Optimizing state-discrimination receivers for continuous-variable quantum key distribution over a wiretap channel

We address a continuous-variable quantum key distribution protocol employing quaternary phase-shift-keying of coherent states and a non-Gaussian measurement inspired by quantum receivers minimizing the error probability in a quantum-state-discrimination scenario. We consider a pure-loss quantum wiretap channel, in which a possible eavesdropper is limited to collect the sole channel losses. We perform a characterization of state-discrimination receivers and design an optimized receiver maximizing the asymptotic secure key rate (SKR), namely the key-rate optimized receiver (KOR), comparing its performance with respect to the pretty good measurement and the heterodyne-based protocol. We show that the KOR increases the SKR for metropolitan-network distances. Finally, we also investigate the implementations of feasible schemes, such as the displacement feed-forward receiver, obtaining an increase in the SKR in particular regimes.


Introduction
Quantum key distribution (QKD) is the art of sharing a secure key between two distant parties in the presence of an untrusted channel [1][2][3][4].In a QKD scenario, a transmitter (Alice) sends quantum states through a quantum channel to a receiver (Bob), who performs a suitable measurement to extract a set of correlated data.The security of this scheme against any potential attack by an eavesdropper (Eve) is guaranteed by the laws of quantum mechanics [5,6].
On the other hand, in many other frameworks non-Gaussian measurements often outperform Gaussian ones, and this makes it interesting to investigate their role also for CV-QKD.A relevant example is provided by quantum state discrimination theory, in which Alice encodes information onto non-orthogonal states and the task is to design an efficient receiver minimizing the error probability of Bob's decision [30][31][32][33][34].This optimal receiver has been shown to be non-Gaussian, whereas Gaussian receivers are limited by the so-called shot noise limit (SNL) [32].However, deriving the optimum measurement is rather cumbersome as it requires convex semidefinite programming [32,35,36].As a consequence, there have also been developed suboptimal methods such as the pretty good measurement (PGM) method, which provides an upper bound to the minimum error probability and still beats the SNL [32,37,38].Finally, feasible receivers have been proposed for both binary [39][40][41][42] and quaternary [43][44][45][46] coherent-state discrimination, exploiting linear optics and photodetection, thus being easier to implement into practice.Beside quantum communications, in the existing literature state-discrimination receivers have also been investigated for CV-QKD [47].
In this paper, we propose a new quantum state-discrimination receiver for CV-QKD, namely, the key-rate optimized receiver (KOR).In more detail, we consider a CV-QKD protocol employing a quaternary phase-shift-keying (QPSK) modulation of coherent states [15,[19][20][21][22][23]25] in which Bob implements the KOR rather than a Gaussian measurement.We compute the secure key rate (SKR), that is, the asymptotic length of the secret key per unit time slot, assuming a quantum wiretap channel [48][49][50], which represents a realistic paradigm for many different situations, e.g.free-space optical communications [51].For the sake of simplicity, we consider a pure-loss channel, in order to deal with discrimination of pure states at Bob's side.This latter assumption depicts a simplified scenario, providing a cornerstone fostering more advanced developments.We design the KOR to maximize the SKR of the addressed protocol and compare it with the PGM, showing that both these non-Gaussian measurements improve the SKR in the metropolitan-network distance regime with respect to the heterodyne-based protocol.We also investigate the performance of some feasible quantum receivers, by considering the feed-forward displacement receiver proposed in [43].
The structure of the paper is the following.First, in Section 2 we briefly outline the general structure of quantum state-discrimination receivers that will be employed throughout the work.Thereafter, Section 3 presents the scheme of the protocol under investigation and describes the construction of the KOR.Then, in Section 4 we compare the performance of the designed receiver with the same protocol employing heterodyne detection, whereas in Section 5 we compute the SKR for the feed-forward displacement receiver.Finally, in Section 6 we summarize the results and draw some conclusions and outlooks.

