Polar Codes for Covert Communications over Asynchronous Discrete Memoryless Channels

Abstract

This paper introduces an explicit covert communication code for binary-input asynchronous discrete memoryless channels based on binary polar codes, in which legitimate parties exploit uncertainty created by both the channel noise and the time of transmission to avoid detection by an adversary. The proposed code jointly ensures reliable communication for a legitimate receiver and low probability of detection with respect to the adversary, both observing noisy versions of the codewords. Binary polar codes are used to shape the weight distribution of codewords and ensure that the average weight decays as the block length grows. The performance of the proposed code is severely limited by the speed of polarization, which in turn controls the decay of the average codeword weight with the block length. Although the proposed construction falls largely short of achieving the performance of random codes, it inherits the low-complexity properties of polar codes.

1. Introduction

Following the proof of existence of a “square root law” [1] for covert communication, several works have revisited the problem of communicating while ensuring a low probability of detection by an adversary. The square root law essentially states that, under mild conditions about the channel, covert communication is possible if and only if the number of message bits scales as the square root of the block length. The exact information-theoretic limits of covert communication over point-to-point Discrete Memoryless Channels (DMCs) and Gaussian channels are now known [2,3,4], and for models relaxing assumptions regarding channel knowledge and synchronicity, the square root law can be circumvented [5,6]. Despite recent results showing, through a random coding argument, the existence of low-complexity covert codes using a concatenated scheme [7], i.e., codes ensuring covert communication with an encoding and decoding complexity that only scale linearly with the block length, no explicit low-complexity constructions are known to date.

As highlighted in [3], the coding mechanism behind covert communication may be linked to the concept of channel output approximation [8], which allows us to leverage recent error control coding approaches to secrecy exploiting similar ideas [9]. However, the main challenge faced when designing explicit instantiations of covert codes is the control of the codeword weight distribution, whose average weight should scale sub-linearly with the block-length [2,3,4].

In this paper, we develop a polar-code based covert code for the asynchronous covert communication model of [6]. The choice of polar codes is motivated by their low-complexity and capacity-achieving properties [10], which have already proved useful in the context of channel resolvability [11]. Existing results, however, do not directly apply to covert communications since the average codeword weight must decay with the block length. We address this issue by first adapting the finite-length analysis of channel polarization [12,13] to source polarization and then analyzing the tension between the speed of polarization and the decay of the average codeword weight.

The remainder of the paper is organized as follows. Section 2 formally introduces the model of covert communication and presents our main contributions. Section 3 establishes several preliminary technical lemmas concerning the polarization of sources with vanishing entropy. Section 4 describes the proposed polar-coding scheme for covert communications and analyzes its performance. Section 5 concludes the paper with a discussion of extensions and possible improvements.

2. Asynchronous Covert Communication Model and Results

2.1. Notation

Before describing the asynchronous covert communication model, we briefly introduce the notation used throughout the paper. Random variables are denoted by upper case letters, e.g., X, and their realizations by lower case letters, e.g., x. Sets are denoted with calligraphic fonts, e.g., $\mathcal{X}$. Vectors of length n are denoted as $X^{1:n}=(X_1,\cdots ,X_n)$ and $x^{1:n}=(x_1,\cdots ,x_n)$ when the length needs to be explicit, and by boldface fonts, e.g., $\mathbf{X}$ and $\mathbf{x}$, when the length can be inferred from the context without ambiguity. When multiple blocks of length n are used, we denote the block index as a subscript, e.g, $X_{1:b}^{1:n}$ denotes a sequence of b blocks of length n. The function log is understood in the base 2, while ln denotes the logarithm to the base e. For two distributions $P,Q$ on some countable set $\mathcal{X}$, we write the Kullback–Leibler divergence and the total variation distance as

$$\begin{array}{c}\hfill \mathbb{D}(P\parallel Q)\triangleq \sum _{x\in \mathcal{X}}P\left(x\right)\log \frac{P\left(x\right)}{Q\left(x\right)}\mathrm{and}\mathbb{V}(P,Q)\triangleq \frac{1}{2}\sum _{x\in \mathcal{X}}|P\left(x\right)-Q\left(x\right)|,\end{array}$$

respectively. We also denote $P^{\otimes n}\left(\mathbf{x}\right)$ as the product distribution ${\prod }_{i=1}^{n}P\left(x_i\right)$ for $\mathbf{x}\in {\mathcal{X}}^n$.

We make repeated use of the Landau notation. In particular, for two real-valued functions $f\left(n\right)$ and $g\left(n\right)$ of $n\in \mathbb{N}$, we write $f\left(n\right)=o\left(g\left(n\right)\right)$ if $\forall \alpha >0$ $\exists n_0\in {\mathbb{N}}^{*}$ such that $\forall n\ge n_0$ $\left|f\left(n\right)\right|\le \alpha \left|g\left(n\right)\right|$; $f\left(n\right)=O\left(g\left(n\right)\right)$ if $\exists \alpha >0$ $\exists n_0\in {\mathbb{N}}^{*}$ such that $\forall n\ge n_0$ $\left|f\left(n\right)\right|\le \alpha \left|g\left(n\right)\right|$; $f\left(n\right)=\omega \left(g\left(n\right)\right)$ if $\forall \alpha >0$ $\exists n_0\in {\mathbb{N}}^{*}$ such that $\forall n\ge n_0$ $\left|f\left(n\right)\right|\ge \alpha \left|g\left(n\right)\right|$.

The polarization kernel matrix $G_2=\left[\begin{array}{cc}1& 1\\ 0& 1\end{array}\right]$ will be merely denoted G. We denote $G^{\otimes \nu }$ the matrix representing the recursive transformation over $\nu$ levels of polarization. Thus, the corresponding polar code is of length $n=2^{\nu }$. Since the length of binary polar codes is a power of two, we restrict our attention to block lengths $n\in \mathbb{D}\triangleq \{2^{\nu }:\nu \in {\mathbb{N}}^{*}\}$.

2.2. Channel Model

The channel model for covert communication is illustrated in Figure 1 and Figure 2. A legitimate transmitter (Alice) attempts to reliably communicate to a legitimate receiver (Bob) over a DMC $(\mathcal{X},W_{Y|X},\mathcal{Y})$, while avoiding detection from an adversary (Willie) who observes signals through another DMC $(\mathcal{X},W_{Z|X},\mathcal{Z})$. In the remainder of the paper, we restrict our attention to a binary input alphabet $\mathcal{X}=\{0,1\}$, with 0 representing the innocent input symbol in the absence of communication. We denote $P_0\triangleq W_{Y|X=0}$ and $Q_0\triangleq W_{Z|X=0}$ as the output distributions induced by the innocent symbol 0. Similarly, we denote $P_1\triangleq W_{Y|X=1}$ and $Q_1\triangleq W_{Z|X=1}$ as the output distributions induced by symbol 1. We assume that both $P_1$ and $Q_1$ are absolutely continuous with respect to (w.r.t.) $P_0$ and $Q_0$, respectively, to avoid the special situations discussed in Appendix V of [3].

Formally, a message $W\in 〚1,M_n〛$ with uniform distribution is encoded into a codeword of length n, possibly with the help of secret key $S\in 〚1,K_n〛$ only known to Alice and Bob but using a public codebook known to all parties; the codeword is hidden within a larger transmission window of size $N>n$, with N a function of n, by choosing the starting index T of the codeword uniformly at random between 1 and $N^{\prime }\triangleq N-n+1$. The set of indices corresponding to the codeword forms the codeword window. The sequence transmitted during the transmission window is denoted $X^{1:N}$, and the corresponding observations of Bob and Willie are denoted $Y^{1:N}$ and $Z^{1:N}$, respectively. It is convenient to introduce the following distributions. The distribution induced at the output of the adversary’s channel in a codeword window is denoted ${\widehat{Q}}^n$. When the codeword is embedded in a transmission window starting at a known index t, the distribution induced at the output of the adversary’s channel in the transmission window is

$$\begin{array}{c}\hfill {\widehat{Q}}_t^N\left(\mathbf{z}\right)=\prod _{k=1}^{t-1}{Q}_0\left(z_k\right)\prod _{k=t}^{t+n-1}{\widehat{Q}}^n\left(z_k\right)\prod _{k=t+n}^N{Q}_0\left(z_k\right).\end{array}$$

(1)

Finally, the distribution induced at the output of the adversary’s channel in the transmission window when randomizing the start index T is ${\widehat{Q}}^N\triangleq {\mathbb{E}}_T\left({\widehat{Q}}_T^N\right)$.

Given the secret key S and the observation $Y^{1:N}$, Bob forms an estimate $\widehat{W}$ of the original message W, whose performance is measured by the probability of error $P_e^{\left(n\right)}\triangleq {\mathbb{E}}_S\left(\mathbb{P}\left(\widehat{W}\ne W|S\right)\right)$. Given the observation $Z^{1:N}$ and the knowledge of Alice’s codebook, Willie performs a hypothesis test to determine if communication took place. Hypothesis $H_0$ corresponds to the absence of communication, in which case the distribution of $Z^{1:N}$ is $Q_0^{\otimes N}$; Hypothesis $H_1$ corresponds to communication, in which case the distribution induced by the code is ${\widehat{Q}}^N$ over the transmission window. Note that ${\widehat{Q}}^N$ can be computed using knowledge of the codebook and the distribution of T. The covertness of the transmission is measured by the total variation $V^{\left(n\right)}\triangleq \mathbb{V}\left({\widehat{Q}}^N,Q_0^{\otimes N}\right)$. A small value of $V^{\left(n\right)}$ ensures that the best binary hypothesis test is not significantly better than a “blind” test that would ignore the observation $Z^{1:N}$ [3].

Our objective is to construct sequences of codes such that ${\lim }_{n\to \infty }{P}_e^{\left(n\right)}=0$ and ${\lim }_{n\to \infty }{V}^{\left(n\right)}=0$.

2.3. Main Results

We start by recalling a known result established with a random coding argument, which serves as a benchmark for our code construction.

Proposition 1.

