Fundamental limitations to key distillation from Gaussian states with Gaussian operations

We establish fundamental upper bounds on the amount of secret key that can be extracted from quantum Gaussian states by using only local Gaussian operations, local classical processing, and public communication. For one-way public communication, or when two-way public communication is allowed but Alice and Bob first perform destructive local Gaussian measurements, we prove that the key is bounded by the R\'enyi-$2$ Gaussian entanglement of formation $E_{F,2}^{\mathrm{\scriptscriptstyle G}}$. Since the inequality is saturated for pure Gaussian states, this yields an operational interpretation of the R\'enyi-$2$ entropy of entanglement as the secret key rate of pure Gaussian states that is accessible with Gaussian operations and one-way communication. In the general setting of two-way communication and arbitrary interactive protocols, we argue that $2 E_{F,2}^{\mathrm{\scriptscriptstyle G}}$ is still an upper bound on the extractable key. We conjecture that the factor of $2$ is spurious, which would imply that $E_{F,2}^{\mathrm{\scriptscriptstyle G}}$ coincides with the secret key rate of Gaussian states under Gaussian measurements and two-way public communication. We use these results to prove a gap between the secret key rates obtainable with arbitrary versus Gaussian operations. Such a gap is observed for states produced by sending one half of a two-mode squeezed vacuum through a pure loss channel, in the regime of sufficiently low squeezing or sufficiently high transmissivity. Finally, for a wide class of Gaussian states that includes all two-mode states, we prove a recently proposed conjecture on the equality between $E_{F,2}^{\mathrm{\scriptscriptstyle G}}$ and the Gaussian intrinsic entanglement. The unified entanglement quantifier emerging from such an equality is then endowed with a direct operational interpretation as the value of a quantum teleportation game.


I. INTRODUCTION
Quantum entanglement enables distant parties to generate a shared secret key by employing public discussion only [1][2][3], a feat impossible in the classical setting [4,5] without additional assumptions on the information available to the eavesdropper [5][6][7][8][9].In the last decades, quantum key distribution (QKD) has established itself as a fundamental primitive in quantum cryptography, thus gaining a central role in the flourishing quantum information science and technology [10].Accordingly, the amount of secret key that can be extracted from a state is regarded as an entanglement measure of fundamental operational importance [11][12][13][14].
In this paper, we investigate the operational effectiveness of the all-Gaussian framework in the context of QKD, establishing ultimate limitations on the amount of secret key that can be extracted from arbitrary multi-mode Gaussian states by means of local Gaussian operations, local classical processing, and public communication -a quantity that we call Gaussian secret key.The fact that the initial state is Gaussian and that the available quantum operations are Gaussian does not mean that the state will be Gaussian at all stages of the protocol, essentially because local classical operations are entirely unrestricted.For example, Alice could decide to apply a random displacement to her system (say, either +s or −s, with equal probabilities), making the resulting state non-Gaussian.
In a nutshell we prove that, while key distillation is indeed possible in the Gaussian setting, it is not as efficient as it could be if also non-Gaussian measurements were allowed.Our bounds are given in terms of a Gaussian entanglement measure known as the Rényi-2 Gaussian entanglement of formation (denoted E G F,2 ) [63][64][65][66][67][68], and thus endow this quantity with a sound operational meaning.In this context, after formalizing basic definitions on CV systems (Section II) and Gaussian key distillation protocols (Section III), we establish three main results in Section IV.
First, if only one-way public communication is allowed then the Gaussian secret key is at most E G F,2 , with the inequality saturated for pure Gaussian states (Theorem 4).Secondly, we argue that the Gaussian secret key is anyway limited by 2E G  F,2 even in the most general setting where we allow twoway public communication (Theorem 5).Lastly, we show that the upper bound E G F,2 -without the factor 2 -still holds even for two-way public communication, provided that Alice and Bob start the protocol with destructive Gaussian measurements (Theorem 6).
The Rényi-2 Gaussian entanglement of formation E G F,2 is a monogamous and additive Gaussian entanglement monotone enjoying a wealth of properties [65][66][67][68].Moreover, its computation amounts to a simple single-letter optimisation problem that is analytically solvable for all two-mode mixed states [63,64].Instrumental to our approach is the study of the connection between E G F,2 and another Gaussian entanglement measure known as the Gaussian intrinsic entanglement (denoted E G ↓ ) [69][70][71].In Section V we prove that holds for all multi-mode Gaussian states and, more remarkably, we establish the recently conjectured [69] equality F,2 for the vast class of 'normal' Gaussian states, which include in particular all two-mode Gaussian states (Theorem 7).
In Section VI we explore further applications and interpretations of our results.In particular, in the one-way communication scenario we show that E G F,2 is often smaller than the one-way distillable entanglement on the physically relevant class of states obtained by sending one half of a two-mode squeezed vacuum across a pure loss channel, entailing that restricting to Gaussian operations leads to a decrease of distillable key.We also provide a general operational interpretation for E G F,2 in a game-theoretical context based on quantum teleportation in the presence of a malicious jammer.We present our concluding remarks in Section VII.

II. CONTINUOUS VARIABLE BASICS
We start by recalling the formalism of CV Gaussian states and measurements [23,38,39,72]; see Appendix A for further details.

A. Phase space representations
For a CV system made of m harmonic oscillators (modes), the displacement operator associated with a vector ξ ∈ R 2m is defined by [39, Section 3.1] D(ξ) e iξ ⊺ Ωr . (1) Note that D(ξ) is a unitary operator.Furthermore, for all ξ it holds that D(ξ) † = D(−ξ).The canonical commutation relations can be rewritten in the so-called Weyl form in terms of the displacement operators.They read [39,Eq. (3.11)] The characteristic function of an m-mode quantum state ρ is the function χ ρ : R 2m → C defined by [39,Section 4.3] χ ρ (ξ) Tr[ρD(−ξ)] . (3) Its Fourier transform is the Wigner function, in formula B. Gaussian states Let x j and p j (1 ≤ j ≤ m) be the canonical operators of an m-mode CV system, whose vacuum state we denote with |0⟩.Defining the vector r (x 1 , . . ., x m , p 1 , . . ., p m ) ⊺ , the canonical commutation relations can be written in matrix notation as [r, r ⊺ ] = iΩ, where A quadratic Hamiltonian is a self-adjoint operator of the form H q = 1 2 r ⊺ Kr + t ⊺ r, where K > 0 is a 2m × 2m real matrix, and t ∈ R 2m .Gaussian states are by definition thermal states of quadratic Hamiltonians (and limits thereof).They are uniquely defined by their mean or displacement vector, expressed as s Tr[ρ r] ∈ R 2m [73], and by their quantum covariance matrix (QCM), a 2m × 2m real symmetric matrix given by V Tr ρ {r − s, (r − s) ⊺ } .Physical QCMs V satisfy the Robertson-Schrödinger uncertainty principle hereafter referred to as bona fide condition [74], which implies V > 0 and det V ≥ 1.Any real matrix V that obeys the bona fide condition is the QCM of some Gaussian state, which is pure iff det V = 1.The Gaussian state with mean s and QCM V will be denoted by ρ G [V, s].Note that mean vectors and QCMs compose with direct sum under tensor products, The characteristic function as well as the Wigner function of Gaussian states are in fact Gaussian.More precisely, Note that W ρ G [V,s] is a Gaussian with mean s and covariance matrix V/2.In particular, the differential entropy where we used the notation If V is a QCM, then det V = m j=1 ν 2 j (V) is the squared product of the symplectic eigenvalues.Since these are no smaller than 1, we conclude that det V ≥ 1 and hence M(V) ≥ 0. Therefore, for all Gaussian states it holds that

