# Privacy in continuous-variable distributed quantum sensing

A. de Oliveira Junior, Anton Andersen, Benjamin Lundgren Larsen, Sean William Moore, Damian Markham, Masahiro Takeoka, Jonatan Bohr Brask, Ulrik Andersen

► To cite this version:

A. de Oliveira Junior, Anton Andersen, Benjamin Lundgren Larsen, Sean William Moore, Damian Markham, et al.. Privacy in continuous-variable distributed quantum sensing. 2025. hal-05265562

HAL Id: hal-05265562

https://hal.sorbonne-universite.fr/hal-05265562v1

Preprint submitted on 17 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Privacy in continuous-variable distributed quantum sensing

A. de Oliveira Junior,¹ Anton L. Andersen,² Benjamin Lundgren Larsen,¹ Sean William Moore,²
Damian Markham,² Masahiro Takeoka,³,⁴ Jonatan Bohr Brask,¹ and Ulrik L. Andersen¹

¹Center for Macroscopic Quantum States bigQ, Department of Physics,
Technical University of Denmark, Fysikvej 307, 2800 Kgs. Lyngby, Denmark

²Sorbonne Université, CNRS, LIP6, F-75005 Paris, France

³Department of Electronics and Electrical Engineering, Keio University,
3-14-1 Hiyoshi, Kohoku-ku, Yokohama 223-8522, Japan

⁴Advanced ICT Research Institute, National Institute of Information and
Communications Technology (NICT), Koganei, Tokyo 184-8795, Japan

(Dated: September 17, 2025)

Can a distributed network of quantum sensors estimate a global parameter while protecting every locally encoded value? We answer this question affirmatively by introducing and analysing a protocol for distributed quantum sensing in the continuous-variable regime. We consider a multipartite network in which each node encodes a local phase into a shared entangled Gaussian state. We show that the average phase can be estimated with high precision, exhibiting Heisenberg scaling in the total photon number, while individual phases are inaccessible. Although complete privacy—where all other combinations of phases remain entirely hidden—is unattainable for finite squeezing in multi-party settings, it emerges in the large-squeezing limit. We further investigate the impact of displacements and optical losses, revealing trade-offs between estimation accuracy and privacy. Finally, we benchmark the protocol against other continuous-variable resource states.

# I. INTRODUCTION

Sensing spatially distributed parameters lies at the heart of emerging quantum technologies, with implications ranging from clock synchronisation [1, 2] to distributed computing [3, 4] and precision metrology [5, 6]. Over the past two decades, we have learned how quantum information may be processed, shared, and protected across networks [7–10]. Within this landscape, quantum sensor networks, in which entangled resources are distributed among spatially separated nodes that collaboratively estimate parameters, have emerged as powerful platforms for both fundamental studies and real-world applications [6, 11–18].

A central challenge in any such network is privacy: each node should learn only the authorised global quantity while remaining ignorant of the individual parameters. This is especially pressing in scenarios where nodes are not fully trusted or may act adversarially. The concept of privacy in quantum metrology [19–23] aims to ensure that local parties can estimate a global quantity—typically a linear function of encoded parameters—without revealing any individual values or functions thereof.

Recent advances in discrete-variable (DV) quantum networks have led to protocols for private parameter estimation [19, 24, 25], including experimental demonstrations [20], optimal state constructions [21], and analyses of robustness against noise and loss [22, 26]. Continuous-variable (CV) networks, by contrast, remain unexplored, even though optical Gaussian states provide deterministic, large-scale entanglement at room temperature [27, 28]. This motivates the key question addressed in the present work: Under an experimentally feasible protocol, can CV sensor networks be made private and, if so, what is the price paid in precision?

<figure><img src="image_2.png" /><figcaption>FIG. 1. Phase estimation & privacy. Two squeezed states are combined at a local beam splitter to generate a two-mode squeezed state, which is then split into four modes using two additional beam splitters. Each party receives one mode, and a local phase $\theta_k$ is encoded. The goal is to estimate the average phase while guaranteeing that individual phases—or any other combination thereof—cannot be inferred.</figcaption></figure>

We answer this question by proposing and analysing a privacy-preserving CV protocol that is experimentally feasible. Assuming a trusted source, a two-mode squeezed vacuum is distributed through a beam-splitter network that feeds $M$ modes. Each node encodes a local phase and performs a local measurement; globally, the network estimates the average phase. By tailoring the correlations in the shared Gaussian state, we confine all accessible information to that average while suppressing leakage about orthogonal combinations. See Fig. 1 for a schematic representation of the protocol discussed in this paper, illustrated with a network of $M = 4$ modes.

To quantify privacy, we analyse the quantum Fisher information matrix (QFIm), which determines the fundamental precision limits of parameter estimation and reveals how much information about the individual phases can be inferred [29, 30]. We find a sharp dichotomy between the two-mode and the multi-mode settings. For two parties, a two-mode squeezed state remains completely private, and no

<footnote>* alexssandreoliveira@gmail.com</footnote>
<figure><img src="image_3.png" /><figcaption>FIG. 2. *Estimation scheme.* The parties (depicted as coloured circles) request an *M*-partite state $\rho_0$ from the source $\mathcal{S}$ (red star), which (a) prepares and distributes it within the network. Then, (b) an unknown parameter $\theta_\mu$ is locally encoded via a quantum operation $\Lambda_\mu(\theta_\mu)$. The task is to estimate a function of the encoded parameter. Consequently, the probe is measured (c) either locally or globally, and the results are publicly transmitted to the central node.</figcaption></figure>

combination other than the average phase is accessible, for
any finite squeezing or loss. However, if a party knows its
local phase before the final read-out, it can then infer the
other's phase from the average. While the state itself does
not leak any additional combinations, such local knowledge
effectively constitutes a “break in privacy”. When the same
resource is distributed among more parties, this stringent “no-
local-knowledge” no longer applies—each node may know its
own phase—yet perfect privacy can no longer be attained with
finite squeezing. Increasing the squeezing causes all QFIm
eigenvalues to grow, but the dominant eigenvalue grows faster,
asymptotically driving the matrix towards rank 1. This leaves
an eavesdropper with vanishing information about any combi-
nation other than the dominant one. We also show that privacy
is fragile under displacement, which breaks the symmetry in
phase space, and we quantify the competing effects of optical
loss, demonstrating that suitably engineered multipartite CV
states–beyond standard GHZ-type constructions–retain com-
plete privacy properties under realistic conditions.

The paper is organised as follows. In Sec. II, we set the
scene by introducing the notion of privacy, providing a quan-
titative formulation, and recalling the Gaussian formalism.
Sec. III presents a motivating example: a two-mode squeezed
state that remains completely private under local phase shifts,
even with finite squeezing and loss. We discuss the opti-
mal conditions for privacy, the corresponding measurement
strategies, and the role of correlations. Building on this, we
present our main results on constructing a privacy protocol
for *M* parties. This includes Lemma 2, which characterises
the quantum Fisher information matrix (QFIm) of the net-
work, Theorem 3, which gives its eigenvalues, and Corol-
lary 4, which analyses its privacy properties. We then de-
velop a general formulation of the QFIm for Gaussian states
undergoing phase encoding [Lemma 5], together with a pri-
vacy measure expressed directly in terms of the covariance
matrix [Theorem 6]. Next, in Sec. IV, we discuss these re-
sults in comparison with other Gaussian resources, such as

independent single-mode squeezed states and cluster states.
Finally, we conclude by summarising our findings and pro-
viding an outlook that highlights open questions and poten-
tial future directions. The technical details underpinning our
results are presented in the appendices. In Appendix A, we
provide equivalent characterisations of unobservability, which
touch upon the definition of privacy and its characterisation.
Then, Appendices B and C give examples of privacy in spe-
cific states and elaborate on the motivating example, while
Appendices D and E present our analytical findings on the
privacy measure and the quantum Fisher information matrix.

II. SETTING THE SCENE

In this section we define the task, the tools, and the bench-
marks for privacy. We pose distributed quantum sensing as
estimating a linear target function $f(\theta) = v \cdot \theta$ while hiding all
other functions. We introduce the quantum Fisher information
matrix $\mathcal{Q}$, which allows us to formalise privacy via unobserv-
able directions, i.e., vectors in $\ker \mathcal{Q}$. This yields two tiers:
weak and complete privacy. The former refers to cases where
individual phases remain private but certain combinations of
phases may be leaked; the latter applies when only the target
function is accessible and no other combination is leaked. We
show how to assess the privacy of a given setup directly from
$\mathcal{Q}$. To quantify and qualitatively understand the dependence
of privacy on system parameters, we use the privacy measure
$P(\mathcal{Q}, v)$ introduced in Ref. [22]. We then adopt the Gaussian
phase-space formalism, establish the notation used in this pa-
per, and introduce the main quantities that will serve as our
figures of merit.
A. Privacy quantification

We consider a distributed estimation problem in which M parties, connected by quantum and classical links, seek to learn a global property of a system while revealing nothing beyond what is strictly authorised (see Fig. 2a). Each node hosts local data θ_μ and wishes to collaborate on estimating a linear function of the vector θ = (θ_1, ..., θ_M), whilst ensuring that no party (or eavesdropper) can infer the individual values or any unauthorised combination thereof. Formally, the parties share an initial joint probe state and then apply the composite channel Λ_θ := ⊗_{μ=1}^M Λ_μ(θ_μ), where Λ_μ(θ_μ) encodes the unknown parameter at node μ (see Fig. 2b). After this local encoding, every node performs a measurement and broadcasts its outcome to a trusted central processor (see Fig. 2c). These broadcast outcomes are accessible to all parties, but by design they contain only the authorised information. The task is to estimate a target function f(θ) while taking into account key constraints:

1. (Integrity): The estimation of $f(\theta)$ must be accurate as the underlying quantum resources permit.

In principle, this calls for checks on the state source, the distribution channels and any intermediate operations. Verification schemes for untrusted sources already exist for both DV and CV graph states [24, 31], but here we *assume* a trusted source that prepares the requested state within a known tolerance. The only imperfection we model explicitly is optical loss during distribution, which we take as a stand-in for residual integrity concerns. More generally, both integrity and privacy rely on the state itself; verification therefore serves both purposes. Here we simply assume a trusted source that prepares the requested state within a known tolerance, and ask: given such a state, what integrity and privacy can be guaranteed? With this caveat fixed, the remainder of the paper concentrates on privacy.

2. (Privacy): We distinguish two operational levels.

(a) Strong (complete) privacy. Only the agreed global quantity $f(\theta)$ becomes accessible. Neither individual phases nor any other combination can be inferred—legitimate parties and eavesdroppers alike can do no better than pure guessing.

(b) Weak privacy. Some extra collective information may leak—for example, other combination of phases, but single phase remains hidden. An adversary can still only guess the value of each local phase, even though they might learn limited information about certain mixtures of them.

Throughout the paper, we focus on achieving at least the weak level and, where possible, the strong level. Formal criteria for both notions are given in Definition 1 once the necessary estimation tools have been introduced.

We address the problem of privacy in distributed quantum sensing using tools from quantum estimation theory [32], in

particular the quantum Fisher information matrix. Let $\hat{\rho}$ denote the initial probe state and $\hat{\rho}(\theta) = \Lambda_{\theta}(\rho)$ the encoded state. The elements of the quantum Fisher information matrix are given by [33–35]

$$ \mathcal{Q}_{\mu\nu}(\hat{\rho}(\theta)) := \frac{1}{2} \mathrm{tr} (\hat{\rho}(\theta)(\hat{L}_{\theta_{\mu}}, \hat{L}_{\theta_{\nu}})) \quad (1) $$

where $\{\hat{A}, \hat{B}\} = \hat{A}\hat{B} + \hat{B}\hat{A}$ denotes the anticommutator and $2\partial_{\theta_{\mu}}\hat{\rho}(\theta) = \hat{\rho}(\theta)\hat{L}_{\theta_{\mu}} + \hat{L}_{\theta_{\mu}}\hat{\rho}(\theta)$ is the symmetric logarithmic derivative. The matrix $\mathcal{Q}$ governs both the achievable precision and the information that can leak about $\theta$. In particular, the quantum Cramér–Rao bound for any unbiased estimator $\hat{\theta}$ reads [36, 37]

$$ \mathrm{cov}(\hat{\theta}) \ge \mathcal{Q}^{+}, \quad (2) $$

where $\mathrm{cov}(\hat{\theta})$ is the covariance matrix, $\mathcal{Q}^+$ is the Moore–Penrose pseudoinverse, and “≥” denotes the Löowner order [38]. For any real vector $\mathbf{v} \in \mathbb{R}^M$ define the linear combination $\varphi = \mathbf{v}^\mathrm{T}\theta$. Applying (2) to a scalar estimator $\hat{\varphi} = \mathbf{v}^\mathrm{T}\theta$ yields

$$ \mathrm{var}(\hat{\varphi}) \ge \mathbf{v}^\mathrm{T}\mathcal{Q}^+\mathbf{v}. \quad (3) $$

If $\mathbf{v} \in \mathrm{ker}(\mathcal{Q})$ then $\mathbf{v}^\mathrm{T}\mathcal{Q}^+\mathbf{v} = 0$, i.e. the bound becomes trivial. Nevertheless, the probe state is locally invariant under shifts $\theta \mapsto \theta + \mathbf{tv}$; hence $\varphi$ cannot be estimated with finite error by any measurement. Such a direction $\mathbf{v}$ is called *unobservable*.

**Definition 1** (Unobservable direction & private parameter). For $\mathbf{v} = (v_1, \dots, v_M) \in \mathbb{R}^M$ define the directional derivative:

$$ \partial_{\mathbf{v}} \hat{\rho}(\theta) := \sum_{\mu=1}^{M} v_{\mu} \frac{\partial}{\partial \theta_{\mu}} \hat{\rho}(\theta). \quad (4) $$

1. A vector $\mathbf{v}$ is an unobservable at $\theta$ if $\partial_{\mathbf{v}}\hat{\rho}(\theta) = 0$.

2. A component $\theta_j$ is private at $\theta$ if there exists an unobservable $\mathbf{v}$ with $v_j \neq 0$.

Observe that in the above definition, $\partial_{\mathbf{v}}\hat{\rho}(\theta) = 0$ is equivalent to $|\hat{\rho}(\theta + \mathbf{tv}) - \hat{\rho}(\theta)| = O(t^2)$ as $t \to 0$, i.e., shifting the probe state along $\mathbf{v}$ changes $\theta_j$ while leaving every measurement statistic unchanged, so the data can never fix $\theta_j$. Privacy can be characterised via the following simple Lemma:

**Proposition 1** (Private parameters). A component $\theta_j$ is private at $\theta$ iff there exists $\mathbf{v} \in \mathrm{ker}(\mathcal{Q})$ with $v_j \neq 0$.

*Sketch of the proof.* An unobservable direction is a coordinated change of the parameters that leaves all measurement outcome probabilities unchanged to first order. If such a direction has a nonzero j-component ($v_j \neq 0$), then we can vary $\theta_j$ slightly while compensating with other components so that no statistics change. In that case the data cannot locally fix $\theta_j$ on its own, so $\theta_j$ is private. Conversely, if $\theta_j$ is private in the sense of Definition 1, then by definition there exists a small change of the whole parameter vector that changes $\theta_j$ but keeps all outcome probabilities unchanged to first order. That change is precisely an unobservable direction with $v_j \neq 0$. Lemma 7 shows that unobservable directions coincide with the kernel of the QFIm, so this is equivalent to $\mathbf{v} \in \mathrm{ker}(\mathcal{Q})$ with $v_j \neq 0$. This establishes Proposition 1. For the proof see Appendix A. □
Equivalently, $\theta_j$ is private iff $e_j \notin \text{range}(Q)$, where $e_j$ denotes the unit vector with a 1 in the j-th entry and zeros elsewhere, and range($Q$) is the column space (image) of $Q$. Requiring a null vector supported only on $j$ (i.e., $e_j \in \ker Q$) is sufficient but not necessary. Our notion of privacy is information-theoretic: it depends only on unobservability, i.e., on the kernel of the QFIm, and it makes no assumptions about what parties may already know. In practice, therefore, we monitor the smallest eigenvalues of $Q$—and, in particular, whether any of them vanish—as a primary indicator of privacy.

Importantly, we distinguish between two tiers of privacy in what follows. The first, which we call the weak form, holds when $\dim \ker Q > 0$. Equivalently, there exists a nonzero $v$ with $v^\top Q = 0$, so at least one (nontrivial) linear combination of phases is unobservable (see Definition 1). This condition alone does not guarantee that every individual phase is private; $\theta_j$ is private iff there exists $v \in \ker Q$ with $v_j \neq 0$ [see Proposition 1]. The second, a strong (or complete) is a finer-grained privacy measure—which goes beyond the simple rank-one criterion—is obtained by fixing a target function, specified by the coefficient vector $v$, and evaluating [22]:

$$P(Q, v) = \frac{v^\top Q v}{\text{tr}(Q)} \quad (5)$$

Throughout we evaluate $P(Q, v)$ with unit-norm directions, i.e., $||v||_2 = 1$. This removes arbitrary scaling of the target direction, so that $P$ is scale-invariant and interpretable as a share of the total information $\text{tr}(Q)$ concentrated along the target $f(\theta)$. Operationally, we now track two aspects: (i) whether the probe retains sensitivity to the public function, encoded in $P$, and (ii) whether any orthogonal combination of parameters remains hidden, captured by the kernel dimension $\dim \ker Q$. Combining these two indicators, we arrive at three operational privacy regimes:

1. $P = 1$ (complete privacy): The QFIm is rank-one and proportional to $vv^\top$, so all accessible information concerns the function $f(\theta)$. In this case $\dim \ker Q = N - 1$ automatically.

