$\max_{\bar{c}_{1}^{n}\hat{c}_{1}^{n}\in\widetilde{\Omega}}H_{\alpha}(D)_{\rho_{|\bar{c}_{1}^{n}\hat{c}_{1}^{n}}}$
there. Furthermore, in such cases we find that (denoting the desired bound on
honest abort probability as $\varepsilon^{\mathrm{com}}$, the completeness
parameter) it seems better to choose the intervals $I_{\hat{c}}$ such that
each term causes an abort with probability at most
$\varepsilon^{\mathrm{com}}/3$ (i.e. we distribute the “abort-probability
contributions” evenly), rather than using the same interval width for all
terms. Note also that while these intervals can be simply chosen using e.g.
the Chernoff bound, better results can be obtained by instead using the
binomial-distribution analysis described in [LLR+21, KAG+24] (either by using
inbuilt software functions that can evaluate binomial-distribution tail
bounds, or relaxing them to normal-distribution tail bounds as described in
[LLR+21]).

For the above protocol, we can construct GEATT channels $\mathcal{M}_{j}$ in
the fashion described in [MR23], with the $E_{j}$ register in each round
storing all the side-information Eve collects and updates, including both her
quantum side-information and the public announcements from each round. We then
construct a single rate-bounding channel $\mathcal{M}$ for all of them using
Lemma 9, which is an infrequent-sampling channel as discussed below Definition
13. For this rate-bounding channel, we can apply an EUR for von Neumann
entropy [BCC+10] to lower-bound $H(S|E\widetilde{E})_{\nu_{|\perp}}$ for any
$\nu\in\Sigma$ (i.e. any state that could be produced by
$\mathcal{M}\otimes\operatorname{id}_{\widetilde{E}}$). Specifically, if we
let $X,\widetilde{X}$ denote registers that store Alice and Bob’s
symmetrized383838As in, after they have XOR’d their outcomes with the
symmetrization bit $F$. Note that strictly speaking, in order to apply EURs to
the values $S,X,\widetilde{X}$ (which are produced after symmetrization, i.e.
not the raw outcomes of $X$ or $Z$ measurements), we are implicitly applying a
standard argument [RGK05] that the same overall state (including all side-
information) could instead have been produced by just taking the raw outcomes
of measurements on some other initial state, essentially by “commuting” the
symmetrization with the measurements by re-expressing it as a rotation on the
pre-measurement qubits. An alternative option could be to omit the
symmetrization step and instead use e.g. Fano’s inequality to write
$H(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}}\leq
h_{\mathrm{bin}}\left(\Pr\\!\left[X\neq\widetilde{X}|\widehat{C}\neq\perp\right]\right)$
for the purposes of the bound (173) below, but this would require more steps
to extend to the Rényi EUR bound (180). $X$-measurement outcomes conditioned
on $\widehat{C}\neq\perp$ (i.e. we are in the “test” component of the
infrequent-sampling channel), then

$\displaystyle H(S|E\widetilde{E})_{\nu_{|\perp}}\geq
1-H(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}}=1-h_{\mathrm{bin}}\left(\Pr\\!\left[X\neq\widetilde{X}|\widehat{C}\neq\perp\right]\right)=1-h_{\mathrm{bin}}\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right),$
(173)

where
$H(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}}=h_{\mathrm{bin}}\left(\Pr\\!\left[X\neq\widetilde{X}|\widehat{C}\neq\perp\right]\right)$
holds because the marginal distributions of $X,\widetilde{X}$ conditioned on
$\widehat{C}\neq\perp$ are uniform, and in the last step we recall that
$\widehat{C}$ is set to $\perp$ with probability $1-\gamma$ and otherwise is
set to $1$ if and only if $X\neq\widetilde{X}$. Combined with [DFR20, Lemma
B.9], this gives (note that here we have $\dim(S)=2$, because we designed the
protocol such that $S$ is still bit-valued even in a test round):

$\displaystyle\forall\alpha\in\left(1,1+\frac{1}{\log\left(5\right)}\right),\quad
H_{\widehat{\alpha}}(S|E\widetilde{E})_{\nu_{|\perp}}\geq
1-h_{\mathrm{bin}}\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)-(\widehat{\alpha}-1)\log^{2}\left(5\right).$
(174)

Again, one could instead use [DF19, Corollary IV.2] here for tighter but
slightly more elaborate bounds; we omit this for ease of presentation.

Without loss of generality, we can assume that once the $n$ measurement steps
have been completed, Eve no longer acts on her register $E_{n}$ (by replacing
any operation she does afterwards with its Stinespring isometry). Let $\rho$
denote the state produced in the protocol just before privacy amplification,
and let $\Omega$ denote the event that both393939Note that this event is a
stricter condition than just the acceptance test accepting (which would be the
event $\operatorname{freq}_{\hat{c}_{1}^{n}}\in S_{\Omega}$), so it remains
the case that every distribution $\hat{c}_{1}^{n}$ with nonzero probability in
the conditional state $\rho_{|\Omega}$ satisfies
$\operatorname{freq}_{\hat{c}_{1}^{n}}\in S_{\Omega}$, i.e. the first
condition on $S_{\Omega}$ in Theorem 2 indeed holds. Also note that we are
implicitly exploiting the fact that in Theorem 2, $\Omega$ does not have to be
an event defined entirely on the $\widehat{C}_{1}^{n}$ registers, as discussed
in Corollary 1. the acceptance test and error verification accepted. Then
since $S_{\Omega}$ as defined in (170) is convex, we can apply Theorem 2
together with Lemma 10 and the bound (112) for infrequent-sampling channels
(which is tight for this protocol, i.e. the equality (113) holds) to obtain

$\displaystyle
H^{\uparrow}_{\alpha}(S_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
$\displaystyle\geq\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\widehat{C}}\in\mathbb{P}_{\widehat{C}}}\left(q(\perp)\left(1-h_{\mathrm{bin}}\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)-(\widehat{\alpha}-1)\log^{2}\left(5\right)\right)+\frac{1}{\widehat{\alpha}-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\widehat{C}}\right)\right)n$
$\displaystyle\qquad-\frac{\alpha}{\alpha-1}\log\frac{1}{p_{\Omega}},$ (175)

where we have relaxed the optimization over $\nu\in\Sigma$ by noting that the
bound (174) in fact only depends on the classical distribution
$\boldsymbol{\nu}_{\widehat{C}}$. Note that since the domains of
$\mathbf{q},\boldsymbol{\nu}_{\widehat{C}}$ enforce that they are normalized,
and also the value of $\nu_{\widehat{C}}(\perp)$ is fixed as $1-\gamma$ by the
infrequent-sampling structure, there are in fact only $3$ independent
variables in the above minimization.

Then by applying (107) to convert the above bound to smooth min-entropy and
following the proof structure in [MR23] or [KAG+24], one can show that if we
choose any values404040The parameter $\varepsilon_{\mathrm{EV}}$ here is
denoted as $\varepsilon_{\mathrm{KV}}$ in [MR23]; we have used different
notation simply because we refer to the relevant step as “error verification”
instead of “key validation”.
$\varepsilon_{\mathrm{s}},\varepsilon_{\mathrm{a}},\varepsilon_{\mathrm{EV}},\varepsilon_{\mathrm{PA}}\in(0,1)$
and set

$\displaystyle\ell_{\mathrm{key}}$
$\displaystyle=\left\lfloor\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\widehat{C}}\in\mathbb{P}_{\widehat{C}}}\left(q(\perp)\left(1-h_{\mathrm{bin}}\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)-(\widehat{\alpha}-1)\log^{2}\left(5\right)\right)+\frac{1}{\widehat{\alpha}-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\widehat{C}}\right)\right)n\right.$
$\displaystyle\qquad\left.-\frac{\alpha}{\alpha-1}\log\frac{1}{\varepsilon_{\mathrm{a}}}-\frac{1}{\alpha-1}\log\frac{2}{\varepsilon_{\mathrm{s}}^{2}}-\lambda_{\mathrm{EC}}-\left\lceil\log\frac{1}{\varepsilon_{\mathrm{EV}}}\right\rceil-2\log\frac{1}{\varepsilon_{\mathrm{PA}}}\right\rfloor,$
(176)

the protocol will be $\varepsilon^{\mathrm{secure}}$-secure (see [TL17, MR23]
for full definitions, or [PR21] under the term soundness instead) with414141To
obtain this result we have basically added the correctness and secrecy
parameters from [MR23], except that the secrecy parameter in that work is
rescaled by a factor of $2$ as compared to [PR21, TL17], and so we have first
adjusted it accordingly. We have also removed the dependence of the secrecy
parameter in that work on $\varepsilon_{\mathrm{EV}}$, because for our
protocol we perform the acceptance test directly on the $\widehat{C}_{1}^{n}$
registers rather than a guess for it; see [KAG+24].

$\displaystyle\varepsilon^{\mathrm{secure}}=\max\left\\{\frac{\varepsilon_{\mathrm{PA}}}{2}+2\varepsilon_{\mathrm{s}},\varepsilon_{\mathrm{a}}\right\\}+\varepsilon_{\mathrm{EV}}.$
(177)

Note that since the optimal choice of $\alpha$ in (7.2) is often close to $1$,
the effects of $\varepsilon_{\mathrm{a}},\varepsilon_{\mathrm{s}}$ in that
bound are significantly larger than those of
$\varepsilon_{\mathrm{PA}},\varepsilon_{\mathrm{EV}}$. Hence for our numerical
calculations, given some desired value of $\varepsilon^{\mathrm{secure}}$ we
use the heuristic choice of setting

$\displaystyle\varepsilon_{\mathrm{PA}}=\varepsilon_{\mathrm{EV}}=\varepsilon_{\mathrm{small}},\qquad\varepsilon_{\mathrm{a}}=\varepsilon^{\mathrm{secure}}-\varepsilon_{\mathrm{small}},\qquad\varepsilon_{\mathrm{s}}=\frac{1}{2}\left(\varepsilon^{\mathrm{secure}}-\frac{3}{2}\varepsilon_{\mathrm{small}}\right),$
(178)

where $\varepsilon_{\mathrm{small}}$ is a parameter we choose to maximize
$\ell_{\mathrm{key}}$. Specifically, substituting the above expressions into
(7.2), given any fixed choice of $\alpha$ we can find the best
$\varepsilon_{\mathrm{small}}$ by differentiating with respect to
$\varepsilon_{\mathrm{small}}$ (note that the infimum term is independent of
$\varepsilon_{\mathrm{small}}$ and can be entirely ignored for this purpose),
which yields the explicit solution

