Pith. sign in

REVIEW 5 minor 1 cited by

Quantum Key Distribution with Basis-Dependent Detection Probability

T0 review · 0 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves security of prepare-and-measure QKD when detection probability depends on the measurement basis, using a tunable beam splitter to estimate the phase error rate from observed statistics instead of assuming the worst case.

desk verdict The proof genuinely drops basis-independent detection by estimating mismatches in real time, and it holds at the level of its stated assumptions, but the security now rests on a TBS trust assumption that is acknowledged and unresolved. read the letter →

arxiv 2411.19874 v2 pith:GTIWSWYP submitted 2024-11-29 quant-ph

Federico Grasselli , Giovanni Chesi , Nathan Walk , Hermann Kampermann , Adam Widomski , Maciej Ogrodnik , Micha{l} Karpiński , Chiara Macchiavello
show 2 more authors
Dagmar Bru{ss} Nikolai Wyderka
This is my paper · ORCID
classification quant-ph MSC 81P94 PACS 03.67.Dd
keywords quantumkeydistributionbasis-dependentdetectionprobabilityphaseerrorratetunablebeamsplitterdecoy-statemethoddetectordecoytechniquecollectiveattackstime-binQKD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Quantum key distribution proofs usually assume that Bob's chance of detecting a given incoming state does not depend on which measurement basis he uses. The authors drop that assumption. They prove that a prepare-and-measure protocol with two measurement bases remains secure under collective attacks even when an adversary induces basis-dependent detection efficiencies, provided Bob adds a fast tunable beam splitter and uses its statistics to estimate the phase error rate in real time. The asymptotic key rate they derive is a lower bound on the standard secret-key rate for collective attacks, and their simulations show positive rates for honest time-bin setups that previous worst-case proofs would penalize. The point is that the protocol monitors whether an eavesdropper is actively exploiting the efficiency mismatch instead of assuming the worst case.

What carries the argument

The load-bearing object is the tunable beam splitter (TBS), a beam splitter whose transmittance $(\eta_i,\eta_l)$ can be switched inside and outside the key-detection window $Z$ within a single round. It turns the $Z$-basis detector's click POVM into the diagonal operator $Z_{\checkmark}=\sum_{\alpha\ge0}p_{\checkmark|\alpha}\Pi^\alpha_Z$ with $p_{\checkmark|\alpha}=1-(1-p_Z^d)\eta_\downarrow^\alpha$, so the seven TBS settings act as detector decoys that reveal how much of Bob's received state lies in the zero-, one-, and multi-photon sectors of $Z$. The proof reduces the phase error rate to the at-most-one-photon subspace, bounds the leftover weight $w_{>1}^Z$ via a linear system, and expresses the phase-error bound (42) in terms of observed gains and QBERs; an uncertainty relation with the compatibility coefficient $c=\max_{j,k}|\langle 1_{Z_j}|S^{-1}|1_{X_k}\rangle|^2$ then converts this into Eve's conditional entropy.

What would settle it

An experiment in which Eve can modulate the tunable beam splitter's transmittance as a function of the incoming optical mode would test the proof's boundary: if that control kept the apparent key rate positive while Eve could predict the key, the security claim would be false.

Watch

Extended reading notes

Core claim

This paper's central claim is that the usual assumption $Z_{\checkmark}=X_{\checkmark}$, that a click is equally likely in either measurement basis for every input state, can be dropped without losing security. For phase-randomized coherent states with three intensities and $d$-outcome bases satisfying the single-photon basis-independence condition (7), the authors construct a protocol in which Bob routes each received signal through a tunable beam splitter whose transmittance differs inside and outside the key-detection window. From the gains and error rates of the seven TBS settings, together with the decoy-state method, they upper-bound the phase error rate $\tilde e_{X,1}$ and prove that the key rate (17) is a lower bound on the asymptotic secret-key rate under collective attacks. The proof needs no a priori characterization of mode-dependent detection efficiencies; instead it estimates the weight of Eve's states outside the at-most-one-photon-in-$Z$ subspace and solves linear systems that isolate the TBS's effect on zero- and one-photon components. Simulations on a four-dimensional time-bin setup show positive key rates up to 30 dB loss for honest implementations, while an intercept-resend attack that steers clicks into one basis lowers the proved rate proportionately.