General structure of a state-discrimination receiver
In this paper, we investigate the potentiality of state-discrimination receivers for secure quantum communications and propose a new quantum receiver, the KOR, for CV-QKD protocols employing discrete modulation.To begin with, in this section, we present the general structure of a state-discrimination receiver within the framework of quantum state discrimination theory, or quantum decision theory [32][33][34][35][36][37][38].
Generally speaking, we have a source emitting M non-orthogonal linearly independent quantum states {|γ k ⟩} k , k = 0, . . ., M − 1, with a priori probabilities q k , 0 ≤ q k ≤ 1, and the task is to design a quantum receiver.That is, we look for a positiveoperator-valued measure (POVM) {Π j } j , j = 0, . . ., M − 1, Π j ≥ 0 and j Π j = 1, 1 being the identity operator over the whole Hilbert space, such that registering the outcome j infers the state generated by the source to be |γ j ⟩.When the outcome j is obtained, we underline that the receiver makes the decision j even if the state k ̸ = j was sent, resulting in a decision error.
For the decision between pure states, the Kennedy theorem [32,39] proves an optimum POVM to be 1-rank, namely, Π j = |µ j ⟩⟨µ j |, expressed in terms of a set of measurement vectors {|µ j ⟩} j .As a consequence, the problem may be recast into a geometric optimization task.Indeed, we introduce the state and measurement (row) matrices respectively.Moreover, it is not restrictive to reduce the problem to the M dimensional subspace spanned by the encoded states, S = span{|γ k ⟩ : k = 0, . . ., M − 1} [32,52].Accordingly, the measurement vectors are expressible as a linear combination of the state vectors, with A being an M × M matrix with coefficients (a kj ) k,j .The identity resolution constraint now becomes j Π j = P S , P S being the projection operator onto subspace S.
In turn, the conditional probability of obtaining outcome j if the k-th state is probed is given by where G being the M × M Gram matrix: that is the matrix of the overlaps between the encoded states.Thus, a quantum receiver is completely characterized by its corresponding matrix A, subject to the constraint guaranteeing the identity resolution of the resulting POVM, as derived in Appendix A. The scenario may be further simplified if the constellation of states {|γ k ⟩} k exhibits the geometric uniform symmetry (GUS) [32], namely if there exists a symmetry operator S such that In this case, we may safely assume also the measurement vectors to exhibit the GUS for the same operator S, thus the POVM {Π j } j is identified by a single "reference" measurement vector a k0 ∈ C, while all the others will be retrieved as |µ j ⟩ = S j |µ 0 ⟩, j = 0, . . ., M − 1.Consequently, A is a circulant matrix, having the form which is diagonalizable by the unitary matrix U = F −1 , F = (e −i2πjk/M / √ M ) jk , j, k = 0, . . ., M − 1, being the discrete Fourier transform matrix [53].Its eigendecomposition is given by A = U ΛU † , where Λ = diag(λ 0 , . . ., λ M −1 ), is the diagonal matrix composed of the eigenvalues {λ j } j of A. Furthermore, circulant matrices form a commutative algebra [53], thus A † is also circulant and [A, A † ] = 0. Thereby, A † = U Λ † U † and Equation ( 6) becomes: where ).We conclude that A and G −1 are simultaneously diagonalizable and |λ j | 2 = g −1 j , {g j } j being the eigenvalues of the Gram matrix (5) listed in increasing order, that is, g 0 ≥ g 1 ≥ . . .≥ g M −1 .In conclusion, the matrix A may be re-expressed in the following form: where and in which the relative phases ϕ = (ϕ 0 , . . ., ϕ M −1 ) provide the only free parameters.Furthermore, the matrix A ϕ is defined up to an overall phase due to (2), therefore we may fix ϕ 0 = 0, ending up with M − 1 phases whose value can be arbitrarily chosen.We conclude that, in the presence of GUS, every quantum receiver is ultimately identified by the set of phases ϕ, which may be properly chosen to optimize a desired figure of merit, according to the context under investigation.In the existing literature, the typical figure of merit of quantum discrimination theory is the error probability representing the probability of inferring a symbol j ̸ = k if the k-th state is sent.In this case, the optimal matrix A minimizing (14) may be retrieved via convex semidefinite programming [32,35,36].Alternatively, simpler suboptimal schemes have been proposed, providing an upper bound of the minimum error probability.The most relevant is the PGM method [32,37,38], leading to a suboptimal POVM which coincides with the optimal measurement for constellations exhibiting GUS [32].The matrix A for the PGM reads: which may be retrieved from (11) by setting all phases to zero, ϕ = (0, . . ., 0).In the following section, we discuss a different approach and adopt a quantum receiver described by (11) to maximize the SKR of the four-state CV-QKD protocol, optimizing the free phases to design the optimized discrete receiver for CV-QKD, namely, the KOR.

