Two parity checks can filter errors in paired-state quantum keys

Quantum key distribution aims to establish shared secret keys, but matching the users’ data and limiting an eavesdropper’s knowledge are separate requirements. A filter that improves agreement does not necessarily improve secrecy or the final number of usable key bits.

In an arXiv preprint submitted on 9 November 2026, Luis Adrián Lizama-Pérez and José Mauricio López-Romero investigate this distinction for paired-state Loop-Back quantum key distribution. Their theoretical analysis identifies two public parity checks that can substantially reduce errors under an independent-error model. It does not report an experimental demonstration of the proposed device.

A round trip with information in missing clicks

The architecture divides the optical work between a fixed station, Alice, and a lightweight portable terminal, Bob. Alice prepares two time-separated pulses encoded in polarization. Bob independently selects a polarization filter for each pulse and returns whatever passes through. His two private filter settings form a two-bit record.

Alice estimates those settings from the returned detection pattern and her preparation choices. In the ideal, lossless, basis-matched model, a missing click indicates that Bob blocked the photon. In a real channel, however, accidental loss can also produce a missing click, causing Alice to infer the wrong setting.

The baseline analysis retains all basis-matched records, including records with no return clicks. Those outcomes are therefore part of the protocol, not automatically discarded failures.

Checking blocks instead of correcting bits

The proposed filter groups three two-bit records into a six-bit block. For each record, parity indicates whether its two bits are equal or different. Bob publicly announces two comparisons: one between the first and second record parities, and another between the second and third. Alice calculates the corresponding comparisons from her estimates.

If either comparison disagrees, the entire block is discarded. If both agree, all six bit positions are retained. This selection process is called advantage distillation; it does not locate or repair individual errors.

The authors show that adding a third comparison to close the three-record path into a triangle changes no acceptance decisions. That closing comparison follows algebraically from the other two. More generally, a connected graph needs only a spanning tree—a connected set of edges without cycles—to impose the same acceptance condition, assuming all checks are delivered and verified.

Passing nevertheless does not establish agreement. Flipping both bits within one record leaves its parity unchanged, so that error escapes every graph check.

Lower errors, fewer retained blocks

For independent errors with probability e in every bit, the authors derive exact acceptance and residual-error formulas. For small e, three-record blocks have a residual bit-error probability whose leading term is e², rather than e. Two-record blocks also give quadratic suppression, but with a leading term of 3e². Three records are thus the smallest connected block achieving the unit coefficient—not a proven optimum for secret-key production.

At an input bit-error probability of 10%, the three-record filter retains about 55.72% of blocks and leaves approximately 1.73% erroneous bit positions among those retained. The authors report checking their formulas using exhaustive enumeration and simulations.

The independence assumption matters. If errors always flip both bits of a record together, every block passes and the bit-error rate remains unchanged. Larger connected blocks can also sacrifice more data without necessarily improving the eventual secret-key rate.

What the security result establishes

The paper supplies a conditional security theorem that allows an eavesdropper to hold arbitrary quantum side information. Given an independently justified bound on her ability to guess the original block, it bounds her guessing ability after the two checks and acceptance announcement. The filter cannot supply that starting bound from the observed error rate alone.

A separate calculation provides positive entropy results for a restricted channel: single-photon emissions, ideal filters, independent passive tapping and no injected adversarial light. These assumptions do not follow simply from measured optical loss. Active probing or unintended output modes require additional characterization and security analysis.

Accepted strings still need reconciliation, equality verification and privacy amplification. Discarded blocks, public disclosures and finite-size costs must all enter a complete comparison with processing that omits the filter.

Combining filtering with established reconciliation methods, and extending the station to support keys between two portable users, remain proposed research directions. The demonstrated result is a precisely characterized selection rule, not a generally certified secure mobile quantum network.