<p>Renyi entropy is analogous, in some sense, to $\ell_p$-norms, so let's first recall why those norms are useful.</p>

<p>Suppose we have a vector of numbers $a \in \mathbb{R}^n$. We want to have a single number that represents, in some sense, how does the typical element of $a$ look like.</p>

<p>One way to do so is to take the average of the numbers in $a$, which roughly corresponds to the $\ell_1$ norm: $\mathbb{E}_{1 \le i \le n}[|a_i|]$. This is often useful, but for some applications it has the following problems: First, the $\ell_1$ norm does not give us a good upper bound on the largest element of $a$, because if there is a single large element and many zeroes, the $\ell_1$ norm will be significantly smaller than the largest element. On the other hand, the $\ell_1$ norm also does not give us a good bound on how small the elements of $a$ are, for example, how many zeroes $a$ has - this problem occurs in exactly the same scenario as before. </p>

<p>Of course, when the elements of $a$ have a lot of variance, such as in the extreme scenario as above, no single number can give solve both problems above. We have a tradeoff. For example, if we only want to know the largest element, we can use the $\ell_\infty$ norm, but then we will lose all information about the smaller elements. If we want the number of zeroes, we can look at the $\ell_0$ norm, which is just the size of the support of $a$.</p>

<p>Now, the reason for considering $\ell_p$ norms is that they give us the whole continuous tradeoff between the two extremes. If we want more information on the large elements we take $p$ to be larger, and vice versa.</p>

<p>Same goes for Renyi entropies: Shanon's entropy is like $\ell_1$ norm - it tells us something about the "typical" probability of an element, but nothing about the variance or the extremes. The min-entropy gives us information on the element with the largest probability, but loses all information about the rest. The support size gives the other extreme. The Renyi entropies give us a continuous tradeoff between the two extremes.</p>

<p>For example, many times the Renyi-2 entropy is useful because it is on the one hand close to Shanon's entropy, and thus contains information on all the elements on the distribution, and on the other hand gives more information on the elements with the largest probability. In particular, it is known that bounds on the Renyi-2 entropy gives bounds on the min-entropy, see, e.g., Appendix A here: <a href="http://people.seas.harvard.edu/~salil/research/conductors-prelim.ps">http://people.seas.harvard.edu/~salil/research/conductors-prelim.ps</a> </p>

CC BY-SA 3.0
2015-04-07T09:53:57.980Z
2015-04-13T22:58:08.540Z
2015-04-13T22:58:08.540Z
Or Meir
<p>Renyi entropy (of order 2) is useful in cryptography for analyzing the probability of collisions.</p>

<p>Recall that the Renyi entropy of order 2 of a random variable $X$ is given by</p>

<p>$$H_2(X) = - \log_2 \sum_x \Pr[X=x]^2.$$</p>

<p>It turns out that $H_2(X)$ lets us measure of the probability that two values drawn i.i.d. according to the distribution of $X$ happen to be the same ("collide"): this probability is exactly $2^{-H_2(X)}$.  After drawing $n$ times from this distribution, the expected number of collisions among these $n$ draws is $C(n,2) 2^{-H_2(X)}$.</p>

<p>These facts are useful in cryptography, where collisions can sometimes be problematic and enable attacks.</p>

<p>For some analysis of other uses in cryptography, I recommend the following PhD dissertation:</p>

<p>Christian Cachin. <a href="http://www.zurich.ibm.com/~cca/papers/d.pdf">Entropy Measures and Unconditional Security in
Cryptography</a>.  PhD dissertation, ETH Zurich, May 1997.</p>

