Morane Beaumet

Anica Dose

Alois Bräuer

Jean-Pierre Mahy

Wadih Ghattas
email: wadih.ghattas@universite-paris-saclay.fr

Michael Groll

Corinna R Hess
email: corinna.hess@ch.tum.de

An artificial metalloprotein with metal-adaptive coordination sites and Ni-dependent quercetinase activity

Keywords:

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Artificial metalloenzymes (AMEs) are powerful tools for catalyzing transformations under ecofriendly conditions. [1,[START_REF] Mahy | Catalysis Series[END_REF] The protein environment confers chemo-and regio-selectivity that may be further improved by directed evolution. [START_REF] Reetz | [END_REF] Thus both primary and secondary coordination sphere effects can be exploited to enhance and expand the range of activities of the metal binding sites within these systems. In this regard, AMEs offer distinct advantages over molecular catalysts.

Several strategies have been established for the design of AMEs. [1,4,5] The vast majority of these are based on two methods. The first method involves substitution of the metal cofactor-either a metal ion or a complete prosthetic group-within a natural metalloenzyme. [6][7][8][9][10][11] The second method relies on covalent or supramolecular anchoring of molecular complexes to a protein. [12] An alternate method for AME engineering involves the introduction of coordinating canonical amino acids with appropriate coordination geometries to engineer metal binding sites into metal-free natural or de novo proteins. [13][14][15][16][17] In contrast to the aforementioned metal substitution and tethering strategies, the entire coordination environment must be constructed to achieve tight metal binding, and the optimal geometry and/or redox properties to enable substrate activation. Thus, the creation of amino acid ligated metal centers within suitable protein cavities that can simultaneously bind select substrates and are catalytically active, is significantly more challenging. An AME example generated by this latter method, and of relevance to this work, is an artificial Cu II -Diels-Alderase reported by Podtetenieff et al. [18] This enzyme was generated by engineering a DHH metal-binding motif within the synthase subunit of the TIM barrel protein, imidazole glycerol phosphate synthase from Thermotoga maritima (tHisF). [19] The motif was generated by using the native aspartic acid at position 11, and by replacing residues L50 and I52 with histidines. The resultant Cu II :tHisF DHH exhibited 73% conversion of the 2-azachalcone substrate and good enantioselectivity (46% ee; 13/1 endo/exo) in the reaction with cyclopentadiene. EPR spectroscopic studies provided evidence that the copper ion interacted with the His residues of the engineered NNO site. However, a crystal structure was not available, such that further details regarding the coordination environment could not be ascertained.

Inspired by the Cu II -Diels-Alderase, we set out to develop other tH-isF-based AMEs, with a particular interest in the production of oxygen activating enzymes. The carboxylate/His/His triad of Cu II :tHisF DHH offers a versatile motif that could support other metals in varied coordina-tion geometries. For example, metalloprotease active sites often consist of Zn II ligated by two histidines and a glutamate residue in a tetrahedral geometry; [20] and in mononuclear non heme iron oxygenases the iron ion is coordinated to an NNO motif in a fac-octahedral geometry. [21] The spacious cavity of the tHisF TIM barrel (ca. 1000 Å 3 ) also should offer access to a wide array of substrates. We herein present the crystal structures of tHisF DHH , an EHH variant (tHisF EHH ), and Zn II -and Ni IIcontaining forms of the latter. The structures of the two metalloproteins reveal the ability of the tHisF EHH protein to adapt to preferences of the metal ion. Importantly, Ni II :tHisF EHH catalyzes the oxygen dependent 2,4-dioxygenolytic cleavage of the flavonols quercetin and myricetin, providing the first example of an artificial quercetinase.

Results & discussion

We successfully crystallized the apo-tHisF DHH protein that formed the basis of the aforementioned Cu II -Diels-Alderase (DHH site depicted in Fig. S1b). [18] However, our initial attempts to obtain metalcontaining tHisF DHH structures were unsuccessful. tHisF DHH also has no affinity for Zn II , as shown by isothermal titration calorimetry (ITC; Fig. S4), although this late transition metal is associated with a flexible coordination geometry. We therefore replaced the aspartic acid in the NNO motif (D11) with the longer glutamic acid residue, which we envisaged might offer greater flexibility to accommodate metal ions in conjunction with H50 and H52. The crystal structure of apo-tHisF EHH inferred a more favorable geometry for metal coordination (Fig. S1c).

Metal binding to the EHH site was again initially assessed using Zn II , and indeed, tHisF EHH has good affinity for Zn II , with a dissociation constant (K D (Zn II )) of 2 μM and 1:1 stoichiometry (Fig. S3). The wild type protein (tHisF WT ) shows no affinity for the metal (Fig. S2), in further support of specific binding of Zn II to the NNO site. The crystal structure of Zn II :tHisF EHH (Fig. 1d, and Fig. S1f-g) confirms the coordination of the metal to the triad motif. The zinc center adopts a distorted tetrahedral geometry, with a water molecule occupying the fourth position. The Zn-O Glu distance is 1.9 Å, while the Zn-N His bonds are in the range of 2.1-2.2 Å. The coordination of Zn II leads only to minor movements of the amino acid side chains compared to their position in the apo structure, which demonstrates that the His and Glu residues are optimally oriented for metal binding. In contrast, larger movements of D11 and H52 would be required to provide the analogous tetrahedral coordina- tion environment in tHisF DHH . [22] Comparing the structures of apo-tHisF DHH and apo-tHisF EHH further reveals that both the asparate and glutamate residues are engaged in hydrogen bonding with H52 (N His •••O Asp/Glu = 2.8 Å), such that binding of metal ions to either NNO motif first necessitates the disruption of this hydrogen bond. However, a lower energy penalty may coincide with breaking this interaction for the more flexible glutamate.

With our interest in the production of oxygen activating enzymes in mind we next examined Ni II binding to the EHH construct, motivated by the recent studies of the nickel-dependent quercetin 2,4-dioxygenase (Ni II -QueD FLA ). [START_REF] Company | Comprehensive Coordination Chemistry III[END_REF][START_REF] Jeoung | [END_REF][25] Quercetin (Scheme 1) and the Diels-Alder cycloaddition substrates, cyclopentadiene and 2-azachalcone, are of similar size, suggesting that tHisF could accommodate the former molecule. The affinity of tHisF EHH for Ni II is only slightly lower than that for Zn II (K D (Ni II ) = 10 μM) and a 1:1 stoichiometry is also observed (Fig. S3), whereas the unmodified tHisF WT again shows no affinity for Ni II (Fig. S4).

Inspection of the active site in the X-ray structure of Ni II :tHisF EHH reveals a markedly different coordination mode of Ni II compared to Zn II (Fig. 1a-c, e). The nickel cation binds only to two of the engineered residues, H50 and H52 (Ni-N His (avg) = 2.3 Å), bypassing the glutamate in favor of a serine residue (S144) from an opposing strand within the TIM barrel that is weakly bound to the metal (Ni-O Ser = 2.7 Å). The three amino acids are oriented in a meridional fashion (N His -Ni-N His = 82°; N His -Ni-O Ser = 102°), with three water molecules occupying the remaining positions of the overall pseudo-octahedral site. In this case, while the overall protein structure is preserved (Fig. S1e, 0.4 Å r.m.s.d. for 242 C α -atoms), the interaction with serine leads to significant movement of several amino acid side chains in the cation binding site compared to the apo and Zn II :tHisF EHH structures. Thus, the Ni II structure demonstrates the moderate flexibility of the tHisF peptide chain, and the ability of the protein to accommodate varied coordination geometries at different sites.

The quercetinase activity of Ni II :tHisF EHH was subsequently investigated by absorption spectroscopy (Fig. 2), following the consumption of quercetin. The activities of apo-tHisF EHH , of tHisF WT in the presence of Ni II , and of Ni(NO 3 ) 2 •6H 2 O were also examined as controls (Fig. 2 inset; see ESI for details). Apo-tHisF EHH did not exhibit any activity, while the tHisF WT /Ni II mixture and nickel nitrate alone showed minimal background conversion of quercetin. In contrast, Ni II :tHisF EHH exhibited the highest quercetinase activity, indicating that the reaction proceeds at the engineered active site.

The highest activity was found at pH 8.2 (Fig. 3 top and Fig. S7-S10); the optimal activity of quercetinases likewise is observed at a similar pH (pH 8). [26,27] In the naturally occurring Ni-dependent enzyme, quercetin coordinates to the metal active site via the O-atom at C3 (Scheme 1), and substrate binding is favored by deprotonation of the respective OH group under slightly basic conditions. However, quercetin is not stable in buffer solutions at high pH values [28]-even at pH 8 the background quercetin consumption is no longer negligible (Fig. 3, top). Consequently, kinetic studies with Ni II :tHisF EHH were carried out at pH 7.5, which also is more relevant as it reflects the activity under physiological conditions. In the absence of oxygen, activity was not observed. However, the quercetin absorption band at 385 nm was significantly red-shifted to 433 nm, suggesting the formation of an enzyme-substrate complex (Fig. 2, red trace, and Fig. S14)-specifically binding of quercetin to the Ni ion. In contrast, the addition of quercetin to Zn II :tHisF EHH did not lead to any change in the absorption spectrum, nor did Zn II :tHisF EHH exhibit activity (Fig. S15). Reactivity studies demonstrated that the catalytic conversion of quercetin by Ni II :tHisF EHH followed Michaelis-Menten kinetics, with values of K m,app = 20 μM and k cat,app = 0.11 min -1 (Fig. 3, bottom and Fig. S11).

