Trusted detector noise analysis for discrete modulation schemes of continuous-variable quantum key distribution

Discrete-modulated continuous-variable quantum key distribution protocols are promising candidates for large-scale deployment due to the large technological overlap with deployed modern optical communication devices. The security of discrete modulation schemes has previously analyzed in the ideal detector scenario in the asymptotic limit. In this work, we calculate asymptotic key rates against collective attacks in the trusted detector noise scenario. Our results show that we can thus cut out most of the effect of detector noise and obtain asymptotic key rates similar to those had we access to ideal detectors.

On the one hand, Gaussian modulation schemes are simpler to analyze theoretically than discrete modulation systems, and they give secret key rates close to the theoretical limits [21,22]. On the other hand, continuous modulation itself is usually only approximated by a (relatively large) set of discrete modulation settings. This approximation needs to be taken into account during the full security analysis (see e.g. [23][24][25]). Moreover, as Gaussian modulation schemes often require more resources in terms of randomness and classical postprocessing resources, discrete modulation schemes thus offer further simplification of implementation. However, in previous experimental demonstrations of discrete modulation schemes, either only effective entanglement has been verified [16,18] which is a necessary pre-condition for QKD or security has been established only against a restricted subset of collective attacks [17,19]. By now, there are asymptotic security proofs against arbitrary collective attacks for binary [26], ternary [27] as well as quaternary modulation schemes and beyond [28,29]. Previous proofs for a general discrete modulation scheme [28,29] investigate the untrusted detector noise scenario where the imperfection of detectors can be controlled by Eve (and thus one can treat detectors as ideal). In reality, the amount of electronic noise of an off-the-shelf homodyne detector in a CVQKD experiment can be much higher than the channel excess noise. As a result, the key rate in the untrusted detector noise scenario drops very quickly to zero as the transmission distance increases. However, since detectors are securely located in Bob's laboratory where Eve is unable to access, it is reasonable to assume that Eve does not control detector imperfections especially those noise sources that are on the electronic circuitry, which is more remote from the quantum mechanical part of the signal detection.
In this work, we extend our previous analysis [29] to the trusted detector noise scenario where detector imperfections (detector inefficiency and electronic noises) are not accessible to Eve. We remark that Gaussian modulation schemes have been analyzed in the trusted detector noise scenario and these studies show the effects of electronic noise and detector inefficiency on the key rates are not very significant in the trusted detector noise scenario [10,30] compared to the ideal detector scenario. As we show in this work, this observation also holds for discrete modulation schemes. However, we emphasize that our analysis is not a trivial application of the method used for Gaussian modulation protocols and instead we adopt a different approach. The reason is that the previous method used in the Gaussian modulation protocols relies on the fact [31,32] that the optimal Eve's attacks for Gaussian modulation schemes correspond to Gaussian channels which make it easy to decouple the trusted detector noise from the channel noise when one looks at the covariance matrix. However, we cannot assume Gaussian channels here since Gaussian attacks are not expected to be optimal for discrete modulation schemes. In our analysis, based on a (commonly used) quantum optical model of the imperfect detector, we find its corresponding mathematical description in terms of positive operator-valued measure (POVM) and then use this POVM to construct observables corresponding to quantities that are measured experimentally. These observables are then used in our security proof. We also point out the crucial difference between our analysis and Ref. [33] for discrete modulation schemes: Our asymptotic analysis is valid against arbitrary collective attacks while Ref. [33] uses the Gaussian channel assumption and thus its security analysis [33] is restricted to Gaussian collective attacks.
Our main contributions of this work are finding a suit-able POVM description of a noisy heterodyne detector and revising our previous analysis [29] by using a new set of constraints from this POVM in the numerical key rate optimization problem [34,35]. Similar to our previous analysis, this method is applicable to both direct reconciliation and reverse reconciliation schemes. Moreover, we also study the postselection of data [7] in the trusted detector noise scenario. As a concrete example, we apply our method to the quadrature phase-shift keying scheme with heterodyne detection and focus on the reverse reconciliation scheme. Our analysis here is still restricted to the asymptotic regime against collective attacks and we make the same photon-number cutoff assumption as in the previous works [28,29] to truncate the infinite-dimensional Hilbert space in order to perform the numerical calculation. From the numerical observation, we believe the results do not depend on the choice of cutoff when it is appropriately chosen. We direct the discussion about this assumption to Sec. III B of Ref. [29] and leave it for future work to provide an analytical justification of this assumption beyond the numerical evidences. To extend our analysis to the finite-key regime, we remark that we have recently extended the numerical method of Ref. [35] on which our analysis is based to include finite key analysis [36]. However, there remain some technical challenges to solve before we can apply this method to this protocol and thus we leave the finite key analysis for future work. The rest of paper is outlined as follows. In Sec. II, we review the protocol and proof method in Ref. [29]. We then present a trusted detector noise model and the corresponding POVM description in Sec. III. In Sec. IV, we modify the key rate optimization problem to take trusted detector noise into account. We discuss our simulation method in Sec. V. We show the simulation results without postselection in Sec. VI and with postselection in Sec. VII. Finally, we summarize the results and provide insights for future directions in Sec. VIII. We present technical details in the Appendices.

