Pauli Error Composition Determines the Multipartite Advantage in Conference Key Agreement

Pauli Error Composition Determines the Multipartite Advantage in Conference Key Agreement Ryder Carlson,1 Lochlan Fitzgerald,1 Kidus Peter,1 and Wilson Smith2, ∗ 1

arXiv:2610.07251v1 [quant-ph] 5 Oct 2026

2

The Coding School dba Frontier Technology Institute, Los Angeles, California, USA Department of Computer Science, University of Maryland, College Park, Maryland, USA (Dated: October 7, 2026)

GHZ-based conference key agreement distributes a shared key to N parties in one network use, whereas pairwise BB84 needs N − 1. The survival of that advantage has been studied against party number, loss, and topology, but almost always with the channel fixed at depolarizing. Simulating both protocols exactly for N = 3, 4, 5 under dephasing, amplitude damping, and depolarizing noise, we find the crossover is set by the channel’s Pauli error composition, not its identity: normalized to average infidelity, amplitude damping and depolarizing agree to within about 1% at each group size, while dephasing can tolerate roughly 2.4× more at N = 3. We derive a closed-form rate for arbitrary per-party Pauli noise and use it to prove that concentrating a fixed noise budget on one arm is strictly worse than spreading it, and that giving the dealer role to the cleanest arm improves the rate by roughly 18%. One structural fact drives every result: the phase-error term is a product over all N arms, while the bit-error term stays local to a pair.

I.

INTRODUCTION

Quantum key distribution creates a shared secret key between parties that is secured by physical law instead of computational assumptions. The two-party case is well developed, both theoretically and in deployed systems. When more than two parties require a common key, or a conference key, the protocol can be generalized in two ways. The parties can run bipartite QKD pairwise and combine the results, or they can distribute an N -party GHZ state and measure it directly, as in the N -party BB84 protocol of Grasselli et al. [1]. The multipartite route has a resource argument in its favor, because in a bottleneck network where all parties connect through a central station, one GHZ state serves every party in a single network use, while the pairwise scheme requires N − 1 separate distributions. Epping et al. formalized this advantage [2], and it has been demonstrated experimentally over metropolitan distances [3]. The advantage is not unconditional, as GHZ states are more fragile than Bell pairs. The literature has mapped several ways the advantage can disappear: Memmen et al. show that transmission loss eliminates it beyond roughly 15 km per link, and threshold error rates fall as party number grows [4]. Nearly all of these analyses, however, fix the channel at depolarizing, a uniformity with structural roots in how security proofs symmetrize noise (Section III). As a result, the dependence of the crossover on channel type, as opposed to noise magnitude, party number, loss, or topology, has not been mapped. This distinction is important because the two entropy terms in the conference key rate have different structure. The GHZ rate pays h(Qx ), built from ⟨X ⊗N ⟩ and there-

∗ smith@umd.edu; mentor: helped formulate the question, super-

vised research, advised on manuscript organization

fore a product over all N arms, and maxi h(Q1,i ), built from ⟨Z1 Zi ⟩ and confined to a single pair. A channel that produces only phase-type errors leaves the second term identically zero, but one that produces bit-flip-type errors as well activates it. This suggests that the crossover depends on which Pauli components a channel produces, and that a threshold measured for depolarizing noise will transfer to some channels and badly miss others. We test this by simulating both protocols exactly for N = 3, 4, 5 under dephasing, amplitude-damping, and depolarizing channels, locating the crossover by bisection, and normalizing to average channel infidelity so that thresholds are comparable across parameterizations. Four results come out of this. The raw thresholds spread by a factor of 8, which initially looks like a large channel effect; normalized to average infidelity, most of that spread is parameterization, and what remains sorts by error composition: amplitude damping and depolarizing, with unrelated Kraus structure but matched composition, cross within 1.2% of each other at every group size, while dephasing tolerates 2.38× more infidelity at N = 3. Admixing bit-flip-type error into dephasing collapses the threshold by a factor of 14, front-loaded because it reflects the activation of a term rather than the growth of one. Thresholds fall with N , confirming earlier depolarizing-specific results under a per-qubit noise model. And at fixed total noise, concentration on one arm is significantly worse than an even split, which we prove from a closed-form rate for arbitrary per-party Pauli noise; this answers a question Proietti et al. posed numerically [3] and yields a zero-cost operational rule for which party should hold the dealer role. Section II fixes notation and derives the structural asymmetry the results turn on. Section III situates the work in the existing comparison literature. Section IV describes the simulation. Section V reports results, and Section VI discusses their common mechanism, the relation to prior work, and the limitations, chiefly the omission of transmission loss.

2 II.

BACKGROUND

P1 |ψ⟩

A.

Notation

(1)

with h(0) = h(1) = 0. A single channel-strength parameter γ ∈ [0, 1] controls the noise on each arm. The physical meaning of γ depends on the channel and is given in Section II D.

B.

Bipartite QKD and the entanglement-based baseline

In BB84 [5], Alice sends qubits prepared randomly in the Z or X basis, and Bob measures in a random basis. After sifting, the parties estimate the quantum bit error rate in each basis and extract a secret key at the asymptotic rate rBB84 = 1 − h(Qz ) − h(Qx ). The two entropy terms are the two costs of turning a noisy raw string into a secret one. The first, h(Qz ), is the information leaked during error correction, since the parties must publicly exchange that many bits per round to fix their strings. The second, h(Qx ), is the number of bits sacrificed in privacy amplification. It is set by the phase error rate because the Z and X bases are complementary: an eavesdropper cannot gain information about the Z basis without disturbing the X basis. A low Qx therefore bounds what an eavesdropper could have learned, and hashing the key down by h(Qx ) bits removes it. Our pairwise baseline is the entanglement-based version of this protocol, in which √ a source distributes Bell pairs |Φ+ ⟩ = (|00⟩ + |11⟩)/ 2 and the two parties measure in randomly chosen bases. This is the E91-style implementation [6], and its asymptotic key rate is the same as prepare-and-measure BB84, since measuring one half of a maximally entangled state in a randomly chosen basis is equivalent to preparing a random state in that basis. We use the entanglement-based form because the GHZ protocol is entanglement-based, and putting both protocols in the same formalism means the same noise channels act on the same kind of object on both sides of the comparison.

