Average Secrecy Throughput (AST) Explained

• Average Secrecy Throughput (AST) is a metric that measures the effective secure data rate by averaging the positive secrecy rate over channel variations and reliability constraints.
• Different formulations of AST address various regimes—including MMF, rotatable antennas, finite-blocklength, and RIS-assisted systems—highlighting trade-offs between outage probability, interference, and secure throughput.
• Optimization techniques for AST involve resource-allocation strategies such as greedy artificial noise allocation and bisection search to maximize secure throughput under practical system constraints.

Average Secrecy Throughput (AST) is a long-term physical-layer security metric for quantifying the rate at which confidential information is delivered securely under channel randomness, secrecy constraints, and, in many formulations, reliability constraints. The literature does not use a single universal AST definition. In measured multi-mode fiber (MMF) channels, AST is the expectation of the positive-part secrecy rate over the legitimate and eavesdropper channels (Jorswieck et al., 2021). In delay-limited and outage-based formulations, AST is the target secrecy rate multiplied by the probability of secure non-outage (Pei et al., 2024, Rahman et al., 2023). In finite-blocklength and short-packet settings, AST is written as an information rate discounted by average block error, leakage, or both (Mamaghani et al., 2023, Zheng et al., 18 Mar 2026, Liu et al., 18 Sep 2025). Closely related papers also use the terms secrecy throughput, effective secrecy throughput (EST), and average achievable secrecy throughput (AAST) for the same general design objective (Monteiro et al., 2017, Ibrahim et al., 2021, Zheng et al., 18 Mar 2026).

1. Definitions and nomenclature

The mathematical form of AST depends on the communication regime, the secrecy model, and whether coding is asymptotic, outage-limited, or finite-blocklength. In the MMF wiretap model, the instantaneous secrecy rate is

$$R_s(\mathbf{H},\mathbf{G}) =\bigl[C_b(\mathbf{H},Q_s,Q_n)-C_e(\mathbf{G},Q_s,Q_n)\bigr]^+,$$

and the AST is

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$

when $\mathbf{H}$ is measured and deterministic over a block (Jorswieck et al., 2021). In the rotatable-antenna setting, two equivalent definitions are given: $$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$ and

$$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$

(Jiang et al., 22 Nov 2025). In RIS-assisted ambient backscatter communication (AmBC), the secrecy throughput is

$T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$

with analogous per-stream quantities $T_u^\psi(R_u)$ and $T_c^\psi(R_c)$ for the ambient-source data signal and the backscatter signal under ipSIC or pSIC (Pei et al., 2024).

In finite-blocklength work, AST explicitly absorbs reliability and leakage penalties. For fading wiretap channels with average information leakage (AIL), the instantaneous secrecy throughput in slot $i$ is

$$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$

and the AST is

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$0

over $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$1 independent fading blocks (Mamaghani et al., 2023). In short-packet fluid-antenna systems (FAS), the AST is

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$2

(Zheng et al., 18 Mar 2026). In RIS-assisted autonomous aerial vehicle (AAV) networks, AST is

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$3

under decoding-error and information-leakage constraints (Liu et al., 18 Sep 2025).

Regime	AST form	Representative source
MMF wiretap	$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$4	(Jorswieck et al., 2021)
Rotatable antenna	$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$5 or $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$6	(Jiang et al., 22 Nov 2025)
Delay-limited RIS-AmBC	$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$7	(Pei et al., 2024)
Finite blocklength with AIL	time-average of $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$8 under $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$9	(Mamaghani et al., 2023)
Short-packet FAS	$\mathbf{H}$0	(Zheng et al., 18 Mar 2026)
Short-packet RIS-AAV	$\mathbf{H}$1	(Liu et al., 18 Sep 2025)

This range of definitions makes AST a family of operational secrecy-throughput metrics rather than a single invariant quantity. What remains common is the combination of confidential rate with a success mechanism: positive secrecy rate, outage complement, or finite-blocklength decoding success.

2. Canonical secrecy models underlying AST

AST is built from a wiretap model with a legitimate link and an eavesdropper link. In the MMF formulation, the baseband model is

$\mathbf{H}$2

with transmit covariance $\mathbf{H}$3, total power constraint $\mathbf{H}$4, perfect knowledge of $\mathbf{H}$5, and only distributional knowledge of $\mathbf{H}$6 at the transmitter (Jorswieck et al., 2021). The secrecy design uses a message covariance $\mathbf{H}$7 and an artificial-noise covariance $\mathbf{H}$8 satisfying

$\mathbf{H}$9

with $$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$0. The resulting legitimate and eavesdropper capacities are log-determinant expressions,

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$1

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$2

which then feed the positive-part secrecy rate (Jorswieck et al., 2021).

