Quantum steganographic protocols using degenerate and entanglement-assisted quantum codes

Nihar Ranjan Dash; R. Srikanth; Sanjoy Dutta; Subhashish Banerjee

REVIEW 2 major objections 2 minor 41 references

Quantum steganographic protocols using degenerate and entanglement-assisted quantum codes

T0 review · 2 major / 2 minor · reviewed 2026-05-22 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Preshared quantum entanglement encodes secret messages into nonlocal correlations for steganography without needing the eavesdropper to overestimate noise.

desk verdict This paper encodes secrets into entanglement correlations to drop the Eve-ignorance assumption in quantum steganography, but the error-correction steps still need explicit checks for no leakage. read the letter →

arxiv 2505.15869 v2 pith:G5FX47PX submitted 2025-05-21 quant-ph

Sanjoy Dutta , Nihar Ranjan Dash , Subhashish Banerjee , R. Srikanth This is my paper

classification quant-ph

keywords quantumsteganographyentanglement-assistedcodescatalyticerrorcorrectionsecrecycapacitynonlocalcorrelationschannelsdegenerate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Traditional quantum steganography hides messages by disguising them as extra channel noise, which requires assuming the eavesdropper overestimates how noisy the channel is. This paper shows that preshared entanglement can instead encode the message directly into nonlocal quantum correlations. As a result, the secrecy capacity is bounded by the actual capacity of the quantum communication channel rather than by any gap in the eavesdropper's knowledge. Three concrete protocols are given that rely on catalytic quantum error-correcting codes, degenerate entanglement-assisted codes, or the phase information in the entanglement. Upper and lower bounds on secrecy capacity are derived for each protocol and their robustness under realistic conditions is shown.

What carries the argument

Catalytic and entanglement-assisted quantum error-correcting codes that simultaneously correct channel errors and preserve secrecy in the nonlocal correlations of preshared entanglement.

What would settle it

An experiment or calculation that shows the steganographic encoding produces observable correlations or information leakage beyond what the error-correcting code can conceal would disprove the claimed security.

Watch

Extended reading notes

Core claim

By encoding the secret message into the nonlocal correlations of preshared quantum entanglement, the protocols remove the requirement that the eavesdropper overestimate channel noise. The resulting secrecy capacity is therefore determined by the quantum channel capacity itself. The three protocols employ catalytic QECCs to recycle entanglement, degenerate entanglement-assisted QECCs that let both parties contribute to secrecy, and the phase bit of the shared entanglement, with explicit upper and lower bounds derived on the achievable secrecy rates.

Load-bearing premise

The error-correcting codes can fix transmission errors while leaving the secret information hidden inside the entanglement correlations without creating detectable leakage.

Editorial extensions

If this is right

Secrecy capacity is set directly by the underlying quantum channel capacity rather than by assumed gaps in eavesdropper knowledge.
Catalytic codes recycle the entanglement resource across multiple uses of the protocol.
Entanglement assistance allows both sender and receiver to contribute to the secrecy mechanism.
The protocols remain secure and functional under realistic noisy quantum channel conditions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The method could be combined with existing quantum key distribution schemes to add a steganographic layer on top of key generation.
Similar encoding into nonlocal correlations might apply to continuous-variable quantum systems or to multipartite entanglement networks.
The approach opens the possibility of designing quantum networks where hidden communication shares the same resources as error correction.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The main thing to know is that the authors shift quantum steganography from hiding messages in channel noise that Eve might misjudge to encoding them directly in the nonlocal correlations of preshared entanglement. This lets the secrecy capacity bounds come from the quantum channel capacity itself rather than from any assumed gap in Eve's knowledge. They present three protocols built on catalytic QECCs, degenerate entanglement-assisted QECCs, and the phase bit of the entanglement, with upper and lower bounds derived for each and some discussion of robustness under noise. Catalytic codes recycle the entanglement resource while the entanglement-assisted versions let both parties contribute to the secrecy layer. This combination is new as a concrete construction for entanglement-based steganography. The paper does a solid job laying out the protocols in terms of known code families and tying the capacity expressions to standard quantum channel results, which gives readers a clear starting point for further work. The soft spot sits in the error-correction operations themselves. Syndrome extraction and recovery in these codes involve measurements or controlled gates on the code space, and it is not obvious from the abstract-level description that these steps leave the secret-carrying correlations untouched and undetectable by Eve under general noise. If the full text supplies invariance arguments or explicit leakage bounds for the chosen code families, the claim holds; otherwise the derived capacities rest on an assumption that still needs verification. Readers working on quantum error correction, entanglement-assisted communication, or secrecy capacities will find the constructions useful. The paper shows clear engagement with the relevant literature on QECCs and channel capacities, so it deserves a serious referee. I would send it to peer review with a request that reviewers focus on whether the correction steps preserve the required decoupling.