CC BY-SA 3.0
2015-04-06T15:41:34.323Z
Is there such a direct probabilistic definition of any q-Renyi entropy? (as you can see from my answer, the only way I know of defining this at arbitrary q is via defining partition functions corresponding to a physical system which has been specified via its Lagrangian or Hamiltonian or its action)
Student
CC BY-SA 3.0
2015-04-06T16:18:00.843Z
@Anirbit, I don't konw.  None that I recall seeing (though it's possible q-Renyi entropy might lead to bounds on other bounds we care about...)
D.W.
CC BY-SA 3.0
2015-04-06T20:16:43.260Z
Also it seems that "information entropy" seems to be basically the "thermodynamic entropy". So even at (q=1)-Renyi entropy i.e entanglement entropy there is a conceptual gap about the complexity interpretation of it?
Student
CC BY-SA 3.0
2015-04-07T09:57:50.723Z
@D.W.:Nice answer, I neglected to include this case: indeed it seems that Renyi entropies of various orders are connected with different cryptographic scenarios, including for example the min-entropy (which corresponds to the Renyi parameter approaching $-\infty$) which plays a part in randomness extraction.
kodlu
CC BY-SA 3.0
2015-04-09T20:26:27.997Z
@D.W. There seems to be a probabilistic interpretation. Do see my comment on the original question.
Student
CC BY-SA 3.0
2015-04-06T03:42:34.133Z
2015-04-06T03:42:34.133Z
D.W.
<p>This other stackexchange answer and this blog post might be very helpful to get a quick feel of a basic example,</p>

<ul>
<li><p><a href="https://physics.stackexchange.com/questions/73424/deriving-entanglement-entropy-from-renyi-entropy">https://physics.stackexchange.com/questions/73424/deriving-entanglement-entropy-from-renyi-entropy</a></p></li>
<li><p><a href="https://johncarlosbaez.wordpress.com/2011/02/10/rnyi-entropy-and-free-energy/" rel="nofollow noreferrer">https://johncarlosbaez.wordpress.com/2011/02/10/rnyi-entropy-and-free-energy/</a></p></li>
</ul>

<p>Roughly speaking Renyi entropies know about the excited states of a quantum system but the entanglement entropy knows about the ground states. WARNING: This intuition could be terribly crude but might just be a good "mental hook" :D I would be VERY happy to know of a better and precise way to say this! </p>

<p>One can think of calculating the entanglement entropy $S_1$ (which is a more physical quantity) as the singular limit of calculating the Renyi entropies ($S_q$ for each $q \in \mathbb{Z}^+$). But this limit $S_1 = limit_{q \rightarrow 1} S_q$ is terribly badly defined. So often the idea is that one can calculate $S_q$ at an arbitrary integer value and then do an analytic continuation of that to $q \in \mathbb{R}$ and then try to define taking of the $ q \rightarrow 1$ limit. (though always $q \in \mathbb{R}$, this I call "analytic" continuation because often enough one needs to do the interpolation via contours in the complex plane - and the continuation can depend on what contours one chooses through the poles and branch-cuts of the $S_q$ that one started with) </p>

<p>At integral values of $q&gt;1$ typically there is a always a very well-defined construction in terms of some integration of some function on some $q-$branched manifold. After one has done such an integration one happily forgets about the manifold used and just tries to do the analytic continuation parametrically in the variable $q$. </p>

<p>There are always a lot of issues about existence and well-posedness when one tries to do these anayltic continuations - but for someone like me who is brought up on a daily diet of Feynman path-integrals its a very common issue to deal with and we have a lot of tools to address these. Three nice papers to look into for these issues are, <a href="http://arxiv.org/pdf/1306.5242.pdf" rel="nofollow noreferrer">http://arxiv.org/pdf/1306.5242.pdf</a>, <a href="http://arxiv.org/pdf/1402.5396.pdf" rel="nofollow noreferrer">http://arxiv.org/pdf/1402.5396.pdf</a>, <a href="http://arxiv.org/pdf/1303.7221.pdf" rel="nofollow noreferrer">http://arxiv.org/pdf/1303.7221.pdf</a> (the last of these papers might be an easier starting point) This presentation might also help, <a href="https://www.icts.res.in/media/uploads/Talk/Document/Tadashi_Takayanagi.pdf" rel="nofollow noreferrer">https://www.icts.res.in/media/uploads/Talk/Document/Tadashi_Takayanagi.pdf</a></p>

<p>What Renyi entropy says in terms of quantum complexity theory might be an exciting question! Can one think of the Renyi index as somehow parameterizing a hierarchy of complexity classes? That should be fun if true! Do let me know :) </p>