Wireless AST models frequently replace matrix capacities by scalar SNR-based expressions. In the rotatable-antenna system, the channels are

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$3

with Rician fading, instantaneous SNRs $$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$4, and capacities

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$5

(Jiang et al., 22 Nov 2025). In RIS-assisted mixed RF-FSO and integrated RF-UWOC systems, the instantaneous secrecy capacity is written as

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$6

where $$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$7 is the end-to-end legitimate SNR, typically based on a dual-hop approximation, and $$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$8 is the wiretap SNR in the relevant eavesdropping scenario (Rahman et al., 2023, Sarawar et al., 2024).

Finite-blocklength AST retains the same basic wiretap structure but replaces asymptotic secrecy capacity by a reliability-and-dispersion-limited expression. In the FAS short-packet model,

$$\mathrm{AST}= \mathbb{E}[C_s(\theta)] =\mathbb{E}\!\bigl[\max(0,C_B(\theta)-C_E(\theta))\bigr],$$9

when $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$0, with

$$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$1

and an RU decoding-error expression $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$2 given by a Gaussian-$$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$3 function (Zheng et al., 18 Mar 2026). In the RIS-assisted AAV short-packet model, the block error likewise depends on

$$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$4

together with dispersion terms $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$5, $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$6, and the leakage parameter $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$7 (Liu et al., 18 Sep 2025). Across these formulations, AST inherits its statistical structure from the joint law of the main and wiretap channels and its operational meaning from the secrecy criterion enforced at the code level.

3. Optimization formulations and algorithmic approaches

AST is usually the objective of a constrained resource-allocation problem. In the MMF setting, the design problem is

$$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$8

subject to positive semidefiniteness and the total power constraint. The associated Lagrangian introduces a scalar multiplier $$\mathrm{AST}=R_s(1-P_{\mathrm{outage}}), \qquad P_{\mathrm{outage}}=\Pr\{C_s(\theta)<R_s\}$$9 and Hermitian PSD multipliers $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$0, and the KKT conditions impose stationarity and complementary slackness. The paper states that $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$1 is a difference of two concave log-det functionals, so the problem is in general nonconvex (Jorswieck et al., 2021). To handle this, a threshold-based “Greedy AN Allocation” algorithm is proposed: compute the SVD of $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$2, assign message power to modes with $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$3, assign AN power to modes with $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$4, estimate $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$5 by Monte Carlo over $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$6, and optimize over the threshold and relative power split by grid search or golden-section search (Jorswieck et al., 2021).

The rotatable-antenna AST maximization problem is reduced to a scalar adjustment factor $T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$7. The expected secrecy rate

$T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$8

is expressed as a double integral involving noncentral-$T(R)=\bigl[1-P_{\mathrm{out}}(R)\bigr]R,$9 densities. The paper proves quasi-concavity with respect to $T_u^\psi(R_u)$0, establishes single-peaked behavior, and therefore uses bisection to find the unique maximizer. Under line-of-sight only, a closed-form near-optimal solution is derived; at high SNR,

$T_u^\psi(R_u)$1

with corresponding optimal deflection angles $T_u^\psi(R_u)$2 and $T_u^\psi(R_u)$3 (Jiang et al., 22 Nov 2025).

Finite-blocklength AST optimization commonly couples coding parameters with AN or power-allocation variables. In the AIL-based formulation, one chooses blocklengths $T_u^\psi(R_u)$4 and AN power fractions $T_u^\psi(R_u)$5 to maximize

$T_u^\psi(R_u)$6

under a maximum blocklength, integrality of $T_u^\psi(R_u)$7, $T_u^\psi(R_u)$8, and the per-slot leakage constraint $T_u^\psi(R_u)$9. The adaptive design decomposes the problem into per-slot subproblems; because the secrecy constraint is nonconvex in $T_c^\psi(R_c)$0, the paper proposes either a 2-D exhaustive or heuristic search, or a lower-complexity alternating scheme that first inverts the approximate AIL constraint to obtain the minimal feasible $T_c^\psi(R_c)$1, then performs a one-dimensional maximization in $T_c^\psi(R_c)$2 with bisection, and finally rounds $T_c^\psi(R_c)$3 to an integer (Mamaghani et al., 2023). The non-adaptive design replaces slot-wise adaptation by a single $T_c^\psi(R_c)$4 chosen from channel statistics and an on-off threshold $T_c^\psi(R_c)$5 defined by

$T_c^\psi(R_c)$6

(Mamaghani et al., 2023).