(adapted from [6]). Consider sequences of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in {\mathbb{N}}^{*}}$, ${\left\{{\beta }_n\right\}}_{n\in {\mathbb{N}}^{*}}$ such that ${\alpha }_n\in \omega \left(\frac{1}{\sqrt{n}}\right)\cap o\left(1\right)$, ${\beta }_n=\omega \left(2^{-\frac{n{\alpha }_n}{\log n}}\right)\cap o\left(1\right)$ as n goes to infinity. Let $N=\frac{2^{n{\alpha }_n^2}}{{\beta }_n{\alpha }_n^2}$. There exist codes of increasing block length n hidden in transmission windows of size N such that

$$\begin{array}{cc}\hfill \underset{n\to \infty }{\lim }\frac{\log M_n}{n{\alpha }_n}& \ge \mathbb{D}\left(P_1\parallel P_0\right)\hfill \\ \hfill \underset{n\to \infty }{\lim }\frac{\log K_n}{n{\alpha }_n}& \le {\left[\mathbb{D}\left(Q_1\parallel Q_0\right)-\mathbb{D}\left(P_1\parallel P_0\right)\right]}^{+}\hfill \\ \hfill \underset{n\to \infty }{\lim }{P}_e^{\left(n\right)}& =0\hfill \\ \hfill \underset{n\to \infty }{\lim }{V}^{\left(n\right)}& =0.\hfill \end{array}$$

Proposition 1 states that the number of bits $\log M_n$ scales as $n{\alpha }_n$ with a constant pre-factor at least equal to $\mathbb{D}\left(P_1\parallel P_0\right)$ for all admissible choices of ${\alpha }_n$. As ${\alpha }_n$ increases, so does the scaling of $\log M_n$, but at the expense of increasingly larger monitoring windows. Proposition 1 captures the correct scaling for the transmission window size, the number of message bits, and the number of key bits with the block length n, as shown by the converse proof in [5]. While this result has been obtained with a random coding argument, in which codewords are sampled independently according to product distributions, the main contribution of the present paper is to establish a similar result using polar codes in place of random codes.

In the following, we allow ourself a slight modification of the coding scheme defined in Section 2.2 to consider $b_n$ consecutive transmission windows of size N, where $b_n$ will be specified later. The messages and keys used in the transmission windows might be dependent, but the codeword in each of them is otherwise created as defined earlier. The probability of error $P_e^{\left(n\right)}$ is appropriately modified to consider the set of messages ${\left\{W_i\right\}}_{i=1}^{b_n}$ as

$$\begin{array}{c}\hfill P_e^{\left(n\right)}=\mathbb{P}\left({\left\{{\widehat{W}}_i\right\}}_{i=1}^{b_n}\ne {\left\{W_i\right\}}_{i=1}^{b_n}\right),\end{array}$$

(2)

and $V^{\left(n\right)}$ considers the distribution induced over the $b_n$ consecutive transmission windows

$$\begin{array}{c}\hfill V^{\left(n\right)}=\mathbb{V}\left({\widehat{Q}}^{b_{n}N},Q_0^{\otimes b_{n}N}\right).\end{array}$$

(3)

Our results also depend on a constant $\kappa$, whose value results from the analysis of finite length polarization and is further discussed in Section 3.

Proposition 2.

There exists a constant $\kappa \in ]0,\frac{1}{2}[$, such that for all sequences of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in \mathbb{D}}\in \omega \left(\frac{1}{n^{\kappa }}\right)\cap o\left(1\right)$, ${\left\{{\beta }_n\right\}}_{n\in \mathbb{D}}\in \omega \left(2^{-\frac{n{\alpha }_n}{\log n}}\right)\cap o\left(\frac{1}{\log n}\right)$, and sequence of integers ${\left\{b_n\right\}}_{n\in \mathbb{D}}\in \omega \left(\log n\right)\cap o\left(\frac{1}{{\beta }_n}\right)\cap o\left(n\right)$ as n goes to infinity, there exist low-complexity polar-code based schemes operating over $b_n$ transmission windows of size $N=\frac{2^{n{\alpha }_n^2}}{{\beta }_n{\alpha }_n^2}$, each embedding a codeword window of length n, with

$$\begin{array}{cc}\hfill \underset{n\in \mathbb{D}\to \infty }{\lim }\frac{\log M_n}{n{b}_n{\alpha }_n}& \ge \mathbb{D}\left(P_1\parallel P_0\right),\hfill \\ \hfill \underset{n\in \mathbb{D}\to \infty }{\lim }\frac{\log K_n}{n{b}_n{\alpha }_n}& \le {\left[\mathbb{D}\left(Q_1\parallel Q_0\right)-\mathbb{D}\left(P_1\parallel P_0\right)\right]}^{+},\hfill \\ \hfill \underset{n\in \mathbb{D}\to \infty }{\lim }{P}_e^{\left(n\right)}& =0,\hfill \\ \hfill \underset{n\in \mathbb{D}\to \infty }{\lim }{V}^{\left(n\right)}& =0.\hfill \end{array}$$

Proof. 

See Section 4. ☐

The constant $\kappa$ in the statement of Proposition 2 is more precisely identified in Proposition 3. The precise code construction behind the statement is provided in Section 4, and the exact encoding and decoding algorithms are given in Algorithms 1 and 2 in Section 4.2. The complexity of both algorithms scales linearly with the number of transmission windows $b_n$ and as $n\log n$ with the codeword length n. Note that Proposition 2 differs from Proposition 1 on two accounts. First, the polar-code based scheme only holds for a limited range of scalings for ${\alpha }_n$. A numerical investigation suggests that $\kappa$ is on the order of ${10}^{-3}$, which completely precludes our codes from operating in the square-root law regime and requires absurdly large code length; however, if one backs away from the optimal scalings identified above, our approach does provide a low-complexity construction with provable guarantees. As further discussed in Section 3, this results from our inability to establish a faster polarization speed. In particular, as will be clear from our analysis, we rely on a fine polarization result from [12] to show that covertness holds, and the value of $\kappa$ is therefore much more constrained than what would be expected by only looking at the inverse scaling exponent [14,15]. Our results might be improved by considering a “moderate deviation regime” in the same spirit as [14], but this would require a non-trivial extension of existing results, which we defer to future work. Second, the proposed scheme requires a chaining over $b_n$ transmission windows; we shall see in Section 4 that the chaining allows us to “realign” polarization sets. Although this chaining does not fall into the exact situation of Section 2.2 in which a single block is considered, covertness is guaranteed over the entire chain of blocks; in addition, a mild scaling such as $b_n=\omega \left(\log n\right)$ is valid so that the number of blocks may be much smaller than the block-length. Finally, the proposed code construction is non-trivial, but its performance is still far from that of the random codes in Proposition 1. Section 5 discusses several ongoing efforts to improve performance.

Algorithm 1 Alice’s encoder

Require: Vector C of $\left|{\mathcal{V}}_C\right|$ uniformly distributed key bits; $b_n$ vectors ${\left\{W_i\right\}}_{i=1,b_n}$ of $\left|{\mathcal{V}}_W\right|$ uniformly distributed message bits; $b_n$ vectors ${\left\{W_i^{\prime }\right\}}_{i=1,b_n}$ of $\left|{\mathcal{V}}_{W^{\prime }}\right|$ uniformly distributed message bits; Vector $S_1$ of $\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}\right|$ uniformly distributed key bits; $b_n-1$ vectors ${\left\{S_i\right\}}_{i=2,b_n}$ of $\left|{\mathcal{V}}_S\right|$ uniformly distributed key bits; $b_n$ vectors ${\left\{S_i^{\prime }\right\}}_{i=1,b_n}$ of $\left|{\mathcal{V}}_{C^{\prime }}\right|$ uniformly distributed key bits; $b_n$ vectors ${\left\{S_i^{″}\right\}}_{i=1,b_n}$ of $\log N$ uniformly distributed key bits; 1: for block $i=1$ to $b_n$ do 2:   ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_C\right]\leftarrow C$ 3:   ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_W\right]\leftarrow W_i$ 4:   ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{W^{\prime }}\right]\leftarrow W_i^{\prime }$ 5:   if $i=1$ then 6:     ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_S\right]\leftarrow S_1$ 7:   else 8:     ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{S^{\prime }}\right]\leftarrow W_{i-1}^{\prime }$ 9:     ${\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_S\right]\leftarrow S_i$ 10:   end if 11:   Successively draw the components of ${\tilde{U}}_i^{1:n}$ in ${\mathcal{V}}_X^c$ according to $$\forall j\in {\mathcal{V}}_X^c{\tilde{p}}_{U_i^j|U_i^{1:j-1}}\left(u_i^j|{\tilde{U}}_i^{1:j-1}\right)\triangleq q_{U^j|U^{1:j-1}}\left(u_i^j|{\tilde{U}}_i^{1:j-1}\right)$$ (4) 12:   Transmit ${\tilde{X}}_i^{1:n}\triangleq {\tilde{U}}_i^{1:n}{G}^{\otimes \nu }$ over the channel $W_{Y|X}$, which gives the output ${\tilde{Y}}_i^{1:n}$, and over the channel $W_{Z|X}$, which gives the output ${\tilde{Z}}_i^{1:n}$. Assume that $C_i^{\prime }\oplus S_i^{\prime }\triangleq {\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{C^{\prime }}\right]$ is made available at the decoder. Randomize the position of the codeword window using $S_i^{″}$ 13: end for

Algorithm 2 Bob’s decoder

Require: Vector C of $\left|{\mathcal{V}}_C\right|$ uniformly distributed key bits; Vector $S_1$ of $\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}\right|$ uniformly distributed key bits; $b_n-1$ vectors ${\left\{S_i\right\}}_{i=2,b_n}$ of $\left|{\mathcal{V}}_S\right|$ uniformly distributed key bits; $b_n$ vectors ${\left\{S_i^{\prime }\right\}}_{i=1,b_n}$ of $\left|{\mathcal{V}}_{C^{\prime }}\right|$ uniformly distributed key bits; $b_n$ vectors ${\left\{S_i^{″}\right\}}_{i=1,b_n}$ of $\log N$ uniformly distributed key bits; $b_n$ vectors ${\{C_i^{\prime }\oplus S_i^{\prime }\}}_{i=1,b_n}$ of $\left|{\mathcal{V}}_{C^{\prime }}\right|$ made available; 1: Form an estimate ${\widehat{X}}_1^{1:n}$ of ${\tilde{X}}_1^{1:n}$ from $(C,S_1,C_1^{\prime },{\tilde{Y}}_1^{1:n})$ 2: Form the estimate ${\widehat{U}}_1^{1:n}={\widehat{X}}_1^{1:n}{G}^{\otimes \nu }$ 3: ${\widehat{W}}_1\leftarrow {\widehat{U}}_1^{1:n}\left[{\mathcal{V}}_W\right]$ 4: ${\widehat{W}}_1^{\prime }\leftarrow {\widehat{U}}_1^{1:n}\left[{\mathcal{V}}_{W^{\prime }}\right]$ 5: for block $i=2$ to $b_n$ do 6:   Form an estimate ${\widehat{X}}_i^{1:n}$ of ${\tilde{X}}_i^{1:n}$ from $(C,{\widehat{W}}_{i-1}^{\prime },S_i,C_i^{\prime },{\tilde{Y}}_i^{1:n})$ 7:   Form the estimate ${\widehat{U}}_i^{1:n}={\widehat{X}}_i^{1:n}{G}^{\otimes \nu }$ 8:   ${\widehat{W}}_i\leftarrow {\widehat{U}}_i^{1:n}\left[{\mathcal{V}}_W\right]$ 9:   ${\widehat{W}}_i^{\prime }\leftarrow {\widehat{U}}_i^{1:n}\left[{\mathcal{V}}_{W^{\prime }}\right]$ 10: end for

3. Preliminaries: Polarization of Sources with Vanishing Entropy Rate

Our code construction exploits recent results on polar codes that suggest how information-theoretic proofs exploiting source coding with side information and privacy amplification as primitives [16,17] may be converted into polar coding schemes by a suitable identification of polarization sets [11,18]. Specifically, the approach consists in recognizing that both primitives have counterparts based on polar codes, see Lemma 3 and Lemma 4 of [11], as well as [19,20]. Before we pursue a similar approach here, we must first extend Lemmas 3 and 4 of [11] to the case relevant for covert communications.