C.

• •

|0⟩

Throughout this paper, N refers to the number of parties. Party 1 is the dealer (Alice), and parties 2 through N are receivers (Bobs). We write the binary entropy function as h(x) = −x log2 x − (1 − x) log2 (1 − x),

H

GHZ states and the N-BB84 protocol

The N -party √ GHZ state is |GHZN ⟩ = |+⟩⊗N = ⊗N ⊗N (|0⟩ + |1⟩ )/ 2. It is the +1 eigenstate of the operators X ⊗N and Zi Zj for each pair (i, j), and these two groups of stabilizers are what the protocol measures.

|0⟩ |0⟩

q1

•

q2

··· .. .

..

q3 .. . q N

.

q1

GHZ source

q2

P2

q3

P3

qN

PN

FIG. 1. Preparation (left) and distribution (right) of an N qubit GHZ state. The source prepares the state and sends one qubit qi to each party Pi , including the dealer P1 .

The N -party generalization of BB84 (N-BB84) [1] is as follows. In each round, the parties share a GHZ state and all measure in the same basis, chosen from {Z, X} according to a pre-shared key. Rounds in which everyone measures in Z are key-generation rounds: with an ideal GHZ state, all N outcomes are identical, so the dealer’s bit is already the shared conference key bit. Rounds in which every party measures in X are parameter-estimation rounds: on an ideal state, the parity of the N outcomes is deterministic, so any deviation bounds how much phase information an eavesdropper can hold. The two error rates that enter the key rate are therefore Qx =

1 − ⟨X ⊗N ⟩ , 2

Q1,i =

1 − ⟨Z1 Zi ⟩ , 2

(2)

where Qx is the error rate of the collective X measurement and Q1,i is the pairwise Z-basis error rate between the dealer and receiver i. The asymptotic conference key rate is rGHZ = 1 − h(Qx ) − max h(Q1,i ). 2≤i≤N

(3)

The maximum appears because error correction must work for every receiver independently—the dealer cannot assume that the Bobs will collaborate—so the worst link sets the reconciliation cost.

D.

Noise channels

We model each arm of the network as an independent single-qubit channel acting on the qubit delivered to that party. We consider three channels. Dephasing (phase damping) suppresses the offdiagonal elements of the density matrix without changing populations, with Kraus operators     1 √ 0 0 0 √ . K0 = , K1 = (4) 0 γ 0 1−γ It is equivalent to a phase-flip √ channel applying a Z gate with probability pz = (1 − 1 − γ)/2. Depolarizing replaces the state with the maximally mixed state with some probability, applying X, Y , and

3 Z each with probability γ/3: E(ρ) = (1 − γ)ρ +

γ (XρX + Y ρY + ZρZ) . 3

(5)

Amplitude damping models energy loss to the environment, taking |1⟩ toward |0⟩:    √  1 √ 0 0 γ K0 = , K1 = . (6) 0 0 0 1−γ The first two are Pauli channels, but amplitude damping is not. This difference matters in Section II G, where the closed-form results apply to the Pauli case, and in Section V E, where amplitude damping is handled by exact density-matrix simulation with a Pauli-twirled comparison.

E.

Structural asymmetry

Why a crossover exists at all, and why it moves with channel type, is visible in the stabilizer structure. Consider independent Pauli noise on each arm, with party j subject to X, Y , and Z errors with probabilities pxj , pyj , and pzj . Define the per-party aggregates fj = pxj +pyj (errors that anticommute with Z) and gj = pzj +pyj (errors that anticommute with X). An X error on any qubit commutes with X ⊗N and leaves it unchanged, while Z and Y errors anticommute with it and flip its sign. Because the sign flips are independent across parties, the expectation value is a product over all N arms. In contrast, Z1 Zi is flipped only by errors on qubits 1 and i, so its expectation value involves just two factors. So Qx accumulates multiplicatively across the entire network while each Q1,i stays local to a pair. One noisy arm worsens the phase estimate for every party at once, whereas in the pairwise protocol both error types remain confined to the link on which they occur. This asymmetry is why the crossover tracks a channel’s Pauli components, why admixing bit-flip error into dephasing is so damaging, why GHZ tolerance degrades as N grows, and why a concentrated noise budget is worse than a spread one. The exact expressions for Qx and Q1,i are derived in Section II G.

F.

Resource counting

The two protocols do not consume network resources at an equal rate, so a comparison requires an explicit convention. In a bottleneck network, where all parties connect through a central station, the GHZ protocol distributes one state to all N parties in a single network use, whereas the pairwise protocol requires N −1 separate links. We therefore compare rGHZ against rpairwise /(N −1), the convention used in the multipartiteadvantage literature [2, 4].

We compare the asymptotic secret fractions per unit of network use. Transmission loss, detector efficiency, quantum memories, and finite-key corrections are outside the model, and their effect on the comparison is discussed in Section VI D. G.

