{"id":"fcc89edf-8c52-4d4f-af94-da95e8608cb4","arxiv_id":"2501.00754","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Using quantum label encoding, the authors claim to guarantee that an authorized learner achieves better PAC-learning outcomes than any eavesdropper, and they demonstrate the effect with convolutional neural networks.","lead":"This paper proposes a way to send labeled training data so that only an authorized learner gets clean labels, while any eavesdropper gets noisy ones. It gives a PAC-learning-style guarantee that the authorized learner can achieve a target accuracy with high confidence, while the eavesdropper cannot match that guarantee.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's proof asserts the key noise-tradeoff implication (Eq. 18) without deriving it; the stated assumptions do not imply it, and the theorem's condition conflicts with its proof.","rationale":"The reader's weakest assumption points to the unproven noise-tradeoff relation, and my analysis confirms that this is the load-bearing gap. However, I found a sharper formulation: the paper's own stated assumptions (Eqs. 14 and 15) do not even imply the key step (Eq. 18), because they do not order η_A against η_E. The proof of Theorem 2 is not merely incomplete; as written, the inference is invalid. Additionally, the theorem statement contains a sign inconsistency (η_A > η⋆ vs. η_A < η⋆) that makes the central claim ambiguous. This supports the reader's rejection verdict, so I recommend no change to the verdict. The concrete counterexample demonstrates the logical failure: both noise levels below η⋆ can yield the opposite inequality, so the guaranteed superiority of the authorized learner does not follow from the stated premises. Qualitative observations about noisy labels and the CNN experiments are suggestive but do not repair the missing derivation. The central theorem, as presented, is not established.","tokens_in":14632,"tokens_out":4059,"duration_ms":33426,"concrete_test":"Construct a counterexample satisfying the paper's stated assumptions: let η⋆ = 0.11, set η_A = 0.05, η_E = 0.01, and |Ξ_A| = |Ξ_E|, so Eq. (14) and Eq. (15) hold. Then γ_A = 0.9025ϵ²/2 and γ_E = 0.9604ϵ²/2, giving δ⋆_A > δ⋆_E, contradicting Eq. (18). More generally, attempt to re-derive Eq. (18) from Eqs. (14)–(16) without extra assumptions; if the derivation requires an additional tradeoff condition (e.g., η_A < η_E), Theorem 2's condition must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is Theorem 2. Its proof reduces to Eq. (18): η_A < η⋆ ⇒ δ⋆_A < δ⋆_E, where δ⋆ = e^{-γ|Ξ|} and γ = ϵ²(1−2η)²/2. With ϵ_E = ϵ_A and |Ξ_A| ≥ |Ξ_E| (Eq. 14), this requires the unstated relation η_A < η_E (or more generally γ_A|Ξ_A| > γ_E|Ξ_E|). Proposition 1's Eq. (15) only says both η_A and η_E are below η⋆; it does not order them. The one-line proof of Theorem 2 does not derive this ordering; it imports a QKD information-disturbance tradeoff from Ref. [31] without formalizing it in this PAC framework. Moreover, the theorem statement says 'if η_A > η⋆ is secured' while the proof uses η_A < η⋆, an internal mismatch. Without the missing implication, LE could have lower noise than LA while both are below η⋆, making δ⋆_A > δ⋆_E and destroying the guaranteed superiority. Thus the central theorem is unsupported as stated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework for guaranteeing that an authorized learner achieves better PAC learning outcomes than an eavesdropper, using quantum label encoding. It defines a 'learning probability', connects it to PAC confidence, derives a corollary relating dataset size, label noise, accuracy, and confidence (Eq. (7)), and states Theorem 2 claiming that if a protocol satisfies Eq. (15), the authorized learner can be guaranteed a better PAC guarantee than any eavesdropper. The authors implement a quantum label transmission protocol and test with CNNs on a cats/dogs image classification task, reporting learning-probability curves for authorized and eavesdropping learners under different noise levels.","tokens_in":14911,"tokens_out":5418,"duration_ms":45769,"significance":"If the main theorem were proved, this would be a striking result connecting quantum information-theoretic