# Covert Communication Over Additive-Noise Channels

Cécile Bouette, Laura Luzzi, Ligong Wang

► To cite this version:

Cécile Bouette, Laura Luzzi, Ligong Wang. Covert Communication Over Additive-Noise Channels. IEEE Transactions on Information Theory, 2024, 10.1109/TIT.2024.3522151. hal-04856965

HAL Id: hal-04856965

https://hal.science/hal-04856965v1

Submitted on 27 Dec 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Covert Communication Over Additive-Noise Channels

Cécile Bouette, Student Member, IEEE, Laura Luzzi, Member, IEEE, and Ligong Wang, Senior Member, IEEE

***Abstract***—We study the fundamental limits of covert communications over general memoryless additive-noise channels. We assume that the legitimate receiver and the eavesdropper share the same channel and therefore see the same outputs. Under mild integrability assumptions, we find a general upper bound on the square-root scaling constant, which only involves the variance of the logarithm of the probability density function of the noise. Furthermore, we show that, under some additional assumptions, this upper bound is tight. We also provide upper bounds on the length of the secret key required to achieve the optimal scaling.

***Index Terms***—Covert communication, information-theoretic security, low probability of detection, non-Gaussian noise, square-root law.

## I. INTRODUCTION

COVERT COMMUNICATION, also known as communication with low probability of detection [1], [2], [3], [4], refers to a scenario where a transmitter and a receiver wish to prevent a potential eavesdropper from making a good guess on whether communication is ongoing or not. Covertness is desirable in many applications, since merely revealing who is communicating, when, and from where can leak sensitive information, even if the content of the communication is not disclosed.

Covert communication has been previously studied in the context of steganography and spread-spectrum techniques. In the framework of information theory, [1] first determined the order of magnitude of the achievable message length that the legitimate users can reliably communicate over a noisy channel while ensuring a low probability of detection by the eavesdropper. The work showed that the capacity—in nats per channel use—under a covertness constraint is zero: the maximum message length that can be transmitted reliably and covertly scales like the square root of the total number of channel uses. This phenomenon is sometimes called the *square-root law* and is also observed in steganography [5], [6]. While [1] considered additive white Gaussian noise (AWGN) channels, the square-root law was also established for binary symmetric channels in [2], which, in addition, shows that covert communication can sometimes be realized without

employing a secret key. The exact scaling constant for the square-root law—which we shall formally define later on— was characterized for discrete memoryless channels (DMCs) and AWGN channels in [3]. The minimum required key length for covert communication over various types of channels was derived in [4].

Some other works studied situations where the square-root law may not hold, e.g., where the eavesdropper has uncertainty about the noise distribution [7], or in some multiple-antenna scenarios [8]. The present work does not consider such scenarios and stays within the framework of [1], [2], [3], [4].

In a recent work [9], we extended the previous results on AWGN channels to channels with *generalized Gaussian noise* to compute or, for some parameter range, upper-bound the square-root scaling constant for covert communication. In the present paper, we make yet a further extension to consider general noise distributions.

We note that non-Gaussian noise models have practical relevance. For instance, the Laplace distribution is used to model noise spikes due to rare events [10, Chapter 10]; generalized Gaussian distributions [11], [12] can be used to model impulsive noise, such as atmospheric noise [13] and interference in ultra-wideband systems [14]; dense wireless networks with interference are characterized by heavy-tailed noise, which can be modeled using $\alpha$-stable distributions [15], [16], [17].

In this work, we assume that the legitimate receiver and the eavesdropper face exactly the same noise distribution. Under mild integrability assumptions, we show that the square-root scaling constant is upper-bounded by a simple expression that only involves the variance of the logarithm of the probability density function (PDF) of the noise. We then show that, under some additional assumptions on the noise PDF, the said upper bound is tight, i.e., there exist covert channel codes that can asymptotically achieve it. We further provide (sometimes loose) upper bounds on the key length that is needed to achieve the optimal scaling constant.

As examples, we compute the scaling constant (or its upper bound) when the noise distribution is exponential, generalized Gaussian, or gamma. For generalized Gaussian noise, we recover the results in [9].

The rest of this paper is organized as follows. Section II introduces the problem setup. Section III proves an upper bound on the square-root scaling constant for covert communication over general additive-noise channels. Section IV shows that, under some additional assumptions on the noise distribution, the upper bound of Section III is achievable. Section V computes the scaling constant (or the upper bound)

Cécile Bouette and Laura Luzzi are with Laboratoire ETIS—UMR 8051, CY Cergy Paris Université, ENSEA, CNRS, 95000 Cergy-Pontoise, France (e-mail: cecile.bouette@ensea.fr; laura.luzzi@ensea.fr). Laura Luzzi is currently a visiting researcher with Project COSMIQ, Centre Inria de Paris, 48 rue Barrault, 75013 Paris, France (e-mail: laura.luzzi@inria.fr).

Ligong Wang is with the Department of Information Technology and Electrical Engineering, ETH Zurich, 8092 Zurich, Switzerland (e-mail: ligwang@isi.ee.ethz.ch).

This work was supported in part by CY Initiative of Excellence (grant Investissements d'Avenir ANR-16-IDEX-0008).
<figure><img src="image_2.png" /><figcaption>Fig. 1: General setup for covert communication.</figcaption></figure>

for a few examples. Section VI contains upper bounds on the key length required for the achievability result in Section IV. Finally, Section VII concludes the paper with some remarks.

## II. PROBLEM SETUP

We usually use upper-case letters like $X$ to denote (real) random variables and lower-case letters like $x$ to denote their realizations. A length-$n$ random vector $(X_1, \dots, X_n)$ is denoted $X^n$. We use $P_X$ to denote the cumulative distribution function of the random variable $X$ and $P_{X^n}$ that of the random vector $X^n$. The PDF corresponding to $P_X$, when it exists, is denoted $p_X$. The Kullback-Leibler divergence relative entropy [18] between two distributions $P$ and $Q$ is denoted $D(P||Q)$, the differential entropy of random variable $X$ is denoted $h(X)$, and the mutual information between $X$ and $Y$ is denoted $I(X;Y)$; all of these are measured in nats.

We consider the setup illustrated in Fig. 1, where a transmitter and a receiver communicate in the presence of an eavesdropper over an additive-noise channel described by

$$Y_i = X_i + Z_i, \quad i = 1, 2, \dots, n, \quad (1)$$

where $X_i$ denotes the channel input random variable, $Y_i$ the channel output random variable, and $Z_i$ the additive noise random variable, at time $i$, all of which take values in $\mathbb{R}$.

The sender and the receiver are assumed to share a sufficiently long secret key $K \in \mathcal{K}$. The key and the message are assumed to be uniformly distributed and independent of each other. A code $\mathcal{C} = (f, g)$ of length $n$ for message set $\mathcal{M}$ and key set $\mathcal{K}$ consists of an encoder $f: \mathcal{M} \times \mathcal{K} \to \mathbb{R}^n, (m, k) \mapsto x^n$ and a decoder $g: \mathbb{R}^n \times \mathcal{K} \to \mathcal{M}, (y^n, k) \mapsto \hat{m}$.

The eavesdropper observes the same output as the legitimate receiver. We will assume that the eavesdropper knows the encoding and decoding functions $f$ and $g$, but not the value of the secret key $K$.

Covertness requires that the eavesdropper should not be able to detect whether transmission is ongoing or not. Specifically, we consider the following covertness condition: for some given $\Delta > 0$ and for every $n$, the output distribution must satisfy

$$D(P_{Y^n} || P_{Z^n}) \le \Delta, \quad (2)$$

where $P_{Z^n}$ denotes the distribution of the noise vector $Z^n$, and $P_{Y^n}$ that of the output sequence averaged over the messages and over the key: for every $y^n \in \mathbb{R}^n$,

$$p_{Y^n}(y^n) = \frac{1}{|\mathcal{K}| \cdot |\mathcal{M}|} \sum_{m=1}^{|\mathcal{M}|} \sum_{k=1}^{|\mathcal{K}|} p_{Y^n|X^n}(y^n|f(m, k)). \quad (3)$$

Given $\epsilon > 0$, we denote by $A_n(\Delta, \epsilon)$ the maximum of $\ln |\mathcal{M}|$ for which there exists a code $\mathcal{C}$ of length $n$ that satisfies covertness condition (2), and whose average probability of decoding error is at most $\epsilon$. As in [3], we define the square-root scaling constant:

$$L \triangleq \lim_{\epsilon \downarrow 0} \liminf_{n \to \infty} \frac{A_n(\Delta, \epsilon)}{\sqrt{n\Delta}}. \quad (4)$$

We assume that the noise stochastic process $\{Z_i\}_{i \in \{1, 2, \dots, n\}}$ is independent of the message and the secret key. We further assume that $\{Z_i\}_{i \in \{1, 2, \dots, n\}}$ is independent and identically distributed (i.i.d.) according to a PDF $p_Z(z)$, $z \in \mathbb{R}$. A fortiori, $p_Z$ is Lebesgue-measurable and $\int_{\mathbb{R}} p_Z(z) dz = 1$.

We make the following technical assumptions on $p_Z$: there exists some $\zeta \in (0, 1)$ such that

$$\int_{\mathbb{R}} p_Z(z) (\ln(p_Z(z)))^4 dz < \infty \quad (5)$$

$$\int_{\mathbb{R}} p_Z(z) \zeta dz < \infty \quad (6)$$

$$\int_{\mathbb{R}} p_Z(z) \zeta (\ln(p_Z(z)))^4 dz < \infty. \quad (7)$$

These imply some further integrability properties:

**Lemma 1:** If $p_Z$ satisfies (5)–(7), then, for every $k \in \{0, 1, 2, 3, 4\}$, the integrals

$$\int_{\mathbb{R}} p_Z(z)^{\nu(z)} |\ln(p_Z(z))|^k dz \quad (8)$$

are uniformly bounded over $\nu: \mathbb{R} \to [\zeta, 1]$, $z \mapsto \nu(z)$.

*Proof:* For any $k \in \{0, 1, 2, 3, 4\}$, $\nu: \mathbb{R} \to [\zeta, 1]$, and $z \in \mathbb{R}$,

$$p_Z(z)^{\nu(z)} |\ln(p_Z(z))|^k \le (p_Z(z) + p_Z(z)^{\zeta}) (1 + (\ln(p_Z(z)))^4), \quad (9)$$

where the right-hand side does not depend on $\nu$ and is integrable due to (5)–(7). $\square$

## III. A GENERAL UPPER BOUND ON $L$

The following theorem provides a general upper bound on $L$. We shall later show that, under some additional assumptions on $p_Z$, this bound is tight.

**Theorem 1:** For the memoryless additive-noise channel (1) with $p_Z$ satisfying (5)–(7),

$$L \le \sqrt{2} \sqrt{\mathrm{Var}[\ln(p_Z(Z))]} \quad (10)$$

The following lemma will be used in the proof of Theorem 1.

