% An exposition-friendly rewrite of the original paper.
% Target audience: an intelligent high school student willing to work through
% density-matrix linear algebra for the first time.
hypersetup{pdftitle={Entanglement with zero distillable secret key in local dimension ten},pdfauthor={OpenAI}}
newcommand{Mat}[1]{M_{#1}(C)}
# Entanglement with zero distillable secret key in local dimension ten
maketitle
Abstract:
We construct an entangled density operator (rho) on (C^{10} ⊗ C^{10})
whose range contains no nonzero product vector and whose distillable
secret key is zero. More precisely: for every integer (nge1) and every
admitted protocol on (rho^{ ⊗ n}), the unhalved trace-norm distance
from any completed bit output to an ideal secret bit (with arbitrary
eavesdropper state) is at least (1/5). The construction disproves the
unrestricted two-map PPT-composition conjecture of Christandl,
M"uller-Hermes, and Wolf. A separate trace-preserving PPT channel on
(Mat{21}) has a square that is not entanglement breaking.
# What we prove, and why it is surprising
Fix two finite-dimensional complex Hilbert spaces (C^a) and (C^b).
A density operator (rho) on (C^a ⊗ C^b) is a positive
semidefinite matrix of trace one. It is separable if it is a
finite convex combination of positive product matrices, and
entangled otherwise.
We consider two-party protocols with one-dimensional quantum
instruments, private ancillas, private randomness, and authenticated
two-way classical communication. The input is the only shared private
resource. An eavesdropper Eve starts with a purification of the input and
sees the complete public transcript. Distillable secret key
(K_D(rho)) is defined as the supremum of bits-per-copy rates that
these protocols can extract, with zero asymptotically vanishing error.
Section~sec:transcript gives the precise operational model.
The sentence we are trying to falsify has been current since
2005~[cite]:
Every entangled state has positive distillable secret key.
The paper produces an explicit counterexample.
[Entangled state with zero secret key]
There is an explicitly specified entangled density operator (rho) on
(C^{10} ⊗ C^{10}) whose range contains no nonzero product vector
and for which (K_D(rho)=0). More precisely: for every integer (nge1)
and every admitted protocol on (rho^{ ⊗ n}) that produces a
completed bit output (tau_{K_AK_BE'}) with (E') retaining an initial
purification and the full public transcript, we have, for every
eavesdropper state (sigma_{E'}),
norm{
tau_{K_AK_BE'}-frac12sum_{i=0}^1 |i,i>< i,i| ⊗ sigma_{E'}
}_1gefrac15.
Thus the traditional trace distance to an ideal bit is at least (1/10).
The bound (1/5) is uniform in (n), in the number of rounds, in the
protocol itself, and in the eavesdropper's purification. Proposition~%
prop:operational-extensions presents three natural extensions:
conditioning on a positive-probability transcript event, vanishing abort
probabilities, and trace-norm limits of completed actual outputs whose
Eve registers retain the full information.
The state is derived from maps. A linear map (F:Mat atoMat b) is
completely positive (CP) if (id_k ⊗ F) is
positive for every (kge1). It is PPT if both (F) and
(T_bcirc F) are CP, where (T_d(X)=X^{T}) is the (complex-linear)
transpose on (Mat d). A CP map (F) is entanglement breaking
(EB) if applying it to one subsystem of any positive bipartite input
always outputs a separable state. Equivalently, its
Choi matrix is separable~[cite]. Our second main result is a
counterexample to composition.
[Two PPT maps whose composition is not EB]
There are explicitly specified PPT maps
(Phi_1,Phi_2:Mat{10}toMat{10}) such that (Z=J(Phi_2circPhi_1))
is nonzero and its range contains no nonzero product vector. Hence
(Phi_2circPhi_1) is not entanglement breaking.
The maps (Phi_1,Phi_2) come from a (6times4) real integer matrix
pencil (M(x)=x_0M_0+x_1M_1+x_2M_2+x_3M_3). Section~%
sec:certificate constructs them; Section~sec:geometry
proves the tensor-criterion that turns them into Theorem~%
thm:main-pair. Theorem~thm:main-state is then the
corresponding statement for the density operator
(rho=Z/tr Z).
A trace-preserving channel version of the same phenomenon is stated next.
[Trace-preserving PPT channel whose square is not EB]
There is an explicitly specified trace-preserving PPT channel
(Θ:Mat{21}toMat{21}) whose square (ΘcircΘ) is not
entanglement breaking.
The dimension (21) is (2·10+1): the pair from Theorem~%
thm:main-pair is embedded, rescaled, and completed by an absorbing
flag, following Christandl--M"uller-Hermes--Wolf~[cite] and
Filippov~[cite]. Section~sec:applications presents the
details.
# Foundations: maps, PPT, and the represented class
All matrix algebras are finite-dimensional over (C), with fixed
orthonormal bases and product bases. We write (X^*) for conjugate
transpose, (overlineoverline XX) for entrywise conjugation,
(T_d(X)=X^{T}) for the complex-linear transpose on (Mat d). For a
linear map (F), its Hilbert--Schmidt adjoint (F^dagger) satisfies
(tr(Y^*F(X))=tr((F^dagger(Y))^*X)). If (V) is a matrix, we write
(Ad_V(X)=VXV^*).
Our Choi matrix convention is
J(F)=sum_{i,j=1}^a E_{ij} ⊗ F(E_{ij})
=(id_a ⊗ F)(Ω_aΩ_a^*),
Ω_a=sum_{i=1}^a e_i ⊗ e_i.
So (norm{Ω_a}^2=a), and the first tensor factor is the input
reference. This fixes every dimensional factor in the transfer formula
and in every channel corollary. It is the map--operator correspondence
of Jamiol{}kowski and Choi~[cite].
[PPT stability]
Let (F:Mat atoMat b) be CP. Then (F^dagger) and
(T_bcirc Fcirc T_a) are CP. Moreover
[
Fcirc T_a is CPiff T_bcirc F is CP.
]
If (F) is PPT, so are (T_bcirc F), (Fcirc T_a), its adjoint,
(T_bcirc Fcirc T_a), and (F^sharp:=T_acirc F^daggercirc T_b).
Tensor products of PPT maps are PPT. If (P:Mat{a'}toMat a) and
(Q:Mat btoMat{b'}) are CP, then (Qcirc Fcirc P) is PPT whenever
(F) is PPT.
Proof.
Write (F(X)=sum_r A_r X A_r^*) with Kraus matrices
(A_rinC^{btimes a}). Then
(F^dagger(Y)=sum_r A_r^*YA_r) and
((T_bcirc Fcirc T_a)(X)=sum_r A_rbarXA_rbar^{,*}),
which proves both CP assertions. Applying the simultaneous-transpose
statement to (Fcirc T_a) or (T_bcirc F) gives the equivalence.
These arguments all work with rectangular Kraus matrices.
Transpose is Hilbert--Schmidt self-adjoint, so when (F) is PPT the
identities (T_acirc F^dagger=(Fcirc T_a)^dagger) and
(F^daggercirc T_b=(T_bcirc F)^dagger) are CP. That proves PPT for
the adjoint; simultaneous transposition gives the simultaneous
transpose and the transpose-adjoint. The output transpose of
(T_bcirc F) is (F), and of (Fcirc T_a) is
(T_bcirc Fcirc T_a): both CP by hypothesis. Finally
(T_{b'}circ Qcirc Fcirc P
=(T_{b'}circ Qcirc T_b)circ(T_bcirc F)circ P) is a composition of
CP maps; the untransposed composite (Qcirc Fcirc P) is CP too.
Products follow from (T_{b_1b_2}=T_{b_1} ⊗ T_{b_2}).
[Choi characterization of CP and of EB]
A linear map (F:Mat atoMat b) is CP iff (J(F)succeq0). For a CP
map, the following are equivalent:
(J(F)) is separable;
for every (kge1) and (Wsucceq0) in (Mat k ⊗ Mat a),
((id_k ⊗ F)(W)) is separable.
Also (J(T_bcirc F)=(id_a ⊗ T_b)J(F)) and
(J(Fcirc T_a)=(T_a ⊗ id_b)J(F)).
Proof.
The forward CP implication is immediate from (eq:choi-definition).
Conversely, write (J(F)=sum_r v_rv_r^*); each (v_r) has a unique
(A_rinC^{btimes a}) with (v_r=(I_a ⊗ A_r)Ω_a). Comparing
the ((i,j)) block gives (F(E_{ij})=sum_r A_rE_{ij}A_r^*), hence the
Kraus representation. This is Choi's criterion~[cite].
If (J(F)) is separable, spectral decompositions of its positive
factors express it as (sum_r a_ra_r^* ⊗ b_rb_r^*), and blockwise
comparison gives the measure-and-prepare formula
(F(X)=sum_rtr[(a_ra_r^*)^{T}X],b_rb_r^*). With
(E_r=(a_ra_r^*)^{T}succeq0), for (Wsucceq0)
[
tr_a[(I_k ⊗ E_r)W]
=tr_a[(I_k ⊗ √(E_r))W(I_k ⊗ √(E_r))]succeq0.
]
Therefore ((id_k ⊗ F)(W)) is a sum of positive products
with second factor (b_rb_r^*). The converse follows by testing
(W=Ω_aΩ_a^*). The two transpose identities are immediate
from reindexing matrix units. This is entanglement breaking in the cone
sense~cite[Theorem 4]{HSR2003}.
[Nonseparability from range]
Every nonzero separable positive matrix has a nonzero product vector in
its range. Consequently, a nonzero positive matrix whose range contains
no nonzero product vector is nonseparable.
Proof.
Refine a separable decomposition by spectral decompositions of its
positive factors. It becomes (Z=sum_r v_rv_r^*) with each (v_r)
a product vector (a_r ⊗ b_r). Since
(ker Z=∩_r v_r^perp), every (v_r) lies in
((ker Z)^perp=ran Z). If (Zne0), at least one (v_r) is
nonzero. This is the range criterion of Horodecki~[cite].
[The represented class (C]
A density operator (omega) on (C^a ⊗ C^b) belongs to
(C if there exist positive integers (r,s), a vector
(chiinC^r ⊗ C^s), and linear maps
(L:calL:Mat rtoMat a), (M:calM:Mat stoMat b) such
that
omega=(L ⊗ M)(*),
L, L T_r, M, M T_s
are CP.
Only (omega) is normalized. The vector (chi) may be unnormalized
and the maps may not preserve trace.
This is a representation property, not a physical claim. Lemma~%
lem:ppt-stability shows that (L,M are also
PPT in the output-transpose convention. In particular (omega) itself
has positive partial transpose, since
((T_a ⊗ id_b)(omega)
=((T_acircL) ⊗ M)(*)succeq0).
[Closure under tensor products]
(C is closed under finite tensor products (after grouping
all first-party systems and all second-party systems). In particular
(omega^{ ⊗ n}inC for every (omegainC
and (nge1).
Proof.
Tensor the representing vectors and local maps separately. Tensor
products of CP maps are CP and input transpose in the grouped product
basis is the tensor product of the individual input transposes. The
required four CP conditions are preserved. The output is
(omega^{ ⊗ n}) (trace one). Local permutation unitaries and
their conjugates are CP pre- and post-compositions and preserve
everything.
[Choi transfer]
Let (F:Mat atoMat b) and (G:Mat btoMat c) be CP maps and set
(F^sharp=T_acirc F^daggercirc T_b). Then
J(Gcirc F)=(F^sharp ⊗ G)(Ω_bΩ_b^*).
If (F,G) are PPT and (Z:=J(Gcirc F)ne0), then (lambda:=tr Z>0)
and
(Z)/(lambda)=(F^sharp ⊗ G)
((Ω_bΩ_b^*)/(lambda))inC
on (C^a ⊗ C^c).
Proof.
If (A_r) and (B_s) are Kraus matrices for (F) and (G), then
(F^sharp(Y)=sum_r A_r^{T}YA_rbar=sum_r A_r^{T}Y(A_r^{T})^*),
so the Kraus matrices of (F^sharp) are the transposes (A_r^{T}).
