While intermediate steps in the entropy accumulation proofs of Refs. [1, 2, 4] involve bounds of a roughly similar form, the critical difference is that, in those bounds, the value on the right-hand side is a minimization over all possible single-round states, which results in trivial bounds if directly applied in a protocol.

In fact, the $[\alpha /(\alpha -1)]\log [1/(\mathrm{Pr}[\mathrm{\Omega }])]$ term does not affect the final key rates in sufficiently “simple” protocols, as discussed in Refs. [10, 11]; however, other $O(1)$ corrections arise when considering, e.g., privacy amplification theorems.

A caveat here is that if the security proof uses a constant Rényi parameter independent of $n$, then the $h_{\widehat{\alpha }}$ term in our result is also independent of $n$—thus, even at large $n$, it does not converge to exactly the minimum Rényi entropy over single-round states compatible with the accept condition. This finding likely reflects the general principle that Rényi entropies have “worse” chain rules as compared to von Neumann entropy. However, for the purposes of security proofs, we can overcome this issue in various ways by tuning the Rényi parameters as a function of $n$; we discuss this case further in Sec. 7c.

In that model, the $E_n$ register will usually also contain a copy of ${\widehat{C}}_1^n$, but this does not affect any of the final bounds.

This definition could likely be extended to $\alpha \in \{0,1,\infty \}$ by taking the respective limits. However, our subsequent discussions suggest that, for instance, the $\alpha =\infty$ case would essentially correspond to $H_{\infty }$ conditional entropies, which are simply zero in many circumstances (unlike $H_{\infty }^{\uparrow }$) and hence unlikely to be of much interest. Furthermore, in Theorem V.1, the $[1/(\widehat{\alpha }-1)]$ factor would be zero at $\widehat{\alpha }=\infty$, which makes the result somewhat trivial; see the discussion in Sec. 5b.

Earlier versions of this work referred to $H_{\alpha }^f$ as a QES entropy; we have chosen to update the terminology to bring it more in line with Ref. [17].

There is no danger of ambiguity in having used $\rho$ to denote all states in this lemma since a read-and-prepare channel always simply extends a state without “disturbing” any registers.

In fact, this $M$ term can be entirely avoided if we first use the “normalization property” in Lemma IV.7 below to shift all the $f$ values to negative values, allowing us to choose $M=0$. Alternatively, $M=0$ could be achieved by modifying our construction to instead follow Ref. [1] and generate a pair of quantum registers $D\overline{D}$, and then use the fact that $H_{\alpha }(D|\overline{D})$ can be assigned negative values to obtain $H_{\alpha }(DQ\overline{C}|\overline{D}\widehat{C}{Q}^{\prime }{)}_{\rho }=H_{\alpha }^f(Q\overline{C}|\widehat{C}{Q}^{\prime }{)}_{\rho }$. However, in that case, it might not straightforwardly hold that $H_{\alpha }(D|\overline{D})=H_{\alpha }^{\uparrow }(D|\overline{D})$.

It may appear strange to make the $Q$ register trivial since, in some protocols, it corresponds to the raw “secret data,” but the idea is that in Ref. [18] and follow-up works, the QEF analysis is applied in such a way that the $\overline{C}$ register itself contains all the raw “secret data.” Our results can be viewed as slightly extending their approach by also allowing for an additional, possibly quantum $Q$ (for the case where $Q$ is classical, it can still be basically accommodated in their approach by incorporating it into the $\overline{C}$ register but choosing a QES/QEF that is independent of its value).

To avoid potential confusion, we highlight that, for each $j$, we have multiple different QESs, which are indexed by the values ${\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}$. We also highlight that each such QES is a function on the alphabet of ${\overline{C}}_j{\widehat{C}}_j$ only not the “preceding” registers ${\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}$. Of course, by the equivalence between $k$-tuples and functions on a discrete set of size $k$, in principle, we could view the tuple of values ${\{f_{|{\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}}({\overline{c}}_j{\widehat{c}}_j)\}}_{{\overline{c}}_1^j{\widehat{c}}_1^j}$ as being a function on the alphabet of ${\overline{C}}_1^j{\widehat{C}}_1^j$, but for this theorem statement, it is more convenient to use the presented form. (In other contexts, it can be convenient to view it as such a function, but we defer that discussion to later work.)

