extfieldsofstudy:
Computer Science
Medicine

s2fieldsofstudy:
Computer Science
Mathematics

text:
The idemetric property: when most distances are (almost) the same

We introduce the \emph{idemetric} property, which formalises the idea that most nodes in a graph have similar distances between them, and which turns out to be quite standard amongst small-world network models. Modulo reasonable sparsity assumptions, we are then able to show that a strong form of idemetricity is actually equivalent to a very weak expander condition (PUMP). This provides a direct way of providing short proofs that small-world network models such as the Watts-Strogatz model are strongly idemetric (for a wide range of parameters), and also provides further evidence that being idemetric is a common property. We then consider how satisfaction of the idemetric property is relevant to algorithm design. For idemetric graphs we observe, for example, that a single breadth-first search provides a solution to the all-pairs shortest paths problem, so long as one is prepared to accept paths which are of stretch close to 2 with high probability. Since we are able to show that Kleinberg's model is idemetric, these results contrast nicely with the well known negative results of Kleinberg concerning efficient decentralised algorithms for finding short paths: for precisely the same model as Kleinberg's negative results hold, we are able to show that very efficient (and decentralised) algorithms exist if one allows for reasonable preprocessing. For deterministic distributed routing algorithms we are also able to obtain results proving that less routing information is required for idemetric graphs than the worst case in order to achieve stretch less than 3 with high probability: while $\Omega(n^2)$ routing information is required in the worst case for stretch strictly less than 3 on almost all pairs, for idemetric graphs the total routing information required is $O(nlog(n))$.

Introduction
One of the basic tasks of network science is to identify properties which are common to most real-world networks of interest, from telecommunication and computer networks, to networks arising in biological or social contexts. A well known example of such a property is given by the fact that these networks tend to be small worlds, i.e. nodes in real-world networks tend to have short paths between them. The phrase "six degrees of separation", which originated with the experiments of Stanley Milgram [SM67] in the 60s, sums up the idea that two people normally have a short path of contacts connecting them. This idea has subsequently been extensively verified [MK89, WS98,AJB99] and has since permeated popular culture.
As well as the existence of short paths, however, a notable feature of many of these networks is that they have strongly concentrated distance distributions. Most distances, in other words, are almost the same. Close to 60% of Facebook user pairs are at distance 5 in the underlying friendship network [RH16], for example, while over 80% of actor pairs on the IMDB 1 are at a distance either 4 or 5. 2 Perhaps to an even greater extent, this is a feature which also carries over to most small-world network models. Figure 1 shows examples of distance distributions for three of the best known small-world models, the Erdős-Rényi [ER60], Preferential Attachment [BA99] and Watts-Strogatz [WS98] models. As we shall see, in these and most other small-world models, such as the Chung-Lu [CL02,CL03] and Norros-Reittu [NR06] models, the distance distributions can be proved to become proportionately more concentrated (in a certain formal sense) as the size of the network increases.
In order to study this phenomenon in a formal setting, of course we need a mathematical definition which makes precise the idea that "most distances are almost the same". Definition 1.1 below is new, and seems natural. Distance is displayed on the x-axis, while the y-axis shows the proportion of pairs at that distance: (a) is for the Preferential Attachment (PA) model, with 10 6 nodes and mean degree 6; (b) is for the Erdős-Rényi model G(n, p), with n = 5 × 10 4 nodes and expected degree 25; (c) is for the Watts-Strogatz model with 10 6 nodes, in which each node is initially connected to 10 neighbours either side, and the rewiring probability is 0.2.
Let G be a random network model for which distances are defined in the standard fashion, 3 which produces for every n ∈ N (and perhaps taking other inputs, which we consider for now to be fixed) an ensemble of graphs with n nodes, i.e. a probability distribution over a certain set of graphs with n nodes. For each n we let G n be a graph sampled from the distribution given by G. Recall that if X is a random variable and {X n } n≥0 is a sequence of random variables, then we say that X n tends to X in probability, denoted X n P − −− → X, if for every > 0, P(|X n − X| > ) → 0 as n → ∞.
Definition 1.1. We say G is idemetric if there exists a finite valued function f (i.e. f (n) ∞), such that if u n and v n are nodes chosen uniformly at random from G n , then X n = d(u n , v n )/ f (n) P − −− → 1. 4 For network models in which the graph produced may not be connected but does have a giant component, a weaker notion than idemetric is also useful. We shall say an event occurs with high probability if it occurs with probability tending to 1 as n → ∞.
Definition 1.2. We say that a random network model G is weakly idemetric if both: 1. There exists κ ∈ (0, 1] such that, with high probability, the largest component of G n is of size at least κn. and a generalised model has often been considered (see, for example, [DHH10]) which depends on two parameters, an integer m ≥ 1 and a real δ > −m: roughly speaking, in every step a new node is added to the network and connected to m existing nodes with a probability proportional to their degree plus δ. This produces a degree distribution with power law exponent τ = 3 + δ/m, meaning that all values of τ > 2 are possible (which is the motivation for including δ in the definition of the model). Let the graph distance H n be the distance between two randomly chosen nodes in the giant component. When m = 1 and δ > −1, we have [BP94,RH]: When m ≥ 1 and δ > 0 (so that τ > 3) there exist 0 < a 1 < a 2 < ∞ such that, as n → ∞, P(a 1 log(n) ≤ H n ≤ a 2 log(n)) = 1 − o(1). If m ≥ 2 and δ = 0 (so that τ = 3) then [BR04,RH]: When m ≥ 2 the graph produced is connected with high probability, meaning that these results suffice to give idemetricity. When m = 1 the connectivity properties depend somewhat on the details of the model (such as whether self-edges are allowed), but the established results still suffice to establish that the corresponding models are at least weakly idemetric. For a detailed summary of these results together with self-contained proofs see [RH].
Of course the Preferential Attachment model was introduced to try and explain the power law degree distributions observed in many real networks. An alternative and related approach which has been extensively studied, is to consider the configuration model applied to an i.i.d. sequence of degrees with a power-law degree distribution. According to this model one starts by sampling the degree sequence from a power law and then connects nodes with the sampled degrees at random (possibly resulting in a multigraph). The results obtained here are broadly similar, although constant multiplicative factors may differ [HHM05,HHZ07]. When τ ∈ (2, 3) graph distance centres around 2log log(n)/|log(τ − 2)|, while for τ > 3 the graph distance grows logarithmically with n.
In this paper we shall show further that the Watts-Strogatz model [WS98], and the Kleinberg model [JK00] are both idemetric for a wide range of parameters.
Given that it seems most (if not all) well-known small world models are at least weakly idemetric for a wide range of parameters, we then distinguish two clear aims.
1. In the spirit of the programme of research on quasi-random graphs by Fan Chung et al. [CGW89,CG08], which is aimed at showing that many conditions satisfied by random graphs are equivalent to each other, we would like to characterise the (weakly/strongly) idemetric network models.
2. We would like to understand how one can make use of knowledge that the idemetric property is satisfied. What is the significance for algorithm design?
In Section 2 we address the first of these aims. Modulo reasonable sparsity assumptions, we establish the surprising fact that, for unweighted undirected networks, being strongly idemetric is actually equivalent to a very weak expander condition, which we call PUMP and which is described in Definition 1.5 below. This provides a direct way of providing short proofs that networks models are strongly idemetric, and we immediately apply it to establish that the Watts-Strogatz model is strongly idemetric for a wide range of parameters.
Definition 1.4. For a node u, we write B u (r) to denote the ball around u of radius r, while B u (r) denotes the complement of B u (r). For sets of nodes X, Y, we write e(X, Y) to denote the number of edges incident to one node in X and one node in Y.
Definition 1.5. G is a weak ball expander (PUMP) if whenever 0 < < 1 2 there exists α > 0 such that, for all sufficiently large n, if u is chosen uniformly at random then with probability > 1 − both of the following hold: (i) there exists r with |B u (r)| ≥ n, (ii) for all r with n ≤ |B u (r)| ≤ (1 − )n, e(B u (r), B u (r)) ≥ α |B u (r)|.
In Section 3 we then address the second aim above. For idemetric network models we observe that a single breadth-first search provides a solution to the all-pairs shortest paths problem, so long as one is prepared to accept paths which are of stretch close to 2 with high probability. 5 The significance of this result stems from the broad class of networks to which it applies. One might hope, nevertheless, to be able to achieve smaller stretch, by further restricting the class of network models considered in a reasonable fashion: Question 1.6. Does there exist a condition which is satisfied by most/all well-known small world network models, and which allows for an efficient 6 solution to the all-pairs shortest paths problem, with stretch < 2?
Since we are then able to show that Kleinberg's model is idemetric for a wide range of parameters, our results here contrast nicely with the well known negative results of Kleinberg [JK00] concerning efficient decentralised algorithms for finding short paths: for precisely the same model as Kleinberg's negative results hold, we are able to show that very efficient (and decentralised) algorithms exist if one allows for reasonable preprocessing. For deterministic distributed routing algorithms we are also able to obtain results proving that less routing information is required for idemetric graphs than the worst case in order to achieve stretch less than 3 with high probability: while Ω(n 2 ) routing information is required in the worst case for stretch strictly less than 3 on almost all pairs, for idemetric graphs the total routing information required is O(nlog(n)).

