{"id":"5d538834-44d4-450f-ac17-bd5ff9a5f462","arxiv_id":"2608.12659","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"A satellite twin-field QKD simulation with a topological data-analysis gate shows no rate advantage over the same gate without TDA, and the authors state the full composable-security proof remains incomplete.","lead":"This paper tests a new way to choose which time blocks of a satellite quantum key exchange should be kept, using the topology of public satellite telemetry instead of private key data. In a simulation from 2,000 to 5,000 km, the topological filter never extended the usable range, and the certified secret-key rate is zero because the security proof is unfinished.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The KMeans-derived public gate's conditional independence (Markov condition, §IV-D(a)) is asserted, not proven; without it, Eq. (17) does not bound a real protocol and the conditional candidate rates are unsecured.","rationale":"The reader's weakest-assumption analysis identifies the same load-bearing point: the Markov confidence condition in §IV-D(a) is asserted, not proven. My stress-test pass sharpens it by noting that the KMeans-derived threshold in §III-D is a global function of the full public transcript, so the acceptance event Omega_i is not obviously a per-round causal EAT flag. This makes the missing proof more specific: it is not enough to show that the oracle reads only public telemetry; one must show that the post-selected state satisfies the EAT hypotheses for every possible transcript, including the dependence induced by a global, data-dependent threshold. The concern is material because Eq. (17) is the framework's security ledger: if this condition fails, the conditional candidate rates are not bounds on any real protocol, and the headline comparison between TDA-off and TDA-on loses its cryptographic meaning. I nevertheless recommend keeping the reader's CONDITIONAL verdict rather than moving to REJECT. The paper is unusually candid: it repeatedly says the certified composable rate is zero and the full protocol-level security proof is incomplete, and Section VI-A lists 'Formal Verification of Oracle Models' as future work. The released code and artifacts are a real strength, and the negative TDA ablation may survive even if the ledger is reinterpreted as an engineering benchmark rather than a security bound. The concern therefore reinforces the conditional status of the paper's claims without overturning its stated, carefully scoped contributions. A focused audit of the Markov condition, as proposed in the concrete test, would settle whether the conditional rates can be promoted to protocol-meaningful quantities or whether they should remain purely illustrative simulator outputs.","tokens_in":13156,"tokens_out":10319,"duration_ms":123059,"concrete_test":"Using the released Zenodo artifact, add an audit hook to the Quantum Execution and Topological Control layers that exports, per block, the public score g_i, the acceptance bit Omega_i, the private basis choices X_i and Z_i, and the private phase-bit values. Re-run the 2,000-km configuration for at least 30 Monte Carlo repetitions and compute (a) the conditional mutual information I(Omega_i; X_i, Z_i | g_i) and (b) the maximum absolute difference in empirical distributions of X_i, Z_i between accepted and rejected blocks after stratifying on g_i. If either is nonzero beyond sampling noise, the Markov condition in §IV-D(a) is violated and Eq. (17) cannot certify the reported conditional rates. If both are zero, the empirical independence holds in the simulator, though a formal EAT proof would still be needed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's own limitation statement says the full protocol-level composable-security proof is incomplete and the certified rate is zero, so the positive 2,000-km rates are only as meaningful as the ledger that produced them. That ledger is Eq. (17), whose validity requires the Markov confidence condition stated in §IV-D(a): the public telemetry S_i and gating decision T_i must be conditionally independent of the private operations X_i, Z_i given the quantum state rho_i. The paper asserts this is enforced structurally because the Topological Control Layer uses only bright reference pulses and beacon tracking. But the implemented gate is not a fixed per-round map: §III-D defines Omega_i = I{g_i >= theta} with theta obtained by a blind two-cluster KMeans split over the full empirical sample {g_i}. The threshold therefore depends on the entire public transcript, including future blocks, and the conditional independence of Omega_i given rho_i is not a consequence of 'reference-only' inputs; it is a nontrivial statistical property that must be proven for the acceptance event and for the resulting post-selected state. Without such a proof, or a per-round causal EAT construction, Eq. (17) is not shown to bound a real protocol, and the positive candidate rates and the 'TDA reduces rate' comparison are unsecured. The released code may implement the stated gate faithfully, but that does not establish the EAT hypotheses. This is the single load-bearing concern: the most important number in the paper—the conditional candidate rate—rests on an unproven independence condition, and the paper's own disclaimers do not repair that gap; they merely label the output 'conditional'.