Closed form for independent Pauli noise

The stabilizer argument of Section II E carries through to an explicit rate. Let arm j carry an independent Pauli channel applying X, Y , Z with probabilities pxj , pyj , pzj , and recall the aggregates fj = pxj + pyj and gj = pzj + pyj . An error configuration flips the sign of X ⊗N if and only if it anticommutes with it on an odd number of arms. On arm j this happens with probability gj , independently of every other arm. For a single ±1-valued quantity that flips with probability g, the expectation is (1 − g)(+1) + g(−1) = 1 − 2g, and independence means these factors multiply across all N arms. The same argument applies to Z1 Zi , which is sensitive only to errors on arms 1 and i, occurring with probabilities f1 and fi , giving a two-factor product: ⟨X ⊗N ⟩ =

N Y

(1 − 2gj ),

⟨Z1 Zi ⟩ = (1 − 2f1 )(1 − 2fi ).

j=1

(7) The error rates follow directly: N h Y i Qx = 12 1− (1−2gj ) ,

  Q1,i = 12 1−(1−2f1 )(1−2fi ) .

j=1

(8) Since h is increasing on [0, 12 ] and Q1,i is increasing in fi , the maximum over receivers is attained at the noisiest receiver arm, so  h 
i 1 rGHZ = 1 − h(Qx ) − h 2 1 − (1 − 2f1 ) 1 − 2 max fi . i≥2

(9) The pairwise baseline on the same arms has, for the link (1, i), Qx = 21 [1 − (1 − 2g1 )(1 − 2gi )] and Qz = 12 [1 − (1 − 2f1 )(1 − 2fi )]; the conference rate is the minimum over receivers, divided by N − 1. We record this closed form because it does three things the simulation cannot: it turns the noise-distribution result of Section V D from an observation into a theorem, and it gives the dealer-assignment rule of Section VI B directly, with no search over permutations. It also provides an analytic check on the simulation at every parameter point and every group size, rather than only along the dephasing axis where Qz vanishes. III.

RELATED WORK

The comparison between multipartite quantum communication and bipartite QKD has been studied from

4 several perspectives, including network efficiency, noise tolerance, experimental feasibility, and security under realistic conditions. While GHZ-based conference key agreement (CKA) is often presented as a generalization of BB84, the literature consistently shows that its advantages are conditional, particularly in the presence of noise and imperfect channels. Early work established the feasibility of multipartite quantum cryptography using GHZ correlations [7]. Chen and Lo extended this to noisy environments, giving distillation schemes and prepare-and-measure constructions for conference key agreement and secret sharing, and computing the fidelity thresholds above which those protocols remain secure [8]. These results demonstrated that secure key generation survives degraded entanglement, but did not directly answer whether multipartite protocols are superior to bipartite ones. That question was central to the work of Epping et al. [2], who showed that GHZ-based protocols can reduce the number of required network transmissions, especially in bottlenecked topologies. A single multipartite state can distribute correlations to all users simultaneously, while pairwise requires multiple independent links. Grasselli, Kampermann, and Bruß subsequently introduced the N -party BB84 protocol and proved its security in the finite-key regime [1]; the asymptotic rate derived there is the expression used throughout the present work. Murta et al. survey the resulting landscape [9], including six-state, twin-field and single-photon-interference variants [10–12], device-independent protocols [13, 14], and anonymity-preserving extensions [15–17]. Despite this conceptual advantage, further work has shown that multipartite protocols are more sensitive to physical imperfections. Memmen, Eisert, and Walk show that the advantage of multipartite entanglement depends on channel loss, synchronization constraints, and network structure [4]. The requirement that all qubits in a GHZ state arrive successfully in the same round leads to an exponential decrease in performance as the number of parties increases: in terms of the single-link transmission probability p, the multipartite yield scales as pN against p2 /(N − 1) for the bipartite scheme. Two conventions from this literature carry over to the present comparison. The bipartite baseline is charged N − 1 network uses against the GHZ protocol’s one, a convention implemented in both of the above works by dividing the two-party rate by N − 1. Rates are compared per network use rather than per distributed resource, since the latter penalizes the bipartite protocol for the fact that Bell pairs are easier to produce than GHZ states. Experimental work supports this conclusion while also revealing additional details. Proietti et al. demonstrated GHZ-based CKA over tens of kilometers, confirming that multipartite protocols can be implemented in practice [3]. Pickston et al. built a six-photon graph state supporting both four-party GHZ CKA and three-Bell-pair pairwise QKD on identical hardware, observing a higher

rate for the GHZ protocol under controlled conditions [18]. Both studies also show how much the advantage depends on well-controlled channels: in practice, unequal loss and noise across links introduce asymmetries that significantly degrade performance. The asymmetry in question is where the experimental literature comes closest to the present work without resolving it. The supplementary material of Proietti et al. models a four-user star with an independent depolarizing parameter on each link and observes that the conference key rate depends on how noise is distributed across the network, identifying this as a degree of freedom with no two-party analogue. They frame the observation as an open problem, and the analysis is restricted to depolarizing channels. Pickston et al. encountered the same effect from the other direction: because noise was distributed unevenly across their six qubits, the achievable rate depended on which party was assigned the dealer role, and they optimized empirically over all permutations. Underlying several of these observations is a structural difference in how noise propagates: errors in the GHZ protocol feed a global correlation term while pairwise errors stay confined to individual links, an asymmetry made precise in Section II E. What the comparison literature has not varied is the type of noise. Epping et al. model each receiver’s qubit under a depolarizing channel; Murta et al. plot the sixstate and BB84 comparison for local depolarizing noise applied to the GHZ state; Memmen et al. use single-qubit depolarization together with time-dependent memory dephasing; the asymmetry analysis of Proietti et al. is depolarizing only; and device-independent analyses assume depolarized honest implementations [13, 14]. Memory dephasing appears widely, but as a storage process rather than as a channel type whose effect on the crossover is compared against others. This uniformity has structural reasons: security proofs symmetrize arbitrary channels to a depolarized form, which erases distinctions between channel types by construction, and the parameter space grows quickly once each link carries its own multiparameter channel family. The consequence is that the dependence of the crossover on channel type, as opposed to noise magnitude, party number, loss, or topology, has not been mapped quantitatively. Amplitude damping is a particular casualty of this convention, since it is not a Pauli channel and therefore falls outside the Bell-diagonal and GHZ-diagonal machinery on which most CKA rate calculations rely. The standard workaround is the Pauli twirling approximation, which reproduces the exact channel’s average fidelity to first order while discarding coherent terms [19, 20]. Because the accuracy of this approximation is not guaranteed once channels are composed across a network protocol, the present work reports both the exact simulation and the twirled comparison rather than assuming equivalence. The present study builds on these findings by resolving the GHZ-versus-pairwise crossover along the axis the literature has left fixed. We map the crossover as a function

5 of channel type rather than channel strength, and find it is governed by the channel’s Pauli error composition: channels producing only phase-type errors tolerate substantially more noise than those producing both, while channels with matched composition give crossovers agreeing to within about one percent despite differing Kraus structure. We derive a closed-form key rate for arbitrary per-party Pauli noise across N parties, and use it to prove the noise-distribution dependence that Proietti et al. observed numerically for depolarizing channels. Prior work has analyzed large networks, experimental systems, loss, and finite-key effects; fewer studies isolate how noise composition and placement together determine the regime in which GHZ-based communication loses its advantage to simpler pairwise approaches.