Characterising the idemetric network models
Throughout this section, we restrict attention to undirected, unweighted graphs. The results of this section thus apply to all small-world models mentioned in the paper other than the Kleinberg model, which is directed and is dealt with later. If one is interested in real-world networks, then it makes sense to restrict attention further to graphs which are sparse, and in particular to network models in which individual nodes have finite expected degree in the limit. A natural way to formalise this is as follows.
Definition 2.1. Let deg(u) denote the degree of the node u. If G n is sampled from the distribution given by G and u is chosen uniformly at random from G n , then p n (d) is the probability that deg(u) = d. We'll say an undirected network model is of finite expected degree (FED) if there exists a probability distribution p on N with finite mean such that: So in Definition 2.1, (F1) and (F2) just say that p n converges nicely to p with finite mean as n → ∞. FED is a natural sparsity condition which we can expect to be satisfied by the small-world network models we study (for 'realistic' parameter values): all of the undirected network models mentioned in this paper satisfy the condition for a wide range of parameter values. The following sparsity condition, however, is the one we shall actually need in our proofs, and is implied by FED. Let's say a set of nodes U is a node cover for a set of edges E, if every edge from E is incident with at least one node from U.
Definition 2.2. G is uniformly sparse (US) if, for each > 0, there exists a constant C such that the following holds with probability at least 1 − for all sufficiently large n: for any set of y ≥ n edges from G n , every node covering is of size at least y/C .
Proof. Let p be as guaranteed by satisfaction of FED. Define M n = d d p n (d) and M = d d p(d). By a formal property C of nodes, we mean a set of pairs (G n , u). For fixed n ∈ N, if (G n is sampled according to the distribution given by G and) u is chosen uniformly at random from G n , then we define: So M n (C) can be thought of as the contribution to the mean M n given by C. For any formal properties C 1 and C 2 , note that: Given > 0, let D be such d≤D d p(d) > M− 2 /3. Let C 1 be the set of all pairs (G n , u) such that u ∈ G n is of degree at most D. Satisfaction of FED guarantees that, for all sufficiently large n, d≤D d p n (d) > M n − 2 /2. So, to phrase this another way, for all sufficiently large n we have: Now choose µ > 0 to be small, and suppose towards a contradiction that there exist infinitely many n for which the following condition holds: ( n ): With probability at least , the µn many nodes of highest degree have total degree summing to at least n.
Let C 2 be the set of all pairs (G n , u) such that the µn many nodes of highest degree in G n have total degree summing to at least n, and such that u is one of one of those µn nodes of highest degree in G n . When ( n ) holds, we have that: On the other hand, since D is a bound on the degree of u whenever (G n , u) ∈ C 1 ∩ C 2 , we also have: So long as µ is chosen sufficiently small, (1)-(4) then produce the required contradiction. We conclude that, for an appropriate choice of µ > 0 and for all sufficiently large n, it holds with probability at least 1 − that the µn many nodes of highest degree have total degree summing to less than n. Since this holds for all > 0, and since (F2) holds, we can then strengthen this statement slightly. For each > 0 we can choose K ∈ N such that, for an appropriate choice of µ > 0, the following holds with probability at least 1 − for all sufficiently large n: the µ n many nodes of highest degree have total degree summing to less than n and the total number of edges in G n is less than K n. Now if the µ n many nodes of highest degree have total degree summing to less than n, it clearly holds that no set of µ n many nodes can act as a node cover for any set of ≥ n many edges. US is therefore satisfied for C = K /µ .
As mentioned in the introduction, it turns out that a characterisation of the strongly idemetric (SI) network models can be given in terms of expander graphs, which have been studied intensively by mathematicians and computer scientists since the 1970s and have applications in the design and analysis of communication networks, in the theory of error correcting codes and in pseudorandomness. For background on expanders see [HLW06].
Definition 2.4. We say G with |G| = n is an α-edge expander if the following holds for any set of nodes S with |S | ≤ n/2: e(S ,S ) ≥ α|S |.
Definition 2.4, however, is too strong for our purposes, since it requires nice behaviour with respect to all S with |S | ≤ n/2. Definition 1.5, restated below, weakens Definition 2.4 by requiring that the given condition holds only when S is a large ball B u (r), and even then only most of the time. Since Definition 1.5 only describes conditions on S with n ≤ |S | ≤ (1 − )n, we can drop the restriction that |S | ≤ n/2 without making the definition any stronger.
Definition 1.5. G is a weak ball expander (PUMP) if whenever 0 < < 1 2 there exists α > 0 such that, for all sufficiently large n, if u is chosen uniformly at random then with probability > 1 − both of the following hold: (i) there exists r with |B u (r)| ≥ n, (ii) for all r with n ≤ |B u (r)| ≤ (1 − )n, e(B u (r), B u (r)) ≥ α |B u (r)|.
Definition 2.5. We define r u ( ) to be the least r for which |B u (r)| ≥ n, or to be undefined if no such r exists.
Lemma 2.6. If G is a PUMP and US, then it is SI.
To establish that G is SI, we use a condition which is equivalent to PUMP: P2 : For every > 0, there exists α > 0 such that, for all sufficiently large n, the following holds with probability > 1 − : (u, , α ) holds for at least (1 − )n many nodes in G n .
Suppose G satisfies P2 and US. Given arbitrary > 0, it suffices to show the existence of b , such that for all sufficiently large n, if u, v, u , v are nodes chosen uniformly at random from G n , then |d(u, v)−d(u , v )| < b with probability > (1 − ). To this end, let 1 be sufficiently small compared to (we shall come back and specify precisely what this means later). Let α 1 be the constant guaranteed by satisfaction of P2 w.r.t. 1 , and write α to denote α 1 . Let C α 1 be the corresponding constant guaranteed by satisfaction of US, and write C for C α 1 . Finally, to complete the initial round of definitions, put β := α/C.
Fix a node u and suppose that (u, 1 , α) holds. Very roughly, the idea now is as follows. Let r be such that 1 n ≤ |B u (r)| ≤ (1 − 1 )n. The expander property PUMP means we are guaranteed that e(B u (r), B u (r)) ≥ α|B u (r)|. So long as it holds for any set of y ≥ α 1 n edges from G n , that every node covering is of size at least y/C, it then follows that |B u (r + 1)| ≥ (1 + β)|B u (r)|. This exponential growth means that most nodes will be within some constant range of distances from u. Then a simple transitivity argument can be used to show that this constant range is the same for most nodes u.
Now let us describe the details of that argument more precisely. Since (u, 1 , α) holds, any ball B u (r 0 ) of size s with 1 n ≤ s ≤ (1 − 1 )n has least αs edges coming out of it (i.e. e(B u (r), B u (r)) ≥ αs), which are incident with at least βs distinct nodes outside B u (r) -so long, that is, as it holds for any set of y ≥ α 1 n edges from G n , that every node covering is of size at least y/C. B u (r 0 + 1) therefore has at least (1 + β)s nodes. Iterating this argument, ball B u (r 0 + r) has at least min((1 + β) r s, (1 − 1 )n) nodes, for any r ∈ N. In particular, letting r 0 = r u ( 1 ), it follows that: ( 1 )). To present the transitivity argument referred to above, let E 1 be the set of all unordered node pairs {u, v} such that (u, 1 , α) and (v, 1 , α) both hold, and such that r u ( 1 ) ≤ d(u, v) ≤ r u (1 − ). Note that, so long as (u, 1 , α) holds for at least (1 − 1 )n many nodes in G n , there are at most 1 n 2 + 2 1 n 2 = 3 1 n 2 many node pairs which do not belong to E 1 . If at least 18 1 n many nodes had degree less than 2 3 n in E 1 , i.e. for at least 18 1 n many nodes u there were less than 2 3 n nodes v with {u, v} ∈ E 1 , this would imply the existence of more than 18 1 n · 1 3 n ordered node pairs not belonging to E 1 , meaning more than 3 1 n 2 unordered node pairs which don't belong to E 1 . We conclude that less than 18 1 n many nodes have degree less than 2 3 n in E 1 . Define E 2 to be all those node pairs {u, v} ∈ E 1 , for which both u and v have degree at least 2 3 n in E 1 , so that there are less than 3 1 n 2 + 18 1 n 2 = 21 1 n 2 many node pairs which do not belong to E 2 . The point of defining E 2 this way is: ( †) If {u, v}, {w, x} ∈ E 2 , then both u and w have degree at least 2 3 n in E 1 , meaning that there exists y with {u, y}, {w, y} ∈ E 1 .
Note that for any two node pairs that are adjacent in E 1 , i.e. for any two node pairs in E 1 of the form {u, v}, {v, w}, the difference between their distances is at most 1 3 b , by (5). More generally, it then follows from ( †), that if {u, v}, {w, x} ∈ E 2 , the difference between their distances is at most b .
To finish the proof, let us consider how 1 should be defined so that b suffices for the satisfaction of SI w.r.t. . For all sufficiently large n, we were given that with probability at most 1 , it fails to be the case that (u, , α ) holds for at least (1 − 1 )n many nodes in G n . For all sufficiently large n, there is also probability at most α 1 that it fails to be the case that, for any set of y ≥ α 1 n edges from G n , every node covering is of size at least y/C. We can assume that α < 1. When we choose the two pairs {u, v} and {u , v }, in order to ensure that |d(u, v) − d(u , v )| < b , we require both of these pairs to be in E 2 . Since there are n(n − 1)/2 unordered pairs, this happens with probability at least 1 − 2·21 1 n 2 n(n−1) 2 . So for all sufficiently large n the probability that at least one of the pairs is not in E 2 is at most 85 1 . It thus suffices that 1 < /87. Lemma 2.7. If G is SI and US, then it is a PUMP.
Proof. Given US, suppose that the condition PUMP fails to hold. So there exists 0 > 0, such that for all α > 0 there exist infinitely many n for which the following holds with probability at least 0 : for u chosen uniformly at random (u, 0 , α) fails to hold. It suffices to show that if is chosen small enough compared to 0 , then, given any b ∈ N there exist infinitely many n such that if u, v, u , v are nodes chosen uniformly at random from G n then, with probability ≥ , either one of the distances Choose < ( 0 ) 2 /4 and suppose given b > 0. For any node u, let N u be the n 0 /2 nodes closest to u (with ties broken arbitrarily) and let F u be the n 0 /2 nodes furthest from u. If (u, 0 , α) fails then this happens either for reason (1), that there does not exist r with |B u (r)| ≥ 0 n, or for reason (2), that there exists r with 0 n ≤ |B u (r)| ≤ (1 − 0 )n, such that e(B u (r), B u (r)) < α|B u (r)|. In the case that (u, 0 , α) fails for reason (1), v is then chosen such that d(u, v) is infinite with probability > 1− 0 , which we can assume is greater than 0 /4. It remains to show that if α > 0 is chosen small enough, and if (u, 0 , α) fails for reason (2), then with probability at least 1/2, all nodes in N u are at a distance greater than 2b from all nodes in F u : In that case there exists A ∈ {N, F} for which we are guaranteed |d To establish the claim we make use of US. For a set of nodes U, we let B U (r) denote ∪ u∈U B u (r). For any 1 > 0, let C 1 /2 > 1 be the constant guaranteed by satisfaction of US with respect to 1 /2, and define f (1, 1 ) = 1 /2C 1 /2 . So long as a node covering of any set of n 1 /2 many edges must be of size at least n f (1, 1 ) (< n 1 /2), we conclude that U must be of size at least n f (1, 1 ) in order for it to be the case that B U (1) ≥ n 1 . Now we can iterate this idea. For any given 1 > 0 and k ∈ N, let β 0 be such that 0 . Let C f (k, 1 )/2 be the constant guaranteed by satisfaction of US with respect to f (k, 1 )/2, and let β 1 be the maximum of β 0 and 2C f (k, 1 )/2 . Then we define f (k + 1, 1 ) = 1 /β k+1 1 . Now define α = f (2b , 0 /4), where we can assume b ∈ N. US ensures that for all sufficiently large n, the following occurs with probability > 1 − α: If (u, 0 , α) fails for reason (2), then there exists r with 0 n ≤ |B u (r)| ≤ (1 − 0 )n for which |B u (r + 1) − B u (r)| < αn, which, so long as ( † α ) holds, means that r u (1 − 0 /2) > r + 2b ≥ r u ( 0 /2) + 2b . Since we can assume α < 1/2, this suffices to establish the required claim, that with probability at least 1/2, all nodes in N u are at a distance greater than 2b from all nodes in F u . Lemmas 2.3, 2.6 and 2.7 give us the promised characterisation.
Along with the Erdős-Rényi random graph and the Preferential Attachment model of Barabási and Albert, the Watts-Strogatz model is one of the best known and most studied small-world models. The definition is given in the Appendix, and depends on two parameters p and m: roughly, p is the rewiring probability, while m is the number of neighbours on each side prior to rewiring.
Using the characterisation given by Theorem 2.8, we get the following result. The proof appears in the Appendix. While the proof is simpler in the case that pm > 1, this condition can presumably be significantly weakened.