Referee Report

2 major / 2 minor

Summary. The manuscript introduces three quantum steganographic protocols that encode secret messages into nonlocal correlations using preshared entanglement. The protocols rely on catalytic QECCs (for entanglement recycling), degenerate entanglement-assisted QECCs, and the phase bit of entanglement. The central claim is that this encoding allows secrecy-capacity bounds to be taken directly from the underlying quantum channel capacity, eliminating the traditional requirement that Eve overestimate channel noise. Upper and lower bounds are derived for each protocol and practical robustness is asserted.

Significance. If the decoupling between error-correction operations and the secret-carrying nonlocal correlations holds, the work would remove a key limitation of prior quantum steganography and yield capacity expressions grounded in standard quantum channel capacities. The catalytic and entanglement-assisted constructions are technically interesting and could improve resource efficiency in covert quantum communication.

major comments (2)

[§3.2] §3.2 (catalytic QECC protocol): the argument that syndrome extraction and recovery leave the logical entanglement correlations intact and leakage-free is stated without an explicit invariance calculation or commutator check between the recovery map and the secret-encoding operators; this assumption is load-bearing for the claimed lower bound.
[§4.1, Eq. (15)] §4.1, Eq. (15) (degenerate EA-QECC): the upper-bound derivation equates the stego secrecy capacity to the quantum channel capacity, but no explicit mutual-information calculation is supplied showing that Eve’s output remains uncorrelated with the phase-bit secret after the channel and correction; the degeneracy argument alone does not automatically guarantee this under general noise.

minor comments (2)

[Abstract] The abstract states that practical robustness is demonstrated, yet the noise models, error rates, and quantitative metrics (e.g., leakage probability or fidelity thresholds) are not summarized.
[Throughout] Notation for the catalytic entanglement resource and the phase-bit encoding should be unified across sections to avoid reader confusion.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the careful reading and constructive comments. The points raised highlight areas where additional explicit calculations can strengthen the presentation of our entanglement-based protocols. We address each major comment below and indicate the revisions we will make.

read point-by-point responses

Referee: [§3.2] §3.2 (catalytic QECC protocol): the argument that syndrome extraction and recovery leave the logical entanglement correlations intact and leakage-free is stated without an explicit invariance calculation or commutator check between the recovery map and the secret-encoding operators; this assumption is load-bearing for the claimed lower bound.

Authors: We agree that an explicit invariance argument is needed to support the lower bound. The catalytic QECC construction relies on the recovery map acting as the identity on the logical subspace that encodes the secret correlations. In the revised manuscript we will insert a direct commutator calculation showing that the recovery operator commutes with the secret-encoding Pauli operators on the logical qubits, confirming that the nonlocal correlations remain untouched and that no information leaks to the environment or to Eve. revision: yes
Referee: [§4.1, Eq. (15)] §4.1, Eq. (15) (degenerate EA-QECC): the upper-bound derivation equates the stego secrecy capacity to the quantum channel capacity, but no explicit mutual-information calculation is supplied showing that Eve’s output remains uncorrelated with the phase-bit secret after the channel and correction; the degeneracy argument alone does not automatically guarantee this under general noise.

