PaperlayerView exact revision on arXiv

Source-linked AI summary

Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Marcel Mordarski, Benjamin Gras, Abdelrahman Shehata, Daniel Budina, Roberto Bondesan

arXiv:2610.01792v1quant-phcs.CRcs.ITcs.LGmath.IT

TL;DR

The paper asks whether an attacker unable to alter channel noise gains information by adapting to device drift, a value not quantified by frozen-channel evaluations. It models adaptation as a constrained sequential decision process over attack circuits and bounds its value against fixed play and a dynamic-programming upper bound.

  • Problem

    For an attacker who cannot alter channel noise, the information gained by adapting to drift is unquantified, although it determines how conservative a provisioned margin is.

    Source: A. Problem construction · p. 2, A. Adaptive eavesdropping as a… · p. 7

  • Method

    The attacker selects a circuit from a library each round as channel noise follows an Ornstein–Uhlenbeck process, with an abort budget over the episode.

    Source: C. Methodology · p. 3, A. Adaptive eavesdropping as a… · p. 7

  • Results

    Both the greedy oracle and zero-detection trained agent fall below the dynamic-programming upper bound, which quantifies the value of anticipating the episode budget.

    Source: A. Adaptive eavesdropping as a… · p. 7

  • Takeaways & Limitations

    The measured gap concerns the conservatism of provisioned margins for physically restricted attackers, not the soundness of formal security proofs.

    Source: A. Problem construction · p. 2

    The evaluated values assume asymptotic detection statistics and perfect tracking of current noise; delayed estimation and finite-sample effects remain open questions.

    Source: §V · p. 10

Abstract

from arXiv · show

Quantum key distribution (QKD) links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel's own noise gains by following that drift has not been quantified. Adaptive eavesdropping is posed here as a constrained Markov decision process in which the attacker selects one circuit per round while the noise level follows an Ornstein--Uhlenbeck process and the abort condition is a budget over each block of rounds. The value of adaptation is bounded by the best fixed circuit and a dynamic-programming upper bound. The actions are learnt attacks. Whereas Decker et al. trained a parametrised circuit on a fixed gate template against a fixed channel, here the gate structure and rotation angles are searched jointly. This yields circuits compact enough to form a discrete action set, extending the construction to noise models lacking a known template, including the amplitude damping channel. On device-independent E91 under bilateral depolarising noise, a reinforcement-learning attacker raises her Holevo information from $0.135$ for the best fixed circuit to $0.348$ at zero detection, $98\%$ of the upper bound. On BB84 under a drifting bit-flip channel, she exceeds a conservative noise-indexed rule by $0.024$ in fidelity, reaching $99\%$ of the upper bound. Under stationary noise, the attacker's gain from basis asymmetry changes sign between an averaged and a per-basis error-rate constraint. The search, started from random gate sequences, recovers the analytical cloners and the collective-attack key rate, and meets the lower bound of the Winick--L\"utkenhaus--Coles objective from above.

I. INTRODUCTION

QKD provisioning assumes stationary channels between recalibrations, but devices drift during measurement windows. The paper studies whether an attacker constrained to the channel’s own noise can gain information by adapting, and develops a sequential method to evaluate that gain.

A. Problem construction

  • A stationary analysis does not quantify the information gained by an attacker adapting to channel drift, leaving the conservatism of recalibration margins unmeasured.The question concerns an attacker who cannot alter the channel’s noise, not the validity of security proofs that attribute all observed disturbance to Eve.Source: A. Problem construction · pp. 1–2

B. Prior work

  • Prior learnt attacks optimize circuit angles on a fixed template and fixed channel, so they provide no strategy for a drifting device.Searching gate topology as well as angles is motivated for channels such as amplitude damping, where a suitable template is not known.Source: B. Prior work · p. 2