For each pair, direct expansion gives
((A_r^{T} ⊗ B_s)Ω_b=(I_a ⊗ B_sA_r)Ω_a).
Summing the corresponding rank-one outer products gives
(eq:choi-transfer).
Now suppose (F,G) are PPT. Besides (F^sharp) and (G) CP, Lemma~%
lem:ppt-stability gives (F^sharpcirc T_b=T_acirc F^dagger
=(Fcirc T_a)^dagger) CP and (Gcirc T_b) CP, which are exactly
the input-transpose conditions in (eq:represented-class). Finally
(Z=sum_{r,s}|(I_a ⊗ B_sA_r)Ω_a><(I_a ⊗ B_sA_r)Ω_a|)
and (lambda=sum_{r,s}norm{B_sA_r}_F^2). Since (Zne0),
(lambda>0), and (chi=Ω_b/sqrtlambda) proves
(eq:choi-transfer-normalized). Its squared norm is (b/lambda),
which is allowed.
# A four-effect coherence inequality
The first step of the operational obstruction is a purely algebraic
inequality about any state in (C and four arbitrary positive
local matrices. It compares the "coherence" between two equal-bit
branches with the weights of branches in which the bits disagree. No
pointwise normalization is assumed: later the matrices will be densities
at a fixed public transcript, where pointwise normalization is not
required.
[Positive block estimate]
Let (H) and (J) be square matrices of possibly different sizes and
(Z) have corresponding rectangular size. If
(H&Z Z^*&Jsucceq0), then
(norm{Z}_1le√(tr H,tr J)). This holds also for singular
(H,J).
Proof.
Spectral decomposition of the positive block matrix writes it as a finite
sum of outer products of block columns (binom{a_k}{b_k}). So
(H=sum_k a_ka_k^*), (J=sum_k b_kb_k^*), (Z=sum_k a_kb_k^*).
Since a rank-one (ab^*) has trace norm (norm{a}norm{b}), triangle
and C-S give
(norm{Z}_1lesum_knorm{a_k}norm{b_k}
le(sum_knorm{a_k}^2)^{1/2}(sum_knorm{b_k}^2)^{1/2}
=√(tr H,tr J)).
[Four-effect inequality]
Let (omegainC act on (C^p ⊗ C^q). For arbitrary
(X_0,X_1succeq0) in (Mat p) and (Y_0,Y_1succeq0) in (Mat q),
put (D_{ij}=X_i ⊗ Y_j) and (p_{ij}=tr(D_{ij}omega)), with
(i,jin{0,1}). Then
norm{sqrt{D_{00}},omegasqrt{D_{11}}}_1
lesqrt{p_{00}p_{01}}+sqrt{p_{10}p_{11}}+2sqrt{p_{01}p_{10}}.
No normalization is assumed.
Proof. [Strategy]
Represent (omega=(L ⊗ M)(*)) with
(L,M input-transpose CP. Pull the (X_i,Y_j) back
by adjoints to positive matrices on the input spaces. A congruence
regularizes the two pullback pairs so they commute with sum equal to a
projection. Then a direct block bound and a reverse block bound (via
the input transpose) sandwich the off-diagonal term. Splitting the input
vector according to which of the two commuting effects is larger, the
off-diagonal contributions obey a spectral weighting that gives the four
terms on the RHS.
Proof.
Fix a representation
(omega=(L ⊗ M)(*)) with
(L T_r), (M T_s) CP. Pull back:
(A_i=L^ r),
(B_j=M^ s). These are positive.
Normalization on the support.:
Let (H=A_0+A_1) and (Pi) be the orthogonal projection onto
(ran H). If (ainker H), then (a^*A_i a=norm{√(A_i)a}^2)
sums to zero over (i), so (A_i) kills (ker H) and
(A_i=Pi A_iPi). Let (S) be (H^{-1/2}) on (ran H) and the
identity on (ker H). Then the (A_i'=S^*A_iS) are positive, supported
on (Pi), and satisfy (A_0'+A_1'=Pi), so they commute.
This congruence is achievable inside the representation without changing
(omega): with (Ad_S(U)=SUS^*), replace
(L by (L and (chi) by
((S^{-1} ⊗ I_s)chi). The output (omega) is unchanged, the
pullbacks become (A_i'), the map is still CP, and
(L'calL'circ T_r=(L T_r)circAd_{overlineoverline S}S) is
CP. Suppress the primes.
Two block estimates.:
Let (C=L ⊗ M For vectors
(u,zinC^r ⊗ C^s) put
(p_{ij}(u)=u^*(A_i ⊗ B_j)u) and
(Z(u,z)=sqrt{D_{00}},C(uz^*)sqrt{D_{11}}). CP of (C) applied to
the rank-one (binom{u}{z}binom{u}{z}^*) gives a positive block.
Conjugating by (diag(sqrt{D_{00}},sqrt{D_{11}})) and
applying Lemma~lem:positive-block yields
norm{Z(u,z)}_1lesqrt{p_{00}(u)p_{11}(z)}.
For the reverse estimate, the global input transpose
(T_{rs}=T_r ⊗ T_s) makes (Ccirc T_{rs}) CP. Apply the same
block argument to this map on the ordered pair ((overlineoverline z,z,overlineoverline u)u))
and the same output filters. Since
((overlineoverline zz,overlineoverline u^*)^u^*)^T=uz^*),
((overlineoverline zz,overlineoverline z^*)^z^*)^T=zz^*), and
((overlineoverline uu,overlineoverline u^*)^u^*)^T=uu^*), the off-diagonal output is
unchanged but the two diagonal weights swap:
norm{Z(u,z)}_1lesqrt{p_{00}(z)p_{11}(u)}.
It is the transpose on both input factors that supplies this reverse
estimate.
Splitting the input vector.:
Choose a common eigenbasis of the commuting (A_0,A_1). Let (P) project
onto the eigenvectors where the (A_0)-eigenvalue is at least the
(A_1)-eigenvalue, and set (v=(P ⊗ I_s)chi),
(w=((I_r-P) ⊗ I_s)chi). Since (PA_i(I_r-P)=0), cross terms in
the (p_{ij}) vanish:
p_{ij}=p_{ij}(v)+p_{ij}(w),
p_{11}(v)le p_{01}(v), p_{00}(w)le p_{10}(w).
The first comparison follows because (A_0-A_1succeq0) on (ran P),
so its tensor with (B_1) has nonnegative quadratic form on (v); the
second follows similarly on (ker P) with (B_0).
Assembling four terms.:
Diagonal terms: (eq:direct-block-bound) with (eq:spectral-weights)
gives
[
norm{Z(v,v)}_1lesqrt{p_{00}(v)p_{11}(v)}lesqrt{p_{00}p_{01}},
norm{Z(w,w)}_1lesqrt{p_{00}(w)p_{11}(w)}lesqrt{p_{10}p_{11}}.
]
Off-diagonal: (Z(v,w)) is bounded by (eq:reversed-block-bound) and
(Z(w,v)) by (eq:direct-block-bound), and both right sides become
(sqrt{p_{10}p_{01}}). Finally
(sqrt{D_{00}}omegasqrt{D_{11}}
=Z(v,v)+Z(v,w)+Z(w,v)+Z(w,w)), so the triangle inequality gives
(eq:coherence).
By Lemma~lem:tensor-closure this applies to arbitrary joint
positive matrices on all of Alice's and all of Bob's copies of a state in
(C Its lack of normalization is exactly what lets us apply it
at each complete public transcript.
# Complete public transcripts
At each public transcript, a protocol induces the same two pairs of
positive local matrices on Alice's and Bob's input spaces, for all four
possible bit values. These matrices are not just the final measurements;
they are the aggregated effects of the whole protocol on its input. This
section proves that this factorization holds at measurable transcripts
of the admitted protocol model, using a probe experiment that turns
classical independence conditional on the transcript into matrix-valued
product structure.
## Finite-record case
Let (R) be the input state on (C^a ⊗ C^b).
In fixed product bases, Eve's canonical purification is
|Psi_R>=sum_h sqrt R,|h>_{AB}|h>_E,
Econg A ⊗ B.
Suppose the protocol is finite (only finitely many steps, all classical
records finite) and produces bits (i,jin{0,1}) almost surely on
(R). At a fixed complete transcript (t), Alice's instrument branches
consistent with (t) and final bit (i) compose into a CP map
(A_i^t on her input; Bob's into (B_j^t on his.
Because the compatible private histories sum independently inside each
laboratory (the other party's unannounced outcomes cannot affect what a
laboratory does), the joint branch is
(A_i^t ⊗ B_j^t Public-source weights are
scalars fixed by (t); absorb the product into either local map.
Set (X_i(t)=(A_i^t)^ and
(Y_j(t)=(B_j^t)^ These are positive matrices, and
the effect at branch ((i,j)) is (D_{ij}(t)=X_i(t) ⊗ Y_j(t)).
Tracing out the private memories leaves Eve with the density
[
tau_{ij}(t)=(sqrt R,D_{ij}(t)sqrt R)^T,
]
where the transpose is in the product basis identifying (E) with
(A ⊗ B). The same (X_0,X_1) and (Y_0,Y_1) work for all four
branches. Private instrument labels are summed, not transmitted to Eve.
No pointwise normalization is required at a fixed (t).
## Admitted protocol model
The general statement replaces the preceding matrices by densities with
respect to a single transcript measure, and covers continuous transcript
spaces and infinite public schedules. The proof runs the protocol on a
product of two local probes with untouched references, uses conditional
independence of the two local histories given the transcript, and then
transfers to the actual input via a filter on the references.
[Admitted local protocols]
(A,B) are finite-dimensional complex input spaces. An admitted protocol
consists of local quantum instruments, local memories and randomness, and
authenticated two-way public classical communication. Data and joint
laws satisfy:
Initial resources. A recorded standard Borel public variable
(C_0), possibly constant, with a law fixed once the protocol is chosen.
It is independent of the input plus any purifying or untouched reference.
Conditional on (C_0), the joint state of input-reference and the two
initial private auxiliaries factors position by position: input-reference
state times one local resource per laboratory. Shared initial randomness
is included in (C_0). No preshared secret key.
Local instruments. Each instrument assigns CP operations to
measurable outcome sets, countably additively on states, with measurable
outcome laws and measurable conditional local updates, and total
operation trace-preserving. Outcome space is standard Borel. Instruments
may depend measurably on local private history and preceding public
record.
Local aggregation and chronological history. A local subroutine
completed before a later public step may be aggregated into one
instrument that retains its continuing memory. Public communication stays
in the public schedule. Genuine classical history, including private
outcomes and public records, is a finite sequence or an
(N-indexed sequence in standard Borel coordinate spaces. Local
choices use only that laboratory's preceding private history and the
preceding public record; anything affecting the other party is
communicated through a public step.
Public steps and the complete record. Public discussion is
correspondingly finite or (N-indexed. Each message is
produced by its sender's local process from that sender's private
history and the preceding public record. A later public-source draw
uses a measurable probability kernel (kappa_m(t,dc)) depending only on
the preceding public record and identical for every input; the draw
multiplies by the scalar kernel and acts as the identity on quantum
registers. Public choices of speaker and stopping decisions use these
same two rules. (T) records (C_0), all public messages, draws, speaker
choices, and stopping decisions. Private outcomes and quantum memories
stay home.
Reference-compatible prefix laws. The specified instruments act
on arbitrary positive trace-class inputs. Unnormalized branch laws give
countably additive positive matrix-valued measures on any untouched
finite-dimensional reference for finite prefixes. Integrating the next
record recovers the preceding reference measure after tracing out the
current laboratory memories.
Terminal outputs. A terminal classical output may be a measurable
function of that laboratory's instrument history and received (T). A
terminal quantum readout is supplied with its incoming memory (via one
fixed measurable local CP process on those histories) and a selected
local instrument on that memory, selected using only that laboratory's
private history and (T). Together with the schedule, these give one
countably additive unnormalized instrument law on the complete history
and terminal outcomes for all inputs and finite untouched references.