Formally, consider the sequences of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in \mathbb{D}}$ such that ${\alpha }_n\in \omega \left(\frac{1}{\sqrt{n}}\right)\cap o\left(1\right)$. For every $n\in \mathbb{D}$, define the Bernoulli distribution ${\Pi }_{{\alpha }_n}$ over $\{0,1\}$ as ${\Pi }_{{\alpha }_n}\left(1\right)=1-{\Pi }_{{\alpha }_n}\left(0\right)={\alpha }_n$ and its associated product distribution

$$\begin{array}{c}\hfill {\Pi }_{{\alpha }_n}^{\otimes n}\left(\mathbf{x}\right)=\prod _{i=1}^n{\Pi }_{{\alpha }_n}\left(x_i\right).\end{array}$$

(5)

Define the joint distribution of sequences in ${\mathcal{X}}^n\times {\mathcal{Y}}^n$

$$\begin{array}{c}\hfill q_{X^{1:n}{Y}^{1:n}}(\mathbf{x},\mathbf{y})\triangleq {\Pi }_{{\alpha }_n}^{\otimes n}\left(\mathbf{x}\right)W_{Y|X}^{\otimes n}\left(\mathbf{y}\right|\mathbf{x}),\end{array}$$

(6)

with $W_{Y|X}$ defined in Section 2.2. In other words, for a fixed n, the process $X^{1:n}{Y}^{1:n}$ has a product distribution but the process ${\left\{X^{1:n}{Y}^{1:n}\right\}}_{n\in \mathbb{D}}$ is not stationary and the entropy rate $\frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)$ vanishes. We refer to such a source as a “vanishing entropy rate source”. Assume now that the random vector $X^{1:n}\in {\mathcal{X}}^n$ is transformed into $U^{1:n}=X^{1:n}{G}^{\otimes \nu }$. For ${\delta }_n\in ]0,\frac{1}{2}[$, the set of high entropy bits is defined as

$${\mathcal{H}}_{X|Y}\left({\delta }_n\right)\triangleq \left\{i\in 〚1,n〛:H\left(U_i|U^{1:i-1}{Y}^{1:n}\right)>{\delta }_n\right\},$$

(7)

and the set of very high entropy bits is defined as

$${\mathcal{V}}_{X|Y}\left({\delta }_n\right)\triangleq \left\{i\in 〚1,n〛:H\left(U_i|U^{1:i-1}{Y}^{1:n}\right)>1-{\delta }_n\right\}$$

(8)

The following proposition shows that the sets ${\mathcal{H}}_{X|Y}$ and ${\mathcal{V}}_{X|Y}$ can still polarize for vanishing entropy rate sources.

Proposition 3.

(Fine polarization of vanishing entropy sources). For any $\delta \in \left[0,\frac{1}{2}\right]$, set ${\delta }_n=2^{-n^{\delta }}$. For any $\epsilon \in [0,1-2\delta ]$, there exists ${\kappa }_{\delta ,\epsilon }>0$, $A_{\delta ,\epsilon }>0$ and $C_{\delta ,\epsilon }$ such that for any vanishing entropy rate source $q_{X^{1:n}{Y}^{1:n}}(\mathbf{x},\mathbf{y})$ as in (6) and for any integer $n\in \mathbb{D}$ with $n>2^{C_{\delta ,\epsilon }}$, we have

$$\begin{array}{ccc}\hfill 0& \le & \frac{|{\mathcal{H}}_{X|Y}\left({\delta }_n\right)\cap {\mathcal{V}}_{X|Y}{\left({\delta }_n\right)}^c|}{n}\le \frac{A_{\delta ,\epsilon }}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\hfill \end{array}$$

(9)

$$\begin{array}{ccc}\hfill \frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)-{\delta }_n& \le & \frac{\left|{\mathcal{H}}_{X|Y}\left({\delta }_n\right)\right|}{n}\le \frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)+\frac{A_{\delta ,\epsilon }}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\hfill \end{array}$$

(10)

$$\begin{array}{ccc}\hfill \frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)-\frac{A_{\delta ,\epsilon }}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}& \le & \frac{\left|{\mathcal{V}}_{X|Y}\left({\delta }_n\right)\right|}{n}\le \frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)+{\delta }_n.\hfill \end{array}$$

(11)

Proof. 

The proof adapts the approach developed for finite length channel polarization [12] to source polarization. The idea is to first analyze a “rough” polarization to obtain a bound on the cardinality of the set of unpolarized sources, followed by a “fine” polarization to boost the polarization. Details require a careful adaptation but are otherwise similar to [12], and are therefore provided as supplementary material. ☐

For Proposition 3 to be meaningful, the relative size of the sets ${\mathcal{H}}_{X|Y}\left({\delta }_n\right)$ and ${\mathcal{V}}_{X|Y}\left({\delta }_n\right)$ in (10) and (11) should be asymptotically equivalent to the entropy rate $\frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)$. This is possible if $\frac{1}{n}H\left(X^{1:n}|Y^{1:n}\right)=\omega \left(\frac{1}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\right)$, i.e., polarization happens “fast enough” and the relative number of unpolarized symbols in (9) decays faster than the entropy rate. Therefore, our result only ensures the polarization of vanishing entropy rate sources for values of ${\alpha }_n$ that do not decay too rapidly; specifically, we require ${\alpha }_n=\omega \left(\frac{1}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\right)\cap o\left(1\right)$. Numerical analysis shows, for instance, that for $\delta =0.1$ and $\epsilon =0.59$, ${\kappa }_{\delta ,\epsilon }\epsilon \approx 6.53\times {10}^{-3}$. Note that this falls short of $\frac{1}{\sqrt{n}}$, which would be required for the square-root-law of communication. Nevertheless, we are now able to extend Lemma 3 and Lemma 4 of [11] to the finite length regime, which forms the basis of our construction for covert communications.

Lemma 1.

(Source coding with side information). Let $\delta \in [0,\frac{1}{2}]$, $\epsilon \in [0,1-2\delta ]$; set ${\delta }_n=2^{-n^{\delta }}$ and let ${\kappa }_{\delta ,\epsilon }>0$ be the constant identified by Proposition 3. Consider a vanishing entropy rate source $q_{X^{1:n}{Y}^{1:n}}$, as per (6) with ${\alpha }_n=\omega \left(\frac{1}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\right)\cap o\left(1\right)$. For $X^{1:n}$ polarized as $U^{1:n}=X^{1:n}{G}^{\otimes \nu }$, let $U^{1:n}\left[{\mathcal{H}}_{X|Y}\left({\delta }_n\right)\right]$ denote the high entropy bits of $U^{1:n}$. For every $i\in 〚1,n〛$, sample ${\tilde{U}}^{1:n}$ from the distribution

$${\tilde{p}}_{U_i|U^{1:i-1}}\left({\tilde{u}}_i\right|{\tilde{u}}^{1:i-1})\triangleq \left\{\begin{array}{cc}\mathbb{1}\{{\tilde{u}}_i=u_i\}\hfill & \mathrm{if}i\in {\mathcal{H}}_{X|Y}\left({\delta }_n\right)\hfill \\ q_{U_i|U^{1:i-1}{Y}^{1:n}}\left({\tilde{u}}_i\right|{\tilde{u}}^{1:i-1}\mathbf{y})\hfill & \mathrm{if}i\in {\mathcal{H}}_{X|Y}{\left({\delta }_n\right)}^c\hfill \end{array}\right.$$

(12)

and create $\tilde{\mathbf{x}}=\tilde{\mathbf{u}}{G}^{\otimes \nu }$. Then ${\tilde{X}}^{1:n}\ne X^{1:n}=O\left(n{\delta }_n\right)$.

Proof. 

See the proof of Lemma 3 in [11], using Proposition 3 instead of the standard polarization result. ☐

Lemma 2

(Privacy amplification). Let $\delta \in [0,\frac{1}{2}]$, $\epsilon \in [0,1-2\delta ]$; set ${\delta }_n=2^{-n^{\delta }}$ and let ${\kappa }_{\delta ,\epsilon }>0$ be the constant identified by Proposition 3. Consider a vanishing entropy rate source $q_{X^{1:n}{Y}^{1:n}}$, as per (6) with ${\alpha }_n=\omega \left(\frac{1}{n^{{\kappa }_{\delta ,\epsilon }\epsilon }}\right)\cap o\left(1\right)$. For $X^{1:n}$ polarized as $U^{1:n}=X^{1:n}{G}^{\otimes \nu }$, let $U^{1:n}\left[{\mathcal{V}}_{X|Y}\left({\delta }_n\right)\right]$ denote the very high entropy bits of $U^{1:n}$. Denote by $q_{U^{1:n}\left[{\mathcal{V}}_{X|Y}\left({\delta }_n\right)\right]Y^{1:n}}$ the joint distribution between $U^{1:n}\left[{\mathcal{V}}_{X|Y}\left({\delta }_n\right)\right]$ and $Y^{1:n}$, and denote by $q_U$ the uniform distribution over $〚1,2^{\left|{\mathcal{V}}_{X|Y}\right|}〛$. Then, $\mathbb{V}(q_{U^{1:n}\left[{\mathcal{V}}_{X|Y}\left({\delta }_n\right)\right]Y^{1:n}},q_U{q}_{Y^{1:n}})=O\left(\sqrt{n{\delta }_n}\right)$.