Load-bearing premise

The load-bearing premise is that the receiver's tunable beam splitter is outside the adversary's control and treats every optical mode the same way; if Eve could influence or mode-dependently alter its transmittance, the estimated phase-error bound could be biased.

Editorial extensions

If this is right

  • Real QKD devices with unequal nominal detector efficiencies or dark-count rates no longer need their efficiency mismatch fully characterized before a secure key can be certified.
  • In honest implementations the new proof returns key rates close to the standard decoy-BB84 rate; the gap seen in simulations is attributed to a non-tight bound on the multi-photon weight $w_{>1}^Z$ rather than to the protocol itself.
  • Against an intercept-resend attack that steers which basis clicks, the proved key rate tracks the true extractable key, while the BB84 rate can overestimate it by more than ten percentage points.
  • The protocol applies to any two-basis setup in which one basis is a time-of-arrival measurement and the TBS can be tuned along the measured degree of freedom, including time-bin and time-frequency QKD.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the same real-time-monitoring strategy could be adapted to other implementation flaws, such as basis-dependent source leakage, by inserting a fast switchable element and estimating the leakage parameter from the augmented statistics rather than bounding it a priori.
  • Inference: the paper's observation that the honest-implementation gap comes from the $w_{>1}^Z$ bound suggests a concrete test: increasing the number of decoy intensities should tighten the gap to decoy-BB84, which could be verified in simulation without new hardware.
  • Inference: because the proof does not restrict Bob's received states to a finite dimension, standard reductions to finite-dimensional symmetries are not available; a plausible path to coherent-attack security is an entropic uncertainty-relation argument, which the authors leave open.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

0 major / 5 minor

Summary. This paper presents an analytical security proof for prepare-and-measure QKD protocols that drops the usual assumption that the detection probability of a state is independent of the measurement basis. The receiver incorporates a high-speed tunable beam splitter (TBS) that is switched between seven settings per round, and the security proof combines the decoy-state method, an entropic uncertainty relation, and a detector-decoy technique to bound the phase error rate in terms of observed statistics. The asymptotic key rate is given in Eq. (17) and is shown to be a lower bound on the Devetak-Winter rate under collective attacks. Simulations on a four-dimensional time-bin QKD setup show that the protocol yields positive key rates for honest implementations and detects a tailored intercept-resend attack that induces a detection efficiency mismatch, whereas a standard BB84 key rate overestimates the secure key rate in that scenario. The proof is self-contained and the mathematical steps are detailed in the appendices.

Significance. If correct, this is a significant result for implementation security of QKD: it provides a provably secure protocol that is robust to detection efficiency mismatches, including adversary-induced mode-dependent mismatches, without requiring a prior worst-case characterization of the efficiency mismatch. The analytical derivation is detailed and the simulation study is informative, illustrating both the achievable positive key rates and the protocol's ability to reduce the key rate in proportion to an active attack. The main limitation is clearly stated: the security proof assumes that the TBS is mode-independent and cannot be influenced by the adversary; this is a reasonable trust assumption for Bob's apparatus and is identified as future work. The paper is a valuable contribution to the QKD security literature.