IV. A.

on the network size N ; the pairwise side acquires its N dependence only through the resource convention of Section IV D.

D.

Resource convention

Following Memmen et al. [4], the pairwise rate is divided by N −1 before comparison, charging that protocol one network use per link against the GHZ protocol’s single use for all parties. This is implemented directly in the pairwise rate function, so every comparison, threshold, and figure in this work uses rpairwise /(N − 1). Section VI D discusses the sensitivity of the thresholds to this choice.

METHODS

E.

Locating the crossover

Simulation framework

Crossover thresholds γ ∗ are found by bisection on the signed gap rGHZ (γ)−rpairwise (γ)/(N −1) over γ ∈ [0, 0.9], with tolerance 10−9 , returning no result if the gap does All results are produced by exact density-matrix not change sign on the interval. An analogous bisection simulation in Cirq. A single simulator instance, cirq.DensityMatrixSimulator(dtype=np.complex128), locates the noise strength at which rGHZ first reaches zero. Bisection replaces the coarse grid search used in was used. Error rates are obtained from expectation earlier iterations of this work: on a 0.005 grid, thresholds values computed directly from the density matrix are accurate only to the grid spacing, which turned out to rather than by sampling measurement outcomes, so be comparable to the very differences between channels the reported quantities have no shot noise, and the we were trying to resolve in Section V B. only numerical error is floating-point. Double precision is required throughout; the reason is quantified in Section V A. F. B.

State preparation and noise model

The N -party GHZ state is prepared by a Hadamard on the dealer’s qubit followed by CNOT gates from the dealer to each of the N − 1 receivers. The Bell pair for the pairwise baseline is the same construction at N = 2. After preparation, a single-qubit channel is applied independently to every qubit, including the dealer’s, modeling the star topology in which the central station distributes one qubit down each arm. Three channels are used, each parameterized by a single strength γ ∈ [0, 1]: cirq.phase damp, cirq.amplitude damp, and cirq.depolarize, with Kraus operators as given in Section II D.

C.

Error rate estimation

From the noisy density matrix, we evaluate the stabilizer expectation values ⟨X ⊗N ⟩ and ⟨Z1 Zi ⟩ for i = 2, . . . , N as Pauli-string observables, and convert them to the error rates Qx and Q1,i of Eq. (2). The asymptotic conference key rate is Eq. (3), floored at zero. The pairwise baseline applies the identical estimator to a twoqubit Bell state. A single link’s error rates do not depend

Infidelity normalization

Cirq parameterizes the three channels independently, so a given γ does not denote the same physical disturbance across channels, and raw thresholds are not comparable. Each threshold is therefore converted to the average channel infidelity 1 − Favg , computed by applying the channel’s Kraus operators to each of the six axis states |0⟩, |1⟩, |±⟩, |±i⟩, evaluating the fidelity to the input state, and averaging. These six states form a 2design, so the average reproduces the Haar average over pure input states.

G.

Stacked and asymmetric noise

Two variants of the circuit constructors support the remaining results. Stacked-noise versions accept independent strengths for the amplitude-damping, phasedamping, and depolarizing channels and apply all selected channels in sequence on each qubit; these produce the admixture sweep of Section V B, in which all three channels share one parameterization and thresholds are directly comparable within the sweep. An asymmetric variant accepts a per-arm list of noise strengths, used for the fixed-budget comparisons of Section V D and the dealer-permutation test of Section VI B.

6 TABLE I. Crossover noise strength γ ∗ , the strength γdies at which the GHZ rate reaches zero (dashes: no zero on γ ∈ [0, 0.9]), and the crossover expressed as average channel infidelity 1 − Favg . Channel Dephasing

Amplitude damping Depolarizing

FIG. 2. Dephasing crossover threshold γ ∗ versus group size: closed form (line) against independent Cirq simulation (open squares), N = 3...5. The two bisections agree to 2.6 × 10−10 , limited by the solver tolerance; the maximum pointwise keyrate discrepancy across 46 noise values and all three group sizes is 1.2 × 10−15 .

γdies — — — 0.13920 0.12105 0.10822 0.07197 0.06209 0.05513

1 − Favg at γ ∗ 0.09472 0.07720 0.06604 0.03974 0.03536 0.03210 0.03975 0.03513 0.03172

The crossover is set by the channel’s Pauli composition

Code availability

All code is available at https://github.com/QHSRP/ Quantum-Computing-BB84. The rate estimators, circuit constructors (including the stacked-noise and asymmetric variants of Section IV G), crossover routines, and infidelity calculation are in GHZ CKA.py. V. A.

γ∗ 0.48759 0.40956 0.35701 0.11739 0.10462 0.09512 0.05963 0.05269 0.04758

where the crossover sits. All results below use dtype = np.complex128. B.

H.