C. Gaussian measurements
Quantum measurements are modelled by positive operatorvalued measures (POVM) E(dx) over a measure space X , with outcome probability distribution being p(dx Gaussian measurements over an m-mode system are defined by the POVM on the measure space X = R 2m , with the QCM Γ denoting the seed of the measurement.We will sometimes represent this as the quantum-classical channel where the vectors |x⟩ are formally orthonormal. 1  On a Gaussian state ρ G [V, s], the Gaussian measurement in (12) yields as outcome a random variable X ∈ R 2m whose probability density function reads [39,Section 5.4.4] In other words, X is normally distributed with mean s and covariance matrix (V + Γ)/2. 2 If the measured system A is part of a bipartite system AB initially in a Gaussian state ρ G [V AB , s AB ], the postmeasurement state on B conditioned on obtaining the outcome x is again Gaussian, has QCM given by the Schur complement and displacement vector that depends on V AB , s AB , and x as reported in [39,Section 5.4.5].Importantly, note that the postmeasurement state of Gaussian measurements depends on the measurement outcome only through its mean vector and not through its QCM: indeed, the expression (15) is independent of x.
1 For a mathematically rigorous notion of quantum-classical channel, see Barchielli and Lupieri [76] and also Holevo and Kuznetsova [77]. 2 The factor 1/2 depends on the different conventions chosen for QCMs and classical covariance matrices.For example, we have defined the first entry of the QCM of an m-mode state ρ with vanishing displacement vector to be which is twice the variance of the observable x 1 on ρ.
From the above interpretation of the expression (15) as the QCM of the reduced post-measurement state it immediately follows that V ′ B is also a QCM, i.e. it satisfies Moreover, one can also conclude that V ′ B must be pure if such are both V AB and Γ A .These important facts can also be established directly by exploiting the properties of Schur complements reviewed in Appendix A 3. 3The simplest unitary operations one can account for in the Gaussian formalism are so-called Gaussian unitaries, constructed as products of factors of the form e −iH q τ , with H q a quadratic Hamiltonian.For a Gaussian unitary U , the induced state transformation ρ → U ρU † becomes V → S VS ⊺ at the level of QCMs.Here S is a 2m × 2m symplectic matrix, satisfying S ΩS ⊺ = Ω.
A Gaussian measurement protocol on a CV system A conditioned on a random variable U is a procedure of the following form: (i) We append to A a single-mode ancilla R 1 in the vacuum state; conditioned on U, we apply a Gaussian unitary to AR 1 and perform a Gaussian measurement with seed Γ U 1 on the last m 1 modes of the resulting state (possibly, m 1 = 0), obtaining a random variable X 1 ∈ R 2m 1 .Note that both the Gaussian unitary and Γ U 1 may depend on U. The modes remaining after the measurement form a system that we denote with A 1 .(ii) We append to A 1 a single-mode ancilla R 2 in the vacuum state, and use X 1 together with U to decide on a Gaussian unitary to apply to A 1 R 2 and on a Gaussian measurement with seed Γ X 1 U 2 to carry out on the last m 2 -modes of the resulting state (possibly, m 2 = 0).(iii) We continue in this way, until after r rounds the protocol terminates.The output products are a random variable X = (X 1 , . . ., X r ) ∈ R 2 r i=1 m i (the measurement outcome) and a quantum system A r . 4

D. Gaussian entanglement measures
In this paper we will relate the secret key that can be distilled by means of Gaussian protocols to the quantum correlations contained in Gaussian states.In general, operationally motivated correlation quantifiers for quantum states are usually based on the von Neumann entropy which is the correct quantum generalisation of the Shannon entropy for classical random variables.Other Rényi-α en-tropies, given for α ≥ 1 by although mathematically important, are commonly thought not to have such a direct operational meaning.However, in the constrained Gaussian setting we study here our interest lies not in the correlations possessed by the state per se, but rather in that part of them that can be accessed by the local parties.Since we also assume that these are restricted to Gaussian measurements, we in fact want to look at the correlations displayed by the classical random variables that constitute the outcomes of those measurements.When the random variable X models the outcome of a Gaussian measurement with seed σ performed on the Gaussian state ρ G [V, s], its Shannon differential entropy, generally defined by the formula H(X) = − d 2n x p X (x) log 2 p X (x), takes the form (cf. ( 9)) This kind of expression, basically the log-determinant of a QCM, up to additive constants, resembles that appearing in the formula for the Rényi-2 entropy of the state, where M has already been defined in (10).Although (19) and (20) are not identical, they share the same functional form.Hence, in some sense it is the Rényi-2 entropy, and not the von Neumann entropy, that is connected to the Shannon entropy of the experimentally accessible measurement outcomes, when those measurements are also Gaussian.For this precise reason, one can expect the Rényi-2 entropy to play a role in quantifying those correlations of Gaussian states that can be extracted via Gaussian measurements [67].In fact, quantifiers based on the Rényi-2 entropy and their applications have been extensively investigated [65-67, 69, 78, 79].
Let us start by introducing a simple correlation quantifier known as the classical mutual information of the quantum state ρ [80,81].It is formally given by where M A , M B are measurements on A and B with outcomes being the classical random variables X and Y.When ρ AB = ρ G [V AB , s AB ] is Gaussian, and M A , M B are also restricted to be Gaussian measurements with seeds Γ A , Γ B , the maximal mutual information between the local outcomes becomes the Gaussian mutual information, given by [82] where the log-determinant mutual information of a bipartite QCM V AB is given by [67] Proving ( 22) using ( 14) and ( 19) is an elementary exercise that is left to the reader.Its solution rests upon the fact that the conditional mutual information is a balanced entropic expression, and hence the 'spurious' constant terms in (19) cancel out.While ( 22) is difficult to compute in general, it is known that [70,82,83] for all pure bipartite QCMs γ AB .We present a self-contained proof of this fact in Appendix A 4, Lemma 16.Note that the last equality simply follows from the fact that the local reductions of a pure state all have the same Rényi entropies.
Moving on from total correlations to entanglement, we can rely on (20) and (10) to form a version of the entanglement of formation called the Rényi-2 Gaussian entanglement of formation [65]: This quantity obeys several properties, most notably it is faithful and monogamous: for all QCMs V ABC , it holds that [66, Corollary 7] where we use colons to signify the partition we are referring to.When combined with the fact that it comes from a convex roof construction, this implies that E G F,2 is also additive [67, Corollary 17]: Incidentally, both (26) and (27) are easy corollaries of the identity [67, Theorem 15] where is the log-determinant conditional mutual information [67], and the infimum ranges over all extensions V ABC of V AB , i.e. over all QCMs V ABC such that Π AB V ABC Π ⊺ AB = V AB .Furthermore, the measure (25) is known to coincide [67] with a Gaussian version of the squashed entanglement [12,14,[84][85][86], and it can be analytically computed in a variety of cases of strong physical interest [63,64].
Following an entirely different path, a new entanglement quantifier for Gaussian states has been recently introduced [69][70][71].The Gaussian intrinsic entanglement E G ↓ (V AB ) of a bipartite Gaussian state with QCM V AB is defined as the minimal intrinsic information [9,11,[87][88][89][90][91][92][93] of the classical random variables obtained upon measuring it with Gaussian measurements, assuming that Eve holds a purification of it but her measurement and classical post-processing are also Gaussian.Denoting with γ ABE a purification of V AB , we get where Γ A , Γ B , and Γ E are arbitrary QCM on systems A, B, and E, respectively, and I M is defined in (29).It is an easy exercise to show that the objective function on the right-hand side of (30) coincides with the conditional mutual information of the triple of random variables generated by carrying out Gaussian measurements with seeds Γ A , Γ B , Γ E on the Gaussian state with QCM V ABE .In formula, ) .The proof of ( 31) is entirely analogous to that of (22).One can show that (30) does not depend on the choice of the purification γ ABE of V AB [69][70][71].In order to investigate the asymptotic setting, we will consider the regularisation of (30) as well, given by It is also worth noticing that (29) can be cast into the form of an unconditional log-determinant mutual information (23) with the help of Schur complements.Namely, by iteratively applying Schur's determinant factorisation formula (A16) one can easily verify that [67, Eq. ( 28)]