Each terminal readout includes a tag for missing or non-invoked. Summing
either laboratory's terminal outcomes removes that local refinement;
summing both and tracing memory recovers the reference measure on the
complete history.
Completion on a specified input. A completed bit-output protocol
on a specified input has a bit in each laboratory almost surely on that
input, with normalized joint output. More generally a completed
key-output protocol produces a bit in a specified finite classical
alphabet per party.
For finite protocols of the specified type, composing the given
instruments supplies prefix laws and any finite terminal refinement.
The separate complete-history and terminal-process requirements matter
for countable schedules and for aggregated subroutines. No uniform bound
on communication, message size, or round count is imposed. A terminal
classical bit can depend on an entire infinite record.
## Common factors at a complete transcript
[Common local factors at a transcript]
Let (R) be a density operator on (A ⊗ B), and let an admitted
protocol produce bits (i,jin{0,1}) almost surely on (R). Give Eve
the canonical purification~(eq:canonical-purification) and let her
retain (E) and the complete transcript (T) with values in a standard
Borel space. Then there exist a finite positive measure (mu) on the
transcript space and measurable positive matrices (X_0(t),X_1(t)inMat a)
encoding Alice's side and (Y_0(t),Y_1(t)inMat b) encoding Bob's side,
such that the positive matrix-valued measure of Eve in branch ((i,j))
has density
tau_{ij}(t)=(sqrt R,[X_i(t) ⊗ Y_j(t)]sqrt R)^T
quadwith respect to mu,
the same (X_i,Y_j) work for all four branches outside one
(mu)-null set, and
(sum_{i,j}inttrtau_{ij}(t),dmu(t)=1).
Proof. [Strategy]
Run the protocol on a product of normalized maximally entangled local
probes with untouched references. On this input the local sampling tapes
are conditionally independent given the transcript. Informationally
complete POVM tests on the untouched references turn the scalar
independence into matrix product structure. A filter on the references
prepares the canonical purification and pushes the product structure
through to the actual input.
Proof.
Set (a=dim A), (b=dim B), and attach untouched references
(A_0cong A) and (B_0cong B). Run the protocol on the product of the
normalized local probes
|Phi_a>_{AA_0} ⊗ |Phi_b>_{BB_0},
|Phi_a>=a^{-1/2}sum_{r=1}^a |r,r>,
|Phi_b>=b^{-1/2}sum_{s=1}^b |s,s>.
Assign bit zero in a laboratory if its prescribed bit is never produced,
retaining bits already produced. This is a measurable local default rule;
we remove its contribution after recovering the actual input.
Conditional independence of local tapes.:
Take a finite informationally complete POVM on each reference (basis
projections, and ((|r>+|s>)/sqrt2) and
((|r>+i|s>)/sqrt2) rank-one projections, normalized into
a POVM). These tests commute with all laboratory operations because the
references are untouched.
In this tested product-probe experiment, sample (C_0) with its fixed
law, then conditional on (C_0) simulate the whole run using independent
local random tapes (U) (Alice) and (V) (Bob), plus fresh public
uniform random variables for public-source draws.
At each local instrument, sample the conditional outcome law from a fresh
uniform variable on the appropriate tape, and apply the stipulated
conditional update. Only the recorded public-source draw enters the
transcript. Induction over finite prefixes gives the genuine joint
finite-prefix laws. Standard-Borel kernel sampling is standard
cite[App.~A1, Thm.~A1.2, Lemma 3.22]{Kallenberg2002}.
Each defaulted bit and each reference POVM outcome is a measurable
function of one local tape and (T). Let (F_m=
A step sent by Alice makes the new record measurable with respect to
(sigma(U)veeF_m; Bob's symmetric. A public-source step
has the sampling kernel as its regular conditional law. Induction shows
(Uperp VmidF_m for every (m), and passing to
(F_∞=calF_∞=sigma(T)) in (L^1) gives
(E[u(U)v(V)bbE[u(U)v(V)mid T]=E[u(U)bbE[u(U)mid T]E[v(V)bbE[v(V)mid T]).
Using regular conditional probability kernels on the standard Borel
tape and transcript spaces~cite[Thm.~6.3--6.4]{Kallenberg2002} and
testing against countable generating algebras, we get
(P_{U,Vmid T=t}=P_{Umid T=t} ⊗ P_{Vmid T=t})
on a single full-measure set of (t). Alice's defaulted bit + reference
POVM outcome is conditionally independent of Bob's, given (t).
Reference densities and product structure.:
Return to the run without performing the reference POVM on the probes.
The fixed initial law and specified finite-prefix instruments give a
positive matrix-valued reference measure at every prefix; summing the
next local outcome recovers it, as does integrating a public-source
outcome. Countable extension in finite dimension
cite[Thm.~6.14]{Kallenberg2002} constructs the complete-history positive
matrix-valued reference measure. Let (W) denote the resulting reference
measure on the history space; when a terminal quantum readout is used,
its instrument refines this to (widehatwidehat WW), agreeing on the preterminal
history.
Push (widehatwidehat WW) forward to the defaulted-bit pair plus transcript.
Call the transport measures (W_{ij}). The probe transcript law
(mu(S)=sum_{i,j}tr W_{ij}(S)) is a probability measure. Squeeze and
Radon--Nikodym give matrix-entry densities (W_{ij}(t)) with
(sum_{i,j}tr W_{ij}(t)=1) for (mu)-a.e. (t), positivity
a.e., and
[
U_i(t)=sum_jtr_{B_0}W_{ij}(t),
V_j(t)=sum_itr_{A_0}W_{ij}(t),
sum_itr U_i(t)=sum_jtr V_j(t)=1.
]
The conditional POVM statistics and their factorized form give
[
tr[(E_r ⊗ G_s)W_{ij}(t)]=tr[E_rU_i(t)]tr[G_sV_j(t)]
]
almost everywhere.
Since (E_r ⊗ G_s) span the Hermitian matrices on
(A_0 ⊗ B_0), we conclude
W_{ij}(t)=U_i(t) ⊗ V_j(t)quadfor all (i,j)
and mu-a.e. t.
Recovering the actual purification.:
Identify (A_0 ⊗ B_0) with (E) in the product basis and set
(K=√(ab),(sqrt R)^T). The elementary identity
((I ⊗ S^T)sum_h|h,h>=(S ⊗ I)sum_h|h,h>)
shows that (I_{AB} ⊗ K) maps the product probes
(eq:local-probes) to (|Psi_R>) exactly. The same initial
law and local auxiliaries are used on probes and actual input. On each
finite cylinder of histories the reference matrix for the filtered input
is (K W(,·,)K^*) because the filter on the untouched references
commutes with every local instrument. Every public-source update also
commutes. Uniqueness of finite measures on cylinders extends this to the
full history sigma field; the same commutation holds for any appended
terminal instrument by clause~protocol:terminal.
Let (N) be the event that some prescribed bit is missing before the
default rule. On the actual input (R), clause~protocol:completion
gives (tr[Kwidehatwidehat W(N)K^*]=0W(N)K^*]=0), so (Kwidehatwidehat W(N)K^*=0W(N)K^*=0), so
default bit tags correspond to zero filtered measure on the actual
input. Therefore
[
tau_{ij}(t)=K(U_i(t) ⊗ V_j(t))K^*quadat mu-a.e. t.
]
Expanding,
(K(U_i ⊗ V_j)K^*=ab(sqrt R)^T(U_i ⊗ V_j)(sqrt R)^T
=(sqrt R(aU_i^T ⊗ bV_j^T)sqrt R)^T).
Take (X_i(t)=aU_i(t)^T) and (Y_j(t)=bV_j(t)^T), adjusting on a
null set if necessary. Transposition preserves positivity, giving
(eq:eve-blocks). No inverse of (R) appears.
[Recovery from another purifying space]
Let (R) and (|Psi_R>) be as in Lemma~lem:transcript, and
let (|psi>in A ⊗ B ⊗ widetilde E) be any
purification. There is a channel
(R:calR:T( E)toT(E) mapping
(|psi>) to (|Psi_R>). If Alice and Bob run the same
admitted protocol and Eve retains her purification and full transcript,
(R ⊗ id_T) recovers the canonical output of
Lemma~lem:transcript. Moreover (R maps every ideal
secret-bit law with Eve in (widetilde ET) to one with Eve in (ET).
Proof.
Let (S=⊆ E). Schmidt decomposition gives
an isometry (V:S E) with
(|psi>=(I_{AB} ⊗ V)|Psi_R>).
Choose any density (zeta) on (E) and set
[
R(*xi V+tr[(I_{widetilde E}-VV^*)xi],zeta.
]
Compression is CP; the second term is a positive trace functional times a
fixed state. Trace is preserved, so (R is a channel. Its
first term inverts (V) on the actual purifying support; the second
vanishes there. Local operations keep each conditional purifying state
on (ran V); public-source steps and identity on register (T) do not
disturb this. Recovery is exact in every transcript and bit branch, and
the formula extends to trace-class inputs on larger (widetilde E).
An ideal bit has form
(frac12sum_{i}|i,i>< i,i| ⊗ sigma); conjugating by
(R ⊗ id_T) replaces (sigma) by a normalized
state and keeps the form. Trace-norm contraction transfers any lower
bound from the canonical to the general case.
# Separation from an ideal secret bit
The coherence inequality applies at each transcript. Take
(S = the trace-norm distance from the actual transcript joint
state to the ideal secret-bit transcript joint state. Two forces compete:
correctness forces little mass in unequal-bit branches, and secrecy
forces the equal-bit branches to have matching Eve densities of at least
half mass each. A Cauchy--Schwarz calculation turns these into incompatible
requirements. Below (eta < 1/5) they cannot both hold.
Throughout, the trace norm is unhalved:
(norm{H}_1=tr√(H^*H)). A classical-quantum state is a positive
matrix-valued measure of total trace one. If a Hermitian difference of
such measures has density (H(t)) with respect to a common finite
dominating measure (lambda), then
(norm{H}_1=intnorm{H(t)}_1,dlambda(t)), independent of the
dominating measure by homogeneity.
[Distillable secret key]
Let (omega) be a bipartite state, with Eve initially holding a
purification. A key-distillation sequence uses an admitted protocol of
Definition~def:protocol on each (omega^{ ⊗ n}), allowing
each party to process all its (n) copies jointly. The normalized
classical output at each party is a string of fixed length (ell_n).
Eve's register (E') retains the initial purification and the complete
public transcript. For any normalized state or classical-quantum law
(sigma_{E'}), the ideal length-(ell) key is
[
gamma^{(ell)}_sigma=2^{-ell}sum_{zin{0,1}^ell}
|z,z>< z,z| ⊗ sigma_{E'}.
]
The sequence is secure if there are normalized comparison laws
(sigma_{E'}^{(n)}) with
(norm{tau^{(n)}_{K_AK_BE'}-gamma^{(ell_n)}_{sigma^{(n)}}}_1to0).
Its asymptotic lower rate is (liminf_n ell_n/n). The distillable
secret key (K_D(omega)) is the supremum of these rates over secure
sequences (empty key achieves rate zero).
[Root fidelity and trace norm]
For square complex matrices (A,B) of the same size,
f(A^*A,B^*B):=norm{√(A^*A)√(B^*B)}_1=norm{AB^*}_1.
For positive matrices (H,J) of the same size,
f(H,J)gefrac{tr H+tr J-norm{H-J}_1}{2}.
Also (f(H^T,J^T)=f(H,J)).
Proof.
Extend the partial isometries in the polar decompositions (A=U√(A^*A))
and (B=V√(B^*B)) to unitaries. Then
(AB^*=U√(A^*A)√(B^*B)V^*); unitary invariance of the trace
norm gives (eq:polar-fidelity) (valid also for singular (A,B)).
