}\longleftrightarrow$
$\displaystyle\;f(y,y^{*})=\frac{i(y^{*}-y)}{\sqrt{2}},$
$\displaystyle\hat{n}\longleftrightarrow$
$\displaystyle\;f(y,y^{*})=\absolutevalue{y}^{2}-1,$
$\displaystyle\hat{d}\longleftrightarrow$
$\displaystyle\;f(y,y^{*})=y^{2}+(y^{*})^{2}.$

We remark that this way of defining these observables corresponds to the
antinormally ordered expansion of operators [Cahill1969a, Cahill1969b].

###  IV.2 Revised optimization problem in the trusted detector noise scenario

In Ref. [Lin2019], we chose observables
$\\{\hat{O}\\}=\\{\hat{q},\hat{p},\hat{n},\hat{d}\\}$ by using
$M^{B}_{y}=E_{y}$ in Eq. (18) for the untrusted detector noise scenario. In
this work, we change to a new set of observables
$\\{\hat{q},\hat{p},\hat{n}+\hat{d}/2+\mathds{1},\hat{n}-\hat{d}/2+\mathds{1}\\}$,
which gives the same key rates as the old one since the last two observables
in this new set are linear combinations of observables $\hat{n}$ and $\hat{d}$
as well as the identity operator. This new set of observables corresponds to
the set of
$\\{f(y,y^{*})\\}=\\{\sqrt{2}\real(y),\sqrt{2}\imaginary(y),2\real(y)^{2},2\imaginary(y)^{2}\\}$
333Due to our definition of quadrature operators, we include the factor
$\sqrt{2}$ so that we can simply enter values reported in an experiment using
shot noise units as expectation values of corresponding observables.. The sole
purpose of this change compared with Ref. [Lin2019] is to make the data
postprocessing in an agreement with the typical classical postprocessing in an
experiment. That is, in an experiment, when a heterodyne detection gives two
real numbers $q_{s}$ and $p_{s}$ which we set $\real(y)=q_{s}$ and
$\imaginary(y)=p_{s}$, one usually computes variances of $\real(y)$ and
$\imaginary(y)$ by computing the expectation values of $\real(y)^{2}$ and
$\imaginary(y)^{2}$ in addition to expectation values of $\real(y)$ and
$\imaginary(y)$.

In the trusted detector noise scenario, we need to substitute $M^{B}_{y}$ in
Eqs. (16) and (18) by $G_{y}$. To distinguish operators defined in this way
from the first and second moment of quadrature operators $\hat{q}$ and
$\hat{p}$, we call first-moment observables $\hat{F}_{Q}$ and $\hat{F}_{P}$
and second-moment observables $\hat{S}_{Q}$ and $\hat{S}_{P}$. More
explicitly, they are defined as

$\displaystyle\hat{F}_{Q}$
$\displaystyle=\int\frac{y+y^{*}}{\sqrt{2}}G_{y}d^{2}y,$ (21)
$\displaystyle\hat{F}_{P}$
$\displaystyle=\int\frac{i(y^{*}-y)}{\sqrt{2}}G_{y}d^{2}y,$
$\displaystyle\hat{S}_{Q}$
$\displaystyle=\int(\frac{y+y^{*}}{\sqrt{2}})^{2}G_{y}d^{2}y,$
$\displaystyle\hat{S}_{P}$
$\displaystyle=\int[\frac{i(y^{*}-y)}{\sqrt{2}}]^{2}G_{y}d^{2}y.$

Then the revised key rate optimization problem becomes

minimize $\displaystyle
D\big{(}\mathcal{G}(\rho_{AB})||\mathcal{Z}[\mathcal{G}(\rho_{AB})]\big{)}$
(22) subject to
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{F}_{Q})]=p_{x}\langle\hat{F}_{Q}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{F}_{P})]=p_{x}\langle\hat{F}_{P}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{S}_{Q})]=p_{x}\langle\hat{S}_{Q}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}(\outerproduct{x}{x}_{A}\otimes\hat{S}_{P})]=p_{x}\langle\hat{S}_{P}\rangle_{x},$
$\displaystyle\Tr[\rho_{AB}]=1,$
$\displaystyle\Tr_{B}[\rho_{AB}]=\sum_{i,j=0}^{3}\sqrt{p_{i}p_{j}}\bra{\alpha_{j}}\ket{\alpha_{i}}\outerproduct{i}{j}_{A},$
$\displaystyle\rho_{AB}\geq 0,$

where the index $x$ runs over the set $\\{0,1,2,3\\}$ and the Kraus operator
for the postprocessing map $\mathcal{G}$ has the same form as in Eq. (10) but
now with the region operators defined in terms of $G_{y}$’s in Eq. (16).

