An adaptive attack on Wiesner's quantum money

Main results

• Efficient adaptive attacks can create arbitrarily many copies of a valid Wiesner money state when valid notes are returned and invalid notes are destroyed.The attack applies to Wiesner’s scheme and the Bennett et al. variant.Source: §1 · pp. 1–2

The BT attack

• The bomb-testing attack identifies Wiesner’s four possible qubit states by weakly rotating a probe, applying a controlled operation, and repeatedly validating the money.For |0⟩ and |1⟩, detection probability is O(δ); for |+⟩ and |−⟩, the probe distinguishes the states while the money remains invariant.Source: §1 · p. 2

Generalizations

• The generalized bomb-testing attack is insufficient when possible states become arbitrarily close, motivating a protective-measurement attack for more general state sets.The relevant separation is θmin = min 1≤i≠j≤r arccos |⟨βi|βj⟩|.Source: §1 · p. 3

The PM attack

• Protective tomography estimates expectation values from a single unknown state while repeatedly using validation and preserving the state when tests succeed.The probe is weakly coupled to the state, validated repeatedly, and measured to estimate ⟨A⟩ and reconstruct the state.Source: §1 · p. 3
• For any constant ϵ, the tomography attack returns a state with fidelity at least 1 − ϵ with probability at least 1 − ϵ, conditioned on avoiding detection.The paper frames protective tomography in terms of validation cost, accuracy, and confidence.Source: §1 · p. 3

Discussion and applications

• The attacks apply specifically when a successful validation returns the same money state; issuing a fresh state and serial number after validation blocks these attacks.The paper also argues that this replacement policy preserves Wiesner’s static classical validation data and modest hardware requirements.Source: §1 · pp. 3–4

• The Zeno-assisted Elitzur-Vaidman tester distinguishes a live bomb from a dud while driving the probability of disturbing the object toward zero [EV93].Source: §2 · p. 5
• The tester uses two registers: it prepares the system in |0⟩, rotates the probe by δ, applies a controlled interaction, and measures the system register each round.Source: §2 · p. 5
• If the system is a dud, repeated rotations move the probe from |0⟩ toward |1⟩, so the final probe measurement yields |1⟩.Source: §2 · pp. 5–6
• The same controlled-interaction framework is mathematically equivalent to the original bomb tester and motivates its use against quantum money.Source: §2 · pp. 5–6
• For a live bomb, the system is usually measured as |0⟩ and the probe is projected back toward |0⟩, allowing the rounds to continue without triggering the bomb.Source: Figure 1 · p. 6, §2 · p. 6

An adaptive attack on Wiesner’s quantum money

• The attack also applies when bad bills are destroyed, unlike earlier attacks that relied on access to post-measurement bad bills [Lut10].Source: §3 · p. 6
• The attack tests |+⟩ first, tests |−⟩ with controlled-(−X) if necessary, and then measures computational-basis states safely.Source: Figure 3 · p. 7, §3 · p. 7
• For |0⟩ and |1⟩, the X operation produces a rejected orthogonal state, so the validation measurement projects the control back to |0⟩ with failure probability arbitrarily close to zero.Source: §3 · p. 7
• For |+⟩, the flip leaves the money qubit invariant and rotates the control to |1⟩, while |−⟩ alternates signed rotations yet passes every test perfectly.Source: §3 · p. 7
• Wiesner’s strict 4-state scheme is vulnerable: an attacker can identify all n qubits using at most 2n × N adaptive questions to an unforgiving tester.Source: §3 · p. 8
• Parallel probing can reduce the verification-round complexity by a factor of n compared with identifying qubits sequentially.Source: §3 · p. 8
• Adding more finite, known single-qubit states does not restore security, because analogous controlled operations can test the added states.Source: §3 · p. 8

4.1 Proof of lemma 2: Coupling to the expectation value of a dichotomic observable

• For any dichotomic observable A, protective measurement achieves running time N, accuracy O(1/N), and failure probability O(1/N).Weak interactions rotate the probe by an amount proportional to ⟨A⟩ while validation preserves the money state with high probability.Source: §4 · p. 9, §4.1 · p. 11

4.3 Proof of Lemma 3: Single copy estimation of an expectation value.

• A protective-measurement protocol estimates ⟨A⟩ with precision at least ν, confidence at least 1 − η, failure probability O(f), and running time O(ln^2(η^-1)ν^-4f^-1).Source: §4 · p. 9, §4.3 · p. 12

4.4 Proof of Theorem 5: tomography of a single qubit

• A single-qubit protective-tomography protocol reconstructs a mixed state ρ from approximate σ_x, σ_y, and σ_z expectations with fidelity at least 1 − ϵ and confidence at least 1 − η.The reconstruction projects the estimated Bloch representation to the closest valid single-qubit state.Source: §4 · p. 10, §4.4 · p. 13

