{"id":"3a0df1bb-0e0b-4efb-978c-3402610eacb7","arxiv_id":"2411.15545","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"For shared stabilizer and graph states, secret key distribution between two parties is possible exactly when they are inseparable, and for AME stabilizer states the help of any majority of parties is necessary and sufficient.","lead":"The paper proves when multi-party quantum states called stabilizer states can let any two parties establish a secret key with the help of a majority of other parties, and it extends the construction to general graph states. A reader interested in quantum networks would read it because it offers a concrete, near-term recipe for multi-party quantum key distribution built on existing graph-state technology.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's sufficiency proof is not secure QKD: the odd-path stabilizer in Lemma 4 lets an idle path neighbor recover the key, so the claimed security proof is invalid.","rationale":"The paper's core AME stabilizer theorem (Theorem 1) is cleanly proven and is the strongest part of the work. The reader's stated weakest assumption, that a colluding majority of cooperators can reconstruct the key in the AME protocol, does not actually land: in the AME protocol the cooperators' public announcements reveal only the product of the two communicants' outcomes, and no subset of size ≤⌊n/2⌋ has any information about the individual key bit, so even if all cooperators exchange outcomes they cannot compute the key. The genuinely load-bearing gap is in Theorem 3's sufficiency proof. Lemma 4 constructs a stabilizer from every other vertex on a shortest path, but the resulting support omits some path vertices; a party at an omitted vertex can measure a single local Pauli and, using the already-public cooperator outcomes, evaluate a stabilizer that is not a substring of the chosen σ. The 5-qubit path example shows this concretely: party 4 learns X5 = Z4. This is not a mere cosmetic issue because QKD is meaningless if another party holding a qubit of the shared state can compute the key. Section V even recognizes this class of attack and proposes the full-path product as a fix, but that fix is not integrated into Lemma 4 or Theorem 3. Both this gap and the invalid qudit proof in Appendix C mean the manuscript needs revision before the advertised protocols can be accepted as secure. Since both issues are repairable by relatively local changes, the reader's CONDITIONAL verdict remains appropriate, even though my reason differs from the reader's weakest-assumption analysis.","tokens_in":20328,"tokens_out":19942,"duration_ms":189553,"concrete_test":"For the 5-qubit path graph state with stabilizers S1=X1Z2, S2=X2Z1Z3, S3=X3Z2Z4, S4=X4Z3Z5, S5=X5Z4, simulate the protocol for 1↔5 using σ=S1S3S5 with party 3 announcing X3. Let party 4 measure Z4 and compute X5 from the stabilizer relations X1X3Z4=+1 and X1X3X5=+1, i.e. X5=Z4. Confirm that party 4 recovers the key. Then repeat with the full-path stabilizer σ=S1S2S3S4S5 = X1X2X3X4X5Z1Z5 and verify that every vertex of the path is now a cooperator and no remaining party outside the support can reconstruct X1 or X5 from public and local information.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Lemma 4 (Appendix D), for communicants 1 and r on a shortest path, the proof constructs σ = S1·S3·S5·...·Sr (odd-indexed stabilizers) and claims it satisfies Fact 1, hence is secure. Fact 1 only rules out substrings of σ that are stabilizers; it does not prevent a party whose qubit lies on the path but outside the support of σ from measuring one extra local Pauli and exploiting a stabilizer that is not a substring of σ. Concretely, take the 5-qubit path graph state 1-2-3-4-5. The Lemma 4 construction for QKD between 1 and 5 is σ = S1S3S5 = X1X3X5, with only party 3 as cooperator. The stabilizer S1S3 = X1X3Z4 gives X1X3Z4 = +1, and since X1X3X5 = +1, we get X5 = Z4. If party 4 measures Z4 and hears the public outcome X3 from party 3, party 4 recovers communicant 5's key bit exactly. This contradicts the claim of secure QKD in Lemma 4 and hence in Theorem 3. Section V explicitly acknowledges such attacks and proposes the full-path product σ = ∏_{k∈P(i,j)} S_k as a fix, but that fix is not what Lemma 4 or Theorem 3 proves. The theorem is probably repairable by using the full-path construction, but as written the sufficiency proof does not establish security against other parties sharing the state.