Amplitude Constrained Vector Gaussian Wiretap Channel: Properties of the Secrecy-Capacity-Achieving Input Distribution

Abstract

This paper studies the secrecy capacity of an n-dimensional Gaussian wiretap channel under a peak power constraint. This work determines the largest peak power constraint ${\overline{\mathsf{R}}}_n$, such that an input distribution uniformly distributed on a single sphere is optimal; this regime is termed the low-amplitude regime. The asymptotic value of ${\overline{\mathsf{R}}}_n$ as n goes to infinity is completely characterized as a function of noise variance at both receivers. Moreover, the secrecy capacity is also characterized in a form amenable to computation. Several numerical examples are provided, such as the example of the secrecy-capacity-achieving distribution beyond the low-amplitude regime. Furthermore, for the scalar case $(n=1)$, we show that the secrecy-capacity-achieving input distribution is discrete with finitely many points at most at the order of $\frac{{\mathsf{R}}^2}{{\sigma }_1^2}$, where ${\sigma }_1^2$ is the variance of the Gaussian noise over the legitimate channel.

1. Introduction

Consider the vector Gaussian wiretap channel with outputs

$$\begin{array}{cc}\hfill {\mathbf{Y}}_1& =\mathbf{X}+{\mathbf{N}}_1,\hfill \end{array}$$

(1a)

$$\begin{array}{cc}\hfill {\mathbf{Y}}_2& =\mathbf{X}+{\mathbf{N}}_2,\hfill \end{array}$$

(1b)

where $\mathbf{X}\in {\mathbb{R}}^n$, ${\mathbf{N}}_1\sim \mathcal{N}({\mathbf{0}}_n,{\sigma }_1^2{\mathbf{I}}_n)$ and ${\mathbf{N}}_2\sim \mathcal{N}({\mathbf{0}}_n,{\sigma }_2^2{\mathbf{I}}_n)$, and with $(\mathbf{X},{\mathbf{N}}_1,{\mathbf{N}}_2)$ being mutually independent. The output ${\mathbf{Y}}_1$ is observed by the legitimate receiver, whereas the output ${\mathbf{Y}}_2$ is observed by the malicious receiver. In this work, we are interested in the scenario where the input $\mathbf{X}$ is limited by a peak power constraint or amplitude constraint, and assume that $\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)=\{\mathbf{x}:\parallel \mathbf{x}\parallel \le \mathsf{R}\}$, i.e., ${\mathcal{B}}_0\left(\mathsf{R}\right)$ is an n-ball centered at the origin and of radius $\mathsf{R}$. For this setting, the secrecy capacity is given by

$$\begin{array}{cc}\hfill C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)& =\underset{\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}I(\mathbf{X};{\mathbf{Y}}_1)-I(\mathbf{X};{\mathbf{Y}}_2)\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill & =\underset{\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}I(\mathbf{X};{\mathbf{Y}}_1|{\mathbf{Y}}_2),\hfill \end{array}$$

(3)

where the last expression holds due to the (stochastically) degraded nature of the channel. It can be shown that for ${\sigma }_1^2\ge {\sigma }_2^2$ the secrecy capacity is equal to zero. Therefore, in the remainder, we assume that ${\sigma }_1^2<{\sigma }_2^2$.

We are interested in studying the input distribution $P_{{\mathbf{X}}^{★}}$ that maximizes (3) in the low (but not vanishing) amplitude regime. Since closed-form expressions for secrecy capacity are rare, we derive the secrecy capacity in an integral form that is easy to evaluate. For the scalar case $(n=1)$, we establish an upper bound on the number of mass points of $P_{{\mathbf{X}}^{★}}$, valid for any amplitude regime. We also argue in Section 2.3 that the solution to the secrecy capacity can shed light on other problems seemingly unrelated to security. The paper also provides a number of numerical simulations of $P_{{\mathbf{X}}^{★}}$ and $C_s$, the data for which are made available at [1].

1.1. Literature Review

The wiretap channel was introduced by Wyner in [2], who also established the secrecy capacity of the degraded wiretap channel. The results of [2] were extended to the Gaussian wiretap channel in [3]. The wiretap channel plays a central role in network information theory; the interested reader is referred to [4,5,6,7,8] and references therein for a detailed treatment of the topic. Furthermore, for an in-depth discussion on the wiretap fading channel, refer to [9,10,11,12].

In [3], it was shown that the secrecy-capacity-achieving input distribution of the Gaussian wiretap channel, under an average power constraint, is Gaussian. In [13], the authors investigated the Gaussian wiretap channel consisting of two antennas, both at the transmitter and receiver sides, and of a single antenna for the eavesdropper. The secrecy capacity of the MIMO wiretap channel was characterized in [14,15], where the Gaussian input was shown to be optimal. An elegant proof, using the I-MMSE relationship [16], of the optimality of Gaussian input, is given in [17]. Moreover, an alternative approach in the characterization of the secrecy capacity of a MIMO wiretap channel was proposed in [18]. In [19,20], the authors discuss the optimal signaling for secrecy rate maximization under average power constraints.

The secrecy capacity of the Gaussian wiretap channel under the peak power constraint has received far less attention. The secrecy capacity of the scalar Gaussian wiretap channel with an amplitude and power constraint was considered in [21], where the authors showed that the capacity-achieving input distribution $P_{{\mathbf{X}}^{★}}$ is discrete with finitely many support points.

The work of [21] was extended to noise-dependent channels by Soltani and Rezki in [22]. For further studies on the properties of the secrecy-capacity-achieving input distribution for a class of degraded wiretap channels, refer to [23,24,25].

The secrecy capacity for the vector wiretap channel with a peak power constraint was considered in [25], where it was shown that the optimal input distribution is concentrated on finitely many co-centric shells.

1.2. Contributions and Paper Outline

In Section 2, we introduce the mathematical tools, assumptions, and definitions used throughout the paper. Specifically, in Section 2.1, we introduce the oscillation theorem. In Section 2.2, we give a definition of low-amplitude regimes. Moreover, in Section 2.3, we show how the wiretap channel can be seen as a generalization of point-to-point channels and the evaluation of the largest minimum mean square error (MMSE), both under the assumption of amplitude-constrained input. In Section 2.4, we provide a definition of the Karush–Kuhn–Tucker (KKT) conditions for the wiretap channel.

In Section 3, we detail our main results. Theorem 2 provides a sufficient condition for the optimality of a single hypersphere. Theorem 3 and Theorem 4 give the conditions under which we can fully characterize the behavior of ${\overline{\mathsf{R}}}_n$, that is, the radius below which we are in the low-amplitude regime, i.e., the optimal input distribution is composed of a single shell. Furthermore, Theorem 5 gives an implicit and an explicit upper bound on the number of mass points of the secrecy-capacity-achieving input distribution when $n=1$.

In Section 4, we derive the secrecy capacity expression for the low-amplitude regime in Theorem 6. We also investigate its behavior when the number of antennas n goes to infinity.

Section 5 extends the investigation of the secrecy capacity beyond the low-amplitude regime. We numerically estimate both the optimal input pmf and the resulting capacity via an algorithmic procedure based on the KKT conditions introduced in Lemma 2.

Section 6, Section 7, Section 8 and Section 9 provide the proof for Theorem 3 and Theorem 4–6, respectively. Finally, Section 10 concludes the paper.

1.3. Notation

We use bold letters for vectors ($\mathbf{x}$) and uppercase letters for random variables (X). We denote by $\parallel \mathbf{x}\parallel$ the Euclidean norm of the vector $\mathbf{x}$. Given a vector $\mathbf{x}\in {\mathbb{R}}^n$ and a scalar a, with a little abuse of notation, we denote $\parallel a·{\mathbf{e}}_1+\mathbf{x}\parallel$ by $\parallel a+\mathbf{x}\parallel$, where ${\mathbf{e}}_1=[1,0,\cdots ,0]$ is the first vector in the standard basis of the Euclidean vector space ${\mathbb{R}}^n$. Given a random variable X, its probability density function (pdf), pmf, and cumulative distribution function are denoted by $f_{\mathbf{X}}$, $P_{\mathbf{X}}$, and $F_{\mathbf{X}}$, respectively. The support set of $P_{\mathbf{X}}$ is denoted and defined as

$$\begin{array}{cc}\hfill \mathsf{supp}\left(P_{\mathbf{X}}\right)& =\{\mathbf{x}:\mathrm{for}\mathrm{every}\mathrm{open}\mathrm{set}\mathcal{D}\ni \mathbf{x}\mathrm{we}\mathrm{have}\mathrm{that}{P}_{\mathbf{X}}\left(\mathcal{D}\right)>0\}.\hfill \end{array}$$

(4)

We denote by $\mathcal{N}(\mu ,\Sigma )$ a multivariate Gaussian distribution with mean vector $\mu$ and covariance matrix $\Sigma$. The pdf of a Gaussian random variable with zero mean and variance ${\sigma }^2$ is denoted by ${\varphi }_{\sigma }(·)$. We denote by ${\chi }_n^2\left(\lambda \right)$ the noncentral chi-square distribution with n degrees of freedom and with noncentrality parameter $\lambda$. We represent the $n\times 1$ vector of zeros by ${\mathbf{0}}_n$ and the $n\times n$ identity matrix by ${\mathbf{I}}_n$. Furthermore, we represent by $\mathsf{D}$ the relative entropy. The minimum mean squared error is denoted by

$$\begin{array}{c}\hfill \mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\mathbf{N})=\mathbb{E}\left[{\parallel \mathbf{X}-\mathbb{E}\left[\mathbf{X}\right|\mathbf{X}+\mathbf{N}]\parallel }^2\right].\end{array}$$

(5)

The modified Bessel function of the first kind of order $v\ge 0$ is denoted by ${\mathsf{I}}_v\left(x\right),x\in \mathbb{R}$. The following ratio of the Bessel functions is commonly used in this work:

$${\mathsf{h}}_v\left(x\right)=\frac{{\mathsf{I}}_v\left(x\right)}{{\mathsf{I}}_{v-1}\left(x\right)},x\in \mathbb{R},v\ge 0.$$

(6)

Finally, the number of zeros (counted in accordance with their multiplicities) of a function $f:\mathbb{R}\to \mathbb{R}$ on the interval $\mathcal{I}$ is denoted by $\mathrm{N}(\mathcal{I},f)$. Similarly, if $f:\mathbb{C}\to \mathbb{C}$ is a function on the complex domain, $\mathrm{N}(\mathcal{D},f)$ denotes the number of its zeros within the region $\mathcal{D}$.

2. Preliminaries

2.1. Oscillation Theorem

In this work, we often need to upper bound the number of oscillations of a function, i.e., its number of sign changes. This is useful, for example, to bound the number of zeros of a function or the number of roots of an equation. To be more precise, let us define the number of sign changes as follows.

Definition 1

(Sign Changes of a Function). The number of sign changes of a function $\xi :\Omega \to \mathbb{R}$ is given by

$$\mathcal{S}\left(\xi \right)=\underset{m\in \mathbb{N}}{sup}\left\{\underset{y_1<\cdots <y_m\subseteq \Omega }{sup}\mathcal{N}{\left\{\xi \left(y_i\right)\right\}}_{i=1}^m\right\},$$

(7)

where $\mathcal{N}{\left\{\xi \left(y_i\right)\right\}}_{i=1}^m$ is the number of sign changes of the sequence ${\left\{\xi \left(y_i\right)\right\}}_{i=1}^m$.

