{"id":"7b0d5646-a2a6-4449-a6ac-c40d6b1721d6","arxiv_id":"2507.02622","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A classically secure access control system is shown to leak user secrets with certainty once quantum registers and local quantum memory are allowed, motivating new entanglement-aware access control models.","lead":"This paper shows a concrete case where a classically secure access control system becomes insecure when quantum registers are added, because quantum entanglement lets users correlate their measurements beyond what the access matrix allows. It then proposes new access control models that explicitly manage multi-qubit operations and entanglement to close the gap.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The proof of Theorem 3.3 schedules w1 to prepare the GHZ state after M_acc is set to M1, but M1 only grants w1 access to C_1 and flip on B; the required requests on C_2,...,C_n are unauthorised, so the constructed execution is invalid.","rationale":"The central claim of the paper is the existence of a security breach (Theorem 3.3). The proof constructs an explicit (S,P) and argues Pr[B(t2)=A(t1)]=1. The load-bearing step is the preparation of the GHZ state by w1, which requires access to all C_j. The schedule sets Macc=M1 before w1 acts, and M1 does not grant w1 access to C_2...C_n. Hence the constructed history is not authorised, so the proof does not establish the theorem. The reader's verdict of REJECT is supported, though for a slightly different reason than the stated weakest_assumption: the reader's weakest_assumption concerns the contingency on the lifting (LF); our concern is an internal contradiction in the proof's schedule. The reader's rationale does mention the authorization problem, so there is partial overlap, but the weakest_assumption field itself is not the same. A concrete test—checking authorisation of the history—would settle the issue; if the repair works, the central claim might be salvageable, but as submitted it is unproven.","tokens_in":40954,"tokens_out":7594,"duration_ms":78874,"concrete_test":"Verify each request in the constructed history against Auth(s,o,r) = (r in Macc[s,o]) for M0, M1, M2 as defined in Figures 2-4. Specifically, check whether any request by w1 on C_j (j>1) occurs after v's Line 1 has set Macc=M1; if so, the history is unauthorised and the construction fails. Then test the repair: move w1's GHZ preparation to before s(1)=v (i.e., while Macc=M0), keeping the rest of the schedule unchanged, and recompute Pr[B(t2)=A(t1)] to see whether the equality still holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"When M_acc = M1 (set by v at Line 1 of Figure 1), the scheduler in the proof of Theorem 3.3 assigns s(2)=...=s(2n+1)=w1 to execute Line 1 of Figure 5, which prepares |GHZ(n)> across C^2_1...C^2_n. The proof states this is done by swapping the content of each C_j into L[w1], preparing the GHZ state there, and swapping back. Each swap requires a request (w1, C_j, all) or similar. But under M1 (Figure 3), w1 holds 'all' only on C_1, not on C_2,...,C_n. Therefore Auth(w1, C_j, all) = false for j>1, and the history generated is not authorised per Definition 2.5. The execution (S,P) is thus not a valid execution of the access control system, so Theorem 3.3's claimed counterexample is not established. This is an internal error in the proof, not a disagreement about quantum consensus. The error may be repairable by moving the GHZ preparation into the M0 phase (where w1 has 'all' on every C_j) and only then setting M1, but as written the central claim is unsupported.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes a small multi-user access control system in the access-matrix model, proves a classical information-theoretic security bound (Theorem 3.1), and then claims that if the C_j registers are made quantum and the right 'all' is lifted to allow arbitrary operations on a register together with the user's local memory (LF), the same system becomes completely insecure (Theorem 3.3) because entangled users can violate Mermin's inequality. The paper then proposes three families of quantum access control models (subsystem, group, entanglement) and analyzes their security, flexibility, and efficiency.","tokens_in":41226,"tokens_out":10353,"duration_ms":122237,"significance":"If Theorem 3.3 were valid, the paper would provide the first explicit counterexample showing that a classically secure access control policy can be broken by a seemingly natural quantum lifting, with a clean explanation via Mermin's inequality. The paper is also valuable for proposing concrete access-control models with explicit control of multi-register operations and entanglement, and for giving a self-contained proof of the Mermin inequality variant. However, the central counterexample as currently written is not a valid execution of the system: the scheduler has w1 issue requests on C_2,...,C_n that the access matrix M1 does not authorize. The main threat result is therefore not established in the submitted version.","major_comments":[{"comment":"The scheduler construction is not an authorized execution. The proof sets s(2)=...