Proof. 

See the proof of Lemma 4 in [11], using Proposition 3 instead of the standard polarization result. ☐

4. Polar Codes for Covert Communication

In this section, we describe our proposed polar-code based scheme for covert communication. After preliminaries regarding covert processes in Section 4.1, the algorithms used for encoding and decoding are described in Section 4.2, and their performance is analyzed in Section 4.3, Section 4.4 and Section 4.5.

4.1. Covert Process

Our code construction follows the idea put forward in [3,6], which suggests to have the code induce a “covert process” at the output of the adversary’s channel by leveraging the notion of channel resolvability [8], and to show that the covert process is itself indistinguishable from the product distribution $Q_0$.

Formally, consider any sequence of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in \mathbb{D}}$ such that ${\alpha }_n\in \omega \left(\frac{1}{\sqrt{n}}\right)\cap o\left(1\right)$. For every $n\in \mathbb{D}$, recall the definition of the Bernoulli distribution ${\Pi }_{{\alpha }_n}$ over $\{0,1\}$ as ${\Pi }_{{\alpha }_n}\left(1\right)=1-{\Pi }_{{\alpha }_n}\left(0\right)={\alpha }_n$, and its associated product distribution ${\Pi }_{{\alpha }_n}^{\otimes n}$; this distribution induces the mixture $Q_{{\alpha }_n}={\alpha }_n{Q}_1+(1-{\alpha }_n)Q_0$ at the output of the channel $(\mathcal{X},W_{Z|X},\mathcal{Z})$, for which we also define the product distribution

$$Q_{{\alpha }_n}^{\otimes n}\left(\mathbf{z}\right)=\prod _{i=1}^n{Q}_{{\alpha }_n}\left(z_i\right).$$

(13)

The “covert process” is the distribution $Q_{{\alpha }_n}^N\left(\mathbf{z}\right)={\mathbb{E}}_T\left(Q_{{\alpha }_n,T}^N\left(\mathbf{z}\right)\right)$ where

$$\begin{array}{c}\hfill Q_{{\alpha }_n,t}^N\left(\mathbf{z}\right)=\prod _{k=1}^{t-1}{Q}_0\left(z_k\right)\prod _{k=t}^{t+n-1}{Q}_{{\alpha }_n}\left(z_k\right)\prod _{k=t+n}^N{Q}_0\left(z_k\right)\end{array}$$

(14)

In other words, $Q_{{\alpha }_n}^N$ is the distribution at the output of the channel $(\mathcal{X},W_{Z|X},\mathcal{Z})$ obtained when randomizing the start index $T\in 〚1,N^{\prime }〛$ of a block of n consecutive bits sampled according to ${\Pi }_{{\alpha }_n}$. The name “covert process” is justified by the following lemma, which provides the scaling of the parameters ${\alpha }_n$ and N such that the distribution $Q_{{\alpha }_n}^N$ becomes asymptotically indistinguishable from the distribution $Q_0^{\otimes N}$.

Lemma 3.

(adapted from Lemma 1 and Equation (25) in [6]). Consider sequences of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in {\mathbb{N}}^{*}}$, ${\left\{{\beta }_n\right\}}_{n\in {\mathbb{N}}^{*}}$ such that ${\alpha }_n\in \omega \left(\frac{1}{\sqrt{n}}\right)\cap o\left(1\right)$, ${\beta }_n=o\left(1\right)$ as n goes to infinity. Let $N=\frac{2^{n{\alpha }_n^2}}{{\beta }_n{\alpha }_n^2}$. Then,

$$\mathbb{D}\left(Q_{{\alpha }_n}^N\parallel Q_0^{\otimes N}\right)\le O\left({\beta }_n\right).$$

(15)

4.2. Encoding and Decoding Algorithms

Let $n\in \mathbb{D}$ be the length of the codeword window. We propose a scheme that operates over $b_n$ transmission windows of length N, where $b_n$ will be specified later. In every transmission window $i\in 〚1,b_n〛$:

• Transmitter and receiver use a secret key $S_i^{″}$ of $\log N$ bits to determine the position of the codeword window within the transmission window. Note that this secret key is not required in the random coding proof of [6], but is required here to maintain a low complexity at the decoder; fortunately, this change has negligible effect on the scaling of the key.
• The content of each codeword window is obtained through a polar-code based scheme that ensures reliable decoding to the receiver and approximates the process $Q_{{\alpha }_n}^{\otimes n}$ at the adversary’s output, which we describe next.

In the remainder of this section we fix $\delta \in \left]0,\frac{1}{2}\right[$, $\epsilon \in ]0,1-2\delta [$, ${\delta }_n\triangleq 2^{-n^{\delta }}$. We let $\kappa \triangleq {\kappa }_{\delta ,\epsilon }\epsilon$ and $A\triangleq A_{\delta ,\epsilon }$, where ${\kappa }_{\delta ,\epsilon }$ and $A_{\delta ,\epsilon }$ are the constants identified by Proposition 3. We consider sequences of positive numbers ${\left\{{\alpha }_n\right\}}_{n\in \mathbb{D}}\in \omega \left(\frac{1}{n^{\kappa }}\right)\cap o\left(1\right)$, ${\left\{{\beta }_n\right\}}_{n\in \mathbb{D}}\in \omega \left(2^{-\frac{n{\alpha }_n}{\log n}}\right)\cap o\left(\frac{1}{\log n}\right)$, a sequence of integers ${\left\{b_n\right\}}_{n\in \mathbb{D}}\in \omega \left(\log n\right)\cap o\left(\frac{1}{{\beta }_n}\right)\cap o\left(n\right)$, and we set $N=\frac{2^{n{\alpha }_n^2}}{{\beta }_n{\alpha }_n^2}$. Finally, we consider a vanishing entropy rate source $q_{X^{1:n}{Y}^{1:n}{Z}^{1:n}}\sim {\Pi }_{{\alpha }_n}^{\otimes n}{W}_{Y|X}^{\otimes n}{W}_{Z|X}^{\otimes n}$ (the marginal $q_{Z^{1:n}}^{\otimes n}$ is $Q_{{\alpha }_n}^{\otimes n}$) and we define the sets

$$\begin{array}{cc}\hfill {\mathcal{V}}_X\left({\delta }_n\right)& \triangleq \{j\in 〚1,n〛:H\left(U_j\right|U^{1:j-1})>1-{\delta }_n\}\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill {\mathcal{H}}_{X|Y}\left({\delta }_n\right)& \triangleq \{j\in 〚1,n〛:H\left(U_j\right|U^{1:j-1}{Y}^{1:n})>{\delta }_n\}\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill {\mathcal{V}}_{X|Z}\left({\delta }_n\right)& \triangleq \{j\in 〚1,n〛:H\left(U_j\right|U^{1:j-1}{Z}^{1:n})>1-{\delta }_n\},\hfill \end{array}$$

(18)

where all entropies should be computed based on $q_{X^{1:n}{Y}^{1:n}{Z}^{1:n}}$. To alleviate the notation, we drop the dependence on ${\delta }_n$ in the sets from now on, and write for instance ${\mathcal{V}}_X$ in place of ${\mathcal{V}}_X\left({\delta }_n\right)$. We also write $H\left(X\right)$ and $H\left(X\right|Y)$ although these quantities should be understood for the independent and identically distributed (i.i.d.) random variables obtained as marginals of $q_{X^{1:n}{Y}^{1:n}{Z}^{1:n}}$. As illustrated in Figure 3a, the construction is based on the following sets:

• ${\mathcal{V}}_C\triangleq {\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}$, which will contain uniformly distributed bits C representing the code;
• ${\mathcal{V}}_{C^{\prime }}\triangleq {\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_X^c$, which will contain non-uniformly distributed bits $C^{\prime }$ computed from the other bits;
• ${\mathcal{V}}_{W^{\prime }}$, the largest subset of ${\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_{X|Z}$ such that $\left|{\mathcal{V}}_{W^{\prime }}\right|\le \left|{\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X\right|$, which will contain uniformly distributed messages $W^{\prime }$;
• ${\mathcal{V}}_W\triangleq \left({\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_X\right)⧹{\mathcal{V}}_{W^{\prime }}$, which will contain additional uniformly distributed messages W;
• ${\mathcal{V}}_{S^{\prime }}$, any subset of ${\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X$ such that $\left|{\mathcal{V}}_{S^{\prime }}\right|=\left|{\mathcal{V}}_{W^{\prime }}\right|$, which will use messages $W^{\prime }$ transmitted in the previous transmission window as a key;
• ${\mathcal{V}}_S=\left({\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X\right)⧹{\mathcal{V}}_{S^{\prime }}$, which will contain uniformly distributed secret key symbols S.

Alice’s encoder is formally provided in Algorithm 1 while Bob’s decoder is provided in Algorithm 2, but the chaining of the transmission windows over $b_n$ blocks is illustrated in Figure 3b and we discuss here the salient features of the algorithms. In every block $i\in 〚1,b_n〛$, a message $W_i$ is transmitted with the assistance of a secret key $S_i$ as expected from the model of Section 2.2. In addition, the chaining exploits the property that the bits in ${\mathcal{V}}_{W^{\prime }}$ are held secret from Willie and can therefore be used as a secret key in the next block, which is formally proved in Section 4.5; this chaining allows us to transmit an additional message $W_i^{\prime }$ in every block, which is crucial to achieve the scalings of Proposition 2 as shown in Section 4.3. The chaining also relies on the secrecy of the bits in ${\mathcal{V}}_C$, which allows us to reuse the same random bits C across all blocks. Finally, some bits of shared randomness $C_i^{\prime }$ must be transmitted secretly, covertly, and reliably to the receiver. As we show in Section 4.3, the number of such bits is negligible compared to the number of covert bits transmitted; we therefore ensure their secrecy by performing a one time pad $C_i^{\prime }\oplus S_i^{\prime }$ with another secret key $S_i^{\prime }$, and we ensure reliability and covertness in a single additional block at the end, e.g., using the somewhat inefficient scheme of [1]. In the remainder, we will ignore this last block for simplicity and assume that $C_i^{\prime }\oplus S_i^{\prime }$ is made available to the decoder “for free”.