While the resulting lower bound on $H_{{\alpha }^{\prime }}^{{\widehat{f}}_{\mathrm{full}}}(S_1^n|{\overline{C}}_1^n{\widehat{C}}_1^n{E}_n{)}_{\rho }$ is not zero, this is easily addressed by either using Lemma IV.7 to “normalize” the lower bound to zero or, equivalently, just modifying the analysis to hash to a shorter key.

We write this condition in this form to highlight that $\mathrm{\Omega }$ does not have to be an event defined entirely on the state $\rho$ itself, which allows more flexibility in applications. This is also why we use a separate symbol $\tilde{\mathrm{\Omega }}$ to denote the set of values ${\overline{c}}_1^n{\widehat{c}}_1^n$ such that ${\rho }_{|\mathrm{\Omega }}({\overline{c}}_1^n{\widehat{c}}_1^n)>0$.

Strictly speaking, the convex range is not fully defined by only the channels ${\mathcal{E}}_j$ since one also has to specify the various embeddings. However, all of our subsequent results hold for any choice of embeddings, so we will usually not specify this explicitly.

The potential exception here would be for protocols where one has a priori knowledge that some rounds would behave differently from others, for instance, in satellite QKD where the photon losses are likely to vary over the course of the protocol. In that case, there are potential benefits to be gained from the more general “adaptive” analysis described in the previous section, though, as mentioned, such an analysis would be more elaborate than the results we present in this section.

This assumption does not affect its applicability to DI security proofs (at least, assuming that the dimensions are finite but unbounded) because, in such security proofs, we can suppose that $\mathcal{M}$ acts on systems of finite but unknown dimension and say that the bounds we derive are independent of this dimension and hence valid for any such $\mathcal{M}$ [36].

In fact, rather than $H_{{\alpha }^{\prime }}$ specifically, for the purposes of this argument, we can discuss any Rényi entropy $\mathbb{H}$ satisfying $H_{\min }\le \mathbb{H}\le H$ because, for any classical-quantum state ${\rho }_{CQ}$, we have $\mathbb{H}(C|Q{)}_{\rho }=0$ for some such $\mathbb{H}$ if and only if $\mathbb{H}(C|Q{)}_{\rho }=0$ for all such $\mathbb{H}$ [since $\mathbb{H}(C|Q{)}_{\rho }=0$ implies $H_{\min }(C|Q{)}_{\rho }=0$, which implies the conditional states ${\rho }_{Q|c}$ are all perfectly distinguishable and hence $H(C|Q{)}_{\rho }=0$ as well].

Technically, to complete the argument we must rule out the possibility of a sequence of feasible values limiting to zero. To do so, we can follow the steps described in the proof of Lemma V.4 to replace $S_{\mathrm{\Omega }}$ with its closure by a continuity argument, in which case, for finite-dimensional $\tilde{Q}$, we obtain a continuous optimization over a compact set and hence the infimum is attained (and hence strictly positive). An alternative prospect is to introduce another convex optimization $\underset{\mathbf{q}\in S_{\mathrm{\Omega }}}{\inf }\underset{\omega \in {\mathrm{S}}_{=}(\tilde{Q})}{\inf }{H}_{{\alpha }^{\prime }}(S\overline{C}|\widehat{C}E\tilde{E}{)}_{{\nu }^{\omega }}$ subject to the constraint $\parallel \mathbf{q}-{\mathit{\nu }}_{\overline{C}\widehat{C}}^{\omega }{\parallel }_1\le \delta$, which matches the “simplistic” optimization in Eq. (83) when picking $\delta =0$. It seems likely that one could prove the optimal value of this optimization is continuous with respect to $\delta \ge 0$ (for instance, by modifying the arguments in Ref. [55]); if so, then, by continuity, there exists some ${\delta }_{\star }>0$ such that this optimization is lower bounded by, say, $h_{\star }/2$. Thus, we can conclude the desired property that every feasible $(\mathbf{q},\omega )$ in our bound Eq. (82) is bounded away from zero since for every such point we either have $\parallel \mathbf{q}-{\mathit{\nu }}_{\overline{C}\widehat{C}}^{\omega }{\parallel }_1\le {\delta }_{\star }$ and thus $H_{{\alpha }^{\prime }}(S\overline{C}|\widehat{C}E\tilde{E}{)}_{{\nu }^{\omega }}\ge h_{\star }/2>0$ or $D(\mathbf{q}\parallel {\mathit{\nu }}_{\overline{C}\widehat{C}}^{\omega })\ge {\delta }_{\star }^2/(2\ln 2)>0$ by Pinsker’s inequality. This prospective approach has the advantage that, in the DI case, it seems plausible that we still have continuity with respect to $\delta$ even after later proof steps where we further minimize over the GEATT channels themselves (to accommodate all possible measurements and dimensions). However, we leave a rigorous proof of these continuity claims for future work since here we only aim to give a plausibility argument that $h_{\widehat{\alpha }}$ is “usually” nonzero.