Definition 2

(Totally Positive Kernel). A function $f:{\mathbb{I}}_1\times {\mathbb{I}}_2\to \mathbb{R}$ is said to be a totally positive kernel of order n if $det\left({\left[f(x_i,y_j)\right]}_{i,j=1}^m\right)>0$ for all $1\le m\le n$, for all $x_1<\cdots <x_m\in {\mathbb{I}}_1$, and $y_1<\cdots <y_m\in {\mathbb{I}}_2$. If f is a totally positive kernel of order n for all $n\in \mathbb{N}$, then f is a strictly totally positive kernel.

In [26], Karlin noticed that some integral transformations have a variation-diminishing property, which is described in the following theorem.

Theorem 1

(Oscillation Theorem). Given domains ${\mathbb{I}}_1$ and ${\mathbb{I}}_2$, let $p:{\mathbb{I}}_1\times {\mathbb{I}}_2\to \mathbb{R}$ be a strictly totally positive kernel. For an arbitrary y, suppose $p(·,y):{\mathbb{I}}_1\to \mathbb{R}$ is an n-times differentiable function. Assume that μ is a measure on ${\mathbb{I}}_2$, and let $\xi :{\mathbb{I}}_2\to \mathbb{R}$ be a function with $\mathcal{S}\left(\xi \right)=n$. For $x\in {\mathbb{I}}_1$, define

$$\Xi \left(x\right)=\int \xi \left(y\right)p(x,y)\mathrm{d}\mu \left(y\right).$$

(8)

If $\Xi :{\mathbb{I}}_1\to \mathbb{R}$ is an n-times differentiable function, then either $\mathrm{N}({\mathbb{I}}_1,\Xi )\le n$, or $\Xi \equiv 0$.

The above theorem says that the number of zeros of a function $\Xi$, which is the output of the integral transformation, is less than the number of sign changes of the function $\xi$, which is the input to the integral transformation.

2.2. Low-Amplitude Regime

In this work, a low-amplitude regime is defined as follows.

Definition 3.

Let ${\mathbf{X}}_{\mathsf{R}}\sim P_{{\mathbf{X}}_{\mathsf{R}}}$ be uniform on $\mathcal{C}\left(\mathsf{R}\right)=\{\mathbf{x}:\parallel \mathbf{x}\parallel =\mathsf{R}\}$. The capacity in (3) is said to be in the low-amplitude regime if $\mathsf{R}\le {\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$, where

$${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)=max\left\{\mathsf{R}:P_{{\mathbf{X}}_{\mathsf{R}}}=arg\underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}I(\mathbf{X};{\mathbf{Y}}_1|{\mathbf{Y}}_2)\right\}.$$

(9)

If the set in (9) is empty, then we assign ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)=0$.

The quantity ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$ represents the largest radius $\mathsf{R}$, for which $P_{{\mathbf{X}}_{\mathsf{R}}}$ is secrecy-capacity-achieving.

One of the main objectives of this work is to characterize ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$.

2.3. Connections to Other Optimization Problems

The distribution $P_{{\mathbf{X}}_{\mathsf{R}}}$ occurs in a variety of statistical and information-theoretic applications. For example, consider the following two optimization problems:

$$\begin{array}{cc}\hfill \underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}& I(\mathbf{X};\mathbf{X}+\mathbf{N}),\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill \underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}& \mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\mathbf{N}),\hfill \end{array}$$

(11)

where $\mathbf{N}\sim \mathcal{N}({\mathbf{0}}_n,{\sigma }^2{\mathbf{I}}_n)$. The first problem seeks to characterize the capacity of the point-to-point channel under an amplitude constraint, and the second problem seeks to find the largest minimum mean squared error under the assumption that the signal has bounded amplitude; the interested reader is referred to [27,28,29] for a detailed background on both problems.

Similarly to the wiretap channel, we can define the low-amplitude regime for both problems as the largest $\mathsf{R}$ such that $P_{{\mathbf{X}}_{\mathsf{R}}}$ is optimal and denote these by ${\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left({\sigma }^2\right)$ and ${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left({\sigma }^2\right)$. We now argue that both ${\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left({\sigma }^2\right)$ and ${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left({\sigma }^2\right)$ can be seen as a special case of the wiretap solution. Hence, the wiretap channel provides an interesting unification and generalization of these two problems.

First, note that the point-to-point solution can be recovered from the wiretap by simply specializing the wiretap channel to the point-to-point channel, that is,

$$\begin{array}{c}\hfill {\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left({\sigma }^2\right)=\underset{{\sigma }_2\to \infty }{lim}{\overline{\mathsf{R}}}_n({\sigma }^2,{\sigma }_2^2).\end{array}$$

(12)

Second, to see that the MMSE solution can be recovered from the wiretap, recall that by the I-MMSE relationship [16] we have that

$$\begin{array}{cc}\hfill & \underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}I(\mathbf{X};{\mathbf{Y}}_1)-I(\mathbf{X};{\mathbf{Y}}_2)\hfill \end{array}$$

$$\begin{array}{cc}\hfill & =\underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}\frac{1}{2}{\int }_{{\sigma }_1^2}^{\infty }\frac{\mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\sqrt{s}\mathbf{Z})}{s^2}\mathrm{d}s-\frac{1}{2}{\int }_{{\sigma }_2^2}^{\infty }\frac{\mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\sqrt{s}\mathbf{Z})}{s^2}\mathrm{d}s\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill & =\underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}\frac{1}{2}{\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{\mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\sqrt{s}\mathbf{Z})}{s^2}\mathrm{d}s\hfill \end{array}$$

(14)

where $\mathbf{Z}$ is standard Gaussian. Now, note that if we choose ${\sigma }_2^2={\sigma }_1^2+ϵ$, then by the mean value theorem we arrive at

$$\begin{array}{cc}\hfill & \underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}I(\mathbf{X};{\mathbf{Y}}_1)-I(\mathbf{X};{\mathbf{Y}}_2)=\underset{P_{\mathbf{X}}:\mathbf{X}\in {\mathcal{B}}_0\left(\mathsf{R}\right)}{max}\frac{ϵ}{2}\frac{\mathrm{mmse}\left(\mathbf{X}\right|\mathbf{X}+\sqrt{{\sigma }_1^2}\mathbf{Z})}{{\sigma }_1^4}+o\left(ϵ\right),\hfill \end{array}$$

(15)

where ${lim}_{ϵ\to 0^{+}}o\left(ϵ\right)/ϵ=0$. Consequently, for a small enough $ϵ>0$,

$${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left({\sigma }^2\right)={\overline{\mathsf{R}}}_n({\sigma }^2,{\sigma }^2+ϵ).$$

(16)

2.4. KKT Conditions

Let us define the secrecy density for the vector Gaussian wiretap channel as

$$\begin{array}{cc}\hfill \Xi (\mathbf{x};P_{{\mathbf{X}}^{★}})& =\mathsf{D}(f_{{\mathbf{Y}}_1|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_1^{★}})-\mathsf{D}(f_{{\mathbf{Y}}_2|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_2^{★}}),\hfill \end{array}$$

(17)

where $\mathsf{D}(·\parallel ·)$ is the relative entropy.

For the scalar case $(n=1)$, the KKT conditions are necessary and sufficient to ensure that $P_{{\mathbf{X}}^{★}}$ is capacity-achieving [21].

Lemma 1.

$P_{{\mathbf{X}}^{★}}$ maximizes (3) if, and only if,

$$\begin{array}{cc}\hfill \Xi \left(x\right)& =C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},1),x\in \mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right),\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill \Xi \left(x\right)& \le C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},1),x\in [-\mathsf{R},\mathsf{R}],\hfill \end{array}$$

(19)

where for $x\in \mathbb{R}$

$$\begin{array}{cc}\hfill \Xi \left(x\right)& =\mathsf{D}(f_{Y_1|X}(·|x)\parallel f_{Y_1^{★}})-\mathsf{D}(f_{Y_2|X}(·|x)\parallel f_{Y_2^{★}})\hfill \end{array}$$

(20)

$$\begin{array}{cc}\hfill & =\mathbb{E}\left[g\left(Y_1\right)|X=x\right]+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right),\hfill \end{array}$$

(21)

and where

$$\begin{array}{c}\hfill g\left(y\right)=\mathbb{E}\left[log\frac{f_{Y_2^{★}}(y+N)}{f_{Y_1^{★}}\left(y\right)}\right],y\in \mathbb{R},\end{array}$$

(22)

with$N\sim \mathcal{N}(0,{\sigma }_2^2-{\sigma }_1^2)$.

Proof. 

The first part of Lemma 1 was shown in [21]. The proof of (21) goes as follows:

$$\begin{array}{cc}\hfill & \mathsf{D}(f_{Y_1|X}(·|x)\parallel f_{Y_1^{★}})-\mathsf{D}(f_{Y_2|X}(·|x)\parallel f_{Y_2^{★}})-log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill & ={\int }_{-\infty }^{\infty }log\frac{1}{f_{Y_1^{★}}\left(y\right)}{\varphi }_{{\sigma }_1}(y-x)\mathrm{d}y-{\int }_{-\infty }^{\infty }log\frac{1}{f_{Y_2^{★}}\left(y\right)}\mathbb{E}\left[{\varphi }_{{\sigma }_1}(y-x-N)\right]\mathrm{d}y\hfill \end{array}$$

(24)

$$\begin{array}{cc}\hfill & ={\int }_{-\infty }^{\infty }log\frac{1}{f_{Y_1^{★}}\left(y\right)}{\varphi }_{{\sigma }_1}(y-x)\mathrm{d}y-{\int }_{-\infty }^{\infty }\mathbb{E}\left[log\frac{1}{f_{Y_2^{★}}(y+N)}\right]{\varphi }_{{\sigma }_1}(y-x)\mathrm{d}y\hfill \end{array}$$

(25)

$$\begin{array}{cc}\hfill & ={\int }_{-\infty }^{\infty }\mathbb{E}\left[log\frac{f_{Y_2^{★}}(y+N)}{f_{Y_1^{★}}\left(y\right)}\right]{\varphi }_{{\sigma }_1}(y-x)\mathrm{d}y\hfill \end{array}$$

(26)

$$\begin{array}{cc}\hfill & ={\int }_{-\infty }^{\infty }g\left(y\right){\varphi }_{{\sigma }_1}(y-x)\mathrm{d}y,\hfill \end{array}$$

(27)

where $N\sim \mathcal{N}(0,{\sigma }_2^2-{\sigma }_1^2)$ and (24) hold by noticing that ${\varphi }_{{\sigma }_2}(y-x)$ can be reformulated as the convolution of Gaussian pdfs $\mathbb{E}\left[{\varphi }_{{\sigma }_1}(y-x-N)\right]$; in (25) we applied the change in variable $y\mapsto y+N$. This concludes the proof.    □

The convexity of the optimization problem is also guaranteed for the vector wiretap model in (1) with $n>1$. Then, the results of Lemma 1 can be extended to the vector case as follows.

Lemma 2.