2. $0 < P < 1$ and $\dim \ker Q > 0$ (partially private): At least one eigenvalue of $Q$ is zero, i.e. $\ker(Q) \neq \{0\}$. Consequently some (or even all) individual parameters $\theta_j$ remain hidden, while the probe still carries information about $f(\theta)$.

3. $0 \le P < 1$ and $\dim \ker Q = 0$ (not private): All eigenvalues of $Q$ are finite, so every $\theta_j$ is observable. Whether the probe also estimates $f(\theta)$ depends only on $P$: if $P = 0$ the probe is blind to $f$, whereas for $0 < P < 1$ it reveals $f$ and the full parameter set.

As a remark of what we discussed above, note that complete privacy occurs exactly when $P(Q, v) = 1$, so that the QFIm is rank one and every direction orthogonal to $v$ is unobservable. Conversely, we speak of weak privacy whenever the reduced QFIm possesses at least one unobservable direction, i.e. whenever

$$\dim \ker Q > 0 \iff \exists v \neq 0 : v^\top Q = 0. \quad (6)$$

Complete privacy is therefore the limiting case of weak privacy in which the only observable quantity is the public function ($f(\theta) = v \cdot \theta$). Some examples are illustrated in the following box:

### Example: privacy measure for GHZ, W & $|+\rangle^{\otimes 3}$

As a warm-up, consider three parties sharing a given state $|\psi\rangle$. Each party $j$ locally encodes a phase $\theta_j$ by applying the unitary operation $U(\theta_j) = |0\rangle\langle 0| + e^{i\theta_j}|1\rangle\langle 1|$. The aim is to estimate the average phase while remaining completely agnostic about other combinations of the individual phases. The privacy measure for different choices of the initial state (see Appendix B for details) is given by

$$(a) |\text{GHZ}\rangle = \frac{1}{\sqrt{2}}(|000\rangle + |111\rangle) \rightarrow P(Q_{\text{GHZ}}, v) = 1.$$

Here $Q_{\text{GHZ}}$ is the all-ones matrix. Its kernel is the two-dimensional subspace $\{v : v_1+v_2+v_3 = 0\}$, so for each $j$ there exist null vectors with $v_j \neq 0$. Hence every individual phase $\theta_j$ is private. The only observable combination is the sum $\theta_1 + \theta_2 + \theta_3$, which coincides with the chosen target.

$$(b) |W\rangle = \frac{1}{\sqrt{3}}(|100\rangle + |010\rangle + |001\rangle) \rightarrow P(Q_W, v) = 0.$$

One has $\ker Q_W = \text{span}\{(1, 1, 1)\}$ (any global shift of all three phases is invisible). Because the null vector has all three nonzero components, Proposition 1 again implies that each $\theta_j$ is private: shifting all $\theta_j$ together changes each component while leaving all statistics intact. However, the chosen target direction $v \propto (1, 1, 1)$ lies entirely in the kernel, so the average phase is unobservable and $P(Q_W, v) = 0$.

$$(c) |+\rangle^{\otimes 3} = \left[ \frac{1}{\sqrt{2}}(|0\rangle + |1\rangle) \right]^{\otimes 3} \rightarrow P(Q_+, v) = \frac{1}{3}.$$

In this case, $Q_+$ is full rank (no kernel), so there is no null direction with $v_j \neq 0$; by Proposition 1 no individual phase is private. The probe reveals all three phases (and thus the average), with $P(Q_+, v) = 1/3$ indicating that only one third of the total information is aligned with the average; the rest leaks into orthogonal combinations.

The privacy measure also has two formal properties that make it operationally appealing. First, it is basis invariant, for any real orthogonal matrix $B$ one has $P(BQB^\top, Bv) = P(Q, v)$, so a mere rotation of parameter coordinates cannot alter the assessed privacy. Second, it is continuous, because if $|Q| < \epsilon$ then $|P(Q + \Delta Q, v) - P(Q, v)| \le \delta(\epsilon)$, so small experimental imperfections translate into proportionally small shifts in $P$ with $\delta(\epsilon) \to 0$ as $\epsilon \to 0$.
## B. Gaussian formalism

Given a Gaussian state and access to a sequence of linear optics transformations, our aim is to understand how privacy is affected by these operations, and how one can optimally design a quantum network that maximises privacy. To set the stage for our analysis, we begin by introducing the formalism of Gaussian states and expressing the quantum Fisher information matrix in this framework.

We consider quantum systems with $M$ canonical degrees of freedom, associated with annihilation and creation operators $\hat{a}_{\mu}$ and $\hat{a}_{\mu}^{\dagger}$, respectively, where $\mu \in \{1, \dots, M\}$. Setting $\hbar = 1$, we adopt the canonical commutation relations $[\hat{a}_{\mu}, \hat{a}_{\nu}] = [\hat{a}_{\mu}^{\dagger}, \hat{a}_{\nu}^{\dagger}] = 0$ and $[\hat{a}_{\mu}, \hat{a}_{\nu}] = \delta_{\mu\nu}$. For each mode, we define Hermitian position- and momentum-like operators as $\hat{x}_{\mu} = \frac{1}{\sqrt{2}}(\hat{a}_{\mu} + \hat{a}_{\mu}^{\dagger})$ and $\hat{p}_{\mu} = \frac{1}{i\sqrt{2}}(\hat{a}_{\mu} - \hat{a}_{\mu}^{\dagger})$, which satisfy the canonical commutation relation $[\hat{x}_{\mu}, \hat{p}_{\nu}] = i\delta_{\mu\nu}$. The canonical commutation relations between the corresponding $2M$ self-adjoint position and momentum operators can be written in a particularly convenient form by employing the row vector $\hat{r} = (\hat{x}_1, \hat{p}_1, \dots, \hat{x}_M, \hat{p}_M)^{\mathrm{T}}$, which obeys the commutation relation $[\hat{r}, \hat{r}^{\mathrm{T}}] = i\Omega^{1}$, where $\Omega$ is the symplectic form. Through-out this paper, we denote by $M \in \mathbb{N}$ the number of bosonic modes in the interferometer. Each mode is held by a distinct party that also equals the number of users. A second symbol $N \in \mathbb{N}$ will appear only inside recursive constructions (e.g. $M = 2^N$); it never counts parties.

Our focus is on Gaussian states. These are completely characterised by their vector of first moments $\bar{r}$ and covariance matrix $\sigma$, defined as [29, 39, 40]

$$ \bar{r} = \mathrm{tr}(\hat{\rho}\hat{r}) \quad \text{and} \quad \sigma = \frac{1}{2} \mathrm{tr}[\hat{\rho}\{(\hat{r} - \bar{r}), (\hat{r} - \bar{r})^{\mathrm{T}}\}]. \quad (7) $$

We consider Gaussian operations, described by symplectic transformations acting on the displacement vector and covariance matrix as $\sigma \rightarrow F\sigma F^{\mathrm{T}}$ and $\bar{r} \rightarrow F\bar{r} + \hat{d}$, where $\hat{d}$ is a $2n$-dimensional real vector of displacements and $F$ satisfies $F\Omega F^{\mathrm{T}} = \Omega$. These operations are fully determined by the symplectic matrix $F$ and displacement vector $\bar{r}$, and are implemented by Gaussian unitaries. Any such unitary on $M$ modes can be realised by a passive linear transformation, followed by single-mode squeezing and another passive transformation—corresponding in quantum optics to a sequence of beam splitters, phase shifters, and single-mode squeezers.

Our figure of merit is the quantum Fisher information matrix. For a Gaussian state with covariance matrix $\sigma$ and a vector of first moments $\bar{r}$, the QFIm [Eq. (1)] can be expressed as follows [41]:

$$ Q_{\mu\nu}(\sigma, \bar{r}) = \frac{1}{2} \mathrm{tr}[(\sigma^{-1}\partial_{\theta_{\mu}}\sigma)(\sigma^{-1}\partial_{\theta_{\nu}}\sigma)] + \partial_{\theta_{\mu}}\bar{r}^{\mathrm{T}}\sigma^{-1}\partial_{\theta_{\nu}}\bar{r}, \quad (8) $$

where $\sigma^{-1}$ is well defined whenever the state is strictly positive (full rank). The first term quantifies information stored in

the covariances, while the second term accounts for displacements; either term vanishes when the corresponding quantity is parameter-independent.

## III. PRIVACY IN CONTINUOUS VARIABLE SYSTEMS

### Motivating example

To set the stage, we present a minimal yet illustrative example that captures the essential features of our setting. This example allows us to introduce and discuss, in a concrete manner, the main ingredients of interest, namely, loss, displacement, measurement strategies, and the role of entanglement. A key feature of this setup is that the local phases are unknown to each party; if either party had full knowledge of its own phase, privacy would be trivially violated given there are only two participants. This constraint, however, can be relaxed in scenarios involving more parties, where privacy can still be preserved even if some parties have partial knowledge of the encoded phases.

Consider a two-mode squeezed state (TMSS) undergoing local phase shifts $\theta_1$ and $\theta_2$. In this simplest case, one may ask whether it is possible to estimate only the average phase. To make the scenario more realistic, we introduce noise prior to the phase encoding, modelled by a beam splitter with transmissivity $\eta$. For simplicity, we assume that both modes experience the same level of loss, even though in experimental implementations this symmetry may not hold. This assumption allows for a cleaner analytical treatment and captures the essential features of the problem; in Appendix C, we show how the analysis generalises when the losses differ. Under this symmetric-loss model, it can be shown that the quantum Fisher information matrix of the output state is given by

$$ Q(r, \eta) = \frac{2\eta^2 \sinh^2 2r}{1 + 4(1 - \eta)\eta \sinh^2 r} \begin{pmatrix} 1 & 1 \\ 1 & 1 \end{pmatrix}. \quad (9) $$

This matrix is clearly of rank one, capturing the fact that only a single linear combination of the two local phases can be estimated. Diagonalising $Q(r, \eta)$, we find that it has a single non-zero eigenvalue $\lambda_{\mathrm{avg}} = 4\eta^2 \sinh^2 2r/[1 + 4(1-\eta)\eta \sinh^2 r]$, associated with the eigenvector $v_{\mathrm{avg}} = 1/\sqrt{2}(1, 1)^{\mathrm{T}}$ corresponding to the average phase $\phi_{\mathrm{avg}} := 1/2(\theta_1 + \theta_2)$. The second eigenvalue vanishes, $\lambda_{\mathrm{rel}} = 0$, with the corresponding eigenvector $v_{\mathrm{rel}} = 1/\sqrt{2}(-1, 1)^{\mathrm{T}}$ linked to the relative phase $\phi_{\mathrm{rel}} := 1/2(\theta_1 - \theta_2)$. The vanishing QFI along this orthogonal direction confirms that the relative phase cannot be estimated. Since $v_{\mathrm{rel}} \in \ker Q$ and both components of $v_{\mathrm{rel}}$ are non-zero, according to Proposition 1, both phases $\theta_1$ and $\theta_2$ are private. In fact, since the QFIm is rank one, we have complete privacy, and therefore $P(Q, v_{\mathrm{avg}}) = 1$. Although only the average phase remains estimable in the presence of noise, it is important to emphasise that the optimality of the estimation is affected by $\eta$, as the QFIm is reduced by a factor of $\eta^2/[1 + 4(1 - \eta)\eta \sinh^2 r]$.

An interesting case arises when the modes are displaced before encoding the phases. Although this improves the estimation precision (as the quantum Fisher information increases),

<footnote n="1">¹ The commutator of row and column vectors of operators is taken as an outer product. The symmetrised and anti-symmetrised are defined as $\{\hat{r}, \hat{r}^{\mathrm{T}}\} := \hat{r}\hat{r}^{\mathrm{T}} + (\hat{r}\hat{r}^{\mathrm{T}})^{\mathrm{T}}$ and $[\hat{r}, \hat{r}^{\mathrm{T}}] = \hat{r}\hat{r}^{\mathrm{T}} - (\hat{r}\hat{r}^{\mathrm{T}})^{\mathrm{T}}$</footnote>
it compromises privacy. For simplicity, we set $\eta = 1$ and analyse what happens with the spectrum of the QFIm. In contrast with the previous case (no displacement), now the matrix ceases to be rank-1 and there are no zero eigenvalues – both average and relative phase can be estimated with some precision. The two eigenvalues are $\lambda_{\text{avg/rel}} = f(\alpha_1, \alpha_2, r) \pm g(\alpha_1, \alpha_2, r)$—due to the complicated dependence of $f$ and $g$ with the parameters, we decide to omit the explicit function and discuss their behaviour qualitatively. Qualitatively, $\lambda_{\text{avg}}$ is always larger than $\lambda_{\text{rel}}$, with the gap determined by the imbalance between the displacement contributions in the two modes. When $\alpha_1 = \alpha_2 = 0$, we recover the undisplaced TMSS case, where $\lambda_{\text{rel}} = 0$ and only the average phase is accessible. As soon as at least one displacement amplitude is nonzero, $\lambda_{\text{rel}}$ becomes strictly positive: this reflects the fact that displacements introduce local phase references, making the relative phase imprint itself onto the state. Physically, while the undisplaced TMSS is insensitive to opposite local phase shifts due to its perfect photon-number correlations, displacements break this symmetry by populating number-difference sectors, thus converting the relative phase into an observable quantity. The loss of privacy by displacing the modes can be quantified by using Eq. (5), which gives us

$$P(Q, v_{\text{avg}}) = 1 - \frac{(\alpha_1^2 + \alpha_2^2) \cosh 2r + 2\alpha_1\alpha_2 \sinh 2r}{2(\alpha_1^2 + \alpha_2^2) \cosh 2r + \sinh^2 2r}, \quad (10)$$

where, without loss of generality, we assume that $\alpha_1, \alpha_2 \in \mathbb{R}$. Note that the second term in Eq. (10) is always positive; thus, displacing the modes before encoding the local phases invariably leads to a reduction in the privacy measure.

We now turn to the question of which measurements the parties are allowed to perform, and what the optimal protocol is for estimating the average phase. If we restrict attention to Gaussian measurements, it can be shown that the optimal strategy within the Gaussian toolbox involves the following scheme: after the local phase encoding, each party sends their mode into a local beam splitter and performs a homodyne measurement, each in a conjugate quadrature, rotated by an angle $\phi$ (see Appendix B-1). The optimal angle $\phi_{\text{opt}}$ is given by

$$\phi_{\text{opt}} = \frac{\theta_1 + \theta_2}{2} + \tan^{-1} \left( \frac{\eta \sinh 2r}{\sqrt{1 + 4(1 - \eta)\eta \sinh^2 r}} \right). \quad (11)$$

However, this dependence of $\phi_{\text{opt}}$ on the unknown average phase poses a practical challenge. This apparent circularity is resolved by standard adaptive metrology: a short pre-run with heterodyne (or fixed-angle homodyne) detection provides a coarse estimate of $\phi_{\text{avg}}$. The local oscillators are then iteratively steered towards $\phi_{\text{opt}}$ until the classical Fisher information matches the quantum one. In the regime where phase shifts are small, the average can be neglected, and the optimal angle becomes effectively independent of the unknown parameter, removing the need for adaptive alignment.

Finally, let us consider the role of entanglement for privacy. This naturally leads to a comparison between the previous scenario and the case in which the two-mode squeezed state is

<figure><img src="image_4.png" /><figcaption>FIG. 3. Protocol. Two orthogonally squeezed states are generated by optical parametric oscillator (OPOs) and mixed at a central beam splitter to produce a two-mode squeezed state. This is symmetrically distributed via a recursive beam splitter network (yellow area), where each layer mixes modes with vacuum, doubling their number. The resulting state then undergoes local phase shifts $\{\theta_1, ..., \theta_M\}$, followed by local measurements.</figcaption></figure>

replaced by two single-mode squeezed states. Following the same protocol (and assuming $\eta = 1$ and $\alpha_1 = \alpha_2 = 0$), it is straightforward to show that the QFIm is proportional to the identity, $Q(r) = 2 \sinh^2 r \mathbb{1}_2$, with a degenerate spectrum $\lambda_{\text{avg/rel}} = 2 \sinh^2 r$. Hence $\ker(Q) = \mathbf{0}$ and, by Proposition 1, there exists no nonzero vector $v$ with $v_j \neq 0$ lying in the kernel. In particular, no component $\theta_j$ is private. This can be seen directly from the privacy measure: for both the average-phase direction $v_{\text{avg}}$ and the relative-phase direction $v_{\text{rel}}$, we have $P(Q, v_{\text{avg}}) = P(Q, v_{\text{rel}}) = 1/2$. Thus only half of the available information aligns with the chosen public function, and the remaining half leaks into the orthogonal combination. Equivalently, the scalar QCRB (3) shows that both combinations are estimated with identical precision. By contrast with the TMSS case, where $Q$ is rank-one and concentrates all information along the average-phase direction, two independent single-mode squeezers distribute information uniformly across all phase combinations. This highlights the operational role of entanglement for privacy in this two-party setting: without it, neither strong nor weak privacy can be achieved.

