Entanglement with zero distillable secret key in local dimension ten

Proof. Choose Kraus matrices A_r\in\C^{b\times a} such that F(X)=\sum_r A_rXA_r^*. Then

which proves both CP assertions. Applying the simultaneous-transpose assertion to F\circ T_a or to T_b\circ F proves their equivalence. This argument works with rectangular Kraus matrices. The operator-sum representation is standard [39, 15].

Transpose is self-adjoint for the Hilbert–Schmidt inner product. Hence, when F is PPT,

are CP. This proves the PPT assertion for the adjoint, and simultaneous transposition gives the simultaneous transpose and transpose-adjoint. The output transpose of T_b\circ F is F, while that of F\circ T_a is T_b\circ F\circ T_a; all these maps are CP. This proves the remaining PPT assertions. With product bases, T_{b_1b_2}=T_{b_1}\otimes T_{b_2}, so the tensor-product assertion follows from closure of CP maps under tensor products. Finally, for P:\Mat{a'}\to\Mat a and Q:\Mat b\to\Mat{b'},

is a composition of CP maps. The untransposed composition is CP as well.□

Proof. The forward CP implication follows from (2.1). Conversely, write a positive Choi matrix as J(F)=\sum_r v_rv_r^*. There is a unique matrix A_r\in\C^{b\times a} with v_r=(I_a\otimes A_r)\Omega_a. Comparison of the (i,j) blocks gives F(E_{ij})=\sum_r A_rE_{ij}A_r^* and hence the Kraus representation of F. This is Choi’s finite-dimensional criterion [15].

If J(F) is separable, spectral decompositions of its positive factors write it as \sum_r a_ra_r^*\otimes b_rb_r^*. Comparison of blocks now gives the measure-and-prepare formula

Put E_r=(a_ra_r^*)^{\T}\succeq0. For W\succeq0, each partial matrix

is positive. Thus (\mathrm{id}_k\otimes F)(W) is a sum of positive products with second factors b_rb_r^*. The converse follows by applying the asserted property to W=\Omega_a\Omega_a^*. This proves the entanglement-breaking characterization [33, Theorem 4] at the level of the CP cone. The two transpose identities follow directly by reindexing the matrix units in (2.1).□

Proof. Refine a separable decomposition by the spectral decompositions of its positive factors. It then has the form Z=\sum_r v_rv_r^* with product vectors v_r=a_r\otimes b_r. Since \ker Z=\bigcap_r v_r^\perp, every v_r lies in (\ker Z)^\perp=\ran Z. If Z\ne0, at least one v_r is nonzero.□

Proof. Tensor the representing vectors and the first-party maps separately from the second-party maps, and use the canonical local permutation unitaries to group the systems. Tensor products of CP maps are CP, and input transpose in the grouped product basis is the tensor product of the individual input transposes. Hence the four maps required in (2.2) remain CP. The output is the tensor product of the original states and has trace one. The local permutation unitaries and their conjugates are CP pre- and post-compositions, so they do not affect the conclusion.□

Proof. Let A_r\in\C^{b\times a} and B_s\in\C^{c\times b} be Kraus matrices for F and G. Transposing the adjoint formula gives

Thus the Kraus matrices of F^\sharp:\Mat b\to\Mat a are the transposes A_r^{\T}. For each pair of Kraus matrices, direct expansion in the fixed bases gives

Summing the corresponding rank-one matrices proves (2.3). This is the rectangular CP form of the transpose-adjoint identity in [16, Lemma I.1(2)]; its use for local products of PPT maps is discussed there in Section IV.B.

Suppose now that F and G are PPT. Besides complete positivity of F^\sharp and G, Lemma 2.1 gives

These are exactly the input-transpose conditions for the two local maps in Definition 2.4. Finally,

The nonzero positive matrix Z has \lambda>0. Taking \chi=\Omega_b/\sqrt\lambda in (2.2) proves (2.4). Its squared norm is b/\lambda, which is allowed by the definition. No trace-preserving hypothesis or additional factor of b is used.□

Proof. A spectral decomposition of the positive block matrix expresses it as a finite sum of outer products of block columns \binom{a_k}{b_k}. Consequently H=\sum_k a_ka_k^*, J=\sum_k b_kb_k^*, and Z=\sum_k a_kb_k^*. Since a rank-one matrix ab^* has trace norm \norm{a}\,\norm{b}, the triangle inequality and Cauchy–Schwarz give

No inverse of a diagonal block is used.□

Proof. Fix a representation of \omega as above. Pull the four matrices back to the two input spaces by the Hilbert–Schmidt adjoints:

These matrices are positive. For instance, for every a\in\C^r,

We first replace the representation by one in which A_0 and A_1 commute; the two complete-positivity conditions will then give complementary estimates for each off-diagonal term of the input.

Normalization on the support. Set H=A_0+A_1, and let \Pi be the orthogonal projection onto \ran H. If a\in\ker H, the nonnegative numbers a^*A_i a=\norm{\sqrt{A_i}a}^2 sum to zero, so each A_i annihilates \ker H. It follows also that A_i=\Pi A_i\Pi. Define S to be H^{-1/2} on \ran H and the identity on \ker H. The matrix S is positive and invertible on all of \C^r, including when H=0. The two positive matrices

are supported on \Pi and satisfy A_0'+A_1'=\Pi. Hence they commute: [A_0',A_1']=[A_0',\Pi-A_0']=0.

This congruence can be made inside the representation without changing \omega. With \Ad_S(U)=SUS^*, replace

The resulting output is the same, and the pullbacks of X_i are A_i'. The new map is CP, and its input-transpose condition follows from

Thus it remains a representation of the kind required by Definition 2.4. We now suppress the primes.

The two block estimates. Let C=\mathcal L\otimes\mathcal M. For input vectors u,z\in\C^r\otimes\C^s, define

Complete positivity of C means that applying it entrywise to

gives a positive block matrix. Conjugate that matrix by \operatorname{diag}(\sqrt{D_{00}},\sqrt{D_{11}}) and apply Lemma 3.1. The result is

The second estimate concerns the same Z(u,z), but exchanges the two input vectors in the diagonal weights. In the product input basis the global input transpose is T_{rs}=T_r\otimes T_s. The map

is CP. Apply the preceding block argument to this map, with the ordered pair (\overline z,\overline u) and the same two output filters. The identities

show that the off-diagonal output is unchanged while the two diagonal inputs are exchanged. We obtain

It is the transpose on both input factors here that supplies this reverse estimate.