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a modular simulation framework for inter-satellite twin-field QKD with a topological post-selection oracle. The constellation is modeled as a cellular sheaf; public beacon telemetry is processed through a Koopman EDMD estimator, a Hodge decomposition of witness phases, and a TDA persistence-landscape trust factor, and the acceptance event Omega is derived by blind KMeans thresholding of the public gate score. The framework couples this gating layer to a GEAT-based finite-key ledger with stochastic count sampling. Simulations at 2,000-5,000 km compare TDA-off and TDA-on configurations on identical channel realizations. The paper reports median conditional candidate rates at 2,000 km of 2.14e-6 (TDA off) and 5.87e-7 (TDA on) bit per emitted pulse, zero at 3,000-5,000 km, and that TDA is active in all 4,788 evaluated windows but does not extend the positive-candidate range. The abstract and Section V-C explicitly label these rates as conditional numerical candidates and state that the certified composable rate is zero throughout because the full protocol-level composable-security proof is incomplete.","tokens_in":13514,"tokens_out":7845,"duration_ms":80694,"significance":"If the framework is correct, its main value is an auditable, reproducible simulation benchmark and an honest negative ablation of TDA in a LEO ISL setting. The paper has real strengths: the codebase and JSON artifacts are released with provenance metadata; the ablation uses identical physical channel realizations for both arms; the finite-key ledger uses stochastic count sampling rather than asymptotic averages; and the authors are explicit that no certified composable rate is claimed. However, the cryptographic significance is currently limited by an unproven Markov condition that underlies Eq. (17). As submitted, the paper supports a software-engineering benchmark claim more securely than a protocol-security claim, and the TDA comparison is quantitatively fragile because it rests on three Monte Carlo repetitions per configuration.","major_comments":[{"comment":"The Markov confidence condition is asserted rather than proved. The implemented acceptance event is not a fixed per-round map: Omega_i in Eq. (16) is defined by thresholding the gate score g_i at a KMeans-derived threshold theta that is fit on the full empirical sample {g_i}, so Omega_i depends on the entire public transcript, including future blocks. The observation that the inputs are reference-only does not imply the required conditional independence of Omega_i from the private operations X_i, Z_i given the quantum state rho_i; this is a nontrivial statistical property that must be proven for the acceptance event and the post-selected state. Without such a proof, or a causal per-round EAT construction, Eq. (17) is not shown to bound a real protocol, and the positive 2,000-km conditional candidate rates are not established as GEAT finite-key rates. I note that the manuscript itself states that the full composable proof is incomplete; the point here is that the exported conditional rates still inherit this gap.","section":"§III-D and §IV-D(a), Eq. (17)"},{"comment":"The central quantitative claim—that enabling TDA lowers the 2,000-km median candidate rate by 72.6% and reduces the accepted fraction from 64.36% to 52.22%—rests on only three Monte Carlo repetitions per distance. The q10–q90 whiskers shown in Figs. 4 and 5 are not stable quantile estimates from three samples, and the quantum layer uses explicit binomial count sampling, so the observed difference could be sampling noise. The manuscript should either provide more repetitions with proper confidence intervals, or explicitly downgrade the quantitative comparison to an illustrative observation from a small number of seeds.","section":"§V-A, §V-C, Figs. 4–5"},{"comment":"The paper frames the topological oracle as 'structurally preventing' key leakage and 'preserving the secret key rate', while simultaneously exporting CONDITIONAL_PROTOCOL_PROOF_INCOMPLETE and reporting a certified composable rate of zero. This tension should be resolved. Either prove (or give a precise reduction establishing) that the KMeans gate satisfies the GEAT hypotheses, or re-scope the contribution as a simulation framework with unproven candidate rates and remove the security-preservation language from the abstract and introduction. As written, a reader could take away a security guarantee that the paper explicitly disclaims.","section":"Abstract, §I, §V-C"}],"minor_comments":[{"comment":"The sentence that E_cyc 'can be used to define GEAT