## Abstract

Within a global physical theory, a notion of locality allows us to find and justify information-processing primitives, like non-signalling between distant agents. Here, we propose exploring the opposite direction: to take agents as the basic building blocks through which we test a physical theory, and recover operational notions of locality from signalling conditions. First, we introduce an operational model for the effective state spaces of individual agents, as well as the range of their actions. We then formulate natural secrecy conditions between agents and identify the aspects of locality relevant for signalling. We discuss the possibility of taking commutation of transformations as a primitive of physical theories, as well as applications to quantum theory and generalized probability frameworks. This ‘it from bit’ approach establishes an operational connection between local actions and local observations, and gives a global interpretation to concepts like discarding a subsystem or composing local functions.

This article is part of a discussion meeting issue ‘Foundations of quantum mechanics and their impact on contemporary society’.

## 1. Introduction

In modelling local agents acting within a global theory, the intuitive assumption is that both their actions and their knowledge are restricted to a bounded region. The canonical example is a scientist who has full control of her laboratory and can perform local tomography. In reality though, the breadth of knowledge and the range of action of agents may be decoupled. For example, prisoners can acquire global knowledge by reading the news, but their actions are limited to small subsystems. Conversely, someone locked in a control room may only have local knowledge of the shapes of different buttons, but pressing one may have global consequences. The observation that the knowledge and action do not always go hand in hand implies that in order to model agents we have to specify both (§2). This naturally leads us to search for minimal operational constraints needed to ensure that agents are truly local.

Here, we motivate a notion of *secrecy* between agents, which captures whether actions performed by an agent (like writing a message, choosing a bit or preparing a quantum state) can be perceived by another (§3); traditional notions of non-signalling correspond to an extended secrecy between space-like separated regions (§5). This work brings together and clarifies concepts of locality used in quantum theory, generalized probabilistic theories and field theories. It highlights that the *state space* and *transformations* of a theory are but a subjective choice of representation of the underlying physical theory from a viewpoint that is convenient to a given agent, as argued by Spekkens [1]. Here, we tentatively suggest commutation of transformations as a primitive of physical theories. In particular, we show how to derive local agents (and effective descriptions of local subsystems) from commutation relations on global transformations (§4).

This work draws from our ‘resource theories of knowledge’ [2], and has natural applications in multi-player settings, such as cryptographic scenarios, games or resource theories. There is yet a more exciting possible application: to recover the space–time structure of a physical theory from the primitive notion of test agents, in the spirit of Hardy’s operational general relativity [3] and of the task of localization in wireless sensor networks [4]. The idea is to send out agents (or probes) to unknown positions, see if they can communicate with each other, and use the signalling graph to define distances between agents, reconstruct their relative positions and infer properties of space–time (figure 1). For this, we must first find appropriate, theory-independent notions of agents and signalling.

## 2. Modelling agents

We start with a top-down approach, where we first describe a global theory (as seen by a global agent), and then model restricted agents acting within that theory.

### (a) Global theory

From the point of view of a given global agent, a global theory may be represented via a state space *Ω* and a set of transformations that are available to the agent [5–8]. We can think of the state space as the ‘language’ chosen by this global observer to describe nature. For example, *Ω* could be the set of coordinates and momenta of all celestial bodies; in quantum theory, it could be the set of valid density matrices over a global Hilbert space. It need not be a static picture: in astronomy, an alternative state space *Ω*′ could be the set of possible trajectories of celestial bodies, and in quantum theory it could include all global Hamiltonians that determine the free evolution of density matrices. Three observations are pertinent at this point: firstly, *Ω* is not the ultimate description of reality, just a convenient representation from the point of view of a global agent; secondly, different pictures, like *Ω* and *Ω*′, may be related and mapped to one another [1,2]; and thirdly, *Ω* need not have any special structure *a priori* besides being a set—indeed, the approach laid out here will allow us to find an operational subsystem structure in the set of states.

The transformations in represent all actions that the theory allows the global agent to implement. We can think of them as the ways in which the agent may test a theory, by applying actions that change state parameters. For example, an explicit theory of a quantum universe may allow only for unitary operations, while a more generous theory could equip the agent with implicit large ancillas, and allow her to implement general quantum channels, state preparations and even tomography. Again the two views can be related: the latter is an *effective theory* derived from the unitary quantum theory, by internalizing part of the global space as belonging to the agent and her instruments, and not to the object of study (the rest of the universe) [2]. In the context of field theories, this is discussed as *emerging agency* [3]. In a superdeterministic theory, there is only one possible course of evolution for the universe, and consists only of functions that apply it (for example, where the global agent is given some choice of time). Formally, is a monoid of functions *f*:*Ω*→*Ω*: it contains the identity transformation and is closed under concatenation (an associative binary operation), such that performing two actions subsequently, *f*°*g*, is still an allowed operation. We discuss the monoidal assumption and possible relaxations in §5.