### Privacy in a quantum network

Given a continuous-variable resource state to be distributed among parties for collective average-phase estimation, one asks what experimentally feasible scenario achieves optimal privacy when arbitrary linear-optical operations are allowed. To address this question, we introduce an experimentally feasible protocol that splits a two-mode squeezed state into $M = 2^N$ modes, with $N \in \mathbb{N}$. We first consider the simplest scenario, in which the network is prepared, the parties encode their individual phases, and the resulting privacy is assessed. We then generalise the scheme by allowing arbitrary linear-optical operations, and study how this additional freedom affects the privacy. Figure 3a provides a pictorial overview,
while the key steps of the protocol are:

1. A two-mode squeezed state is distributed among M modes using a beam splitter network, with vacuum states injected into the unused input ports.

2. Each output mode undergoes a local phase shift $\theta_i$, where $i \in \{1, \dots, M\}$.

3. A local measurement is performed and the average phase is estimated.

As our goal is to analyse the privacy of the protocol, we first construct the quantum Fisher information matrix for the setting at hand. The following lemma gives its explicit form:

**Lemma 2** (Beam-splitter-tree QFIm). Consider a two-mode squeezed state split into $2^N$ modes by a balanced 50:50 beam splitter network. Encoding local phases $\theta = (\theta_1, \dots, \theta_M)$ via $U(\theta) = \bigotimes_{\mu=1}^M e^{i\theta_\mu \hat{n}_\mu}$, the corresponding quantum Fisher information matrix $Q$ is independent of $\theta$ and can be written in the projector form

$$Q = \frac{\cosh 2r - 1}{2^{N-2}} (1_M - \Pi_+ - \Pi_0) + \frac{\cosh 4r - 1}{2^{N-1}} \Pi_+, \quad (12)$$

where $\Pi_+ = 11^\top/M$ and $\Pi_0 = ss^\top/M$ with $1 = (1, \dots, 1)^\top$ and $s = \underbrace{(1, \dots, 1)}_{M/2}, \underbrace{-1, \dots, -1)}_{M/2}^\top$.

With an explicit characterisation of the quantum Fisher information matrix in hand, Definition 1 together with Proposition 1 imply that its eigenvalues determine the achievable privacy. The following theorem gives the spectrum of $Q$:

**Theorem 3** (Spectrum and eigenmodes of the QFIM). The eigenvalues of the quantum Fisher information matrix $Q$ characterised by Lemma 2 are

$$\lambda(Q) = \left\{ 0, \underbrace{\frac{\cosh 2r - 1}{2^{N-2}}, \dots, \frac{\cosh 2r - 1}{2^{N-2}}}_{M-2 \text{ times}}, \frac{\cosh 4r - 1}{2^{N-1}} \right\}. \quad (13)$$

The corresponding orthonormal eigenbasis is given by:

i. Zero eigenvalue: $v_0 = \frac{s}{\sqrt{M}}$.

ii. Degenerate eigenvalue: $W = \{w : 1^\top w = 0, s^\top w = 0\}$.

iii. Largest eigenvalue: $v_{\text{avg}} = \frac{1}{\sqrt{M}}$.

The spectrum in Theorem 3 admits a clear metrological interpretation. There are three distinct sectors: one zero eigenvalue (a single direction with vanishing sensitivity), an $(M-2)$-dimensional shot-noise-limited subspace with eigenvalues scaling linearly with the mean photon number, and a unique enhanced direction whose eigenvalue includes a quadratic contribution in the photon number, thus attaining Heisenberg scaling. In other words, among all independent phase combinations, only one collective mode is metrologically special, while all others remain shot-noise limited. A detailed derivation of the photon-number scaling of these eigenvalues is provided in Appendix D-4.

Combining Lemma 2 with Theorem 3, we can now determine the privacy properties of this protocol. This is done via the following corollary:

**Corollary 4** (Private components). For a two-mode squeezed state split into $M = 2^N$ modes via a balanced 50:50 beam splitter network, with local phases encoded through phase shifts, the following holds:

(i) The kernel of $Q$ is one-dimensional, with $v_0 \in \ker Q$, so there exists a single unobservable direction and the scheme exhibits privacy.

(ii) Since every entry of $s$ is nonzero, Proposition 1 implies that each parameter $\theta_j$ is individually private.

(iii) The QFIm is not rank-one, there are $M-2$ degenerate eigenvalues $\frac{\cosh 2r-1}{2^{N-2}}$ associated with the subspace $W$. Hence complete privacy does not hold.

The proofs of these three results are given in Appendix D. We also provide an efficient Mathematica notebook that constructs the covariance matrix of the beam splitter tree, the quantum Fisher information matrix, and its eigenvalues for an arbitrary number of nodes in the network–along with many other results concerning privacy in CV systems [42].

The above results assume a specific resource state, namely a two-mode squeezed state, and a specific protocol, consisting of a beam splitter network followed by local phase encoding. We now generalise these results to a generic pure state under a generic protocol. More precisely, we provide closed-form expressions for the quantum Fisher information matrix and the corresponding privacy measure, expressed directly in terms of the system’s covariance matrix, for arbitrary multi-mode Gaussian states subjected to local phase shifts.

**Lemma 5** (QFIm for Gaussian phase shifts). Let $|\Psi(\theta)\rangle$ be a pure M-mode Gaussian state obtained by applying local phase shifts to a pure state $|\psi_0\rangle$

$$|\Psi(\theta)\rangle = \left( \bigotimes_{\mu=1}^{M} e^{i\theta_{\mu}\hat{n}_{\mu}} \right) |\psi_{0}\rangle, \quad (14)$$

where $\hat{n}_\mu = \hat{a}_\mu^\dagger \hat{a}_\mu$ is the number operator on mode $\mu$, and each $\theta_\mu \in \mathbb{R}$. The quantum Fisher information matrix associated with multi-parameter phase estimation $\theta = (\theta_1, \dots, \theta_M)$ can be expressed in terms of the quadrature covariance matrix and first moments as follows:

$$Q_{\mu\nu} = 2 \sum_{z,w \in \{x,p\}} \left( \sigma_{\hat{z}_\mu \hat{w}_v}^2 + 2 \sigma_{\hat{z}_\mu \hat{w}_v} \bar{\sigma}_{\hat{z}_\mu} \bar{\hat{w}}_{\hat{w}_v} \right) - \delta_{\mu\nu}. \quad (15)$$

where $\sigma_{\hat{z}_\alpha \hat{w}_\beta} = \langle \hat{z}_\alpha \hat{w}_\beta \rangle$ and $\bar{\sigma}_{\hat{z}_\alpha} = \langle \hat{z}_\alpha \rangle$.

The proof of the above lemma is given in Appendix E. In the case of interest–where $|\psi_0\rangle$ is a two-mode squeezed state distributed through a beam splitter network–Lemma 5 recovers Lemma 2 (and vice versa). Lemma 5 also enables us to derive the following theorem for the privacy measure:

**Theorem 6** (Privacy in Gaussian phase estimation). The privacy when estimating the average phase from a pure M-mode
<figure><img src="image_5.png" /><figcaption>FIG. 4. Quantum Fisher information spectrum. Log-log plot of the eigenvalues of the quantum Fisher information matrix $\lambda(Q)$ as a function of the squeezing parameter $r$, for different numbers of modes $M = 2^N$. The largest eigenvalue is shown with solid lines, while the smallest nonzero eigenvalue is shown with dashed lines. As $M$ increases, the spectral gap between the two eigenvalues widens, highlighting how the distribution of information across phase directions depends on both squeezing and network size. The total number of photons (and hence the total metrological resource) is conserved; splitting the state among more modes spreads these photons more thinly across the network, so each local phase shift affects fewer photons and the sensitivity per parameter direction decreases.</figcaption></figure>

Gaussian state $|\Psi(\theta)\rangle$, where each local parameter $\theta_\mu$ is encoded via $U_\mu(\theta_\mu) = e^{i\theta_\mu \hat{n}_\mu}$, is given by

$$P(Q, v) = \frac{2 \sum_{\substack{\mu, \nu \\ z, w \in \{x, p\}}} (\sigma_{z_\mu \hat{w}_\nu}^2 + 2 \sigma_{z_\mu \hat{w}_\nu} \bar{\tau}_{z_\mu} \bar{\tau}_{\hat{w}_\nu}) - M}{M \left[ 2 \sum_{\substack{\mu, \nu \\ z, w \in \{x, p\}}} (\sigma_{z_\mu \hat{w}_\mu}^2 + 2 \sigma_{z_\mu \hat{w}_\mu} \bar{\tau}_{z_\mu} \bar{\tau}_{\hat{w}_\mu}) - M \right]}, \quad (16)$$

where the above summation denotes the double sum over $\mu, v$ and $z, w \in \{x, p\}$.

The proof of the above theorem is provided in Appendix E.

We conclude this section by emphasising the key aspects of our results, which will be further discussed in the next section. First, in the case of a two-mode squeezed state, complete privacy is achieved only in a two-party network—namely, when the state is not distributed beyond the original pair. This situation is directly analogous to the discrete-variable case, where the phases are encoded in a Bell state $|\psi\rangle = 2^{-1/2}(|00\rangle + |11\rangle)$. Since scalability is often desirable, we extend this setting by distributing the two-mode squeezed state among multiple parties using a beam splitter network. In doing so, we find that while each individual phase remains private, certain combinations of phases are leaked. Hence complete privacy is no longer possible. Importantly, however, the leaked information is insufficient to reconstruct any individual phase. This situation is analogous to solving a system of linear equations with fewer equations than variables: the “malicious” parties can do no better than make educated guesses. Having established these theoretical results, we now turn to an analysis of their qualitative and quantitative behaviour.

IV. PRIVACY OPTIMALITY

As we discussed in the previous section, for $N \ge 2$ complete privacy cannot be achieved; however, privacy at the level of individual phases remains guaranteed. We now turn our attention to this scenario and analyse the optimality of the achieved privacy under arbitrary linear-optical operations, including displacement and loss.

In Fig. 4 we plot the two non-zero eigenvalues of the QFIm [Eq.(13)] as functions of the squeezing parameter on a log-log scale, for different values of $M$ (colours ranging from red to black). The left and right panels show the largest and smallest non-zero eigenvalues, respectively. As the squeezing increases, the dominant eigenvalue grows much more rapidly than the subdominant one, so that most of the estimable information becomes concentrated along a single direction—the average phase—while other combinations become negligible in comparison. With a fixed total mean photon number, increasing the number of modes $M$ spreads the photons across more parameters; as a result, each local phase receives fewer photons and the shot-noise-limited sensitivity per direction decreases.

Applying theorem 6, one can get a closed-form expression for the privacy as a function of the number of parties ($M = 2^N$) in the average phase estimation, namely we have that

$$P(Q, v_{\text{avg}}) = 1 - \frac{2^N - 2}{[(2^N - 1) + \cosh 2r]} \quad \text{for } r > 0, \quad (17)$$

Eq. (17) shows how the privacy measure depends on the squeezing parameter for different numbers of modes, ranging from $M = 4$ to $M = 128$. The trend is clear: as the number of parties $M$ increases, privacy decreases. Each additional beam splitter interaction spreads entanglement into more vacuum modes, distributing information more broadly across the network. While a single two-mode squeezed state guarantees perfect privacy between two parties, extending this resource to multiple users inevitably introduces information leakage at finite squeezing. Complete privacy in the multi-party setting would therefore require the unphysical limit of infinite squeezing.

At first sight, this behaviour may seem paradoxical: although the privacy measure falls approximately as $1/M$, the quantum Fisher information matrix always contains a strictly zero eigenvalue, ensuring that at least one linear combination of local phases remains completely hidden. This feature reflects the structure of the beam splitter network. Each added layer doubles the number of output modes and enlarges the phase subspace orthogonal to the protected direction. Besides the fully hidden alternating vector $(-1, 1, -1, \dots, 1)^T$, the QFIm acquires $M - 2$ further orthogonal directions—for example, $(0, -1, 0, \dots, 0, 1)^T$ or $(-1, 0, \dots, 1, 0)^T$—all associated with the same finite eigenvalue $(\cosh 2r - 1)/2^{N-2}$. With $r$ held fixed, the total Fisher information must then be distributed across more directions. Consequently, the share associated with the average phase diminishes, and the privacy measure in Eq. (17) decreases with increasing $M$.

Henceforth, we restrict attention to the four-mode instance $M = 4$. This is the smallest network that already displays
<figure><img src="image_6.png" /><figcaption>FIG. 5. *Displacement & loss.* The two-mode squeezed state is first displaced by amounts $\alpha_1$ and $\alpha_2$, and then subjected to a loss channel modelled by beam splitters with transmissivities $\eta_1$ and $\eta_2$, respectively. Subsequently, the modes undergo the beam splitter network, after which local phases are encoded.</figcaption></figure>

all the qualitative features discussed above—a single fully hidden direction, additional degenerate orthogonal sensing directions—yet it can be experimentally realised as will be further discussed in the outlook. Using Eq. (16), we get and define the corresponding privacy measure as a function of the squeezing parameter: $P_4(r) := 1 - \frac{2}{3+\cosh 2r}$.

We now consider a slightly more general scenario by introducing displacement operations on both modes before they are sent through the beam splitter network (see Fig. 5). Specifically, we investigate how the privacy is affected when modes 1 and 2 are displaced by amounts $\alpha_1$ and $\alpha_2$, respectively. First, as in the two-mode case discussed in the motivating example, introducing displacements removes the strictly zero eigenvalue of the QFIm, so that no parameter direction remains completely hidden. However, the smallest eigenvalue can remain very small (i.e., $\epsilon$-close to zero). This motivates the use of the privacy measure to analyse how privacy changes when displacements are present. Second, using Theorem 6, we show that the privacy measure, when the two-mode squeezed state is split into four modes, is given by $P(Q, v) = P_4(r) - f(r, \alpha_1, \alpha_2)$. Here, $f(r, \alpha_1, \alpha_2)$ is a non-negative function that quantifies the reduction in privacy due to the displacements. Without loss of generality, we take $\alpha_1$ and $\alpha_2$ to be real. Since $f(r, \alpha_1, \alpha_2) \ge 0$ for all displacement values and all $r$, the privacy necessarily decreases as soon as either mode is displaced. Owing to the intricate dependence of $f(r, \alpha_1, \alpha_2)$ on the displacement parameters, we omit its full analytical expression, but it can be easily computed using Lemma 5. Rather than presenting the expression here, which offers limited insight on its own, we instead analyse the qualitative behaviour of the function and illustrate its impact through representative plots in Fig. 6.

In the first panel of Fig. 6, we examine privacy in the absence of loss ($\eta = 1$) while displacing the two-mode squeezed state by a relative amount $|\alpha| = |\alpha_2 - \alpha_1|$ in phase space. As shown, the privacy measure decreases with increasing $|\alpha|$, although it asymptotically approaches one in the limit $r \to \infty$. Since displacement is a resource for parameter estimation, the reduction in privacy arises entirely from information leakage: displacements break the symmetry in phase space and individual phases are imprinted in the first moments. Correspondingly, the scalar quantum Fisher information shown in the bottom panel of Fig. 6 increases with $|\alpha|$, reflecting the trade-off between estimation precision and privacy. Importantly, val-

<figure><img src="image_7.png" /><figcaption>FIG. 6. *Privacy under displacement & loss.* The first panel shows the behaviour of the privacy as a function of the squeezing parameter for different values of the displacement magnitude $|\alpha| = |\alpha_2 - \alpha_1|$, in the absence of loss. In the second panel, we fix $|\alpha| = 0$ and analyse how the privacy is affected by the inclusion of a loss channel with efficiency $\eta$.</figcaption></figure>

ues of $P$ close to 1 should not be read as ‘more secrecy’ by themselves: in regimes where overall sensitivity is depleted, $P \to 1$ can simply indicate that nearly all information (notably about orthogonal combinations) has been erased rather than genuinely hidden. In the second panel, we replace displacement with a loss channel, modelled by coupling the modes to vacuum via a beam splitter of transmissivity $\eta$. This process simulates imperfections in state preparation. As expected, loss degrades the privacy measure. However, this reduction does not arise from information leakage—the zero eigenvalue of the QFIm persists even in the presence of loss. Instead, the decrease in the privacy measure stems from the fact that overall sensitivity is reduced. A possible way to improve privacy in the presence of loss is to allow for a finite displacement and optimise over $|\alpha|$ so that the estimation precision increases while only partially sacrificing privacy. This optimisation can be carried out numerically using the code provided in Ref. [42].