CV-QKD with state-discrimination receivers over a wiretap channel
As mentioned in the previous section, we design the KOR to optimize the SKR of the four-state protocol depicted in Figure 1, in which the sender, Alice, employs the QPSK modulation.The latter is a special case of phase-shift keying (PSK) modulation in which information is encoded in one of M coherent states where α ≥ 0, generated with equal a priori probabilities q k = 1/M .That is, the PSK constellation is composed of M coherent states with the same energy α 2 and phaseshifted by θ = 2π/M ; therefore, it satisfies the GUS for the phase-shift symmetry operator S θ = exp(−i θ n), n being the photon-number quantum operator [32].The QPSK is a special case of PSK with M = 4.
After the modulation stage, Alice injects the signals into an untrusted quantum channel and the receiver, Bob, probes the received pulses via a state-discrimination receiver, namely, a finite-valued POVM {Π j } j with the properties described in Section 2. However, already existing protocols [10-15, 17-19, 22] usually assume Gaussian POVMs at the receiver, either homodyne or heterodyne detection, and unconditional security proofs are guaranteed only for Gaussian measurements [27][28][29].In fact, under the unconditional security paradigm, one considers the most powerful eavesdropping attack, where an eavesdropper, Eve, performs any arbitrary channel manipulation that preserves the local statistics at Alice's and Bob's sides.Physical layer security is then addressed via a constrained functional optimization over all possible channels, leading to the Devetak-Winter (DW) bound [54].This task has been obtained for protocols employing Gaussian measurements under the assumption of either a linear [15] or nonlinear channel [19], thanks to the optimality of Gaussian attacks [27][28][29].Recently, a tight lower bound to the DW bound has also been obtained via nonlinear convex optimization algorithms and without invoking Gaussian optimality [20].
Nevertheless, in practical scenarios it is justified to address physical layer security under a wider set of assumptions, including restricted eavesdropping [50] and different trust levels of the infrastructure [55], computing the SKR under the so-called composable security paradigm.For instance, in a typical satellite QKD attack, Eve intercepts a part of the signal not being captured by Bob's telescope [56].Similarly, in the fiber based protocols we may assume an attack to be performed without breaking the structure of the fiber to implement arbitrary signal manipulation.In the recent literature, secure key distillation in these practical conditions is gaining much interest, with particular reference to wiretap channels [50] modeling the previous realistic assumptions, and passive eavesdropping [57,58], which have also been tested experimentally [62].
Given the present scenario, CV-QKD with non-Gaussian measurements still remains an open problem since the Gaussian optimality theorem does not hold anymore, and the DW bound can only be directly evaluated with the advanced methods presented in [20].In light of this, here we start from scratch and address composable security, by considering a quantum wiretap channel [48][49][50].In this scenario, we consider a restricted eavesdropping strategy where Eve may only collect the lost fraction of the encoded signals without performing arbitrary channel manipulation.Once again, we remark that this represents a realistic scenario which is worth of interest for practical conditions, but does not guarantee unconditional security.In turn, the purpose of our research is to show that, in particular conditions, it is possible to theoretically design a suitable measurement outperforming the conventional quadrature detection schemes.
Moreover, we also perform a further assumption and consider a pure-loss channel, described as a beam splitter with transmissivity d being the transmission distance (expressed in km) and κ = 0.2 dB/km is the loss rate of common fibers at telecom wavelength [63][64][65][66][67].This case is worth of investigation for a twofold reason.At first, in the recent literature there has been a revived interest in passive eavesdropping strategies [51,[57][58][59][60][61].Secondly, passive eavesdropping can be used as the first stepping stone to identify scenarios where a potential advantage of quantum receivers may be substantial, even in the possible presence of nonzero excess noise.Provided these two assumptions, in the following we construct the optimized POVM that describes the KOR, and show it to bring advantages in some particular regimes.
In the presence of a pure-loss quantum wiretap channel, if Alice generates the state |α k ⟩, the transmitted fraction |α 1. Accordingly, the dimensional reduction holds [32,52], and we restrict our attention to the M -dimensional subspace spanned by the transmitted pulses, namely, S = span{|α (t) k ⟩ : k = 0, . . ., M − 1} and apply the results of Section 2.
To form a truly identity-resolving set, the POVM elements {Π j } j , j = 0, . . ., M −1, shall be complemented with an (M + 1)-th inconclusive element Π M = 1 − P S , P S being the projection operator onto S. For the case under investigation, Π M is irrelevant, and we will neglect it in the following.However, this would not be true anymore in the presence of a channel excess noise; thus, registering a zero probability for this additional outcome may provide a useful way to check the reasonableness of the pure-loss hypothesis in a realistic implementation of the proposed protocol.

