Quantum Error Correction in the Black Hole Interior

We study the quantum error correction properties of the black hole interior in a toy model for an evaporating black hole: Jackiw-Teitelboim gravity entangled with a non-gravitational bath. After the Page time, the black hole interior degrees of freedom in this system are encoded in the bath Hilbert space. We use the gravitational path integral to show that the interior density matrix is correctable against the action of quantum operations on the bath which (i) do not have prior access to details of the black hole microstates, and (ii) do not have a large, negative coherent information with respect to the maximally mixed state on the bath, with the lower bound controlled by the black hole entropy and code subspace dimension. Thus, the encoding of the black hole interior in the radiation is robust against generic, low-rank quantum operations. For erasure errors, gravity comes within an $O(1)$ distance of saturating the Singleton bound on the tolerance of error correcting codes. For typical errors in the bath to corrupt the interior, they must have a rank that is a large multiple of the bath Hilbert space dimension, with the precise coefficient set by the black hole entropy and code subspace dimension.


Introduction
In the AdS/CFT correspondence, where a precise non-perturbative definition of quantum gravity exists [1,2], one of the most basic objects is the bulk-to-boundary map V in the large N and large t'Hooft coupling limit [3][4][5][6]. In this limit, the bulk description is well approximated by semi-classical supergravity, and the bulk-to-boundary map V embeds bulk semi-classical states into the Hilbert space H CFT of the dual, strongly coupled, quantum mechanical theory. The bulk semi-classical states in question are essentially comprised of effective field theory (EFT) excitations of bounded energy density around some chosen gravitational background g, which we can arrange in the form of a bulk EFT Hilbert space H g bulk EFT . Two decades of work have explored aspects of this embedding of the bulk gravity EFT in the boundary CFT. One of the most mysterious aspects of the map is the emergence of locality in the bulk low-energy theory, especially in regions causally hidden behind horizons.
Some fundamental properties of the map V , such as the redundancy of bulk operator representations and radial locality, are most naturally understood by realizing that the embedding has the structure of a quantum error correcting code [7][8][9]. In the quantum error correction (QEC) language, states in the bulk effective field theory around the gravitational background g are often referred to as the code subspace H code ⊂ H CFT [10]. The code subspace is intuitively the subspace of states in the full Hilbert space H CFT upon which a bulk local EFT operator may be represented, and states outside the code subspace are interpreted as having lost access to the operator either due to absorption by a large black hole or a more fundamental breakdown of the emergent background metric g [11]. Quantum error correction in this holographic context means that the representation on a boundary subregion A of bulk operators within a corresponding bulk subregion enclosed between A and the quantum extremal surface (QES) for A -called the "entanglement wedge" W(A) -is robust against the erasure of the complementary subregion A [12]. Equivalently, the state of bulk quantum fields in the region W(A) is "encoded" in the boundary subregion A, and is protected from any and all "errors", i.e., operator actions, on A. Conversely operators in the entanglement wedge W(A) can be reconstructed entirely from data in A. This modernization of the bulkto-boundary map is referred to as entanglement wedge reconstruction (EWR).
The EWR paradigm has provided a powerful framework for bringing tools from quantum information theory to bear on problems in quantum gravity. For instance, EWR played an important role in recent progress on the black hole information problem [13][14][15][16][17]. These papers studied an asymptotically AdS 2 evaporating black hole coupled to a non-gravitational bath, where the bath serves as a reservoir to collect the Hawking radiation (Fig. 1). In this context, if one computes the von Neumann entropy of the bath past the Page time, the semi-classical description involves a new quantum extremal surface that develops in the black hole interior and cuts off the naive growth of the entropy, reproducing the expected Page curve. Crucially, the EWR paradigm in this context implies that the region in the black hole interior enclosed by this new QES -the so called "island" -is encoded in the bath, and thus bulk operators in the island can be represented as operators on the bath. Indeed, it was shown in [16] that The dual semi-classical description is that of an evaporating black hole coupled to a bath. Past the Page time, there is a new Quantum Extremal Surface (black dot) relevant for the entropy of the bath, and the region in the black hole interior enclosed by it to its left is called the "island". a general tool from the theory of quantum error correction called the Petz map can be used to give an explicit reconstruction of operators in the black hole interior. This is a surprising and radical claim -the bath need not be a conventional, strongly coupled holographic quantum field theory, and could be a free field theory, for instance. Yet, it can encode semi-classical supergravity degrees of freedom in the same sense as holographic duality, i.e., a portion of the bath is dual to, or an equivalent description of, the gravity degrees of freedom in a distant part of space. In an evaporating black hole, this would appear to be at odds with the semi-classical causal structure of the black hole spacetime, as the encoded island lies behind the horizon. However, this encoding should be fundamentally different from the standard bulk-boundary map in holographic dualities: we expect it to be exponentially complex in the black hole entropy, i.e, implementing this encoding with a quantum computer should be exponentially complex in N , explaining why simple observables give the appearance of information loss in Hawking radiation. By contrast, the standard encodings of EFT excitations in regions of AdS space that are causally accessible from the boundary only have polynomial complexity since the reconstruction just involves solving equations of motion [3,5,6]. Note that for entanglement wedges of a strongly coupled theory which include a "Python's Lunch", which we will discuss below, the encoding map is also expected to be highly complex since the main source of reconstructive power is entanglement between gravitational degrees of freedom.
correcting structure of the code in the Hawking radiation for the interior of the black hole [18]. In this paper, Kim, Preskill and Tang (KPT) suggested that the bulk degrees of freedom in the black hole interior are encoded in the radiation with robust QEC properties -more so than the usual QEC familiar in encoding of "causal wedges", i.e., regions causally connected to the spacetime boundary in AdS/CFT. In particular, they found (in a model for black hole evaporation) that despite the fact that the "island" region in the black hole interior is encoded in the early Hawking radiation, this encoding is protected in the QEC sense from all "low-complexity" and "low-rank" errors on the early radiation as long as the remaining black hole is macroscopic. Here an "error" is any quantum operation that acts on the radiation. This is very different from the standard statement of QEC in AdS/CFT where the bulk entanglement wedge W(A) is protected from errors in A, but not in general from errors on A itself. KPT further argued that this robust error correction has an important bearing on the apparent tension between islands and the semi-classical causal structure of the black hole -all low complexity quantum operations on the bath commute with the representations in the bath of bulk operators in the black hole interior. Thus, in order to affect the black hole interior explicitly, an observer in the bath will have to perform an exponentially complex operation. Crucial to the analysis of KPT was an assumption that the reduced state on the bath/radiation is pseudorandom, i.e., cannot be reliably distinguished from the maximally mixed state (more generally, the thermal ensemble) with a polynomial complexity quantum operation; complexity theory enters their arguments through this assumption.
The main purpose of our work is to study these novel quantum error correction properties of the encoding of the black hole interior in Hawking radiation. Instead of using the KPT pseudorandomness assumption, we will directly study the QEC properties in a toy model for an evaporating black hole in Jackiw-Teitelboim (JT) gravity using the Euclidean gravity path integral. We will show that in this setting the bulk density matrix in the interior is approximately recoverable from the action of quantum operations on the bath which (i) do not have prior access to the details of the black hole microstates and their overlaps, and (ii) do not have a large, negative "coherent information" -an information theoretic measure of the amount of noise a quantum operation generates -with respect to the maximally mixed state on the bath (which we may interpret as the "semi-classical state" of the radiation, i.e., the analog of Hawking's thermal state). The lower bound on the coherent information is controlled by the black hole entropy and code subspace dimension. This implies that the encoding of the black hole interior in the radiation is robust against generic, low-rank quantum operations on the bath which do not have access to details of the black hole microstate, thus providing a gravitational perspective on the results of KPT. Furthermore, for erasure errors on the bath, we show that gravity comes within an O(1) distance of saturating the quantum Singleton bound on the error tolerance of quantum error correcting codes. We also show that typical errors on the bath must have a large rank compared to the product of the black hole Hilbert space and bath Hilbert space dimensions in order to affect the interior. We comment on the interpretation of our coherent information criterion in light of an unusual non-isometry property of the interior encoding map that we describe.
While our analysis here is limited to the specific example of the black hole interior, we propose that even for a more general entanglement wedge W (A) dual to a CFT subregion A, the encoding of semi-classical degrees of freedom in the python's lunch [19][20][21] (i.e., the part hidden behind a non-minimal QES) should be robust against generic, low-rank errors on the boundary subregion A. By "generic", we mean quantum operations which do not have prior access to the details of the encoding map. Note that such robust error correction properties certainly do not hold in the causal wedge. Indeed, after the Page time the black hole interior is in the python's lunch because it is hidden behind a non-minimal QES, namely the empty surface. Finally, we discuss implications of our results for the consistency of the island program for black hole information recovery [13][14][15][16][17] with the semi-classical causal structure of evaporating black hole spacetimes.
Four sections follow. In Sec. 2, we review necessary ideas from quantum error correction as well as the toy model of black hole evaporation which serves as our primary example. In Sec. 3, we apply QEC tools to the toy model and, using the gravitational path integral, derive our criterion for correctable errors on the black hole interior code subspace. Euclidean wormholes play a key role in the action of errors on the encoded state which are not correctable. We also discuss the non-isometric nature of the interior encoding. In Sec. 4 we present a detailed analysis of erasure errors and typical/random, fixed-rank errors. We conclude with a discussion of generalization to other entanglement wedges and implications for the semi-classical causal structure of the evaporating black hole spacetime in Sec. 5.

Preliminaries
In this section, we review background material on quantum error correction, following [22], and the toy model of black hole evaporation [16] which we will use in later sections. The material in this section is not new, but is included here to keep the article somewhat selfcontained.