CC BY-SA 3.0
2015-04-05T20:56:05.980Z
2015-04-05T21:38:21.640Z
2017-04-13T12:40:17.207Z
Student
<p>Renyi entropy has found its way into definitions of <em>quantitative information flow</em>, an area or security research. See <a href="https://users.cs.fiu.edu/~smithg/LICS15.pdf" rel="nofollow noreferrer">G. Smith's survey paper</a>.</p>

CC BY-SA 4.0
2018-07-13T09:44:27.050Z
2018-07-13T09:44:27.050Z
Kai
<p>Consider trying to make atomic guesses for an unknown random variable $X$ distributed over some finite set $A.$ In Shannon entropy, it is assumed that you can query bit by bit, i.e., if $A=\{1,\ldots,N\}$ you can ask: </p>

<p><strong>Is $X\in \{1,\ldots,N/2\}$ ?</strong> (assume $N$ even or use floor/ceiling functions)</p>

<p>In crypto and some decoding scenarios this is not realistic. Trying to guess an unknown pasword you need to make atomic queries, i.e. query if $X$ is a specific value.</p>

<p>It turns out that the expected number of queries to guess a random variable $X$ then depends tightly on the Renyi entropy of order $1/2.$ So do some higher moments. For example</p>

<p>$$E[G]\leq \frac{(\sum_{x \in A} P_X(x)^{1/2})^2}{2}$$</p>

<p>and the numerator is essentially the logarithm of Renyi entropy of order $1/2.$ One can also make Shannon entropy very large while Renyi entropy and expectation of the number of guesses is very small. If you relied on Shannon entropy for security you'd be in trouble in that case.</p>

<p>Please also see the related question <a href="https://cstheory.stackexchange.com/questions/12892/guessing-a-low-entropy-value-in-multiple-attempts?rq=1">Guessing a low entropy value in multiple attempts</a></p>

<p>Some references:</p>

<ol>
<li>J. O. Pliam, On the Incomparability of Entropy and Marginal Guesswork in Brute-Force Attacks. INDOCRYPT 2000: 67-79</li>
<li>E. Arikan, An inequality on guessing and its application to sequential decoding. IEEE Transactions on Information Theory 42(1): 99-105,1996.</li>
<li>S. Boztas, On Renyi entropies and their applications to guessing attacks in cryptography, IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences 97(12):2542-2548, 2014.</li>
</ol>

CC BY-SA 3.0
2015-06-23T00:11:26.897Z
I am unable to access this S.Boztas paper. You have a publicly accessible link?
Student
CC BY-SA 3.0
2015-06-23T12:48:11.203Z
@Anirbit see the RMIT research repository, http://researchbank.rmit.edu.au/
kodlu
CC BY-SA 3.0
2015-06-23T22:23:22.613Z
I have searched through that link. It only took me in circles. I never found a publicly accessible pdf file!
Student
CC BY-SA 3.0
2015-06-24T07:37:56.297Z
@Anirbit, sorry, I thought it was really deposited there!
kodlu
CC BY-SA 3.0
2015-04-06T00:33:48.110Z
2015-04-06T00:33:48.110Z
2017-04-13T12:32:28.117Z
kodlu
<p>Most of us are familiar with &mdash; or at least have heard of &mdash; the Shannon entropy of a random variable, $H(X) = -\mathbb{E} \bigl[ \log p(X)\bigr]$, and all the related information-theoretic measures such as relative entropy, mutual information, and so on. There are a few other measures of entropy that are commonly used in theoretical computer science and information theory, such as the min-entropy of a random variable.</p>

<p>I've started seeing these <a href="http://en.wikipedia.org/wiki/R%C3%A9nyi_entropy">so-called Renyi entropies</a> more often as I browse the literature. They generalize the Shannon entropy and the min-entropy, and in fact provide a whole spectrum of entropic measures of a random variable. 
I work mostly in the area of quantum information, where the quantum version of Renyi entropy is also considered quite often. </p>

<p>What I don't really understand is why they are useful. I've heard that oftentimes they're easier to work with analytically than say Shannon/von Neumann entropy or min-entropy. But they also can be related back to Shannon entropy/min-entropy, as well.</p>