Authors: The upper bound in Section 4.1 is obtained by showing that the phase-bit secret is protected by the degeneracy of the entanglement-assisted code, so that Eve’s accessible information is limited to the noise on the underlying quantum channel. We acknowledge that a direct mutual-information calculation would make this step fully rigorous. In the revision we will add an explicit evaluation of I(E; secret) after the channel and correction, demonstrating that the degeneracy ensures the secret remains uncorrelated with Eve’s output for the noise models considered, thereby justifying the equality to the quantum capacity. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; secrecy bounds taken directly from quantum channel capacity

full rationale

The paper's central move is to encode the secret into nonlocal correlations of preshared entanglement, thereby setting stego-channel capacity bounds equal to those of the underlying quantum communication channel. No quoted derivation step reduces a claimed prediction or first-principles result to a fitted parameter, self-citation, or definitional tautology. The three protocols (catalytic QECC, degenerate EA-QECC, phase-bit) are introduced as constructions whose error-correction properties are assumed to preserve the correlations; this modeling assumption is external to the capacity calculation itself and does not create a self-referential loop. The derivation chain therefore remains independent of its own outputs.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

The central claims rest on standard quantum-information assumptions about the existence and usability of preshared entanglement and QECCs; no new free parameters or invented entities are introduced in the abstract.

assumptions (2)

domain assumption Preshared entanglement between sender and receiver is available and remains secure for the duration of the protocol.
Required to encode the secret into nonlocal correlations without classical randomness.
domain assumption Catalytic or entanglement-assisted QECCs can correct channel noise while preserving the secrecy of the encoded correlations.
Invoked to enable the three protocols and the claimed capacity bounds.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Quantum steganographic protocols using degenerate and entanglement-assisted quantum codes." pith.science (2026). https://pith.science/paper/G5FX47PX

@misc{pith2026250515869,
  author       = {Pith},
  title        = {Pith review of: Quantum steganographic protocols using degenerate and entanglement-assisted quantum codes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G5FX47PX}},
  note         = {Machine review of arXiv:2505.15869}
}

read the original abstract

Steganography is the art of concealing secret information by embedding it in an apparently innocent-looking message. Quantum steganography applies the principles of quantum mechanics to traditional steganography and, compared to the latter, offers significant advantages, including heightened security, improved concealment, and increased data-hiding capacity. Traditionally, quantum steganography disguises the covert communication as channel noise, which is corrected using preshared classical randomness. This method requires the steganalytic eavesdropper Eve to overestimate the level of channel noise, so that the bounds on the stego channel capacity depend on this assumed gap in Eve's knowledge of the channel. In this work, we point out that by means of preshared quantum entanglement the secret message can be encoded into nonlocal correlations, obviating the need for such an assumption of Eve's ignorance. Consequently, the capacity bounds on the stego channel can then come from the channel capacity of the quantum communication channel. We introduce three such entanglement-based quantum steganographic protocols that make use of catalytic quantum error-correcting codes (QECCs), degenerate entanglement-assisted QECCs, or the phase bit of preshared entanglement. Here catalytic QECCs enable recycling entanglement, while entanglement assistance allows both sender and receiver to contribute to the protocol's secrecy. We derive upper and lower bounds on the secrecy capacity of each protocol, and demonstrate their practical robustness.

Discussion (0). Sign in to comment.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

IndisputableMonolith/Foundation/RealityFromDistinction.lean reality_from_one_distinction unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

by means of preshared quantum entanglement the secret message can be encoded into nonlocal correlations... capacity bounds on the stego channel can then come from the channel capacity of the quantum communication channel
IndisputableMonolith/Cost/FunctionalEquation.lean washburn_uniqueness_aczel unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

catalytic QECCs enable recycling entanglement, while entanglement assistance allows both sender and receiver to contribute to the protocol's secrecy

What do these tags mean?

matches: The paper's claim is directly supported by a theorem in the formal canon.
supports: The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends: The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses: The paper appears to rely on the theorem as machinery.
contradicts: The paper's claim conflicts with a theorem or certificate in the canon.
unclear: Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

41 extracted references · 41 canonical work pages

[1]

(More generally, if secret rate is ks, then k = 2ks.) Further, Alice prepares a local ebit |Φ+⟩l1, l2

