## 2 Description of [PERSON]'s attack and its properties
### Flat attacks with respect to basis \(b\)  
Assume now that [PERSON]'s attack \(U\) is fixed, and that \(P_{e}^{\overline{b}}\) is given by Eq. (15). We will present a virtual attack that is proven to be better for [PERSON], as it induces a smaller error-rate. This virtual attack cannot be executed by [PERSON] since it requires knowledge of the basis \(b\) used by [PERSON] (a knowledge that, of course, [PERSON] does not have at the stage in which she chooses her transformation \(U\)). Still, the existence of such an attack that is proven to be better for [PERSON], allows us to derive bounds on [PERSON]'s knowledge when the original attack (actually used by [PERSON]) is applied.  
**Proposition 1**.: _For each attack \(U\) with \(\rho_{0}^{b}\), \(\rho_{1}^{b}\) and \(p_{e}^{b}\) given by (6), (7) and (10), that satisfy_  
\[\langle E_{00}^{b}|E_{11}^{b}\rangle+\langle E_{01}^{b}|E_{10}^{b}\rangle=e^{ i\theta}r\qquad\qquad\qquad\text{for }r\in\mathbf{R}_{+} \tag{16}\]  
_there exists \(U_{b}^{\prime}\) with the same \(\rho_{0}^{b}\), \(\rho_{1}^{b}\) and \(p_{e}^{b}\) as \(U\), which satisfy_  
\[\langle E_{00}^{b}|E_{11}^{\prime b}\rangle+\langle E_{01}^{\prime b}|E_{10}^{ \prime b}\rangle=r. \tag{17}\]  
Proof.: Let \(S_{\theta}^{b}:\mathcal{H}_{2}\rightarrow\mathcal{H}_{2}\) be defined by \(S_{\theta}^{b}|0^{b}\rangle=|0^{b}\rangle\) and \(S_{\theta}^{b}|1^{b}\rangle=e^{i\theta}|1^{b}\rangle\). \(S_{\theta}^{b}\) is clearly unitary and consequently so is \(\mathbf{1}_{j}^{E}\otimes S_{\theta}:\mathcal{H}_{j}^{E}\otimes\mathcal{H}_{2} \rightarrow\mathcal{H}_{j}^{E}\otimes\mathcal{H}_{2}\) where \(\mathbf{1}_{j}^{E}\) is the identity on \(\mathcal{H}_{j}^{E}\). Let \(U_{b}^{\prime}=U(\mathbf{1}_{j}^{E}\otimes S_{-\theta})\). \(U_{b}^{\prime}\) is such that  
\[U_{b}^{\prime}|0\rangle|0^{b}\rangle =\qquad|E_{00}^{b}\rangle|0^{b}\rangle+\qquad|E_{01}^{b}\rangle|1 ^{b}\rangle=|\phi_{0}^{\prime b}\rangle, \tag{18}\] \[U_{b}^{\prime}|0\rangle|1^{b}\rangle =e^{-i\theta}|E_{10}^{b}\rangle|0^{b}\rangle+e^{-i\theta}|E_{11}^{b }\rangle|1^{b}\rangle=|\phi_{1}^{\prime b}\rangle. \tag{19}\]  
\(|\psi_{1}^{b}\rangle\) are thus called _lift-ups_ of \(\rho_{0}\) and \(\rho_{1}\). Since they are also pure, they are said to be _purifications_ of \(\rho_{0}\) and \(\rho_{1}\). Moreover they are normalized and by Eq. (20) their overlap is  
\[\langle\psi_{0}^{b}|\psi_{1}^{b}\rangle=\langle E_{00}^{b}|E_{11}^{b}\rangle+ \langle E_{01}^{b}|E_{10}^{b}\rangle=r. \tag{23}\]  
This establishes a direct relation between the overlap of \(|\psi_{0}^{b}\rangle\) and \(|\psi_{1}^{b}\rangle\) and the probability of error \(p_{e}^{\vec{b}}\). Since the overlap \(r\) is real and positive, with \(0\leq r\leq 1\), there is an angle \(\alpha\) such that  
\[\cos(2\alpha)=r=\langle\psi_{0}^{b}|\psi_{1}^{b}\rangle\hskip 56.905512 pt0\leq \alpha\leq\pi/4.\]  
As a consequence, we get  
\[p_{e}^{\vec{b}}=\frac{1}{2}[1-\cos(2\alpha)]=\sin^{2}(\alpha)\quad\mbox{or} \quad\sin(\alpha)=(p_{e}^{\vec{b}})^{1/2}. \tag{24}\]  
Since \(\langle\psi_{0}^{b}|\psi_{1}^{b}\rangle\) is real, it is equal to \(\langle\psi_{1}^{b}|\psi_{0}^{b}\rangle\) and consequently the (non normalized) states \(|\psi_{0}^{b}\rangle+|\psi_{1}^{b}\rangle\) and \(|\psi_{0}^{b}\rangle-|\psi_{1}^{b}\rangle\) are orthogonal and their norms are \(\sqrt{2+2\cos(2\alpha)}=2\cos(\alpha)\) and \(\sqrt{2-2\cos(2\alpha)}=2\sin(\alpha)\) respectively. We thus let  
\[|0_{H}^{b}\rangle=\frac{1}{2\cos(\alpha)}[|\psi_{0}^{b}\rangle+|\psi_{1}^{b} \rangle];\hskip 56.905512 pt|1_{H}^{b}\rangle=\frac{1}{2\sin(\alpha)}[|\psi_{0}^{b }\rangle-|\psi_{1}^{b}\rangle]. \tag{25}\]  
Using this basis, we can re-write the purification for \(x\in\{0,1\}\), as  
\[|\psi_{x}^{b}\rangle=\cos(\alpha)|0_{H}^{b}\rangle+(-1)^{x}\sin(\alpha)|1_{H} ^{b}\rangle. \tag{26}\]