In Appendix LABEL:app:representation, we discuss how to represent these
operators in the photon-number basis. Combining with the photon-number cutoff
assumption (i.e.
$\rho_{AB}=(\mathds{1}_{A}\otimes\Pi_{N})\rho_{AB}(\mathds{1}_{A}\otimes\Pi_{N})$,
where $N$ is the cutoff photon number and $\Pi_{N}$ is the projection onto the
subspace spanned by the photon-number states from $0$ to $N$ photons), we can
directly solve this key rate optimization problem in Eq. (22) numerically. We
direct readers to Sec. IV B of Ref. [Lin2019] for the discussion about the
numerical algorithm for the optimization problem and its performance.

##  V Simulation method

In an experiment, the expectation values shown in the optimization problem in
Eq. (22) can be obtained from some suitable postprocessing of noisy heterodyne
detection results. Without doing experiments, we perform simulations of a
corresponding experiment with a noisy heterodyne detector to obtain those
expectation values. With these values specified, one can solve the key rate
optimization problem using a numerical convex optimization package to obtain
numerical results. We emphasize that our security proof technique does not
depend on the specific channel model used for the simulation.

###  V.1 Channel model for simulation

To understand how the protocol behaves in the trusted detector noise scenario,
we simulate the quantum channel by using a realistic physical channel in an
honest implementation of the protocol. A realistic physical channel in the
context of the optical fiber communication can be modeled by a phase-invariant
Gaussian channel with the transmittance $\eta_{t}$ and excess noise $\xi$. In
a typical fiber for optical communication, the attenuation coefficient is 0.2
dB/km and thus $\eta_{t}=10^{-0.02L}$ for a distance $L$ in kilometers. The
excess noise $\xi$ is defined as

$\displaystyle\xi=\frac{(\Delta q_{\text{obs}})^{2}}{(\Delta
q_{\text{vac}})^{2}}-1,$ (23)

where $(\Delta q_{\text{vac}})^{2}=N_{0}=1/2$ is the variance in $q$
quadrature of the vacuum state and $(\Delta q_{\text{obs}})^{2}$ is the
observed variance in $q$ quadrature of the measured signal state. As the value
of $\xi$ is normalized with respect to the vacuum variance, the channel excess
noise $\xi$ is reported in the shot noise units (SNU) and independent of
different conventions of defining quadrature operators.

Apart from the shot noise, there are several contributions to the total noise
in the measurement data such as preparation noise, detector noise and noises
introduced in the fiber due to Raman scattering. As we treat the detection
noise as trusted, we assume all other contributions are under Eve’s control.
In other words, all additional noises beyond the shot noise except for the
detector noise become a part of the effective quantum channel regardless of
the physical origin of each noise component, and they contribute to the value
of the excess noise $\xi$. In the literature, the value of the excess noise
$\xi$ is commonly reported at the input of the quantum channel corresponding
to measuring $(\Delta q_{\text{obs}})^{2}$ at the output of Alice’s lab. By
choosing this convention of reporting the value of excess noise, we may
alternatively imagine that this effective quantum channel first introduces the
amount of excess noise $\xi$ to the signal state at the input of the channel
and the rest of this quantum channel is then lossy but noise-free. Under this
channel model, a coherent state $\ket{\alpha}$, after transmitting through
this quantum channel, becomes a displaced thermal state centered at
$\sqrt{\eta_{t}}\alpha$ with its variance $\frac{1}{2}(1+\eta_{t}\xi)$ for
each quadrature.

###  V.2 Simulated statistics

From our simulation, the simulated state $\sigma^{x}_{B}$ conditioned on the
choice of $x$ is a displaced thermal state whose Wigner function is

$\displaystyle W_{\sigma^{x}_{B}}(\gamma)$
$\displaystyle=\frac{1}{\pi}\frac{1}{\frac{1}{2}(1+\eta_{t}\xi)}\exp[-\frac{\absolutevalue{\gamma-\sqrt{\eta_{t}}\alpha_{x}}^{2}}{\frac{1}{2}(1+\eta_{t}\xi)}].$
(24)

When Bob applies his heterodyne measurement described by the POVM
$\\{G_{y}\\}$, the probability density function $P(y|x)$ for the measurement
outcome $y$ conditioned on Alice’s choice $x$ is

$\displaystyle P(y|x)$
$\displaystyle=\frac{1}{\pi(1+\frac{1}{2}\eta_{d}\eta_{t}\xi+\nu_{\text{el}})}\exp[-\frac{\absolutevalue{y-\sqrt{\eta_{d}\eta_{t}}\alpha_{x}}^{2}}{1+\frac{1}{2}\eta_{d}\eta_{t}\xi+\nu_{\text{el}}}].$
(25)

The observables defined in Eq. (21) have the following expectation values from
the simulation:

$\displaystyle\langle\hat{F}_{Q}\rangle_{x}$
$\displaystyle=\sqrt{2\eta_{d}\eta_{t}}\real(\alpha_{x}),$ (26)
$\displaystyle\langle\hat{F}_{P}\rangle_{x}$
$\displaystyle=\sqrt{2\eta_{d}\eta_{t}}\imaginary(\alpha_{x}),$
$\displaystyle\langle\hat{S}_{Q}\rangle_{x}$
$\displaystyle=2\eta_{d}\eta_{t}\real(\alpha_{x})^{2}+1+\frac{1}{2}\eta_{d}\eta_{t}\xi+\nu_{\text{el}},$
$\displaystyle\langle\hat{S}_{P}\rangle_{x}$
$\displaystyle=2\eta_{d}\eta_{t}\imaginary(\alpha_{x})^{2}+1+\frac{1}{2}\eta_{d}\eta_{t}\xi+\nu_{\text{el}}.$

###  V.3 Estimation of error correction cost

We estimate the cost of error correction from the simulated statistics. From
the probability density function $P(y|x)$ shown in Eq. (25), we can obtain the
joint probability distribution $\widetilde{P}(x,z)$ for Alice’s choice
$\mathbf{X}=x$ and Bob’s discretized key value $\mathbf{Z}=z$ by the following
integral

$\displaystyle\widetilde{P}(z|x)=\int_{\Delta_{a}}^{\infty}dr\;r\int_{\frac{2z-1}{4}\pi}^{\frac{2z+1}{4}\pi}d\theta
P(re^{i\theta}|x).$ (27)

Since $\widetilde{P}(x)=p_{x}=\frac{1}{4}$, we then obtain the joint
probability distribution
$\widetilde{P}(x,z)=\widetilde{P}(z|x)\widetilde{P}(x)$. Using the definition
of $\operatorname{I}(\mathbf{X};\mathbf{Z})$ in terms of $\widetilde{P}(x,z)$,
we can approximate the cost of error correction by Eq. (6) for the reverse
reconciliation scheme considered in this work. When $\Delta_{a}$ is not zero,
that is, in the presence of postselection, the sifting factor
$p_{\text{pass}}$ is the sum of $\widetilde{P}(x,z)$ over
$x,z\in\\{0,1,2,3\\}$. We then renormalize the probability distribution before
plugging it in the definition of $\operatorname{I}(\mathbf{X};\mathbf{Z})$.

For the purpose of illustration, we choose the error correction efficiency
$\beta$ to be 95% for our simulations, which is around typical values for the
state-of-the-art error correction codes (see e.g. Ref. [Milicevic2018]).

##  VI Key rate in the absence of postselection

In this section, we present results when no postselection is performed, that
is, $\Delta_{a}=0$. We make two comparisons. The first one is to compare key
rates in the trusted and untrusted detector noise scenarios. The second one is
to analyze how different imperfections in detectors affect key rates in the
trusted detector noise scenario.

###  VI.1 Comparison between trusted and untrusted detector noise scenarios

For this comparison, we supply the same set of simulated data from Eq. (26) to
the optimization problem for the untrusted detector noise scenario in Eq. (8)
and the one for the trusted detector noise scenario in Eq. (22). For
simulation, we choose parameters $\eta_{d}=0.719$, $\nu_{\text{el}}=0.01$ from
Ref. [Soh2015] for illustration. The result is shown in Fig. 3.

Figure 3:  Secure key rate versus the transmission distance for untrusted
detector noise (black diamonds) and trusted detector noise (red stars)
scenarios. The excess noise is $\xi=0.01$ at the input of the quantum channel.
Parameters for detector are $\eta_{d}=0.719$, $\nu_{\text{el}}=0.01$[Soh2015].
The error correction efficiency is $\beta=0.95$. The coherent state amplitude
is optimized via a coarse-grained search over the interval $[0.5,0.9]$ with a
step size of $0.05$ and the channel transmittance is $\eta_{t}=10^{-0.02L}$
for each distance $L$ in kilometers. The effective channel excess noise in the
untrusted detector scenario is shown with the $y$ axis on the right. At 20 km,
the effective channel excess noise $\xi_{\text{eff}}$ is roughly 0.045.

As we can see from this figure, the key rate of the untrusted detector noise
scenario drops quickly at a short distance less than 20 km even though the
electronic noise is only 0.01 SNU, which is a low value compared to detectors
used in many other CV experiments. On the other hand, the key rate in the
trusted detector noise scenario extends to much longer distances, which
exhibits a similar behavior as the results shown in Ref. [Lin2019] when the
detector is treated as ideal. One explanation for this behavior is that in
Ref. [Lin2019], we observe that the key rate for the QPSK scheme drops quickly
when the channel excess noise $\xi$ is large. Since the value of $\xi$ is
reported at the input of the quantum channel while the value of
$\nu_{\text{el}}$ is measured at Bob’s side, to treat $\nu_{\text{el}}$ as a
part of channel excess noise in the untrusted detector noise scenario, one
needs to define the effective value of $\xi$ to include the value of
$\nu_{\text{el}}$. For the effective value $\xi_{\text{eff}}$, the electronic
noise $\nu_{\text{el}}$ needs to be scaled by a factor of $1/\eta_{t}$ (in
addition to $1/\eta_{d}$), which is large for slightly long distances as
$\eta_{t}$ becomes small. As a result, the redefined value $\xi_{\text{eff}}$
of $\xi$ is quite large as shown in Fig. 3 and this behavior of key rate is
then expected. By the observation made from this figure, it is not surprised
that for a larger value of electronic noise, the key rate in the untrusted
detector noise scenario would drop to zero at an even shorter distance.