Alice and Bob pre-share an ebit |Φ+⟩AB, and agree on a [[ n, k, d; 0]] QECC, with k ≥2. (More generally, if secret rate is ks, then k = 2ks.) Further, Alice prepares a local ebit |Φ+⟩l1, l2

work page
[2]

Alice decides on two bits– the cover message w, and the secret bit b, and employs dense coding to prepare the Bell state |η(w, b)⟩AB ≡(|0, w⟩ + (−1)b |1, w⟩)AB

work page
[3]

Alice then encodes one half of her local ebit and her entangled qubits, i.e., the ﬁrst two particles in the state |Φ+⟩l1, l2 |η(w, b)⟩AB = |0, 0⟩l1, A |0, w⟩l2, B + (−1)b |0, 1⟩l1, A |0, w⟩l2, B + |1, 0⟩l1, A |1, w⟩l2, B + (−1)b |1, 1⟩l1, A |1, w⟩l2, B obtaining |(0, 0)L⟩l1, A |0, w⟩l2, B + (−1)b |(0, 1)L⟩l1, A |0, w⟩l2, B + |(1, 0)L⟩l1, A |1, w⟩l2, B + (...

work page
[4]

She transmits her particles to Bob over a noisy chan- nel. After performing the necessary quantum error cor- rection using her and his particles jointly, and decod- ing the resultant state, he obtains |Φ+⟩l1, l2 |η(w, b)⟩A, B, where particles A, B, l1 are now with Bob

work page
[5]

This results in the transformation |η(w, b)⟩ − → |w⟩ |b⟩

On the particles A, B Bob applies a CNOT with the con- trol on B followed by a Hadamard on B. This results in the transformation |η(w, b)⟩ − → |w⟩ |b⟩

work page
[6]

The state |Φ+⟩l1, l2 will serve as shared ebit of the next round. The catalytic aspect, which is the replenishment of the enta n- glement consumed, ensures that the initial pre-shared ebit suf- ﬁces to transmit any number of secret qubits, over subsequen t rounds. Note that because we employ a dense-coding protocol, Al- ice is restricted to transmitting a...

work page
[7]

T o achieve innocence (asymptotically), the entr opy in Alice’s alphabet must be su ﬃciently low

is satisﬁed. T o achieve innocence (asymptotically), the entr opy in Alice’s alphabet must be su ﬃciently low. Proof. To begin with, Alice encodes her cover message |ψ⟩A into an EA code logical state |ψL⟩AB. Suppose her secret bit corresponds to error eA ∈EA. She prepares the state eA |ψL⟩AB and transmits her qubits to Bob. As eA is correctable, Bob obtai...

work page
[8]

1 In the second possibility above, the reason that we exclude the case I◦N(S) is that the weight of an arbitrary error e satisﬁes |e| ≤ ⌊d−1 2 ⌋

Suppose Eve expects Alice’s communica- tion to be subject to a dephasing channel E ≡ (1 −r)I + rZ (0 ≤r ≤1), and Alice and Bob know this. 1 In the second possibility above, the reason that we exclude the case I◦N(S) is that the weight of an arbitrary error e satisﬁes |e| ≤ ⌊d−1 2 ⌋. Thus |eAeB| ≤ d −1, whereas any logical operator OL is such that |OL| ≥d....

work page

Show all 41 references

[9]

direct steganography

E |Υ(w, b)⟩, with E being an arbitrary single-qubit error. We assume that his entangled particle is error-free, an assumption justiﬁ ed be- cause his qubit hasn’t been transmitted across the channel. Here S 1, S 3 and S 4 are the ﬂipping stabilizers, while S 2 is the only non-...