$P_{{\mathbf{X}}^{★}}$ maximizes (3) if, and only if,

$$\begin{array}{cc}\hfill \Xi (\mathbf{x};P_{{\mathbf{X}}^{★}})& =C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n),\mathbf{x}\in \mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right),\hfill \end{array}$$

(28a)

$$\begin{array}{cc}\hfill \Xi (\mathbf{x};P_{{\mathbf{X}}^{★}})& \le C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n),\mathbf{x}\in {\mathcal{B}}_0\left(\mathsf{R}\right),\hfill \end{array}$$

(28b)

where for $\mathbf{x}\in {\mathbb{R}}^n$

$$\begin{array}{cc}\hfill \Xi (\mathbf{x};P_{{\mathbf{X}}^{★}})& =\mathsf{D}(f_{{\mathbf{Y}}_1|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_1^{★}})-\mathsf{D}(f_{{\mathbf{Y}}_2|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_2^{★}})\hfill \end{array}$$

(29)

$$\begin{array}{cc}\hfill & =\mathbb{E}\left[g\left({\mathbf{Y}}_1\right)|\mathbf{X}=\mathbf{x}\right],\hfill \end{array}$$

(30)

and where

$$\begin{array}{c}\hfill g\left(\mathbf{y}\right)=\mathbb{E}\left[log\frac{f_{{\mathbf{Y}}_2^{★}}(\mathbf{y}+\mathbf{N})}{f_{{\mathbf{Y}}_1^{★}}\left(\mathbf{y}\right)}\right]+nlog\left(\frac{{\sigma }_2}{{\sigma }_1}\right),\mathbf{y}\in {\mathbb{R}}^n,\end{array}$$

(31)

with $\mathbf{N}\sim \mathcal{N}({\mathbf{0}}_n,({\sigma }_2^2-{\sigma }_1^2){\mathbf{I}}_n)$.

Proof. 

This is a straightforward vector extension of Lemma 1.    □

Thanks to the spherical symmetry of the additive noise distributions and of $P_{\mathbf{X}}$, the secrecy density $\Xi (\mathbf{x};P_{\mathbf{X}})$ can be expressed as a function of $\parallel \mathbf{x}\parallel$ only. Therefore, we denote the secrecy density in spherical coordinates by $\tilde{\Xi }(\parallel \mathbf{x}\parallel ;P_{\parallel \mathbf{X}\parallel })$, and give a rigorous definition in (A9).

3. Main Results

3.1. A New Sufficient Condition on the Optimality of $P_{{\mathbf{X}}_{\mathsf{R}}}$

Our first main result provides a sufficient condition for the optimality of $P_{{\mathbf{X}}_{\mathsf{R}}}$.

Theorem 2.

If

$$\mathsf{R}<{\sigma }_1^2\sqrt{n\left(\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}\right)},$$

(32)

then $P_{{\mathbf{X}}_{\mathsf{R}}}$ is secrecy-capacity-achieving.

Proof. 

Let us consider the equivalent definition of the secrecy density in spherical coordinates (A9). Note that if the derivative of $\tilde{\Xi }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })$ makes at most one sign change, from negative to positive, then the maximum of $\parallel \mathbf{x}\parallel \mapsto \tilde{\Xi }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })$ occurs at either $\parallel \mathbf{x}\parallel =0$ or $\parallel \mathbf{x}\parallel =\mathsf{R}$.

From Lemma A1 in the Appendix B, the derivative of $\tilde{\Xi }$ is as given below

$$\begin{array}{c}\hfill {\tilde{\Xi }}^{\prime }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })=\parallel \mathbf{x}\parallel \mathbb{E}\left[{\tilde{M}}_2\left({\sigma }_1{Q}_{n+2}\right)-M_1\left({\sigma }_1{Q}_{n+2}\right)\right]\end{array}$$

(33)

where $Q_{n+2}^2$ is a noncentral chi-square random variable with $n+2$ degrees of freedom and noncentrality parameter $\frac{{\parallel \mathbf{x}\parallel }^2}{{\sigma }_1^2}$, and

$$\begin{array}{cc}\hfill M_i\left(y\right)& =\frac{1}{{\sigma }_i^2}\left(\frac{\mathsf{R}}{y}{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\mathsf{R}}{{\sigma }_i^2}y\right)-1\right),i\in \{1,2\}\hfill \end{array}$$

(34)

$$\begin{array}{cc}\hfill {\tilde{M}}_2\left(y\right)& =\mathbb{E}\left[M_2(\parallel y+\mathbf{W}\parallel )\right],\hfill \end{array}$$

(35)

where $\mathbf{W}\sim \mathcal{N}({\mathbf{0}}_{n+2},({\sigma }_2^2-{\sigma }_1^2){\mathbf{I}}_{n+2})$. A calculation related to (33) was erroneously performed in [27]. However, this error does not change the results of [27] as only the sign of the derivative is important and not the value itself. Note that ${\tilde{\Xi }}^{\prime }(0;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })=0$ and that ${\tilde{\Xi }}^{\prime }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })>0$ for a sufficiently large $\parallel \mathbf{x}\parallel$; in fact, we have

$$\begin{array}{cc}\hfill {\tilde{\Xi }}^{\prime }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })& >\parallel \mathbf{x}\parallel \left(\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}\right)-\frac{\parallel \mathbf{x}\parallel }{{\sigma }_1^2}\mathbb{E}\left[\frac{\mathsf{R}}{{\sigma }_1{Q}_{n+2}}\right]\hfill \end{array}$$

(36)

$$\begin{array}{cc}\hfill & =\parallel \mathbf{x}\parallel \left(\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}\right)-\frac{\parallel \mathbf{x}\parallel }{{\sigma }_1^2}\mathbb{E}\left[\frac{\mathsf{R}}{\parallel \mathbf{x}\parallel }{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\parallel \mathbf{x}\parallel }{{\sigma }_1}{Q}_n\right)\right]\hfill \end{array}$$

(37)

$$\begin{array}{cc}\hfill & \ge \parallel \mathbf{x}\parallel \left(\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}\right)-\frac{\mathsf{R}}{{\sigma }_1^2},\hfill \end{array}$$

(38)

where (36) follows from $0\le {\mathsf{h}}_{\frac{n}{2}}\left(x\right)\le 1$ for $x\ge 0$; (37) follows by noticing that $\frac{\mathsf{R}}{{\sigma }_1\sqrt{t}}{f}_{Q_{n+2}^2}\left(t\right)=\frac{\mathsf{R}}{\parallel \mathbf{x}\parallel }{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\parallel \mathbf{x}\parallel }{{\sigma }_1}\sqrt{t}\right)f_{Q_n^2}\left(t\right)$; and finally, (38) holds by ${\mathsf{h}}_{\frac{n}{2}}\left(x\right)\le 1$.

Then, to show that $\tilde{\Xi }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })$ is maximized in $\parallel \mathbf{x}\parallel =\mathsf{R}$, we need to prove that ${\tilde{\Xi }}^{\prime }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })$ changes sign at most once. To that end, we need Karlin’s oscillation theorem presented in Section 2.1. By using (33), the fact that the pdf of a chi-square is a positive defined kernel [26], and Theorem 1, the number of sign changes of ${\tilde{\Xi }}^{\prime }(\parallel \mathbf{x}\parallel ;P_{\parallel {\mathbf{X}}_{\mathsf{R}}\parallel })$ is upper-bounded by the number of sign changes of

$$G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}\left(y\right)={\tilde{M}}_2\left(y\right)-M_1\left(y\right),$$

(39)

for $y\in {\mathbb{R}}^{+}$. Note that

$$\begin{array}{cc}\hfill G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}\left(y\right)& \ge -\frac{1}{{\sigma }_2^2}+\frac{1}{{\sigma }_1^2}-\frac{\mathsf{R}}{{\sigma }_1^{2}y}{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\mathsf{R}}{{\sigma }_1^2}y\right)\hfill \end{array}$$

(40)

$$\begin{array}{cc}\hfill & \ge -\frac{1}{{\sigma }_2^2}+\frac{1}{{\sigma }_1^2}-\frac{{\mathsf{R}}^2}{{\sigma }_1^{4}n},\hfill \end{array}$$

(41)

where the inequality in (40) follows from ${\mathsf{h}}_{\frac{n}{2}}\left(x\right)\ge 0$ for $x\ge 0$, and (41) follows from ${\mathsf{h}}_{\frac{n}{2}}\left(x\right)\le \frac{x}{n}$ for $x\ge 0$ and $n\in \mathbb{N}$. We conclude by noting that (41) is nonnegative, hence has no sign change, for

$$\mathsf{R}<{\sigma }_1^2\sqrt{n\left(\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}\right)}$$

(42)

for all $y\in {\mathbb{R}}^{+}$, thus guaranteeing that $P_{{\mathbf{X}}_{\mathsf{R}}}$ is secrecy-capacity-achieving.    □

Remark 1.

As a consequence of the proof of Theorem 2, for any $\mathsf{R}\ge 0,{\sigma }_2\ge {\sigma }_1\ge 0$ and $n\in \mathbb{N}$, if $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}\left(y\right)$ has at most one sign change, then $P_{{\mathbf{X}}_{\mathsf{R}}}$ is secrecy-capacity-achieving if, and only if, for all $\parallel \mathbf{x}\parallel =\mathsf{R}$

$$\Xi (\mathbf{0};P_{{\mathbf{X}}_{\mathsf{R}}})\le \Xi (\mathbf{x};P_{{\mathbf{X}}_{\mathsf{R}}}).$$

(43)

Because of the difficulty in evaluating analytical properties of (39), proving that $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}$ has at most one sign change does not seem easy. However, in Appendix A, we show via extensive numerical evaluations that $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}$ changes sign at most once for any $n,\mathsf{R},{\sigma }_1,{\sigma }_2$ that we tried.

3.2. Characterizing the Low-Amplitude Regime

Let us characterize the low-amplitude regime as follows.

Theorem 3.

Consider a function

$$\begin{array}{cc}\hfill f\left(\mathsf{R}\right)& ={\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)+{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathsf{R}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]-1}{s^2}\mathrm{d}s\hfill \end{array}$$

(44)

where $\mathbf{Z}\sim \mathcal{N}({\mathbf{0}}_n,{\mathbf{I}}_n)$. If $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}$ of (39) has at most one sign change, the input ${\mathbf{X}}_{\mathsf{R}}$ is secrecy-capacity-achieving if, and only if, $\mathsf{R}\le {\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$, where ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$ is given as the solution of

$$f\left(\mathsf{R}\right)=0.$$

(45)

Remark 2.

Note that (45) always has a solution. To see this, observe that $f\left(0\right)=\frac{1}{{\sigma }_2^2}-\frac{1}{{\sigma }_1^2}<0$ and $f(\infty )=\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}>0$. Moreover, the solution is unique because $f\left(\mathsf{R}\right)$ monotonically increases for $\mathsf{R}\ge 0$.

The solution to (45) needs to be found numerically. To avoid any loss of accuracy in the numerical evaluation of ${\mathsf{h}}_v\left(x\right)$ for large values of x, we used the exponential scaling provided in the MATLAB implementation of ${\mathsf{I}}_v\left(x\right)$. Since evaluating $f\left(\mathsf{R}\right)$ is rather straightforward and not time-consuming, we opted for a binary search algorithm.

In Table 1, we show the values of ${\overline{\mathsf{R}}}_n(1,{\sigma }_2^2)$ for some values of ${\sigma }_2^2$ and n. Moreover, we report the values of ${\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left(1\right)$ and ${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left(1\right)$ from [27] in the first and the last row, respectively. As predicted by (12), we can appreciate the close match of the ${\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left(1\right)$ row with the one of ${\overline{\mathsf{R}}}_n(1,1000)$. Similarly, the agreement between the ${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left(1\right)$ row and the ${\overline{\mathsf{R}}}_n(1,1.001)$ row is justified by (16).