Conditions for quantum error correction
Let H code denote the code subspace, and let {|i } d i=1 be a basis of states for H code . Furthermore, let H phys be a larger Hilbert space in which we wish to encode H code , via the isometric encoding map: Thus V V † projects the physical Hilbert onto encoding of the code subspace in the physical degrees of freedom. The general theory of quantum error correction deals with recovering the encoded state from the physical system after the action of quantum operations, which can potentially create "errors" in the encoding. Errors in the physical system can be modelled by the action of a quantum channel E which is a linear, completely positive 1 and trace preserving map which takes a state (i.e., a density matrix 2 ) on H phys to another state on H phys .
The action of a general quantum channel can always be expressed in terms of its Kraus operators {E m }: where requiring E to be trace preserving implies The minimum number of Kraus operators necessary to implement E is sometimes called the (Kraus) rank of the channel, and could be regarded as measure of how complex a channel is. 3 Another particularly useful fact is that the action of any quantum channel E on a state ρ can be modeled by a unitary operation on an enlarged Hilbert space that includes an auxiliary environment. In detail, introduce an environment H env spanned by {|e m } in some initial 1 All operations of the form E(ρ) = m EmρE † m are completely positive. Complete positivity of E means (1E ⊗ E)(A) ≥ 0 for any positive A ≥ 0 which acts on the extended system HE ⊗ H phys . For any |ψ E,phys , we define |φm E,phys = (1E ⊗ E † m )|ψ E,phys . By A ≥ 0 we have φm|A|φm ≥ 0. Summing over m, we find the action of 1E ⊗ E on A: The middle expression is nothing but ψ|(1E ⊗ E)(A)|ψ , and we have shown it is non-negative for any |ψ , so we have (1E ⊗ E)(A) ≥ 0. These conditions guarantee in our setting that density matrices on the system plus the environment are mapped to density matrices. 2 In our notation, we will refer to both pure states |ψ and density matrices ρ as "states". 3 Obviously, the rank is not related to the circuit complexity of the channel since a channel of rank 1 has a single unitary Kraus operator which can have arbitrary circuit complexity.
state |e 0 . Then act on the enlarged state ρ ⊗ |e 0 e 0 | ∈ H phys ⊗ H env with a unitary operator U E , and trace out the environment to get where E m = e m |U E |e 0 , i.e., U E |ψ ⊗|e 0 = m E m |ψ ⊗|e m . This expression of the channel E as the trace over an environment after conjugation by a unitary U E will be referred to as the isometric extension (sometimes also called the Stinespring dilation) of E. It is a way of representing a quantum channel as an open system.
We say that an error E can be corrected on H code if there exists a recovery channel R such that R(E(ρ)) = ρ, (2.5) for any density matrix ρ supported on H code , or more precisely, supported on the image of the code subspace inside the physical Hilbert space under V . One of the central results of the theory of quantum error correction is that the channel E is exactly correctable if and only if it satisfies the "Knill-Laflamme" conditions [22]: where P code = V V † is the projector onto the code subspace. The projection, trace preservation, and positivity properties of the operators on the left hand side of (2.6) imply that α is actually a density matrix on H env .
It is useful to restate this criterion in a different form. We introduce a reference system with a Hilbert space H ref isomorphic to the code Hilbert space and construct the state where |Ψ i phys = V |i code are the basis states of the code subspace of the physical Hilbert space. The state |Ψ can be thought of as the action of the error channel on a state that is maximally entangled between the code subspace and an auxiliary reference system, and is engineered so that its entanglement properties are related to the validity of (2.6). where the reduced density matrices above are defined as ρ ref,env = Tr phys |Ψ Ψ | and so on. This is called the decoupling principle [24].
We can diagnose decoupling by computing the mutual information: where each term on right hand side is the entropy of the reduced density matrix on the indicated factor. This mutual information vanishes if and only if the decoupling principle holds. The decoupling principle also generalizes to approximate quantum error correction [25]. For instance, we will often be interested in cases where the above mutual information is not strictly zero, but small (i.e., exponentially small in the black hole entropy). In such a situation, the mutual information gives a bound on the decoupling: where ||A|| 1 = Tr √ A † A is the trace norm. This in turn implies that the error channel is approximately correctable [18], i.e., there exists a recovery channel R such that where the maximization is over all states supported on the code subspace.
Using the decoupling principle, we can derive a simple bound on the number of maximal errors, i.e., erasures, a code can tolerate while remaining correctable. Let t−1 be the maximum number of qubits in the physical Hilbert space on which we can tolerate errors. Let d be the dimension of the code space and let 2 S be the dimension of the physical Hilbert space. Partition the physical Hilbert space into three subsets: Q 1 and Q 2 with (t − 1) qubits each and Q 3 with the remaining (S − 2t + 2) qubits. Now consider the state Since both Q 1 and Q 2 have less than t qubits each, we can, by definition, tolerate errors on these subsystems. For instance, we could bring in (t − 1) environment qubits and swap the state on Q 1 or Q 2 with the environment. For such operations to be correctable, by the decoupling principle there must be no correlations after the swap between the environment and the reference. This in turn means that the initial state cannot have correlations between the qubits in Q 1 and the reference, and similarly for Q 2 . Using this fact, we get where all the entropies refer to the state |χ , and we have used the subadditivity of entropy in the last step of each inequality. The second equality follows because the entropy of a subsystem of a pure state equals the entropy of its complement. Adding these inequalities gives where we used the fact that the reference state is maximally entangled with the code subspace and so S(ref) = log 2 d while the S(Q 3 ) is bounded from above by the number of qubits in Q 3 , namely (S − 2t + 2). This last inequality is known as the quantum Singleton bound.
Subsystem QEC condition: We will be interested in a setting where the code subspace has a natural tensor factorization H code = H a ⊗ H a . In the black hole case this will correspond to factorization of some subset of the bulk quantum field theory degrees of freedom between the interior and the exterior of the black hole. With this additional structure, we can define a more general version of error correction [26,27], which, following [10], we will refer to as "subsystem quantum error correction". We say that the state on H a is recoverable under the error E if, for any density matrix ρ supported on H a and any density matrix σ supported on H a , there exists a recovery channel R such that for some density matrix σ on H a . We again have in mind that the density matrix on the left hand side has been encoded in H phys by the map V before the action of E. In analogy with equation (2.6) the channel E is correctable on H a if and only if where P code is the projector onto the code subspace, and B mn are some operators with support only on H a [26,27] .
Following [27], it is useful to restate this criterion in the form of a decoupling principle. In order to do this, we once again need to introduce a reference system. Let us in fact introduce two reference systems R a and R a which have the same dimensions as H a and H a respectively. For any basis state |i, i code ≡ |i a ⊗ |i a , let |Ψ i,i phys be the image of |i, i code in H phys under the encoding map V : We now introduce a basis for the reference system |i, i ref = |i Ra ⊗|i R a , and an environment H env supporting isometric extension of the quantum channel E. In terms of these quantities we define We are now in a position to restate the condition for subsystem quantum error correction: an error E is correctable on H a if and only if the reduced state ρ corresponding to |Ψ on the subsystem H ref ⊗ H env factorizes as Equivalently, It is particularly useful to restate the QEC conditions in the form of a vanishing mutual information because it distills down the criterion to the computation of specific entanglement entropies. In AdS/CFT, the gravitational path integral can compute entanglement entropies via the replica trick. Thus, we can hope to get a handle on the error correction properties of subsystems in gravity by studying the above mutual information via the gravitational path integral. Indeed, for the black hole interior, the only way we can currently access the bulkto-boundary encoding map V is indirectly via the Euclidean path integral. In Sec. 3, our primary goal is to compute this mutual information with R a and R a being the reference systems for the interior and exterior code subspaces on an evaporating black hole background after the Page time.

PSSY model
In this section, we review a toy model for an evaporating black hole that was constructed by Penington, Shenker, Stanford and Yang (PSSY) [16]. We will use this model below. Consider an evaporating black hole in Jackiw-Teitelboim (JT) gravity with an end of the world (EOW) brane deep inside the black hole capping off the geometry, plus some propagating bulk degrees of freedom which constitute the code subspace. The Euclidean action is given by: where I field theory is a bulk effective field theory action and the JT gravity action is with the boundary conditions: The boundary condition on the the EOW brane is given by Here S 0 can be thought of as the entropy of the higher-dimensional extremal black hole for which the JT theory is the two-dimensional reduction, or it can be thought of as the ground state entropy of the JT system.
The EOW brane hosts semi-classical, intrinsic degrees of freedom, which we label by Greek letters, α, β etc., running from 1 to k. These intrinsic EOW brane states are taken to be orthogonal in the bulk semi-classical description i.e., these indices along the brane are contracted with the propagator δ αβ . We think of these states as arising from some sort of theory living on the brane, or alternatively as a flavor index for the brane which must be conserved along the worldline to ensure orthogonality. The JT gravity black hole describes the semi-classical bulk dual to an excited state in a holographic quantum mechanical system, which we label B. More precisely, JT gravity describes an ensemble average over the Hamiltonian of the dual quantum mechanical system B [28]; in this context, the EOW brane states correspond to effectively random superpositions of energy eigenstates, 4 with the coefficients chosen from a Gaussian ensemble with zero mean and unit variance [16].
In order to model an evaporating scenario, we entangle this system (B) with a quantum mechanical radiation system (R): where |ψ α i B is a state in the quantum system B whose semi-classical bulk dual consists of the black hole, including an EOW brane with its intrinsic degrees of freedom in the state α, and the bulk code subspace fields in the code basis state i (i = 1, ..., d). Note that the entanglement is mediated by the EOW brane degrees of freedom, and not by the code subspace states. We will choose the code subspace to consist of simple, qubit-like excitations in the effective field theory, as will be explained below. The strategy is to treat this one-parameter family (labelled by k) of entangled states as snapshots of an AdS black hole evaporating into a reservoir/bath, with k playing the role of time. More accurately, rather than considering an evaporating black hole per se, we maximally entangle a black hole with a fixed number of degrees of freedom with an ever larger number of radiation states and study the consequences. It was shown in [16] that as the parameter k becomes large, there is a phase transition in the entanglement entropy S(R) at k ∼ e S 0 , where S 0 is the extremal black hole entropy. The phase transition cuts off the naive growth of entropy and realizes the expected Page curve. The mechanism by which this happens in the replica trick computation of entropy involves the appearance of a new gravitational saddle, i.e., the replica wormhole, which makes the dominant contribution past the Page point [16].