**Lemma 2:** Consider $p_Z$ satisfying (5)–(7). For any $\gamma \in [0, 1-\zeta)$, let the random variable $\tilde{Z}$ have PDF

$$p_{\tilde{Z}}(\tilde{z}) = \alpha \cdot p_Z(\tilde{z})^{1-\gamma}, \quad \tilde{z} \in \mathbb{R}, \quad (11)$$

where

$$\alpha = \left( \int_{\mathbb{R}} p_Z(z)^{1-\gamma} dz \right)^{-1}. \quad (12)$$

Then the following hold:
1) For $\gamma \in [0, 1 - \zeta)$,

$$h(\tilde{Z}) = -\frac{\ln(\alpha)}{\gamma} + \frac{1 - \gamma}{\gamma} D(P_{\tilde{Z}}\|P_Z). \quad (13)$$

2) For any random variable Y satisfying

$$D(P_Y\|P_Z) \le D(P_{\tilde{Z}}\|P_Z), \quad (14)$$

we have

$$h(Y) \le h(\tilde{Z}). \quad (15)$$

That is, $p_{\tilde{Z}}$ as in (11) maximizes the differential entropy for a given Kullback-Leibler divergence to $P_Z$.

3) For $\gamma \downarrow 0$,

$$D(P_{\tilde{Z}}\|P_Z) = \frac{\gamma^2}{2}\mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^3) \quad (16)$$

$$h(\tilde{Z}) - h(Z) = \gamma \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^2). \quad (17)$$

4) The function $\gamma \mapsto D(P_{\tilde{Z}}\|P_Z)$ is continuous on $[0, 1-\zeta)$.

*Proof:* We first prove 1) as follows:

$$\begin{align}
D(P_{\tilde{Z}}\|P_Z) & = \int_{\mathbb{R}} p_{\tilde{Z}}(z) \ln\left(\frac{p_{\tilde{Z}}(z)}{p_Z(z)}\right) dz \nonumber \\
& = -h(\tilde{Z}) - \int_{\mathbb{R}} p_{\tilde{Z}}(z) \ln(p_Z(z)) dz \nonumber \\
& = -h(\tilde{Z}) - \frac{1}{1-\gamma} \int_{\mathbb{R}} p_{\tilde{Z}}(z) \ln(\alpha p_Z(z)^{1-\gamma}) dz + \frac{\ln(\alpha)}{1-\gamma} \nonumber \\
& = -h(\tilde{Z}) + \frac{1}{1-\gamma} h(\tilde{Z}) + \frac{\ln(\alpha)}{1-\gamma} \nonumber \\
& = \frac{\gamma}{1-\gamma} h(\tilde{Z}) + \frac{\ln(\alpha)}{1-\gamma} \tag{18}
\end{align}$$

which implies (13).

We next show 2). For any random variable Y satisfying (14), we have

$$\begin{align}
0 \le D(P_Y \| P_{\tilde{Z}}) & = -h(Y) - \int_{\mathbb{R}} p_Y(y) \ln(p_{\tilde{Z}}(y)) dy \nonumber \\
& = -h(Y) - \int_{\mathbb{R}} p_Y(y) \ln(\alpha p_Z(y)^{1-\gamma}) dy \nonumber \\
& = -h(Y) - \ln(\alpha) - (1-\gamma) \int_{\mathbb{R}} p_Y(y) \ln(p_Z(y)) dy \nonumber \\
& = -h(Y) - \ln(\alpha) + (1-\gamma) D(P_Y \| P_Z) + (1-\gamma) h(Y) \nonumber \\
& \le -\gamma h(Y) - \ln(\alpha) + (1-\gamma) D(P_{\tilde{Z}} \| P_Z) \tag{19} \\
& = \gamma(h(\tilde{Z}) - h(Y)), \tag{20}
\end{align}$$

where (19) follows from (14); and (20) from (18). Inequality (20) implies (15).

We next show 3). There exists $\theta: \mathbb{R} \to (0, \gamma)$ such that the Taylor expansion of $p_Z(z)^{-\gamma}$ with the Lagrange form of the remainder is

$$p_Z(z)^{-\gamma} = 1 - \gamma \ln(p_Z(z)) + \frac{\gamma^2}{2} (\ln(p_Z(z)))^2 - \frac{\gamma^3}{6} (\ln(p_Z(z)))^3 p_Z(z)^{-\theta(z)} \quad z \in \mathbb{R}. \quad (21)$$

The normalization factor $\alpha$ is then

$$\begin{align}
\alpha &= \left( \int_{\mathbb{R}} p_Z(z) \left( 1 - \gamma \ln(p_Z(z)) + \frac{\gamma^2}{2} (\ln(p_Z(z)))^2 - \frac{\gamma^3}{6} (\ln(p_Z(z)))^3 p_Z(z)^{-\theta(z)} \right) dz \right)^{-1} \nonumber \\
&= \left( 1 + \gamma h(Z) + \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + O(\gamma^3) \right)^{-1} \tag{22} \\
&= 1 - \gamma h(Z) - \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \gamma^2 h(Z)^2 + O(\gamma^3), \tag{23}
\end{align}$$

where (22) follows by Lemma 1 and (23) follows by the Taylor expansion of $x \mapsto (1+x)^{-1}$. Note that

$$\begin{align}
\ln \alpha &= - \ln \left( 1 + \gamma h(Z) + \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + O(\gamma^3) \right) \nonumber \\
&= - \gamma h(Z) - \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \frac{\gamma^2}{2} h(Z)^2 + O(\gamma^3) \nonumber \\
&= - \gamma h(Z) - \frac{\gamma^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^3). \tag{24}
\end{align}$$

We also have

$$\begin{align}
\int_{\mathbb{R}} p_Z(z)^{1-\gamma} \ln(p_Z(z)) dz & \nonumber \\
& = \int_{\mathbb{R}} p_Z(z) \left( 1 - \gamma \ln(p_Z(z)) + \frac{\gamma^2}{2} (\ln(p_Z(z)))^2 - \frac{\gamma^3}{6} (\ln(p_Z(z)))^3 p_Z(z)^{-\theta(z)} \right) \ln(p_Z(z)) dz \nonumber \\
& = -h(Z) - \gamma \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^3 \right] + O(\gamma^3). \tag{25}
\end{align}$$

(The expectations above are finite by Lemma 1.) We can now compute the Taylor expansion of $D(P_{\tilde{Z}}\|P_Z)$ in $\gamma$:

$$\begin{align}
D(P_{\tilde{Z}}\|P_Z) & = \int_{\mathbb{R}} p_{\tilde{Z}}(z) \ln\left(\alpha \frac{p_Z(z)^{1-\gamma}}{p_Z(z)}\right) dz \nonumber \\
& = \ln(\alpha) - \gamma \alpha \int_{\mathbb{R}} p_Z(z)^{1-\gamma} \ln(p_Z(z)) dz \nonumber \\
& = -\gamma h(Z) - \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \frac{\gamma^2}{2} h(Z)^2 + O(\gamma^3) \nonumber \\
& \quad - \gamma \left( 1 - \gamma h(Z) - \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \gamma^2 h(Z)^2 \right. \nonumber \\
& \quad \left. + O(\gamma^3) \right) \cdot \left( -h(Z) - \gamma \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] \right. \nonumber \\
& \quad \left. + \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^3 \right] + O(\gamma^3) \right) \tag{26} \\
& = -\gamma h(Z) - \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] + \frac{\gamma^2}{2} h(Z)^2 + \gamma h(Z) \nonumber \\
& \quad + \gamma^2 \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] - \gamma^2 h(Z)^2 + O(\gamma^3) \nonumber \\
& = \frac{\gamma^2}{2} \mathbb{E} \left[ (\ln(p_Z(Z)))^2 \right] - \frac{\gamma^2}{2} h(Z)^2 + O(\gamma^3)
\end{align}$$
$$ = \frac{\gamma^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^3), \qquad (27) $$

where (26) follows by (22), (23), (24) and (25). Similarly we compute the Taylor expansion of $h(\tilde{Z}) - h(Z)$: using (13) we find

$$ \begin{aligned} h(\tilde{Z}) - h(Z) &= -\frac{\ln(\alpha)}{\gamma} + \frac{1-\gamma}{\gamma} D(P_{\tilde{Z}}\|P_Z) - h(Z) \\ &= \frac{\gamma h(Z) + \frac{\gamma^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^3)}{\gamma} \\ &\quad + \frac{1-\gamma}{\gamma} \left( \frac{\gamma^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^3) \right) \\ &\quad - h(Z) \end{aligned} \qquad (28) $$

$$ = \gamma \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma^2), \qquad (29) $$

where (28) follows by (24) and (27).

Finally, we show 4). Continuity at $\gamma = 0$ follows by (27), because the latter implies

$$ \lim_{\gamma \downarrow 0} D(P_{\tilde{Z}} \| P_Z) = 0. \qquad (30) $$

We next write

$$ \begin{aligned} D(P_{\tilde{Z}} \| P_Z) &= \int_{\mathbb{R}} \alpha p_Z(z)^{1-\gamma} \ln \left( \frac{\alpha p_Z(z)^{1-\gamma}}{p_Z(z)} \right) dz \\ &= -\gamma \alpha \int_{\mathbb{R}} p_Z(z)^{1-\gamma} \ln(p_Z(z)) dz + \ln(\alpha). \end{aligned} \qquad (31) $$

To prove the desired continuity, it suffices to show that both $\alpha$ and

$$ \int_{\mathbb{R}} p_Z(z)^{1-\gamma} \ln(p_Z(z)) dz \qquad (32) $$

are continuous in $\gamma \in (0, 1 - \zeta)$. The statement for $\alpha$ follows by (23). For $k = 0, 1$ the function

$$ \gamma \mapsto p_Z(z)^{1-\gamma} \ln(p_Z(z))^k \qquad (33) $$

is continuous for every $z \in \mathbb{R}$. For all $\gamma \in (0, 1 - \zeta)$, the function

$$ z \mapsto p_Z(z)^{1-\gamma} \ln(p_Z(z))^k \qquad (34) $$

is integrable by Lemma 1. Furthermore,

$$ \left| p_Z(z)^{1-\gamma} (\ln(p_Z(z)))^k \right| \le p_Z(z) |\ln(p_Z(z))|^k + p_Z(z)^{\zeta} |\ln(p_Z(z))|^k, \qquad (35) $$

where the right-hand side is again integrable by Lemma 1. By the lemma of continuity under integrals [19, 11.4], we conclude that both $\alpha$ and (32) are continuous in $\gamma \in (0, 1 - \zeta)$, hence so is $D(P_{\tilde{Z}} \| P_Z)$. $\square$

**Proof of Theorem 1:** Take any code $\mathcal{C}$ of length $n$. Let $\bar{X}$ denote a random variable such that $P_{\bar{X}}$ is the average input distribution over the secret key, a uniformly drawn message, and the $n$ channel uses, and let $\bar{Y}$ denote the channel output random variable when the input is $\bar{X}$, so $P_{\bar{Y}}$ is the average output distribution (in the same sense as $P_{\bar{X}}$):

$$ P_{\bar{X}}(\cdot) = \frac{1}{n} \sum_{i=1}^{n} P_{X_i}(\cdot), \qquad (36) $$

$$ P_{\bar{Y}}(\cdot) = \frac{1}{n} \sum_{i=1}^{n} P_{Y_i}(\cdot). \qquad (37) $$

Starting with the condition (2), similarly to [3] we have:

$$ \begin{aligned} \Delta &\ge D(P_{Y^n} \| P_{Z^n}) \\ &= -h(Y^n) - \mathbb{E}[\ln(p_{Z^n}(Y^n))] \\ &= \sum_{i=1}^{n} (-h(Y_i|Y^{i-1}) - \mathbb{E}[\ln(p_Z(Y_i))]) \\ &\ge \sum_{i=1}^{n} (-h(Y_i) - \mathbb{E}[\ln(p_Z(Y_i))]) \\ &= \sum_{i=1}^{n} D(P_{Y_i} \| P_Z) \\ &\ge n D(P_{\bar{Y}} \| P_Z), \end{aligned} \qquad (38) $$

where the last step follows because the Kullback-Leibler divergence is convex.