III. GAUSSIAN SECRET KEY DISTILLATION PROTOCOLS
We now consider a communication scenario where two separate parties, Alice and Bob, hold a large number n of copies of a bipartite state ρ AB and want to exploit them to generate a secret key by employing only Gaussian local operations and public communication (GLOPC).It is always understood that we grant them access to local randomness, modelled by random variables that are independent of everything else.
A generic GLOPC protocol can be formalised as a quantum-to-classical channel from the bipartite CV system AB to a set of classical alphabets KK ′ C (with K and K ′ finite and identical) controlled by Alice, Bob, and the eavesdropper Eve, respectively.Such a protocol will thus be composed of the following steps: (i) Alice performs a Gaussian measurement protocol on A conditioned on some local random variable U 1 .(ii) She uses the measurement outcome X 1 together with U 1 to prepare a message C 1 , which is sent to Bob and Eve.(iii) Bob performs a Gaussian measurement protocol on B conditioned on C 1 and on some other local random variable V 1 .He uses the measurement outcome Y 1 together with V 1 and C 1 to prepare a message C ′ 1 , which is sent to Alice and Eve.(iv) After 2r back-and-forth rounds the communication ceases.Alice uses her local random variables U 1 , . . ., U r , the measurement outcomes X 1 , . . ., X r , and Bob's messages C ′ 1 , . . ., C ′ r to prepare a random variable S stored in K, that is, her share of the secret key.Bob does the same with his local random variables V 1 , . . ., V r , his measurement outcomes Y 1 , . . ., Y r , and Alice's messages C 1 , . . ., C r , generating his share of the key S ′ and storing it into K ′ .
In what follows, we will also consider two restricted classes of Gaussian protocols.First, the 1-GLOPC protocols, in which public communication is permitted only in one direction, say from Alice to Bob (see Figure 1).Second, the protocols that can be implemented with Gaussian local (destructive) measurements and public communication (GLMPC protocols); these start with Alice and Bob making preliminary Gaussian measurements on their entire local subsystems, and then processing only the obtained classical variables with the help of two-way public communication.
Unless otherwise specified, we will always assume that Eve has access to a purification of the initial quantum state of Alice and Bob and can intercept all publicly exchanged messages (denoted with C), storing them in her register C.

A. Distillable secret key
Generally speaking, we say that a number R > 0 is an achievable rate for secret key distillation from the state ρ AB with a class of protocols P if there exists transformations Λ n ∈ P taking as inputs states on A n B n and producing as outputs random variables S n , S ′ n , C n in classical registers K n K ′ n C n , with the range of S n , S ′ n being 1, . . ., 2 ⌈Rn⌉ , in such a way that [93] lim |ii⟩⟨ii| is an ideal secret key of length ⌈Rn⌉, and the minimisation is over all classical-quantum states ω C n E n .The meaning of ( 34) is that the key held by Alice and Bob is asymptotically decoupled from Eve's system, and is thus sufficiently secure to be used in applications [94].
Definition 1.The P-distillable secret key K P of the state ρ AB is the supremum of all rates achievable with protocols in P, K P (ρ AB ) sup R > 0 such that Eq. ( 34) holds.
In this paper we are naturally interested in the case where ρ AB is a Gaussian state with QCM V AB , and the considered protocols are either GLOPC, or 1-GLOPC, or GLMPC.The associated secret keys are easily seen to depend on V AB only; we will denote them with the shorthand notation ↔ (V AB ), respectively.A particularly useful upper bound on K P (V AB ) can be established by forcing Eve to apply a Gaussian measurement with pure seed of her choice before the beginning of the protocol, and to broadcast the obtained outcome to Alice and Bob together with the description of Γ E .From (15) we know that in this case the state that Alice and Bob share is Gaussian and has QCM where γ ABE is a purification of the QCM V AB .Since Alice and Bob also know Eve's measurement outcome, they can easily apply local displacements and have their state's mean vanish.
The protocols then proceed as detailed earlier in this Section.Note that Eve's measurement outcome is now independent of Alice and Bob's state and is thus useless.We summarise this discussion by giving the following definition.
Definition 2. For P ∈ {GLOPC, 1-GLOPC, GLMPC}, the modified P-distillable secret key associated with a Gaussian state with QCM V AB , denoted K where Q C n is an arbitrary probability distribution over the alphabet C n .
It should be clear that the new class of protocols in Definition 2 allows for a secret key distillation rate that is never smaller than that corresponding to the protocols in Definition 1, because in the former case Eve is forced to lose access to her quantum system at an early stage.We give a formal proof of this below.Lemma 3.For all P ∈ {GLOPC, 1-GLOPC, GLMPC} and all QCMs V AB , it holds that where K P (V AB ) and K P (V AB ) are given in Definitions 1 and 2, respectively.
Proof.Let R > 0 be an achievable rate for K P (V AB ).Construct a sequence of protocols n are two copies of an alphabet of size 2 ⌈Rn⌉ , and a sequence of states ω For a fixed n, consider an arbitrary QCM Γ E n .For a vector x ∈ F n R 2nm E , with m E being the number of modes of E, let p(x) denote the value on x of the probability density function of the outcome of the Gaussian measurement with seed Γ E n on Eve's share of the state ρ ⊗n ABE .Also, let be the displacement vector of the postmeasurement state on A n B n corresponding to the outcome x.
We now construct a modified protocol Λ ′ n : where the measurable space F n = R 2nm E pertains to Eve.To do this, we distinguish two separate cases.If P ∈ {GLOPC, 1-GLOPC}, then Λ ′ n proceeds as follows: (i) Alice draws a local random variable X on F n distributed according to p, applies to A n the displacement unitary D t X A n , and then continues with her (first) Gaussian measurement protocol as prescribed by Λ n .(ii) During the (first) round of communication, Alice sends to Bob and Eve not only the message originally prescribed by Λ n , but also the random variable X. (iii) Before continuing with his (first) Gaussian measurement protocol dictated by Λ n , Bob applies a displacement unitary D t X B n to his share of the system.(iv) The protocol continues with further communication rounds (if P = GLOPC) or directly with key generation (if P = 1-GLOPC) as prescribed by Λ n .
If instead P = GLMPC, the modified protocol Λ ′ n is even simpler: (i) Alice and Bob apply global Gaussian measurements to their entire subsystems as dictated by Λ n , obtaining measurement outcomes Z n and W n , respectively.(ii) Before preparing her first message for Bob, Alice draws a local random variable X on F n distributed according to p and translates Z n by t X A n .(iii) Alice then sends to Bob not only the message originally prescribed by Λ n , but also X. (iv) Before preparing his first message for Alice, Bob translates W n by t X B n .(v) The protocol continues with further communication rounds and then with key generation as prescribed by Λ n .
It is not too difficult to verify that in all three cases ) with the system F n storing X being on Eve's side.Let us now estimate the figure of merit in (36) for this protocol.We have that inf Here: in 1 we used (39); in 2 we let the displacement act on the Gaussian state and considered the ansatz which is nothing but the probability distribution obtained by making the Gaussian measurement with seed Γ E n on ω C n F n ; finally, 3 follows from the data processing inequality for the trace norm.Taking the supremum over , where we used (38).In light of Definition 2, this shows that R is also an achievable rate for K P (V AB ), concluding the proof.□