Splitting the input vector. Choose a common orthonormal eigenbasis of the commuting A_0,A_1. Let P be the projection onto the basis vectors on which the eigenvalue of A_0 is at least the eigenvalue of A_1, and set

Then \chi=v+w. Because PA_i(I_r-P)=0, the cross terms in the quadratic forms defining p_{ij} vanish. The eigenvalue comparison on the two subspaces, together with B_0,B_1\succeq0, therefore gives

For example, A_0-A_1 is positive on \ran P, so its tensor product with B_1 has nonnegative quadratic form on v; the second comparison follows on \ker P using B_0.

We can now bound the four terms in the expansion of C(\chi\chi^*). For the diagonal terms, (3.2) and (3.4) give

For Z(v,w) use the reverse estimate (3.3); for Z(w,v) use the direct estimate (3.2). Both right sides become the same:

Finally,

The triangle inequality now yields (3.1).□

Proof. Write a=\dim A and b=\dim B, and attach untouched finite references A_0\cong A and B_0\cong B. Run the protocol on the product of the normalized local probes

The protocol need not produce both bits on this auxiliary input. For this experiment assign bit zero in a laboratory if its prescribed bit is never produced, and retain a bit that has already been produced. The assignment is a measurable local rule. It does not replace the other laboratory’s output when only one output is missing. We will remove the contribution of these auxiliary defaults after recovering the actual input.

The proof has three steps. First, clauses 1–4 give conditional independence of the two local sampling tapes on the product probes, given the complete public transcript. Next, clauses 5–6 give positive reference measures; informationally complete tests turn the scalar independence into product matrix densities. Finally, a filter on the untouched references prepares (4.1) and transfers those densities to Eve’s actual blocks.

Conditional independence on the product probes. The scalar factorization has the finite private-coin rectangle property as a classical antecedent [6, Lemma 6.7]. We prove the complete-history version needed here before recovering its matrix-valued factors.

Choose a finite informationally complete POVM on each reference. One explicit construction in dimension d starts with the projections onto the basis vectors and onto

These projections span the real vector space of Hermitian matrices. If they are P_1,\ldots,P_N, the 2N effects P_k/N and (I-P_k)/N form a POVM with the same spanning property. Call the two resulting POVMs (E_r)_r and (G_s)_s. Because the references are untouched, these tests commute with all laboratory operations. Their joint statistics with the transcript and final bits can therefore be computed with the tests performed at the start.

In this tested product-probe experiment, sample C_0 with the same fixed law as in the actual run. Conditional on C_0, all local outcomes can be sampled using independent local random tapes U for Alice and V for Bob. The tapes may be taken as countable products of uniform variables, with coordinates reserved for the reference tests and any terminal readouts. They are chosen before the sampling; the local outcome histories are then functions of these tapes and the public record. At each local instrument, sample its conditional outcome law using a fresh uniform variable on that laboratory’s tape and apply the stipulated conditional state update. The tested input and private ancillas are a product across laboratories conditional on C_0, and each local update changes only its own local state. At a public-source step, sample \kappa_m(T_m,dc) using a fresh public uniform variable independent of the private tapes and all prior sampling variables; only the recorded draw enters the transcript. This step leaves the quantum registers unchanged. Induction over the specified finite prefixes therefore shows that this sampling has the genuine joint finite-prefix laws. For a standard Borel outcome space a probability kernel has such a jointly measurable sampler: one may code the space by a Borel subset of [0,1] and use the measurable kernel-sampling theorem [36, Appendix A1, Theorem A1.2, and Lemma 3.22]. The initial reference tests and each specified local terminal quantum readout are sampled in the same way. Their stated local compatible refinements give the genuine tested laws on the complete histories. A terminal classical readout is already a measurable function of its records. Each defaulted bit and each reference-test result is consequently a measurable function of that laboratory’s tape and the complete public transcript. This sampling describes the auxiliary product input; the actual input R need not have a product simulation.

Let T_m consist of C_0 and the first m subsequent public records, and let \mathcal F_m=\sigma(T_m). At a step sent by Alice the new record is measurable with respect to \sigma(U)\vee\mathcal F_m; at a step sent by Bob the analogous statement holds with V. At a public-source step with new draw C, the sampling construction gives

We show by induction that U and V are conditionally independent given \mathcal F_m. The assertion at m=0 follows from the product initial resources and independent private tapes conditional on C_0.

Suppose it holds at m and Alice sends the next record. For bounded measurable functions u and v, conditional independence gives

As \mathcal F_{m+1}\subseteq\sigma(U)\vee\mathcal F_m, conditioning this equality on \mathcal F_{m+1} shows that

Using the same equality inside the conditional expectation of u(U)v(V) gives

The Bob step is symmetric.

For a public-source step, let \varphi be a bounded measurable function of its new draw C, and write (\kappa_m\varphi)(T_m)=\int\varphi(c)\,\kappa_m(T_m,dc). The kernel condition and the induction hypothesis give

Testing against bounded \mathcal F_m-measurable factors times \varphi(C) and applying the monotone class theorem identifies conditional expectations on \mathcal F_{m+1}=\mathcal F_m\vee\sigma(C). Taking v=1 or u=1 shows that the respective conditional marginal is unchanged; taking both functions gives their product. Thus the same factorization (4.4) holds after the public-source step. The rules for speaker and stopping records are among these sender and public-source steps. If two messages were simultaneous, ordering them preserves the required measurability for the second, because it still depends only on its original earlier record. Fixed padding after a public stop also preserves the claim.

Set \mathcal F_\infty=\sigma(\bigcup_m\mathcal F_m)=\sigma(T), the sigma field of the actual complete transcript. The auxiliary sampling uniforms for later public draws are not adjoined. If Z is bounded, then

Indeed, these are the orthogonal projections of Z onto increasing closed subspaces of L^2. Their limit is the projection onto the closure of the union. Indicators of finite-prefix events belong to that union, and the monotone class theorem shows that their span is dense in L^2(\mathcal F_\infty). The limiting projection is therefore the indicated conditional expectation. For bounded u,v, the two conditional expectations on the right of (4.4) converge in L^2 and remain bounded. Cauchy–Schwarz applied to the difference of their products gives convergence in L^1. Passing to the limit in (4.4) proves

The tape spaces and \mathsf T are standard Borel. They admit regular conditional probability kernels and conditional integration of functions depending on t [36, Theorems 6.3–6.4]. Apply the last factorization to indicators from countable generating algebras for the two tape spaces, including the whole spaces, and discard the union of the resulting null sets. Their product rectangles form a \pi-system generating the product sigma field. Uniqueness of probability measures on that \pi-system then yields, on a single set of full transcript measure,

In particular this law factors the conditional expectations of any bounded measurable function of (U,t) and any bounded measurable function of (V,t). Thus the pair consisting of Alice’s defaulted bit and her reference-test result is conditionally independent of the corresponding pair for Bob, given t.