side-information states (Sec. IV)' promises a formal object that Section IV never defines; either add the mapping to the Security Ledger Layer or remove the promise.","section":"§III-C"},{"comment":"With 2e4 blocks and TDA window and stride both equal to 50 blocks, each run has approximately 400 windows and the four distances times three repetitions give approximately 4,800 windows, but the paper reports 4,788 evaluated windows; the discrepancy is not explained.","section":"§V-A and Fig. 3"},{"comment":"KMeans cluster labels are arbitrary, and the text says the gate 'accepts the high-score cluster' without stating how the high-score label is identified deterministically; specify the implementation rule, such as comparing cluster centroids and selecting the larger mean.","section":"§III-D, Eq. (16)"},{"comment":"The notation T_i is introduced for the derived gating decision but is never formally distinguished from Omega_i; align the notation so that Eq. (17) and the Markov condition refer to the same object.","section":"§IV-D(a)"},{"comment":"The symbols n, p_obs,i, Delta_GEAT, leak_EC, and epsilon are used without a single consolidated definition; please define all of them in one place near the ledger equation.","section":"Eq. (17)"}],"recommendation":"major_revision","confidential_remarks":"The paper is honest, open, and reproducible, and the negative TDA ablation is a useful benchmark. My main hesitation is scope: as a quant-ph security contribution, the unproven Markov condition is load-bearing; as a simulation-framework contribution, the security-framing language should be toned down and the Monte Carlo evidence strengthened. I recommend major revision rather than rejection because the issues are addressable within the manuscript's stated scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What you should know: the headline is a negative result and the authors are upfront about it. They simulate TF-QKD over inter-satellite links with a public-only topological gate, find that adding TDA cuts the 2,000-km conditional candidate rate from 2.14e-6 to 5.87e-7 bit/pulse and doesn't extend the positive range (both arms die at 3,000 km and beyond), and state repeatedly that the certified composable rate is zero everywhere. That honesty is the best thing about the paper.\n\nWhat's new: the integration of cellular sheaves, Hodge decomposition, persistence landscapes, and a Koopman filter as a public post-selection oracle, wrapped in an open-source simulator with a GEAT ledger and exported JSON/provenance. The mathematical pieces are standard, but the combination is new and the artifact is genuinely auditable. The negative ablation is useful: it cautions against assuming TDA gating is beneficial.\n\nThe soft spot is load-bearing. Section IV-D(a) asserts a Markov condition—public telemetry and gating decision conditionally independent of private operations given the quantum state—but does not prove it. Worse, the implemented gate is not a per-round causal map. Section III-D defines Omega_i = I{g_i >= theta} where theta comes from a KMeans split over the full empirical sample, so Omega_i depends on the whole transcript, future blocks included. That makes the conditional-independence claim non-obvious, and the paper does not close it. The authors do flag the incomplete composable proof, but flagging a gap is not closing it; without that condition, Eq. (17) does not bound a real protocol. Also minor but real: the numeric comparison rests on three Monte Carlo repetitions, and there is no conventional adaptive post-selection baseline, so the claimed contrast with traditional heuristics isn't directly tested.\n\nCredit where due: the TDA ablation uses identical channel realizations, the code and data are released, and the limitation statements are explicit. The central negative finding—TDA doesn't extend the positive range—doesn't depend on the Markov condition; it's a simulation observation. The positive rate values do depend on it, and those are correctly labeled conditional.\n\nWho this is for: people building satellite QKD simulators and anyone evaluating TDA as a gating heuristic. It deserves a serious referee because it's a reproducible, honest study with a novel integration. My recommendation: send to peer review, but require the authors to either prove the conditional independence for the actual KMeans gate or drop the security-language and present the framework as a simulation tool with candidate rates.","headline":"An honest, reproducible negative-result study: TDA gating doesn't help in their simulated ISL scenario, the authors say so clearly, and the unproven Markov condition keeps the positive candidate rates from being security claims.","tokens_in":14069,"tokens_out":2015,"would_cite":false,"duration_ms":21810,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A public, topology-based post-selection gate for satellite twin-field QKD is simulated, but no certified composable key rate emerges.","keywords":["Twin-Field QKD","Inter-Satellite