Quantum key distribution (QKD) links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel's own noise gains by following that drift has not been quantified. Adaptive eavesdropping is posed here as a constrained Markov decision process in which the attacker selects one circuit per round while the noise level follows an Ornstein--Uhlenbeck process and the abort condition is a budget over each block of rounds. The value of adaptation is bounded by the best fixed circuit and a dynamic-programming upper bound. The actions are learnt attacks. Whereas Decker et al. trained a parametrised circuit on a fixed gate template against a fixed channel, here the gate structure and rotation angles are searched jointly. This yields circuits compact enough to form a discrete action set, extending the construction to noise models lacking a known template, including the amplitude damping channel. On device-independent E91 under bilateral depolarising noise, a reinforcement-learning attacker raises her Holevo information from $0.135$ for the best fixed circuit to $0.348$ at zero detection, $98\%$ of the upper bound. On BB84 under a drifting bit-flip channel, she exceeds a conservative noise-indexed rule by $0.024$ in fidelity, reaching $99\%$ of the upper bound. Under stationary noise, the attacker's gain from basis asymmetry changes sign between an averaged and a per-basis error-rate constraint. The search, started from random gate sequences, recovers the analytical cloners and the collective-attack key rate, and meets the lower bound of the Winick--Lütkenhaus--Coles objective from above.
Comments
Presented as submission 202 at QCrypt 2026 qcrypt.net/2026/technical/accepted-papers/. A parallel work exploring the machine-learning aspects of this approach, titled "Sparsity for Free: A Budget-Induced Equilibrium in Joint Topology-Parameter Search'', has been accepted for NeurIPS 2026
Quantum key distribution (QKD) links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel's own noise gains by following that drift has not been quantified. Adaptive eavesdropping is posed here as a constrained Markov decision process in which the attacker selects one circuit per round while the noise level follows an Ornstein--Uhlenbeck process and the abort condition is a budget over each block of rounds. The value of adaptation is bounded by the best fixed circuit and a dynamic-programming upper bound. The actions are learnt attacks. Whereas Decker et al. trained a parametrised circuit on a fixed gate template against a fixed channel, here the gate structure and rotation angles are searched jointly. This yields circuits compact enough to form a discrete action set, extending the construction to noise models lacking a known template, including the amplitude damping channel. On device-independent E91 under bilateral depolarising noise, a reinforcement-learning attacker raises her Holevo information from 0.135 for the best fixed circuit to 0.348 at zero detection, 98% of the upper bound. On BB84 under a drifting bit-flip channel, she exceeds a conservative noise-indexed rule by 0.024 in fidelity, reaching 99% of the upper bound. Under stationary noise, the attacker's gain from basis asymmetry changes sign between an averaged and a per-basis error-rate constraint. The search, started from random gate sequences, recovers the analytical cloners and the collective-attack key rate, and meets the lower bound of the Winick--Lütkenhaus--Coles objective from above.
BB84 quantum key distribution derives its security from a physical guarantee that any eavesdropper disturbs the channel in a statistically detectable way. Prior work evaluates this by assuming Eve attacks at a fixed, analytically optimized rate. We examine what happens when Eve is modeled instead as a learning agent. Classical reinforcement learning is used, specifically tabular Q-Learning, SARSA, and Double Q-Learning, to adaptive BB84 eavesdropping. This formulates the attacker's decision as a Markov Decision Process where the agent observes Quantum Bit Error Rate (QBER) feedback and decides, qubit by qubit, whether to intercept or pass. Experiments span three channel noise levels (μch∈{1%,3%,5%}) and are validated across five independent random seeds (45 training runs per condition, 10,000 episodes each). Against the best non-adaptive analytical baseline, Q-Learning reduces detection from 99.4% to 0.28%±0.27% at μch=1% while extracting approximately 10.5 correct bits per episode. This is a 355-fold reduction that is statistically significant (p=0.020, Mann-Whitney U test). We also report the spontaneous emergence of an end-game burst, where agents independently learn to surge their attack rate at the final block. This exploit vanishes under randomized checkpoint intervals while stealth performance remains statistically indistinguishable. These results motivate the inclusion of adaptive adversary baselines in quantum cryptographic security evaluations.
Many modern classical encryption schemes, based on computational complexity, are threatened by quantum computers. Quantum Key Distribution (QKD) aims to address this threat, with security enforced by quantum-mechanical principles. The security of QKD protocols, like the six-state protocol (6QKD), relies on understanding all possible eavesdropping attacks. The optimal known individual eavesdropping attack on 6QKD in a noiseless channel is the Universal Quantum Cloning Machine (UQCM). However, the utility of quantum machine learning (QML) for QKD eavesdropping analysis is largely unexplored. The recent work by Decker et al. (2025) used QML to find new attacks on the four-state BB84 protocol, but this methodology has not yet been generalized to the more complex 6QKD protocol. This thesis generalizes the quantum circuit (QCL) learning framework to analyze individual eavesdropping attacks on 6QKD. We designed a parameterized quantum circuit (ansatz) appropriate for 6QKD, notably adapting our circuit to two ancilla, and expanding the measurement strategy to three bases. We used QCL to find the optimal attack parameters in a simulated noiseless, asymmetric (bit-flip, phase-flip), and symmetric (depolarizing) noise channels. In the noiseless quantum channel, the QCL successfully converges to and reproduces the theoretical performance of the UQCM, validating the adapted methodology. In the asymmetric bit-flip and phase-flip noise channels, the QCL discovers a novel "imbalanced cloner" attack that outperforms the standard UQCM in average fidelity. The model learns to exploit the noise asymmetry by sacrificing the fidelity in the degraded bases and gaining higher fidelity in the unaffected basis. In a symmetric depolarizing noise channel, the QCL performance converges exactly to the UQCM, demonstrating it finds no exploitable noise asymmetry. This work provides the first QCL-based security analysis of the 6QKD protocol. We demonstrate that the QCL is a generalizable tool for quantum security analysis. Furthermore, we present the first (to our knowledge) evidence of a 6QKD "imbalanced cloner" that outperforms UQCM in asymmetric noisy environments.