Path finding
In this section, we consider how satisfaction of the idemetric property may be useful for algorithm design, and in particular for path finding.
The task of finding the shortest path between two nodes in a (possibly weighted and/or directed) graph is a fundamental problem in computer science, which has been extensively studied since the 1950s. Since often one would like to make queries for multiple pairs of nodes in the same graph, a number of variants of the problem also become significant: The Single Source Shortest Paths (SSSP) Problem. The well known algorithm of Dijkstra [ED59] was originally formulated to give the shortest path between a single pair of nodes, but the version which is now better known solves the SSSP problem: a single node is fixed as the "source" node and the algorithm then finds shortest paths from the source to all other nodes in the graph. For a graph with n nodes and m edges, this algorithm for the SSSP problem terminates in time O(n 2 ), but has been repeatedly improved upon. Thorup's algorithm 7 [MT99], for example, runs in time O(m) for undirected weighted graphs with non-negative integer weights. For undirected unweighted graphs, a simple breadth-first search suffices, terminating in time O(n) for sparse graphs.
The All Pairs Shortest Paths (APSP) Problem. For the APSP problem one is required to output a data structure encoding all shortest paths between any pair of nodes. When a pair of nodes (a, b) is queried, the data structure should return a shortest path from a to b in time O( ), where is the number of edges on this path. The classic Floyd-Warshall algorithm [RF62,SW62] solves this problem in time O(n 3 ) for directed graphs. Running Thorup's solution to the SSSP for each node in an undirected graph gives an O(nm) algorithm, which is much more efficient when the graph is sparse. For dense directed graphs, on the other hand, Williams' algorithm [RW14] is the best known, running in time O(n 3 /2 Θ(logn) 1/2 ).
As pointed out by Thorup and Zwick [TZ05], however, there are many contexts in which the above solutions to the APSP problem are not satisfactory. Quite simply, the time and space complexity bounds provided by these algorithms are not practical for many real-world graphs of interest. One would like algorithms for which the preprocessing time -the time required to produce the data structure -is close to linear in n, or ideally, which can be run efficiently in an online and decentralised fashion, responding to changes in the graph structure as they occur. It therefore becomes natural to consider ways in which one can reasonably make the problem easier, and thereby obtain more efficient solutions. One option is to accept approximate solutions, i.e. algorithms which produce paths which are close to optimal. This can be made precise by requiring paths of small stretch, where a path from a to b is of stretch k if it is at most k times as long as the shortest path. Another way in which to make the problem easier is to restrict attention to graphs with convenient properties. This will be a reasonable thing to do, so long as we consider properties which one can expect to be satisfied by graphs arising from real-world networks. Of course, our interest here is in the extent to which the restriction to idemetric networks us useful.