Positive reference measures and their densities. Return to the experiment in which the probes are retained and the reference tests are not performed. We first construct its reference matrix measure on the space of all genuine classical instrument histories, including private histories. The fixed initial law of C_0 and the specified finite-prefix instruments give a positive reference matrix measure at every prefix. Summing the next local outcome recovers the preceding reference measure because the total instrument is trace preserving. Integrating a public-source outcome does the same because its scalar kernel has total mass one and acts as the identity on the quantum registers. These measures are therefore consistent on finite cylinders.

Here is the countable extension in finite-dimensional terms. For a positive reference test, its scalar finite-prefix laws are consistent finite measures; after normalization, or by adjoining the complementary test outcome, the countable product extension theorem applies [36, Theorem 6.14]. It supplies a finite scalar measure on the countable standard Borel history space. Recover matrix entries from finitely many rank-one reference tests by polarization. For an arbitrary reference vector z, extend also its positive rank-one test. On finite cylinders the resulting scalar measure equals the quadratic form z^*W(\,\cdot\,)z of the recovered matrix measure. Uniqueness of finite measures on cylinders extends this equality to the entire history sigma field. Thus z^*W(S)z\ge0 for every measurable S and every z, so W is a positive matrix-valued measure. This argument constructs a measure for the untouched finite references; it asks for no limiting state of unused quantum memory.

Measurable terminal classical readouts and the local default rule now give measurable events in the history space. If a terminal quantum readout is used, the incoming local process stipulated in Definition 4.1, on those same instrument histories and with an untouched finite reference, together with its specified local instrument gives the bit-conditioned positive reference measures. Each instrument is selected from its own laboratory’s history and T; their joint refinement is obtained by the two local operations. Include the missing or noninvoked tag among the outcomes, so summing both local outcomes recovers the reference measure on the complete history. This terminal operation is a separate extension of that history; its outcome is included in the enlarged history before the classical readout. This is where clauses 5–6 supply the needed locality, prefix compatibility, and reference stability. Write \widehat W for the resulting positive reference measure on the enlarged history space. Its marginal on the preterminal history is W; when no readout is used, identify \widehat W with W using trivial terminal tags. The construction uses the genuine instrument records; the tapes above were only a sampling device for their tested scalar laws.

Let W_{ij}(S) be the restriction and pushforward of \widehat W to the defaulted bit pair (i,j) and transcript in a measurable set S\subseteq\mathsf T. Define the probe transcript law

It is a probability measure: the probe is normalized, the instrument totals preserve trace, and the defaults assign a pair on every history. For each i,j, positivity and \tr W_{ij}(S)\le\mu(S) imply absolute continuity of every matrix entry with respect to \mu. Hence there are entrywise Radon–Nikodym densities W_{ij}(t). Only the dominated finite-measure case is needed here. For completeness, if 0\le\nu\le c\mu, the functional g\mapsto\int g\,d\nu on simple functions is bounded in L^2(\mu) by Cauchy–Schwarz. Its Hilbert space representing vector is a density, and indicator tests show that the density lies between 0 and c. Apply this fact to the finitely many polarization tests for the matrix entries.

Testing the densities on a countable dense set of reference vectors shows that W_{ij}(t)\succeq0 outside one null set. The equality defining \mu also gives

Put

Both local pairs are positive, and \sum_i\tr U_i(t)=\sum_j\tr V_j(t)=1 almost everywhere.

The conditional scalar statistics of the reference tests are the traces against these densities. Their local marginals are \tr[E_rU_i(t)] and \tr[G_sV_j(t)], because the other POVM sums to the identity. Conditional independence from (4.5) therefore gives

for every i,j,r,s, outside one null set. The tensor products E_r\otimes G_s span the Hermitian matrices on A_0\otimes B_0. Equality against that spanning family proves

We have obtained the same two local matrix pairs for all four branches, without conditioning on a positive-probability singleton transcript and without making private instrument labels public.

Recovering the actual purification. Identify A_0\otimes B_0 with E in the product basis and define

The elementary identity (I\otimes S^\T)\sum_h|h,h\rangle=(S\otimes I)\sum_h|h,h\rangle shows that applying I_{AB}\otimes K to the product probes (4.3) gives exactly |\Psi_R\rangle. This joint filter on the references is an algebraic preparation of the input purification; the laboratories are not required to implement it. It need not be trace preserving or a contraction.

The same independent law of C_0 and the same C_0-conditioned local auxiliary resources are used on the probes and on the actual input. Consequently the filter also prepares the full initial joint law, including C_0 and those resources. On each finite cylinder of genuine histories, the reference matrix for this filtered input is K W(\,\cdot\,)K^*, because the references are untouched and the filter commutes with every local instrument. Every public-source update also commutes with the filter: at a given public record it multiplies both laws by the same scalar kernel and acts as the identity on the reference. The scalar entries on both sides are finite measures, so uniqueness extends their equality from cylinders to the full history sigma field. The same commutation holds for any appended terminal instrument by clause 6. Thus the filtered law on the enlarged history is K\widehat W(\,\cdot\,)K^*, and the identity holds for the bit-conditioned measures as well.

Let N be the event in this enlarged history space that at least one prescribed local bit is missing before the default rule. The event may depend on private records. On the actual input its probability is zero by hypothesis, so positivity gives

Every subevent of N has a positive filtered matrix bounded by this zero matrix. It therefore also contributes zero. Thus the local defaults leave the actual output measure unchanged, even though they may occur on the probes. The argument was made on full histories before discarding private records, so N need not be public.

It follows from (4.6) that the actual Eve density in branch (i,j) is K(U_i(t)\otimes V_j(t))K^*. The matrix (\sqrt R)^\T is Hermitian. Hence direct multiplication gives

Take X_i(t)=aU_i(t)^\T and Y_j(t)=bV_j(t)^\T, redefining them on a null set if necessary. Transposition preserves positivity, so these are measurable positive local matrices. The filtered total trace is one because R is normalized, and (4.2) follows. No inverse of R appears anywhere in the construction.□

Proof. Let \mathcal S=\supp(R^\T)\subseteq E. Schmidt decomposition gives an isometry V:\mathcal S\to\widetilde E with |\psi\rangle=(I_{AB}\otimes V)|\Psi_R\rangle; the canonical vector is supported on \mathcal S in its purifying factor. Choose any density operator \zeta on E, and define, with the compression term included into E from \mathcal S,

Compression is CP, as is the positive trace functional followed by preparation of \zeta. Their sum preserves trace, so \mathcal R is a channel. Its first term inverts V on the actual purifying support, and the second term vanishes there. Local operations on A,B keep each conditional purifying state supported in \ran V, and public-source steps act as the identity on that register, so recovery is exact in every transcript and bit branch. The same formula is valid when \widetilde E is larger than the finite purifying support, acting on trace-class inputs.