### (b) Local agents

Local agents are characterized by limited knowledge: their inability to distinguish global states that appear identical in their eyes. We can formalize this by building equivalence classes of states that are indistinguishable from the perspective of an agent. For example, in quantum theory, we could have an agent Bob who only has access to a Hilbert space ; two global states are indistinguishable (or equivalent) from Bob’s perspective if they have the same marginal in . This defines an equivalence relation , where denotes a partial trace over all systems except *B*. The corresponding equivalence classes are
Taking the quotient over, this equivalence relation gives us a new space state *Ω*/∼_{B}, which is in one-to-one correspondence with the set of all reduced density matrices in . This is Bob’s *effective state space*, sufficient to encode all the information that he can observe about any global state (figure 2). In this case, the map from the global to the local spaces (the *canonical map*) is given by the partial trace
More generally, we can always build the effective state space of an agent in this way, even if we do not know anything about the structure of the global space (for instance whether it can be split into a convenient tensor form ). The construction of an agent’s effective state space *Ω*_{B}:=*Ω*/∼_{B} is in the spirit of the Leibniz principle of identity of indiscernibles [9]. Yet, this operational procedure emphasizes that both discernibility and identity are subjective concepts (figure 2). Limitations on Bob’s perspective may have nothing to do with spatial locality. Bob might only have access to crude measurement instruments unable to distinguish microscopic details of states, or he may not be able to distinguish a global phase or gauge [3]. In generalized probability frameworks, Bob’s perspective can correspond to a grouping of individual global outcomes into events (appendix E). In algebraic quantum field theory, these equivalence classes could emerge from algebras of local observables (e.g. [10] for a review).

The other ingredient needed to define an agent, as we saw in the Introduction, is a description of the actions available to him. As his actions may have a global impact, a minimal approach is to take them to be a submonoid of the globally allowed transformations. We discuss relaxations of this definition in §5. Generalizations of this approach can be found in [2]. There, we also study explicit ways to move between global and local views (technically, related by *Galois insertions*), effective theories and other properties of local agents.

### Definition 2.1 (Global theory and restricted agents).

A *global theory of agents* is defined by a pair , where *Ω* (the *state space*) is a set and is a monoid of transformations *f*: *Ω*→*Ω*, with the concatenation operation °.

A *restricted agent* *B* acting within the theory is defined by a pair , where ∼_{B} is an equivalence relation in *Ω* and is a submonoid of called the set of *local operations* of the agent. The quotient space *Ω*_{B}:=*Ω*/∼_{B} is called the *effective space* of agent *B*. The *reduction* to the effective space is given by the canonical map

Having defined the effective state space of a restricted agent, we can also see how such an agent perceives the outcome of her local actions. Namely, the effect of an action applied to a global state *ρ* is seen by agent *B* as [*f*_{B}(*ρ*)]_{B}. This has been explored in more detail in [2], and is not used in this work. In short, such an agent could then define a local theory of accessible states and actions, , where the transformations act on the reduced state space *Ω*_{B} as

We can always further coarse-grain the effective state space of a given agent *B* in order to obtain a more restricted agent *C*. For example, in renormalization group flow, lowering the cut-off corresponds to coarse-graining over more and more observables [11,12]. The following proposition formalizes this idea [2], prop. III.5. All proofs can be found in appendix A.

### Proposition 2.2 (Nested agents).

*Let* *be a global theory, and B*, *C two restricted agents. Then the following are equivalent*:

(

*i*)*C has more restricted knowledge than B, that is*, [*ρ*]_{B}⊆[*ρ*]_{C}, ∀*ρ*∈*Ω*,(

*ii*)*there exists an equivalence relation*∼_{B→C}*in B’s effective state space Ω*_{B}*such that Ω*_{C}≅*Ω*_{B}/∼_{B→C}.

## 3. Secrecy between agents

### (a) Secrecy

Having defined agents, we may study conditions for secrecy and non-signalling between them. Consider a set-up of two agents Alice and Bob, represented by and . Imagine that Alice wants to keep her actions (like writing a message or preparing a state) secret from Bob. This is achieved if Bob cannot tell whether she applied them, even after post-processing.^{1}

### Definition 3.1 (Secrecy).

We say that an agent *A* has access to *secret operations* towards another agent *B* if
for all . If all actions in are secret towards *B* and those in are secret towards *A*, we say that the two agents are *mutually secret*.

We may ask if this definition is robust enough, that is, whether further pre- or post-processing by Alice and Bob could destroy the secrecy of a choice of action . The next proposition shows that no matter how many ‘secret’ transformations in Alice implements, or how Bob acts in between to try and recover information, he will not detect any of the effects of Alice’s actions. In addition, it is easy to see that pre-processing with a global function (such as distributing entanglement between the two parties) cannot lift secrecy, as definition 3.1 requires it to hold for all initial states.

### Proposition 3.2 (Robustness of secrecy).

If *A* has secret operations with respect to *B* (according to definition 3.1), then pre- and post-processing cannot lift the secrecy, that is,
for all states *ρ*∈*Ω*, secret operations and , and global operations and .

### (b) Extended secrecy

We may also ask whether Alice’s actions stay secret to Bob in the presence of an additional global transformation . Transformations, such as a subsystem swap or a communication channel, may break secrecy; others, like the use of a Popescu–Rohrlich box, do not.^{2} For this situation, we define an extended notion of secrecy in the spirit of definition 3.1, which reduces to definition 3.1 in the case *f*=id. Here, Bob may try to post-process information before and after the global transformation.

### Definition 3.3 (Extended secrecy).

Let *A* be an agent with access to secret operations towards an agent *B*, . We say that is in addition secret (towards *B*) *in the presence of a global transformation* if
for all . We say that the agents are *mutually secret in the presence of* *f* if all actions in are secret towards *B* in the presence of *f* and vice versa.

We can now show that, analogously to proposition A.2, further pre- and post-processing by Alice and Bob cannot lift the secrecy.