IV. BOUNDS TO GAUSSIAN SECRET KEY DISTILLATION
We now present our main results establishing fundamental upper bounds on the secret key that can be distilled by means of the Gaussian protocols introduced in Section III.To keep the presentation accessible, some auxiliary results and more technical derivations will be deferred to Appendices.

A. One-way public communication
As announced, our first result is a bound on the 1-GLOPC distillable secret key of an arbitrary Gaussian state.Theorem 4. For all QCMs V AB , it holds that Since the right-hand side of (40) does not depend on the direction of communication, (40) holds irrespectively of whether we consider Alice-to-Bob or Bob-to-Alice public communication, as long as we do not allow both.The protocol achieving (41) consists in the application of local homodyne measurements followed by a classical secret key distillation protocol [8,9].To prove (40), we will make use of the modified secret key K G → (V AB ) introduced in Definition 2 and establish the following chain of inequalities, , where the leftmost one follows from Lemma 3.
Proof.Let γ ABE be a purification of V AB , and let us consider a 1-GLOPC protocol applied on the corresponding Gaussian state.Let us look at the situation right before Bob's measurement (see Figure 1).Almost all 'quantumness' has disappeared, in the sense that the only party still holding a quantum state is Bob.From the point of view of Alice, who knows the value of U, the Gaussian measurement protocol she has applied in the first step, and the associated outcome X, Bob's state ρ B|U,X is Gaussian.
We now claim that this situation can be simulated by an entirely classical system.Namely, let W B be a random variable on the phase space R 2m B of Bob's system whose probability distribution conditioned on the values of U and X coincides with the Wigner function of ρ B|U,X , which is everywhere positive because ρ B|U,X is Gaussian.Noting that: (a) the vacuum itself has positive Wigner function; (b) any Gaussian unitary amounts to a linear transformation at the phase space level, and thus preserves the positivity of the Wigner function; and (c) the POVM elements describing Gaussian measurements also have positive Wigner function, by inspecting the defini-tion of Gaussian measurement protocol (Section II C) we see that step (iii) in Figure 1 can be simulated by purely classical operations on W B , C, and V.We are therefore in the situation depicted in Figure 2.
We can proceed by following to a certain extent the technique introduced by Maurer [5].In what follows, we will compute conditional entropies and mutual informations between random variables that are both discrete (U, S , C, S ′ , V) and continuous (X and W B ).In the latter case it is understood that we employ the differential entropy (measured in bits) instead of the discrete one, although we will denote both with the symbol H for simplicity.Remember that a linear entropy inequality involving differential entropies is valid if and only if its discrete counterpart is 'balanced' and valid [95].Our derivation rests only upon balanced inequalities.We start by writing Now, Here: 1 comes from data processing; 2 is a consequence of the fact that S is a deterministic function of U and X; 3 is again data processing, using the fact that S ′ is a deterministic function of C, V, and W B ; finally, 4 uses that V is independent of U, X, and W B , even conditioned on C. Now, observe that Note that 5 is just the positivity of the mutual information I(W B : C) ≥ 0, 6 is a rephrase of (11), and 7 comes from (9).Combining ( 42)-( 44) yields We now consider a sequence of 1-GLOPC protocols Λ n : and Now, consider a fixed sequence of QCMs Γ E n .Set denote by S n , S ′ n the keys produced by the protocol Λ n run with input ρ G [τ A n B n , 0], and let C n be the message exchanged.Applying (45), we see that By tracing away E n , from (46) we deduce that the probability distribution P S n S ′ n is at least ϵ n -close in total variation norm to that of two perfectly correlated copies of the key.In turn, this ensures that Pr{S n S ′ n } < ϵ n .Hence, Fano's inequality [96] gives is the binary entropy, and we remembered that The same reasoning guarantees that P S n is at least ϵ n -close in total variation norm to the uniform distribution over an alphabet of size 2 ⌈Rn⌉ , whose entropy (measured in bits, as usual) is naturally given by ⌈Rn⌉.The Fannes-Auedenaert inequality [97,98] thus guarantees that The last consequence of (46) we are interested in can be deduced by tracing away the K ′ system.By doing so we see that the joint random variable S n C n is at least ϵ n -close in total variation norm to a pair S n C n of independent random variables such that S n is uniformly distributed over an alphabet of size 2 ⌈Rn⌉ .We deduce that The above derivation is justified as follows: in 8 we observed that H S n = ⌈Rn⌉ ≥ H(S n ); in 9 we used the fact that S n and C n are independent; finally, in 10 we exploited the asymptotic continuity of the conditional entropy [99][100][101][102].
Combining ( 48)-( 52) yields the bound Since this holds for all pure QCMs Γ E n , we can take the infimum of the last addend over Γ E n .Note that inf Here, 11 is a consequence of (A26), while 12 is an application of the non-trivial fact that the Rényi-2 Gaussian entanglement of formation coincides with the Rényi-2 Gaussian squashed entanglement for all Gaussian states [67, Theorem 5 and Remark 2] (cf.(28); remember that γ ABE is a purification of V AB ).Finally, 13 follows from the additivity of the Rényi-2 Gaussian entanglement of formation [67, Corollary 1].Therefore, optimising (53) over pure QCMs Γ E n and using (54) yields Dividing by n, taking the limit n → ∞ and using the continuity of the binary entropy together with the fact that ϵ n − −− → n→∞ 0 finally gives that Taking the supremum over achievable rates R, we then see that which together with (37) proves (40).It remains to prove (41).Fortunately, this is much easier to do: indeed, it suffices to exhibit a protocol that starting with an arbitrary number of copies of a pure QCM γ AB achieves a secret key distillation rate that is arbitrarily close to M(γ A ).To do this, fix ϵ > 0, and apply (24) to select two Gaussian measurements with seeds Γ A and Γ B such that Calling X and Y the outcomes of those measurements, we know that I(X : also holds.If Alice and Bob carry out the aforementioned Gaussian measurements separately on every single copy of γ AB they share, by applying the above procedure they obtain n independent copies of the jointly Gaussian random variables X and Y. Now, let Alice and Bob 'bin' the continuous variables X and Y so as to obtain discrete random variables X ′ and Y ′ with the property that I(X ′ : Y ′ ) ≥ I(X : Y) − ϵ/3 ≥ M(γ A ) − 2ϵ/3.This is known to be possible [103], and indeed can be verified by elementary means, e.g.exploiting the uniform continuity of Gaussian distributions.
At this point, we can use a special case of a result proved by Maurer [8, Theorem 4] (see also previous works by Maurer himself [5] as well as Ahlswede and Csiszar [9, Proposition 1]), and later generalised to the classical-quantum case in the fundamental work by Devetak and Winter [104, Theorem 1].For the case where Eve has no prior information, it states that the secret key distillation rate that one can achieve from i.i.d.copies of a correlated pair (X ′ , Y ′ ) of discrete random variables by means of one-way public communication 5coincides with the mutual information I(X ′ : Y ′ ). 6To apply Maurer's achievability result, we need to verify that his security criterion is stronger than ours.Writing out everything for the case where Eve has no prior information, a side-by-side comparison of the two security criteria is as follows.
Maurer [8,Definition 2]: This paper (Definition 1): inf Here, |S | is the size of the alphabet of S , and δ S S ′ /N is the perfectly correlated uniform distribution of size N.We now verify that ( 59) implies ( 60) for some ϵ ′ universally related to ϵ.For the sake of simplicity, we write out the argument in the case where the random variable C ranges over a discrete alphabet.We have that inf Here, in the second to last line we applied twice Pinsker's inequality [105][106][107], while the last line follows directly from (59).
The above argument shows that I(X ′ : Y ′ ) is indeed the supremum of all achievable secret key rates for the random variables (X ′ , Y ′ ).Therefore, any rate of the form I(X ′ : Y ′ ) − ϵ/3 ≥ M(γ A )−ϵ is achievable.Since this holds for an arbitrary ϵ > 0, we see that in fact Together with (40), this establishes (41) and concludes the proof. 7 It is important at this point to recall that, when arbitrary local operations are permitted in conjunction with one-or twoway public communication (1-LOPC or LOPC, respectively), the secret key of any pure state ψ AB is well known to equal its local von Neumann entropy S 1 (ψ A ), as defined in (17).Instead, (41) features the Rényi-2 entropy (20) of the local state.Since this is typically smaller, S 2 ≤ S 1 , our result (41) shows that the Gaussian secret key of any pure Gaussian state is smaller than its unrestricted LOPC secret key, highlighting a fundamental limitation in the ability of Gaussian operations to extract secrecy from quantum states.Later in Section VI A we will explore an example of such a limitation in a relevant family of mixed Gaussian states as well.