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies majority-agreed key distribution (MAKD) from absolutely maximally entangled (AME) stabilizer states. The central results are: (i) Theorem 1, stating that in any n-qubit AME stabilizer state, for any choice of ⌊n/2⌋+1 qubits there exists a stabilizer element supported only on those qubits (exactly one for odd n, three for even n), so that QKD between any two parties can be performed with the cooperation of any ⌊n/2⌋−1 other parties, and this number is necessary and sufficient; (ii) Theorem 2, a qudit generalization; and (iii) Theorem 3, extending the construction to arbitrary graph states, where QKD between two qubits is claimed to be possible if and only if the two qubits are not separable across a bipartition, i.e., are connected by a path in the underlying graph. The paper also discusses self-testing of the shared states, conference keys, multiple independent keys, and fixed authorizer sets. The main protocol idea is to use stabilizer elements whose support defines the cooperating parties; the paper's Fact 1 and Lemma 4 are meant to establish that the chosen stabilizers do not leak the key to the public or to other parties sharing the state.","tokens_in":20616,"tokens_out":11145,"duration_ms":95174,"significance":"If Theorem 1 and Theorem 2 are correct, they provide a clean structural characterization of AME stabilizer states that is directly useful for multipartite cryptographic tasks, and the explicit counting (one or three stabilizers for a given majority subset) is an elegant result. The extension to graph states in Theorem 3, if proven, would give a practically relevant criterion based on graph connectivity, and the paper's discussion of conference keys and multiple independent keys adds value for near-term quantum network applications. The paper is written in a self-contained manner, with stabilizer-formalism proofs and explicit protocol steps; the self-testing section borrows known Bell inequalities, which is a reasonable choice. However, the security proof of Theorem 3 is not sound as written, and the qudit proof of Theorem 2 is too terse and contains apparent dimensional errors; these issues directly affect the main claims and must be addressed before the results can be relied upon.","major_comments":[{"comment":"The security claim of Lemma 4 is invalid. The odd-product stabilizer σ = S1·S3·S5·...·Sr is checked only against Fact 1, i.e., against substrings of σ that are stabilizer elements. But Fact 1 does not protect against a party whose qubit lies on the path but outside the support of σ, who can measure one extra local Pauli and combine it with the public announcements. Concretely, take the 5-qubit path graph 1-2-3-4-5 and communicants 1 and 5. The Lemma 4 construction gives σ = X1X3X5 (with party 3 as the only cooperator). The stabilizer group element S1S3 = X1X3Z4 is not a substring of σ, yet it implies X1X3Z4 = +1, and together with the relation X1X3X5 = +1 it yields X5 = Z4. Thus party 4, who is not a cooperator, can measure Z4, hear party 3's public X3 outcome, and recover communicant 5's raw key bit exactly. This contradicts the security claim of Lemma 4 and hence invalidates the sufficiency direction of Theorem 3 as written. Section V explicitly acknowledges this type of attack and proposes the full-path product σ = ∏_{k∈P(i,j)} S_k as a fix, but that fix is not what Lemma 4 or the proof of Theorem 3 proves. The theorem is probably repairable by adopting the full-path construction and proving its security, but the current proof does not establish it.","section":"Appendix D, Lemma 4, Eq. (D1)"},{"comment":"The proof of the qudit theorem is not reliable as written. The text states E(I/d^{|A|}) = E(1/d^{n-|A|} ∑_{σ∈S_{N\\A}} σ), which incorrectly sets the reduced density matrix of A to the maximally mixed state; the AME property for a majority subset A only gives E(ρ_A) = |N\\A|, not maximal mixedness. Furthermore, the concluding line 'S_{N\\A} cannot be a trivial group since |A| < |N\\A|' is dimensionally wrong for odd n, where |A| = ⌊n/2⌋+1 > |N\\A|. The intended counting argument (entropy of ρ_A equals |A|-k, where d^k = |S_A|) may well yield the claimed stabilizer existence, but as written the derivation needs to be rewritten with the correct entropy equality and the correct sizes of A and N\\A.","section":"Appendix C, proof of Theorem 2"},{"comment":"The paper's own Section V observes that the odd-path stabilizers used in Lemma 4 allow other parties to determine the key ('It is possible that the public outcomes allow some other party possessing a qubit of the shared graph state to determine the secret key'), and it proposes the full-path product as a remedy. This admission is in direct tension with the unqualified wording of Theorem 3, which is stated without