For (eq:fidelity-lower), put (Z=sqrt H-sqrt J). Then
(H-J=Zsqrt H+sqrt J Z). The spectral sign
(sgn(Z)) is a Hermitian contraction, so trace-norm
duality and cyclicity give
(norm{H-J}_1getr[sgn(Z)(H-J)]=tr[|Z|(sqrt H+sqrt J)]ge tr Z^2),
where the last inequality uses
(<sqrt H+sqrt J>ge|<sqrt H-sqrt J>|
=|z|) in an eigenvector of (Z). Finally
(tr Z^2=tr H+tr J-2tr(sqrt Hsqrt J)) and
(0letr(sqrt Hsqrt J)lenorm{sqrt Hsqrt J}_1=f(H,J)).
The transpose identity follows from functional calculus.
[Uniform obstruction to a secret bit]
Let (omegainC For every integer (nge1), let an
admitted completed protocol on (omega^{ ⊗ n}) produce normalized
bit registers (K_A,K_B), and let its output (tau_{K_AK_BE'})
retain in (E') an initial purification held by Eve and the complete
public transcript. For every normalized (sigma_{E'}),
norm{tau_{K_AK_BE'}-tfrac12sum_{i=0}^1
|i,i>< i,i| ⊗ sigma_{E'}}_1gefrac15.
Thus the traditional trace distance is at least (1/10), and
(K_D(omega)=0) in Definition~def:distillable-key.
Proof.
Group Alice's and Bob's factors, and set (R=omega^{ ⊗ n}). Lemma~%
lem:tensor-closure gives (RinC Apply Eve's classical
readout of the transcript and Lemma~lem:purification-recovery;
trace-norm contraction reduces the claim to the canonical purification and
the full transcript (T).
Apply Lemma~lem:transcript: there exist (mu), positive
(X_i(t),Y_j(t)), and Eve densities (tau_{ij}(t)) of
(eq:eve-blocks). Fix any normalized positive matrix-valued
comparison law (sigma_{ET}). Let (nu(S)=trsigma_{ET}(S)), use
(lambda=mu+nu), and replace each actual density and both (X_i(t))
by their product with (h=dmu/dlambda), leaving (Y_j(t))
unchanged. Equation~(eq:eve-blocks) and all probabilities are
preserved. The ideal law has positive density (sigma(t)) with
(inttrsigma(t),dlambda(t)=1). Now rename (lambda) as (mu).
This common measure keeps singular parts of either law; no support
assumption.
For these common densities set
(D_{ij}(t)=X_i(t) ⊗ Y_j(t)),
(p_{ij}(t)=trtau_{ij}(t)=tr[D_{ij}(t)R]),
(P_{ij}=int p_{ij}(t),dmu(t)). All (P_{ij}ge0) and
(sum_{i,j}P_{ij}=1). With (A=sqrt{D_{00}}sqrt R) and
(B=sqrt{D_{11}}sqrt R), transpose invariance and
(eq:polar-fidelity) give
f(tau_{00}(t),tau_{11}(t))
=norm{sqrt{D_{00}(t)}Rsqrt{D_{11}(t)}}_1.
Apply Lemma~lem:coherence a.e. and scalar Cauchy--Schwarz after
integration:
mathfrak f:=frakf:=int f(tau_{00}(t),tau_{11}(t)),dmu(t)
lesqrt{P_{00}P_{01}}+sqrt{P_{10}P_{11}}+2sqrt{P_{01}P_{10}}.
No pointwise POVM normalization was used.
Let (eta) be the unhalved trace-norm distance to the ideal bit after
the common transcript readout, and define
(e=P_{01}+P_{10}),
(q=intnorm{tau_{00}-tau_{11}}_1dmu),
(a_i=intnorm{tau_{ii}-tfrac12sigma(t)}_1dmu).
The unequal-bit blocks of the ideal state are zero. Additivity of trace
norm across bit blocks, then triangle within equal-bit blocks, gives
eta=e+a_0+a_1, qle a_0+a_1=eta-e.
Trace conservation gives:
since actual equal-bit branches have total trace (1-e) while ideal
have total trace one,
(a_0+a_1ge|e|), hence by (eq:linked-errors),
eleeta/2.
Integration of (eq:fidelity-lower) gives
(mathfrak ffrakfge(P_{00}+P_{11}-q)/2=(1-e-q)/2ge(1-eta)/2). On the
other side, Cauchy--Schwarz on the first two terms and AM-GM on the
last give
(sqrt{P_{00}P_{01}}+sqrt{P_{10}P_{11}}le√(e(1-e))) and
(2sqrt{P_{01}P_{10}}le e), so
(1-eta)/(2)lemathfrak ffrakfle√(e(1-e))+e, elefraceta2.
If (eta<1/5), then (e<1/10), and on (0le ele1/10) the function
(√(e(1-e))+e) is increasing with value (2/5) at (e=1/10).
The right side is strictly below (2/5), while the left is strictly
above. This proves (eq:uniform-secret-bit-gap).
Finally, if a secure sequence had (ell_nge1) for infinitely many
(n), the local classical channels retaining only the first bit would
map each (gamma^{(ell_n)}_{sigma^{(n)}}) to an ideal bit; trace-norm
contraction would give completed bit outputs approaching an ideal bit,
contradicting the gap. Thus every secure sequence has (ell_n=0) for
all sufficiently large (n), and (K_D(omega)=0).
[Conditioning, aborts, completed-output limits]
Consider inputs (omega^{ ⊗ n}) with (omegainC and
(nge1), and admitted protocols whose normalized completed outputs
retain an arbitrary initial purification and the full transcript.
If (A) is a measurable transcript event with probability
(r>0), the normalized bit output conditioned on (A) has
distance at least (1/5) from every ideal bit law for the
accepted output. The bound is uniform in (r>0).
Suppose a sequence of completed protocols has a local abort symbol
available. If the probability that at least one party aborts
tends to zero, and the normalized non-aborting outputs approach
ideal non-aborting bit laws, then replacing each abort by the
fixed bit (0) gives completed bit outputs approaching ideal
bits. Such a sequence is impossible for inputs in (C
Let (tau_k) be completed normalized bit outputs to which the
gap applies, possibly on different output spaces. Suppose their
bit registers are kept fixed and their Eve registers embedded in
a common (F) with embeddings (R_k If
(widehattau_ktotau) in trace norm, then
(norm{tau-tfrac12sum_i|i,i>< i,i| ⊗ sigma_F}_1
ge 1/5) for every normalized (sigma_F).
Proof.
(1) Restrict the canonical factors of Lemma~lem:transcript to
(A), and replace both (X_i(t)) by (X_i(t)/r), leaving (Y_j(t))
unchanged. All four blocks are divided by (r), and every probability
and root fidelity scale by the same factor. The proof of
(eq:fidelity-sandwich) applies without change. No lower bound on
(r) is used.
(2) Let (delta_k) be the probability of at least one abort,
(tau_k^{ok}) the normalized non-aborting state (when
(delta_k<1)), (xi_k) the normalized aborting part. Product local
channels (Q sending each party's own abort symbol to (0)
fix the ideal bit (gamma_k) and give
(norm{Q(-gamma_k}_1
le(1-delta_k)norm{tau_k^{ok}-gamma_k}_1+2delta_kto0),
contradicting Theorem~thm:zero-key applied to the completed protocol
with the local replacement appended.
(3) Recovery channel (R_k transfers ideal bits:
(R_k:calR_k:sigma|->sigma_{R_k} Contraction and the
per-protocol gap give
(norm{widehattau_k-gamma_sigma}_1genorm{tau_k-gamma_{R_k(}}_1ge1/5).
Then
(norm{tau-gamma_sigma}_1ge 1/5-norm{widehattau_k-tau}_1to 1/5).
No convergence on auxiliary probes and no factorization of (tau) is
used.
# Tensor geometry from singular directions
We now construct the dimension-ten pair. The argument has one geometric
step: a map (L:Mat 4toMat 4) with twenty specific projective
directions at which (L(xx^*)) is singular. The symmetric square of
(C^4) records the quadratic monomials of (x); the exterior square
(∧^2C^4) converts rank loss of (L(xx^*)) into a product
vector in the kernel of a (6times6) intermediate Choi matrix.
Two products in the kernel is all we need: the composite Choi matrix
(Z) is then positive with each (hathat xx ⊗ hathat xx) in its kernel.
Any product vector would have to be inside the kernel; two nonzero
quadratics whose zero sets together cover all twenty directions cannot
both vanish on nine of them (because (9+9<20)).
For a vector (x), write (P_x=xx^*), with no normalization. A
projective direction ([x]) is the complex line through (xne0).
[Tensor criterion]
Let (L:Mat 4toMat 4) be PPT. Suppose
(X={x_1,...,x_{20}}subsetC^4∖{0}) represents
twenty distinct projective directions with:
(rank L(P_x)<4) for every (xinX, and every nonzero
homogeneous quadratic in (C[x_0,x_1,x_2,x_3]) vanishes on at
most nine members of (X;
(L(P_y)) is positive definite for some (yinC^4).
Then there are explicitly constructed PPT maps
(Phi_1,Phi_2:Mat{10}toMat{10}) with
(Z=J(Phi_2circPhi_1)ne0) and
(ran Zcap{u ⊗ v}={0}). In particular (Phi_2circPhi_1)
is not entanglement breaking.
Section~sec:certificate constructs the input (L). The proof below
is the mechanism of the tensor criterion.
Proof.
Symmetric and exterior tensors.
Index an orthonormal basis of (C^{10}) by pairs (ile j<4), and of
(C^6) by (i<j<4). Define
U e_{ii}&=e_i ⊗ e_i,&
U e_{ij}&=(e_i ⊗ e_j+e_j ⊗ e_i)/(sqrt2)(i<j),
notag
V e_{ij}&=(e_i ⊗ e_j-e_j ⊗ e_i)/(sqrt2)(i<j).
Their ranges are the symmetric and antisymmetric tensor subspaces. Put
hathat x=U^*(xx=U^*(x ⊗ x)
=sum_i x_i^2;e_{ii}+sqrt2sum_{i<j}x_ix_j;e_{ij}.
Then (Uhathat x=xx=x ⊗ x) and (UP_{hathat x}xU^*=P_x ⊗ P_x).
The coordinates of (hathat xx) are the ten quadratic monomials of (x).
A nonzero (uinC^{10}) with (u^*hathat x=0x=0) at ten distinct points is
a nonzero homogeneous quadratic vanishing there, which the hypothesis
forbids. So any ten (hathat xx)'s are independent; equivalently the ten
(hathat xx)'s span (C^{10}) for any ten of the (xinX
Identify (C^6=∧^2C^4) with (e_{ij}=e_iwedge e_j) and this
basis orthonormal. Then (V(awedge b)=(a ⊗ b-b ⊗ a)/sqrt2).
For (i<j) let (k<l) be complements and (ε_{ijkl}) be the
sign of the ordering ((i,j,k,l)) of ((0,1,2,3)). Define the real
signed permutation (K) of (C^6) by (K e_{ij}=ε_{ijkl}e_{kl});
explicitly
[
(Ke_{01},Ke_{02},Ke_{03},Ke_{12},Ke_{13},Ke_{23})
=(e_{23},-e_{13},e_{12},e_{03},-e_{02},e_{01}),
]
so (K=K^*=K^{-1}). The conjugation (w|-> Koverlineoverline ww) is the
complementary-pair exterior dual used by Schliemann, Loss, and
MacDonald~[cite].
Define (S,R:Mat{10}toMat 6) by
S(A)=V^*(L ⊗ L)(UAU^*)V,
R(A)=K,S(A)^T,K^*.
Embeddings and compressions are CP; (L) PPT gives (L ⊗ L) PPT;
Lemma~lem:ppt-stability makes (S) PPT. Input-transpose CP of
(S) plus simultaneous transpose gives (T_6circ S) PPT, so (R)
is PPT.
The composite Choi matrix.
The rectangular maps give an endomorphism
(R^daggercirc Scirc T_{10}) of (Mat{10}). To express it as a
composition of two endomorphisms, let (E:C^6toC^{10}) be the real
coordinate inclusion into the first six positions and define
Phi_1(A)=E,S(A^T),E^*,
Phi_2(B)=R^dagger(E^* B E).