Table 1. Values of ${\overline{\mathsf{R}}}_n^{\mathrm{MMSE}}\left(1\right)$, ${\overline{\mathsf{R}}}_n(1,{\sigma }_2^2)$, and ${\overline{\mathsf{R}}}_n^{\mathrm{ptp}}\left(1\right)$.

n	MMSE	${\mathit{\sigma }}_2^2$				ptp
		1.001	1.5	10	1000
1	1.057	1.057	1.161	1.518	1.664	1.666
2	1.535	1.535	1.687	2.221	2.450	2.454
3	1.908	1.909	2.098	2.768	3.061	3.065
4	2.223	2.224	2.444	3.229	3.575	3.580
5	2.501	2.501	2.750	3.634	4.026	4.031
6	2.751	2.752	3.025	3.999	4.432	4.438
7	2.981	2.982	3.278	4.334	4.805	4.811
8	3.195	3.196	3.513	4.646	5.151	5.158
9	3.395	3.396	3.733	4.937	5.475	5.483
10	3.585	3.586	3.941	5.213	5.781	5.789
11	3.765	3.766	4.139	5.475	6.072	6.080
12	3.936	3.938	4.328	5.725	6.350	6.359
13	4.101	4.102	4.509	5.964	6.616	6.625
14	4.259	4.260	4.683	6.195	6.872	6.881
15	4.412	4.413	4.851	6.417	7.119	7.128
16	4.560	4.561	5.013	6.632	7.357	7.367
17	4.702	4.704	5.170	6.839	7.588	7.598
18	4.841	4.842	5.323	7.041	7.812	7.823
19	4.976	4.977	5.471	7.238	8.030	8.041
20	5.107	5.109	5.616	7.429	8.242	8.254
21	5.235	5.237	5.756	7.615	8.449	8.461
22	5.360	5.362	5.894	7.797	8.651	8.663
23	5.483	5.484	6.028	7.974	8.848	8.860
24	5.602	5.603	6.159	8.148	9.041	9.054
25	5.719	5.720	6.288	8.318	9.230	9.243
26	5.834	5.835	6.414	8.485	9.416	9.428
27	5.946	5.948	6.538	8.649	9.597	9.610
28	6.056	6.058	6.659	8.809	9.775	9.789
29	6.165	6.166	6.778	8.967	9.951	9.964
30	6.271	6.273	6.895	9.122	10.123	10.136
31	6.376	6.378	7.010	9.274	10.292	10.306
32	6.479	6.481	7.124	9.424	10.458	10.472
33	6.580	6.582	7.235	9.571	10.622	10.636
34	6.680	6.682	7.345	9.717	10.783	10.798
35	6.779	6.780	7.453	9.860	10.942	10.957

3.3. Large n Asymptotics

We now use the result in Theorem 3 to characterize the asymptotic behavior of ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$. In particular, it is shown that ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$ increases as $\sqrt{n}$.

Theorem 4.

For ${\sigma }_1^2\le {\sigma }_2^2$

$$\underset{n\to \infty }{lim}\frac{{\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)}{\sqrt{n}}=c({\sigma }_1^2,{\sigma }_2^2),$$

(46)

where $c=c({\sigma }_1^2,{\sigma }_2^2)$ is the solution of

$${\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{\frac{c^2}{{\left(\frac{\sqrt{s}}{2}+\sqrt{\frac{s}{4}+c^2}\right)}^2}+\frac{c^2(c^2+s)}{{\left(\frac{s}{2}+\sqrt{\frac{s^2}{4}+c^2(c^2+s)}\right)}^2}-1}{s^2}\mathrm{d}s=0.$$

(47)

Proof. 

See Section 7.    □

In Figure 1, for ${\sigma }_1^2=1$ and ${\sigma }_2^2=1.001,1.5,10,1000$, we show the behavior of ${\overline{\mathsf{R}}}_n(1,{\sigma }_2^2)/\sqrt{n}$ and how its asymptotic converges to $c(1,{\sigma }_2^2)$.

Figure 1. Asymptotic behavior of ${\overline{\mathsf{R}}}_n(1,{\sigma }_2^2)/\sqrt{n}$ versus n for ${\sigma }_1^2=1$ and ${\sigma }_2^2=1.001,1.5,10,1000$. In red, we show $c(1,{\sigma }_2^2)$ defined in (46).

3.4. Scalar Case $(n=1)$

For the scalar case, the optimal input distribution $P_{{\mathbf{X}}^{★}}$ is discrete. In this regime, we provide an implicit and an explicit upper bound on the number of support points of the optimal input probability mass function (pmf) $P_{{\mathbf{X}}^{★}}$.

Theorem 5.

Let $Y_1^{★}$ and $Y_2^{★}$ be the secrecy-capacity-achieving output distributions at the legitimate and malicious receivers, respectively, and let

$$\begin{array}{c}\hfill g\left(y\right)=\mathbb{E}\left[log\frac{f_{Y_2^{★}}(y+N)}{f_{Y_1^{★}}\left(y\right)}\right],y\in \mathbb{R},\end{array}$$

(48)

with $N\sim \mathcal{N}(0,{\sigma }_2^2-{\sigma }_1^2)$. For $\mathsf{R}>0$, an implicit upper bound on the number of support points of $P_{{\mathbf{X}}^{★}}$ is

$$\begin{array}{c}\hfill |\mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right)|\le \mathrm{N}\left([-L,L],g(·)+{\kappa }_1\right)<\infty \end{array}$$

(49)

where

$$\begin{array}{cc}\hfill {\kappa }_1& =log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s,\hfill \end{array}$$

(50)

$$\begin{array}{cc}\hfill L& =\mathsf{R}\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}+\sqrt{\frac{\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}+2C_s}{\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}}}.\hfill \end{array}$$

(51)

Moreover, an explicit upper bound on the number of support points of $P_{{\mathbf{X}}^{★}}$ is obtained by using

$$\begin{array}{c}\hfill \mathrm{N}\left([-L,L],g(·)+{\kappa }_1\right)\le \rho \frac{{\mathsf{R}}^2}{{\sigma }_1^2}+O(log\left(\mathsf{R}\right)),\end{array}$$

(52)

where $\rho ={(2\mathrm{e}+1)}^2{\left(\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}\right)}^2+{\left(\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}+1\right)}^2$.

The upper bounds in Theorem 5 are generalizations of the upper bounds on the number of points presented in [30] in the context of a point-to-point AWGN channel with an amplitude constraint. Indeed, if we let ${\sigma }_2\to \infty$, while keeping ${\sigma }_1$ and $\mathsf{R}$ fixed, then the wiretap channel reduces to the AWGN point-to-point channel.

To find a lower bound on the number of mass points, a possible approach consists of the following steps:

$$\begin{array}{cc}\hfill C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},1)& =I({\mathbf{X}}^{★};Y_1)-I({\mathbf{X}}^{★};Y_2)\hfill \end{array}$$

(53)

$$\begin{array}{cc}\hfill & \le H\left({\mathbf{X}}^{★}\right)-I({\mathbf{X}}^{★};Y_2)\hfill \end{array}$$

(54)

$$\begin{array}{cc}\hfill & \le log\left(\right|\mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right)\left|\right)-I({\mathbf{X}}^{★};Y_2),\hfill \end{array}$$

(55)

where the above uses the nonnegativity of the entropy and the fact that entropy is maximized by a uniform distribution. Furthermore, by using a suboptimal uniform (continuous) distribution on $[-\mathsf{R},\mathsf{R}]$ as an input and the entropy power inequality, the secrecy capacity is lower-bounded by

$$C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},1)\ge \frac{1}{2}log\left(1+\frac{\frac{2{\mathsf{R}}^2}{\pi \mathrm{e}{\sigma }_1^2}}{1+\frac{{\mathsf{R}}^2}{{\sigma }_2^2}}\right).$$

(56)

Combining the bounds in (55) and (56), we arrive at the following lower bound on the number of points:

$$|\mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right)|\ge \sqrt{1+\frac{\frac{2{\mathsf{R}}^2}{\pi \mathrm{e}{\sigma }_1^2}}{1+\frac{{\mathsf{R}}^2}{{\sigma }_2^2}}}{\mathrm{e}}^{I({\mathbf{X}}^{★};Y_2)}.$$

(57)

At this point, one needs to determine the behavior of $I({\mathbf{X}}^{★};Y_2)$. A trivial lower bound on $\left|\mathsf{supp}\right(P_{{\mathbf{X}}^{★}}\left)\right|$ can be found by lower-bounding $I({\mathbf{X}}^{★};Y_2)$ by zero. However, this lower bound on $\left|\mathsf{supp}\right(P_{{\mathbf{X}}^{★}}\left)\right|$ does not grow with $\mathsf{R}$, while the upper bound does increase with $\mathsf{R}$. A possible way of establishing a lower bound that increases in $\mathsf{R}$ is by showing that $I({\mathbf{X}}^{★};Y_2)\approx \frac{1}{2}log\left(1+\frac{{\mathsf{R}}^2}{{\sigma }_2^2}\right)$. However, because not much is known about the structure of the optimal input distribution $P_{{\mathbf{X}}^{★}}$, it is not immediately evident how one can establish such an approximation or whether it is valid.

4. Secrecy Capacity Expression in the Low-Amplitude Regime

The result in Theorem 3 can also be used to establish the secrecy capacity for all $\mathsf{R}\le {\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$, as is performed next.

Theorem 6.

If $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}$ of (39) has at most one sign change and if $\mathsf{R}\le {\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$, then

$$C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)=\frac{1}{2}{\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{{\mathsf{R}}^2-{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathsf{R}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]}{s^2}\mathrm{d}s.$$

(58)

Proof. 

See Section 9.    □

Large n Asymptotics

It is important to note that as ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$ grows as $\sqrt{n}$, according to Theorem 4, when we keep $\mathsf{R}$ constant and increase the number of antennas to infinity, the low-amplitude regime becomes the only regime. The next theorem characterizes the secrecy capacity in this ‘massive-MIMO’ regime (i.e., where $\mathsf{R}$ is fixed and n goes to infinity).

Theorem 7.

Consider the expression in (58) and fix $\mathsf{R}\ge 0$ and ${\sigma }_1^2\le {\sigma }_2^2$, then

$$\begin{array}{cc}\hfill & \underset{n\to \infty }{lim}{C}_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)={\mathsf{R}}^2\left(\frac{1}{2{\sigma }_1^2}-\frac{1}{2{\sigma }_2^2}\right).\hfill \end{array}$$

(59)

Proof. 

See Appendix C.    □

Remark 3.

The result in Theorem 7 is reminiscent of the capacity in the wideband regime [31, Ch. 9], where the capacity increases linearly in the signal-to-noise ratio. Similarly, Theorem 7 shows that in the large antenna regime, the secrecy capacity grows linearly with the difference in the single-to-noise ratio between the legitimate user and the eavesdropper.

In Theorem 7, $\mathsf{R}$ was held fixed. It is also interesting to study the case when $\mathsf{R}$ is a function of n. Specifically, it is interesting to study the case when $\mathsf{R}=c\sqrt{n}$ for some coefficient c.

Theorem 8.

Suppose that $c\le c({\sigma }_1^2,{\sigma }_2^2)$. Then,

$$\underset{n\to \infty }{lim}\frac{C_s({\sigma }_1^2,{\sigma }_2^2,c\sqrt{n},n)}{n}=\frac{1}{2}log\left(\frac{1+c^2/{\sigma }_1^2}{1+c^2/{\sigma }_2^2}\right).$$

(60)

Proof. 