Finding short paths in idemetric networks
For now let us restrict attention to unweighted graphs, although similar arguments can be made for the weighted case. If G is idemetric then we can obtain an approximate solution to the APSP problem very 7 Here and throughout the paper we work under standard RAM model assumptions. simply as follows. For each n let G n be a graph generated according to G with n nodes, and let r n be a beacon which is chosen uniformly at random in G n . We can then carry out a breadth-first search from r n , and then again with edge directions reversed if the graph is directed, in order to find, for all a ∈ G n , a shortest path p(a, r n ) from a to r n and a shortest path p(r n , a) from r n to a. In network models with the small-world property, each node a can then store these short paths p(a, r n ) and p(r n , a), taking space at most O(polylog(n)) for each node. For a n and b n chosen uniformly at random from the nodes in G n , let n be the length of the path from a n to b n given by concatenating p(a n , r n ) and p(r n , b n ). Since G is idemetric, we then have that: n d(a n , b n ) → 2 in probability.
We therefore have: Observation 3.1. If G is idemetric then the all-pairs shortest path problem can be reduced to the singlesource shortest path problem, so long as one is prepared to accept solutions which are of stretch 2 + o(1) with high probability.
Note that if G is also of small diameter (as is the case for the Watts-Strogatz and PA models, for example), then even in the small proportion of cases where stretch 2 + o(1) fails, a short path will still be given by the simple algorithm above. If G is weakly idemetric, then similar results hold if we restrict to nodes in the giant component. The significance of Observation 3.1 stems from the broad class of networks to which it applies. Greedy routing, for example, can often be very efficient in networks which come with an appropriate geometric embedding, see for example [BK17]. The attraction of Observation 3.1, however, is that it can be applied in scenarios where there is no given geometric embedding (and where it is not even clear how greedy routing would be defined).
It is also worth observing, that if we restrict attention to graphs of small diameter (O(polylog(n)) say), then one can run a decentralised version of the algorithm above, which may be seen as a distributed version of the Bellman-Ford algorithm, and which stills runs quite efficiently in an online fashion with the nodes computing in parallel. For the sake of simplicity, let's consider graphs of bounded degree. Rather than unilaterally choosing a single beacon, it suffices to have each node choose to be a beacon with probability log(n)/n. Then we can consider a stage by stage process, such that during each stage s + 1 and for each beacon r, each node u compares the shortest path u s (r) it has previously seen from u to r, with each of the paths given by taking the edge to a neighbour v and then following v s (r) (with information as to which nodes are beacons disseminating simultaneously). If the graph is of diameter , then correct values are obtained after at most many of these update stages, or many stages after any changes to the graph. Each stage involves each node passing O(polylog(n)) many bits to each of its neighbours.
The question of finding short paths in small-world graphs was addressed by Kleinberg in [JK00]. Since he considered decentralised algorithms in the absence of any preprocessing, however, his results were largely negative -the central point of that paper was that while short paths may exist, this does not mean that they can be easily found. For a variant of the the Watts-Strogatz model, now referred to as the Kleinberg model, he was able to prove that, while short (O(log(n))) paths will exist between all pairs of nodes with high probability, no efficient decentralised algorithms exist for finding short paths (in the absence of preprocessing, and for a wide range of parameter inputs). To contrast with Kleinberg's negative results, we prove next that the Kleinberg model is idemetric. So for precisely the graphs which Kleinberg is able to conclude efficient decentralised algorithms do not exist in the absence of preprocessing, we establish that very efficient decentralised algorithms do exist when reasonable levels of (even decentralised) preprocessing are permitted.
We are able to conclude this simply because the network model is idemetric. First of all, let us define the model.
The Kleinberg model. The model we consider is exactly the same as that in Kleinberg [JK00]. For any square number n, we begin with a set of nodes identified with the lattice points in a √ n × √ n square, The lattice distance between two nodes (x, y) and (r, s) is defined to be the number of lattice steps separating them when we fix periodic boundary conditions: For a universal constant p ≥ 1, each node u has a directed edge to every other node within lattice distance p. For universal constants q ≥ 0 and r ≥ 0, we also construct directed edges from u to q other nodes (the long-range contacts) using independent random trials; the ith directed edge from u has endpoint v with probability proportional to [d (u, v)] −r (to obtain a probability distribution, we divide this quantity by the appropriate normalising constant 8 ). This defines the network model KL(r, p, q). Note that the lattice distance between two nodes d (a, b) may be quite different than d(a, b).
Since the Kleinberg model gives directed graphs, we cannot apply Theorem 2.8 in order to prove that it is idemetric. We shall give a more direct proof, which is also more informative since it allows us to deduce the precise function f (see Definition 1.1) with respect to which the condition of being idemetric holds. As well as its relationship to Observation 3.1, the fact that the Kleinberg model is idemetric, is of significant interest in its own right.
Theorem 3.2. For all p, q ∈ N with p, q ≥ 1, and for all r ∈ R with r ∈ [0, 2), the random network model KL(r, p, q) is idemetric.
Proof. We consider first the case p = q = 1. Once we have dealt with this case, generalising to arbitrary p, q ≥ 1 will then be straightforward. The proof for the case p = q = 1 is split into four sections A-D, and we then consider the general case p, q ≥ 1 in Section E.
(A) The setup. Let a and b be nodes chosen uniformly at random from amongst the nodes in G, a graph with n nodes generated according to KL(r, p, q). We can consider the sets of nodes A * 1 , A * 2 , . . . and B * 1 , B * 2 . . . , where: We are interested in finding the least i such that b ∈ A * i , and so are interested in the values A i = |A * i | (and later will also be interested in B i = |B * i |). Clearly A * 1 = {a}, so A 1 = 1, and then A * 2 consists of the four lattice neighbours of a, together with the node which is the outbound long-range contact of a. As we continue to consider A * i and A i for larger values of i, the process is complicated, however, by potential collisions: distinct nodes u and v may have outbound long-range contacts which are near to each other. The outbound long-range contact of a could be one of its four lattice neighbours, for example, or two of the lattice neighbours of a could have long-range contacts which are within distance one of each other. The latter possibility could then lead to double counting in A 4 , unless one is careful. To give a useful upper bound for A i , we therefore consider a simplified process in which, roughly speaking, every long-range contact appears on a new two dimensional lattice at an infinite lattice distance from the previous node. Formally, we can simply consider the sequence C i , where C i = 0 for i < 0 and, for i ≥ 0: So, as depicted in Figure 2, C 1 = 1, C 2 = 5, C 3 = 17, C 4 = 57, and so on, and C i is the value that A i would take were it not for the possibility of collisions, as described above.
The enumeration of ∪ i C * i . It will also be useful to have a counterpart C * i to A * i and B * i , so that C * i is a set of nodes with |C * i | = C i . To this end, we consider 3-dimensional points (x, y, z), which we shall call 3-nodes, and specify that the lattice distance between (x, y, z) and (x , y , z ) is infinite when z z , and is equal to the lattice distance between (x, y) and (x , y ) otherwise. If a = (x a , y a ), we let C * 1 = {(x a , y a , 0)}. In order to enumerate C * i+1 , we take each element u = (x, y, z) of C * i in turn and proceed as follows. 1. Enumerate into C * i+1 all 3-node lattice neighbours of u (i.e. those 3-nodes at lattice distance 1) which have not already been enumerated into ∪ j≤i+1 C * j . 2. Let v = (x , y ) be the outbound long-range contact of (x, y). Let z be such that no nodes with third coordinate z have been enumerated into ∪ j≤i+1 C * j before, and enumerate (x , y , z ) into C * i+1 as the outbound long-range contact of u.
We say that the 3-node u = (x, y, z) ∈ C * i corresponds to the node (x, y). Note that, due to collisions, it may be the case that a node (x, y) has several 3-nodes in C * i corresponding to it. The process above specifies an enumeration of ∪ i C * i , and we also consider it to specify an enumeration of ∪ i A * i in the obvious way: nodes in this set are enumerated in the order of their first corresponding 3-nodes in ∪ i C * i . Distances between 3nodes are defined in the standard way, in terms of the number of edges on the shortest directed path between two nodes: there are directed edges from each 3-node u to each of its lattice neighbours, i.e. those v such that d (u, v) = 1, and a directed edge from u to its outbound long-range contact. For 3-nodes u and v, we say that v is a descendant of u if u is a 3 node in C * i , v is a 3-node in C * j for some j > i and d(u, v) = j − i. We will normally be interested in the descendants of u, only in the case that u is a long-range outbound contact.
It follows immediately from the definitions that for all i, A i ≤ C i . Since C i = C i−1 + j≥1 C i− j−1 · 4 j for i > 0, equation (6) can then be rewritten for i > 0: Given that, for i > 2, C i−1 = 2C i−2 + 3C i−3 + 4 j≥2 C i− j−2 , this in turn then gives, for i > 2: Standard techniques can then be applied in order to solve this linear recurrence relation. Since the characteristic polynomial has a largest root α ≈ 3.38298, it follows that for some constant ρ > 0: Let us define: To within an additive constant, we then have that n is the least k such that k i=1 C i ≥ n. Note that, for i > 0, C i+1 ≥ 2C i . For any > 0, it follows that: C i , we conclude that, for any > 0, with high probability: To prove the theorem, it thus suffices to show that, for any > 0, the following holds with high probability: (B) Proving (10). First of all we need to establish a useful bound for the distribution on long-range contacts. Suppose that we are given arbitrary nodes u and v, but that we do not know the value of u which is the outbound long-range contact of u. Let ln(n) denote the natural logarithm. Then we shall show that, irrespective of the given relative positions of u and v, the fact that r ∈ [0, 2) implies: The proof of (11) is given in the Appendix. Towards proving (10), fix with 0 < < 1/6, and for the remainder of the proof let * = (1+ ) n 2 (note that we drop the subscript n for convenience). The basic idea, as depicted in Figure 3, is that so long as A * * and B * * are reasonably large, it is very likely the case that one of the nodes in A * * has some node in B * * as an outbound long-range contact. This gives a short path from a to b. More precisely, what we do is to show that for any constant µ > 1, the following both hold with high probability: A * > µn 1/2 ln(n) and B * > µn 1/2 ln(n).
If this holds for µ > 4 then either * i=1 A * i and * i=1 B * i already have non-empty intersection, which gives the required short path from a to b, or else we can apply (11) to conclude that the probability every member of A * * will fail to have a member of B * * as a long-range contact is bounded above by: 1 − 4n 1/2 ln(n) 4nln(n) µn 1/2 = 1 − 1 n 1/2 µn 1/2 → e −µ as n → ∞.
Given that µ was arbitrary, (12) therefore suffices to give (10). It remains to establish (12). (C) Proving (12) for A * . We deal first with A * -achieving the lower bound for B * then uses most of the same ideas but is complicated by the fact that nodes do not have a fixed number of inbound long-range contacts. We deal with the case for B * in Section D of the proof. To achieve the lower bound for A * , we make some new definitions. Given the enumeration of ∪ i C * i specified previously, we say u ∈ C * i+1 is collision causing if both: (a) It is a long-range outbound contact of an element of C * i , and corresponds to a node in i+1 j=1 A * j which is within lattice distance log 2 (n) of another previously enumerated element of i+1 j=1 A * j , and; (b) It is not the descendant of a 3-node which is already collision causing.
Since we follow the process for less than log 2 (n)/2 many steps (i.e. * < log 2 (n)/2), long-range outbound contacts at a lattice distance > log 2 (n) from all other nodes will not lead to collisions of the kind discussed previously. We then define the discounted 3-nodes, to be all those 3-nodes in * i=1 C * i which are either collision causing, or else are descendants of a collision causing 3-node. The key point of these definitions is that any two 3-nodes in * i=1 C * i which are not discounted correspond to distinct nodes in * i=1 A * i . For each i, let nd(C * i ) be all those 3-nodes in C * i which are not discounted, and define nd(C i ) = |nd(C * i )|. The basic idea is now that we want to show, for all sufficiently large n and for all i ≤ * , that nd(C i ) is unlikely to be very much smaller than C i . Since distinct nodes in nd(C * i ) correspond to distinct nodes in A * i , and since it follows from the definition of * that C * = Ω(n (1+ )/2 ), this will suffice to give the probabilistic lower bound for A * in (12).
In order to give the probabilistic lower bound for nd(C i ) just discussed, we will need to bound the probability that a given long-range contact is collision causing. So suppose that we are given an arbitrary node u and an arbitrary set of nodes C. While we know which node u is, and we know the elements of C, suppose that we do not know the value of u , which is the outbound long-range contact of u. We want to show that if |C| ≤ n 2/3 , then: The proof of (13) is given in the appendix. Using this bound, we can now provide the probabilistic lower bound for nd(C i ) discussed previously. Let α be defined as before, in (8). What we want to show is that, for every α 0 < α, the following holds with high probability: Given (14), let α 0 < α be such that log α α 0 > (1 + /2)/(1 + ). Then with high probability: A * ≥ nd(C * ) > α * 0 = (α log α α 0 ) (1+ ) n /2 > α (1+ /2) n /2 = n 1 2 + 4 .
For any constant µ > 0, the last term n 1 2 + 4 is greater than µn 1/2 ln(n) for all sufficiently large n. So this gives (12) for A * , as required.
To prove (12) for A * , it therefore remains to use (13) in order to establish (14). To this end, consider the version of the recurrence relation (6) which results when, in each generation, the nodes in C * i only have (1 − β)C i many long-range outbound contacts (for β < 1). We'll use E i to denote the new resulting sequence of values: Of course (1 − β)E i may not be integer valued, but the sequence given by this recurrence relation is meaningful in giving a lower bound to the number of non-discounted 3-nodes there will be in each generation, in a context where we always have some integer number ≥ (1 − β)nd(C i ) of non-collision causing long-range outbound contacts for elements of nd(C * i ). The same algebraic manipulations as before can be applied, in order to reduce (15) to: This is gives a characteristic equation which is a function of β: Now in a neighbourhood of x = α, β = 0, the derivates of f with respect to x and β are both positive, meaning that the largest root of f is a continuous decreasing function of β in some neighbourhood of this point. For each α 0 < α sufficiently close to α, it follows that there exists β > 0 for which α 0 is the largest root of f (x, β). Similarly, for each α 0 > α sufficiently close to α, there exists β < 0 for which α 0 is the largest root of f (x, β).
So suppose given α 0 < α and with 0 < < 0.5. To prove (14) it suffices to show, for all sufficiently large n, that nd(C * ) > α * 0 with probability > 1 − . Choose α 1 and β, with α 0 < α 1 < α, 0 < β < 0.5, and such that α 1 is the largest root of f (x, β). Suppose we are given nd(C * i ) for some i < * . For all sufficiently large n, the fact that we chose < 1/6 in the definition of * means that: Then, according to (13), for sufficiently large n the number of outbound long-range contacts of elements of nd(C * i ) which are collision causing, is stochastically dominated by: Applying the Chernoff bound to this stochastically dominating binomial, we conclude that for some I β > 0, and for all sufficiently large n, the probability that more than a β proportion of the outbound long-range contacts of elements of nd(C * i ) are collision causing is bounded above by: Now nd(C i ) is guaranteed to grow at a certain rate, since nd(C i ) ≥ 4(i − 1) for i ≥ 2. We can therefore choose i 0 such that e −I β 4(i 0 −1) < /2, and this means that with probability 1, e −I β nd(C i 0 ) < /2.
We chose β < 0.5. So if at most a β proportion of the long-range contacts of elements of nd(C * i 0 ) are collision causing, we have nd(C i 0 +1 ) ≥ 1.5nd(C i 0 ). Since < 0.5 this gives: Then so long as at most a β proportion of the long-range contacts of elements of nd(C * i 0 +1 ) are collision causing, we have e −I β nd(C i 0 +2 ) < /8, and so on. Define Π β, to be the following event: for all i with i 0 ≤ i < * , at most a β proportion of the long-range contacts of elements of nd(C * i ) are collision causing. The analysis above then gives, for sufficiently large n: To complete the argument, consider all those 3-nodes at a lattice distance of i 0 − 1 from a. These are the 3-nodes we considered above, which are guaranteed to belong to nd(C * i 0 ). So long as Π β, holds, we can give a lower bound for the number of descendants of these nodes which belong to nd(C * i 0 +i−1 ) for each i > 0 through the series: There exists a constant ρ > 0 such that lim i→∞ E i /(ρα i 1 ) = 1. Since α 0 < α 1 , we can choose i 1 > i 0 such that nd(C * * ) > α * 0 whenever Π β, holds and * > i 1 . This gives (14) as required. (D) Proving (12) for B * . As remarked on previously, establishing (12) for B * is complicated by the fact that nodes do not have a fixed number of inbound long-range contacts. The proof is similar to the case for A * , however, and so Section D of the proof is given in the Appendix.
(E) The case p, q ≥ 1. The generalised form of the recurrence relation (6) is given as follows. For i < 0, C i = 0. Then C 0 = 1/q and, for i ≥ 0: Using this expression for C i , we get that, for i > 0: For i > 2, this means that C i−1 = (q + 1)C i−2 + (2p 2 + 2p − 1)qC i−3 + j≥2 4p 2 qC i− j−2 . For i > 2 we then have: The largest root α of the corresponding characteristic polynomial is the same as the largest eigenvalue of the matrix: That the largest eigenvalue α of M is positive and real (and occurs with multiplicity 1) follows directly from the Perron-Frobenius Theorem for non-negative matrices. In a manner precisely analogous to the proof for p = q = 1, we conclude that, for some constant ρ > 0: The remainder of the proof then goes through with only the obvious required modifications. The definitions of C * i and D * i (where D * i is defined in Section D of the proof, in the Appendix) have to be adjusted to incorporate the increased number of neighbours, for example, and the expression log 2 (n) must be replaced throughout with plog 2 (n). The expected number of inbound long-range contacts for each node is now q, and distributions on the number of inbound long-range contacts must be adjusted accordingly. The general form of (16) is: Again we have that if α is the largest root then in a neighbourhood of x = α, β = 0, the derivates of f with respect to x and β are both positive.
So the proof establishes that the Kleinberg model is idemetric with respect to f = log α n, where α is the largest eigenvalue of the matrix M given in (19).