An ideal bit has the form \frac12\sum_{i=0}^1|i,i\rangle\langle i,i|\otimes\sigma. Applying \mathcal R\otimes\mathrm{id}_T to its Eve factor replaces \sigma by another normalized state and leaves that form intact. This includes ideal states with mass outside \ran V. Thus trace-norm contraction transfers any lower bound proved for the canonical output and every canonical ideal law to the output for the arbitrary purification and every ideal law in its larger space.□

Proof. Extend the partial isometries in the polar decompositions of the square matrices to unitaries, writing A=U\sqrt{A^*A} and B=V\sqrt{B^*B}. Then AB^*=U\sqrt{A^*A}\sqrt{B^*B}V^*, and unitary invariance of the trace norm proves (5.2). This extension is available even when either matrix is singular.

For (5.3), put A=\sqrt H, B=\sqrt J, and Z=A-B. The matrix Z is Hermitian and H-J=ZA+BZ. The spectral sign \operatorname{sgn}(Z) is a Hermitian contraction. Trace-norm duality and cyclicity therefore give

In a unit eigenvector of Z with eigenvalue z, positivity of A,B implies

Summing in an eigenbasis of Z shows \tr[|Z|(A+B)]\ge\tr Z^2. Finally,

Combining these inequalities proves the lower bound. No commutation of H and J was used. For the transpose identity, functional calculus gives \sqrt{H^\T}=(\sqrt H)^\T. The product of the two transposed square roots is (\sqrt J\sqrt H)^\T; transpose and adjoint preserve trace norm, proving f(H^\T,J^\T)=f(H,J).□

Proof. Group all of Alice’s factors and all of Bob’s factors, and set R=\omega^{\otimes n}. Lemma 2.5 gives R\in\mathscr C. First apply the classical readout of Eve’s retained complete public transcript, leaving her initial purifying register unchanged, and discard any extra retained registers. On the actual output this produces the full classical transcript together with the purification. On any ideal bit comparison state it produces an ideal bit with a classical-quantum comparison law. Next, Lemma 4.3 supplies a channel from the retained purifying space to the canonical one, leaving the transcript unchanged. It recovers the actual canonical output and again sends every ideal law to an ideal law. Trace-norm contraction under these Eve-side channels therefore reduces the claim to the canonical purification (4.1) and the full classical transcript T.

Apply Lemma 4.2 to obtain a finite transcript measure \mu, the positive factors X_i(t),Y_j(t), and the Eve densities \tau_{ij}(t) of (4.2). Fix any normalized positive matrix-valued comparison law \sigma_{ET} on the same transcript space.

Let \nu be the transcript law of \sigma_{ET}, namely \nu(S)=\tr\sigma_{ET}(S), and use the common finite measure \lambda=\mu+\nu. If h=d\mu/d\lambda, replace each actual density by h(t)\tau_{ij}(t) and both X_i(t) by h(t)X_i(t), leaving the Y_j(t) unchanged. Equation (4.2) then still holds, including where h=0. The ideal law has a positive density \sigma(t) with respect to \lambda and \int\tr\sigma(t)\,d\lambda(t)=1. Homogeneity preserves all actual probabilities and root-fidelity integrals in this change of measure. We now denote \lambda again by \mu. This common measure keeps singular parts of either original transcript law; there is no assumption that the ideal and actual laws have the same support.

For these common densities set

All P_{ij} are nonnegative and \sum_{i,j}P_{ij}=1. With A=\sqrt{D_{00}(t)}\sqrt R and B=\sqrt{D_{11}(t)}\sqrt R, the transpose invariance and (5.2) give

The privacy interpretation of an off-diagonal coherence norm as the fidelity of conditional Eve states is also used in the private-state approach [30, Eq. (7)]. Here the identity is applied to unnormalized branches at each complete transcript. Its proof includes singular R and singular effects.

Apply Lemma 3.2 at almost every t. Scalar Cauchy–Schwarz after integration gives

For example, \int\sqrt{p_{00}(t)p_{01}(t)}\,d\mu(t) is at most \sqrt{P_{00}P_{01}}. The factors need only be positive; no pointwise POVM normalization was used.

We next express what small distance from the fixed ideal bit would require of this same \mathfrak f. Let \eta be the unhalved trace-norm distance after the common transcript readout, and define

The unequal-bit blocks of the ideal state are zero. Additivity of the trace norm across the classical bit blocks, and then the triangle inequality within the two equal-bit blocks, give

Trace conservation gives one further inequality that is needed for the uniform constant. The actual equal-bit blocks have total trace 1-e, whereas the corresponding ideal blocks have total trace one. Thus

and (5.7) implies

Integrating (5.3) gives

On the other hand, Cauchy–Schwarz on the first two terms of (5.6) and the arithmetic–geometric mean inequality on the last give

The two estimates have the exact combined form

If \eta<1/5, then e<1/10. On 0\le e\le1/10 the function \sqrt{e(1-e)}+e is increasing and has value 2/5 at e=1/10. The right side of (5.9) is therefore strictly less than 2/5, while its left side is strictly greater than 2/5. This contradiction proves (5.4), uniformly in n, the represented state, the protocol, and the ideal comparison law.

Finally suppose a secure key-distillation sequence had \ell_n\ge1 for infinitely many n. Along those indices, the local classical channels that retain the first bit of each string and discard the other bits, while retaining E', map \gamma^{(\ell_n)}_{\sigma^{(n)}} to an ideal bit: exactly half the uniform strings have either first bit. Trace-norm contraction would make the resulting bit-output error tend to zero, contradicting (5.4). Thus every secure sequence has \ell_n=0 for all sufficiently large n. In particular its asymptotic lower rate is zero. The empty key achieves rate zero, so K_D(\omega)=0.□

Proof. For the first assertion, use the canonical factors from Lemma 4.2. Restrict their measure \mu to A and replace both X_0(t),X_1(t) by X_0(t)/r,X_1(t)/r, leaving the Y_j(t) unchanged. Each of the four blocks in (4.2) is divided by r, and its integral over A is the corresponding normalized accepted block. All probabilities and the root fidelity scale by the same factor 1/r. The accepted total trace is one, so the proof of (5.9), including e\le\eta/2, applies without change. The recovery and common-measure arguments cover arbitrary purifications and arbitrary ideal laws for the accepted output. No positive lower bound on r was used.

For the second assertion, let \delta_k be the probability of at least one abort, let \tau_k^{\mathrm{ok}} be the normalized non-aborting state when \delta_k<1, and let \xi_k be the normalized state on the aborting part when \delta_k>0. The completed state is the sum of these two positive classical parts with weights 1-\delta_k and \delta_k. Let \mathcal Q be the product of the two local classical channels sending each party’s own abort symbol to zero and fixing its bit values. It is defined on every completed output and preserves each non-aborting ideal bit \gamma_k. Since the trace-norm distance between normalized states is at most two,

The right side tends to zero under the stated hypotheses. This contradicts Theorem 5.3 for the completed bit-output protocol with the local replacement appended. The replacement uses only abort symbols actually available to the respective laboratories.