In the VBCM-based FAS short-packet framework, the paper proves that AAST is monotonically non-decreasing in the number of RU ports $T_c^\psi(R_c)$7. This reduces a three-dimensional joint optimization over transmit power, blocklength, and port number to a two-dimensional grid search over $T_c^\psi(R_c)$8, with the corollary $T_c^\psi(R_c)$9 (Zheng et al., 18 Mar 2026). In RIS-assisted short-packet AAV networks, the blocklength problem

$i$0

is shown to be quasi-concave under continuous relaxation, so the optimizer satisfies

$i$1

and can be found by bisection, with integer selection by comparing neighboring integers (Liu et al., 18 Sep 2025). Across these systems, AST optimization is typically nonconvex but often admits dimensionality reduction, structural monotonicity, or one-dimensional searches once the physical model is exploited.

4. Finite-blocklength and short-packet formulations

Finite-blocklength AST departs from asymptotic secrecy-rate analysis by incorporating decoding error, information leakage, and latency directly into the throughput metric. In fading wiretap channels without instantaneous eavesdropper CSI, the AIL-based framework introduces the instantaneous secrecy throughput

$i$2

where $i$3 is the average information leakage in slot $i$4 and $i$5 is the maximum tolerable AIL threshold (Mamaghani et al., 2023). The finite-blocklength secrecy rate approximation is based on the Polyanskiy–Yang–Poor bound, and the average leakage is approximated as

$i$6

which produces tractable adaptive and non-adaptive AST designs (Mamaghani et al., 2023). The paper reports that allowing a small, nonzero AIL can drastically reduce the required blocklength or improve reliability by tens of dB in error probability, and that AN beamforming can drive $i$7 as SNR $i$8, whereas pure MRT asymptotes to a nonzero leakage floor (Mamaghani et al., 2023).

The FAS short-packet framework introduces a variable block-correlation model (VBCM) for the spatially correlated fluid-antenna channels. The AST is

$i$9

with the decoding error approximated by a three-segment linear function of $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$0 conditioned on $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$1. Closed-form and asymptotic expressions are obtained by combining this piecewise linearization with Gauss-Chebyshev quadrature (Zheng et al., 18 Mar 2026). The paper further proves that $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$2 is non-decreasing in $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$3, and its numerical results show an order-of-magnitude secrecy throughput improvement over conventional fixed-position antenna systems, with blocklength selection identified as the most critical design parameter (Zheng et al., 18 Mar 2026).

In RIS-assisted AAV short-packet networks, the AST is

$$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$4

and the external-eavesdropper case is expressed as a double integral over the AAV and eavesdropper SNRs,

$$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$5

(Liu et al., 18 Sep 2025). The internal-eavesdropper case includes NOMA decoding of an untrusted user’s symbol, residual SIC interference, and a worst-case eavesdropper model. The paper gives

$$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$6

and states that the AST in the internal-eavesdropper case is invariably lower than in the external-eavesdropper case because of the two-stage SIC decoding (Liu et al., 18 Sep 2025). The asymptotic analysis also shows that, in the external scenario, AST converges to a limit independent of $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$7 as $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$8 (Liu et al., 18 Sep 2025).

A recurring structural feature of finite-blocklength AST is the rate–reliability–secrecy trade-off. In the AIL framework, too short a blocklength leads to high leakage and on-off suppression of throughput, whereas too long a blocklength reduces the per-block rate $$\mathcal T[i]=(1-\varepsilon)\,\frac{m}{N[i]}\,\mathbf{1}\{\bar\delta[i]\le\phi\},$$9, so the optimum lies in a mid-range (Mamaghani et al., 2023). In the FAS and AAV short-packet models, AST is likewise unimodal in blocklength because the coding-rate term decreases with $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$00 or $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$01 while the error term improves (Zheng et al., 18 Mar 2026, Liu et al., 18 Sep 2025).

5. Representative channel families and numerical behavior

Measured MMF channels provide a concrete example in which AST is improved by artificial noise adapted to the modal eigen-structure. For a 55-mode MMF, the paper reports positive average secrecy rates with the proper use of AN and compares Greedy AN with waterfilling. The mean secrecy throughput values are $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$02 versus $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$03 bits/s/Hz at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$04 dB, $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$05 versus $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$06 bits/s/Hz at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$07 dB, and $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$08 versus $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$09 bits/s/Hz at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$10 dB for waterfilling and Greedy AN, respectively. At $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$11 dB this is described as a $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$12 increase, and at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$13 dB the gain exceeds $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$14. The Greedy AN curve remains above the pessimistic ergodic lower bound and approaches the upper bound at high SNR (Jorswieck et al., 2021).

RIS-assisted AmBC introduces a two-stream AST structure. The data-signal and backscatter ASTs are

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$15

with separate outage behavior under ipSIC and pSIC (Pei et al., 2024). The asymptotic analysis shows that the data-link secrecy diversity order is zero, because the backscatter link acts as residual interference in the SIC process, and that the backscatter link has $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$16 but $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$17 (Pei et al., 2024). Numerical results confirm that AST versus the number of RIS elements $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$18 is non-monotonic, reflecting the balance between a stronger backscatter link and heavier interference on the data link; the reflecting coefficient $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$19 has opposite effects on the two AST components; and stronger eavesdropping ability lowers both ASTs (Pei et al., 2024).