Quantum error correction behind the horizon
We now come to the first main goal of this paper, which is to apply equation (2.22) to the black hole interior in the PSSY toy model for an evaporating black hole. Following PSSY, we consider a black hole entangled with radiation past the Page time: The physical Hilbert space is H phys = H B ⊗H R , where B is the microscopic quantum mechanical system describing the black hole, and R is the Hilbert space of the radiation bath which absorbs the Hawking radiation. Loosely speaking, our code subspace will be the Hilbert space of bulk quantum field theory excitations on the black hole background, but we will specify it more precisely below. We will take this Hilbert space to factorize as i.e., it is a tensor product of the degrees of freedom in the black hole interior times degrees of freedom in the black hole exterior. Let {|i int } be an orthonormal basis spanning the interior Hilbert space H int and let {|i ext } be an orthonormal basis spanning the exterior Hilbert space H ext . As before, there is a basis for H code given by |i, i code = |i int ⊗ |i ext . We view this system as a quantum error correcting code: Corresponding to a basis state |i, i code ∈ H code , we have an image under the encoding in the physical Hilbert space: given by where |ψ α i,i B is a state in the Hilbert space of the CFT dual to the black hole whose corresponding bulk geometry has an EOW brane in the internal state α and bulk quantum fields in the state |i, i code . Thus, the encoding map leads to a representation of the code state as an excitation around a particular evaporating black hole (entangled with the radiation bath), which has a universal coarse description as a gravitating geometry, and a dual microscopic CFT representation. Past the Page time, the quantum extremal surface for the radiation bath lies at the bifurcation point in the black hole geometry, so that by the general entanglement wedge reconstruction paradigm, we expect the factor of the code subspace associated to the interior of the black hole to be encoded within the radiation Hilbert space.
Formally, the state |ψ α i,i B can be constructed in the boundary CFT via a Euclidean path integral with sources turned on, corresponding to asymptotic boundary conditions for the bulk quantum fields (Fig. 2). In Sec. 3.2, we will show that this holographic encoding map is only an isometry up to non-perturbatively small O(de −S 0 ) corrections. Therefore, we can use the error-correcting code theorems discussed in Sec. 2.1 (which strictly speaking assume isometric encoding), so long as we are considering a sufficiently small code subspace with d e S 0 .
Another subtlety involves our assumption of a factorized code subspace in (3.2). In the path integral construction of the encoding map, smooth sources producing finite energy densities will not result in states that are products between H int and H ext . Conversely, a state for bulk quantum fields that is a product between the interior and exterior will generically have large energy density near the horizon. However, we are interested in an effective field theory around the black hole background, which therefore comes equipped with a UV cutoff (much smaller than Planck scale). The Hilbert space thus does include product states between the interior and exterior, provided the excitations are separated by distances much larger than the UV cutoff scale. For instance, we could imagine constructing a qubit degree of freedom in the interior and another qubit degree of freedom in the exterior, from sufficiently localized, lowenergy operators in the effective field theory, well-separated from the horizon. Our analysis is performed in this setting. By turning on various Euclidean sources on the asymptotic boundary [29], we can at least formally construct such states |ψ α i,i B corresponding to low energy bulk modes of the effective field theory in product states |i, i code . We will ignore O(G N ) back-reaction corrections to the geometry and the state of bulk matter fields in the code subspace.
As mentioned before, past the Page time, the black hole interior is in the entanglement wedge of the radiation/bath. We will ask what type of quantum operations acting on the bath Hilbert space H R are correctable on the code subspace in the black hole interior. By correctable, we mean that we should be able to recover the reduced density matrix of bulk modes in the interior of the black hole (i.e., with support on H int ) after the action of such X X |i, i 0 i code

Coherent information criterion
The question we wish to address fits perfectly within the formalism of subsystem quantum error correction explained in the previous section. Following that logic, we model the error as a quantum channel E = {E m } which acts on the physical Hilbert space H B ⊗ H R . More precisely, we will only consider errors which act on the radiation bath Hilbert space H R , leaving H B untouched. Next, we introduce two reference systems R i and R e which have the same dimensions as H int and H ext respectively. Recall that H int and H ext are the two factors of H code . Now define the state where, following the discussion in Sec. 2.1, we have introduced another factor H env corresponding to an auxiliary environment, and the reference space is In order to determine whether the reduced density matrix of bulk quantum fields in the black hole interior is correctable under the action of E, we are instructed to compute the mutual information: The error is correctable if and only if I Ψ (R i : R e ∪ env) = 0, i.e., the corresponding density matrix factorizes as For gravity computations, it is often more convenient to consider the Rényi version of the above mutual information: More precisely, instead of computing the von Neumann entropies S vN = −Tr ρ log ρ, we compute the Rényi entropy S (n) = 1 1−n log Tr ρ n for integer values of n. The von Neumann entropies can then be obtained by analytically continuing the Rényi entropies in n and taking the limit n → 1 + . So, our goal now is to compute the above Rényi mutual information.
In order to compute the Rényi mutual information, we first compute the reduced density matrix on R i ∪ R e ∪ env by tracing out the physical Hilbert space: where N is a normalization constant. To determine the normalization constant, we take the trace of the above expression. Using equation (2.3), we get where i and i are indices in the code space and α is an index of the EOW brane state. Using the gravity description in the semi-classical limit, the overlap is computed by the geometry depicted in Fig. 3. This geometry is filling in a boundary condition which consists of two copies of Fig. 2 that are glued together to produce the overlap where Z 1 is the exponential of the on-shell gravitational action (2.24) (or beyond the semiclassical approximation, the JT gravity path integral) on a disc capped off by an EOW brane, along with the non-code-subspace bulk field theory modes in their Hartle-Hawking vacuum state. We explicitly pulled out the factor of e S 0 coming from the first term in the JT action.
Since we are ignoring the back-reaction from the effective field theory, so on the disc it simply gives the path integral overlap i, i |i, i code . Then, enforcing Tr ρ R i ,Re,env = 1 determines the normalization factor where d i and d e are the dimensions of the interior and exterior factors in the code subspace respectively. We will continue to make these contributions of the code subspace portion of the effective field theory explicit, and absorb the remainder of the bulk field theory modes into partition functions like Z 1 . Figure 3: The Euclidean black hole geometry which enters in determining the normalization factor N defined in (3.11), specifically contributing to the overlap ψ α i,i |ψ α i,i B . The red line is the EOW brane with index α, the blue line is an interior code subspace excitation with label i, and the green line is an exterior code subspace excitation with label i .

Let us now evaluate
(3.14) Here i and i are indices in the code subspace, α and β are EOW brane indices, and the m indices label Kraus operators. Notice that the reference space and auxiliary environment have disappeared here because we are taking the trace on them. It is convenient to group together all the factors pertaining to the channel E and the corresponding sums over the environment indices to define a tensor which we will call f : We can re-express the f -tensor in terms of the isometric extension of E as where in the second sum we have also inserted complete sets of radiation states γ |γ γ| R = 1 R . In terms of the f -tensor defined above, we have The light grey boxes denote U E while dark grey boxes denote U † E . Dashed blue and red internal legs denote environment and radiation indices respectively. External legs are outgoing (incoming) to denote uncontracted indices in a bra (ket). (Right) The contraction of the f -index structure with the gravitational overlaps (i.e., asymptotic boundaries), denoted with solid black lines, required to compute the sums in (3.17, 3.18). Each term in these sums involves a product of overlaps between n sets of asymptotic gravitational states. The states are defined in terms of operators acting at the asymptotic boundaries which are illustrated here as black lines. Below we will see that the gravitational path integral can fill in these boundaries in various ways that may connect them or not through a bulk geometry.
Using the isometric extension, the f -tensor can be conveniently visualized in terms of a tensor network, as shown in Fig. 4. Similarly, we get Tr ρ n Re,env = 1 k n N n i 1 ,··· ,in i 1 ,··· ,i n α 1 ··· ,αn β 1 ,··· ,βn The coefficients in these various expressions involving products of overlaps of the black hole states can be computed using the standard rules of JT gravity.
More precisely, JT gravity plus EOW branes computes an ensemble average of microscopic theories [16,28,30], but the error correction theorems we developed in Sec. 2.1, refer to single theories, not an ensemble. We can nevertheless use the JT gravity approach because, in the limit of large k and S 0 , the ensemble average is a good approximation to the typical answer since the variance is suppressed in k and e −S 0 . We must carefully to account for the various different bulk geometries which can fill in the fixed asymptotic boundary conditions. Below, we will first consider the two most important geometries, namely the fully disconnected geometry and the fully connected one; both of these preserve the Z n symmetry of the asymptotic boundary conditions. We will also argue later that at least for erasure errors, the Z n -breaking bulk geometries do not dominate, at least far from the phase transition between the two Z n -symmetric solutions. However, we do not have a general proof for all errors.

An assumption about E
In the computations that follow, we will assume the error operation E does not have prior access to black hole microstates, or more precisely, the f -tensor structure, which contains all the details of the quantum channel E, has no additional black hole microstate overlaps in it. Thus, we will only have to evaluate the products of gravitational overlaps ψ α i,i |ψ β j,j B that are explicitly written in equations (3.17), (3.18) and (3.19) using JT gravity. If the assumption were not true, then the evaluation of the f -tensor would contain additional gravitational path integrals, and we would have to account for additional geometries in JT gravity which potentially connect between the overlaps appearing explicitly in (3.17,3.18,3.19) and those contained inside the f -tensor structure. A simple example of this situation would be if the Stinespring dilation of the channel E couples an external environment qubit to the Petz operator reconstruction on the bath of a bulk operator in the black hole interior [16]. Since the Petz operator is constructed with knowledge of black hole microstates (or more precisely, with knowledge of the encoding map V ), this channel would violate our assumption. 5 Furthermore, we expect such channels to also be exponentially complex in the sense of circuit complexity. Indeed, [18] conjectured that the density matrix on the bath Hilbert space is pseudorandom, i.e., it cannot be reliably distinguished from the maximally mixed state on the bath with polynomial complexity operations. It would be interesting to better understand the interplay between this pseudorandom assumption and our assumption about the absence of microstate overlaps in E.

Fully disconnected geometry
We now turn to the evaluation of the various entropies in JT gravity. To begin we consider the fully disconnected contribution where each of the gravitational overlaps in (3.17), (3.18) Figure 5: The disconnected gravitational contribution to the Rényi entropy of R i ∪ R e ∪ env. The grey region is the gravitational geometry filling in the boundary conditions, while the red lines are EOW branes. Green and blue lines denote bulk contractions of the exterior and interior factors in the code subspace respectively. Dotted lines indicate identifying and summing over the code-subspace indices.
and (3.19) is evaluated by a separate bulk geometry. In this case, we can simply use the formula This is derived in an identical fashion to the calculation of the norm N in Fig. 3, but with the more general code subspace overlap i, i |j, j code = δ ij δ i j and EOW brane index matching yielding δ αβ . The resulting computation is diagrammed in Figs. 5 and 6, and gives Tr ρ Tr ρ n Re,env disconn.
where we have defined For example, the code subspace dimension factors in the disconnected contribution to Tr ρ n are computed by observing in Fig. 5 that there is one green index loop yielding d e , one blue index loop yielding d i , and the normalization N contributes (d i d e ) −n . The Tr σ n env contribution comes from the f -tensor with appropriate index contractions dictated by the EOW brane propagators (Kronecker deltas matching indices) in the geometry.
The contribution to the Rényi mutual information coming from the fully disconnected geometry is given by taking the logarithm of (3.21) and subtracting from it the logarithm of Figure 6: The disconnected gravitational contributions to the Rényi entropies of R e ∪ env (left) and The grey region is the gravitational geometry filling in the boundary conditions, while the red lines are EOW branes. Green and blue lines denote bulk contractions of the exterior and interior factors in the code subspace respectively.
(3.22) plus the logarithm of (3.23): Thus, when the disconnected geometry dominates the gravity path integral, the encoding of the black hole interior is robust, i.e., error channels that act only on the bath H R do not affect the encoding of the black hole interior. Of course, the mutual information is not strictly zero, because of sub-leading in e −S 0 contributions. Nevertheless, the state on the black hole interior is at least approximately correctable, i.e., there exists a recovery channel R such that where the maximization is over all density matrices supported on the code subspace. This result follows from the error correction theorems we reviewed in Sec. 2.1, specifically (2.11).