For the third assertion, denote the recovery channel for the kth embedding by \mathcal R_k. For any ideal bit \gamma_\sigma in the common space, applying this channel to Eve maps it to the ideal bit \gamma_{\mathcal R_k(\sigma)} on the kth output space and recovers \tau_k from \widehat\tau_k. Contraction and the per-protocol gap therefore give

The triangle inequality now yields

Only the completed actual outputs need converge. The embeddings must retain and permit recovery of the full purification and public records, so they do not coarse-grain that information. The argument requires no convergence on the auxiliary probe inputs and no factorization statement for the limit itself. In particular, it does not assume that finite padded transcript laws converge in trace norm to a law of an infinite transcript.□

Proof. Symmetric and exterior tensors. Index an orthonormal basis of \C^{10} by pairs 0\leq i\leq j<4, and an orthonormal basis of \C^6 by pairs 0\leq i<j<4, both in lexicographic order. Define isometries U:\C^{10}\to\C^4\otimes\C^4 and V:\C^6\to\C^4\otimes\C^4 by

Their ranges are the symmetric and antisymmetric tensor subspaces. Put

Thus U\widehat x=x\otimes x and UP_{\widehat x}U^*=P_x\otimes P_x. The coordinates of \widehat x are the ten quadratic monomials with nonzero normalization factors. Hence the quadratic hypothesis is equivalent to the assertion that any ten vectors among \{\widehat x:x\in\mathcal X\} span \C^{10}: a failure to span would give a nonzero vector u with u^*\widehat x=0 at those ten points, and u^*\widehat x is a nonzero homogeneous quadratic.

Identify \C^6 with \bigwedge^2\C^4 by e_{ij}=e_i\wedge e_j, with this basis orthonormal. Under this identification,

For i<j, let k<l be the complementary indices, and let \epsilon_{ijkl} be the sign of the ordering (i,j,k,l) of (0,1,2,3). Define the real signed permutation K on \C^6 by

Explicitly,

so K=K^*=K^{-1}. The conjugate operation w\mapsto K\overline w is the complementary-pair exterior dual also used by Schliemann, Loss, and MacDonald for two fermions in a four-dimensional one-particle space [55, Section III, Equations (26)–(28)].

Define S,R:\Mat{10}\to\Mat6 by

The embeddings and compressions are CP, so Lemma 2.1 makes S PPT. The map T_6\circ S is CP by this PPT property, and its output transpose is S, which is CP. Thus T_6\circ S is PPT, and the CP conjugation by K makes R PPT.

The composite Choi matrix. The rectangular maps give an endomorphism R^\dagger\circ S\circ T_{10} of \Mat{10}. To express it as the composition of two maps on that algebra, let E:\C^6\to\C^{10} be the real coordinate inclusion into the first six positions and define

For \Phi_1, Lemma 2.1 makes S\circ T_{10} CP by input/output transpose equivalence, and makes its output transpose T_6\circ S\circ T_{10} CP by simultaneous transposition of S. Thus S\circ T_{10} is PPT, and the CP embedding by E preserves that property. The adjoint and CP-composition clauses of the same lemma make \Phi_2 PPT. The formulas determine both maps explicitly once L is given. For example, if L(A)=\sum_r Q_rAQ_r^*, the adjoints in the construction are

Since E^*E=I_6, \Phi_2\circ\Phi_1=R^\dagger\circ S\circ T_{10}. Its Choi matrix Z is positive. The convention (2.1) gives, for arbitrary matrices a,b of the appropriate sizes,

For Hermitian a,b\in\Mat{10}, the Hilbert–Schmidt adjoint identity therefore gives

The Choi transpose has canceled the input transpose in (6.5). We will prove that the right side vanishes at a=b=P_{\widehat x} for each singular direction. Positivity of Z will then give the kernel vector \widehat x\otimes\widehat x. The positive definite output will separately show that Z is nonzero.

Singular outputs and kernel products. For any operator B on \C^4,

Both sides send a\wedge b to Ba\wedge Bb. If B_x=L(P_x)\succeq0 and W_x=\ran B_x, it follows that

Indeed, in an orthonormal eigenbasis of B_x, the exterior eigenvalues are \lambda_i\lambda_j for i<j. This proves both positivity and the range identity. A Hermitian matrix D satisfies D^{\T}=\overline D, so transposition conjugates its range. Consequently

For exterior two-vectors w,u, let [w\wedge u]_{0123} denote the coefficient of e_0\wedge e_1\wedge e_2\wedge e_3. With the Hermitian inner product conjugate-linear in its first argument, the definition of K gives

Here k<l is complementary to i<j in each term. If w,u\in\bigwedge^2W and \dim W<4, then w\wedge u\in\bigwedge^4W=0. Equations (6.7)–(6.9) show that S(P_{\widehat x}) and R(P_{\widehat x}) have orthogonal ranges for every x\in\mathcal X. This includes \dim W_x<2, when both exterior ranges are zero. The conjugation in (6.9) is essential for this conclusion over complex subspaces.

For x\in\mathcal X, orthogonality of the two positive output ranges gives

For a positive matrix, v^*Zv=0 implies Zv=0. Hence

For the input y in the second hypothesis, S(P_{\widehat y})=\bigwedge^2(L(P_y)) is positive definite, and so is R(P_{\widehat y})=K S(P_{\widehat y})^{\T}K^*. The trace of their product is strictly positive. Equation (6.6) at a=b=P_{\widehat y} therefore proves Z\ne0.

Excluding product vectors from the range. It remains to exclude a product vector from the range. The following zero-set argument uses the product-exclusion principle of Bennett and coauthors [10, Lemma 1], in the nonorthogonal form given by Pittenger [49, Section IV, Lemma 3], and is related to Parthasarathy’s polynomial interpolation construction [45, Proposition 1.3]. Suppose that a nonzero product u\otimes v belongs to \ran Z. Since Z is Hermitian, its range is the orthogonal complement of its kernel. Equation (6.10) implies

For example,

This is a homogeneous quadratic in x; only its fixed coefficients are conjugated. Its distinct monomials make it nonzero when u\ne0. The same holds for p_v, since v\ne0. Each polynomial therefore vanishes on at most nine members of \mathcal X. Their zero sets cannot cover all twenty members, because 9+9<20. This contradiction proves that \ran Z contains no nonzero product vector.