The stability lemma gives (Phi_1,Phi_2) PPT. Since (E^*E=I_6),
(Phi_2circPhi_1=R^daggercirc Scirc T_{10}) with Choi matrix
(Z=J(Phi_2circPhi_1)ge0).
Singular outputs and kernel products.
The Choi pairing gives, for arbitrary (a,b) of compatible sizes,
(tr[(a ⊗ b)J(F)]=tr[bF(a^T)]). For Hermitian
(a,binMat{10}),
tr[(a ⊗ b)Z]=tr[bR^dagger(S(a))]=tr[R(b)S(a)].
For a Hermitian (B) on (C^4),
(V^*(B ⊗ B)V=∧^2B). If (B_x=L(P_x)succeq0) and
(W_x=ran B_x), then
(S(P_{hathat x}x)=∧^2 B_x) with range
(∧^2 W_x). Transposition conjugates a range, so
(ran R(P_{hathat x}x)=K∧^2 W_xbar).
For exterior two-vectors (w,u), with Hermitian inner product
conjugate-linear in the first argument, the definition of (K) gives
< Koverlineoverline w,u>w,u>
=[wwedge u]_{0123},
the coefficient of (e_0wedge e_1wedge e_2wedge e_3). If
(w,uin∧^2 W) and (dim W<4), then this wedge vanishes; so
(S(P_{hathat x}x)) and (R(P_{hathat x}x)) have orthogonal ranges for every
(xinX (including (dim W_x<2), when both are zero).
Hence
[
(hathat xx ⊗ hathat x)^*Z(x)^*Z(hathat xx ⊗ hathat x)x)
=tr[R(P_{hathat x}x)S(P_{hathat x}x)]=0
]
for (xinX Positive (Z) with (v^*Zv=0) implies
(Zv=0), so
hathat xx ⊗ hathat xxinker Z (xinX).
For the second hypothesis' input (y), (S(P_{hathat y}y)=∧^2L(P_y))
is positive definite, as is (R(P_{hathat y}y)=KS(P_{hathat y}y)^T K^*), so
(tr[R(P_{hathat y}y)S(P_{hathat y}y)]>0), giving (Zne0) by
(eq:choi-pairing).
Excluding product vectors from the range.
Suppose (u ⊗ vinran Z) is nonzero. Since (Z) is Hermitian,
(ran Zperpker Z), so (eq:kernel-vectors) gives
(p_u(x)p_v(x)=0) at every (xinX, where
(p_u(x)=u^*hathat xx), (p_v(x)=v^*hathat xx). Each is a homogeneous
quadratic in (x); nonzero (u,v) mean nonzero (p_u,p_v). Each
vanishes on at most nine of (X Two zero sets cover at most
(9+9<20) points, contradiction. So no nonzero product vector is in
(ran Z). By Lemma~lem:product-range (Z) is nonseparable;
Lemma~lem:choi-separable gives (Z) not EB.
# An integer pencil and its exact certificate
We now supply (L:Mat 4toMat 4) satisfying Proposition~%
prop:tensor-criterion. Everything is explicit and integer.
The twenty singular directions ([x]) of a (6times 4) integer pencil
(M(x)=x_0M_0+x_1M_1+x_2M_2+x_3M_3) are certified by exact modular
arithmetic at three primes. The ranks and the quadratic-evaluation bound
are obtained by a single algebraic computation (the algebra generated by
the maximal minors of the pencil) whose quotient is proved to be a
degree-twenty field with Galois group (S_{20}).
## The pencil and (L)
Use indices (0,1,2,3) and define real (6times 4) matrices
M_0&=
6&0&0&00&6&0&00&0&6&00&0&0&60&0&0&00&0&0&0
,&
M_1&=
-12&0&0&00&-6&0&00&0&6&00&0&0&12-6&0&6&6-6&-6&6&0
,[2mm]
M_2&=
0&6&-2&06&6&0&2-2&0&10&00&2&0&240&0&0&60&-6&6&-6
,&
M_3&=
0&0&-4&-30&-2&-3&-4-4&-3&11&6-3&-4&6&256&6&0&00&-6&6&6
.
For (xinC^4), (M(x)=sum_i x_iM_i); then (L) is defined on
matrix units by
L(E_{ij})=M_i^{T}M_j (0le i,j<4).
[The pencil is PPT]
(L) is PPT. For every (xinC^4),
L(P_x)=M(x)^{T}M(x)bar=M(x)^*M(x),
rank L(P_x)=rank M(x).
Moreover (L(P_{e_0})=36I_4).
Proof.
Direct integer multiplication gives
(M_i^{T}M_j=M_j^{T}M_i) for all (i,j)
(block symmetry). For each row (r), let (Q_r) be the (4times4)
matrix with (i)-th column equal to row (r) of (M_i^{T}); then
(L(A)=sum_{r=1}^6 Q_rAQ_r^*), so (L) is CP. Block symmetry also
makes every (M_i^{T}M_j) symmetric, so (T_4circ L=L), giving PPT.
For complex (x):
(L(P_x)=sum_{i,j}x_ix_jbarM_i^{T}M_j
=M(x)^{T}M(x)bar), and interchanging (i,j) with block
symmetry gives (M(x)^*M(x)). Since
(v^*M(x)^*M(x)v=norm{M(x)v}^2), (ker L(P_x)=ker M(x)), giving
the rank identity. Finally (M_0^{T}M_0=36I_4).
[Twenty directions]
The projective directions ([x]inP^3( with
(rank M(x)<4) consist of exactly twenty distinct points, each with
unique representative (x=(1,t_1,t_2,t_3)). Every nonzero homogeneous
quadratic in (C[x_0,x_1,x_2,x_3]) vanishes on at most nine of them.
The equation (M(x)y=0) with (x,yne0) relates to bilinear kernel
geometry of (4times4) PPT states whose matrix and partial transpose
both have rank six~cite[Sect.~2.2,7]{HansenEtAl2012}. The twenty
product rays (x ⊗ y) there are different from the twenty
(x ⊗ x) here; the specific pencil matters.
Proof. [Proof of Proposition~prop:twenty-directions]
The maximal (4times4) minors of (M(x)) vanish exactly on
(rank M(x)<4). We chain three pieces:
[A] The maximal-minor ideal defines a nonzero affine quotient
spanned by the twenty monomials of degree (le3), so the direction set
is contained in the affine chart (x_0=1). (Lemma~%
lem:six-bilinear supplies a nonzero simultaneous vanishing point of
the six rows of (M(x)y) for some (xne0,yne0).)
[B] A (20times20) multiplication operator (N) on that span
encodes the quotient. Its characteristic polynomial (f(z)=det(zI_{20}-N))
is monic with coefficients in (Z_{(p)}) for each of the primes
(p=41,131,139). Exact modular computation gives: (det Hequiv40) mod (41),
(23) mod (131), (9) mod (139); (f) irreducible mod 41 (so
over (Q)); factor degrees (1,2,17) mod 131; (1,19) mod 139. The
local Frobenius lemma then gives Galois elements of cycle types
((1,2,17)) and ((1,19)). Irreducibility makes the Galois group
transitive; a transposition (seventeenth power of ((1,2,17))) plus
transitivity on ordered pairs gives (S_{20}).
[C] With (S_{20}) acting, the evaluation matrix
(E_{j,alpha}=(t^{(j)})^alpha) for (|alpha|le2) has
rank ten over (C). Any nonzero quadratic's dehomogenization
(q(1,t)) is nonzero exactly when (q) is nonzero; if it vanished on
ten of the twenty triples, the rank-ten evaluation matrix would force
(q=0). So no nonzero quadratic vanishes on ten of the twenty.
## Six-bilinear, monic-reduction, local-Frobenius
The three algebraic facts plugged into the proof above are stated here.
[Six bilinear equations]
Any six complex bilinear forms on (C^4timesC^4) have a common zero
((x,y)) with (xne0), (yne0).
Proof.
Let (u_{ij}) denote (X_iY_j) in the polynomial ring
(R=[u_{ij}]congC[X_iY_j]subsetC[X,Y]) (a Noetherian
domain). Its closed points are exactly rank (le1) matrices with the
relations (u_{ij}u_{kell}=u_{iell}u_{kj}).
For (P_{a,b}=(u_{ij}:ige a or jge b)), (P_{a,b}) is prime
and the chain
(0=P_{4,4}subset P_{3,4}subset P_{2,4}subset P_{1,4}
subset P_{1,3}subset P_{1,2}subset P_{1,1}subsetmathfrak mfrakm)
is strict, so (htmathfrak mfrakmge7).
Let (ell_1,...,ell_6) be the six forms and
(mathfrak a=(fraka=(ell_1,...,ell_6)). If the only common zero on
rank-one matrices were zero, the Nullstellensatz would give
(√(mathfrak a)=fraka)=mathfrak mfrakm), making (mathfrak mfrakm) minimal over
a six-generator ideal. Krull's height theorem would give
(htmathfrak mfrakmle6), contradiction. So some nonzero
rank-one (xy^{T}) annihilates all six forms.
[Monic local reduction]
Let (p) be prime and ((L,R_p)) be one of ((Q,Z_{(p)})) or
((Q_p,Z_p)). If a monic (Pin R_p[z]) factors as (P=gh) with
monic (g,hin L[z]), then (g,hin R_p[z]), their reductions mod (p)
retain degree. Consequently, if (P) has positive degree and irreducible
reduction in (F_p[z]), then (P) is irreducible over (L).
Proof.
Normalize (v_p(p)=1). For (a=sum_i a_iz^ine0), set
(nu(a)=min_{a_ine0}v_p(a_i)). Scaling by (p^{-nu}) makes
coefficients integral with least valuation zero; reductions are nonzero
and multiply in the domain (F_p[z]), so
(nu(ab)=nu(a)+nu(b)). Monic (g,h) have (nule0); monic
(Pin R_p[z]) has (nu(P)=0). Additivity forces
(nu(g)=nu(h)=0), so both have integral coefficients. Their leading
coefficients remain one, so degrees are preserved; a monic constant is
(1) and has degree zero. A nontrivial factorization over (L) would
factor (P) over (F_p[z]) nontrivially, contradiction.
[Locally integral Frobenius]
Let (FinQ[z]) be monic, separable, of positive degree, with
coefficients in (Z_{(p)}). If its reduction modulo (p) is
squarefree with irreducible factor degrees (s_1,...,s_h), then the
Galois group of its rational splitting field contains an element of
cycle type ((s_1,...,s_h)).
Proof.
Embed coefficients in (Z_p), put (s=lcm(s_1,...,s_h))
and choose a monic irreducible (overlineoverline gginF_p[X]) of degree (s).
Lift to monic (ginZ_p[X]); Lemma~lem:monic-local-reduction
gives (g) irreducible over (Q_p). Let
(O=[alpha]congZ_p[X]/(g)) where (alpha) is a root;
(O is a free rank-(s) (Z_p)-module with
(O/pcalO/pO~=F_{p^s}), and every element with nonzero
residue is a unit.
Hensel-style lifting: every simple residue root of a (Z_p[z])
polynomial lifts uniquely to a root in (O
Since (overlineoverline FF) is squarefree with roots in (F_{p^s}), we get
(deg F) distinct roots in (O Finite fields are perfect,
so (overlinealpha^p) is a simple root of (overlineoverline gg) and lifts to
some (betainO Sending (alpha|->beta) gives a
(Q_p)-embedding (Eto E) with (E=Q_p(alpha)); call it (sigma).
Finiteness makes it an automorphism, and (sigma(O)= OcalO)
because the residue action is a permutation. If (rho_r) is the lifted
root of (F) with residue (r), uniqueness gives
(sigma(rho_r)=rho_{r^p}). So (sigma)'s permutation of lifted
roots has cycle lengths (s_1,...,s_h), exactly the Frobenius cycle
lengths on their residues. The rational splitting subfield is preserved,
giving the required rational Galois element.