II. BACKGROUND
Our key rate calculation in the trusted detector noise scenario uses a similar proof method as in our previous work [29]; that is, we numerically perform the key rate optimization problem [35] with a modified set of constraints. In particular, we discuss how to modify the key rate optimization problem in Sec. IV based on the POVM description of a noisy heterodyne detector in Sec. III. To help understand this modification, we first review main ideas of the proof in Ref. [29].
For illustration, we focus on the quadrature phase-shift keying scheme with heterodyne detection. We remark that since the previous proof can be generalized to other discrete modulation schemes beyond four coherent states at the cost of more computational resources, our modified analysis for the trusted detector noise scenario can also be generalized in the same way. Moreover, one can apply a similar idea presented in this paper to study the homodyne detection scheme in the presence of trusted detector noise.
A. Quadrature phase-shift keying protocol To begin with, we review the quadrature phase-shift keying (QPSK) scheme with heterodyne detection. The quantum part of the protocol consists of many repetitions of the following two steps: (1) Alice obtains a uniformly random number x ∈ {0, 1, 2, 3}, selects the state |α x = αe 2ix π from the set {|α , |iα , |−α , |−iα } according to the value of x, and sends it to Bob. (2) Bob applies the heterodyne detection to the received state and obtains a measurement outcome y ∈ C.
After the quantum communication phase of the protocol, they proceed with the usual classical postprocessing part of a QKD protocol including announcement, sifting, parameter estimation, key map (with discretization), error correction and privacy amplification (see Ref. [29] for a more detailed description). We highlight the key map step below.
In the case of reverse reconciliation, for each measurement outcome y written as y = |y|e iθ , where θ ∈ [− π 4 , 7π 4 ), Bob obtains a discretized value z according to the following rule: where j ∈ {0, 1, 2, 3} and ∆ a is a postselection parameter that needs to be optimized for the selected protocol and experimental parameters [37]. A protocol without postselection corresponds to setting ∆ a = 0.
To perform the postselection of data in combination of reverse reconciliation, Bob announces positions where he obtains the value ⊥. After removing the positions related to the value ⊥, Alice's string X consists of her random number x's in the remaining positions, and Bob's raw key string Z consists of his discretized outcome z's left. (Alternatively, they may choose to announce and keep positions related to the value ⊥ and let the privacy amplification subprotocol effectively remove those positions.) Alice and Bob may decide to recast their strings to binary strings before or during the error correction step depending on their choice of the error-correction code. For the consistency of our presentation, we use the alphabet {0, 1, 2, 3} and let X and Z denote the single-round version of X and Z, respectively.
Key map for quadrature phase-shift keying scheme in terms of Bob's measurement outcome y ∈ C. Each colored region Aj corresponds to a discretized key value j. The measurement outcome in the central disk with a radius ∆a is discarded during the postselection of data and is mapped to the symbol ⊥.
B. Review of security proof method

Source-replacement scheme
The first step of our security proof is to apply the source-replacement scheme [38][39][40][41] to obtain an equivalent entanglement-based scheme for the given prepareand-measure protocol. Then we proceed to prove the security of the entanglement-based scheme.
Given Alice's state ensemble {|α x , p x } (where p x = 1 4 for this protocol) for her preparation in the prepare-andmeasure scheme, Alice effectively prepares a bipartite state |Ψ AA in the source-replacement scheme, which is defined as where {|x } is an orthonormal basis for register A. Then Alice sends the register A to Bob via an insecure quantum channel and keeps register A for her measurement described by the POVM M A = {M A x = |x x| : x ∈ {0, 1, 2, 3}}. The quantum channel that maps register A to Bob's register B is described by a completely positive (CP) trace-preserving (TP) map, E A →B and is assumed to be under Eve's control. Thus, Alice and Bob's joint state ρ AB before their measurements is where id A is the identity channel on Alice's system A.
When Alice performs a local measurement using her POVM {M A x } on register A and obtains an outcome x, she effectively sends the coherent state |α x to Bob. Bob's received state ρ x B conditioned on Alice's choice of x is Bob applies his POVM M B = {M B y } to register B to obtain his measurement outcomes. In the case of untrusted detector noise (or ideal heterodyne detector), the POVM of the heterodyne detection is {E y = 1 π |y y| : y ∈ C}, where |y denotes a coherent state with complex amplitude y.