Having characterised the impact of imperfections in the TMSS-based protocol, we now ask whether alternative Gaussian states, especially those with different entanglement structures, might offer improved or comparable privacy. In particular, we explore whether continuous-variable analogues of graph states, such as linear cluster states generated via controlled-Z (CZ) operations, can support private estimation of the average phase. While such states are foundational resources for universal measurement-based quantum computation, their usefulness for privacy-preserving metrology remains unclear. To address this, we compare the privacy of cluster states with that of both the TMSS-split network and separable squeezed product states, and further examine how the cluster strength affects the privacy of the resulting network.

We benchmark the privacy of different Gaussian states un-
<figure><img src="image_8.png" /><figcaption>FIG. 7. *Privacy optimality.* Privacy $P(Q, v)$ as a function of the squeezing parameter $r$ (a) for three different initial states: a two-mode squeezed state distributed via a symmetric beam splitter network (black curve), a linear cluster state constructed from four parties prepared in squeezed states and entangled via sequential CZ operations (red) applied to the pairs {(1, 2), (2, 3), (3, 4)} with optimal coupling strength $g_{opt} \approx 0.88$, and a product of single-mode squeezed states (dashed). In the right panel, (b) we show the privacy of the cluster state for different values of the coupling strength $g$ as a function of the squeezing parameter. Increasing the coupling strength does not improve privacy and, in fact, leads to greater information leakage about individual parameters.</figcaption></figure>

der average phase estimation (see Fig. 7). Our results show that a two-mode squeezed vacuum distributed symmetrically via beam splitters concentrates all Fisher information along the target direction, leading to near-perfect privacy in the large squeezing limit. In contrast, cluster states, despite their entanglement structure, do not support private estimation: their privacy measure asymptotically converges to the separable state baseline $P = 1/4$. Further, we show that increasing the CZ coupling strength in cluster states does not enhance privacy, suggesting a fundamental incompatibility between the position-position correlations introduced by CZ operations and the number-based phase encoding used in this protocol. Whether TMSS is optimal among all Gaussian states remains an open question. For the specific protocol considered here, however, we provide both analytical and numerical evidence supporting its near-optimality. More sophisticated continuous-variable protocols for privacy may in principle exist, but they are likely to be experimentally challenging to implement. This further highlights the TMSS-based scheme as a practical and effective platform for privacy in distributed quantum sensing.

V. CONCLUSION AND OUTLOOK

We have introduced and rigorously analysed an information-theoretic characterisation of privacy for continuous-variable sensor networks. Our framework builds on the notion of unobservable directions—vectors lying in the kernel of the quantum Fisher information matrix—which allows us to determine whether a given component $\theta_j$ is private. This yields an operational way to assess privacy at the level of individual components (local phases). For the two-mode-squeezed resource distributed over $M = 2^N$ modes, we derived a closed-form projector expression for the

QFIm (Lemma 2), obtained its full spectrum and eigenmodes (Theorem 3), and translated these into operational privacy statements (Corollary 4): there is a single unobservable direction, every local phase is individually private, yet complete privacy is not attained at finite squeezing because $Q$ is not rank-one. We also obtained general closed-form expressions for the QFIm of arbitrary multimode Gaussian states undergoing local phase shifts (Lemma 5), and for the associated privacy measure $P(Q, v)$ (Theorem 6). Together, these results provide an operational toolbox for certifying privacy in continuous-variable networks beyond the specific examples considered here.

We further analysed two practically relevant scenarios. First, we studied the effect of displacements, which enhance estimation precision by imprinting phases into the first moments but simultaneously remove the zero eigenvalue of the QFIm, thus destroying privacy at the component level. Second, we investigated optical loss, which preserves the zero eigenvalue but reduces the overall sensitivity, lowering the privacy measure without introducing additional leakage. Together, these cases highlight the distinct ways in which resources (displacement) and imperfections (loss) shape the balance between precision and privacy.

Next, a comparative study revealed that alternative Gaussian resources, such as four-mode cluster states or independent single-mode squeezers, perform worse than the two-mode squeezed-state protocol, confirming the latter as the optimal state towards private distributed sensing in the continuous-variable regime. Our results show that, among Gaussian states, the two-mode squeezed state outperforms the specific alternatives studied here. A natural follow-up question is how to formally identify the family of optimal states for a given target direction, under an explicit privacy constraint. This would provide a systematic understanding of the trade-off between metrological performance and information leakage, and may reveal new state families that outperform standard resources in constrained settings.

While our analysis assumes an honest setting—namely, that the entanglement source reliably prepares the target state and all parties follow the protocol—this is an idealisation that may not hold in practical network deployments. A natural next step is therefore to incorporate a certification layer, enabling participants to verify, in situ, that the distributed resource is sufficiently close to the intended state, even in the presence of faulty or potentially malicious sources, channels, or nodes. In the discrete-variable regime, Shettell et al. [19] have already shown how stabiliser-based tests can certify GHZ-type states and preserve both metrological integrity and input privacy in the presence of untrusted channels and dishonest parties. More recently, Descamps and Markham [31] extended this result to continuous-variable graph states, developing noise-tolerant verification routines that work with realistic squeezing and finite-precision homodyne measurements. An open problem is to develop a certification protocol tailored to our specific scheme—thus relaxing the honesty assumptions, strengthening privacy guarantees against adversarial behaviour, and paving the way towards fully secure, device-independent implementations of distributed quantum
metrology sensing.

Finally, our scheme can be feasibly implemented using a
source of two-mode squeezed states, an array of beam split-
ters, and homodyne detectors. These are all standard tools
in quantum optics. Two-mode squeezed states can be gen-
erated via standard nonlinear processes such as parametric
down-conversion [43] or four-wave mixing [44]. The gener-
ated state is interfered on a balanced beam splitter to produce
the two-mode squeezed vacuum, which is then distributed to
four parties by an additional beam splitter network, creating
the required four-mode entangled state. Each party encodes
a local phase shift by controlling the relative phase between
the signal and their local oscillator. Homodyne measurements
of appropriately chosen quadratures on each mode are then
performed to reconstruct the covariance matrix of the state.
Since no displacements are introduced, the first moments van-
ish, and the quantum Fisher information matrix follows di-
rectly from the covariance data according to Eq. 8. The entire
scheme relies only on well-established optical components,

making it experimentally feasible within current continuous-
variable platforms.

ACKNOWLEDGMENTS

AOJ would like to thank Mohammad Mehboudi for the
helpful discussions. The authors acknowledge financial
support from the EU Horizon Europe (QSNP, grant no.
101114043 & CLUSTEC, grant no. 101080173 & Clus-
terQ, grant no. 101055224), NNF project CBQS (NNF
24SA0088433), the Danish National Research Foundation
grant bigQ (DNRF 142). MT acknowledges JST Moonshot
R&D (JPMJMS226C and JPMJMS2061), JST CRONOS (JP-
MJCS24N6), and JST ASPIRE (JPMJAP2427). SWM and
DM acknowledge support from the ANR project EQUINE
(ANR-23-QUAC-0001).

[1] P. Komar, E. M. Kessler, M. Bishof, L. Jiang, A. S. Sørensen, J. Ye, and M. D. Lukin, A quantum network of clocks, Nat. Phys 10, 582 (2014).

[2] H. Dai, Q. Shen, C.-Z. Wang, S.-L. Li, W.-Y. Liu, W.-Q. Cai, S.-K. Liao, J.-G. Ren, J. Yin, Y.-A. Chen, Q. Zhang, F. Xu, C.-Z. Peng, and J.-W. Pan, Towards satellite-based quantum-secure time transfer, Nat. Phys 16, 848-852 (2020).

[3] S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, Demonstration of blind quantum computing, Science 335, 303-308 (2012).

[4] J. F. Fitzsimons, Private quantum computation: an introduction to blind quantum computing and related protocols, *Npj Quantum Inf* 3 (2017).

[5] V. Giovannetti, S. Lloyd, and L. Maccone, Quantum metrology, Phys. Rev. Lett. 96, 010401 (2006).

[6] Q. Zhuang, Z. Zhang, and J. H. Shapiro, Distributed quantum sensing using continuous-variable multipartite entanglement, Phys. Rev. A 97, 032329 (2018).

[7] H. J. Kimble, The quantum internet, Nature 453, 1023 (2008).

[8] D. Gottesman, T. Jennewein, and S. Croke, Longer-baseline telescopes using quantum repeaters, Phys. Rev. Lett. 109, 070503 (2012).

[9] T. Baumgratz and A. Datta, Quantum enhanced estimation of a multidimensional field, Phys. Rev. Lett. 116, 030801 (2016).

[10] L.-Z. Liu, Y.-Z. Zhang, Z.-D. Li, R. Zhang, X.-F. Yin, Y.-Y. Fei, L. Li, N.-L. Liu, F. Xu, Y.-A. Chen, and J.-W. Pan, Distributed quantum phase estimation with entangled photons, Nat. Photonics 15, 137-142 (2020).

[11] T. J. Proctor, P. A. Knott, and J. A. Dunningham, Networked quantum sensing, arXiv:1702.04271 (2017).

[12] T. J. Proctor, P. A. Knott, and J. A. Dunningham, Multiparam-
eter estimation in networked quantum sensors, Phys. Rev. Lett.
120, 080501 (2018).

[13] W. Ge, K. Jacobs, Z. Eldredge, A. V. Gorshkov, and M. Foss-Feig, Distributed quantum metrology with linear networks and separable inputs, Phys. Rev. Lett. 121, 043604 (2018).

[14] J. Rubio, P. A. Knott, T. J. Proctor, and J. A. Dunningham, Quantum sensing networks for the estimation of linear functions, J. Phys. A 53, 344001 (2020).

[15] P. Sekatski, S. Wölk, and W. Dür, Optimal distributed sensing in noisy environments, Phys. Rev. Res. 2, 023052 (2020).

[16] S. Wölk, P. Sekatski, and W. Dür, Noisy distributed sensing in the bayesian regime, QST 5, 045003 (2020).

[17] Z. Zhang and Q. Zhuang, Distributed quantum sensing, QST 6, 043001 (2021).

[18] A. Hamann, P. Sekatski, and W. Dür, Optimal distributed multi-parameter estimation in noisy environments, Quantum. Sci. Technol 9, 035005 (2024).

[19] N. Shettell, M. Hassani, and D. Markham, Private network pa-
rameter estimation with quantum sensors, arXiv:2207.14450
(2022).

[20] J. Ho, J. W. Webb, R. M. J. Brooks, F. Grasselli, E. Gauger, and A. Fedrizzi, Quantum-private distributed sensing, arXiv:2410.00970 (2024).

[21] M. Hassani, S. Scheiner, M. G. A. Paris, and D. Markham, Privacy in networks of quantum sensors, Phys. Rev. Lett. 134, 030802 (2025).

[22] L. Bugalho, M. Hassani, Y. Omar, and D. Markham, Private and Robust States for Distributed Quantum Sensing, Quantum 9, 1596 (2025).

[23] J. de Jong, S. Scheiner, N. R. Solomons, Z. Chaoui, D. Markham, and A. Pappa, Anonymous and private parameter estimation in networks of quantum sensors, arXiv:2507.01101 (2025).

[24] A. Unnikrishnan and D. Markham, Verification of graph states in an untrusted network, Phys. Rev. A 105, 052420 (2022).

[25] S. W. Moore and J. A. Dunningham, Secure quantum-enhanced measurements on a network of sensors, Phys. Rev. A 111, 012616 (2025).

[26] Y. Ueda, M. Ishihara, W. Roga, and M. Takeoka, Quantum net-
work sensing with efficient multi-partite entanglement distribu-
tion via lossy channels, arXiv:2505.10148 (2025).

[27] G. Adesso and F. Illuminati, Entanglement in continuous-variable systems: recent advances and current perspectives, J. Phys. A Math. Theor. 40, 7821-7880 (2007).

[28] H. Krauter, D. Salart, C. A. Muschik, J. M. Petersen, H. Shen, T. Fernholz, and E. S. Polzik, Deterministic quantum teleportation between distant atomic objects, Nature Physics 9, 400-404 (2013).
(2013).

[29] A. Serafini, *Quantum continuous variables: a primer of theoretical methods* (CRC press, 2023).

[30] R. Bertlmann and N. Friis, *Modern Quantum Theory: From Quantum Mechanics to Entanglement and Quantum Information* (Oxford University Press, 2023).

[31] E. Descamps and D. Markham, Noisy certification of continuous-variable graph states, *Phys. Rev. A* **111**, 022413 (2025).

[32] M. G. A. Paris, Quantum estimation for quantum technology, *Int. J. Quantum Inf.* **07**, 125 (2009).

[33] D. Safránek, Simple expression for the quantum fisher information matrix, *Phys. Rev. A* **97**, 042322 (2018).

[34] J. Liu, H. Yuan, X.-M. Lu, and X. Wang, Quantum fisher information matrix and multiparameter estimation, *J. Phys. A Math. Theor.* **53**, 023001 (2019).

[35] L. J. Fiderer, T. Tufarelli, S. Piano, and G. Adesso, General expressions for the quantum fisher information matrix with applications to discrete quantum imaging, *PRX Quantum* **2**, 020308 (2021).

[36] S. Ragy, M. Jarzyna, and R. Demkowicz-Dobrzański, Compatibility in multiparameter quantum metrology, *Phys. Rev. A* **94**, 052108 (2016).

[37] M. Szczykulska, T. Baumgratz, and A. Datta, Multi-parameter quantum metrology, *Adv. Phys.: X* **1**, 621 (2016).

[38] R. Bhatia, *Matrix Analysis*, Graduate Texts in Mathematics (Springer New York, 1996).

[39] C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Gaussian quantum information, *Rev. Mod. Phys.* **84**, 621 (2012).

[40] J. B. Brask, Gaussian states and operations – a quick reference, arXiv:2102.05748 (2022).

[41] A. Monras, Phase space formalism for quantum estimation of gaussian states, arXiv:1303.3682 (2013).

[42] A. de Oliveira Junior, *Privacy in continuous-variable distributed quantum sensing*, GitHub (2022).

[43] L.-A. Wu, H. Kimble, J. Hall, and H. Wu, Generation of squeezed states by parametric down conversion, *Phys. Rev. Lett* **57**, 2520 (1986).

[44] R. Slusher, L. Hollberg, B. Yurke, J. Mertz, and J. Valley, Observation of squeezed states generated by four-wave mixing in an optical cavity, *Phys. Rev. Lett* **55**, 2409 (1985).

[45] M. F. Cenni, L. Lami, A. Acín, and M. Mehboudi, Thermometry of Gaussian quantum systems using Gaussian measurements, *Quantum* **6**, 743 (2022).

[46] I. Bengtsson and K. Zyczkowski, *Geometry of Quantum States: An Introduction to Quantum Entanglement* (Cambridge University Press, 2006).

[47] M. E. Peskin, *An Introduction to quantum field theory* (CRC press, 2018).
Appendix A: Unobservability & privacy

In this appendix, we prove Proposition 1. To this end, we first present a lemma that provides equivalent characterisations of unobservability, the content of which renders the proof of the proposition straightforward.