Memory efficient routing with small stretch
In this subsection we consider deterministic distributed routing algorithms, but focus instead on the total routing information required in order to achieve paths of small stretch for almost all pairs. As before we shall consider methods which give short paths even when stretch 2 + o(1) fails, so long as the graph is of small diameter (as is the case for most small-world models which give connected graphs with high probability). The standard set-up we consider is as in [GG01], and we refer the reader to that paper for the precise details of the framework. The nodes in a graph are given labels in {1, . . . , n} and each edge adjacent to a node u is given an output port number in {1, . . . , deg(u)} with respect to u, where deg(u) is the degree of u. Our results here are strong in the sense that lower bounds on routing information allow arbitrary relabelling of nodes and ports, while upper bounds assume one is given arbitrary and fixed labelings of nodes and ports. A routing function R is a pair (P, H), where P is the port function and H is the header function. For any two distinct nodes u and v, R produces a path u = u 0 , . . . , u k = v of nodes, along with a sequence h 0 , . . . , h k of headers and a sequence p 0 , . . . , p k of ports. We stipulate that h 0 = v and p 0 = 0. In general, a message with header h i , arriving at node u i through input port p i , is forwarded to the output port Routing functions are defined as a set of local routing functions R u = (P u , H u ), one for each node u. The memory requirement of node u is the length of the smallest program that computes R u . The total memory requirement for a routing function is the sum of the memory requirements of the nodes.
The first observation to be made here, is that we can employ a similar trick to that described in Section 3.1 for idemetric network models. To deal with G n we pick a beacon r n uniformly at random and perform a breadth-first search from r n , defining a spanning tree T . At each node u other than r n we simply store a port number p(u) which takes them the first step on a shortest path to r n . At r n , meanwhile, we store O(nlogn) bits of information: for each other node u, r n stores the predecessor v in T together with v's port number for the edge to u. For (u, v) as input, u begins by sending a header of the form (v, 0) to the node at its port p(u). The last coordinate 0 indicates that we are in the phase of the routing process where a path is being followed to the beacon. The next node v therefore passes on the same header, and so on, until the beacon is reached. Upon reaching r n , the beacon then finds the sequence of port numbers q 0 , . . . , q d given by T and leading to v if followed in turn, before passing on the header (q 1 , . . . , q d , 1) to the node w at its output port q 0 . Since the last coordinate 1 indicates that we are now moving away from the beacon, w then passes the header (q 2 , . . . , q d , 1) to the next node, and so on, until the header is the singleton (1) and v is reached. This argument gives the following result, where we say that a statement holds for almost all pairs if it holds with high probability for r n , u, v chosen uniformly at random. The next result shows that, in fact, the problem is provably easier in the idemetric case than in the general case.
Proof. This can be obtained by a modification of the proof given by Gavoille and Genger, which proves the same statement when stretch < 3 is required for all rather than almost all pairs. In the Appendix we describe the necessary modifications.

Discussion
Many real networks have strongly concentrated distance distributions: Figure 4 gives some examples derived from the Social Computing Data Repository. Rather than real data, however, the focus of this paper has been on network models. We have seen here that most (if not all) of the well known small-world network models are at least weakly idemetric for a wide range of parameters. While the terminology itself was not used, this had previously been shown for the Erdős-Rényi, Preferential Attachment, Chung-Lu, and Norros-Reittu models, as well as for bounded degree expanders. In Sections 2 and 3, we gave proofs for the Watts-Strogatz and the Kleinberg models. Modulo the sparsity condition FED, in fact, we were able to show that being strongly idemetric is equivalent to the weak expander condition PUMP for undirected and unweighted network models. As well as providing further evidence that it is a common property, this characterisation gives an easy way of providing short proofs that network models are idemetric. It remains, however, to thoroughly investigate the extent to which the prevalence of (weakly/strongly) idemetric models is reflected in real-world data. It would be of considerable interest to find that it is almost universally the case (as it seems to be for models) that real-world networks expand through mechanisms which cause the distance distributions to become proportionately more concentrated as the network grows. If, on the other hand, there are significant instances in which the distance distribution is seen not to remain concentrated as the size of the network increases, then this raises an obvious question: can one define natural small-world models, which produce realistic graphs (in the sense that they produce graphs with the standard properties associated with real-world networks, such as being scale-free, having high clustering coefficients etc) and which are not at least weakly idemetric? Data accessibility. All experimental data is presented in Figures 1 and 4 in its entirety.
Competing interests. There are no competing interests to declare.
Authors' contributions. All authors contributed to the construction of the proofs in this paper.

The definition of the Watts-Strogatz model
The model is defined via a two stage process. We begin with a regular ring lattice, i.e. n nodes are arranged in a circle, such that each has an edge to the m nearest nodes on each side. So if the nodes are labelled 0, . . . , n − 1, then there is an edge between distinct nodes i and j iff |i − j| ≤ m mod n. For every node i, we then take each edge (i, j) such that 0 < ( j − i) mod n ≤ m (i.e. such that j is 'to the right' of i) and 'rewire' it with probability p ∈ [0, 1]. Rewiring is done by replacing the edge (i, j) with an edge (i, k), where k is chosen with uniform probability from all possible values that avoid self-loops and multi-edges. Whether or not the edge is rewired, i is referred to as the 'fixed node' of the edge.

The proof of Theorem 2.9
We use the same notation as in the definition of the Watts-Strogatz model in Section 5.1. So n, m and p are as defined there. To prove the theorem, we must establish that when pm > 1, the Watts-Strogatz model is both FED and a PUMP.
Establishing that the model is FED. When rewiring occurs and the edge (i, j) is replaced with an edge (i, k), we refer to k as the 'new node' of the edge (i, k). If u is chosen uniformly at random then deg(u) can be expressed as the sum of two terms N(u) + F n (u), where N(u) ∼ m + Bin(m, 1 − p) and F n (u) is the number of edges for which u is the new node.
For reasons that will soon become clear, our first aim is to show that for every > 0, there exists a constant c such that with probability > 1 − e −c n : ( † ) All nodes are of degree < n.
So suppose > 0. Since the total degree of all nodes is 2mn, it immediately follows that at most a constant number 2mn/ n = 2m/ of nodes can have degree ≥ n. Consider the rewiring process as it proceeds around the ring, starting with node 0, then moving on to node 1, and so on. When we come to consider the rewirings for v u, suppose that v has degree ≤ n. In that case, no matter what has happened previously during the rewiring process, the probability that v rewires an edge for which u becomes the new node is less than pm/(1 − 2 )n for all sufficiently large n. For all sufficiently large n, F n (u) is thus stochastically dominated by X ∼ 2m/ + Bin(n, pm/(1 − 2 )n). Applying Chernoff bounds, we conclude that for some constant c, the probability u has degree ≥ n is less than e −cn . Since u was chosen uniformly at random, the probability that at least one node has degree n is therefore bounded above by ne −cn . We can thus choose c as required.
Next we want to show that F n (u) converges in distribution to Y ∼ Poisson(pm). 9 To this end, consider again the rewiring process as it proceeds around the ring. Suppose > 0 and consider first the case that † holds. When we come to consider the rewirings for v u, the probability that v rewires an edge for which u becomes the new node is less than pm/(1 − 2 )n, so long as n is sufficiently large. For all sufficiently large n, F n (u) is thus stochastically strictly dominated by Y ,n ∼ Bin(n, pm/(1 − 2 )n) if we condition on satisfaction of † . Since the probability that † fails is exponentially small, however, (and since F n (u) is always less than mn) we conclude that F n (u) is stochastically dominated by Y ,n ∼ Bin(n, pm/(1 − 2 )n) for all sufficiently large n, even if we don't condition on satisfaction of † . Let n → 0 be chosen such that F n (u) is stochastically dominated by Y n ,n , and define Y n = Y n ,n . As n → ∞, Y n converges in distribution to Y ∼ Poisson(mp). In general, for any discrete random variables X n , Y n and Y, if we have that (a) for all sufficiently large n, Y n stochastically dominates X n , (b) every X n has mean M, and (c) E(Y n ) → M, while the sequence Y n converges in distribution to Y, then it follows that the sequence X n converges in distribution to Y. The expected degree of u is 2m, so since E(N(u)) = 2m − pm, this immediately implies E(F n (u)) = mp. It thus follows that F n (u) converges in distribution to Y ∼ Poisson(mp), as claimed.
Let Y ∼ Poisson(mp), and define p(d) = P(N(u) + Y = d). We have shown already that (F1) from Definition 2.1 holds with respect to p. That (F2) holds is immediate, since d d p n (d) = 2m, which is the mean of the distribution p.
Establishing that the model is a PUMP. It suffices to verify that the definition is satisfied for all sufficiently small > 0. In order to see this, note that while the condition (i) (that there exists r with |B u (r)| ≥ n) is stronger for larger , the fact that α > 0 means that when both (i) and (ii) from the definition are satisfied with respect to > 0, (i) is also satisfied for all > with < 1 2 . For each u and r ≥ 1, we let B * r (u) = B r (u) − B r−1 (u). First of all we look to establish the following lemma: Lemma 5.1. For all > 0, and N ∈ N, there exists M ∈ N such that for all sufficiently large n, if u is chosen uniformly at random then |B * M (u)| ≥ N with probability > 1 − .
Proof. Since pm > 1, we have m ≥ 2. For u which is chosen uniformly at random from G n , and r ∈ N, define C 0 (u) = {u}. Given C r (u), define C r+1 (u) to be the union of C r (u) and the set of all nodes j such that there exists i ∈ C r (u) and an edge (i, j) for which i is the fixed node. For each r ∈ N, define C * r+1 (u) = C r+1 (u) − C r (u). For r ≥ 2, let q r be the number of nodes i ∈ C r−2 which are the fixed node of at least one edge which was rewired. For each r ≥ 2 and each possible value of q r it holds with high probability that |C * r (u)| > 2q r , and that C * r (u) ⊆ B * r (u). For fixed N, the probability that q r < N tends to 0 as r → ∞ (since the rewirings are independent events). So the result holds for M large compared to N. Now let > 0 be sufficiently small that pm(1 − ) > 1. If |B u (r) * | = N, then let v 1 , . . . , v N be an enumeration of B u (r) * . In order to put a probabilistic lower bound on |B u (r + 1) * |, we can take each v i in turn, and consider the expected value of ρ i , which is the number of nodes outside B u (r) which rewire an edge for which v i is the new node, and which do not rewire any edges for which some v j with j < i is the new node. If |B u (r + 1)| < n, as we come to consider v i , the expected value of ρ i is greater than pm(1 − ), no matter the values for ρ j , j < i. We conclude that |B u (r + 1) * | stochastically dominates X which is a sum of N i.i.d random variables, each with mean pm(1− ). If we choose β > 1 with β < pm(1− ), then, applying Chernoff bounds, we get that for some I β > 0, either |B u (r+1)| ≥ n, or else the probability that |B u (r+1) * | < β|B u (r) * | is bounded above by e −I β N . Applying the same argument, and assuming that |B u (r + 1) * | ≥ β|B u (r) * |, we then have that either |B u (r + 2)| ≥ n, or else the probability that |B u (r + 2) * | < β|B u (r + 1) * | is bounded above by e −I β Nβ . Iterating this argument, we conclude that if |B u (M) * | = N then the probability that there fails to exist any r for which B u (r) ≥ n, is bounded above by: For any > 0, the expression above is less than for all sufficiently large N. So, for sufficiently small > 0, (i) from the definition of PUMP holds with probability > 1 − for all sufficiently large n, by Lemma 5.1. In fact, a more detailed analysis of the argument above allows us to draw a stronger conclusion. If |B u (M) * | = N, and for all r ∈ [M, M ] we have |B u (r + 1) * |/|B u (r) * | ≥ β, then for each β 1 with 1 < β 1 < β it holds for all sufficiently large M that |B u (M ) * |/|B u (M )| > 1 − β −1 1 . We conclude that for all sufficiently small > 0, there exists α 1 > 0 such that the following holds with probability > 1 − for all sufficiently large n: there exists r with |B u (r)| ≥ n and such that |B u (r) * | ≥ α 1 n. In order to conclude the proof, suppose |B u (r) * | ≥ α 1 n, and under the assumption that |B u (r + 1)| ≤ (1 − )n consider the number of nodes outside B u (r) which rewire an edge for which the new node is in B u (r) * . For some J > 0 the probability that this number is not at least α 1 n is bounded above by e −J n . Condition (ii) from the definition therefore holds for all sufficiently large n, if we set α = .