We investigated the reaction scope of our artificial quercetinase using the substrate analogues myricetin, galangin, taxifolin, and luteolin (Scheme 1 and Figs. S12-S13). The Ni II :tHisF EHH AME showed no activity toward the electron deficient galangin, but exhibited a greater activity toward the more electron rich myricetin, with k cat,app = 0.53 min -1 (Fig. 3, bottom and Fig. S12), despite a lower affinity for the latter substrate (K m,app = 25 μM). The reduced flavanonol taxifolin did not react, confirming the double bond between C2 and C3 as the site of oxidative cleavage. Similarly, the AME has no activity toward luteolin, which lacks the 3-OH group involved in Ni II coordination to the naturally oc- Since the Ni II :tHisF EHH structure revealed that E11 was not involved in metal binding, we returned to the tHisF DHH variant and examined its affinity for Ni II and activity. Surprisingly, tHisF DHH has no affinity for nickel nitrate as determined by ITC (Fig. S4), such that the K D (Ni II ) of the protein must be >100 μM. Samples of tHisF DHH with added nickel also showed no activity toward quercetin beyond background reactivity (Fig. 2 and Fig. S6), such that Ni II either does not coordinate to, or is not retained by the protein. The marked differences in the behaviour of tHisF EHH and tHisF DHH toward nickel (Fig. S4), may likewise stem from differences in the interaction between H52 and the carboxylate at position 11. Binding of Ni II to the His/His/Ser site requires the rotation of H52, which again requires disruption of the hydrogen bond to the carboxylate residue. The movements involved with metal binding and ac-tive site orientation underscore a well-established principle that broader protein structural features, even distant from the active site, play an important role in regulating the dynamics, coordination environments and activities of enzymes. [29,30] These factors must be taken into consideration in the design and optimization of AMEs.

Conclusions

Overall, our initial studies with tHisF EHH highlight the significant potential of this system for the construction of artificial enzymes. The TIM barrel shows good plasticity and is able to adjust to several coordination geometries even based only on the simple bis-His motif. We are currently examining the coordination of other metal ions within tHisF XHH and optimized constructs thereof. Ni II :tHisF EHH is among the limited examples of AMEs generated by engineering an active site solely using canonical amino acids. The reactivity of Ni II :tHisF EHH furthermore underscores the capacity of tHisF-based metalloprotein constructs to facilitate O 2 dependent chemistry. The rate of quercetin conversion by Ni II :tHisF EHH is lower than by Ni II -QueD FLA . [27] This is unsurprising, given that first, the native enzyme evolved specifically for quercetin as a substrate; and second, the metal active site of Ni II -QueD FLA contains an additional histidine ligand (EHHH rather than EHH motif), with the three His residues in a facial orientation. Mutation of a single His residue decreases the activity by 150-fold or abolishes it entirely (Table 1). [26] Thus, the activity of our engineered and unoptimized Ni II :tHisF EHH is already remarkable, and even higher than that of the mutated Ni II -QueD FLA . Comparison with quercetinase-inspired synthetic complexes further emphasizes the significance of our artificial quercetinase. Nisuperoxides-the active species in quercetinase-have successfully been generated in a few cases, including with bis-chelating ligands, but no reactivity toward quercetin was reported. [START_REF] Company | Comprehensive Coordination Chemistry III[END_REF]31] Ni II complexes based on polypyridyl or triazacyclononane ligands have been shown to carry out the oxidative ring opening of flavonols. While the molecular complexes comprise metal bound quercetin or one of its analogues, further addition of quercetin was rarely performed, thus limiting the activity to one turnover at best. [32][33][34][35] Among the rare examples assayed in multi-turnover reactions, [36,37] the complexes developed by Itoh et al. stand out with k app reaching 10.9 10 3 M -2 s -1 using 3hydroxyflavone as substrate. However, these reactions were carried out at high temperatures reaching 100 °C and in organic solventsincluding DMF, which served as a co-substrate in one case - [38] in contrast to the eco-friendly conditions we use in the case of Ni II :tHisF EHH .

Fig. 1 .

 1 Fig. 1. X-ray structure of tHisF EHH containing an engineered metal center. a) Ribbon diagram of tHisF EHH in complex with Ni II (cyan). Amino acids H50, H52 and S144 (shown as balls-and-sticks; gold carbon atoms; PDB ID 7QC9) coordinate the metal atom, while three defined water molecules (red) complete the pseudooctahedral coordination sphere. b) Surface representation of the Ni II :tHisF EHH -complex with colors indicating negative and positive electrostatic potentials (contoured from -10 to +10 kT/e). c) Close-up view of the engineered active site in the Ni II :tHisF EHH complex showing the 2F O -F C electron density map (grey mesh, contoured to 1.0 σ) and the anomalous nickel signal (green mesh, contoured to 20.0 σ). d) Close-up view of the engineered active site in the Zn II :tHisF EHH -complex (tetrahedral coordination completed by one water molecule) showing the 2F O -F C electron density map (grey mesh, contoured to 1.0 σ) and the anomalous zinc signal (purple mesh, contoured to 20.0 σ; PDB ID 7QC8). e) Comparison of the coordination sphere of Ni II and Zn II in the binding site of tHisF EHH . (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)

Scheme 1 .Fig. 2 .

 12 Scheme 1. Top: oxidative cleavage of quercetin as catalyzed by quercetinase. The reaction initially leads to the formation of CO and 2-((3,4-dihydroxyphenoxy) carbonyl)-4,6-dihydroxybenzoic acid; the latter compound undergoes hydrolysis to yield 3,4-dihydroxybenzoic acid and 2,4,6-trihydroxybenzoic acid as the final products. The bottom pathway depicts the active species with substrate and O 2 bound to the Ni site of the naturally occurring Ni II -QueD FLA ; quercetin binds via the O-atom at C3. [24] Bottom: four quercetin analogues examined in this work.

Fig. 3 .

 3 Fig. 3. Top left: rate of quercetin consumption at varied pHs using 50 μM quercetin in 50 mM MOPS (pH 6.5, 7 and 7.5), 50 mM HEPES (2-[4-(2-hydroxyethyl) piperazin-1-yl]ethanesulfonic acid)(pH 7.5, 8 and 8.2) or 50 mM CHES (2-(Cyclohexylamino)ethanesulfonic acid) (pH 8.6 and 9) in the presence (black bars) and absence (grey bars) of 23 μM Ni II :tHisF EHH . Top right: graph depicting the rate difference between the Ni II :tHisF EHH and buffer samples. Bottom: dependence of the initial reaction rate on quercetin (solid line) or myricetin concentration (dashed line) using 44 μM Ni II :tHisF EHH .

Acknowledgements

CRH gratefully acknowledges Prof. Manfred T. Reetz for handing off the tHisF project to us and supplying the tHisF for initial project work. We thank Dr. John Podtetenieff for helpful discussions. Philippe Ibouanga is acknowledged for assistance with protein preparation and crystallization. The present work has benefited from the platform PIM of I2BC supported by French Infrastructure for Integrated Structural Biology (FRISBI) ANR-10-INBS-05. We thank the staff of the beamline X06SA at the Paul Scherrer Institute, Swiss Light Source, Villigen Switzerland for assistance during data collection, and acknowledge funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under BioStruct-X (grant agreement no. 283570).

Data availability

No data was used for the research described in the article.

Ni II :tHisF offers a rare and valuable functional platform for structurefunction studies. This Ni enzyme and related variants will shed important insight into the structural and electronic factors that underpin cofactor regulation and activity of AMEs.

Accession number

Coordinates and structure factors have been deposited in the RCSB Protein Data Bank under the following accession codes (for details see Table S2): tHisF WT (7QC3), tHisF DHH (7QC6), tHisF EHH (7QC7) Zn II :tHisF EHH (7QC8) and Ni II :tHisF EHH (7QC9).

Author statements

All authors participated equally to this work, reviewed and proofread the manuscript."

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Appendix A. Supplementary data

Supplementary data to this article can be found online at https:// doi.org/10.1016/j.jinorgbio.2022.111914.


In some works, the term "covert capacity" refers to the scaling factor of information

Covert Communication Over the Poisson Channel

Ligong Wang, Member, IEEE Abstract-We consider the problem of communication over a continuous-time Poisson channel subject to a covertness constraint: The relative entropy between the output distributions when a message is transmitted and when no input is provided must be small. In the absence of both bandwidth and peak-power constraints, we show the covert communication capacity of this channel, in nats per second, to be infinity. When a peak-power constraint is imposed on the input, the covert communication capacity becomes zero, and the "square-root scaling law" applies. When a bandwidth constraint but no peak-power constraint is imposed, the covert communication capacity is again shown to be zero, but we have not determined whether the square-root law holds or not.

Index Terms-Covert communication, low probability of detection, Poisson channel.

I. INTRODUCTION

C OVERT communication, or communication with low probability of detection [START_REF] Bash | Limits of reliable communication with low probability of detection on AWGN channels[END_REF]- [START_REF] Bloch | Covert communication over noisy channels: A resolvability perspective[END_REF], refers to applications where the transmitter and the receiver must keep an eavesdropper from discovering the fact that they are using the channel to communicate. Specifically, the signals observed by the eavesdropper when the channel is used must be statistically close to the signals observed when the channel is not used. For additive white Gaussian noise (AWGN) channels, the channel not being used is modeled by the transmitter always sending zero; for a discrete memoryless channel (DMC), this is modeled by the transmitter sending an "innocent" symbola specific input symbol, the choice of which is given as part of the channel model. For a DMC, if the output distribution at the eavesdropper generated by the innocent symbol is a convex combination of the output distributions generated by the other, non-innocent input symbols, then a positive covert communication rate is achievable; otherwise the maximum amount of information that can be covertly communicated grows proportionally to the square root of the total number of channel uses [START_REF] Wang | Fundamental limits of communication with low probability of detection[END_REF]. For the AWGN channel, the latter, squareroot scaling law applies [START_REF] Bash | Limits of reliable communication with low probability of detection on AWGN channels[END_REF], [START_REF] Wang | Fundamental limits of communication with low probability of detection[END_REF].

As most practically relevant channel models appear to follow the square-root scaling law and thus have zero capacity (in nats per channel use) 1 for covert communication, some works have considered variations of the DMC and AWGN channel models. For example, [START_REF] Che | Reliable deniable communication with channel uncertainty[END_REF]- [START_REF] Sobers | Covert communication in the presence of an uninformed jammer[END_REF] consider channels with parameters that are unknown to the eavesdropper, and [START_REF] Lee | Covert communication with channel-state information at the transmitter[END_REF] considers channels with channel-state information (CSI) available to the transmitter. These works show that, under such additional assumptions, positive covert communication rates are sometimes achievable.