**Lemma 7** (Equivalent criteria for unobservability). Let $\mathcal{Q}$ be the quantum Fisher information matrix with entries $Q_{\mu\nu} = \frac{1}{2} \text{tr}[\hat{\rho}\{\hat{L}_{\theta_\mu}, \hat{L}_{\theta_\nu}\}]$ with $\hat{L}_{\theta_\mu}$ being the SLDs. For any real vector $v$, the following are equivalent:

$$ (i) \quad \partial_v \hat{\rho} = 0, $$

$$ (ii) \quad \hat{L}_v := \sum_\mu v_\mu \hat{L}_{\theta_\mu} = 0 \text{ on supp}(\hat{\rho}) $$

$$ (iii) \quad v \in \ker \mathcal{Q}. $$

*Proof.* (i) $\iff$ (ii). If $\partial_v \hat{\rho} = 0$, then the defining equation for the symmetric logarithmic derivative (SLD) reduces to

$$ \hat{\rho} \hat{L}_v + \hat{L}_v \hat{\rho} = 0, \qquad (A1) $$

or equivalently,

$$ \hat{\rho} \hat{L}_v = -\hat{L}_v \hat{\rho}. \qquad (A2) $$

Since $\hat{\rho}$ is Hermitian and positive semi-definite, it admits a spectral decomposition $\hat{\rho} = \sum_k \lambda_k |\psi_k\rangle\langle\psi_k|$ with $\lambda_k \ge 0$. For each $k$ with $\lambda_k > 0$ (i.e., in supp($\hat{\rho}$)), applying Eq. (A2) to $|\psi_k\rangle$ yields:

$$ \hat{\rho}(\hat{L}_v |\psi_k\rangle) = -\hat{L}_v(\hat{\rho} |\psi_k\rangle) = -\lambda_k(\hat{L}_v |\psi_k\rangle). \qquad (A3) $$

This implies $\hat{L}_v |\psi_k\rangle$ is an eigenvector of $\hat{\rho}$ with eigenvalue $-\lambda_k < 0$. Since $\hat{\rho}$ is positive semidefinite, it has no negative eigenvalues, $\hat{L}_v |\psi_k\rangle = 0$ for all such $k$. Thus, $\hat{L}_v = 0$ on supp($\hat{\rho}$). Conversely, if $\hat{L}_v = 0$ on supp($\hat{\rho}$), then $\hat{L}_v \hat{\rho} = 0$ and $\hat{\rho} \hat{L}_v = 0$. Substituting into the SLD equation gives $\partial_v \hat{\rho} = 0$.

$$ (ii) \iff (iii). \text{ We begin by computing the quadratic form } v^\top Q v: $$

$$ v^\top Q v = \sum_{\mu,v} v_\mu v_v Q_{\mu v} = \frac{1}{2} \sum_{\mu,v} v_\mu v_v \text{tr}[\hat{\rho} \{\hat{L}_{\theta_\mu}, \hat{L}_{\theta_v}\}] = \frac{1}{2} \sum_{\mu,v} v_\mu v_v \text{tr}[\hat{\rho} (\hat{L}_{\theta_\mu} \hat{L}_{\theta_v} + \hat{L}_{\theta_v} \hat{L}_{\theta_\mu})] = \sum_{\mu,v} v_\mu v_v \text{tr}[\hat{\rho} \hat{L}_{\theta_\mu} \hat{L}_{\theta_v}], \qquad (A4) $$

where the last step uses the symmetry of the sum under $\mu \leftrightarrow v$. Now define $\hat{L}_v := \sum_\mu v_\mu \hat{L}_{\theta_\mu}$. Then:

$$ \hat{L}_v^2 = \left(\sum_\mu v_\mu \hat{L}_{\theta_\mu}\right) \left(\sum_v v_v \hat{L}_{\theta_v}\right) = \sum_{\mu,v} v_\mu v_v \hat{L}_{\theta_\mu} \hat{L}_{\theta_v}, \qquad (A5) $$

so $v^\top Q v = \text{tr}[\hat{\rho} \hat{L}_v^2]$. Since $\hat{L}_v^2$ is a positive semidefinite operator and $\hat{\rho}$ is positive semidefinite, the trace $\text{tr}[\hat{\rho} \hat{L}_v^2]$ is zero if and only if $\hat{L}_v = 0$ on the support of $\hat{\rho}$. Therefore,

$$ \hat{L}_v = 0 \text{ on supp}(\hat{\rho}) \iff v \in \ker \mathcal{Q}. \qquad (A6) $$

Now, if $v \in \ker \mathcal{Q}$, then $\text{tr}[\hat{\rho} \hat{L}_v^2] = 0$. Since both $\hat{\rho}$ and $\hat{L}_v^2$ are positive semidefinite, this implies that $\hat{L}_v = 0$ on supp($\hat{\rho}$). Hence,

$$ v \in \ker \mathcal{Q} \implies \hat{L}_v = 0 \text{ on supp}(\hat{\rho}), \qquad (A7) $$

which is exactly condition (ii).

Finally, we can relate the private component $\theta_j$ with $\ker(\mathcal{Q})$ via:

**Proposition 8** (Characterization of private parameters). A component $\theta_j$ is private at $\theta$ iff there exists $v \in \ker \mathcal{Q}$ with $v_j \neq 0$.

*Proof.* If $\theta_j$ is private, Definition 1 supplies such a $v$ with $\partial_v \hat{\rho} = 0$. Lemma 7 (i) $\Rightarrow$ (iii) then yields $v \in \ker \mathcal{Q}$. Conversely, for $v \in \ker \mathcal{Q}$ with $v_j \neq 0$, Lemma 7 (iii) $\Rightarrow$ (i) gives $\partial_v \hat{\rho} = 0$, so $\theta_j$ is private. □
## Appendix B: Privacy measure in GHZ, W, and product states

To illustrate the notion of privacy, consider a simple phase-estimation protocol. Specifically, three parties sharing a state $|\Psi\rangle$ each locally encode a phase $\theta_j$ by applying the unitary operation $U(\theta_j) = |0\rangle\langle 0| + e^{i\theta_j} |1\rangle\langle 1|$. Our goal is to assess privacy when the parties attempt to estimate the average phase $\theta_{avg} = (\theta_1 + \theta_2 + \theta_3)/3$. This can be achieved by computing $P(Q, v)$, where in this case $v = \frac{1}{\sqrt{3}}(1, 1, 1)$. Consequently, the problem reduces to calculating the quantum Fisher information matrix $Q$ with respect to the average phase. As we are dealing with pure states, the QFIm is simply given by

$$Q_{\mu\nu}(\theta) = 4\mathrm{Re}\left[\langle\partial_{\theta_{\mu}}\Psi(\theta)|\partial_{\theta_{\nu}}\Psi(\theta)\rangle - \langle\partial_{\theta_{\mu}}\Psi(\theta)|\Psi(\theta)\rangle^2\right]. \qquad (B1)$$

To highlight the non-trivial nature of $P(Q, v)$, we consider two different state preparations undergoing the local encoding. Namely,

$$|GHZ\rangle = \frac{1}{\sqrt{2}}(|000\rangle + |111\rangle) \xrightarrow{U(\theta)} |\Phi_{GHZ}(\theta)\rangle = \frac{1}{\sqrt{2}}(|000\rangle + e^{i(\theta_1+\theta_2+\theta_3)} |111\rangle). \qquad (B2)$$

$$|W\rangle = \frac{1}{\sqrt{3}}(|001\rangle + |010\rangle + |100\rangle) \xrightarrow{U(\theta)} |\Phi_+(\theta)\rangle = \frac{1}{\sqrt{3}}(e^{i\theta_3} |001\rangle + e^{i\theta_2} |010\rangle + e^{i\theta_1} |100\rangle). \qquad (B3)$$

Observe that these two cases corresponds to extreme cases, while the GHZ state allows for complete privacy, W states has no privacy at all. To see this, we compute the quantum Fisher information for each state:

$$Q_{\text{GHZ}} = \begin{pmatrix} 1 & 1 & 1 \\ 1 & 1 & 1 \\ 1 & 1 & 1 \end{pmatrix}, \quad Q_{\text{W}} = \frac{4}{9} \begin{pmatrix} 2 & -1 & -1 \\ -1 & 2 & -1 \\ -1 & -1 & 2 \end{pmatrix}. \qquad (B4)$$

From their quantum Fisher information, we observe that while $Q_{GHZ}$ is a rank-1 matrix proportional to $vv^\top$, $Q_W$ is a full-rank matrix and not proportional to $vv^\top$. In fact, the direction $v = \frac{1}{\sqrt{3}}(1, 1, 1)$ is orthogonal to the eigenspace of $Q_W$-that is, the average phase is completely inaccessible from this state. We can directly verify that $P(Q_{GHZ}, v) = 1$ and $P(Q_W, v) = 0$.

As a final case, we now consider the scenario in which the parties share product states and each encodes the local phase, leading to

$$|+3\rangle = \left[ \frac{1}{\sqrt{2}} (|0\rangle + |1\rangle) \right]^{\otimes 3} \xrightarrow{U(\theta)} |\Phi_+(\theta)\rangle = \bigotimes_{j=1}^{3} \frac{1}{\sqrt{2}} (|0\rangle + e^{i\theta_j} |1\rangle). \qquad (B5)$$

In this case, the quantum Fisher information is simply $Q_+ = 1_3$. This implies that each phase $\theta_j$ can be independently and optimally estimated. Nothing is hidden-all functions are accessible, as the QFIm is full rank and every direction in parameter space is estimable. Even though the product state leaks all information (i.e., there is no privacy in the conventional sense), the privacy measure $P(Q, v)$ is still non-zero-specifically, $P(Q, v) = \frac{1}{3}$. The fact that $P$ is not zero reflects that the desired function is indeed accessible, but information about other functions is also present.

## Appendix C: Minimal scenario for privacy

Consider a scenario in which two parties share a two-mode squeezed state, characterised by the covariance matrix

$$\sigma = \frac{1}{2} \begin{pmatrix} \cosh 2r & 0 & -\sinh 2r & 0 \\ 0 & \cosh 2r & 0 & \sinh 2r \\ -\sinh 2r & 0 & \cosh 2r & 0 \\ 0 & \sinh 2r & 0 & \cosh 2r \end{pmatrix}, \qquad (C1)$$

with a first-moment vector given by $r = 0$. To maintain generality, one can assume an imperfect state preparation by sending the two-mode squeezed state through a Gaussian loss channel. This can be modelled by coupling both modes to a vacuum mode via a beam splitter with transmissivity $\eta$. After this transformation, the covariance matrix of the output state is given by:

$$\sigma_{\text{loss}} = \frac{1}{2} \begin{pmatrix} 1 + 2\eta \sinh^2 r & 0 & -\eta \sinh 2r & 0 \\ 0 & 1 + 2\eta \sinh^2 r & 0 & \eta \sinh 2r \\ -\eta \sinh 2r & 0 & 1 + 2\eta \sinh^2 r & 0 \\ 0 & \eta \sinh 2r & 0 & 1 + 2\eta \sinh^2 r \end{pmatrix}, \qquad (C2)$$
Assuming that both parties encode a phase $\theta_j$ via a phase shift, the encoded covariance matrix takes the following form:

$$ \sigma_{\theta} = \frac{1}{2} \begin{pmatrix} 1 + 2\eta \sinh^2 r & 0 & -\eta \cos(\theta_1 + \theta_2) \sinh 2r & -\eta \sin(\theta_1 + \theta_2) \sinh 2r \\ 0 & 1 + 2\eta \sinh^2 r & -\eta \sin(\theta_1 + \theta_2) \sinh 2r & \eta \cos(\theta_1 + \theta_2) \sinh 2r \\ -\eta \cos(\theta_1 + \theta_2) \sinh 2r & -\eta \sin(\theta_1 + \theta_2) \sinh 2r & 1 + 2\eta \sinh^2 r & 0 \\ -\eta \sin(\theta_1 + \theta_2) \sinh 2r & \eta \cos(\theta_1 + \theta_2) \sinh 2r & 0 & 1 + 2\eta \sinh^2 r \end{pmatrix}, \quad (C3) $$

The symmetric logarithmic derivatives (SLDs) can be directly obtained when $\eta = 1$. However, for an arbitrary $\eta$, the calculation is not as straightforward. Nonetheless, we can construct an ansatz for the SLD. More precisely, both symmetric logarithmic derivatives are identical and given by:

$$ \mathcal{L}_{\theta_{1,2}} = \frac{\sinh 2r}{2 + 4\eta(1 - \eta)\sinh^2 r} \begin{pmatrix} 0 & 0 & \sin(\theta_1 + \theta_2) & -\cos(\theta_1 + \theta_2) \\ 0 & 0 & -\cos(\theta_1 + \theta_2) & -\sin(\theta_1 + \theta_2) \\ \sin(\theta_1 + \theta_2) & -\cos(\theta_1 + \theta_2) & 0 & 0 \\ -\cos(\theta_1 + \theta_2) & -\sin(\theta_1 + \theta_2) & 0 & 0 \end{pmatrix}. \quad (C4) $$

Observe that Eq. (C4) satisfies $D_\sigma(\mathcal{L}_{\theta_{1,2}}) = 2\partial_{\theta_1,\theta_2}\sigma$.

Thus, it is straightforward to show that the quantum Fisher information matrix in this case is rank-1 and given by

$$ \mathcal{Q} = \frac{2\eta^2 \sinh^2 2r}{1 + 4(1 - \eta)\eta \sinh^2 r} \begin{pmatrix} 1 & 1 \\ 1 & 1 \end{pmatrix}. \quad (C5) $$

This implies that $P(\mathcal{Q}, \nu) = 1$. In the case where there are no losses $\eta = 1$ and $\mathcal{Q} \propto \sinh^2 2r$ as expected.

## 1. Optimal measurement

We now show that the optimal measurement for estimating the average phase $\theta_{avg} := (\theta_1 + \theta_2)/2$ in our two-mode setup is a Gaussian measurement–specifically, an adaptive scheme in which the two-mode squeezed state, after local phase encoding, is passed through a 50:50 beam splitter, followed by homodyne detection at an optimal angle $\phi_{opt}$. We begin with the state after the phase shifts, whose covariance matrix is given by Eq. (C2). Each mode is then sent through a local 50:50 beam splitter. This transformation renders the output state’s covariance matrix block-diagonal:

$$ \sigma_{\theta,bs} = \frac{1}{2} \begin{pmatrix} A & 0 \\ 0 & B \end{pmatrix} \quad (C6) $$

where A and B are matrices given by

$$ A = \frac{1}{2} \begin{pmatrix} 1 - \eta(2 \sinh^2 r - \sin 2r \cos \theta) & -\eta \sinh 2r \sin \theta \\ -\eta \sinh 2r \sin \theta & 1 + \eta(2 \sinh^2 r + \sinh 2r \cos \theta) \end{pmatrix} \quad (C7) $$

$$ B = \frac{1}{2} \begin{pmatrix} 1 - \eta(2 \sinh^2 r + \sin 2r \cos \theta) & \eta \sinh 2r \sin \theta \\ \eta \sinh 2r \sin \theta & 1 - \eta(\sinh 2r \cos \theta - 2 \sinh^2 r) \end{pmatrix} \quad (C8) $$

The symmetry and block-diagonal form of the covariance matrix allows us to analyse each mode independently, simplifying the analysis of measurement strategies. We now turn to the measurement stage, where each party performs homodyne detection on a rotated quadrature. Party 1 measures a rotated $\hat{x}_\phi$ quadrature, while Party 2 measures the conjugate $\hat{p}_\phi$ quadrature. Specifically, the measurement covariance matrices are taken in the limiting form:

$$ \sigma_M^{(1)} = R(\phi) \text{diag}\left(\frac{1}{r_1}, r_1\right) R(\phi)^\text{T} \quad \text{and} \quad \sigma_M^{(2)} = R(\phi) \text{diag}\left(r_2, \frac{1}{r_2}\right) R(\phi)^\text{T} \quad (C9) $$

where $R(\phi)$ is a rotation matrix with $r_1$ and $r_2$ being squeezing parameters. In the limit $r_1 \to \infty$ and $r_2 \to \infty$, these measurements become projective: Party 1 effectively measures $\hat{x}_\phi$, and Party 2, $\hat{p}_\phi$, with infinite precision along those directions and maximal uncertainty in their conjugates.

The classical Fisher information can be expressed in terms of the first and second moments as follows [45]

$$ \mathcal{F}_C(\theta; r_\theta, \sigma_\theta; \sigma_M) = \frac{1}{2} \text{tr} \left\{ \left[ (\sigma_\theta + \sigma_M)^{-1} \left( \frac{\partial \sigma_\theta}{\partial \theta} \right)^2 \right] \right\} + \left( \frac{\partial r_\theta}{\partial \theta} \right)^\text{T} (\sigma_\theta + \sigma_M)^{-1} \left( \frac{\partial r_\theta}{\partial \theta} \right). \quad (C10) $$
<figure><img src="image_9.png" /><figcaption>FIG. 8. Beam-splitter tree. (a) A two-mode squeezed state (A, B) is split into $M = 2^N$ modes ($N \ge 2$) by a balanced beam-splitter tree. At each layer $l$, every mode is mixed on a 50:50 beam splitter with vacuum in the ancillary port. The leaves $j$ at the output originate either from A or B; we indicate the origin by colouring the leaves in yellow ($m(j) = A$) or green ($m(j) = B$). Leaf indices $j$ and layer indices $l$ follow the conventions defined in Eqs. (D2) and (D6). (b) Legend showing the optical elements used in the beam-splitter tree.</figcaption></figure>

The optimal measurement angle is obtained by maximising $\mathcal{F}_C(\phi)$ with respect to $\phi$. This yields:

$$ \phi_{\text{opt}} = \frac{\theta_1 + \theta_2}{2} + \tan^{-1} \left( \frac{\eta \sinh 2r}{\sqrt{1 + 4(1-\eta)\eta \sinh^2 r}} \right). \qquad (\text{C11}) $$

Finally, plugging $\phi_{\text{opt}}$ into the classical FI yields:

$$ \mathcal{F}_C(r) = \frac{2\eta^2 \sinh^2 2r}{1 + 4(1 - \eta)\eta \sinh^2 r}. \qquad (\text{C12}) $$

## Appendix D: Covariances and quantum Fisher information matrix of a two-mode squeezed state through a balanced tree

In this appendix we derive closed-form expressions for the covariance matrix of a state that starts as a two-mode squeezed state and is then split into $M = 2^N$ modes ($N \ge 2$) by a balanced beam splitter tree. At each layer, every mode is mixed on a 50:50 beam splitter with vacuum in the ancillary port (see Fig. 8). We then give the covariance matrix after $2^N$ local phase shifts are encoded on the modes. Finally, we obtain an analytical form of the quantum Fisher information matrix, together with its eigenvalues and eigenvectors. The entire appendix can also be reproduced using a Mathematica notebook (see Ref. ??), where all matrices are provided and the results can be verified both analytically and numerically. For clarity, the discussion is organised into three parts.

