How much can Shamir secret sharing leak when devices use correlated quantum resources?

Trace distance measures how well an adversary separates two secrets

The paper asks what an adversary learns when every device releases a small quantum output computed from its classical Shamir share. Each device receives one share, acts on its register of an initial quantum resource, and emits one qubit. The adversary collects all emitted qubits together with an initial reference and may process them jointly. The resource is independent of the secret and the sharing randomness, and devices do not communicate or receive adversary feedback during leakage.

Security is measured by the trace distance between the states the adversary receives under two chosen secrets, halved: Adv(ρ,σ) = ½‖ρ−σ‖₁. A small value means the two secrets are hard to distinguish. Every statement is claimed for every pair of chosen secrets and every permitted family of local maps, so the bound is not tied to one particular strategy.

This measure matters because it is not the same as the classical secrecy threshold of Shamir sharing. Fewer than t shares reveal no information in the original scheme, but here each device emits a qubit derived from its share, and the question is how much those emitted qubits plus an arbitrary finite reference can reveal. The paper's positive results are about exponential decay of this trace distance, not about reconstructing the secret exactly.

Primitive transfer channels make leakage decay exponentially

The main positive result covers a fixed quantum memory whose transfer channel is primitive, meaning the channel forgets its initial state. For every fixed finite-dimensional emission channel with this property, there are constants δ, c > 0 and n₀ such that for n ≥ n₀ and t/n ≥ 1−δ, the leakage states of any two secrets have trace distance at most 2^(−cn). Here n is the number of devices and t is the reconstruction threshold.

The constants are uniform over the initial memory state, the permitted local maps, finite adversary references, every prime p > n, and distinct nonzero evaluation points. The adversary may hold any extension of the device marginal, including the final memory and preparation environments. The same type of guarantee holds for restrictions of a fixed stationary quantum chain satisfying an upper operator mixing condition, and pure matrix product states with fixed canonical tensors and a primitive transfer channel inherit the bound uniformly over their two open boundary vectors.

Primitivity is a substantive restriction, not a technical convenience. The usual memory that copies a classical basis label can generate a GHZ resource and enable the known attack, so it does not give exponential security. The paper also exhibits a family of two-dimensional primitive memories, varying with the number of shares, that retains constant leakage. The positive memory result therefore requires a fixed process or uniform control of its mixing, not merely primitivity at each system size.

Independent device–reference pairs set the quantitative foundation

The quantitative input to all later comparisons is a leakage bound for independent device–reference pairs, where the initial resource factors as a tensor product over devices and each reference register is held by the adversary. When the initial resource factors this way, one-qubit leakage is exponentially small at every reconstruction rate above τ_ref ≈ 0.9197212757 by a fixed margin, and classical-bit leakage has the sufficient rate τ_cl ≈ 0.7172542188. Both statements allow arbitrary finite references, including entanglement within each initial pair.

These rates are sufficient, not claimed optimal below full threshold. The corresponding scalar rates in the earlier work by Batra, Kitagawa, Nishimaki, and Yamakawa are 0.9331803707 for independent blocks of two devices and 0.7333927776 for unentangled one-qubit leakage without outside quantum references. The paper sharpens the relevant moment bounds by treating opposite Fourier frequencies together, which is why the sufficient rates improve, but it makes no optimality claim below full threshold.

The bound is independent of the reference dimension. An unbounded adversary reference prevents a direct bound on the dimension of the analyzed local output, so the proof replaces it with domination by one reference state uniformly over the share value. A dominated-state Fourier estimate then combines with the dual MDS code of Shamir sharing to control leakage on the selected set.

At full threshold the optimal base depends on dimension and Schmidt number

At full threshold t = n, the paper determines how the optimal exponential base depends on entanglement assistance. For a d-dimensional output and initial pairs of Schmidt number at most r, the exact base is (dr/π) sin(π/(dr)), for d ≥ 2 and 1 ≤ r ≤ d. With unrestricted entanglement assistance the base becomes (d²/π) sin(π/d²), and with a classical output alphabet of size d it is (d/π) sin(π/d), even in the presence of arbitrary finite references.

For the qubit case this gives 2√2/π, and for a classical bit it gives 2/π. The largest leakage distance is bounded above and below by constant multiples of the corresponding base to the power n, uniformly in the field and evaluation points, and a dense-coding construction attains the lower bound for every prescribed pair of distinct secrets. The Schmidt number of a mixed state is the smallest bound on the Schmidt ranks in a pure-state decomposition, so it quantifies how much entanglement assistance the initial pairs carry.

The distinction between these bases matters because they answer different questions. The qubit base 2√2/π applies to one-qubit leakage with independent device–reference pairs at full threshold, while the classical-bit base 2/π applies to a classical output alphabet. The general (dr/π) sin(π/(dr)) formula interpolates across output dimension and Schmidt number, so a reader comparing leakage rates should not substitute one base for another without matching the output type and entanglement assistance.