See Appendix D.    □

Notice that (60) is equivalent to the secrecy capacity of a vector Gaussian wiretap channel subject to an average power constraint. Gaussian wiretap channels under average power constraints have been extensively investigated [3,32] and, for an average power constraint $\mathbb{E}[\parallel \mathbf{X}{\parallel }^2]\le \mathsf{P}$, the resulting secrecy capacity is given by [3]

$$C_G({\sigma }_1^2,{\sigma }_2^2,\mathsf{P},n)=\frac{n}{2}log\frac{1+\mathsf{P}/{\sigma }_1^2}{1+\mathsf{P}/{\sigma }_2^2}.$$

(61)

Thus, the result in (60) can be restated as

$$\underset{n\to \infty }{lim}\frac{C_s({\sigma }_1^2,{\sigma }_2^2,c\sqrt{n},n)}{C_G({\sigma }_1^2,{\sigma }_2^2,c^2,n)}=1.$$

(62)

In other words, for the regime considered in Theorem 8, for a large enough n the secrecy capacity under the amplitude constraint ${\mathsf{R}}_n=c\sqrt{n}$ behaves as the secrecy capacity under the average power constraint $c^2$.

5. Beyond the Low-Amplitude Regime

To evaluate the secrecy capacity and find the optimal distribution $P_{{\mathbf{X}}^{★}}$ beyond ${\overline{\mathsf{R}}}_n$ we rely on numerical estimations. We remark that, as pointed out in [25], the secrecy-capacity-achieving distribution is isotropic and consists of finitely many co-centric shells. Keeping this in mind, we can find the optimal input distribution $P_{{\mathbf{X}}^{★}}$ by just optimizing over $P_{\parallel \mathbf{X}\parallel }$ with $\parallel \mathbf{X}\parallel \le \mathsf{R}$.

5.1. Numerical Algorithm

In the case of scalar Gaussian wiretap channels, the secrecy capacity and the optimal input pmf can be estimated via the algorithm described in [33], i.e., a numerical procedure that takes inspiration from the deterministic annealing algorithm sketched in [34]. Let us denote by ${\widehat{C}}_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$ the numerical estimate of the secrecy capacity, and by ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$, the estimate of the optimal pmf on the input norm. To numerically evaluate ${\widehat{C}}_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$ and ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$, we extend to the vector case the algorithm in [33]. Our extension is defined in Algorithm 1. The input parameters of the main function are the noise variances ${\sigma }_1^2$ and ${\sigma }_2^2$, the radius $\mathsf{R}$, the vectors $\mathsf{\rho }$ and $\mathbf{p}$ being, respectively, the mass points positions and probabilities of a tentative input pmf, the number of iterations in the while loop $N_c$, and finally, a tolerance $\epsilon$ to set the precision of the secrecy capacity estimate.

Algorithm 1 Secrecy capacity and optimal input pmf estimation

1: procedure Main$\left({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},\mathsf{\rho },\mathbf{p},N_c,\epsilon \right)$ 2:     repeat 3:         $k\leftarrow 0$ 4:         while $k<N_c$ do 5:            $k\leftarrow k+1$ 6:            $\mathsf{\rho }\leftarrow$Gradient Ascent$(\mathsf{\rho },\mathbf{p})$ 7:            $\mathbf{p}\leftarrow$Blahut–Arimoto$(\mathsf{\rho },\mathbf{p})$ 8:         end while 9:         valid ← KKT Validation$(\mathsf{\rho },\mathbf{p},\epsilon )$ 10:         if valid = False then 11:            $(\mathsf{\rho },\mathbf{p})\leftarrow$Add–Point$(\mathsf{\rho },\mathbf{p})$ 12:         end if 13:     until valid = True   14:     ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }\leftarrow (\mathsf{\rho },\mathbf{p})$   15:     ${\widehat{C}}_s\left({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n\right)\leftarrow I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel })$   16:     return ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel },{\widehat{C}}_s\left({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n\right)$   17: end procedure

At its core, the numerical procedure iteratively refines its estimate of $P_{\parallel {\mathbf{X}}^{★}\parallel }$ by running a gradient ascent algorithm to update the vector $\mathsf{\rho }$ and a variant of the Blahut–Arimoto algorithm [35] to update $\mathbf{p}$.

The Gradient Ascent procedure uses the secrecy information as the objective function and stops either when $\mathsf{\rho }$ has reached convergence or at a given maximum number of iterations. Let us denote by $I_s(\parallel \mathbf{X}\parallel ;P_{\parallel \mathbf{X}\parallel })$ the secrecy information as a function of the input norm. Notice that, given a tentative pmf ${\widehat{P}}_{\parallel \mathbf{X}\parallel }$ of mass points $\mathsf{\rho }$, probabilities $\mathbf{p}$, and $\left|\mathsf{supp}\right({\widehat{P}}_{\parallel \mathbf{X}\parallel }\left)\right|=K$, we have

$$\begin{array}{c}\hfill I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel })=\sum _{i=1}^K{p}_i·\tilde{\Xi }\left({\rho }_i;{\widehat{P}}_{\parallel \mathbf{X}\parallel }\right),\end{array}$$

(63)

where $\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$ is the secrecy density, with respect to the input norm, defined in (A9) and where $p_i$ and ${\rho }_i$ are, respectively, the ith element of $\mathbf{p}$ and $\mathsf{\rho }$. Then, the Gradient Ascent updates are given by

$$\begin{array}{c}\hfill {\rho }_i={\rho }_i+\alpha ·\frac{\partial }{\partial {\rho }_i}{I}_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel }),i=1,\cdots ,K,\end{array}$$

(64)

where the partial derivatives are defined in Appendix E and $\alpha$ is the step size in the gradient ascent. We remark that, to ensure convergence to a local maximum, we use the gradient ascent algorithm in a backtracking line search version [36]. By suitably adjusting the step size $\alpha$ at each iteration, the backtracking line search version guarantees us that each new update of $\mathsf{\rho }$ provides a nondecreasing associated secrecy information, compared to the previous update of $\mathsf{\rho }$.

The Blahut–Arimoto function runs a variant of the Blahut–Arimoto algorithm. For the scalar case, an example of the Blahut–Arimoto optimization, applied to wiretap channels, is given in [37]. Similar results can be extended to the case of vector wiretap channels. Given the current probabilities $p_i$’s, the updates are obtained by evaluating

$$\begin{array}{cc}\hfill p_i^{\prime }& =p_{i}exp\left(\tilde{\Xi }\left({\rho }_i;{\widehat{P}}_{\parallel \mathbf{X}\parallel }\right)\right),i=1,\cdots ,K,\hfill \end{array}$$

(65)

and finally, by normalizing each $p_i^{\prime }$ and assigning them to the entries of the vector $\mathbf{p}$

$$\begin{array}{cc}\hfill p_i& =\frac{p_i^{\prime }}{{\sum }_{k=1}^K{p}_i^{\prime }},i=1,\cdots ,K.\hfill \end{array}$$

(66)

Similarly to Gradient Ascent, the Blahut–Arimoto procedure stops either when the values of $\mathbf{p}$ have reached a stable convergence or after a set number of updates.

Since the joint optimization of $\mathsf{\rho }$ and $\mathbf{p}$ is not numerically feasible, we need to reiterate both the Blahut–Arimoto and the Gradient Ascent procedures a given number of times, namely $N_c$. The parameter $N_c$ is chosen empirically in such a way that $\mathsf{\rho }$ and $\mathbf{p}$ become fairly stable, and therefore we can expect to have reached joint convergence for both of them.

Then, the KKT Validation procedure ensures that the values of $\mathsf{\rho }$ and $\mathbf{p}$ are indeed close to the optimal ones. We check the optimality of ${\widehat{P}}_{\parallel \mathbf{X}\parallel }$ by verifying whether the KKT conditions in Lemma 2 are satisfied. Since the algorithm has to verify the KKT conditions numerically, i.e., with finite precision, we find it more convenient to check the negated version of (28), where a tolerance parameter $\epsilon$ is introduced that trades off accuracy with computational burden. Specifically, ${\widehat{P}}_{\parallel \mathbf{X}\parallel }$ is not an optimal input pmf if any of the following conditions are satisfied:

$$\begin{array}{cc}\hfill & |\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel })-I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel }\left)\right|>\epsilon ,\mathrm{for}\mathrm{some}t\in \mathsf{supp}\left({\widehat{P}}_{\parallel \mathbf{X}\parallel }\right)\hfill \end{array}$$

(67a)

$$\begin{array}{cc}\hfill & I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel })+\epsilon <\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel }),\mathrm{for}\mathrm{some}t\in [0,\mathsf{R}].\hfill \end{array}$$

(67b)

Note that in (67), in place of the secrecy capacity $C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$, which is unknown, we used the secrecy information given by the tentative pmf ${\widehat{P}}_{\parallel \mathbf{X}\parallel }$, i.e., $I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$. Condition (67a) is derived by negating (28a): there exists a $t\in \mathsf{supp}\left({\widehat{P}}_{\parallel \mathbf{X}\parallel }\right)$, such that $\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$ is $\epsilon$-away from the secrecy information $I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$. Condition (67b) is the negated version of (28b): there exists a $t\in [0,\mathsf{R}]$ such that $\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$ is at least $\epsilon$-larger than the secrecy information $I_s(\parallel \mathbf{X}\parallel ;{\widehat{P}}_{\parallel \mathbf{X}\parallel })$. With some abuse of notation, we refer to (67) as to the $\epsilon$-KKT conditions. If the tentative pmf ${\widehat{P}}_{\parallel \mathbf{X}\parallel }$ does not pass the check of the $\epsilon$-KKT conditions, then the algorithm checks whether a new point has to be added to the pmf.

The Add Point procedure evaluates the position of the new mass point

$$\begin{array}{c}\hfill {\rho }_{\mathrm{new}}=arg\underset{t\in [0,\mathsf{R}]}{max}\tilde{\Xi }(t;{\widehat{P}}_{\parallel \mathbf{X}\parallel }).\end{array}$$

(68)

The point ${\rho }_{\mathrm{new}}$ is appended to the vector $\mathsf{\rho }$ and the probabilities $\mathbf{p}$ are set to be equiprobable.

The whole procedure is repeated until KKT Validation gives a positive outcome, and at that point the algorithm returns ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$ as the optimal pmf estimate and ${\widehat{C}}_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$ as the secrecy capacity estimate.

Remark 4.

In this work, we focus on the secrecy capacity and on the secrecy-capacity-achieving input distribution. However, it is possible to study other points of the rate-equivocation region of the degraded wiretap Gaussian channel by suitably changing the KKT conditions, as reported in [21], Equations (33) and (34). With the due modifications, the proposed optimization algorithm can find the optimal input distribution for any point of the rate-equivocation region.

5.2. Numerical Results

In Figure 2, we show with black dots the numerical estimate ${\widehat{C}}_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$ versus $\mathsf{R}$, evaluated via Algorithm 1, for ${\sigma }_1^2=1$, ${\sigma }_2^2=1.5,10$, $n=2,4$, and tolerance $\epsilon ={10}^{-6}$. For the same values of ${\sigma }_1^2$, ${\sigma }_2^2$, and n we also show, with the red lines, the analytical low-amplitude regime secrecy capacity $C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$ versus $\mathsf{R}$ from Theorem 6. In addition, we show with blue dotted lines the secrecy capacity under the average power constraint $\mathbb{E}\left[{\parallel \mathbf{X}\parallel }^2\right]\le {\mathsf{R}}^2$:

$$\begin{array}{cc}\hfill C_G({\sigma }_1^2,{\sigma }_2^2,{\mathsf{R}}^2,n)& =\frac{n}{2}log\frac{1+{\mathsf{R}}^2/{\sigma }_1^2}{1+{\mathsf{R}}^2/{\sigma }_2^2}\ge C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n),\hfill \end{array}$$

(69)

where the inequality follows by noting that the average power constraint $\mathbb{E}\left[{\parallel \mathbf{X}\parallel }^2\right]\le {\mathsf{R}}^2$ is weaker than the amplitude constraint $\parallel \mathbf{X}\parallel \le \mathsf{R}$. Finally, the dashed vertical lines show ${\overline{\mathsf{R}}}_n$, i.e., the upper limit of the low-amplitude regime, for the considered values of ${\sigma }_1^2$, ${\sigma }_2^2$, and n.

