Physically unclonable functions (PUFs) convert microscopic manufacturing noise inside a chip into a device-specific hardware fingerprint, but delay-based designs fall to machine-learning modelling once an adversary collects enough challenge-response pairs (CRPs). This article reports an empirical study of six machine-learning attacks — logistic regression, least-squares regression, a multilayer perceptron, an LMN feature-lifting model, a denoising autoencoder, and a compact Transformer encoder — against Arbiter OR-AND-XOR PUFs (AOX-PUFs), simulated with pypuf on the University of Sheffield's Stanage high-performance computing cluster across CRP budgets from 2,500 to 1.9 million. The attacks exploit the Arbiter PUF's linear-additive delay model, and the defence under test is a BB84-inspired encoding wrapper motivated by the Quantum Lock forging-probability bound. Classical AOX-PUFs were modelled with 95–99% accuracy within tens of thousands of CRPs, while BB84-inspired encoding capped every attacker at a flat ceiling of roughly 0.85–0.90 that did not rise within either batch, even at close to two million CRPs. Decomposing the encoding pipeline shows that this ceiling tracks the simulated measurement-success probability rather than a genuine basis-secrecy effect: disclosing the encoding basis altered outcomes by less than a percentage point. An illustrative calculation based on the Quantum Lock bound shows that a genuine quantum advantage should decay the forging probability exponentially as the number of encoded output qubits grows, a prediction the flat empirical ceiling does not fulfil. The results corroborate prior architectural-hardening findings for AOX-PUFs while diverging from the CRP-inflation behaviour the Quantum Lock model predicts.
Physically unclonable functions (PUFs) convert microscopic manufacturing noise inside a chip into a device-specific hardware fingerprint, but delay-based designs fall to machine-learning modelling once an adversary collects enough challenge-response pairs (CRPs). This article reports an empirical study of six machine-learning attacks — logistic regression, least-squares regression, a multilayer perceptron, an LMN feature-lifting model, a denoising autoencoder, and a compact Transformer encoder — against Arbiter OR-AND-XOR PUFs (AOX-PUFs), simulated with pypuf on the University of Sheffield's Stanage high-performance computing cluster across CRP budgets from 2,500 to 1.9 million. The attacks exploit the Arbiter PUF's linear-additive delay model, and the defence under test is a BB84-inspired encoding wrapper motivated by the Quantum Lock forging-probability bound. Classical AOX-PUFs were modelled with 95–99% accuracy within tens of thousands of CRPs, while BB84-inspired encoding capped every attacker at a flat ceiling of roughly 0.85–0.90 that did not rise within either batch, even at close to two million CRPs. Decomposing the encoding pipeline shows that this ceiling tracks the simulated measurement-success probability rather than a genuine basis-secrecy effect: disclosing the encoding basis altered outcomes by less than a percentage point. An illustrative calculation based on the Quantum Lock bound shows that a genuine quantum advantage should decay the forging probability exponentially as the number of encoded output qubits grows, a prediction the flat empirical ceiling does not fulfil. The results corroborate prior architectural-hardening findings for AOX-PUFs while diverging from the CRP-inflation behaviour the Quantum Lock model predicts.
Physical unclonable functions(PUFs) provide a unique fingerprint to a physical entity by exploiting the inherent physical randomness. Gao et al. discussed the vulnerability of most current-day PUFs to sophisticated machine learning-based attacks. We address this problem by integrating classical PUFs and existing quantum communication technology. Specifically, this paper proposes a generic design of provably secure PUFs, called hybrid locked PUFs(HLPUFs), providing a practical solution for securing classical PUFs. An HLPUF uses a classical PUF(CPUF), and encodes the output into non-orthogonal quantum states to hide the outcomes of the underlying CPUF from any adversary. Here we introduce a quantum lock to protect the HLPUFs from any general adversaries. The indistinguishability property of the non-orthogonal quantum states, together with the quantum lockdown technique prevents the adversary from accessing the outcome of the CPUFs. Moreover, we show that by exploiting non-classical properties of quantum states, the HLPUF allows the server to reuse the challenge-response pairs for further client authentication. This result provides an efficient solution for running PUF-based client authentication for an extended period while maintaining a small-sized challenge-response pairs database on the server side. Later, we support our theoretical contributions by instantiating the HLPUFs design using accessible real-world CPUFs. We use the optimal classical machine-learning attacks to forge both the CPUFs and HLPUFs, and we certify the security gap in our numerical simulation for construction which is ready for implementation.
