Why does an optimal collective attack correspond to a case involving purification of a biparitite state shared between Alice and Bob?

Question

In Acin's paper (arXiv), it is mentioned that, given Eve chooses to do a collective attack (which roughly means Eve applies the same attack to each system of Alice and Bob, and that the devices with Alice and Bob are memoryless so they behave independently and identically at each step of the protocol), an optimal collective attack corresponds to the case where the tripartite state $\vert \psi_{ABE} \rangle$ is the purification of the bipartite state $\rho_{AB}$ shared by Alice and Bob.

Why is that so? I get the point that this means including Eve's knowledge would make noisy state $\rho_{AB}$ into a noiseless state $\vert \psi_{ABE} \rangle$, but this just says that Eve has some knowledge. How does this translate to it being a requirement for a collective attack to be "optimal"?

Answer 1

I will give the rough explanation and let you fill in the details concerning that exact paper.

Your goal is to compute or lower-bound the quantity $$ \min_{\mathrm{attacks}} H(X|E) $$ where $H$ is the von Neumann entropy, $X$ is the output of Alice's measurement and $E$ is Eve's quantum system. Note in that paper they use the Holevo quantity but there is a relationship between the two. The minimization is taken over all possible attacks (choices of states / choices of measurements) that the adversary can make that agree with the statistics you observe (in that paper a CHSH value).

But now suppose you found an attack $\rho_{ABE}$ that was not pure. Well, we know purifications always exist so we could find another attack $|\psi\rangle_{ABEF}$ where the system $F$ is purifying $\rho_{ABE}$. But suppose we give $F$ to Eve so she now has $EF$, morally, she now has more information so this cannot be worse that the original attack. Indeed, this is captured mathematically with the strong subadditivity inequality which states $$ H(X|E) \geq H(X|EF)\,. $$ What we have shown is that for every attack, there always exists an attack using a pure state that is at least as good. Therefore when we look for the optimal attack it is sufficient to check only pure states.