Construction of the KOR
In our protocol Bob shall employ an optimized POVM to perform discrimination among the transmitted pulses, described by the state vector Γ = (|α M −1 ⟩) and the Gram matrix: in which the overlap G lk = ⟨α k ⟩ reads [68]: The constellation of transmitted pulses maintains the GUS for the phase-shift operator S θ , thus the set of measurement vectors M = {|µ j ⟩} j , j = 0, . . ., M − 1, also satisfies the GUS, and the corresponding matrix A is in the form (11), according to the results of Section 2. The KOR is obtained by optimizing the phases ϕ to maximize the SKR, and is described by the optimized "reference" measurement vector: where a mod b is the modulo operation, returning the reminder of the division a/b, a, b ∈ Z, and {|n⟩} n is the photon-number basis.
Given the previous considerations, we compute the SKR of the discussed protocol, considering a reverse reconciliation scenario, which guarantees higher security in many existing protocols [10][11][12].Moreover, for the sake of simplicity, we perform the asymptotic key-rate calculation, where the channel parameters are known with no uncertainty.Under this paradigm, for a generic state-discrimination receiver described by the phase vector ϕ, the SKR reads: where I AB and χ BE are the mutual information between Alice and Bob and the Holevo information [69] between Bob and Eve, respectively, and β ≤ 1 is the reconciliation efficiency [15,17].The mutual information reads: where G being the Gram matrix (18), and are the conditional and overall probabilities of Bob's detection associated with outcome j = 0, . . ., M −1, respectively, and H[p(x)] = − x p(x) log 2 p(x) is the Shannon entropy of the probability distribution p(x).
To compute the Holevo information shared between Bob and Eve, that is the maximum amount of information accessible to Eve, we approach the problem in the prepare-&-measure picture [7,10,11] and obtain: where ρ E|j and ρ E are the conditional and overall Eve's state, respectively, p B (j) is Bob's probability distribution (25) and S[ρ] = − Tr[ρ log 2 ρ] represents the von Neumann entropy associated with state ρ.These two states may be retrieved from the joint state of Bob and Eve after the channel, that is: where ρ A = k q k |α k ⟩⟨α k | is Alice's overall state, |0⟩ is the vacuum state and U BS (T ) is unitary operator associated with a beam splitter with transmissivity T [9], as displayed in Figure 1.In turn, we have: and Tr B being the partial trace over Bob's mode and 1E being the identity operator over Eve's mode.Finally, the von Neumann entropy of states ( 28) and ( 29) may be computed with the methods outlined in Appendix B.
In our analysis, we are interested in the maximum achievable SKR as a function of the transmission distance d, therefore, in the end we will perform optimization over the free parameters, namely the phases ϕ and the constellation energy α 2 .The final, optimized, SKR is therefore equal to with the optimized phases and modulation energy denoted by ϕ KOR = (0, ϕ (KOR) 1