### Proposition 3.4 (Robustness of extended secrecy).

If an agent *A* only uses secret operations with respect to agent *B* in the presence of , then further pre- and post-processing cannot lift the secrecy, that is,
for all states *ρ*∈*Ω*, local operations and , and global operations and .

In particular, for the case in which Bob only implements post-processing at the very end, proposition 3.4 implies that forms a monoid.

### Corollary 3.5 (Secret monoid).

*The set* *of secret operations in the presence of a global function* *forms a monoid, i.e.* *and*

Naturally, if we further restrict the actions and knowledge of one of the agents (as in proposition 2.2), secrecy is maintained.

### Corollary 3.6 (Restricted agents and secrecy).

*Let A, B and C be three agents, such that C is more restricted than B, that is*, *and* [*ρ*]_{B}⊆[*ρ*]_{C}, *for all* *ρ*∈*Ω*.

*If* *was secret towards A* (*in the presence of* ), *the same is true of* . *If* *was secret towards B* (*in the presence of f*), *it is still secret towards C* (*idem*).

## 4. Commuting agents

Now, we explore how secrecy is affected when the actions of two agents *A* and *B* commute. This is particularly relevant in the context of the non-signalling principle, because actions at space-like separation naturally commute.

### Definition 4.1 (Commuting agents).

We say that two agents *A* and *B* commute if
for all .

For example, in field theory commutativity holds for measurements or field interactions at space-like separation, and this is in general how causality is recovered there [13].^{3} Motivated by this, we here take the commutation of actions in space-like separated regions as a fundamental building block in deriving agents that are secret relative to each other. Note that, in particular, finding commuting sets of transformations in is something that can be done prior to definitions of local agents; this is shown explicitly in [2].^{4} Commutation is also an operational property of the theory: for example, commutation is independent of the choice of reference frames in relativity and quantum field theory [13,14]. If two agents commute, secrecy follows from simpler conditions.

### Proposition 4.2 (Secrecy for commuting agents).

*If A and B commute, then if there exists a subset of actions* *such that* ,
*then* *is secret towards B in the presence of f. In particular, g*_{A}(*ρ*)∼_{B}*ρ for all* *implies secrecy of A towards B*.

### (a) Secrecy from commutation

Starting only from commutation relations on the global transformations, we can construct descriptions of local agents that have secret actions with respect to each other. More specifically, given any two commuting submonoids , we can construct equivalence relations ∼_{A},∼_{B} so that two agents Alice and Bob have secret actions with respect to each other.

The first step is to start with transformations (‘Alice’s transformations’), and look for the most generous effective state space that is insensitive to transformations in . This will model the perspective of an agent, Bob, who cannot detect Alice’s actions.^{5}

### Definition 4.3 (Perspective insensitive to transformations).

Let be a submonoid of transformations. First, we define a binary relation in *Ω* called *convergence through * as
We take the transitive closure of to define the *perspective insensitive to transformations* ,

The above construction gives us minimal restrictions for independent agents. The following theorem is adapted from [2].

### Theorem 4.4 (Deriving secret agents).

*Commuting submonoids* *give rise to descriptions of mutually secret agents
*

Indeed, all agents whose actions commute with and for whom transformations in are secret must be described by a coarse-graining of (figure 3). This and related minor results can be found in appendix D. In appendix F, we generalize theorem 4.4 to extended secrecy in the presence of global functions. There, we also extend the construction of the effective spaces of two agents to the case where the two monoids of transformations do not commute: without commutation, this construction is not as simple.

### (b) Perceived commutation from secrecy

We can now ask if the actions of two mutually secret agents must always commute. The answer is no, not at a global level: unbeknown to the two agents, their actions could affect other degrees of freedom of the global theory. This can become relevant when the actions of two agents affect a common environment that is not directly accessible to them but could be recovered by a third party.

For example, consider again the state space of three bits, where Alice can only see the first bit and Bob the second. Now imagine that Alice has access to all the transformations that change the first bit and, as a side effect, reset the third bit to 0, while Bob has access to all the actions that act on the second bit and, as a side effect, flip the third bit. From a global viewpoint, their actions do not commute. However, for someone who only had access to the combined knowledge of Alice and Bob (the first two bits), their actions would appear to commute. For such an agent, only local time ordering of Alice and Bob’s actions matters, as the two processes *f*_{A}°*f*_{B} and *f*_{B}°*f*_{A} are indistinguishable. This is yet another example of how subsystems and local descriptions represent simplified pictures of the global theory, reducing the degrees of freedom of the theory to an operational minimum *for a given agent*, who in this case would not need to model global time ordering.

## 5. Applications

In the previous sections, we have shown how to derive a notion of locality within a global theory starting from a primitive notion of individual agents, and their observed secrecy and commutation relations.

The operational approach laid out here has the advantage of carrying very few assumptions about the underlying physical theory. For example, it goes to a higher level of abstraction than generalized probability theories by not taking for granted that all agents express their knowledge in terms of reliable (classical) statistics about the outcomes of measurements.

Our notion of effective state spaces captures the concept of *beables* of a theory: aspects (or classes) of states that can in fact be physically observed and distinguished [3,16]. Our approach highlights that beables are observer-dependent: for example, what appears to be a gauge may turn out to be only a local gauge [3], and the same applies to ‘global’ phases of quantum states or yet-to-be-discovered microscopic details of some structure. We can never rule out the existence of a more refined underlying theory, but with effective state spaces we can tailor the descriptions used in a theory to the level of detail needed for a particular application. This goes in the direction of the work of Colbeck & Renner [17], who showed that quantum theory is *complete* for the task of guessing measurement outcomes, and further refinements would be irrelevant.

