{"id":"83e4a374-1cec-49b6-b55f-65681b905933","arxiv_id":"1908.06063","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"The YY2018 quantum summation protocol lets the state-preparing party P1 steal other parties' secret integers, and the proposed countermeasure adds entanglement checks; one of the two attacks is new, but the security analysis has gaps.","lead":"A quantum protocol for several parties to sum secret numbers is shown to be insecure: the party who prepares the quantum states can read everyone else's inputs. The authors add a verification step and simplify the protocol, though the fix's security proof is not airtight.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (21) shows a single fake state evades the S3 check with probability N/(N+q), which is ~1 for fixed q and large N; the improved protocol's security is not established unless q scales with N.","rationale":"The attack on YY2018 in the paper checks out: P1 can prepare fake states and recover private strings because the original protocol lacks any verification of the shared entangled states. The improved protocol, however, has a concrete quantitative gap that the reader's weakest_assumption points toward but does not fully spell out. The probability in Eq. (21) is not a negligible function of a fixed security parameter; for input length N and fixed q, the single-fake attack succeeds with probability N/(N+q), which is close to 1 for large N. This is not merely a missing proof: it is an explicit attack probability arising from the protocol's own sampling procedure. The paper's statement that this approaches zero when q is sufficiently large is only true if q is allowed to grow with N, and no such scaling or security bound is provided. The claimed selected-fake pass probability is also stated without derivation, and for the F|0>^⊗n fake state that leaks in S4, the computational-basis pass probability is d^{-(n-1)}, not the paper's 1/(2d). These issues do not invalidate the valid cryptanalysis of YY2018, but they do mean the proposed countermeasure is not yet a rigorous security fix. The reader's CONDITIONAL verdict remains appropriate: the vulnerability result should be accepted, while the improved protocol requires a substantial security analysis or a redesigned verification step before the improvement claim can be accepted.","tokens_in":10858,"tokens_out":35166,"duration_ms":364456,"concrete_test":"Run the single-fake attack of §4.1 with fixed parameters, e.g., N=1000, q=20, d=2, n=2: P1 sends 999 genuine |ω> states and one F|0>^⊗n state; P2..Pn choose q=20 detection positions uniformly at random. Count the fraction of runs in which the fake position is not among the checked positions; Eq. (21) predicts ≈1000/1020=0.98. For those runs, verify that in S4 the fake state's Fourier outcomes are all 0, so Pj sends Mj=Kj and P1 learns one integer from every party. If the measured success rate matches N/(N+q), the improved protocol fails for fixed q; this also demonstrates the need for an explicit q(N,ε) security proof.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1's own Eq. (21) gives the probability that P1's one fake state is not selected by the S3 random check as C(N+q-1,q)/C(N+q,q) = N/(N+q). This is exactly the probability that the fake state survives to S4 and P1 obtains one integer from every party: using F|0>^⊗n as the fake state, the S4 Fourier-basis measurement yields L_j = 0 for all j, so each P_j sends M_j = K_j ⊕ L_j = K_j and P1 learns the t-th entry of every private string. The paper claims this probability approaches 0 when q is sufficiently large, but for any fixed q it tends to 1 as N grows; e.g., N=1000, q=20 gives 0.98. To obtain negligible failure, q must grow with N, a scaling the paper never states or proves. The additional claim that a selected fake state passes with probability 1/2+1/(2d) is asserted without derivation and, for the F|0>^⊗n state that actually leaks, the computational-basis pass probability would be d^{-(n-1)}, not 1/(2d); in any case a selected fake state is discarded, so the unselected probability is the operative one. Thus the central claim that the improved protocol defeats P1's attacks is not supported for realistic parameter choices.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper revisits Yang and Ye's 2018 quantum Fourier transform based multiparty quantum summation protocol (YY2018) and claims that the protocol is vulnerable to participant attacks by the state-preparing party P1. It presents two attacks: Attack 1, in which P1 measures all entangled states in the computational basis, applies F-dagger before distribution, and later recovers each honest party's private integer from the announced measurement results because she knows the initial measurement outcomes; and Attack 2, in which P1 exploits the correlation l1 xor ... xor ln = 0 of the Fourier-basis representation to recover one private integer of a party. The authors then propose an improved protocol that adds q extra states and a random two-basis checking step S3 to detect fake states, and that replaces the encoding operations by Fourier-basis measurements followed by modular addition. The paper concludes that the improved protocol resists P1's attacks and also removes the need for quantum Fourier transform encoding operations.","tokens_in":11089,"tokens_out":6696,"duration_ms":68621,"significance":"The two attacks described in Section 3 are genuine and are derived directly from the protocol equations; they are a useful contribution