2022
[10]

G. J. Simmons, in Advances in Cryptology: Proceedings of Crypto 83 (Springer, 1984) pp. 51–67

1984
[11]

Dutta, R

H. Dutta, R. K. Das, S. Nandi, and S. M. Prasanna, IETE Tech - nical Review 37, 632 (2020)

2020
[12]

T. A. Brun, Physical Review A 99, 032343 (2019)

2019
[13]

Shi, L.-s

R.-h. Shi, L.-s. Huang, W. Yang, and H. Zhong, IEEE Transa c- tions on Computers 69, 1805 (2020)

2020
[14]

Qu, X.-B

Z.-G. Qu, X.-B. Chen, X.-J. Zhou, X.-X. Niu, and Y .-X. Yan g, Optics Communications 283, 4782 (2010)

2010
[15]

M. S. Taha, M. S. Mohd Rahim, S. A. Lafta, M. M. Hashim, and H. M. Alzuabidi, in IOP conference series: materials science and engineering , V ol. 518 (IOP Publishing, 2019) p. 052003

2019
[16]

Sanguinetti, G

B. Sanguinetti, G. Traverso, J. Lavoie, A. Martin, and H. Zbinden, Physical Review A 93, 012336 (2016)

2016
[17]

Qu and I

Z. Qu and I. B. Djordjevic, IEEE Photonics Journal 14, 1 (2022)

2022
[18]

Gea-Banacloche, Journal of Mathematical Physics 43, 4531 (2002)

J. Gea-Banacloche, Journal of Mathematical Physics 43, 4531 (2002)

2002
[19]

B. A. Shaw and T. A. Brun, Physical Review A 83, 022310 (2011)

2011
[20]

Sutherland and T

C. Sutherland and T. A. Brun, Physical Review A 100, 052312 (2019)

2019
[21]

Mihara, Physics Letters A 379, 952 (2015)

T. Mihara, Physics Letters A 379, 952 (2015)

2015
[22]

Z. Qu, T. Zhu, J. Wang, and X. Wang, Computers, Materials & Continua 56 (2018)

2018
[23]

Tudorache, V

A.-G. Tudorache, V . Manta, and S. Caraiman, Advances in Electrical & Computer Engineering 21 (2021)

2021
[24]

Min-Allah, N

N. Min-Allah, N. Nagy, M. Aljabri, M. Alkharraa, M. Alqa h- tani, D. Alghamdi, R. Sabri, and R. Alshaikh, Applied Scienc es 12, 10294 (2022)

2022
[25]

Luo, R.-G

G. Luo, R.-G. Zhou, and W. Hu, Quantum Information Pro- cessing 22, 138 (2023)

2023
[26]

A. A. Abd El-Latif, B. Abd-El-Atty, S. Elseuoﬁ, H. S. Kha lifa, A. S. Alghamdi, K. Polat, and M. Amin, Physica A: Statistical Mechanics and its Applications 541, 123687 (2020)

2020
[27]

Joshi, A

R. Joshi, A. Gupta, K. Thapliyal, R. Srikanth, and A. Pat hak, Quantum Information Processing 21, 164 (2022)

2022
[28]

Nagy and N

M. Nagy and N. Nagy, Ieee Access 8, 213671 (2020)

2020
[29]

Mihara, Quantum Information Processing 20, 1 (2021)

T. Mihara, Quantum Information Processing 20, 1 (2021)

2021
[30]

Wang and Q

J. Wang and Q. Zhang, in Proceedings of the IEEE Interna- tional Conference on Quantum Computing and Engineering (IEEE, 2021) pp. 1–6

2021
[31]

Hsieh, I

M.-H. Hsieh, I. Devetak, and T. Brun, Physical Review A—Atomic, Molecular, and Optical Physics 76, 062313 (2007)

2007
[32]

F. R. F. Pereira and S. Mancini, Entropy 25, 37 (2022)

2022
[33]

D. A. Lidar and T. A. Brun, Quantum error correction (Cam- bridge university press, 2013)

2013
[34]

T. Brun, I. Devetak, and M.-H. Hsieh, science 314, 436 (2006)

2006
[35]

T. A. Brun, I. Devetak, and M.-H. Hsieh, IEEE Transactio ns on Information Theory 60, 3073 (2014)

2014
[36]

Smith and J

G. Smith and J. A. Smolin, Physical review letters 98, 030501 (2007)

2007
[37]

S. J. Devitt, W. J. Munro, and K. Nemoto, Reports on Progr ess in Physics 76, 076001 (2013)

2013
[38]

Banerjee and A

A. Banerjee and A. Pathak, Physics Letters A 376, 2944 (2012)

2012
[39]

Sheng, L

Y .-B. Sheng, L. Zhou, and G.-L. Long, Science Bulletin 67, 367 (2022)

2022
[40]

N. R. Dash, S. Dutta, R. Srikanth, and S. Banerjee, Physi cal Review A 109, 062411 (2024)

2024
[41]

A. L. Grimsmo and S. Puri, PRX Quantum 2, 020101 (2021)

2021

Pith tools

Reviewed May 22, 2026 · model on record in the stance chip above.