Key rate optimization
The next step is to formulate the key rate optimization problem for the entanglement-based scheme. One can rewrite the well-known Devetak-Winter formula [42] into the following form [34,35] where δ EC is the actual amount of information leakage per signal pulse in the error-correction step, D(ρ||σ) = Tr(ρ log 2 ρ)−Tr(ρ log 2 σ) is the quantum relative entropy between two (subnormalized) density operators ρ and σ, G is a CP, trace non-increasing map for post-processing and Z is a pinching quantum channel for accessing results of the key map. The set S contains all density operators compatible with experimental observations. A more detailed discussion about the map G can be found in Appendix A of Ref. [29]. For the reverse reconciliation scheme, we can express the cost of error correction δ EC by where H(Z) is the Shannon entropy of the raw key Z, β is the reconciliation efficiency of the chosen error-correction code, and I(X; Z) is the classical mutual information between X and Z. Before we review the set of constraints as well as G and Z maps for the quadrature phase-shift keying scheme, we start with basic definitions. Given the annihilation operatorâ and creation operatorâ † of a single-mode state with the usual commutation relation [â,â † ] = 1, we define the quadrature operatorsq andp, respectively, aŝ They obey the commutation relation [q,p] = i1. To utilize the second-moment observations q 2 and p 2 to constrain ρ AB , we previously defined the following two operatorsn = 1 2 (q 2 +p 2 −1) =â †â andd =q 2 −p 2 =â 2 +(â † ) 2 [29]. The relation between these observables and the heterodyne detection POVM is highlighted in Sec. IV A. For the untrusted detector noise (or ideal heterodyne detector) scenario, the key rate optimization problem [29] is Tr[ρ AB ] = 1, where the index x runs over the set {0, 1, 2, 3} and q x , p x , n x , and d x denote the corresponding expectation values of operatorsq,p,n, andd for the conditional state ρ x B , respectively. As indicated in Fig. 1, the protocol can perform postselection of data. To perform postselection, we defined the region operators as r re iθ re iθ dθ dr (9) for j ∈ {0, 1, 2, 3}. The area of integration for each operator corresponds to a region shown in Fig. 1.
The postprocessing map G in the reverse reconciliation scheme is given by G(σ) = KσK † for any input state σ, where the Kraus operator K is The pinching quantum channel Z is given by projections {|j j| R ⊗ 1 AB : j ∈ {0, 1, 2, 3}} as

III. NOISY HETERODYNE DETECTION
In this section, we present our physical model for a noisy heterodyne detector and give the corresponding POVM description. We start with a general situation and then make a simplification for the ease of calculation.
A. Trusted detector noise model As a heterodyne detector consists of two homodyne detectors and a beam splitter, we consider imperfections in each homodyne detector. A homodyne detector may have non-unity detector efficiency and also have some amount of electronic noise which is the additional noise introduced to the measured data by its electronic components. In an experiment, one is able to obtain the amount of electronic noise and the value of detector efficiency by a calibration routine. To model a realistic homodyne detector with non-unity detector efficiency and some amount of electronic noise, we use a quantum optical model which is used in Refs. [10,30,33], although the source of this electronic noise is in the actual electronics part. An alternative view of the electronic noise is that we can think about the detector as being a perfect detector followed by some classical postprocessing of the data, which adds noise. One should note that in a trusted device scenario, the characterization of the actual noise should be experimentally verified. Our physical model is chosen for convenience of calculating the POVM. We depict this physical model of a noisy heterodyne detector in Fig. 2 and in this diagram, we consider the general case of non-identical detectors since these two homodyne detectors used in an experiment may have different imperfections. We label the efficiency of the homodyne detector used for q-quadrature measurement as η 1 and its electronic noise as ν 1 . Similarly, the efficiency of the homodyne detector used for p-quadrature measurement is labeled as η 2 and its electronic noise is labeled as ν 2 . As our treatment for both homodyne detectors in this heterodyne setup is identical, we take one homodyne detector as an example and we treat the other one similarly by using its corresponding efficiency and electronic noise. To model an imperfect homodyne detector with its efficiency η 1 and electronic noise ν 1 , we insert a beam splitter before a perfect homodyne detector. The ratio of transmission to reflection of this beam splitter is η 1 : 1−η 1 . One input port of this beam splitter is the signal pulse and the other input port is a thermal state used to model electronic noise, which is equivalent to sending one mode of the EPR state to the beam splitter. To relate this thermal state to the amount of electronic noise ν 1 , the variance of each quadrature for the thermal state is the mean photon number of this thermal state.
In later sections, we choose to consider a simplified scenario where these two homodyne detectors are identical for the purpose of illustration and the ease of numerical calculation. That is, they both have the same detector efficiency η 1 = η 2 = η d and the same electronic noise ν 1 = ν 2 = ν el . The homodyne detector for the q-quadrature measurement has detector efficiency η1 and electronic noise ν1. The homodyne detector for the p-quadrature measurement has detector efficiency η2 and electronic noise ν2. The notation ρ th (n) stands for a thermal state with a mean photon numbern.
. Beam splitters are 50:50 unless specified otherwise. Each homodyne detector inside a gray box is ideal. LO stands for local oscillator.

B. POVM description
When two homodyne detectors give two real numbers q and p for quadrature measurements, we label the outcome as y = q + ip. We use the Wigner function formulation to find the POVM {G y : y ∈ C} corresponding to this noisy heterodyne detector model. By considering Tr(G y ρ) for an arbitrary input density operator ρ to the noisy heterodyne detector, we are able to find the Wigner function W Gy of the POVM element G y as The full derivation is shown in Appendix A.
As we later need to perform the numerical key rate optimization and impose the same photon-number cutoff assumption [29], we need to obtain a photon-number basis representation of G y . In principle, one may use the Wigner function description of |n m| to find m| G y |n given the Wigner function of G y in Eq. (12). To ease our calculation, we consider a simpler case where we treat two homodyne components as identical, that is, we set η 1 = η 2 = η d and ν 1 = ν 2 = ν el in Eq. (12) and it is simplified to be The reason for this simplification is that instead of performing numerical integration to find the matrix elements of G y and operators defined in terms of G y , we are able to obtain an analytical (more efficiently computable) expression for each such operator. Since this Wigner function in this simpler case is that of a displaced thermal state up to a prefactor 1/(η d π), we see this POVM element is a scaled projection onto a displaced thermal state. More precisely, , which can be expressed in the photon-number basis as Analytical expressions of matrix elements m| G y |n are known in the literature [43] and shown in Appendix B. Let us add a few remarks about this simplification. In the case of non-identical homodyne detectors in an experimental setup, one may choose to apply our simplified analysis [that is, using the POVM in Eq. (14)] by setting the value of η d as max(η 1 , η 2 ) and the value of ν el as min(ν 1 , ν 2 ). The additional loss and noise are then attributed to Eve. This simplification can produce almost tight key rates as long as the differences between two homodyne detectors are sufficiently small. Alternatively, one may choose to use the expression of G y in the general case whose Wigner function is given in Eq. (12) and obtain the matrix elements G y via numerical integration. We emphasize that the principles presented in this work also hold for the general case and we choose to present results based on this simpler case for the ease of calculation.