As presented here, our framework simplifies the modelling of agents for the pedagogical purpose of highlighting the advantages of this general direction. In appendix C, we show how one could relax some of our assumptions to model agents that are limited in time or who can only approximately distinguish states. In the following, we discuss further applications and relation to other work.

### (a) Non-signalling

One natural application of our extended notion of secrecy is the traditional non-signalling condition. To see this, imagine that the two agents are cooperating, so that Alice is trying to communicate information to Bob by means of some action on her side. Bob can now either directly apply post-processing , or he can wait for some time to pass, as represented by a function that implements global time evolution over time *t*. If Alice and Bob are mutually secret in the presence of *u*_{t}, for all *t*≤*T*, we conclude that they cannot signal to each other in this time window.

In appendix E, we show explicitly how our notion of extended secrecy implies traditional non-signalling in the framework of generalized probabilistic theories [18,19] for the case of two parties performing binary measurements (two inputs, two outputs on each side), where the state space consists of probability distributions over outcomes of possible measurements on physical systems. The generalization to finitely many inputs and outputs is straight forward.

### (b) Reconstructing space–time

Building on the example above, if two agents cannot signal in the presence of *u*_{t} for *t*≤*T* and in addition can signal in the presence of *u*_{t} for *t*>*T*, this can be used to define a *distance* between the two agents, via *d*∝*T*. The proportionality constant can be interpreted as the speed of signal propagation, for example the speed of light.

The challenge to obtaining a meaningful distance is two-fold: firstly, choosing a ‘natural’ family of transformations {*u*_{t}}_{t} to represent time evolutions, and secondly, choosing a family of agents that do not conflate different types of coarse-grainings. For example, locality and macroscopicity each give rise to a natural notion of distance, relating to the space between agents and to precision of observation, respectively; the latter could be used to quantify chaos given a family of time evolutions.

More generally, we can try to use signalling between agents to infer properties of space–time of a given theory, as illustrated in figure 1. Some steps in this direction have been given, for example, in [3,20,21]. This would be of particular interest in the context of field theories [10,22,23]. We leave the generalization of the operational approach depicted in figure 1 to reconstruct position as future work.

### (c) Relation to modular approaches

Our global approach complements modular, bottom-up constructions [24], like process theories based on symmetric monoidal categories [5–8,25]. For the purpose of comparison with our work, modular theories can be understood as theories of individual systems (or ‘objects’) and local actions (processes) on those systems, which allow for parallel and sequential composition of processes on different systems. Typically, they assume the following. (1) Processes with matching output and input systems can be composed sequentially. That is, a process *f*:*A*→*A*′ can be composed with a process *g*:*A*′→*A*′′, to form a new process *g*°*f*:*A*→*A*′′ satisfying
(figure 4*a*). (2) Any two systems *A* and *B* can be combined in parallel to form a composite system denoted by *A*⊗*B*. (3) Any two processes *f*:*A*→*A*′ and *g*:*B*→*B*′ can be composed to yield a process *f*⊗*g*:*A*⊗*B*→*A*′⊗*B*′ satisfying
(figure 4*b*). This last assumption implies that processes act locally without disturbing other systems, and that actions on independent systems always commute. This allows us to represent process theories in terms of diagrams that can be easily composed (figure 4).

Our approach is more general in that we do not assume the strong subsystem structure imposed by conditions (2) and (3). As such, our work strengthens Coecke *et al.*’s [7] argument that non-signalling can be derived from a simpler condition (appendix B). In general, our top-down view can be taken as a precursor and sanity check for process theories. In complex global theories, a strong subsystem structure may not be clear-cut from the start. The cautious researcher can first use our approach to test different reduced descriptions for independence conditions. If she succeeds in finding independent effective spaces—which is not always possible—she may then frame them as subsystems and attempt a modular construction.

At a conceptual level, our approach gives a global interpretation to aspects of process theories that are more epistemic than physical. For example, if we think of subsystems as building blocks of a global space, it appears natural to see ‘discarding a subsystem’ as a physical action, like throwing away a piece of Lego (figure 4*c*). However, if we start from the global space and see subsystems as arbitrary restricted descriptions, then ‘discarding a subsystem’ corresponds to a coarse-graining over the relevant degrees of freedom (for example, going from *Ω*_{AB} to an effective space *Ω*_{A}), a change of perspective rather than a physical transformation.

### (d) Relation to causal structures

Our notion of secrecy between agents is analogous to *causal independence* between events in graphs used to study causality in physics. Causal structures [1,26–30] try to capture the causal relations between events within a larger context (figure 5). Both causality (as expressed by Reichenbach’s principle) and secrecy are guiding principles of a certain way of representing a theory (causal structures and restricted agents, respectively) that help us understand a complex situation—they are not necessarily fundamental features of the laws of Nature. How useful the representation is depends both on the guiding principle and on the choice of variables of interest (like events or agents).