$\displaystyle\varepsilon_{\mathrm{small}}=\frac{8+17(\alpha-1)-\sqrt{64+56(\alpha-1)+(\alpha-1)^{2}}}{2(9+12(\alpha-1))}\varepsilon^{\mathrm{secure}}\approx\frac{3}{4}(\alpha-1)\varepsilon^{\mathrm{secure}}.$
(179)

On the other hand, a tighter bound can be obtained by directly using EURs for
Rényi entropies to bound $h_{\widehat{\alpha}}$. Specifically, by using the
fact that $H_{\widehat{\alpha}}\geq
H_{\frac{1}{2-\widehat{\alpha}}}^{\uparrow}$ ([TBH14] or [Tom16, Corollary
5.3]) and then applying the EUR from [MLDS+13, Theorem 11], we have

$\displaystyle H_{\widehat{\alpha}}(S|E\widetilde{E})_{\nu_{|\perp}}\geq
H^{\uparrow}_{\frac{1}{2-\widehat{\alpha}}}(S|E\widetilde{E})_{\nu_{|\perp}}\geq
1-H^{\uparrow}_{\beta}(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}},\text{
where }\beta=\frac{1}{\widehat{\alpha}}.$ (180)

Note that if we write $\widehat{\alpha}=1+\widehat{\mu}$, then
$\beta=1/(1+\widehat{\mu})=1-\widehat{\mu}+O(\widehat{\mu}^{2})$. The
$H^{\uparrow}_{\beta}(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}}$ term is
a purely classical Rényi entropy and hence coincides with the entropy from
[Ari77]. Again using the fact that the symmetrized bits $X,\widetilde{X}$ have
uniform marginal distributions, we can explicitly calculate

$\displaystyle
H^{\uparrow}_{\beta}(X|\widetilde{X})_{\nu_{|\widehat{C}\neq\perp}}$
$\displaystyle=\frac{\beta}{1-\beta}\log\left(\sum_{i=0}^{1}\left(\sum_{j=0}^{1}\left(\frac{\nu_{\widehat{C}}(i\oplus
j)}{2\gamma}\right)^{\beta}\right)^{1/\beta}\right)$
$\displaystyle=\frac{1}{1-\beta}\log\left(\left(1-\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}+\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}\right).$
(181)

For $\alpha$ somewhat further away from $1$, the above bound has an important
advantage over the previous bound (174) in that as $\nu_{\widehat{C}}(1)\to
0$, it converges towards the tight bound
$H_{\widehat{\alpha}}(S|E\widetilde{E})_{\nu_{|\perp}}\geq 1$, unlike (174)
which yields a lower bound that remains of the form
$1-\Theta(\widehat{\alpha}-1)$. With this bound, we conclude that the same
security levels as described above can be achieved by instead setting

$\displaystyle\ell_{\mathrm{key}}$
$\displaystyle=\left\lfloor\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\widehat{C}}\in\mathbb{P}_{\widehat{C}}}\left(q(\perp)\left(1-\frac{1}{1-\beta}\log\left(\left(1-\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}+\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}\right)\right)+\frac{1}{\widehat{\alpha}-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\widehat{C}}\right)\right)n\right.$
$\displaystyle\qquad\left.-\frac{\alpha}{\alpha-1}\log\frac{1}{\varepsilon_{\mathrm{a}}}-\frac{1}{\alpha-1}\log\frac{2}{\varepsilon_{\mathrm{s}}^{2}}-\lambda_{\mathrm{EC}}-\left\lceil\log\frac{1}{\varepsilon_{\mathrm{EV}}}\right\rceil-2\log\frac{1}{\varepsilon_{\mathrm{PA}}}\right\rfloor.$
(182)

In the above bounds, we have converted to smooth min-entropy rather than
directly using the Rényi privacy amplification theorem of [Dup21], in order to
achieve a “fairer” comparison to [TL17]. However, our approach is certainly
compatible with the latter since it proceeds by first bounding the Rényi
entropy, and this typically yields better finite-size keyrates [GLH+22].
Furthermore, this gives us a “fully Rényi” security proof, maximally
exploiting the results we have developed in this work. We hence also perform
some calculations for this approach. Specifically, using the single-round
Rényi entropy bounds (180)–(7.2) together with the Rényi privacy amplification
theorem, we can conclude that if we set [KAG+24]

$\displaystyle\ell_{\mathrm{key}}$
$\displaystyle=\left\lfloor\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\widehat{C}}\in\mathbb{P}_{\widehat{C}}}\left(q(\perp)\left(1-\frac{1}{1-\beta}\log\left(\left(1-\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}+\left(\frac{\nu_{\widehat{C}}(1)}{\gamma}\right)^{\beta}\right)\right)+\frac{1}{\widehat{\alpha}-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\widehat{C}}\right)\right)n\right.$
$\displaystyle\qquad\left.-\lambda_{\mathrm{EC}}-\left\lceil\log\frac{1}{\varepsilon_{\mathrm{EV}}}\right\rceil-\frac{\alpha}{\alpha-1}\log\frac{1}{\varepsilon_{\mathrm{PA}}}+2\right\rfloor,$
(183)

then the protocol will be $\varepsilon^{\mathrm{secure}}$-secure with the much
simpler security parameter

$\displaystyle\varepsilon^{\mathrm{secure}}=\varepsilon_{\mathrm{PA}}+\varepsilon_{\mathrm{EV}}.$
(184)

Optimizing the choice of $\varepsilon_{\mathrm{PA}}$ and
$\varepsilon_{\mathrm{EV}}$ for a desired $\varepsilon^{\mathrm{secure}}$ and
fixed $\alpha$ yields the following explicit solution (in this case, it is
$\varepsilon_{\mathrm{PA}}$ that contributes much more significantly to the
key length than $\varepsilon_{\mathrm{EV}}$, due to the behaviour of the Rényi
privacy amplification theorem):

$\displaystyle\varepsilon_{\mathrm{EV}}=\frac{\alpha-1}{2\alpha-1}\varepsilon^{\mathrm{secure}},\qquad\varepsilon_{\mathrm{PA}}=\frac{\alpha}{2\alpha-1}\varepsilon^{\mathrm{secure}}.$
(185)

Figure 1: Keyrates for EB-BB84 from our approach, for an example with QBER
threshold $Q_{\mathrm{thresh}}=0.025$ and security parameter
$\varepsilon^{\mathrm{secure}}=10^{-10}$. The brown, blue, and purple curves
correspond to the keyrates given by the formulas (7.2), (7.2) and (7.2),
respectively, where we used heuristic numerical methods to evaluate the
(fairly simple) minimizations in those formulas. For comparison, the dashed
red curve is the corresponding result from [TL17, Fig. 7] (based on smooth-
entropy EURs), and the black horizontal line is the asymptotic rate. It can be
seen that our results are always an improvement over that work, except for the
case of the suboptimal formula (7.2) at small $n$. (The choices of
$S_{\Omega}$, $\lambda_{\mathrm{EC}}$ and epsilon parameters we used in our
formulas are described in the main text, and we roughly optimized the choices
of $\gamma$ and $\alpha$ by simply evaluating the formulas over a grid of
values for those parameters and taking the best result; we leave a more
refined approach for future applications.)

In Fig. 1, we plot the keyrates $\frac{\ell_{\mathrm{key}}}{n}$ obtained from
the formulas (7.2), (7.2) and (7.2) for a simple example with
$Q_{\mathrm{thresh}}=0.025$. Comparing them to the corresponding curve in
[TL17, Fig. 7], we find that while (7.2) is slightly worse at small $n$, we
have better keyrates everywhere else as compared to the results in that work.
In particular, the formula (7.2) already performs better everywhere despite
also proceeding via a smooth min-entropy bound (instead of Rényi privacy
amplification), i.e. this means it genuinely certifies a better bound on
smooth min-entropy as compared to the proof in that work. (It is true that
technically our protocol implements infrequent-sampling rather than sampling-
without-replacement as in their protocol; however, we believe that the
comparison is still fairly reasonable.) An important question is whether this
improvement still holds in the presence of photon loss; we leave this for
future work.

We remark that in fact, using Theorem 2 for this proof was slightly
suboptimal: our bound for the [HB24] model (Theorem 3) is slightly tighter, as
previously discussed. However, we choose to present our results based on
Theorem 2 to demonstrate that we can get keyrates comparable to the smooth-
entropy EUR approach in [TL17] even with this slight suboptimality. Also note
that here we considered an EB protocol, which does not require a “single-
signal interaction” condition when applying the GEAT; when considering PM
protocols instead, one should anyway use the [HB24] model to avoid requiring
this condition.

###  7.3 DIRE from collision-entropy accumulation

In [LLR+21], an experiment was performed to demonstrate DIRE, with a security
proof using the EAT (under the original Markov conditions as described in Sec.
6.1 here). To briefly summarize, each round consists of an infrequent-sampling
channel (Definition 13) such that in test rounds, the CHSH game is played and
the “secret test register” $\overline{C}_{j}$ is set to $0$ for a loss and $1$
for a win; in generation rounds, fixed inputs are supplied to their devices
and the outputs are recorded, with $\overline{C}_{j}$ being set to $\perp$.
The “public test registers” $\widehat{C}_{j}$ are trivial in this analysis.
The secret register $S_{j}$ for the proof technically consists of outputs from
both Alice and Bob’s devices; however, for the purposes of the single-round
analysis we follow that work and simply lower-bound its entropy by only
considering Alice’s output.

As the [LLR+21] analysis was based on the previous EAT, they considered only
the von Neumann entropy in the single-round analysis. We could of course do
the same with our results using the methods discussed above (and we again find
improved finite-size performance compared to previous results, which we
present in a companion work [HT24]). However, in this section we demonstrate
an alternative perspective that given a bound on the single-round min-entropy
or collision entropy, we can “accumulate” it to obtain a bound on the overall
$H^{\uparrow}_{2}$ entropy, on which we can directly apply a “traditional”
privacy amplification result [Ren05, Theorem 5.5.1]. (A collision-entropy
analysis was also used in [MDR+19], but it was under an IID assumption.)