We next derive a bound on $A_n(\Delta, \epsilon_n)$ in terms of $\bar{X}$ and $\bar{Y}$. For each realization $K = k$ of the secret key, we denote by $\epsilon_{n,k}$ the error probability of the code $\mathcal{C}$ with $K = k$. Let $\epsilon_n$ be the error probability averaged over the key. For each $k \in \mathcal{K}$, we have by Fano's inequality:

$$ \ln|\mathcal{M}|(1 - \epsilon_{n,k}) - 1 \le I(X^n; Y^n)|\mathcal{K} = k), \qquad (39) $$

where the joint distribution on $(X^n, Y^n)$ is computed according to a uniformly drawn message. By averaging over the key, we obtain

$$ \begin{aligned} \ln|\mathcal{M}|(1 - \epsilon_n) - 1 &\le I(X^n; Y^n)|\mathcal{K}) \\ &\le I(X^n, \mathcal{K}; Y^n) \end{aligned} \qquad (40) $$

$$ \begin{aligned} &= \sum_{i=1}^{n} I(X^n; Y_i|Y^{i-1}) \\ &= \sum_{i=1}^{n} (h(Y_i|Y^{i-1}) - h(Y_i|X^n, Y^{i-1})) \end{aligned} $$

$$ \begin{aligned} &= \sum_{i=1}^{n} (h(Y_i|Y^{i-1}) - h(Y_i|X_i)) \\ &\le \sum_{i=1}^{n} I(X_i; Y_i) \end{aligned} $$

$$ \le nI(\bar{X}; \bar{Y}) \qquad (41) $$

$$ = n(h(\bar{Y}) - h(Z)), \qquad (42) $$

where (40) holds by the Markov chain:

$$ \mathcal{K} \to X^n \to Y^n; \qquad (43) $$

and (41) because mutual information is concave in the input distribution. By the definition of $A_n(\Delta, \epsilon)$, (42) implies

$$ A_n(\Delta, \epsilon_n)(1 - \epsilon_n) - 1 \le n(h(\bar{Y}) - h(Z)). \qquad (44) $$

We shall complete the proof using (38), (44), and Lemma 2. We first treat the special case where $Z$ has the uniform distribution over a subset of $\mathbb{R}$; let us denote this subset by $\mathcal{S}$, so

$$ p_Z(z) = \begin{cases} \frac{1}{\lambda(\mathcal{S})}, & z \in \mathcal{S} \\ 0, & \text{otherwise,} \end{cases} \qquad (45) $$
where $\lambda$ denotes the Lebesgue measure. In this case, one can show that covert communication is not possible at all, so $L = 0$; we provide a proof in Appendix A. It then follows that (10) trivially holds in this case.

In the rest of this proof we shall assume that $p_Z$ does not have the form (45). Then, given any $\gamma > 0$, $P_{\tilde{Z}}$ defined by (11) differs from $P_Z$, therefore $D(P_{\tilde{Z}}\|P_Z) > 0$. Recall that the function $\gamma \mapsto D(P_{\tilde{Z}}\|P_Z)$ is continuous on $[0, 1 - \zeta]$; see Lemma 2, part 4). Therefore, there exists a sequence $\{\gamma_n\}$ such that

$$ \lim_{n \to \infty} \gamma_n = 0, \quad (46) $$

and, for large enough $n$, the PDFs defined as

$$ p_{\tilde{Z}_n}(\tilde{z}) = \alpha_n \cdot p_Z(\tilde{z})^{1-\gamma_n}, \quad \tilde{z} \in \mathbb{R}, \quad (47) $$

with

$$ \alpha_n = \left( \int_{\mathbb{R}} p_Z(z)^{1-\gamma_n} dz \right)^{-1}, \quad (48) $$

satisfy

$$ D(P_{\tilde{Z}_n} \| P_Z) = \frac{\Delta}{n}. \quad (49) $$

Using (16) we then have

$$ \frac{\Delta}{n} = \frac{\gamma_n^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma_n^3), \quad (50) $$

which implies

$$ \gamma_n = \sqrt{\frac{2}{\mathrm{Var}[\ln(p_Z(Z))]} \sqrt{\frac{\Delta}{n}} + o\left(\frac{1}{\sqrt{n}}\right)}. \quad (51) $$

We now continue from (44) as follows:

$$ \begin{aligned} & \frac{A_n(\Delta, \epsilon_n)(1 - \epsilon_n) - 1}{n} \\ & \le h(\bar{Y}) - h(Z) \\ & \le h(\tilde{Z}_n) - h(Z) \\ & = \gamma_n \mathrm{Var}[\ln(p_Z(Z))] + O(\gamma_n^2) \\ & = \sqrt{2}\sqrt{\mathrm{Var}[\ln(p_Z(Z))]} \sqrt{\frac{\Delta}{n}} + o\left(\frac{1}{\sqrt{n}}\right), \end{aligned} \quad (52) \quad (53) \quad (54) $$

where (52) follows by (15), (38), and (49); (53) by (17); and (54) by (51). Recalling the definition (4) and taking $n \to \infty$ and $\epsilon_n \to 0$ in (54) complete the proof. $\square$

**Remark 1:** Theorem 1 is reminiscent of [3, Theorem 3], which provides an upper bound on $L$ for DMCs in terms of the output distribution induced by the “off” input symbol, denoted $Q_0$, and the capacity-achieving output distribution, denoted $Q^*$. If $Q^*$ is the uniform distribution, then [3, Theorem 3] has a similar form to Theorem 1 with the PDF $p_Z$ replaced by the discrete distribution $Q_0$.

**Remark 2:** The right-hand side of (10) does not change when the noise $Z$ is scaled by a constant factor. This is true in general: for any channel (1), scaling the additive noise by a constant factor $c$ does not affect $L$, because this effect can be canceled out by multiplying the input $X$ by $c$ at the transmitter. Then, for both the receiver and the eavesdropper, there is no loss in optimality in scaling the output by $1/c$ to recover the same $Y$ as in the original channel.

## IV. TIGHTNESS OF THE UPPER BOUND

Under some additional assumptions on the noise PDF $p_Z$, one can show that the upper bound of Theorem 1 is tight.

**Assumption 1:** Assume that $p_Z$ satisfies the following:

1) $p_Z$ is bounded, i.e., there exists some $b > 0$ such that

$$ p_Z(z) \le b, \quad z \in \mathbb{R}; \quad (55) $$

2) $z \mapsto p_Z(z) \ln(p_Z(z))$ is uniformly continuous on its support $\mathrm{supp}(p_Z)$, i.e., for all $\epsilon > 0$, there exists $\delta > 0$ such that, for any $z_1, z_2 \in \mathrm{supp}(p_Z)$, $|z_1 - z_2| \le \delta$, we have

$$ |p_Z(z_1) \ln(p_Z(z_1)) - p_Z(z_2) \ln(p_Z(z_2))| \le \epsilon; \quad (56) $$

3) there exists some $\xi \in (0, 1)$ such that, for all $\gamma \in [0, \xi)$, there exists a random variable $X$ independent of $Z \sim p_Z$ such that the PDF of $X + Z$ is $p_{\tilde{Z}}$ given by (11).

**Theorem 2:** For the memoryless additive-noise channel (1), if $p_Z$ satisfies (5)–(7) as well as Assumption 1, then

$$ L = \sqrt{2} \sqrt{\mathrm{Var}[\ln(p_Z(Z))]}; \quad (57) $$

Before proving Theorem 2, we recall Lévy's convergence theorem concerning weak convergence (also called convergence in distribution) of real-valued random variables,<fnref n="1" /> and prove a lemma.

**Definition 1 (Characteristic function [20, 16.1]):** Let $X$ be a real-valued random variable. The characteristic function of $X$, $\varphi_X: \mathbb{R} \to \mathbb{C}$, $t \mapsto \varphi_X(t)$, is given by

$$ \varphi_X(t) = \mathbb{E}[e^{itX}], \quad t \in \mathbb{R}. \quad (58) $$

**Definition 2 (Weak convergence [20, 17.1]):** Let $\{X_n\}$ be a sequence of random variables and $X$ be another random variable. The probability distributions $\{P_{X_n}\}$ converge weakly to $P_X$ as $n \to \infty$ if, for every bounded continuous function $f$ on $\mathbb{R}$,

$$ \lim_{n \to \infty} \mathbb{E}[f(X_n)] = \mathbb{E}[f(X)]. \quad (59) $$

Since both the real and the imaginary parts of the function $x \mapsto e^{itx}$ are bounded and continuous for every $t \in \mathbb{R}$, if $\{P_{X_n}\}$ converge weakly to $P_X$ as $n \to \infty$, then the characteristic functions of $\{X_n\}$ must converge pointwise to the characteristic function of $X$. The reverse is also true:

**Theorem 3 (Lévy's convergence theorem [20, 18.1]):** Consider a sequence of random variables $\{X_n\}$ with respective characteristic functions $\{\varphi_{X_n}\}$. If, as $n \to \infty$, $\varphi_{X_n}$ converges pointwise to some function $\varphi$ that is continuous at 0, then $\varphi$ is the characteristic function of some random variable $X$, and $P_{X_n}$ converges weakly to $P_X$.

Let $P_0$ denote the degenerate (i.e., deterministic) distribution

$$ P_0(x) = \begin{cases} 0, & x < 0 \\ 1, & x \ge 0, \end{cases} \quad (60) $$

<footnote n="1">¹Weak convergence can also be defined for general probability measures, but that is not needed in the present work.</footnote>
and let $\varphi_0$ denote the corresponding characteristic function, so

$$ \varphi_0(t) = 1, \quad t \in \mathbb{R}. \qquad (61) $$

**Lemma 3:** Consider any $p_Z$ satisfying (5)–(7) and Assumption 1. For every $n$, let $\gamma_n \in (0, \xi)$, and let $X_n$ be independent of $Z$ and be such that

$$ \tilde{Z}_n = X_n + Z \qquad (62) $$

has density

$$ p_{\tilde{Z}_n}(\tilde{z}) = \alpha_n p_Z(\tilde{z})^{1-\gamma_n}, \quad \tilde{z} \in \mathbb{R}, \qquad (63) $$

where

$$ \alpha_n = \left( \int_{\mathbb{R}} p_Z(z)^{1-\gamma_n} dz \right)^{-1}. \qquad (64) $$

If $\gamma_n \to 0$ as $n \to \infty$, then, as $n \to \infty$, $P_{\tilde{Z}_n}$ converges weakly to $P_Z$, and $P_{X_n}$ converges weakly to $P_0$.