security with PAC learnability, with potential applications in secure machine learning. The paper deserves credit for making the central claim precise enough to be checked, for specifying a concrete protocol, and for quantitative experiments with 150 runs per condition across three CNN models. However, the theorem's key implication (Eq. (18)) is unproven; the suppression of the model-complexity term in Eqs. (6)-(7) invalidates the derived PAC bound; and the experiments largely restate that label noise degrades CNN accuracy. As it stands, the central contribution is not established.","major_comments":[{"comment":"The derivation from Eq. (5) to Eq. (6) drops the model-complexity factor. From |Theta| >= M_{b,η} = [2/(ε^2(1−2η)^2)] ln(2|H|/δ), the correct implication is δ >= 2|H| exp(−ε^2(1−2η)^2|Theta|/2), not δ >= exp(−ε^2(1−2η)^2|Theta|/2). Consequently Eq. (7) is not a valid lower bound on δ, and every later comparison of δ* values in Eqs. (16) and (18) inherits this error.","section":"Sec. 2.1, Eqs. (6) and (7)"},{"comment":"The proof asserts that 'from Eq. (14) and Eq. (15), we can prove that η_A < η⋆ ⇒ δ⋆_A < δ⋆_E', but this is not derived. Eq. (14) gives |Ξ_A| >= |Ξ_E|, and Eq. (15) gives η_A, η_E < η⋆ without ordering η_A and η_E. Since δ⋆_j = exp(−ε_j^2(1−2η_j)^2|Ξ_j|/2), with ε_E = ε_A the inequality δ⋆_A < δ⋆_E requires (1−2η_A)^2|Ξ_A| > (1−2η_E)^2|Ξ_E|, which neither Eq. (14) nor Eq. (15) implies. The proof substitutes the desired conclusion for a derivation.","section":"Sec. 2.3, Theorem 2 proof, Eq. (18)"},{"comment":"The theorem states that 'if η_A > η⋆ is secured from Ξ_Q,A, there is no condition that ensures LE becomes a (ϵ_E, δ_E)-PAC learner satisfying (ϵ_E <= ϵ_A) ∧ (δ_E <= δ_A)', but the proof uses η_A < η⋆ in Eq. (18). This is an internal inconsistency: the condition in the theorem and the condition in the proof are opposite. The statement must be corrected before the claim can be evaluated.","section":"Sec. 2.3, Theorem 2 statement"},{"comment":"The experimental validation is largely circular. The protocol generates Ξ_Q,A and Ξ_Q,E from the same noise model, and the simulations compare learners with η_A = 0.01, 0.03, and 0.05, all below η⋆ ≈ 0.11, while η_E is not measured (Sec. 3.1 states 'the value of η_E cannot be estimated in S_E(P)'). Thus the observed gap between LA and LE learning curves only demonstrates that lower label noise yields better CNN accuracy; it does not test the quantum information-disturbance tradeoff that Eq. (18) requires. Moreover, the text acknowledges cases where LE's learning probability 'appears similar to, or even higher than, those of LA' (Sec. 3.2, NNL with large data), which contradicts the guaranteed-superiority claim in Theorem 2 and is not reconciled.","section":"Sec. 3.1 and 3.2, experimental validation"},{"comment":"The existence of a protocol P and threshold η⋆ satisfying Eq. (15) is imported from quantum key distribution results (Ref. [31]) and is not proven in this PAC learning framework. Conjecture 1, which links Holevo's condition to learning outcome quality, is explicitly a conjecture and is not demonstrated. Since Theorem 2 depends on both, the paper's central claim is conditional on unproved external assumptions that are not stated as theorems or formally connected to the PAC sample-complexity analysis.","section":"Sec. 2.3, Proposition 1 and Sec. 3.1, Conjecture 1"}],"minor_comments":[{"comment":"Theorem 1 is stated as an 'iff' with |Theta| >= (1/ε) ln(|H|/δ). This is the realizable-case sample complexity for a finite hypothesis class; the relationship to the constant 2 in Eq. (5) is not explained, and the sense in which it is tight should be clarified.","section":"Sec. 2.1, Eq. (4)"},{"comment":"The caption says '(a) for ε_T = 0.03 and (c) ε_T = 0.01', but the learning-probability panels are (b) and (c); the parenthetical labels are inconsistent with the figure.","section":"Sec. 3.2, Fig. 2 caption"},{"comment":"There is a typo in 'Hilbet-space'; it should read 'Hilbert-space'.","section":"Sec. 1, Introduction"},{"comment":"The identification of the learning probability with the PAC confidence 1−δ is asserted via Remark 1, but the random test model in Eq. (8) is a heuristic. The connection between the rate parameter