######  Remark 10.

Readers interested in results more applicable to DIQKD may refer to the
companion work [HT24]. For this example here, we have chosen randomness
expansion rather than QKD because in the former, _any_ $\Omega(n)$ lower bound
on the overall
$H^{\uparrow}_{2}(S_{1}^{n}\overline{C}_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}$
entropy is enough to eventually produce a nonzero key length. In contrast, for
QKD there is an error-correction term $\lambda_{\mathrm{EC}}$ that remains
significant at large $n$, so an $\Omega(n)$ lower bound on
$H^{\uparrow}_{2}(S_{1}^{n}\overline{C}_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}$
would still need to have a sufficiently large implicit constant in order to
produce a nonzero key length, even asymptotically.

Specifically, in [PAM+10, MPA11] a bound was derived on
$H^{\uparrow}_{\infty}(S\overline{C}|\widehat{C}T\widehat{E})_{\nu_{|\perp}}$
as a function of CHSH winning probability. Noting that $H_{2}\geq
H^{\uparrow}_{\infty}$ ([TBH14] or [Tom16, Corollary 5.3]), we can
write424242It would have been cleaner if we could directly “accumulate”
$H^{\uparrow}_{\infty}$; however, it can be seen that our bounds for the EAT
or GEAT scenarios involve $H_{\alpha}$ rather than $H^{\uparrow}_{\alpha}$ in
the single-round terms, and therefore we cannot directly make use of a bound
on single-round $H^{\uparrow}_{\infty}$ without first converting it to
$H_{2}$. (For the [HB24] scenario though, the bounds we presented in Sec. 6.2
are indeed based on single-round $H^{\uparrow}_{\alpha}$, which would indeed
allow us to directly “accumulate” min-entropy.) Though in any case, for the
CHSH game in particular, [MDR+19] showed that the bound (188) is in fact tight
for _both_ $H_{2}$ and $H^{\uparrow}_{\infty}$, so there is no loss of
tightness in considering the former instead for this particular protocol.

$\displaystyle\begin{gathered}H_{2}(S\overline{C}|\widehat{C}T\widehat{E})_{\nu_{|\perp}}\geq
H^{\uparrow}_{\infty}(S\overline{C}|\widehat{C}T\widehat{E})_{\nu_{|\perp}}\geq
f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right),\\\
\text{where}\quad f_{\mathrm{CHSH}}(w)\coloneqq
1-\log\left(1+\sqrt{2-\frac{(8w-4)^{2}}{4}}\right).\end{gathered}$ (188)

Applying the Lemma 14 version of Theorem 2 with the Lemma 10 bound (these
choices are to ensure the Rényi parameter does not change further), we obtain
a form of “collision entropy accumulation”, albeit with $H^{\uparrow}_{2}$ of
the final state rather than $H_{2}$:

$\displaystyle\begin{gathered}H^{\uparrow}_{2}(S_{1}^{n}\overline{C}_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}\geq
nh_{2}-\log\frac{1}{p_{\Omega}},\\\ \text{where}\quad
h_{2}=\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\overline{C}}\in\mathbb{P}_{\overline{C}}}\left(q(\perp)f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right)+D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\overline{C}}\right)\right).\end{gathered}$
(191)

With this we can apply a “traditional” privacy amplification theorem for
unsmoothed $H^{\uparrow}_{2}$ [Ren05, Theorem 5.5.1], from which we conclude
we can obtain an $\varepsilon^{\mathrm{secret}}$-secret key with length given
by

$\displaystyle\ell_{\mathrm{key}}=\left\lfloor
nh_{2}-2\log\frac{1}{\varepsilon^{\mathrm{secret}}}+2\right\rfloor.$ (192)

(Technically, to obtain the above we have used the fact that for this protocol
we have
$H^{\uparrow}_{2}(S_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}=H^{\uparrow}_{2}(S_{1}^{n}\overline{C}_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}$
by [DFR20, Lemma B.7], because $\overline{C}_{1}^{n}$ in this protocol can be
“projectively reconstructed” from $S_{1}^{n}T_{1}^{n}$. Also, the log-
probability term does not appear in the final key length formula because it
simply becomes an appropriate prefactor in the secrecy definition; see [Dup21,
KAG+24].)

The above formula for $\ell_{\mathrm{key}}$ is a linear expression with only
an $O(1)$ finite-size correction, so we might hope that it could perform
better at small $n$, where the $O(\sqrt{n})$ finite-size corrections of the
previous EAT have larger relative effects. Evaluating the value of $h_{2}$ in
the above formula for the parameters used in the main experiment of [LLR+21],
we find the result $h_{2}=4.47\times 10^{-9}$, which appears fairly small.
However, we note that to achieve the secrecy parameter of
$\varepsilon^{\mathrm{secret}}=3.09\times 10^{-12}$ that was chosen in that
work, the minimum number of rounds required for nontrivial key length (i.e.
$\ell_{\mathrm{key}}\geq 1$) with this formula is then
$n_{\mathrm{min}}=1.685\times 10^{10}$, which is indeed a slight improvement
over the value $n_{\mathrm{min}}=8.951\times 10^{10}$ found in that work. (On
the other hand, if we consider the larger value $n=1.3824\times 10^{11}$ used
in the actual [LLR+21] experiment, the formula (192) yields a much smaller
$\ell_{\mathrm{key}}$ than the analysis in that work — this is somewhat
expected since the rate asymptotically converges to $h_{2}$ rather than the
single-round von Neumann entropy.)

As mentioned in previous sections, the above approach has the drawback that
$h_{2}$ is a constant independent of $n$, because the “penalty term” in (191)
does not change with $n$. This implies in particular that it does not converge
to $\inf_{\boldsymbol{\nu}_{\overline{C}}\in
S_{\Omega}}\nu_{\overline{C}}(\perp)f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right)$
even at large $n$. To overcome this issue, we can fine-tune further by noting
that since the Rényi entropies are monotone in $\alpha$, the lower bound in
(188) also holds for any $H_{\alpha}$ with $\alpha\leq 2$, and therefore we
could invoke our bounds with any such $\alpha$ instead. Together with the
Rényi privacy amplification theorem [Dup21]434343Again, we could instead
convert to $H_{\mathrm{min}}^{\varepsilon_{\mathrm{s}}}$ and apply the
corresponding privacy amplification theorem (under the current state of
results in privacy amplification, this may be necessary if the protocol uses
Trevisan’s extractor instead of 2-universal hashing). However, in that case we
find no improvement in $n_{\mathrm{min}}$ over (192), though we can at least
still get about $n_{\mathrm{min}}=3\times 10^{10}$, which is still better than
[LLR+21]. The issue basically seems to be that for security proofs based on
our $H_{\mathrm{min}}^{\varepsilon_{\mathrm{s}}}$ bound rather than our
$H^{\uparrow}_{\alpha}$ bound, one has to pick a “threshold” value
$\varepsilon_{\mathrm{a}}$ and split the analysis into cases where
$p_{\Omega}$ is above or below $\varepsilon_{\mathrm{a}}$; this introduces
additional finite-size corrections, and the resulting $\ell_{\mathrm{key}}$
formula then fails to reduce to (192) in the $\alpha\to 2$ limit., this means
we could get an $\varepsilon^{\mathrm{secret}}$-secret key by picking

$\displaystyle\ell_{\mathrm{key}}$
$\displaystyle=\left\lfloor\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\overline{C}}\in\mathbb{P}_{\overline{C}}}\left(q(\perp)f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right)+\frac{1}{\alpha-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\overline{C}}\right)\right)n-\frac{\alpha}{\alpha-1}\log\frac{1}{\varepsilon^{\mathrm{secret}}}+2\right\rfloor.$
(193)

where $\alpha\in(1,2]$ can be optimized over. Note that in this approach, the
final Rényi entropy
$H^{\uparrow}_{\alpha}(S_{1}^{n}\overline{C}_{1}^{n}|T_{1}^{n}\widehat{E})_{\rho_{|\Omega}}$
that we bounded may have a very different Rényi parameter from the single-
round bound; however, it has the advantage that at large $n$, the “first-order
constant” will indeed converge to $\inf_{\boldsymbol{\nu}_{\overline{C}}\in
S_{\Omega}}\nu_{\overline{C}}(\perp)f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right)$
(e.g. by taking $\alpha=1+\Theta(1/\sqrt{n})$). By optimizing $\alpha$ in this
formula (193), we find that $\ell_{\mathrm{key}}\geq 1$ can be achieved even
at e.g. $n=10^{10}$.

In fact, with this perspective we can also apply the Lemma 11 bound instead,
by setting $\alpha^{\prime}=2$ and hence requiring
$\frac{{\alpha}}{{\alpha}-1}=2+\frac{\alpha^{\prime\prime}}{\alpha^{\prime\prime}-1}$
(if we write $\alpha=1+\mu$, this translates to
$\alpha^{\prime\prime}=1+\frac{\mu}{1-2\mu}=1+\mu+O(\mu^{2})$; note that this
means we have to restrict to $\mu<1/2$ i.e. $\alpha<3/2$). Due to symmetries
of the protocol, the bound (188) also holds for the state $\nu$ without
conditioning on $\bar{c}=\perp$ (this fact was implicitly used in [LLR+21]).
With this we can pick

$\displaystyle\ell_{\mathrm{key}}$
$\displaystyle=\left\lfloor\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\nu}_{\overline{C}}\in\mathbb{P}_{\overline{C}}}\left(f_{\mathrm{CHSH}}\left(\frac{\nu_{\overline{C}}(1)}{\gamma}\right)+\frac{\alpha^{\prime\prime}}{\alpha^{\prime\prime}-1}D\left(\mathbf{q}\middle\|\boldsymbol{\nu}_{\overline{C}}\right)\right)n-\frac{\alpha}{\alpha-1}\log\frac{1}{\varepsilon^{\mathrm{secret}}}+2\right\rfloor.$
(194)

We find that at $n\sim 10^{10}$, this bound is worse than (193). However, when
$n$ gets closer to the values used in the [LLR+21] experiment, it sometimes
performs better than (193) (though still somewhat worse than the results in
[LLR+21] based on single-round von Neumann entropy, but surprisingly, not by a
large extent). This behaviour essentially seems to be because we have fixed
the value of $\alpha^{\prime}$ in this case, so the other Rényi parameter
$\alpha^{\prime\prime}$ remains equal to $\alpha$ up to order
$O((\alpha-1)^{2})$, hence more or less avoiding the “loss” in Rényi
parameter. Hence at large $n$ (where the optimal $\alpha$ becomes close to
$1$), it can sometimes outperform (193) because it does not have the
$q(\perp)$ prefactor. However, roughly speaking we do not expect this to be
the case if we were to instead work with von Neumann entropy (via (106)) in
this regime, since in that case the Rényi parameters would have the worse
scaling $\alpha^{\prime},\alpha^{\prime\prime}=1+2\mu+O(\mu^{2})$ as discussed
previously, assuming we choose
$\alpha^{\prime}=\alpha^{\prime\prime}$.444444In fact another potential
question is whether we would actually get better $n_{\mathrm{min}}$ values via
this von Neumann entropy approach; we leave this question for future work. One
point that may be worth highlighting is that similar to the advantage of (7.2)
over (174) in the previous section, working with the collision-entropy bound
(188) ensures that the optimization for the “first-order term” always returns
a strictly positive value, unlike the relaxation to von Neumann entropy via
the continuity bound (106), which may yield a negative value if
$\alpha^{\prime}$ is not sufficiently close to $1$. Hence it seems likely that
the collision-entropy approach will indeed be better for small $n$, where the
optimal Rényi parameters are further from $1$.