because they identify a realistic cheating strategy for the state-preparing party that YY2018 overlooked. The proposed simplification of replacing encoding operations with Fourier-basis measurements plus modular addition is elegant and is correctly argued at the algebraic level. The paper is also transparent in comparing itself with the concurrent work by Gu and Hwang. However, the security analysis of the improved protocol is not yet convincing: the detection-failure probability is mishandled, the claimed numerical pass probability is unsubstantiated and in fact wrong for the explicit fake state, and the crucial premise that the S3 checks certify the remaining N states is not proved. These issues are load-bearing for the paper's central claim that the improved protocol is secure against P1.","major_comments":[{"comment":"The detection-failure probability is N/(N+q), and the text says this 'will approach 0 when q is sufficiently large.' This is not correct as a scaling statement: for any fixed q, N/(N+q) tends to 1 as N increases. For example, N=1000 and q=20 gives 0.98. Since the analyzed case is exactly P1's single-fake-state Attack 1, the improved protocol is not shown to be secure for large N unless q grows with N, e.g., q = Omega(N), and the paper never states or proves such a requirement. This gap directly affects the central security claim.","section":"Sec. 4.1, Eq. (21)"},{"comment":"The claimed pass probability (1/2 + 1/(2d)) for a fake state selected in the S3 check is asserted without derivation, and it is incorrect for the explicit fake state in Eq. (20). If the computational basis is chosen, all honest parties measuring F|r> obtain the same value r and the state passes with probability 1, not 1/(2d); if the Fourier basis is chosen, the outcomes are all r and pass only when n r is 0 modulo d, which is not generally 1/d. For d=2, n=3 the actual pass probability is 1/2, whereas (1/2 + 1/(2d)) = 3/4. A correct analysis of the optimal fake state and of the S3 test is needed.","section":"Sec. 4.1, pass-probability claim"},{"comment":"The security argument assumes that passing the S3 checks on q randomly chosen states certifies that the remaining N states are genuine |omega> shared by all parties. This premise is unproven. S3 is a randomized two-basis spot check performed against an adversarial state preparer, and the paper provides no bound on the probability that an unselected state differs from |omega> conditional on all checks passing, nor does it analyze what P1 learns from the check rounds or whether her announcements can be adaptive. Without such a bound, the statement in S4 that 'all parties share, with a high probability, N genuine d-level n-component entangled states' is not supported. This gap is load-bearing because the privacy of the honest parties' inputs in S4 relies exactly on l^t_1 xor ... xor l^t_n = 0 and on P1 not knowing the l^t_j values.","section":"Sec. 4, S3 and S4"}],"minor_comments":[{"comment":"The claim that the improved protocol removes the need for the quantum Fourier transform is overstated: the parties still measure in the Fourier basis in S4, which requires a Fourier-basis measurement or an equivalent operation. Please rephrase to say that the protocol removes the need for the participants to perform the encoding operation U_k F.","section":"Abstract and Section 4"},{"comment":"The notation with the big operator combining a direct sum and a summation is unusual and undefined. Please define the intended expression clearly, e.g., by writing x_1 xor x_2 xor ... xor x_n each time.","section":"Eq. (19)"},{"comment":"There is a typo: 'entangled sates' should be 'entangled states.'","section":"Sec. 4, S1"},{"comment":"In Attack 2, Step (2), the text says Pj performs U_kj F 'on the received components' while only one component was sent to Pj; the wording should be singular for clarity.","section":"Sec. 3.2"}],"recommendation":"major_revision","confidential_remarks":"The algebraic attacks in Section 3 appear sound and are the strongest part of the paper. The main obstacle is the security proof of the proposed countermeasure: the scaling issue in Eq. (21) and the unproven/incorrect pass-probability claim are both load-bearing. If the authors can provide a rigorous certification argument for S3/S4 and correct the scaling statement, the paper is likely publishable as a cryptanalysis-and-countermeasure note."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague —\n\nWhat you should know: the two attacks on Yang-Ye’s 2018 summation protocol are real. I checked the algebra on both. Attack 1 is the natural cheating-prepare attack: P1 measures the |ω> states, sends known states, and recovers every k from the announced M_j. Attack 2 is a bit more clever — she keeps n−1 components and uses the correlation l1⊕…⊕ln=0 to extract a single k after the Fourier measurement. The observation that U_k F is equivalent to Fourier-basis measurement plus classical addition is correct and genuinely simplifies the implementation. The paper also openly credits concurrent work by Gu and Hwang for Attack 1 and the detection idea, which is the right thing to do.