, . . . , ϕ (KOR)
M −1 ) and α 2 KOR .As a consequence, we define the KOR via Equation (11), as the quantum receiver associated with the optimized phase vector ϕ KOR .Furthermore, we compare the performance of the KOR with that associated with the PGM, for which the optimized SKR reads: with zero phases and the optimized energy α 2 PGM .The results obtained for the above two receivers are discussed in the following section, where we compare both SKRs with the key rate of the heterodyne-based protocol in order to highlight the advantages brought by the two non-Gaussian measurements.
The heterodyne-based protocol is analogous to the one discussed above and employs double homodyne detection at Bob's side, that is, a measurement of both field quadratures q and p, retrieving a pair of real outcomes x = (x B , y B ) ∈ R 2 .We underline that, while both the KOR and the PGM are described in terms of a finite-valued POVM with M possible outcomes, in the presence of heterodyne detection we have a continuousvariable measurement.Therefore, in this case Bob's conditional probability reads: σ 2 0 being the shot-noise variance [9], which from now on will be taken equal to 1, meaning, we perform calculations in shot-noise units (SNU).The obtained mutual information is, similarly as in (23), given by: with p B|α k (x).Instead, the Holevo information becomes: with ρ E given in (28) and The integration in (34) can been performed numerically by exploiting the Simpson's rule [70].Finally, the resulting SKR is obtained as with the optimized modulation energy α 2 het .As a final remark, towards a realistic implementation of the present protocol, we underline that both the KOR and the PGM may not represent appropriate POVMs for the channel evaluation stage.Indeed, assuming that the channel properties do not change, Alice and Bob must estimate the channel parameters, which in the present case is limited to the sole transmissivity T .However, unlike homodyne and heterodyne detection, in principle the designed POVM {Π j } j does not guarantee full channel characterization.This problem may be circumvented, at least for the asymptotic key rate calculation, by performing Gaussian detection on a small fraction of the exchanged pulses and reserving it for the channel estimation stage, whilst exploiting the non-Gaussian receiver only for the key extraction.On the contrary, in the presence of a finite-size scenario, Alice and Bob estimate the channel transmissivity T with a finite uncertainty ∆T , thus leaving more space for Eve's intervention.Therefore, they employ a conservative strategy and compute the SKR by considering a lower value of the transmissivity, namely T − ∆T .However, the main effect of this lower effective transmissivity is to reduce the range of distances for which the state-discrimination receivers outperforms the heterodyne protocol.Furthermore, the dataset for the key extraction is also finite, resulting in a lower SKR with respect to the asymptotic case.

Results
In this section, we compare the results derived previously.In Figure 2(a) we plot the SKRs (30), ( 31) and ( 36) as a function of the transmission distance d, expressed in km.The reconciliation efficiency is fixed to β = 0.95 [22,64,65].It can be seen in the plot that both PGM and KOR beat the heterodyne-based protocol, that is K p ≥ K het , p = PGM, KOR.The improvement in the SKR is more relevant for metropolitannetwork distances, in particular for d ≤ 100 km, whereas for larger ones both K KOR and K PGM approach K het and achieve the same asymptotic scaling.To quantify this improvement we compute the ratio reported in Figure 2(b).Both the ratios exhibit peaks for d ≤ 40 km and then decrease towards 1 in the long-distance regime, but the behaviour is rather different between the two cases.In fact, R PGM achieves a single maximum at ≈ 5 km, increasing the SKR with respect to K het by more than 42%, and then decays monotonously to 1. On the contrary, K KOR is not a monotonic function of the transmission distance and, in turn, the associated ratio exhibits two separated peaks.The KOR coincides with the PGM up to its first maximum, that is R KOR = R PGM for d ≲ 7 km, while for larger d we have R KOR ≥ R PGM .Thereafter, R KOR reaches a local minimum and then achieves a second maximum at ≈ 23 km, with ≈ 47% increase in the SKR.Ultimately, the curve decreases to 1, approaching the heterodyne-based protocol together with R PGM .The behavior of K KOR is a consequence of the resulting optimized phases ϕ (KOR) j , depicted in Figure 3(a).We recall that ϕ (KOR) 0 = 0 by definition.For d ≲ 7 km we have ϕ KOR = 0 and the optimized receiver is identical to the PGM, whereas for larger distances the optimized phases are nonzero and R KOR ≥ R PGM .Interestingly, for d ≳ 20 km the optimized phase tuple becomes distance-independent and reads ϕ KOR = (0, π/2, π, π/2).This choice allows to reach the second maximum in Figure 2(b), after which the KOR approaches the heterodyne-based protocol.For completeness, Figure 3(b) reports also the optimized energies α 2 p , p = PGM, KOR, and α 2 het .All curves converge to 0.5 average number of photons in the long-distance regime but, differently from the other cases, α 2 KOR shows the same non-monotonic trend of K KOR .The previous results prove non-Gaussian receivers as a potential tool for improving the key rate of the QPSK protocol, at least in the present composable security approach.Remarkably, they also highlight that the discrete-valued POVM minimizing the error probability, namely the PGM, does not coincide with the discrete-valued POVM maximizing the SKR, namely the KOR.The reason becomes evident when comparing separately the mutual and the Holevo information appearing in the SKR (22).In Figure 4 we plot the quantities I BE , p = PGM, KOR, computed with the same optimized energy and phases previously obtained and depicted in Figure 3.As we can see, in the metropolitan-network distance regime the optimized receiver is associated with a reduced mutual information with respect to the PGM but, at the same time, reducing the mutual information induces also a reduction of the Holevo information extractable by Eve, thus resulting in a SKR.As a consequence, differently from the state-discrimination scenario, in CV-QKD emerges a tradeoff between the goal of increasing the information accessible to Bob and the necessity of making the encoded symbols less "distinguishable" to weaken Eve's attack.
In light of this, we may interpret the physical meaning of the optimized phases as follows.For small transmission distances κd ≪ 1, Eve's intercepted signals are too weak to give her sufficient knowledge on which symbol was sent and the two different goals of reducing the error probability and maximizing the SKR are compatible, therefore the KOR coincides with the PGM.On the contrary, for larger d the compatibility does not hold anymore, and Bob has to sacrifice part of his potential information and to reduce the mutual information shared with Alice to the detriment of the eavesdropper.
The discussed tradeoff may be qualitatively appreciated by comparing the phasespace representations of the PGM and the KOR effects.More in detail, we consider the two reference measurement vectors |µ 0 ⟩ p , p = PGM, KOR, computed from (20) with the phases ϕ = 0 and ϕ = (0, π/2, π, π/2), respectively, and compute the associated Wigner function k ⟩.However, W (PGM) (x, y) is well concentrated around state |α (t) 0 ⟩, while W (KOR) (x, y) is more delocalized over the four states and the peaks are less distinguishable.This implies a reduced distinguishability of the states and, in turn, a reduced mutual information I (KOR) AB .On the contrary, when the distance is larger, e.g.d = 100 km, the transmitted states are weak coherent states with a greater overlap between one another.As a consequence, W (p) (x, y) for respective receivers are equally delocalized over the four peaks and the differences between PGM Figure 6.Scheme of the displacement feed-forward receiver proposed in [43].The incoming signal |α k ⟩ is split into N copies.Each copy m = 1, . . ., N undergoes a conditional displacement D(−α jm / √ N ) followed by on-off detection.For the first copy we have j 1 = 0.For the others, the outcome of the (m − 1)-th detection sets out the displacement amplitude j m to be implemented on the following copy.and KOR become negligible; see Figures 5(c) and 5(d).In turn, the associated SKRs converge to the same value, corresponding also to the rate of the heterodyne-based protocol, as depicted in Figure 2. Furthermore, in all cases we observe a Wignernegativity, proving both |µ 0 ⟩ p to be non-classical (as well as non-Gaussian) states at all distances [9,68,71].