ξ and the PAC sample-complexity bound is not formalized, so calling P_L a 'measurable physical quantity' is stronger than what is demonstrated.","section":"Sec. 2.2, Definition 3 and Remark 1"},{"comment":"The relation |Ξ_Q,E| <= |Ξ_Q,A| is described as 'generally assumed', but in the collective-attack simulations the paper sets |Θ_Q| = |Ξ_Q,A| = |Ξ_Q,E|, making Eq. (14) an equality. The dataset-size advantage in Eq. (14) is therefore not tested by the experiments.","section":"Sec. 2.3, Eq. (14)"}],"recommendation":"reject","confidential_remarks":"The central theorem is supported only by an asserted implication, and the manuscript contains an internal mismatch between the theorem statement and proof. These are not local presentation issues: the security claim reduces to an assumed noise ordering between authorized and eavesdropping learners. I recommend rejection, although a substantially reworked version that states the noise tradeoff as an explicit assumption, corrects the bound in Eqs. (6)-(7), and aligns the theorem statement with the proof could be considered in the future."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the central theorem is not established. The proof of Theorem 2 hinges on an implication (Eq. 18) that is asserted, not derived, and the theorem statement has an internal sign error (says η_A > η⋆, proof uses η_A < η⋆). As it stands, the main formal claim collapses.\n\nWhat is actually new: the 'learning probability' framing is a useful way to connect PAC confidence to empirically measurable cumulative success rates. The CNN experiments are reasonable and show a qualitative gap between the authorized and eavesdropping learners as noise changes. That part is suggestive.\n\nWhere the soft spots are:\n\n- Eq. (6)/(7): the reader says dropping the 2|H| factor is invalid. It is not invalid—since δ ≥ 2|H|e^{-γ|Θ|}, the weaker δ ≥ e^{-γ|Θ|} follows. But the bound becomes loose, and the paper treats it as if it were the tight lower bound. That matters because the subsequent comparison of δ^*_A and δ^*_E uses these loose bounds.\n\n- The logical gap in Theorem 2: even if δ^*_A < δ^*_E, that does not imply that LE cannot be guaranteed with δ_E ≤ δ_A. The proof assumes that because the lower bounds are ordered, the actual failure probabilities are ordered. They are not. You need an upper bound on LE's achievable guarantee, not a lower bound on its sample-complexity-derived δ.\n\n- The tradeoff η_A < η_E (or γ_A|Ξ_A| > γ_E|Ξ_E|) is the load-bearing assumption. Proposition 1 only says both are below η⋆, not that they are ordered. The one-line proof imports this from QKD security analyses, but that is a different setting and the mapping to PAC noise is not formalized.\n\n- Experimentally, there is no classical baseline and the fit to the theory is qualitative. The authors themselves note deviations for large datasets and robust models, which is honest but weakens the validation.\n\nBottom line: the idea is plausible and the empirical pattern is real, but the formal claim does not hold as written. A referee could help the authors fix the statement and proof, or weaken the claim to a conjecture. I would send it to peer review because the core idea deserves scrutiny, but I would not cite the theorem as proven.","headline":"Central theorem unproven: the key tradeoff is imported from QKD, the proof has a sign error, and the δ-comparison does not follow; the learning-probability framing and experiments are suggestive but not validating.","tokens_in":15440,"tokens_out":5031,"would_cite":false,"duration_ms":45063,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68Q32","68T05","81P68"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proves that when the authorized learner's measured noise falls below a critical threshold in a quantum label-encoding protocol, no eavesdropper can be guaranteed equally good PAC learning, and the condition can be checked from…","keywords":["PAC learning","quantum label encoding","learning probability","data security","eavesdropper","noisy sample complexity","CNN image classification","quantum key distribution"],"falsifier":"Simulate the proposed protocol with an eavesdropper employing the optimal collective attack and directly measure