*Proof:* We first show that $P_{\tilde{Z}_n}$ converges weakly to $P_Z$. To this end, take any bounded continuous function $f$ on $\mathbb{R}$, and we have

$$ \begin{aligned} & \left| \mathbb{E}[f(\tilde{Z}_n)] - \mathbb{E}[f(Z)] \right| \\ &= \left| \int_{\mathbb{R}} f(z) p_{\tilde{Z}_n}(z) dz - \int_{\mathbb{R}} f(z) p_Z(z) dz \right| \\ &\le \|f\|_{\infty} \int_{\mathbb{R}} |p_{\tilde{Z}_n}(z) - p_Z(z)| dz \\ &= \|f\|_{\infty} \|P_{\tilde{Z}_n} - P_Z\|_1 \\ &\le \|f\|_{\infty} \sqrt{2D(P_{\tilde{Z}_n} \|P_Z),} \end{aligned} \qquad (65) $$

where (65) follows by Pinsker's inequality. The right-hand side of (65) tends to 0 as $n \to \infty$, because $\gamma_n \to 0$ and by Lemma 2. It follows that $\mathbb{E}[f(\tilde{Z}_n)]$ tends to $\mathbb{E}[f(Z)]$ as $n \to \infty$, therefore, by definition, $P_{\tilde{Z}_n}$ converges weakly to $P_Z$.

The above implies

$$ \lim_{n \to \infty} \varphi_{\tilde{Z}_n}(t) = \varphi_Z(t), \quad t \in \mathbb{R}. \qquad (66) $$

For any $n$, since $X_n$ is independent of $Z$, we have [20, 16.4]

$$ \varphi_{\tilde{Z}_n}(t) = \varphi_Z(t)\varphi_{X_n}(t), \quad t \in \mathbb{R}, \qquad (67) $$

where $\varphi_{X_n}$ is the characteristic function of $X_n$. By properties of characteristic functions [20, 16.2], $\varphi_Z$ is continuous and $\varphi_Z(0) = 1$, hence there exists an interval around 0 on which $\varphi_Z(t) \neq 0$. By (66) and (67), for any $t$ in this interval,

$$ \lim_{n \to \infty} \varphi_{X_n}(t) = 1. \qquad (68) $$

By, e.g., [21, Theorem 9.6.4], we know that (68) must hold for all $t \in \mathbb{R}$. This and Theorem 3 imply that $P_{X_n}$ converges weakly to $P_0$ as $n \to \infty$. $\square$

**Proof of Theorem 2:** The converse part follows immediately from Theorem 1. We shall prove the direct part using techniques similar to [9, Theorem 3], [3, Section V-B], together with Lemma 3.

Fix $\chi \in (1, \frac{3}{2})$. For sufficiently large $n$, let $\tilde{Z}_n$ have the PDF (63), with the choice

$$ \gamma_n = \sqrt{\frac{2}{\mathrm{Var}[\ln(p_Z(Z))]} \left( \frac{\Delta}{n} - \frac{1}{n^\chi} \right)}. \qquad (69) $$

(It will become clear later on that this choice of $\gamma_n$ is to satisfy the covertness condition.) Further, let $X$ be independent of $Z$ and have the distribution of $X_n$ satisfying (62); the existence of such $X$ (for sufficiently large $n$) is guaranteed by Assumption 1.

We generate a random codebook $\mathcal{C}$ by picking every code-word i.i.d. according to $P_X$ and independently of the other codewords. Note that

$$ \begin{aligned} & \mathbb{E}_{\mathcal{C}}[D(P_{Y^n|\mathcal{C}}\|P_{Z^n})] \\ &= \mathbb{E}_{\mathcal{C}}\left[D(P_{Y^n|\mathcal{C}}\|P_{\tilde{Z}_n}^{\times n})\right] + D(P_{\tilde{Z}_n}^{\times n}\|P_{Z^n}). \end{aligned} \qquad (70) $$

For the moment we assume the key is arbitrarily long and therefore allows the output $P_{Y^n|\mathcal{C}}$ of the random codebook averaged over the key to be “sufficiently close” to i.i.d. with high probability. This means that the first term in (70) is close to zero. We admit that this assumption is unrealistic, but we shall show in Section VI that a finite key would suffice. To show that $\mathcal{C}$ satisfies the covertness condition (2) with high probability, it now suffices to show that the second term on the right-hand side of (70) is less than $\Delta$ for sufficiently large $n$. This can be shown as follows:

$$ D(P_{\tilde{Z}_n}^{\times n} \| P_{Z^n}) = n D(P_{\tilde{Z}_n} \| P_Z) \qquad (71) $$

$$ = n \frac{\gamma_n^2}{2} \mathrm{Var}[\ln(p_Z(Z))] + O(n\gamma_n^3) \qquad (72) $$

$$ = \Delta - n^{1-\chi} + O\left(\frac{1}{\sqrt{n}}\right), \qquad (73) $$

where (72) follows by (16); and (73) by (69). From (73) it is clear that $D(P_{\tilde{Z}_n}^{\times n}\|P_{Z^n}) < \Delta$ for sufficiently large $n$.

We next look at the mutual information corresponding to this code construction. To simplify notation, we henceforth use $Y$ to denote the single-letter channel output, i.e., $Y = X + Z$; recall that $Y \sim \tilde{Z}_n$ and that the distributions of $X$ and $Y$ both depend on $n$. Since the inputs are i.i.d., we have

$$ \begin{aligned} \lim_{n \to \infty} \frac{1}{\sqrt{n}} I(X^n; Y^n) &= \lim_{n \to \infty} \sqrt{n} I(X; Y) \\ &= \lim_{n \to \infty} \sqrt{n} (h(Y) - h(Z)) \\ &= \lim_{n \to \infty} \sqrt{n} (h(\tilde{Z}_n) - h(Z)) \\ &= \sqrt{2} \sqrt{\mathrm{Var}[\ln(p_Z(Z))]} \cdot \sqrt{\Delta}, \end{aligned} \qquad (74) $$

where the last step follows by (17) and (69).

It now remains to show that this limit of mutual information is operationally achievable. Namely, we wish to show

$$ \lim_{\epsilon \downarrow 0} \liminf_{n \to \infty} \frac{A_n(\Delta, \epsilon)}{\sqrt{n}} \ge \lim_{n \to \infty} \frac{1}{\sqrt{n}} I(X^n; Y^n). \qquad (75) $$

From [22, Theorem 18.5] we know that, for any $\tau > 0$ the average error probability $\epsilon$ of the above random code is bounded as

$$ \epsilon \le \mathbb{P}\{i_{X^n, Y^n}(X^n, Y^n) \le \ln |\mathcal{M}_n| + \tau\} + e^{-\tau}, \qquad (76) $$

where $\mathcal{M}_n$ denotes the message set to be transmitted when the total number of channel uses is $n$; and where

$$ i_{X^n, Y^n}(x^n, y^n) = \ln \left( \frac{p_{Y^n|X^n}(y^n|x^n)}{p_{Y^n}(y^n)} \right) \qquad (77) $$
is the information density. Choosing $\tau = n^{1/4}$, we rewrite (76) as

$$ \epsilon \le \mathbb{P}\left\{ \frac{i_{X^n, Y^n}(X^n, Y^n)}{\sqrt{n}} \le \frac{\ln |\mathcal{M}_n|}{\sqrt{n}} + n^{-1/4} \right\} + e^{-n^{1/4}}. \quad (78) $$

Letting $n \to \infty$ in (78), we know that, with high probability, the average error probability of the random code C will tend to zero provided

$$ \lim_{n \to \infty} \frac{\ln |\mathcal{M}_n|}{\sqrt{n}} < \mathbb{P}\text{-lim inf}_{n \to \infty} \frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n), \quad (79) $$

where $\mathbb{P}$-lim inf denotes the limit inferior in probability; see [23]. We shall show that the term inside the $\mathbb{P}$-lim inf converges in probability to its expectation

$$ \mathbb{E}\left[\frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n)\right] = \frac{1}{\sqrt{n}} I(X^n; Y^n), \quad (80) $$

which, combined with (74), will yield the desired achievability result. By Chebyshev's inequality, for any $a > 0$,

$$ \mathbb{P}\left\{ \left| \frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n) - \mathbb{E}\left[ \frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n) \right] \right| \ge a \right\} \\ \le \frac{\mathrm{Var}\left( \frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n) \right)}{a^2}. \quad (81) $$

Hence, to prove the desired convergence in probability and thereby the desired achievability result, it now only remains to show that the variance on the right-hand side of (81) converges to 0 as $n \to \infty$.

Recall that $Y$ has the same PDF as $\tilde{Z}_n$, which has the following Taylor expansion

$$ \begin{aligned} p_Y(y) &= p_{\tilde{Z}_n}(y) \\ &= \alpha_n p_Z(y) (1 - \gamma_n \ln(p_Z(y)) p_Z(y)^{-\theta_n(y)}), \end{aligned} \quad (82) $$

where $\theta_n(y) \in (0, \gamma_n)$ for all $y \in \mathbb{R}$. We now bound the variance in (81) as follows:

$$ \begin{aligned} & \mathrm{Var}\left(\frac{1}{\sqrt{n}} i_{X^n, Y^n}(X^n, Y^n)\right) \\ &= \mathrm{Var}\left(\frac{1}{\sqrt{n}} \ln\left(\frac{p_{Y^n|X^n}(Y^n|X^n)}{p_{Y^n}(Y^n)}\right)\right) \\ &= \mathrm{Var}\left(\ln\left(\frac{p_{Y|X}(Y|X)}{p_Y(Y)}\right)\right) \tag{83} \\ &= \mathrm{Var}\left(\ln\left(\frac{p_Z(Z)}{p_Y(Y)}\right)\right) \\ &= \mathrm{Var}\left(\ln\left(\frac{p_Z(Z)}{\alpha_n p_Z(Y)(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)})}\right)\right) \end{aligned} $$

$$ = \mathrm{Var}\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right) - \ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right) - \ln(\alpha_n)\right) $$

$$ \begin{aligned} & \le \mathbb{E}\left[\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right) - \ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2\right] \\ & \le 2\mathbb{E}\left[\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right)\right)^2\right] \\ & \quad + 2\mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2\right], \end{aligned} \quad (85) $$

where (83) follows because $(X^n, Y^n)$ are i.i.d.; (84) by (82); and (85) by adding the nonnegative term

$$ \mathbb{E}\left[\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right) + \ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2\right]. $$

To prove that the variance of the information density approaches zero, it thus suffices to prove that both expectations on the right-hand side of (85) approach zero. We start with the second expectation and write it as the sum of two parts:

$$ \begin{aligned} & \mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2\right] \\ &= \mathbb{P}\{p_Z(Y) \le 1\} \\ & \quad \cdot \mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2 \middle| p_Z(Y) \le 1\right] \\ & \quad + \mathbb{P}\{p_Z(Y) \ge 1\} \\ & \quad \cdot \mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2 \middle| p_Z(Y) \ge 1\right]. \end{aligned} \quad (86) $$