Finally, we highlight that numerical exploration again suggests that rather
than using the accept condition in the [LLR+21] experiment (which only
constrains the frequency of $\bar{c}=0$), our bounds yield better results if
we instead follow the approach in Remark 9 (while preserving the same bound on
honest abort probability).

##  8 Conclusion and future work

In summary, in this work we have found a connection between entropy
accumulation and QEFs, yielding families of Rényi entropy bounds that are
suitable for use in both variable-length and fixed-length protocols. Our
results for the latter case have the important advantage of not requiring
affine min-tradeoff functions, and furthermore we find that they give a
significant improvement in practice over previous EAT or GEAT bounds. Since
our approach proceeds via Rényi entropies, it also unlocks a variety of
options for security proofs based on any Rényi entropies, including “fully
Rényi” security proofs (without an IID assumption) that approach the “correct”
asymptotic behaviour by taking $\alpha\to 1$.

Certainly, one question for future consideration would be whether the bounds
could be further tightened. As discussed in Sec. 7.1, it seems many steps in
the proof are tight, apart from Lemma 8. It would be interesting to see if
improvements could be found on that step. However, we highlight again that the
current bound is already tight enough to outperform the smoothed-entropy EURs
in at least some contexts.

Another consideration is the fact that in current DIQKD security proofs, the
handling of the test-round registers is highly inconvenient — since they do
not fulfil the NS condition, one has to include them in the
$\overline{C}_{1}^{n}$ registers on the “left side” of the conditioning, then
shift them to the “right side” via chain rules [AFRV19, TSB+22, CMT23].
Ideally, to resolve this issue, one would like to have a version of entropy
accumulation that does not require the test-round registers to explicitly
appear in the entropy terms (or be “reconstructible” from the registers that
appear, in the sense of [MFS+22a]). It does not seem straightforward how to do
so with the proof approaches thus far, but this remains an interesting open
question that should be further explored. Failing that, it may be interesting
to consider the question of whether there is a more natural way to handle the
$\overline{C}_{1}^{n}$ registers for variable-length protocols rather than
simply shifting them onto the “right side” of the conditioning (especially in
the case of DIRE), perhaps by using some other structure in QES-entropies.

######  Remark 11.

For fixed-length protocols using infrequent-sampling channels (Definition 13)
though, we can at least propose an improved method for handling the
$\overline{C}_{1}^{n}$ registers as compared to previous works such as
[AFRV19, MDR+19, TSB+22, GLH+22]. Specifically, let us suppose the protocol
(more precisely the GEATT model used to describe it) satisfies the following
properties:

  * •

The $E_{n}$ register at the end of the protocol contains a copy of some
classical registers $T_{1}^{n}$ that record whether each round is a test or
generation round.

  * •

Conditioned on the event $\Omega$, the fraction of test rounds is at most some
fixed constant $\gamma^{\mathrm{max}}$.

These properties are usually easy to satisfy when designing a protocol (the
second one by choosing the accept condition appropriately; this usually only
has a small effect on the completeness parameter since the honest behaviour is
IID). The results in this work give bounds on
$H^{\uparrow}_{\alpha}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$,
but the main quantity of interest in e.g. DIQKD security proofs is often
either
$H^{\uparrow}_{\alpha}(S_{1}^{n}|\overline{C}_{1}^{n}\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
or
$H^{\uparrow}_{\alpha}(S_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
(the former for protocols that just directly announce the
$\overline{C}_{1}^{n}$ values, the latter for protocols that “compress” those
values as in [AFRV19, TSB+22, NDN+22]). We now observe that given the above
two properties, we can easily relate all these quantities as follows, for any
$\alpha\in[1/2,\infty]$:

$\displaystyle
H^{\uparrow}_{\alpha}(S_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(S_{1}^{n}|\overline{C}_{1}^{n}\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}-H^{\uparrow}_{0}(\overline{C}_{1}^{n}|T_{1}^{n})_{\rho_{|\Omega}}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}-\max_{{t_{1}^{n}\text{
s.t.}\;\rho_{|\Omega}(t_{1}^{n})>0}}H^{\uparrow}_{0}(\overline{C}_{1}^{n})_{\rho_{|t_{1}^{n}}}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}-\gamma^{\mathrm{max}}\dim(\overline{C}_{j})n,$
(195)

where in the last line we can replace $\dim(\overline{C}_{j})$ with
$\dim(\overline{C}_{j})-1$ if $\overline{C}_{j}=\perp$ never occurs in test
rounds.454545This property follows automatically from the definition of
infrequent-sampling channels whenever the $\widehat{C}_{j}$ registers are
trivial; the only issue if $\widehat{C}_{j}$ are nontrivial is that our
definition _technically_ allows one to set $\overline{C}_{j}=\perp$ in test
rounds if $\widehat{C}_{j}\neq\perp$, though we do not expect this will be a
serious issue for actual protocols. In the above, the second line is464646We
could have obtained a similar result by instead using the chain rule from
[Dup15] here to extract a
$H^{\uparrow}_{1/2}(\overline{C}_{1}^{n}|T_{1}^{n})_{\rho_{|\Omega}}$ term,
but this would have a (fairly minor) disadvantage of causing a small “higher-
order” change in Rényi parameter, comparable to (75). Note that even with
this, our approach would still differ slightly from [GLH+22] due to how we
bound the
$H^{\uparrow}_{1/2}(\overline{C}_{1}^{n}|T_{1}^{n})_{\rho_{|\Omega}}$ term in
the subsequent steps. proven in Appendix C (see (16), noting that $E_{n}$
contains the register $T_{1}^{n}$), the third line follows from the fact that
since $\overline{C}_{1}^{n}T_{1}^{n}$ are classical we can (see [Tom16, Eq.
(5.27)]) write
$H^{\uparrow}_{0}(\overline{C}_{1}^{n}|T_{1}^{n})_{\rho_{|\Omega}}$ in the
form given in [Ren05, Definition 3.1.2 and 3.1.4], and the fourth line follows
from the imposed property that the event $\Omega$ implies there are at most
$\gamma^{\mathrm{max}}n$ rounds in which $\overline{C}_{j}$ was not
deterministically set to $\perp$, and conditioned on $t_{1}^{n}$ the positions
of those rounds are fixed.

The above chain of computations serves to bound both
$H^{\uparrow}_{\alpha}(S_{1}^{n}|\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$
and
$H^{\uparrow}_{\alpha}(S_{1}^{n}|\overline{C}_{1}^{n}\widehat{C}_{1}^{n}E_{n})_{\rho_{|\Omega}}$,
so one can use whichever is more convenient in a DIQKD security proof. Also,
while we presented the above bound in terms of the $\overline{C}_{j}$
registers, it is easily modified to slight variants where e.g. one only
considers Bob’s registers; see [HT24]. We believe that this bound should be
not only simpler but also tighter than the previous approaches in [AFRV19,
MDR+19, TSB+22, GLH+22], which were based on chain rules that changed the
smoothing parameter or Rényi parameter.474747Furthermore, in our bound the
subtracted term simply has the form
$\gamma^{\mathrm{max}}\dim(\overline{C}_{j})n$ where $\gamma^{\mathrm{max}}$
only needs to be chosen to be sufficiently large for the _honest_ IID behavior
to accept with high probability. In comparison, the subtracted terms in
[AFRV19, MDR+19, TSB+22, GLH+22] were instead of roughly the form
$\dim(\overline{C}_{j})\gamma n+O(\sqrt{n})$ where the $O(\sqrt{n})$ term
accommodated potential non-IID behavior. It seems likely that the former value
is smaller, though we do not aim to prove this rigorously. (We briefly
highlight however that [CMT23] introduced an approach in which the subtracted
term was also roughly of the form
$\gamma^{\mathrm{max}}\dim(\overline{C}_{j})n$, though there was still a
change of smoothing parameter.)

However, for variable-length protocols this technique does not work directly,
because we do not condition on an “acceptance event” and so it seems less
straightforward to constrain the state support in the subtracted entropic
term. As discussed previously, one approach might be to use Lemma 5, and then
apply the EAT to bound the resulting
$H_{\alpha^{\prime\prime}}(\overline{C}_{1}^{n}|T_{1}^{n})_{\rho}$ term on the
_unconditioned_ state (noting that for an infrequent-sampling channel, the
single-round $H_{\alpha^{\prime\prime}}(\overline{C}_{j}|T_{j})_{\nu}$ entropy
is bounded even without “testing”), but the bound might be slightly worse.

We also note that in this work we have focused on presenting fairly simple
example applications, such as fully qubit BB84 and a simple DIRE scenario. In
upcoming works, we aim to apply these results to more sophisticated protocols
such as decoy-state QKD and DIQKD.

## Acknowledgements

We are very grateful to Peter Brown and Thomas van Himbeeck for discussions of
their work on $f$-weighted Rényi entropies — our presentation in Sec. 4 in
terms of QES-entropies was formulated based on their approach, though we
developed the overall proof structure that led to Theorem 2 mostly
independently. We also thank Ashutosh Marwah for providing us with the proof
of Lemma 16, as well as Frédéric Dupuis, Tony Metger, Renato Renner, Martin
Sandfuchs, and Ramona Wolf for helpful discussions. A.A. and E.T. conducted
research at the Institute for Quantum Computing, at the University of
Waterloo, which is supported by Innovation, Science, and Economic Development
Canada. Support was also provided by NSERC under the Discovery Grants Program,
Grant No. 341495. T.H. acknowledges support from the Marshall and Arlene
Bennett Family Research Program, the Minerva foundation with funding from the
Federal German Ministry for Education and Research and the Israel Science
Foundation (ISF), and the Directorate for Defense Research and Development
(DDR&D), grant No. 3426/21.