The proof of (11)
In order to establish (11), note that P(u = v) is minimised by taking v at a maximum possible lattice distance from u, and by taking r as large as possible. So it suffices to prove the result for r = 2, and when v is at a maximum lattice distance from u. In that case: (20) where the second inequality follows from the general bound x j=1 j −1 ≤ (1 + ln(x)). Then (20) and (21) combine to give (11), as required.

The proof of (13)
Recall that we are given an arbitrary node u and an arbitrary set of nodes C. While we know which node u is, and we know the elements of C, we do not know the value of u , which is the outbound long-range contact of u. We want to show that if |C| ≤ n 2/3 , then P(u ∈ C) = o(1).
In order to prove (13), we define the following sets of nodes: The number of nodes in i j=1 H j is 2 i+1 (2 i − 1), so long as n is sufficiently large. We say that H i is complete for n when the size of i j=1 H j takes this maximum value. Similarly, we say that I k is complete for n when it is of size 4k. In what follows we shall be concerned with P(u ∈ H i ) and P(u ∈ I k ) for various i and k. When we consider such values, the implicit assumption will always be that n is sufficiently large that H i and I k are complete for n.
Given (22), this means that (13) holds when C is chosen to be a set of n 2/3 many nodes which are as near as possible to u, and therefore holds for all C with |C| ≤ n 2/3 .

(D) Proving (12) for B *
We begin by defining the sets D * i , which are to B * i as C * i is to A * i . As we enumerate the sets D * i , it is useful to monitor whether or not we have considered the long-range inbound contacts of each node before: all nodes start as unseen and will be labelled seen during the enumeration once we have considered their long-range inbound contacts. If b = (x b , y b ), we let D * 1 = {(x b , y b , 0)}. In order to enumerate D * i+1 , we take each element u = (x, y, z) of D * i in turn and proceed as follows. 1. Enumerate into D * i+1 all 3-node lattice neighbours of u which have not already been enumerated into ∪ j≤i+1 D * j . 2. We divide into two cases. If (x, y) is not labelled as seen then proceed according to (a) below.
Otherwise proceed according to (b).
(a) Let v 1 , . . . , v k be the inbound long-range contacts of (x, y), where v j = (x j , y j ). For each j ∈ [1, k] in turn, let z j be such that no 3-nodes with third coordinate z j have been enumerated into ∪ j≤i+1 D * j before, and enumerate (x j , y j , z j ) into D * i+1 as an inbound long-range contact of u. Label (x, y) as seen.
(b) Let k be sampled from a distribution Bin(n, 1/n) (independent from all other distributions considered). Let z 1 , ..., z k be distinct and such that, for each i ∈ [1, k], no node with third coordinate z j has been enumerated into ∪ j≤i+1 D * j before. For each i ∈ [1, k] enumerate (0, 0, z i ) into D * i+1 as an inbound long-range contact of u.
We let D i = |D * i |. The definitions we gave previously for collision causing nodes, discounted nodes and descendants are applied to the 3-nodes in i D * i in the obvious way -replacing "outbound" everywhere with "inbound", replacing A * i with B * i , and replacing d(u, v) in the definition of descendant with d(v, u) (we are now interested in 3-nodes as elements of D * i rather than C * i , so these definitions replace rather than extend the previous ones).
In order to prove (12) for B * , it suffices to establish the following analogue of (14). For every α 0 < α, the following holds with high probability: The proof would proceed much as it did for (14), except that there are now two non-deterministic factors influencing nd(D i ): as well as the fact that 3-nodes may or may not be discounted, they may also have from 0 to n many inbound long-range contacts (0 to n − 1 if r 0). Whereas previously it followed directly from (9) that (17) held for all sufficiently large n, now we have to provide further proof that with high probability: Only after (26) is established will we be in a position to conclude that, with high probability, the probabilistic bound (13) can be applied at all stages i < * . To prove (25) we therefore first have to prove that, for every α 1 > α, the following holds with high probability: In order to see that (27) gives (26), choose α 1 > α such that log α (α 1 ) < 4/(3(1 + )). Then (27) gives that with high probability: ∪ j≤ * D * j < α * 1 = (α log α α 1 ) * < α 4(1+ ) n 6(1+ ) = n 2/3 .
We define † to be the minimum of * and the first i such that | ∪ j≤i+1 D * j | ≥ n 2/3 . In order to establish that with high probability † = * and (27) holds, we can argue much as in the proof of (14). So suppose given α 1 > α and with 0 < < 0.5. To prove (27) it suffices to show, for all sufficiently large n, that ∪ j≤ * D * j < α * 1 with probability > 1 − . Choose α 2 and β, with α < α 2 < α 1 , 0 < β < 0.5, and such that α 2 is the largest root of f (x, −β), where f is as defined in (16). Now suppose we are given ∪ j≤i D * j for some i < † -so for some i < † we are told precisely the elements of D * j for each j ≤ i (but we are not told the value of † ). Before we are told the long-range inbound contacts of a given node u ∈ D * i during the enumeration of D * i+1 , we do not know the outbound long range contacts of any nodes other than some of those we have enumerated into ∪ j≤i+1 D * i already, and the outbound long-range contacts of all other nodes remain uniformly and independently distributed amongst the unseen nodes. The number of inbound long-range contacts of elements of D * i is therefore stochastically dominated by X, which is the sum of D i i.i.d. random variables, each with distribution Bin(n, 1/(n − n 2/3 )). At the same time, the number of inbound long-range contacts of elements of D * i stochastically dominates X , which is the sum of D i i.i.d. random variables, each with distribution Bin(n − n 2/3 , 1/n). Applying Chernoff bounds, we conclude that for some I β > 0, and for all sufficiently large n, the probability that the number of inbound long-range contacts of elements of D * i is outside the interval [(1 − β)D i , (1 + β)D i ] is bounded above by 10 : We can then continue to argue much as in the proof of (14). Let i 0 be such that e −I β 4(i 0 −1) < /4. We chose β < 0.5. So if the number of inbound long-range contacts of elements of D * i is at least (1 − β)D i , we have D i 0 +1 ≥ 1.5D i 0 , which means that e −I β D i 0 +1 < /8, and so on. We can also choose N 0 which depends on but is independent of n, and such that P(D i 0 > N 0 ) < /2. Define Π β, to be the following event: D i 0 ≤ N 0 and, for all i with i 0 ≤ i < † , the number of inbound long-range contacts of elements of D * i is in the interval The analysis above then gives, for sufficiently large n: Consider the recurrence relation: So long as Π β, holds, we have: Since there exists ρ > 0 for which and since α 2 < α 1 , we can choose i 1 such that: ∀i ∈ [i 1 , † ], ∪ j≤i D * j < α i 1 .
We also have that E * < n 2/3 for all sufficiently large n, which means that so long as Π β. holds and n is sufficiently large, † = * . Thus (28) gives (27), as required.
With (26) established, we can then prove (25) in almost exactly the same way that we proved (14). Suppose given α 0 < α and with 0 < < 0.5. To prove (25) it suffices to show, for all sufficiently large n, that nd(D * ) > α * 0 with probability > 1 − . Choose α 1 and β, with α 0 < α 1 < α, 0 < β < 0.5, and such that α 1 is the largest root of f (x, β), where f is as in (16). Let † be the minimum of * and the first i such that | ∪ j≤i+1 D * j | ≥ n 2/3 . By (27) it holds with high probability that † = * . Suppose we are given nd(D * i ) for some i < † . Then, according to (13), for sufficiently large n the number of inbound long-range contacts of elements of nd(D * i ) which are not collision causing, stochastically dominates X which is the sum of nd(D i ) many i.i.d random variables, each with mean 1 − β/2. Applying the Chernoff bound to X, we conclude that for some I β > 0, and for all sufficiently large n, the probability that we fail to have at least (1 − β)nd(D i ) many long-range inbound contacts of elements of nd(D * i ) which are not collision causing is bounded above by: e −I β nd(D i ) .
Now nd(D i ) is guaranteed to grow at a certain rate, since nd(D i ) ≥ 4(i − 1) for i ≥ 2. We can therefore choose i 0 such that e −I β 4(i 0 −1) < /2, and this means that with probability 1, e −I β nd(D i 0 ) < /2.
Then so long as at least (1 − β)nd(D i 0 +1 ) many inbound long-range contacts of elements of nd(D * i 0 +1 ) are not collision causing, we have e −I β nd(D i 0 +2 ) < /8, and so on. Define Π β, to be the following event: for all i with i 0 ≤ i < † , at least (1 − β)nd(D i ) many inbound long-range contacts of elements of nd(D * i ) are not collision causing. The analysis above then gives, for sufficiently large n: To complete the argument, consider all those 3-nodes at a lattice distance of i 0 − 1 from b. These 3-nodes are guaranteed to belong to nd(D * i 0 ). So long as Π β, holds, we can give a lower bound for the number of descendants of these nodes which belong to nd(D * i 0 +i−1 ) for each i ≤ † − i 0 + 1 through the series: There exists a constant ρ > 0 such that lim i→∞ E i /(ρα i 1 ) = 1. Since α 0 < α 1 , we can choose i 1 > i 0 such that nd(D * * ) > α * 0 whenever Π β, holds, † = * and * > i 1 . This gives (25) as required.