### 1. Compact expression for the beam-splitter tree covariance matrix

In this subsection we derive compact formulas for the “leaf-to-leaf” covariances $\sigma_{jk}^{(x)}$ and $\sigma_{jk}^{(p)}$ generated by a balanced beam-splitter tree fed by a two-mode squeezed state on inputs A, B. The key idea is that each output quadrature $\hat{z}_j$ can be written as a scaled version of one of the original input quadratures (A or B) together with extra terms coming from the vacuum modes that enter the unused ports of the beam splitters. These extra terms have simple $\pm$ signs that depend on the path through the tree. We will keep track of these signs and scaling factors, compute the covariances coming from the squeezed inputs and the vacua separately, then add them to obtain explicit formulas for $\sigma_{jk}^{(x)}$ and $\sigma_{jk}^{(p)}$. Finally, we combine them into the global block-diagonal covariance matrix $\sigma = \sigma^{(x)} \oplus \sigma^{(p)}$.

For a mode $m$ mixed with an ancillary vacuum mode $v$, a balanced beam splitter acts on the dimensionless quadratures

$$ \begin{pmatrix} x_m \\ x_v \end{pmatrix} \rightarrow \frac{1}{\sqrt{2}} \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} \begin{pmatrix} x_m \\ x_v \end{pmatrix}, \qquad \begin{pmatrix} p_m \\ p_v \end{pmatrix} \rightarrow \frac{1}{\sqrt{2}} \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} \begin{pmatrix} p_m \\ p_v \end{pmatrix}. \qquad (\text{D1}) $$
Because (D1) is block-diagonal in $(x, p)$, it creates no cross $x-p$ correlations provided the input state itself is free of such terms. We adopt this assumption throughout.

Let A and B denote the two modes that carry an initial two-mode squeezed state; every remaining input port is prepared in vacuum. A balanced binary tree of 50:50 beam splitters of depth $N$ doubles the mode count at each layer. We count layers starting from 1; hence a tree of depth $N$ contains $N-1$ beam-splitter layers and produces $M = 2^N$ output modes (see Fig. 8). We label leaves and layers by $j \in \{0, 1, \dots, 2^N - 1\}$ and $\ell \in \{1, \dots, N-1\}$, and set

$$j_i(j) := \lfloor j/2^i \rfloor \bmod 2 \quad (i \in \mathbb{N}_0), \qquad (D2)$$

$$r(j) := j_{N-1}(j), \qquad (D3)$$

$$s_{\ell}(j) := (-1)^{j_{N-\ell-1}(j)}, \qquad (D4)$$

$$b(j, \ell) := \lfloor j/2^{N-\ell} \rfloor. \qquad (D5)$$

The following lemma gives an explicit expression for the quadrature operator at each output mode in terms of the initial inputs and the vacuum contributions introduced at each layer of the beam splitter tree:

**Lemma 9.** For any $z \in \{x, p\}$ and every leaf $j$,

$$\hat{z}_j = 2^{-(N-1)/2} \hat{z}_{m(j)} + \sum_{\ell=1}^{N-1} 2^{-(N-\ell)/2} s_{\ell}(j) \hat{z}_{\text{vac}}^{(\ell,b(j,\ell))}, \qquad (D6)$$

where $m(j) = A$ if $r(j) = 0$ and $m(j) = B$ if $r(j) = 1$.

*Proof.* The proof proceeds by induction on the network depth $N$. For the base case $N = 2$, the tree contains two beam splitters, each mixing one of A, B with a fresh vacuum. Applying (D1) once gives

$$\hat{z}_j = 2^{-1/2} \hat{z}_{m(j)} + 2^{-1/2} s_1(j) \hat{z}_{\text{vac}}^{(1,b(j,1))}, \qquad (D7)$$

which matches (D6) for $N = 2$. Assume (D6) holds for depth $N-1$. Attach to every leaf a balanced beam splitter that mixes the leaf with a fresh vacuum $\hat{z}_{\text{vac}}^{(N-1,b)}$ ($b = 0, \dots, 2^{N-1}-1$). Denote by $\hat{z}_j^{(\text{old})}$ the quadrature on the depth-(N-1) leaf j before the extra splitter is inserted. The two new leaves, labelled 2j and 2j + 1, obey

$$\hat{z}_{2j+\nu} = 2^{-1/2} [\hat{z}_j^{(\text{old})} + (-1)^{\nu} \hat{z}_{\text{vac}}^{(N-1,b)}] \quad \text{for } \nu \in \{0, 1\}. \qquad (D8)$$

Inserting the induction hypothesis for $\hat{z}_j^{(\text{old})}$ and observing that $(-1)^\nu = s_{N-1}(2j + \nu)$ yields (D6) for depth $N$. The identities $b(2j + \nu, \ell) = b(j, \ell)$ and $s_\ell(2j + \nu) = s_\ell(j)$ for $\ell < N-1$ follow directly from the definitions, completing the proof. $\square$

Next, we use the previous lemma to decompose each output quadrature into its squeezed and vacuum contributions, in preparation for computing covariances between the leaf modes. Define

$$\hat{z}_j^{(\text{sq})} := 2^{-(N-1)/2} \hat{z}_{m(j)} \quad \text{and} \quad \hat{z}_j^{(\text{vac})} := \sum_{\ell=1}^{N-1} 2^{-(N-\ell)/2} s_{\ell}(j) \hat{z}_{\text{vac}}^{(\ell,b(j,\ell))}. \qquad (D9)$$

Because the initial TMSS pair (A, B) and all ancilla vacua are uncorrelated and the network is a real orthogonal (hence symplectic) transformation on $(x, p)$, cross terms remain zero: $\langle \hat{z}_j^{(\text{sq})} \hat{z}_k^{(\text{vac})} \rangle = 0$ for all $j, k$. With $\hat{x} = (\hat{a} + \hat{a}^\dagger)/\sqrt{2}$ and $\hat{p} = (\hat{a} - \hat{a}^\dagger)/(i\sqrt{2})$, the TMSS state satisfies $\text{cov}(\hat{x}_A, \hat{x}_B) = -\frac{1}{2} \sinh 2r$ and $\text{cov}(\hat{p}_A, \hat{p}_B) = \frac{1}{2} \sinh 2r$. Propagating through the tree gives

$$\text{cov}(\hat{x}_j^{(\text{sq})}, \hat{x}_k^{(\text{sq})}) = \frac{1}{2^N} [\cosh 2r \delta_{m(j),m(k)} + \sinh 2r (1 - \delta_{m(j),m(k)})], \qquad (D10)$$

$$\text{cov}(\hat{p}_j^{(\text{sq})}, \hat{p}_k^{(\text{sq})}) = \frac{1}{2^N} [\cosh 2r \delta_{m(j),m(k)} - \sinh 2r (1 - \delta_{m(j),m(k)})]. \qquad (D11)$$

For the vacuum ancillas, we have $\langle \hat{z}_{\text{vac}}^{(\ell,b)} \hat{z}_{\text{vac}}^{(\ell',b')} \rangle = \frac{1}{2} \delta_{\ell,\ell'} \delta_{b,b'}$, so

$$\text{cov}(\hat{z}_j^{(\text{vac})}, \hat{z}_k^{(\text{vac})}) = \frac{1}{2} \sum_{\ell=1}^{N-1} 2^{-(N-\ell)} s_{\ell}(j) s_{\ell}(k) \delta_{b(j,\ell), b(k,\ell)}. \qquad (D12)$$
Adding (D10)–(D12) yields

$$ \sigma_{jk}^{(x)} = 2^{-N} [\cosh 2r \delta_{m(j),m(k)} - \sinh 2r (1 - \delta_{m(j),m(k)})] + \frac{1}{2} \sum_{\ell=1}^{N-1} 2^{-(N-\ell)} s_{\ell}(j) s_{\ell}(k) \delta_{b(j,\ell), b(k,\ell)}, \quad (D13) $$

$$ \sigma_{jk}^{(p)} = 2^{-N} [\cosh 2r \delta_{m(j),m(k)} + \sinh 2r (1 - \delta_{m(j),m(k)})] + \frac{1}{2} \sum_{\ell=1}^{N-1} 2^{-(N-\ell)} s_{\ell}(j) s_{\ell}(k) \delta_{b(j,\ell), b(k,\ell)}, \quad (D14) $$

which are symmetric and positive-definite. Now we collect the x-and p-covariances into the full $2M \times 2M$ covariance matrix. Because the $\hat{x}$ and $\hat{p}$ quadratures remain uncorrelated throughout the network, the global covariance matrix takes the block-diagonal form

$$ \sigma = \sigma^{(x)} \oplus \sigma^{(p)}, \quad (D15) $$

with the canonical ordering $(\hat{x}_0, \hat{x}_1, \dots, \hat{x}_{M-1}, \hat{p}_0, \hat{p}_1, \dots, \hat{p}_{M-1})$. Alternatively, using the interleaved ordering $(\hat{x}_0, \hat{p}_0, \hat{x}_1, \hat{p}_1, \dots)$, we define a permutation $\mathcal{P}$ such that

$$ \sigma = \mathcal{P} \begin{pmatrix} \sigma^{(x)} & 0 \\ 0 & \sigma^{(p)} \end{pmatrix} \mathcal{P}^{\top}, \quad (D16) $$

where $\mathcal{P}(2j) = j$, $\mathcal{P}(2j+1) = M+j$ for $j = 0, \dots, M-1$. This completes the construction of the full covariance matrix of the output state.

## 2. Covariance matrix phase-shift

In this subsection we describe how the covariance matrix changes when local phase shifts are applied to each output mode of the beam-splitter tree. Each phase shift $\theta_j$ acts as a rotation in the $(x, p)$ quadrature space of mode $j$, and all such rotations together form a block-diagonal symplectic matrix $S(\theta)$. By applying the standard transformation rule $\sigma \mapsto S(\theta), \sigma, S(\theta)^\top$ to the block-diagonal covariance from the previous section, we obtain explicit formulas for the rotated covariance blocks $\sigma^{(xx)}(\theta)$, $\sigma^{(xp)}(\theta)$, $\sigma^{(px)}(\theta)$, and $\sigma^{(pp)}(\theta)$.

Consider the zero-mean Gaussian state produced by the beam splitter tree of depth $N$ given by Eq. (D15). Let $\theta = (\theta_0, \dots, \theta_{M-1}) \in \mathbb{R}^M$ and define the symplectic matrix:

$$ S(\theta) = \bigoplus_{j=0}^{M-1} \begin{pmatrix} \cos \theta_j & \sin \theta_j \\ -\sin \theta_j & \cos \theta_j \end{pmatrix}. \quad (D17) $$

The local phase-rotation unitary $\hat{U}(\theta) = \prod_{j=0}^{M-1} e^{-i\theta_j \hat{a}_j^\dagger \hat{a}_j}$ transforms the covariance matrix as

$$ \sigma(\theta) := S(\theta)\sigma S(\theta)^\top = \begin{pmatrix} \sigma^{(xx)}(\theta) & \sigma^{(xp)}(\theta) \\ \sigma^{(px)}(\theta) & \sigma^{(pp)}(\theta) \end{pmatrix}, \quad (D18) $$

with entries for $j, k = 0, \dots, M-1$,

$$ \sigma_{jk}^{(xx)}(\theta) = \cos \theta_j \cos \theta_k \sigma_{jk}^{(x)} + \sin \theta_j \sin \theta_k \sigma_{jk}^{(p)}, \quad (D19) $$

$$ \sigma_{jk}^{(xp)}(\theta) = -\cos \theta_j \sin \theta_k \sigma_{jk}^{(x)} + \sin \theta_j \cos \theta_k \sigma_{jk}^{(p)}, \quad (D20) $$

$$ \sigma_{jk}^{(px)}(\theta) = -\sin \theta_j \cos \theta_k \sigma_{jk}^{(x)} + \sin \theta_j \sin \theta_k \sigma_{jk}^{(p)}, \quad (D21) $$

$$ \sigma_{jk}^{(pp)}(\theta) = \sin \theta_j \sin \theta_k \sigma_{jk}^{(x)} + \cos \theta_j \cos \theta_k \sigma_{jk}^{(p)}. \quad (D22) $$

The form of Eq. (D18) is easily understood once one recalls how a phase-rotation acts in the Heisenberg picture. First, for each mode $j$,

$$ \hat{U}(\theta)^{\dagger} \begin{pmatrix} \hat{x}_j \\ \hat{p}_j \end{pmatrix} U(\theta) = \begin{pmatrix} \cos \theta_j & \sin \theta_j \\ -\sin \theta_j & \cos \theta_j \end{pmatrix} \begin{pmatrix} \hat{x}_j \\ \hat{p}_j \end{pmatrix}. \quad (D24) $$

Because a linear (and, in particular, symplectic) transformation $S$ carries the covariance matrix to $\sigma \mapsto S(\theta)\sigma S(\theta)^\top$, the full transformation law follows at once. Finally, substituting the block-diagonal form of the original $\sigma$ and the block structure of $S(\theta)$ yields the explicit block expression displayed in Eq. (D18).
### 3. Quantum Fisher information from a beam splitter tree

Finally, we now compute the quantum Fisher information matrix for estimating the local phases $\theta$ applied to the modes at the output of the beam-splitter tree, and determine its eigenvalues and eigenvectors in closed form. Starting from the covariances $\sigma_{jk}^{(x)}$ and $\sigma_{jk}^{(p)}$ derived earlier, we first show that the QFIm does not depend on the actual phase values, so it can be evaluated at $\theta = 0$. We then use the symmetry of the tree to prove that $Q$ has only three distinct kinds of entries, which allows us to write it in a simple projector form. This structure makes the eigendecomposition straightforward: two special phase patterns ($u_+$ for a uniform phase and $u_0$ for an A-vs-B imbalance) give two of the eigenvalues, and any vector orthogonal to both lies in a degenerate subspace with a common eigenvalue $\lambda_\perp$.

Consider the zero-mean Gaussian output of the depth-N beam-splitter tree fed by a two-mode squeezed state on inputs A, B (all other inputs in vacuum), with quadrature covariances $\sigma_{jk}^{(x)}$, $\sigma_{jk}^{(p)}$ given by Eqs. (D13)–(D14). Below, we prove that after encoding local phase shifts as in Eq. (D18), the QFIm $Q$:

(a) is independent of $\theta$ and has entries

$$Q_{jk} = 2[(\sigma_{jk}^{(x)})^2 + (\sigma_{jk}^{(p)})^2] - \delta_{jk}; \qquad (D25)$$

(b) admits the projector form

$$Q = \lambda_{\perp}(1_M - \Pi_{+} - \Pi_{0}) + \lambda_{+} \Pi_{+} \quad \text{with} \quad \Pi_{+} := \frac{11^{\mathrm{T}}}{M} \quad \text{and} \quad \Pi_{0} := \frac{ss^{\mathrm{T}}}{M}, \qquad (D26)$$

$$\text{where } \mathbf{1} = (1, \dots, 1)^{\mathrm{T}} \text{ and } s = \underbrace{(1, \dots, 1)}_{M/2}, \underbrace{-1, \dots, -1}_{M/2}^{\mathrm{T}};$$

(c) has spectrum

$$\lambda(Q) = \left\{ 0, \underbrace{\frac{\cosh 2r - 1}{2^{N-2}}, \dots, \frac{\cosh 2r - 1}{2^{N-2}}, \frac{\cosh 4r - 1}{2^{N-1}}}_{M-2 \text{ times}} \right\}. \qquad (D27)$$

Equivalently, entrywise,

$$Q_{jk} = \begin{cases} \lambda_{\perp} + \frac{\lambda_{+} - 2\lambda_{\perp}}{M}, & j=k, \\ \frac{\lambda_{+} - 2\lambda_{\perp}}{M}, & j \neq k \text{ and } m(j) = m(k), \\ \frac{\lambda_{+}}{M}, & m(j) \neq m(k), \end{cases} \qquad (D28)$$

where

$$\lambda_{\perp} = \frac{\cosh 2r - 1}{2^{N-2}} \quad \text{and} \quad \lambda_{+} = \frac{\cosh 4r - 1}{2^{N-1}}. \qquad (D29)$$

*Step 1 (Independence of $\theta$ and entrywise formula).* By Lemma 5 and zero mean, the QFIm is

$$Q_{jk}(\theta) = 2 \sum_{z,w \in \{x,p\}} \sigma_{z_j \hat{w}_k}(\theta)^2 - \delta_{jk}, \qquad (D30)$$

where $\sigma_{z_j \hat{w}_k}(\theta)$ are the second moments after encoding. Using Frobenius-norm invariance under left/right orthogonal multiplications [46],

$$\sum_{z,w} \sigma_{z_j \hat{w}_k}(\theta)^2 = \|\sigma_{jk}(\theta)\|_F^2 = \|R(\theta_j) \sigma_{jk}(\mathbf{0}) R(\theta_k)^{\mathrm{T}}\|_F^2 = \|\sigma_{jk}(\mathbf{0})\|_F^2 = (\sigma_{jk}^{(x)})^2 + (\sigma_{jk}^{(p)})^2. \qquad (D31)$$

Thus $Q_{jk}(\theta)$ is independent of $\theta$, and evaluating at $\theta = 0$ yields (D25).

