🔬 physics

Quantum Vault: Symmetric No-Cloning Protection for Token Issuer and User (Benchmarked on IBM Quantum)

This paper proposes and benchmarks a "Quantum Vault" protocol on IBM Quantum processors that secures token authentication by storing token copies at the issuing bank to eliminate classical side information, thereby symmetrically protecting both users and issuers against forgery while enabling public verifiability, traceability, and revocability with negligible error rates.

Original authors: Lucas Tsunaki, Boris Naydenov

Published 2026-10-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Lucas Tsunaki, Boris Naydenov

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of secure communication, there is a fundamental rule of nature that acts as a perfect lock: you cannot make a perfect copy of an unknown quantum state. This principle, known as the no-cloning theorem, suggests that if a piece of information exists in a quantum form, it is impossible to duplicate it without destroying the original. This idea has long fueled dreams of unforgeable digital currency and unbreakable identity cards, often called quantum money or tokens. The concept is simple: a bank issues a physical token holding a specific, secret quantum state. To spend it, the user presents the token to a merchant, who checks if the state matches the bank's records. If the token has been copied, the laws of physics guarantee the copy will fail the test. However, for decades, a critical weakness remained in these plans. The system relied on the bank keeping a secret list of the quantum states' settings in a classical computer database. If a hacker stole that digital list, they could simply recreate the tokens perfectly, bypassing the quantum lock entirely. The security of the entire system depended on the secrecy of a digital file, a vulnerability that recent global cyberattacks have shown is all too real.

A team of researchers at the Helmholtz-Zentrum Berlin for Materials and Energy has proposed a new way to solve this problem, removing the need for that vulnerable digital list entirely. Instead of storing the secret settings in a computer, they suggest the bank keeps a physical copy of the token itself in a secure "quantum vault." When the bank issues a token to a user, it simultaneously creates an identical twin and stores it in this vault. To verify a token, the bank or an authorized merchant does not look up a number in a database. Instead, they perform a direct physical comparison between the user's token and the one sitting in the vault. If the two are identical, the token is accepted; if they differ, it is rejected. This method ensures that even if a hacker steals every piece of classical data the bank possesses, they cannot forge a token because they lack the physical quantum twin required for the comparison. The researchers tested this idea using real quantum computers from IBM, running simulations to see how well the system holds up against a determined attacker trying to guess the token's state.

The experiment involved creating tokens made of many small quantum bits, rather than just one, to make the verification process more robust. The researchers simulated a scenario where a hacker tried to steal information about a genuine token by measuring it in different ways and then using that information to build a fake copy. They found that while a hacker could successfully guess the state of a single token with a relatively high chance of success, the odds of them forging an entire bill made of many tokens dropped dramatically. In their tests, using a bill composed of 200 tokens, the probability of a successful forgery on the least powerful computer they tested was less than one in ten billion. Even on the most advanced machines available to them, the chance of a fake bill slipping through was vanishingly small, while genuine bills were accepted with near certainty. This demonstrates that by removing the classical secret and relying on a physical comparison, the system becomes secure against the most common type of digital theft.

The study also highlighted how the quality of the hardware affects security. The researchers ran the same protocol on three different quantum processors, each with slightly different levels of precision and error rates. They found that even on the machine with the highest error rates, the system remained incredibly secure, though the margin of safety was tighter than on the better machines. This suggests that as quantum hardware continues to improve, the security of such a system will only get stronger. The researchers noted that this approach changes the nature of the token from an anonymous piece of cash to a traceable identity card, similar to a credit card. Because the bank holds the vault copy, they can track who owns which token and revoke access if necessary, adding a layer of governance that anonymous cash cannot offer.

Perhaps the most significant aspect of this work is that it moves the security of the system from the digital realm to the physical realm. In previous proposals, the security relied on the assumption that the bank's computer database was impenetrable. In this new model, the security relies on the laws of physics and the physical presence of the vault copy. The researchers showed that this method works even when the verification process is open to untrusted parties, such as a vendor who does not know the user personally. The vendor simply needs access to the bank's vault interface to perform the comparison, without ever needing to know the secret settings of the token. This opens the door for a public verification system where anyone can check a token's validity, provided they have a link to the bank's secure vault.

The researchers acknowledge that building a real-world version of this system faces significant hurdles, primarily the difficulty of storing quantum states for long periods without them fading away. Current quantum memories are fragile and often require extreme cold or vacuum conditions, making them difficult to carry around like a wallet. However, the study serves as a crucial proof of concept, showing that the theoretical framework is sound and that the security metrics are achievable with existing technology. By benchmarking the protocol on real hardware, the team provided concrete data on how many tokens are needed to ensure safety and how the system behaves under real-world noise and errors. Their work suggests that while the technology to carry a quantum vault in a pocket is not yet here, the path to creating unforgeable, traceable, and secure digital identities is becoming clearer, relying not on secret passwords, but on the unbreakable rules of the quantum world.

Technical Summary: Quantum Vault: Symmetric No-Cloning Protection for Token Issuer and User

Problem Statement
Current proposals for quantum tokens, quantum money, and identity authentication rely on the no-cloning theorem to prevent forgery. In standard architectures, an issuing agent (e.g., a bank) prepares a quantum state $|\psi\rangle$ defined by classical parameters $(\theta, \phi)$ , transmits the state to a user, and stores the classical description $(\theta, \phi)$ for later verification. While the no-cloning theorem protects the user's token from being copied, this architecture contains a critical vulnerability: if an attacker steals the classical side information $(\theta, \phi)$ from the issuing agent, they can generate perfect fake tokens without violating the no-cloning theorem. The verifier, comparing the fake token against the stolen classical data, would accept it, unaware of the security breach. This "estimate-and-forge" attack on the issuer's database remains a significant, often overlooked, threat to quantum money and network proposals.