Let us illustrate this. In classical causal graphs, events are represented by random variables, in principle subject to intervention (figure 5*a*). As we move from purely classical scenarios to more physical situations, like those involving quantum measurements, the formalism of causal structures is evolving to focus on agents and on explicit physical transformation as carriers of causal influence, similarly to our approach. For example, in the quantum causal structures of [31], events can correspond to quantum systems where agents can act locally (figure 5*b*). Generally speaking, ‘events’ embody a particular coarse-graining of a global picture into variables or subsystems of interest. As such, a single causal graph cannot reveal all the features of a complex theory—a different decomposition may explore new causal relations.^{6} The choice of relevant nodes can be guided by https://plato.stanford.edu/entries/operationalism/: (i) we start by picking ‘variables’ that we care about (like the outcomes of an experiment, or a subsystem corresponding to the perspective and range of intervention of an agent); (ii) we then use Reichenbach’s principle and independence conditions to complete the causal graph, by identifying further nodes and constraining the channels between them.^{7} This procedure is similar in spirit to how in the present work we could start with the description of a few agents and use secrecy and commutation constraints to identify other subspaces and transformations of interest, or build a notion of locality. How successful we are in this endeavour depends largely on the (subjective) starting point—a poor initial choice of events or agents could make it impossible to find a meaningful causal graph or independent agents.

Even with a clever choice of initial variables, it could be that the guiding principle is not powerful enough to provide meaningful representations for all physical situations. This is likely to be the case in both approaches, which are still rooted in classical intuitions—resulting in concepts like agents, Reichenbach’s principle and time order. In trying to explain a physical scenario in terms of these classical notions, we risk running into paradoxes such as the inconsistencies between quantum agents in [32]. It remains to explore whether both our approach and causal models can handle this kind of physical challenge, and whether extensions to cover them would still be intuitive enough to help us make sense of the world.

## Data accessibility

This article has no additional data.

## Authors' contributions

The authors contributed equally to this paper.

## Competing interests

The authors declare that they have no competing interests.

## Funding

L.K. acknowledges support from the European Research Council via grant no. 258932, the Swiss National Science Foundation through the National Centre of Competence in Research *Quantum Science and Technology* (QSIT), and the European Commission via the project *RAQUEL*. L.d.R. acknowledges support from ERC AdG NLST and EPSRC grant *DIQIP*, from the FQXi grant *Physics of the observer*, and from the Perimeter Institute for Theoretical Physics. Research at the Perimeter Institute is supported by the government of Canada through Industry Canada and by the Province of Ontario through the Ministry of Economic Development & Innovation.

## Acknowledgements

We thank Bob Coecke and Barry Sanders for discussions on discarding and non-signalling; Lucien Hardy, Ryszard Paweł Kostecki and Renato Renner for discussions on locality; John-Mark Allen and Mirjam Weilenmann for discussions on causality; David Jennings and Markus Müller for bringing up approximate distinguishability; Roger Colbeck for feedback on this manuscript; Miyuko for sanctuary; and Sandu Popescu for the mantra ‘one idea, one paper’. This one goes out to Matt and Rob—let us disagree again soon.

## Appendix A. Proofs

### Proposition A.1 (Nested agents).

*Let* *be a global theory, and B, C two restricted agents. Then the following are equivalent*:

(

*i*)*C has more restricted knowledge than B, that is*[*ρ*]_{B}⊆[*ρ*]_{C}, ∀*ρ*∈*Ω*,(

*ii*)*There exists an equivalence relation*∼_{B→C}*in B’s effective state space Ω*_{B}*such that Ω*_{C}≅*Ω*_{B}/∼_{B→C}.

### Proof.

For each direction:

1 → 2. We build the equivalence relation in

*Ω*_{B}as As [*ρ*]_{B}⊆[*ρ*]_{C}for all*ρ*∈*Ω*, ∼_{B→C}is a well-defined equivalence relation, and the reduced space*Ω*_{B}/∼_{B→C}is in one-to-one correspondence with the space of the equivalence classes [*ρ*]_{C}.2 → 1. By assumption, the reduction

*h*_{C}is isomorphic to*h*_{B→C}°*h*_{B}. Therefore, [*ρ*]_{C}≅[[*ρ*]_{B}]_{B→C}and [*ρ*]_{B}⊆[*ρ*]_{C}.

▪

### Proposition A.2 (Robustness of secrecy).

If *A* has secret operations with respect to *B* (according to definition 3.1), then pre- and post-processing cannot lift the secrecy, that is
for all states *ρ*∈*Ω*, secret operations and , global operations and .

### Proof.

We apply the secrecy condition (definition 3.1) multiple times. Define . Starting from the left-hand side, we have □

### Proposition A.3 (Robustness of extended secrecy).

If an agent *A* only uses secret operations with respect to the agent *B* in the presence of , then further pre- and post-processing cannot lift the secrecy, that is
for all states *ρ*∈*Ω*, local operations and , global operations and .

### Proof.

The proof is analogous to the proof of proposition A.2 and uses definition 3.3; we also define and Then □

### Corollary A.4 (Restricted agents and secrecy).

Let *A*, *B* and *C* be three agents, such that *C* is more restricted than *B*, that is and [*ρ*]_{B}⊆[*ρ*]_{C}, for all *ρ*∈*Ω*.

If was secret towards *A* (in the presence of ), the same is true of . If was secret towards *B* (in the presence of *f*), it is still secret towards *C* (idem).

### Proof.

As , it is secret towards *A*. This also restricts the post-processing that *C* can do, and since *ρ*∼_{B}*σ*⇒*ρ*∼_{C}*σ*, we have that is secret towards *C*. ▪

### Proposition A.5 (Secrecy for commuting agents).

If *A* and *B* commute, then if there exists a subset of actions such that, ,
then is secret towards *B* in the presence of *f*. In particular, *g*_{A}(*ρ*)∼_{B}*ρ* for all implies secrecy of *A* towards *B*.