Links","Cellular Sheaves","Quantum Network Simulation","Finite-Key Security","Topological Data Analysis","Generalized Entropy Accumulation Theorem","Post-selection"],"falsifier":"Run the published simulator's exported transcripts and test whether the acceptance event is statistically independent of the simulated private basis choices and phase-error events after conditioning on the public channel state; for example, estimate P(accept | basis = Z, state) and P(accept | basis = X, state) from the JSON exports. A significant difference in any window would falsify the Markov confidence condition and void the positive candidate rates.","tokens_in":12916,"feed_emoji":"🛰️","tokens_out":9110,"duration_ms":73800,"temperature":0.7,"pith_summary":"This paper claims that topological post-selection can be made compatible with strict finite-key security accounting for Twin-Field QKD between satellites. It models the satellite constellation as a cellular sheaf and derives a public acceptance event from beacon telemetry alone, so the decision to keep a block never touches private key-basis data. The authors build a modular simulator with stochastic noise injection and an explicit Generalized Entropy Accumulation Theorem (GEAT) ledger to test the idea. In their 2,000–5,000 km orbital scenario, the simulator returns positive conditional candidate rates only at 2,000 km, and the topological gate is active in all windows yet never extends the positive range. Because the protocol-level composable-security proof is incomplete, the certified composable rate is zero at every evaluated distance.","feed_headline":"Satellite QKD topology gate yields no certified key rate","feed_subtitle":"Topological post-selection passes simulation checks, but rates stay conditional without a composable proof.","key_machinery":"The load-bearing object is the public gate score $g_i = t_{\\phi,i}\\,t_{\\mathrm{sheaf},i}\\,t_{\\mathrm{TDA},i}$: a phase-consistency factor from a Koopman-EDMD public estimator, a sheaf-consensus factor from the Hodge-decomposed cycle and gradient obstruction energies on the diamond witness sub-complex, and a persistence-landscape trust factor computed from Alpha-complex persistent homology of the IQR-scaled telemetry point cloud. A blind two-cluster KMeans split on the empirical scores turns $g_i$ into the acceptance event $\\Omega_i$, and the Security Ledger Layer feeds only the surviving blocks through the GEAT inequality with finite-size confidence intervals and an LP solver. The mechanism's job is to make post-selection a public, auditable transcript so that the ledger's Markov condition can be asserted structurally rather than heuristically.","core_discovery":"The central claim is that the constellation, treated as a cellular complex with a sheaf of local telemetry stalks, provides a public synchronization oracle: wrapped phase residuals between the direct link and witness paths, separated by a discrete Hodge decomposition into cycle and gradient energies, plus a persistence-landscape trust score over an IQR-normalized telemetry point cloud, fuse into a single gate score $g_i$ whose blind KMeans threshold defines the acceptance event $\\Omega$. Because only reference intensities and beacon phases enter $g_i$, the oracle is claimed to satisfy the Markov condition required by GEAT, allowing a numerical security ledger to bound key length without adaptive-leakage penalties. The simulation comparison, with all other components fixed, gives median conditional candidates of $2.14\\times10^{-6}$ and $5.87\\times10^{-7}$ bit per emitted pulse at 2,000 km with TDA off and on, and zero at 3,000–5,000 km; the exported status is CONDITIONAL_PROTOCOL_PROOF_INCOMPLETE, so no certified composable rate is claimed.","pith_inferences":["If the Markov condition were machine-verified, the same public-oracle architecture would transfer to other phase-sensitive protocols, such as measurement-device-independent QKD over dynamic free-space links, where adaptive post-selection is currently difficult to certify.","The negative TDA result suggests the persistence-landscape factor may need acceptance-matched calibration: a natural test is to re-run the ablation with $t_{\\mathrm{TDA}}$ normalized so that the accepted fraction is equal across arms and ask whether the conditional candidate rate improves.","The cliff from positive candidates at 2,000 km to zero at 3,000 km is tied to the fixed pulse budget $N=10^{13}$; increasing the budget or aperture diameter should move the cliff, which is directly testable with the released artifact.","One could audit the published transcripts for a statistical correlation between $\\Omega$ and simulated phase-error events after conditioning on public telemetry; finding none would be evidence for the independence claim, while finding any would void the candidate rates."],"forward_implications":["At 2,000 km the median conditional candidate is $2.14\\times10^{-6}$ bit per emitted pulse without TDA and $5.87\\times10^{-7}$ with