B. Two-way public communication
We now turn to our second main result, a weaker bound on the Gaussian secret key of an arbitrary Gaussian state in the presence of two-way public communication.
Theorem 5.For all QCMs V AB , it holds that Proof.We will prove that , where the first inequality follows from the case P = GLOPC of Lemma 3. To establish the second one, consider as usual a sequence of GLOPC protocols Λ n : A n B n → K n K ′ n C n with rate R as in Definition 2. Pick numbers ϵ n > 0 such that ( 46) and ( 47) hold, consider an arbitrary sequence of QCMs Γ E n , and define the QCM τ A n B n by (48).
Similarly to what we saw in the proof of Theorem 4, since the global input state is Gaussian and all measurements, ancillary states, and unitaries are Gaussian, the whole protocol can be simulated by a purely classical process.The input of this simulation is the pair of correlated random variables (W A n , W B n ), whose joint distribution coincides with the Wigner function of ρ G [τ A n B n , 0].Let S n , S ′ n be the pair of keys generated by Alice and Bob, and let C n the messages exchanged.By a result of Maurer, we have that [5, Theorem 1] Employing (9) we see immediately that where the last identity follows because thanks to the discussion following (16) we know that τ A n B n is a pure QCM.Plugging ( 64), ( 50), (51), and ( 52) inside (63) yields ⌈Rn⌉ < F,2 (V AB ) upon taking the infimum over Γ E n as in (54).Dividing by n and taking the limit for n → ∞ gives R < 2E G F,2 (V AB ), and then upon an optimisation over all achievable rates R. □ We conjecture that the factor of 2 in ( 62) is not tight, and that in fact holds true for all QCMs V AB .Establishing this would further bolster the operational significance of the Gaussian entanglement measure E G F,2 in the context of QKD.As evidence in favour of our conjecture, we present partial proof of it for the class of protocols GLMPC, corresponding to a scenario where we allow two-way public communication, but only after Alice and Bob perform complete destructive Gaussian measurements on their subsystems.This is the third main result of this paper.Theorem 6.For all QCMs V AB , it holds that and moreover The argument we use to prove Theorem 6 is very close in spirit to those proposed by Maurer [5], Ahlswede and Csiszar [9], and Maurer and Wolf [87] to upper bound the secret key capacity of a tripartite probability distribution.In the latter two papers, in particular, the notion of intrinsic information was introduced and discussed at length (see [9, Theorem 1] and [87, § II]).
Proof.We start by proving the first inequality in (66).Let Alice, Bob and Eve start with n copies of the pure Gaussian state with QCM γ ABE , so that the global QCM reads γ ⊕n ABE .Consider a sequence of GLMPC protocols Λ n : for some rate R > 0, as per Definition 1.By construction, the GLMPC protocol Λ n can be decomposed as where M G Γ A n and M G Γ B n are complete destructive Gaussian measurements with seeds Γ A n and Γ B n on Alice's and Bob's side, respectively, and Λ c n is a classical protocol involving only local operations and public communication.For a formal representation of the quantum-classical channels M G Γ A n , M G Γ B n , see (13).Now, consider an arbitrary Gaussian measurement M G Γ E n with seed Γ E n on Eve's subsystem; denote the corresponding output alphabet with Z n = R 2nm E .Employing first the data processing inequality for the trace norm and then (69) yields ρ G γ ⊗n ABE , 0 defines a triple of random variables X n , Y n , Z n .Denoting with C n the message exchanged during the execution of Λ c n and with S n , S ′ n the locally generated secret keys, the celebrated result of Maurer [5, Theorem 1] that we have already used multiple times states that It is now an elementary exercise to verify that analogous conditions to (50)-( 52) apply to our case.The only one which needs a very slight modification is (52).Construct the triple of random variables S n , C n , Z n such that: S n and C n , Z n are independent; S n is uniformly distributed over 1, . . ., 2 ⌈Rn⌉ ; and C n , Z n has probability distribution Also, observe that by (31).Plugging ( 51), ( 73), (50), and ( 72) inside (71) yields Since this holds for all QCMs Γ E n , Taking a further supremum on Γ A n , Γ B n and remembering the definition of the Gaussian intrinsic entanglement (30) gives Dividing by n and taking the liminf for n → ∞ produces Since this holds for all achievable rates R, we also obtain that which proves the first inequality in (66).
We now move on to the proof of (67).To start off, we massage the expression (30) thanks to (33), obtaining Before we proceed further, let us define one more quantity via a slight modification of (79).More precisely, we set Here, in 1 we restricted the infimum in ( 79) to pure QCMs Γ E , while in 2 we exchanged supremum and infimum according to the max-min inequality sup x∈X inf y∈Y f (x, y) ≤ inf y∈Y sup x∈X f (x, y) [108].We now show that in fact In 3 we recalled the definition (22), in 4 we used (24), in 5 we exploited (33), and finally in 6 we leveraged a recently established result on the equality between Rényi-2 Gaussian squashed entanglement and Rényi-2 Gaussian entanglement of formation [67, Theorem 5 and especially Remark 2].
We have therefore established (67).Applying it to the QCM V ⊕n AB and taking the liminf for n → ∞ yields where the last identity is a consequence of the additivity ( 27) of the Rényi-2 Gaussian entanglement of formation.This establishes the second inequality in (66) and concludes the proof.□ Note that the upper bound on K G, M ↔ provided by Lemma 3 would lead straight to the inequality K G, M ↔ ≤ E G F,2 .However, this is a priori less tight than the estimate ↓ established in Theorem 6.This discrepancy is due to the type of constraints we impose on Eve's action: in Lemma 3 we assumed that she performs a destructive Gaussian measurement at the very beginning of the protocol, subsequently broadcasting the obtained outcome to Alice and Bob; in Theorem 6, instead, we assumed that first Alice and Bob make their destructive Gaussian measurements, and then Eve makes hers, keeping the outcome secret.