both $\\eta_A$ and $\\eta_E$; the central claim collapses if any parameter regime shows $\\eta_A < \\eta^\\star$ yet $\\gamma_E|\\Xi_{Q,E}| \\ge \\gamma_A|\\Xi_{Q,A}|$, or if CNN trials reveal an eavesdropper consistently matching the authorized learner's accuracy and confidence in that regime.","tokens_in":14415,"feed_emoji":"🔐","tokens_out":7101,"duration_ms":63837,"temperature":0.7,"pith_summary":"The paper sets out to prove that an authorized learner can be guaranteed a better learning outcome than any eavesdropper when training labels are encoded in qubits. It works in the probably-approximately-correct (PAC) framework and introduces learning probability as a measurable stand-in for PAC confidence. The central result is a threshold condition: if the authorized learner measures a label noise $\\eta_A$ below a critical value $\\eta^\\star$, then no eavesdropper can be guaranteed to match the authorized learner's accuracy and confidence simultaneously. What makes this practical is that the guarantee is certified using only quantities the authorized learner can measure about their own dataset, namely its size $|\\Xi_{Q,A}|$ and noise $\\eta_A$. The authors validate the prediction with CNN image classification, where decreasing $\\eta_A$ widens the gap in learning probability between authorized and eavesdropping learners.","feed_headline":"Quantum labels secure learning for the authorized user","feed_subtitle":"Low noise below a quantum threshold bars eavesdroppers from matching the learner's PAC guarantee.","key_machinery":"The load-bearing object is quantum label encoding, a classical-quantum hybrid encoding in which each label $c(x)$ is stored as a qubit state $|c(x)\\rangle$ rather than a classical bit. Around it, the paper builds a transmission protocol in which the authorized learner sends random states $|0\\rangle$, $|1\\rangle$, $|\\pm\\rangle$ to a data center; the data center returns the label-encoded state for $k=0,1$ or an unchanged $\\pm$ test state, and the authorized learner uses the $\\pm$ states to estimate their own noise $\\eta_A$ via Eq. (19). The learning-probability function $P_L(|\\Theta|,\\epsilon)$ links the confidence $1-\\delta$ in PAC learning to a directly measurable cumulative distribution over training-data consumption. The threshold $\\eta^\\star$ is imported from quantum key distribution security analyses, where information gain and disturbance trade off, and the proof combines this with the noisy sample-complexity bound $M_{b,\\eta} = \\frac{2}{\\epsilon^2(1-2\\eta)^2}\\ln(2|H|/\\delta)$.","core_discovery":"On the paper's own terms, Theorem 2 is the discovery: for a quantum protocol satisfying the threshold condition $(\\eta_A < \\eta^\\star) \\wedge (\\eta_E < \\eta^\\star)$, when the authorized learner's noise lies below $\\eta^\\star$, the PAC lower bound $\\delta^\\star_A = e^{-\\gamma_A |\\Xi_{Q,A}|}$ is strictly smaller than $\\delta^\\star_E = e^{-\\gamma_E |\\Xi_{Q,E}|}$ with $\\gamma = \\epsilon^2(1-2\\eta)^2/2$ and equal accuracies. An eavesdropper can therefore never be assured PAC quality $(\\epsilon_E \\le \\epsilon_A) \\wedge (\\delta_E \\le \\delta_A)$ in the same data transmission, though a single lucky hypothesis is not ruled out. The condition depends only on authorized-side measurements, so the authorized learner can certify the eavesdropper's limitation from their own noisy dataset.","pith_inferences":["Beyond the paper's claims, a natural next test is to derive the $\\eta_A$–$\\eta_E$ tradeoff analytically for the label-encoding protocol itself, rather than importing thresholds from quantum key distribution; that would determine whether Theorem 2 survives outside the QKD regime.","The learning-probability formulation could serve as a practical audit tool: a model provider can report a PAC-style certificate from the empirical cumulative distribution of data consumption, independent of any adversary.","Robust models with ample data will erode the numerical gap (the paper already observes this for NASNetLarge), so the security guarantee should be understood as worst-case PAC assurance, not a universal accuracy separation.","The same certification logic might extend to other encodings, such as continuous-variable labels or