the full-path restriction. The theorem and the protocol description need to be aligned: either Theorem 3 should state the specific stabilizer construction that is proven secure, or the security proof must be supplied for the construction that is actually proposed. As it stands, a reader following the proof of Theorem 3 cannot infer a secure protocol.","section":"Section V and Theorem 3"}],"minor_comments":[{"comment":"The Bell operator Ic is written with expectation values that include products of operators, but the local observables A_i, A'_i are never defined. Please define the measurement settings explicitly, so the expression is comprehensible and the claimed quantum expectation value can be verified.","section":"Section III, Eq. (14)"},{"comment":"The term 'substring' is used informally. A formal definition (restriction of a Pauli string to a subset of qubits, with the remaining factors replaced by identity) would make Fact 1 and the proof of Lemma 4 easier to follow.","section":"Section IV, Fact 1 and following text"},{"comment":"The security analysis in Appendix B only considers a single outside party using one local Pauli observable. The security model (passive, non-colluding adversaries, authenticated classical channels, honest-but-curious cooperating parties) is not stated in Section II or Section V. Please state the assumed adversary model explicitly, since this determines the validity of the claimed security guarantees.","section":"Appendix B"},{"comment":"The captions refer to 'green' public qubits; if the figures are printed in black and white, this is not visible. Please use a different visual marker (e.g., dashed circles) for public qubits.","section":"Figures 5-7"},{"comment":"Reference [110] reads 'Noisemodel from backend' and [111] is a Matplotlib citation; these appear to be leftover acknowledgements, not scholarly references. Please remove or properly cite the relevant sources.","section":"Reference list"},{"comment":"There are several typographical issues, including 'Absolutely Maxima lly' in the title, misaligned text in Table I, and inconsistent use of ± in equations (B1). A careful proofreading pass is needed.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on 2411.15545. The result worth stealing is Theorem 1: for qubit AME stabilizer states, any ⌊n/2⌋+1 parties can find a stabilizer on exactly their qubits, making the MAKD cooperation count tight. The proof via reduced stabilizer entropies is clean and correct. The necessary direction of Theorem 3 is also solid: separability forces any candidate stabilizer to have stabilizer substrings, which leaks the key.\n\nBut the sufficiency half of Theorem 3 does not hold as written. Lemma 4 builds σ = S1S3...Sr along the path and claims Fact 1 guarantees security. Fact 1 only blocks substrings of σ; it doesn't block a product of two adjacent stabilizers that overlaps σ partially. The 5-qubit path graph is a concrete counterexample: for communicants 1 and 5, σ = X1X3X5, and idle party 4 can use S1S3 = X1X3Z4 to get X5 = Z4 from the public X3. So a non-cooperating neighbor recovers the key. The paper's own Section V concedes exactly this attack for subset-path stabilizers and proposes the full-path product ∏ S_k as a fix, but Lemma 4 and the proof of Theorem 3 never apply that fix. The sufficiency claim is unproven as written. It's probably repairable, but the current text is internally inconsistent.\n\nThe qudit extension is also unproven. Appendix C's argument that S_{N\\A} is nontrivial because |A| < |N\\A| is wrong on its face, and in fact AME implies the complement has no nontrivial stabilizer for these sizes. Theorem 2 needs real work.\n\nThe graph-state material on conference keys and independent keys is interesting and mostly plausible, but it inherits the security flaw. The self-testing section is straightforwardly borrowed, while the die-roll partitioning trick is a nice practical touch, and the paper honestly notes that key rates are not computed.