##  Appendix A Comparison to previous GEATT definition

Here we outline some differences between the conditions in [MFS+22a] and our
approach. In that work, only a single “testing register” $C_{j}$ was produced
in each round, and the bounds they obtained were on entropies of the form
$\mathbb{H}(S_{1}^{n}|E_{n})$ (for various entropies $\mathbb{H}$) for the
final state, under a condition that $C_{1}^{n}$ can be “projectively
reconstructed” from $S_{1}^{n}E_{n}$ in that state. In this work, we have two
such registers $\overline{C}_{j}$ and $\widehat{C}_{j}$ in each round, and we
instead take the approach of obtaining bounds on the entropies of the form
$\mathbb{H}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})$, where
$\overline{C}_{1}^{n}\widehat{C}_{1}^{n}$ are explicitly involved in the final
bound but we do not impose the projective reconstruction condition. However,
note that if $\overline{C}_{1}^{n}$ and $\widehat{C}_{1}^{n}$ can separately
be projectively reconstructed from $S_{1}^{n}$ and $E_{n}$ respectively (which
should be basically equivalent to the projective reconstruction property for
$C_{1}^{n}$ in that work, because it requires $C_{1}^{n}$ to be a
deterministic function of outcomes of separate projective measurements on
$S_{1}^{n}$ and $E_{n}$, which can therefore be viewed as
$\overline{C}_{1}^{n}$ and $\widehat{C}_{1}^{n}$), then
$\mathbb{H}(S_{1}^{n}\overline{C}_{1}^{n}|\widehat{C}_{1}^{n}E_{n})=\mathbb{H}(S_{1}^{n}|E_{n})$
for any entropy with “reasonable” data-processing properties, and so our
results should be basically equivalent in those aspects. Similar
considerations hold when considering the single-round entropies
$\mathbb{H}(S_{j}\overline{C}_{j}|\widehat{C}_{j}E_{j})$ as well. (Strictly
speaking, [MFS+22a] does not state that the projective reconstruction property
is required for individual rounds. However, a close inspection of the proof
shows that in fact it is implicitly required to obtain the bound just before
Eq. (4.10) in their proof, because their argument is based on the argument in
[DF19] which requires this property in single rounds as well.)

##  Appendix B Alternative proofs of strong duality

Here we provide an alternative proof of Lemma 13 that provides options for
removing the finite-dimensionality assumption on $\widetilde{Q}$ (at least,
for the purposes of proving this lemma in isolation — other steps such as the
fundamental GEAT bound (63) still currently require that assumption, due to
the use of a de Finetti argument in its proof), possibly by imposing extra
conditions on $S_{\Omega}$.

We begin by removing some “extraneous” degrees of freedom from the
optimizations. Specifically, given the rate-bounding channel $\mathcal{M}$,
let us introduce a notion of its “supporting alphabet”484848An alternative
approach for the purposes of our analysis would have been to simply restrict
the alphabet of the registers $\overline{C}\widehat{C}$ to
$\mathcal{C}_{\mathcal{M}}$ rather than
$\overline{\mathcal{C}}\times\widehat{\mathcal{C}}$, since the values outside
$\mathcal{C}_{\mathcal{M}}$ will never occur and thus have no “physical
relevance”. However, this would the slightly unpleasant side-effect that the
resulting alphabet is not guaranteed to have a Cartesian-product form.
$\mathcal{C}_{\mathcal{M}}\subseteq\overline{\mathcal{C}}\times\widehat{\mathcal{C}}$,
which we define as the set of values $\bar{c}\hat{c}$ that can be produced
with nonzero probability by some input state to $\mathcal{M}$:

$\displaystyle\mathcal{C}_{\mathcal{M}}\coloneqq\left\\{(\bar{c},\hat{c})\in\overline{\mathcal{C}}\times\widehat{\mathcal{C}}\;\middle|\;\nu^{\omega}(\bar{c}\hat{c})>0\text{
for some }\omega\in\operatorname{S}_{=}(\widetilde{Q})\right\\}.$ (196)

We will write $\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$ to denote distributions
on $\mathcal{C}_{\mathcal{M}}$. Basically, our first goal is to “remove some
dependencies” on terms corresponding to
$\bar{c}\hat{c}\notin\mathcal{C}_{\mathcal{M}}$.

Observe that for any $\boldsymbol{\lambda}$ such that
$\operatorname{supp}(\boldsymbol{\lambda})\not\subseteq\mathcal{C}_{\mathcal{M}}$,
by definition of $\mathcal{C}_{\mathcal{M}}$ we have
$\operatorname{supp}(\boldsymbol{\lambda})\not\subseteq\operatorname{supp}(\boldsymbol{\nu}_{\overline{C}\widehat{C}}^{\omega})$
for _every_ $\omega$. This means we can exclude any such
$\boldsymbol{\lambda}$ from the infimum in the last line of (5.2) without
changing its value, because for such $\boldsymbol{\lambda}$ we have
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\lambda})=+\infty$ for all
$\omega$ (due to the
$D\left(\boldsymbol{\lambda}\middle\|\boldsymbol{\nu}^{\omega}_{\overline{C}\widehat{C}}\right)$
term). For convenience, let us introduce the notation
$\boldsymbol{\mu}_{\oplus\mathbf{0}}$ for any distribution
$\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$ to mean the
corresponding distribution in $\mathbb{P}_{\overline{C}\widehat{C}}$ obtained
by padding $\boldsymbol{\mu}$ with zero entries. With this, we can carry on
from the last line of (5.2) to obtain:

$\displaystyle r_{\widehat{\alpha}}(\mathbf{f})=$
$\displaystyle\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}}\inf_{\omega\in\operatorname{S}_{=}(\widetilde{Q})}\left(G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})+\left(\mathbf{q}-\boldsymbol{\mu}_{\oplus\mathbf{0}}\right)\cdot{\mathbf{f}}\right)$
$\displaystyle=$ $\displaystyle\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}}\left(J_{\widehat{\alpha}}(\boldsymbol{\mu})+\left(\mathbf{q}-\boldsymbol{\mu}_{\oplus\mathbf{0}}\right)\cdot{\mathbf{f}}\right),$
(197)

where we introduce a new function $J_{\widehat{\alpha}}$ that computes the
infimum over the only term involving $\omega$:

$\displaystyle
J_{\widehat{\alpha}}(\boldsymbol{\mu})\coloneqq\inf_{\omega\in\operatorname{S}_{=}(\widetilde{Q})}G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}}).$
(198)

With this, from the last line of (B) we see that
$\sup_{\mathbf{f}}r_{\widehat{\alpha}}(\mathbf{f})$ is the dual problem of

$\displaystyle\begin{gathered}\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}}J_{\widehat{\alpha}}(\boldsymbol{\mu})\\\
\text{
s.t.}\quad\mathbf{q}-\boldsymbol{\mu}_{\oplus\mathbf{0}}=\mathbf{0}\end{gathered},$
(201)

and to obtain our desired result we shall show strong duality holds for this
problem.

To do so, we first note that the objective
$J_{\widehat{\alpha}}(\boldsymbol{\mu})$ has the following critical properties
with respect to $\boldsymbol{\mu}$:

  * •

It is convex over $\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$,
because
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})$
is jointly convex in $(\boldsymbol{\mu},\omega)$, and for a jointly convex
function of two variables, taking the infimum with respect to one variable
over a convex set preserves convexity in the other variable [BV04, Chapter
3.2.5] (as long as the infimum is not $-\infty$ everywhere, which is easily
seen to be true for $G^{*}_{\widehat{\alpha},\nu^{\omega}}$).

  * •

It is finite over $\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$,
because we can construct a feasible point $\omega$ in (198) with finite
objective value: by definition of $\mathcal{C}_{\mathcal{M}}$, for each
$\bar{c}\hat{c}\in\mathcal{C}_{\mathcal{M}}$ we can find some $\omega$ such
that $\boldsymbol{\nu}_{\overline{C}\widehat{C}}^{\omega}(\bar{c}\hat{c})>0$;
by taking a mixture of such cases, we can obtain an $\omega$ such that
$\boldsymbol{\nu}_{\overline{C}\widehat{C}}^{\omega}$ has full support on
$\mathcal{C}_{\mathcal{M}}$ (by linearity of $\mathcal{M}$), which means
$D\left(\boldsymbol{\mu}_{\oplus\mathbf{0}}\middle\|\boldsymbol{\nu}_{\overline{C}\widehat{C}}^{\omega}\right)$
and hence also
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})$
is finite for this $\omega$.494949Alternative option: since the mapping
$\omega\to{\nu}^{\omega}_{\overline{C}\widehat{C}}$ is a quantum-to-classical
channel, one can show it must be of the form
$\omega\to\sum_{\bar{c}\hat{c}}\operatorname{Tr}\\!\left[\Gamma_{\bar{c}\hat{c}}\omega\right]\left|\bar{c}\hat{c}\right>\\!\\!\left<\bar{c}\hat{c}\right|$
for some POVM elements $\Gamma_{\bar{c}\hat{c}}$; furthermore, we must have
$\Gamma_{\bar{c}\hat{c}}\neq 0$ for all
$\bar{c}\hat{c}\notin\mathcal{C}_{\mathcal{M}}$. With this we can show that
any full-support $\omega_{\widetilde{Q}}$ yields a distribution
$\boldsymbol{\nu}^{\omega}_{\overline{C}\widehat{C}}$ with full support on
$\mathcal{C}_{\mathcal{M}}$ (at least, assuming countable dimension; the
argument should generalize further in some fashion but we do not consider this
further here), giving the desired result. (The
$D_{\widehat{\alpha}}\left(\nu^{\omega}_{SE\widetilde{E}\land\bar{c}\hat{c}}\middle\|\mathbb{I}_{S}\otimes\nu^{\omega}_{E\widetilde{E}\land\hat{c}}\right)$
terms in the sum are all finite as previously discussed, so they pose no
issues.)