multi-level quantum labels, if a corresponding noise threshold can be identified."],"forward_implications":["An authorized learner can certify, from their own dataset size and noise level alone, that eavesdroppers are not guaranteed equally good PAC learning.","The guarantee is about assurance rather than absolute prohibition: an eavesdropper might still return a good hypothesis, but no PAC-style promise covers it.","Tighter noisy sample-complexity bounds would upgrade Theorem 2 from 'not ensured' to 'forbidden', as the authors state in the conclusion.","Lowering $\\eta^\\star$ by improving the encoding protocol would shrink the learning quality available to eavesdroppers.","CNN experiments show the authorized-vs-eavesdropper gap in learning probability grows as measured $\\eta_A$ decreases."],"supporting_citations":[{"why":"Valiant's PAC framework supplies the sample-complexity definition and Theorem 1's bound.","marker":"[21]"},{"why":"Angluin and Slonim's noisy learning result gives the $\\eta$-dependent sample-complexity bound in Eq. (5), from which Corollary 1 follows.","marker":"[26]"},{"why":"The transmission protocol is a modified version of the earlier secure quantum pattern encoding scheme from this reference.","marker":"[19]"},{"why":"Quantum key distribution security analysis supplies the threshold values $\\eta^\\star \\simeq 0.11$ for collective attacks and the underlying noise tradeoff.","marker":"[31]"},{"why":"Introduces the classical-quantum hybrid encoding that this paper adapts as quantum label encoding.","marker":"[23, 24]"},{"why":"The quantum no-cloning theorem is cited to ground Proposition 1's claim that a robust protocol restricts eavesdropper strategies.","marker":"[32, 33]"}],"fun_headline_variants":["Quantum labels guarantee learning exclusively for authorized user","Noise threshold bars eavesdroppers from matching PAC bounds","Authorized learner's PAC guarantee beats eavesdropper's","Quantum encoding secures learning outcome for authorized only"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the authorized learner's large-dataset quality $\\gamma_A|\\Xi_{Q,A}|$ exceeds the eavesdropper's whenever $\\eta_A < \\eta^\\star$; the paper imports this noise-quality tradeoff from quantum key distribution security analyses instead of deriving it for the label-encoding protocol.","fun_headline_variants_meta":{"raw":{"variants":["Quantum labels guarantee learning exclusively for authorized user","Noise threshold bars eavesdroppers from matching PAC bounds","Authorized learner's PAC guarantee beats eavesdropper's","Quantum encoding secures learning outcome for authorized only"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000266,"raw_usage":{"total_tokens":1594,"prompt_tokens":913,"completion_tokens":681,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":529,"completion_tokens_details":{"reasoning_tokens":619}},"tokens_in":529,"tokens_out":681,"duration_ms":7251,"temperature":1.0,"reasoning_tokens":619,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:43:34.470729+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Simulate the proposed protocol with an eavesdropper employing the optimal collective attack and directly measure both $\\eta_A$ and $\\eta_E$; the central claim collapses if any parameter regime shows $\\eta_A < \\eta^\\star$ yet $\\gamma_E|\\Xi_{Q,E}| \\ge \\gamma_A|\\Xi_{Q,A}|$, or if CNN trials reveal an eavesdropper consistently matching the authorized learner's accuracy and confidence in that regime.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Valiant's PAC framework supplies the sample-complexity definition and Theorem 1's bound."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Angluin and Slonim's noisy learning result gives the $\\eta$-dependent sample-complexity bound in Eq. (5), from which Corollary 1 follows."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The transmission protocol is a modified version of the earlier secure quantum pattern encoding scheme from this reference."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Quantum key distribution security analysis supplies the threshold values $\\eta^\\star \\simeq 0.11$ for collective attacks and the underlying noise tradeoff."}],"review_version":1}