<p>Can anyone provide examples (classical or quantum) of when using Renyi entropies is "the right thing to do"? What I'm looking for is some "mental hook" or "template" for knowing when I might want to use Renyi entropies.</p>

<p>Thanks!</p>

CC BY-SA 3.0
2015-04-09T20:37:18.163Z
Addendum to my answer : It seem that there is a probabilistic definition of q-Renyi entropy ($q \in \mathbb{Z}^+$) i,e $H_q (\{ p_i \}_{i=1}^n )= \frac{1}{1-q} ln [ \sum_{k=1}^n p_k^q ]$. Then $lim_{q \rightarrow 1} H_q = - \sum p_k ln (p_k)$ and this RHS is called the ``Shannon Entropy". One also defines the other limit i.e $H_{\infty}  (X) = ln [\frac{1}{ max_{a} Pr[X=a]} ]$.  These ideas seem to have found uses in expander construction as seen here, math.rutgers.edu/~sk1233/courses/topics-S13, math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/CRVW01/crvw01.pdf , arxiv.org/pdf/math/0406038.pdf
Student
<it.information-theory><quantum-information>
The utility of Renyi entropies?
Henry Yuen
# The utility of Renyi entropies?

(Asked by: username_0 on 2015-04-05)

Most of us are familiar with — or at least have heard of — the Shannon entropy of a random variable, $H(X) = -\mathbb{E} \bigl[ \log p(X)\bigr]$, and all the related information-theoretic measures such as relative entropy, mutual information, and so on. There are a few other measures of entropy that are commonly used in theoretical computer science and information theory, such as the min-entropy of a random variable.

I've started seeing these [so-called Renyi entropies](http://en.wikipedia.org/wiki/R%C3%A9nyi_entropy) more often as I browse the literature. They generalize the Shannon entropy and the min-entropy, and in fact provide a whole spectrum of entropic measures of a random variable.
I work mostly in the area of quantum information, where the quantum version of Renyi entropy is also considered quite often.

What I don't really understand is why they are useful. I've heard that oftentimes they're easier to work with analytically than say Shannon/von Neumann entropy or min-entropy. But they also can be related back to Shannon entropy/min-entropy, as well.

Can anyone provide examples (classical or quantum) of when using Renyi entropies is "the right thing to do"? What I'm looking for is some "mental hook" or "template" for knowing when I might want to use Renyi entropies.

Thanks!

**Tags:** it.information-theory, quantum-information

> **Comments:**
> **username_1**: Addendum to my answer : It seem that there is a probabilistic definition of q-Renyi entropy ($q \in \mathbb{Z}^+$) i,e $H_q (\{ p_i \}_{i=1}^n )= \frac{1}{1-q} ln [ \sum_{k=1}^n p_k^q ]$. Then $lim_{q \rightarrow 1} H_q = - \sum p_k ln (p_k)$ and this RHS is called the ``Shannon Entropy". One also defines the other limit i.e $H_{\infty}  (X) = ln [\frac{1}{ max_{a} Pr[X=a]} ]$.  These ideas seem to have found uses in expander construction as seen here, math.rutgers.edu/~sk1233/courses/topics-S13, math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/CRVW01/crvw01.pdf , arxiv.org/pdf/math/0406038.pdf  

---

## 5 answers

### Answer by username_4 on 2015-04-06. Score: 16 | Accepted answer

Consider trying to make atomic guesses for an unknown random variable $X$ distributed over some finite set $A.$ In Shannon entropy, it is assumed that you can query bit by bit, i.e., if $A=\{1,\ldots,N\}$ you can ask:

**Is $X\in \{1,\ldots,N/2\}$ ?** (assume $N$ even or use floor/ceiling functions)

In crypto and some decoding scenarios this is not realistic. Trying to guess an unknown pasword you need to make atomic queries, i.e. query if $X$ is a specific value.

