Security Analysis of Ensemble-Based Quantum Token Protocol Under Advanced Attacks
Pith reviewed 2026-05-23 06:47 UTC · model grok-4.3
The pith
Ensemble-based quantum tokens stay secure against attacks that measure sub-ensembles or single qubits.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
We prove the security of the ensemble-based quantum token protocol under advanced attacks that assume measurements on sub-ensembles and individual qubits. Numerical simulations and experiments on the IBM Quantum Platforms verify resistance to these attacks for different types, and we demonstrate that the security of the quantum coin can be made high by increasing the number of tokens.
What carries the argument
Ensemble-based quantum token protocol in which a quantum coin is formed by combining multiple tokens drawn from identically prepared qubit ensembles but with different initializations.
If this is right
- Security of the quantum coin increases without bound as the number of constituent tokens grows.
- The protocol can be realized with any quantum system once the provided numerical tools are applied.
- Experimental data from real quantum hardware supports that the modeled attacks do not break the scheme.
- The combination of varied initializations across tokens prevents consistent state reconstruction.
Where Pith is reading between the lines
- Similar ensemble diversity might strengthen other quantum money constructions against partial measurement attacks.
- Practical devices could exploit the same noise and measurement limitations that the simulations already include.
- Extending the analysis to attacks that adaptively choose which sub-ensembles to measure would test the next layer of robustness.
Load-bearing premise
The modeled attacks that allow measurements on sub-ensembles or individual qubits represent the most sophisticated feasible copying attempts and the simulations plus IBM experiments capture real-world noise and measurement effects.
What would settle it
An IBM Quantum experiment or simulation in which an attacker extracts a usable copy of the full quantum coin after performing sub-ensemble or single-qubit measurements on all tokens.
Figures
read the original abstract
We present and characterize advanced attacks on an ensemble-based quantum token protocol that allows for implementing non-clonable quantum coins. Multiple differently initialized tokens of identically prepared qubit ensembles are combined to a quantum coin that can be issued by a bank. A sophisticated attempt to copy tokens can assume that measurements on sub-ensembles can be carried through and that even individual qubits can be measured. Even though such an advanced attack might be perceived as technically unfeasible, we prove the security of the protocol under these conditions. We performed numerical simulations and verified our results by experiments on the IBM Quantum Platforms for different types of advanced attacks. Finally, we demonstrate that the security of the quantum coin can be made high by increasing the number of tokens. This paper in conjunction with provided numerical simulation tools verified against experimental data from the IBM Quantum Platforms allows for securely implementing our ensemble-based quantum token protocol with arbitrary quantum systems.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript presents an ensemble-based quantum token protocol for non-clonable quantum coins and analyzes its security against advanced attacks involving measurements on sub-ensembles and individual qubits. It claims to prove security under these modeled conditions, supports the analysis via numerical simulations and experiments on IBM Quantum Platforms, and concludes that security improves by increasing the number of tokens.
Significance. If the security analysis holds for the modeled attacks and the experimental validation is robust, the work offers a practical route to quantum token implementation on near-term hardware, with explicit scaling of security via ensemble size and direct comparison to real-device noise.
major comments (1)
- [Attack modeling and security proof] Attack modeling and security proof sections: The analysis treats attacks as non-adaptive measurements on sub-ensembles or single qubits and claims a proof of security. No derivation or bound is provided showing invariance under adaptive strategies (conditional basis choice on prior outcomes) or coherent joint POVMs after qubit storage. This assumption is load-bearing for the central security claim, as the skeptic note correctly identifies that information gain could exceed the modeled case.
minor comments (2)
- [Abstract] The abstract states that 'provided numerical simulation tools' allow secure implementation, but the manuscript body contains no link, repository reference, or description of these tools.
- [Experimental results] Experimental figures comparing IBM runs to simulations would benefit from explicit indication of which attack type (sub-ensemble vs. individual qubit) each dataset corresponds to and inclusion of statistical error bars.
Simulated Author's Rebuttal
We thank the referee for the thorough review and constructive comments on our manuscript. Below we provide a point-by-point response to the major comment, offering clarification on the attack modeling while remaining faithful to the analysis presented in the paper.
read point-by-point responses
-
Referee: [Attack modeling and security proof] Attack modeling and security proof sections: The analysis treats attacks as non-adaptive measurements on sub-ensembles or single qubits and claims a proof of security. No derivation or bound is provided showing invariance under adaptive strategies (conditional basis choice on prior outcomes) or coherent joint POVMs after qubit storage. This assumption is load-bearing for the central security claim, as the skeptic note correctly identifies that information gain could exceed the modeled case.