Ultimately, the messages transmitted consist of the messages $W_i$ and $W_i^{\prime }$ transmitted in every block i; the keys required consist of the keys $S_i$, $S_i^{\prime }$, $S_i^{″}$ used in every block i, as well as the bits C.

Remark 1.

The proposed chaining scheme could be further modified as follows. First, since the bits of C are secret from the perspective of Willie, they could be publicly disclosed and not counted as part of the secret keys, without compromising the performance. We have opted to count C as part of the key to make the analysis slightly more concise. Second, the bits of $C_i^{\prime }\oplus S_i^{\prime }$ could be chained by sacrificing part of the message $W_i$; since their amount is negligible, this would again not affect performance. We have opted to avoid this chaining since a last transmission for the bits $C_{b_n}^{\prime }\oplus S_{b_n}^{\prime }$ would be necessary anyway.

Remark 2.

Because of the stochastic encoding in Algorithm 1, our codes are neither linear codes nor cosets of linear codes. In that regard, calling our codes “polar codes” is a slight abuse of terminology but follows standard practice [11,18,20]. Strictly speaking, our codes are only “polarization-based”.

4.3. Analysis of Normalized Set Sizes

We start by analyzing the normalized set sizes of the proposed scheme. Specifically, we are interested in characterizing the asymptotic total number of message bits $\log M_n$ and total number of key bits $\log K_n$, normalized by $n{b}_n{\alpha }_n$.

Over $b_n$ transmission windows, the total number of message bits consists of those in ${\mathcal{V}}_W$ and ${\mathcal{V}}_{W^{\prime }}$ in every transmission window. Hence, for every $n\in \mathbb{D}$, $\log M_n=b_n\left|{\mathcal{V}}_W\right|+b_n\left|{\mathcal{V}}_{W^{\prime }}\right|$. Similarly, the total number of key bits consists of those in ${\mathcal{V}}_S$ (except for the first block which requires ${\mathcal{V}}_S+{\mathcal{V}}_{S^{\prime }}$), the bits for the one time pad in ${\mathcal{V}}_{C^{\prime }}$, the bits required to identify the codeword window within the transmission window, and the bits in ${\mathcal{V}}_C$, so that $\log K_n=b_n\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}\right|+b_n\left|{\mathcal{V}}_{C^{\prime }}\right|+b_n\log N+\left|{\mathcal{V}}_C\right|$.

Lemma 4.

$$\begin{array}{c}\hfill \underset{n\in \mathbb{D}\to \infty }{\lim }\frac{\log M_n}{n{b}_n{\alpha }_n}=\mathbb{D}\left(P_1\parallel P_0\right).\end{array}$$

Proof. 

By definition,

$$\begin{array}{c}\hfill \frac{\log M_n}{n{b}_n{\alpha }_n}=\frac{\left(\left|{\mathcal{V}}_W\right|+\left|{\mathcal{V}}_{W^{\prime }}\right|\right)}{n{\alpha }_n}=\frac{\left|{\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_X\right|}{n{\alpha }_n}.\end{array}$$

Introducing ${\mathcal{H}}_{X|Y}^c\subset {\mathcal{V}}_{X|Y}^c$, we obtain

$$\left|{\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_X^{}\right|=\left|{\mathcal{V}}_{X|Y}^c\cap {\mathcal{V}}_X^{}\right|-\left|{\mathcal{H}}_{X|Y}^{}\cap {\mathcal{V}}_{X|Y}^c\cap {\mathcal{V}}_X^{}\right|$$

(19)

Since, ${\mathcal{V}}_{X|Y}^{}\subset {\mathcal{V}}_X^{}$, we have $|{\mathcal{V}}_{X|Y}^c\cap {\mathcal{V}}_X^{}|=|{\mathcal{V}}_X^{}|-|{\mathcal{V}}_{X|Y}^{}|$ and, in addition, $0\le |{\mathcal{H}}_{X|Y}^{}\cap {\mathcal{V}}_{X|Y}^c\cap {\mathcal{V}}_X^{}|\le |{\mathcal{H}}_{X|Y}^{}\cap {\mathcal{V}}_{X|Y}^c|$. Using Proposition 3 to bound $|{\mathcal{V}}_X^{}|$, $|{\mathcal{V}}_{X|Y}^{}|$, and $|{\mathcal{H}}_{X|Y}^{}\cap {\mathcal{V}}_{X|Y}^c|$, we obtain

$$\begin{array}{cc}\hfill \frac{\log M_n}{n{b}_n{\alpha }_n}& \ge \frac{H\left(X\right)-H\left(X|Y\right)}{{\alpha }_n}-\frac{{\delta }_n}{{\alpha }_n}-2\frac{A}{n^{\kappa }{\alpha }_n}.\hfill \end{array}$$

(20)

Since $H\left(X\right)-H\left(X|Y\right)=I\left(X;Y\right)={\alpha }_n\mathbb{D}\left(P_1\parallel P_0\right)+o\left({\alpha }_n\right)$ (Lemma 1, [3]), and remembering the choice of ${\alpha }_n$, ${\delta }_n$ earlier, we obtain the desired result (note that we use ${\alpha }_n\in \omega \left(\frac{1}{n^{\kappa }}\right)\cap o\left(1\right)$ here). ☐

Lemma 5.

$$\begin{array}{c}\hfill \underset{n\in \mathbb{D}\to \infty }{\lim }\frac{\log K_n}{n{b}_n{\alpha }_n}={[\mathbb{D}\left(Q_1\parallel Q_0\right)-\mathbb{D}\left(P_1\parallel P_0\right)]}^{+}.\end{array}$$

Proof. 

We first assume that $\left|{\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_{X|Z}\right|\le \left|{\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X\right|$. By definition,

$$\begin{array}{cc}\hfill \frac{\log M_n+\log K_n}{n{b}_n{\alpha }_n}& =\frac{b_n\left|{\mathcal{V}}_W^{}\right|+b_n\left|{\mathcal{V}}_S^{}\right|+(b_n+1)\left|{\mathcal{V}}_{S^{\prime }}^{}\right|+b_n\left|{\mathcal{V}}_{C^{\prime }}\right|+b_n\log N+\left|{\mathcal{V}}_C\right|}{n{b}_n{\alpha }_n}\hfill \\ & =\frac{\left|{\mathcal{V}}_W^{}\right|+\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}^{}\right|+\left|{\mathcal{V}}_{C^{\prime }}^{}\right|}{n{\alpha }_n}+\frac{\left|{\mathcal{V}}_{S^{\prime }}^{}\right|+\left|{\mathcal{V}}_C^{}\right|}{n{b}_n{\alpha }_n}+\frac{\log N}{n{\alpha }_n}.\hfill \end{array}$$

We analyze the terms on the right hand side in order. First, since ${\mathcal{V}}_{X|Z}\subset {\mathcal{V}}_X$, we have $\left|{\mathcal{V}}_W^{}\right|+\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}^{}\right|=\left|{\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X\right|=\left|{\mathcal{V}}_X^{}\right|-\left|{\mathcal{V}}_{X|Z}^{}\right|$, and by Proposition 3 applied to the vanishing entropy rate sources $q_{X^{1:n}}$ and $q_{X^{1:n}{Z}^{1:n}}$

$$\begin{array}{cc}\hfill \frac{\left|{\mathcal{V}}_W^{}\right|+\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}^{}\right|}{n{\alpha }_n}& \ge \frac{H\left(X\right)-H\left(X\right|Z)}{{\alpha }_n}-\frac{{\delta }_n}{{\alpha }_n}-\frac{A}{n^{\kappa }{\alpha }_n}.\hfill \end{array}$$

(21)

Since $H\left(X\right)-H\left(X|Z\right)=I\left(X;Z\right)={\alpha }_n\mathbb{D}\left(Q_1\parallel Q_0\right)+o\left({\alpha }_n\right)$ (Lemma 1, [3]) and remembering the choice of ${\alpha }_n$, ${\delta }_n$ earlier, it follows that $\frac{\left|{\mathcal{V}}_W^{}\right|+\left|{\mathcal{V}}_S\right|+\left|{\mathcal{V}}_{S^{\prime }}^{}\right|}{n{\alpha }_n}=\mathbb{D}\left(Q_1\parallel Q_0\right)+o\left(1\right)$. This also implies that $\frac{\left|{\mathcal{V}}_{S^{\prime }}^{}\right|}{n{b}_n{\alpha }_n}=o\left(1\right)$. Next, since ${\mathcal{V}}_X^c\subset {\mathcal{V}}_{X|Y}^c$, we have with Proposition 3 that

$$\begin{array}{c}\hfill \frac{\left|{\mathcal{V}}_{C^{\prime }}\right|}{n{\alpha }_n}\le \frac{\left|{\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Y}^c\right|}{n{\alpha }_n}\le \frac{A}{n^{\kappa }{\alpha }_n},\end{array}$$

(22)

which vanishes by definition of ${\alpha }_n$. Similarly, since ${\mathcal{V}}_C\subset {\mathcal{H}}_X$, Proposition 3 applied to the vanishing entropy rate source $q_{Z^{1:n}}$ ensures that

$$\begin{array}{c}\hfill \frac{\left|{\mathcal{V}}_C\right|}{n{b}_n{\alpha }_n}\le \frac{H\left(X^{1:n}\right)}{n{b}_n{\alpha }_n}+\frac{A}{n^{\kappa }{b}_n{\alpha }_n}=-\frac{\log {\alpha }_n}{b_n}-\frac{(1-{\alpha }_n)\log (1-{\alpha }_n)}{b_n{\alpha }_n}+\frac{A}{n^{\kappa }{b}_n{\alpha }_n},\end{array}$$

(23)

which vanishes with our choice of ${\alpha }_n$ and $b_n$ (note that we use the condition $b_n=\omega \left(\log n\right)$ here). Finally, since $N=\frac{2^{n{\alpha }_n^2}}{{\beta }_n{\alpha }_n^2}$, we have

$$\begin{array}{c}\hfill \frac{\log N}{n{\alpha }_n}={\alpha }_n-\frac{\log {\beta }_n}{n{\alpha }_n}-\frac{2\log {\alpha }_n}{n{\alpha }_n},\end{array}$$

(24)

which vanishes with the choice of ${\alpha }_n$, ${\beta }_n$ (note that we use the condition ${\beta }_n\in \omega \left(2^{-\frac{n{\alpha }_n}{\log n}}\right)$ here).