=s(2n+1)=w1 to execute Line 1 of Figure 5 at a time when M_acc has already been set to M1 by v's Line 1. The proof states that Line 1 can be executed by swapping each C_j into L[w1], preparing the GHZ state there, and swapping back. Each such swap requires a request (w1,C_j,all) or an equivalent authorized operation. But under M1 (Figure 3), w1 holds 'all' only on C1 and 'flip' on B; the entries for C_2,...,C_n are empty. Hence Auth(w1,C_j,all)=false for j>1 under Definition 2.5, and the generated history is not authorized. The execution (S,P) is therefore not a valid execution of the access control system, so Theorem 3.3's claimed counterexample is not established. This is an internal error in the proof, not a disagreement about quantum consensus. A repair may be possible by preparing the GHZ state during the M0 phase (where w1 does have 'all' on every C_j) and only then invoking v's Line 1, but as written the proof fails.","section":"§3.3, Theorem 3.3 proof"},{"comment":"The breach is conditional on the specific lifting (LF), which requires both that local memories become quantum and that 'all' on X authorizes arbitrary operations on X together with L[s]. The paper's own protective models in Section 4 restore security precisely by rejecting this lifting and keeping local memories classical. This is not an internal inconsistency, because Theorem 3.3 explicitly assumes (LF), but the abstract and introduction state the threat to 'existing computer systems' in unconditional terms. The scope of the claimed threat should be qualified, or the paper should argue why (LF) is the canonical or inevitable lifting for a quantum upgrade, otherwise the headline claim is broader than what the scenario demonstrates.","section":"§3.3, lifting (LF); §1 abstract"}],"minor_comments":[{"comment":"The title contains a typo: 'qantum' should be 'quantum'.","section":"Theorem 3.3 title"},{"comment":"The title contains a typo: 'ineqality' should be 'inequality'.","section":"Lemma 3.2 title"},{"comment":"The entries of M2 are ambiguous: the row for w1 reads 'read all', which could be read as granting read access on every register, whereas the text explains that each w_j can read C_j and B. The figure should be made consistent with the prose.","section":"Figure 4"},{"comment":"In the proof, Obs(w1,t2) is written as an ordered list 'B(t2), C_j(t2), L[w1](t2)', but Obs is defined in Theorem 3.1 as a set determined by the read entries of the access matrix at time t2. The notation should be aligned with that definition, and the dependences on j should be made explicit (if only C1 is readable at t2, then Obs should mention C1, not an unspecified C_j).","section":"§3.3, Theorem 3.3 proof"},{"comment":"The space complexity expression contains a typo: the summand should be (N_q choose j), not (N_q choose k), so that the sum counts all non-empty subsets of size at most k.","section":"Theorem 4.4"}],"recommendation":"major_revision","confidential_remarks":"The main proof error is localized and a repair seems plausible, so I recommend major revision rather than rejection. The authors should re-examine all scheduler constructions for authorization, ideally by explicitly listing every request in the history of Theorem 3.3 and checking it against the access matrix at the time it is issued. They should also consider whether the threat claim should be scoped more narrowly to the (LF) lifting, since the protective models in Section 4 work by rejecting (LF)."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I think the reader's take is about right: the paper has a genuinely novel idea and a load-bearing flaw in the main proof. The central scenario—showing that a classically secure access control system can be broken when quantum registers are added under a natural lifting—is exactly the kind of concrete question that deserves attention. What's new and valuable here is linking the Mermin inequality to an access control leak rather than to Bell-test cryptography, and the proposed models (subsystem control, group control, entanglement control) plus the flexibility hierarchy are a reasonable and useful extension of earlier work, particularly the subsystems idea from Ying, Feng, and Yu.\n\nThe problem is Theorem 3.3. The constructed execution schedules w1 to prepare an n-partite GHZ state over C_1,...,C_n at a point where the access matrix M1 gives w1 'all' only on C_1 and 'flip' on B, and nothing on C_2,...,C_n. The proof explicitly says this is done by swapping each C_j into w1's local memory, which requires requests (w1, C_j, all) for every j. Those requests are not authorized under M1, so the history is invalid by the paper's own Definition 2.5. This is an internal error, not a disagreement about quantum mechanics. I checked the appendix and the main text; the scheduler really does set M1 before the GHZ preparation, and M1 really is sparse. The stress-test note is correct.\n\nThis flaw is load-bearing. The entire motivation for the protective models in Section 4 is the existence of a concrete, proven breach under the straightforward lifting. If the proof is fixed—say, by moving the GHZ preparation into the M0 phase where w1 has 'all' on every C_j—the paper could regain its central claim. But as submitted, the theorem is unsupported. There is also the modeling assumption that local memories become quantum, which the paper acknowledges and then rejects in Section 4; that's a legitimate design choice, not an error.