minor comments (5)
  1. [Sec. IIIB] The assumption that the TBS is mode-independent and adversary-uninfluenceable is crucial for the derivation of the detector-decoy equations, e.g., Eq. (C181) and the bound on w>1_Z in Eq. (B5). Since this is a load-bearing boundary of the central claim, it should be stated more prominently in the abstract and in Sec. VII, and the physical conditions under which it could be violated (e.g., a wavelength-dependent TBS in time-frequency QKD) should be discussed explicitly.
  2. [Sec. VI] The discussion correctly attributes the gap to the decoy-BB84 rate in Fig. 4 to the looseness of the bound on w>1_Z, Eq. (B5). It would be helpful to state this earlier, near Eq. (B5), and to comment on whether additional decoy intensities or a different estimator could tighten the bound and reduce the gap.
  3. [Sec. VA] The simulation sets the decoy intensities to µ2 = 2µ3 = 2·10^-6 and pµ1 = 1, which corresponds to an asymptotic regime. A brief comment on the experimental feasibility of these parameters, and on the finite-key behavior if these extremes are relaxed, would strengthen the practical relevance of the simulations.
  4. [Fig. 3] The colorbar/contour levels in Fig. 3 are not described in the caption; the reader cannot easily read off the tolerable loss values. Please add a short description of the color scale or use explicit contour labels.
  5. [General] The notation ~e_X,1 (phase error rate) and e_X,1 (bit error rate) is used throughout; please ensure that the tilde is not accidentally dropped in any formula, and that Appendix B is fully consistent with the main text definitions.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the key-rate bound follows from the Devetak-Winter rate using observed statistics and external theorems; the only self-citations are to the authors' experimental setup papers, which are not load-bearing for the security proof.

full rationale

The paper's central derivation is the bound on the asymptotic key rate (17) as a lower bound on the Devetak-Winter rate (21). Every input to this chain is either an observed quantity (gains G, QBERs Q, estimated yields Y, estimated phase-error bound) or an external theorem (Devetak-Winter [46], entropic uncertainty relations [48-51], the decoy-state method [37-39], the detector-decoy technique [28], and the Tomamichel-Leverrier measurement-map formalism [8]). The phase-error bound (42) is written entirely in terms of observed test-round yields and bit-error rates plus the detector-decoy bounds (B5)-(B8); no target quantity is inserted as an input. The yields are estimated from observed gains through the standard decoy-state linear system, so there is no fitted parameter that is then renamed as a prediction. The simulations in Sec. V are forward calculations from assumed channel parameters, not fits of the proof's outputs. The only self-citations are to the authors' own experimental setup papers [29,30], used to parametrize the simulated time-bin QKD scheme, and to [45] supporting the attack model; none of these carries the security proof, so they are not load-bearing. The TBS mode-independence assumption (Sec. IIIB) is a stated boundary of the proof's applicability and is explicitly listed as future work (Sec. VII); it limits the scope of the claim but does not make the derivation circular. The paper even honestly discloses that its w>1_Z bound is non-tight for honest implementations (Sec. VI), which is the opposite of concealing the source of the gap to the decoy-BB84 rate. No step in the derivation reduces, by construction or by self-citation, to its own input.

Assumptions & free parameters 5 free parameters · 10 assumptions · 1 invented entities

The security proof itself introduces no fitted free parameters and no invented physical entities. The listed free parameters are simulation and protocol inputs; the central theorem is a conditional statement given those protocol choices. The load-bearing assumptions are the standard QKD tools plus the trust placed in Bob's TBS and the partial characterization of the detectors.

