© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

arXiv:2603.07538 · Physical Review A

Energy-time attack on detectors in quantum key distribution

Konstantin Zaitsev, Vladimir Bizin, Dmitriy Kuzmin, Vadim Makarov

quant-phphysics.ins-detSubmitted Mar 8, 2026• Announced Mar 10, 2026• 0 citations• Revised May 12, 2026 (v2)

v1 · Mar 8, 2026 v2 · May 12, 2026

Abstract

Quantum key distribution is unbreakable in theory but may be hacked via imperfections in its hardware implementations. While many imperfections have been mitigated by countermeasures and advanced security proofs, several remain unsolved. One of these is a superlinear behaviour in single-photon detectors, when the click probability rises faster with the photon number of an incoming light pulse than expected from individual independent photon detections. Here we test an avalanche single-photon detector sinusoidally-gated at 312.5 MHz for superlinearity. Its click probability is moderately superlinear. However, we notice that the click timing depends strongly on the incoming pulse energy. The click occurs progressively earlier, shifting more than 2 ns as the energy rises over a wide 50-dB range. An attacker might use this energy-time effect to conditionally toggle the click between adjacent key bit slots, violating an implicit assumption in the security proofs and rendering them inapplicable. We propose two attacks that exploit this flaw.

Journal reference: Phys. Rev. A 114, 012601 (2026)
DOI: 10.1103/nmdx-c94q
Comments: Minor improvements after referee comments. 11 pages, 6 figures

Related papers

Superlinear threshold detectors in quantum cryptography

Lars Lydersen, Nitin Jain, Christoffer Wittmann +5 more

We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, and gated avalanche photodiode detectors based on our own measurements. The analysis shows that quantum key distribution systems using detector(s) of either type can be vulnerable to eavesdropping. The avalanche photodiode detector becomes superlinear toward the end of the gate. For systems expecting substantial loss, or for systems not monitoring loss, this would allow eavesdropping using trigger pulses containing less than 120 photons per pulse. Such an attack would be virtually impossible to catch with an optical power meter at the receiver entrance.

arXiv:1106.2119•Physical Review A•Sep 15, 2011•91 citations

Countermeasure against blinding attack for single-photon detectors in quantum key distribution

Lianjun Jiang, Dongdong Li, Yuqiang Fang +12 more

Abstract Quantum key distribution (QKD), rooted in quantum mechanics, offers information-theoretic security. However, practical systems open security threats due to imperfections, notably bright-light blinding attacks targeting single-photon detectors. Here, we propose a concise, robust defense strategy for protecting single-photon detectors in QKD systems against blinding attacks. Our strategy uses a dual approach: detecting the bias current of the avalanche photodiode (APD) to defend against continuous-wave blinding attacks, and monitoring the avalanche amplitude to protect against pulsed blinding attacks. By integrating these two branches, the proposed solution effectively identifies and mitigates a wide range of bright light injection attempts, significantly enhancing the resilience of QKD systems against various bright-light blinding attacks. This method fortifies the safeguards of quantum communications and offers a crucial contribution to the field of quantum information security.

Journal of Semiconductors•Apr 1, 2024•2 citations

Quantum hacking: attacking practical quantum key distribution systems

Bing Qi, Chi‐Hang Fred Fung, Yi Bing Zhao +4 more

Quantum key distribution (QKD) can, in principle, provide unconditional security based on the fundamental laws of physics. Unfortunately, a practical QKD system may contain overlooked imperfections and violate some of the assumptions in a security proof. Here, we report two types of eavesdropping attacks against a practical QKD system. The first one is "time-shift" attack, which is applicable to QKD systems with gated single photon detectors (SPDs). In this attack, the eavesdropper, Eve, exploits the time mismatch between the open windows of the two SPDs. She can acquire a significant amount of information on the final key by simply shifting the quantum signals forwards or backwards in time domain. Our experimental results in [9] with a commercial QKD system demonstrate that, under this attack, the original QKD system is breakable. This is the first experimental demonstration of a feasible attack against a commercial QKD system. This is a surprising result. The second one is "phase-remapping" attack [10]. Here, Eve exploits the fact that a practical phase modulator has a finite response time. In principle, Eve could change the encoded phase value by time-shifting the signal pulse relative to the reference pulse.

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE•Aug 29, 2007•2 citations

Hacking single-photon avalanche detectors in quantum key distribution via pulse illumination

Zhihao Wu, Anqi Huang, Huan Chen +6 more

Quantum key distribution (QKD) has been proved to be information-theoretically secure in theory. Unfortunately, the imperfect devices in practice compromise its security. Thus, to improve the security property of practical QKD systems, a commonly used method is to patch the loopholes in the existing QKD systems. However, in this work, we show an adversary's capability of exploiting the imperfection of the patch itself to bypass the patch. Specifically, we experimentally demonstrate that, in the detector under test, the patch of photocurrent monitor against the detector blinding attack can be defeated by the pulse illumination attack proposed in this paper. We also analyze the secret key rate under the pulse illumination attack, which theoretically confirmed that Eve can conduct the attack to learn the secret key. This work indicates the importance of inspecting the security loopholes in a detection unit to further understand their impacts on a QKD system. The method of pulse illumination attack can be a general testing item in the security evaluation standard of QKD.

arXiv:2002.09146•Optics Express•Jul 24, 2020•29 citations

Hacking the subcarrier wave quantum key distribution system by exploiting the avalanche-transition region of a single-photon detector

Mikhail Gellert, Boris Aleksandrovich Nasedkin, Vladimir Chistiakov

This paper investigates loopholes in subcarrier wave quantum key distribution systems associated with the superlinear operating regime of avalanche photodiode single-photon detectors. The results demonstrate that an eavesdropper can control the receiver’s detection outcomes. The presented analysis may facilitate the identification of similar attacks and the development of countermeasures for quantum key distribution systems.