IV. KEY RATE OPTIMIZATION PROBLEM
We start with a reformulation of the optimization problem in Eq. (8) in the untrusted detector noise scenario which serves as a basis for our modification in the trusted detector noise scenario. The purpose of this reformulation is that once we substitute the POVM of the noisy heterodyne detector in place of the one for the ideal heterodyne detector, we can easily formulate the optimization problem in the trusted detector noise scenario. Specifically, we change Bob's POVM {M B y } from the ideal heterodyne detection {E y = 1 π |y y|} to the POVM description of the noisy heterodyne detection G y found in Eq. (14). Moreover, some constraints are modified to match with how data are processed in a typical experiment.
A. Reformulation of the optimization problem in the untrusted detector noise scenario We reconsider the key rate optimization problem in the untrusted detector noise scenario by rewriting region operators in Eq. (9) and observables in Eq. (8) in terms of the POVM of an ideal heterodyne detector {E y }. In the case of ideal heterodyne detection, the POVM description of Bob's measurement {M B y } is M B y = E y = 1 π |y y|, the projection onto a coherent state |y . By writing y = re iθ in the polar coordinate and integrating over the corresponding region A j , we obtain Eq. (9). If we rewrite Eq. (9) in terms of M B y , we see region operators R j 's are defined by where the region of integration A j in the complex plane is shown in Fig. 1 and From the heterodyne detection, we obtain a probability density function P (y) for the outcome y ∈ C. (We obtain such a probability density function for each conditional state ρ x B . While it is more proper to denote this conditional probability density function as P (y|x), for simplicity of notation in this section, we use P (y).) When the heterodyne detector is ideal, this probability density function is the Husimi Q function. In particular, as discussed in our previous work [29], the expectation values of operatorsq,p,n andd defined in Sec. II B are related to the Q function via where the subscript x labels the conditional state ρ x B . In general, one may be interested in a quantity like f (y, y * )P (y)d 2 y where f (y, y * ) is a real-valued function on y and y * such that the integral converges. Such a quantity can be described as the expectation value of an observable that is defined in the following waŷ since Tr ρÔ = d 2 y f (y, y * ) Tr ρM B y = d 2 y f (y, y * )P (y).
By comparing Eq. (19) to Eq. (17) and identifying P (y) by Q x (y), we observe the following choices of f (y, y * ) for q,p,n andd:q We remark that this way of defining these observables corresponds to the antinormally ordered expansion of operators [44,45].

B. Revised optimization problem in the trusted detector noise scenario
In the trusted detector noise scenario, we can define observables in a similar way as in the untrusted detector scenario. In this case, we need to substitute M B y in Eqs. (16) and (18) by G y . For the first-moment observables, we continue to use f (y, y * ) = y+y * √ 2 = Re(y) and f (y, y * ) = i(y * −y * ) √ 2 = Im(y). However, for the second-moment observables, we consider operators associated with f (y, y * ) = ( y+y * √ 2 ) 2 = Re(y) 2 and with f (y, y * ) = ( i(y * −y) √ 2 ) 2 = Im(y) 2 in an agreement with the actual classical postprocessing in a typical experiment. That is, in a typical experiment, when a heterodyne detection gives two numbers q and p which we set Re(y) = q and Im(y) = p, one usually computes variances of Re(y) and Im(y) by computing the expectation values of Re(y) 2 and Im(y) 2 in addition to expectation values of Re(y) and Im(y). By using those choices of f (y, y * ) in Eq. (18), operators constructed in this way correspond to expectation values f (y, y * )P (y)d 2 y in a typical experiment, where P (y) is the underlying probability density function corresponding to the experimental data. (Due to our definition of quadrature operators, we include the factor √ 2 so that we can simply enter values reported in an experiment using shot noise units as expectation values of corresponding observables.) To distinguish operators defined in this way from firstand second-moment of quadrature operatorsq andp, we shall call first-moment observables asF Q andF P and second-moment observables asŜ Q andŜ P . They are de-fined asF Then the revised key rate optimization problem becomes where the index x runs over the set {0, 1, 2, 3}.
In Appendix B, we discuss how to represent these operators in the photon-number basis. Combining with the photon-number cutoff assumption (i.e. ρ AB = (1 A ⊗ Π N )ρ AB (1 A ⊗ Π N ), where N is the cutoff photon number and Π N is the projection onto the subspace spanned by the photon-number states from 0 to N photons), we can directly solve this key rate optimization problem in Eq. (22) numerically. We direct readers to Sec. IV B of Ref. [29] for the discussion about the numerical algorithm for the optimization problem and its performance.