5.6
Modifications required to change the proof of [GG01] into a proof of Theorem 3.4 We assume full knowledge of the proof of Gavoille and Gengler in [GG01]. In that paper, Lemma 1 gives an inequality concerning the ratio between binomial coefficients, which we now replace with the following, which can also be proved using Stirling's approximation.
Lemma 5.2. Suppose π(q) : N → N satisfies the condition that π(q)/q → 0 as q → ∞. Then there exists a real γ > 1 and a constant d > 0 such that for all q which are multiples of 5: q 4q/5 4q/5 π(q) q π(q) 2q/5 q/5 > d · γ q Gavoille and Gengler specify for each n a set of graphs with n nodes, where the nodes are partitioned into three sets V = W ∪ A ∪ B, where |W| = q and |A| = |B| = p. Each possible graph is identified by a matrix M which specifies which nodes in A and W are neighbours (by construction this suffices to give the same information for B and W). The basic form of the argument involves showing that, from a routing function with stretch < 3, M can be recovered using only a small amount of extra information. The construction of M from the routing function consists of three steps. In the first step a matrix M is produced, in which entries are port numbers given by the routing function as responses to certain appropriately defined queries.
In the next step a matrix, let us call it M 0 (although it is not named in the presentation given in [GG01]), is produced from M by setting each entry to 1 if its numeral value is unique amongst the values in that row, and setting it to 0 otherwise. A crucial feature of M 0 is that any entries which are set to 1 are 'correct', in the sense that the corresponding entry is 1 in M. 11 Now that we work with a routing function which only gives stretch < 3 for almost all pairs, however, the difficulty is that a matrix M 1 will be produced in place of M 0 , which may not satisfy this correctness condition for 1 entries. It suffices to show that only a small amount of information is required in order to convert M 1 into M 0 . We can carry out this conversion in two stages.
Stage 1. In the first stage, we take each row of M 1 in turn, and change any 1s which are 0s in M 0 into 0s. The number of port labels for nodes in A, means that any row of M 1 has less than c = 4q/5 many 1s. Note also that, as observed in [GG01], any row of M 0 has at most 2q/5 many 0s. In all but o(p) of the rows, specifying which 1s should be flipped requires specifying at most o(q) many of the (less than 4q/5 many) 1s in that row of M 1 (since stretch < 3 holds for almost almost all pairs). For o(p) of the rows, however, we may have to specify up to 2q/5 many 1s to change to 0. Overall, for some function π : N → N such that π(q)/q → 0 as q → ∞, this gives the following upper bound for the information required to carry out the first stage: plog 4q/5 π(q) + o(p)log q 2q/5 .
Stage 2. In the second stage we take the modified form of M 1 resulting from Stage 1 (in an abuse of notation, we shall still refer to it as M 1 ), and we change any 0s which are 1s in M 0 into 1s. Arguing similarly to as in Stage 1, we get a (generous) upper bound on the amount of information required in order to specify the appropriate bits to be flipped: plog q π(q) + o(p)log q 4q/5 .
With these modifications in place, we need to consider how they affect the bound on K, which is the number of bits required to store the routing function. In [GG01] the relevant bound is: K ≥ plog q 4q/5 2q/5 q/5 − O(nlog(n)).
By Lemma 5.2, and since o(p)log q 2q/5 and o(p)log q 4q/5 are both o(n 2 ), it still holds that K = Ω(n 2 ), as required.


extfieldsofstudy:
Computer Science
Mathematics
Physics

text:
Quantum Encryption and Generalized Quantum Shannon Impossibility

The famous Shannon impossibility result says that any encryption scheme with perfect secrecy requires a secret key at least as long as the message. In this paper we provide its quantum analogue with imperfect secrecy and imperfect correctness. We also give a systematic study of information-theoretically secure quantum encryption with two secrecy definitions. We show that the weaker one implies the stronger but with a security loss in $d$, where $d$ is the dimension of the encrypted quantum system. This is good enough if the target secrecy error is of $o(d^{-1})$.

I. INTRODUCTION
Encryption schemes are typically considered as a computational primitive, since an information-theoretically secure (ITS) symmetric key encryption scheme can only securely encrypt messages of length at most the length of the secret key by Shannon's impossibility result [1]. This impossibility result has been extended to the case of imperfect secrecy and imperfect correctness (see [2]).
We start by revisiting the quantum Shannon impossibility for quantum encryption using classical keys. Let K be a discrete random variable. An encryption scheme is a quantum operation Ψ that maps a quantum state ρ to Ψ k (ρ) using a classical key k ← K with probability Pr(k). We say an encryption scheme is perfect if it maps an arbitrary quantum state to a fixed state and it is invertible. There is a lower bound on the entropy of keys that if an encryption scheme that perfectly encrypts n qubits using a classical key drawn from K, then where H is the Shannon entropy. The proof was given by Boykin and Roychowdhury for the case without any initial ancilla in encryption [3]. Ambainis et al. provided a more general proof that allows an initial fixed ancilla [4]. (A slightly more general version, where the initial ancilla state may depend on the key, was given in [5]. See also [6,7] for a different proof of the same lower bound.) For imperfect encryption, the encrypted state can deviate from a fixed state by an amount ǫ, which is called secrecy error (see Def. 5). It was shown by Desrosiers and Dupuis [8] that for an encryption scheme with secrecy error ǫ, the classical key K must have length [9] log |K| ≥ 2n + 2 log(1 − ǫ), where |K| denotes the size of the alphabet of K.
Herein we further consider the case of imperfect correctness, that is, the encryption is allowed to be non-invertible. The amount that a quantum state after encryption-decryption deviates its original is called correctness error (see Def. 4), We use the proof technique in [8] and generalize the statement: for an encryption scheme with secrecy error ǫ and correctness error γ, the classical key K must have length In the security definition of quantum encryption, it should be considered that the adversary may hold a quantum system that is entangled with the message quantum state to be encrypted. To achieve such security (Def. 5), the quantum Shannon impossibility says that a quantum encryption scheme has to use a classical key roughly twice as long as the quantum message. If the sender is not entangled with the adversary, Hayden et al. argued that a key of n + log n + 2 log(1/ǫ) bits is enough to approximately encrypt n qubits [10]. (See [11] for a discussion of the security with respect to different norms.) Ambainis and Smith proposed one quantum encryption scheme based on δ-biased set (generalized from [12]) that requires a key of n + 2 log n + 2 log(1/ǫ) + O(1) bits, together with two other schemes that use shorter keys [13]. Later Dickinson and Nayak improved this upper bound to n + 2 log(1/ǫ) + O(1) [14]. The entropic notion of this security was studied by Desrosiers [15]. Herein we will proceed to study this notion of security without assuming that the message quantum state is not entangled with the adversary (Def. 7), which is called weak information-theoretic security in this paper. We show that a weak ITS quantum encryption with secrecy error ǫ is also ITS but with secrecy error d 2 ǫ, where d is the dimension of the message state to be encrypted. As an application, we can prove the security of an encryption with respect to this weak notion when the secrecy loss is not that important. For example, the quantum homomorphic encryption scheme for Clifford circuits uses a key from the permutation group of O(n log n) bits, where n = log d [16]. Finally we will also prove a Shannon impossibility result for this weak notion of security. This paper is organized as follows. In Sec. II we give some basics about quantum information processing. Then we discuss the notions of quantum encryption in Sec. III. We prove the quantum Shannon impossibility results in Sec. IV, followed by the discussion section.

II. PRELIMINARIES
A quantum system will be denoted by a capital letter and its corresponding complex Hilbert space will be denoted by the corresponding calligraphic letter. For example, the Hilbert space of a quantum system A is A. We will use d A to denote the dimension of A. Let L(A) denote the space of linear operators on a complex Hilbert space A. A quantum state of system A is described by a density operator ρ ∈ L(A) that is positive semidefinite and with unit trace (tr(ρ) = 1). Let D(A) = {ρ ∈ L(A) : ρ ≥ 0, tr(ρ) = 1} be the set of density operators on A. When ρ ∈ D(A) is of rank one, it is called a pure quantum state and we can write ρ = |ψ ψ| for some unit vector |ψ ∈ A, where ψ| = |ψ † is the conjugate transpose of |ψ . If ρ is not pure, it is called a mixed state and can be expressed as a convex combination of pure quantum states.
Associated with an n-qubit quantum system is a complex Hilbert space C When ρ ∈ D(A) is diagonal in the computational basis {|0 , |1 , . . . , |d A − 1 }, we say ρ is classical. In this case, ρ corresponds to a discrete distribution on {0, 1, . . . , d A − 1}. In other words, a random variable of n classical bits can be represented as an n-qubit quantum state that is diagonal in the computational basis.
The Hilbert space of a joint quantum system AB is the tensor product of the corresponding Hilbert spaces A ⊗ B. We will use a subscript to specify which subsystem a vector belongs to or an operator operates on. Let I A denote the identity on the subsystem A. Thus the totally-mixed state in A is 1 dA I A . For ρ AB ∈ D(A ⊗ B), we will use ρ A = tr B (ρ AB ) to denote its reduced density operator in system A, where the partial trace is defined by A separable state ρ AB has a density operator of the form where ρ x A ∈ D(A) and ρ x B ∈ D(B). Especially when A is classical, is called a classical-quantum (cq) state.
The evolution of a quantum state ρ ∈ D(A) is described by a completely positive and trace-preserving map In particular, if the evolution is a unitary U , we have the evolved state U (ρ) = U ρU † . The trace distance between two quantum states ρ and σ is The fidelity between ρ and σ is where the maximization is over all purifications |φ of σ A and all purifications |ψ of ρ A or any fixed purification |ψ ′ of ρ A .
Below is a variant of Uhlmann's theorem.
Proof. Let |ψ ABR be a purification of ρ AB , which is immediately a purification of A relation between the fidelity and the trace distance of two quantum states was proved by Fuchs and van de Graaf [19] that When ρ or σ is pure, we have The min-entropy of A conditioned on B is defined as König et al. gave an operational definition of min-entropy [20]: where Ψ : B → B ′ is a quantum operation as defined in Eq. (2), B ′ ≡ A, and |Φ AB ′ = 1 √ dA x |x A |x B ′ is the maximally-entangled state. The leakage chain rule for conditional min-entropy when ρ AB is separable [8] says that