The present paper is concerned with covert communication over the Poisson channel [START_REF] Kabanov | The capacity of a channel of the Poisson type[END_REF]- [START_REF] Wyner | Capacity and error exponent for the direct detection photon channel -parts I and II[END_REF]. The Poisson channel is a standard model for optical communication employing intensity modulation at the transmitter and photodetection at the receiver, hence covert communication over such a channel is of practical importance.

On a continuous-time Poisson channel, the input is a nonnegative waveform, and the output is a doubly stochastic Poisson process whose conditional intensity is given by the input waveform plus the "dark current"-a constant describing background noise. We assume that, when the transmitter is not sending a message, it sends the all-zero waveform.

Like [START_REF] Wang | Fundamental limits of communication with low probability of detection[END_REF], we adopt a setup where the intended receiver and the eavesdropper observe the same channel output, and where the transmitter and the receiver share a sufficiently long secret key. The key allows the transmitter and the receiver to use a random codebook whose realization is unknown to the eavesdropper. In all our achievability proofs, we shall generate the random codebook by choosing all input symbols to be independent and identically distributed (IID). This renders the output also IID, so the covertness analysis can be performed by computing relative entropies between distributions of a single output random variable. Using IID inputs is obviously inefficient in the usage of the secret key. For bounds on the number of secret key nats that need to be used, or for covert communication without using a secret key, see, e.g., [START_REF] Che | Reliable deniable communication: Hiding messages in noise[END_REF], [START_REF] Bloch | Covert communication over noisy channels: A resolvability perspective[END_REF]. We note that, when one adopts a wiretap channel model [START_REF] Wyner | The wiretap channel[END_REF] with different channel coefficients (gain and dark current in the Poisson case) for the intended receiver and the eavesdropper, the scaling behavior (e.g., linear or square-root) that we derive in this paper will remain unchanged, but the required number of key nats will depend heavily on the difference between the two channels.

The first interest of this work lies in the case where there is neither a peak constraint nor a bandwidth constraint on the input waveform. We show that, in this case, the Poisson channel has an infinite per-second covert communication capacity. Thus, the continuous-time Poisson channel follows no squareroot scaling law that is analogous to the one for discretetime AWGN channels and many DMCs; instead, it allows the number of covert information nats to grow super-linearly with total communication time.

Compared to most previously studied channel models that allow positive-rate covert communication, our model is of a different nature. First, the Poisson channel is memoryless, but is dissimilar to those DMCs that allow positive-rate covert communication [START_REF] Wang | Fundamental limits of communication with low probability of detection[END_REF], in the sense that its output distribution conditional on the all-zero input is not a convex combination of the output distributions conditional on any input waveforms that are not almost everywhere zero. To see this, simply note that any input waveform with a positive Lebesgue integral will increase the expectation of the total number of output arrivals compared to the all-zero input waveform. Second, our model is dissimilar to the queueing channel considered in [START_REF] Mukherjee | Covert bits through queues[END_REF]. In [START_REF] Mukherjee | Covert bits through queues[END_REF] it is assumed that, when no message is being communicated via the queueing channel, packets arrive in a random, Poisson process, making the problem similar to that of "stealth" [START_REF] Hou | Effective secrecy: reliability, confusion and stealth[END_REF]. Third, we do not assume any unknown parameter or channel state as in [START_REF] Che | Reliable deniable communication with channel uncertainty[END_REF]- [START_REF] Lee | Covert communication with channel-state information at the transmitter[END_REF]. Such additional assumptions would typically allow the transmitter to send a non-vanishing average signal power or a non-vanishing percentage of non-innocent symbols. As we shall see, our Poisson model requires that the average input power tend to zero as total communication time grows large, but even this vanishing input power provides unbounded communication capacity.

In some sense, this Poisson channel has infinite covert communication capacity because it is a continuous-time channel with no bandwidth limit. Indeed, as we show later on in this paper, once we restrict the communication bandwidth to a certain value to reduce the Poisson channel to discrete time, the maximum covert communication rate will again vanish as total communication time grows large. Also crucial to the infinitecapacity result is the absence of a peak-power constraint. It is well known that a peak-constrained infinite-bandwidth Poisson channel has a finite per-second communication capacity [START_REF] Kabanov | The capacity of a channel of the Poisson type[END_REF]- [START_REF] Wyner | Capacity and error exponent for the direct detection photon channel -parts I and II[END_REF], whereas, without a peak constraint, its capacity for standard, non-covert communication is infinity. We shall show that the peak-constrained Poisson channel obeys the squareroot scaling law for covert communication, i.e., that the maximum number of nats that can be communicated covertly grows proportionally to the square root of total communication time.

The rest of this paper is organized as follows. Section II studies the Poisson channel with neither peak-power nor bandwidth constraint, and shows its per-second covert communication capacity to be infinity. Section III treats the peaklimited case and derives the exact scaling law. Section IV treats the band-limited case and derives an upper bound. Section V then concludes the paper with some remarks.

II. THE NO-CONSTRAINT CASE

Consider a continuous-time Poisson channel with constant dark current λ > 0. The input to the channel must be a Lebesgue-measurable, nonnegative signal x(t) ≥ 0, t ∈ [0, T], where T > 0 is the total communication time. Conditional on this input signal, the channel output Y (t), t ∈ [0, T], is a Poisson process whose time-t intensity is x(t) + λ. That means Y (•) is a random counting function with Y (0) = 0 with probability one and, for t

1 , t 2 ∈ [0, T], t 1 < t 2 , Pr[ Y (t 2 ) -Y (t 1 ) = k|X(•) = x(•)] = e -s s k k! , k ∈ Z + 0 , (1)
where

s = t2 t1 x(t) + λ dt. (2)
A codebook on [0, T] at rate R nats per second for communication over this channel contains e TR input signals x m (t), t ∈ [0, T], m ∈ {1, . . . , e TR }. An encoder maps a message m ∈ {1, . . . , e TR } to the corresponding input signal x m (t), t ∈ [0, T], and sends this signal into the channel. A corresponding decoder maps the output signal y(t), t ∈ [0, T], to the decoded message m ∈ {1, . . . , e TR }. With the help of a sufficiently long secret key, the transmitter and the receiver use a random code to communicate their message. The eavesdropper, which is colocated with the receiver, is assumed to know the distribution according to which the random code is chosen, but not the actual choice (because it does not know the secret key).

In this section, we do not impose a peak constraint on the input signal, hence the value of x m (t) at a specific time t may be arbitrarily large. The peak-limited case is discussed in the next section. As we shall see, our result does not depend on whether there is an average-power constraint on the input or not.

Let Q T denote the distribution of Y (t), t ∈ [0, T], when there is no input signal, i.e., when x(t) = 0 for all t ∈ [0, T]. Thus, Q T describes the homogeneous Poisson process of intensity λ on [0, T]. Further, let P T denote the distribution of Y (t), t ∈ [0, T], induced by the random codebook and a uniformly chosen message M . Thus, P T is the unconditional output distribution when the channel is used to communicate a message.

We say that a rate R is achievable covertly if, for every T > 0, we can construct a random code on [0, T] of rate at least R such that the probability of a decoding error, i.e., of M = M , tends to zero as T tends to infinity, and that

lim T→∞ D(P T Q T ) = 0, (3)
where D(• •) denotes the relative entropy: For two probability measures P and Q over the same set, if P is absolutely continuous with respect to Q, then

D(P Q) = E P log dP dQ , (4)
where dP dQ is the Radon-Nikodym derivative of P with respect to Q. (Alternatively, one can define D(P Q) as the supremum over all finite partitions of the sample space of the relative entropy between the probability mass functions resulting from P and Q by the partition; see [START_REF] Pinsker | Information and Information Stability of Random Variables and Processes[END_REF].) Note that, by Pinsker's inequality [START_REF] Cover | Elements of Information Theory[END_REF], the condition (3) implies that the total variation distance between P T and Q T must also tend to zero as T → ∞.

We define the covert communication capacity for this channel as the supremum of all rates that are achievable covertly.

Theorem 1: The covert communication capacity of the continuous-time Poisson channel described above is infinity, i.e., all positive rates are achievable covertly.

Clearly, only the achievability part of Theorem 1 needs proof. Before proceeding with the proof, we describe a random coding scheme and analyze its covertness. These will be used in the proof of Theorem 1, and again in the next section.

Scheme 1: Fix τ, η > 0 and q ∈ (0, 1). Divide the interval [0, T] into slots of τ seconds: [0, τ ), [τ, 2τ ), . . .. Randomly generate a codebook 2 by choosing each codeword independently according to the following distribution: Within the kth slot, k ∈ {1, . . . , T τ }, X(t) = X k with probability one for all t ∈ [(k -1)τ, kτ ), where the random variables X k , k = 1, . . . , T τ , are IID with X k = η, with probability q, 0, with probability 1 -q.

(5)

Proposition 1: Suppose the transmitter uses Scheme 1 to transmit a message. If (λ + qη)τ < 1, then

D(P T Q T ) ≤ q 2 η 2 2λ + q 3 η 3 3λ 2 + q 4 η 4 3λ 3 + λητ + q 2 η 2 τ + qη 2 τ 2 + qη λ (η + λ) 2 τ • T. (6)
Proof: For the kth τ -second slot, let Y k denote the total number of arrivals in Y (•) within this slot, that is

Y k = Y (kτ ) -Y ((k -1)τ ), k ∈ {1, . . . , T τ }.
Note that, since with probability one X(t) is constant within the slot (both when the transmitter is sending and when it is not sending a message), Y 1 , . . . , Y T τ form a sufficient statistic for the eavesdropper. Under both P T and Q T , Y 1 , . . . , Y T τ are IID. When no message is being communicated (i.e., under Q T ), each Y k has the Poisson distribution of mean λτ , which we denote by Q . When the transmitter is sending a message (under P T ), for each k, with probability 1 -q the random variable Y k has the Poisson distribution of mean λτ , and with probability q it has the Poisson distribution of mean (η + λ)τ ; we denote this mixture of two Poisson distributions by P . Then we have

D(P T Q T ) = T τ D(P Q ). (7)
We next bound D(P Q ). For each i ∈ Z + 0 , we have

Q (i) = e -λτ (λτ ) i i! (8a)
P (i) = (1 -q) e -λτ (λτ ) i i! + q e -(η+λ)τ (ητ + λτ ) i i! . (8b)
Hence

D(P Q ) = ∞ i=0 P (i) log P (i) Q (i) (9) = ∞ i=0 P (i) log 1 -q + qe -ητ 1 + η λ i (10) = ∞ i=0 σ i , (11)
where in the last line we defined

σ i P (i) log 1 -q + qe -ητ 1 + η λ i , i ∈ Z + 0 . ( 12
)
2 We emphasize that this random code is what the transmitter and the receiver will use, and not an intermediate step in proving the existence of a good deterministic (or "less random") code, as in, e.g., [START_REF] Cover | Elements of Information Theory[END_REF].