The latter bound holds whenever $\overline{C}$ has the property that it can be “projectively reconstructed” from $S\widehat{C}E$ in the sense of Lemma B.7 of Ref. [1], by simply observing that, in that case, the lemma gives us $H_{\alpha }(S\overline{C}|\widehat{C}E\tilde{E})=H_{\alpha }(S|\widehat{C}E\tilde{E})$ and $H(S\overline{C}|\widehat{C}E\tilde{E})=H(S|\widehat{C}E\tilde{E})$, so we can apply the continuity bound of Lemma B.9 of Ref. [1] without including $\overline{C}$.

Similar to Ref. [2], this choice is just to demonstrate a possible scaling; for the best finite-size bounds, one should optimize the Rényi parameter choices numerically for each $n$.

One can tune ${\alpha }^{\prime }$ and ${\alpha }^{\prime \prime }$ in other ways; e.g., if we fix one as a constant and set the other to $1+\mu$, then we can obtain $\widehat{\alpha },\alpha =1+\mu +O({\mu }^2)$, but this approach sacrifices the option to bring the constant one closer to 1.

We highlight that this loss comes inherently from the Lemma V.1 bound rather than the subsequent bound in Eq. (92) since the latter is an equality in such scenarios.

Alternatively, one can directly show that this expression is jointly convex in $(\mathbf{t},{\breve{\mathit{\nu }}}^{\omega }(\overline{c}\widehat{c}))$ by using the fact that the function $x\log (x/y)$ is jointly convex on $(x,y)\in {\mathbb{R}}_{\ge 0}^2$. However, this case ignores any “coupling” with the prefactors of the entropy terms in, e.g., Lemma V.1.

This claim is, in fact, somewhat delicate. First, note that for $n$ IID instances of a Bernoulli random variable with expectation $p_{\exp }$, if we write the observed success frequency as $Q_{\mathrm{obs}}$, then the probability that $|Q_{\mathrm{obs}}-p_{\exp }|$ exceeds some value $\delta$ can be shown to be at most $2e^{-\frac{{\delta }^{2}n}{3p_{\exp }}}$ by a Chernoff bound argument. Thus (focusing only on the $\perp \perp$ term and ignoring contributions from other test-round outcomes), we can choose ${\delta }_{\gamma }={\delta }_{\gamma }^{\prime }=\sqrt{(3\gamma /n)\log (2/{ϵ}_{\mathrm{com}})}$ while still ensuring an accept probability of at least $1-O({ϵ}_{\mathrm{com}})$ on honest IID behavior (by applying the Chernoff bound argument with $p_{\exp }=\gamma$, viewing a single-round “success” as the event that $\perp \perp$ did not occur). In that case, if we pick the scaling of $\gamma$ with $n$ to be any function that goes to zero more slowly than $1/n$ (as is indeed the case in the subsequent analysis), we see that ${\delta }_{\gamma }$ and ${\delta }_{\gamma }^{\prime }$ would indeed become arbitrarily small compared to $\gamma$. However, if we pick $\gamma \propto 1/n$ exactly, this argument does not work, just as in Ref. [2]. We leave a more detailed analysis [perhaps preserving the $D(\mathbf{r}\parallel \mathbf{s})$ term to avoid invoking an explicit lower bound on ${\gamma }_q$] for future work.

The KL divergence term is already convex, so it suffices to show convexity of this entropy term alone. Still, it is true that, in principle, there may be situations where the sum of the KL divergence term and entropy term is convex even if the latter is not convex by itself—considering this possibility might help in tackling the issue we shall shortly discuss regarding the full linear combination ${\sum }_{\overline{c}\widehat{c}}q(\overline{c}\widehat{c})H(S|E\tilde{E}{)}_{{\nu }_{|\overline{c}\widehat{c}}^{\omega }}$. However, we leave this more elaborate possibility for future work, if it is relevant.