V. SIMULATION METHOD
In an experiment, the expectation values shown in the optimization problem in Eq. (22) can be obtained from some suitable post-processing of noisy heterodyne detection results. Without doing experiments, we perform simulations of a corresponding experiment with a noisy heterodyne detector to obtain those expectation values.
With these values specified, one can solve the key rate optimization problem using a numerical convex optimization package to obtain numerical results. We emphasize that our security proof technique does not depend on the specific channel model used for the simulation.

A. Channel model for simulation
To understand how the protocol behaves in the trusted detector noise scenario, we simulate the quantum channel by using a realistic physical channel in an honest implementation of the protocol. A realistic physical channel in the context of the optical fiber communication can be modeled by a phase-invariant Gaussian channel with the transmittance η t and excess noise ξ. In a typical fiber for optical communication, the attenuation coefficient is 0.2 dB/km and thus η t = 10 −0.02L for a distance L in kilometers. The excess noise ξ is defined as where (∆q vac ) 2 is the variance in q-quadrature of the vacuum state and (∆q obs ) 2 is the observed variance in q-quadrature of the measured signal state. With our definition of quadrature operators, (∆q vac ) 2 = 1 2 . As the value of ξ is normalized with respect to the vacuum variance, the value of ξ is reported in the shot noise units (SNU) and independent of different conventions of defining quadrature operators.
Apart from the shot noise, there are several contributions to the total noise in the measurement data such as preparation noise, detector noise and noises introduced in the fiber due to Raman scattering. As we treat the detection noise as trusted, we assume all other contributions are under Eve's control. In other words, all additional noises beyond the shot noise except the detector noise become a part of the effective quantum channel regardless of the physical origin of each noise component, and they contribute to the value of the excess noise ξ. In the literature, the value of the excess noise ξ is commonly reported at the input of the quantum channel corresponding to measuring (∆q obs ) 2 at the output of Alice's lab. By choosing this convention of reporting the value of excess noise, we may alternatively imagine that this effective quantum channel first introduces the amount of excess noise ξ to the signal state at the input of the channel and the rest of this quantum channel is then lossy but noise-free. Under this channel model, a coherent state |α , after transmitting through this quantum channel, becomes a displaced thermal state centered at √ η t α with its variance 1 2 (1 + η t ξ) for each quadrature.

B. Simulated statistics
From our simulation, the simulated state σ x B conditioned on the choice of x is a displaced thermal state whose Wigner function is .
When Bob applies his heterodyne measurement described by the POVM {G y }, the probability density function P (y|x) for the measurement outcome y conditioned on Alice's choice x is The observables defined in Eq. (21) have the following expectation values from the simulation:

C. Estimation of error correction cost
We estimate the cost of error correction from the simulated statistics. From the probability density function P (y|x) shown in Eq. (25), we can obtain the joint probability distribution P (x, z) for Alice's choice X = x and Bob's discretized key value Z = z by the following integral Since P (x) = p x = 1 4 , we then obtain the joint probability distribution P (x, z) = P (z|x) P (x). Using the definition of I(X; Z) in terms of P (x, z), we can approximate the cost of error correction by Eq. (6) for the reverse reconciliation scheme considered in this work. When ∆ a is not zero, that is, in the presence of postselection, the sifting factor p pass is the sum of P (x, z) over x, z ∈ {0, 1, 2, 3}. We then renormalize the probability distribution before plugging it in the definition of I(X; Z).

VI. KEY RATE IN THE ABSENCE OF POSTSELECTION
In this section, we present results when no postselection is performed, that is, ∆ a = 0. We make two comparisons. The first one is to compare key rates in the trusted and untrusted detector noise scenarios. The second one is to analyze how different imperfections in detectors affect key rates in the trusted detector noise scenario.

A. Comparison between trusted and untrusted detector noise scenarios
For this comparison, we supply the same set of simulated data from Eq. (26) to the optimization problem for the untrusted detector noise scenario in Eq. (8) and the one for the trusted detector noise scenario in Eq. (22). For simulation, we choose parameters η d = 0.719, ν el = 0.01 from [13] for illustration. The result is shown in Fig. 3. Secure key rate versus the transmission distance for untrusted detector noise (black diamonds) and trusted detector noise (red stars) scenarios. The excess noise is ξ = 0.01 at the input of the quantum channel. Parameters for detector are η d = 0.719, ν el = 0.01 [13]. The coherent state amplitude is optimized via a coarse-grained search over the interval [0.5, 0.9] with a step size of 0.05 and the channel transmittance is ηt = 10 −0.02L for each distance L in kilometers. The effective channel excess noise in the untrusted detector scenario is shown with the y-axis on the right. At 20 km, the effective channel excess noise ξ eff is roughly 0.045.
As we can see from this figure, the key rate of the untrusted detector noise scenario drops quickly at a short distance less than 20 km even though the electronic noise is only 0.01 SNU, which is a low value compared to detectors used in many other CV experiments. On the other hand, the key rate in the trusted detector noise scenario extends to much longer distances, which exhibits a similar behavior as the results shown in Ref. [29] when the detector is treated as ideal. One explanation for this behavior is that in Ref. [29], we have observed that the key rate for the QPSK scheme drops quickly when the channel excess noise ξ is large. Since the value of ξ is reported at the input of the quantum channel while the value of ν el is measured at Bob's side, to treat ν el as a part of channel excess noise in the untrusted detector noise scenario, one needs to define the effective value of ξ to include the value of ν el . For the effective value ξ eff , the electronic noise ν el needs to be scaled by a factor of 1/η t (in addition to 1/η d ), which is large for slightly long distances as η t becomes small. As a result, the redefined value ξ eff of ξ is quite large as shown in Fig. 3 and this behavior of key rate is then expected. By the observa-tion made from this figure, it is not surprised that for a larger value of electronic noise, the key rate in the untrusted detector noise scenario would drop to zero at an even shorter distance.