We finally assume that $\left|{\mathcal{H}}_{X|Y}^c\cap {\mathcal{V}}_{X|Z}\right|>\left|{\mathcal{H}}_{X|Y}\cap {\mathcal{V}}_{X|Z}^c\cap {\mathcal{V}}_X\right|$, which is equivalent to assuming that $\left|{\mathcal{V}}_X\cap {\mathcal{H}}_{X|Y}^c\right|>\left|{\mathcal{V}}_X\cap {\mathcal{V}}_{X|Z}^c\right|$. With Proposition 3 and Lemma 1 of [3], this implies that $\mathbb{D}\left(P_1\parallel P_0\right)>\mathbb{D}\left(Q_1\parallel Q_0\right)+o\left(1\right)$. Since we have ${\mathcal{V}}_S=\varnothing$ in this case, following the same steps as earlier we now obtain ${\lim }_{n\in \mathbb{D}\to \infty }\frac{\log K_n}{n{b}_n{\alpha }_n}=0$, which is the desired result. ☐

4.4. Reliability Analysis

In this section, we prove that the proposed scheme ensures reliable communication. To avoid any confusion between the distribution induced by the algorithms and the underlying vanishing entropy rate source, we denote the distribution induced by Algorithm 1 by $\tilde{p}$; accordingly, all random variables generated according to this distribution have a tilde, e.g., $\tilde{X}$ has distribution ${\tilde{p}}_X$. The estimates obtained from Algorithm 2 are denoted with a hat, e.g., $\widehat{X}$. Since the location of the transmission window is known to the legitimate receiver, it is sufficient to show that ${\lim }_{n\to \infty }\mathbb{P}\left[{\widehat{X}}_{1:b_n}^{1:n}\ne {\tilde{X}}_{1:b_n}^{1:n}\right]=0$. We proceed to prove this with a series of lemmas.

Lemma 6.

For any transmission window $i\in 〚1,b_n〛$

$$\mathbb{D}\left(q_{X^{1:n}{Y}^{1:n}}∥{\tilde{p}}_{X_i^{1:n}{Y}_i^{1:n}}\right)=\mathbb{D}\left(q_{X^{1:n}}∥{\tilde{p}}_{X_i^{1:n}}\right)\le {\delta }_n^{\left(1\right)}$$

(25)

where ${\delta }_n^{\left(1\right)}\triangleq n{\delta }_n$.

Proof. 

We have

$$\begin{array}{cc}\hfill \mathbb{D}\left(q_{X^{1:n}{Y}^{1:n}}∥{\tilde{p}}_{X_i^{1:n}{Y}_i^{1:n}}\right)& =\mathbb{D}\left(q_{X^{1:n}}∥{\tilde{p}}_{X_i^{1:n}}\right)+{\mathbb{E}}_{q_{X^{1:n}}}\left[\mathbb{D}\left(q_{Y^{1:n}|X^{1:n}}∥{\tilde{p}}_{Y_i^{1:n}|X_i^{1:n}}\right)\right]\hfill \end{array}$$

(26)

$$\begin{array}{cc}& =\mathbb{D}\left(q_{X^{1:n}}∥{\tilde{p}}_{X_i^{1:n}}\right)\hfill \end{array}$$

(27)

$$\begin{array}{cc}& =\mathbb{D}\left(q_{U^{1:n}}∥{\tilde{p}}_{U_i^{1:n}}\right)\hfill \end{array}$$

(28)

$$\begin{array}{cc}& =\sum _{j=1}^n{\mathbb{E}}_{q_{U^{1:j-1}}}\left[\mathbb{D}\left(q_{U^j|U^{1:j-1}}∥{\tilde{p}}_{U_i^j|U_i^{1:j-1}}\right)\right]\hfill \end{array}$$

(29)

$$\begin{array}{cc}& =\sum _{j\in {\mathcal{V}}_X}{\mathbb{E}}_{q_{U^{1:j-1}}}\left[\mathbb{D}\left(q_{U^j|U^{1:j-1}}∥{\tilde{p}}_{U_i^j|U_i^{1:j-1}}\right)\right]\hfill \end{array}$$

(30)

$$\begin{array}{cc}& =\sum _{j\in {\mathcal{V}}_X}\left(1-H\left(U^j|U^{1:j-1}\right)\right)\hfill \end{array}$$

(31)

$$\begin{array}{cc}& \le \left|{\mathcal{V}}_X\right|{\delta }_n\hfill \end{array}$$

(32)

$$\begin{array}{cc}& \le n{\delta }_n\hfill \end{array}$$

(33)

where (26) comes from the chain rule of divergence, (27) comes from

$${\mathbb{E}}_{q_{X^{1:n}}}\left[\mathbb{D}\left(q_{Y^{1:n}|X^{1:n}}∥{\tilde{p}}_{Y_i^{1:n}|X_i^{1:n}}\right)\right]={\mathbb{E}}_{q_{X^{1:n}}}\left[\mathbb{D}\left(W_{Y|X}^{\otimes n}∥W_{Y|X}^{\otimes n}\right)\right]=0$$

(34)

Equation (28) comes from the invertibility of $X^{1:n}=U^{1:n}{G}^{\otimes \nu }$ and ${\tilde{X}}^{1:n}={\tilde{U}}^{1:n}{G}^{\otimes \nu }$, (29) comes from the chain rule of divergence, (30) comes from the definition of the encoder for $j\in {\mathcal{V}}_X^c$ in (4), (31) comes from the uniformity of the symbols in ${\mathcal{V}}_X$, (32) comes from the definition of ${\mathcal{V}}_X$. ☐

Lemma 7.

For any transmission window $i\in 〚1,b_n〛$, define the event

$${\mathcal{E}}_i\triangleq \left\{{\widehat{X}}_i^{1:n}\ne {\tilde{X}}_i^{1:n}\right\}$$

(35)

Then,

$$\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_{i-1}^c\right]=\mathbb{P}\left[{\widehat{X}}_i^{1:n}\ne {\tilde{X}}_i^{1:n}|{\widehat{X}}_{i-1}^{1:n}={\tilde{X}}_{i-1}^{1:n}\right]\le {\delta }_n^{\left(2\right)}$$

(36)

where ${\delta }_n^{\left(2\right)}=O\left(n^{1/2}{\delta }_n^{1/2}\right)$.

Proof. 

For $i\in 〚1,b_n〛$, define the event that the sequence produced by the polar encoder differs from the actual one:

$${\mathcal{E}}_i^{\left(XY\right)}\triangleq \left\{\left({\tilde{X}}_i^{1:n},{\tilde{Y}}_i^{1:n}\right)\ne \left(X^{1:n},Y^{1:n}\right)\right\}$$

(37)

and define an optimal coupling such that

$$\mathbb{P}\left[{\mathcal{E}}_i^{\left(XY\right)}\right]=\mathbb{V}\left(q_{X^{1:n}{Y}^{1:n}},{\tilde{p}}_{X_i^{1:n}{Y}_i^{1:n}}\right)\le \sqrt{\mathbb{D}\left(q_{X^{1:n}{Y}^{1:n}}∥{\tilde{p}}_{X_i^{1:n}{Y}_i^{1:n}}\right)}\le \sqrt{{\delta }_n^{\left(1\right)}}$$

(38)

by Pinsker’s inequality and Lemma 6. Then, we have

$$\begin{array}{cc}\hfill \mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_{i-1}^c\right]& =\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_i^{\left(XY\right)c}\cap {\mathcal{E}}_{i-1}^c\right]\mathbb{P}\left[{\mathcal{E}}_i^{\left(XY\right)c}\right]+\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_i^{\left(XY\right)}\cap {\mathcal{E}}_{i-1}^c\right]\mathbb{P}\left[{\mathcal{E}}_i^{\left(XY\right)}\right]\hfill \end{array}$$

(39)

$$\begin{array}{c}\le \mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_i^{\left(XY\right)c}\cap {\mathcal{E}}_{i-1}^c\right]+\mathbb{P}\left[{\mathcal{E}}_i^{\left(XY\right)}\right]\hfill \end{array}$$

(40)

$$\begin{array}{c}\le O\left(n{\delta }_n\right)+\sqrt{{\delta }_n^{\left(1\right)}}\hfill \end{array}$$

(41)

where (39) comes from the law of total probabilities, (40) from $\mathbb{P}\left[{\mathcal{E}}_i^{\left(XY\right)c}\right]\le 1$, $\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_i^{\left(XY\right)}\cap {\mathcal{E}}_{i-1}^c\right]\le 1$, and (41) from Lemma 1 and the optimal coupling. ☐

Lemma 8.

We have

$$\mathbb{P}\left[{\widehat{X}}_{1:b_n}^{1:n}\ne {\tilde{X}}_{1:b_n}^{1:n}\right]\le {\delta }_n^{\left(3\right)}$$

(42)

where ${\delta }_n^{\left(3\right)}=O\left(b_n{n}^{1/2}{\delta }_n^{1/2}\right)$.

Proof. 

We have the following partition

$$\bigcup _{i=1}^{b_n}{\mathcal{E}}_i=\bigcup _{i=1}^{b_n}\left({\mathcal{E}}_i\cap {\left(\bigcup _{j=1}^{i-1}{\mathcal{E}}_j\right)}^c\right).$$

(43)

Thus,

$$\begin{array}{cc}\hfill \mathbb{P}\left[{\widehat{X}}_{1:b_n}^{1:n}\ne {\tilde{X}}_{1:b_n}^{1:n}\right]=\mathbb{P}\left[\bigcup _{i=1}^{b_n}{\mathcal{E}}_i\right]& =\mathbb{P}\left[\bigcup _{i=1}^{b_n}{\mathcal{E}}_i\cap {\left(\bigcup _{j=1}^{i-1}{\mathcal{E}}_j\right)}^c\right]\hfill \end{array}$$

(44)

$$\begin{array}{c}=\sum _{i=1}^{b_n}\mathbb{P}\left[{\mathcal{E}}_i\cap {\left(\bigcup _{j=1}^{i-1}{\mathcal{E}}_j\right)}^c\right]\hfill \end{array}$$

(45)

$$\begin{array}{c}\le \sum _{i=1}^{b_n}\mathbb{P}\left[{\mathcal{E}}_i\cap {\mathcal{E}}_{i-1}^c\right]\hfill \end{array}$$

(46)

$$\begin{array}{c}=\sum _{i=1}^{b_n}\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_{i-1}^c\right]\mathbb{P}\left[{\mathcal{E}}_{i-1}^c\right]\hfill \end{array}$$

(47)

$$\begin{array}{c}\le \sum _{i=1}^{b_n}\mathbb{P}\left[{\mathcal{E}}_i|{\mathcal{E}}_{i-1}^c\right]\hfill \end{array}$$

(48)

$$\begin{array}{c}\le O\left(b_{n}n{\delta }_n\right)+b_n\sqrt{{\delta }_n^{\left(1\right)}}\hfill \end{array}$$

(49)

where (45) comes from the probability of the partition, (46) from ${\mathcal{E}}_{i-1}\subseteq {\displaystyle \bigcup _{j=1}^{i-1}}{\mathcal{E}}_j$, (47) from the definition of conditional probability, (48) from $\mathbb{P}\left[{\mathcal{E}}_{i-1}^c\right]\le 1$, and (49) from Lemma 7. The choice $b_n=o\left(n\right)$ ensures that $\mathbb{P}\left[{\widehat{X}}_{1:b_n}^{1:n}\ne {\tilde{X}}_{1:b_n}^{1:n}\right]$ vanishes. ☐

4.5. Covertness Analysis

In this section, we prove that the proposed scheme is covert in the sense that ${\lim }_{n\in \mathbb{D}\to \infty }\mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}}∥q_{Z_{1:b_n}^{1:n}}\right)=0$, where $q_{Z_{1:b_n}^{1:n}}({\mathbf{z}}_1,\dots ,{\mathbf{z}}_{b_n})\triangleq {\prod }_{i=1}^{b_n}{Q}_{{\alpha }_n}^{\otimes n}\left({\mathbf{z}}_i\right)$.