C. Methodology

  • The method searches gate sequences and rotation angles jointly, enforcing the monitored abort threshold as a strict feasibility constraint.An evolutionary outer loop proposes gate sequences while a gradient-free inner loop tunes angles; unlike a soft penalty, strict feasibility excludes circuits that exceed the threshold.Source: C. Methodology · p. 3
  • For drift, a library of small circuits becomes the action set in a constrained Markov decision process with a block-wide abort budget.The noise follows an Ornstein–Uhlenbeck process; a value-based reinforcement-learning agent is compared with the best fixed circuit and a dynamic-programming upper bound.Source: C. Methodology · p. 3

D. Contributions

The paper contributes a search for explicit attacks across stationary noisy channels and a sequential framework for adaptation under drift. It also clarifies the protocol figures of merit and reports that basis asymmetry’s benefit depends on the monitoring convention.

D. Contributions

  • On E91, adaptation multiplies the attacker’s information by about 2.6 at unchanged detection, with its value bounded between fixed play and a dynamic-programming upper bound.The contribution list also reports that the upper bound is reachable without tolerated detection on both protocols.Source: D. Contributions · p. 3
  • Under stationary noise, basis asymmetry benefits the attacker with an averaged error-rate constraint but harms her when each basis is constrained separately.The search is also applied to amplitude damping, derives a noise limit beyond which an undisturbed E91 link yields no key, and is validated against known results and a numerical lower bound.Source: D. Contributions · p. 3

II. PROTOCOLS, CHANNELS AND FIGURES OF MERIT

  • In BB84, Bob’s fidelity FAB averages correct recovery over four states, while Eve’s FAE averages Helstrom success over the two bases after basis announcement.The stated abort threshold is FAB ⩾0.87; the supplied passage notes it is not an operational one-way threshold under the untrusted convention.Source: §II · p. 4
  • In E91, the parties monitor the CHSH value S, while the attacker’s information is the Holevo quantity χ(A:E).The protocol aborts when S falls below its threshold τS.Source: §II · p. 4

III. ATTACKS UNDER STATIONARY CHANNEL NOISE

Under stationary noise, the attainable leak falls below the noiseless cloning envelope, and the measured benefit of basis asymmetry depends on whether errors are monitored jointly or per basis. The search also reproduces the Pauli-noise analytical result and supplies circuits for the later adaptive attack library.

A. Attainable information on noisy channels

  • For Pauli noise, the search matches the analytical expression within 2 × 10−4, validating noisy-channel search while its returned circuits populate the adaptive library.The noiseless-envelope separation reflects a physically restricted attacker under the trusted-noise convention, not looseness in published bounds.Source: A. Attainable information on noisy… · p. 4
  • 0.828 at ε = 0.02, 0.786 at ε = 0.10, and 0.664 at ε = 0.22 are attainable FAE, below the 0.836 noiseless envelope at FAB = 0.87.The gap grows from 0.0085 to 0.050 and then 0.172 as channel error increases.Source: A. Attainable information on noisy… · p. 4, Figure 1 · p. 5

B. Monitoring conventions and basis asymmetry

  • With basis-averaged QBER monitoring, basis asymmetry gives gains below 10−4 at ε = 0.02, 0.0012 at ε = 0.10, and 0.0059 at ε = 0.22.The channel errors are indistinguishable by their averaged disturbance, but disturbance in an already damaged basis is partially masked.Source: B. Monitoring conventions and basis… · p. 5
  • Under per-basis constraints, the asymmetry gain reverses: trusted gains are −0.0049 at ε = 0.06 and −0.0214 at ε = 0.10, while untrusted gains are −0.048 at ε = 0.10 and −0.085 at ε = 0.22.The untrusted convention requires the attacker to reproduce each observed rate within 2×10−3; values should be compared only within the same noise convention.Source: B. Monitoring conventions and basis… · p. 5, Figure 1 · p. 5
  • At ε = 0.10 on the one-basis channel, per-basis constraints lower attainable fidelity from 0.7858 to 0.7631, a 0.023 reduction without additional measurement.Averaged monitoring lets the attacker place disturbance where it is cheapest, whereas per-basis monitoring ties it to the remaining room in each basis.Source: B. Monitoring conventions and basis… · pp. 5–6

C. Non-Pauli noise and ancilla size

The search extends to amplitude damping and finds little benefit from enlarging the ancilla at the tested operating point. For E91, bilateral depolarising noise affects the CHSH constraint on both subsystems, while its effects on the eavesdropper’s information and the honest key-rate boundary are distinct.