B. Detector imperfection in the trusted detector noise scenario
To guide the experimental implementation of the QPSK scheme, we may be interested in the robustness of the protocol in the presence of detector inefficiency and electronic noise in the trusted detector noise scenario. For this purpose, we investigate the effects of different levels of detector efficiency and electronic noise on the key rate. For curves in Figs. 4 and 5, our simulation uses the same channel model but different detector imperfections, that is, in Eq. (26), the same values of channel parameters η t and ξ but different values of detector efficiency η d and electronic noise ν el (as specified in the captions) for different curves.
In Fig. 4, we choose values of η d and ν el for a homodyne detector from two experiments [11,13] and compare these results with the ideal detector. For the comparison, we optimize α via a coarse-grained search for each distance. We see that with a noisy heterodyne detector, the key rate drops moderately from the key rate of using an ideal detector. The amount of decrease is like a constant prefactor in the key rate. As the detector is nosier, the key rate becomes lower as expected. Secure key rate versus transmission distance for different detector imperfections reported in experiments in a comparison to the ideal detector. Other parameters are the excess noise ξ = 0.01, error-correction efficiency β = 0.95 and the transmittance ηt = 10 −0.02L for each distance L in kilometers. For each distance, the coherent state amplitude α is optimized via a coarse-grained search in the interval [0.5, 0.9] with a step size of 0.05. Black curve with diamond markers is for the ideal heterodyne detector; red curve with star markers is for the detector used in Ref. [13]; Cyan curve with square markers is for the detector used in Ref. [11].
To show that different values of electronic noise have little impacts on the secure key rates in the trusted noise scenario, we compare key rates with two choices of the electronic noise value in Fig. 5a while we fix the value of detector efficiency η d to be 0.7. As the key rate difference is relatively small between the curve with ν el = 0.05 and that with ν el = 0.08, we also plot the difference of key rate (that is, the key rate with ν el = 0.05 minus the key rate with ν el = 0.08) in the same figure. (Note that the non-smoothness in the curve of difference is due to the coarse-grained search for the coherent state amplitude in the presence of the numerical performance issue discussed in Ref. [29].) We observe that when the electronic noise is trusted, its impact on the secure key rates is insignificant. This result eases the requirements of a detector in a CVQKD experiment with the QPSK scheme. Similarly, we investigate the effects of detector efficiency in Fig. 5b. In particular, we fix the value of electronic noise ν el to be 0.05 SNU and plot four choices of detector efficiency between 0.5 and 0.8. We see the key rate curves are close to each other.
In Fig. 6, we investigate the tradeoff between trusting the detector efficiency and lumping it together with the channel transmittance, similar to a scenario studied in Ref. [46] for discrete-variable systems. For the fixed amount of total transmittance η := η t η d , it is interesting to see how trusting different values of detector efficiency affects the key rate. We observe that when the value of the product of channel transmittance η t and detector efficiency η d is fixed, if the detector efficiency η d is lower, meaning that the more contribution to the total transmittance η is trusted, then the key rate is higher. This observation is similar to the observation made for discrete-variable systems in Ref. [46].
To summarize, in a discrete modulation experiment, if one is able to obtain accurate values of η d and ν el by a suitable calibration procedure and able to maintain a low level of the effective channel excess noise ξ to a value like 0.01, then the QPSK scheme is able to extend to a distance beyond 100 km in the asymptotic regime. We remark that the optimal amplitude for the QPSK scheme in the trusted detector noise scenario is around 0.75 corresponding to a mean photon number of around 0.56, similar to the optimal amplitude in the ideal or untrusted detector noise scenario reported in our previous work [29]. This mean photon number is much lower than that for Gaussian modulation schemes.

VII. KEY RATE WITH POSTSELECTION
In this section, we investigate the effects of postselection in the trusted detector noise scenario. As demonstrated in our previous analysis [29], postselection of data can improve the key rate of QPSK scheme in the untrusted detector noise scenario. Postselection is simple to implement in an experiment. It not only improves the key rate but also reduces the required volume of data postprocessing. Thus, it is advantageous to include a postselection step in the protocol. As expected, we show here that this advantage also exists in the trusted detector noise scenario.
In Fig. 7, we search for the optimal postselection parameter for different transmission distances and take the distances L = 50 km and L = 75 km as examples. For this figure, we also optimize the choice of coherent state amplitude via a coarse-grained search. The x-axis in each plot is the postselection parameter ∆ a . We observe the optimal value of the postselection parameter ∆ a is around 0.6 for both L = 50 km and L = 75 km. We also observe that the optimal choice of the postselection parameter ∆ a does not change significantly for different distances.
In Fig. 8, we show the key rate as a function of transmission distance for two scenarios: with or without postselection. Since the optimal postselection parameter does not change significantly for different distances, we opti- mize the postselection parameter ∆ a via a coarse-grained search in a restricted interval. For this figure, we fix the coherent state amplitude to be 0.75 and the channel excess noise ξ to be 0.01. We see postselection can indeed improve the key rate. The percentage of improvement compared to the key rate without postselection is roughly between 5% to 8% and the probability of being postselected is around 70% to 80%. Thus, postselection can reduce the amount of data for postprocessing by around 20% to 30% while improving the key rate.
We end this section with a remark on the postselection pattern. The postselection pattern (see Fig. 1) studied in this work is a simple, intuitive and convenient choice when we evaluate the region operators. However, it is not necessarily the optimal way to postselect data [7,47]. It is an interesting future work to investigate other patterns of postselection.