Physical unclonable functions(PUFs) provide a unique fingerprint to a physical entity by exploiting the inherent physical randomness. Gao et al. discussed the vulnerability of most current-day PUFs to sophisticated machine learning-based attacks. We address this problem by integrating classical PUFs and existing quantum communication technology. Specifically, this paper proposes a generic design of provably secure PUFs, called hybrid locked PUFs(HLPUFs), providing a practical solution for securing classical PUFs. An HLPUF uses a classical PUF(CPUF), and encodes the output into non-orthogonal quantum states to hide the outcomes of the underlying CPUF from any adversary. Here we introduce a quantum lock to protect the HLPUFs from any general adversaries. The indistinguishability property of the non-orthogonal quantum states, together with the quantum lockdown technique prevents the adversary from accessing the outcome of the CPUFs. Moreover, we show that by exploiting non-classical properties of quantum states, the HLPUF allows the server to reuse the challenge-response pairs for further client authentication. This result provides an efficient solution for running PUF-based client authentication for an extended period while maintaining a small-sized challenge-response pairs database on the server side. Later, we support our theoretical contributions by instantiating the HLPUFs design using accessible real-world CPUFs. We use the optimal classical machine-learning attacks to forge both the CPUFs and HLPUFs, and we certify the security gap in our numerical simulation for construction which is ready for implementation.
Physical Unclonable Functions (PUFs) provide hardware-level security by exploiting intrinsic randomness to produce device-unique responses. However, machine learning and side-channel attacks increasingly undermine their classical assumptions, calling for new approaches to ensure unforgeability. Quantum mechanics naturally supports this goal through intrinsic randomness and the no-cloning theorem, motivating the study of Quantum Physical Unclonable Functions (QPUFs). Yet, existing QPUF models often assume ideal unitary dynamics, neglecting non-unitary effects such as decoherence and dissipation that arise in real quantum devices. This work introduces a new class of non-unitary QPUFs that leverage open quantum system dynamics as a foundation for security. Three architectures are proposed: the Dissipative QPUF (D-QPUF), which uses amplitude damping as an entropy source; the Measurement-Feedback QPUF (MF-QPUF), which employs mid-circuit measurements and conditional unitaries; and the Lindbladian QPUF (L-QPUF), which models Markovian noise via the Lindblad master equation and Trotter-Suzuki decomposition. Simulation results show that these non-unitary designs achieve strong uniqueness, uniformity, and unforgeability, with controllable reliability trade-offs from stochastic noise. The L-QPUF, in particular, exhibits exponential modeling resistance under limited challenge-response access. By reframing environmental noise as a constructive resource, this work establishes a framework for noise-aware quantum hardware authentication and highlights non-unitary evolution as a viable foundation for post-quantum security.
We show that a class of optical physical unclonable functions (PUFs) can be efficiently PAC-learned to arbitrary precision with arbitrarily high probability, even in the presence of intentionally injected noise, given access to polynomially many challenge-response pairs, under mild and practical assumptions about the distributions of the noise and challenge vectors. We motivate our analysis by identifying similarities between the integrated version of Pappu’s original optical PUF design and the post-quantum Learning with Errors (LWE) cryptosystem. We derive polynomial bounds for the required number of samples and the computational complexity of a linear regression algorithm, based on size parameters of the PUF, the distributions of the challenge and noise vectors, and the desired accuracy and probability of success of the regression algorithm. We use a similar analysis to that done by Bootle et al. [“LWE without modular reduction and improved side-channel attacks against BLISS,” in Advances in Cryptology – ASIACRYPT 2018], who demonstrated a learning attack on poorly implemented versions of LWE cryptosystems. This extends the results of Rührmair et al. [“Optical PUFs reloaded,” Cryptology ePrint Archive, 2013], who presented a theoretical framework showing that a subset of this class of PUFs is learnable in polynomial time in the absence of injected noise, under the assumption that the optics of the PUF were either linear or had negligible nonlinear effects. (Rührmair et al. also included an experimental validation of this technique, which of course included measurement uncertainty, demonstrating robustness to the presence of natural noise.) We recommend that the design of strong PUFs should be treated as a cryptographic engineering problem in physics, as PUF designs would benefit greatly from basing their physics and security on standard cryptographic assumptions. Finally, we identify future research directions, including suggestions for how to modify an LWE-based optical PUF design to better defend against cryptanalytic attacks.