We separately bound σ 0 , σ 1 , and the remaining terms.

For σ 0 we have

P (0) = (1 -q)e -λτ + qe -(η+λ)τ (13) ≥ (1 -q)(1 -λτ ) + q(1 -(η + λ)τ ) (14) = 1 -(λ + qη)τ, (15)
where we used the fact that e -a ≥ 1 -a for all a ∈ R. We also have

log(1 -q + qe -ητ ) ≤ -q(1 -e -ητ ) (16)
≤ -q ητ - η 2 τ 2 2 , ( 17
)
where the first inequality follows because log(1 + a) ≤ a for all a ∈ (-1, ∞), and the second inequality because e -a ≤ 1 -a + a 2 2 for a ≥ 0. Note that the left-hand side of ( 16) is negative, whereas, when (λ + qη)τ < 1, the right-hand side of ( 15) is positive. We can hence combine ( 15) and ( 17) to obtain, whenever (λ + qη)τ < 1,

σ 0 ≤ -(1 -(λ + qη)τ ) • q ητ - η 2 τ 2 2 (18) ≤ -qητ 1 -λ + qη + η 2 τ , (19)
where the last inequality follows by dropping a negative term.

For σ 1 we have

P (1) = (1 -q)λτ e -λτ ≤1 +q(η + λ)τ e -(η+λ)τ ≤1 (20)
≤ (λ + qη)τ (21)
and 21) and ( 23) and dropping a negative term we obtain

log 1 -q + q e -ητ ≤1 1 + η λ ≤ log 1 + qη λ (22)
≤ qη λ - q 2 η 2 2λ 2 + q 3 η 3 3λ 3 . (23) Combining (
σ 1 ≤ qητ 1 + qη 2λ + q 2 η 2 3λ 2 + q 3 η 3 3λ 3 . ( 24
)
For the remaining {σ i : i ≥ 2}, we have

log 1 -q + q e -ητ ≤1 1 + η λ i ≤ log 1 + q ≤1 1 + η λ i -1 (25)
≤ log 1 + 1 + η λ i -1 (26)
= i • log 1 + η λ (27)
≤ i • η λ . ( 28
) Thus ∞ i=2 σ i ≤ η λ ∞ i=2 P (i) • i, (29)
where

∞ i=2 P (i) • i = ∞ i=1 P (i) • i -P (1) • 1 (30) = E P [Y ] -P (1) (31) = (1 -q)λτ + q(η + λ)τ -(1 -q) e -λτ ≥1-λτ λτ + q e -(η+λ)τ ≥1-(η+λ)τ (η + λ)τ (32) ≤ (1 -q)λτ + q(η + λ)τ -(1 -q)(1 -λτ )λτ -q(1 -(η + λ)τ )(η + λ)τ (33) = (1 -q)λ 2 τ 2 + q(η + λ) 2 τ 2 . ( 34
)
Hence we obtain

∞ i=2 σ i ≤ η λ (1 -q)λ 2 τ 2 + q(η + λ) 2 τ 2 . ( 35
)
Combining ( 7), ( 11), ( 19), [START_REF] Wang | A refined analysis of the Poisson channel in the high-photon-efficiency regime[END_REF], and (35), we conclude that (6) holds whenever (λ + qη)τ < 1.

Proof of Theorem 1: Let the transmitter use the random code in Scheme 1, where τ , η, and q are chosen as (deterministic) functions of T:

τ = T -1 e -T (36a) η = e T/2 (36b) q = T -3/4 e -T/2 . ( 36c
)
Note that the average input power by the above choice equals qη = T -3/4 , which tends to zero as T tends to infinity. Hence any nonzero average-power constraint on the input will be satisfied when T grows sufficiently large.

Applying the choices (36) to Proposition 1 confirms that (3) is satisfied, i.e., that the random code is covert. It remains to derive a lower bound on the communication rates that are achievable using the proposed scheme. To this end, let the decoder map the output waveform to a sequence Ŷ1 , . . . , Ŷ T τ as follows:

Ŷk = 0, if Y (kτ ) = Y ((k -1)τ ) 1, otherwise. ( 37
)
Then we have a discrete memoryless channel with

Pr( Ŷ = 1|X = 0) = 1 -e -λτ (38a) Pr( Ŷ = 1|X = η) = 1 -e -(η+λ)τ . ( 38b
)
We then use the information-spectrum method [START_REF] Verdú | A general formula for channel capacity[END_REF], [START_REF] Han | Information Spectrum Methods in Information Theory[END_REF] to lower-bound the maximum achievable rate. Let the input vector of length T τ be denoted by X and the corresponding binary output vector be denoted by Ŷ, then the following rate is achievable:

P -lim inf T→∞ 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) , (39)
where P -lim inf denotes the limit infimum in probability; see [START_REF] Verdú | A general formula for channel capacity[END_REF], [START_REF] Han | Information Spectrum Methods in Information Theory[END_REF]. To bound (39), we bound the mean and the variance of the random variable inside the P -lim inf. Henceforth we ignore the • operator, whose effect vanishes as T → ∞.

For any fixed T, (X , Ŷ) is IID across different time slots, hence

E 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) = 1 τ I(X ; Ŷ ). (40)
By ( 5) and (38), I(X ; Ŷ ) can be written as

I(X ; Ŷ ) = H b (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) -(1 -q) H b (1 -e -λτ ) -q H b (1 -e -(λ+η)τ ), (41)
where H b (•) denotes the binary entropy function:

H b (p) = -p log p -(1 -p) log(1 -p), p ∈ [0, 1]. ( 42
)
We bound the three terms on the right-hand side of (41) separately.

For the first term on the right-hand side of (41), we drop a nonnegative term to get

H b (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) ≥ (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) • log 1 (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) . (43)
Then we bound

(1 -q) (1 -e -λτ ) ≥λτ -λ 2 τ 2 2 +q (1 -e -(λ+η)τ ) ≥(λ+η)τ - (λ+η) 2 τ 2 2 ≥ (1 -q) λτ - λ 2 τ 2 2 + q (λ + η)τ - (λ + η) 2 τ 2 2 (44) ≥ (λ + qη) - q(λ + η) 2 τ 2 - λ 2 τ 2 τ, (45)
where the last inequality follows by dropping a term qλ 2 τ 2 2 . We also have

(1 -q) (1 -e -λτ ) ≤λτ +q (1 -e -(λ+η)τ ) ≤(λ+η)τ ≤ (1 -q)λτ + q(λ + η)τ = (λ + qη)τ. (46)
Combining (43), (45), and (46) we have, for large enough T,

H b (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) ≥ (λ + qη) - q(λ + η) 2 τ 2 - λ 2 τ 2 τ log 1 (λ + qη)τ . (47)
Now consider the other two terms on the right-hand side of (41). By our choices (36), when T is sufficiently large, λτ < 1 2 and (λ + η)τ < 1 2 . Since H b (•) is monotonically increasing on (0, 1 2 ), we can bound

H b (1 -e -λτ ) ≤ H b (λτ ) (48) = λτ log 1 λτ + (1 -λτ ) log 1 1 -λτ ≤ λτ 1-λτ (49) ≤ λτ log 1 λτ + λτ. (50)
Similarly,

H b (1 -e -(η+λ)τ ) ≤ (η + λ)τ log 1 (η + λ)τ + (η + λ)τ. (51)
Combining ( 40), ( 41), ( 47), (50), and (51) yields, for large enough T,

E 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) ≥ (λ + qη) - q(λ + η) 2 τ 2 - λ 2 τ 2 log 1 (λ + qη)τ -(1 -q)λ log 1 λτ -(1 -q)λ -q(η + λ) log 1 (η + λ)τ -q(η + λ) (52) = (1 -q)λ log λ λ + qη + q(λ + η) log λ + η λ + qη -(λ + qη) - q(λ + η) 2 + λ 2 2 τ log 1 (λ + qη)τ . (53)
For our choices (36), for large enough T, the right-hand side of (53) is dominated by its second term, which can be bounded as

q(λ + η) log λ + η λ + qη ≥ qη log η λ + qη (54) = T -3/4 log e T/2 λ + T -3/4 (55) = T 1/4 2 -T -3/4 log(λ + T -3/4 ). ( 56
)
One can verify that the sum of the remaining terms on the right-hand side of (53) tends to -λ as T grows to infinity; we omit the details. We thus have

lim inf T→∞ E 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) T 1/4 ≥ 1 2 . ( 57
)
We next bound the variance of the random variable inside the P -lim inf in (39). Since (X , Ŷ) is IID across different slots, we have

Var 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) = 1 T 2 • T τ Var log P Ŷ |X ( Ŷ |X ) P Ŷ ( Ŷ ) (58) ≤ 1 Tτ E   log P Ŷ |X ( Ŷ |X ) P Ŷ ( Ŷ ) 2   (59) = 1 Tτ x ∈{0,η} ŷ∈{0,1} P X Ŷ (x , ŷ) log P Ŷ |X (ŷ|x ) P Ŷ (ŷ) 2 . (60)
We simplify each summand on the right-hand side of (60) and provide an upper bound on it. For the summand with x = 0 and ŷ = 0 we have

P X Ŷ (0, 0) log P Ŷ |X (0|0) P Ŷ (0) 2 ≤ 1 • log e -λτ (1 -q)e -λτ + qe -(λ+η)τ 2 (61) = log(1 -q(1 -e -ητ )) 2 . ( 62
)
For the summand with x = 0 and ŷ = 1 we have