C. Non-Pauli noise and ancilla size

  • Amplitude-damping circuits of four to five gates attain leak declining from 0.820 to 0.744 as γ increases from 0.05 to 0.20.Amplitude damping is not a Pauli channel, and the search treats it without modification.Source: C. Non-Pauli noise and ancilla size · p. 6
  • At ε = 0.10, enlarging the ancilla from one to two qubits changes the attainable value from 0.7850 to 0.7858, and a third qubit produces no four-decimal change.The two-qubit ancilla used in the study is therefore adequate at this one-basis operating point.Source: C. Non-Pauli noise and ancilla size · p. 6

D. Bilateral noise in the entanglement-based protocol

  • Under bilateral depolarising noise, Alice’s channel lowers χ through data processing, while Bob’s leaves χ unchanged but tightens the CHSH margin; a single-subsystem model uses (1 − p) instead of (1 − p)^2.At small p, that modeling error halves the estimated noise-induced CHSH loss and places the honest-link failure point at roughly twice its true noise level.Source: D. Bilateral noise in the… · p. 6
  • The honest depolarised pair reaches Ssec ≈ 2.4240, with the finite-statistics operational threshold τS ≈ 2.444; bilateral noise brings the honest CHSH value below τS at p ≈ 0.070.The attacker’s operating band closes at a noise level set by quantum theory and the key-rate formula.Source: D. Bilateral noise in the… · p. 6

IV. ATTACKS UNDER DEVICE DRIFT

The paper frames drift-aware eavesdropping as a sequential decision problem because static analyses cannot assess adaptation across changing channel states. It uses a finite library of learned circuits and benchmarks policies against fixed-circuit and dynamic-programming bounds under an episode-level abort budget.

A. Adaptive eavesdropping as a constrained decision process

  • The channel parameter follows an Ornstein–Uhlenbeck process, and each episode has 50 rounds in which the attacker selects a circuit and earns FAE for BB84 or χ(A:E) for E91.Abort depends on the monitored statistic’s episode mean falling below its threshold, rather than a single-round value.Source: A. Adaptive eavesdropping as a… · p. 7
  • The attacker observes current and three prior noise values, her previous action, recent monitored-statistic mean, cumulative mean reward, and remaining rounds; exact noise observation removes inference lag and favours the attacker.The observation idealises inference from the public error-rate record, since the attacker knows the disturbance she contributes.Source: A. Adaptive eavesdropping as a… · p. 7
  • Compact learned circuits form discrete libraries of 24 BB84 and 26 E91 circuits, plus identity, making the constrained Markov decision process solvable by standard methods.The policy selects library circuits, and the detection penalty is tuned for strict or tolerated settings.Source: A. Adaptive eavesdropping as a… · p. 7

IV. ATTACKS UNDER DEVICE DRIFT

  • A drifting channel creates a sequential question that frozen-behaviour analyses cannot answer: policies must allocate an episode-wide abort budget while anticipating future noise.The objective averages over stochastic channel trajectories.Source: §IV · p. 6, A. Adaptive eavesdropping as a… · p. 7

A. Adaptive eavesdropping as a constrained decision process

  • The best fixed circuit’s zero-detection reward is bounded above by any zero-detection adaptive policy, which in turn is bounded by dynamic programming, Vfix ≤ Vπ ≤ VDP.The dynamic-programming value is the absolute upper bound for the circuit library under the no-detection constraint.Source: A. Adaptive eavesdropping as a… · p. 7
  • Both the greedy oracle and zero-detection trained agent fall below VDP, while the oracle’s gap measures the value of anticipating the episode budget.The agent’s shortfall from VDP indicates unexploited potential.Source: A. Adaptive eavesdropping as a… · p. 7

B. Libraries of learnt circuits

The paper builds compact learned-circuit libraries and a value-based agent for choosing safe attacks as channel noise drifts. Across BB84 and E91, adaptation improves on fixed or conservative policies while remaining near the zero-detection dynamic-programming bound.

