Adversarial Stress Tests for Quantum Certification

1. Problem Statement

The paper addresses a critical vulnerability in Semi-Device-Independent (SDI) certification protocols: the risk of false certification arising not from genuine quantum advantages, but from misalignment between the experimental operational model and the theoretical benchmark used for comparison.

In standard SDI scenarios (e.g., dimension witnesses), certification relies on comparing an observed score against a classical ceiling ($S_C$). However, realistic implementations often deviate from idealized assumptions (Independent and Identically Distributed - IID inputs, no memory, no selection bias). These deviations include:

• Input Bias: Non-uniform distribution of query settings.
• Temporal Correlations/Memory: Device behavior dependent on history.
• Selection Effects/Postselection: Discarding specific rounds (e.g., detection failures) before scoring.
• Adaptive Control: Classical agents adjusting strategies based on past data.

The authors argue that if the scoring rule, the statistical confidence bound, and the classical reference value are not defined under the same operational data model, the system may produce "artificial" violations of classical limits. These violations persist even asymptotically (as sample size $N \to \infty$) and are distinct from statistical fluctuations, which vanish with large $N$.

2. Methodology

The authors propose a protocol-agnostic framework based on an Alignment Principle. The core methodology involves three aligned components:

1. Operational Score Definition:

   • The paper advocates for unconditional scoring. Instead of calculating the success rate only over "kept" rounds (conditional scoring), the score must be calculated over all attempted rounds ($N_{test}$).
   • Discarded rounds are treated as failures (contribution = 0). This prevents adversarial postselection from artificially inflating the score.
   • Formula: $\hat{S} = \frac{1}{N_{test}} \sum_{t \in T} X_t$, where $X_t$ is the success indicator.

2. Martingale-Safe Statistical Bounds:

   • To handle temporal correlations and adaptive strategies (non-IID data), the framework uses martingale concentration inequalities (e.g., Azuma-Hoeffding) rather than standard IID assumptions.
   • This provides a lower confidence bound ($S_{low}$) that remains valid even if the device has memory or adaptive behavior.
   • Formula: $S_{low} = \hat{S} - \sqrt{\frac{\ln(1/\alpha)}{2N_{test}}}$.

3. Effective Classical Ceiling ($S_{C,eff}$):

   • The classical benchmark must be re-derived to match the specific operational deviations (e.g., biased inputs, selection rules).
   • The authors formalize $S_{C,eff}$ as the solution to a finite optimization problem over the convex hull of deterministic encoder-decoder strategies consistent with the operational constraints.
   • For biased inputs, $S_{C,eff}$ is higher than the ideal uniform-input ceiling.

The Diagnostic Metric: Robustness Gap ($\Delta_{rob}$)
The central diagnostic tool is the Robustness Gap:
$$\Delta_{rob} = S_{low} - S_{C,eff}$$

• $\Delta_{rob} > 0$: Genuine supra-classical certification (at confidence level $1-\alpha$).
• $\Delta_{rob} \leq 0$: The data is consistent with classical strategies under the operational model.

3. Key Contributions

• Formalization of the Alignment Principle: The paper identifies that certification validity requires consistency between the score, the statistical bound, and the classical benchmark. Misalignment is shown to be a structural modeling error, not just a statistical one.
• Adversarial Stress Testing via Reinforcement Learning (RL): The authors use learning-based classical agents (bandit algorithms) to stress-test the framework. They demonstrate that adaptive classical strategies do not create new loopholes; rather, they simply recover the effective classical ceiling implied by the operational model.
• Resolution of Postselection Loopholes: The paper proves that conditional scoring combined with postselection can inflate scores to 1.0 (perfect success) even for classical systems. Unconditional scoring restores the correct operational meaning.
• Asymptotic Distinction: The work clearly distinguishes between statistical noise (vanishes as $N \to \infty$) and model misalignment (persists as $N \to \infty$), showing that false certification can be permanent if the benchmark is incorrect.

4. Results (Case Study: 2→1 Random Access Code)

The framework was tested using the 2→1 Random Access Code (RAC), a minimal SDI task where a classical bit is sent to guess one of two input bits.

• Biased Inputs:
  • When input queries are biased (probability $q \neq 0.5$), the ideal classical ceiling ($0.75$) is invalid.
  • The effective ceiling becomes $S_{C,eff} = 0.75 + |2q - 1|/2$.
  • Result: Data appearing to violate the $0.75$ limit was shown to be fully classical once compared against the bias-corrected $S_{C,eff}$.
• Adaptive Strategies:
  • RL agents (bandits) adapted to biased or drifting input distributions.
  • Result: The agents improved their performance to match the analytically derived $S_{C,eff}$ but never exceeded it. This confirms that adaptive learning does not expand the set of achievable classical correlations; it only optimizes within the constraints of the operational model.
• Postselection Stress Test:
  • When using conditional scoring with adversarial postselection (discarding failures), the score approached 1.0, falsely suggesting quantumness.
  • Result: Switching to unconditional scoring immediately restored the score to the classical limit, eliminating the false certification.
• Memory and Misalignment:
  • Simulations showed that while static classical strategies might occasionally fail to trigger false positives under a "careless" (misaligned) benchmark, adaptive memory significantly amplifies the rate of false certification by efficiently tracking drift and bias. However, under the aligned framework (unconditional scoring + effective ceiling), all strategies (static or adaptive) satisfied $\Delta_{rob} \leq 0$.

5. Significance and Implications

• Systematic Diagnostic for Real-World Quantum Tech: The framework provides a necessary "sanity check" for quantum communication and measurement systems (e.g., QKD, randomness expansion) where classical control, data filtering, and non-ideal hardware are ubiquitous.
• Closing the "Modelling Loophole": The paper shifts the focus from physical loopholes (like detection efficiency) to modelling loopholes. It argues that many apparent quantum advantages in noisy, adaptive environments may simply be artifacts of comparing real-world data against idealized theoretical bounds.
• Protocol Agnosticism: While demonstrated on the 2→1 RAC, the alignment principle and the robustness gap metric are applicable to any SDI or Device-Independent (DI) certification task involving finite data and operational deviations.
• Future Directions: The authors suggest integrating this alignment logic with algorithmic computation of classical polytopes and applying it to entropic witnesses and higher-dimensional tests.

In summary, the paper establishes that robust certification requires operational consistency. Without aligning the scoring rule, statistical bounds, and classical benchmarks to the actual experimental conditions (including bias and selection), certification claims are structurally unsound, regardless of the sample size.