Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Technical Summary: Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Problem Statement
Quantum Key Distribution (QKD) security proofs typically assume stationary channels between device recalibrations. In practice, legitimate parties (Alice and Bob) must provision operating margins to accommodate device drift and channel noise. These margins are currently set based on device characterisation rather than an analysis of what an eavesdropper (Eve) could gain by adapting her strategy to the channel's drift. While static numerical methods (e.g., semidefinite relaxations) bound Eve's information for a fixed noise level, they do not address the sequential decision problem posed by a drifting channel. Specifically, it has not been quantified whether an attacker, constrained by the physical noise process she cannot alter, can extract significantly more information by adapting her attack strategy round-by-round compared to using a single fixed strategy.

Methodology
The authors extend the "learnt attack" framework of Decker et al. [13] to address two primary limitations: fixed circuit templates and stationary channels.

1. Joint Search of Topology and Parameters: Instead of optimizing only rotation angles within a pre-defined circuit template, the authors treat the gate structure (topology) and rotation angles as unknowns. They employ an evolutionary outer loop to propose gate sequences (using $\{RX, RY, RZ, CNOT\}$) and an inner loop (using gradient-free optimizers like CMA-ES or SPSA) to tune angles. This allows the discovery of compact circuits (4–9 gates) suitable for discrete action sets, applicable even to noise models lacking known analytical templates (e.g., amplitude damping).
2. Adaptive Eavesdropping as a Constrained MDP: The drifting channel is modeled as an Ornstein–Uhlenbeck process. The attacker's problem is formulated as a constrained Markov Decision Process (MDP).
   • State: The attacker observes the current noise level, recent history, and accumulated statistics.
   • Action: Selection of a circuit from a pre-learned library.
   • Constraint: The mean monitored statistic (e.g., fidelity $F_{AB}$ or CHSH value $S$) over a block of rounds must not cross an abort threshold.
   • Objective: Maximize expected information (Holevo quantity $\chi$ or fidelity $F_{AE}$) while avoiding detection.
3. Evaluation Framework: The value of adaptation is bounded by comparing a reinforcement learning (RL) agent against:
   • The best fixed circuit (static baseline).
   • A greedy oracle that selects the best safe action myopically.
   • A dynamic programming (DP) upper bound, which solves the MDP optimally over the library to establish the theoretical maximum for the given action set.

Key Contributions

1. Mapping Attainable Information: The authors map the maximum information an attacker can extract on stationary noisy channels across different noise families (Pauli and amplitude damping) and monitoring conventions. They quantify the separation between the theoretical "noiseless" cloning bound and the actual attainable bound under trusted-noise conventions.
2. Basis Asymmetry and Monitoring Conventions: The study demonstrates that the sign of an attacker's gain from basis asymmetry depends on the monitoring convention. Under a basis-averaged error rate constraint, asymmetry yields a small positive gain; under per-basis constraints, the gain reverses sign and increases significantly in magnitude.
3. Bilateral Noise in Entanglement-Based Protocols: For the device-independent E91 protocol, the authors derive that bilateral depolarising noise affects the CHSH value quadratically ($(1-p)^2$), whereas a single-subsystem model would incorrectly estimate a linear degradation. This identifies a specific noise threshold ($p_{cliff} \approx 0.074$) beyond which even an undisturbed link yields no key.
4. Quantifying the Value of Adaptation: By solving the constrained MDP, the authors show that adaptive strategies significantly outperform static ones:
   • E91 (Device-Independent): An adaptive attacker increases Holevo information from 0.135 (best fixed circuit) to 0.348 (adaptive RL agent) at zero detection, reaching 98% of the DP upper bound. This represents a ~2.6x increase in extracted information.
   • BB84: The adaptive agent exceeds a conservative, noise-indexed rule by 0.024 in fidelity, capturing roughly 75% of the theoretical headroom available up to the DP bound.
5. Validation: The search procedure recovers known analytical results (e.g., optimal cloners for Pauli noise, collective-attack key rates) and meets the lower bound of the Winick–Lütkenhaus–Coles objective from above, validating the search methodology.

Results

• Stationary Noise: For stationary channels, the search confirms that the "trusted-noise" convention (where the attacker cannot alter the channel noise) results in a conservative margin. The gap between the theoretical noiseless bound and the attainable bound grows with noise levels.
• Drifting Noise:
  • On BB84 with a drifting bit-flip channel, the adaptive agent achieves $F_{AE} = 0.7434$ (strictly zero detection), matching the greedy oracle and achieving 99% of the DP upper bound ($0.7527$).
  • On E91 with bilateral depolarising noise, the adaptive agent achieves $\chi \approx 0.348$ (zero detection), compared to $0.135$ for the best fixed circuit. The agent reaches 98% of the DP upper bound ($0.356$).
  • The results indicate that the "value of adaptation" is substantial, particularly for device-independent protocols where the noise geometry is more restrictive.
• Detection Tolerance: Allowing a small detection rate (e.g., 4% on BB84) yields marginal gains over strict zero-detection strategies, suggesting that the primary advantage comes from the adaptation itself rather than risk tolerance.

Significance and Claims
The paper claims to provide the first quantification of the advantage an eavesdropper gains by adapting to channel drift when constrained by the physical noise process. The authors state that this work does not invalidate existing security proofs (which remain valid under entropy-accumulation arguments) but rather clarifies the "operating margin" between the proven security bound and the actual information available to a physically restricted attacker.

The significance lies in translating dynamic threats into measurable, optimizable quantities. This allows network operators to potentially extend recalibration intervals and maximize throughput without compromising security, addressing a primary economic barrier to the commercial adoption of QKD. The authors emphasize that their results are constructive lower bounds on attacker power; they complement, rather than replace, formal security proofs which provide the necessary upper bounds. The work highlights that current static assumptions may lead to over-provisioning (loss of key rate) or underestimation of risk in drifting environments.