V. EQUIVALENCE OF GAUSSIAN ENTANGLEMENT MEASURES
In the previous Section we have seen that Theorem 6 brings into play, in addition to the Rényi-2 Gaussian entanglement of formation (25), also the (regularised) Gaussian intrinsic entanglement (30).As mentioned in the Introduction, these two measures have been conjectured to be identical on all Gaussian states [69][70][71], and in Theorem 6 we established that at least E G ↓ ≤ E G F,2 holds true in general.For a particularbut, in fact, quite vast -class of Gaussian states we are able to prove the opposite inequality as well, thus confirming the conjecture.
We call the QCM V AB of a bipartite Gaussian state normal if it can be brought into a form in which all xp cross-terms vanish (referred to as xp-form) using local symplectic operations alone; see Appendix A 2 for an explicit definition.Here, the xp cross terms of an m-mode QCM W are all the entries W jk with | j − k| > m, and a local symplectic operation is a map of the form , where S A , S B are symplectic matrices.All pure QCMs [83] as well as all two-mode mixed QCMs [109,110] are normal.
Our fourth main result then amounts to the following.
Theorem 7.For a normal QCM V AB , it holds that In particular, (84) holds for all two-mode QCMs.
The proof of Theorem 7 makes use of additional facts and technical results presented in Appendices A 4 and A 5.
Proof.In the proof of Theorem 6, and more precisely in (80), we introduced an auxiliary quantity E G ↓ .In ( 81) and ( 82) we also showed that E G ↓ ≤ E G ↓ = E G F,2 on all QCMs.We now prove that the opposite inequality E G ↓ (V AB ) ≥ E G ↓ (V AB ) holds as well, at least for normal QCMs V AB .
Since V AB is normal and both E G ↓ and E G ↓ are invariant under local symplectics, we can assume directly that V AB is in xpform, V AB = Q 0 0 P .Using Lemma 9 of Appendix A 2, we construct a symplectic matrix here written with respect to an xp block partition, such that again with respect to the same partition.This is useful because we can now construct very conveniently a purification γ ABE of V AB : Here, with respect to an AB|E block partition we have that where Σ (Π x ) ⊺ Π x − (Π p ) ⊺ Π p .An important observation to make is that γ (0) ABE , S AB , and hence also γ ABE are all in xpform.
Let us now go back to the sought inequality Since the left-hand side is defined by a supremum over Gaussian measurements, parametrised by Γ A , Γ B , we estimate it as In the above derivation, the equality in 1 is simply (79), the inequality in 2 follows by choosing Γ A (t), Γ B (t) as defined in (A13), and the inequality in 3, which is the real technical hurdle here, follows by combining Lemma 17 and Proposition 18 of Appendix A 5.
We now look at the set of matrices ((γ ABE +Γ E )/(γ E +Γ E )) x , where Γ E is an arbitrary QCM on E, not necessarily in xpform.With respect to an xp block partition, let us parametrise it as We now compute: The justification of the above derivation is as follows.4: We made use of ( 87) and of the covariance property (A20).5: We applied (85).6: We computed the Schur complement with the help of (88).7: We used the fact that Λ and Σ are all in xp-form.8: We calculated thanks to the block inversion formulae (A18).Here, the symbols * indicate unspecified matrices of appropriate size.By the above calculation, the function on the right-hand side of (89) depends only on the combination K − J(L + D) −1 J ⊺ , which is a rather special function of the free variable Γ E .Now, on the one hand where we applied the monotonicity of Schur complements (A22), and then observed that Γ E /L > 0 follows from the block positivity conditions (A19), once one remembers that Γ E > 0 as Γ E is a QCM.On the other hand, every positive definite matrix T > 0 can be written as T = K − J(L + D) −1 J ⊺ for some K, J, L forming -according to (90) -a pure QCM Γ E in xp-form.In fact, it suffices to set K = T = L −1 and J = 0; this makes the corresponding Γ E pure, as can be seen e.g. by comparing it with (A11), and clearly in xp-form.We have just proved that which can be rephrased as We make use of this crucial fact to further massage the right-hand side of (89), obtaining that Here: in 9 we used (92); in 10 we observed that both γ ABE , Γ E , and hence also the pure QCM (γ ABE + Γ E )/(γ E + Γ E ), are in xp-form, which allowed us to apply Corollary 14 of Appendix A 4; in 11 we recalled (24), and finally 12 follows elementarily from enlarging the set over which we compute the infimum.Combining the above inequality with ( 81) and ( 82) ) for all normal QCMs V AB .To complete the proof, it suffices to observe that the direct sum V ⊕n AB of normal matrices V AB is still normal.Hence, where the last equality comes from (27).□ Theorem 7 establishes a powerful equivalence of two originally quite distinct Gaussian entanglement measures, for all two-mode Gaussian states and more generally all normal QCMs.The reader could wonder whether normal QCMs constitute a proper subset of all QCMs beyond the two-mode case, In Appendix B we show that this is indeed the case, by constructing an explicit example of a non-normal QCM over a (1 + 2)-mode system.The validity of the conjecture