For the second part, we notice that, for any $y$ such that $p_Z(y) \ge 1$ (if such $y$ exists), by (55),

$$ \ln(p_Z(y))p_Z(y)^{-\theta_n(y)} \le \ln(p_Z(y)) \le \max\{0, \ln(b)\}, \quad (87) $$

therefore

$$ \begin{aligned} & \mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2 \middle| p_Z(Y) \ge 1\right] \\ & \le \left(\ln\left(1 - \gamma_n \max\{0, \ln(b)\}\right)\right)^2, \end{aligned} \quad (88) $$

which tends to zero as $n \to \infty$. We now bound the first term on the right-hand side of (86) as follows:

$$ \begin{aligned} & \mathbb{P}\{p_Z(Y) \le 1\} \\ & \quad \cdot \mathbb{E}\left[\left(\ln\left(1 - \gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)\right)^2 \middle| p_Z(Y) \le 1\right] \\ & \le \mathbb{P}\{p_Z(Y) \le 1\} \\ & \quad \cdot \mathbb{E}\left[\left(\gamma_n \ln(p_Z(Y))p_Z(Y)^{-\theta_n(Y)}\right)^2 \middle| p_Z(Y) \le 1\right] \\ & \le \gamma_n^2 \int_{\mathbb{R}} \left(\ln(p_Z(y))\right)^2 p_Z(y)^{-2\theta_n(y)} p_Y(y) dy \\ & = \gamma_n^2 \alpha_n \int_{\mathbb{R}} \left(\ln(p_Z(y))\right)^2 p_Z(y)^{1-\gamma_n-2\theta_n(y)} dy. \end{aligned} \quad (89) $$

By Lemma 1, for large enough $n$, the integral in the above expression is finite. Since $\alpha_n \to 1$ and $\gamma_n \to 0$ as $n \to \infty$, we conclude that the right-hand side of (89) tends to zero. We have thus shown that both terms on the right-hand side of
(86) tend to zero and, therefore, the second expectation on the right-hand side of (85) tends to zero as $n \to \infty$.

We now consider the first expectation on the right-hand side of (85), which can be written as

$$ 
\begin{aligned}
& \mathbb{E}\left[\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right)\right)^2\right] \\
&= \mathbb{E}\left[(\ln(p_Z(Z)))^2\right] - 2\mathbb{E}[\ln(p_Z(Z)) \ln(p_Z(Y))] \\
&\quad + \mathbb{E}\left[(\ln(p_Z(Y)))^2\right].
\end{aligned}
\quad (90) $$

We first consider the third term on the right-hand side:

$$ 
\begin{aligned}
& \mathbb{E}\left[(\ln(p_Z(Y)))^2\right] \\
&= \int_{\mathbb{R}} p_Y(y)(\ln(p_Z(y)))^2 dy \\
&= \int_{\mathbb{R}} \alpha_n p_Z(y)(1 - \gamma_n \ln(p_Z(y))p_Z(y)^{-\theta_n(y)}) \\
&\quad \cdot (\ln(p_Z(y)))^2 dy.
\end{aligned}
\quad (91) $$

By Lemma 1 and the fact that $\alpha_n \to 1$ as $n \to \infty$, we have

$$ \lim_{n \to \infty} \mathbb{E}\left[(\ln(p_Z(Y)))^2\right] = \mathbb{E}\left[(\ln(p_Z(Z)))^2\right]. \quad (92) $$

We next consider the second term on the right-hand side of (90). We can write this expectation as a double (Riemann-Stieltjes) integral:

$$ 
\begin{aligned}
& \mathbb{E}[\ln(p_Z(Z)) \ln(p_Z(Y))] \\
&= \int_{\mathbb{R}} \int_{\mathbb{R}} p_Z(y-x) \ln(p_Z(y-x)) \ln(p_Z(y)) dy dP_X(x).
\end{aligned}
\quad (93) $$

Since, by Assumption 1, $t \mapsto p_Z(t) \ln(p_Z(t))$ is uniformly continuous on $\text{supp}(p_Z)$, we have that the family of functions $\{t \mapsto p_Z(y-t) \ln(p_Z(y-t))\}_y$ is pointwise equicontinuous wherever $y-t \in \text{supp}(p_Z)$. Again by Assumption 1, they are also uniformly bounded. By Lemma 3 and [24, Theorem 3.1], [25, Theorem 8.2.18], the following limit holds uniformly over $y \in \mathbb{R}$:

$$ \lim_{n \to \infty} \int_{\mathbb{R}} p_Z(y-x) \ln(p_Z(y-x)) dP_X(x) = p_Z(y) \ln(p_Z(y)). \quad (94) $$

Therefore,

$$ 
\begin{aligned}
& \lim_{n \to \infty} \int_{\mathbb{R}} \int_{\mathbb{R}} p_Z(y-x) \ln(p_Z(y-x)) \ln(p_Z(y)) dP_X(x) dy \\
&= \int_{\mathbb{R}} \ln(p_Z(y)) \lim_{n \to \infty} \int_{\mathbb{R}} p_Z(y-x) \ln(p_Z(y-x)) dP_X(x) dy \\
&= \int_{\mathbb{R}} \ln(p_Z(y)) p_Z(y) \ln(p_Z(y)) dy \\
&= \mathbb{E}\left[(\ln(p_Z(Z)))^2\right].
\end{aligned}
\quad (95) $$

Combining (90), (92), and (95), we obtain

$$ \lim_{n \to \infty} \mathbb{E}\left[\left(\ln\left(\frac{p_Z(Z)}{p_Z(Y)}\right)\right)^2\right] = 0. \quad (96) $$

We have now shown that both expectations on the right-hand side of (85) tend to zero as $n \to \infty$. Hence the variance in (81) tends to zero as $n \to \infty$, establishing (75) and completing the proof. □

## V. EXAMPLES

In this section we apply Theorems 1 and 2 to specific noise distributions. As before, we consider the channel (1) with the noise sequence being i.i.d.

### A. Exponential noise

Let the noise random variable Z have the exponential distribution of parameter $\Lambda > 0$:

$$ p_Z(z) = \Lambda e^{-\Lambda z}, \quad z \in \mathbb{R}^+. \quad (97) $$

This distribution satisfies both (5)–(7) and Assumption 1. Verifying (5)–(7) and Assumption 1 part 1) is straightforward. For part 2), we note that $z \mapsto p_Z(z) \ln(p_Z(z))$ has a bounded derivative, therefore, by the mean value theorem, it is uniformly continuous. To check part 3), for any $\gamma > 0$, we notice that $\tilde{Z}$ defined in (11) has the exponential distribution of parameter $(1 - \gamma)\Lambda$. It was shown in [26] that there exists X independent of Z such that $\tilde{Z} = X + Z$.

We can hence apply Theorem 2 to obtain

$$ 
\begin{aligned}
& L = \sqrt{2} \sqrt{\text{Var}[\ln(p_Z(Z))]} \\
&= \sqrt{2} \sqrt{\text{Var}[\ln(\Lambda) - \Lambda Z]} \\
&= \sqrt{2} \sqrt{\text{Var}[\Lambda Z]} \\
&= \sqrt{2}.
\end{aligned}
\quad (98) $$

### B. Generalized Gaussian noise

Consider Z having the generalized Gaussian distribution [11], [27], [12] of parameters $p > 0$ and $\sigma > 0$:

$$ p_Z(z) = \frac{c_p}{\sigma} e^{-\frac{|z|^p}{2\sigma^p}}, \quad z \in \mathbb{R}, \quad (99) $$

where

$$ c_p = \frac{p}{2^{\frac{p+1}{p}} \Gamma(\frac{1}{p})}, \quad (100) $$

with $\Gamma(\cdot)$ denoting the gamma function. The problem of characterizing the scaling constant L for this noise distribution was studied in our previous work [9]; here we shall obtain the same results by directly applying Theorems 1 and 2.

First we notice that (5)–(7) are satisfied for all $\sigma > 0$ and $p > 0$. Therefore, we can apply Theorem 1 to obtain

$$ L \le \sqrt{2} \sqrt{\text{Var}\left[\frac{|Z|^p}{2\sigma^p}\right]} = \sqrt{\frac{2}{p}}, \quad (101) $$

recovering [9, Theorem 2].

When $p = 2$, (99) becomes the Gaussian distribution, which satisfies Assumption 1. Theorem 2 then implies $L = 1$, recovering [3, Theorem 5].

When $p \in (0, 1]$, by [12] we know that Assumption 1 part 3) is satisfied. Indeed, $\tilde{Z}$ defined in (11) is also generalized Gaussian with the same p but a different $\sigma$; by [12], the generalized Gaussian distribution is self-decomposable when $0 < p \le 1$, meaning that there exists X independent of Z with $\tilde{Z} = X + Z$. The remaining parts of Assumption 1 are straightforward to verify. We can therefore apply Theorem 2 to obtain

$$ L = \sqrt{\frac{2}{p}}, \quad 0 < p \le 1, \quad (102) $$

recovering [9, Theorem 3].
### C. Generalized gamma noise

Consider $Z$ following the generalized gamma distribution [28, Appendix A.3], [29] of parameters $r, \sigma, \beta > 0$:

$$p_Z(z) = \frac{\beta}{\Gamma(r)\sigma^{\beta r}} z^{\beta r - 1} e^{-(\frac{z}{\sigma})^{\beta}}, \quad z \in \mathbb{R}^{+} \quad (103)$$

with $\Gamma(\cdot)$ denoting the gamma function.

One can easily verify that $p_Z$ satisfies (5)–(7), therefore, by Theorem 1, we have

$$L \le \sqrt{2} \sqrt{\left(r - \frac{1}{\beta}\right)^2 \psi'(r) - r + \frac{2}{\beta}}, \quad (104)$$

with $\psi'$ denoting the first derivative of the digamma function $\psi$:

$$\psi(r) = \frac{\Gamma'(r)}{\Gamma(r)}, \quad r \in \mathbb{R}. \quad (105)$$

Details of the computation can be found in Appendix C.

**Remark 3:** When $\beta = 1$, (103) reduces to the gamma distribution. When $r = \frac{1}{\beta}$, (103) reduces to the generalized Gaussian distribution (99) with $p = \beta$, but restricted to $\mathbb{R}^+$, and (104) becomes the same as (101). We cannot apply Theorem 2 to obtain an exact characterization of $L$ because the generalized gamma distribution is not known to satisfy Assumption 1, in particular its part 3).

### VI. BOUNDS ON THE KEY LENGTH

In Section IV, we assumed that an arbitrarily long key was shared between the transmitter and the receiver. In this section, we show that a finite key is sufficient to achieve the optimal $L$ given in Theorem 2. We provide an upper bound on the required key length in terms of $n$ and refine this upper bound when the noise has Gaussian or exponential distribution.