Lemma 9.

For any transmission window $i\in 〚1,b_n〛$

$$\begin{array}{cc}\hfill \mathbb{D}\left(q_{X^{1:n}{Z}^{1:n}}∥{\tilde{p}}_{X_i^{1:n}{Z}_i^{1:n}}\right)& =\mathbb{D}\left(q_{X^{1:n}}∥{\tilde{p}}_{X_i^{1:n}}\right)\le {\delta }_n^{\left(1\right)}\hfill \end{array}$$

(50)

$$\begin{array}{cc}\hfill \mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)& \le \mathbb{V}\left({\tilde{p}}_{X_i^{1:n}{Z}_i^{1:n}},q_{X^{1:n}{Z}^{1:n}}\right)\le {\delta }_n^{\left(4\right)}\hfill \end{array}$$

(51)

where ${\delta }_n^{\left(1\right)}\triangleq n{\delta }_n$ and ${\delta }_n^{\left(4\right)}=\sqrt{n{\delta }_n}$.

Proof. 

The proof of the divergence inequality is identical to Lemma 6. The proof of the total variation distance inequality follows from

$$\begin{array}{cc}\hfill \mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)& \le \mathbb{V}\left({\tilde{p}}_{X_i^{1:n}{Z}_i^{1:n}},q_{X^{1:n}{Z}^{1:n}}\right)\hfill \end{array}$$

(52)

$$\begin{array}{c}\le \sqrt{\mathbb{D}\left(q_{X^{1:n}{Z}^{1:n}}∥{\tilde{p}}_{X_i^{1:n}{Z}_i^{1:n}}\right)}\hfill \end{array}$$

(53)

$$\begin{array}{c}\le \sqrt{{\delta }_n^{\left(1\right)}}=\sqrt{n{\delta }_n}\hfill \end{array}$$

(54)

where (52) comes from the total variation of marginal distributions, (53) from Pinsker’s inequality, and (54) from the previous inequality. ☐

Lemma 10.

For $i\in 〚1,b_n〛$,

$$\begin{array}{c}\hfill I\left({\tilde{Z}}_i^{1:n};C{W}_i^{\prime }\right)\le {\delta }_n^{\left(5\right)}\end{array}$$

(55)

where ${\delta }_n^{\left(5\right)}=n{\delta }_n+2{\delta }_n^{\left(4\right)}\left[n(1+2\log |\mathcal{Z}\left|\right)-2\log 2{\delta }_n^{\left(4\right)}\right]$.

Proof. 

Let $i\in 〚2,b_n〛$.

$$\begin{array}{c}H\left(\left.U^{1:n}\left[{\mathcal{V}}_{X|Z}\right]\right|Z^{1:n}\right)-H\left(\left.{\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right]\right|{\tilde{Z}}_i^{1:n}\right)\hfill \end{array}$$

(56)

$$\begin{array}{c}=H\left(U^{1:n}\left[{\mathcal{V}}_{X|Z}\right],Z^{1:n}\right)-H\left({\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right],{\tilde{Z}}_i^{1:n}\right)+H\left({\tilde{Z}}_i^{1:n}\right)-H\left(Z^{1:n}\right)\hfill \end{array}$$

(57)

$$\begin{array}{c}\le 2\mathbb{V}\left({\tilde{p}}_{U_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right],Z_i^{1:n}},q_{U^{1:n}\left[{\mathcal{V}}_{X|Z}\right],Z^{1:n}}\right)\left[n\log \left(\left|\mathcal{X}\right|\left|\mathcal{Z}\right|\right)-\log 2\mathbb{V}\left({\tilde{p}}_{U_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right],Z_i^{1:n}},q_{U^{1:n}\left[{\mathcal{V}}_{X|Z}\right],Z^{1:n}}\right)\right]\hfill \end{array}$$

(58)

$$\begin{array}{c}+2\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)\left[n\log \left|\mathcal{Z}\right|-\log 2\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)\right]\hfill \end{array}$$

(59)

$$\begin{array}{c}\le 2\mathbb{V}\left({\tilde{p}}_{X_i^{1:n}{Z}_i^{1:n}},q_{X^{1:n}{Z}^{1:n}}\right)\left[n\log \left(\left|\mathcal{X}\right|\left|\mathcal{Z}\right|\right)-\log 2\mathbb{V}\left({\tilde{p}}_{X_i^{1:n},Z_i^{1:n}},q_{X^{1:n},Z^{1:n}}\right)\right]\hfill \end{array}$$

(60)

$$\begin{array}{c}+2\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)\left[n\log \left|\mathcal{Z}\right|-\log 2\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)\right]\hfill \end{array}$$

(61)

$$\begin{array}{c}\le 2{\delta }_n^{\left(4\right)}\left[n\log \left(\left|\mathcal{X}\right|\left|\mathcal{Z}\right|\right)-\log 2{\delta }_n^{\left(4\right)}\right]+2{\delta }_n^{\left(4\right)}\left[n\log \left|\mathcal{Z}\right|-\log 2{\delta }_n^{\left(4\right)}\right]\hfill \end{array}$$

(62)

$$\begin{array}{c}=2{\delta }_n^{\left(4\right)}\left[n(1+2\log |\mathcal{Z}\left|\right)-2\log 2{\delta }_n^{\left(4\right)}\right]\hfill \end{array}$$

(63)

$$\begin{array}{c}\triangleq {\delta }_n^{\left(XZ\right)}\hfill \end{array}$$

(64)

where (57) comes from the chain rule of entropy, (58) and (59) from Lemma 2.7 of [21] with n large enough, (60) and (61) from the total variation of marginal distributions, the invertibility of $X^{1:n}=U^{1:n}{G}^{\otimes \nu }$ and ${\tilde{X}}^{1:n}={\tilde{U}}^{1:n}{G}^{\otimes \nu }$ and that the function $x\mapsto x(1-\log x)$ is monotonically increasing, and (62) from Lemma 9. Hence for $i\in 〚2,b_n〛$,

$$\begin{array}{cc}\hfill I\left({\tilde{Z}}_i^{1:n};C{W}_i^{\prime }\right)& \le I\left({\tilde{Z}}_i^{1:n};{\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right]\right)\hfill \end{array}$$

(65)

$$\begin{array}{c}=H\left({\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right]\right)-H\left({\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right]|{\tilde{Z}}_i^{1:n}\right)\hfill \end{array}$$

(66)

$$\begin{array}{c}=|{\mathcal{V}}_{X|Z}|-H\left({\tilde{U}}_i^{1:n}\left[{\mathcal{V}}_{X|Z}\right]|{\tilde{Z}}_i^{1:n}\right)\hfill \end{array}$$

(67)

$$\begin{array}{c}\le |{\mathcal{V}}_{X|Z}|-H\left(U^{1:n}\left[{\mathcal{V}}_{X|Z}\right]|Z^{1:n}\right)+{\delta }_n^{\left(XZ\right)}\hfill \end{array}$$

(68)

$$\begin{array}{c}\le |{\mathcal{V}}_{X|Z}|-\sum _{j\in {\mathcal{V}}_{X|Z}}H\left(U^j\right|U^{1:j-1}{Z}^{1:n})+{\delta }_n^{\left(XZ\right)}\hfill \end{array}$$

(69)

$$\begin{array}{c}\le |{\mathcal{V}}_{X|Z}|-|{\mathcal{V}}_{X|Z}|(1-{\delta }_n)+{\delta }_n^{\left(XZ\right)}\hfill \end{array}$$

(70)

$$\begin{array}{c}\le n{\delta }_n+{\delta }_n^{\left(XZ\right)}\hfill \end{array}$$

(71)

where (66) come the definition of mutual information, (65) and (70) from the definition of the set ${\mathcal{V}}_{X|Z}$, (67) from the uniformity of symbols in ${\mathcal{V}}_{X|Z}$, (68) comes from (64), and (69) from the chain rule of entropy and conditioning. ☐

Lemma 11.

The outputs of all blocks are asymptotically independent in the sense that

$$\mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},\prod _{i=1}^{b_n}{\tilde{p}}_{Z_i^{1:n}}\right)\le b_n\sqrt{{\delta }_n^{\left(5\right)}}.$$

(72)

Proof. 