### Proof.

To show the second part of the proposition, secrecy of towards *B*, we have
for all .

To show secrecy in the presence of *f*, we use
for all . ▪

### Lemma A.6.

The perspective induced by a submonoid is an equivalence relation in *Ω*.

### Proof.

By construction is transitive, reflexive and symmetric. ▪

### Theorem A.7 (Deriving secret agents).

*Commuting submonoids* *give rise to descriptions of mutually secret agents
*

### Proof.

We must show that
for all and . By proposition ??, we only need to show , for all . This holds since (as is a monoid), and so . We proceed analogously to find the effective state space of *A*. ▪

## Appendix B. Relation to terminality

In [7], Coecke argues that a process theory [8,25] is non-signalling if it satisfies a simpler condition dubbed terminality. Terminality states that local processes on a system right before ‘discarding’ it cannot have any observable effect (figure 6*a*). Discarding subsystems is a concept that corresponds to tracing out or coarse-graining over local information. For example, in quantum theory, it is implemented by the partial trace: terminality is naturally satisfied for completely positive trace-preserving operations on the discarded systems, but does not hold for non-deterministic effects such as projections onto particular outcomes of measurements [7].

In our language, the condition of terminality corresponds to the independence condition *f*_{A}(*ρ*)∼_{B}*ρ*, where *f*_{A} are local functions on a system *A* and ∼_{B} corresponds to the local picture of other systems *B* outside *A*. Recall that the assumptions behind process theories like [7] impose some structure on transformations and agents, in particular, commutation between agents’ local actions. As we saw in proposition 4.2, this independence condition together with commutation already implies secrecy.

It remains to see if our secrecy condition is equivalent to the non-signalling of [7], depicted in figure 6*b*. This non-signalling corresponds roughly to secrecy under pre- and post-processing, as implemented by an initial state preparation *f*_{⊥} and a deterministic effect *f*_{⊤}. In our picture, robustness of secrecy under pre- and post-processing is ensured by proposition A.2. In this case, pre-processing with a function *f*_{⊥} can be included without loss of generality in the initial state. On the other hand, post-processing with *f*_{⊤} is eliminated by the choice of local perspective ∼_{B}.

Hence, the result of [7] that terminality implies non-signalling follows from our propositions A.2 and A.5 together. Our premise that actions by different local agents commute is weaker than the assumptions employed by Coecke *et al*. [7]. In conclusion, our approach strengthens the argument in [7] for the significance of a condition like terminality. At the same time, we take a more general approach to subsystems than the bottom-up model of process theories in [7], thus highlighting the role of commutation in the context of defining local agents and non-signalling.

## Appendix C. Relaxing some assumptions

Let us now give some guidelines on how to relax two of the assumptions of our framework, in order to cover more realistic representations of agents.

**(a) Approximate distinguishability**

Often agents may not have clear-cut distinguishability criteria. For example, an agent may categorize light frequencies into basic colours such as green and blue—there may be some frequencies that the agent could file as both green and blue. In the language of PBR [33], the reduced states ‘blue’ and ‘green’ would be epistemic and not ontic (with respect to the underlying state space of frequencies *Ω*). Agents could also have a notion of approximate distinguishability, for example, of the sort ‘I can distinguish these two states with probability 1−*p*.’

We propose a simple approach to address these cases. (i) Build a generous effective state space *Ω*_{B} by assigning different reduced states to every two states in *Ω* that can be distinguished in principle by the agent. (ii) Build an approximation structures in the effective state space [2]. An approximation structure comprehends all neighbourhoods parametrized by whatever measure is operational for the agent. For example, one valid approximation structure for quantum states corresponds to the *ϵ*-balls induced by the trace distance; another could be just the cover {blue, green, …} of the possible colours assigned to each frequency. (iii) Build notions of approximate secrecy, where we can demand, for example
for all , instead of the stricter condition of secrecy, where we demand that the two final states are completely indistinguishable from *B*’s perspective. The properties of approximate secrecy are inherited from the approximation structure.

**(b) Time-limited agents**

In this work, we model local actions as monoids and . When applying secrecy to find non-signalling conditions between time-limited agents, the monoidal structure of actions is only a convenient approximation, which allows us to concatenate post-processing actions indefinitely. The intuition behind this approximation is that Alice and Bob’s actions can be implemented essentially instantaneously, compared to the relevant time scales. One example would be the action of choosing a bit as an input to a measurement, by pressing a button in Alice’s laboratory (see appendix E). With this interpretation, and can consistently be modelled as monoids, because it is assumed that the concatenation of two instantaneous actions can again be implemented instantaneously. In this model, time evolution is explicitly modelled by global functions ; this could include the actual effect of pressing the button.

When functions in and on Alice’s and Bob’s sides take some finite time *t*>0 to implement, we may instead of full monoidal structure only have if the functions *f*_{A} and *g*_{A} together take less than a given time *T* to implement. In this case, the notion of secrecy or non-signalling and our results that relate to it can still be recovered for functions and concatenations of functions that do not exceed this time-frame *T*.

## Appendix D. Commuting agents: additional results

In the main text, we have noted that the perspective induced by transformations is minimal: any agent whose actions commute with and towards whom transformations in are secret must, in fact, be described by a coarse-graining of .