free parameters (5)
  • Signal intensity µ1 = optimized over µ1 in simulations (e.g., Fig. 4)
    Protocol parameter; only constrained by µ1 > µ2+µ3. The security proof does not depend on its value.
  • Decoy intensities µ2, µ3 = 2e-6 and 1e-6 in simulations
    Chosen for simulations; proof requires µ2 > µ3 >= 0.
  • TBS transmittances η↑, η↓, η2 = 0.9, 0.1, 0.4 in simulations
    Protocol choices satisfying constraints (9)-(10); needed for the detector-decoy bounds.
  • Intrinsic QBERs qZ, qX = scanned 0-0.3; set to 0.02/0.05 in Figs. 4-5
    Channel-model inputs for simulations, not fitted to the proof.
  • Channel loss, detector efficiencies, dark counts = η=10^{-1/10} (1 dB), ηZ=0.9·10^{-1/10}, ηX=ηZ·10^{-1/10}, pZ_d=10^{-4}, pX_d=1.2e-4
    Physical setup parameters from experimental Refs [29,30]; used to generate simulation statistics.
assumptions (10)
  • standard math Devetak-Winter rate lower-bounds asymptotic secret key rate under collective attacks.
    Used in Eq. (21)/(C3) to start the security proof; standard result from quantum information.
  • standard math Entropic uncertainty relation with quantum side information H(Z|E)+H(X|B) >= log(1/c).
    Applies in Appendix C3b via Lemma 1, using Alice's fictitious measurements in the entanglement-based picture.
  • standard math Decoy-state method estimates single-photon yields and error rates from PRCS intensities µ1>µ2+µ3, µ2>µ3>=0.
    Used throughout Appendix D and in (17); standard decoy-state security.
  • standard math Detector decoy technique provides bounds on photon-number weights from different TBS transmittance settings.
    Used to bound w>1_Z in Appendix C4d; from Moroder et al. [28].
  • domain assumption The TBS cannot be influenced by the adversary and its transmittance settings are mode-independent.
    Stated in Sec. IIIB; needed so the TBS statistics reliably reflect the received state. If false, the estimates in the proof could be biased. The authors flag relaxing this as future work.
  • domain assumption Nominal (mode-independent) detector efficiencies ηZ, ηX and dark count probabilities pZ_d, pX_d are known.
    Sec. III; the proof factors out common loss and uses these values in POVM elements (C179),(C267).
  • domain assumption Alice's single-photon states in Z and X bases have identical average state S (Eq. (7)), enabling the entanglement-based picture.
    Sec. IIIA, Eq. (7); required for the uncertainty relation bound (C76)-(C87).
  • domain assumption Security is proven in the asymptotic limit under collective attacks only.
    Stated in abstract and Sec. IV; no coherent-attack or finite-key claim.
  • domain assumption TBS transmittance range satisfies η↑ > η↓/(1−η↓) and ηX/ηZ > (η↓)^{-1}(1−sqrt((1−η↓)/η↑)).
    Constraints (9)-(10) needed for positivity of detector-decoy bounds; argued achievable in Sec. IIIB.
  • domain assumption Bob maps multi-click detection events to a single outcome, never to no-detection.
    Sec. IIIB; used in POVM construction (C253)-(C257).
invented entities (1)
  • High-speed tunable beam splitter (TBS) in Bob's receiver independent evidence
    purpose: Generates additional detection statistics by switching transmittance within each round; used with detector decoys to estimate multi-photon weight and bound phase error rate.
    The TBS is a physical component realizable with dual-output Mach-Zehnder modulators [40,41]; not a new particle or force, so no new physics entity beyond the protocol design.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantum Key Distribution with Basis-Dependent Detection Probability." pith.science (2026). https://pith.science/paper/GTIWSWYP

@misc{pith2026241119874,
  author       = {Pith},
  title        = {Pith review of: Quantum Key Distribution with Basis-Dependent Detection Probability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GTIWSWYP}},
  note         = {Machine review of arXiv:2411.19874}
}
read the original abstract

Quantum Key Distribution (QKD) is a promising technology for secure communication. Nevertheless, QKD is still treated with caution in certain contexts due to potential gaps between theoretical models and actual QKD implementations. A common assumption in security proofs is that the detection probability at the receiver, for a given input state, is independent of the measurement basis, which might not always be verified and could lead to security loopholes. This paper presents a security proof for QKD protocols that does not rely on the above assumption and is thus applicable in scenarios with detection probability mismatches, even when induced by the adversary. We demonstrate, through simulations, that our proof can extract positive key rates for setups vulnerable to large detection probability mismatches. This is achieved by monitoring whether an adversary is actively exploiting such vulnerabilities, instead of considering the worst-case scenario as in previous proofs. Our work highlights the importance of accounting for basis-dependent detection probabilities and provides a concrete solution for improving the security of practical QKD systems.