We have

$$\begin{array}{cc}\hfill \mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},\prod _{i=1}^{b_n}{\tilde{p}}_{Z_i^{1:n}}\right)& \le \sum _{i=1}^{b_n}{\mathbb{E}}_{{\tilde{p}}_{Z_{1:i-1}^{1:n}}}\left[\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}|Z_{1:i-1}^{1:n}},{\tilde{p}}_{Z_i^{1:n}}\right)\right]\hfill \end{array}$$

(73)

$$\begin{array}{c}=\sum _{i=1}^{b_n}\mathbb{V}\left({\tilde{p}}_{Z_{1:i}^{1:n}},{\tilde{p}}_{Z_{1:i-1}^{1:n}}{\tilde{p}}_{Z_i^{1:n}}\right)\hfill \end{array}$$

(74)

$$\begin{array}{c}\le \sum _{i=1}^{b_n}\mathbb{V}\left({\tilde{p}}_{Z_{1:i}^{1:n}C{W}_i^{\prime }},{\tilde{p}}_{Z_{1:i-1}^{1:n}C{W}_i^{\prime }}{\tilde{p}}_{Z_i^{1:n}}\right)\hfill \end{array}$$

(75)

$$\begin{array}{c}\le \sum _{i=1}^{b_n}\sqrt{\mathbb{D}\left({\tilde{p}}_{Z_{1:i}^{1:n}C{W}_i^{\prime }}\parallel {\tilde{p}}_{Z_{1:i-1}^{1:n}C{W}_i^{\prime }}{\tilde{p}}_{Z_i^{1:n}}\right)}.\hfill \end{array}$$

(76)

where (73) follows from the chain rule of total variation. Note that

$$\begin{array}{cc}\hfill \mathbb{D}\left({\tilde{p}}_{Z_{1:i}^{1:n}C{W}_i^{\prime }}\parallel {\tilde{p}}_{Z_{1:i-1}^{1:n}C{W}_i^{\prime }}{\tilde{p}}_{Z_i^{1:n}}\right)& =I\left({\tilde{Z}}_{1:i-1}C{W}_i^{\prime };{\tilde{Z}}_i^{1:n}\right)\hfill \end{array}$$

(77)

$$\begin{array}{c}=I\left(C{W}_i^{\prime };{\tilde{Z}}_i^{1:n}\right)+I\left({\tilde{Z}}_{1:i-1};{\tilde{Z}}_i^{1:n}|C{W}_i^{\prime }\right)\hfill \end{array}$$

(78)

$$\begin{array}{c}=I\left(C{W}_i^{\prime };{\tilde{Z}}_i^{1:n}\right),\hfill \end{array}$$

(79)

where we have used the Markov chain $Z_{1:i-1}^{1:n}-C{W}_i^{\prime }-Z_i^{1:n}$. The result then follows by Lemma 10. ☐

Lemma 12.

We have

$$\mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},q_{Z_{1:b_n}^{1:n}}\right)\le {\delta }_n^{\left(6\right)}$$

(80)

where ${\delta }_n^{\left(6\right)}=b_n(\sqrt{{\delta }_n^{\left(5\right)}}+{\delta }_n^{\left(4\right)})$.

Proof. 

We have

$$\begin{array}{cc}\hfill \mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},q_{Z_{1:b_n}^{1:n}}\right)& =\mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},\prod _{i=1}^{b_n}{q}_{Z^{1:n}}\right)\hfill \end{array}$$

(81)

$$\begin{array}{c}\le \mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},\prod _{i=1}^{b_n}{\tilde{p}}_{Z_i^{1:n}}\right)+\mathbb{V}\left(\prod _{i=1}^{b_n}{\tilde{p}}_{Z_i^{1:n}},\prod _{i=1}^{b_n}{q}_{Z^{1:n}}\right)\hfill \end{array}$$

(82)

$$\begin{array}{c}\le \mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},\prod _{i=1}^{b_n}{\tilde{p}}_{Z_i^{1:n}}\right)+\sum _{i=1}^{b_n}\mathbb{V}\left({\tilde{p}}_{Z_i^{1:n}},q_{Z^{1:n}}\right)\hfill \end{array}$$

(83)

$$\begin{array}{c}\le b_n\sqrt{{\delta }_n^{\left(5\right)}}+b_n{\delta }_n^{\left(4\right)}\hfill \end{array}$$

(84)

where we have used the results of Lemmas 9 and 11. ☐

We finally conclude the proof of covertness as follows. We let ${\left\{T_i\right\}}_{i=1}^{b_n}$ be the independent uniform random variables denoting the choice of the start time in each of the chained $b_n$ transmission windows. Note that the distribution ${\widehat{Q}}^{b_{n}N}$ induced by the code may be written as ${\widehat{Q}}^{b_{n}N}\left(\mathbf{z}\right)={\mathbb{E}}_{T_1,\cdots ,T_{b_n}}\left({\widehat{Q}}_{T_1,\cdots ,T_n}^{b_{n}N}\left(\mathbf{z}\right)\right)$ where for $(t_1,\cdots ,t_{b_n})\in 〚1,N^{\prime }{〛}^{b_n}$

$$\begin{array}{c}\hfill {\widehat{Q}}_{t_1,\cdots ,t_n}^{b_{n}N}\left(\mathbf{z}\right)={\widehat{Q}}^{b_{n}n}\left({\mathbf{z}}_{\mathbf{t}}\right)\prod _{i=1}^{b_n}\left(\prod _{k=1}^{t_i-1}{Q}_0\left(z_{(i-1)N+k}\right)\prod _{k=t_i+n}^N{Q}_0\left(z_{(i-1)N+k}\right)\right)\end{array}$$

(85)

and ${\mathbf{z}}_{\mathbf{t}}$ contains the components ${\left\{z_{(i-1)N+t_i-1+k}\right\}}_{i\in 〚1,b_N〛,k\in 〚1,n〛}$ corresponding to the positions where a code is used in every transmission window. This formulation allows us to isolate the distribution ${\widehat{Q}}^{b_{n}n}\left({\mathbf{z}}_{\mathbf{t}}\right)$, which corresponds to the chained coded blocks of length n. We also define the process $Q_{{\alpha }_n}^{b_{n}N}$ as

$$\begin{array}{c}\hfill Q_{{\alpha }_n}^{b_{n}N}\left(\mathbf{z}\right)\triangleq {\mathbb{E}}_{T_1,\cdots ,T_{b_n}}\left(\prod _{i=1}^{b_n}{Q}_{{\alpha }_n,T_i}^N\left({\mathbf{z}}_i\right)\right)=\prod _{i=1}^{b_n}{\mathbb{E}}_{T_i}\left(Q_{{\alpha }_n,T_i}^N\left({\mathbf{z}}_i\right)\right),\end{array}$$

(86)

where $\mathbf{z}=({\mathbf{z}}_1,\dots ,{\mathbf{z}}_{b_n})$. We then bound $\mathbb{V}\left({\widehat{Q}}^{b_{n}N},Q_0^{\otimes b_{n}N}\right)$ as follows.

$$\begin{array}{cc}\hfill \mathbb{V}\left({\widehat{Q}}^{b_{n}N},Q_0^{\otimes b_{n}N}\right)& \stackrel{\left(a\right)}{\le }\mathbb{V}\left({\widehat{Q}}^{b_{n}N},Q_{{\alpha }_n}^{b_{n}N}\right)+\mathbb{V}\left(Q_{{\alpha }_n}^{b_{n}N},Q_0^{\otimes b_{n}N}\right)\hfill \end{array}$$

(87)

$$\begin{array}{c}\stackrel{\left(b\right)}{\le }\mathbb{V}\left({\mathbb{E}}_{T_1,\cdots ,T_{b_n}}\left({\widehat{Q}}_{T_1,\cdots ,T_n}^{b_{n}N}\right),{\mathbb{E}}_{T_1,\cdots ,T_{b_n}}\left(\prod _{i=1}^{b_n}{Q}_{{\alpha }_n,T_i}^N\right)\right)+\sqrt{b_n\mathbb{D}\left(Q_{{\alpha }_n}^N\parallel Q_0^{\otimes N}\right)}\hfill \end{array}$$

(88)

$$\begin{array}{c}\stackrel{\left(c\right)}{\le }{\mathbb{E}}_{T_1,\cdots ,T_{b_n}}\left(\mathbb{V}\left(Q_{T_1,\cdots ,T_n}^{b_{n}N}\right),\prod _{i=1}^{b_n}{Q}_{{\alpha }_n,T_i}^N\right)+O\left(\sqrt{b_n{\beta }_n}\right)\hfill \end{array}$$

(89)

$$\begin{array}{c}\stackrel{\left(d\right)}{=}\mathbb{V}\left({\widehat{Q}}^{b_{n}n},Q_{{\alpha }_n}^{\otimes b_{n}n}\right)+O\left(\sqrt{b_n{\beta }_n}\right)\hfill \end{array}$$

(90)

$$\begin{array}{c}\stackrel{\left(e\right)}{=}\mathbb{V}\left({\tilde{p}}_{Z_{1:b_n}^{1:n}},q_{Z_{1:b_n}^{1:n}}\right)+O\left(\sqrt{b_n{\beta }_n}\right)\hfill \end{array}$$

(91)

$$\begin{array}{c}\stackrel{\left(f\right)}{=}{\delta }_n^{\left(6\right)}+O\left(\sqrt{b_n{\beta }_n}\right),\hfill \end{array}$$

(92)

where $\left(a\right)$ follows by the triangle inequality; $\left(b\right)$ follows from the definition of ${\widehat{Q}}^{b_{n}N}$ and $Q_{{\alpha }_n}^{b_{n}N}$, Pinsker’s inequality, and the product form of $Q_{{\alpha }_n}^{b_{n}N}$ and $Q_0^{\otimes b_{n}N}$ over the $b_n$ blocks; $\left(c\right)$ follows from the convexity of total variation distance and Lemma 3; $\left(d\right)$ follows from the definition of $\mathbb{V}\left(Q_{T_1,\cdots ,T_n}^{b_{n}N}\right)$ and ${\prod }_{i=1}^{b_n}{Q}_{{\alpha }_n,T_i}^N$; $\left(e\right)$ follows by substituting the notation used in the analysis of the chained scheme; $\left(f\right)$ follows from Lemma 12. With our choice of ${\beta }_n$, $b_n$, and ${\delta }_n$, note that ${\lim }_{n\to \infty }{\delta }_n^{\left(6\right)}=0$ and ${\lim }_{n\to \infty }{b}_n{\beta }_n=0$, hence establishing covertness (note that we use the condition $b_n\in o\left(\frac{1}{{\beta }_n}\right)$ here).

5. Conclusions

In this paper, we have proposed a coding scheme for covert communication based on polar codes. Although our scheme offers a first explicit solution of covert communication in a non-trivial regime, its performance is still far from that of random codes. The proven speed of polarization severely limits the rate at which the average weight of codewords can decay, and in particular we cannot approach the average codeword weight on the order of $\sqrt{n}$ required by the square root law. We have circumvented this issue by hiding the transmission window within a larger window as in [5,6], and at least in the regime for which our proofs hold, the proposed scheme achieves the best known rates. Several extensions and improvements are currently under investigation, particularly the refinement of Proposition 3 to improve the constant $\kappa$ and the use of non-binary polar codes in conjunction with pulse-position modulation [22].