**Proposition 1:** For the memoryless additive-noise channel (1), if $p_Z$ satisfies (5)–(7) as well as Assumption 1, then there exists a sequence of codes that asymptotically achieves the optimal scaling factor $L$ of Theorem 2 with key lengths satisfying

$$\ln|K| = O(n). \quad (106)$$

**Proposition 2:** For $P_Z$ being a Gaussian or exponential distribution, (106) can be strengthened to

$$\ln|K| = o(\sqrt{n}). \quad (107)$$

The proofs of Propositions 1 and 2 can be found in Appendix B.

**Remark 4:** For Gaussian noise, the result of Proposition 2 is essentially known, albeit in settings with several technical differences from ours; for example, apply [4, Theorem 6] to the special case where (in the notation therein) $P_0 = Q_0$ and $P_1 = Q_1$. If the eavesdropper's channel is noisier than the receiver's channel, then one can show that no key is needed. This would be similar to [4, Theorem 6] with $D(Q_1||Q_0) < D(P_1||P_0)$. Some other related results on the key length in Gaussian covert communication can be found in [30], [31], [32].

### VII. CONCLUDING REMARKS

There are not many examples of additive-noise channels whose capacity under a certain input cost constraint [33], [34] admits a closed-form expression, notably the AWGN channel with a second-moment constraint, the exponential-noise channel with a first-moment constraint [26], the channel with Cauchy noise and logarithmic constraint [35], and some generalized Gaussian-noise channels [27]. Some works provide bounds on the capacity or show properties of optimal input distributions, e.g., [16], [36].

In contrast, we are able to derive a simple expression for the scaling constant $L$ for covert communication over rather general additive-noise channels. This is because, in a sense, the covertness condition (2) translates to a constraint on the output that is naturally “fitted” to the noise distribution,<fnref n="2" /> which in turn allows for a precise characterization of (or an elegant upper bound on) $L$.

It is not clear to us how to generalize Theorems 1 and 2 to scenarios where the receiver and the eavesdropper face different noise distributions, because the cost constraint would now be fitted to the eavesdropper's noise, not the receiver's. A special case where such generalization is straightforward is the Gaussian wiretap channel: the receiver and the eavesdropper are corrupted by Gaussian noise with different variances $\sigma^2$ and $\sigma_e^2$, respectively. In this case, it is well known that $L = \sigma_e^2/\sigma^2$.

Validity of the formula (57) is limited by Assumption 1, notably its part 3). For example, 3) is not known to be true for some generalized Gaussian distributions [12]. However, 3) being false (or not known to be true or false) for a certain noise PDF does not necessarily imply that the formula (57) cannot hold for such noise. This is because the input distribution to achieve $L$ need not be unique, i.e., we do not need the PDF of $X+Z$ to be exactly (11). For example, for the AWGN channel, (11) is a Gaussian distribution, and $X$ should also be Gaussian in order to induce this output distribution. However, choosing $X$ to take only two values, $\pm a$ for some $a$ approaching zero as $n \to \infty$, can also attain $L$ [37]. If one can show that similar input distributions can attain $L$ on other additive-noise channels, in particular, those that do not satisfy Assumption 1, then one may be able to further extend the validity of (57).

## APPENDIX A
UNIFORM NOISE

Consider the noise (45). Suppose there exists an input distribution that yields an output distribution $P_Y$ such that

$$D(P_Y \| P_Z) < \infty. \quad (108)$$

For this to hold, $P_Y$ needs to be absolutely continuous with respect to $P_Z$, i.e., $P_Y \ll P_Z$, and we have

$$\begin{aligned} D(P_Y \| P_Z) &= -h(Y) - \int_S p_Y(y) \ln(p_Z(y)) dy \\ &= -h(Y) - \ln\left(\frac{1}{\lambda(S)}\right) \end{aligned}$$

<footnote n="2">²For example, for Gaussian noise, it translates into a second-moment constraint, and for exponential noise into a first-moment constraint.</footnote>
$$= h(Z) - h(Y). \tag{109}$$

On the other hand, since $Y = X + Z$, we must have

$$\begin{aligned} I(X; Y) &= h(Y) - h(Z) \\ &= -D(P_Y \| P_Z) \end{aligned} \tag{110}$$

where the last step follows by (109). Since $I(X; Y) \ge 0$, the only way this can happen is to have $P_Z = P_Y$. That is, the only way to satisfy (108) is to have $X = 0$ with probability one. It thus follows that covert communication is not possible and therefore, by definition, $L = 0$.

## APPENDIX B

### PROOFS OF PROPOSITIONS 1 AND 2

We consider the same random code construction as in the proof of Theorem 2 in Section IV, where the codewords are generated i.i.d. according to $P_X$ such that $X_n \sim P_X$ satisfies (62). (As before, to avoid cumbersome notation, we do not explicitly write the distributions of $X$ and $Y$ as functions of $n$.) We denote by $\mathcal{C}$ the random codebook and by $P_{Y^n|\mathcal{C}}$ the output distribution conditional on $\mathcal{C}$. Recalling (70), we shall find sufficient conditions on $\ln |\mathcal{K}|$ such that

$$\lim_{n \to \infty} \mathbb{E}_{\mathcal{C}} [D(P_{Y^n|\mathcal{C}} \| P_{Y^n})] = 0, \tag{111}$$

which will ensure that $\mathcal{C}$ has the desired covertness property with high probability. This will further guarantee the existence of a good deterministic code $\mathcal{C}$ that is covert and has a small error probability, because we have already shown that, with high probability, the random code $\mathcal{C}$ has an average error probability that tends to zero.

To establish (111), we apply the channel resolvability bound of [38, Theorem 14], which asserts that, for $\rho \in (0, 1]$,

$$\begin{aligned} \mathbb{E}_{\mathcal{C}}[D(P_{Y^n|\mathcal{C}} \| P_{Y^n})] &\le \frac{1}{\rho} \ln \left(1 + e^{-\rho \ln(|\mathcal{K}| \times |\mathcal{M}|) + n \Psi(\rho |P_{Y|\mathcal{X}}, P_X)}\right) \end{aligned} \tag{112}$$

where

$$\Psi(\rho | P_{Y|X}, P_X) = \ln \left( \mathbb{E} \left[ \left( \frac{p_{Y|X}(Y|X)}{p_Y(Y)} \right)^\rho \right] \right). \tag{113}$$

(A similar resolvability technique based on [38, Theorem 14] was proposed in [31, Lemma 13].)

**Proof of Proposition 1:** For sufficiently small $\rho$, the expectation in (113) can be upper-bounded as

$$\begin{aligned} & \mathbb{E} \left[ \left( \frac{p_{Y|X}(Y|X)}{p_Y(Y)} \right)^\rho \right] \\ &= \mathbb{E} \left[ \left( \frac{p_Z(Y-X)}{p_Y(Y)} \right)^\rho \right] \\ &\le \mathbb{E} \left[ \left( \frac{b}{p_Y(Y)} \right)^\rho \right] \\ &= b^\rho \int_{\mathbb{R}} p_Y(y)^{1-\rho} dy \\ &= b^\rho \int_{\mathbb{R}} \alpha_n^{1-\rho} p_Z(y)^{1-\gamma_n(1-\rho)-\rho} dy \\ &= \alpha_n^{1-\rho} b^\rho \int_{\mathbb{R}} p_Z(y)^{1-\rho} \cdot \left(1 - \gamma_n(1-\rho) \ln(p_Z(y)) p_Z(y)^{-\theta_n(y)}\right) dy \end{aligned} \tag{115}$$

$$= b^\rho \int_{\mathbb{R}} p_Z(y)^{1-\rho} dy + O\left(\frac{1}{\sqrt{n}}\right) \tag{116}$$

where (114) follows by (55); (115) by the Taylor expansion of $p_Y(y)$ with the Lagrange form of the remainder (82); and (116) by (23), (69), and Lemma 1. For sufficiently small $\rho$, Lemma 1 ensures that the integral in (116) is finite, which in turn implies that (113) is bounded. Therefore choosing $\ln|\mathcal{K}| = O(n)$ ensures that the right-hand side of (112) goes to 0 as $n \to \infty$, establishing (111). $\square$

**Proof of Proposition 2:**

a) Gaussian noise: Let $Z \sim \mathcal{N}(0, \sigma^2)$ with $\sigma > 0$. It is easy to check that the input and output distributions are $X \sim \mathcal{N}(0, \frac{\sigma^2 \gamma_n}{1-\gamma_n})$ and $Y \sim \mathcal{N}(0, \frac{\sigma^2}{1-\gamma_n})$, respectively, and

$$\begin{aligned} \Psi(\rho | P_{Y|X}, P_X) &= \ln \left( \int_{\mathbb{R}} \int_{\mathbb{R}} p_{X,Y}(x, y) \left( \frac{p_{Y|X}(y|x)}{p_Y(y)} \right)^\rho dx dy \right) \\ &= \ln \left( \int_{\mathbb{R}} \int_{\mathbb{R}} p_Z(y-x) p_X(x) \left( \frac{p_Z(y-x)}{p_Y(y)} \right)^\rho dx dy \right) \\ &= \ln \left( \int_{\mathbb{R}} \int_{\mathbb{R}} \left( \frac{1}{\sqrt{2\pi\sigma}} \right)^2 \sqrt{\frac{1-\gamma_n}{\gamma_n}} e^{-\frac{(y-x)^2}{2\sigma^2}} e^{-\frac{x^2}{2\sigma^2(1-\gamma_n)}} \right. \\ & \qquad \left. \cdot \left( \frac{1}{\sqrt{1-\gamma_n}} e^{-\frac{(y-x)^2}{2\sigma^2}} e^{-\frac{y^2}{2\sigma^2(1-\gamma_n)}} \right)^\rho dx dy \right) \\ &= \ln \left( \int_{\mathbb{R}} \int_{\mathbb{R}} \left( \frac{1}{\sqrt{2\pi\sigma}} \right)^2 \frac{(1-\gamma_n)^{\frac{1}{2}-\frac{\rho}{2}}}{\sqrt{\gamma_n}} e^{-\frac{(y-1+\rho\gamma_n)x^2}{2\sigma^2(1+\rho\gamma_n)}} \right. \\ & \qquad \left. \cdot e^{-\frac{x^2(1-\gamma_n)(1-\rho^2\gamma_n)}{2\sigma^2(1+\rho\gamma_n)}} dy dx \right) \tag{117} \\ &= \ln \left( \frac{(1-\gamma_n)^{\frac{1}{2}-\frac{\rho}{2}}}{\sqrt{\gamma_n}} \frac{1}{\sqrt{1+\rho\gamma_n}} \sqrt{\frac{\gamma_n(1+\rho\gamma_n)}{(1-\gamma_n)(1-\rho^2\gamma_n)}} \right) \\ &= \ln \left( \frac{(1-\gamma_n)^{-\frac{\rho}{2}}}{\sqrt{1-\rho^2\gamma_n}} \right), \end{aligned} \tag{118}$$

where (117) follows by Fubini's theorem.