P X Ŷ (0, 1) log P Ŷ |X (1|0) P Ŷ (1) 2 = (1 -q)(1 -e -λτ ) • log 1 -e -λτ (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) 2 (63) ≤ λτ log λτ + qητ 1 -e -λτ 2 . ( 64
)
For the summand with x = η and ŷ = 0 we have

P X Ŷ (η, 0) log P Ŷ |X (0|η) P Ŷ (0) 2 = qe -(λ+η)τ log e -(λ+η)τ (1 -q)e -λτ + qe -(λ+η)τ 2 (65) ≤ q(ητ ) 2 . ( 66
)
For the summand with x = η and ŷ = 1 we have

P X Ŷ (η, 1) log P Ŷ |X (1|η) P Ŷ (1) 2 = q(1 -e -(λ+η)τ ) • log 1 -e -(λ+η)τ (1 -q)(1 -e -λτ ) + q(1 -e -(λ+η)τ ) 2 (67) ≤ q(λ + η)τ log (λ + η)τ 1 -e -λτ 2 . ( 68
)
Plugging our choices (36) into (62), ( 64), (66), and (68), one can verify that, as T grows large, the right-hand side of (68) satisfies

lim T→∞ q(λ + η)τ log (λ + η)τ 1 -e -λτ 2 T 5/4 τ = 1 4 , (69)
and dominates all the other summands. We then have

lim sup T→∞ Var 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) T 1/4 ≤ 1 4 . ( 70
)
Combining ( 57) and ( 70) and applying Chebyshev's inequality we have, for any finite a,

lim T→∞ Pr 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) ≤ a ≤ lim T→∞ Var 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) E 1 T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) -a 2 (71) ≤ lim T→∞ T 1 4 4 T 1 4 2 -a 2 = 0. ( 72
)
Hence ( 39) is infinity and, consequently, the proposed random coding scheme can achieve an arbitrarily large per-second rate.

III. THE PEAK-LIMITED CASE

Now consider the same continuous-time Poisson channel with dark current λ as in the previous section, but now we impose a peak-power constraint on the input: At every time t, the channel input must satisfy, with probability one,

X(t) ≤ A, (73)
where A > 0 is a given constant. We modify the covertness constraint. Instead of (3), we now require, for all T > 0,

D(P T Q T ) ≤ δ (74)
for some given constant δ > 0. This is because, as we shall see, we are now in the square-root-scaling scenario, and the exact scaling law depends on δ; adopting the constraint (3) will not allow us to demonstrate this dependence. As in the previous section, we allow the transmitter and the receiver to use a random codebook by exploiting a shared secret key. Denote by M(T, δ, ) the largest possible cardinality of the message set that can be communicated over the channel in T seconds such that (74) is satisfied, and that the average probability of a decoding error is no larger than .

Theorem 2: Over the above peak-limited Poisson channel,

lim ↓0 lim T→∞ log M(T, δ, ) √ T = √ 2λδ A + λ A log A + λ λ -1 . (75)
Proof: We first prove the converse part. The capacity of a peak-and average-power-limited Poisson channel is known. To use this capacity result to derive an upper bound on the lefthand side of (75), we derive an upper bound on the average input power from the covertness constraint.

Given a random code over [0, T] for a message set of cardinality M, let ρ denote its average input power:

ρ 1 T E T 0 X(t) dt . (76)
By Fano's Inequality and the Data-Processing Inequality [START_REF] Cover | Elements of Information Theory[END_REF] we have

(1 -) log M ≤ I(X T 0 ; Y T 0 ), (77)
where tends to zero when tends to zero. In the above, X T 0 denotes the waveform X(t), t ∈ [0, T], and similarly for Y T 0 . The maximum possible value for I(X T 0 ; Y T 0 ) under peakpower constraint A and average-power constraint ρ is a classic result [START_REF] Davis | Capacity and cutoff rate for Poisson-type channels[END_REF], [START_REF] Wyner | Capacity and error exponent for the direct detection photon channel -parts I and II[END_REF]:

I(X T 0 ; Y T 0 ) ≤ T • max p∈[0, ρ A ] p(A + λ) log(A + λ) + (1 -p)λ log λ -(pA + λ) log(pA + λ) , (78)
which can be weakened to

I(X T 0 ; Y T 0 ) ≤ Tρ • A + λ A log A + λ λ -1 . (79)
We next derive a bound on ρ from the covertness criterion (74). The relative entropy D(P T Q T ) can be computed as follows. For the distribution P T , one can define the conditional intensity function at time t ∈ [0, T] as

α t (y t 0 ) lim ∆↓0 Pr( Y t+∆ -Y t ≥ 1|Y t 0 = y t 0 ) ∆ . (80)
At any y T 0 , the Radon-Nikodym derivative between P T and Q T is given by [20, Eq. (19.125)]

dP T dQ T y T 0 = exp T 0 log α t (y t 0 ) λ dy t 0 - T 0 (α t (y t 0 ) -λ) dt , (81)
so

D P T Q T = E P T T 0 α t (Y t 0 ) log α t (Y t 0 ) λ -α t (Y t 0 ) + λ dt . (82)
Using Jensen's Inequality [START_REF] Cover | Elements of Information Theory[END_REF] and noting that

1 T E T 0 α t (Y t 0 ) dt = 1 T E T 0 X(t) + λ dt = ρ + λ, (83)
we obtain from (74) and (82):

(λ + ρ) log λ + ρ λ -ρ ≤ δ T . (84)
This requires that, as T → ∞, ρ must approach zero; more specifically, since the left-hand side of (84) behaves like ρ 2 2λ

for small ρ, we need

lim sup T→∞ Tρ 2 2λ ≤ δ. (85)
Combining ( 77), (79), and (85) proves the converse part of the theorem.

We next prove the achievability part. To this end, we use Scheme 1 with the parameters

τ = T -2 (86a) η = A (86b) q = 1 -γ A 2λδ T , (86c)
where γ > 0 will be chosen to approach zero later on.

To show that this random code is covert, we apply Proposition 1 with the parameters (86) to obtain

lim sup T→∞ D(P T Q T ) ≤ (1 -γ) 2 δ. (87)
Therefore, for any γ > 0, (74) is satisfied for large enough T.

To characterize the rates achievable using the above scheme, we again map the output within each slot to a binary random variable as in (37), yielding the transition probabilities

Pr( Ŷ = 1|X = 0) = 1 -e -λτ (88a) Pr( Ŷ = 1|X = A) = 1 -e -(A+λ)τ . ( 88b
)
Again using the information-spectrum method [START_REF] Verdú | A general formula for channel capacity[END_REF], [START_REF] Han | Information Spectrum Methods in Information Theory[END_REF] we can lower-bound the left-hand side of (75) by

P -lim inf T→∞ 1 √ T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) . (89)
For the random variable inside the P -lim inf we have

E 1 √ T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) = √ T τ I(X ; Ŷ ). (90)
We omit some details to claim

lim T→∞ √ T τ I(X ; Ŷ ) = (1 -γ) √ 2λδ A + λ A log A + λ λ - 1 .
(91) By bounding the variance of the random variable inside the P -lim inf in (89), where we again omit the details, we can then show

P -lim inf T→∞ 1 √ T log P Ŷ|X Ŷ X P Ŷ ( Ŷ) = (1 -γ) √ 2λδ A + λ A log A + λ λ -1 . ( 92
)
The proof is completed by letting γ approach zero.

Remark 1: The term A+λ A log A+λ λ -1 on the right-hand side of (75) approaches zero as A ↓ 0, and behaves like log A when A is large. Further note that the converse proof of Theorem 2 continues to hold when A is a function of T. Therefore, if we allow A to grow large with T (while keeping λ and δ constant), then, for large T, log M(T, δ, )

√ 2λδ √ T log A. ( 93
)
This implies that, in order to achieve a positive per-second rate, the peak input power must at least grow exponentially with √ T. Recall that, in our achievability scheme for the no-constraint case, we chose the peak input power to grow exponentially with T; see (36).

IV. THE BAND-LIMITED CASE

In intensity-modulated optical communication, the input usually consists of rectangular pulses, and the "bandwidth" refers to the reciprocal of the smallest possible duration of an input rectangular pulse. Thus, to model a band-limited scenario, we require that the transmitter must send a sequence of rectangular pulses each of τ seconds, where τ is now a given constant and cannot be chosen to be arbitrarily small as in previous sections. We hence have a discrete-time Poisson channel with input alphabet R + 0 , output alphabet Z + 0 , and transition law

W (y|x) = e -(µ+x) (µ + x) y y! , x ∈ R + 0 , y ∈ Z + 0 . ( 94
)
Here µ > 0 is the discrete-time dark current, which equals λτ , with λ being the continuous-time dark current. We do not impose a peak constraint on the input X. The standard (noncovert) communication capacity of the discrete-time Poisson channel under a peak-or average-power constraint, or both, does not have a known closed-form expression; some bounds and asymptotic results can be found in [START_REF] Shamai | Capacity of a pulse amplitude modulated direct detection photon channel[END_REF]- [START_REF] Wang | A refined analysis of the Poisson channel in the high-photon-efficiency regime[END_REF]. Suppose the channel (94) is used n times (so the total communication time is nτ seconds). Let Q n denote the output distribution when there is no input, i.e., Q n describes n random variables that are IID according to the Poisson distribution of mean µ. Let P n denote the output distribution when the transmitter is active: P n is averaged over the message and the randomly generated codebook. The covertness criterion is

D(P n Q n ) ≤ δ, (95)
where δ > 0 is a given constant. Let M(n, δ, ) denote the largest possible cardinality of the message set for a (random) codebook over n channel uses such that (95) is satisfied, and that the average probability of a decoding error is no larger than . The following asymptotic upper bound shows that the number of nats that can be communicated covertly grows at most proportionally to √ n log log n. Thus, in particular, the covert communication capacity of this channel is zero nats per channel use or, equivalently, zero nats per second in continuous time.

Proof: As in the proof of the converse for Theorem 2, we use the covertness criterion to derive an upper bound on the average input power. We then apply this average-power bound to a previously obtained capacity upper bound for the discretetime Poisson channel with an average-power constraint.