By Lemma 2.3, the nonzero positive matrix Z is nonseparable. Lemma 2.2 then shows that the composite is not entanglement breaking.□

Proof. Direct integer multiplication gives

The exact checker in Appendix A verifies these equalities. For each row r, let Q_r be the 4-by-4 matrix whose ith column is the transpose of row r of M_i. Comparing entries gives L(A)=\sum_{r=1}^6Q_rAQ_r^*, so L is CP. Equation (7.4) also makes every M_i^{\T}M_j symmetric. Therefore T_4\circ L=L, proving the PPT property.

For complex x, expansion of (7.2) gives

Interchanging i,j and using (7.4) gives the second expression in (7.3). Since v^*M(x)^*M(x)v=\norm{M(x)v}^2, the kernel of this Gram matrix is \ker M(x), which proves the rank equality. Finally, M_0^{\T}M_0=36I_4.□

Proof of Theorem 1.2. Take L from (7.2). Lemma 7.1 supplies its PPT property, the rank identity, and the positive-definite input L(P_{e_0})=36I_4. Proposition 7.2 supplies the twenty distinct directions and the quadratic bound. Proposition 6.1 therefore applies, with the explicit maps in (6.5) determined by the integer matrices (7.1).

The positive test also gives an exact nonzero Choi value. Since \widehat{e_0}=e_{00}, Equations (6.4) and (6.6) yield

Thus the constructed pair has the asserted nonzero product-free composite Choi range, and its composite is not entanglement breaking.□

Proof of Theorem 1.1. Take \Phi_1,\Phi_2 from (6.5) and put Z=J(\Phi_2\circ\Phi_1). Theorem 1.2 proves that Z is nonzero and that its range contains no nonzero product vector. It is positive because \Phi_2\circ\Phi_1 is CP. Thus \lambda=\tr Z>0, and \rho=Z/\lambda is a density operator on \C^{10}\otimes\C^{10} with the same range as Z. Lemma 2.3 makes \rho entangled.

Both maps are PPT. Lemma 2.6, with a=b=c=10, gives

In particular, the representing vector is \Omega_{10}/\sqrt{\lambda}; normalization is by the actual Choi trace. Theorem 5.3 now gives (1.1) for every n\geq1 and every protocol and ideal bit in its stated scope, including the purification and complete public record. The same theorem gives K_D(\rho)=0. All matrices defining \rho are specified by (7.1) and (6.5), so the state is explicit.□

Proof. Define

The adjoint of a CP map is CP, so A_i\succeq0. Since A_i\preceq(\tr A_i)I_m, we have F_i\succeq(1-c_i\tr A_i)I_m=c_iI_m\succ0. The adjoint identity, using that A_i is Hermitian, gives

for every complex matrix B. Hence c_i\Psi_i is trace nonincreasing on positive inputs, and the positive effect F_i records the missing trace.

Use the standard-coordinate decomposition

and let W_0,W_1 be the real coordinate inclusions. For X\in\Mat{2m+1} write X_{jj}=W_j^*XW_j, x_\star=e_\star^*Xe_\star, and P_\star=e_\star e_\star^*. Set

The formula discards the off-diagonal input blocks. The two moving branches are CP compositions. For the flag branches, take spectral decompositions F_i=\sum_r\lambda_{ir}v_{ir}v_{ir}^* and set

Then \tr(F_iX_{i-1,i-1})P_\star=\sum_r K_{ir}XK_{ir}^*. The remaining flag term is P_\star XP_\star. Thus \Theta is CP. Since c_iA_i+F_i=I_m, for every complex X,

The discarded blocks have zero trace, so \Theta is trace preserving.

Because W_0,W_1,e_\star have real coordinates, output transposition in () replaces \Psi_i by T_m\circ\Psi_i in the moving branches and fixes the flag output. Coordinate transpose is complex-linear: it does not conjugate the possibly complex scalar multiplying P_\star. The effects F_i need not be real. Each transposed moving branch is CP by the PPT hypothesis, and the flag branches are CP as shown above. Therefore T_{2m+1}\circ\Theta is CP, proving that \Theta is PPT.

The flag is absorbing: \Theta(P_\star)=P_\star. Applying () twice to an input on the first block gives, for every B\in\Mat m,

Compression to that block consequently gives

Expanding in the coordinate matrix units of the input turns (8.4) into (8.1). The coordinate qualification fixes the reference factor: for general complex isometries W,V and a compatible map \Gamma,

Here W_0 is real, so the reference factor is exactly the one displayed in (8.1).

Local compression preserves separability, since it takes a positive product A\otimes B to (W_0^*AW_0)\otimes(W_0^*BW_0). Thus separability of J(\Theta^2) would imply separability of the positive multiple c_1c_2J(\Psi_2\circ\Psi_1) in (8.1). This proves the last assertion.□

Proof of Theorem 1.3. Apply Proposition 8.1 with m=10 and \Psi_i=\Phi_i from (6.5). Their composite Choi matrix is nonseparable by Theorem 1.2 and Lemma 2.3. Formula () therefore gives the required PPT channel on \Mat{21}.□

Proof. We first prove that \Psi is PPT. To establish nonseparability, let B be the compression of C to the span of the vectors e_i\otimes e_i, expressed in that basis, and let \mathbf1=(1,\ldots,1)^\T. We will compare two bounds on the sum of its entries. The vector Gram matrix gives

whereas the zero tensor-basis diagonal entries would force a separable decomposition of C to satisfy \mathbf1^*B\mathbf1\leq\kappa\tr B. We will also have \tr B=QD>0, so the strict inequality \kappa<Q/K will make these bounds incompatible.

The block Gram matrix and its partial transposes. Regard each u_q also as a vector in \C^K. For arbitrary w_i\in\C^D, self-adjointness of the projections gives

Thus the block matrix H=[H_{ij}]_{i,j\in\mathcal I}=J(\Psi) is positive semidefinite. Lemma 2.2 implies that \Psi is CP.

Since c_{qr}=c_{rq} is real, the first hypothesis gives

Indeed, if c_{qr}\ne0, the two projections commute; if c_{qr}=0, both blocks vanish and no commutation is needed. Let \Gamma_1=T_n\otimes\mathrm{id}_D and \Gamma_2=\mathrm{id}_n\otimes T_D denote the partial transposes on the input and output Choi factors. Block symmetry gives

For the second identity, full transpose is the product of the two partial transposes. Full transpose preserves complex positive semidefiniteness: from H=R^*R we get H^{\T}=(\overline R)^*\overline R. The Choi identities in Lemma 2.2 now show that T_D\circ\Psi is CP. Hence \Psi is PPT.

Lemma 2.1 gives complete positivity and the PPT property for \Psi^\dagger. We will also use a more specific identity. Testing the defining adjoint relation on matrix units gives, for every A\in\Mat D,

Equation (9.5) therefore yields

on all complex matrices, including non-Hermitian ones.