  * •

It is continuous over
$\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$ as long as we
chose $\operatorname{\mathtt{Pur}}$ to be a continuous function, because in
that case
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})$
is continuous in $(\boldsymbol{\mu},\omega)$ (as discussed in the main text),
and we are taking its infimum over a compact set
$\operatorname{S}_{=}(\widetilde{Q})$. (Note that while
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})$
was only continuous in an extended-real sense,
$J_{\widehat{\alpha}}(\boldsymbol{\mu})$ is finite everywhere by the preceding
point, and hence continuous in the standard sense.)

Since $J_{\widehat{\alpha}}(\boldsymbol{\mu})$ is entirely independent of
$\mathbf{q}$, the above properties trivially give (joint) convexity,
finiteness and continuity over
$(\mathbf{q},\boldsymbol{\mu})\in\mathbb{P}_{\overline{C}\widehat{C}}\times\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$
as well. With this we can again suppose $S_{\Omega}$ is closed without loss of
generality, since the continuity property over
$\mathbb{P}_{\overline{C}\widehat{C}}\times\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$
allows us to switch between $S_{\Omega}$ and its closure. With these
properties, we have strong duality by the Clark-Duffin condition (or Sion’s
minimax theorem), after which we obtain the desired final result by
“reversing” all the above transformations:

$\displaystyle\sup_{\mathbf{f}}r_{\widehat{\alpha}}(\mathbf{f})$
$\displaystyle=\begin{gathered}\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}}J_{\widehat{\alpha}}(\boldsymbol{\mu})\\\
\text{
s.t.}\quad\mathbf{q}-\boldsymbol{\mu}_{\oplus\mathbf{0}}=\mathbf{0}\end{gathered}$
(204) $\displaystyle=\begin{gathered}\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\mu}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}}\inf_{\omega\in\operatorname{S}_{=}(\widetilde{Q})}G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\mu}_{\oplus\mathbf{0}})\\\
\text{
s.t.}\quad\mathbf{q}-\boldsymbol{\mu}_{\oplus\mathbf{0}}=\mathbf{0}\end{gathered}$
(207) $\displaystyle=\begin{gathered}\inf_{\mathbf{q}\in
S_{\Omega}}\inf_{\boldsymbol{\lambda}\in\mathbb{P}_{\overline{C}\widehat{C}}}\inf_{\omega\in\operatorname{S}_{=}(\widetilde{Q})}G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\lambda})\\\
\text{ s.t.}\quad\mathbf{q}-\boldsymbol{\lambda}=\mathbf{0},\end{gathered}$
(210)

where the last line holds because as discussed previously, any
$\boldsymbol{\lambda}$ such that
$\operatorname{supp}(\boldsymbol{\lambda})\not\subseteq\mathcal{C}_{\mathcal{M}}$
yields $G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\lambda})=+\infty$
for every $\omega$.

######  Remark 12.

In this proof of Lemma 13, the _only_ point we invoked the finite-
dimensionality condition was in showing that $J_{\widehat{\alpha}}$ is
continuous (where we used compactness of
$\operatorname{S}_{=}(\widetilde{Q})$) — all other properties, such as
convexity and finiteness, were true even for infinite-dimensional
$\widetilde{Q}$. Hence this approach also provides an alternative method to
obtain the desired result without requiring finite-dimensionality of
$\widetilde{Q}$, if we instead impose additional conditions on $S_{\Omega}$ in
order to use Slater’s condition, which requires no continuity properties.
Specifically, suppose we additionally require that the relative interior of
$S_{\Omega}$ contains a distribution $\mathbf{q}^{\star}$ such that
$q^{\star}(\bar{c}\hat{c})>0$ if and only if
$\bar{c}\hat{c}\in\mathcal{C}_{\mathcal{M}}$ (i.e.
$\operatorname{supp}(\mathbf{q}^{\star})=\mathcal{C}_{\mathcal{M}}$). In that
case, if we let
$\boldsymbol{\mu}^{\star}\in\mathbb{P}_{\mathcal{C}_{\mathcal{M}}}$ be the
distribution $\mathbf{q}^{\star}$ with the terms in
$\mathcal{C}_{\mathcal{M}}$ removed, we see that
$(\mathbf{q}^{\star},\boldsymbol{\mu}^{\star})$ is a relative interior point
of the domain in the constrained optimization (201) (in which the objective
$J_{\widehat{\alpha}}(\boldsymbol{\mu})$ is finite505050Here we did not simply
try to apply Slater’s condition to the original constrained optimization
(137), because it would require the existence of some $\omega$ in the relative
interior of the effective domain of
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\lambda})$ (i.e. the domain
on which it takes finite values), which is more subtle in the infinite-
dimensional case. Though for the finite-dimensional case, in our above proof
of the finiteness of $J_{\widehat{\alpha}}$, we did argue that
$G^{*}_{\widehat{\alpha},\nu^{\omega}}(\boldsymbol{\lambda})$ is finite over
all full-support $\omega$, and hence any full-support $\omega$ yields such an
interior point. everywhere), and it satisfies the equality constraint. This
suffices to invoke Slater’s condition to claim that strong duality holds for
that optimization, yielding the desired result without any finite-
dimensionality conditions.515151However, this proof method also still does not
immediately certify dual attainment, despite using Slater’s condition — this
is because when transforming the optimizations we only focused on preserving
the optimal value, rather than other properties such as dual attainment. We
leave a more extensive analysis of such aspects for future work, if it should
become important.

We also highlight that the interior-point requirement stated above should hold
in any practical protocol, because $S_{\Omega}$ would need to contain a
“tolerance interval” for each outcome value
$\bar{c}\hat{c}\in\mathcal{C}_{\mathcal{M}}$. A rigorous formulation of this
claim is as follows. Given that $S_{\Omega}$ is convex, the interior-point
requirement holds whenever the following conditions are fulfilled:

  1. 1.

For every distribution $\mathbf{q}\in S_{\Omega}$, we have
$\operatorname{supp}(\mathbf{q})\subseteq\mathcal{C}_{\mathcal{M}}$.

  2. 2.

There exists some “reference” distribution $\mathbf{q}^{\mathrm{ref}}$ with
$\operatorname{supp}(\mathbf{q}^{\mathrm{ref}})\subseteq\mathcal{C}_{\mathcal{M}}$,
and some $\delta>0$, such that $S_{\Omega}$ contains all distributions
$\mathbf{q}$ with
$|q(\bar{c}\hat{c})-q^{\mathrm{ref}}(\bar{c}\hat{c})|\leq\delta$ for all
$\bar{c}\hat{c}\in\mathcal{C}_{\mathcal{M}}$.

To prove this suffices, simply construct the desired relative interior point
by taking $\mathbf{q}^{\mathrm{ref}}$ and perturbing it if necessary to make
it full-support on $\mathcal{C}_{\mathcal{M}}$; it is straightforward to show
such a perturbation always exists while keeping it in the relative interior of
$S_{\Omega}$ (under the first condition listed above, which ensures the
$\bar{c}\hat{c}\notin\mathcal{C}_{\mathcal{M}}$ terms do not “contribute” to
the affine hull of $S_{\Omega}$). Also, any practical protocol should satisfy
these conditions, because it would need to accept with nontrivial probability
on some honest behaviour — assuming for simplicity that this honest behaviour
is IID (though various non-IID scenarios can also be considered), this
necessarily implies $S_{\Omega}$ must contain all frequency distributions of
the form just described, with $\mathbf{q}^{\mathrm{ref}}$ being the honest
single-round distribution and $\delta$ a small but strictly positive
value.525252There is no need to include any “tolerance interval” for the
$\bar{c}\hat{c}\notin\mathcal{C}_{\mathcal{M}}$ terms, because zero-
probability events (on a finite alphabet) would literally never occur. There
is a technical issue that the supporting alphabets induced by
$\mathcal{M}_{j}$ versus $\mathcal{M}$ might be different in principle, but we
do not expect this situation to arise in practice.

An alternative prospect would be to try proving that $J_{\widehat{\alpha}}$ is
continuous even for infinite-dimensional $\widetilde{Q}$. We believe this
seems to be a plausible property, though proving this claim seems slightly
subtle because in that case $\operatorname{S}_{=}(\widetilde{Q})$ is not
closed, and taking the infimum over such a set does not generically preserve
continuity. A more detailed analysis of the continuity properties of
$J_{\widehat{\alpha}}$ may be able to resolve this point. In the process it
might be able to remove the use of continuity of $\operatorname{\mathtt{Pur}}$
(which is also slightly subtle in the infinite-dimensional case because the
formula (24) does not directly generalize), because in fact we really only
need continuity properties of the “subsequent” quantities
$D\left(\boldsymbol{\mu}_{\oplus\mathbf{0}}\middle\|\boldsymbol{\nu}_{\overline{C}\widehat{C}}^{\omega}\right)$
and
$D_{\widehat{\alpha}}\left(\nu_{SE\widetilde{E}\land\bar{c}\hat{c}}\middle\|\mathbb{I}_{S}\otimes\nu_{E\widetilde{E}\land\hat{c}}\right)$.

##  Appendix C A one-shot chain rule

We thank Ashutosh Marwah for providing us with the proof of this claim. For
our calculations here, we briefly make use of the Petz entropies:

######  Definition 17.

(Petz entropies) For any bipartite state $\rho\in\operatorname{S}_{=}(AB)$,
and $\alpha\in[0,\infty]$, we define the following two Petz conditional
entropies:

$\displaystyle\bar{H}_{\alpha}(A|B)_{\rho}=-\bar{D}_{\alpha}(\rho_{AB}\|\mathbb{I}_{A}\otimes\rho_{B})$
$\displaystyle\bar{H}_{\alpha}^{\uparrow}(A|B)_{\rho}=\sup_{\sigma_{B}\in\operatorname{S}_{=}(B)}-\bar{D}_{\alpha}(\rho_{AB}\|\mathbb{I}_{A}\otimes\sigma_{B}),$
(211)

where $\bar{D}_{\alpha}$ denotes the Petz divergence [Pet86]; see e.g. [Tom16]
for further details. For $\alpha=1$, both the above values coincide and are
equal to the von Neumann entropy.

For classical states, the Petz and sandwiched Rényi divergences coincide and
are equal to the classical Rényi divergences; the same therefore also holds
for the conditional entropies.