Authors: We appreciate the referee drawing attention to this distinction. Our security analysis explicitly models the strongest attacks feasible under the protocol constraints: measurements performed on sub-ensembles or on individual qubits. Because the qubits in each token are identically prepared and independent, the maximum information extractable by an adversary is achieved by optimal individual measurements; any adaptive choice of basis conditioned on prior outcomes cannot increase the total information beyond this bound, as the marginal distributions remain identical. Similarly, the per-qubit information bound we derive upper-limits the advantage obtainable from any coherent joint POVM across stored qubits. This is corroborated by our numerical simulations, which test multiple measurement strategies (including those equivalent to adaptive selection) and show consistent security scaling with ensemble size. The proof in the manuscript therefore covers the worst-case information gain under the stated attack model. We are happy to add a clarifying paragraph in the security analysis section if the referee finds it helpful, but we maintain that no additional derivation is required for the central claim. revision: no
Circularity Check
Security analysis is self-contained with external verification
full rationale
The paper defines advanced attack models (sub-ensemble and individual-qubit measurements), performs numerical simulations of forgery probability under those models, and validates against independent IBM Quantum Platform experiments. No quoted equation or section reduces the security bound to a fitted parameter from the same dataset, a self-citation chain, or a redefinition of the protocol itself. The central claim (security under the stated attack class) is supported by explicit simulation and hardware runs rather than by construction from the protocol definition.
Axiom & Free-Parameter Ledger
Forward citations
Cited by 1 Pith paper
-
Ensemble-Based Quantum Token Protocol Benchmarked on IBM Quantum Processors
Ensemble quantum token protocol benchmarked on IBM processors achieves bank acceptance of forged tokens below 10^{-22} while accepting legitimate tokens above 0.999.
Reference graph
Works this paper leans on
-
[1]
Random Guess We begin with the simplest scenario: The forger does not perform any measurement and just guesses the angles θf, ϕf for preparing a forged token. We obtain for the average probability that the bank accepts this token as a function of θf, ϕf: pf0(θf, ϕf) = πZ 0 dθb πZ −π dϕb fθ(θb) fϕ(ϕb) × × nTX n=0 pt(N, n, P0b, P1b, θf, ϕf, θb, ϕb). (8) Not...
-
[2]
Using the information from the measurement the forger prepares a token with the angles θf, ϕf
One Measurement Now we consider the case where the forger performs one measurement on the bank’s token using the angles θf1 , ϕf1 and detects nf1 photons. Using the information from the measurement the forger prepares a token with the angles θf, ϕf. The average probability that the bank accepts this token is given by pf1 = N1X nf1=0 πZ 0 dθb πZ −π dϕb fθ(...
-
[3]
Using the measurement results, the forger generates a forged token
Two Measurements Now the forger divides the token into several parts and measures each part containing Nj qubits with individ- ual angles θfj , ϕfj and detects nfj photons. Using the measurement results, the forger generates a forged token. The average probability that the bank accepts a forged token prepared by the forger from two measurements is given b...
-
[4]
By now the extension pattern of equation Eq
Three Measurements Finally if the forger performs three measurements, the average probability for the bank accepting the forged to- ken is given by pf3 = N1X nf1=0 N2X nf2=0 N3X nf3=0 πZ 0 dθb πZ −π dϕb fθ(θb) fϕ(ϕb)× × pt(N1, nf1 , P0f, P1f, θf1 , ϕf1 , θb, ϕb)× × pt(N2, nf2 , P0f, P1f, θf2 , ϕf2 , θb, ϕb)× × pt(N3, nf3 , P0f, P1f, θf3 , ϕf3 , θb, ϕb)× ×...
-
[5]
Forger’s Measurement Process Since the bank chooses the angles θb, ϕb uniformly dis- tributed on the Bloch sphere, as described in Eq. 6, there are no preferred directions and the forger has the free choice of setting the measurement basis. Thus, the forger chooses the basis in such a way that the angles θf1 = 0, ϕf1 = 0 are used in the first measurement ...
-
[6]
Direct Inversion Tomography (DIT) The simplest method providing in principle the com- plete information of the bank state θb, ϕb is performing three measurements, one in each of the dimensions on the Bloch sphere using Nj = N/3 qubits. In detail, the forger measures nf1 photons using θf1 = 0, ϕf1 = 0, nf2 photons using θf2 = π 2 , ϕf2 = 0 and nf3 photons ...
-
[7]
Maximum Likelihood Method (ML) The above method has the disadvantage that the forger has to divide the quantum token into three parts and has to perform a measurement with different angles on each part. This may be technically unfeasible for some quan- tum systems like NV-centers, where the ensemble insep- arability is guaranteed by the diffraction limite...