If the message rate scales according to the optimal scaling constant $L$ as in Theorem 2, i.e., $\lim_{n \to \infty} \frac{\ln|\mathcal{M}|}{\sqrt{\Delta\sqrt{n}}} = 1$, then there exists a positive sequence $\{\xi_n\}$ such that $\xi_n = o(\sqrt{n})$ and $\ln|\mathcal{M}| \ge \sqrt{\Delta\sqrt{n}} - \xi_n$. Let $\{\rho_n\}$, $\rho_n \in (0, 1)$ for any $n$, be such that $\rho_n \to 0$ and $\rho_n \xi_n \to \infty$ when $n \to \infty$. Continuing from (118), we obtain

$$\begin{aligned} \Psi(\rho_n | P_{Y|X}, P_X) &= -\frac{\rho_n}{2} \ln(1 - \gamma_n) - \frac{1}{2} \ln(1 - \rho_n^2 \gamma_n) \\ &= -\frac{\rho_n}{2} (-\gamma_n + O(\gamma_n^2)) - \frac{1}{2} (-\rho_n^2 \gamma_n + O(\rho_n^4 \gamma_n^2)) \\ &= \left(\frac{\rho_n}{2} + \frac{\rho_n^2}{2}\right) \gamma_n + O(\rho_n \gamma_n^2) \\ &= \rho_n(1 + \rho_n) \sqrt{\frac{\Delta}{n}} + O\left(\frac{\rho_n}{n}\right), \end{aligned} \tag{119}$$
where (119) follows by recalling the expression of $\gamma_n$ in (69). We have now established the upper bound

$$ 
\begin{aligned}
\mathbb{E}_C [D(P_{Y^n|C}||P_{Y^n})] \\
&\le \frac{1}{\rho_n} \ln \left( 1 + e^{-\rho_n (\ln|K| + \ln|M|) + \rho_n (1+\rho_n) \sqrt{\Delta}\sqrt{n} + O(\rho_n)} \right) \\
&\le \frac{1}{\rho_n} e^{-\rho_n (\ln|K| - \rho_n \sqrt{\Delta}\sqrt{n} - \xi_n + O(1))}.
\end{aligned} 
\quad (120) 
$$

A key length $\ln|K| = \rho_n\sqrt{\Delta}\sqrt{n} + 2\xi_n$ would be sufficient to ensure (111). Since $\rho_n \to 0$ and $\xi_n = o(\sqrt{n})$, it follows that $\ln|K| = o(\sqrt{n})$.

b) Exponential noise: For $Z$ having the exponential distribution (97) of parameter $\Lambda > 0$, which we denote $\mathcal{E}(\Lambda)$, the target output distribution is $Y \sim \mathcal{E}((1 - \gamma_n)\Lambda)$. The input distribution that induces this output distribution is a mixture of a point mass at 0 and an exponential distribution [26]:

$$ P_X(x) = \begin{cases} 0, & x < 0 \\ 1 - \gamma_n e^{-(1-\gamma_n)\Lambda x}, & x \ge 0. \end{cases} \quad (121) $$

We compute $\Psi(\rho|P_{Y|X}, P_X)$ as follows:

$$ 
\begin{aligned}
\Psi(\rho|P_{Y|X}, P_X) \\
&= \ln\left(\int_{\mathbb{R}} \int_{\mathbb{R}} p_Z(y-x) \left(\frac{p_Z(y-x)}{p_Y(y)}\right)^\rho dP_X(x) dy\right) \\
&= \ln\left( (1-\gamma_n) \int_0^\infty \Lambda e^{-\Lambda y} \left(\frac{1}{1-\gamma_n} \frac{e^{-\Lambda y}}{e^{-\Lambda(1-\gamma_n)y}}\right)^\rho dy \\
&\qquad + \gamma_n \int_0^\infty \int_0^y \Lambda^2(1-\gamma_n) e^{-\Lambda(y-x)} e^{-\Lambda(1-\gamma_n)x} \\
&\qquad \qquad \cdot \left(\frac{1}{1-\gamma_n} \frac{e^{-\Lambda(y-x)}}{e^{-\Lambda(1-\gamma_n)y}}\right)^\rho dx dy \right) \\
&= \ln\left( (1-\gamma_n)^{1-\rho} \int_0^\infty \Lambda e^{-\Lambda(1+\rho\gamma_n)y} dy \right. \\
&\qquad \left. + \gamma_n \int_0^\infty \int_0^y \Lambda^2(1-\gamma_n)^{1-\rho} e^{-\Lambda(1+\gamma_n\rho)y} e^{\Lambda(\gamma_n+\rho)x} dx dy \right) \\
&= \ln\left( \frac{(1-\gamma_n)^{1-\rho}}{1+\rho\gamma_n} \right. \\
&\qquad \left. + \gamma_n \int_0^\infty \Lambda \frac{(1-\gamma_n)^{1-\rho}}{\gamma_n+\rho} e^{-\Lambda(1+\gamma_n\rho)y} (e^{\Lambda(\gamma_n+\rho)y} - 1) dy \right) \\
&= \ln\left( 1 - \gamma_n + \gamma_n \frac{(1-\gamma_n)^{1-\rho}}{\gamma_n+\rho} \right. \\
&\qquad \left. \cdot \left( \frac{1}{1+\gamma_n\rho - \gamma_n - \rho} - \frac{1}{1+\gamma_n\rho} \right) + o(\gamma_n) \right) \\
&= \frac{\rho}{1-\rho}\gamma_n + o(\gamma_n) \\
&= \frac{\sqrt{2\rho}}{1-\rho}\sqrt{\frac{\Delta}{n}} + o\left(\frac{1}{\sqrt{n}}\right),
\end{aligned} 
\quad (122) 
$$

where (122) follows by recalling the expression of $\gamma_n$ in (69). By a similar reasoning to the Gaussian case, it follows that $\ln|K| = o(\sqrt{n})$ suffices to ensure (111). $\square$

## APPENDIX C
### DERIVATION OF (104)

By Theorem 1,

$$ 
\begin{aligned}
L &\le \sqrt{2\sqrt{\mathrm{Var}[\ln(p_Z(Z))]}} \\
&= \sqrt{2}\sqrt{\mathbb{E}[\ln(p_Z(Z))^2] - (h(Z))^2},
\end{aligned} 
\quad (123) 
$$

where

$$ h(Z) = \ln\left(\frac{\Gamma(r)\sigma}{\beta}\right) + r + \left(\frac{1}{\beta} - r\right)\psi(r). \quad (124) $$

The other term on the right-hand side of (123) can be written as

$$ 
\begin{aligned}
& \mathbb{E}[\ln(p_Z(Z))^2] \\
&= \int_0^\infty p_Z(z) \\
&\quad \cdot \left( \ln\left(\frac{\beta}{\Gamma(r)\sigma^{\beta r}}\right) + (\beta r - 1) \ln(z) - \left(\frac{z}{\sigma}\right)^\beta \right)^2 dz \\
&= \left( \ln\left(\frac{\beta}{\Gamma(r)\sigma^{\beta r}}\right) \right)^2 \\
&\quad + \int_0^\infty p_Z(z) \left( 2 \ln\left(\frac{\beta}{\Gamma(r)\sigma^{\beta r}}\right) \left( (\beta r - 1) \ln(z) - \left(\frac{z}{\sigma}\right)^\beta \right) \right. \\
&\qquad \left. + (\beta r - 1)^2 \ln(z)^2 \right. \\
&\qquad \left. - 2(\beta r - 1) \ln(z) \left(\frac{z}{\sigma}\right)^\beta + \left(\frac{z}{\sigma}\right)^{2\beta} \right) dz \\
&= \left( \ln\left(\frac{\beta}{\Gamma(r)\sigma^{\beta r}}\right) \right)^2 \\
&\quad + 2 \ln\left(\frac{\beta}{\Gamma(r)\sigma^{\beta r}}\right) \left( (\beta r - 1) \mathbb{E}[\ln(Z)] - \mathbb{E}\left[\left(\frac{Z}{\sigma}\right)^\beta\right] \right) \\
&\quad + (\beta r - 1)^2 \mathbb{E}[\ln(Z)^2] - 2(\beta r - 1) \mathbb{E}\left[\ln(Z)\left(\frac{Z}{\sigma}\right)^\beta\right] \\
&\quad + \mathbb{E}\left[\left(\frac{Z}{\sigma}\right)^{2\beta}\right].
\end{aligned} 
\quad (125) 
$$

We now proceed to compute all the terms in (125):

$$ \mathbb{E}\left[\left(\frac{Z}{\sigma}\right)^{\beta}\right] = r, \quad (126) $$

$$ \mathbb{E}\left[\left(\frac{Z}{\sigma}\right)^{2\beta}\right] = (r+1)r, \quad (127) $$

$$ 
\begin{aligned}
\mathbb{E}[\ln(Z)] &= \int_0^\infty \frac{\beta}{\Gamma(r)\sigma^{\beta r}} z^{\beta r - 1} e^{-(\frac{z}{\sigma})^\beta} \ln(z) dz \\
&= \frac{1}{\sigma} \int_0^\infty \frac{\beta}{\Gamma(r)} \left(\frac{z}{\sigma}\right)^{\beta r - 1} e^{-(\frac{z}{\sigma})^\beta} \ln\left(\frac{z}{\sigma}\right) dz + \ln(\sigma) \\
&= \frac{1}{\beta\Gamma(r)} \int_0^\infty z^{r-1} e^{-z} \ln(z) dz + \ln(\sigma) \\
&= \frac{\Gamma'(r)}{\beta\Gamma(r)} + \ln(\sigma) \\
&= \frac{1}{\beta}\psi(r) + \ln(\sigma),
\end{aligned} 
\quad (128) 
$$
$$
\begin{align}
\mathbb{E}[\ln(Z)^2] &= \int_0^\infty \frac{\beta}{\Gamma(r)\sigma^{\beta r}} z^{\beta r-1} e^{-(\frac{z}{\sigma})^\beta} \ln(z)^2 dz \nonumber \\
&= \frac{1}{\sigma} \int_0^\infty \frac{\beta}{\Gamma(r)} \left(\frac{z}{\sigma}\right)^{\beta r-1} e^{-(\frac{z}{\sigma})^\beta} \ln\left(\frac{z}{\sigma}\right)^2 dz \nonumber \\
&\quad + 2 \ln(\sigma) \mathbb{E}[\ln(Z)] - \ln(\sigma)^2 \nonumber \\
&= \frac{1}{\beta^2 \Gamma(r)} \int_0^\infty z^{r-1} e^{-z} \ln(z)^2 dz \nonumber \\
&\quad + 2 \ln(\sigma) \mathbb{E}[\ln(Z)] - \ln(\sigma)^2 \nonumber \\
&= \frac{\Gamma''(r)}{\beta^2 \Gamma(r)} + 2 \ln(\sigma) \mathbb{E}[\ln(Z)] - \ln(\sigma)^2 \nonumber \\
&= \frac{1}{\beta^2} \psi'(r) + \frac{1}{\beta^2} \psi(r)^2 + 2 \frac{\ln(\sigma)}{\beta} \psi(r) + \ln(\sigma)^2, \tag{129}
\end{align}
$$

$$
\begin{align}
& \mathbb{E} \left[ \ln(Z) \left( \frac{Z}{\sigma} \right)^{\beta} \right] \nonumber \\
&= \int_0^{\infty} \frac{\beta}{\Gamma(r) \sigma^{\beta r}} z^{\beta r - 1} e^{-(\frac{z}{\sigma})^{\beta}} \ln(z) \left(\frac{z}{\sigma}\right)^{\beta} dz \nonumber \\
&= \frac{1}{\sigma} \int_0^{\infty} \frac{\beta}{\Gamma(r)} \left(\frac{z}{\sigma}\right)^{\beta r - 1} e^{-(\frac{z}{\sigma})^{\beta}} \ln\left(\frac{z}{\sigma}\right) \left(\frac{z}{\sigma}\right)^{\beta} dz \nonumber \\
&\quad + \ln(\sigma) \mathbb{E} \left[ \left( \frac{Z}{\sigma} \right)^{\beta} \right] \nonumber \\
&= \frac{1}{\beta \Gamma(r)} \int_0^{\infty} z^r e^{-z} \ln(z) dz + r \ln(\sigma) \nonumber \\
&= \frac{\Gamma'(r+1)}{\beta \Gamma(r)} + r \ln(\sigma) \nonumber \\
&= \frac{1}{\beta} r \frac{\Gamma'(r)}{\Gamma(r)} + \frac{1}{\beta} + r \ln(\sigma) \nonumber \\
&= \frac{r}{\beta} \psi(r) + \frac{1}{\beta} + r \ln(\sigma). \tag{130}
\end{align}
$$

Combining all numbered equations above yields (104).