N 3 4 5 3 4 5 3 4 5

RESULTS

Validation against closed forms

Under pure dephasing, the key rates admit an exact closed form. Phase damping produces no bit-flip errors, so Qz = 0 identically and the GHZ rate reduces to a single entropy term, rGHZ = 1 − h(Qx ) with Qx = (1−(1−γ)N/2 )/2, while the Bell pair sees Qx = γ/2 and Qz = 0. These expressions give an independent check on the entire simulation, from circuit construction to expectation values to the rate formula. Across 46 noise values spanning γ ∈ [0, 0.9] and group sizes N = 3, 4, 5, the largest discrepancy between simulated and analytic key rate is max |rsim − ranalytic | = 1.2 × 10−15 . Solving for the crossover location on each side independently, the two agree to 2.6 × 10−10 (Fig. 2), a figure set by the bisection tolerance rather than by simulation error. This level of agreement requires double precision. Cirq’s DensityMatrixSimulator defaults to complex64, which introduces errors of order 10−6 in the key rate near the crossover: h(x) has a divergent derivative at x = 0 and 1, so single-precision error in Qx is amplified exactly where the two protocols are closest, which is

Each protocol was simulated across each of the three channels and the crossover located by performing bisection on rGHZ − rpairwise /(N − 1) (Fig. 3 shows the two extremes). Table I collects the results. The table also reports γdies , the noise strength at which the GHZ rate itself reaches zero. At every crossover, the GHZ protocol is still producing key; γ ∗ precedes γdies by 14–21% for the channels that have one. The crossover is an economic boundary set by the resource convention, not a security failure of the multipartite protocol. Under dephasing, the GHZ rate remains positive over the entire range examined. In raw parameter terms, the thresholds differ by a factor of 8.18 at N = 3. However, Cirq parameterizes phase damp, amplitude damp, and depolarize independently, so γ carries a different meaning in each case, and the comparison is between incommensurable quantities. We therefore convert each threshold to the average infidelity of the underlying single-qubit channel, averaged over the six axis states, which form a 2-design and reproduce the Haar average. The rightmost column of Table I is the comparable one. Normalized, the spread shrinks to a factor of 2.38 at N = 3 (2.20 at N = 4, 2.08 at N = 5). Most of the apparent order-of-magnitude effect was parameterization. Amplitude damping and depolarizing land almost on top of each other. At N = 3, their thresholds are 0.03974 and 0.03975, agreeing to better than one part in a thousand, and they agree to within 1.2% at every group size tested, even though they differ by a factor of two in raw γ and have entirely different Kraus structure. The channels do not sort by name, but by whether they produce bit-flip-type errors as well as phase-type ones.

7

FIG. 3. The GHZ–pairwise crossover at two noise compositions, N = 3. (a) Pure dephasing: the protocols cross at γ ∗ = 0.488. (b) Equal stacking of dephasing, amplitude damping, and depolarizing at a common strength: γ ∗ = 0.035, a factor of 14 lower. Note the tenfold difference in axis scale between panels, although the protocols and resource convention are identical.

This is exactly what the stabilizer structure of Section II E predicts. The GHZ rate has two entropy terms: h(Qx ), made from ⟨X ⊗N ⟩ and therefore accumulating multiplicatively across all N arms, and maxi h(Q1,i ), built from ⟨Z1 Zi ⟩ and confined to a single pair. Dephasing produces only phase-type errors, so Qz = 0 exactly and the GHZ protocol pays nothing on the second term; its tolerance is correspondingly higher, by a factor of roughly 2 in infidelity (2.4 at N = 3, narrowing to 2.1 at N = 5). Amplitude damping and depolarizing both feed both terms, and once matched in infidelity, their crossovers nearly coincide. A cleaner demonstration of the same effect avoids the cross-channel comparison entirely. We stack a dephasing channel with amplitude-damping and depolarizing channels at strength α times the dephasing strength and sweep α from 0 to 1; every point in the sweep uses the same parameterization, so thresholds are directly comparable to one another (Fig. 4). The threshold falls from 0.48759 at α = 0 to 0.03488 at α = 1, a factor of 14, and the collapse is front-loaded: admixing secondary channels at just 5% of the dephasing strength cuts the tolerable noise by more than half. The GHZ advantage is disproportionately sensitive to bit-flip-type errors because they activate an entropy term that pure dephasing leaves identically zero.

C.

Scaling with group size

Crossover thresholds fall monotonically with N for every channel, in both raw and infidelity-normalized terms (Fig. 5). For dephasing, the normalized threshold falls from 0.09472 at N = 3 to 0.0660 at N = 5; for depolarizing, it falls from 0.0398 to 0.0317. The pairwise protocol has no N dependence because each link always involves

FIG. 4. Crossover threshold γ ∗ as bit-flip-type error is admixed into pure dephasing at ratio α (amplitude damping and depolarizing each at strength αγ), N = 3. All points share one parameterization, so thresholds are directly comparable. The collapse is front-loaded: 5% admixture more than halves the threshold, because it activates the h(Qz ) term that pure dephasing leaves identically zero.

two parties; the trend comes from the GHZ side, where the phase error term compounds over an additional arm with each increase of N . The direction of the effect is not new. Epping et al. give threshold QBERs as a function of party number [2], and Memmen et al. derive explicit depolarizing thresholds against N for essentially this comparison [4]. Our contribution on this specific point is confirmatory, and is reported mainly because it is a necessary precondition for reading Table I correctly. The noise model does, however, differ significantly

8

FIG. 5. Crossover thresholds versus group size for the three channels. (a) Raw parameter γ ∗ , which is not comparable across channels because Cirq parameterizes each independently. (b) The same thresholds normalized to average channel infidelity 1 − Favg : amplitude damping and depolarizing agree to within 1.2% at every N , while dephasing sits a factor of 2.4 to 2.1 higher. The channel ordering in (a) is an artifact of parameterization; the structure in (b) is physical.