Figure 2. Secrecy capacity in bit per channel use (bpcu) versus $\mathsf{R}$ for ${\sigma }_2^2=1.5,10$ and $n=2,4$. The secrecy capacity under average power constraints $C_G({\sigma }_1^2,{\sigma }_2^2,{\mathsf{R}}^2,n)$ is defined in (69), while under peak power constraints, i.e., $C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)$, is defined in (58).

In Figure 3, we consider discrete values for $\mathsf{R}$ and for each value of $\mathsf{R}$ we plot the corresponding estimated pmf ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$, evaluated via Algorithm 1, for ${\sigma }_1^2=1$, ${\sigma }_2^2=1.5$, $n=2,8$, and tolerance $\epsilon ={10}^{-6}$. The figure shows, at each $\mathsf{R}$, the normalized amplitude of support points in the estimated pmf, while the size of the circles qualitatively shows the probability associated with each support point. Similarly, Figure 4 shows the evolution of the pmf estimate for ${\sigma }_1^2=1$, ${\sigma }_2^2=10$, $n=2,8$, and $\epsilon ={10}^{-6}$. It is interesting to notice how in both Figure 3 and Figure 4 when a new mass point is added to the pmf, it appears in zero. Moreover, the mass point of radius $\mathsf{R}$ always seems to be optimal.

Figure 3. Evolution of the numerically estimated ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$ versus $\mathsf{R}$ for ${\sigma }_1^2=1$, ${\sigma }_2^2=1.5$, (a) $n=2$, and (b) $n=8$.

Figure 4. Evolution of the numerically estimated ${\widehat{P}}_{\parallel {\mathbf{X}}^{★}\parallel }$ versus $\mathsf{R}$ for ${\sigma }_1^2=1$, ${\sigma }_2^2=10$, (a) $n=2$, and (b) $n=8$.

Finally, Figure 5 shows the output distributions of the legitimate user and of the eavesdropper in the case of ${\sigma }_1^2=1$, ${\sigma }_2^2=10$, $n=2$, and for two values of $\mathsf{R}$. At the top of the figure, the distributions are shown for $\mathsf{R}=2.25$, which is a value close to ${\overline{\mathsf{R}}}_2(1,10)$. At the bottom of the figure, the distributions are shown for $\mathsf{R}=7.5$. For both values of $\mathsf{R}$, the legitimate user sees an output distribution where the co-centric rings of the input distribution are easily distinguishable. On the other hand, as expected, the output distribution seen by the eavesdropper is close to a Gaussian.

Figure 5. Output pdf of the legitimate user and of the eavesdropper for ${\sigma }_1^2=1$, ${\sigma }_2^2=10$, $n=2$, (a,b) $\mathsf{R}=2.25$, and (c,d) $\mathsf{R}=7.5$. An animation showing the evolution of the output pdf as $\mathsf{R}$ varies can be found in [1].

6. Proof of Theorem 3

Estimation Theoretic Representation

By Remark 1, if $G_{{\sigma }_1,{\sigma }_2,\mathsf{R},n}$ has at most one sign change, $P_{{\mathbf{X}}_{\mathsf{R}}}$ is secrecy-capacity-achieving if, and only if, for all $\parallel \mathbf{x}\parallel =\mathsf{R}$

$$\Xi (\mathbf{0};P_{{\mathbf{X}}_{\mathsf{R}}})\le \Xi (\mathbf{x};P_{{\mathbf{X}}_{\mathsf{R}}}).$$

(70)

We seek to re-write the condition (70) in the estimation theoretic form. To that end, we need the following representation of the relative entropy [38]:

$$\mathsf{D}(P_{{\mathbf{X}}_1+\sqrt{t}\mathbf{Z}}\parallel P_{{\mathbf{X}}_2+\sqrt{t}\mathbf{Z}})=\frac{1}{2}{\int }_t^{\infty }\frac{g\left(s\right)}{s^2}\mathrm{d}s,$$

(71)

where

$$\begin{array}{cc}\hfill g\left(s\right)& =\mathbb{E}\left[\parallel {\mathbf{X}}_1-{\ell }_2({\mathbf{X}}_1+\sqrt{s}\mathbf{Z}){\parallel }^2\right]-\mathbb{E}\left[\parallel {\mathbf{X}}_1-{\ell }_1({\mathbf{X}}_1+\sqrt{s}\mathbf{Z}){\parallel }^2\right]\hfill \end{array}$$

(72)

and where

$$\begin{array}{cc}\hfill {\ell }_i\left(\mathbf{y}\right)& =\mathbb{E}\left[{\mathbf{X}}_i\right|{\mathbf{X}}_i+\sqrt{s}\mathbf{Z}=\mathbf{y}]\hfill \end{array}$$

(73)

$$\begin{array}{cc}\hfill & =\int {\mathbf{x}}_i{f}_{{\mathbf{X}}_i|{\mathbf{X}}_i+\sqrt{s}\mathbf{Z}}({\mathbf{x}}_i\mid \mathbf{y})\mathrm{d}{\mathbf{x}}_i,i\in \{1,2\}.\hfill \end{array}$$

(74)

Another fact that will be important for our expression is

$$\begin{array}{c}\hfill \mathbb{E}\left[{\mathbf{X}}_{\mathsf{R}}\mid {\mathbf{X}}_{\mathsf{R}}+\sqrt{s}\mathbf{Z}=\mathbf{y}\right]=\frac{\mathsf{R}\mathbf{y}}{\parallel \mathbf{y}\parallel }{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\parallel \mathbf{y}\parallel \mathsf{R}}{s}\right),\end{array}$$

(75)

see, for example [27], for the proof.

Next, using (71) and (75) note that for any $\parallel \mathbf{x}\parallel =\mathsf{R}$ we have that for $i\in \{1,2\}$

$$\begin{array}{cc}\hfill \mathsf{D}(P_{\mathbf{x}+\sqrt{{\sigma }_i^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_i^2}\mathbf{Z}})& =\frac{1}{2}{\int }_{{\sigma }_i^2}^{\infty }\frac{\mathbb{E}\left[{∥\mathbf{x}-\frac{\mathsf{R}(\mathbf{x}+\sqrt{s}\mathbf{Z})}{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel }{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)∥}^2\right]}{s^2}\mathrm{d}s\hfill \end{array}$$

(76)

$$\begin{array}{cc}\hfill & =\frac{1}{2}{\int }_{{\sigma }_i^2}^{\infty }\frac{\mathbb{E}\left[{∥\mathbf{x}∥}^2\right]-\mathbb{E}\left[{∥\frac{\mathsf{R}(\mathbf{x}+\sqrt{s}\mathbf{Z})}{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel }{\mathsf{h}}_{\frac{n}{2}}\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)∥}^2\right]}{s^2}\mathrm{d}s\hfill \end{array}$$

(77)

$$\begin{array}{cc}\hfill & =\frac{1}{2}{\int }_{{\sigma }_i^2}^{\infty }\frac{{\mathsf{R}}^2-{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]}{s^2}\mathrm{d}s,\hfill \end{array}$$

(78)

where (77) follows from

$$\begin{array}{cc}\hfill \mathrm{mmse}\left({\mathbf{X}}_{\mathsf{R}}\right|\mathbf{Y})& =\mathbb{E}\left[\parallel {\mathbf{X}}_{\mathsf{R}}-\mathbb{E}\left[{\mathbf{X}}_{\mathsf{R}}\right|\mathbf{Y}]{\parallel }^2\right]\hfill \end{array}$$

(79)

$$\begin{array}{cc}\hfill & =\mathbb{E}\left[\parallel {\mathbf{X}}_{\mathsf{R}}{\parallel }^2\right]-\mathbb{E}\left[\parallel \mathbb{E}\left[{\mathbf{X}}_{\mathsf{R}}\right|\mathbf{Y}]{\parallel }^2\right].\hfill \end{array}$$

(80)

Moreover, for $\parallel \mathbf{x}\parallel =0$, it holds

$$\begin{array}{c}\hfill \mathsf{D}(P_{\mathbf{0}+\sqrt{{\sigma }_i^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_i^2}\mathbf{Z}})=\frac{1}{2}{\int }_{{\sigma }_i^2}^{\infty }\frac{{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\mathsf{R}\parallel \mathbf{Z}\parallel }{s}\right)\right]}{s^2}\mathrm{d}s.\end{array}$$

(81)

Now, note that by using the definition of $\Xi (\mathbf{x};P_{{\mathbf{X}}_{\mathsf{R}}})$ in (30), (78), and (81) we have that for $\parallel \mathbf{x}\parallel =\mathsf{R}$

$$\begin{array}{cc}\hfill \Xi (\mathbf{x};P_{{\mathbf{X}}_{\mathsf{R}}})& =\mathsf{D}(P_{\mathbf{x}+\sqrt{{\sigma }_1^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_1^2}\mathbf{Z}})-\mathsf{D}(P_{\mathbf{x}+\sqrt{{\sigma }_2^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_2^2}\mathbf{Z}})\hfill \end{array}$$

(82)

$$\begin{array}{cc}\hfill & =\frac{1}{2}{\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{{\mathsf{R}}^2-{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]}{s^2}\mathrm{d}s,\hfill \end{array}$$

(83)

and

$$\begin{array}{cc}\hfill \Xi (\mathbf{0};P_{{\mathbf{X}}_{\mathsf{R}}})& =\mathsf{D}(P_{\mathbf{0}+\sqrt{{\sigma }_1^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_1^2}\mathbf{Z}})-\mathsf{D}(P_{\mathbf{0}+\sqrt{{\sigma }_2^2}\mathbf{Z}}\parallel P_{{\mathbf{X}}_{\mathsf{R}}+\sqrt{{\sigma }_2^2}\mathbf{Z}})\hfill \end{array}$$

(84)

$$\begin{array}{cc}\hfill & =\frac{1}{2}{\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]}{s^2}\mathrm{d}s\hfill \end{array}$$

(85)

Consequently, the necessary and sufficient condition in Theorem 2 can be equivalently written as

$$\begin{array}{cc}\hfill & {\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)+{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]-1}{s^2}\mathrm{d}s\le 0.\hfill \end{array}$$

(86)

Now ${\overline{\mathsf{R}}}_n({\sigma }_1^2,{\sigma }_2^2)$ will be the largest $\mathsf{R}$ that satisfies (86), which concludes the proof of Theorem 3.