## The multiplication operator and (f(z))
Let (A=[t_1,t_2,t_3]/I), (I) generated by the fifteen
maximal minors (p_rho(t)=Delta_rho(1,t)). Monomial order:
first by total degree, then lexicographically. Let (v) be the twenty
monomials of degree (le3), (w) the fifteen of degree four, with
coefficients (DinZ^{15times20}), (HinZ^{15times15}):
((p_rho(t))_rho=Dv(t)+Hw(t)).
Exact coefficients yield (det Hequiv40notequiv0pmod{41}), so
(H) is invertible. Define (C=-H^{-1}D); in (A, (w=Cv)
expresses degree-four monomials as combinations of degree (le3)
monomials. Multiplication by (t_1) is the formal (20times20) matrix
(N) on the spanned (v):
[
Ne_alpha=e_{alpha+(1,0,0)} (for |alpha|le2),
Ne_alpha=textstylesum_{|beta|le3}C_{alpha+(1,0,0),beta}e_beta
(for |alpha|=3).
]
Put (f(z)=det(zI_{20}-N)). Then (f) has coefficients in
(Z_{(p)}) for (p=41,131,139); Newton's identities compute the
twenty-one characteristic coefficients and the modular gcd degrees
(d_p(k)=deggcd(overlineoverline f,z^f,z^{p^k}-z)) without leaving those rings.
Exact modular data (see Section~app:arithmetic for recorded values):
{ccll}
(p) & (det Hbmod p) & computed gcd degrees & deduced factor degrees
41 & 40 & (0) for (1le k<20), (20) at (k=20) & (20)
131 & 23 & (1,3,18) at (k=1,2,17) & (1,2,17)
139 & 9 & (1,20) at (k=1,19) & (1,19)
Since (p>20), divisions in Newton's identities are valid.
Irreducibility mod 41 + Lemma~lem:monic-local-reduction gives
(f) irreducible over (Q). Applying Lemma~%
lem:local-frobenius at (p=131,139) gives Galois elements of
cycle types ((1,2,17)) and ((1,19)). Irreducibility gives
transitivity; a transposition from the 17th power of ((1,2,17)) plus
2-transitivity (from the 19-cycle with stabilizer transitive on the other
19) gives every transposition, hence (S_{20}).
## The affine quotient is a field
The (w=Cv) relations force (A to be spanned by the twenty
low monomials. Independence follows from (f) irreducible: if
(pi:Q^{20}toA with (e_alpha|-> t^alpha), then
(pi N=mu_1pi) where (mu_1) is multiplication by (t_1).
Irreducibility makes (N) have no proper invariant subspace, so
(kerpi=0). The twenty low monomials are a (Q)-basis of
(A, and (N) is multiplication by (t_1). Since the minimal
polynomial of (N) equals (f), the subalgebra generated by (t_1) is
already all of (A:
A~=Q[z]/(f), z|-> t_1.
In particular (A is a field, and there are
(h_2,h_3inQ[z]) of degree below twenty with (t_2=h_2(t_1)),
(t_3=h_3(t_1)).
Separability (char 0) gives twenty distinct complex roots
(lambda_1,...,lambda_{20}). Extending scalars:
C[t_1,t_2,t_3]/IC[t_1,t_2,t_3]~=C[z]/(f)
~=prod_{j=1}^{20}C,
by CRT. The common zeros are exactly
(t^{(j)}=(lambda_j,h_2(lambda_j),h_3(lambda_j))), all distinct and
reduced.
## Quadratic evaluations via Galois
Let (K be a splitting field of (f),
(G=Gal(K/bbK/Q)). The evaluation matrix
(E_{j,alpha}=(t^{(j)})^alpha) for
(1le jle20), (|alpha|le2) has column rank ten over
(K Under the (S_{20}) action, (sigmain G) permutes
triples and preserves all (h_2,h_3) rational structure; so
(sigmaE_{j,alpha}=E_{sigma(j),alpha}).
(S_{20}) transitive on ten-element subsets transports the nonzero
determinant of one (10times10) submatrix to every (10times10)
submatrix. Hence (E has column rank ten over (K
and over (C).
A nonzero homogeneous quadratic (q) dehomogenizes to a nonzero
(q(1,t)); if it vanished at ten triples, the invertible evaluation
matrix would force (q=0). So (q) vanishes on at most nine.
## Putting it together
Combine Lemmas~lem:pencil-ppt and~%
prop:twenty-directions: Proposition~prop:tensor-criterion
applies with (m=10), giving the (20)-direction pair
(Phi_1,Phi_2). The composed Choi matrix
(Z=J(Phi_2circPhi_1)ne0) has no nonzero product in its range, so
(Phi_2circPhi_1) is not EB. The state (rho=Z/tr Z) is
entangled. This proves Theorems~thm:main-pair
and~thm:main-state. The exact-arithmetic realisation is in
Section~app:arithmetic.
# Applications: state, pair, and channel
We now connect the dimension-ten pair to the operational theorem, and
produce the trace-preserving channel on (Mat{21}).
Proof. [Proof of Theorem~thm:main-state]
Let (Phi_1,Phi_2) be from (eq:phi-pair),
(Z=J(Phi_2circPhi_1)). Theorem~thm:main-pair gives (Zne0),
(ran Z) product-free, (Zge0). So (lambda=tr Z>0) and
(rho=Z/lambda) has the same range, hence is entangled
(Lemma~lem:product-range). Both (Phi_1,Phi_2) are PPT.
Lemma~lem:choi-transfer with (a=b=c=10) gives
[
rho=(Phi_1^sharp ⊗ Phi_2)
(frac{Ω_{10}Ω_{10}^*}{lambda})
inC.
]
Theorem~thm:zero-key and Proposition~%
prop:operational-extensions give (eq:main-gap) and
(K_D(rho)=0). All matrices defining (rho) are explicit by
(eq:explicit-matrices) and (eq:phi-pair).
subsection{Trace-preserving PPT channel on (Mat{21})}
We want (Θ:Mat{21}toMat{21}) a trace-preserving PPT channel
whose square is not EB. The pair ((Phi_1,Phi_2)) need not be trace
preserving. The next proposition switches two coordinating blocks and
uses an absorbing flag, following Christandl--M"uller-Hermes--Wolf~%
cite[Sec.~IV.A]{CMHW2019} and Filippov~%
cite[Prop.~3,~Eq.~(15)]{Filippov2021}.
[Channel completion]
Let (Psi_1,Psi_2:Mat mtoMat m) be PPT maps. There are explicit
(c_1,c_2>0), a trace-preserving PPT channel
(Θ:Mat{2m+1}toMat{2m+1}), and a real coordinate isometry
(W_0:C^mtoC^{2m+1}) such that
(W_0^* ⊗ W_0^*)J(ΘcircΘ)(W_0 ⊗ W_0)
=c_1c_2J(Psi_2circPsi_1).
If (J(Psi_2circPsi_1)) is nonseparable, (ΘcircΘ) is
not EB.
Proof.
Set
(A_i=Psi_i^dagger(I_m)), (c_i=1/(1+tr A_i)),
(F_i=I_m-c_iA_i). Adjoints of CP maps are CP, so (A_isucceq0).
Since (A_ipreceq(tr A_i)I_m), we get
(F_isucceq(1-c_itr A_i)I_m=c_iI_m>0). The adjoint identity gives
(trPsi_i(B)=tr(A_iB)), whose complement wrt (c_i) is
(tr(F_iB)).
Decompose (C^{2m+1}=C^m_0 ⊕ C^m_1 ⊕ C e_star); (W_0,W_1)
are the two coordinate inclusions. For (XinMat{2m+1}) write
(X_{jj}=W_j^*XW_j), (x_star=e_star^*Xe_star),
(P_star=e_star e_star^*). Set
Θ(X)&=c_2W_0Psi_2(X_{11})W_0^*
+c_1W_1Psi_1(X_{00})W_1^*notag
&+(tr(F_1X_{00})+tr(F_2X_{11})+x_star)P_star.
The moving branches are CP compositions; the flag branches use
(F_i=sum_rlambda_{ir}v_{ir}v_{ir}^*) and
(K_{ir}=sqrt{lambda_{ir}}e_star v_{ir}^*W_{i-1}^*), whose
(sum_r K_{ir}XK_{ir}^*=tr(F_iX_{i-1,i-1})P_star) is CP.
Trace preservation: (c_iA_i+F_i=I_m) gives
(trΘ(X)=tr X_{00}+tr X_{11}+x_star=tr X).
PPT: because (W_0,W_1,e_star) are real, output transposition sends
(Psi_i) to (T_mcircPsi_i) in the moving branches and fixes the
flag. The effects (F_i) may be complex; coordinate transpose does not
conjugate the scalar multiplying (P_star). Each transposed moving
branch is CP by hypothesis, and the flag is CP; so
(T_{2m+1}circΘ) is CP.
Flag absorbing: (Θ(P_star)=P_star). Applying (eq:channel)
twice to (W_0BW_0^*), for (BinMat m),
[
Θ^2(W_0BW_0^*)
=c_1c_2W_0Psi_2(Psi_1(B))W_0^*
+(tr(F_1B)+c_1tr(F_2Psi_1(B)))P_star.
]
Compression:
(W_0^*Θ^2(W_0BW_0^*)W_0=c_1c_2Psi_2(Psi_1(B))). Coordinate
matrix units give (eq:choi-corner). If the compressed positive
multiple were separable, then because compression takes
(A ⊗ B|->(W_0^*AW_0) ⊗ (W_0^*BW_0)) on products,
(J(Psi_2circPsi_1)) would be separable. Contradiction if it is not.
Proof. [Proof of Theorem~thm:main-channel]
Apply Proposition~prop:channel-completion with (m=10),
(Psi_i=Phi_i). The composed Choi matrix (J(Phi_2circPhi_1)) is
nonseparable (Theorem~thm:main-pair). Formula (eq:channel)
produces a trace-preserving PPT channel on (Mat{21}); its square's
Choi matrix has the nonseparable corner (eq:choi-corner), hence is
not EB.
For the exact positive evaluation used in Theorem~thm:main-pair,
Theorem~thm:main-pair's argument shows
[
S(P_{e_{00}})=R(P_{e_{00}})=36^2I_6,
(e_{00} ⊗ e_{00})^*Z(e_{00} ⊗ e_{00})
=6·36^4=10{,}077{,}696>0.
]
# An alternative construction from projection overlaps
The dimension-ten construction is done. This section builds another
entangled member of (C, in much larger dimension, by a
different mechanism. Real unit vectors and projective measurements
produce a large sum of correlations. Zero trace overlaps among the
projections restrict the supports of product vectors in any hypothetical
separable decomposition. These two constraints force a contradiction.
Two preliminaries. First, for self-adjoint projections (E,F),
tr(EF)=tr(FEF)=tr((EF)^*EF)ge0.
So (tr(EF)=0) iff (EF=0). No commutation required.
Second, each block of a Choi matrix can be tested by pairing against
matrix units. This will be the identity we test against in Section~%
sec:projection's proof.
[Rectangular projection criterion]
Let (Q,K,D) be positive integers, (Q a set of size (Q).
Take unit vectors (u_qinR^K for (qinQ, with
(c_{qr}=u_q^{T}u_r). For each (q), ({P_i:iinI_q}) is
a finite projective measurement on (C^D); zero projections allowed.
Take the (I_q disjoint, (I=⊔_qcalI=⊔_qI_q,
(n=|I|calI|). Suppose:
(P_iP_j=P_jP_i) whenever (c_{qr}ne0);
there is a real (kappa<Q/K) such that every
(J⊆I with (tr(P_iP_j)>0) for all distinct
(i,jin J) has (|J|lekappa).
Define (Psi:Mat ntoMat D) on matrix units by
H_{ij}=c_{qr}P_iP_j, Psi(E_{ij})=H_{ij}
(iinI_q, jinI_r).
Then (Psi,Psi^dagger) are PPT, and
C:=J(Psi^daggercircPsi) is nonseparable over C^n ⊗ C^n,
tr C=Q^2D.