ACKNOWLEDGMENT

The authors would like to thank Malcolm Egan and Matthieu Bloch for helpful discussions, as well as the anonymous reviewers for their suggestions and comments.

REFERENCES

[1] B. A. Bash, D. Goeckel, and D. Towsley, “Limits of reliable communication with low probability of detection on AWGN channels,” *IEEE J. Sel. Areas Commun.*, vol. 31, no. 9, pp. 1921–1930, February 2012.

[2] P. H. Che, M. Bakshi, and S. Jaggi, “Reliable deniable communication: hiding messages in noise,” in *Proc. IEEE Int. Symp. Inform. Theory*, Istanbul, Turkey, July 7–13 2013.

[3] L. Wang, G. W. Wornell, and L. Zheng, “Fundamental limits of communication with low probability of detection,” *IEEE Trans. Inform. Theory*, vol. 62, no. 6, pp. 3493–3503, April 2016.

[4] M. R. Bloch, “Covert communication over noisy channels: a resolvability perspective,” *IEEE Trans. Inform. Theory*, vol. 62, no. 5, pp. 2334–2354, February 2016.

[5] A. D. Ker, “A capacity result for batch steganography,” *IEEE Signal Process. Lett.*, vol. 14, no. 8, pp. 525–528, August 2007.

[6] T. Filler, A. D. Ker, and J. Fridrich, “The square root law of steganographic capacity for Markov covers,” in *Proc. of SPIE - The International Society for Optical Engineering*, San Jose, CA, USA, August 2–5 2009.

[7] S. Lee, R. J. Baxley, M. A. Weitnauer, and B. Walkenhorst, “Achieving undetectable communication,” *IEEE J. Sel. Top. Signal Process.*, vol. 9, no. 7, pp. 1195–1205, October 2015.

[8] A. Bendary, A. Abdelaziz, and C. E. Koksal, “Achieving positive covert capacity over MIMO AWGN channels,” *IEEE J. Sel. Areas Inform. Theory*, vol. 2, no. 1, pp. 149–162, March 2021.

[9] C. Bouette, L. Luzzi, and L. Wang, “Covert communication over two types of additive noise channels,” in *Proc. IEEE Inform. Theory Workshop*, Saint-Malo, France, April 23–28 2023.

[10] S. M. Kay, *Fundamentals of Statistical Signal Processing, Volume II: Detection Theory*, 1st ed. Prentice Hall, 1998.

[11] S. Nadarajah, “A generalized normal distribution,” *J. Appl. Stat.*, vol. 32, no. 7, pp. 685–694, September 2005.

[12] A. Dytso, R. Bustin, H. V. Poor, and S. Shamai, “Analytical properties of generalized Gaussian distributions,” *J. Stat. Distrib. Appl.*, vol. 5, no. 1, pp. 1–40, December 2018.

[13] S. A. Kassam, *Signal Detection in Non-Gaussian Noise*, ser. Springer Texts in Electrical Engineering. Springer New York, NY, 1988.

[14] N. C. Beaulieu and D. J. Young, “Designing time-hopping ultrawide bandwidth receivers for multiuser interference environments,” *Proceedings of the IEEE*, vol. 97, no. 2, pp. 255–284, February 2009.

[15] P. Cardieri, “Modeling interference in wireless ad hoc networks,” *IEEE Communications Surveys & Tutorials*, vol. 12, no. 4, pp. 551–572, May 2010.

[16] M. L. De Freitas, M. Egan, L. Clavier, A. Goupil, G. W. Peters, and N. Azzaoui, “Capacity bounds for additive symmetric α-stable noise channels,” *IEEE Trans. Inform. Theory*, vol. 63, no. 8, pp. 5115–5123, August 2017.

[17] L. Clavier, T. Pedersen, I. Larrad, M. Lauridsen, and M. Egan, “Experimental evidence for heavy tailed interference in the IoT,” *IEEE Commun. Lett.*, vol. 25, no. 3, pp. 692–695, March 2021.

[18] T. M. Cover and J. A. Thomas, *Elements of Information Theory*, 2nd ed. John Wiley & Sons, 2006.

[19] R. L. Schilling, *Measures, integrals and martingales*, 2nd ed. Cambridge University Press, 2017.

[20] D. Williams, *Probability with martingales*. Cambridge Univ. Pr, 1991.

[21] T. Kawata, *Fourier Analysis in Probability Theory*. Academic Press Inc., 1972.

[22] Y. Polyanskiy and Y. Wu, *Information Theory: From Coding to Learning*. Cambridge University Press, 2025. [Online]. Available: https://people.lids.mit.edu/yp/homepage/data/itbook-export.pdf

[23] S. Verdú and T. S. Han, “A general formula for channel capacity,” *IEEE Trans. Inform. Theory*, vol. 40, no. 4, pp. 1147–1157, July 1994.

[24] R. Ranga Rao, “Relations between weak and uniform convergence of measures with applications,” *The Annals of Mathematical Statistics*, vol. 33, no. 2, pp. 659–680, June 1962.

[25] V. I. Bogachev and M. A. S. Ruas, *Measure theory*. Springer, 2007.

[26] S. Verdú, “The exponential distribution in information theory,” *Problems Inform. Transmission*, vol. 32, no. 1, pp. 86–95, March 1996.

[27] A. Dytso, R. Bustin, H. V. Poor, and S. S. Shitz, “On additive channels with generalized Gaussian noise,” in *Proc. IEEE Int. Symp. Inform. Theory*, Aachen, Germany, June 25–30 2017, pp. 426–430.

[28] F. Steutel and K. van Harn, *Infinite divisibility of probability distributions on the real line*. CRC Press Inc., 2003.

[29] E. W. Stacy, “A generalization of the gamma distribution,” *Ann. Math. Stat.*, vol. 33, no. 3, pp. 1187–1192, September 1962.

[30] Q. E. Zhang, M. R. Bloch, M. Bakshi, and S. Jaggi, “Undetectable radios: covert communication under spectral mask constraints,” in *Proc. IEEE Int. Symp. Inform. Theory*, Paris, France, July 8–13 2019, pp. 992–996.

[31] ——, “Undetectable radios: covert communication under spectral mask constraints,” *arXiv preprint arXiv:2001.01201*, 2020.

[32] S.-Y. Wang and M. R. Bloch, “Covert MIMO communications under variational distance constraint,” *IEEE Trans. Inf. Forensics Secur.*, vol. 16, pp. 4605–4620, September 2021.

[33] R. G. Gallager, “Energy limited channels: coding, multiaccess, and spread spectrum,” *Laboratory for Information and Decision Systems, MIT*, vol. LIDS-P, no. 1714, November 1987.

[34] S. Verdú, “On channel capacity per unit cost,” *IEEE Trans. Inform. Theory*, vol. 36, no. 5, pp. 1019–1030, September 1990.

[35] J. Fahs and I. Abou-Faycal, “A Cauchy input achieves the capacity of a Cauchy channel under a logarithmic constraint,” in *Proc. IEEE Int. Symp. Inform. Theory*, Honolulu, HI, USA, June 30–July 5 2014, pp. 3077–3081.

[36] ——, “On properties of the support of capacity-achieving distributions for additive noise channel models with input cost constraints,” *IEEE Trans. Inform. Theory*, vol. 64, no. 2, pp. 1178–1198, February 2018.

[37] L. Wang, “On Gaussian covert communication in continuous time,” *EURASIP J. App. Sig. Proc.*, December 2019.
[38] M. Hayashi and R. Matsumoto, "Secure multiplex coding with dependent and non-uniform multiple messages," *IEEE Trans. Inform. Theory*, vol. 62, no. 5, pp. 2355-2409, May 2016.

**Cécile Bouette** (Student Member, IEEE) received the master's degree in engineering from Télécom Bretagne, Mines-Télécom Institute, France, in 2017, and the master's degree in applied mathematics from Aix Marseille Université in 2021. She is now a PhD student with ETIS laboratory (UMR 8051, CY Cergy Paris Université, ENSEA, CNRS) in Cergy-Pontoise, France. Her research interests include classical information theory and physical layer security.

**Laura Luzzi** (Member, IEEE) received the degree in Mathematics from the University of Pisa, Italy, in 2003 and the Ph.D. degree in Mathematics for Technology and Industrial Applications from Scuola Normale Superiore, Pisa, Italy, in 2007. From 2007 to 2012 she held postdoctoral positions in Télécom-ParisTech and Supélec, France, and a Marie Curie IEF Fellowship at Imperial College London, United Kingdom. Since 2012, she is an Assistant Professor at ENSEA, Cergy-Pontoise, France, and a researcher at ETIS (UMR 8051, CY Cergy Paris Université, ENSEA, CNRS). She is currently a visiting researcher with Project COSMIQ, Centre Inria de Paris. Her research interests include coding for wireless communications, physical layer security and lattice-based cryptography.

**Ligong Wang** (Senior Member, IEEE) received the B.E. degree in electronic engineering from Tsinghua University, Beijing, China, in 2004, and the M.Sc. and Dr.Sc. degrees in electrical engineering from ETH Zurich, Switzerland, in 2006 and 2011, respectively. In the years 2011-2014 he was a Postdoctoral Associate with the Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, Cambridge, MA, USA. He joined the CNRS of France as a Researcher (chargé de recherche) in 2014; he is on leave of absence from the CNRS since 2023. He is now a Senior Researcher with the Signal and Information Processing Laboratory, ETH Zurich, Switzerland, and also a Lecturer with the Lucerne University of Applied Sciences and Arts (HSLU), Switzerland. During 2019-2023 he served as Associate Editor for Shannon Theory for the IEEE Transactions on Information Theory.