Figures

Figures reproduced from arXiv: 2411.19874 by the authors.

Figure 1
Figure 1. FIG. 1. Bob’s measurement apparatus. The incoming sig [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. FIG. 2. Schematic representation of one measurement round. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. FIG. 3. Maximal tolerable channel loss for a positive key rate [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: FIG. 4. Comparison of the secret key rate from our proof [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: FIG. 5. Comparison of the secret key rate derived in this [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 5
Figure 5. Figure 5: As a matter of fact, the BB84 rate overestimates [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: FIG. 6. Bob’s measurement apparatus. In each round, the incoming signal (mode [PITH_FULL_IMAGE:figures/full_fig_p039_6.png]
Figure 7
Figure 7. Figure 7: FIG. 7. Bob’s simplified measurement apparatus. Here, the common loss of the two detectors in Fig. 6 – which amounts to [PITH_FULL_IMAGE:figures/full_fig_p040_7.png]
Figure 8
Figure 8. Figure 8: FIG. 8. The secret key rate in Eq. (17) in case of the honest implementation of Sec. V A, as a function of the detection efficiency [PITH_FULL_IMAGE:figures/full_fig_p087_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Security of quantum key distribution with source and detector imperfections through phase-error estimation

    quant-ph 2025-07 conditional novelty 6.0 of 10

    A modular proof technique extends phase-error-estimation security bounds from basis-independent to mismatched detector efficiencies, enabling finite-key QKD security with simultaneous source and detector imperfections.

Reference graph

Works this paper leans on

16 extracted references · 16 canonical work pages · cited by 1 Pith paper

  1. [1]

    III that Alice prepares WCPs with three different intensities:S = {µ1, µ2, µ3}, withµ1 > µ2+µ3 and µ2 > µ3 ≥ 0

    Standard equations of the decoy-state method We recall from Sec. III that Alice prepares WCPs with three different intensities:S = {µ1, µ2, µ3}, withµ1 > µ2+µ3 and µ2 > µ3 ≥ 0 . The parties use all three intensities both to generate the key and to derive the decoy bounds. The equalities on which the decoy-state method relies on, relate the unobserved yiel...

    work page

  2. [2]

    Bounds on yields and bit error rates We observe that the equations defining the decoy-state method, namely (D2), (D4), (D5), (D7), and (D8), share the same structure, which can be exemplified as follows: Gµj = ∞X n=0 e−µj µn j n! Yn, (D9) where Gµj can be replaced by a gain or a product of QBER and gain, whileYn can be replaced by a yield or a product of ...

    work page

  3. [5]

    Secret key rate In this subsection we complete the security proof of Protocol 1. We combine the upper bound obtained on the phase error rate (C436) with the entropy bound (C87) to derive the following bound on the entropy of interest: H(ZA|E)ρ|1,ΩZ ≥ log2 1 c − u(˜eX,1), (C438) where we used the fact thatu(x) in (20) is a monotonically non-decreasing func...

    work page

  4. [7]

    µn 3 n! Yn = f (1)Y1 + ∞X n=3 f (n)Yn, (D15) where we introduced: f (n) := (µ2 2 − µ2

    work page

  5. [8]

    µn 1 n! − (µ2 1 − µ2

    work page

  6. [9]

    µn 2 n! + (µ2 1 − µ2

    work page

  7. [10]