###  VI.2 Detector imperfection in the trusted detector noise scenario

To guide the experimental implementation of the QPSK scheme, we may be
interested in the robustness of the protocol in the presence of detector
inefficiency and electronic noise in the trusted detector noise scenario. For
this purpose, we investigate the effects of different levels of detector
efficiency and electronic noise on the key rate. For curves in Figs. 4 and 5,
our simulation uses the same channel model but different detector
imperfections, that is, in Eq. (26), the same values of channel parameters
$\eta_{t}$ and $\xi$ but different values of detector efficiency $\eta_{d}$
and electronic noise $\nu_{\text{el}}$ (as specified in the captions) for
different curves.

In Fig. 4, we choose values of $\eta_{d}$ and $\nu_{\text{el}}$ for a homodyne
detector from two experiments [Jouguet2013, Soh2015] and compare these results
with the ideal detector. For the comparison, we optimize $\alpha$ via a
coarse-grained search for each distance. We see that with a noisy heterodyne
detector, the key rate drops moderately from the key rate of using an ideal
detector. The amount of decrease is like a constant prefactor in the key rate.
As the detector is noisier, the key rate becomes lower as expected.

Figure 4:  Secure key rate versus transmission distance for different detector
imperfections reported in experiments in a comparison to the ideal detector.
Other parameters are the excess noise $\xi=0.01$, error-correction efficiency
$\beta=0.95$, and the transmittance $\eta_{t}=10^{-0.02L}$ for each distance
$L$ in kilometers. For each distance, the coherent state amplitude $\alpha$ is
optimized via a coarse-grained search in the interval $[0.5,0.9]$ with a step
size of $0.05$. Black curve with diamond markers is for the ideal heterodyne
detector; red curve with star markers is for the detector used in Ref.
[Soh2015]; cyan curve with square markers is for the detector used in Ref.
[Jouguet2013].

To show that different values of electronic noise have little impacts on the
secure key rates in the trusted noise scenario, we compare key rates with two
choices of the electronic noise value in Fig. 5a while we fix the value of
detector efficiency $\eta_{d}$ to be 0.7. As the key rate difference is
relatively small between the curve with $\nu_{\text{el}}=0.05$ and that with
$\nu_{\text{el}}=0.08$, we also plot the difference of key rate (that is, the
key rate with $\nu_{\text{el}}=0.05$ minus the key rate with
$\nu_{\text{el}}=0.08$) in the same figure. (Note that the non-smoothness in
the curve of difference is due to the coarse-grained search for the coherent
state amplitude in the presence of the numerical performance issue discussed
in Ref. [Lin2019].) We observe that when the electronic noise is trusted, its
impact on the secure key rates is insignificant. This result eases the
requirements of a detector in a CVQKD experiment with the QPSK scheme.
Similarly, we investigate the effects of detector efficiency in Fig. 5b. In
particular, we fix the value of electronic noise $\nu_{\text{el}}$ to be 0.05
SNU and plot four choices of detector efficiency between 0.5 and 0.8. We see
the key rate curves are close to each other.

(a)

(b)

Figure 5:  Secure key rate versus transmission distance for different detector
imperfections with the excess noise $\xi=0.01$. For both plots, the coherent
state amplitude is optimized via a coarse-grained search over the interval
$[0.5,0.9]$ with a step size 0.05 and $\beta=0.95$. (a) Comparison of key
rates between two values of the electronic noise when the detector efficiency
is set to be $\eta_{d}=0.7$ for both curves. The difference of two curves is
also plotted with the secondary $y$-axis on the right. (b) Comparison of key
rates for different values of detector efficiency when the electronic noise is
$\nu_{\text{el}}=0.05.$

In Fig. 6, we investigate the tradeoff between trusting the detector
efficiency and lumping it together with the channel transmittance, similar to
a scenario studied in Ref. [Zhang2020] for discrete-variable systems. For the
fixed amount of total transmittance $\eta:=\eta_{t}\eta_{d}$, it is
interesting to see how trusting different values of detector efficiency
affects the key rate. We observe that when the value of the product of channel
transmittance $\eta_{t}$ and detector efficiency $\eta_{d}$ is fixed, if the
detector efficiency $\eta_{d}$ is lower, meaning that if more contribution to
the total transmittance $\eta$ is trusted, then the key rate is higher. This
observation is similar to the observation made for discrete-variable systems
in Ref. [Zhang2020].