We introduce noise-adaptive quantum key distribution (QKD) protocols, in which the honest parties optimize the encoding (state preparation) and decoding (measurement basis) operations according to the noise models affecting the honest subsystems induced by an eavesdropper. This extends conventional QKD schemes that employ fixed encoding and decoding strategies independent of the noise characteristics of the communication channel. We investigate three representative protocols: entanglement-based secure dense coding (SDC), the entanglement-free Lucamarini and Mancini (LM05), and a two-way prepare-and-measure Bennett Brassard (BB84) protocols. Using entropic uncertainty relations, we derive the corresponding secret key rates for both adaptive and conventional non-adaptive scenarios under collective attacks. For independent but identical noise acting on the forward and backward transmission channels, as well as for correlated and non-Markovian environments, we identify classes of channels for which adaptive schemes yield enhanced secret key rates for the considered protocols. In contrast, we also determine Pauli channels, including depolarizing and bit flip channels, for which adaptive strategies provide no benefit. We further show that these optimal sets are generally non-unique and can differ substantially from the unitaries that maximize dense-coding capacity in the absence of security constraints. Our results establish noise-adaptive encoding and decoding as a powerful framework for improving secure communication over realistic noisy quantum channels.
The security analysis of the Ekert 1991 (E91), Bennett 1992 (B92), six-state protocol, Scarani–Acín–Ribordy–Gisin 2004 (SARG04) quantum key distribution (QKD) protocols, and their variants have been studied in the presence of collective-rotation noise channels. However, besides the Bennett–Brassard 1984 (BB84) being the first proposed, extensively studied, and essential protocol, its security proof under collective-rotation noise is still missing. Thus, we aim to close this gap in the literature. Consequently, we investigate how collective-rotation noise channels affect the security of the BB84 protocol. Mainly, we study scenarios where the eavesdropper, Eve, conducts an intercept-resend attack on the transmitted photons sent via a quantum communication channel shared by Alice and Bob. Notably, we distinguish the impact of collective-rotation noise and that of the eavesdropper. To achieve this, we provide rigorous, yet straightforward numerical calculations. First, we derive a model for the collective-rotation noise for the BB84 protocol and parametrize the mutual information shared between Alice and Eve. This is followed by deriving the quantum bit error rate (QBER) for two intercept-resend attack scenarios. In particular, we demonstrate that, for small rotation angles, one can extract a secure secret key under a collective-rotation noise channel when there is no eavesdropping. We observe that noise induced by rotation of 0.35 radians of the prepared quantum state results in a QBER of 11%, which corresponds to the lower bound on the tolerable error rate for the BB84 QKD protocol against general attacks. Moreover, a rotational angle of 0.53 radians yields a 25% QBER, which corresponds to the error rate bound due to the intercept-resend attack. Finally, we conclude that the BB84 protocol is robust against intercept-resend attacks on collective-rotation noise channels when the rotation angle is varied arbitrarily within particular bounds.
Quantum circuit learning (QCL) has been proposed to optimize eavesdropping attacks on BB84.We investigate the behavior of learned attacks under depolarizing, bit-flip, phaseflip, amplitude-damping, phase-damping, and combined noise.After validating the variational model against the noiseless phasecovariant cloning machine (PCCM) frontier, we compare the optimized QCL attacks with analytical PCCM reference points evaluated under the same noise conditions.Results show that deviations from PCCM behavior depend primarily on noise structure: basis-dependent channels induce asymmetric strategies, whereas depolarizing noise largely preserves symmetry.Consequently, aggregate figures of merit may hide basis-resolved asymmetries within the restricted attack model considered here.
Quantum Key Distribution (QKD) enables information-theoretic secure key exchange by exploiting fundamental quantum phenomena such as superposition and no-cloning. Classical QKD protocols (e.g., BB84) guarantee that any eavesdropping attempt introduces detectable disturbances, but they typically assume stable, high-quality channels and unconstrained devices. In contrast, Internet of Things (IoT) networks present a radically different environment: devices have limited processing power, minimal onboard memory, strict energy budgets, and communicate over highly variable wireless links subject to interference and rapid fading. These constraints lead to elevated quantum bit error rates (QBER), frequent key reconciliation failures, and prohibitive energy costs, all of which jeopardize practical QKD deployment. To address these challenges, we propose an AI-powered QKD protocol specifically optimized for IoT scenarios. Our approach integrates three AI modules: (1) a gradient-boosted regression channel estimator that predicts instantaneous link transmittance using lightweight sensor data and historical photon counts; (2) a reinforcement learning (RL) agent that adaptively tunes photon intensity, basis-selection probability, and reconciliation block size to balance key rate and error rate; and (3) a convolutional neural network (CNN) classifier that selects the optimal Low-Density Parity-Check (LDPC) code rate based on real-time noise characteristics. We simulate a star-topology IoT network of 50 battery-powered devices communicating over 5 km polarization-encoded links with realistic urban loss (0.1–0.3 dB/km) and environmental noise. Compared against a static BB84 baseline, our AI-enhanced protocol reduces average QBER from 4.5% to 2.9%, increases secure key rate from 12.5 kbps to 16.0 kbps, lowers latency by 22%, and reduces energy consumption per key bit by 18%. These improvements persist across channel conditions and device heterogeneity, demonstrating robustness.