Employing feasible receivers
Even though both PGM and KOR discussed in the previous sections have shown interesting potentialities for CV-QKD, from a practical point of view there is no clear idea on their experimental implementation.Differently from the case of binary discrimination where the PGM is implemented via the Dolinar receiver [72,73], in the presence of QSPK designing a feasible optimum receiver is an open problem.In fact, the Dolinar receiver has been generalized, obtaining the so-called Bondurant receiver [74], which, unfortunately, is not optimum.As a consequence, it is not known how to reach the minimum error probability with optical feedback and linear optics.Nevertheless, at the state of the art many feasible quantum receivers are based on displacement operations and photon counting [39][40][41][43][44][45][46].Therefore, it is worth of interest to investigate also the performance of these receivers for CV-QKD.Here, in particular, we focus on the proposal of the displacement feed-forward receiver (DFFRx) presented in [43] and depicted in Figure 6.Its functioning will be presented in detail in the following subsection.

Description of the displacement feed-forward receiver
The DFFRx, presented schematically in Figure 6 K het and, in turn, R disp (N ) saturates to an asymptotic value ≤ 1.The best performance is achieved in the limit of infinite copies, N ≫ 1, where the receiver approximates the Bondurant receiver, obtaining a maximum increase in the SKR of about ≲ 20% and d max (N ) ≲ 25 km.
This behaviour is a direct consequence of the optimized modulation α 2 disp (N ), reported in Figure 8(b).In fact, α 2 disp (N ) is a decreasing function of d, which in the longdistance regime, κd ≫ 1, reaches an asymptotic value ≳ 0.5.Numerical calculations also show this asymptote to be independent of the number of copies N .In these conditions, Bob receives a signal with T α 2 disp (N ) ≪ 0.5 mean photons, for which the DFFRx does not beat the SQL, as depicted in Figure 7.In turn, even the SKR of the CV-QKD protocol is lower than the corresponding heterodyne protocol.On the other hand, for κd ≪ 1, the optimized modulation is of few photons, the DFFRx outperforms the SQL and we observe an increase also in the SKR.
In conclusion, despite its feasibility, the present displacement feed-forward scheme is not optimal for CV-QKD, just as it is not optimal for coherent state discrimination.Nevertheless, it still provides an improvement of the resulting key rate in the shortdistance regime, being a candidate for experimental realizations of the present protocol.