Figure 6:  Secure key rate versus the detector efficiency $\eta_{d}$ for a
fixed value of total transmittance $\eta:=\eta_{t}\eta_{d}=0.3155$. This
figure studies the tradeoff between the key rate and the amount of trusted
loss. Other parameters are the excess noise $\xi=0.01$, the electronic noise
$\nu_{\text{el}}=0.01$, and the error-correction efficiency $\beta=0.95$. We
include two curves for different choices of coherent state amplitude $\alpha$.

To summarize, in a discrete modulation experiment, if one is able to obtain
accurate values of $\eta_{d}$ and $\nu_{\text{el}}$ by a suitable calibration
procedure and able to maintain a low level of the effective channel excess
noise $\xi$ to a value like $0.01$, then the QPSK scheme is able to extend to
a distance beyond 100 km in the asymptotic regime. We remark that the optimal
amplitude for the QPSK scheme in the trusted detector noise scenario is around
0.75 corresponding to a mean photon number of around 0.56, similar to the
optimal amplitude in the ideal or untrusted detector noise scenario reported
in our previous work [Lin2019]. This mean photon number is much lower than
that for Gaussian modulation schemes.

##  VII Key rate with postselection

In this section, we investigate the effects of postselection in the trusted
detector noise scenario. As demonstrated in our previous analysis [Lin2019],
postselection of data can improve the key rate of the QPSK scheme in the
untrusted detector noise scenario. Postselection is simple to implement in an
experiment. It not only improves the key rate but also reduces the required
volume of data postprocessing. Thus, it is advantageous to include a
postselection step in the protocol. As expected, we show here that this
advantage also exists in the trusted detector noise scenario.

In Fig. 7, we search for the optimal postselection parameter for different
transmission distances and take the distances $L=50$ km and $L=75$ km as
examples. For this figure, we also optimize the choice of coherent state
amplitude via a coarse-grained search. The $x$ axis in each plot is the
postselection parameter $\Delta_{a}$. We observe the optimal value of the
postselection parameter $\Delta_{a}$ is around 0.6 for both $L=50$ km and
$L=75$ km. We also observe that the optimal choice of the postselection
parameter $\Delta_{a}$ does not change significantly for different distances.

(a)

(b)

Figure 7:  (a) Secure key rate versus postselection parameter $\Delta_{a}$ for
$L=50$ km. (b) Secure key rate versus postselection parameter $\Delta_{a}$ for
$L=75$ km. For both plots, the channel excess noise is $\xi=0.01$ and the
error-correction efficiency $\beta=0.95$. The coherent state amplitude is
optimized via a coarse-grained search in the interval [0.6, 0.8] with a step
size of 0.05. Parameters for detectors are $\eta_{d}=0.552$ and
$\nu_{\text{el}}=0.015$ from Ref. [Jouguet2013].

In Fig. 8, we show the key rate as a function of transmission distance for two
scenarios: with or without postselection. Since the optimal postselection
parameter does not change significantly for different distances, we optimize
the postselection parameter $\Delta_{a}$ via a coarse-grained search in a
restricted interval. For this figure, we fix the coherent state amplitude to
be 0.75 and the channel excess noise $\xi$ to be 0.01. We see postselection
can indeed improve the key rate. The percentage of improvement compared to the
key rate without postselection is roughly between 5% to 8% and the probability
of being postselected is around 70% to 80%. Thus, postselection can reduce the
amount of data for postprocessing by around 20% to 30% while improving the key
rate.

Figure 8:  Comparison of key rates with or without postselection. Detector
parameters are from Ref. [Jouguet2013] where $\eta_{d}=0.552$ and
$\nu_{\text{el}}=0.015$. The difference of two curves is also plotted with the
secondary $y$ axis on the right. Other parameters are the channel excess noise
$\xi=0.01$, the coherent state amplitude $\alpha=0.75$, and the error-
correction efficiency $\beta=0.95$. The postselection parameter is optimized
via a coarse-grained search in the interval [0.45,0.7] with a step size 0.05.

We end this section with a remark on the postselection pattern. The
postselection pattern (see Fig. 1) studied in this work is a simple,
intuitive, and convenient choice when we evaluate the region operators.
However, it is not necessarily the optimal way to postselect data
[Silberhorn2002, Heid2006]. It is an interesting future work to investigate
other patterns of postselection.

##  VIII Summary and future directions

We provide a method to analyze the asymptotic security of a discrete
modulation scheme of CVQKD in the trusted detector noise scenario where both
nonunity detector efficiency and electronic noise are trusted. In particular,
we find the POVM elements corresponding to a noisy heterodyne detector. As we
demonstrate our method on the quadrature phase-shift keying scheme, we show
that when the detector imperfection is trusted, the key rates are similar to
the one with the ideal heterodyne detector studied previously [Lin2019]. Our
analysis in this work eases the requirements of an experimental implementation
of the discrete modulation scheme as the detector imperfection is usually a
major source of noise.