B. Libraries of learnt circuits

  • BB84 uses 24 circuits across four aggressiveness levels and six noise anchors; E91’s CHSH-only library has 26 feasible five-to-nine-gate cells.The E91 construction uses a three-qubit preparation and yields a constructive lower bound for a dimension-restricted attacker at operating noise.Source: B. Libraries of learnt circuits · pp. 7–8

C. Adaptive agent and baselines

  • The value-based reinforcement-learning agent uses invalid-action masking to exclude circuits that would push the ten-round mean below the threshold.The agent and greedy oracle share this safety filter; the comparison also includes passive and reference policies.Source: C. Adaptive agent and baselines · p. 9

E. Value of adaptation on E91

  • χ = 0.3484 at zero detection, versus χ = 0.135 for the best fixed circuit, puts the E91 agent within 2% of VDP ≈ 0.356.The adaptive attack yields approximately 2.6 times the fixed circuit’s information; the released coarse-grid dynamic-programming run reaches 0.3540 with 7% detection.Source: Table III · p. 9, E. Value of adaptation on E91 · pp. 9–10
  • Across 200 paired E91 episodes, the agent trails the greedy oracle by 0.0023 and outperforms masked policy gradient by 0.0017; both differences are significant.Unmasked policy-gradient agents reach χ ≈ 0.26–0.28, while the coarse-grid dynamic-programming run’s 7% detection is a discretisation artefact; a fine grid gives a zero-detection optimum of 0.356±0.001.Source: E. Value of adaptation on E91 · pp. 9–10

D. Value of adaptation on BB84

  • FAE = 0.7434 at zero detection matches the BB84 greedy oracle and exceeds the conservative lookup’s 0.7197 by 0.024.The agent achieves 98.8% of VDP = 0.7527; the drift experiments enforce the basis-averaged constraint FAB ≥ 0.87.Source: D. Value of adaptation on BB84 · p. 9, Figure 4 · p. 10

F. Tolerance for detection

Tolerating detection does not improve the final attainable BB84 information beyond what is available without detection, while E91 shows no gain from the tolerated penalty. The paper frames its attacks as constructive evidence for provisioning margins, not formal security certificates, and identifies limits to the evaluated drift threat models.

F. Tolerance for detection

  • FAE = 0.7477 at 4% detection exceeds the strict BB84 agent by 0.0043, but the same VDP = 0.7527 is reached without detection.The gain reflects an easier learning problem under a softer penalty, not a task-inherent trade-off; the tolerated and strict E91 agents coincide.Source: F. Tolerance for detection · p. 10

V. DISCUSSION

  • The evaluated adaptive threat models assume asymptotic detection statistics and perfect tracking of current noise; delayed estimation and finite-sample effects remain open questions.The BB84 drift library also restricts the attacker to one-qubit memory and a basis-averaged constraint; per-basis monitoring alters attainable information.Source: §V · pp. 10–11

VI. PRACTICAL CONSEQUENCES

  • Drift changes the information available to an attacker under trusted noise, and the E91 and BB84 experiments show gains over fixed or conservative policies.These values concern provisioning margins; they are not claims about the soundness of formal proofs.Source: §VI · p. 11

S1. LEARNT ATTACKS ON A FIXED TEMPLATE: A REVIEW OF REF. [13]

  • Unlike Ref. [13], which fixes the gate template and channel, this work searches gate structure and angles and evaluates attacks on channel families and drifting channels.The learnt attacks serve as actions in a sequential adaptation problem.Source: S1. LEARNT ATTACKS ON A FIXED… · p. 13

S2. THE TWO-LOOP SEARCH PROCEDURE

A two-loop search jointly explores gate sequences and rotation angles, with protocol-specific objectives and optimisers. Starting from random sequences, it recovers known cloners and the symmetric-channel key rate without analytical input.