Consider any random code over n channel uses and for a message set of cardinality M. Following the same steps as [4, Eq. ( 13)], we have

D(P n Q n ) ≥ n D( P Q), (97)
where P denotes the average per-letter output distribution when the transmitter is sending a message, and Q that when the transmitter is sending only zeros, i.e., Q is the Poisson distribution of mean µ. Let

ρ E P [Y ] -µ. (98)
D( P Q) ≥ ∞ y=0 e -(µ+ρ) (µ + ρ) y y! log e -(µ+ρ) (µ+ρ) y y! e -µ µ y y! (99) = ∞ y=0 e -(µ+ρ) (µ + ρ) y y! y log µ + ρ µ -ρ (100) = (µ + ρ) log µ + ρ µ -ρ. (101)
Recalling (97), the right-hand side of (101) must be less than or equal to δ n . This implies that ρ must tend to zero as n → ∞. Further note that the right-hand side of (101) behaves like ρ 2 2µ for small ρ, so ρ must satisfy

lim sup n→∞ nρ 2 2µ ≤ δ. (102)
By a standard argument using Fano's Inequality, the Data-Processing Inequality, and the chain rule, we have, for some that tends to zero when ↓ 0, (

-) log M ≤ I(X n ; Y n ) ≤ n I( X; Ȳ ), 1
where, by slightly abusing notation, X denotes a random variable that has the average per-letter input distribution computed from the given random codebook, and Ȳ denotes the corresponding output. Note that Ȳ has distribution P and, by (94) and ( 98), E X = ρ. In the limit where ρ tends to zero, we have the following upper bound [START_REF] Lapidoth | The discretetime Poisson channel at low input powers[END_REF]Proposition 2]:

lim sup ρ↓0 sup E[ X]≤ρ I( X; Ȳ ) ρ log log 1 ρ ≤ 2. (104)
Combining ( 102), (103), and (104) and letting n → ∞ and ↓ 0 yield the desired bound.

Remark 2: We have not fully determined the scaling behavior of log M(n, δ, ), but it must lie between √ n and √ n log log n. To see that it should grow at least proportionally to √ n, we observe the following: If one imposes a peak constraint on X, then using the methods in [START_REF] Wang | Fundamental limits of communication with low probability of detection[END_REF] one can show that log M(n, δ, ) grows proportionally to √ n, i.e., the squareroot scaling law holds in the band-and peak-limited case.

We have not been able to find a scheme that allows log M to grow faster than √ n, let alone like √ n log log n. Although the bound (104) is order-tight, to achieve it, [START_REF] Lapidoth | The discretetime Poisson channel at low input powers[END_REF] uses flashsignaling, where the transmitter sends large signals sparsely. These large signals are easy to detect, hence not suitable for covert communication. (Note that (102) is a necessary but not sufficient condition for covertness.)

V. CONCLUDING REMARKS

We have shown that the continuous-time Poisson channel with neither peak nor bandwidth constraint allows unbounded data rates for covert communication. The proposed scheme is however not very practical. Notably, the peak input power that we use grows exponentially with total communication time T. As we pointed out in Remark 1, in order to achieve a positive (not necessarily infinite) rate, the peak input power must at least grow exponentially with

√

T. The Poisson channel, being a model for optical communication, is related to the bosonic channel, a quantum model for optical communication. Covert communication over the bosonic channel was studied in [START_REF] Bash | Quantum-secure covert communication on bosonic channels[END_REF]. Results on these two channels are however not directly comparable. First, when studying the bosonic channel, one usually considers a finite number of optical modes, so the channel is effectively in discrete time and hence not comparable to the continuoustime Poisson channel models. Second, in discrete time, the background noise on the bosonic channel is usually assumed to be in a thermal state, in which the number of photons follows a geometric distribution, whereas for the discrete-time Poisson channel, the background noise is modeled as having a Poisson distribution.

Some recent works [START_REF] Wang | On Gaussian covert communication in continuous time[END_REF], [START_REF] Zhang | Undetectable radios: Covert communication under spectral mask constraints[END_REF] have studied the Gaussian channel in continuous time. In [START_REF] Wang | On Gaussian covert communication in continuous time[END_REF] we have shown that, like the Poisson channel, the continuous-time Gaussian channel without bandwidth constraint also permits positive-rate covert communication. The mathematical models of the Gaussian channel and the Poisson channel are however fundamentally different, as are the optimal covert communication schemes for them. In the Poisson case, our chosen input signal consists of sparse narrow pulses; in the Gaussian case, we have shown it to be optimal to spread the input power evenly over both time and frequency. It is also interesting to note that an averagepower constraint on the input would be inactive in the Poisson case, but active in the Gaussian case.

Theorem 3 :

 3 For the above discrete-time Poisson channel, lim ↓0 lim sup n→∞ log M(n, δ, ) √ n log log n ≤ 8µδ.

(

  Note that ρ is nonnegative.) For a fixed E P [Y ], D( P Q) is minimized by P also being a Poisson distribution; see [17, Problem 12.2]. Hence we have


Yuval Kochman
email: yuvalko@cs.huji.ac.il

Ligong Wang
email: ligong.wang@ensea.fr

On the Communication Exponent of Distributed Testing for Gaussian Correlations

This work addresses distributed binary hypothesis testing, where observations at two terminals are jointly Gaussian, each one standard, with two possible correlation coefficients. We assume that one of the terminals is colocated with the decision center, and focus on a single (Stein) error exponent. Rather than the traditional exponent that is defined with respect to the source blocklength, we assume the source data to be unlimited, and consider the error exponent as a function of the communication message length. We examine two different approaches, one by quantization and the other by sending the index of the maximum, and find them to yield the same exponent. We further find that binning improves upon both approaches in the same way. Finally we compare the obtained exponents to two upper bounds and determine the optimal exponent in some very special cases.

I. INTRODUCTION

The goal of distributed hypothesis testing (DHT) is to distinguish between different possible joint distributions of data observed at several terminals, when the communication between them is constrained. We shall consider the popular side-information setting, where two terminals observe sequences X k and Y k , respectively, which are independent and identically distributed (i.i.d.) over the k time instances. The first ("encoder") creates an n-nat message W = f (X k ), while the second ("decoder") makes a decision using some discriminant rule g(W, Y k ) . Further, we shall consider the Stein problem, where there are two hypotheses H 0 and H 1 regarding the joint distribution, where the error probability under H 0 is only required to approach zero (possibly slowly), and one seeks the fastest decay of error probability under H 1 .

Let p( , n, k) denote the smallest attainable error probability under H 1 when the source blocklength is k, the message contains no more than n nats, and the error probability under H 0 is required to be no larger than . Traditionally, the error probability asymptotics are considered under fixed rates. That is, for some fixed R > 0, one is interested in

E(R) lim ↓0 lim k→∞ - 1 k log p( , kR , k). (1)
Although this exponent is not known in general, many works derived bounds on it; we shall refer to some of them [START_REF] Ahlswede | Hypothesis testing with communication constraints[END_REF]- [START_REF] Hadar | Error exponents in distributed hypothesis testing of correlations[END_REF] in the sequel. The focus of this work is on a different exponent, inspired by the analysis of distributed parameter estimation by Hadar and Shayevitz [START_REF] Hadar | Distributed estimation of gaussian correlations[END_REF]. We assume unlimited source data, and study the exponential decay of the error probability as a function of the message length, so the quantity of interest is the communication exponent:

E c lim ↓0 lim n→∞ - 1 n lim k→∞ log p( , n, k) . (2)
Since one can apply a fixed-rate scheme on unbounded source data, we have

E c ≥ lim R↓0 E(R) R . (3)
It is unclear whether equality should hold in the above or not.

In order for the communication exponent to be finite, the Xand Y -marginals of the joint distribution must not depend on the hypothesis. We consider in this work such a case, where each (X, Y ) pair is zero-mean jointly Gaussian, and where the covariance matrix under H i is given by

Σ i = 1 ρ i ρ i 1 , (4)
where ρ 0 ∈ [-1, 1] and, without loss of generality,

ρ 1 ∈ [0, 1].
Deriving exponents for the Gaussian case requires more than substitution in known single-letter expressions for discretealphabet sources. 1 In Section II we present necessary preliminaries and a technical lemma, which is used extensively in this work.

In Section III we derive achievable exponents using two very different approaches. In the first we derive fixed-rate exponents for this source by extending well-known schemes for discrete-alphabet sources: the simple Ahlswede-Csiszár (AC) quantization scheme [START_REF] Ahlswede | Hypothesis testing with communication constraints[END_REF], and Han's improved quantization scheme [START_REF] Han | Hypothesis testing with multiterminal data compression[END_REF]; in extending Han's scheme, we apply the abovementioned technical lemma. Applying (3) to these bounds gives the following achievable communication exponents, respectively:

E AC = (ρ 1 -ρ 0 ) 2 (5)
E Han = (ρ 1 -ρ 0 ) 2 1 -ρ 2 1 . (6)
In the second approach we apply to the DHT problem the technique used in [START_REF] Hadar | Distributed estimation of gaussian correlations[END_REF] for correlation estimation, where an exponentially long source block is used, and the index of the maximum X within the block is sent. We find that the resulting exponent equals E Han ; we reason that the sharp concentration of the maximum mimics Han's use of improved ("fixed-type") quantization.

In Section IV, we add a binning element to the above approaches. We analyze the Gaussian version of the quantizationand-binning scheme of Shimokawa-Han-Amari (SHA) [START_REF] Shimokawa | Error bound of hypothesis testing with data compression[END_REF]. We also provide a (nontrivial) variant of the index-of-maximum scheme where the index is binned. Again both approaches yield the same communication exponent: for ρ 0 ≥ 0,

E SHA = (ρ 1 -ρ 0 ) 2 (1 -ρ 1 max(ρ 0 , ρ 1 ))(1 -ρ 0 min(ρ 0 , ρ 1 )) . (7)
Finally, in Section V we compare E AC , E Han , and E SHA to two upper bounds on E c . The comparison reveals that beyond the case ρ 1 = 0, we have the exact value of E c also for ρ 0 ∈ {0, 1}.

Due to the space limit, we shall focus on intuitive explanations to our approaches, and omit some technical details.