######  Lemma 16.

For any $\rho\in\operatorname{S}_{=}(A_{1}A_{2}B)$ and
$\alpha\in[1/2,\infty]$, we have

$\displaystyle H^{\uparrow}_{\alpha}(A_{1}|A_{2}B)_{\rho}$ $\displaystyle\geq
H^{\uparrow}_{\alpha}(A_{1}A_{2}|B)_{\rho}-\bar{H}^{\uparrow}_{0}(A_{2}|B)_{\rho}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(A_{1}A_{2}|B)_{\rho}-H^{\uparrow}_{0}(A_{2}|B)_{\rho}.$
(212)

Consequently, for any $\rho\in\operatorname{S}_{=}(A_{1}A_{2}B_{1}B_{2})$ and
$\alpha\in[1/2,\infty]$, we have

$\displaystyle H^{\uparrow}_{\alpha}(A_{1}|A_{2}B_{1}B_{2})_{\rho}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(A_{1}A_{2}|B_{1}B_{2})_{\rho}-\bar{H}^{\uparrow}_{0}(A_{2}|B_{2})_{\rho}$
$\displaystyle\geq
H^{\uparrow}_{\alpha}(A_{1}A_{2}|B_{1}B_{2})_{\rho}-H^{\uparrow}_{0}(A_{2}|B_{2})_{\rho}.$
(213)

If the registers in the $\bar{H}^{\uparrow}_{0}$ and $H^{\uparrow}_{0}$ terms
are classical, then there is no difference between those versions of the
bounds, since those values are then equal as mentioned above.

###### Proof.

Let $\beta\in[1/2,\infty]$ be such that $1/\alpha+1/\beta=2$, and purify
$\rho$ onto some register $C$. For this analysis we suppose that $\rho$ is
such that $\rho_{A_{1}A_{2}C}$ can be chosen to be full-rank (our claimed
result then holds for rank-deficient states as well, by continuity of Rényi
entropies with respect to the state [MLDS+13] for $\alpha\neq 0$).

Focusing on the registers $A_{1}A_{2}C$, by [MD23, Corollary C.3] we have a
chain rule535353Strictly speaking that chain rule is only stated for
$\beta\in(0,\infty)$, but we can first suppose that $\alpha>1/2$ so that
$\beta<\infty$, then to obtain our desired result we can take the $\alpha\to
1/2$ limit at the end, exploiting continuity of the sandwiched Rényi
divergences with respect to $\alpha$ ([Tom16, Corollary 4.2] together with the
fact that convex functions are continuous on the interior of their domain).
(also implicitly observed in [DFR20, Eq. (44)]):

$\displaystyle H^{\uparrow}_{\beta}(A_{1}A_{2}|C)_{\rho}\geq
H^{\uparrow}_{\beta}(A_{1}|C)_{\rho}+H_{\beta}(A_{2}|A_{1}C)_{\nu},$ (214)

where $\nu$ is a state of the following form (leaving tensor factors of
identity implicit for brevity):

$\displaystyle\nu_{A_{2}A_{1}C}=\nu_{A_{1}C}^{1/2}\rho_{A_{1}C}^{-1/2}\rho_{A_{2}A_{1}C}\rho_{A_{1}C}^{-1/2}\nu_{A_{1}C}^{1/2},$
(215)

for some $\nu_{A_{1}C}\in\operatorname{S}_{=}(A_{1}C)$ (which is full-rank
whenever $\rho_{A_{1}C}$ is full-rank). Importantly, note that this state
satisfies

$\displaystyle H_{\beta}(A_{2}|A_{1}C)_{\nu}\geq
H_{\infty}(A_{2}|A_{1}C)_{\nu}=H_{\infty}(A_{2}|A_{1}C)_{\rho},$ (216)

where the inequality is simply by monotonicity in $\beta$, and the equality
follows from the SDP characterization of $D_{\infty}$ ([Dat09] and [Tom16,
Proposition 4.3]):

$\displaystyle
D_{\infty}(\rho_{A_{2}A_{1}C}\|\mathbb{I}_{A_{2}}\otimes\rho_{A_{1}C})$
$\displaystyle=\inf\left\\{\lambda\;\middle|\;\rho_{A_{2}A_{1}C}\leq
2^{\lambda}\,\mathbb{I}_{A_{2}}\otimes\rho_{A_{1}C}\right\\}$
$\displaystyle=\inf\left\\{\lambda\;\middle|\;\rho_{A_{1}C}^{-1/2}\rho_{A_{2}A_{1}C}\rho_{A_{1}C}^{-1/2}\leq
2^{\lambda}\,\mathbb{I}_{A_{2}}\otimes\mathbb{I}_{A_{1}C}\right\\}$
$\displaystyle=\inf\left\\{\lambda\;\middle|\;\nu_{A_{1}C}^{1/2}\rho_{A_{1}C}^{-1/2}\rho_{A_{2}A_{1}C}\rho_{A_{1}C}^{-1/2}\nu_{A_{1}C}^{1/2}\leq
2^{\lambda}\,\mathbb{I}_{A_{2}}\otimes\nu_{A_{1}C}\right\\}$
$\displaystyle=\inf\left\\{\lambda\;\middle|\;\nu_{A_{2}A_{1}C}\leq
2^{\lambda}\,\mathbb{I}_{A_{2}}\otimes\nu_{A_{1}C}\right\\}$
$\displaystyle=D_{\infty}(\nu_{A_{2}A_{1}C}\|\mathbb{I}_{A_{2}}\otimes\nu_{A_{1}C}),$
(217)

where the second and third lines are obtained by noting that the constraint in
each infimum holds if and only if the constraint in the preceding infimum
holds (because positive-semidefiniteness ordering is preserved by conjugation
with positive semidefinite operators). Therefore we can conclude

$\displaystyle H^{\uparrow}_{\beta}(A_{1}A_{2}|C)_{\rho}\geq
H^{\uparrow}_{\beta}(A_{1}|C)_{\rho}+H_{\infty}(A_{2}|A_{1}C)_{\rho},$ (218)

and by applying the duality relations
$H^{\uparrow}_{\beta}(A_{1}A_{2}|C)_{\rho}=-H^{\uparrow}_{\alpha}(A_{1}A_{2}|B)_{\rho}$,
$H^{\uparrow}_{\beta}(A_{1}|C)_{\rho}=-H^{\uparrow}_{\alpha}(A_{1}|A_{2}B)_{\rho}$
for $H^{\uparrow}_{\alpha}$ [Bei13, MLDS+13] and
$H_{\infty}(A_{2}|A_{1}C)_{\rho}=-\bar{H}^{\uparrow}_{0}(A_{2}|B)_{\rho}$
between sandwiched and Petz entropies [TBH14], the above is equivalent to

$\displaystyle H^{\uparrow}_{\alpha}(A_{1}A_{2}|B)_{\rho}\leq
H^{\uparrow}_{\alpha}(A_{1}|A_{2}B)_{\rho}+\bar{H}^{\uparrow}_{0}(A_{2}|B)_{\rho}.$
(219)

This yields our claimed bounds in (16) (where the second line follows from the
generic relation $H^{\uparrow}_{\alpha}\geq\bar{H}^{\uparrow}_{\alpha}$
between sandwiched and Petz entropies [Tom16, Eq. (4.88)]). To get our claimed
bounds in (16), we simply set $B\coloneqq B_{1}B_{2}$ in the first line of
(16) and apply the data-processing inequality
$\bar{H}^{\uparrow}_{0}(A_{2}|B_{1}B_{2})_{\rho}\leq\bar{H}^{\uparrow}_{0}(A_{2}|B_{2})_{\rho}$
for Petz entropies [Tom16] at $\alpha=0$, then again apply
$H^{\uparrow}_{\alpha}\geq\bar{H}^{\uparrow}_{\alpha}$. (We do not directly
obtain the second line in (16) by data-processing on $H^{\uparrow}_{0}$
because the sandwiched entropies do not satisfy data-processing for
$\alpha<1/2$ [BFT17].) ∎