Journal of the Optical Society of America B•Oct 8, 2026•0 citations

Countering detector manipulation attacks in quantum communication through detector self-testing

Lijiong Shen, Christian Kurtsiefer

In practical quantum key distribution systems, imperfect physical devices open security loopholes that challenge the core promise of this technology. Apart from various side channels, a vulnerability of single-photon detectors to blinding attacks has been one of the biggest concerns and has been addressed both by technical means as well as advanced protocols. In this work, we present a countermeasure against such attacks based on self-testing of detectors to confirm their intended operation without relying on specific aspects of their inner working and to reveal any manipulation attempts. We experimentally demonstrate this countermeasure with a typical InGaAs avalanche photodetector, but the scheme can be easily implemented with any single photon detector.

arXiv:2204.06155•APL Photonics•Jan 1, 2025•4 citations

Quantum key distribution is unbreakable in theory but may be hacked via imperfections in its hardware implementations. While many imperfections have been mitigated by countermeasures and advanced security proofs, several remain unsolved. One of these is a superlinear behaviour in single-photon detectors, when the click probability rises faster with the photon number of an incoming light pulse than expected from individual independent photon detections. Here we test an avalanche single-photon detector sinusoidally-gated at 312.5 MHz for superlinearity. Its click probability is moderately superlinear. However, we notice that the click timing depends strongly on the incoming pulse energy. The click occurs progressively earlier, shifting more than 2 ns as the energy rises over a wide 50-dB range. An attacker might use this energy-time effect to conditionally toggle the click between adjacent key bit slots, violating an implicit assumption in the security proofs and rendering them inapplicable. We propose two attacks that exploit this flaw.

We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, and gated avalanche photodiode detectors based on our own measurements. The analysis shows that quantum key distribution systems using detector(s) of either type can be vulnerable to eavesdropping. The avalanche photodiode detector becomes superlinear toward the end of the gate. For systems expecting substantial loss, or for systems not monitoring loss, this would allow eavesdropping using trigger pulses containing less than 120 photons per pulse. Such an attack would be virtually impossible to catch with an optical power meter at the receiver entrance.

Abstract Quantum key distribution (QKD), rooted in quantum mechanics, offers information-theoretic security. However, practical systems open security threats due to imperfections, notably bright-light blinding attacks targeting single-photon detectors. Here, we propose a concise, robust defense strategy for protecting single-photon detectors in QKD systems against blinding attacks. Our strategy uses a dual approach: detecting the bias current of the avalanche photodiode (APD) to defend against continuous-wave blinding attacks, and monitoring the avalanche amplitude to protect against pulsed blinding attacks. By integrating these two branches, the proposed solution effectively identifies and mitigates a wide range of bright light injection attempts, significantly enhancing the resilience of QKD systems against various bright-light blinding attacks. This method fortifies the safeguards of quantum communications and offers a crucial contribution to the field of quantum information security.

Quantum key distribution (QKD) can, in principle, provide unconditional security based on the fundamental laws of physics. Unfortunately, a practical QKD system may contain overlooked imperfections and violate some of the assumptions in a security proof. Here, we report two types of eavesdropping attacks against a practical QKD system. The first one is "time-shift" attack, which is applicable to QKD systems with gated single photon detectors (SPDs). In this attack, the eavesdropper, Eve, exploits the time mismatch between the open windows of the two SPDs. She can acquire a significant amount of information on the final key by simply shifting the quantum signals forwards or backwards in time domain. Our experimental results in [9] with a commercial QKD system demonstrate that, under this attack, the original QKD system is breakable. This is the first experimental demonstration of a feasible attack against a commercial QKD system. This is a surprising result. The second one is "phase-remapping" attack [10]. Here, Eve exploits the fact that a practical phase modulator has a finite response time. In principle, Eve could change the encoded phase value by time-shifting the signal pulse relative to the reference pulse.

Quantum key distribution (QKD) has been proved to be information-theoretically secure in theory. Unfortunately, the imperfect devices in practice compromise its security. Thus, to improve the security property of practical QKD systems, a commonly used method is to patch the loopholes in the existing QKD systems. However, in this work, we show an adversary's capability of exploiting the imperfection of the patch itself to bypass the patch. Specifically, we experimentally demonstrate that, in the detector under test, the patch of photocurrent monitor against the detector blinding attack can be defeated by the pulse illumination attack proposed in this paper. We also analyze the secret key rate under the pulse illumination attack, which theoretically confirmed that Eve can conduct the attack to learn the secret key. This work indicates the importance of inspecting the security loopholes in a detection unit to further understand their impacts on a QKD system. The method of pulse illumination attack can be a general testing item in the security evaluation standard of QKD.

In practical quantum key distribution systems, imperfect physical devices open security loopholes that challenge the core promise of this technology. Apart from various side channels, a vulnerability of single-photon detectors to blinding attacks has been one of the biggest concerns and has been addressed both by technical means as well as advanced protocols. In this work, we present a countermeasure against such attacks based on self-testing of detectors to confirm their intended operation without relying on specific aspects of their inner working and to reveal any manipulation attempts. We experimentally demonstrate this countermeasure with a typical InGaAs avalanche photodetector, but the scheme can be easily implemented with any single photon detector.