II. PRELIMINARIES: TYPICALITY OF GAUSSIAN VECTORS

Typicality. Following [START_REF] Arikan | Guessing subject to distortion[END_REF], we define a spherical -type class of dimension k and power P as

T k,P, = x k ∈ R k : x k 2 kP -1 ≤ , (8)
where • denotes the Euclidean norm. We say that a vector

x k ∈ R k is typical with respect to variance P if 2 x k ∈ T k,P, .
We say that a vector pair (x k , y k ) is jointly typical with respect to a covariance matrix Σ if any linear combination of the vectors is typical, i.e., if, for any a = (a 1 , a 2 ) T ∈ R2 , a 1 x k + a 2 y k is typical with respect to variance a T Σa. 3We shall need the following large-deviation results on scalar amplitude asymptotics and dimension asymptotics.

Amplitude asymptotics. For parameters k, P , as above, define the interval

S k,P, [ √ kP (1 -), √ kP (1 + )]. (9)
Let X be a standard Gaussian variable. Let P be fixed, then

lim ↓0 lim k→∞ - 1 k log Pr {X ∈ S k,P, } = P 2 . ( 10
)
This continues to hold when we replace X by -X. Dimension asymptotics. Let the random vector X k be i.i.d. standard Gaussian and fix P > 0, then

lim ↓0 lim k→∞ - 1 k log Pr{X k ∈ T k,P, } = D G (P ), (11)
where

D G (P ) 1 2 [P -log P -1] (12)
is the Kullback-Leibler divergence between zero-mean scalar Gaussian distributions of variances P and 1, respectively.

The results [START_REF] David | Order Statistics[END_REF] and [START_REF] Hadar | Communication complexity of estimating correlations[END_REF] are standard; we omit their derivations. The same exponents hold for the probability for X k 2 to be above or below a threshold, e.g.,

lim k→∞ - 1 k log Pr{ X k 2 ≥ kP } = D G (P ) if P > 1. (13)
We further need the following lemma concerning a mixture of an i.i.d. Gaussian vector and a deterministic vector. We call

X k a γ-mixture if X k = 1 -γ Z k + √ γ v k , (14)
where

Z k ∈ R k is i.i.d. standard Gaussian, and v k ∈ T k,1, .
Lemma 1: Fix γ ∈ (0, 1), and let {X k , k ∈ Z + } be γmixtures as in ( 14). Then

lim ↓0 lim k→∞ - 1 k log Pr{X k ∈ T k,P, } = D(γ, P ), (15)
where

D(γ, P ) γ + P -A 2γ - 1 2 log A -1 + γ 2γ , (16)
where

A = (1 -γ) 2 + 4P γ. Furthermore, lim k→∞ - 1 k log Pr{ X k 2 ≥ kP } = D(γ, P ) if P > 1, (17) lim k→∞ - 1 k log Pr{ X k 2 ≤ kP } = D(γ, P ) if P < 1. ( 18
)
Proof Method: The proof follows the technique used in [START_REF] Swannack | Reflecting on the AWGN error exponent[END_REF] for deriving the Gaussian sphere-packing exponent. We decompose X k into two parts: a component along the direction of v k , and the remaining k -1 dimensions. Roughly speaking, we can then apply [START_REF] David | Order Statistics[END_REF] to the former, and (11) to the latter. Finally, we find the (exponentially) most likely combination of the two components such that X k 2 is around kP .

One may verify that D(γ, P ) ≥ D G (P ), 4 with equality for P = 1 as well as in the limit γ → 0. We shall need in the sequel the following fact: for P close to 1,

D(γ, P ) = (P -1) 2 4(1 -γ 2 ) + O((P -1) 3 ). (19)

III. QUANTIZATION VERSUS INDEX OF MAXIMUM

In this section and in the next one, we shall often use the following relationship between X and Y : under

H i , i ∈ {0, 1}, Y = ρ i X + 1 -ρ 2 i Z, ( 20
)
where Z is standard Gaussian and independent of X.

A. Ahlswede-Csiszár-Style Exponent

In a classic work by Ahlswede and Csiszár [START_REF] Ahlswede | Hypothesis testing with communication constraints[END_REF] a simple scheme is proposed for DHT on discrete memoryless sources. The encoder's observation X k is quantized at rate R to a sequence U k . The decoder will declare H 0 if and only if (U k , Y k ) are jointly typical according to H 0 . It is assumed that the quantizer emulates in an i.i.d. manner the quantization test-channel between U and X.

A corresponding coding scheme in the Gaussian setting works as follows. The encoder generates quantization codewords {u k (m), m = 1, . . . , e nR } i.i.d. according to the zero-mean Gaussian distribution with variance

σ 2 R 1 -exp{-2R}, ( 21
)
where R is the communication rate. Given x k , it finds u k (m) which minimizes x k -u k (m) and sends the index m. The decoder checks if u k (m) and y k are jointly typical under H 0 . The obtained error exponent is (see also [5, Eq. ( 5)]):

E AC (R) = 1 2 log 1 -ρ 2 1 σ 2 R 1 -ρ 2 0 σ 2 R - ρ 1 (ρ 0 -ρ 1 )σ 2 R 1 -ρ 2 1 σ 2 R . ( 22
)
We then obtain (5) by noting that, when R is small, σ 2 R ≈ 2R.

B. Han-Style Exponent

In [START_REF] Han | Hypothesis testing with multiterminal data compression[END_REF], Han improves upon the Ahlswede-Csiszár scheme by noting that an i.i.d. quantization model is suboptimal, in the sense that it allows an atypical behavior of (U k , X k ) to contribute to an error event in which, under H 1 , (U k , Y k ) is typical with respect to H 0 . Thus, Han proposed to verify at the encoder that U k , X k are jointly typical. In the Gaussian case, we use the same idea to propose the following scheme. Consider the following joint distribution: U is zero-mean Gaussian with variance σ 2 R as in (21); Q (the quantization noise) is standard Gaussian independent of U ; and

X = U + 1 -σ 2 R Q. (23)
• Encoder: Generate {u k (m)} i.i.d. according to the zeromean Gaussian distribution of variance (21); discard those that are atypical. Given x k , look for an index m such that x k and u k (m) are jointly typical (in the sense of Section II) with respect to the covariance matrix of (U, X) as defined above. If successful, send m. If no such m can be found, send a special message to inform the decoder to declare H 1 . • Decoder: If the special message is received, declare H 1 .

Otherwise, check if u k (m) and y k are jointly typical with respect to the joint distribution on (U, Y ) computed from (U, X) as above, with Y given by (20) for i = 0, and with Z being independent of (U, X). If they are jointly typical, declare H 0 ; otherwise declare H 1 . One can verify that the error probability under H 0 indeed vanishes. Under H 1 , the only error event is that the pair

(U k (m), X k ) is "ρ 1 -typical," but (U k (m), Y k ) is "ρ 0 -typical."
For this analysis, we consider a suboptimal rule that declares

H 0 whenever S k Y k -η U k (m)
is typical, where η > 0 will be specified later. By (20), under H 1 we have:

S k = ρ 1 X k -η U k (m) + 1 -ρ 2 1 Z k . ( 24
)
Recall that the encoder guarantees X k and U k (m) to be jointly typical. Also note that, by (23),

ρ 1 X -η U = (ρ 1 -η) U + ρ 1 1 -σ 2 R Q, (25)
where U and Q are independent. We then obtain that ρ i X kη U k (m) 2 /k must be close to σ 2 η,R,1 , where we define

σ 2 η,R,i (ρ i -η) 2 σ 2 R + ρ 2 i (1 -σ 2 R ), i ∈ {0, 1}. (26)
Under H i , S k has a typical power of

P η,i (R) = 1 -ρ 2 i + σ 2 η,R,i = 1 + η(η -2ρ i )σ 2 R . (27)
Thus, under

H 1 , S k Pη,1(R) is a σ 2 η,R,1
Pη,1(R) -mixture vector. We can then apply Lemma 1 to obtain that the probability of S k being typical has exponent

E η (R) = D σ 2 η,R,1 P η,1 (R) , P η,0 (R) P η,1 (R) . ( 28
)
The best error exponent achievable with this scheme is then sup η≥0 E η (R). An explicit solution of the maximization is cumbersome. For a lower bound, we look at the regime where ησ R 1 while σ 2 R 1. In this regime,

σ 2 η,R P η,1 (R) ≈ 1 - 1 -ρ 2 1 η 2 σ 2 R (29a) P η,0 (R) P η,1 (R) ≈ 1 + 2 η (ρ 1 -ρ 0 ). (29b)
Using (19) we then obtain [START_REF] Hadar | Distributed estimation of gaussian correlations[END_REF]. Remark 1: Recall the decoder above examines typicality of

S k = Y k -η U k (m)
. This is equivalent to examining whether |ρ -ρ 0 | ≤ , where

ρ 1 + η 2 σ 2 R -s k (m) 2 /k 2ησ 2 R . (30)
This notation will allow easier comparison with the schemes that follow.

C. Exponent via Index of Maximum

Let X k consist of i.i.d. standard Gaussian random variables, where k = exp n, and let J be the index of the maximum component of X k . The following is a well-known result in order statistics [10, Ex. 10.5.3]:

E[X J ] = √ 2n + o(1) (31a) Var[X J ] = o(1). (31b)
Using (20), we have

Y J = ρ i ( √ 2n + X) + 1 -ρ 2 i Z J , (32)
where X X J -√ 2n, and Z J is standard Gaussian independent of X. In [START_REF] Hadar | Distributed estimation of gaussian correlations[END_REF], Hadar and Shayevitz use this observation to study mean-squared error estimation of the correlation. It is almost immediate to extend the idea to the DHT problem, as we describe below.

The encoder finds the index J of the maximum in X k and computes X. If X is larger than a chosen positive constant , it sends a special message informing the decoder to declare H 1 ; otherwise it conveys the index J. The decoder declares H 0 if and only if it receives an index (i.e., not the special message) and |ρ -ρ 0 | ≤ , where

ρ Y J √ 2n . ( 33
)
One can verify that the error probability under H 0 tends to zero as n grows large. Under H 1 ,

Y J - √ 2n ρ 1 1 -ρ 2 1
is "approximately" standard Gaussian. We can hence use [START_REF] David | Order Statistics[END_REF] with

P = 2(ρ 1 -ρ 0 ) 2 1 -ρ 2 1 ( 34
)
to recover the Han-style exponent [START_REF] Hadar | Distributed estimation of gaussian correlations[END_REF]. Notice that ρ "plays the role" of ρ (30) of the quantization scheme.