7. Proof of Theorem 4

The objective of the proof is to understand how the condition in (45) behaves as $n\to \infty$. To study the large n behavior, we need to the following bounds on the ${\mathsf{h}}_{\nu }$ [39,40]: for $\nu >\frac{1}{2}$

$$\begin{array}{c}\hfill {\mathsf{h}}_{\nu }\left(x\right)=\frac{x}{\frac{2\nu -1}{2}+\sqrt{\frac{{(2\nu -1)}^2}{4}+x^2}}·g_{\nu }\left(x\right),\end{array}$$

(87)

where

$$\begin{array}{c}\hfill 1\ge g_{\nu }\left(x\right)\ge \frac{\frac{2\nu -1}{2}+\sqrt{\frac{{(2\nu -1)}^2}{4}+x^2}}{\nu +\sqrt{{\nu }^2+x^2}}.\end{array}$$

(88)

Now let $\mathsf{R}=c\sqrt{n}$ for some $c>0$. The goal is to understand the behavior of

$$\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)+{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]$$

(89)

as n goes to infinity. First, let

$$\begin{array}{c}\hfill V_n=\frac{\parallel \mathbf{Z}\parallel }{\sqrt{n}},\end{array}$$

(90)

and note that

$$\begin{array}{cc}\hfill \underset{n\to \infty }{lim}\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \sqrt{s}\mathbf{Z}\parallel c\sqrt{n}}{s}\right)\right]& =\underset{n\to \infty }{lim}\mathbb{E}\left[{\left(\frac{\frac{c{V}_n}{\sqrt{s}}}{\frac{n-1}{2n}+\sqrt{\frac{{(n-1)}^2}{4n^2}+{\left(\frac{c{V}_n}{\sqrt{s}}\right)}^2}}·g_{\frac{n}{2}}\left(\frac{c{V}_n}{\sqrt{s}}n\right)\right)}^2\right]\hfill \end{array}$$

(91)

$$\begin{array}{cc}\hfill & =\mathbb{E}\left[\underset{n\to \infty }{lim}{\left(\frac{\frac{c{V}_n}{\sqrt{s}}}{\frac{n-1}{2n}+\sqrt{\frac{{(n-1)}^2}{4n^2}+{\left(\frac{c{V}_n}{\sqrt{s}}\right)}^2}}·g_{\frac{n}{2}}\left(\frac{c{V}_n}{\sqrt{s}}n\right)\right)}^2\right]\hfill \end{array}$$

(92)

$$\begin{array}{cc}\hfill & =\frac{c^2}{{\left(\frac{\sqrt{s}}{2}+\sqrt{\frac{s}{4}+c^2}\right)}^2},\hfill \end{array}$$

(93)

where (92) follows from the dominated convergence theorem, and (93) follows since, by the law of large numbers we have, almost surely,

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}{V}_n^2=\underset{n\to \infty }{lim}\frac{1}{n}\sum _{i=1}^n{Z}_i^2=\mathbb{E}\left[Z^2\right]=1.\end{array}$$

(94)

Second, let

$$\begin{array}{c}\hfill W_n=\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel }{\sqrt{n}},\end{array}$$

(95)

where, without loss of generality, we take $\mathbf{x}=[\mathsf{R},0,\dots ,0]$

$$\begin{array}{cc}\hfill \underset{n\to \infty }{lim}\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathbf{x}+\sqrt{s}\mathbf{Z}\parallel c\sqrt{n}}{s}\right)\right]& =\underset{n\to \infty }{lim}\mathbb{E}\left[{\left(\frac{\frac{c{W}_n}{s}·g_{\frac{n}{2}}\left(\frac{c{W}_n}{s}n\right)}{\frac{n-1}{2n}+\sqrt{\frac{{(n-1)}^2}{4n^2}+{\left(\frac{c{W}_n}{s}\right)}^2}}\right)}^2\right]\hfill \end{array}$$

(96)

$$\begin{array}{cc}\hfill & =\mathbb{E}\left[\underset{n\to \infty }{lim}{\left(\frac{\frac{c{W}_n}{s}·g_{\frac{n}{2}}\left(\frac{c{W}_n}{s}n\right)}{\frac{n-1}{2n}+\sqrt{\frac{{(n-1)}^2}{4n^2}+{\left(\frac{c{W}_n}{s}\right)}^2}}\right)}^2\right]\hfill \end{array}$$

(97)

$$\begin{array}{cc}\hfill & =\frac{c^2(c^2+s)}{{\left(\frac{s}{2}+\sqrt{\frac{s^2}{4}+c^2(c^2+s)}\right)}^2},\hfill \end{array}$$

(98)

where (97) follows from the dominated convergence theorem and where (98) follows since, by the strong law of large numbers we have, almost surely,

$$\begin{array}{cc}\hfill \underset{n\to \infty }{lim}{W}_n^2& =\underset{n\to \infty }{lim}\frac{1}{n}{(\sqrt{s}{Z}_1+c\sqrt{n})}^2+s\underset{n\to \infty }{lim}\frac{1}{n}\sum _{i=2}^n{Z}_i^2\hfill \end{array}$$

(99)

$$\begin{array}{cc}\hfill & =c^2+s.\hfill \end{array}$$

(100)

Combining (93) and (98) with (45), we arrive at

$$\begin{array}{cc}\hfill & {\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{\frac{c^2}{{\left(\frac{\sqrt{s}}{2}+\sqrt{\frac{s}{4}+c^2}\right)}^2}+\frac{c^2(c^2+s)}{{\left(\frac{s}{2}+\sqrt{\frac{s^2}{4}+c^2(c^2+s)}\right)}^2}-1}{s^2}\mathrm{d}s=0.\hfill \end{array}$$

(101)

8. Proof of Theorem 5

8.1. Implicit Upper Bound

A consequence of the KKT conditions of Lemma 1 is the inclusion

$$\mathsf{supp}\left(P_{{\mathbf{X}}^{★}}\right)\subseteq \left\{x\in [-\mathsf{R},\mathsf{R}]:\Xi \left(x\right)-C_s=0\right\}$$

(102)

which suggests the following upper bound on the number of support points of $P_{{\mathbf{X}}^{★}}$:

$$\begin{array}{cc}\hfill \left|\mathsf{supp}\right(P_{{\mathbf{X}}^{★}}\left)\right|& \le \mathrm{N}\left([-\mathsf{R},\mathsf{R}],\Xi \left(x\right)-C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},1)\right)\hfill \end{array}$$

(103)

$$\begin{array}{cc}\hfill & =\mathrm{N}\left([-\mathsf{R},\mathsf{R}],\mathbb{E}\left[g\left(Y_1\right)+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s|X=x\right]\right)\hfill \end{array}$$

(104)

$$\begin{array}{cc}\hfill & \le \mathcal{S}\left(g(·)+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s\right)\hfill \end{array}$$

(105)

$$\begin{array}{cc}\hfill & \le \mathrm{N}\left(\mathbb{R},g(·)+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s\right)\hfill \end{array}$$

(106)

$$\begin{array}{cc}\hfill & =\mathrm{N}\left([-L,L],g(·)+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s\right)\hfill \end{array}$$

(107)

$$\begin{array}{cc}\hfill & <\infty ,\hfill \end{array}$$

(108)

where (104) follows from using (21); (105) follows from applying Karlin’s oscillation Theorem 1 and the fact that the Gaussian pdf is a strictly totally positive kernel, which was shown in [26]; (107) is proved in Lemma A3 in the Appendix B; and (108) follows because $g(·)$ is an analytic function in $(-L,L)$. The implicit upper bound (49) of Theorem 5 follows from (107) and (108).

8.2. Explicit Upper Bound

The key to finding an explicit upper bound on the number of zeros will be the following complex-analytic result.

Lemma 3

(Tijdeman’s Number of Zeros Lemma [41]). Let $L,s,t$ be positive numbers, such that $s>1$. For the complex valued function $f\ne 0$, which is analytic on $\left|z\right|<(st+s+t)L$, its number of zeros $\mathrm{N}({\mathcal{D}}_L,f)$ within the disk ${\mathcal{D}}_L=\{z:|z|\le L\}$ satisfies

$$\begin{array}{cc}\hfill \mathrm{N}({\mathcal{D}}_L,f)& \le \frac{1}{logs}\left(log\underset{\left|z\right|\le (st+s+t)L}{max}\left|f\left(z\right)\right|-log\underset{\left|z\right|\le tL}{max}\left|f\left(z\right)\right|\right).\hfill \end{array}$$

(109)

Furthermore, the following loosened version of the implicit upper bound in (49) will be useful.

Lemma 4.

$$\begin{array}{cc}\hfill \left|\mathsf{supp}\right(P_{{\mathbf{X}}^{★}}\left)\right|& \le \mathrm{N}\left([-L,L],h(·)\right)+1\hfill \end{array}$$

(110)

where

$$\begin{array}{cc}\hfill \frac{h\left(y\right)}{{\sigma }_1^2{f}_{Y_1}\left(y\right)}& =\frac{{\mathbb{E}}_N\left[\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_2=y+N]\right]-y}{{\sigma }_2^2}-\frac{\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_1=y]-y}{{\sigma }_1^2}\hfill \end{array}$$

(111)

$$\begin{array}{cc}\hfill & =\frac{\mathbb{E}\left[Nlog{f}_{Y_2}(y+N)\right]}{{\sigma }_2^2-{\sigma }_1^2}-\frac{\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_1=y]-y}{{\sigma }_1^2},\hfill \end{array}$$

(112)

and where $N\sim \mathcal{N}(0,{\sigma }_2^2-{\sigma }_1^2)$.

Proof. 

Starting from (107), we can write

$$\begin{array}{cc}\hfill \left|\mathsf{supp}\right(P_{{\mathbf{X}}^{★}}\left)\right|& \le \mathrm{N}\left([-L,L],g(·)+log\left(\frac{{\sigma }_2}{{\sigma }_1}\right)-C_s\right)\hfill \end{array}$$

(113)

$$\begin{array}{cc}\hfill & \le \mathrm{N}\left([-L,L],g^{\prime }(·)\right)+1\hfill \end{array}$$

(114)

$$\begin{array}{cc}\hfill & =\mathrm{N}\left([-L,L],{\sigma }_1^2{f}_{Y_1}(·)g^{\prime }(·)\right)+1\hfill \end{array}$$

(115)

where in step (114), we applied Rolle’s theorem, and in step (115), we used the fact that multiplying by a strictly positive function (i.e., ${\sigma }_1^2{f}_{Y_1}$) does not change the number of zeros. The first derivative of g can be computed as follows:

$$\begin{array}{cc}\hfill g^{\prime }\left(y\right)& =\mathbb{E}\left[\frac{\mathrm{d}}{\mathrm{d}y}log{f}_{Y_2}(y+N)\right]-\frac{\mathrm{d}}{\mathrm{d}y}log{f}_{Y_1}\left(y\right)\hfill \end{array}$$

(116)

$$\begin{array}{cc}\hfill & =\frac{{\mathbb{E}}_N\left[\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_2=y+N]\right]-y}{{\sigma }_2^2}-\frac{\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_1=y]-y}{{\sigma }_1^2},\hfill \end{array}$$

(117)

where in the last step, we used the well-known Tweedie’s formula (see for example [42,43]):

$$\mathbb{E}\left[{\mathbf{X}}^{★}\right|Y_i=y]=y+{\sigma }_i^2\frac{\mathrm{d}}{\mathrm{d}y}log{f}_{Y_i}\left(y\right).$$

(118)

An alternative expression for the first term in the right-hand side (RHS) of (116) is as follows:

$$\begin{array}{cc}\hfill \mathbb{E}\left[\frac{\mathrm{d}}{\mathrm{d}y}log{f}_{Y_2}(y+N)\right]& ={\int }_{-\infty }^{\infty }{f}_N\left(n\right)\frac{\mathrm{d}}{\mathrm{d}y}log{f}_{Y_2}(y+n)\mathrm{d}n\hfill \end{array}$$

(119)

$$\begin{array}{cc}\hfill & =-{\int }_{-\infty }^{\infty }\left(\frac{\mathrm{d}}{\mathrm{d}n}{f}_N\left(n\right)\right)·log{f}_{Y_2}(y+n)\mathrm{d}n\hfill \end{array}$$

(120)

$$\begin{array}{cc}\hfill & ={\int }_{-\infty }^{\infty }\frac{n}{{\sigma }_2^2-{\sigma }_1^2}{f}_N\left(n\right)·log{f}_{Y_2}(y+n)\mathrm{d}n\hfill \end{array}$$