S2. THE TWO-LOOP SEARCH PROCEDURE

  • The outer loop evolves gate sequences while a fixed-budget, gradient-free inner loop tunes angles; CMA is used for BB84 and SPSA for E91.The optimiser comparison reports matching fidelity and equilibrium gate count at fixed budget.Source: S2. THE TWO-LOOP SEARCH PROCEDURE · p. 13, Table S1 · p. 14
  • At fixed evaluation budget, larger topologies receive noisier fitness estimates, and selection settles on compact circuits without an explicit size penalty.Exact evaluation instead returns circuits of four to eight gates, versus four to six under the budgeted sweeps.Source: S2. THE TWO-LOOP SEARCH PROCEDURE · pp. 13–14

S3.1. Reproduction of analytical cloners

S3.2. Collective attacks and the asymptotic key rate

S3.3. Comparison with a reliable numerical lower bound

The constructed attacks are compared with numerical lower bounds and evaluated across channel conditions and monitoring conventions. Their feasibility constraints make each exhibited attack compatible with the observed statistics.

S3.3. Comparison with a reliable numerical lower bound

  • Across four operating points, the constructed attack extracts χ(AZ:E) = h(QX), and its upper bound agrees with the numerical lower bound within 3 × 10^-4 in rate.Both bounds reproduce the Shor–Preskill rate 1 − h(QZ) − h(QX).Source: S3.3. Comparison with a reliable… · p. 15

S4. CHANNEL SWEEPS: SPECIFICATION AND RESULTS

  • Across the exact channel sweeps, attainable values match the closed form within 2 × 10^-4; at ε = 0.10, re-optimisation improves FAE by 0.0012 over the transplanted circuit.The symmetric-channel circuit remains feasible on the one-basis channel at FAB = 0.8700.Source: S4. CHANNEL SWEEPS: SPECIFICATION AND… · p. 15

S4.1. Per-basis repetition

S5.1. Constructed attacks as upper bounds

  • A constructed attack gives an upper bound on the key rate because it evaluates the rate at one feasible eavesdropping strategy; stronger attacks yield lower upper bounds.Maximising χ returns χ = h(Q) at tested Q, collapsing the bound to r ⩽ 1 − 2h(Q).Source: S5.1. Constructed attacks as upper… · pp. 16–17

S5.2. Comparison with semidefinite relaxations

The section checks a CHSH semidefinite relaxation against known results and compares information bounds with attacks constructed by the search.

S5.2. Comparison with semidefinite relaxations

  • The CHSH relaxation maximises the Bell expression subject to a positive semidefinite moment matrix, reproducing Tsirelson’s bound at three monomial sets.The table reports moment-matrix dimension and the number of distinct moments.Source: S5.2. Comparison with semidefinite… · p. 17, Table S6 · p. 17
  • The device-independent guessing-probability relaxation agrees with the analytical Pguess(S) = 1/2 − S²/4 to one part in 10^10.The guessing probability is obtained from two subnormalised behaviours, each with its own positive semidefinite moment matrix.Source: S5.2. Comparison with semidefinite… · p. 17, Table S7 · p. 17

S5.3. upper bounds and lower bounds

  • At S = τS, the guessing-probability bound gives χ ⩽ 0.776, the collective-attack envelope gives χ ⩽ 0.607, and constructed attacks attain χ ≈ 0.350 averaged over operating noise.The min-entropy bound is looser than the von Neumann entropy envelope at every S.Source: S5.3. upper bounds and lower bounds · pp. 17–18, Table S8 · p. 18

S5.4. Distribution of computational cost

The section compares computational costs, clarifies the scope of device-independent bounds, and specifies how numerical lower-bound rates are evaluated and compared.