Conclusions and outlooks
In this paper we have investigated the role of state-discrimination receivers for CV-QKD.In particular, we have addressed a QPSK protocol based on a pure-loss wiretap channel assumption, and proposed an optimized non-Gaussian state-discrimination receiver, the KOR, to be employed by Bob in place of the commonly exploited Gaussian measurements.We have compared the performance of both the KOR and PGM with respect to the heterodyne-based protocol and obtained an increase in the SKR for metropolitan-network distances.Moreover, we have also discussed the role of feasible schemes, such as the displacement feed-forward receiver, obtaining an increased SKR in the short-distance regime up to a maximum transmission distance.
The results obtained in this paper suggest suitable non-Gaussian receivers as a resource to increase the key rate in the CV-QKD framework.Nevertheless, they only provide a first step towards the analysis of CV-QKD with non-Gaussian measurements and leave many points as open problems.At first, the extension of the present analysis to the more realistic case of a thermal-loss channel remains a challenging task.In fact, in the presence of thermal mixed states, designing the receiver achieving the minimum error probability is non-trivial.The general structure of quantum receivers derived in Section 2 does not hold anymore, as the M mixed states now span the whole infinite dimensional Hilbert space.Moreover, from the perspective of quantum communications, the optimum receiver achieving the minimum error probability can only be obtained numerically via linear convex semidefinite programming [32].There exists an extension of the PGM method, where the Gram matrix is obtained via the "factor decomposition" of the quantum states [32,36,75,76].However, the resulting POVM is not optimal anymore, even in the presence of GUS, and only provides a non-tight upper bound of the minimum error probability.As a consequence, the search of the key-rate optimized receiver could only be obtained via a brute-force functional optimization over all possible POVMs, being a nonlinear and non-convex problem.
Secondly, the sketch of an unconditional security proof may be designed, identifying which is the optimal Eve's attack.To do so, we should optimize over all the possible attacks compatible with Alice and Bob's statistics, retrieving the DW bound [22,54] by extending the methods of [20].Indeed, the question whether or not protocols employing non-Gaussian measurement guarantee higher security than Gaussian ones is an interesting open problem.
Finally, we should investigate the scalability of the present scheme with discretemodulation formats of higher order, like PSK schemes with M ≥ 4 encoded states or quadrature-amplitude-modulation (QAM) constellations, in which the GUS is not satisfied anymore [26,32].

Figure 1 .
Figure1.Scheme of the CV-QKD protocol discussed in the paper.Alice generates one of the coherent states |α k ⟩, k = 0, . . ., M − 1, with uniform probability q k = 1/M and sends it via the quantum wiretap channel to Bob, who performs the POVM {Π j } j .

Figure 2 .
Figure 2. (a) Logarithmic plot of K p , p = PGM, KOR, compared to K het , as a function of the transmission distance d in km.(b) Plot of the ratio R p , p = PGM, KOR, as a function of the transmission distance d.State-discrimination receivers improve the SKR with respect to the heterodyne-based protocol in the regime d ≤ 100 km.In both pictures we set β = 0.95.

Figure 4 .
Figure 4. Logarithmic plot of I (p) AB and χ (p) BE , p = PGM, KOR, as a function of the transmission distance d in km.Both the quantities are computed with the optimized parameters α 2p and ϕ KOR (for the optimized receiver).We set β = 0.95.

Figure 7 .Figure 8 .
Figure 7. Plot of the decision error probability P (disp) err (N ) as a function of the signal energy α 2 for different N , compared to both the SQL and the minimum error probability achieved by the PGM.The displacement feed-forward receiver beats the SQL only in the regime α 2 ≫ 1 and, for large N , scales as P (disp) err (N ) ≈ α 2 e −2α 2 , whilst the minimum error probability is P (PGM) err ≈ e −2α 2 .