If $\mathcal{Z}$ and $\mathcal{G}$ are not trace preserving, care is needed to ensure consistency with the definition in Eq. (16) we chose here for Umegaki divergence.

Note that in the $G_{\alpha ,\rho }^{*}$ formula, the first case can still take a value $+\infty$ for some values of $\mathit{\lambda }$ due to the $D(\mathit{\lambda }\parallel {\mathit{\rho }}_{\overline{C}\widehat{C}})$ term. Specifically, this happens whenever $\mathrm{supp}(\mathit{\lambda })\cancel{\subseteq }\mathrm{supp}({\mathit{\rho }}_{\overline{C}\widehat{C}})$.

In this lemma, Lagrange dual problems are defined in the sense described in, e.g., Ref. [26]. Since the constraints are equality constraints, there is an arbitrary sign convention to pick when defining the dual variables; see the last line of Eq. (112) for the sign convention we used.

In this paragraph, we informally refer to “the” best choice of $f$, though this is technically a misnomer because it is necessarily nonunique—given any QES $f$ in Corollary V.1, inspecting the bound shows that $f+\kappa$ for any $\kappa \in \mathbb{R}$ yields an identical bound since the $\kappa$ dependence “cancels off.” (Loosely speaking, this nonuniqueness seems to arise from the implicit normalization constraint in the domains $S_{\mathrm{\Omega }}$ and ${\mathbb{P}}_{\overline{C}\widehat{C}}$, though we leave further analysis for future work.) Furthermore, it might potentially be possible that the optimal $f$ is not attained, as we discuss later. However, this nonuniqueness or nonattainability does not have any effects on our actual proofs of Lemma V.4 or Theorem V.1; we are merely highlighting a technicality in our informal statements here.

For our proofs, let us say continuity and closedness are defined with respect to the topology induced by, say, the 1-norm.

This is because we have argued above that the expressions in Eqs. (78) and (79) are equal for any choice of purifying function, which means that the latter is independent of the choice of purifying function. Thus, we can focus on any specific choice without loss of generality; in particular, under the finite-dimensionality assumption, we can pick the one shown in Eq. (29), which is indeed continuous (this can be seen by, e.g., computing the fidelity between purifications of $\delta$-close states under that formula and then applying Fuchs–van de Graaf to convert to 1-norm distance).

An alternative approach, similar to the convexity argument above: After noting that ${\nu }^{\omega }$ is continuous in $\omega$, observe that $G_{\widehat{\alpha },{\nu }^{\omega }}(\mathbf{f})=-H_{\widehat{\alpha }}^f(S\overline{C}|\widehat{C}E\tilde{E}{)}_{{\nu }^{\omega }}=M-H_{\widehat{\alpha }}(DS\overline{C}|\widehat{C}E\tilde{E}{)}_{{\nu }^{\omega }}$ for a suitable extending channel as defined in Lemma IV.1, so $G_{\widehat{\alpha },{\nu }^{\omega }}(\mathbf{f})$ is continuous in $\omega$ (by the continuity of conditional Rényi entropy with respect to the state). This implies that $G_{\widehat{\alpha },{\nu }^{\omega }}^{*}(\mathit{\lambda })$ is lower semicontinuous with respect to $(\mathit{\lambda },\omega )$ since it is a supremum over a family of functions $\mathit{\lambda }·\mathbf{f}-G_{\widehat{\alpha },{\nu }^{\omega }}(\mathbf{f})$ that are each lower semicontinuous with respect to $(\mathit{\lambda },\omega )$. Thus, we have lower semicontinuity of $G_{\widehat{\alpha },{\nu }^{\omega }}^{*}(\mathit{\lambda })+(\mathbf{q}-\mathit{\lambda })·\mathbf{f}$ with respect to $(\mathbf{q},\mathit{\lambda },\omega )$, which suffices to apply the version of our subsequent argument based on Sion’s minimax theorem (which only requires semicontinuity rather than continuity).

The registers $\tilde{A}$ in these statements are intended to include shield systems as well, if required by the security proof.