III. INFORMATION-THEORETICALLY SECURE QUANTUM ENCRYPTION
Suppose the sender holds a quantum system M , which may or may not be entangled with a quantum system E held by the adversary. The joint system of the sender and the adversary will be denoted by the subscript ρ ME . Definition 3. A symmetric-key quantum encryption scheme F is defined by the following algorithms: 1) (Key generation) F.KeyGen: 1 η → K, where η is a security parameter and K is a discrete random variable {k, Pr(k)} depending on η. The algorithm outputs a classical private key k ∈ K.
2) (Encryption) F.Enc k : D(M) → D(C). The algorithm takes a secret key k and a quantum state ρ ∈ D(M) as input and outputs a ciphertext σ ∈ D(C).
We will use Γ arg F.func to denote the quantum operation corresponding to the algorithm F.func with argument arg. For example, Γ k F.Enc is the encryption algorithm of F using a secret key k generated from the distribution K. In addition, when arg is a distribution, it means the quantum operation is averaged over the distribution. Consequently, Γ K F.Enc denotes the encryption algorithm of F weighted by the probability distribution K, that is, The encrypted quantum state in the view of the adversary is then Definition 4. (Correctness) F is an encryption scheme with correctness error γ = γ(η) if for any ρ ME ∈ D(M ⊗ E) and k ← F.KeyGen(1 η ), Semantic security in the computational setting was introduced by Goldwasser and Micali [21]. Following that, an information-theoretic security notion of entropy security was defined (in a classical setting) by Russel and Wang [22]. Dodis and Smith [12] discussed the security notions more generally and showed that entropy security is equivalent to a security notion of indistinguishability. Several ITS notions of perfect security are further discussed in [23,24]. Entropic security and entropic indistinguishability are also equivalent in the quantum settings [8,15]. It is natural to use trace distance as a measure of the indistinguishability of two quantum states.
Definition 5. (Secrecy) F is an ITS encryption scheme with secrecy error ǫ = ǫ(η) if there exists Ω M ∈ D(M) such that for any ρ ME ∈ D(M ⊗ E), This security definition says that an encrypted quantum state of an ITS encryption is statistically indistinguishable to the tensor product of a fixed quantum state and the local state of the adversary.
We can also define the security as follows.
Definition 6. (Secrecy) F is an ITS encryption scheme with secrecy error ǫ = ǫ(η) if for any ρ ME , ρ ′ ME ∈ D(M ⊗ E) with tr M (ρ ME ) = tr M (ρ ′ ME ), Definition 5 directly implies Def. 6 with secrecy error 2ǫ by the triangle inequality. On the other hand, consider ρ ′ ME = |0 E 0|⊗ ρ E , where ρ E = tr M ρ ME . Then Def. 6 directly implies Def. 5 with Ω M = Γ K F.Enc (|0 M 0|) and secrecy error ǫ. Therefore, these two definitions are equivalent up to a factor of 2. As a consequence, we will use Def. 6 for secrecy error and operationally we use the one that is more convenient for the context.
We can also define a weaker security without any reference involved.
Definition 7. (Weak Secrecy) F is a weak ITS encryption scheme with secrecy error ǫ = ǫ(η) if for ρ, ρ ′ ∈ D(M), For a perfect encryption scheme, the two notions are equivalent. If we assume that the message state is not entangled with the adversary, then the weak secrecy is equivalent to the regular secrecy. It is easy to show that if ρ ME is separable, the two notions are equivalent. Remark As in the standard language of cryptography, we define the secret key K, correctness error γ, and secrecy error ǫ as functions of the security parameter η. In the following discussion we will omit the security parameter as it is irelevent to our discussion.
Next we show that an weak ITS encryption scheme is also ITS but with an additional security loss in the dimension of the message system to be encrypted. Before we prove this statement, we need the following lemma.
Lemma 8. If F is a weak ITS encryption scheme with security error at most ǫ(κ), then, for x|y = 0, we have the following mathematical result: Proof. Assume x|y = 0. Consider |ψ 0 = 1 ✷ Theorem 9. If F is a weak ITS encryption scheme with security error at most ǫ, then F is a regular ITS encryption scheme with secrecy error at most d 2 ǫ, where d is the dimension of the encrypted message system.
Proof. Suppose that F is a weak ITS encryption scheme by Def. 7 with secrecy error ǫ. We first consider a pure state ρ ME = |ψ ME ψ| with |ψ ME = i √ λ i |i M |i E and ρ E = tr M (|ψ ME ψ|) = i λ i |i E i|. We would like to show that If this equation holds for any pure ρ ME , then for σ ME = j p j ρ j ME , where ρ j ME are pure, we have It remains to prove Eq. (12).
where (a) is because A ⊗ |i j| tr = 1 2 A † A ⊗ |j j| = A tr and (b) is by Def. 7 and Lemma 8. ✷ As an application of this theorem, it suffices to prove that an encryption scheme is ITS with respect to Def. 6 if we target at secrecy error o(2 −n ), where n is the number of encrypted qubits. Example 1. Ambainis and Smith introduced an approximate quantum encryption scheme based on δ-based sets [13]. It was shown that the Ambainis-Smith scheme is ITS with secrecy error δ2 n [8] On the other hand, it is weak ITS with secrecy error δ2 0.5n [13] and hence ITS with secrecy error at most δ2 2.5n by Theorem 9.
Example 2. The secrecy of the quantum homomorphic encryption scheme for Clifford circuits by Ouyang et al. [16] was proved with respect to the weak secrecy (Def. 7) but we can prove its IT-security with respect to Def. 6 without much loss in parameters by Theorem 9. Similarly for the secrecy of the quantum homomorphic encryption scheme for the instantaneous quantum polynomial (IQP) circuits in [25].
At the end of this section we prove a theorem, which is similar to [4,Theorem 5.2], saying that an n-qubit imperfect encryption scheme can encrypt 2n classical bits with the same correctness and secrecy errors. Proof. Suppose F is ITS by Def 6. Define U |x = σ x ⊗ I 1 √ 2 n i∈{0,1} n |i A |i B for x ∈ {0, 1, 2, 3} n , where σ x = n j=1 σ xj . That is, U maps x to one of the 2n-qubit Bell states. Let F ′ .Enc k : {0, 1, 2, 3} n → D(C 2 2n ) be the algorithm corresponding to the following operation: LetŨ denote the inverse of U , which does the Bell measurement such thatŨ (U |x x|U † ) = |x x|. Note that U can be implemented by a unitary circuit, and henceŨ can be implemented by the reverse of that unitary circuit. Let F ′ .Dec k : D(C 2 2n ) → {0, 1, 2, 3} n be the algorithm corresponding to the following operation: When the message is classical, the joint state of the sender and the adversary ρ ME is a cq state. Thus the correctness of the encryption on the message alone implies the general correctness in Def. 4. Therefore, by the correctness of F . Similarly, for the encryption of classical messages, the weak security in Def. 7 implies the regular security in Def. 6. For v, v ′ ∈ {0, 1, 2, 3} n , where ρ AB = 1 2 n i,j∈{0,1} n σ v |i j| (σ v ) † ⊗ |i j| and similarly for ρ ′ AB . Note that tr A ρ AB = tr A ρ ′ AB . The last inequality follows from the secrecy of F (Def 6). ✷

IV. QUANTUM SHANNON IMPOSSIBILITY
In this section we generalize Shannon's impossibility in the quantum case.
Theorem 11. Suppose F = (KeyGen, Enc, Dec) is an ITS quantum encryption scheme on M = C 2 n with correctness error γ and secrecy error ǫ. Then Proof. Let where |Φ MC is the maximally-entangled state. Let By the secrecy of F, we have ρ MC − σ MC tr ≤ ǫ and hence by Eq. (4), Let which satisfies tr K ρ MCK = ρ MC . By Uhlmann's theorem (Corollary 2) and Eq. (13), there exists σ MCK with tr K (σ MCK ) = σ MC such that Let V = k |kk KK ′ k| K and let τ MCK = tr K ′ V σ MCK V † . This ensures that τ MCK is classical on K and it still holds that tr K τ MCK = σ MC . Then we have where Γ F.Dec,K is the decryption operation controlled by the K subsystem. Hence tr K I M ⊗ Γ F.Dec,K (ρ MCK ) − tr K I M ⊗ Γ F.Dec,K ( √ 2ǫ. Thus which implies, by Eq. (5), where (a) is by Eq. (6); (b) follows from the leakage chain rule Eq. (7) and that tr K τ MCK = σ MC and H min (M |C) τ = n. Therefore, we have log |K| ≥ 2n + log 1 − γ + √ 2ǫ .

✷
Next we consider a quantum Shannon impossibility for quantum encryption with weak IT-security in Def. 7.
Following steps similar to the proof of the previous theorem, we have log |K| ≥ 2n + log 1 − γ + √ 2 n ǫ .

V. DISCUSSION
In this paper we studied quantum encryption with imperfect correctness and imperfect secrecy. We discussed two notions of information-theoretic security and we showed that the weak security (Def. 7) implies the regular security (Def. 5) but with a secrecy loss in the dimension of the encrypted message (Theorem 9). Two examples of the Ambainis-Smith δ-biased set scheme and the quantum homomorphic encryption scheme for Clifford circuits were given for applications of Theorem 9. We also showed that an imperfect quantum encryption scheme that encrypts n qubits can encrypt 2n classical bits with the same correctness and secrecy errors (Theorem 10).
The quantum Shannon impossibility results were generalized to the case with imperfect secrecy and imperfect correctness for both notions of security. For ǫ ≪ 2 −n , a weak ITS quantum encryption scheme is also ITS by Theorem 9. In this case, our Shannon impossibility results for weak ITS scheme also agrees that roughly 2n bits are necessary to encrypt n qubits. For regular ITS quantum encryption schemes our lower bound (Theorem 11) is slightly lower than the one by Desrosiers and Dupuis in Eq. (1) in the case of γ = 0. This is because we have to use fidelity and trace distance alternatively in the proof, using the inequalities of Fuchs and van de Graaf Eq. (4), which induces a loss in the secrecy error.