[1] [1]

(More generally, if secret rate is ks, then k = 2ks.) Further, Alice prepares a local ebit |Φ+⟩l1, l2

Alice and Bob pre-share an ebit |Φ+⟩AB, and agree on a [[ n, k, d; 0]] QECC, with k ≥2. (More generally, if secret rate is ks, then k = 2ks.) Further, Alice prepares a local ebit |Φ+⟩l1, l2

work page

[2] [2]

Alice decides on two bits– the cover message w, and the secret bit b, and employs dense coding to prepare the Bell state |η(w, b)⟩AB ≡(|0, w⟩ + (−1)b |1, w⟩)AB

work page

[3] [3]

Alice then encodes one half of her local ebit and her entangled qubits, i.e., the ﬁrst two particles in the state |Φ+⟩l1, l2 |η(w, b)⟩AB = |0, 0⟩l1, A |0, w⟩l2, B + (−1)b |0, 1⟩l1, A |0, w⟩l2, B + |1, 0⟩l1, A |1, w⟩l2, B + (−1)b |1, 1⟩l1, A |1, w⟩l2, B obtaining |(0, 0)L⟩l1, A |0, w⟩l2, B + (−1)b |(0, 1)L⟩l1, A |0, w⟩l2, B + |(1, 0)L⟩l1, A |1, w⟩l2, B + (...

work page

[4] [4]

She transmits her particles to Bob over a noisy chan- nel. After performing the necessary quantum error cor- rection using her and his particles jointly, and decod- ing the resultant state, he obtains |Φ+⟩l1, l2 |η(w, b)⟩A, B, where particles A, B, l1 are now with Bob

work page

[5] [5]

This results in the transformation |η(w, b)⟩ − → |w⟩ |b⟩

On the particles A, B Bob applies a CNOT with the con- trol on B followed by a Hadamard on B. This results in the transformation |η(w, b)⟩ − → |w⟩ |b⟩

work page

[6] [6]

The state |Φ+⟩l1, l2 will serve as shared ebit of the next round. The catalytic aspect, which is the replenishment of the enta n- glement consumed, ensures that the initial pre-shared ebit suf- ﬁces to transmit any number of secret qubits, over subsequen t rounds. Note that because we employ a dense-coding protocol, Al- ice is restricted to transmitting a...

work page

[7] [7]

T o achieve innocence (asymptotically), the entr opy in Alice’s alphabet must be su ﬃciently low

is satisﬁed. T o achieve innocence (asymptotically), the entr opy in Alice’s alphabet must be su ﬃciently low. Proof. To begin with, Alice encodes her cover message |ψ⟩A into an EA code logical state |ψL⟩AB. Suppose her secret bit corresponds to error eA ∈EA. She prepares the state eA |ψL⟩AB and transmits her qubits to Bob. As eA is correctable, Bob obtai...

work page

[8] [8]

1 In the second possibility above, the reason that we exclude the case I◦N(S) is that the weight of an arbitrary error e satisﬁes |e| ≤ ⌊d−1 2 ⌋

Suppose Eve expects Alice’s communica- tion to be subject to a dephasing channel E ≡ (1 −r)I + rZ (0 ≤r ≤1), and Alice and Bob know this. 1 In the second possibility above, the reason that we exclude the case I◦N(S) is that the weight of an arbitrary error e satisﬁes |e| ≤ ⌊d−1 2 ⌋. Thus |eAeB| ≤ d −1, whereas any logical operator OL is such that |OL| ≥d....

work page