We point out the limitations in the current work. First, the analysis in this
work is still restricted to the asymptotic scenario. We notice that there is a
recent work on the finite key analysis of binary modulation protocol
[Matsuura2020]. However, the key rate there was very pessimistic and one
expects that quadrature-shift keying schemes will have much better
performance. It remains an open question to provide a finite key analysis of
general discrete modulation beyond binary modulation. As we recently extend
the underlying numerical method used in this security analysis to finite-key
regime [George2020], we hope to perform the finite key analysis for discrete
modulation schemes, especially the protocol studied in this work. However,
there remain technical challenges to solve before such an analysis can be
carried out and thus we leave the finite key analysis for future work. The
second limitation is the same photon-number cutoff assumption used in Refs.
[Ghorai2019, Lin2019]. While numerical evidences show that our results are
stable when the cutoff photon number is chosen appropriately, we plan to have
a more rigorous analysis on the effects of truncation beyond numerical
evidences in future work. Thirdly, we present simulation results in a simple
scenario where two homodyne components are treated as identical. This scenario
is commonly assumed in previous studies of Gaussian modulation schemes. In the
simple scenario, we are able to provide simplified expressions for region
operators and observables used in the key rate optimization problem. However,
our principles presented in this paper work for the general case where two
detectors are not identical. To handle the general case, one may perform the
numerical integration of POVM element $G_{y}$’s to find necessary operators in
the photon-number basis from the photon-number basis representation of each
POVM element $G_{y}$ shown in Appendix LABEL:app_sec:general_case. It may
become numerically demanding to perform these integrals. Alternatively, one
may attempt to simplify expressions analytically similar to what we have done
for the simple case. It remains as a technical question to efficiently compute
the matrix elements of operators defined in terms of $G_{y}$ in the photon-
number basis, which we expect can be solved. Nevertheless, this current
limitation does not affect the principles and methodology we present in this
work about the treatment of trusted detector noise. It is also expected that
observations in the general case will be similar to observations we make here
in the simple case.

Finally, we remark on the generality of our method of treating trusted
detector noise. If a different physical model of a detector is adopted (which
needs to be verified experimentally), we expect that a similar method as
described here can be used to find a correct POVM description for the given
physical model and then this POVM can be used in the security analysis.

###### Acknowledgements.

We thank Mi Zou and Feihu Xu for helpful discussions related to experiments.
We also thank Twesh Upadhyaya for code review. The work is performed at the
Institute for Quantum Computing (IQC), University of Waterloo, which is
supported by Industry Canada. J. L. acknowledges the support of Mike and
Ophelia Lazaridis Fellowship from IQC. The research has been supported by
NSERC under the Discovery Grants Program, Grant No. 341495, and under the
Collaborative Research and Development Program, Grant No. CRDP J 522308-17.
Financial support for this work has been partially provided by Huawei
Technologies Canada Co., Ltd.

##  APPENDIX A Derivation of noisy heterodyne detection POVM via Wigner
functions

###  A.1 Basic Wigner functions

As we use the Wigner function approach for our derivation, we recall useful
expressions from Ref. [Leonhardt2010] for later references.

To calculate $\Tr(FG)$ for two operators $F$ and $G$ in terms of their Wigner
functions $W_{F}$ and $W_{G}$, the overlap formula is

$\displaystyle\Tr(FG)=\pi\int d^{2}\alpha\;W_{F}(\alpha)W_{G}(\alpha).$ (28)

We can easily generalize the formula to multimode cases. The input-output
Wigner functions under a beam-splitter transformation whose transmittance is
$\eta$ are related by

$\displaystyle
W_{\text{out}}(\alpha,\beta)=W_{\text{in}}(\sqrt{\eta}\alpha+\sqrt{1-\eta}\beta,\sqrt{1-\eta}\alpha-\sqrt{\eta}\beta).$
(29)

We list Wigner functions for some quantum states that are relevant for our
discussions here. The Wigner function of a vacuum state $\ket{0}$ is

$\displaystyle
W_{\ket{0}}(\gamma)=\frac{2}{\pi}e^{-2\absolutevalue{\gamma}^{2}}.$ (30)

The Wigner function of a thermal state $\rho_{\text{th}}(\bar{n})$ with the
mean photon number $\bar{n}$ is

$\displaystyle
W_{\rho_{\text{th}}(\bar{n})}(\gamma)=\frac{2}{\pi}\frac{1}{1+2\bar{n}}e^{-\frac{2\absolutevalue{\gamma}^{2}}{1+2\bar{n}}}.$
(31)

The Wigner function of a displaced thermal state (DTS)
$\rho_{\text{DTS}}(\alpha,\bar{n}):=\hat{D}(\alpha)\rho_{\text{th}}(\bar{n})\hat{D}^{\dagger}(\alpha)$
with the amount of displacement $\alpha$ is

$\displaystyle
W_{\rho_{\text{DTS}}(\alpha,\bar{n})}(\gamma)=\frac{2}{\pi}\frac{1}{1+2\bar{n}}e^{-\frac{2\absolutevalue{\gamma-\alpha}^{2}}{1+2\bar{n}}}.$
(32)

We notice that if we set $\alpha=0$, it reduces to Eq. (31).

