Lemma: Two-share privacy

For every set $E$ of at most two physical qubits,

This identity holds on all operators, not only states.

Proof. The syndrome table contains each nonzero four-bit string exactly once. A nonidentity Pauli of weight one has nonzero syndrome. A weight-two Pauli has the sum of two distinct one-site syndromes, again nonzero. Such a Pauli $Q$ anticommutes with a stabilizer generator, implying $V^{†}QV=0$. Expanding operators on $E$ in its Pauli basis proves (eq:privacy).