-
[8]
Otherwise, a rearrangement yields af2 − cos(θf2) cos θ(ML) f sin(θf2) sin θ(ML) f = cos ϕ(ML) f . Since we have cos θ(ML) f = af1 and sin θ(ML) f = q 1 − cos θ(ML) f 2 = q 1 − a2 f1 , we obtain ϕ(ML±) f = ±arccos af2 − cos(θf2) af1 sin(θf2) q 1 − a2 f1 . (19) Again, one has to adapt the argument of the arccos func- tion so that it is located in th...
-
[9]
For this the ensemble should be split into sub-ensembles
Bayesian Method (Ba) If the forger performs multiple measurements on the token, the outcomes of previous measurements can be used to optimize subsequent measurement settings via the Bayesian update rule. For this the ensemble should be split into sub-ensembles. Before the j-th measure- ment, the knowledge of the forger is described by a prior probability ...
work page 2000
-
[10]
One Measurement Firstly, we consider the case that the forger performs one measurement on all of the N1 = N qubits of the quantum token using the measurement angles θf1, ϕf1 and detecting nf1 photons. Using this result, the forger has to determine the angles θf, ϕf of the forged token in 13 0 π/4 π/2 3π/4 π θb 0.0 0.2 0.4 0.6 Photon Counts n nT Optimal Me...
-
[11]
Thus, splitting the quantum token into two parts is a more robust at- tack scenario
Two Measurements Precisely determining both token angles with a single measurement is in general not possible. Thus, splitting the quantum token into two parts is a more robust at- tack scenario. The first part contains N1 ≥ 1 qubits and the second part N2 = N − N1 ≥ 1 qubits. Due to the freedom choice of the coordinate system, the forger again performs t...
work page 2000
-
[12]
Three Measurements Now the forger divides the quantum token into three parts. The first part contains N1 ≥ 1 qubits, the second part N2 ≥ 1 and the third part N3 = N − N1 − N2 qubits. Again, due to the freedom choice of the co- ordinate system, the forger performs the first measure- ment with θf1 = 0 and ϕf1 = 0, detecting nf1 photons. In the second measu...
-
[13]
The probability for the bank rejecting their own generated coins is less than a given limit εcb > 0
-
[14]
The probability for the bank to accept forged coins is less than a given limit εcf > 0. The usage of several quantum tokens within a coin allows the bank to generate coins that fulfill both conditions for any given limits εcb > 0 and εcf > 0, if the average acceptance probability of the bank generated tokens pb is bigger than the acceptance probability of...
work page 2094
-
[15]
This means, if M is large enough, there will always exist a well chosen nb
If we have pb > p f, then the right hand side tends to ∞ with M → ∞ . This means, if M is large enough, there will always exist a well chosen nb. We obtain further 0 ≤∆p √ M − 1√ M − d ⇔ 0 ≤M − d ∆p √ M − 1 ∆p + d2 4 ∆p2 − d2 4 ∆p2 | {z } =0 and finally ⇔ 4 ∆p + d2 4 ∆p2 ≤ √ M − d 2 ∆p 2 ⇔ p 4 ∆p + d2 2 ∆p ≤ √ M − d 2 ∆p . If we have √ M − d 2 ∆p < 0, the...
- [16]
-
[17]
Gavinsky, 2012 IEEE 27th Conference on Computa- tional Complexity , 42 (2011)
D. Gavinsky, 2012 IEEE 27th Conference on Computa- tional Complexity , 42 (2011)
work page 2012
- [18]
-
[19]
F. Pastawski, N. Y. Yao, L. Jiang, M. D. Lukin, and J. I. Cirac, Proceedings of the Na- tional Academy of Sciences 109, 16079 (2012), https://www.pnas.org/doi/pdf/10.1073/pnas.1203552109
-
[20]
M. Georgiou and I. Kerenidis, in 10th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2015) , Leibniz International Proceedings in Informatics (LIPIcs), Vol. 44, edited by S. Beigi and R. K¨ onig (Schloss Dagstuhl – Leibniz- Zentrum f¨ ur Informatik, Dagstuhl, Germany, 2015) pp. 92–110
work page 2015
-
[21]
S. R. Moulick and P. K. Panigrahi, Quantum Information Processing 15, 2475 (2016)
work page 2016
- [22]
- [23]
-
[24]
Kumar, Cryptography 3 (2019), 10.3390/cryptogra- phy3040026
N. Kumar, Cryptography 3 (2019), 10.3390/cryptogra- phy3040026
-
[25]
K. Horodecki and M. Stankiewicz, New Journal of Physics 22, 023007 (2020)
work page 2020
-
[26]
A. Kent, D. Lowndes, D. Pital´ ua-Garc´ ıa, and J. Rarity, npj Quantum Information 8, 28 (2022)
work page 2022
-
[27]
Verfahren zum Erstellen eines Quanten-Datentokens,
K. Singer, C. Popov, and B. Naydenov, “Verfahren zum Erstellen eines Quanten-Datentokens,” (2022)
work page 2022
-
[28]
Ensemble-Based Quantum Token Protocol Benchmarked on IBM Quantum Processors
L. Tsunaki, B. Bauerhenne, M. Xibraku, M. E. Garcia, K. Singer, and B. Naydenov, (2024), arXiv:2412.08530 [quant-ph]
work page internal anchor Pith review Pith/arXiv arXiv 2024
-
[29]
W. M. Itano, J. C. Bergquist, J. J. Bollinger, J. M. Gilli- gan, D. J. Heinzen, F. L. Moore, M. G. Raizen, and D. J. 20 IBMQ M ncT pMf0 p(opt) Mf1 p(opt) Mf2 p(fix) Mf3 1 1 0.03226 0.1409 0.3196 0.4832 9 9 3.784·10−14 2.189·10−8 3.479·10−5 0.001436 16 16 1.376·10−24 2.413·10−14 1.185·10−8 8.831·10−6 25 25 5.207·10−38 5.282·10−22 4.123·10−13 1.268·10−8 She...