A. Secret key from noisy two-mode squeezed states
We now apply our results, and in particular Theorem 4, to study secret key distillation from a class of Gaussian states of immediate physical interest.The states we will look at are obtained by sending one half of a two-mode squeezed vacuum |ψ s ⟩ across a pure loss channel E λ (a.k.a. a quantum-limited attenuator).We recall that a two-mode squeezed vacuum is defined by where |n⟩ denote local Fock states, and the squeeze parameter r s s ln 10 20 is expressed as a function of the squeezing intensity s measured in dB.The pure loss channel E λ is a Gaussian channel whose action at the level of density operators can be expressed as where U λ e i arccos √ λ (x 1 p 2 −x 2 p 1 ) is the Gaussian unitary that represents the action of a beam splitter with transmissivity λ, Tr 2 stands for the partial trace over the second mode, and as usual x j , p j denote the canonical operators pertaining to the j th mode.
The Rényi-2 Gaussian entanglement of formation of the state (E λ ⊗ I) (ψ s ) can be expressed in closed form by adapting the results for the standard (von Neumann) Gaussian entanglement of formation, which has been computed in [111].We find No expression for the corresponding 1-LOPC secret key K → ((E λ ⊗ I) (ψ s )) seems to be known.However, in order to demonstrate the effectiveness of our estimate (40), it suffices to consider suitable lower bounds on this quantity.One such bound is the one-way distillable entanglement [104,112,113], denoted with D → .We succeeded in computing D → ((E λ ⊗ I) (ψ s )) because the state in question is 'degradable', and hence its one-way distillable entanglement equals the readily found coherent information [114].The resulting expression is where g(x) (x + 1) log 2 (x + 1) − x log 2 (x) is the bosonic entropy function.
This shows that, in several physically interesting regimes (either low squeezing or high transmissivity), our bounds accurately capture and quantify the severity of the Gaussian restriction for the task of distilling secrecy.

B. A conditional mutual information game
Finally, we interpret our results in a game-theoretical context.We begin by observing, as an interesting side result, that our proof of Theorem 7 implies the following variant of the strong saddle-point property of the log-determinant conditional mutual information.
A comparison between the one-way distillable entanglement (communication direction: first-to-second subsystem), which lower bounds the 1-LOPC secret key rate K → , and the Rényi-2 Gaussian entanglement of formation, which upper bounds the Gaussian 1-LOPC secret key rate.Both functions are computed for the states (E λ ⊗ I) (ψ s ).Explicit formulae are reported in ( 97) and ( 96), respectively.The comparison proves that the restriction to Gaussian operations reduces the distillable secret key appreciably for either low squeezing or high transmissivity.Our upper bound on the secret key rate can be and often is tighter than the one presented in [115], equal to F PLOB (λ) − log 2 (1 − λ) and plotted here as the black dashed line.This is because the bound in [115] applies to all (Gaussian and non-Gaussian) protocols with unbounded energy budget, while ours is tailored to Gaussian protocols and takes into account limitations to the available energy.
Proposition 8 (Saddle-point property of log-determinant conditional mutual information).Let V AB be a normal QCM with purification γ ABE .Then Proof.The top-most expression is obviously greater or equal to the bottom-most one, owing to the max-min inequality sup x∈X inf y∈Y f (x, y) ≤ inf y∈Y sup x∈X f (x, y).For the opposite inequality, let us write sup Here, 1 follows from (93), while 2 can be deduced by noting that infimum has been enlarged.The proof is then complete.

□
Equalities of the form (98) represent a quintessence of application of methods of game theory in information theory.They appear in the context of a generic problem of finding optimal strategies for communication over a jamming channel.The task is linked to game theory by interpreting the communication as a two-player game between the senderreceiver pair on the one hand, and the malicious jammer on the other; here, the payoff function is some information measure, typically the mutual information [118][119][120].The goal of the sender-receiver pair is to maximise the payoff function, whereas the goal of the jammer is to minimise it.If the payoff function exhibits a saddle-point property akin to (98) on the sets of allowed strategies of the players, then the saddlepoint strategies are simultaneously optimal for both players.The game is then said to have a value, which is equal to the saddle-point value of the payoff function.
Viewed from a game-theoretical perspective, Equation ( 98) then ensures the existence of a value of the following Gaussian quantum game with log-determinant conditional mutual information as the payoff function.At the beginning of the game, the players share a fixed pure Gaussian state with QCM  (98) then guarantees that such a game has a value, and that this value is equal to E G F,2 (V AB ) by (30) and (84).However, the game does not have the structure of a typical communication game with jamming.Namely, all participants appear symmetrically in the game and, in particular, it is not clearly seen, how the jammer disturbs the communication channel between the sender and the receiver.Nevertheless, we can transform the game into a teleportation game (different from the one presented in [121]) exhibiting all the features mentioned above.As a bonus, the obtained game reveals how the separability properties of the initial state across the A : B partition and the measurement chosen by the jammer influence the effective state shared by Alice and Bob.
To find the latter game, we first rewrite equality (98) as inf where with R = diag(1, −1, 1, −1, . . . of the conditional mutual information, together with the fact that RΓ E R is a physical QCM, which runs over the set of all QCMs as Γ E is varied over the set of all QCMs. Looking closely at the Schur complement σ AB , Eq. ( 100), one further finds [58,59] that it can be viewed as an output of a Gaussian trace-decreasing completely-positive map characterised by the QCM (99) with the state with QCM Γ E at the input.Here, E labels the input system and AB the output system.Since the map can be implemented deterministically [58] via the standard CV teleportation protocol [122], we arrive at the teleportation scheme in Figure 4.
In view of the saddle-point property (98), the depicted teleportation game has a value, which is given exactly by the Rényi-2 Gaussian entanglement of formation E G F,2 (V AB ).The optimal strategy for both players is to choose QCMs Γ A , Γ B and Γ E , which achieve E G F,2 (V AB ).This result makes E G F,2 (V AB ) a unique instance of an entanglement measure equipped with such a game-theoretical interpretation.