Integrated RF-UWOC IoT and mixed RF-FSO systems employ outage-based AST or EST,

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$20

under multiple eavesdropping scenarios (Sarawar et al., 2024, Rahman et al., 2023). In the integrated RF-UWOC model, the paper states that AST is unimodal in $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$21, because a higher $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$22 raises throughput but also increases SOP. It also identifies simultaneous RF and UOWC eavesdropping as the worst case, reports that increasing the number of RIS elements improves coherent beamforming underwater and hence AST, and notes that heterodyne detection outperforms IM/DD in secrecy (Sarawar et al., 2024). The mixed RF-FSO RIS model reaches analogous conclusions: larger $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$23, stronger line-of-sight components, weaker turbulence, and smaller pointing error improve AST, and heterodyne detection performs better than IM/DD (Rahman et al., 2023).

Free-space optical MIMOME systems under secrecy-outage constraints use EST as

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$24

in the unconstrained form, and set the metric to zero when the secrecy-outage constraint $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$25 is violated (Monteiro et al., 2017). The adaptive scheme fixes $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$26 so that the reliability outage vanishes, whereas the fixed-rate scheme optimizes both $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$27 and $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$28. The numerical results show that the adaptive scheme is always at least as large as the fixed-rate scheme and that more apertures greatly improve EST (Monteiro et al., 2017).

6. Recurring trade-offs and interpretive issues

A persistent source of ambiguity is that AST is not identical to secrecy capacity. In outage-based formulations, AST is not the expected secrecy capacity but the target secrecy rate multiplied by the non-outage probability: $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$29 or

$$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$30

(Sarawar et al., 2024, Pei et al., 2024). In expectation-based formulations, by contrast, AST is an average of the positive-part secrecy rate itself (Jorswieck et al., 2021, Jiang et al., 22 Nov 2025). These are different operational metrics even when they are both called secrecy throughput.

Another recurring distinction is between asymptotic coding and finite blocklength. In finite blocklength, AST explicitly depends on blocklength and dispersion, and thus on a three-way compromise between spectral efficiency, reliability, and secrecy (Mamaghani et al., 2023, Zheng et al., 18 Mar 2026, Liu et al., 18 Sep 2025). The AIL-based work states that the optimum non-adaptive $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$31 typically lies in the mid-range, while the FAS and AAV short-packet studies report unimodal dependence on blocklength (Mamaghani et al., 2023, Zheng et al., 18 Mar 2026, Liu et al., 18 Sep 2025). This suggests that AST maximization in short-packet secrecy systems is inherently a joint coding-and-resource-allocation problem rather than a pure power-control problem.

Higher SNR does not uniformly translate into higher AST. In RIS-AmBC, ipSIC induces an error floor for both links, so both ASTs saturate and the secrecy diversity orders are zero (Pei et al., 2024). In the internal-eavesdropper RIS-AAV setting with imperfect SIC, the numerical results show that AST peaks at a moderate $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$32 and then collapses because the residual interference term scales with transmit power (Liu et al., 18 Sep 2025). In contrast, MMF with Greedy AN shows large AST gains at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$33 dB and $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$34 dB and approaches the upper bound at high SNR (Jorswieck et al., 2021). The role of SNR is therefore model-dependent and strongly mediated by interference cancellation, AN structure, and short-packet penalties.

Additional degrees of freedom also have nonuniform effects. Increasing the number of RU ports in the VBCM-based FAS model provably makes AAST non-decreasing, with the optimizer at $$\mathrm{AST} =\mathbb{E}_{\mathbf{H},\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr], \qquad \mathrm{AST}(\mathbf{H}) =\mathbb{E}_{\mathbf{G}}\!\bigl[R_s(\mathbf{H},\mathbf{G})\bigr]$$35 (Zheng et al., 18 Mar 2026). By contrast, the RIS-AmBC system has an overall AST that is non-monotonic in the number of RIS elements because stronger backscatter also intensifies interference on the data stream (Pei et al., 2024). A plausible implication is that structural resources such as ports, RIS elements, apertures, or modes improve AST only when the corresponding receiver architecture and interference model preserve the gain rather than convert it into additional coupling or SIC burden.

Across these formulations, AST functions as an operational bridge between secrecy theory and secure-link design. It is the metric through which AN covariance shaping in MMF, deflection-angle control in rotatable antennas, blocklength and leakage management in finite-blocklength wiretap coding, and RIS or FAS architecture choices are rendered directly comparable at the system level (Jorswieck et al., 2021, Jiang et al., 22 Nov 2025, Mamaghani et al., 2023, Zheng et al., 18 Mar 2026).