It turns out that the expected number of queries to guess a random variable $X$ then depends tightly on the Renyi entropy of order $1/2.$ So do some higher moments. For example

$$E[G]\leq \frac{(\sum\_{x \in A} P\_X(x)^{1/2})^2}{2}$$

and the numerator is essentially the logarithm of Renyi entropy of order $1/2.$ One can also make Shannon entropy very large while Renyi entropy and expectation of the number of guesses is very small. If you relied on Shannon entropy for security you'd be in trouble in that case.

Please also see the related question [Guessing a low entropy value in multiple attempts](https://cstheory.stackexchange.com/questions/12892/guessing-a-low-entropy-value-in-multiple-attempts?rq=1)

Some references:

1. J. O. Pliam, On the Incomparability of Entropy and Marginal Guesswork in Brute-Force Attacks. INDOCRYPT 2000: 67-79
2. E. Arikan, An inequality on guessing and its application to sequential decoding. IEEE Transactions on Information Theory 42(1): 99-105,1996.
3. S. Boztas, On Renyi entropies and their applications to guessing attacks in cryptography, IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences 97(12):2542-2548, 2014.

> **Comments:**
> **username_1**: I am unable to access this S.Boztas paper. You have a publicly accessible link?  
> **username_4**: @Anirbit see the RMIT research repository, http://researchbank.rmit.edu.au/  
> **username_1**: I have searched through that link. It only took me in circles. I never found a publicly accessible pdf file!  
> **username_4**: @Anirbit, sorry, I thought it was really deposited there!  

---

### Answer by username_2 on 2015-04-07. Score: 20

Renyi entropy is analogous, in some sense, to $\ell\_p$-norms, so let's first recall why those norms are useful.

Suppose we have a vector of numbers $a \in \mathbb{R}^n$. We want to have a single number that represents, in some sense, how does the typical element of $a$ look like.

One way to do so is to take the average of the numbers in $a$, which roughly corresponds to the $\ell\_1$ norm: $\mathbb{E}\_{1 \le i \le n}[|a\_i|]$. This is often useful, but for some applications it has the following problems: First, the $\ell\_1$ norm does not give us a good upper bound on the largest element of $a$, because if there is a single large element and many zeroes, the $\ell\_1$ norm will be significantly smaller than the largest element. On the other hand, the $\ell\_1$ norm also does not give us a good bound on how small the elements of $a$ are, for example, how many zeroes $a$ has - this problem occurs in exactly the same scenario as before.

Of course, when the elements of $a$ have a lot of variance, such as in the extreme scenario as above, no single number can give solve both problems above. We have a tradeoff. For example, if we only want to know the largest element, we can use the $\ell\_\infty$ norm, but then we will lose all information about the smaller elements. If we want the number of zeroes, we can look at the $\ell\_0$ norm, which is just the size of the support of $a$.

Now, the reason for considering $\ell\_p$ norms is that they give us the whole continuous tradeoff between the two extremes. If we want more information on the large elements we take $p$ to be larger, and vice versa.

Same goes for Renyi entropies: Shanon's entropy is like $\ell\_1$ norm - it tells us something about the "typical" probability of an element, but nothing about the variance or the extremes. The min-entropy gives us information on the element with the largest probability, but loses all information about the rest. The support size gives the other extreme. The Renyi entropies give us a continuous tradeoff between the two extremes.

For example, many times the Renyi-2 entropy is useful because it is on the one hand close to Shanon's entropy, and thus contains information on all the elements on the distribution, and on the other hand gives more information on the elements with the largest probability. In particular, it is known that bounds on the Renyi-2 entropy gives bounds on the min-entropy, see, e.g., Appendix A here: <http://people.seas.harvard.edu/~salil/research/conductors-prelim.ps>


---

### Answer by username_3 on 2015-04-06. Score: 11

Renyi entropy (of order 2) is useful in cryptography for analyzing the probability of collisions.

Recall that the Renyi entropy of order 2 of a random variable $X$ is given by

$$H\_2(X) = - \log\_2 \sum\_x \Pr[X=x]^2.$$

It turns out that $H\_2(X)$ lets us measure of the probability that two values drawn i.i.d. according to the distribution of $X$ happen to be the same ("collide"): this probability is exactly $2^{-H\_2(X)}$. After drawing $n$ times from this distribution, the expected number of collisions among these $n$ draws is $C(n,2) 2^{-H\_2(X)}$.