\n\nThe classical security proof (Theorem 3.1) looks real, and the flexibility results are carefully argued. So the paper is not sloppy overall—it's the one central proof that has the problem.\n\nWho gets value from this? Quantum computer security researchers, formal methods people, and anyone thinking about hybrid classical-quantum OS design. Even with the flaw, the paper is worth sending to a serious referee: the idea is important, the flaw is identifiable and plausibly repairable, and the models deserve scrutiny. My recommendation is to send it out, but with a note to the reviewers to focus on the validity of the constructed execution in Theorem 3.3.","headline":"The Mermin-based breach idea is genuinely interesting, but the central proof as written violates the paper's own access matrix, so the core theorem is not established.","tokens_in":41752,"tokens_out":1481,"would_cite":false,"duration_ms":18882,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P68","81P40"],"pacs":["03.67.-a","03.65.Ud"],"model":"deepseek-v4-flash","headline":"A classically secure access control system can leak a user's secret with certainty after a straightforward quantum upgrade.","keywords":["access control","quantum entanglement","Mermin inequality","security breach","quantum access control","subsystem control","group control","entanglement control"],"falsifier":"Run the execution constructed for Theorem 3.3 on a quantum simulator, following the stated scheduler and programs: $w_1$ prepares a GHZ state over the second qubits of $C_1,\\dots,C_n$, each $w_j$ applies the conditional phase, Hadamard, measures its qubit, and flips $B$ if the outcome is 1; the claim fails if the empirical frequency of $B(t_2) = A(t_1)$ does not converge to 1.","tokens_in":40737,"feed_emoji":"🔐","tokens_out":11037,"duration_ms":115019,"temperature":0.7,"pith_summary":"The paper asks whether a classically proven access control system remains secure when the system is upgraded with quantum registers while the policy is unchanged. It constructs an explicit system where the classical guarantee is a leakage bound of $2^{-(n-7)/2}$ bits, then shows that under a natural lifting of the right 'all' the secret leaks with certainty. The attack creates no new communication channel: a pre-agreed entangled strategy, exploiting violation of the Mermin inequality, makes a public register that the users can read equal the secret register. The paper then proposes and analyzes three families of quantum access control models, namely subsystem control, group control, and entanglement control, and proves each restores the classical security guarantee with different flexibility and efficiency costs.","feed_headline":"Quantum entanglement defeats a classically secure access system","feed_subtitle":"Users who never communicate recover the secret bit with certainty after a natural quantum upgrade.","key_machinery":"The central object is the lifting (LF): a request $(s,X,\\mathrm{all})$ means user $s$ may perform any quantum operation on the composite system of quantum register $X$ and user $s$'s local memory $L[s]$, which is now assumed quantum. This one interpretive choice is what allows users to create entanglement across registers without any change to the access matrix. The carrier of both proofs is the Mermin inequality: the classical security theorem is derived from the classical side of that inequality, and the quantum attack consists of the multi-party strategy that violates it. The protective models replace (LF) by explicit rights over non-empty subsets of quantum registers, group labels, or entanglement flags, so that multi-register operations and entanglement themselves become governed objects.","core_discovery":"The central discovery is Theorem 3.3: if registers $C_1,\\dots,C_n$ become quantum and the right 'all' is interpreted through the lifting (LF), where a request $(s,X,\\mathrm{all})$ authorizes any quantum operation on the composite of register $X$ and user $s$'s local quantum memory, then there exists an execution $(S,P)$ with mutual information $I(A(t_1); Obs(w_1,t_2)) = 1$ between the secret register and what user $w_1$ can observe. In this execution the users implement the quantum strategy for the Mermin game: $w_1$ prepares a GHZ state across the second qubits of the $C_j$ registers, each $w_j$ applies a conditional phase, a Hadamard, a measurement, and flips the public register $B$ if the outcome is 1. The parity of these flips matches the parity of the random string chosen by the trusted user $v$, so $B(t_2) = A(t_1)$ with certainty, whereas the classical system leaks at most $2^{-(n-7)/2}$ bits.","pith_inferences":["The single-bit certainty result is best read as a lower bound on damage: repeating the strategy on independent GHZ blocks or splitting a longer secret into bits should generalize the leak to more than one bit, although the paper does not prove that extension.","A system designer could sidestep this particular attack by keeping local memories classical, but that would prevent