Fully connected geometry
Let us now consider the fully connected contribution. This geometry is the analog of the replica wormhole saddle. By explicit computation, one can prove that this contribution never dominates in Tr ρ n R i , and the dominant contribution is always the disconnected geometry. However, in the other two cases -i.e., Tr ρ n R i ,Re,env and Tr ρ n Re,env -the replica wormhole (Figs. 7 and 8) can become dominant, as we will see below by explicit computation. In these cases, the gravitational path integral for general n result is not easy to compute. But because we are interested in taking the n → 1 + limit we can use the procedure proposed by Lewkowycz and Maldacena [32]: (1) assume that the relevant geometries that contribute are the replica symmetric ones, (2) compute the gravitational action of the Z n quotient of these geometries (Figs. 7 and 8, as shown on the right in Fig. 7), and (3) analytically continue to n = 1 + .
Applying this procedure in the n → 1 + limit, the quotient geometry is (approximately) identical to a copy of a single Euclidean black hole, but with a conical singularity at the black hole bifurcation point, and in addition a twist operator insertion for the bulk fields which corresponds to a specific prescription for contracting the bulk code subspace indices, as shown in Figs. 7 and 8. For example, the gravitational contribution for the connected phase of Tr ρ n R i ,Re,env is computed by evaluating Fig. 7, and this gives where Z n is the exponential of the on-shell gravity action on the disk geometry with n EOW branes, times the bulk field theory path integral on this geometry. There is a similar formula for the gravitational contribution to the connected phase of Tr ρ n Re,env , with the only difference being that we get a factor of d Putting everything together, we get where φ 0 is the value of the dilaton at the bifurcation point, and s bulk is the bulk entropy for all the bulk modes in their Hartle-Hawking vacuum (i.e., those which are not excited in the code subspace). In the above formulas, we have used Z n /(Z 1 ) n ∼ e (1−n)[S 0 +(2π/β)φ 0 +s bulk ] because we are working in the approximation that (n − 1) is small and positive, where the left hand side can be evaluated semi-classically using the Lewkowycz-Maldecena method. The factors of S 0 and φ 0 come from JT gravity, while the s bulk comes from the bulk field theory. The density matrix σ R is defined as The second equation follows because, upon tracing out the environment factor from the action of the Stinespring dilation, we obtain the action of the channel E. The particular state upon which the channel acts is the maximally mixed radiation state, i.e., the "semi-classical (Right) The Z n quotient of the replica wormhole in the n → 1 + limit. The geometry of this manifold, with a cut on the interior, provides a specific prescription for the contractions of the bulk code subspace indices. The bulk field theory state created on the Z 2 -symmetric slice is replicated and results in a bulk Rényi entropy for the black hole interior. In order to compute this entropy, the interior code subspace excitation (blue line) must pass between replicas and the exterior code subspace excitation (green line) must remain within a given replica. This pattern of contractions is drawn on the left figure. The images of the cut on the n → 1 + geometry are the white dashed lines on the n = 3 geometry.
state" on the radiation. As before, this Tr σ n R contribution comes from the f -tensor with appropriate index contractions dictated by the EOW brane propagators in the connected geometry. Notice that here the reduced state σ R has appeared, whereas in the disconnected geometry it was σ env . This difference has to do with the manner in which the EOW brane indices are contracted, and is demonstrated by explicit calculation.
We can take logarithms of the above formulae to show that when the fully connected geometry dominates in the Rényi entropies we get a non-trivial mutual information Therefore, in this case the bulk density matrix in the black hole interior is not correctable under the action of the error on the bath. The mechanism underlying this failure of error correction in gravity is the appearance of the replica wormhole.
Finally, we are interested in the conditions for the fully connected geometry to dominate over the disconnected one. For Tr ρ n Re,env , the criterion for the connected geometry to be where we have defined S BH = S 0 + 2π β φ 0 + s bulk . (As before, S 0 is the extremal entropy, 2π β φ 0 is the classical horizon contribution, and s bulk is the entropy of bulk quantum fields.) Notice that the first inequality actually implies the second, so if Tr ρ n Re,env is dominated by the connected geometry then so is Tr ρ n R i ,Re,env , but the converse is not true except when d i = 1. If we only have Tr ρ n R i ,Re,env dominated by the connected geometry, the above equations show we still have I Ψ = 0. Therefore, we ought to characterize correctability only by the connected phase of Tr ρ n R i ,Re,env . Taking the logarithm on both sides of (3.33), multiplying by 1 n−1 , and taking n → 1 + , we get The left hand side above is entirely a property of the quantum channel E, with no reference to gravity. In quantum information theory, this quantity is referred to as the coherent information.
For a quantum channel E which can be isometrically extended to a unitary U E acting jointly on the system plus an environment factor H env , the coherent information of the channel E with respect to an input state ρ is defined as: (3.35) where ρ env is the reduced density matrix of the environment after the action of the joint unitary U E . The coherent information is a measure for how much of the quantum information in the input state survives the action of the quantum channel; for instance, it decreases monotonically under composition of quantum channels. For our purposes, the input state is the maximally mixed state on R, which we can loosely think of as the "semi-classical state" of the radiation, i.e., a coarse-grained description of the state of the radiation obtained by keeping track of the coupled evolution of the bath with the black hole in the semi-classical gravity description. 6 Equation (3.34) therefore states that if a quantum channel has a sufficiently negative coherent information with respect to the semi-classical state on the radiation Hilbert space, then the encoding of the black hole interior is no longer correctable under such a channel. Conversely, the encoding of the bulk state in the black hole interior is robust against the action of any quantum channel satisfying together with our previous assumption that the channel should not alter the asymptotic Euclidean boundary conditions by sourcing additional boundaries. Therefore, as long as the remaining black hole is macroscopic, we find that the black hole interior is robustly encoded in the radiation. If the black hole entropy is instead so small as to be comparable to the O(1) code subspace entropy log d i , an error with very small negative coherent information could corrupt the interior encoding. In either case, once the bound (3.36) is violated, the black hole interior moves over to the entanglement wedge of the environment factor H env and QEC on the bath fails at that point.
It is worth emphasizing that a channel with large, negative coherent information need not be very complex. Consider the following example. Let the dimension of the environment factor be the same as the dimension of the bath Hilbert space, i.e., dim(H R ) = dim(H env ) = k = 2 M , and let the unitary U correspond to the SWAP operator. For such a channel, we have and so the coherent information is given by Clearly, the SWAP channel violates the bound (3.36). This is not at all surprising because this channel essentially transfers all the entanglement from the radiation density matrix into the environment and replaces the original state of the radiation with |e 0 e 0 | R ; the interior code subspace could not possibly be protected under such a drastic replacement. But importantly, the SWAP channel is not very complex 7 -for every qubit in the radiation, we need one 2-qubit SWAP gate, and so the complexity of this channel should be M ∼ log k.
Note, however, that by unitarity of quantum mechanics, if we treat the radiation as a subsystem and implement the erasure channel via a SWAP operator, this procedure does not actually destroy any information. All it does is move where the black hole interior has been encoded in the larger system. This amounts to including the environment as a subsystem upon which we may try to reconstruct the interior.

Black hole exterior
We can also ask whether the operation E can affect the black hole exterior. In this case, we need to compute the mutual information I Ψ (R e : R i ∪ env). When the disconnected geometry dominates, the calculation is essentially the same as before and we get zero mutual information. When the connected geometry dominates, the calculation of S(R i ∪ R e ∪ env) is also the same as before. The main difference is in Tr ρ n R i ,env (Fig. 9). Instead of (3.29), we get Tr ρ where (n − 1) is small and positive. Note also that Tr ρ n Re , which we need in place of (3.23), is always dominated by the disconnected geometry: (3.40) Using these expressions, we can check that I Ψ (R e : R i ∪ env) = 0, and thus the black hole exterior is never affected by quantum operations on the radiation, which is of course consistent with the fact that the exterior is not in the entanglement wedge of the radiation.