\n\nNow the soft spots. The improved protocol’s security does not hold as stated. Equation (21) gives the probability that one fake state escapes the S3 check as N/(N+q). For fixed q this tends to 1 as N grows — e.g., N=1000, q=20 gives 0.98. The paper says the probability approaches 0 when q is “sufficiently large,” but it never states that q must scale with N, let alone how. That is a load-bearing issue: the whole detection argument depends on that scaling. The claimed pass probability for a selected fake state, 1/2+1/(2d), is also asserted without derivation, and for the F|r> state in Eq. (20) it is not obviously right: in the computational basis the outcomes are uncorrelated, so the pass probability is tiny, not 1/2. And the “no QFT” selling point is overstated, since Fourier-basis measurement still requires the ability to measure in that basis.\n\nThe collusion-security paragraph is a sketch, not a proof. For a protocols paper in this subfield that is typical, but combined with the uncovered scaling problem it means the improved protocol should be read as a proposal, not a proven fix.\n\nWho gets value? Anyone working on secure multiparty quantum summation, and people who cite YY2018 as a building block. The attack result deserves to be on the record. The improved protocol needs a proper security analysis with a stated q(N) scaling and corrected detection probabilities before I’d trust it.\n\nI’d send it to peer review: the cryptanalysis is correct and the field runs on these protocol-specific corrections. But a referee should push hard on Section 4.1.","headline":"The attacks on Yang-Ye 2018 are correct and likely invalidate that protocol, but the improved protocol's security argument has a scaling hole: Eq. (21)'s N/(N+q) is close to 1 for fixed q and large N, and the stated pass probability is not derived.","tokens_in":11641,"tokens_out":6338,"would_cite":false,"duration_ms":61284,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The state preparer in a quantum summation protocol can silently recover all private strings, and a two-basis check closes the attack.","keywords":["quantum summation","quantum Fourier transform","participant attack","state-preparer attack","entangled-state verification","Fourier-basis measurement","modular addition","multi-party quantum computation"],"falsifier":"Exhibit a concrete fake state, for some $d\\ge2$ and $n>2$, whose probability of passing the S3 checks is at least the claimed bound, $\\frac{N}{N+q}$ when it is not selected for checking and $\\frac12+\\frac{1}{2d}$ when it is, and for which the announced measurement values $m_j^t$ allow P1 to compute $k_j^t$. The paper gives no proof that no such state exists, so finding one would refute the claimed security.","tokens_in":10586,"feed_emoji":"🔐","tokens_out":11499,"duration_ms":103553,"temperature":0.7,"pith_summary":"The paper argues that the 2018 multi-party quantum summation protocol based on the quantum Fourier transform is not secure against the participant who prepares the entangled states. That participant, P1, can run two kinds of attacks that recover other parties' private integer strings without tripping the decoy-photon checks, which only detect outside eavesdroppers. The paper then proposes an improved protocol that adds a random two-basis verification stage before any secret encoding, and that replaces the quantum Fourier transform encoding with Fourier-basis measurement plus ordinary modular addition. If the improved protocol is right, protocols in which one player supplies shared entanglement must verify the entanglement itself, not just the transmission.","feed_headline":"A quantum summation protocol leaks secrets to its state preparer","feed_subtitle":"Two participant attacks let the state preparer extract private strings; random two-basis checks close the hole.","key_machinery":"The central object is the d-level n-component entangled state $|\\omega\\rangle_{12\\ldots n} = \\frac{1}{\\sqrt{d}}\\sum_{r=0}^{d-1}|r\\rangle_1|r\\rangle_2\\cdots|r\\rangle_n$. Rewriting it in the Fourier basis gives $|\\omega\\rangle_{12\\ldots n} = \\frac{1}{(\\sqrt{d})^{n-1}}\\sum_{l_1\\oplus\\cdots\\oplus l_n=0}F|l_1\\rangle_1\\cdots F|l_n\\rangle_n$, which is the correlation that makes the protocol work: computational-basis measurements agree, and Fourier-basis measurements satisfy $l_1\\oplus\\cdots\\oplus l_n=0$. The attacks exploit that P1 can deviate from genuine states while retaining knowledge of the hidden $r_t$; the defense checks exactly this correlation in S3. The simplified protocol relies on the equivalence between the encoding operation $U_k^F$ and measuring in the Fourier basis followed by modulo-$d$ addition, which removes the need for participant-side quantum gates.","core_discovery":"The central claim is that YY2018's protocol is vulnerable to participant attacks by P1, the state preparer. In Attack 1, P1 measures each entangled state in the computational basis, applies $F^\\dagger$ to each component, and distributes the resulting product states; because she knows the hidden value $r_t$, each announced result $m_j^t = r_t \\oplus k_j^t$ directly reveals $k_j^t$. In Attack 2, she keeps $n-1$ components of a genuinely entangled state and uses the correlation $l_1 \\oplus \\cdots \\oplus l_n = 0$ to recover one private integer per entangled state. The improved protocol adds an S3 detection round in which randomly selected states are measured in either the computational or the Fourier basis and checked against the correlation, so the attacks are caught before encoding. It then computes the sum by having every party measure the remaining states in the Fourier basis and add their private strings modulo $d$.","pith_inferences":["An adaptive P1 who chooses fake states after seeing the check positions is not analyzed; a complete security proof would need to bound