Post-selective attack with multi-mode projection onto Fock subspace

1. Problem Statement

The paper addresses a critical vulnerability in Quantum Key Distribution (QKD) protocols that utilize phase-encoded linearly independent coherent states (e.g., weak coherent pulses) but do not implement decoy-state protocols or single-photon fraction extraction (such as the GLLP framework).

• Context: While standard security analyses often rely on the Holevo bound (the maximum information an eavesdropper can extract via collective attacks), recent research suggests that post-selective attacks can surpass this bound.
• The Gap: Previous post-selective attacks often relied on abstract transformations without specifying physical realizations. Furthermore, specific attacks combining Photon-Number Splitting (PNS) techniques with post-selection had not been fully analyzed for phase-encoded states in a way that provides a concrete optical implementation.
• Objective: The authors propose and analyze a specific attack scenario where an eavesdropper (Eve) uses multi-mode projection onto a Fock subspace to extract information probabilistically, potentially exceeding the Holevo bound and obtaining the entire key under certain channel conditions.

2. Methodology

The proposed attack relies on a specific sequence of optical operations and quantum state manipulations:

A. Core Mechanism: Multi-mode Projection

The attack exploits the fact that a single-mode coherent state $|\alpha e^{i\phi}\rangle$ loses phase information when projected directly onto a Fock state (photon number state). However, by concatenating the signal with a reference coherent state, Eve creates a two-mode entangled state:
$$|\psi(\alpha, \phi_j)\rangle = |\alpha\rangle \otimes |\alpha e^{i\phi_j}\rangle$$
Eve then applies a projection operator $Q(n)$ onto the subspace where the total photon number is $n$:
$$Q(n) = \sum_{k=0}^{n} |n-k\rangle\langle n-k| \otimes |k\rangle\langle k|$$
This results in a reduced state $|\xi^{(n)}\rangle$ where the overlap between states with different phases $\phi_i$ and $\phi_j$ is modified. Crucially, the scalar product of these reduced states becomes:
$$|\langle \xi^{(n)}(\alpha, \phi_i) | \xi^{(n)}(\alpha, \phi_j) \rangle| = \left( \cos \frac{\phi_i - \phi_j}{2} \right)^n$$
As $n$ increases, the states become more distinguishable (the overlap decreases), allowing Eve to extract more information than the original states permit.

B. Attack Scenario

1. Splitting: Eve intercepts the signal $|\alpha e^{i\phi_j}\rangle$ and splits it using a beamsplitter (transmissivity $\eta_1$ for Eve, $\eta_2$ for the receiver).
2. Augmentation: Eve adds a reference beam (phase-matched) to her portion to form the two-mode state $|\psi\rangle$.
3. Projection & Post-selection:
   • Eve projects the state onto the Fock subspace $n$.
   • Case $n=0$: The resulting state is vacuum (no phase info). Eve blocks the signal sent to the receiver to maintain the expected detection rate.
   • Case $n \geq 1$: The signal is allowed to pass to the receiver. Eve stores the reduced state $|\xi^{(n)}\rangle$ in quantum memory.
4. Information Extraction: After the legitimate users reveal their basis choices, Eve measures her stored states. The information gained depends on the photon number $n$.

C. Efficiency Calculation

The total information $I$ Eve extracts is calculated by summing the information from all non-zero photon number outcomes, weighted by their probability, and normalized by the probability of non-blocked events:
$$I = z \sum_{n=1}^{\infty} \frac{P(2|\eta_1||\alpha|^2, n) \cdot \chi^{(n)}(\Delta)}{1 - P(2|\eta_1||\alpha|^2, 0)}$$
Where:

• $z$ is the fraction of signals attacked.
• $\chi^{(n)}(\Delta)$ is the Holevo bound for the reduced states with $n$ photons.
• $\Delta$ is the phase separation in the information basis.
• $\eta_L$ is the channel loss.

3. Key Contributions

1. Explicit Physical Realization: Unlike previous theoretical post-selective attacks, this paper provides a concrete optical scheme (using beamsplitters, reference beams, and Fock projections) that can be physically implemented.
2. Surpassing the Holevo Bound: The authors derive analytical expressions proving that for specific ranges of channel loss ($\eta_L$) and mean photon number ($|\alpha|^2$), the information extracted by this attack ($I$) exceeds the standard Holevo bound ($\chi$) calculated for the initial states.
3. Three-Parameter Dependency: The attack's success is shown to depend strictly on three protocol parameters:
   • Mean photon number ($|\alpha|^2$).
   • Phase separation ($\Delta$).
   • Channel loss ($\eta_L$).
4. Application to Diverse Protocols: The attack is demonstrated to be applicable to various QKD implementations, including:
   • Mach-Zehnder Interferometer (MZI) based protocols.
   • Phase-time coding schemes.
   • Phase-matching (PM) QKD (e.g., Twin-Field QKD variants).
   • Subcarrier Wave (SCW) QKD.

4. Results and Analysis

The authors analyze the efficiency of the attack by comparing $I$ (attack information) against $\chi$ (Holevo bound) across different parameter spaces:

• High Efficiency Region: The attack is most effective in the low transmission (high loss) regime, specifically when $\eta_L \leq |\alpha|^2 / 2$. In this region, Eve can obtain 100% of the key information ($I=1$) while maintaining the detection rate.
• Superiority Zone: There exists a "middle region" where $I > \chi$ but $I < 1$. Here, the attack is strictly superior to any collective attack but does not yield the full key.
• Limitations:
  • If the channel loss is very low ($\eta_L$ is small), the attack becomes less efficient than standard collective attacks unless the mean photon number is also very low.
  • The attack requires the protocol not to use decoy states. If decoy states (different intensities) are used, Eve cannot satisfy the detection rate condition for all intensities simultaneously, rendering the attack ineffective.
• Phase Sensitivity: The attack remains effective even as the phase difference $\Delta \to 0$, though the region of superiority shrinks. Numerical analysis suggests that for $|\alpha|^2 \gtrsim 0.34$, the attack is generally less efficient than collective attacks regardless of $\Delta$.

5. Significance and Countermeasures

Significance:
This work highlights a severe security loophole in practical QKD systems that rely on phase encoding without decoy-state verification. It demonstrates that the "Holevo bound" is not an absolute limit if the eavesdropper can perform post-selection and manipulate the detection statistics. The attack is particularly dangerous for long-distance QKD where channel loss is high.

Proposed Countermeasures:
The authors suggest several strategies to mitigate this threat:

1. Decoy-State Implementation: Using multiple signal intensities ($|\alpha|^2$) prevents Eve from maintaining the correct detection rate for all intensities simultaneously, breaking the attack's condition.
2. Correlation Monitoring: Legitimate users should monitor not just the detection rate (linear in photon number) but also correlation functions (quadratic in photon number) to detect the specific statistical anomalies introduced by the attack.
3. Single-Photon Fraction Extraction: Ensuring that the protocol processes only single-photon events (via GLLP framework) removes the multi-photon events that the attack relies on.
4. Parameter Optimization: Adjusting the protocol parameters (specifically increasing $|\alpha|^2$ or modifying $\Delta$) to push the system out of the "attack superiority" region shown in the paper's figures.

In conclusion, the paper provides a rigorous theoretical and practical framework for a new class of QKD attacks, urging the community to move beyond standard collective attack assumptions and implement robust countermeasures like decoy states in phase-encoded systems.