### Proposition D.8 (Induced perspective is minimal).

Let be an agent towards whom is secret, and such that and commute. Then with the equivalence relation induced by . This implies that there exists an equivalence relation in the effective state space such that

### Proof.

As is secret towards *B*,
and so, due to transitivity of ∼_{B}, also
Again due to transitivity it directly follows that
and so
for all *ρ*∈*Ω*. We may thus employ proposition A.2. ▪

### Corollary D.9.

Let be monoids such that . Then the induced equivalence relations and satisfy This again implies that there exists an equivalence relation in the effective state space such that

### Proof.

This follows from the fact that is secret towards , together with proposition D.8. The second statement follows again from proposition A.2. ▪

Finally, the following proposition shows that equivalence classes are preserved by commuting transformations , providing an operational interpretation to the perspective of agents : namely, states that are indistinguishable from Bob’s point of view remain indistinguishable after he applies functions ,

### Proposition D.10 (Induced perspective is operational).

Let be commuting transformations. Then the perspective induced by satisfies
for any and *ω*,*ρ*∈*Ω*.

### Proof.

From the definition of it follows that
with
for all *ν*,*ω*∈*Ω*. But then, because and commute, for all of *ω*,*τ*_{1},…,*τ*_{n}, *ρ* it holds that
for all . From the definition of as the transitive closure of , it then also follows that
□

## Appendix E. Application to generalized probability theories

Generalized probability theories (GPTs [18,19,34–36]) are a framework to infer as much as possible about a physical system without making assumptions about its inner workings (like the assumption that states can be represented as vectors in a Hilbert space). Instead, it is assumed that agents can implement and label a number of physical procedures, like preparations, transformations and, crucially, measurements. Note that the agents need not know the actual physical state prepared; in order to label a procedure, they only need to be confident that they can repeat it. Indeed, the basic assumption behind GPT frameworks is that agents can extract significant measurement statistics (for example, by repeating a procedure many times). Hence, GPTs model outputs of measurements as random variables, and agents’ knowledge of procedures as probability distributions.

The usual approach to build GPTs is bottom-up, starting with local procedures that can be composed to reach a global theory. Here, we are interested in the opposite direction: given a global GPT, can we find meaningful notions of local variables? Firstly, we need to model global and local knowledge.

**(c) Basic formalism**

While we are inspired by known GPT models [18,19,34–36], we take a slightly different and simplified approach here. The idea is that agents only have direct access to classical random variables (like input settings and outputs of a physical measurement). As they correspond to accessible information, we denote probability distributions over these random variables by states. Transformations *f* are naturally modelled by conditional probability distributions that take input to output states, such that *f*(*P*_{X})=*P*′_{Z}, with
For example, suppose that we want to model an experiment where an agent performs a quantum measurement by pressing two buttons: button *X* prepares a quantum state *ρ*^{x} and button *Y* measures it according to the POVM with possible outcomes {*z*}_{z∈Z}. The distributions *P*_{XY} over inputs and *P*′_{Z} over outputs correspond to accessible ‘states.’ We model the transformation as a conditional distribution with . The final distribution *P*′_{Z} of outcomes given an input distribution *P*_{XY} is therefore
Note that it is the conditional distribution that encodes the ‘physical’ information about a particular setting (like the quantum state and POVM), which may be inaccessible to the agents.

To compare with the models of [18,19], our transformations are analogous to their states. However, in our agent-driven approach, we restrict the set of allowed measurements to those accessible to a particular agent in the resource theory—in this case, they can thus be seen as a subset of the fiducial measurements that define a state in [18,19].

In our model, global states correspond to distributions over a global random variable *X*. Restricted agents are those unable to distinguish some of the outcomes of the global variable. We can model this via arbitrary groupings of outcomes *x*∈*X* into equivalence classes, i.e. events {*B*_{b}}_{b}. The reduction function *h*_{B} to the effective state space of an agent *B* simply sums over all the probabilities of the individual outcomes *x*∈*B*_{b} in each event *B*_{b} and returns the probability associated with the event,

**(d) Secrecy and non-signalling**

Consider now two agents *A* and *B* whose actions commute. To guarantee secrecy of *A* towards *B*, we only need to satisfy the independence condition *g*_{A}(*P*_{X})∼_{B}*P*_{X} (for all global *P*_{X} and all , see proposition 4.2). In our language, this condition reads
For simplicity, we took *Y* and *X* to be identical random variables that represent the global state before and after the transformation, and *h*_{B} is a particular coarse-graining of outcomes into events. The condition then states that *h*_{B} is insensitive to the transformation (conditional probability distribution) from inputs *x*∈*X* to outcomes *y*∈*Y* .

If *A* and *B* commute and are mutually secret, we can ask if an additional global transformation allows for signalling between them (definition 3.3). Our condition for extended secrecy in the presence of *f*, *f*_{B}°*f*°*g*_{A}(*P*_{X})∼_{B}*f*_{B}°*f*(*P*_{X}), for all global *P*_{X}, and , becomes
E 1Non-signalling functions are then those that do not let information encoded in propagate to Bob’s perspective ∼_{B}, that is, such that is secret with respect to in the presence of *f*. Here, again for simplicity *X*,*Y*,*Z*,*V* were chosen as identical random variables, and both represent the conditional probability distribution corresponding to *f*. For a simple example in a two-bit space (figure 7).

We can compare our definition of secrecy in the presence of *f* to traditional notions of non-signalling. Consider again the simple case of a two-bit input and output space of figure 7. The definition of non-signalling found, for example, in [17] reads *P*_{Y |AB}=*P*_{Y |B}, or
E 2This condition formalizes the idea that Bob cannot learn anything about Alice’s input *a* by looking solely at his output *y* and input *b*. In our framework, Alice’s choice of input is encoded in a local transformation (for example, could correspond to pressing a button to choose input 0 and to choose 1), and therefore ‘Bob’s ignorance about Alice’s input’ translates to ‘Bob’s ignorance about Alice’s action *g*_{A}.’