S5.4. Distribution of computational cost

  • In the CHSH scenario, the relaxation is three orders of magnitude cheaper, but at eight settings its 42.6 s solve time reaches parity with one circuit-search operating point.Circuit-search cost is 43–49 s per operating point and does not depend on the number of settings.Source: S5.4. Distribution of computational cost · p. 18, Table S9 · p. 18

S5.5. Comparison with device-independent upper bounds

  • The constructed upper bound is limited to the stated ancilla dimension and noise model, so it is not device-independent; the shared-CHSH comparison was not carried out.The convex-combination bound is expected to be tighter where the bounds overlap, but no outcome is claimed.Source: S5.5. Comparison with… · p. 19

S6.1. Comparison parameters

  • The comparison uses per-basis error rates (QZ, QX) with Eve responsible for all disturbance; reconciliation efficiency shifts both bounds equally and leaves their gap unchanged.The same input makes the constructed upper bound and the numerical lower bound directly comparable.Source: S6.1. Comparison parameters · p. 19

S6.2. Evaluation of the lower bound

  • The Bell-diagonal lower-bound evaluation reduces to a one-dimensional maximisation and returns 1 − h(QZ) − h(QX), with each evaluation taking about one second.The optimum is at d = QZQX; the identity is a numerical check, not an assumed input.Source: S6.2. Evaluation of the lower bound · p. 19

S6.3. Evaluation of the upper bound

The section evaluates the search against key-rate bounds, then translates discovered circuits into channel descriptions that conventional methods can use. It also identifies where comparisons with noisy-channel rate studies remain unmatched.

S6.3. Evaluation of the upper bound

  • The upper-bound evaluation uses the eavesdropper’s Holevo information about the key-basis bit and evaluates the bound at the rates the circuit actually produces.The circuit must reproduce both basis rates within 2 × 10^-3; Table S10 summarizes matched-rate attacks and upper and lower key-rate bounds.Source: S6.3. Evaluation of the upper bound · p. 20, Table S10 · p. 20

S6.4. Convergence diagnostics

  • Increasing the search budget closed both intermediate upper-bound gaps to below 10^-4 and returned smaller circuits of five and four gates.The earlier gaps were 0.073 and 0.036 in rate; comparing a constructive upper bound with a proved lower bound provides a convergence diagnostic.Source: S6.4. Convergence diagnostics · p. 20

S6.5. Relation to noisy-channel key-rate studies

  • No like-for-like numerical comparison is available with the cited thermal-loss or atmospheric-turbulence rate studies because both the state spaces and channel models differ.The search has been extended to amplitude damping, but not run on either channel; thermal loss is identified as a next comparison.Source: S6.5. Relation to noisy-channel… · p. 20

S7. TRANSLATION OF DISCOVERED CIRCUITS TO EAVESDROPPING STRATEGIES

S7.2. Kraus operators and induced channels

  • For a two-qubit ancilla, four 2 × 2 Kraus operators describe the induced channel using at most 32 real parameters.The channel composition is Λ◦N on Bob’s side while the attacker’s marginal is N^c alone; the BB84 drift library instead uses N◦Λ, where the attacker’s marginal depends on noise.Source: S7.2. Kraus operators and induced… · p. 21

S7.3. Measurements and resulting correlations

The attacker’s strategy is completed by a measurement selected after the public announcement, and the resulting correlations can be passed to conventional relaxations. The translated circuit also serves as a feasible starting point or witness for several analyses.