(121)

$$\begin{array}{cc}\hfill & =\frac{1}{{\sigma }_2^2-{\sigma }_1^2}\mathbb{E}\left[Nlog{f}_{Y_2}(y+N)\right],\hfill \end{array}$$

(122)

where $f_N\left(n\right)={\varphi }_{\sqrt{{\sigma }_2^2-{\sigma }_1^2}}\left(n\right)$. The proof is concluded by letting

$$\begin{array}{c}\hfill h\left(y\right)\triangleq {\sigma }_1^2{f}_{Y_1}\left(y\right)g^{\prime }\left(y\right).\end{array}$$

(123)

□

To apply Tijdeman’s number of zeros Lemma, upper and lower bounds to the maximum module of the complex analytic extension of h over the disk ${\mathcal{D}}_L=\{z:|z|\le L\}$ are proposed in Lemmas A4 and A5 in the Appendix B. Using those bounds, we can provide an upper bound on the number of mass points as follows:

$$\begin{array}{cc}\hfill & \mathrm{N}\left([-L,L],h(·)\right)\hfill \end{array}$$

$$\begin{array}{c}\hfill \le \mathrm{N}\left({\mathcal{D}}_L,\breve{h}(·)\right)\end{array}$$

(124)

$$\begin{array}{cc}\hfill & \le \underset{s>1,t>0}{min}\left\{\frac{log\frac{{max}_{\left|z\right|\le (st+s+t)L}\left|\breve{h}\left(z\right)\right|}{{max}_{\left|z\right|\le tL}\left|\breve{h}\left(z\right)\right|}}{logs}\right\}\hfill \end{array}$$

(125)

$$\begin{array}{cc}\hfill & \le log\frac{\frac{{\mathrm{e}}^{\frac{{(2\mathrm{e}+1)}^2{L}^2}{2{\sigma }_1^2}}}{\sqrt{2\pi {\sigma }_1^2}}\left(a_1{(2\mathrm{e}+1)}^2{L}^2+a_2(2\mathrm{e}+1)L+a_3\right)}{\left(c_{1}L-c_2\mathsf{R}\right)\frac{exp\left(-\frac{{(L+\mathsf{R})}^2}{2{\sigma }_1^2}\right)}{\sqrt{2\pi {\sigma }_1^2}}}\hfill \end{array}$$

(126)

$$\begin{array}{cc}\hfill & =\frac{{(2\mathrm{e}+1)}^2{L}^2}{2{\sigma }_1^2}+\frac{{(L+\mathsf{R})}^2}{2{\sigma }_1^2}+log\frac{a_1{(2\mathrm{e}+1)}^2{L}^2+a_2(2\mathrm{e}+1)L+a_3}{c_{1}L-c_2\mathsf{R}}\hfill \\ \hfill & =\frac{{(2\mathrm{e}+1)}^2{(d_1\mathsf{R}+d_2)}^2}{2{\sigma }_1^2}+\frac{{((d_1+1)\mathsf{R}+d_2)}^2}{2{\sigma }_1^2}\hfill \end{array}$$

(127)

$$\begin{array}{cc}\hfill & +log\frac{a_1{(2\mathrm{e}+1)}^2{(d_1\mathsf{R}+d_2)}^2+a_2(2\mathrm{e}+1)(d_1\mathsf{R}+d_2)+a_3}{(c_1{d}_1-c_2)\mathsf{R}+c_1{d}_2}\hfill \end{array}$$

(128)

$$\begin{array}{cc}\hfill & \le b_1\frac{{\mathsf{R}}^2}{{\sigma }_1^2}+b_2+log\frac{b_3{\mathsf{R}}^2+b_4\mathsf{R}+b_5}{b_6\mathsf{R}+b_7}\hfill \end{array}$$

(129)

$$\begin{array}{cc}\hfill & \le b_1\frac{{\mathsf{R}}^2}{{\sigma }_1^2}+O(log\left(\mathsf{R}\right)),\hfill \end{array}$$

(130)

where (124) follows because extending to a larger domain can only increase the number of zeros; (125) follows from the Tijdeman’s Number of Zeros Lemma; (126) follows from choosing $s=\mathrm{e}$ and $t=1$ and using bounds in Lemmas A4 and A5; (128) follows from using the value of L in (A38); (129) using the bound ${(a+b)}^2\le 2(a^2+b^2)$ and defining

$$\begin{array}{cc}\hfill b_1& ={(2\mathrm{e}+1)}^2{d}_1^2+{(d_1+1)}^2\hfill \end{array}$$

(131a)

$$\begin{array}{cc}\hfill & ={(2\mathrm{e}+1)}^2{\left(\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}\right)}^2+{\left(\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}+1\right)}^2\hfill \end{array}$$

(131b)

$$\begin{array}{cc}\hfill b_2& =\frac{({(2\mathrm{e}+1)}^2+1)d_2^2}{{\sigma }_1^2}\hfill \end{array}$$

(131c)

$$\begin{array}{cc}\hfill & =\frac{({(2\mathrm{e}+1)}^2+1)}{{\sigma }_1^2}\frac{\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}+2C_s}{\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}}\hfill \end{array}$$

(131d)

$$\begin{array}{cc}\hfill & =({(2\mathrm{e}+1)}^2+1)\left(1+2\frac{{\sigma }_2^2}{{\sigma }_2^2-{\sigma }_1^2}{C}_s\right)\hfill \end{array}$$

(131e)

$$\begin{array}{cc}\hfill b_3& =2{(2\mathrm{e}+1)}^2{a}_1{d}_1^2\hfill \end{array}$$

(131f)

$$\begin{array}{cc}\hfill & =2{(2\mathrm{e}+1)}^2\frac{3{\sigma }_1^2}{{\sigma }_2^2\sqrt{{\sigma }_2^2-{\sigma }_1^2}}{\left(\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}\right)}^2\hfill \end{array}$$

(131g)

$$\begin{array}{cc}\hfill b_4& =(2\mathrm{e}+1)d_1{a}_2\hfill \end{array}$$

(131h)

$$\begin{array}{cc}\hfill & =(2\mathrm{e}+1)\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}\left(\frac{\sqrt{2}{\sigma }_1^2}{\sqrt{{\sigma }_2^2}\sqrt{{\sigma }_2^2-{\sigma }_1^2}}+2\right)\hfill \end{array}$$

(131i)

$$\begin{array}{cc}\hfill b_5& =2{(2\mathrm{e}+1)}^2{a}_1{d}_2^2+(2\mathrm{e}+1)a_2{d}_2+a_3\hfill \\ \hfill & =2{(2\mathrm{e}+1)}^2\frac{3{\sigma }_1^2}{{\sigma }_2^2\sqrt{{\sigma }_2^2-{\sigma }_1^2}}\left(\frac{\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}+2C_s}{\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}}\right)\hfill \\ \hfill & +(2\mathrm{e}+1)\left(\frac{\sqrt{2}{\sigma }_1^2}{\sqrt{{\sigma }_2^2}\sqrt{{\sigma }_2^2-{\sigma }_1^2}}+2\right)\sqrt{\frac{\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}+2C_s}{\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}}}\hfill \end{array}$$

(131j)

$$\begin{array}{cc}\hfill & +\frac{{\sigma }_1^2}{\sqrt{{\sigma }_2^2-{\sigma }_1^2}}·\sqrt{|log\left(2\pi {\sigma }_2^2\right){|}^2+\frac{24{({\sigma }_2^2-{\sigma }_1^2)}^2}{{\sigma }_2^4}+{\pi }^2}\hfill \end{array}$$

(131k)

$$\begin{array}{cc}\hfill b_6& =c_1{d}_1-c_2\hfill \end{array}$$

(131l)

$$\begin{array}{cc}\hfill & =\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}\frac{{\sigma }_2+{\sigma }_1}{{\sigma }_2-{\sigma }_1}-\frac{{\sigma }_2^2+{\sigma }_1^2}{{\sigma }_2^2}=2\frac{{\sigma }_1}{{\sigma }_2}\hfill \end{array}$$

(131m)

$$\begin{array}{cc}\hfill b_7& =c_1{d}_2\hfill \end{array}$$

(131n)

$$\begin{array}{cc}\hfill & =\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}\sqrt{\frac{\frac{{\sigma }_2^2-{\sigma }_1^2}{{\sigma }_2^2}+2C_s}{\frac{1}{{\sigma }_1^2}-\frac{1}{{\sigma }_2^2}}};\hfill \end{array}$$

(131o)

and (130) follows from the fact that the $b_1,b_3,b_4$, and $b_6$ coefficients do not depend on $\mathsf{R}$ and the fact that the coefficients $b_2,b_5$, and $b_4$, while they do depend on $\mathsf{R}$ through $C_s$, do not grow with $\mathsf{R}$. The fact that $C_s$ does not grow with $\mathsf{R}$ follows from the bound in (69).

Finally, the explicit upper bound on the number of support points of $P_{X^{★}}$ in (52) is a consequence of (130).

9. Proof of Theorem 6

Using the KKT conditions in (28), we have that for $\mathbf{x}=[\mathsf{R},0,\dots ,0]$

$$\begin{array}{cc}\hfill C_s({\sigma }_1^2,{\sigma }_2^2,\mathsf{R},n)& =\Xi (\mathbf{x};P_{{\mathbf{X}}_{\mathsf{R}}})\hfill \end{array}$$

(132)

$$\begin{array}{cc}\hfill & =\mathsf{D}(f_{{\mathbf{Y}}_1|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_1^{★}})-\mathsf{D}(f_{{\mathbf{Y}}_2|\mathbf{X}}(·|\mathbf{x})\parallel f_{{\mathbf{Y}}_2^{★}})\hfill \end{array}$$

(133)

$$\begin{array}{cc}\hfill & =\frac{1}{2}{\int }_{{\sigma }_1^2}^{{\sigma }_2^2}\frac{{\mathsf{R}}^2-{\mathsf{R}}^2\mathbb{E}\left[{\mathsf{h}}_{\frac{n}{2}}^2\left(\frac{\parallel \mathsf{R}+\sqrt{s}\mathbf{Z}\parallel \mathsf{R}}{s}\right)\right]}{s^2}\mathrm{d}s\hfill \end{array}$$

(134)

where the last expression was computed in (83). This concludes the proof.

10. Conclusions

This paper has focused on the secrecy capacity of the n-dimensional vector Gaussian wiretap channel under the peak power (or amplitude constraint) in a so-called low (but not vanishing) amplitude regime. In this regime, the optimal input distribution $P_{{\mathbf{X}}_{\mathsf{R}}}$ is supported on a single n-dimensional sphere of radius $\mathsf{R}$. The paper has identified the largest ${\overline{\mathsf{R}}}_n$, such that the distribution $P_{{\mathbf{X}}_{\mathsf{R}}}$ is optimal. In addition, the asymptotic of ${\overline{\mathsf{R}}}_n$ has been completely characterized as dimension n approaches infinity. As a by-product of the analysis, the capacity in the low-amplitude regime has also been characterized in a more or less closed form. The paper has also provided a number of supporting numerical examples. Implicit and explicit upper bounds have been proposed on the number of mass points for the optimal input distribution $P_{{\mathbf{X}}^{★}}$ in the scalar case with $n=1$.

There are several interesting future directions. For example, one interesting direction would be to determine a regime in which a mixture of a mass point at zero and $P_{{\mathbf{X}}_{\mathsf{R}}}$ is optimal. It would also be interesting to establish a lower bound on the number of mass points in the support of the optimal input distribution when $n=1$. We note that such a lower bound was obtained for a point-to-point channel in [30]. We finally remark that the extension of the results of this paper to nondegraded wiretap channels is not trivial and also constitutes an interesting but ambitious future direction.