*Step 2 (Projector form and commutant).* Let $v_{jk}$ denote the vacuum contribution appearing in (D13)–(D14):

$$v_{jk} := \frac{1}{2} \sum_{\ell=1}^{N-1} 2^{-(N-\ell)} s_{\ell}(j) s_{\ell}(k) \delta_{b(j,\ell), b(k,\ell)}. \qquad (D32)$$
We claim that

$$v_{jk} = \begin{cases} \frac{1}{2}(1 - 2^{1-N}), & j = k, \\ -2^{-N}, & j \neq k \text{ and } m(j) = m(k), \\ 0, & m(j) \neq m(k). \end{cases} \qquad (D33)$$

For $j=k$, the signs coincide $s_\ell(j) = s_\ell(k)$ and all Kronecker deltas are 1, so $v_{jj} = \frac{1}{2} \sum_{\ell=1}^{N-1} 2^{-(N-\ell)} = \frac{1}{2}(1 - 2^{1-N})$. If $m(j) \neq m(k)$, then $j$ and $k$ lie on opposite outputs of the first (top) beam splitter, so $b(j, 1) \neq b(k, 1)$. At every subsequent level $\ell \ge 2$, each side is split further without mixing with the other, hence $b(j, \ell) \neq b(k, \ell)$ for all $\ell$. Therefore $\delta_{b(j,\ell),b(k,\ell)} = 0$ for every $\ell$, and $v_{jk} = 0$. Now take $j \neq k$ with $m(j) = m(k)$. Let $L \in \{2, \dots, N-1\}$ be the smallest level at which $j$ and $k$ choose different outputs (equivalently, the last level where they coincide is $L-1$). Then only the terms with $\ell = 1, \dots, L-1$ contribute to $v_{jk}$. For $\ell \le L-2$ their choices agree, so $s_\ell(j)s_\ell(k) = +1$, whereas at $\ell = L-1$ they differ and $s_{L-1}(j)s_{L-1}(k) = -1$. Hence,

$$v_{jk} = \frac{1}{2} \left[ \sum_{\ell=1}^{L-2} 2^{-(N-\ell)} - 2^{-(N-L+1)} \right] = \frac{1}{2} \left[ 2^{-(N-L+1)}(1 - 2^{-(L-2)}) - 2^{-(N-L+1)} \right] = -2^{-N}, \qquad (D34)$$

proving Eq. (D33).

According to Eq. (D33) and the structure of the squeezed part in (D13)–(D14), the entries of $Q_{jk}$ in (D25) take only three values: one for $j=k$, one for $j \neq k$ with $m(j) = m(k)$, and one for $m(j) \neq m(k)$. Hence $Q$ is completely determined by three numbers and can be written as

$$Q = \alpha 1_M + \beta \Pi_+ + \gamma \Pi_0, \qquad (D35)$$

for some scalars $\alpha, \beta, \gamma$, where $\Pi_+ = 11^\top/M$ and $\Pi_0 = ss^\top/M$, with

$$11^\top = \begin{pmatrix} \mathbf{1}_A \mathbf{1}_A^\top & \mathbf{1}_A \mathbf{1}_B^\top \\ \mathbf{1}_B \mathbf{1}_A^\top & \mathbf{1}_B \mathbf{1}_B^\top \end{pmatrix} \quad \text{and} \quad ss^\top = \begin{pmatrix} \mathbf{1}_A \mathbf{1}_A^\top & -\mathbf{1}_A \mathbf{1}_B^\top \\ -\mathbf{1}_B \mathbf{1}_A^\top & \mathbf{1}_B \mathbf{1}_B^\top \end{pmatrix}. \qquad (D36)$$

where $\mathbf{1}_A$ and $\mathbf{1}_B$ denote the all-ones vectors of length $M/2$ on the $A$ and $B$ indices, respectively.

*Step 3 (Eigenspaces and eigenvalues).* We now pick two phase patterns that match the symmetry of the tree and make the QFIm simple to evaluate. If we vary the phases along a unit vector $\mathbf{u} \in \mathbb{R}^M$ via $\theta = t \mathbf{u}$, the unitary is $\hat{U}(t) = \exp(-it \hat{G}_u)$ with generator

$$\hat{G}_u := \sum_{j=0}^{M-1} u_j \hat{n}_j. \qquad (D37)$$

For our zero-mean Gaussian setting, one has $\mathbf{u}^\top Q \mathbf{u} = 4 \text{var}(\hat{G}_u)$, so we want directions $\mathbf{u}$ for which $\hat{G}_u$ has a simple form on our state. Define,

$$\mathbf{u}_+ = \frac{\mathbf{1}}{\sqrt{M}} \quad \text{and} \quad \mathbf{u}_0 = \frac{s}{\sqrt{M}}, \quad \text{where } s_j = \begin{cases} +1, & j \in A \\ -1, & j \in B. \end{cases} \qquad (D38)$$

These correspond to a uniform phase (all modes together) and an $A$-vs-$B$ imbalance (plus on $A$, minus on $B$). A passive beam-splitter network redistributes photons but does not create or destroy them. Since all ancillary inputs (other than $A, B$) are in vacuum, the total photon number flowing down the $A$-branch equals the photon number that entered at $A$, and similarly for $B$:

$$\sum_{j \in A} \hat{n}_j = \hat{n}_A, \quad \sum_{k \in B} \hat{n}_k = \hat{n}_B, \quad \sum_{j=0}^{M-1} \hat{n}_j = \hat{n}_A + \hat{n}_B. \qquad (D39)$$

Consequently, the generators for $\mathbf{u}_+$ and $\mathbf{u}_0$ collapse to

$$\hat{G}_+ = \sum_j \frac{1}{\sqrt{M}} \hat{n}_j = \frac{\hat{n}_A + \hat{n}_B}{\sqrt{M}}, \quad \hat{G}_0 = \sum_j \frac{s_j}{\sqrt{M}} \hat{n}_j = \frac{\hat{n}_A - \hat{n}_B}{\sqrt{M}}. \qquad (D40)$$

These simple number combinations make the corresponding variances, and hence the eigenvalues of $Q$ along $\mathbf{u}_+$ and $\mathbf{u}_0$, straightforward to compute for a TMSS. For a TMSS with squeezing $r$ and $\tilde{n} := \sinh^2 r$, $\text{var}(\hat{n}_A) = \text{var}(\hat{n}_B) = \tilde{n}(\tilde{n} + 1)$, $\text{cov}(\hat{n}_A, \hat{n}_B) = \tilde{n}(\tilde{n} + 1)$, so $\text{var}(\hat{n}_A + \hat{n}_B) = 4\tilde{n}(\tilde{n} + 1)$ and $\text{var}(\hat{n}_A - \hat{n}_B) = 0$. For our pure state under local phase shifts, the QFIm satisfies along
any direction $\mathbf{u}: \mathbf{u}^\top \mathbf{Q} \mathbf{u} = 4 \text{var}(\hat{G}_u)$. Since $\mathbf{u}_+$ and $\mathbf{u}_0$ are normalised and are eigenvectors by symmetry, their eigenvalues are $\lambda_\pm = 4 \text{var}(\hat{G}_\pm)$. Computing then, we have that for $\mathbf{u}_+$:

$$ \text{var}(\hat{G}_+) = \frac{1}{m} \text{var}(\hat{n}_A + \hat{n}_B) = \frac{4\bar{n}(\bar{n} + 1)}{M} = \frac{\cosh 4r - 1}{2^{N-1}}. \qquad (D41) $$

For $\mathbf{u}_0$, it follows that

$$ \text{var}(\hat{G}_0) = \frac{1}{m} \text{var}(\hat{n}_A - \hat{n}_B) = 0. \qquad (D42) $$

Finally, from the three-valued structure of $\mathcal{Q}_{jk}$, the QFIm lies in the three-dimensional linear span generated by $\{\mathbf{1}, \Pi_+, \Pi_0\}$. Consequently, $\mathbb{R}^M$ decomposes into three invariant (mutually orthogonal) subspaces: $\text{span}\{\mathbf{u}_+\} \oplus \text{span}\{\mathbf{u}_0\} \oplus \mathcal{W}$, where $\mathcal{W} := \{\mathbf{w}: \mathbf{1}^\top \mathbf{w} = 0, \mathbf{s}^\top \mathbf{w} = 0\}$. On $\mathcal{W}$, we have $\Pi_+ \mathbf{w} = \Pi_0 \mathbf{w} = 0$. So, $\mathcal{Q} \mathbf{w} = \lambda_\perp \mathbf{w}$. To obtain the eigenvalue, choose $\mathbf{w}$ supported on two sibling leaves $j, k$ in the same half created by the last balanced splitter, with entries $w_j = 1, w_k = -1$, others 0. The associated generator is $\hat{G}_\perp = \frac{\hat{n}_j - \hat{n}_k}{\sqrt{2}}$. Writing the last splitter as $\hat{a}_j = \frac{1}{\sqrt{2}}(\hat{c} + \hat{v})$, $\hat{a}_k = \frac{1}{\sqrt{2}}(\hat{c} - \hat{v})$ with $\hat{v}$ a fresh vacuum and $\hat{c}$ the parent mode one layer above, one finds $\hat{n}_j - \hat{n}_k = \hat{c}^\dagger \hat{v} + \hat{v}^\dagger \hat{c}$. On a product state $\rho_c \otimes |0\rangle\langle 0|_v$ (i.e. $\hat{v}$ in vacuum and uncorrelated with $\hat{c}$),

$$ \text{var}(\hat{n}_j - \hat{n}_k) = \langle (\hat{c}^\dagger \hat{v} + \hat{v}^\dagger \hat{c})^2 \rangle = \langle \hat{c}^\dagger \hat{c} \rangle, \qquad (D43) $$

since $\langle \hat{v}^\dagger \hat{v} \rangle = 0, \langle \hat{v} \hat{v}^\dagger \rangle = 1$ and all mixed expectations factorise. Therefore

$$ \lambda_\perp = \frac{\mathbf{w}^\top \mathcal{Q} \mathbf{w}}{\|\mathbf{w}\|^2} = 4 \text{var}(\hat{G}_\perp) = 2 \text{var}(\hat{n}_j - \hat{n}_k) \stackrel{(D43)}{=} 2 \langle \hat{c}^\dagger \hat{c} \rangle. \qquad (D44) $$

Each 50:50 splitter with vacuum halves the mean photon number on the transmitted branch: if $\hat{a}_{\text{out}} = (\hat{a}_{\text{in}} + \hat{v})/\sqrt{2}$ with $\hat{v}$ in vacuum then $\langle \hat{a}_{\text{out}}^\dagger \hat{a}_{\text{out}} \rangle = \frac{1}{2} \langle \hat{a}_{\text{in}}^\dagger \hat{a}_{\text{in}} \rangle$. Along any path from an input to a leaf there are $N-1$ splitters; consequently the leaf mean is $\bar{n}/2^{N-1}$. The parent mode $\hat{c}$ sits one layer above the leaves, so it has passed through $N-2$ splitters and $\langle \hat{c}^\dagger \hat{c} \rangle = \frac{\bar{n}}{2^{N-2}}$. Substituting into (D44) and recalling $\cosh 2r - 1 = 2\bar{n}$ gives

$$ \lambda_\perp = \frac{2\bar{n}}{2^{N-2}} = \frac{\cosh 2r - 1}{2^{N-2}} \qquad (D45) $$

Therefore $\mathcal{Q}$ has eigenvalue 0 on $\text{span}\{\mathbf{u}_0\}$, eigenvalue $\lambda_+$ on $\text{span}\{\mathbf{u}_+\}$, and eigenvalue $\lambda_\perp$ on $\mathcal{W}$, which is equivalent to the projector form (D26) and to the spectrum (D27). The casewise expression (D28) follows from (D26) by evaluating the three cases $j=k, j \neq k$ with $m(j) = m(k)$, and $m(j) \neq m(k)$.

### 4. Average number of photons hitting the phase-shift

In the previous appendix, we proved that the eigenvalues of the QFIm associated with the $2^N$-mode Gaussian state generated by recursively distributing a two-mode squeezed vacuum through a balanced beam splitter network exhibit a highly structured eigenspectrum. More precisely, these are given by

$$ \lambda(\mathcal{Q}) = \left\{ 0, \underbrace{\frac{\cosh 2r - 1}{2^{N-2}}, \dots, \frac{\cosh 2r - 1}{2^{N-2}},}_{2^{N-2} \text{ times}} \frac{\cosh 4r - 1}{2^{N-1}} \right\}. \qquad (D46) $$

We now recast them in terms of the mean photon number. The mean photon number per input mode is $\bar{n} := \sinh^2 r$, so the total mean photon number on the two-mode squeezed state is $\bar{N} := 2 \sinh^2 r$. After the balanced $2^N$-port splitter network, this total is conserved and spread uniformly, hence the mean photons per output mode (i.e., per local phase parameter) is

$$ \bar{n}_{\text{mode}} = \frac{\bar{N}}{2^N} = 2^{1-N} \sinh^2 r. \qquad (D47) $$

Using the identities $\cosh 2r - 1 = 2 \sinh^2 r$ and $\cosh 4r - 1 = 2 \sinh^2 2r = 8 \sinh^2 r \cosh^2 r$, the spectrum can be written as

$$ \lambda(\mathcal{Q}) = \left\{ 0, \underbrace{4\bar{n}_{\text{mode}}, \dots, 4\bar{n}_{\text{mode}}}_{2^N-2 \text{ times}}, 8\bar{n}_{\text{mode}}(1 + 2^{N-1}\bar{n}_{\text{mode}}) \right\}. \qquad (D48) $$
For fixed $N$, the QFIm spectrum splits into three sectors: one null direction (global phase), a $(2^N - 2)$-dimensional shot-noise sector with eigenvalues $\lambda_{SNL} := 4\bar{n}_{mode}$ that grow linearly with the mean photons per mode, and one enhanced direction with $\lambda_{max} := 8\bar{n}_{mode}(1 + 2^{N-1}\bar{n}_{mode})$ that includes a quadratic term from squeezing-induced correlations. In terms of total photons $\bar{N} = 2^N\bar{n}_{mode}$, these become $\lambda_{SNL} = \bar{N}/2^{N-2}$ and $\lambda_{max} = \bar{N}^2/2^{N-2} + 8\bar{N}/2^N$, so the enhancement factor is $\lambda_{max}/\lambda_{SNL} = \bar{N} + 2$. Consequently, estimation variances scale as $1/\lambda$: generic phase combinations are shot-noise limited ~ $1/\bar{N}$, while the special collective phase achieves Heisenberg scaling ~ $1/\bar{N}^2$. The factor $2^N$ only fixes prefactors for a given $N$–it does not change the photon-number scaling exponent.

## Appendix E: Quantum Fisher information matrix & privacy

In this appendix, we prove Lemma 5 and Theorem 6. We begin by considering a pure state $|\psi_0\rangle$ and recalling that a local phase shift on mode $\mu$ is implemented by the unitary $U(\theta_\mu) = e^{i\theta_\mu \hat{n}_\mu}$, where $\hat{n}_\mu := \hat{a}_\mu^\dagger \hat{a}_\mu$ is the number operator. For pure states, the quantum Fisher information matrix (QFIm) is given by

$$Q_{\mu\nu}(\theta) = 4\mathrm{Re}\left[\left\langle\partial_{\theta_{\mu}}\Psi(\theta)\middle|\partial_{\theta_{\nu}}\Psi(\theta)\right\rangle - \left\langle\partial_{\theta_{\mu}}\Psi(\theta)\middle|\Psi(\theta)\right\rangle^2\right]. \quad (E1)$$

Since the local phase-shift unitaries acting on different modes commute, the derivative with respect to each $\theta_\mu$ simplifies to:

$$|\partial_{\theta_{\mu}} \Psi(\theta)\rangle = \frac{\partial}{\partial \theta_{\mu}} \left( e^{i\theta_{\mu} \hat{a}_{\mu}^{\dagger} \hat{a}_{\mu}} \right) \left( \prod_{\nu \neq \mu} e^{i\theta_{\nu} \hat{a}_{\nu}^{\dagger} \hat{a}_{\nu}} \right) |\Phi\rangle = i \hat{n}_{\mu} |\Psi(\theta)\rangle. \quad (E2)$$

Plugging Eq. (E2) into Eq. (E1), we find that the QFIm is given by the covariance of the number operators $\mu$ and $\nu$, i.e.,

$$Q_{\mu\nu}(\theta) = 4[\langle\hat{n}_{\mu}\hat{n}_{\nu}\rangle - \langle\hat{n}_{\mu}\rangle\langle\hat{n}_{\nu}\rangle] = 4 \operatorname{cov}(\hat{n}_{\mu}, \hat{n}_{\nu}) \quad (E3)$$

where all expectation values $\langle\bullet\rangle = \langle\Psi(\theta)\rangle|\bullet|\Psi(\theta)\rangle$ are taken with respect to the final state.