Approximate isometry of the interior encoding
The theorems concerning standard quantum error correction reviewed in Sec. 2.1 assumed an isometric embedding V of the code Hilbert space in the physical Hilbert space. However, the map V |i, i code = |Ψ i,i phys for the black hole interior is not actually an isometry. This is because the enormous number of effective field theory states in the growing interior will eventually outnumber the states of the physical Hilbert space as measured by the black hole entropy. Thus, states that are orthogonal in the effective field theory cannot be orthogonal after embedding in the physical Hilbert space. However, we might expect that for code subspaces which are small compared to the black hole Hilbert space, the interior encoding map V should be an approximate isometry [18], and therefore the standard theorems should still be approximately valid and thus can be used to diagnose the existence of a recovery channel.
We can use the gravitational path integral to demonstrate that this expectation is indeed true. The map V can be made arbitrarily close to an isometry by appropriately tuning the code subspace relative to the black hole Hilbert space. To see this, we will evaluate the Frobenius norm of the operator P 2 − P , where P = V V † is the code subspace projector. If V were an isometry, P would be a projector and we would have P 2 − P = 0. So, if the Frobenius norm of this quantity is small, V is approximately an isometry.
The first step is to normalize P by requiring that where N P is a normalization and d is the code subspace dimension, as appropriate for normalizing a projector. Using P = V V † and the definition of V as above, the left hand side reduces to a combination of gravitational overlaps These overlaps reduce to Ψ i,i |Ψ i,i phys = e S 0 Z 1 where we separated out the e S 0 factor from the JT gravity path integral on the disc as before in (3.13). Therefore, the normalization for P is As usual, we have ignored terms which are subleading in the genus expansion, which is justified as we have S 0 1. This normalization essentially fixes the orthonormality of the code subspace states i, i |j, j code = δ ij δ i j .
We are now interested in the Frobenius norm where we normalized P ≡ P/N P to have a proper projector (see Eq. 3.41). The leading contribution to this norm in the genus expansion should arise from the fully disconnected contribution, where all gravitational boundaries are filled separately by disk geometries with an EOW brane. In fact, an explicit calculations shows that these contributions cancel in the function of P appearing in the Frobenius norm. To see this, we make the replacement Ψ i,i |Ψ j,j = e S 0 Z 1 δ ij δ i j . The completely disconnected contributions are then where the numerators were computed by direct evaluation of the relevant path integrals in the same manner as in the calculation of (3.13). Since this vanishes, we look for the next order contribution in the genus expansion. This comes from the path integral geometries in which precisely one pair of asymptotic boundaries is connected by a wormhole bounded on either side by EOW branes; we will call the JT path integral on this connected pair geometry Z 2 . In Tr P n this term appears from the overall path integral geometry with n − 1 connected components; so the result will be suppressed by e −S 0 compared to each term in the disconnected contribution. Thus, The total Frobenius norm is therefore where the O(e −2S 0 ) term includes contributions with fewer disconnected components, and the genus expansion of each component.
This result tells us that by taking d e S 0 /2 , we can ensure that P is exponentially close to a true projector in the physical Hilbert space. Thus the assumption in [18] that the encoding map for the interior is close to an isometry holds true in the PSSY model of two-dimensional gravity. To use the matrix ensemble language for JT gravity plus EOW branes [28], we have shown that a typical member of the boundary ensemble implements an approximately isometric bulk-to-boundary encoding map V . So we are justified in drawing conclusions about the error correction properties of the typical theory by using the decoupling principle and similar standard isometric error correction theorems. A more refined analysis is possible. We could imagine deriving completely general Knill-Laflamme conditions for the existence of a recovery channel when the encoding map is arbitrarily far from an isometry. In this most general case, V is simply a linear map, not necessarily isometric, which must be injective to provide a faithful encoding. Injectivity certainly requires d e S 0 . However, whether this map is actually faithful depends on how it maps the code space into the actual physical Hilbert space. If we are dealing with a theory of gravity like JT gravity that is dual to an ensemble of microscopic theories, faithfulness of the encoding V requires that the measure in the ensemble should not be concentrated on theories for which V is degenerate. In JT gravity, this is likely the case, as the EOW brane states which we labeled by α are dual to states that include random coefficients in the energy basis [16], and are thus highly unlikely to lead to degeneracies in V for small d compared to e S 0 . However, despite this, it does not follow that the encoding map is necessarily an isometry, or even close to one, because the encoding vectors may have large overlaps in individual members of the ensemble. If we could write generalized Knill-Laflamme conditions, along with a decoupling principle that applied to such non-isometric encodings, we could compute the relevant mutual information to diagnose the existence of a recovery channel for some error E and given linear map V . In this way, we could aim to derive entropic conditions for the existence of a recovery map in every member of the underlying ensemble for a given error, instead of showing its existence only for a typical member of the ensemble as we have done in this paper.
The non-isometric codes discussed in [33] may give some intuition for what the correct generalized Knill-Laflamme conditions should be. In the language used in that work, in this paper we are studying a sort of state-independent sector of typical non-isometric codes where the dimension of the code subspace is small enough to ensure that more conventional error correction criteria are still approximately valid.

Erasures and random errors
The previous section developed general results about robustness against errors of the encoding of the black hole interior in the Hawking radiation. In this section we further investigate two kinds of error channels for which more detailed analyses are possible. In the first class of errors, in which some of the physical bits in the radiation are simply erased, we are able to explicitly sum over all planar gravitational geometries (following the resolvent method of [16]) contributing to mutual information that diagnoses error correction. In the second class consisting of typical errors, where a random unitary acts on the radiation and an auxiliary environment Hilbert space, we give a geometric formula for the mutual Rényi entropy in terms of gravitational path integrals, which when evaluated in JT gravity, reproduces the same coherent information bound obtained previously.