These facts are useful in cryptography, where collisions can sometimes be problematic and enable attacks.

For some analysis of other uses in cryptography, I recommend the following PhD dissertation:

Christian Cachin. [Entropy Measures and Unconditional Security in
Cryptography](http://www.zurich.ibm.com/~cca/papers/d.pdf). PhD dissertation, ETH Zurich, May 1997.

> **Comments:**
> **username_1**: Is there such a direct probabilistic definition of any q-Renyi entropy? (as you can see from my answer, the only way I know of defining this at arbitrary q is via defining partition functions corresponding to a physical system which has been specified via its Lagrangian or Hamiltonian or its action)  
> **username_3**: @Anirbit, I don't konw.  None that I recall seeing (though it's possible q-Renyi entropy might lead to bounds on other bounds we care about...)  
> **username_1**: Also it seems that "information entropy" seems to be basically the "thermodynamic entropy". So even at (q=1)-Renyi entropy i.e entanglement entropy there is a conceptual gap about the complexity interpretation of it?  
> **username_4**: @username_3:Nice answer, I neglected to include this case: indeed it seems that Renyi entropies of various orders are connected with different cryptographic scenarios, including for example the min-entropy (which corresponds to the Renyi parameter approaching $-\infty$) which plays a part in randomness extraction.  
> **username_1**: @username_3 There seems to be a probabilistic interpretation. Do see my comment on the original question.  

---

### Answer by username_1 on 2015-04-05. Score: 4

This other stackexchange answer and this blog post might be very helpful to get a quick feel of a basic example,

* <https://physics.stackexchange.com/questions/73424/deriving-entanglement-entropy-from-renyi-entropy>
* <https://johncarlosbaez.wordpress.com/2011/02/10/rnyi-entropy-and-free-energy/>

Roughly speaking Renyi entropies know about the excited states of a quantum system but the entanglement entropy knows about the ground states. WARNING: This intuition could be terribly crude but might just be a good "mental hook" :D I would be VERY happy to know of a better and precise way to say this!

One can think of calculating the entanglement entropy $S\_1$ (which is a more physical quantity) as the singular limit of calculating the Renyi entropies ($S\_q$ for each $q \in \mathbb{Z}^+$). But this limit $S\_1 = limit\_{q \rightarrow 1} S\_q$ is terribly badly defined. So often the idea is that one can calculate $S\_q$ at an arbitrary integer value and then do an analytic continuation of that to $q \in \mathbb{R}$ and then try to define taking of the $ q \rightarrow 1$ limit. (though always $q \in \mathbb{R}$, this I call "analytic" continuation because often enough one needs to do the interpolation via contours in the complex plane - and the continuation can depend on what contours one chooses through the poles and branch-cuts of the $S\_q$ that one started with)

At integral values of $q>1$ typically there is a always a very well-defined construction in terms of some integration of some function on some $q-$branched manifold. After one has done such an integration one happily forgets about the manifold used and just tries to do the analytic continuation parametrically in the variable $q$.

There are always a lot of issues about existence and well-posedness when one tries to do these anayltic continuations - but for someone like me who is brought up on a daily diet of Feynman path-integrals its a very common issue to deal with and we have a lot of tools to address these. Three nice papers to look into for these issues are, <http://arxiv.org/pdf/1306.5242.pdf>, <http://arxiv.org/pdf/1402.5396.pdf>, <http://arxiv.org/pdf/1303.7221.pdf> (the last of these papers might be an easier starting point) This presentation might also help, <https://www.icts.res.in/media/uploads/Talk/Document/Tadashi_Takayanagi.pdf>

What Renyi entropy says in terms of quantum complexity theory might be an exciting question! Can one think of the Renyi index as somehow parameterizing a hierarchy of complexity classes? That should be fun if true! Do let me know :)


---

### Answer by username_5 on 2018-07-13. Score: 0

Renyi entropy has found its way into definitions of *quantitative information flow*, an area or security research. See [G. Smith's survey paper](https://users.cs.fiu.edu/~smithg/LICS15.pdf).


---