VII. CONCLUSIONS
We studied the operational task of distilling a secret key from Gaussian states using local Gaussian operations, local classical processing, and public communication.When only one-way public communication is allowed, we determined the exact expression of the Gaussian secret key for all Gaussian pure states, and established upper bounds that hold for mixed multi-mode Gaussian states in all other cases.These bounds can be used to benchmark state-of-the-art CV QKD protocols against much simpler, Gaussian ones.Our findings imply that Gaussian secret key distillation, albeit often possible with positive yield, can be strictly less efficient than a general protocol would be.In the Gaussian-restricted scenario, our results often tighten the bounds obtained using the squashed entanglement [123] and the relative entropy of entanglement [115,124].
We also proved a recently proposed conjecture [69] on the equality between Gaussian intrinsic entanglement and Rényi-2 Gaussian entanglement of formation for all Gaussian states whose covariance matrix is 'normal', and in particular for all two-mode Gaussian states.In conjunction with the already proven equality between the latter measure and a Gaussian version of the squashed entanglement [67], this establishes a coalescent and strongly operationally motivated highway to quantifying entanglement of Gaussian states.We further pre-sented an alternative operational interpretation for this treble entanglement quantifier in a game-theoretical scenario.The unification presented in this paper stands in stark contrast with the recently uncovered fundamental non-uniqueness of general entanglement measures [125,126], and points to a much simpler picture in the special case of Gaussian entanglement.
Corollary 14.Let γ AB be a pure QCM in xp-form, i.e. let it be as in (A11).Then Proof.Remembering (A11) and (A27), we see that Also, since γ AB has no off-diagonal terms, it holds that γ AB /γ x AB = γ p AB .Combining this with (A30) and (A26) yields 2M Lemma 15 (Uniform continuity of log-determinant mutual information).Let κ ≥ 1, and consider two matrices V AB , W AB such that V AB , W AB ≥ κ −1 1 AB .Then it holds that where ∥ • ∥ 1 denotes the trace norm.
Proof.Let us start by proving that for any two matrices To see this, we write log 2 det(MN −1 ) = log 2 det(M) − log 2 det(N) Here, in 1 we called µ i , ν i the eigenvalues of M, N, sorted in descending order.To justify 2, instead, start by applying Lagrange's theorem to a continuously differentiable function We now come to the proof of (A32): Here, 3 comes from inequality (A33) applied to M = V A , V B , V AB and N = W A , W B , W AB , respectively.Note that under the operation of taking principal submatrices the minimal eigenvalue never decreases, hence Finally, 4 descends from the observation that since the 'pinching' operation that maps V AB → V A ⊕ V B and W AB → W A ⊕ W B is a quantum channel, it never increases the trace norm, and hence This concludes the proof.□ For the sake of completeness, here we further present a simple justification of the known fact [70,82,83] that in the Gaussian setting the classical mutual information of Gaussian pure states coincides with the local Rényi-2 entropy, as claimed in (24).The above identities can be justified as follows: 1 descends from (A23); 2 is an application of (A30); 3 uses the identity (A24); 4 comes from Lemma 15, which implies that Here we need to establish a couple of technical lemmata which will be useful for the proof of Theorem 7.
Lemma 17.Let V AB be any bipartite QCM, and let γ ABE be any extension of it, i.e. let it satisfy γ AB = V AB .For some QCM Γ E , define We now massage (A39) as follows: Note that the inequality in 4 comes directly from the definitions (A39) and (A40), together with the observation that I M (A p : B p ) 1 p AB = 0.For 5, instead, we applied Lemma 15 twice, which is possible because: (i) W AB ≥ κ −1 1 AB and hence W x AB ≥ κ −1 1 x AB (also, t > 0); and (ii) from the block positivity conditions (A19) for W AB + t 1 AB it follows that W p AB − Z AB is finite thanks to the compactness of W AB .Also, we denoted by m A and m B the number of modes on systems A and B, respectively.From the above estimate it is clear that lim t→0 + sup W AB ∈W AB |F t (W AB ) − F(W AB )| = 0, completing the argument.□ where the first and second rows and columns refer to A, the third and fourth to B 1 , and the fifth and sixth to B 2 .Assume that ∥F∥ ∞ , ∥G∥ ∞ ≤ 1, a ≥ 3, and b 1 , b 2 ≥ 2, so that V AB ≥ 1 AB is a valid QCM.Further assume that b 1 b 2 and that [FF ⊺ , GG ⊺ ] 0. Then V AB is not normal.

FIG. 2 .
FIG.2.The modified protocol used in the proof of Theorem 4. Once the Gaussian protocol on A has been carried out, we can think of the B system as formally simulated by the classical random variable W B whose distribution conditioned on UX coincides with the Wigner function of the (Gaussian) reduced state on B corresponding to the recorded values of U and X.

F 1 = 2 = 1 p 3 = 4 ≤ 5 ≤ 1 + log 2 6 =
t (W AB ) = I M (A : B) W AB +Γ A (t)⊕Γ B (t) I M (A x : B x ) W x AB +Γ x A (t)⊕Γ x B (t) + I M (A p : B p ) W AB +Γ A (t)⊕Γ B (t) W x AB +Γ x A (t)⊕Γ x B (t) I M (A x : B x ) W x AB +t 1 x AB + I M (A p : B p ) W p AB +t −1 I M (A x : B x ) W x AB +t 1 x AB + I M (A p : B p ) 1 p AB +t W p AB −Z ⊺ AB (W x AB +t 1 x AB ) −1 Z AB Note that in 1 we appliedLemma 13, in 2 we made use of (A45) and (A46), and in 3 we employed (A24).Now, we see that|F t (W AB ) − F(W AB )| I M (A x : B x ) W x AB +t 1 x AB − I M (A x : B x ) W x AB + I M (A p : B p ) 1 p AB +t W p AB −Z ⊺ AB (W x AB +t 1 x AB ) −1 Z AB − I M (A p : B p ) 1 p AB κ log 2 (e) W x AB + t 1 x AB − W x AB tlog 2 (e) κ(m A + m B ) + max W AB ∈W AB Tr W p AB .

If b 1 b 2 ,b 2 =
any unitary U satisfying U, b 1 0 0 0 must be of the form U = e iθ 1 0 0 e iθ 2 .Hence, Corollary 20 tells us that Clearly, we can see γ ABE as a purification of the state with QCM V AB .The participants holding subsystems A and B, called Alice and Bob in what follows, choose Gaussian measurements characterised by QCMs Γ A and Γ B to maximise the conditional mutual information I M (A : B|E) γ ABE +Γ A ⊕Γ B ⊕Γ E , while the jammer Eve holding subsystem E chooses a Gaussian measurement with QCM Γ E to minimise it.The equality . 4. Scheme of the teleportation game.The jammer Eve sends through a channel a bipartite Gaussian state of subsystem E = E Ain E Bin with zero first moments and QCM Γ E to subsystems A out and B out of spatially separated recipients Alice and Bob.The channel transforms QCM Γ E as in Eq. (100) and it is realised by teleportation (dashed rectangular block) from Eve to Alice and Bob with the help of a shared fixed Gaussian state with QCM γ ABE , Eq. (99).Here, the shortcut BHD stands for the balanced homodyne detection and D A , D B are displacements.Alice and Bob finally perform Gaussian measurements on their subsystems A out and B out characterised by QCMs Γ A and Γ B .The payoff function is the log-determinant conditional mutual information I M (A : B|E) γ ABE +Γ A ⊕Γ B ⊕Γ E and Alice and Bob choose their measurement QCMs so as to maximise the payoff function, while Eve aims at minimising it.Interestingly, such a game has a value and it is given by the Rényi-2 Gaussian entanglement of formation E G F,2 (V AB ) of the reduced QCM V AB of QCM γ ABE , which belongs to subsystems A and B.
(33)1) being the diagonal matrix representing on the QCM level the transposition operation x j → x ⊺ j = x j , p j → p ⊺ j = −p j .Here, we used property(33)FIG and b = ∞, we obtain the desired inequality log 2 µ i − log 2 ν i ≤ κ log 2 (e) |µ i − ν i |.Finally, in 3 we used the well-known estimate ∥M − N∥ 1 ≥ i |µ i − ν i |, Z AB = (W AB + t 1 x AB ) (W x AB + t 1 x AB ) > 0.To justify 6, note that exploiting again positivity one has that (W AB + t1 x AB ) (W x AB + t 1 x AB ) 1 = Tr (W AB + t 1 x AB ) (W x AB + t 1 x AB ) ≤ Tr[W p AB ].The quantity max W AB ∈W AB Tr W p