Erasure errors
Our analysis in the previous section was in the semi-classical approximation where we restricted attention to replica-symmetric saddles. In this section, we will work with the full gravitational path integral, but in order to do so, we will need to specialize to a particular quantum channel: partial erasure of the radiation. Suppose the error channel E erase simply erases t of the M qubits in H R . The channel applied to the maximally mixed state on H R then yields a maximally mixed state of dimension 2 M −t , since the partial trace over t qubits of a maximally mixed state on M qubits gives a maximally mixed state on M − t qubits. A suitable isometric extension of E erase is simply a partial analog of the SWAP operator discussed previously, where the unitary U E exchanges t "clean" environment qubits with t radiation qubits. More precisely, by "clean" we mean that we take the environment to initially consist of t qubits each in some fixed fiducial state |0 0|, and the action of the channel swaps the state on t of the radiation bath qubits with these t environment qubits. Afterward, the remaining radiation entropy is log 2 M −t and the environment entropy is log 2 t . The coherent information is then The gravitational meaning of this result is surprising. We have found that for, e.g., t ≈ M/2, the coherent information vanishes or is at least very small in magnitude compared to a large black hole entropy. This means that we can erase considerably more than half of the radiation and still reconstruct essentially all effective field theory operators in the black hole interior. Hints of this robustness were seen in doubly holographic models of evaporation [34], where a multiboundary wormhole model was used to reach roughly the same conclusion. But just how sharp is the transition between a correctable and non-correctable erasure error? In other words, can we produce a more accurate criterion than our condition that the coherent information of the erasure channel must exceed minus the black hole entropy by "a large amount", as written in (3.36)? In order to study this transition more precisely, we must incorporate more gravitational geometries than just the disconnected and fully connected phases that we studied in Sec. 3.
As discussed in Sec. 3, in deriving our coherent information criterion we neglected the contribution from geometries breaking Z n symmetry. For erasure errors, we can do better by resumming all the planar geometries; this is a good approximation when the parameters k, e S 0 , d i etc. running in loops are large, and it will give us a sharper picture of the correctability transition for erasure errors. We will perform the planar resummation by writing down a Schwinger-Dyson equation for a resolvent, following [16]. The general idea of this method is to compute the entropy S(ρ) of a density matrix ρ indirectly by first computing a resolvent matrix R(w) = [w1 − ρ] −1 . As is standard practice in, e.g., random matrix theory, we may obtain the eigenvalue density D(w) for ρ by computing the discontinuity of the resolvent across the real axis, 2πiD(w) = Tr[R(w − i ) − R(w + i )] with → 0. With D(w) in hand, the entropy S(ρ) is easily obtained by writing S(ρ) = − dw D(w) w log w. We may similarly evaluate any function of the eigenvalues of ρ using D(w); if we wish to compute Tr ρ n , for instance, we write Tr ρ n = dw D(w)w n . The resolvent is particularly useful in summing planar diagrams for a density matrix ρ that involves gravitational path integrals because there is a recursive Schwinger-Dyson equation that determines R exactly in the planar approximation.
We are going to relax the Lewkowycz-Maldacena assumption of Z n replica symmetry, and will replace it with three simplifying assumptions in order to keep the calculation tractable. As we are most interested in subsystem correctability of H int , we will assume that (i) we restrict ourselves to a code subspace where H ext is trivial (i.e., one-dimensional). Next, as we noticed in Sec. 3, part of the utility of the Lewkowycz-Maldacena assumption was that we were able to choose a particular contraction pattern for the bulk code subspace indices based on the geometry of the replica symmetry quotient manifold (see the discussion around Fig. 7). In relaxing the Lewkowycz-Maldacena assumption to incorporate replica symmetry breaking geometries, we want to continue choosing contraction patterns for the code subspace indices based only on the geometry of the replica manifold, so we assume that (ii) H int corresponds to a degree of freedom moving on or close to the EOW brane. Finally, the canonical ensemble involves integral equations relating the partition functions Z n and the density of states, so we will assume that (iii) we work in the microcanonical ensemble for the black hole, since the density of states in the microcanonical ensemble is flat in the microcanonical window and is therefore related to the microcanonical partition function by a simple algebraic equation; this will greatly simplify our Schwinger-Dyson equation for the resolvent.
Let us be more explicit about the implication of assumption (ii). In products of gravitational microstate overlaps, if H int is a degree of freedom that is "on or close to the EOW brane", we can simply contract this index identically to the contraction pattern of the EOW branes. For example, consider the overlap ψ α 1 i 1 |ψ β 1 j 1 ψ α 2 i 2 |ψ β 2 j 2 B , where i 1 , j 1 , i 2 , j 2 are the interior code subspace indices and α 1 , β 1 , α 2 , β 2 are EOW brane indices. Our assumption (ii) means that if we contract EOW brane indices to obtain δ α 1 β 1 δ α 2 β 2 , we require that the code subspace indices are contracted to yield δ i 1 j 1 δ i 2 j 2 . Similarly, if we contract EOW brane indices as δ α 1 β 2 δ β 1 α 2 , we require that the code subspace contractions give δ i 1 j 2 δ j 1 i 2 . This simplifies our analysis of replica symmetry breaking geometries considerably because it allows us to discard configurations where the EOW brane indices are contracted in a different pattern than the interior code subspace indices, a situation which was in principle possible in Sec. 3 but which did not actually arise due to the Lewkowycz-Maldacena assumption. Here, we are relaxing the Lewkowycz-Maldacena assumption but we will keep one of its important implications by making assumption (ii) to keep the calculation tractable.
With these simplifications, we can work out the Rényi mutual information I where the normalization is the d e = 1 specialization of the one we had previously (3.13). Note that the Rényi mutual information has the property that it vanishes if and only if the state factorizes. So, it is just as good as the mutual information I Ψ (R i : env) as a diagnostic of decoupling between the reference system and the environment.
Let us first consider Tr ρ n R i ,env . It is convenient to first write the matrix elements for the reduced density matrix, each of which involves a gravitational overlap i, e m |ρ R i ,env |j, e n = 1 kN k α,β,γ=1 γ, e m |U E |β, e 0 ψ α i |ψ β j α, e 0 |U † E |γ, e n . We can sum over planar geometries by introducing the resolvent matrix R: where w is a complex number and R has dimension dim(H int ⊗ H env ). We may represent this infinite sum pictorially using the same gravitational boundary conditions and tensor network constructions as in Fig. 4: Here the black lines denote asymptotic boundaries and come with a factor of (kN ) −1 , dashed blue lines denote environment indices, and dashed red lines denote radiation indices; we have suppressed the R i index for simplicity. Further, U E are denoted with light gray boxes and U † E are denoted with dark gray boxes. The nth term additionally also comes with the appropriate power w −n which has been left implicit in the figure.
As an example of how (4.4) is translated to (4.5), take the first non-trivial term in (4.5), which is pictorially representing the matrix element (4.3). The gravitational boundary condition is ψ α i |ψ β j B , represented by the solid black line oriented from ket to bra. Implicit at the left and right endpoints of this condition are the (β, j) and (α, i) indices, respectively. The left endpoint with radiation index β feeds into the light gray U E operator, along with a hanging environment leg that is implicitly contracted with e 0 . The outgoing environment leg of U E is e m , while the outgoing radiation leg is γ, and this radiation index is matched to the incoming radiation index of the dark gray U † E operator. The incoming environment leg in U † E is e n , while the outgoing radiation leg is α, matched to the EOW brane index at the right endpoint of the black line. Finally, the outgoing radiation leg on U † E is implicitly contracted with e 0 . We have suppressed the R i indices since these would just add an extra incoming and outgoing dashed line attaching to the endpoints of the black line, but not interacting with the U E or U † E operators. The missing factors of w and kN are implicit as mentioned under (4.5).
Evaluating (4.5) exactly would be very difficult if we were to allow arbitrary gravitational geometries filling in the boundary conditions. However, in the planar approximation, there is an interesting simplification, as exploited in [16]. If we only consider planar gravitational geometries, namely those whose index loops and bulk gravitational components do not cross each other and do not include higher genus contributions, there is a recursive Schwinger-Dyson equation for this resolvent where the right hand side of (4.5) can be written pictorially as where the shaded regions denote bulk Euclidean spacetimes filling in the asymptotic boundary conditions with the solid red lines denoting EOW branes, and the orange blobs stand for insertions of the resolvent. The logic behind why this sort of recursion captures all the planar contributions is as follows. The first nontrivial term in (4.6) captures all planar geometries in which the first asymptotic boundary is not connected through the bulk to any other asymptotic boundary. Similarly, the second nontrivial term captures all planar geometries in which the first asymptotic boundary is connected through the bulk to just one other asymptotic boundary, but this second boundary does not necessarily have to be adjacent to the first, and it also does not necessarily have to be the last asymptotic boundary on the right. To capture the situations in which they are not adjacent, the resolvent (orange blob) is inserted between the two boundaries, and to capture the situations in which the second boundary is not also the last boundary on the right, the resolvent also is inserted to the right of the second boundary. These two resolvent insertions are independent because any connection through the bulk between them would render the geometry non-planar. Iterating this sequence, and noting that every planar geometry can be put into exactly one such class, we arrive at the recursion relation (4.6).
We can translate (4.6) back to an equation by recalling several facts. First, Z m is the JT gravity path integral on a disk with m EOW branes, and clearly the m th nontrivial term on the right hand side of (4.6) carries a factor of Z m . Second, m explicit gravitational boundary conditions come with a normalization of (kN ) −m as described below (4.5). Also, dashed blue environment index lines come with a factor of w −1 , unless they have a resolvent insertion, in which case this factor is omitted since there is no factor of w on the left hand side of (4.4). Because of this, from the form of (4.6), we see that every term on the right hand side is proportional to w −1 . By our assumption (ii), the code subspace indices are contracted along the EOW branes, which means the R i indices of each resolvent insertion (except the last one on the right) in each term in (4.6) are contracted together, yielding a trace Tr R i R.
Defining the R ∪ env density matrix σ again as we see that because the resolvents are interspersed only on the environment factors, they multiply between the σ factors to give [Tr env (σ. Tr R i R)] m−1 . Here m − 1 appears instead of m since the last factor of σ is generated by the leftmost U E and the rightmost U † E , and is therefore not included in the environment traces generated by the adjacent EOW brane contractions, as can be seen from studying (3.27) and (3.16). This last factor of σ instead has a radiation trace from the single large EOW brane index loop in Z m . Tacking on the last factor of R on the right, which multiplies the environment factor from the right, we finally find The dot notation for products means that we multiply operators which may act on different Hilbert spaces by appending an identity operator to the extra factors. Note the factor of k −m from the normalization was used to construct the m factors of σ.
For a general quantum channel, solving (4.8) seems involved, although not impossible. But our restriction to the partial SWAP channel simplifies things quite a bit. For this channel, we have the factorization so we can rewrite the Schwinger-Dyson equation (4.8) as In fact, the first line also holds for any channel U E which does not generate any mutual information when acting on the maximally mixed radiation state times the fiducial environment state |e 0 e 0 | env ; in other words when I σ (R : env) = 0, as this implies σ = σ R ⊗ σ env . Note that this is a different mutual information from I Ψ (R i : env), which we use to diagnose correctability of U E . To go further, we need expressions for the partition functions Z n , which are found in [16]. We have the integral expression after which the resolvent sum becomes geometric: The integral equation relating the density of states ρ(s) to the JT path integral Z n is complicated due to the dependence of the integrand on the energy s. By employing assumption (iii), we may work instead in the microcanonical ensemble where we define the gravitational path integral with boundary conditions that will fix the energy s in a small window ∆s. This choice will change nothing in the above Schwinger-Dyson analysis except the explicit form of Z n , which is now algebraically related to a flat microcanonical density of states in the energy window [s, s + ∆s] with height e S 0 ρ(s). Specifically, we have the microcanonical entropy S and microcanonical partition functions Z n defined by e S = e S 0 ρ(s)∆s, Z n = e S 0 ρ(s)y(s) n ∆s = e S y(s) n . (4.14) These relations simplify the above integral equation as we replace e S 0 Z n by Z n and ds by ∆s, and after taking a trace over R i ∪ env the microcanonical Schwinger-Dyson equation for This equation can be solved to obtain where we have added a superscript (R i , env) to R to denote the fact that this is the resolvent for the density matrix ρ R i ,env , and we have defined e S = 2 M e S . Similarly, we can also obtain the resolvent R (env) for ρ env : By expanding these resolvents in powers of 1 w , we can compute all the Rényi entropies. We show a comparison of the Rényi mutual information as a function of t, the number of environment qubits, between several Rényi indices in Fig. 10. From these plots we indeed see that Z n -symmetry breaking contributions only become important close to the phase transition and smooth out a relatively sharp transition between the fully disconnected and the fully connected geometries. These two Z n -symmetric contributions were evaluated in general in Sec. 3 and together create a step function shape for the Rényi mutual information, so we interpret the near-step function shape of the full planar resummation as just a small correction to these contributions, at least for erasure errors.
Note also that the transition happens near, but slightly before where S is the logarithm of the total physical Hilbert space dimension (microcanonical JT ensemble with entropy S plus the radiation bath with entropy M log 2) and t log 2 is the logarithm of the environment Hilbert space dimension. This is precisely the upper limit from the quantum Singleton bound (2.15) on the number of qubits that can be erased while leaving the code subspace protected. More specifically, in (2.15) we called S the number of qubits in the physical Hilbert space, so we must replace it here with S/ log 2, and we had a base-2 logarithm of the code subspace dimension, both of which appear in (4.18). The Rényi mutual information starts to become O(1) (as opposed to being exponentially small) when t is only an O(1) number less than the greatest number of qubit erasures that any code can protect against! Thus, the JT gravity model comes within an O(1) number of qubits of saturating the quantum Singleton bound. It would be interesting to characterize the very slightly suboptimal performance of gravity; perhaps non-planar contributions are important to account for in this analysis.

Typical errors
In this section we will consider how well the black hole interior is protected against the action of typical random errors on the radiation bath. In more detail, suppose that the Stinespring dilation of E involves a unitary operator U E acting on a Hilbert space of dimension dim(H R ⊗ H env ) = k , where is the dimension of the environment factor and k controls the dimension of the radiation subspace that is entangled with the black hole microstates. Then, by a typical/random error, we mean one where we can take U E to be a random unitary transformation drawn from the Haar measure on the group U (k ).
We will perform this random error calculation in two ways. First, we will directly Haar average the f -tensor (3.16) and re-compute the mutual information I Ψ (R i : R e ∪env). Second, we will take the Haar average of the coherent information I c (E, 1 R /k) and compare its value with our correctability criterion (3.36). A priori, these two approaches need not give the same result, because averaging the f -tensor first may affect which gravitational geometries dominate the path integral, whereas in averaging the coherent information we have assumed that the replica symmetric contributions are the relevant ones. However, we will see that an interesting simplification occurs when we consider the two limits 1 k and 1 k, and the two approaches in fact agree.