Methodology
To address this vulnerability, the authors propose the Quantum Vault protocol, which eliminates the need for the issuer to store classical descriptions of the token states. The methodology involves three primary steps:

Symmetric Token Generation: Instead of storing classical data, the bank prepares two identical quantum tokens in the same Haar-random state $|\psi\rangle^{\otimes N}$ , where $N$ is the number of non-entangled independent qubits in an ensemble. One token is given to the user, and the other is retained in the bank's "vault." Crucially, all classical information regarding the angles $(\theta, \phi)$ is immediately discarded.
SWAP Test Authentication: Authentication is performed by comparing the user's token against the vault's copy using a SWAP test. This circuit involves an auxiliary qubit, Hadamard gates, and controlled-SWAP operations between the qubits of the two tokens. The measurement outcome of the auxiliary qubit yields a value $c_n \in \{0, 1\}$ $c_{n} \in {0, 1}$ . The average of these outcomes over $N$ $N$ qubits, $\bar{c}$ $\overset{c}{ˉ}$ , serves as the observable for verification.
- If the states are identical, $\bar{c} \approx 0$ .
- If the states differ, $\bar{c} > 0$ .
Hardware-Agnostic Benchmarking: The protocol was implemented and benchmarked on three IBM Quantum processors (Kingston, Fez, and Marrakesh) using the Qiskit SDK. The study utilized an ergodic approximation, time-averaging independent sequential circuit shots to simulate an ensemble of $N$ qubits.
Security Modeling: The authors modeled an "estimate-and-forge" attack where an attacker attempts to reconstruct the token state $|\psi\rangle$ by performing SWAP tests on the user's token along the $x, y, z$ axes. The attacker uses Maximum Likelihood Estimation (MLE) to reconstruct the state and then attempts to forge a token for authentication.

Key Contributions

Symmetric Protection: The protocol provides symmetric protection for both the user and the bank. Neither party holds the classical secret; security relies entirely on the quantum no-cloning theorem and the physical presence of the vault copy.
Bank-Mediated Verifiability: By removing classical secrets, the bank can grant access to the authentication interface to untrusted third parties (e.g., vendors). These parties can verify the token's validity against the vault copy without being able to clone the token or learn its state. However, the scheme is intrinsically non-anonymous, as the bank must know the token's owner to perform the comparison, maintaining a centralized architecture rather than a true public-key system.
Traceability and Revocability: Unlike anonymous quantum money schemes, the Quantum Vault is non-anonymous. Since the bank retains the vault copy, it can trace the token's ownership and revoke it if necessary.
Quantification of Security: The paper quantifies the security of the protocol by comparing the probability of accepting genuine tokens ( $p_b$ ) versus forged tokens ( $p_f$ ) across different hardware platforms.

Results
The study benchmarked the protocol using ensembles of $N=90$ qubits (chosen to balance shot noise and discretization effects) and quantum bills composed of $M=200$ tokens.

Quality Parameters: The hardware performance was characterized by quality parameters $Q_a$ (oscillation amplitude/contrast) and $Q_o$ (offset). The Kingston processor demonstrated the best performance ( $Q_a \approx 0.892$ ), followed by Fez and Marrakesh.
False Negatives (Type 1 Error): The acceptance threshold $c^*$ was calibrated such that genuine tokens are accepted with a probability $p_b \geq 0.99$ .
False Positives (Type 2 Error): For a single token, the probability of a forged token being accepted ( $p_f$ $p_{f}$ ) ranged from approximately 0.66 to 0.75 depending on the hardware. However, for a quantum bill with $M=200$ $M = 200$ tokens, the probability of a successful forgery ( $P_f$ $P_{f}$ ) decays exponentially.
- Even on the worst-performing hardware (Marrakesh) with conservative uncertainty estimates, the probability of a successful attack on a 200-token bill was found to be $P_f < 10^{-10}$ .
- On the best hardware (Kingston), the 1 $\sigma$ confidence interval for $P_f$ ranges from $10^{-33}$ to $10^{-21}$ , with the upper bound of the uncertainty reaching $10^{-21}$ .
Trade-offs: The authors note that eliminating classical side information reduces the authentication efficiency of genuine tokens compared to protocols that retain classical data. Consequently, a larger number of tokens per bill ( $M$ ) is required to achieve the same level of security against forgery.

Significance and Claims
The paper claims that the Quantum Vault represents a crucial step toward practical quantum money and network architectures by securing the issuing agent, not just the user. By demonstrating that the protocol can achieve extremely low forgery probabilities ( $<10^{-10}$ ) on current Noisy Intermediate-Scale Quantum (NISQ) hardware, the authors argue that the scheme is viable for future applications.

The significance lies in the shift from private-key architectures (where only the bank can verify) to a model where public verifiability is possible without compromising security, albeit through a bank-mediated interface rather than a fully decentralized public-key system. The authors emphasize that while the protocol is not a full mathematical security proof against all possible attacks (e.g., substitution attacks or side-channel attacks are noted as limitations), the hardware-agnostic benchmarking on IBM Quantum processors provides a practical upper bound on performance. The results suggest that with ongoing hardware evolution and optimized ensemble comparisons, the Quantum Vault offers a robust, traceable, and revocable framework for quantum identity and value transfer.

Technical Summary: Quantum Vault: Symmetric No-Cloning Protection for Token Issuer and User

More like this