Abstract Physical unclonable functions (PUFs) have been proposed as a way to identify and authenticate electronic devices. Recently, several ideas have been presented to that aim to achieve the same for quantum devices. Some of these constructions apply single-qubit gates in order to provide a secure fingerprint of the quantum device. In this work, we formalize the class of classical readout quantum PUFs (CR-QPUFs) using the statistical query (SQ) model and explicitly show insufficient security for CR-QPUFs based on single-qubit rotation gates, when the adversary has SQ access to the CR-QPUF. We demonstrate how a malicious party can learn the CR-QPUF characteristics and forge the signature of a quantum device through a modelling attack using a simple regression of low-degree polynomials. The proposed modelling attack was successfully implemented in a real-world scenario on real IBM Q quantum machines. We thoroughly discuss the prospects and problems of CR-QPUFs where quantum device imperfections are used as a secure fingerprint.
Purpose This study aims to develop and validate a quantum-enhanced behavioral security framework that integrates a lightweight quantum obfuscation layer into classical intrusion detection systems (IDSs). The primary objective is to harden these models against post-quantum threats, specifically model extraction and feature inversion attacks, while maintaining high detection accuracy across both traditional machine learning and deep learning architectures. Design/methodology/approach A quantum feature obfuscation layer was designed using 6-qubit parameterized circuits with angle encoding and variational ansatz to nonlinearly transform behavioral features. This layer was integrated with classical classifiers (random forest, support vector machine, logistic regression) and a deep learning model multi-layer perceptron (MLP). The framework was evaluated on UNSW-NB15 and NSL-KDD datasets using Qiskit Aer simulators in Google Colab, measuring accuracy, precision, recall, F1-score, model extraction error (MEE) and feature inversion error (FIE). Findings Quantum-assisted models maintained detection performance comparable to classical baselines, with accuracy degradation of 0.7% across all architectures. Security resilience significantly improved, with a 3–4× increase in both MEE and FIE, indicating substantially enhanced resistance to model theft and feature reconstruction. The framework demonstrated improved noise tolerance under Gaussian perturbations. The MLP achieved 92.5% accuracy (classical) versus 91.8% (quantum-assisted), with 3.3× and 3.5× improvements in MEE and FIE, respectively. Research limitations/implications The evaluation was conducted entirely on quantum simulators, not capturing real hardware noise, decoherence and fidelity limitations. The threat model assumes secrecy of quantum circuit parameters, representing a form of model-level security through obscurity. Scalability is constrained by exponential simulation costs, limiting current experiments to 6 qubits. Only feedforward neural networks (MLP) were tested; advanced architectures like CNNs, LSTMs and transformers require future validation. The framework’s resilience against adversaries with partial knowledge of the ansatz structure remains unexplored. Practical implications The framework provides a pragmatic, classifier-agnostic defense layer deployable on freely accessible cloud platforms (Google Colab) without specialized quantum hardware. With only 15–25 ms inference overhead and 40–60% training overhead, it offers viable post-quantum hardening for security-critical applications. Resource-constrained environments such as edge computing nodes and IoT deployments can benefit from this approach. The demonstration that meaningful security gains (3–4× improvement) are achievable using only 6 qubits lowers the barrier for organizations to adopt quantum-assisted security measures today. Social implications As quantum computing threatens classical cryptography, protecting behavioral analytics becomes crucial for critical infrastructure, financial systems and healthcare networks. This research contributes to building resilient cyber defense mechanisms that protect sensitive data and privacy even when encryption is compromised. By democratizing access to quantum-enhanced security through cloud-based simulation platforms, the framework helps bridge the gap between institutions with varying resources, promoting more equitable cybersecurity preparedness for the post-quantum era across both developed and developing nations. Originality/value This work shifts the focus of quantum-enhanced security from pure cryptographic replacement to model-hardening, harnessing quantum state complexity as a defensive mechanism rather than pursuing quantum advantage for classification speed. It introduces a novel quantum obfuscation layer specifically designed for IDS, validated across both traditional ML and deep learning architectures. The consistent security improvements (3–4×) across classifier types confirm the approach is classifier-agnostic. The Colab-based implementation ensures reproducibility and accessibility, providing a practical foundation for future quantum-aware cyber defense research and deployment.