f -Tensor
We begin by directly taking the Haar average of (3.16) and evaluating the resulting gravitational path integrals which appear in the mutual information (3.9) between the interior and the union of the exterior and the environment. This in turn involves the Rényi entropies of various combinations of the black hole interior, exterior and the environment (see Eqs. 3.17,3.18,3.19). We will first average the error over the unitary group and then carry out the gravitational path integral computing the microstate overlaps. As we are most interested in the regimes where the environment is either large ( k 1) or small (1 k) compared to the radiation Hilbert space with both large compared to 1, we will only retain the leading terms in 1/k or 1/ . The Haar average of the f -tensor is then: where we have defined the matrix elements U β,em α,en ≡ β, e m |U E |α, e n , (U † ) β,em α,en ≡ β, e m |U † E |α, e n . (4.20) We compute the integrals in the second line in Appendix A by applying standard results concerning Haar integration of products of unitary matrices. The first term dominates when 1 k, while the second term dominates when 1 k .
Remarkably, the first term in (4.19) has the same microstate index structure as the product of disconnected path integrals (3.20) for the gravitational overlaps in the Rényi mutual informations (3.17), (3.18), and (3.19). The second term has the same microstate index structure as the fully connected diagrams for computing the same product of overlaps, shown for instance in (Fig. 8 and Eq. 3.27). This means that averaging over U E , at least in the two limits 1 k and 1 k , reinforces the two replica-symmetric, disconnected and connected geometries respectively in the gravitational path integral. Due to this simplification, we see that the relevant gravitational geometries that will enter in the calculation of the Rényi mutual information I (n) Ψ (R i : R e ∪ env) are precisely the ones we considered already in Sec. 3. In the n → 1 + limit, the overlaps in (3.17), (3.18), and (3.19) involve different propagators for the matter fields and thus lead to different powers of d i and d e (see discussion below Eq. 3.27), but in a manner identical to Sec.. 3. Therefore, the resulting mutual information will be identical, as we will now confirm explicitly.
Using our result (4.19) for the Haar-averaged f tensor in (3.17), (3.18), and (3.19), along with the gravitational overlaps from the disconnected saddle-points (3.20), we can find the leading disconnected contribution to the Rényi entropies. The contraction off with the tensor on the radiation Hilbert space coming from the gravitational overlaps gives 1 k n α 1 ...αn β 1 ...βn Carrying out the remaining sums over the internal and external code space indices gives The terms in the square brackets give an explicit evaluation of the Tr σ n env factors in (3.21)-(3.23) for the disconnected gravitational contribution to a general error. We can now evaluate the n-th Rényi mutual information (3.9) between the interior of the black hole and the exterior of the black hole plus the environment in the disconnected phase of the gravitational path integral. We find Similarly, we can combine the Haar-averaged f-tensor with the gravitational overlaps from the connected saddlepoints in (3.27), along with its analogs for the other mutual informations, to computed the leading connected contribution to the Rényi entropies (3.17), (3.18), and (3.19). The contraction off with the tensor on the radiation Hilbert space coming from the connected gravitational overlaps gives 1 k n α 1 ...αn β 1 ...βn (δ α 1 β 2 δ α 2 β 3 · · · δ αnβ 1 )f α 1 β 1 ···αnβn = (k ) 1−n + k 1−n + · · · (4.26) Carrying out the remaining sums over the internal and external code space indices (in the n → 1 + limit) gives The quantities S 0 , Z n and Z 1 are discussed below (3.27). The terms in the square brackets give an explicit evaluation of the Tr σ n R factors in (3.28)-(3.29) for the connected gravitational contribution to a general error.
We can now evaluate the Rényi mutual information (3.9) between the interior and exterior plus the environment in the connected phase of the gravitational path integral in the n → 1 limit. In evaluating this mutual information we will continue to use the disconnected expression for the Tr ρ n R i (4.24) because it is dominant for any choice of the error rank as the connected contribution (4.29) is suppressed in powers of k. We get I(R i : R e ∪ env) = lim confirming the general result (3.31) for random error channels.
Finally we can check the condition for the connected phase to dominate the Rényi entropies and hence the mutual information between the black hole interior and the exterior plus the environment. As discussed above, Tr ρ n R i is always dominated by the disconnected component because the connected part (4.29) is suppressed. A little algebra shows that the connected contribution to Tr ρ n Re,env in (4.28) dominates the disconnected contribution in (4.23) when k n−1 + k n−1 where e S 0 (1−n) Z n /Z n 1 ∼ e (1−n)S BH in the n → 1 + limit, as discussed below (3.29). The approximate expression is valid when ∼ O(k 2 ) or smaller. Similarly the connected contribution to Tr ρ n R i ,Re,env in (4.27) dominates the disconnected contribution in (4.22) when k n−1 + k n−1 The approximate expression is again valid when ∼ O(k 2 ) or smaller. This second condition is satisfied for smaller than the first condition.
It can be checked that the mutual information is nonzero if the connected phase dominates just Tr ρ n R i ,Re,env . The condition (4.32) is satisfied when giving a precise condition on the rank of the error channel required to give an error that cannot be corrected.

Coherent information criterion
Alternatively we can diagnose correctability of typical errors by directly computing the Haar average of the coherent information criterion in (3.35). A priori, this is a separate calculation from the one we discussed above, where we took the Haar average of the f -tensor before computing the gravitational path integral. Here, we will take the general correctability criterion, which in particular is nonlinear in the error channel U E , and perform the Haar average. However, in the case of the f -tensor average, because we found that the microstate index structures precisely matched the two relevant ones coming from the disconnected and fully connected gravitational path integral geometries, we ought to obtain the same answer by simply averaging the coherent information. As we will now see, this is indeed what occurs, and we obtain the typical error condition (4.32) in a more straightforward manner, without discussing gravitational path integrals.
The coherent information is given by the difference of two entropies, S(σ R ) and S(σ env ), where we recall that σ R and σ env are partial traces of σ over the complementary factor (see (3.24) and (3.30)). Choosing explicit bases |α R with α = 1, . . . , k and |e m env with m = 1, . . . , for the radiation and environment respectively, the reduced density matrices are We can compute the Haar averaged entropies by using the replica trick just as we did with the gravitational path integral. Note that here we are not actually performing any gravitational path integrals; we are simply using the replica expressions for entropies and computing their Haar averages in order to find the typical value of the coherent information for a random channel. The n th Rényi coherent information with respect to the maximally mixed state is given in terms of the n th Rényi entropies by The necessary traces of powers of the above density matrices are given by  This is sensible, as it suggests that a random unitary operator will (at leading order in k and ) create maximally mixed reduced states on the radiation and environment factors. Using the standard formula for the entropy in terms of these traces as described above (3.32), we find Finally, the coherent information (3.35) for a random error of fixed Kraus rank acting on a radiation space of dimension k is According to this result, a random error must be of sufficient Kraus rank in order to affect the interior. In particular, utilizing (3.36), if then the error E on the interior is not quantum correctable based on our criterion on the coherent information. This result is equivalent to (4.33), as advertised.
If the Kraus rank of the randomizing error is scaling with a fractional power of the radiation dimension k, for instance ∼ √ k, this shows that a typical random error will actually not affect the interior because the ratio k/ will be large, leading to a positive coherent information. This is surprising because after the Page time we have k e S 0 , and a random error with = √ k is modeled by a Stinespring dilation U E that will almost certainly have exponential quantum complexity in S 0 . Our result shows that such exponential complexity errors cannot affect the interior.
It also shows that the erasure/SWAP example we discussed previously is somehow finely tuned, because the SWAP Stinespring dilation only requires an environment of dimension = k, and for this relation log(k/ ) = 0. Of course, for = k we are certainly missing contributions in our Haar integrals as we assumed either k or k , so perhaps these terms provide large corrections to the coherent information for a typical error with = k that brings them closer to the SWAP error. On the other hand, when the Kraus rank of the error is significantly greater than the radiation dimension, it is quite easy to affect the interior after the Page time k e S 0 , as e.g. we may take = k 2 maximal [22] and then we have the condition log 1 k −S 0 which is nothing but the statement that we have passed the Page time.

Discussion
We used a toy model for black hole evaporation in JT gravity to analyze novel quantum error correction properties of the black hole interior. Similar properties were previously proposed by Kim, Preskill and Tang on the basis of a pseudorandom encoding model for Hawking radiation [18], while we investigated these properties in a simple gravitational model. Modeling errors in the encoded state as quantum channels E, we found that any error is correctable provided (i) the channel does not have access to black hole microstate details (or more precisely, the encoding map for the code subspace), and (ii) its coherent information I c with respect to the maximally mixed radiation state is greater than a certain (negative) lower bound set by the black hole entropy. Thus, while the black hole is macroscopic, its interior is robustly protected against generic, low-rank errors (i.e. errors whose rank is smaller than the size of the radiation Hilbert space) on the radiation. The breakdown of correctability upon violating the coherent information bound happens due to the dominance of the replica wormhole geometry in the gravitational path integral, which is the same effect that leads to restoration of the Page curve in entropy calculations.

Robust QEC in the Python's Lunch
In this work, we have focused on the error correction properties of the black hole interior, viewed past the Page time as being encoded in the radiation bath. It is interesting to ask how the robust error correction properties of the black hole interior that we have found may generalize to other entanglement wedges. Recent work [19][20][21] has highlighted the rich structure of entanglement wedges in AdS/CFT. Let A be a subregion, or, more precisely, the domain of dependence D(A) of a subregion A, in the boundary CFT and let A be its complement. We can divide the entanglement wedge W(A) of A in the dual geometry into two portions: (i) the simple wedge, i.e., the portion of W(A) which lies between A and the outermost quantum extremal surface homologous to A, and (ii) the Python's Lunch, i.e., the complement of the simple wedge inside W(A). The simple wedge can further be divided into the causal wedge, i.e., the portion of the simple wedge which is in causal contact with D(A), and its complement inside the simple wedge. It is expected that the encoding map for semiclassical degrees of freedom in the Python's Lunch portion of an entanglement wedge will be exponentially complex, while the encoding map will not be complex in the simple wedge. Indeed, the black hole interior past the Page time is an example of a Python's Lunch, as it is hidden behind a non-minimal QES, namely the empty surface.
It is natural to conjecture that in more general entanglement wedges, the encoding of semi-classical degrees of freedom in the Python's Lunch should be robust against generic, low-rank errors on the boundary subregion A. 8 By "generic", we mean quantum operations which do not have prior access to the details of the microscopic encoding map. 9 In contrast, we do not expect robust quantum error correction in the simple wedge. Indeed, it is not difficult to construct examples of generic, low-rank quantum operations which corrupt the encoding of degrees of freedom in the simple wedge. For instance, in the causal wedge, even a one-qubit environment interacting with A via coupling to some single-trace operator is sufficient. Further, the entire simple wedge can be brought in causal contact with D(A) by a relatively simple unitary operation on A. Our conjecture can be analysed in simplified models of holography, such as random tensor networks or fixed area states, as we will report elsewhere [36]. It would also be interesting to understand the implications of our results in cosmological settings [37,38], de Sitter universes [39], and for disjoint gravitating universes that share entanglement between their degrees of freedom [40][41][42].