A product comparison transports the bound to correlated resources

To pass from independent pairs to correlated resources, the paper bounds a selected device marginal above by a scalar multiple of a product state. Revealing the complementary shares leaves an exact smaller Shamir instance, and a filter on the adversary's reference, using the postselection mechanism of Christandl, König, and Renner, transfers the bound for independent device–reference pairs with the same multiplicative factor. This argument permits arbitrary correlations with the unselected devices and the adversary.

The reduction has two resource-dependent inputs: a one-device Fourier estimate and a bound on a selected marginal. The Fourier estimate controls leakage for independent device–reference pairs by the dual MDS code of Shamir sharing, and the marginal comparison then transports that bound to the resource under study. Each structural application therefore reduces to identifying a large selected set and controlling its domination factor.

The same comparison gives security conditions for resources described in other ways. In a network of independent bipartite sources, an independent vertex set leaves independent device–reference pairs after the complementary registers and shares are revealed. For graph states, known reduced-state formulas express the comparison cost through the rank of the binary adjacency matrix across the selected cut, and suitable dense graph families have a product marginal on half of their vertices. For a pure state drawn from Haar measure, typical entanglement estimates instead give an approximately product marginal on slightly fewer than half of the qubits. Both the dense graph families and typical pure resources yield exponential security at rates above (1 + τ_ref)/2 by a fixed margin.

Constant-advantage attacks need logarithmic preparation depth

Preparation depth gives a complementary restriction on the correlations needed for an attack. The paper considers circuits starting from a product device marginal, with layers of disjoint fixed gates of fixed arity acting on complete device register groups. All causal influence passes through these gates, and no free global classical communication, adaptive feedforward, or postselection is included. Independent local ancillas and local channels may be included.

At full threshold, an attack of constant advantage requires depth of order at least log n, and the known GHZ attack can be prepared in depth of order log n. So logarithmic depth is necessary and sufficient in order of growth for constant-advantage attacks at full threshold in this preparation model. The restriction to complete groups is essential to this statement when a device may contain arbitrarily many registers, because with unlimited registers per device arbitrary parallel wire gates need not satisfy the hypothesis.

The depth barrier follows from a lightcone packing argument. Each output backward lightcone contains at most a^ℓ input groups, each input group belongs to at most a^ℓ output backward lightcones, and a greedy choice gives at least M = ⌈n/a^(2ℓ)⌉ outputs with disjoint backward lightcones. Their joint marginal is a product, and the residual threshold equals M, so the bound for independent device–reference pairs transfers without loss.

The guarantees stop at non-uniform mixing and below full threshold

The positive memory result requires a fixed process or uniform control of its mixing. Memory dimension and primitivity at each system size do not supply uniform mixing, as the example with a channel depending on n shows. The paper also notes that the sufficient rate for primitive memories depends on how many iterations are needed to compare the transfer channel with a reset channel, so the rate is not determined by dimension alone.

Below full threshold, the rates τ_ref ≈ 0.9197212757 and τ_cl ≈ 0.7172542188 are sufficient, with no optimality claim. The exact full-threshold exponential base is established only when reconstruction requires all shares. The paper explicitly leaves open the optimal threshold rate for exponential security below full threshold, whether the best sufficient rate for a fixed primitive memory can be obtained directly from its channel, and the optimal coefficient in the logarithmic preparation-depth requirement.

The scope conditions are also specific. The guarantees hold uniformly over prime fields larger than the number of shares and over distinct nonzero evaluation points, and they permit arbitrary extensions of the device marginal as adversary side information. They do not cover devices that communicate during leakage or receive adversary feedback, and they do not cover preparation models with free global classical communication, adaptive feedforward, or postselection.

Compare the leakage base before comparing security claims

The most decision-relevant comparison in this paper is between the exact full-threshold bases and the sufficient rates below full threshold. At full threshold, the base is (dr/π) sin(π/(dr)) for a d-dimensional output and Schmidt number at most r, reducing to 2√2/π for a qubit and 2/π for a classical bit. Below full threshold, the paper offers sufficient rates τ_ref ≈ 0.9197212757 for one-qubit leakage and τ_cl ≈ 0.7172542188 for classical-bit leakage, and it does not claim these are optimal.

A reader evaluating whether a correlated resource is safe should therefore first ask which regime applies. If reconstruction requires all shares, the exact base and its dependence on output dimension and Schmidt number are the right quantities. If reconstruction requires only a large fraction of shares, the sufficient rates are the relevant thresholds, and the gap to optimality remains open. If the resource is generated by a fixed primitive memory, the guarantee is exponential near full threshold, but a memory that copies a classical basis label can generate a GHZ resource and enable the known attack.

The paper's own priority is the reduction itself: security against local quantum leakage can be derived from a comparison of a selected device marginal with a product state. The estimate for independent device–reference pairs controls leakage on the selected set, exact conditioning on the complementary shares preserves uniformity in the field, and the marginal comparison transports the bound to the correlated resource. For readers deciding which resources to trust, the practical threshold is whether a large selected marginal can be compared with a product at small cost, because that comparison, not the memory dimension alone, determines whether the exponential guarantee applies.

Sources used in this answer