While we also applied Lemma B.5 of Ref. [1] to account for conditioning on $\mathrm{\Omega }$, note that when applying the Rényi privacy amplification theorem of Ref. [10], the $[\alpha /(\alpha -1)]\log [1/(\mathrm{Pr}[\mathrm{\Omega }])]$ term essentially does not affect the final key rates—see, e.g., Refs. [10, 11] or Secs. 7b and 7c of this work.

Since the test rounds are only measured in the $X$ basis, in this formula, we could instead view $Q_{\text{thresh}}$ as only being the “phase error rate” rather than the QBER with respect to multiple bases. However, since the error-correction term ${\lambda }_{\mathrm{EC}}$ instead depends on error rates in generation rounds (i.e., the $Z$-basis error rate), for simplicity, in this analysis we view $Q_{\text{thresh}}$ as a single QBER parameter that characterizes error rates in any basis; thus, we can use it in the formula in Eq. (133) for ${\lambda }_{\mathrm{EC}}$.

In other words, after they have XOR’d their outcomes with the symmetrization bit $F$. Note that, strictly speaking, in order to apply EURs to the values $S$, $X$, and $\tilde{X}$ (which are produced after symmetrization, i.e., not the raw outcomes of $X$ or $Z$ measurements), we are implicitly applying a standard argument [81] that the same overall state (including all side information) could instead be produced by just taking the raw outcomes of measurements on some other initial state, essentially by “commuting” the symmetrization with the measurements by reexpressing it as a rotation on the premeasurement qubits. An alternative option would be to omit the symmetrization step and instead use, e.g., Fano’s inequality to write $H(X|\tilde{X}{)}_{{\nu }_{|\widehat{C}\ne \perp }}\le h_{\mathrm{bin}}(\mathrm{Pr}[X\ne \tilde{X}]|\widehat{C}\ne \perp )$ for the purposes of the bound in Eq. (135), but this would require more steps to extend to the Rényi EUR bound in Eq. (142).

Note that this event is a stricter condition than just the acceptance test accepting (which would be the event ${\mathrm{freq}}_{{\widehat{c}}_1^n}\in S_{\mathrm{\Omega }}$), so it remains the case that every distribution ${\widehat{c}}_1^n$ with nonzero probability in the conditional state ${\rho }_{|\mathrm{\Omega }}$ satisfies ${\mathrm{freq}}_{{\widehat{c}}_1^n}\in S_{\mathrm{\Omega }}$; i.e., the first condition on $S_{\mathrm{\Omega }}$ in Theorem V.1 indeed holds. Also note that we are implicitly exploiting the fact that, in Theorem V.1, $\mathrm{\Omega }$ does not have to be an event defined entirely on the ${\widehat{C}}_1^n$ registers, as discussed in Corollary IV.1.

The parameter ${ϵ}_{\mathrm{EV}}$ here is denoted as ${ϵ}_{\mathrm{KV}}$ in Ref. [21]; we have used different notation simply because we refer to the relevant step as “error verification” instead of “key validation.”

To obtain this result, we have basically added the correctness and secrecy parameters from Ref. [21], except that the secrecy parameter in that work is rescaled by a factor of 2 as compared to Refs. [6, 84], so we have first adjusted it accordingly. We have also removed the dependence of the secrecy parameter in that work on ${ϵ}_{\mathrm{EV}}$ because, for our protocol, we perform the acceptance test directly on the ${\widehat{C}}_1^n$ registers rather than guessing; see Ref. [11].

It would have been cleaner if we could directly “accumulate” $H_{\infty }^{\uparrow }$; however, it can be seen that our bounds for the EAT or GEAT scenarios involve $H_{\alpha }$ rather than $H_{\alpha }^{\uparrow }$ in the single-round terms, and therefore, we cannot directly make use of a bound on single-round $H_{\infty }^{\uparrow }$ without first converting it to $H_2$. (For the Ref. [17] scenario though, the bounds we presented in Sec. 6b are indeed based on single-round $H_{\alpha }^{\uparrow }$, which would indeed allow us to directly accumulate min-entropy.) In any case, for the CHSH game, in particular, Ref. [58] showed that the bound in Eq. (148) is, in fact, tight for both $H_2$ and $H_{\infty }^{\uparrow }$, so there is no loss of tightness in considering the former instead for this particular protocol.