TDA; both configurations fall to zero at 3,000, 4,000, and 5,000 km.","TDA is numerically active in all 4,788 evaluated coherence windows, yet it lowers the median candidate by 72.6% and reduces median acceptance from 64.36% to 52.22%, so it provides no range benefit in this configuration.","Because the exported status is CONDITIONAL_PROTOCOL_PROOF_INCOMPLETE, the certified composable secret key rate is zero at every evaluated distance even though numerical candidates are positive at 2,000 km.","The LP audit reports no infeasible-zero contribution in any sample, so the 3,000–5,000 km zeros reflect ledger arithmetic rather than solver masking.","The gating decision is separated from private key-basis clicks by construction, which is the property the GEAT Markov condition requires."],"supporting_citations":[{"why":"Supplies the repeaterless rate bound that TF-QKD is meant to beat, establishing the motivation.","marker":"[5]"},{"why":"Introduces twin-field QKD, the protocol whose phase sensitivity motivates the topological oracle.","marker":"[6]"},{"why":"Represents the conventional phase-post-selection heuristics that the paper argues are unsafe under GEAT.","marker":"[12]"},{"why":"Provides the GEAT security framework that the ledger applies in Eq. (17).","marker":"[13]"},{"why":"Establishes the generalised entropy accumulation theorem and the second-order penalties for non-IID blocks.","marker":"[14]"},{"why":"Supplies the spectral theory of cellular sheaves used to model the constellation.","marker":"[15]"},{"why":"Covers persistent homology and topological data analysis, the basis of the TDA pipeline.","marker":"[16]"},{"why":"Supplies the simplicial-complex library primitives used for Alpha complexes and persistent homology.","marker":"[26]"},{"why":"Defines persistence landscapes, the representation from which the TDA energy score is computed.","marker":"[27]"},{"why":"Provides finite-size entropy-accumulation analysis for prepare-and-measure and decoy-state QKD that the ledger extends.","marker":"[22]"}],"fun_headline_variants":["Topological QKD gate: no certified key rate","TDA fails to extend satellite QKD range","No composable key from topological post-selection","Satellite TF-QKD: zero certified rate despite TDA","Conditional rates only: topology gate no help"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire security accounting rests on the assumption that the public telemetry and the acceptance decision it produces are independent of the private key-basis choices once the channel state is fixed; the paper asserts this is guaranteed by construction but does not prove it for the KMeans-derived acceptance event.","fun_headline_variants_meta":{"raw":{"variants":["Topological QKD gate: no certified key rate","TDA fails to extend satellite QKD range","No composable key from topological post-selection","Satellite TF-QKD: zero certified rate despite TDA","Conditional rates only: topology gate no help"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000308,"raw_usage":{"total_tokens":1822,"prompt_tokens":1065,"completion_tokens":757,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":681,"completion_tokens_details":{"reasoning_tokens":682}},"tokens_in":681,"tokens_out":757,"duration_ms":6545,"temperature":1.0,"reasoning_tokens":682,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:03:48.583233+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the published simulator's exported transcripts and test whether the acceptance event is statistically independent of the simulated private basis choices and phase-error events after conditioning on the public channel state; for example, estimate P(accept | basis = Z, state) and P(accept | basis = X, state) from the JSON exports. A significant difference in any window would falsify the Markov confidence condition and void the positive candidate rates.","supporting_citations":[{"cited_title":"Fundamental limits of repeaterless quantum communications,","cited_arxiv_id":null,"evidence_quote":"Supplies the repeaterless rate bound that TF-QKD is meant to beat, establishing the motivation."},{"cited_title":"Overcoming the rate–distance limit of quantum key distribution without quantum repeaters,","cited_arxiv_id":null,"evidence_quote":"Introduces twin-field QKD, the protocol whose phase sensitivity motivates the topological oracle."},{"cited_title":"Toward a spectral theory of cellular sheaves,","cited_arxiv_id":null,"evidence_quote":"Supplies the spectral theory of cellular sheaves used to model the constellation."},{"cited_title":"The Gudhi library: Simplicial complexes and persistent homology,","cited_arxiv_id":null,"evidence_quote":"Supplies the simplicial-complex library primitives used for Alpha complexes and persistent homology."},{"cited_title":"Statistical topological data analysis using persistence landscapes,","cited_arxiv_id":null,"evidence_quote":"Defines persistence landscapes, the representation from which the TDA energy score is computed."}],"review_version":1}