We now show that the covariance of number operators can be computed directly from the covariance matrix of the state. First, we express the number operator in terms of quadratures: $\hat{n}_\mu = \hat{a}_\mu^\dagger \hat{a}_\mu = \frac{1}{2}(\hat{x}_\mu - i\hat{p}_\mu)(\hat{x}_\mu + i\hat{p}_\mu) = \frac{1}{2}(\hat{x}_\mu^2 + \hat{p}_\mu^2 - 1)$, where $\hat{a} = (\hat{x}_\mu + i\hat{p}_\mu)/\sqrt{2}$. For zero-mean Gaussian states, all odd moments vanish, and fourth-order moments can be reduced using Wick's theorem [47]

$$\begin{aligned} \langle \hat{z}_{\alpha} \hat{z}_{\beta} \hat{z}_{\gamma} \hat{z}_{\delta} \rangle &= \langle \hat{z}_{\alpha} \hat{z}_{\beta} \rangle \langle \hat{z}_{\gamma} \hat{z}_{\delta} \rangle + \langle \hat{z}_{\alpha} \hat{z}_{\gamma} \rangle \langle \hat{z}_{\beta} \hat{z}_{\delta} \rangle + \langle \hat{z}_{\alpha} \hat{z}_{\delta} \rangle \langle \hat{z}_{\beta} \hat{z}_{\gamma} \rangle, \\ \langle \hat{z}_{\alpha} \hat{z}_{\beta} \hat{w}_{\gamma} \hat{w}_{\delta} \rangle &= \langle \hat{z}_{\alpha} \hat{z}_{\beta} \rangle \langle \hat{w}_{\gamma} \hat{w}_{\delta} \rangle + \langle \hat{z}_{\alpha} \hat{w}_{\gamma} \rangle \langle \hat{z}_{\beta} \hat{w}_{\delta} \rangle + \langle \hat{z}_{\alpha} \hat{w}_{\delta} \rangle \langle \hat{z}_{\beta} \hat{w}_{\gamma} \rangle, \end{aligned} \quad (E4)$$

where $\hat{z}, \hat{w} \in \{\hat{x}, \hat{p}\}$. In particular, setting $\alpha = \beta = \mu$ and $\gamma = \delta = \nu$, we obtain:

$$\langle \hat{z}_{\mu}^{2} \hat{z}_{\nu}^{2} \rangle = \langle \hat{z}_{\mu}^{2} \rangle \langle \hat{z}_{\nu}^{2} \rangle + 2 \langle z_{\mu} z_{\nu} \rangle^{2}, \quad (E5)$$

$$\langle \hat{z}_{\mu}^{2} \hat{w}_{\nu}^{2} \rangle = \langle \hat{z}_{\mu}^{2} \rangle \langle w_{\nu}^{2} \rangle + 2 \langle z_{\mu} w_{\nu} \rangle^{2}. \quad (E6)$$

Expanding the terms in $4\mathrm{cov}(\hat{n}_\mu, \hat{n}_\nu)$ in terms of quadratures $\hat{x}_\mu, \hat{p}_\mu$, we find:

$$4\langle\hat{n}_{\mu}\hat{n}_{\nu}\rangle = \langle(\hat{x}_{\mu}^{2} + \hat{p}_{\mu}^{2} - 1)(\hat{x}_{\nu}^{2} + \hat{p}_{\nu}^{2} - 1)\rangle = 1 + \langle\hat{x}_{\mu}^{2}\hat{x}_{\nu}^{2}\rangle + \langle\hat{p}_{\mu}^{2}\hat{p}_{\nu}^{2}\rangle + \langle\hat{x}_{\mu}^{2}\hat{p}_{\nu}^{2}\rangle + \langle\hat{p}_{\nu}^{2}\hat{x}_{\mu}^{2}\rangle - 2\langle\hat{p}_{\mu}^{2}\rangle - 2\langle\hat{x}_{\mu}^{2}\rangle. \quad (E7)$$

$$4\langle\hat{n}_{\mu}\rangle\langle\hat{n}_{\nu}\rangle = \langle(x_{\mu}^{2} + p_{\mu}^{2} - 1)(x_{\nu}^{2} + p_{\nu}^{2} - 1)\rangle = 1 + \langle x_{\mu}^{2}\rangle\langle x_{\nu}^{2}\rangle + \langle p_{\mu}^{2}\rangle\langle p_{\nu}^{2}\rangle + 2\langle x_{\mu}^{2}\rangle\langle p_{\nu}^{2}\rangle - 2\langle x_{\mu}^{2}\rangle - 2\langle p_{\mu}^{2}\rangle. \quad (E8)$$

For displaced Gaussian states $\hat{z}_\alpha \rightarrow \delta z_\alpha + (\hat{z}_\alpha)$ with $\hat{z} \in \{\hat{x}, \hat{p}\}$ and $\alpha \in \{\mu, \nu\}$, we compute the following product:

$$\begin{aligned} \hat{z}_{\mu}^{2} \hat{w}_{\nu}^{2} = \delta \hat{z}_{\mu}^{2} \delta \hat{w}_{\nu}^{2} &+ 2 \langle \hat{w}_{\nu} \rangle \delta \hat{z}_{\mu}^{2} \delta \hat{w}_{\nu} + \langle \hat{w}_{\nu} \rangle^{2} \delta \hat{z}_{\mu}^{2} \\ &+ 2 \langle \hat{z}_{\mu} \rangle \delta \hat{z}_{\mu} \delta \hat{w}_{\nu}^{2} + 4 \langle \hat{z}_{\mu} \rangle \langle \hat{w}_{\nu} \rangle \delta \hat{z}_{\mu} \delta \hat{w}_{\nu} + 2 \langle \hat{z}_{\mu} \rangle \langle \hat{w}_{\nu} \rangle^{2} \delta \hat{z}_{\mu} \\ &+ \langle \hat{z}_{\mu} \rangle^{2} \delta \hat{w}_{\nu}^{2} + 2 \langle \hat{z}_{\mu} \rangle^{2} \langle \hat{w}_{\nu} \rangle \delta \hat{w}_{\nu} + \langle \hat{z}_{\mu} \rangle^{2} \langle \hat{w}_{\nu} \rangle^{2}. \end{aligned} \quad (E9)$$

Taking the expectation value and applying Wick's theorem, we see that all odd fluctuation moments vanish, and the fourth-order moments decompose as:

$$\langle \hat{z}_{\mu}^{2} \hat{w}_{\nu}^{2} \rangle = \langle \delta \hat{z}_{\mu}^{2} \rangle \langle \delta \hat{w}_{\nu}^{2} \rangle + 2 \langle \delta \hat{z}_{\mu} \delta \hat{w}_{\nu} \rangle^{2} + \langle \hat{w}_{\nu}^{2} \rangle \langle \delta \hat{z}_{\mu}^{2} \rangle + \langle \hat{z}_{\mu}^{2} \rangle \langle \delta \hat{w}_{\nu}^{2} \rangle + 4 \langle \hat{z}_{\mu} \rangle \langle \hat{w}_{\nu} \rangle \langle \delta \hat{z}_{\mu} \delta \hat{w}_{\nu} \rangle + \langle \hat{z}_{\mu} \rangle^{2} \langle \hat{w}_{\nu} \rangle^{2}. \quad (E10)$$
We can now use Eq. (E10) to compute both terms of $4 \operatorname{cov}(n_μ, n_ν)$. Starting with the first, we find that $4\langle\hat{n}_μ\hat{n}_ν\rangle$ is given by:

$$ 
\begin{aligned}
4\langle\hat{n}_{\mu}\hat{n}_{\nu}\rangle = & 1 + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\delta\hat{x}_{\nu}^{2}\rangle + 2\langle\delta\hat{x}_{\mu}\delta\hat{x}_{\nu}\rangle^{2} + \langle\hat{x}_{\nu}\rangle^{2}\langle\delta\hat{x}_{\mu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\hat{x}_{\nu}\rangle^{2} + 4\langle\hat{x}_{\mu}\rangle\langle\hat{x}_{\nu}\rangle\langle\delta\hat{x}_{\mu}\delta\hat{x}_{\nu}\rangle \\
& + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\delta\hat{p}_{\nu}^{2}\rangle + 2\langle\delta\hat{p}_{\mu}\delta\hat{p}_{\nu}\rangle^{2} + \langle\hat{p}_{\nu}\rangle^{2}\langle\delta\hat{p}_{\mu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\hat{p}_{\nu}\rangle^{2} + 4\langle\hat{p}_{\mu}\rangle\langle\hat{p}_{\nu}\rangle\langle\delta\hat{p}_{\mu}\delta\hat{p}_{\nu}\rangle \\
& + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\delta\hat{p}_{\nu}^{2}\rangle + 2\langle\delta\hat{x}_{\mu}\delta\hat{p}_{\nu}\rangle^{2} + \langle\hat{p}_{\nu}\rangle^{2}\langle\delta\hat{x}_{\mu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\hat{p}_{\nu}\rangle^{2} + 4\langle\hat{x}_{\mu}\rangle\langle\hat{p}_{\nu}\rangle\langle\delta\hat{x}_{\mu}\delta\hat{p}_{\nu}\rangle \\
& + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\delta\hat{x}_{\nu}^{2}\rangle + 2\langle\delta\hat{p}_{\mu}\delta\hat{x}_{\nu}\rangle^{2} + \langle\hat{x}_{\nu}\rangle^{2}\langle\delta\hat{p}_{\mu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\hat{x}_{\nu}\rangle^{2} + 4\langle\hat{p}_{\mu}\rangle\langle\hat{x}_{\nu}\rangle\langle\delta\hat{p}_{\mu}\delta\hat{x}_{\nu}\rangle \\
& - 2\langle\hat{x}_{\mu}^{2}\rangle - 2\langle\hat{p}_{\mu}^{2}\rangle.
\end{aligned}
\quad (E11) $$

The second term, $4\langle n_μ \rangle \langle n_ν \rangle$, is given by:

$$ 
\begin{aligned}
4\langle\hat{n}_{\mu}\rangle\langle\hat{n}_{\nu}\rangle = & 1 + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\hat{x}_{\nu}\rangle^{2} + \langle\hat{x}_{\mu}\rangle^{2}\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\hat{x}_{\nu}\rangle^{2} \\
& + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\hat{p}_{\nu}\rangle^{2} + \langle\hat{p}_{\mu}\rangle^{2}\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\hat{p}_{\nu}\rangle^{2} \\
& + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\delta\hat{x}_{\mu}^{2}\rangle\langle\hat{p}_{\nu}\rangle^{2} + \langle\hat{x}_{\mu}\rangle^{2}\langle\delta\hat{p}_{\nu}^{2}\rangle + \langle\hat{x}_{\mu}\rangle^{2}\langle\hat{p}_{\nu}\rangle^{2} \\
& + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\delta\hat{p}_{\mu}^{2}\rangle\langle\hat{x}_{\nu}\rangle^{2} + \langle\hat{p}_{\mu}\rangle^{2}\langle\delta\hat{x}_{\nu}^{2}\rangle + \langle\hat{p}_{\mu}\rangle^{2}\langle\hat{x}_{\nu}\rangle^{2} \\
& - 2\langle\delta\hat{x}_{\mu}^{2}\rangle - 2\langle\hat{x}_{\mu}\rangle^{2} - 2\langle\delta\hat{p}_{\mu}^{2}\rangle - 2\langle\hat{p}_{\mu}\rangle^{2}.
\end{aligned}
\quad (E12) $$

Finally, by combining both terms, the covariance of the number operators can be expressed as:

$$ 
\begin{aligned}
4 \operatorname{cov}(\hat{n}_{\mu}, \hat{n}_{\nu}) = & 2[\langle\delta\hat{x}_{\mu}\delta\hat{x}_{\nu}\rangle^{2} + \langle\delta\hat{p}_{\mu}\delta\hat{x}_{\nu}\rangle^{2} + \langle\delta\hat{x}_{\mu}\delta\hat{p}_{\nu}\rangle^{2} + \langle\delta\hat{p}_{\mu}\delta\hat{p}_{\nu}\rangle^{2}] \\
& + 4[\langle\hat{x}_{\mu}\rangle\langle\hat{x}_{\nu}\rangle\langle\delta\hat{x}_{\mu}\delta\hat{x}_{\nu}\rangle + \langle\hat{p}_{\mu}\rangle\langle\hat{p}_{\nu}\rangle\langle\delta\hat{p}_{\mu}\delta\hat{p}_{\nu}\rangle + \langle\hat{x}_{\mu}\rangle\langle\hat{p}_{\nu}\rangle\langle\delta\hat{x}_{\mu}\delta\hat{p}_{\nu}\rangle + \langle\hat{p}_{\mu}\rangle\langle\hat{x}_{\nu}\rangle\langle\delta\hat{p}_{\mu}\delta\hat{x}_{\nu}\rangle] - \delta_{\mu\nu},
\end{aligned}
\quad (E13) $$

where the Kronecker delta $\delta_{\mu\nu}$ accounts for the non commutativity of the quadrature operators. Therefore, the quantum Fisher information can be simply written in terms of the covariance matrix and first moments as:

$$ 
\begin{aligned}
\mathcal{Q}_{\mu\nu} = & 2(\sigma_{\hat{x}_{\mu}\hat{x}_{\nu}}^{2} + \sigma_{\hat{p}_{\mu}\hat{p}_{\nu}}^{2} + \sigma_{\hat{x}_{\mu}\hat{p}_{\nu}}^{2} + \sigma_{\hat{p}_{\mu}\hat{x}_{\nu}}^{2}) + 4(\sigma_{\hat{x}_{\mu}\hat{x}_{\nu}}\bar{\hat{r}}_{\hat{x}_{\nu}} + \sigma_{\hat{p}_{\mu}\hat{p}_{\nu}}\bar{\hat{r}}_{\hat{p}_{\nu}} + \sigma_{\hat{x}_{\mu}\hat{p}_{\nu}}\bar{\hat{r}}_{\hat{p}_{\mu}} + \sigma_{\hat{p}_{\mu}\hat{x}_{\nu}}\bar{\hat{r}}_{\hat{p}_{\nu}}) - \delta_{\mu\nu} \\
= & 2 \sum_{z,w \in \{x,p\}} (\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}^{2} + 2\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}\bar{\hat{r}}_{\hat{z}_{\mu}}\bar{\hat{r}}_{\hat{w}_{\nu}}) - \delta_{\mu\nu},
\end{aligned}
\quad (E14) $$

where $\sigma_{\hat{z}_{\alpha}\hat{w}_{\beta}} = \langle\hat{z}_{\alpha}\hat{w}_{\beta}\rangle$ and $\bar{\hat{r}}_{\hat{z}_{\alpha}} = \langle\hat{z}_{\alpha}\rangle$. This concludes the proof of Lemma 5.

To prove Theorem 6, we begin by recalling the definition of the privacy measure: $P(v, Q) = v^\top Q v / \operatorname{tr}(Q)$, where $v = (1, \dots, 1)^\top / \sqrt{M}$. Given the quantum Fisher information matrix $Q$ derived in Lemma 5, the numerator of $P$ can be written as

$$ v^\top Q v = \frac{1}{M} \sum_{\mu,v} Q_{\mu v} = \frac{2}{M} \sum_{\mu,v} \sum_{z,w \in \{x,p\}} (\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}^{2} + 2\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}\bar{\hat{r}}_{\hat{z}_{\mu}}\bar{\hat{r}}_{\hat{w}_{\nu}}) - 1 \quad (E15) $$

Similarly, the trace is given by $\operatorname{tr}(Q) = \sum_{\mu} Q_{\mu\mu} = 2 \sum_{\mu} \sum_{z,w \in \{x,p\}} (\sigma_{\hat{z}_{\mu}\hat{w}_{\mu}}^{2} + 2\sigma_{\hat{z}_{\mu}\hat{w}_{\mu}}\bar{\hat{r}}_{\hat{z}_{\mu}}\bar{\hat{r}}_{\hat{w}_{\mu}}) - M$. Combining the numerator and the trace, we obtain the following closed-form expression for the privacy:

$$ P(Q, v) = \frac{2 \sum_{\mu,v} \sum_{z,w \in \{x,p\}} (\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}^{2} + 2\sigma_{\hat{z}_{\mu}\hat{w}_{\nu}}\bar{\hat{r}}_{\hat{z}_{\mu}}\bar{\hat{r}}_{\hat{w}_{\nu}}) - M}{M[2 \sum_{\mu} \sum_{z,w \in \{x,p\}} (\sigma_{\hat{z}_{\mu}\hat{w}_{\mu}}^{2} + 2\sigma_{\hat{z}_{\mu}\hat{w}_{\mu}}\bar{\hat{r}}_{\hat{z}_{\mu}}\bar{\hat{r}}_{\hat{w}_{\mu}}) - M]} \quad (E16) $$

which proves Theorem 6.