the maximum pass probability over all fake states, not just the product states considered in equation (20).","The stated equivalence between $U_k^F$ encoding and Fourier-basis measurement plus modular addition probably extends to other quantum-Fourier-transform-based summation or private-comparison protocols, letting them drop participant-side quantum gates.","Under channel noise, the S3 error threshold must sit above the physical noise rate but below the deviation caused by a fake state; deriving the finite-size trade-off among q, noise, and undetected leakage is a natural next step.","Attack 2's entangling-probe strategy, in which P1 keeps n-1 components while sending one to a victim, may be a general threat to any GHZ-type state-distribution protocol, not only summation."],"forward_implications":["As published, the 2018 protocol leaves every other private string recoverable by P1 using only N prepared states, so it should not be used without an entanglement-verification step.","The improved protocol removes the need for the quantum Fourier transform and participant encoding operations; each party just measures in the Fourier basis and adds modulo d, simplifying implementation.","The random two-basis check is a reusable countermeasure for any multi-party protocol in which one party supplies shared entangled states, because it tests the exact correlation a genuine state must have.","For large q, the probability that a single fake state escapes detection in S3 is $N/(N+q)$ when unselected and at most $\\frac12+\\frac{1}{2d}$ when selected, so the security parameter can be tuned to make undetected leakage arbitrarily small."],"supporting_citations":[{"why":"The target protocol whose state-preparation, encoding, and measurement steps are shown vulnerable to both attacks.","marker":"[28]"},{"why":"Decoy-photon transmission check used in the original protocol; the paper argues it only blocks outside eavesdroppers, not P1's state-preparer attacks.","marker":"[29]"},{"why":"Second decoy-photon technique cited as the basis for transmission security that leaves P1's attacks undetected.","marker":"[30]"},{"why":"Earlier quantum-Fourier-transform-based summation protocol with a circle-type transmission mode, used to clarify that the attack and fix are specific to YY2018's tree-type mode.","marker":"[26]"},{"why":"Independent concurrent work with an attack matching Attack 1; the comparison clarifies the overlap and the novelty of Attack 2.","marker":"[32]"}],"fun_headline_variants":["Quantum summation fix: random basis checks block state-preparer attacks","State preparer can steal sums; new protocol adds detection","Improved quantum summation: no QFT, resists insider attacks","Multi-party summation made secure: countermeasures for P1 attacks","Quantum summation loophole closed: two attacks thwarted"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The improved protocol's security depends on the unproven assumption that any fake state that passes the random two-basis checks in S3 cannot still be used by P1 to recover another party's private number; if such a fake state exists, the fix fails.","fun_headline_variants_meta":{"raw":{"variants":["Quantum summation fix: random basis checks block state-preparer attacks","State preparer can steal sums; new protocol adds detection","Improved quantum summation: no QFT, resists insider attacks","Multi-party summation made secure: countermeasures for P1 attacks","Quantum summation loophole closed: two attacks thwarted"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000207,"raw_usage":{"total_tokens":1351,"prompt_tokens":845,"completion_tokens":506,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":461,"completion_tokens_details":{"reasoning_tokens":422}},"tokens_in":461,"tokens_out":506,"duration_ms":4781,"temperature":1.0,"reasoning_tokens":422,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:58:08.535249+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Exhibit a concrete fake state, for some $d\\ge2$ and $n>2$, whose probability of passing the S3 checks is at least the claimed bound, $\\frac{N}{N+q}$ when it is not selected for checking and $\\frac12+\\frac{1}{2d}$ when it is, and for which the announced measurement values $m_j^t$ allow P1 to compute $k_j^t$. The paper gives no proof that no such state exists, so finding one would refute the claimed security.","supporting_citations":[{"cited_title":"Quantum Information Processing","cited_arxiv_id":null,"evidence_quote":"The target protocol whose state-preparation, encoding, and measurement steps are shown vulnerable to both attacks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Decoy-photon transmission check used in the original protocol; the paper argues it only blocks outside eavesdroppers, not P1's state-preparer attacks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Second decoy-photon technique cited as the basis for transmission security that leaves P1's attacks undetected."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Earlier quantum-Fourier-transform-based summation protocol with a circle-type transmission mode, used to clarify that the attack and fix are specific to YY2018's tree-type mode."},{"cited_title":"Improvement on \"Secure multi-party quantum summation based on quantum Fourier transform\"","cited_arxiv_id":"1907.02656","evidence_quote":"Independent concurrent work with an attack matching Attack 1; the comparison clarifies the overlap and the novelty of Attack 2."}],"review_version":1}