## References

  * [AFRV19] Rotem Arnon-Friedman, Renato Renner and Thomas Vidick  “Simple and Tight Device-Independent Security Proofs”  In _SIAM Journal on Computing_ 48.1 Society for Industrial & Applied Mathematics (SIAM), 2019, pp. 181–225  DOI: 10.1137/18m1174726
  * [Ari77] S. Arimoto  “Information measures and capacity of order alpha for discrete memoryless channels”  In _Topics in Information Theory_ 17, 1977, pp. 41–52
  * [BBM92] Charles H. Bennett, Gilles Brassard and N. David Mermin  “Quantum cryptography without Bell’s theorem”  In _Physical Review Letters_ 68.5 American Physical Society (APS), 1992, pp. 557–559  DOI: 10.1103/physrevlett.68.557
  * [BCC+10] Mario Berta, Matthias Christandl, Roger Colbeck, Joseph M. Renes and Renato Renner  “The uncertainty principle in the presence of quantum memory”  In _Nature Physics_ 6.9 Springer ScienceBusiness Media LLC, 2010, pp. 659–662  DOI: 10.1038/nphys1734
  * [Bei13] Salman Beigi  “Sandwiched Rényi divergence satisfies data processing inequality”  In _Journal of Mathematical Physics_ 54.12 AIP Publishing, 2013  DOI: 10.1063/1.4838855
  * [BFT17] Mario Berta, Omar Fawzi and Marco Tomamichel  “On variational expressions for quantum relative entropies”  In _Letters in Mathematical Physics_ 107.12 Springer ScienceBusiness Media LLC, 2017, pp. 2239–2265  DOI: 10.1007/s11005-017-0990-7
  * [BGW+23] Stefan Bäuml, Carlos Pascual García, Victoria Wright, Omar Fawzi and Antonio Acín  “Security of discrete-modulated continuous-variable quantum key distribution”  In _arXiv:2303.09255v3 [quant-ph]_ , 2023  URL: https://arxiv.org/abs/2303.09255v3
  * [BV04] Stephen Boyd and Lieven Vandenberghe  “Convex Optimization”  Cambridge University Press, 2004  DOI: 10.1017/CBO9780511804441
  * [CMT23] Enrique Cervero-Martín and Marco Tomamichel  “Device independent security of quantum key distribution from monogamy-of-entanglement games”  In _arXiv:2312.04079v1 [quant-ph]_ , 2023  URL: https://arxiv.org/abs/2312.04079v1
  * [Dat09] Nilanjana Datta  “Min- and Max-Relative Entropies and a New Entanglement Monotone”  In _IEEE Transactions on Information Theory_ 55.6, 2009, pp. 2816–2826  DOI: 10.1109/TIT.2009.2018325
  * [DF19] F. Dupuis and O. Fawzi  “Entropy accumulation with improved second-order term”  In _IEEE Transactions on Information Theory_ , 2019, pp. 1–1  DOI: 10.1109/TIT.2019.2929564
  * [DFR20] Frédéric Dupuis, Omar Fawzi and Renato Renner  “Entropy Accumulation”  In _Communications in Mathematical Physics_ 379.3 Springer ScienceBusiness Media LLC, 2020, pp. 867–913  DOI: 10.1007/s00220-020-03839-5
  * [Duf78] R. J. Duffin  “Clark’s Theorem on linear programs holds for convex programs”  In _Proceedings of the National Academy of Sciences_ 75.4 Proceedings of the National Academy of Sciences, 1978, pp. 1624–1626  DOI: 10.1073/pnas.75.4.1624
  * [Dup15] Frédéric Dupuis  “Chain rules for quantum Rényi entropies”  In _Journal of Mathematical Physics_ 56.2 AIP Publishing, 2015, pp. 022203  DOI: 10.1063/1.4907981
  * [Dup21] Frédéric Dupuis  “Privacy amplification and decoupling without smoothing”  In _arXiv:2105.05342v1 [quant-ph]_ , 2021  URL: https://arxiv.org/abs/2105.05342v1
  * [FL12] Agnes Ferenczi and Norbert Lütkenhaus  “Symmetries in quantum key distribution and the connection between optimal attacks and optimal cloning”  In _Physical Review A_ 85.5 American Physical Society (APS), 2012  DOI: 10.1103/physreva.85.052310
  * [FL13] Rupert L. Frank and Elliott H. Lieb  “Monotonicity of a relative Rényi entropy”  In _Journal of Mathematical Physics_ 54.12 AIP Publishing, 2013  DOI: 10.1063/1.4838835
  * [GLH+22] Ian George, Jie Lin, Thomas Himbeeck, Kun Fang and Norbert Lütkenhaus  “Finite-Key Analysis of Quantum Key Distribution with Characterized Devices Using Entropy Accumulation”  In _arXiv:2203.06554v1 [quant-ph]_ , 2022  URL: https://arxiv.org/abs/2203.06554v1
  * [HB24] Thomas Himbeeck and Peter Brown  “Tight and general finite-size security of quantum key distribution” In preparation., 2024
  * [HT24] Thomas Hahn and Ernest Y.-Z. Tan In preparation., 2024
  * [JK21] Rahul Jain and Srijita Kundu  “A direct product theorem for quantum communication complexity with applications to device-independent cryptography”  In _arXiv:2106.04299v3 [quant-ph]_ , 2021  URL: https://arxiv.org/abs/2106.04299v3
  * [JK22] Rahul Jain and Srijita Kundu  “A direct product theorem for quantum communication complexity with applications to device-independent QKD”  In _2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS)_ IEEE, 2022  DOI: 10.1109/focs52979.2021.00125
  * [JMS20] Rahul Jain, Carl A. Miller and Yaoyun Shi  “Parallel Device-Independent Quantum Key Distribution”  In _IEEE Transactions on Information Theory_ 66.9 Institute of ElectricalElectronics Engineers (IEEE), 2020, pp. 5567–5584  DOI: 10.1109/tit.2020.2986740
  * [KAG+24] Lars Kamin, Amir Arqand, Ian George, Norbert Lütkenhaus and Ernest Y.-Z. Tan In preparation., 2024
  * [KW20] Sumeet Khatri and Mark M. Wilde  “Principles of Quantum Communication Theory: A Modern Approach”  In _arXiv:2011.04672 [quant-ph]_ , 2020  DOI: 10.48550/arXiv.2011.04672
  * [LLR+21] Wen-Zhao Liu, Ming-Han Li, Sammy Ragy, Si-Ran Zhao, Bing Bai, Yang Liu, Peter J. Brown, Jun Zhang, Roger Colbeck, Jingyun Fan, Qiang Zhang and Jian-Wei Pan  “Device-independent randomness expansion against quantum side information”  In _Nature Physics_ 17.4 Springer ScienceBusiness Media LLC, 2021, pp. 448–451  DOI: 10.1038/s41567-020-01147-2
  * [MD23] Ashutosh Marwah and Frédéric Dupuis  “Smooth min-entropy lower bounds for approximation chains”  In _arXiv:2308.11736v2 [quant-ph]_ , 2023  URL: https://arxiv.org/abs/2308.11736v2
  * [MDR+19] G. Murta, S. B. Dam, J. Ribeiro, R. Hanson and S. Wehner  “Towards a realization of device-independent quantum key distribution”  In _Quantum Science and Technology_ 4.3 IOP Publishing, 2019, pp. 035011  DOI: 10.1088/2058-9565/ab2819
  * [MFS+22] Tony Metger, Omar Fawzi, David Sutter and Renato Renner  “Generalised entropy accumulation”  In _2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS)_ , 2022, pp. 844–850  DOI: 10.1109/FOCS54457.2022.00085
  * [MFS+22a] Tony Metger, Omar Fawzi, David Sutter and Renato Renner  “Generalised entropy accumulation”  In _arXiv:2203.04989v2 [quant-ph]_ , 2022  URL: https://arxiv.org/abs/2203.04989v2
  * [MLDS+13] Martin Müller-Lennert, Frédéric Dupuis, Oleg Szehr, Serge Fehr and Marco Tomamichel  “On quantum Rényi entropies: A new generalization and some properties”  In _Journal of Mathematical Physics_ 54.12 AIP Publishing, 2013  DOI: 10.1063/1.4838856
  * [MO14] Milán Mosonyi and Tomohiro Ogawa  “Quantum Hypothesis Testing and the Operational Interpretation of the Quantum Rényi Relative Entropies”  In _Communications in Mathematical Physics_ 334.3 Springer ScienceBusiness Media LLC, 2014, pp. 1617–1648  DOI: 10.1007/s00220-014-2248-x
  * [MPA11] Lluís Masanes, Stefano Pironio and Antonio Acín  “Secure device-independent quantum key distribution with causally independent measurement devices”  In _Nature Communications_ 2.1 Springer ScienceBusiness Media LLC, 2011  DOI: 10.1038/ncomms1244
  * [MR23] Tony Metger and Renato Renner  “Security of quantum key distribution from generalised entropy accumulation”  In _Nat. Commun._ 14.5272 Nature Publishing Group, 2023, pp. 1–13  DOI: 10.1038/s41467-023-40920-8
  * [NDN+22] D. P. Nadlinger, P. Drmota, B. C. Nichol, G. Araneda, D. Main, R. Srinivas, D. M. Lucas, C. J. Ballance, K. Ivanov, E. Y.-Z. Tan, P. Sekatski, R. L. Urbanke, R. Renner, N. Sangouard and J.-D. Bancal  “Experimental quantum key distribution certified by Bell's theorem”  In _Nature_ 607.7920 Springer ScienceBusiness Media LLC, 2022, pp. 682–686  DOI: 10.1038/s41586-022-04941-5
  * [PAM+10] S. Pironio, A. Acín, S. Massar, A. Boyer Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning and C. Monroe  “Random numbers certified by Bell’s theorem”  In _Nature_ 464.7291 Springer ScienceBusiness Media LLC, 2010, pp. 1021–1024  DOI: 10.1038/nature09008
  * [Pet86] Dénes Petz  “Quasi-entropies for finite quantum systems”  In _Reports on Mathematical Physics_ 23.1 Elsevier BV, 1986, pp. 57–65  DOI: 10.1016/0034-4877(86)90067-4
  * [PM13] Stefano Pironio and Serge Massar  “Security of practical private randomness generation”  In _Physical Review A_ 87 American Physical Society, 2013, pp. 012336  DOI: 10.1103/PhysRevA.87.012336
  * [PR21] Christopher Portmann and Renato Renner  “Security in Quantum Cryptography”  In _arXiv:2102.00021v2 [quant-ph]_ , 2021  URL: https://arxiv.org/abs/2102.00021v2
  * [Ren05] Renato Renner  “Security of Quantum Key Distribution”, 2005  DOI: 10.3929/ethz-a-005115027
  * [RGK05] Renato Renner, Nicolas Gisin and Barbara Kraus  “Information-theoretic security proof for quantum-key-distribution protocols”  In _Physical Review A_ 72 American Physical Society, 2005, pp. 012332  DOI: 10.1103/PhysRevA.72.012332
  * [TBH14] Marco Tomamichel, Mario Berta and Masahito Hayashi  “Relating different quantum generalizations of the conditional Rényi entropy”  In _Journal of Mathematical Physics_ 55.8 AIP Publishing, 2014  DOI: 10.1063/1.4892761
  * [TL17] Marco Tomamichel and Anthony Leverrier  “A largely self-contained and complete security proof for quantum key distribution”  In _Quantum_ 1 Verein zur Förderung des Open Access Publizierens in den Quantenwissenschaften, 2017, pp. 14  DOI: 10.22331/q-2017-07-14-14
  * [Tom16] Marco Tomamichel  “Quantum Information Processing with Finite Resources”  Springer International Publishing, 2016  DOI: 10.1007/978-3-319-21891-5
  * [TSB+22] Ernest Y.-Z. Tan, Pavel Sekatski, Jean-Daniel Bancal, René Schwonnek, Renato Renner, Nicolas Sangouard and Charles C.-W. Lim  “Improved DIQKD protocols with finite-size analysis”  In _Quantum_ 6 Verein zur Förderung des Open Access Publizierens in den Quantenwissenschaften, 2022, pp. 880  DOI: 10.22331/q-2022-12-22-880
  * [Vid17] Thomas Vidick  “Parallel DIQKD from parallel repetition”  In _arXiv:1703.08508 [quant-ph]_ , 2017  URL: https://arxiv.org/abs/1703.08508
  * [WLC18] A. Winick, N. Lütkenhaus and P. J. Coles  “Reliable numerical key rates for quantum key distribution”  In _Quantum_ 2, 2018, pp. 77  DOI: 10.22331/q-2018-07-26-77
  * [ZFK20] Yanbao Zhang, Honghao Fu and Emanuel Knill  “Efficient randomness certification by quantum probability estimation”  In _Physical Review Research_ 2 American Physical Society, 2020, pp. 013016  DOI: 10.1103/PhysRevResearch.2.013016