It is also useful to note the Wigner functions of a squeezed thermal state
(STS) and of a displaced squeezed thermal state (DSTS). Let $\hat{S}(\xi)$
denote the squeezing operator with a squeezing parameter $\xi$. For our
discussion, we restrict $\xi\in\mathbb{R}$. For a squeezed thermal state
$\rho_{\text{STS}}(\xi,\bar{n}):=\hat{S}(\xi)\rho_{\text{th}}(\bar{n})\hat{S}^{\dagger}(\xi)$,
its Wigner function reads (see, e.g., Eq. (4.13) of Ref. [Kim1989])

$\displaystyle
W_{\rho_{\text{STS}}(\xi,\bar{n})}(\gamma)=\frac{2}{\pi}\frac{1}{1+2\bar{n}}\exp{-2[\frac{e^{2\xi}\real(\gamma)^{2}+e^{-2\xi}\imaginary(\gamma)^{2}}{1+2\bar{n}}]}$
(33)

The Wigner function of a displaced squeezed thermal state
$\rho_{\text{DSTS}}(\alpha,\xi,\bar{n}):=\hat{D}(\alpha)\hat{S}(\xi)\rho_{\text{th}}(\bar{n})\hat{S}^{\dagger}(\xi)\hat{D}^{\dagger}(\alpha)$
can be similarly written as

$\displaystyle
W_{\rho_{\text{DSTS}}(\alpha,\xi,\bar{n})}(\gamma)=\frac{2}{\pi}\frac{1}{1+2\bar{n}}\exp{-2[\frac{e^{2\xi}\real(\gamma-\alpha)^{2}+e^{-2\xi}\imaginary(\gamma-\alpha)^{2}}{1+2\bar{n}}]}$
(34)

###  A.2 Derivation

Figure 9:  A concise but equivalent view of the noisy heterodyne detector
model depicited in Fig. 2. Input modes are labeled in terms of Wigner
functions.

As the physical model of a noisy heterodyne detector is presented in Fig. 2,
our goal here is to find the corresponding POVM elements that correctly
produce the probability density function $P(y)$ of obtaining an outcome
$y\in\mathbb{C}$ for an arbitrary input state $\rho$ to the detector. In our
trusted noise model, the homodyne detector for the $q$ quadrature measurement
has its detector efficiency $\eta_{1}$ and electronic noise $\nu_{1}$ which is
related to a thermal state of the mean photon number
$\bar{n}_{1}=\frac{\nu_{1}}{2(1-\eta_{1})}$. Similarly, the homodyne detector
for the $p$ quadrature measurement has its detector efficiency $\eta_{2}$ and
electronic noise $\nu_{2}$ which corresponds to a thermal state with the mean
photon number $\bar{n}_{2}=\frac{v_{2}}{2(1-\eta_{2})}.$ Figure 9 shows a
compact but equivalent representation of Fig. 2 with Wigner functions
associated to input modes. In this setup, for an output state
$W_{\text{out}}(\alpha,\beta,\gamma,\omega)$ at the step labeled in Fig. 9, we
measure the $q$ quadrature of the mode $\alpha$ and $p$ quadrature of the mode
$\beta$ with two ideal homodyne detectors, and discard the rest modes $\gamma$
and $\omega$. The Wigner function of an ideal homodyne detector for the $q$
quadrature measurement that produces a measurement outcome $\real(y)$ is
$W_{H_{\real(y)}}(\alpha)=\frac{1}{\sqrt{2}\pi}\delta(\real(\alpha)-\frac{\real(y)}{\sqrt{2}})$
where $\delta$ is the Dirac delta function and similarly, the one for the $p$
quadrature measurement with a measurement outcome $\imaginary(y)$ is
$W_{H_{\imaginary(y)}}(\alpha)=\frac{1}{\sqrt{2}\pi}\delta(\imaginary(\alpha)-\frac{\imaginary(y)}{\sqrt{2}})$.
The factors of $\sqrt{2}$ are included such that we can rederive the ideal
heterodyne detector POVM $\\{E_{y}:y\in\mathbb{C}\\}$ in the limit of unity
detector efficiency and zero electronic noise. To discard modes $\gamma$ and
$\omega$ that are not measured, we perform the integration over variables
$\gamma$ and $\omega$.