work page 2081
- [30]
- [31]
-
[32]
T. Hannemann, D. Reiss, C. Balzer, W. Neuhauser, P. E. Toschek, and C. Wunderlich, Phys. Rev. A 65, 050303 (2002)
work page 2002
-
[33]
A. Kandala, K. X. Wei, S. Srinivasan, E. Magesan, S. Carnevale, G. Keefe, D. Klaus, O. Dial, and D. McKay, Phys. Rev. Lett. 127, 130501 (2021)
work page 2021
- [34]
-
[35]
J. R. Glick, T. P. Gujarati, A. D. Corcoles, Y. Kim, A. Kandala, J. M. Gambetta, and K. Temme, Nature 21 Variable Physical quantity θ polar angle on the Bloch sphere ϕ azimuthal angle on the Bloch sphere θb, ϕb angles which the bank prepares and measures the token θfj , ϕfj angles used by the attacker to measure the bank token in the j-th measurement θf, ...
work page 2024
-
[36]
A. Javadi-Abhari, M. Treinish, K. Krsulich, C. J. Wood, J. Lishman, J. Gacon, S. Martiel, P. D. Nation, L. S. Bishop, A. W. Cross, B. R. Johnson, and J. M. Gam- betta, (2024), arXiv:2405.08810 [quant-ph]
work page internal anchor Pith review Pith/arXiv arXiv 2024
-
[37]
L. Tsunaki, “Quantum token,” https://github.com/ lucas-tsunaki/quantum-token (2024)
work page 2024
-
[38]
B. Bauerhenne, “Diqtok forge,” https://github.com/ bauerhenne/diqtok-forge (2024)
work page 2024
- [39]
- [40]
-
[41]
I. I. Rabi, N. Ramsey, and J. Schwinger, Rev. Mod. Phys. 26, 167 (1954)
work page 1954
-
[42]
H. R. Schwarz and N. K¨ ockler,Numerische Mathematik , 8th ed. (Teubner, 2011)
work page 2011
- [43]
-
[44]
F. Jelezko, T. Gaebel, I. Popa, A. Gruber, and J. Wrachtrup, Phys. Rev. Lett. 92, 076401 (2004)
work page 2004
-
[45]
A. Handl and T. Kuhlenkasper, Einf¨ uhrung in die Statis- tik (Springer, 2018)
work page 2018
- [46]
-
[47]
W. Beatrez, O. Janes, A. Akkiraju, A. Pillai, A. Oddo, P. Reshetikhin, E. Druga, M. McAllister, M. Elo, B. Gilbert, D. Suter, and A. Ajoy, Phys. Rev. Lett. 127, 170603 (2021)
work page 2021
-
[48]
A. Schmidt, J. Bernardoff, K. Singer, J. P. Reithmaier, and C. Popov, Phys. Status Solidi A216, 1900233 (2019)
work page 2019
-
[49]
M. M. Delgado, L. Tsunaki, S. Michaelson, M. K. Kuntu- malla, J. P. Reithmaier, A. Hoffman, B. Naydenov, and C. Popov, Diam. Relat. Mater. , 112126 (2025)
work page 2025
-
[50]
L. Tsunaki, A. Singh, K. Volkova, S. Trofimov, T. Preg- nolato, T. Schr¨ oder, and B. Naydenov, (2024), arXiv:2407.09411 [quant-ph]
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.