4.5 Proof of Corollary 6: Protective tomography of n qubits.

• Protective tomography produces approximate classical descriptions of n-qubit product-state money while avoiding detection with probability at least 1 − f and enabling counterfeit generation.If the approximation has infidelity ϵ, each counterfeit fails validation with probability at most 2ϵ on its first use.Source: §4 · p. 10

4.2 A simple protective measurement: Identifying the four Wiesner money states

• For the four Wiesner states, measuring the probe after repeated interaction and validation distinguishes x-basis from z-basis states and uniquely identifies the unknown state.The probe remains near |0⟩ for |0⟩ or |1⟩, but evolves to ∓i|1⟩ for |+⟩ or |−⟩.Source: §4.2 · p. 11

4.5 Proof of Corollary 6: Protective tomography of n qubits.

• Applying single-qubit tomography independently to n qubits and combining the approximations by tensor product preserves total error ϵ and failure probability f.The parameters are scaled to ϵ/n, η/n, and f/n for each qubit, with total running time n times the single-qubit cost.Source: §4 · p. 10, §4.5 · p. 14
• The procedures are run in parallel to save a factor of n in total running time, completing the proof of Corollary 6.The parallelization uses the same idea explained in the preceding section.Source: §4.5 · p. 14

5 Discussion: Comparing the two attacks

• The PM attack has qualitative and quantitative advantages over BT in the scenarios analyzed, including no greater query use and a simple modification that identifies states directly.The comparison is based on the authors’ checked cases rather than an optimality proof.Source: §5 · p. 14
• BT identifies states from a finite list through probe movement, whereas PM measures an expectation value and can be modified to identify the state similarly.In BT, the probe moves only for a narrow angular window; in PM, its rotation is proportional to the expectation value being measured.Source: §5 · p. 14
• Both attacks apply minimal per-round disturbance followed by bank verification, but PM maintains an approximately time-invariant weak channel while BT can become stronger for certain input states.BT’s pointer usually remains near its initial position, except for a small family of states near fixed points.Source: §5 · p. 14

• The BT attack works efficiently and safely for a given list of hidden states.Source: A The basic bomb-tester and… · p. 15
• The attack stops working when the secret states are completely unknown.Source: A The basic bomb-tester and… · p. 15
• The attack also stops working when possible secret states are chosen too close to each other.Source: A The basic bomb-tester and… · p. 15

Using candidate reflections

• A controlled reflection R tests whether the unknown qubit equals a candidate state |β⟩ from the finite list S.If |α⟩=|β⟩, the candidate is identified in the dud case; otherwise, R disturbs |α⟩ and the protocol probes the difference.Source: §A.1 · p. 15

The testing procedure

• The protocol repeatedly rotates a probe, applies controlled R, and validates the money register, with caught probability sin^2(2θ) sin^2(ϕ_k + δ) in one round.Source: §A.1 · p. 15

Special cases

• The dud cases θ=0 and θ=π/2 are handled without detection, with the first yielding probe rotation and the second returning the probe after an even number of rounds.Source: §A.1 · p. 16

Safe identification

• For intermediate θ, sufficiently large N makes the protocol pass all tests and measure |0⟩ in the probe with probability close to 1.The analysis uses a small per-round rotation δ and controls accumulated error through an O(δ^2) approximation.Source: §A.1 · pp. 16–17

Scaling to the full banknote

• Testing all r candidates across n qubits succeeds with probability 1−O(f), while parallelization saves a factor of n in query complexity.The sequential procedure uses a reduced per-test failure budget f′=f/(nr).Source: §A.1 · p. 17

Unknown-state limitation

• For completely unknown or dense state sets, there is no minimal separation angle, so the attacker must guess a threshold θ_min that controls N and δ.Source: §A.2 · p. 17

Dangerous angles

• When θ is on the order of 1/√N, the protocol has a constant probability of getting caught, whereas safer regions occur for much smaller or larger θ.Figure 5 plots protocol outcomes against θ√N and shows the caught probability tending to zero in the safe regime.Source: §A.2 · p. 17

Failure of BT identification

• Because many protocol calls are required, the BT attack most likely gets caught before approximating even one qubit when states are infinite or unknown.Source: §A.2 · p. 17

Protocol mechanism

• The protocol consists of probe rotation, controlled interaction, and validation; eigenstates of R remain factorized and always pass validation.Source: §A.2 · p. 17

Weak-interaction regime

• For non-eigenstates, weak interactions can preserve high validation probability over O(N) rounds, but near +1 eigenstates cumulative detection can grow across repetitions.Protective measurements avoid this specific disturbance problem by maintaining a sufficient upper bound on per-round disturbance.Source: §A.2 · pp. 17–18