Again, we could instead convert to $H_{\min }^{{ϵ}_{\mathrm{s}}}$ and apply the corresponding privacy amplification theorem (under the current state of results in privacy amplification, this may be necessary if the protocol uses Trevisan’s extractor instead of 2-universal hashing). However, in that case, we find no improvement in $n_{\min }$ over Eq. (150), though we can at least obtain about $n_{\min }=3\times {10}^{10}$, which is still better than Ref. [46]. The issue basically seems to be that, for security proofs based on our $H_{\min }^{{ϵ}_{\mathrm{s}}}$ bound rather than our $H_{\alpha }^{\uparrow }$ bound, one has to pick a “threshold” value ${ϵ}_{\mathrm{a}}$ and split the analysis into cases where $p_{\mathrm{\Omega }}$ is above or below ${ϵ}_{\mathrm{a}}$; this introduces additional finite-size corrections, and the resulting ${\ell }_{\mathrm{key}}$ formula then fails to reduce to Eq. (150) in the $\alpha \to 2$ limit.

In fact, another potential question is whether we would actually obtain better $n_{\min }$ values via this von Neumann entropy approach; we leave this question for future work. One point that may be worth highlighting is that, similar to the advantage of Eq. (143) over Eq. (136) in the previous section, working with the collision-entropy bound in Eq. (148) ensures that the optimization for the “first-order term” always returns a strictly positive value, unlike the relaxation to von Neumann entropy via the continuity bound in Eq. (86), which may yield a negative value if ${\alpha }^{\prime }$ is not sufficiently close to 1. Hence, it seems likely that the collision-entropy approach will indeed be better for small $n$, where the optimal Rényi parameters are further from 1.

For readers familiar with Ref. [90], we highlight that, in principle, Theorem V.1 in this work could be used to bound the Rényi entropy conditioned on any particular frequency distribution observed on the ${\overline{C}}_1^n{\widehat{C}}_1^n$ registers, which roughly satisfies the requirements for applying the analysis in Ref. [90], except that the bound has an explicit dependence on $p_{\mathrm{\Omega }}$. Therefore, a direct calculation along the same lines as in that work would result in the final security parameter being multiplied by the number of possible frequency distributions. This result is somewhat undesirable; however, in principle, it is described by a combinatorial coefficient that “only” increases polynomially in $n$. This outcome may be tolerable in practice, as suggested by proofs based on the postselection technique that introduce such polynomial factors [91, 92], albeit based on the dimensions of the quantum systems rather than the classical outcomes (the approach suggested here would hence be superior to the postselection technique for DI protocols or other contexts where the dimension dependence is improved via this approach).

We could obtain a similar result by instead using the chain rule from Ref. [42] here to extract a $H_{1/2}^{\uparrow }(Z_1^n|T_1^n{)}_{{\rho }_{|\mathrm{\Omega }}}$ term, but this would have a (fairly minor) disadvantage of causing a small “higher-order” change in Rényi parameter, comparable to Eq. (64). Note that even with this, our approach would still differ slightly from Ref. [5] due to how we bound the $H_{1/2}^{\uparrow }(Z_1^n|T_1^n{)}_{{\rho }_{|\mathrm{\Omega }}}$ term in the subsequent steps.

Furthermore, in our bound the subtracted term simply has the form ${\gamma }^{\max }n\log |\mathcal{Z}|$, where ${\gamma }^{\max }$ only needs to be chosen to be sufficiently large for the honest IID behavior to accept with high probability. In comparison, the subtracted terms in Refs. [5, 29, 36, 58] were roughly of the form $\gamma n\log |\mathcal{Z}|+O(\sqrt{n})$, where the $O(\sqrt{n})$ term accommodated potential non-IID behavior. It seems likely that the former value is smaller, though we do not aim to prove this rigorously. (We briefly highlight, however, that Ref. [37] introduced an approach in which the subtracted term was also roughly of the form ${\gamma }^{\max }n\log |\mathcal{Z}|$, though there was still a change of smoothing parameter.)

While ${\mathcal{N}}_j$ performs a pinching channel on ${\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}$ in contrast to ${\mathcal{M}}_j$, which acts as an identity on those registers, it does not make a difference for states produced by applying those channels in sequence because ${\mathcal{N}}_{j-1}\circ \dots \circ {\mathcal{N}}_1[{\omega }^0]$ is always already classical on ${\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}$. Similarly, the second and third steps performed by ${\mathcal{N}}_j$ do not disturb the classical registers they act on.