Proof. [Strategy]
The block matrix (H=J(Psi)succeq0) since it is a sum of rank-one
Psd block columns (u_q ⊗ P_iw_i). Block symmetry plus reality
gives PPT. Then compress (C) to the diagonal tensor subspace; a
vector-Gram bound gives (mathbf1^*Bbf1^*Bmathbf1bf1ge(D/K)tr B). A separable
decomposition would give the reverse bound (lekappatr B), and
(kappa<Q/K) closes the contradiction.
Proof.
Regard (u_q) as a vector in (C^K). For (w_iinC^D),
sum_{i,j}< w_i,H_{ij}w_j>
=norm{sum_{q}sum_{iinI_q} ⊗ P_iw_i}^2ge0.
So (Hsucceq0); Lemma~lem:choi-separable gives (Psi) CP.
Block symmetry: since (c_{qr}=c_{rq}) is real and hypothesis 1 makes
(P_i,P_j) commute when (c_{qr}ne0), (H_{ij}=H_{ji}=H_{ij}^*).
The two partial transposes:
H^{Gamma_1}=H, H^{Gamma_2}=H^{T}succeq0,
where (H^{T}succeq0) because (H=R^*R⇒ H^{T}=(barbar R)^*R)^*barbar RR).
Lemma~lem:choi-separable then gives (T_DcircPsi) CP; so
(Psi) is PPT.
Also (Psi^dagger) is PPT and CP (Lemma~lem:ppt-stability).
Explicit form:
[Psi^dagger(A)]_{ij}=tr(H_{ij}^*A);
block symmetry gives (T_ncircPsi^dagger=Psi^dagger).
Compression to diagonal.:
(C=Psi^daggercircPsisucceq0). Its fully indexed entries:
C_{(i,a),(j,b)}=tr(H_{ab}^*H_{ij}).
Since (c_{qq}=1), (P_i^2=P_i), we get (H_{ii}=P_i). The diagonal
entries and the compression (B) to
(span{e_i ⊗ e_i}) compute as
C_{(i,j),(i,j)}&=tr(P_iP_j),
B_{ij}:=C_{(i,i),(j,j)}&=c_{qr}^2tr(P_iP_j).
Completeness of each measurement gives
(sum_{iinI_q}{jinI_r} Summing
over (q,r): (tr C=Q^2D). Also (tr B=QD), and
mathbf1^*Bbf1^*Bmathbf1=Dbf1=Dsum_{q,r}c_{qr}^2ge(D Q^2)/(K).
Indeed (M=sum_q u_qu_q^{T}) has (tr M=Q) and
(tr(M^2)=sum_{q,r}c_{qr}^2); Cauchy--Schwarz on its (K) eigenvalues
gives (tr M^2ge Q^2/K).
Separability bound.:
Suppose (C) separable over (C^n ⊗ C^n). Spectral decomposition
of local factors yields (C=sum_ell(x^{(ell)} ⊗ y^{(ell)})(...)^*).
Whenever (tr(P_iP_j)=0), the diagonal entry
(0=C_{(i,j),(i,j)}=sum_ell|x_i^{(ell)}y_j^{(ell)}|^2) forces each
term zero, so for one (z_i=x_iy_i), (supp z) has no pair with
(tr(P_iP_j)=0). Thus (|supp z|lekappa).
Compressing to the diagonal subspace gives (B=sum_ell z^{(ell)}(z^{(ell)})^*).
Complex Cauchy--Schwarz on supports:
mathbf1^*Bbf1^*Bmathbf1=bf1=sum_ell|sum_i z_i^{(ell)}|^2
lekappasum_ellnorm{z^{(ell)}}^2=kappatr B
<frac QKtr B=(DQ^2)/(K),
contradicting (eq:projection-gram-bound). Hence (C)
nonseparable.
[Same local channel for real projections]
Under the hypotheses of Proposition~prop:projection-criterion,
suppose every (P_i) is real symmetric. Put (Λ=Psi^dagger).
Then
Λcirc T_D=Λ=T_ncircΛ,
trΛ(A)=Q,tr A.
So (Λ/Q:Mat DtoMat n) is a trace-preserving PPT channel.
With (Phi_D=Ω_D/sqrt D) the normalized maximally entangled
vector,
(C)/(Q^2D)=
((Λ)/(Q) ⊗ (Λ)/(Q))(Phi_DPhi_D^*)
is an entangled density operator in (C
Proof.
Reality + block symmetry gives (H_{ij}^{T}=H_{ij}). Equation~%
(eq:projection-adjoint) gives both transpose invariances. Trace:
(trΛ(A)=sum_itr(H_{ii}A)=Qtr A). So (Λ/Q) is a
trace-preserving PPT channel. Lemma~lem:choi-transfer with
(Psi,Λ) gives (Psi^sharp=T_ncircΛcirc T_D=Λ)
by invariances, so
(G:=(Λ ⊗ Λ)(Ω_DΩ_D^*)=C). Divide by
(Q^2D). Nonseparability and trace (Q^2D) give the claim.
[Square embedding]
Under Proposition~prop:projection-criterion's hypotheses with
(nge D), let (U:C^DtoC^n) be the real coordinate isometry onto
the first (D) coordinates. With
Xi_1=Ad_UcircPsi,
Xi_2=Psi^daggercircAd_{U^*}=Xi_1^dagger,
the maps (Xi_1,Xi_2:Mat ntoMat n) are PPT and
(Xi_2circXi_1=Psi^daggercircPsi). Their composition is not EB.
Proof.
Embedding and compression by (U) are CP; the composite is
(Psi^daggercircPsi) with Choi (C) nonseparable. The pair inherits
PPT from Ssec:projection's invariances; the composite Choi matrix
is the nonseparable (C). Lemma~lem:choi-separable gives non-EB.
# A finite combinatorial realization
The projection criterion needs unit vectors and projective measurements
satisfying its two hypotheses. This section constructs them, using
three ingredients: a restricted-intersection bound on sign vectors that
forces orthogonal pairs in large sets; a fiber amplification that
upgrades to eight orthogonal in every large subset of triples; and a
tensor product of Mermin--Peres parity measurements that turns any
orthogonal eight-set into a forbidden positive-overlap choice.
## Vectors with forced orthogonality
Set (p=257), (k=4p=1028), ([k]={1,...,k}). Define
U={A⊆[k]:|A|=2p, 1in A},
b=|U|=calU|=binom{1027}{513}=frac12binom{4p}{2p},
and (s_A=k^{-1/2}(2mathbf1_bf1_{{hin A}}-1)_{h=1}^kinR^k
Each (s_A) is a unit vector; by counting agreeing entries,
s_A^{T}s_B=(k-2|A△ B| )/(k)
=(|Acap B|)/(p)-1.
So (s_Aperp s_B) iff (|Acap B|=p).
Put (a_0=sum_{j=0}^{p-1}binom{k}{j}=sum_{j=0}^{256}binom{1028}{j})
and (delta=a_0/b). Frankl--R"odl~cite[Thm.~1.11]{FR1987} forces
orthogonal families in subsets, but here we get a precise bound by
elementary multilinear methods.
[Restricted intersections]
If (F⊆calF⊆U has no two distinct sets with
orthogonal associated vectors, then (|F|calF|le a_0=delta b).
Proof.
For distinct (A,BinF, common element (1) and equal sizes
give (1le|Acap B|le2p-1); orthogonality is excluded, so
(|Acap B|ne p) and (|Acap B|notequiv0pmod p); also
(|Acap A|=2pequiv0pmod p). Over (F_p) define
(f_A(x)=prod_{hin A}(1-x_h^{p-1})=1-(sum_{hin A}x_h)^{p-1})
in the identity (a^{p-1}=1) for (ainF_p^times). On indicators:
(f_A(mathbf1_B)=bf1_B)=delta_{AB}).
Replace every positive power (x_h^{d}to x_h) for (d>1); evaluations
on Boolean vectors are unchanged and degrees drop to (le p-1).
Independence follows by evaluating any linear relation at each
(mathbf1_Bbf1_B). The multilinear polynomials of degree (le p-1) have
basis ({x^alpha:|alpha|le p-1}), size (a_0). So
(|F|calF|le a_0).
[Fiber amplification]
For (t=1,2,3), to ((A_1,...,A_t)inU^t associate the
unit tensor (s_{A_1} ⊗ ... ⊗ s_{A_t}). If
(R⊆calR⊆U^t contains no collection of (2^t)
distinct tuples whose associated tensors are pairwise orthogonal, then
(|R|calR|le tdelta b^t).
Proof.
(t=1) is Lemma~lem:restricted-intersections. For
(t=2,3), set
(R_A={(A_2,...,A_t):(A,A_2,...,A_t)inR}).
Let (G be those (A) for which (R_A contains
(2^{t-1}) pairwise orthogonal tuples. Two (A,BinG with
(s_Aperp s_B) and disjoint fibers would produce (2^t) forbidden
tuples; so (G has no orthogonal pair, forcing
(|G|calG|le a_0=delta b). Fibers in (G have
(le b^{t-1}) elements; other fibers have (le(t-1)delta b^{t-1}).
Summing gives
[
|R|calR|le(delta b)b^{t-1}+b(t-1)delta b^{t-1}=tdelta b^t.
]
Set questions:
Q=, Q=b^3, K=k^3=1028^3=1{,}086{,}373{,}952,
(u_q=s_{A_1} ⊗ s_{A_2} ⊗ s_{A_3}) for
(q=(A_1,A_2,A_3)). An orthogonal eight-set is (S⊆Q
of size eight with pairwise orthogonal (u_q)'s. Lemma~%
lem:fiber-amplification at (t=3) gives
|R|calR|lekappa:=3delta Q=3a_0b^2
for any (R⊆calR⊆Q with no orthogonal eight-set.
The analytic bound: central binomial
(b=frac12binom{4p}{2p}ge 16^p/(2(4p+1))), and
(a_0le pbinom{4p}{p}le p(4/3)^{4p}3^p < p,12^p). So
(delta < 2p(4p+1)(3/4)^p<2^{-65}). With (2p(4p+1)<2^{20}),
(ple85·3+2), ((3/4)^3<1/2):
(3delta<2^{-33}<1/K), giving
kappa=3a_0b^2<frac QK.
## Six parity measurements (Mermin--Peres)
On (C^2):
(X=0&11&0),
(Z=1&00&-1),
(Y=0&-ii&0).
The Mermin--Peres square~[cite]:
{ccc|c}
X ⊗ I_2&I_2 ⊗ X&X ⊗ X&+I_4
I_2 ⊗ Z&Z ⊗ I_2&Z ⊗ Z&+I_4
X ⊗ Z&Z ⊗ X&Y ⊗ Y&+I_4hline
+I_4&+I_4&-I_4&
Each entry is a real symmetric involution. Order the six contexts as
the three rows and then three columns. In context (t), the three
observables ((O_1,O_2,O_3)) satisfy (O_1O_2=O_2O_1), (O_1,O_2,O_3)
commute, and
(O_3=e_tO_1O_2) with
((e_1,...,e_6)=(1,1,1,1,1,-1)). Signs from (XZ=-iY) and (ZX=iY).
For ((alpha,beta)in{-1,+1}^2), set
h_t(alpha,beta)=frac14(I_4+alpha O_1)(I_4+beta O_2).
These are self-adjoint projections with sums (I_4), ranges carrying
eigensigns ((alpha,beta,e_talphabeta)).
[Parity obstruction]
There is no choice, one projection from each of the six measurements in
(eq:combinatorial-context-projections), such that every pair of
chosen projections from distinct contexts has strictly positive
overlap.
Proof.
If (E) (row) and (F) (column) both select an eigensign (a,b)
for their shared (O), then (aEF=EOF=bEF); positive overlap forces
(a=b). So a hypothetical positive-overlap choice assigns nine
consistent signs to the square. The product over each row's three
signs is (e_t): (+1) for rows; the column constraint (-1) at the
last column contradicts the row product (+1).
## Assembling the tensor product
For each 8-subset (S⊆Q, a separate (C^4) factor.
On an orthogonal eight-set, the six smallest-index elements receive the
six parity measurements; the remaining two get a trivial one-outcome
measurement with the other outcomes zero. Nonorthogonal (S) and all
non-membership questions get trivial measurements.