One may ask why the index-of-maximum approach obtains E Han rather than, say, the more straightforward E AC . Intuitively, this is because the strong concentration of the maximal value (31) plays a similar role to the jointly typical (U k , X k ) sequences in the Han-type scheme.

IV. IMPROVEMENT BY BINNING

A. Shimokawa-Han-Amari-Style Exponent

In [START_REF] Shimokawa | Error bound of hypothesis testing with data compression[END_REF], Shimokawa et al. add a binning element to Han's scheme. We next analyze a Gaussian counterpart to this scheme. We claim without analysis that, whenever ρ 0 < 0, binning is not useful, so in the rest we assume ρ 0 ≥ 0.

• Encoder: Fix some β > 1. Use a quantizer as in Han's scheme, but with rate βR instead of R. Accordingly, the sequences {u k (m)} are now generated with variance

σ 2 βR = 1 -exp{-2βR}. (35)
Randomly distribute the indices {1, . . . , e βR } into exp{(β -1)kR} bins. If the encoder finds a unique m such that u k (m) and x k are jointly typical, it sends the bin index (using rate R); otherwise it sends a special message informing the decoder to declare H 1 . • Decoder: If the special message is received, declare H 1 .

Otherwise, fix η > 0, and, for each m in the bin, evaluate

ρ(m ) 1 + η 2 σ 2 βR -s k (m ) 2 /k 2ησ 2 βR , (36)
where s k (m ) y k -u k (m ). Declare H 0 if, and only if, both the following hold. 1) There exists a single m in the bin for which |ρ( m)ρ 0 | < . This means that s k ( m) is typical with respect to power

P η,0 (βR) = 1 + η(η -2ρ 0 )σ 2 βR . (37)
2) For all m = m in the bin, ρ(m ) < ρ 0 . Under H 0 , with high probability the encoder will be able to find a proper m, and also with high probability ρ(m) ≈ ρ 0 . It remains to analyze the probability that some m = m in the bin is such that ρ(m ) ≥ ρ 0 , i.e., that s k (m ) 2 ≥ kP η,0 (βR). Note that, for m = m, U k (m ) is generated independently of Y k . Hence, by Lemma 1, the probability that a specific m causes such an error has exponent

Ēη (βR) = D η 2 σ 2 βR 1 + η 2 σ 2 βR , P η,0 (βR) 1 + η 2 σ 2 βR . (38)
Using the union bound, we can bound the exponent of the total probability of error of this kind by

Ēη (βR) -(β -1)R. (39)
In order to guarantee that the error probability under H 0 be small, we need (39) to be positive, i.e., we need β ≤ β max where β max is the (unique) root of (39). We now evaluate the error exponent under H 1 . An error under H 1 can occur only if at least one of the following two conditions holds:

1) The "correct" index m is such that ρ(m) ≈ ρ 0 . As in Section III-B, the exponent is E η (βR), which is given by ( 28) with all R replaced by βR. 2) In the bin there exists m = m such that ρ(m ) ≈ ρ 0 and ρ(m) < ρ 0 . The probability exponent of the former is the same as under H 0 and is given by (39). The latter has probability close to one if ρ 0 > ρ 1 , and has probability exponent E η (βR) if ρ 0 < ρ 1 . We conclude that the following exponent is achievable:

E SHA (R) = sup η≥0 max 0≤β≤βmax min{E η (βR), Ēη (βR) -(β -1) + E η (βR)1 {ρ0<ρ1} }. (40)
When ρ 0 < ρ 1 , the minimum is always the first term, thus

E SHA (R) = E Han (β max R), ρ 0 < ρ 1 . (41)
When ρ 0 > ρ 1 , analytical expression of the optimal β is difficult to find. Finally we consider the low-rate limit. It turns out that, in this regime, when η grows large, Ēη (βR) as in (38) approaches its supremum, which is approximately ρ 2 0 βR. Accordingly,

β max ≈ 1 1 -ρ 2 0 . When ρ 0 < ρ 1 we obtain E SHA (R) ≈ (ρ 1 -ρ 0 ) 2 1 -ρ 2 1 β max R ≈ (ρ 1 -ρ 0 ) 2 (1 -ρ 2 0 )(1 -ρ 2 1 ) R. (42) When ρ 0 > ρ 1 , E SHA (R) ≈ max 0≤β≤βmax min (ρ 1 -ρ 0 ) 2 1 -ρ 2 1 βR, (ρ 2 0 -β + 1)R .
(43) The maximum on the right-hand side is achieved by

β * = 1 -ρ 2 1 (1 -ρ 0 ρ 1 ) 2 , ( 44
) thus E SHA (R) ≈ (ρ 1 -ρ 0 ) 2 (1 -ρ 0 ρ 1 ) 2 R. (45)
This in turn yields [START_REF] Arikan | Guessing subject to distortion[END_REF].

B. Index of Maximum with Binning

It is natural to ask whether binning may help to improve upon the basic index-of-maximum approach of Section III-C. Indeed, in an estimation setting, Hadar et al. [START_REF] Hadar | Communication complexity of estimating correlations[END_REF] apply a combination of index of maximum and binning. However, their scheme only works when the correlation coefficient is approximately known. We next present a scheme for DHT, where the correlation coefficient can take two different values.

Consider a source sequence X k , where k = e βn for some β > 1. The indices 1, . . . , e βn are grouped into e n bins each of length e (β-1)n . Let m be the index of the maximum in X k . The encoder checks if X m -√ 2βn is sufficiently small. If it is larger than a chosen positive constant, it sends a special message to inform the decoder to declare H 1 ; otherwise it conveys the index of the bin containing m using n nats.

If the decoder receives a bin-index (i.e., not the special message), then, for each m in the bin, it calculates

ρ(m ) = Y m √ 2βn . (46)
It declares H 0 if and only if the following two conditions hold. 1) There exists an index m with |ρ( m) -ρ 0 | < .

2) For any m = m in the bin, ρ(m ) < ρ 0 . The analysis follows the same logic as for the SHAstyle scheme where ρ(m) replaces ρ(m). Notice that for the

"correct" index m, Y m = ρ i X m + 1 -ρ 2
i Z is approximately Gaussian with mean X m , while the other Y s are zero-mean Gaussian. Thus, one can use the amplitude asymptotics [START_REF] Swannack | Reflecting on the AWGN error exponent[END_REF] on Y m , which yield exponents for ρ(m) that are exactly the same as those that ρ(m) satisfies in the low-rate limit. For example, by the union bound, the error probability under H 0 is guaranteed to be small provided

βρ 2 0 -(β -1) (47)
is positive, which is exactly the condition (39) in the low-rate limit, where Ēη (βR) ≈ ρ 2 0 βR. Eventually, we obtain the same exponent [START_REF] Arikan | Guessing subject to distortion[END_REF] as in quantization with binning.

V. UPPER BOUNDS AND COMPARISON We compare the above achievable communication exponents with two upper bounds. The first upper bound is adapted from Rahman and Wagner [START_REF] Rahman | On the optimality of binning for distributed hypothesis testing[END_REF]. We note that the original upper bound of [START_REF] Rahman | On the optimality of binning for distributed hypothesis testing[END_REF] is for a nonzero rate R > 0. It does not immediately yield an upper bound on the communication exponent by letting R ↓ 0; recall that (3) does not necessarily hold with equality. Accordingly, our upper bound ÊRW is obtained via a proof that is slightly different from [START_REF] Rahman | On the optimality of binning for distributed hypothesis testing[END_REF]:

ÊRW = (ρ 1 -ρ 0 ) 2 (1 -ρ 1 ) 2 , ρ 0 + 1 2 ≥ ρ 1 ≥ 0. (48)
The second upper bound is taken almost directly from Hadar et al. [START_REF] Hadar | Error exponents in distributed hypothesis testing of correlations[END_REF]: ÊHLPS = (ρ 1 -ρ 0 ) 2 (1 -min(ρ 0 , ρ 1 )) 2 -(ρ 0 -ρ 1 ) 2 , ρ 0 , ρ 1 ≥ 0.

(49) Notice that all bounds are normalized by (ρ 1 -ρ 0 ) 2 . Lower bounds, starting from the lowest, are: E AC in dash-dotted blue, E Han in solid blue, and E SHA in solid black. Upper bounds are: ÊHLPS in dashed red (valid for ρ 0 ≥ 0), and ÊRW in solid red (valid for ρ 0 ≥ 0.4).

Comparing the lower and upper bounds, we see that the communication exponent E c is known for the following cases:

1) Testing against independence (ρ 1 = 0) : E c = ρ 2 0 ; 2) Testing for independence (ρ 0 = 0): E c = ρ 2 1 /(1 -ρ 2 1 ); 3) Testing for equality (ρ 0 = 1): E c = ρ 2 1 /(1 -ρ 1 ) 2 . In Figure 1 we plot the different lower and upper bounds on the communication exponent for a specific value of ρ 1 . For better visibility, we normalize all bounds by (ρ 1 -ρ 0 ) 2 . Notice that we have no upper bound for ρ 0 < 0.

2 Fig. 1 .

 21 Fig. 1. Comparison of the different bounds as functions of ρ 0 , for ρ 1 = 0.7.Notice that all bounds are normalized by (ρ 1 -ρ 0 ) 2 . Lower bounds, starting from the lowest, are: E AC in dash-dotted blue, E Han in solid blue, and E SHA in solid black. Upper bounds are: ÊHLPS in dashed red (valid for ρ 0 ≥ 0), and ÊRW in solid red (valid for ρ 0 ≥ 0.4).

This is similar to the case of error exponents for the Gaussian channel, which are not simple extensions of their discrete-channel counterparts.

This notion is of typicality is equivalent to the one in[START_REF] Cover | Elements of Information Theory[END_REF] with respect to a Gaussian density of mean zero and variance P .

This definition is equivalent to requiring x k and y k be typical, and x k , y k be close to kE[XY ].

Intuitively, X k as in (14) is "less random" than an i.i.d. Gaussian vector, thus its probability of atypical behavior is smaller than that of the latter.