In this step, let us take $\tilde{E}$ to be of large enough dimension to be a purifying register for the input registers in the ${\mathcal{N}}_j$ scenario as well, which can be achieved without loss of generality by expanding its dimension as necessary.

For strict technical accuracy in the following steps, these conditional states should be interpreted to still include the registers ${\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}$, though with those registers simply taking the fixed value ${\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}$.

While the QES $f_{|{\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}}$ depends on ${\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}$, its value is fixed by the initial choices in the theorem, not by the state.

Pedantically, to ensure there are no issues involving the dependence of the summation domain in Eq. (b28) on $\omega$, we should first note that we can extend the summation domain to the full alphabet $\overline{\mathcal{C}}\times \widehat{\mathcal{C}}$ without changing the value of $G_{{\alpha }^{\prime },{\alpha }^{\prime \prime },{\nu }^{\omega }}(\mathbf{f})$ (in this case, there are no divergence terms in the sum, so we do not encounter any technical issues).

An alternative approach for the purposes of our analysis would be to simply restrict the alphabet of the registers $\overline{C}\widehat{C}$ to ${\mathcal{C}}_{\mathcal{M}}$ rather than $\overline{\mathcal{C}}\times \widehat{\mathcal{C}}$ since the values outside ${\mathcal{C}}_{\mathcal{M}}$ will never occur and thus have no “physical relevance.” However, this approach would result in the slightly unpleasant side effect that the resulting alphabet is not guaranteed to have a Cartesian-product form.

An alternative option is as follows: Since the mapping $\omega \to {\nu }_{\overline{C}\widehat{C}}^{\omega }$ is a quantum-to-classical channel, one can show that it must be of the form $\omega \to {\sum }_{\overline{c}\widehat{c}}{\mathrm{Tr}}_{{\mathrm{\Gamma }}_{\overline{c}\widehat{c}}\omega }[|\overline{c}\widehat{c}⟩⟨\overline{c}\widehat{c}|]$ for some POVM elements ${\mathrm{\Gamma }}_{\overline{c}\widehat{c}}$; furthermore, we must have ${\mathrm{\Gamma }}_{\overline{c}\widehat{c}}\ne 0$ for all $\overline{c}\widehat{c}\notin {\mathcal{C}}_{\mathcal{M}}$. Thus, we can show that any full-support ${\omega }_{\tilde{Q}}$ yields a distribution ${\mathit{\nu }}_{\overline{C}\widehat{C}}^{\omega }$ with full support on ${\mathcal{C}}_{\mathcal{M}}$ (at least assuming countable dimensions; the argument should generalize further in some fashion but we do not consider this here), giving the desired result.

Here, we did not simply try to apply Slater’s condition to the original constrained optimization in Eq. (109) because it would require the existence of some $\omega$ in the relative interior of the effective domain of $G_{\widehat{\alpha },{\nu }^{\omega }}^{*}(\mathit{\lambda })$ (i.e., the domain on which it takes finite values), which is more subtle in the infinite-dimensional case. However, for the finite-dimensional case, in our above proof of the finiteness of $J_{\widehat{\alpha }}$, we argued that $G_{\widehat{\alpha },{\nu }^{\omega }}^{*}(\mathit{\lambda })$ is finite over all full-support $\omega$, and hence any full-support $\omega$ yields such an interior point.

However, this proof method still does not immediately certify dual attainment, despite using Slater’s condition, because, when transforming the optimizations, we only focused on preserving the optimal value rather than other properties such as dual attainment. We leave a more extensive analysis of such aspects for future work, if it should become important.

For the $\overline{c}\widehat{c}\notin {\mathcal{C}}_{\mathcal{M}}$ terms, there is no need to include any “$\delta$ tolerances” here because zero-probability events (on a finite alphabet) would never occur. There is a technical issue that the supporting alphabets induced by ${\mathcal{M}}_j$ versus $\mathcal{M}$ might be different, in principle, but we do not expect this situation to arise in practice.

The data-processing inequality for Petz entropies is usually only stated for $\alpha \in (0,2]$; here, we extend it to $\alpha =0$ by noting that, by definition, the value of ${\overline{D}}_0$ is given by the $\alpha \to 0$ limit, and thus we indeed have ${\overline{D}}_0(\rho \parallel \sigma )-{\overline{D}}_0(\mathcal{E}[\rho ]\parallel \mathcal{E}[\sigma ])={\lim }_{\alpha \to 0}({\overline{D}}_{\alpha }(\rho \parallel \sigma )-{\overline{D}}_{\alpha }(\mathcal{E}[\rho ]\parallel \mathcal{E}[\sigma ]))\ge 0$.