Pseudorandomness and complexity
Our analysis of QEC in the black hole interior has relied entirely on the gravitational path integral, and provides a different perspective on the results of [18], where the authors relied on quantum information theory arguments together with an assumption on the pseudorandomness of the radiation density matrix. More precisely, the authors of [18] assumed that any low-complexity (i.e., polynomial in the black hole entropy) quantum operation could not reliably distinguish the radiation density matrix from the maximally mixed state. This led them to conclude that the black hole interior was robust against low-complexity errors on the bath. On the other hand, our analysis relied upon a different key assumption: the action of the error channel E should be independent of gravitational overlaps between black hole microstates ψ α i,i |ψ β j,j B . If this assumption were violated, our calculation in Sec. 3 would have to be modified because we would potentially need to include gravitational path integrals on additional manifolds in order compute the amplitudes associated to the action of E. We are thus led to conclude that the interior is robust against (low-rank) errors which do not have prior access to details of black hole microstates (or more generally, the encoding map for the code). It would be nice to further explore the connection between these two approaches.
It is worth noting that in our analysis, the maximally mixed state on the radiation arises naturally as the state relative to which the coherent information of E should be computed in order to determine whether or not the error is correctable. This is an output of the gravitational path integral in the specific toy model we are considering. We can interpret this maximally mixed state loosely as the semi-classical state of the radiation, analogous to Hawking's density matrix, i.e., the coarse-grained, random approximation to the true, pseudorandom density matrix on the radiation.
One curious aspect which deserves further exploration, given this observation, is the following. In the toy model, the gravitational path integral is really computing an ensemble average E[·] over many boundary theories [16]. The maximally mixed radiation state which appears in our criterion happens to also be the ensemble average of the microscopic radiation states in these theories, because these states depend on gravitational overlaps that will vary in each individual theory in the ensemble. So, we may write our criterion for interior state corruption as Though a complete generalization of our criterion to include cases where E has access to microstate details was beyond the scope of our work, we may conjecture that a sufficient criterion for interior state corruption that includes cases where E has access to microstate details should simply move the ensemble average outside to reflect the fact that E also has nontrivial ensemble dependence.
Note that in the above conjecture it is crucial that the implication is only to the right. We are not claiming that the left hand side is a necessary criterion for interior state corruption; we only mean that it may be a sufficient criterion in the presence of a channel E which depends on the microstate details. This contrasts with the criterion (3.36) derived in Sec. 3, which was both necessary and sufficient for interior state corruption due to our no-prior-access assumption. Indeed, the converse of (5.2) can be explicitly violated by a simple channel that couples a Petz operator on the radiation to a single environment qubit.
Understanding (5.2) in greater detail could shed light on properties of the microscopic radiation state, connecting with the work of [18] and potentially bringing complexity theory into the discussion. Indeed, a simple counterexample to our no-prior-access-to-black-holemicrostate-overlaps assumption would be a channel which uses the Petz reconstruction of bulk operators on the radiation; however it seems plausible that such channels are exponentially complex [43,44], and therefore also violate the assumptions of [18]. Analyzing such channels which are allowed to access the microscopic state details in a controlled manner provides an avenue for connecting our assumptions with the pseudorandomness ideas of [18]. In this language, the interesting question to ask is: what properties of the channel E with access to microstate details allow it to corrupt the interior while violating the left hand side of (5.2)? It would be good to make a more precise connection between the pseudorandomness assumption of KPT and the assumptions which have gone into the present analysis, perhaps through an analysis of channels which are allowed to access the microscopic state details, as our setup allows us to relax the no-prior-access assumption in a controlled manner, while relaxing the pseudorandom assumption of KPT seems difficult.

Implications for semi-classical causality
We found that an error channel acting on the radiation can affect the black hole interior if it has a sufficiently negative coherent information. This situation can arise when the Euclidean gravity path integral associated to the error channel is dominated by wormhole contributions. Some of the expected properties of effective field theories can be challenged by the presence of such wormholes [45,46]. We focus here on semi-classical causality in the black hole spacetime, which states that an interior EFT operator φ should commute with EFT operators Q R acting on the radiation: This expression, much like the notion of bulk radial locality in AdS/CFT [11], ought to hold at least in a code subspace of the physical Hilbert space. However, after the Page time, the interior is located within the entanglement wedge of R, and therefore we may reconstruct logical operators such as φ using operators which act only on R in the physical Hilbert space. So, it is not obvious whether microcausality in the sense of (5.3) will still be respected, even in the code subspace. To check this, we must compute the commutator in the physical Hilbert space, using a global representation of φ. By global representation, we mean a representation of φ which acts on the physical Hilbert space H B ⊗H R . In place of the radiation operator Q R , we will use the Kraus operators E n , which model operations we can perform on the Hawking quanta in the radiation.
Correctability of the set of errors E = {E m } has an important implication for this issue, namely consistency with the semi-classical causal structure of the black hole spacetime [18]. Let φ be a bulk operator in the code subspace localized in the black hole interior, This is localized on the interior because we have traced over the exterior factor of the Hilbert space; in other words φ acts as the identity on H ext . Recalling that the action of the encoding map is V |i, i bulk EFT = |Ψ i,i B,R , let O, the "global" representation of φ on the physical where the operators B (ext) mn are analogous to those appearing in (2.17) and P = i,i |Ψ i,i Ψ i,i | B,R is a projector onto the code subspace. Since O is localized on the interior factor on the code subspace, the isometry V by definition obeys V † V = 1 int,ext , and the combination P E † m E n P acts as the identity on H int after conjugation by V (5.6). So we find This is an operator algebra restatement of the error correction conditions [47]. From equation (5.5), we also observe that O commutes with the code subspace projector P = V V † and so this condition translates to P O, E † m E n P = 0, ∀m, n. and so the Kraus operators respect the semi-classical causal structure of the black hole spacetime within the code subspace.
Thus, any correctable quantum operation E on the radiation bath will respect semiclassical causality with respect to operators in the black hole interior. For a correctable quantum operation to violate semi-classical causality, it therefore seems to need prior access to black hole microstate details through the overlaps ψ α i,i |ψ β j,j , which would modify the results we obtained in Sec. 3. On the other hand, the failure of correctability due to a large Kraus rank for E does not necessarily imply a violation of causality, for example if the information is simply moved to another physical environment. In that case the original representation of O on B ∪ R, the union of of the quantum system dual to the black hole and the radiation bath, fails to reconstruct the bulk operator in the interior. One must instead construct interior operators on the joint system B ∪ R ∪ env.
The global representation of φ need not commute with errors that are uncorrectable, as our derivation above concerning semi-classical causality relied on the Knill-Laflamme conditions for correctability. A way out of this apparent violation of causality may be that the global representation of φ is simply inaccessible to any reasonable observer living in the radiation. In that case, violation of causality for observers in the radiation would not be diagnosed by non-commutation of the Kraus operators with the global representation. Instead causality would be violated for such observers if the Kraus operators did not commute with a representation of φ which lives purely on the radiation Hilbert space. We will now demonstrate that, at least for one particular such representation, semi-classical causality is indeed never violated.
An explicit example of such a representation on R alone is the Petz reconstruction O Petz = E(P ) −1/2 E(V φV † ) E(P ) 1/2 . (5.10) This operator makes explicit use of the quantum error channel acting exclusively on the radiation. If there is no recovery channel, i.e., if the error cannot be corrected, then the Petz operator will vanish [16]. This is the case, for example, before the Page time. Thus, this operator respects causality, because it vanishes precisely when the channel is not correctable. It is possible for this to happen because operator makes explicit use of the known error channel. When the error is correctable, the Petz operator has code subspace matrix elements which match the global reconstruction, and so causality is ensured in this case as well, because by (5.9) the Kraus operators will also commute with O Petz in the code subspace. When the error channel is correctable, φ and O Petz are identical as operators acting on the code subspace. The global representation, on the other hand, is always nonzero on the physical Hilbert space if the bulk EFT operator φ is nonzero, and the Knill-Laflamme conditions are not enough to ensure causality for such operators. The bottom line is that an operator represented purely on the radiation with access to the error channel, such as the Petz operator, may be constructed to vanish when the error may violate semi-classical causality with respect to the global representation, thus ensuring that this weaker version of semi-classical causality is preserved.

A Haar integration over unitary matrices
Here we provide details of the evaluation of Haar integrals in Sec. 4.2. As we are most concerned with integrals over U (k ) where 1 k or 1 k, there is a competition between the natural 1/(k ) suppression of the so-called Weingarten functions and particular Kronecker structures which can act to cancel some of the summations. 10 The general formula for the Haar integration in terms of these functions and Kronecker deltas is where |τ | is the minimal number of transpositions 11 needed to form τ , a i is the length of the i th cycle in τ , and C n = (2n)!/(n!(n + 1)!) is the n th Catalan number. The large D limit is relevant here because, in our case, D = k , and we are considering a large radiation Hilbert space of dimension k and errors with Kraus rank .
where in the second to last line the first and second terms have k factors of the radiation indices {γ i } contracted, the second term has factors of {m i } contracted, and in the last line we used the Weingarten function defined in (A.2). The ellipsis includes factors that have larger Weingarten suppression with µ = τ and the tensor structure that correspond to nonreplica-symmetric geometries, since these tensors will contract with the tensor structure that comes from the bulk path integral in Sec. 4.2. To see the Weingarten suppression, consider µτ −1 = σ ∈ S n . Decomposing σ into g transpositions, one observes that Wg(σ, k ) ∼ (k ) −n (−2) −2 k g , which will be suppressed exponentially by the difference between µ and τ when k > 2. Therefore, for a fixed geometry, the largest contribution to the the entropy comes from setting µ = τ .
As observed in 4.2.1, a tensor δ α j β j in the Haar integration that contract with a given bulk geometry represented by the index structure δ α j β j Haar integration reinforces different gravity configurations, in the same manner as (4.21) and (4.26), because α j ,β j (δ α j β j ) 2 = k where k is the number of α-and β-components. Consider an element τ ∈ S n that a geometry that is not replica symmetric, i.e. it gives a δ α β structure that does coincide with either (3.20) or (3.27), e.g. τ = (n 1 2 · · · n − 1) a m-cycle shorter than n. As shown above, the term that has minimal Weingarten suppression given this geometry has µ = τ . However, the choice of µ results in n matched γ-indices and (n − n) mismatched m-indices in the third line of (A.3), contributing k n −n n to this tensor δ β 1 α n · · · δ β n α n −1 δ β n +1 α n +1 · · · δ βn αn . From this one can see that with the same value of the Weingarten function, the dominating contribution to the entropies is either the completely disconnected or the connected cases in either limit k or k respectively. This observation also agrees with the two limits in [16] while they sum over all the planar geometries. Tempting as it is to think that every element in the sum of the symmetric group will reinforce a type of geometry, it is more natural to consider the cyclic group instead, given the boundaries lie on a circle. Unlike [16], it is not clear that the planar geometries has larger weights than the geometries with crossings directly from the Haar integration. However, one can conjecture that a typical error on the radiation can somehow control the entropy of the states in the bulk through different wormholes enabled by replica theory.

A.2 Coherent information criterion
In Sec. 4 In terms of the permutation group element sum in (A.1), the only relevant contribution comes from the "free" configuration µ = τ = e, as this has minimal Weingarten suppression and collapses only a single sum (by setting one pair of indices to be equal via a delta function) in both Rényi entropies. There is just one other configuration which also collapses only a single sum, but which has maximal Weingarten suppression (µ is an n-cycle and τ = e is the identity), so we discard it. Thus, all configurations other than the free one are suppressed in either 1/k or 1/ . This choice results in maximally mixed Rényi entropies, as expected for the leading behavior of a random unitary Stinespring dilation.