TABLE II. GHZ key rate under even versus concentrated noise at fixed budget S, N = 3. Channel Dephasing

S Even split Concentrated Loss % drop 0.30 0.6226 0.5920 0.0307 4.9 0.60 0.4100 0.3117 0.0982 24.0 0.90 0.2640 0.0734 0.1906 72.2 Amplitude 0.15 0.4958 0.3779 0.1179 23.8 damping 0.30 0.1862 0.0000 0.1862 100.0 Depolarizing 0.09 0.4434 0.3451 0.0983 22.2

from that of Epping et al. Our channels act independently on each qubit after distribution, so the growth in Qx with N reflects the accumulation of local errors across an increasing number of arms, whereas Epping’s threshold analysis applies depolarization at the level of the distributed state. The two are not in conflict and should not be read as competing measurements of the same quantity. Nor is this superdecoherence, the fasterthan-linear decay that occurs when qubits couple to a common reservoir [21]; our noise is uncorrelated across arms, so the correct description is local noise accumulation.

D.

Concentrated noise is worse than distributed noise

P Holding the total noise budget S = j γj fixed, we compare an even split across all arms against concentration on a single arm (Fig. 6; Table II). The penalty appears for every channel tested, and

FIG. 6. GHZ key rate under asymmetric dephasing on arms 1 and 2, with arm 3 noiseless, N = 3. The dashed line marks a fixed total budget γ1 +γ2 = 0.6; along it the rate is maximized at the even split (star), the arithmetic–geometric-mean result proved in Section II G, and falls monotonically toward either concentrated end.

grows with the total budget. It vanishes as S → 0, where both configurations approach the noiseless rate, and reaches total suppression at large S, where concentration alone can drive the rate to zero while the even split still yields key. Sampling 4000 random splits of a fixed budget S = 0.9 under dephasing from a Dirichlet distribution, the maximum rate occurs at the near-equal split and the minimum at the most concentrated draw.

9 TABLE III. GHZ key rate under exact and twirled amplitude damping, N = 3. γ 0.020 0.050 0.080 0.100 0.1174

Exact 0.74891 0.49583 0.29819 0.18617 0.09867

Twirled 0.74778 0.49044 0.28660 0.16970 0.07758

Difference 0.00113 0.00538 0.01159 0.01647 0.02109

For Pauli channels, the result is a theorem. With the per-party Q aggregates gj defined in Section II E, Qx = 1 the rate means maxj (1 − 2gj )], so maximizing 2 [1 − Q P imizing j (1 − 2gj ) at fixed j gj . By the arithmetic– geometric mean inequality, this product is maximized when all gj are equal, and it decreases monotonically as the distribution becomes more concentrated. For channels with Qz > 0, a second mechanism reinforces the first: the rate takes maxi h(Q1,i ) over receivers, so the reconciliation cost is determined by the worst link, and concentration is exactly what makes one link worse than the others. This answers a question posed but not resolved by Proietti et al. [3], whose supplementary material observes numerically that conference key rates depend nontrivially on how noise is distributed across a star network and identifies this as a degree of freedom with no two-party analogue. Their analysis is restricted to depolarizing channels; the result above holds for arbitrary per-party Pauli noise and follows analytically from the closed form of Section II G. Pickston et al. saw the same effect experimentally [18], finding that the achievable rate depended on which party was assigned the dealer role because noise was distributed unevenly across their six-qubit resource state.

E.

Amplitude damping: exact simulation versus Pauli twirling

The closed form of Section II G assumes Pauli noise, and amplitude damping is not a Pauli channel, so we do not apply it directly. The standard workaround is the Pauli twirling approximation [19, 20], which replaces the channel with √ its Pauli-diagonal part: px = py = γ/4 and pz = (1 − 1 − γ)/2 − γ/4. Instead of assuming this approximation is adequate, we report both. The twirl uniformly underestimates the key rate, by at most 0.021 bits over the range, with the discrepancy largest near the crossover where both rates are low (Table III). The error has an exact structure. The twirled channel reproduces ⟨X ⊗N ⟩ to machine precision: twirling preserves each Pauli-basis diagonal element, and Qx depends only on the gj aggregates, which the twirl matches by construction. The entire discrepancy is in Qz . To leading order, the twirled channel gives Qz = γ/2 per

pair of arms, exceeding the exact value by γ 2 /2 per arm at every noise strength we tested. The origin is the coherent |0⟩⟨1| damping term that the twirl discards: its second-order contribution partially cancels the population error in ⟨Z1 Zi ⟩, so removing it converts a cancellation into an overestimate of the bit-error rate, which the entropy function then amplifies near the crossover, where rates are small. Propagated to the threshold itself— twirling both protocols, since in practice the approximation would be applied throughout—the crossover lands at 0.11358 against the exact 0.11739, a 3.2% error at N = 3, falling to 2.4% at N = 5. This approximation is therefore adequate for qualitative statements and for placing amplitude damping in Table I, but not for precise quoted threshold values. All amplitude-damping figures in this work are exact densitymatrix simulations; the twirled values appear only in this comparison. This pessimistic bias of the twirl is consistent with what Tomita and Svore observed for surfacecode thresholds under the same approximation [19], here isolated to a single term of the key rate with its coefficient identified exactly.

VI. A.

DISCUSSION

One mechanism accounts for all of the results

The four effects reported above are not independent findings. They are four faces of one structural fact about the N-BB84 rate. The GHZ protocol pays two entropy costs. The first, h(Qx ), derives from ⟨X ⊗N ⟩, whose expectation value under independent per-arm noise is a product over all N arms. The second, maxi h(Q1,i ), derives from ⟨Z1 Zi ⟩, which involves two arms at a time. The pairwise protocol restricts both costs to a single link. Every result follows from asking what a given disturbance does to that product. a. Channel type. A channel that produces no bitflip-type errors leaves Qz identically zero, so the GHZ protocol pays only the global term. Dephasing does this exactly, and tolerates roughly twice the infidelity before losing to the pairwise baseline. Amplitude damping and depolarizing both feed both terms, and when matched in infidelity, their thresholds agree to within 1.2%. The relevant property is the channel’s Pauli error composition, not its identity as a named channel. b. Admixture. The collapse in Fig. 4 is front-loaded because it reflects the activation of a term rather than its growth. Going from pure dephasing to 5% admixture more than halves the tolerable noise, because h(Qz ) moves from identically zero to small, and the marginal cost of the first bit-flip error is much larger than that of any subsequent one. c. Group size. Adding a party adds a factor to the product in Qx while leaving each Q1,i a two-factor quantity. The GHZ side degrades, and the pairwise side does

10 not, so the crossover moves down. d. Noise Q distribution. At a fixed total budget, the product j (1 − 2gj ) is maximized when the gj are equal, by the arithmetic–geometric mean inequality, and falls monotonically as the distribution concentrates. For channels with Qz > 0, the second term reinforces this, since the rate takes a maximum over receivers and concentration is what creates a worst link. That all four predictions hold in simulation, on top of the machine-precision agreement of Section V A, is what convinces us the mechanism is correctly identified, not merely consistent with one dataset.