In the following, we establish a direct equivalence between these two notions of non-signalling in this simple case; we expect this equivalence to hold in more general settings. Let us first flesh out the assumptions behind the equivalence. A gentle warning: we have labelled all the intermediate bits differently ‘to avoid confusion’ (figure 7). As we assume *a priori* that Alice and Bob have mutual secrecy (without *f*), we take that *g*_{A} only acts locally on Alice’s bit,
so that
Similarly, Bob’s post-processing is encoded in which we also assume to be truly local, that is
The final distribution *P*_{Y ′} for Bob becomes
The condition for secrecy in the presence of *f*, equation (1), is then
E 3

### Proposition E.11 (Equivalence to non-signalling in GPTs).

In the setting of figure 7, ‘our’ condition of non-signalling, equation (3), is equivalent to the ‘traditional’ notion, equation (2).

### Proof.

In our language, the non-signalling condition of equation (2) reads
To show that equation (3) implies the above, we choose the particular local actions
There, corresponds to Alice’s choice of input 0, to her choice of 1, and *f*_{B} to no post-processing by Bob. These choices directly imply for all *Q*_{AB},
and so traditional non-signalling follows. For the other direction, we have simply
□

This shows that, for example, PR boxes satisfy our definition of non-signalling functions. Examples for functions that are signalling are conditional probability distributions that swap the states on the two systems, or bitwise addition of the inputs *a* and *b* on the two sides into the outputs *x* and *y*.

## Appendix F. Deriving secrecy without commutation

In principle, the way we have constructed an induced perspective from a monoid can be extended to construct equivalence relations that yield secret agents and in the presence of a global function *f*, and even in the case where functions and do not commute. This is done in the following proposition, which, as is shown in the subsequent corollary, reduces to the definition of induced perspectives and in the case *f*=id and commuting .

### Proposition F.12 (Deriving secret agents).

Let be a global theory, be two monoids of transformations, and let . Then the smallest equivalence class ∼_{B} on *Ω* towards which is secret in the presence of *f*,
for all , is built as follows:

Define the relation ∼ on *Ω* as
Then define another relation ∼′ as
Finally, the relation ∼_{B} on *Ω* is the transitive closure of ∼′, namely through

### Proof.

Both the relation ∼ and ∼′ are by construction reflexive and symmetric. The relation ∼_{B} is then by construction also transitive, and thus constitutes an equivalence relation. The relation ∼_{B} furthermore gives rise to the smallest perspective towards which is secret in the presence of *f*: *ω*=*g*_{A}(*ρ*)⇒*ρ*∼_{B}*ω*. By construction then also *f*_{B}°*f*°*f*′_{B}°*g*_{A}(*ω*)∼_{B}*f*_{B}°*f*°*f*′_{B}(*ω*) and *f*_{B}°*g*_{A}(*ω*)∼_{B}*f*_{B}(*ω*), for all . ▪

### Corollary F.13.

In the case of commuting , the equivalence relation ∼_{B} constructed in proposition F.12 that gives rise to secrecy in the presence of *f* simplifies accordingly and can be constructed as follows.

Define the relation ∼ on *Ω* as
Then define another relation ∼′ as
Then, the relation ∼_{B} on *Ω* is the transitive closure of ∼′, namely through
If in addition , the relation ∼_{B} simplifies to
with ∼ as above. This recovers the construction of induced perspectives in definition 4.3.

### Proof.

In the case when functions in and commute, we can see that
for all . This implies the respective simplifications of the relation ∼_{B}, and recovers the induced perspective of in the case of *f*=id. ▪

## Footnotes

One contribution of 17 to a discussion meeting issue ‘Foundations of quantum mechanics and their impact on contemporary society’.

↵1 Bob’s effective space may include his local processing (states that I can distinguish after applying all my accessible operations) or not (states that I distinguish immediately, before further processing). For the sake of generality, we leave the freedom in this decision up to the agent, and account for post-processing in the definition of secrecy.

↵2 In generalized probability theories, PR boxes can be seen as transformations that take classical inputs and return outputs (appendix E).

↵3 The simplest illustration of this is the commutation of the Klein–Gordon field operators

*ϕ*(*x*) and*ϕ*(*y*) at space-like separated*x*and*y*, [*ϕ*(*x*),*ϕ*(*y*)]=0. Such a commutation condition is also referred to in field theory as the*locality postulate*[14].↵4 Commutation relations result in a nice algebraic structure—a lattice—in the space of transformations [2]. This is also the case for the von Neumann bicommutant in operator algebras [15].

↵5 Essentially, this perspective identifies sets of global states that Alice can locally make ‘converge’ to the same state.

↵6 Furthermore, we can never know if we only have access to an effective state space to start with, and there is a deeper theory that changes all the causal relations, for example by providing new common causes.

↵7 For example, in studying the process of coherent copy in [31], we start with three nodes of interest (systems

*A*,*B*and*C*), which are forced by Reichenbach’s principle to complete the graph with a fourth node.

- Accepted April 16, 2018.

- © 2018 The Authors.

Published by the Royal Society under the terms of the Creative Commons Attribution License http://creativecommons.org/licenses/by/4.0/, which permits unrestricted use, provided the original author and source are credited.