users from holding quantum data in scratch space; the paper's protective models suggest that security comes from making every multi-register quantum operation an explicit access-control decision.","The role of the Mermin inequality here suggests a testable design heuristic: before adding quantum registers to a classically secure policy, check whether any Bell- or Mermin-type correlation strategy can simulate the policy's authorization steps; classical correlation bounds may not survive the quantum upgrade."],"forward_implications":["If the paper is right, any classical-quantum hybrid that adopts the (LF) lifting of 'all' should be considered vulnerable to complete one-bit secret leakage, even when the access matrix is unchanged and the users cannot communicate directly.","The three proposed models, namely $k$-subsystem control, $k$-group control, and $k$-entanglement control, each preserve the classical leakage bound, so they provide concrete policy designs that block the demonstrated attack.","Larger $k$ in these models increases flexibility but raises storage cost; in particular, subsystem control with $k = |Obj_q|$ needs a matrix with exponentially many columns, while group control keeps the matrix linear in the number of quantum registers.","The flexibility comparisons show that SUBSYS, GRP, and ENT are not all comparable, so practical deployments will likely need hybrids, choosing different models for different object classes."],"supporting_citations":[{"why":"Supplies the Mermin inequality, the classical correlation bound used in Theorem 3.1 and the inequality the quantum attack violates.","marker":"[76]"},{"why":"Provides the multi-player Mermin game strategy that the attacking programs P_{w_j} implement in the proof of Theorem 3.3.","marker":"[12]"},{"why":"Defines the access matrix protection model that the paper's authorization rule and system S are built on.","marker":"[65]"},{"why":"Supplies the UCON usage-control framework whose components (subjects, objects, rights, attributes, rules) structure the system model.","marker":"[92]"},{"why":"Prior quantum access control via information-flow security; motivates treating quantum subsystems as objects and is extended by the subsystem-control model.","marker":"[121]"},{"why":"Supplies the probabilistic graphical model tools used in the full proof of the classical security bound in Theorem 3.1.","marker":"[94]"}],"fun_headline_variants":["Entanglement breaches classically secure access control","Quantum entanglement opens security hole in access control","Non-communicating users exploit entanglement to leak secrets","Access control falls to quantum entanglement","Entanglement enables zero-communication secret leak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The breach only occurs under the specific lifting (LF), where a user with right 'all' on a quantum register may perform any quantum operation on that register together with the user's own quantum local memory; if local memories remain classical or authorization is required for each multi-register operation, the attack cannot be run.","fun_headline_variants_meta":{"raw":{"variants":["Entanglement breaches classically secure access control","Quantum entanglement opens security hole in access control","Non-communicating users exploit entanglement to leak secrets","Access control falls to quantum entanglement","Entanglement enables zero-communication secret leak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000816,"raw_usage":{"total_tokens":3541,"prompt_tokens":876,"completion_tokens":2665,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":492,"completion_tokens_details":{"reasoning_tokens":2599}},"tokens_in":492,"tokens_out":2665,"duration_ms":24733,"temperature":1.0,"reasoning_tokens":2599,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T20:25:46.466439+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the execution constructed for Theorem 3.3 on a quantum simulator, following the stated scheduler and programs: $w_1$ prepares a GHZ state over the second qubits of $C_1,\\dots,C_n$, each $w_j$ applies the conditional phase, Hadamard, measures its qubit, and flips $B$ if the outcome is 1; the claim fails if the empirical frequency of $B(t_2) = A(t_1)$ does not converge to 1.","supporting_citations":[{"cited_title":"David Mermin","cited_arxiv_id":null,"evidence_quote":"Supplies the Mermin inequality, the classical correlation bound used in Theorem 3.1 and the inequality the quantum attack violates."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the access matrix protection model that the paper's authorization rule and system S are built on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the UCON usage-control framework whose components (subjects, objects, rights, attributes, rules) structure the system model."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior quantum access control via information-flow security; motivates treating quantum subsystems as objects and is extended by the subsystem-control model."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the probabilistic graphical model tools used in the full proof of the classical security bound in Theorem 3.1."}],"review_version":1}