\n\nBottom line: Theorem 1 alone makes this worth a serious referee. The graph-state generalization is a good idea and likely salvageable, but the security proof needs a substantial rewrite and Theorem 2 needs a correct proof. I'd send it to review with major revision, not desk-reject.","headline":"Theorem 1 is solid and worth citing; the sufficiency proof of Theorem 3 is broken by a concrete attack the authors themselves acknowledge in Section V.","tokens_in":21170,"tokens_out":5153,"would_cite":true,"duration_ms":43349,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P94","81P40","81P68"],"pacs":["03.67.Dd","03.67.Mn"],"model":"deepseek-v4-flash","headline":"Quantum keys from AME states work with any majority's cooperation","keywords":["majority-agreed key distribution","absolutely maximally entangled states","stabilizer states","graph states","quantum key distribution","conference keys","self-testing","multipartite entanglement"],"falsifier":"For every qubit AME stabilizer state with $n=5$ or $n=6$, and for every subset of $\\lfloor n/2\\rfloor+1$ qubits, compute the subgroup of stabilizers supported on that subset; a single subset whose supported subgroup is just the identity would refute Theorem 1, and the analogous qudit computation refutes Theorem 2. For Theorem 3, a stabilizer state whose two target qubits lie in different factors of a product decomposition but which nevertheless admits a key stabilizer with no offending substring would be a counterexample.","tokens_in":20106,"feed_emoji":"🔐","tokens_out":8653,"duration_ms":72605,"temperature":0.7,"pith_summary":"An earlier proposal introduced absolutely maximally entangled (AME) states—multipartite states whose every half-sized reduction is maximally mixed—and suggested they could enable majority-agreed key distribution (MAKD), in which any two parties can set up a secret key only with the cooperation of a majority of the parties sharing the state. This paper proves that when the shared AME state also has stabilizer structure, the cooperation count is exactly optimal: any $\\lfloor n/2\\rfloor-1$ other parties suffice, and no smaller set can. It extends the same guarantee to qudit AME stabilizer states, where examples are more plentiful than for qubits. It then removes the AME requirement entirely for stabilizer states, showing that secure QKD between two parties is possible exactly when those two qubits are not separated by a product structure; for graph states this is simply connectivity. The concrete payoff is a set of protocols—MAKD, conference keys, multiple independent keys per shared state—that use graph states within reach of current preparation and self-testing methods.","feed_headline":"Quantum keys from AME states work with any majority's cooperation","feed_subtitle":"Any two parties sharing an n-qubit AME state can key-exchange with any majority of helpers; graph states add more.","key_machinery":"The load-bearing object is the stabilizer group of the shared state—the set of Pauli tensor products that leave the state invariant. For an AME stabilizer state every stabilizer has weight at least $\\lfloor n/2\\rfloor+1$, and the proof of Theorem 1 counts the independent stabilizers supported on a chosen subset through the reduced-density-matrix expansion $\\rho_A = 2^{-|A|}\\sum_{\\sigma\\in S_A}\\sigma$, using the AME condition to force the subgroup size. For the graph-state generalization, the machinery is the graph itself: stabilizer generators $S_i = X_i\\prod_{j\\in N(i)} Z_j$, the path product $\\sigma = \\prod_{k\\in P(i,j)} S_k$ along a shortest path between communicants, and the equivalence between separability and a block-diagonal tableau (a disconnected graph). Fact 1 tells which stabilizers are safe to use: no substring supported on one communicant may itself be a stabilizer, otherwise the announced permission bits leak the key.","core_discovery":"The paper's central claim is Theorem 1: in a stabilizer state that is also AME, for any choice of $\\lfloor n/2\\rfloor+1$ qubits there is a stabilizer element supported only on those qubits—exactly one when $n$ is odd and three when $n$ is even. Consequently, QKD between any two of the $n$ parties can be completed with the cooperation of any $\\lfloor n/2\\rfloor-1$ other parties, and AME structure makes fewer cooperators impossible. Theorem 2 lifts the statement to $n$-qudit stabilizer AME states, where at least one such stabilizer exists on every chosen subset of $\\lfloor n/2\\rfloor+1$ qudits. Theorem 3 replaces AME by a weaker condition: a shared stabilizer state permits secure QKD between qubits $i$ and $j$ if and only if the state is not separable with $i$ and $j$ in different factors; for graph states, connectedness of the underlying graph is the exact criterion. The paper also proves Fact 1, the necessary condition that a usable key stabilizer must not contain a substring that is itself a stabilizer on one communicant, and uses products of overlapping graph-state stabilizers along paths to build conference keys, parallel independent keys, and fixed authorizer sets.","pith_inferences":["A natural next step is tailoring self-testing inequalities to AME structure rather than borrowing generic graph-state Bell inequalities; the paper leaves key-rate analysis open, and an AME-specific