## 3 Security Analysis
In particular, one can consider the trace distance between the output state produced by the protocol, \(\rho_{S_{A}S_{B}E}\) and the ideal state, which is \(\tau_{SS}\otimes\rho_{E}\), where \(\tau_{SS}=\frac{1}{2^{\ell}}\sum_{s\in\{0,1\}^{\ell}}|s,s\rangle\langle s,s|\) describes a uniformly-chosen key of length \(\ell\), identical for [PERSON] and [PERSON], and where the tensor product indicates that [PERSON]'s system is completely uncorrelated with the final key:  
\[\frac{1}{2}\left\|\rho_{S_{A}S_{B}E}-\tau_{SS}\otimes\rho_{E}\right\|_{1}\leq\varepsilon. \tag{3}\]  
Let us summarize the various notions of security proofs present in the literature from the strongest one to the weakest one:  
1. Composable security against arbitrary attacks, if one can bound the trace distance of Equation (3), without any restriction on the input state \(\rho_{A^{N}B^{N}}\) of the protocol. 2. Composable security against collective attacks, if one can bound the trace distance of Equation (3) under the restriction that the input state is identically and independently distributed, _i.e._, \(\rho_{A^{N}B^{N}}\ =\ \rho_{AB}^{\otimes N}\). 3. Security against collective attacks in the asymptotic limit of infinitely many uses of the channel, if one can compute an upper bound on the Holevo information, \(\chi(B;E)\) from Equation (1), between the raw key and the adversary, assuming that the quantum state shared by [PERSON] and [PERSON] is known. In the case of CV protocols, one only needs to assume that the covariance matrix of the state is known. Let us denote the respective secure key rates (final key length \(\ell\) divided by the number \(N\) of channel uses) for these three notions of security by \(K^{\varepsilon}(N),K^{\varepsilon}_{\text{coll}}(N)\) and \(K^{\text{asympt}}_{\text{coll}}\). The first two quantities,which involve (smooth) conditional min-entropies (defined by [PERSON] in [32] and later extended to infinite-dimensional quantum systems [34, 35]), include finite-size effects and, therefore, depend on \(N\). On the other hand, the asymptotic key rate is independent of \(N\). Since \(K^{\epsilon}(N)\leq K^{\epsilon}_{\rm coll}(N)\leq K^{\rm asympt}_{\rm coll}\), the main question is to determine whether \(K^{\epsilon}(N)\) indeed converges to \(K^{\rm asympt}_{\rm coll}\) in the asymptotic limit and at which rate. Often, in the literature, one can read that computing the value of \(K^{\rm asympt}_{\rm coll}\) is sufficient because de Finetti-type reductions, such as [36, 37], show that the same value also holds for arbitrary attacks. The situation is unfortunately not so simple: de Finetti reductions only make sense in the composable setting, and in general, computing the Devetak-Winter formula is not sufficient to claim security against arbitrary attacks in the finite-size setting. In general, one can either prove security against arbitrary attacks directly, for instance using the uncertainty principle as in [38, 39] following the results from [40], or one can first establish security against collective attacks (in the finite-size regime) and obtain a security claim against arbitrary attacks (with a worse value of \(\varepsilon\)) using a de Finetti reduction [36, 37]. So far, this second approach was only applied for the protocol [23] with coherent states and heterodyne detection [24]. That being said, the behavior of the quantity \(K^{\rm asympt}_{\rm coll}\) is still interesting, because it allows us to compare the various protocols and to understand the effect of losses and noise on the secret key rate. Moreover, it is reasonable to think that the proof technique of [24] can be generalized to most protocols with a Gaussian modulation and that the composable secret key rate \(K^{\epsilon}_{\rm coll}(N)\) valid against collective attacks will converge to the asymptotic key rate for reasonable values of \(N\).