S={S⊆Q:|S|=8calQ:|S|=8},
L=|S|=calS|=binom Q8,
H=⊗_calH=⊗_{SinS}, D=4^L.
For each (qinQ and outcome string
(lambdain{-1,+1}^{2timesS},
I_q={q}timesA^{S},
P_{q,lambda}=⊗_{SinS}{S,q}(lambda_S).
where (h_{S,q}) is the measurement above (or trivial). These are real
symmetric projections summing to (I_D) for each fixed (q).
Keeping every outcome string gives exactly (D=4^L) labels per
question, so (n=|⊔_qI_q|=QDcalI_q|=QD).
The (u_q) and (P_{q,lambda}) satisfy Proposition~%
prop:projection-criterion's two hypotheses with (n=m=QD) and
(kappa=3a_0b^2<Q/K).
Proof.
Hypothesis 1: if (q=r) then projections are in one POVM and commute.
If (qne r) with (c_{qr}ne0) and both nontrivial on one factor,
they would be together in an orthogonal eight-set forcing
(c_{qr}=0). Contradiction. So on each factor at least one selected
projection is trivial or zero, and they commute.
Hypothesis 2: labels per question differ only on one factor and have
zero product; labels for one question are one per question. The trace
overlap factors over the tensor factors. If the questions represented
by a positive-overlap label set contained an orthogonal eight-set (S),
the six selected projections would violate Lemma~%
lem:parity-obstruction on factor (S). So
(|J|lekappa). The strict inequality is (eq:combinatorial-strict-bound).
[Combinatorial construction]
Take the explicit data:
(p=257), (k=1028), (b=binom{1027}{513}),
(a_0=sum_{j=0}^{256}binom{1028}{j}), (Q=b^3),
(K=1086373952), (kappa=3a_0b^2<Q/K), (L=binom Q8),
(D=4^L), (m=QD). Let (Psi) be
from (eq:projection-map), (Λ=Psi^dagger),
(Phi_D=Ω_D/sqrt D). Then:
(Λ/Q) is a trace-preserving PPT channel, and
rho_{comb}
=(Λ/Q ⊗ Λ/Q)(Phi_DPhi_D^*)
=(J(Psi^daggercircPsi))/(Q^2 D)
is an entangled density operator on (C^m ⊗ C^m) in
(C, with (K_D(rho_{comb})=0) and the uniform
unhalved (1/5) gap.
For (U:C^DtoC^m) the first-coordinate isometry,
(Phi_1^{comb}=Ad_UcircPsi),
(Phi_2^{comb}=ΛcircAd_{U^*}) are PPT with
(J(Phi_2^{comb}circPhi_1^{comb})=Q^2Drho_{comb})
nonseparable, so the composition is not EB.
The channel completion (Θ_{comb}) of
Proposition~prop:channel-completion applied to this pair is a
trace-preserving PPT channel on (Mat{2m+1}) whose square has the
nonseparable corner
((W_0^* ⊗ W_0^*)J(Θ_{comb}^2)(W_0 ⊗ W_0)
=c_1c_2Q^2D,rho_{comb}).
Proof.
Lemma~lem:combinatorial-measurements verifies the projection
criterion. Its composite (C=J(Psi^daggercircPsi)) is positive and
nonseparable, (tr C=Q^2D). Real symmetric projections give
Corollary~cor:real-channel; then Theorem~thm:zero-key gives
the operational conclusions. Corollary~cor:square-embedding gives
the square PPT pair, and Proposition~prop:channel-completion gives
the channel.
All quantities are given by finite exact formulas. The (s_A) have
irrational coordinates, but the Gram entries of question vectors
(c_{qr}) are rational; observables and projections are integral; so
every block (H_{ij},Psi,Λ,Phi_1^{comb},Phi_2^{comb}),
and (rho_{comb}) entry is rational. The channel completion
in Proposition~prop:channel-completion has rational coefficients.
Appendix~app:supplementary-checks records the exact integer checks.
appendix
# Exact arithmetic for the dimension-ten certificate
Everything in Section~sec:certificate that can be reduced to exact
finite arithmetic is verified by a single Python~3 program using only
the standard library and integer arithmetic. Its inputs are the matrices
(M_0,...,M_3) of (eq:explicit-matrices). Its outputs are:
an assertion of the block-symmetry identity
(M_i^{T}M_j=M_j^{T}M_i) for all (0le i,j<4);
the integer matrices (DinZ^{15times20}) and
(HinZ^{15times15}) in the decomposition
((p_rho(t))_rho=Dv(t)+Hw(t)), where the
monomial order is total degree first, then lexicographic;
for each of (p=41,131,139): the residue of (det H); the
twenty-one characteristic coefficients of the (F_p)-reduction
of (f(z)=det(zI_{20}-N)); and the gcd degrees
(d_p(k)=deggcd(overlineoverline f,f, z^{p^k}-z)) for (k=1,...,20).
The program runs with assertions enabled (no -O, no
-OO, PYTHONOPTIMIZE unset). From the paper directory:
python3 verification/exact_certificate.py
The recorded output is verification/certificate-output.txt;
an identical build copy supplies the typeset listing.
Details of the computation.:
The function checksym verifies block symmetry using only
(i<j) and column indices (a<b). The cases (i=j) and (a=b)
vanish identically (equal matrix entries), while swapping either also
leaves the same value; so strict loops cover every equality. The array
R is ([Dmid H]); T is the reduction of (N)
modulo the current prime. The program expands each determinant over the
(4!=24) permutations, collects coefficients in that order, and performs Gaussian elimination on (H)
modulo each prime.
For (f(z)=z^{20}+c_1z^{19}+...+c_{20}), Newton's identities
(k c_k=-sum_{i=0}^{k-1}c_itr(N^{k-i})) determine (c_k) from the
traces (tr(N^{k-i})). Division by (k) is valid at each of
(41,131,139) because (p>20). Repeated (p)-th powers of (z) mod
(overlineoverline ff) compute the residues of (z^{p^k}), and the polynomial
Euclidean algorithm gives (d_p(k)). All inverses are in the stated
prime field.
No floating-point approximation, no heuristic search, no general
elimination, and no Galois-group computation is performed. In
particular:
The irreducibility of (f) over (Q) follows from the irreducible
reduction modulo 41 together with Lemma~lem:monic-local-reduction.
The Galois cycle types ((1,2,17)) and ((1,19)) follow from
Lemma~lem:local-frobenius at (p=131,139).
(G=S_{20}) follows from the transposition plus (2)-transitivity
argument of Section~sec:certificate.
The exact gcd degrees recorded are:
[
{c|c}
p & (d_p(1),...,d_p(20))
41 & 0,...,0, 20 (only d_{41}(20)=20ne0)
131 & 1,,3,,0,,0,...,0, 18 (at k=1,2,17)
139 & 1,,0,...,0, 20 (at k=1,19)
]
and the residues of (det H) are (40, 23, 9) modulo (41,131,139),
respectively, each nonzero.
# Supplementary finite checks
The combinatorial construction of Section~sec:combinatorial is
proved by finite formulas and analytic inequalities. Two small
programs verify its exact integer components. Neither is a premise of
the proof.
Combinatorics.:
verification/combinatorics_exact_checks.py uses only the
Python standard library. It checks:
(1) primality of (257) by trial division by the primes up to
(√(257)), namely (2,3,5,7,11,13);
(2) the intermediate binomial and power inequalities used to derive
(delta<2^{-65});
(3) (3a_0K<b) and (3a_0b^2ge3).
Its recorded output combinatorics_exact_checks.json stores
the exact integers (a_0) (under key A) and (b), confirms
(K=1086373952), and records the stronger interval
2^{-194}ledelta<2^{-193}.
The analytic proof requires only (delta<2^{-65}).
Parity gadget.:
verification/gadget_exact_check.py represents each local
projection (h_t(alpha,beta)) by the integral matrix
(R=4h_t(alpha,beta)). It checks observable relations, all operator
identities, eigensigns for all (24) projections, and measurement
completeness. It computes the (36) ordered context-pair overlap
tables; the stored integer (tr(RR')) is exactly (16tr(h_th_{t'})).
It then enumerates all (4^6=4096) selections of one outcome per
context, counts zero overlaps among the (15) unordered pairs of
distinct contexts, and produces:
[
{c|rrrrr}
# of zero-overlap pairs & 1 & 3 & 5 & 7 & 9
# of selections & 144 & 1344 & 2016 & 576 & 16
]
The recorded output gadget_exact_check.json has no selection
with all overlaps strictly positive.
Running.:
Regenerate both outputs with
python3 verification/combinatorics_exact_checks.py
python3 verification/gadget_exact_check.py > verification/gadget_exact_check.json
Assertions enabled, -O/-OO forbidden,
PYTHONOPTIMIZE unset. All computations use exact Python
integers, no floating-point tolerance. The programs do not instantiate
the enormous global matrices or enumerate the question set; those
objects are specified and analyzed by the finite formulas in the text.
{99}
J.~An and S.~Lee, ``Beyond the Positive Partial Transpose Squared
Conjecture: The Qutrit Case,'' arXiv:2607.15947 [quant-ph] (2026).
M.-D.~Choi, ``Completely positive linear maps on complex matrices,''
Linear Algebra Appl. 10 (1975), 285--290.
M.~Christandl, A.~M"uller-Hermes, and M.~M.~Wolf,
``When do composed maps become entanglement breaking?''
Ann. Henri Poincar'e 20 (2019), 2295--2322.
I.~Devetak and A.~Winter, ``Distillation of secret key and entanglement
from quantum states,'' Proc. Roy. Soc. A 461 (2005),
207--235.
S.~N.~Filippov, ``Capacity of trace decreasing quantum operations
and superadditivity of coherent information for a generalized erasure
channel,'' J. Phys. A 54 (2021), 255301.
P.~Frankl and V.~R"odl, ``Forbidden intersections,''
Trans. Amer. Math. Soc. 300 (1987), 259--286.
L.~O.~Hansen, A.~Hauge, J.~Myrheim, and P.~{O}.~Sollid,
``Low-rank positive-partial-transpose states and their relation to
product vectors,'' Phys. Rev. A 85 (2012), 022309.
P.~Horodecki, ``Separability criterion and inseparable mixed states
with positive partial transposition,'' Phys. Lett. A 232
(1997), 333--339.
M.~Horodecki, P.~W.~Shor, and M.~B.~Ruskai,
``Entanglement breaking channels,'' Rev. Math. Phys. 15
(2003), 629--641.
A.~Jamiol{}kowski, ``Linear transformations which preserve trace and
positive semidefiniteness of operators,''
Rep. Math. Phys. 3 (1972), 275--278.
O.~Kallenberg, Foundations of Modern Probability, 2nd ed.,
Springer, New York (2002).
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``Secure key from bound entanglement,''
Phys. Rev. Lett. 94 (2005), 160502.
K.~Horodecki, M.~Horodecki, P.~Horodecki, and J.~Oppenheim,
``General paradigm for distilling classical key from quantum states,''
IEEE Trans. Inf. Theory 55 (2009), 1898--1929.
O.~Kr"uger and R.~F.~Werner (editors),
Some open problems in quantum information theory (2005),
Problem~24, ``Secret key from all entangled states?'' (P.~Horodecki).
N.~D.~Mermin, ``Simple unified form for the major no-hidden-variables
theorems,'' Phys. Rev. Lett. 65 (1990), 3373--3376.
S.-J.~Park, ``Every PPT channel has finite entanglement breaking
index,'' arXiv:2608.13551 [quant-ph] (2026).
A.~Peres, ``Incompatible results of quantum measurements,''
Phys. Lett. A 151 (1990), 107--108.
A.~Peres, ``Two simple proofs of the Kochen--Specker theorem,''
J. Phys. A 24 (1991), L175--L178.
J.~Schliemann, D.~Loss, and A.~H.~MacDonald, ``Double-occupancy
errors, adiabaticity, and entanglement of spin qubits in quantum dots,''
Phys. Rev. B 63 (2001), 085311.