For any input state $\rho$ to the detector, one can in principle obtain the
underlying probability density function $P(y)=\Tr(\rho G_{y})$ for every
measurement outcome $y\in\mathbb{C}$. As the correct POVM element $G_{y}$
needs to produce the observed probability density function $P(y)=\Tr(\rho
G_{y})$, this requirement in terms of Wigner functions becomes $P(y)=\pi\int
d^{2}\alpha W_{\rho}(\alpha)W_{G_{y}}(\alpha)$, where $W_{\rho}$ is the Wigner
function of the input state $\rho$ and $W_{G_{y}}$ is the Wigner function of
the operator $G_{y}$, by the overlap formula in Eq. (28). In Fig. 9, we know
the mathematical description of measurements on the right, but the description
of the state $W_{\text{out}}$ is unknown. On the other hand, we want to find
the description of the measurement directly acting on the input state and the
Wigner function description of the input state and those of ancillary modes on
the left are either assumed to be given or known. To connect these known
descriptions on the two sides of this diagram to find the desired Wigner
function of the POVM element $G_{y}$ that acts on the input state directly, we
start from the right-hand side of this diagram with an unknown four-mode state
$W_{\text{out}}$ and the known measurements on these modes, perform inverse
beam-splitter transformations from right to left of this diagram and finally
obtain $W_{G_{y}}$ by integrating over variables other than $\alpha$. By
starting with the multimode overlap formula for $P(y)$ on the right-hand side
of the diagram and performing the process as described, we obtain

$\displaystyle P(y)$ $\displaystyle=\pi^{4}\int d^{2}\alpha\int d^{2}\beta\int
d^{2}\gamma\int
d^{2}\omega\;\frac{1}{\pi^{2}}W_{\text{out}}(\alpha,\beta,\gamma,\omega)W_{H_{\real(y)}}(\alpha)W_{H_{\imaginary(y)}}(\beta)$
(35) $\displaystyle=\pi^{2}\int d^{2}\alpha\;W_{\rho}(\alpha)\int
d^{2}\beta\;W_{\ket{0}}(\beta)\int
d^{2}\gamma\;W_{\rho_{\text{th}}(\bar{n}_{1})}(\gamma)W_{H_{\real(y)}}(\sqrt{\eta_{1}}\frac{\alpha+\beta}{\sqrt{2}}+\sqrt{1-\eta_{1}}\gamma)$
$\displaystyle\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\times\int
d^{2}\omega\;W_{\rho_{\text{th}}(\bar{n}_{2})}(\omega)W_{H_{\imaginary(y)}}(\sqrt{\eta_{2}}\frac{\alpha-\beta}{\sqrt{2}}+\sqrt{1-\eta_{2}}\omega).$

The next step is to substitute the Wigner function of the vacuum state in Eq.
(30) and that of the thermal state in Eq. (31) and then to perform the
integrals over variables $\beta,\gamma$ and $\omega$. We first integrate over
the variable $\omega$. The relevant integral that involves the variable
$\omega$ is

$\displaystyle\int
d^{2}\omega\;W_{\rho_{\text{th}}(\bar{n}_{2})}(\omega)W_{H_{\imaginary(y)}}(\sqrt{\eta_{2}}\frac{\alpha-\beta}{\sqrt{2}}+\sqrt{1-\eta_{2}}\omega)$
(36) $\displaystyle=$
$\displaystyle\frac{1}{\pi\sqrt{\pi}}\frac{1}{\sqrt{(1-\eta_{2})(1+2\bar{n}_{2})}}\exp(-\frac{\eta_{2}[\imaginary(\beta)+\frac{1}{\sqrt{\eta_{2}}}\imaginary(y)-\imaginary(\alpha)]^{2}}{(1+2\bar{n}_{2})(1-\eta_{2})}).$

Next, we perform the integral related to the variable $\gamma$. Since Eq.
(LABEL:eq:wigner_integration1) does not involve the variable $\gamma$, we do
not need to plug it back to solve the integral that involves the variable
$\gamma$. This integration shown in Eq. (LABEL:eq:wigner_integration2) is
actually similar to the integration that we just did in Eq.
(LABEL:eq:wigner_integration1).

$\displaystyle\int
d^{2}\gamma\;W_{\rho_{\text{th}}(\bar{n}_{1})}(\gamma)W_{H_{\real(y)}}(\sqrt{\eta_{1}}\frac{\alpha+\beta}{\sqrt{2}}+\sqrt{1-\eta_{1}}\gamma)$
(37) $\displaystyle=$
$\displaystyle\frac{1}{\pi\sqrt{\pi}}\frac{1}{\sqrt{(1-\eta_{1})(1+2\bar{n}_{1})}}\exp(-\frac{\eta_{1}\big{[}\real(\beta)-\frac{1}{\sqrt{\eta_{1}}}\real(y)+\real(\alpha)\big{]}^{2}}{(1+2\bar{n}_{1})(1-\eta_{1})}).$

Finally, we integrate over the variable $\beta$. We now need to substitute
results of Eqs. (LABEL:eq:wigner_integration1) and
(LABEL:eq:wigner_integration2) back to Eq. (35). The prefactor is simplified
to be
$\frac{1}{\pi^{3}}\frac{1}{\sqrt{(1-\eta_{1})(1+2\bar{n}_{1})(1-\eta_{2})(1+2\bar{n}_{2})}}$.
Except this prefactor, we perform the following integral

(38)