The tensor-basis diagonal and a compression. The composition \Psi^\dagger\circ\Psi is CP, so C\succeq0. Index its rows and columns by \mathcal I\times\mathcal I. Equation (9.7) gives the fully indexed formula

Since c_{qq}=1 and P_i^2=P_i, we have H_{ii}=P_i. The diagonal entries with indices (i,j), and the entries of the compression B, are consequently

The last equality follows from \tr(P_jP_iP_iP_j)=\tr(P_iP_j), by idempotence and cyclicity of trace. It remains valid without commutation and when c_{qr}=0.

For each pair q,r, completeness of the two measurements gives

Summing (9.10) proves \tr C=Q^2D. The same identity and (9.11) give

To see the inequality, set M=\sum_{q\in\mathcal Q}u_qu_q^{\T}, a positive semidefinite K-by-K real matrix. Then \tr M=Q and \tr(M^2)=\sum_{q,r}c_{qr}^2. Cauchy–Schwarz applied to its K nonnegative eigenvalues yields \tr(M^2)\geq(\tr M)^2/K=Q^2/K. Equivalently, the vector Gram matrix has rank at most K.

The support bound forced by separability. Suppose that C is separable over \C^n\otimes\C^n. Spectrally decomposing its local positive factors and absorbing positive weights into the vectors gives a finite decomposition

Whenever \tr(P_iP_j)=0, the corresponding tensor-basis diagonal entry is

Each summand is nonnegative, so x_i^{(\ell)}y_j^{(\ell)}=0 for every \ell. For one summand put z_i=x_i y_i. If distinct i,j lie in \supp z, then x_i y_j\ne0. The preceding implication and (9.1) force \tr(P_iP_j)>0. The second hypothesis therefore gives |\supp z|\leq\kappa.

Compressing the separable decomposition to the diagonal tensor subspace gives B=\sum_\ell z^{(\ell)}(z^{(\ell)})^*. Complex Cauchy–Schwarz on each support now yields

The inequality is also valid for a zero z^{(\ell)}, whose support is empty. The strict step uses \kappa<Q/K and \tr B=QD>0. This contradicts (9.12) and proves nonseparability.□

Proof. Reality and (9.5) give the additional identity H_{ij}^{\T}=H_{ij}. Equation (9.7) therefore becomes

This proves the first transpose invariance; the second is (9.8). Also,

Since \Lambda is CP and PPT by the proposition, \Lambda/Q is a trace-preserving PPT channel with input size D and output size n.

Apply Lemma 2.6 to the pair \Psi,\Lambda. Its first local factor is

by the two invariances. Thus

Dividing this identity by Q^2D gives (9.16). Proposition 9.1 gives \tr C=Q^2D>0 and complex nonseparability. Finally, \Lambda/Q and (\Lambda/Q)\circ T_D are CP, so (9.16) is a representation of the form in Definition 2.4. This proves the assertion.□

Proof. Embedding and compression by U are CP. The PPT composition stability in Lemma 2.1 therefore applies to both maps. Directly, the reality of U also gives T_n(UAU^*)=U T_D(A)U^*, while (9.8) fixes the output transpose of the second map. The adjoint identity follows by reversing the two factors, and U^*U=I_D gives the composite identity. Its Choi matrix is the nonseparable C of Proposition 9.1; the characterization in Lemma 2.2 proves the last assertion.□

Proof. The restricted-intersection estimate belongs to the Frankl–Wilson theory [23]. The proof below uses the multilinear-polynomial approach of Alon, Babai, and Suzuki [2]. We give the needed specialization in full. The integer 257 is prime: the primes at most \sqrt{257} are 2,3,5,7,11,13, and the respective remainders are 1,2,2,5,4,10.

For distinct A,B\in\mathcal F, their common element 1 and their equal sizes give 1\leq|A\cap B|\leq2p-1. Equation (10.2) excludes the value p. Hence |A\cap B| is nonzero modulo p, whereas |A\cap A|=2p is zero modulo p. Over the field \F_p, define

For every nonzero a\in\F_p, multiplication by a permutes the nonzero field elements; comparing their products gives a^{p-1}=1. Therefore, on the indicator vectors of the members of \mathcal F,

Replace every positive power of each variable in every monomial by its first power. This preserves all evaluations on Boolean vectors and leaves degree at most p-1. The resulting multilinear polynomials remain linearly independent: evaluating a linear relation at each \mathbf1_B makes every coefficient zero. The space of multilinear polynomials of degree at most p-1 has a basis consisting of the a_0 squarefree monomials of those degrees. Thus |\mathcal F|\leq a_0.□

Proof. The case t=1 is Lemma 10.1. For t=2 or 3, write

Let \mathcal G consist of those A for which \mathcal R_A contains 2^{t-1} tuples with pairwise orthogonal tensor vectors in the last t-1 factors. If distinct A,B\in\mathcal G had s_A\perp s_B, choose one such collection in each fiber. Within either lifted collection, orthogonality comes from the last factors; between the two collections, it comes from the first factors. The two fibers are disjoint, so this would produce 2^t distinct tuples forbidden by the hypothesis. Thus \mathcal G has no orthogonal base pair, and |\mathcal G|\leq a_0=\delta b by the preceding lemma.

Each fiber in \mathcal G has at most b^{t-1} elements. Each other fiber has at most (t-1)\delta b^{t-1} elements by the induction hypothesis. Summing these bounds and using at most b fibers of the latter kind gives

□

Proof. Suppose there were such a choice. All six selected projections would be nonzero. Let a selected row projection E and column projection F assign eigensigns a,b\in\{-1,+1\} to their shared observable O. The eigenspace identities and self-adjointness give

If a\ne b, then EF=0 and their overlap is zero, contrary to the hypothesis. Thus the row and column assignments agree at each of the nine entries of the square.

The choice would consequently give nine consistent signs. The product of the three signs in context t is e_t, by (10.10). Multiplying the three row constraints gives product +1 for the nine signs; multiplying the three column constraints gives product -1. This is a contradiction. The argument applies to eigenspaces in the complex Hilbert space \C^4.□

Proof. If q=r, projections with those labels belong to one projective measurement and commute. Suppose that q\ne r and c_{qr}\ne0. They cannot both receive nontrivial contexts on any one factor: that would place them together in an orthogonal eight-set, forcing c_{qr}=0. On each factor at least one of the two selected local projections is consequently 0 or I_4. They commute on each factor, so their tensor products commute. This proves the first hypothesis.

Now let J be a label set with strictly positive trace overlap between every distinct pair. Distinct labels for one question have zero product, so J contains at most one label per question. The trace overlap of any two global projections factors as

Every local factor is nonnegative by (9.1), whether or not the two local projections commute. Thus strict positivity of this finite product implies strict positivity of each factor.