test could substantially improve finite-key efficiency.","The security model presumes the cooperating permission holders do not collude; if a majority secretly pooled their raw outcomes, the published permission bits would determine the key, so a robust implementation would need to detect or prevent such collusion.","Because the number of authorizers is set by path length in a graph state, the same formalism could be used as an access-control layer in quantum networks, letting intermediate parties act as mandatory approval nodes for long-distance keys.","If qudit AME stabilizer states are easier to prepare than qubit ones, the qudit version of Theorem 2 makes MAKD a plausible near-term application in higher-dimensional photonic or atomic platforms."],"forward_implications":["For any $n$-qubit AME stabilizer state, each pair of parties can establish a secret key with exactly $\\lfloor n/2\\rfloor-1$ cooperating parties, and this number is both necessary and sufficient.","For $n$-qudit AME stabilizer states, the same majority-agreed key distribution works because each $\\lfloor n/2\\rfloor+1$-qudit subset carries at least one stabilizer correlation.","For arbitrary shared stabilizer states, QKD between two parties reduces to a single topological condition: the two qubits must not lie in different factors of a product decomposition—for graph states, a path must connect them.","Products of overlapping stabilizers along graph paths yield conference keys shared by more than two parties and allow several independent keys to be extracted from one resource state.","Scalable Bell inequalities for graph states can certify the shared state before MAKD begins, making the protocols compatible with device self-testing."],"supporting_citations":[{"why":"Introduces AME states and the majority-agreed key distribution problem that this paper sharpens.","marker":"[48]"},{"why":"Provides the stabilizer formalism and stabilizer-group structure used throughout Theorems 1 and 2.","marker":"[49]"},{"why":"Defines graph states and their stabilizer generators, the basis for the graph-state protocols.","marker":"[66]"},{"why":"Supplies the scalable Bell inequalities used to self-test the shared graph states before key distribution.","marker":"[65]"},{"why":"Establishes that every stabilizer state is local-Clifford equivalent to a graph state, the bridge used in the proof of Theorem 3.","marker":"[114–116]"},{"why":"Defines the original entanglement-based QKD protocol whose security and self-testing logic the paper adapts.","marker":"[28]"}],"fun_headline_variants":["Any majority unlocks QKD in AME stabilizer states","Graph states extend majority-key QKD beyond AME","Any majority suffices for key agreement in AME states","Any majority works for AME keys; graph states go further","Majority cooperation is necessary and sufficient for AME QKD"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The security analysis assumes the cooperating permission-holding parties are individually honest and do not secretly pool their measurement outcomes; if all cooperators compare notes, the public permission bits suffice to reconstruct the key.","fun_headline_variants_meta":{"raw":{"variants":["Any majority unlocks QKD in AME stabilizer states","Graph states extend majority-key QKD beyond AME","Any majority suffices for key agreement in AME states","Any majority works for AME keys; graph states go further","Majority cooperation is necessary and sufficient for AME QKD"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001218,"raw_usage":{"total_tokens":5079,"prompt_tokens":1085,"completion_tokens":3994,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":701,"completion_tokens_details":{"reasoning_tokens":3912}},"tokens_in":701,"tokens_out":3994,"duration_ms":28874,"temperature":1.0,"reasoning_tokens":3912,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:11:40.630189+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For every qubit AME stabilizer state with $n=5$ or $n=6$, and for every subset of $\\lfloor n/2\\rfloor+1$ qubits, compute the subgroup of stabilizers supported on that subset; a single subset whose supported subgroup is just the identity would refute Theorem 1, and the analogous qudit computation refutes Theorem 2. For Theorem 3, a stabilizer state whose two target qubits lie in different factors of a product decomposition but which nevertheless admits a key stabilizer with no offending substring would be a counterexample.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the scalable Bell inequalities used to self-test the shared graph states before key distribution."}],"review_version":1}