B.

A practical corollary: which party should hold the key

The closed form has an immediate operational consequence that we did not anticipate. The dealer’s arm noise enters every pairwise term Q1,i , while each receiver’s noise enters only one. In a network with unequal arm quality, the dealer role should therefore be assigned to the party with the cleanest link. Simulating all six assignments of the three noise strengths to the three arms for N = 3, with arm noise 0.02, 0.06, and 0.12 under amplitude damping, confirms this. Qx is identical across all six permutations, since it is a symmetric product over arms. The key rate is 0.3575 when the cleanest arm holds the dealer role and 0.3024 otherwise, an 18% improvement for a choice that costs nothing. The degenerate cases are informative too. Assigning the dealer role to the second-cleanest or noisiest arm gives identical rates, because in both cases the maximum over receivers selects the pair formed by the two noisiest arms. The rate is set by the two worst arms unless the dealer is the cleanest one, in which case it is set by the best and worst. The prediction comes with its own test: the effect operates entirely through Qz , so it should vanish for channels that do not produce bit-flip errors. Repeating the same six-permutation test under dephasing gives a rate of 0.714377 for every assignment, identical to six decimal places. This explains an observation by Pickston et al. [18], who found that the achievable rate in their six-photon experiment depended on which party held the dealer role, and optimized empirically over all permutations. The closed form identifies why the optimization helps, predicts which permutation wins without a search, and predicts the conditions under which it will not help at all.

C.

Relation to prior work

Two of the four results have partial precedent, so we state exactly which parts are new.

The movement of the crossover with party number is not. Epping et al. give threshold error rates as a function of N [2], and Memmen et al. derive explicit depolarizing thresholds against N for essentially the comparison studied here [4]. Section V C confirms these under a per-qubit noise model rather than establishing them, and is included because the N -dependence is a precondition for reading Table I correctly, not as a claim of priority. What the type-resolved analysis adds is that the thresholds these works report are specific to depolarizing channels in a way not visible from within a single-channel study: a fidelity-matched comparison places depolarizing and amplitude damping within 1.2% of each other and dephasing a factor of 2.1–2.4 away, so a depolarizing threshold generalizes to some channels and badly misestimates others. The noise-distribution result answers a question that was posed rather than resolved. Proietti et al. observe numerically that conference key rates in a four-user star depend on how depolarizing noise is allocated across links [3], and identify this as a degree of freedom with no twoparty analogue. Section V D establishes the direction of that dependence for arbitrary per-party Pauli noise, and derives it analytically from the arithmetic–geometric mean inequality rather than mapping it numerically. The dealer-assignment corollary of Section VI B is the same mechanism applied to a choice that costs nothing to make, and it accounts for the permutation optimization Pickston et al. arrived at empirically [18], including the prediction that the optimization returns nothing under pure dephasing. Two clarifications prevent apparent conflicts with prior work. Our channels act independently on each qubit after distribution, whereas Epping’s threshold analysis applies depolarization at the level of the distributed state; these are different models, and the resulting thresholds are not competing estimates of one quantity. Separately, the growth of GHZ fragility with N is local noise accumulation, not superdecoherence (Section V C); our noise is uncorrelated across arms, so linear-in-N accumulation is the expected behavior for this model, not evidence of collective coupling.

D.

Limitations

Transmission loss is not modeled. This is the most important omission. Loss affects the GHZ protocol disproportionately, since all N arms must succeed simultaneously, and Memmen et al. show that including it removes the multipartite advantage entirely for links beyond roughly 15 km of direct-transmission fiber [4], in a network where the noise-only analysis would predict an advantage. Our thresholds should therefore be read as characterizing only the noise-induced component of the crossover, and as upper bounds on where the boundary sits in a lossy deployment. The analysis is asymptotic. No finite-key corrections

11 are applied [1, 22], and these would not affect the two protocols equally: the GHZ protocol requires all parties to measure in a matching basis, reducing usable rounds, while the pairwise protocol must compose N − 1 keys to a common security parameter. We do not claim these effects cancel, only that we have not quantified either. The resource-counting convention is assumed. We charge the pairwise protocol N − 1 network uses, following the bottleneck-network convention. All threshold values scale with this choice, and a non-bottleneck topology would remove the prefactor entirely. The model is at qubit level. Source imperfections, multi-pair emission, detector dark counts, and basis misalignment are absent. In particular, photon-numbersplitting attacks are not structurally testable with a QBER-based qubit model, since they can occur without introducing detectable error, so nothing here speaks to implementation security. Group sizes are small. Density-matrix simulation costs memory of order 4N , which restricts direct simulation to N ≤ 5. The trend is established over three points, and extrapolation beyond that range rests on the closed form rather than on simulation.

swered. Amplitude damping and depolarizing agree to 0.03% at N = 3 but separate slowly with group size, reaching 1.2% at N = 5. The twirl analysis of Section V E locates the origin: the non-Pauli part of amplitude damping contributes a per-arm correction of exactly γ 2 /2 to Qz , absent for depolarizing, and its weight in the rate shifts as N grows. Separately, the closed form extends to arbitrary N at negligible cost, so the N -dependence could be pushed well past the simulation limit, subject to spot-checking at the largest tractable size. Finally, the mechanism identified here suggests an experimental target. If the crossover is controlled by Pauli error composition rather than channel identity, then two physically distinct noise processes engineered to the same composition should exhibit the same crossover to within measurement precision. That is a sharper test than any of the comparisons performed here, and it is within reach of the platforms used in existing CKA experiments.