If the questions represented by J contained an orthogonal eight-set S, take the selected labels for its first six questions. At the factor indexed by S, equation (10.16) would give strictly positive overlap for each pair of the six selected context projections. Lemma 10.3 forbids this. The represented questions therefore contain no orthogonal eight-set, and (10.6) gives |J|\leq\kappa. For completeness, the pairwise condition on a singleton is vacuous even when its projection is zero; it still satisfies the bound because a_0,b\geq1 and \kappa=3a_0b^2\geq3. The strict inequality \kappa<Q/K is (10.8).□

Proof. Lemma 10.4 verifies the hypotheses of Proposition 9.1. Its composite C=J(\Psi^\dagger\circ\Psi) is positive and nonseparable over \C^m\otimes\C^m, with \tr C=Q^2D. The projections are real symmetric, so Corollary 9.2 proves (10.18), the channel assertion, and membership in \mathscr C. Theorem 5.3 and Proposition 5.4 give the stated operational conclusions.

Since m=QD\geq D, Corollary 9.3 applies to the displayed coordinate isometry and gives the square PPT pair. Its composite is \Psi^\dagger\circ\Psi, and the real identification (9.17) gives (10.19). Applying Proposition 8.1 to this pair gives the channel on \Mat{2m+1} and its exact corner (10.20). The corner is nonseparable, so that proposition also proves that the channel square is not entanglement breaking.□

Proof of Lemma 7.3. Let X_0,\ldots,X_3,Y_0,\ldots,Y_3 be indeterminates, put u_{ij}=X_iY_j, and consider the finitely generated complex algebra

It is a Noetherian domain. Its closed complex points are exactly the matrices of rank at most one. Indeed, the identities u_{ij}u_{k\ell}=u_{i\ell}u_{kj} force the values at any point to have rank at most one, and every such matrix is xy^{\T} and defines an evaluation of \mathcal R. The maximal ideal \mathfrak m=(u_{ij}:0\leq i,j<4) corresponds to the zero matrix.

For 1\leq a,b\leq4, put P_{a,b}=(u_{ij}:i\geq a\text{ or }j\geq b). The quotient by P_{a,b} is the domain \C[X_iY_j:0\leq i<a,\ 0\leq j<b]. To justify the identification, use the monomial basis X^\alpha Y^\beta with |\alpha|=|\beta| for \mathcal R: a monomial containing an excluded variable factors by an excluded generator, while the remaining monomials stay distinct. Hence

is a strict chain of prime ideals. In particular, \operatorname{ht}\mathfrak m\geq7.

Let \ell_1,\ldots,\ell_6\in\mathcal R be the linear combinations of the u_{ij} representing the six bilinear forms, and put \mathfrak a=(\ell_1,\ldots,\ell_6). If the only common zero on the rank-at-most-one matrices were the zero matrix, the Hilbert Nullstellensatz for the finite-type complex algebra \mathcal R would give \sqrt{\mathfrak a}=\mathfrak m. The prime \mathfrak m would then be minimal over an ideal generated by six elements. Krull’s height theorem bounds the height of such a prime in a Noetherian ring by six, contradicting the chain above [58, Tags 00FV and 0BBZ(1)]. Thus a nonzero rank-one matrix xy^{\T} annihilates all six forms. Both factors are nonzero.□

Proof of Lemma 7.4. Normalize the valuation by v_p(p)=1. In either pair its values on nonzero elements are integers, and R_p/pR_p=\F_p. For a nonzero polynomial a(z)=\sum_i a_i z^i over \mathbb L, put \nu(a)=\min_{a_i\ne0}v_p(a_i). Scaling nonzero polynomials a,b by p^{-\nu(a)} and p^{-\nu(b)} makes their coefficients integral with least valuation zero. Their reductions are nonzero and have nonzero product in the domain \F_p[z]. Thus

For monic g,h one has \nu(g),\nu(h)\leq0, whereas the monic P\in R_p[z] has \nu(P)=0. Additivity forces \nu(g)=\nu(h)=0, so all coefficients of both factors are integral. Their leading coefficients remain one after reduction, which preserves their degrees; a monic constant factor is 1 and retains degree zero. Any factorization of P into two positive-degree polynomials over \mathbb L can be normalized to monic factors, whose reductions would still have positive degree. This contradicts irreducibility of the reduction of P.□

Proof of Lemma 7.5. Embed the coefficients of F into \mathbb Z_p and put s=\operatorname{lcm}(s_1,\ldots,s_h). Choose a monic irreducible \overline g\in\F_p[X] of degree s and a monic coefficient lift g\in\mathbb Z_p[X]; we use the standard finite-field fact that an irreducible polynomial of every positive degree exists. Lemma 7.4 for (\Q_p,\mathbb Z_p) shows that g is irreducible over \Q_p. If \alpha is a root, put

The ring \mathcal O is free of rank s over \mathbb Z_p, hence complete and separated for the p-adic topology, and \mathcal O/p\mathcal O\simeq\F_{p^s}. Every element with nonzero residue is a unit: lift an inverse modulo p and correct it by a convergent geometric series.

Every simple residue root of a polynomial in \mathbb Z_p[z] lifts uniquely to a root in \mathcal O. To see this, suppose r_n is a root modulo p^n whose derivative has nonzero residue. The first-order Taylor congruence gives a unique residue class of c such that r_{n+1}=r_n+p^nc is a root modulo p^{n+1}. Completeness gives a limiting root. If two roots have the same simple residue, the polynomial difference factorization writes their difference times a unit as zero; the roots therefore coincide.

Every root of \overline F lies in \F_{p^s} and is simple. Lifting them gives \deg F distinct roots of F in \mathcal O, hence all the roots. Finite fields are perfect, so \overline\alpha^{\,p} is a simple root of \overline g. Lift it to a root \beta\in\mathcal O of g. Sending \alpha to \beta defines a \Q_p-embedding E\to E, because g is irreducible. This embedding is an automorphism \sigma, as E is finite-dimensional over \Q_p.

Since \beta\in\mathcal O, we have \sigma(\mathcal O)\subseteq\mathcal O. The induced residue map fixes \F_p and sends \overline\alpha to \overline\alpha^{\,p}, so it is Frobenius on \F_{p^s}. In a \mathbb Z_p-basis of \mathcal O, the matrix of this endomorphism reduces to an invertible residue matrix. Its determinant is a p-adic unit, and therefore \sigma(\mathcal O)=\mathcal O.

If \rho_r is the lifted root of F with residue r, uniqueness of lifting gives \sigma(\rho_r)=\rho_{r^p}. Thus the permutation of the lifted roots has exactly the Frobenius cycle lengths on their residues, namely s_1,\ldots,s_h. The subfield of E generated over \Q by these roots is a rational splitting field of F. The automorphism \sigma permutes its generating roots and hence preserves this subfield. Its restriction is the required rational Galois automorphism. A \Q-isomorphism transports the statement to any chosen splitting field.□