    µn 3 n! . (D16) Now we observe thatf (1) is negative: f (1) < 0 ⇔ (µ2 2 − µ2 3)µ1 − (µ2 1 − µ2 3)µ2 + (µ2 1 − µ2 2)µ3 < 0 ⇔ (µ2 2 − µ2 3)µ1 − (µ2 1 − µ2 2)µ2 − (µ2 2 − µ2 3)µ2 + (µ2 1 − µ2 2)µ3 < 0 ⇔ (µ2 2 − µ2 3)(µ1 − µ2) − (µ2 1 − µ2 2)(µ2 − µ3) < 0 ⇔ (µ2 − µ3)(µ1 − µ2) [µ2 + µ3 − µ1 − µ2] < 0, (D17) which is true sinceµ3 < µ2 < µ1. At the same time, we...

    work page

  8. [11]

    − µ2 3(µn−2 1 − µn−2 3 )(µ2 1 − µ2

    work page

Show all 16 references
  1. [12]

    µn−3 3 ) ≥ 0 ⇔ µ1 µ2 2(µn−3 1 + µn−4 1 µ2 + · · ·+ µn−3 2 ) − µ2 3(µn−3 1 + µn−4 1 µ3 +

    ≥ 0 ⇔ (µ1 − µ2)(µ1 − µ3) µ2 2(µ1 + µ3)(µn−3 1 + µn−4 1 µ2 + · · ·+ µn−3 2 ) − µ2 3(µ1 + µ2)(µn−3 1 + µn−4 1 µ3 + . . . µn−3 3 ) ≥ 0 ⇔ µ1 µ2 2(µn−3 1 + µn−4 1 µ2 + · · ·+ µn−3 2 ) − µ2 3(µn−3 1 + µn−4 1 µ3 + . . . µn−3 3 ) + µ2µ3 µ2(µn−3 1 + µn−4 1 µ2 + · · ·+ µn−3 2 ) − µ3(µn−...

  2. [13]

    (eµ1 − µ1) − (µ2 1 − µ2

  3. [14]

    (eµ2 − µ2) + (µ2 1 − µ2

  4. [15]

    (eµ3 − µ3) = −f (1) + (µ2 2 − µ2 3)eµ1 − (µ2 1 − µ2 3)eµ2 + (µ2 1 − µ2 2)eµ3 . (D20) D DECOY-STATE METHOD 2 Bounds on yields and bit error rates 75 By employing the last expression in (D19), we obtain the following upper bound on the one-photon yield: Y1 = 1 − (µ2 2 − µ2 3)eµ1...

  5. [16]

    In principle, in these expressions we could use the bounds already derived for the single yields

    Bounds on linear combinations of yields Some of the quantities appearing in the phase error rate bound (B1), namely (B5)–(B9), depend on linear combi- nations of one-photonZ-basis yields. In principle, in these expressions we could use the bounds already derived for the single...

  6. [17]

    3 and 4, in the absence of eavesdroppers, theZ-basis gain reads: GZ µj ,(ηl,ηl) = 1 − (1 − pZ d )e−µj ηηZ (1−ηl), (E1) where η is the transmittance of the quantum channel

    High-dimensional time-bin QKD According to the channel model employed for simulating the time-bin QKD protocol (Protocol 1) in Figs. 3 and 4, in the absence of eavesdroppers, theZ-basis gain reads: GZ µj ,(ηl,ηl) = 1 − (1 − pZ d )e−µj ηηZ (1−ηl), (E1) where η is the transmitta...

  7. [18]

    Attack-induced efficiency mismatch In order to study the attack presented in Sec VB, we assume that Alice can deterministically send one-photon pulses in each round. This allows us to simplify our proof by removing the decoy-state method, which is no longer needed since in thi...

  8. [19]

    (17), for varying asymmetries in the mode-independent detection efficiency of the two bases, i.e., as a function ofηr = ηX /ηZ

    Secret key rate vs (mode-independent) detection efficiency mismatch In this section, we study the performance of the key rate from our proof, Eq. (17), for varying asymmetries in the mode-independent detection efficiency of the two bases, i.e., as a function ofηr = ηX /ηZ. Thi...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.