Qualitatively, this condition states that $V_j$ does not signal from $E_{j-1}$ to $R_j{\overline{C}}_j{\widehat{C}}_j{F}_j$. Also note that the choice of Stinespring dilation can be arbitrary here due to isometric equivalence of purifications.

Formally, this means we suppose that $E_j$ is isomorphic to ${\widehat{C}}_j{T}_j{E}_{j-1}$, so we can define an “identity channel” ${\mathrm{id}}_{{\widehat{C}}_j{T}_j{E}_{j-1}\to E_j}$ and say that ${\mathcal{M}}_j$ has the form ${\mathrm{id}}_{{\widehat{C}}_j{T}_j{E}_{j-1}\to E_j}\circ {\tilde{\mathcal{M}}}_j$ for some ${\tilde{\mathcal{M}}}_j:R_{j-1}\to S_j{\overline{C}}_j{\widehat{C}}_j{T}_j{R}_j$.

For instance, it seems potentially useful to instead consider $H_{\widehat{\beta }}(D_j{S}_j{\overline{\overline{C}}}_j|{\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}{R}_j{F}_1^j{G}_1^j\tilde{E}{)}_{{\nu }^{\prime }}$ in Eq. (e12) and then try to lower bound it with ${\min }_{{\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}}{H}_{\widehat{\beta }}(D_j{S}_j{\overline{\overline{C}}}_j|R_j{F}_1^j{G}_1^j\tilde{E}{)}_{{\nu }_{|{\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}}^{\prime }}$, but the issue is that ${\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}$ might not be classical in the state ${\nu }_{D_j{S}_j{\overline{\overline{C}}}_j{\overline{C}}_1^{j-1}{\widehat{C}}_1^{j-1}{R}_j{F}_1^j{G}_1^j\tilde{E}}^{\prime }$, and hence ${\nu }_{|{\overline{c}}_1^{j-1}{\widehat{c}}_1^{j-1}}^{\prime }$ is less easily defined.

Strictly speaking, that result is only stated for $\beta \in (0,\infty )$, but we can first suppose that $\alpha >1/2$ so that $\beta <\infty$; then, to obtain our desired result for $\alpha =1/2$, we can take the $\alpha \to 1/2$ limit at the end, exploiting continuity of the sandwiched Rényi divergences with respect to $\alpha$ (Corollary 4.2 of Ref. [30] together with the fact that convex functions are continuous on the interior of their domain).

Technically, for $\beta >1$ (i.e., $\alpha <1$), we have $\mathrm{supp}({\rho }_{A_{1}C})\subseteq \mathrm{supp}({\mathbb{I}}_{A_1}\otimes {\sigma }_C)$ since, by definition, the state $\sigma$ satisfies $D_{\beta }({\rho }_{A_{1}C}\parallel {\mathbb{I}}_{A_1}\otimes {\sigma }_C)\le D_{\beta }({\rho }_{A_{1}C}\parallel {\mathbb{I}}_{A_1}\otimes {\rho }_C)<+\infty$. From the definition of ${\nu }_{A_{1}C}$, it can then be seen that, in fact, $\mathrm{supp}({\rho }_{A_{1}C})$ and $\mathrm{supp}({\nu }_{A_{1}C})$ are equal in this case; thus, the implication indeed holds in both directions, and we obtain the equality $H_{\infty }(A_2|A_{1}C{)}_{\nu }=H_{\infty }(A_2|A_{1}C{)}_{\rho }$. However, this argument seems less straightforward to generalize to the $\beta <1$ regime, where $D_{\beta }({\rho }_{A_{1}C}\parallel {\mathbb{I}}_{A_1}\otimes {\sigma }_C)<+\infty$ does not imply $\mathrm{supp}({\rho }_{A_{1}C})\subseteq \mathrm{supp}({\mathbb{I}}_{A_1}\otimes {\sigma }_C)$; in fact, in that regime, we generally have $\mathrm{supp}({\sigma }_C)\subseteq \mathrm{supp}({\rho }_C)$ instead (Sec. III B in Ref. [32]).