ACKNOWLEDGMENTS

The most valuable extension is the one our limitations imply. Combining the type-resolved analysis here with the loss-and-memory modeling of Memmen et al. [4, 23] would produce an advantage boundary in both noise composition and distance, which is the object a network designer needs and which neither analysis alone provides. One smaller question arose along the way and was an-

This work was carried out as part of the QHSRP at Frontier Technology Institute. The authors thank the Frontier Technology Institute for providing the opportunity and support to conduct this research. We thank our teaching assistant, Aaditya Bhattacharya, for technical guidance throughout the research project, and our instructor, Kian Jansepar, for teaching the quantum computing coursework on which this project builds. We gratefully acknowledge the University of Maryland Discovery Fund and TEDCO for their support of the program.

[1] F. Grasselli, H. Kampermann, and D. Bruß, Finite-key effects in multipartite quantum key distribution protocols, New Journal of Physics 20, 113014 (2018). [2] M. Epping, H. Kampermann, C. Macchiavello, and D. Bruß, Multi-partite entanglement can speed up quantum key distribution in networks, New Journal of Physics 19, 093012 (2017). [3] M. Proietti, J. Ho, F. Grasselli, P. Barrow, M. Malik, and A. Fedrizzi, Experimental quantum conference key agreement, Science Advances 7, eabe0395 (2021). [4] J. Memmen, J. Eisert, and N. Walk, Advantage of multipartite entanglement for quantum cryptography over long and short ranged networks (2023), arXiv:2312.13376 [quant-ph]. [5] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing (Bangalore, India, 1984) pp. 175–179, reprinted in Theor. Comput. Sci. 560, 7–11 (2014). [6] A. K. Ekert, Quantum cryptography based on Bell’s theorem, Physical Review Letters 67, 661 (1991).

[7] M. Hillery, V. Bužek, and A. Berthiaume, Quantum secret sharing, Physical Review A 59, 1829 (1999). [8] K. Chen and H.-K. Lo, Multi-partite quantum cryptographic protocols with noisy GHZ states, Quantum Information & Computation 7, 689 (2007). [9] G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, Quantum conference key agreement: A review, Advanced Quantum Technologies 3, 2000025 (2020). [10] S. Zhao, P. Zeng, W.-F. Cao, X.-Y. Xu, Y.-Z. Zhen, X. Ma, L. Li, N.-L. Liu, and K. Chen, Phase-matching quantum cryptographic conferencing, Physical Review Applied 14, 024010 (2020). [11] X.-Y. Cao, J. Gu, Y.-S. Lu, H.-L. Yin, and Z.-B. Chen, Coherent one-way quantum conference key agreement based on twin field, New Journal of Physics 23, 043002 (2021). [12] F. Grasselli, H. Kampermann, and D. Bruß, Conference key agreement with single-photon interference, New Journal of Physics 21, 123002 (2019). [13] J. Ribeiro, G. Murta, and S. Wehner, Fully deviceindependent conference key agreement, Physical Review A 97, 022307 (2018).

E.

Outlook

12 [14] T. Holz, H. Kampermann, and D. Bruß, Genuine multipartite Bell inequality for device-independent conference key agreement, Physical Review Research 2, 023251 (2020). [15] F. Hahn, J. de Jong, and A. Pappa, Anonymous quantum conference key agreement, PRX Quantum 1, 020325 (2020). [16] F. Grasselli, G. Murta, J. de Jong, F. Hahn, D. Bruß, H. Kampermann, and A. Pappa, Secure anonymous conferencing in quantum networks, PRX Quantum 3, 040306 (2022). [17] J. W. Webb, J. Ho, F. Grasselli, G. Murta, A. Pickston, A. Ulibarrena, and A. Fedrizzi, Experimental anonymous quantum conferencing, Optica 11, 872 (2024). [18] A. Pickston, J. Ho, A. Ulibarrena, F. Grasselli, M. Proietti, C. L. Morrison, P. Barrow, F. Graffitti, and A. Fedrizzi, Conference key agreement in a quantum network, npj Quantum Information 9, 82 (2023). [19] Y. Tomita and K. M. Svore, Low-distance surface codes

under realistic quantum noise, Physical Review A 90, 062320 (2014). [20] A. Katabarwa and M. R. Geller, Logical error rate in the Pauli twirling approximation, Scientific Reports 5, 14670 (2015). [21] J. F. Kam, H. Kang, C. D. Hill, G. J. Mooney, and L. C. L. Hollenberg, Characterization of entanglement on superconducting quantum computers of up to 414 qubits, Physical Review Research 6, 033155 (2024). [22] Z. Li, X.-Y. Cao, C.-L. Li, C.-X. Weng, J. Gu, H.-L. Yin, and Z.-B. Chen, Finite-key analysis for quantum conference key agreement with asymmetric channels, Quantum Science and Technology 6, 045019 (2021). [23] J. Memmen, J. Kunzelmann, N. Walk, J. Eisert, and J. Wallnöfer, Strategy optimization for quantum conference key agreement in asymmetric star networks (2026), arXiv:2605.18677 [quant-ph].

Related documents

• Pauli Error Composition Determines the Multipartite Advantage in Conference Key Agreement#1216626
• Performance Analysis of Multiparty GHZ-State Quantum Conference Key Agreement over Optical Fiber Channel#1201461
• Proof-of-principle long-distance Sagnac twin-field quantum key distribution network#927735
• Scalable Composition of Byzantine Agreements under Reorder Attacks#987959
• Key-Reuse Vulnerability of Phase-Keyed Fourier-Curve Modulation: Relation Leakage and Key-Refresh Cost on Coded Links#1160939