VIII. SUMMARY AND FUTURE DIRECTIONS
We have provided a method to analyze the asymptotic security of a discrete modulation scheme of CVQKD in the trusted detector noise scenario where both non-unity detector efficiency and electronic noise are trusted. In particular, we find the POVM elements corresponding to a noisy heterodyne detector. As we demonstrate our method on the quadrature phase-shift keying scheme, we show that when the detector imperfection is trusted, the key rates are similar to the one with the ideal heterodyne detector studied previously [29]. Our new analysis eases the requirements of an experimental implementation of the discrete modulation scheme as the detector imperfection is usually a major source of noise.
We point out the limitations in the current work. First, the analysis in this work is still restricted to the asymptotic scenario. As we recently extend the underlying numerical method used in this security analysis to finite-key regime [36], we hope to perform the finite key analysis for this protocol. However, there remains technical challenges to solve before such an analysis can be carried out and thus we leave the finite key analysis for future work. The second limitation is the same photon-number cutoff assumption used in Refs. [28,29]. While numerical evidences show that our results are stable when the cutoff photon number is chosen appropriately, we would like to have a more rigorous analysis on the effects of truncation in future work. Third, for the ease of calculation, we give the POVM elements of a noisy heterodyne detector in a simple scenario where two homodyne components are treated as identical. However, our principles presented in this paper work for the general case where two detectors are not identical. To handle the general case, one may choose to find the matrix elements m| G y |n by numerical integration. One concern is that since observables are defined in terms of integration of G y , it may become numerically challenging to perform several integrals at the same time. Alternatively, one may first find a way to simplify the expression analytically similar to what we have done for the simple case. In an experiment, if two homodyne detectors in the heterodyne detection scheme can be chosen to be as similar as possible, we expect that the analysis in this simple case can produce reasonably tight key rates. Nevertheless, the analysis in the general case is still useful to improve the key rates in this scenario. However, if two detectors used in an experiment have quite different imperfections, we then have to use the noisy heterodyne detector POVM without the aforementioned simplification. It remains as a technical question to efficiently compute the matrix elements of this POVM in the photon-number basis, which we expect can be solved. Nevertheless, this current limitation does not affect the principles and methodology we present in this work about the treatment of trusted detector noise. It is also expected that observations in the general case will be similar to observations we have made here in the simple case.
Finally, we remark on the generality of our method of treating trusted detector noise. If a different physical model of a detector is adopted (which needs to be verified experimentally), we expect that a similar method as described here can be used to find a correct POVM description for the given physical model and then this POVM can be used in the security analysis. As we use the Wigner function approach for our derivation, we recall useful expressions from Ref. [48] for later references.
To calculate Tr(F G) for two operators F and G in terms of their Wigner functions W F and W G , the overlap formula is We can easily generalize the formula to the multi-mode case. The input-output Wigner functions under a beam splitter transformation whose transmittance is η are related by We list Wigner functions for some important quantum states below. The Wigner function of a vacuum state |0 is The Wigner function of a displaced thermal statê D(α)ρ th (n)D † (α) with the thermal state's mean photon numbern before the displacement and the amount of displacement α is If we set α = 0, it reduces to the Wigner function of a thermal state ρ th (n) with a mean photon numbern:

Derivation
As the physical model of a noisy heterodyne detector is presented in Fig. 2, our goal here is to find the corresponding POVM elements that correctly produce the probability density function P (y) of obtaining an outcome y ∈ C for an arbitrary input state ρ to the detector. In our trusted noise model, the homodyne detector for the q-quadrature measurement has its detector efficiency η 1 and electronic noise ν 1 which is related to a thermal state of the mean photon numbern 1 = ν1 2(1−η1) . Similarly, the homodyne detector for the p-quadrature measurement has its detector efficiency η 2 and electronic noise ν 2 which corresponds to a thermal state with the mean photon numbern 2 = v2 2(1−η2) . Fig. 9 shows a compact but equivalent representation of Fig. 2 with Wigner functions associated to input modes. In this setup, for an output state W out (α, β, γ, ω) at the step labeled in Fig. 9, we measure the q-quadrature of the mode α and p-quadrature of the mode β with two ideal homodyne detectors, and discard the rest modes γ and ω. The Wigner function of an ideal homodyne detector for the q-quadrature measurement that produces a measurement outcome Re(y) is where δ is the Dirac delta function and similarly, the one for the p-quadrature measurement with a measurement outcome Im(y) is W H Im(y) (α) = δ(Im(α) − Im(y) √ 2 ). The factor √ 2 is included such that we can rederive the ideal heterodyne detector POVM {E y } in the limit of unity detector efficiency and zero electronic noise. To discard modes γ and ω that are not measured, we perform the integration over variables γ and ω.
For any input state ρ to the detector, one can in principle obtain the underlying probability density function P (y) = Tr(ρG y ) for every measurement outcome y ∈ C. As the correct POVM element G y needs to produce the observed probability density function P (y) = Tr(ρG y ), this requirement in terms of Wigner functions becomes P (y) = π d 2 αW ρ (α)W Gy (α), where W ρ is the Wigner function of the input state ρ and W Gy is the Wigner function of the operator G y , by the overlap formula in Eq. (A1). In Fig. 9, we know the mathematical description of measurements on the right, but the description of the state W out is unknown. On the other hand, we want to find the description of the measurement directly acting on the input state and the Wigner function description of the input state and those of ancillary modes on the left are either assumed to be given or known. To connect these known descriptions on the two sides of this diagram to find the desired Wigner function of the POVM element G y that acts on the input state directly, we start from the right hand side of this diagram with an unknown four-mode state W out and the known measurements on these modes, perform inverse beam splitter transforma-tions from right to left of this diagram and finally obtain W Gy by integrating over variables other than α. By start-ing with the multi-mode overlap formula for P (y) on the right-hand side of the diagram and performing the process as described, we obtain The next step is to substitute the Wigner function of the vacuum state in Eq. (A3) and that of the displaced thermal state in Eq. (A5) and then to perform the integrals over variables β, γ and ω. We first integrate over the variable ω.
The relevant integral that involves the variable ω is . (A7) Next, we perform the integral related to the variable γ. Since Eq. (A7) does not involve the variable γ, we do not need to plug it back to solve the integral that involves the variable γ. This integration shown in Eq. (A8) is actually similar to the integration that we just did in Eq. (A7).
(A8) Finally, we integrate over the variable β. We now need to substitute results of Eqs. (A7) and (A8) back to Eq. (A6). The prefactor is simplified to be 1 . Besides this prefactor, we perform the following integral Finally, by putting the prefactor back and expressing the final expression in a format of Gaussian functions, we obtain the following result By substituting inn 1 = ν1 2(1−η1) andn 2 = ν2 2(1−η2) , we derive Eq. (12) after a straightforward simplification.

APPENDIX B: Photon-number basis representation of operators
In this Appendix, we show how to represent region operators as well as observables needed for the optimization problem in Eq. (22) in the photon-number basis. By the same discussion in Appendix B of Ref. [29], under the photon-number cutoff assumption, we need only Π NÔ Π N for an operatorÔ with a cutoff photon number N . Thus, we are interested in finding the expression m|Ô |n for 0 ≤ m, n ≤ N for each relevant operatorÔ. In this Appendix, we restrict the discussion to the scenario where we set η 1 = η 2 = η d and ν 1 = ν 2 = ν el . The POVM element G y in the photon-number basis is expressed as [43] m| G y |n = 1 where we definen d = 1−η d +ν el η d for ease of writing and L (j) k (x) is the generalized Laguerre polynomial of degree k with a parameter j in the variable x. In particular, the diagonal entries are simplified to be where L k (x) = L (0) k (x) is the Laguerre polynomial of degree k in the variable x. For ease of writing later, we define C m,n = 1 πη

Region operators
Our goal here is to write region operators R j = y∈Aj G y d 2 y in the photon-number basis. For simplicity, we work out the expressions in the absence of postselection. To include the postselection, one may numerically integrate over the discarded region and subtract this result from the expression without postselection since this numerical integration is efficiently computable in MATLAB. We first consider off-diagonal elements (i.e. m = n). In this case, we plug the expression of m| G y |n in Eq. (B1) into the definition of R j in Eq. (16), write it in the polar coordinate with y = re iθ and perform the integration over the phase θ to obtain the following expressions.
We notice that the integral over r is a common integral in these four equations. We now perform this common integral to obtain the result in terms of Taylor series expansion of a simple function.
where Γ is the gamma function and f m (a, α, k) is defined as the Taylor series coefficients of the function below in the variable t as We note that the Taylor series coefficients here can be quickly found in MATLAB. Now, we consider the diagonal entries of R j (i.e. m = n). By substituting y = re iθ in Eq. (B2), we note that this expression does not depend on θ. Thus, it is easy to see n| R 0 |n = n| R 1 |n = n| R 2 |n = n| R 3 |n . The integration over the phase θ gives a factor of π 2 . We proceed the integration over variable r and obtain n| R j |n = π 2 1 η d π (B10) where the second term is efficiently computable numerically. The case for m = n follows similarly.

First-moment observables
We then proceed to evaluate the matrix elements ofF Q andF P . In the photon number basis, the matrix elements are (B11) AsF Q is a Hermitian operator, we can first find entries m|F Q |n for m ≤ n. Then for m > n, we simply set m|F Q |n to be the complex conjugate of n|F Q |m . From the integration over θ, the nonzero entries for m ≤ n are m|F Q |m + 1 = √ 2πC m,m+1 (B14) Again, sinceŜ Q andŜ P are Hermitian operators, we only need to define the upper triangular part and then set the lower triangular part using the Hermitian property. The relevant integrals are simplified to be m|Ŝ Q |m = 2πC m,m (B16)