S7.3. Measurements and resulting correlations

  • For prepare-and-measure protocols, the announced basis selects a two-outcome measurement, with the Helstrom measurement optimal for discriminating the ancilla states.The resulting success probability gives the paper’s figure of merit without reference to a particular circuit.Source: S7.3. Measurements and resulting… · p. 21
  • For entanglement-based protocols, the isometry acts on one half of the shared pair, and the resulting correlations yield CHSH and Holevo quantities by the Born rule.These are supplied to a relaxation in standard form alongside the state, measurements, and Kraus set.Source: S7.3. Measurements and resulting… · p. 21

S7.4. Application as an ansatz

  • A discovered circuit supplies a feasible initial point for see-saw optimisation, which is sensitive to initialisation.It also provides a candidate attack for checking conditional-entropy lower bounds; a gap from the explicit attack localises where the relaxation is loose.Source: S7.4. Application as an ansatz · pp. 21–22
  • Exhibiting the circuit answers whether a correlation is attainable at a given noise level with an ancilla of a specified size.The circuit is an explicit witness, while the relaxation contributes certification.Source: S7.4. Application as an ansatz · p. 22

S8. DRIFT ENVIRONMENTS, REFERENCE POLICIES AND REPRODUCIBILITY

The drift environments model blockwise detection and compare learned policies with fixed, greedy, and dynamic-programming references. The supplementary results report evaluation variability, computational cost, scope boundaries, and the distinction from concurrent work.

S8.1. Environment specification

  • Each environment uses 50-round episodes, with noise initialized from a Gaussian and advanced by an Ornstein–Uhlenbeck process; detection depends on the episode’s mean statistic.The observation includes recent noise and action history, while the feasibility mask admits actions that keep the ten-round statistic above threshold.Source: S8.1. Environment specification · p. 22
  • The BB84 environment applies bit-flip noise before the attacker’s unitary and compares fidelity with a conservative noise-indexed lookup; E91 evaluates the Holevo quantity for Alice’s Z outcome.BB84’s lookup selects among six circuits; the E91 library has 27 actions.Source: S8.1. Environment specification · p. 22, S8.3. Values computed for this work · p. 22

S8.2. Checkpoint selection and spread

  • BB84’s three best strict checkpoints reached 0.7434, 0.7433, and 0.7432 without detection; tolerated checkpoints reached 0.7477, 0.7463, and 0.7462 at 4%, 14%, and 4% detection.The match between the agent and greedy oracle was a best-case training outcome, while the ordering in Table III was robust to it.Source: S8.2. Checkpoint selection and spread · p. 22

S8.3. Values computed for this work

  • For E91, the best fixed circuit without detection had χ = 0.135, the greedy oracle reached 0.345, and the refined zero-detection dynamic-programming upper bound was 0.356 ± 0.001.For BB84, the reported dynamic-programming value was 0.7527 without detection; the best fixed circuit could not be evaluated because its library files were absent from the released artefact.Source: S8.3. Values computed for this work · p. 22

S9. NUMERICAL COST AND REPRODUCIBILITY

  • The full reported work required about 150–250 CPU-hours on commodity CPUs, with peak memory below 2 GB.The released artefact includes scripts, notebooks, random seeds, and an environment specification for regenerating reported values from stored results.Source: S9. NUMERICAL COST AND REPRODUCIBILITY · p. 23

S10. SCOPE AND DUAL-USE CONSIDERATIONS

  • The experiments use two-qubit ancillas and idealized noise models; field-link effects such as detector control, finite-key statistics, decoy-state calibration, and source imperfections are not modelled.The authors state that the reported results do not exceed the cited information-theoretic bounds.Source: S10. SCOPE AND DUAL-USE CONSIDERATIONS · p. 23

S11. NOTE ON CONCURRENT WORK

  • Unlike this work’s learned selection among variationally constructed circuits for a drifting channel, Bagunu (2026) [33] studies tabular reinforcement learning on a fixed intercept-resend attack against a stationary channel.Both studies model adaptive eavesdropping as a sequential decision process.Source: S11. NOTE ON CONCURRENT WORK · p. 23
Loading 2610.01792v1…