Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift Marcel Mordarski† ,1, ∗ Benjamin Gras,2, † Abdelrahman Shehata† ,2 Daniel Budina† ,2 and Roberto Bondesan1

arXiv:2610.01792v1 [quant-ph] 1 Oct 2026

1

Department of Computing, Imperial College London, London SW7 2AZ, United Kingdom 2 Department of Electrical and Electronic Engineering, Imperial College London, London SW7 2AZ, United Kingdom

Quantum key distribution (QKD) links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel’s own noise gains by following that drift has not been quantified. Adaptive eavesdropping is posed here as a constrained Markov decision process in which the attacker selects one circuit per round while the noise level follows an Ornstein–Uhlenbeck process and the abort condition is a budget over each block of rounds. The value of adaptation is bounded by the best fixed circuit and a dynamic-programming upper bound. The actions are learnt attacks. Whereas Decker et al. trained a parametrised circuit on a fixed gate template against a fixed channel, here the gate structure and rotation angles are searched jointly. This yields circuits compact enough to form a discrete action set, extending the construction to noise models lacking a known template, including the amplitude damping channel. On device-independent E91 under bilateral depolarising noise, a reinforcement-learning attacker raises her Holevo information from 0.135 for the best fixed circuit to 0.348 at zero detection, 98% of the upper bound. On BB84 under a drifting bit-flip channel, she exceeds a conservative noise-indexed rule by 0.024 in fidelity, reaching 99% of the upper bound. Under stationary noise, the attacker’s gain from basis asymmetry changes sign between an averaged and a per-basis error-rate constraint. The search, started from random gate sequences, recovers the analytical cloners and the collective-attack key rate, and meets the lower bound of the Winick–Lütkenhaus–Coles objective from above.

I. A.

INTRODUCTION Problem construction

Quantum key distribution (QKD) [1, 2] now secures metropolitan links between bank data centres and government sites, and commercial hardware is sold against published security certificates [3]. In every such deployment, the legitimate parties, Alice and Bob, estimate the disturbance of the transmitted states on a sample of their rounds, and a security proof converts that estimate into a bound on the information an eavesdropper, Eve, can hold about the key [4, 5]. The user sets an abort threshold on the estimated disturbance and a finite-key buffer so that the bound remains satisfied, and recalibrates the source and detectors at an interval intended to keep the devices within their characterised specification [5, 6]. The analyses underlying these settings treat the channel as stationary between calibrations. A devicedependent proof such as that of BB84 requires the source and detectors to remain within calibrated bounds (e.g., efficiency matching of the detectors and the fidelity of state preparation) [6, 7], whereas the statistics on which a finite-key analysis rests are gathered over a window during which the equipment drifts [8]. Deployments accommodate the drift by recalibrating on a fixed schedule and carrying a margin wide enough to cover the interval,

∗ marcel.mordarski25@imperial.ac.uk † These authors contributed equally to this work.

and the width of that margin is set from device characterisation, not from an analysis of what an attacker could gain from the drift [6, 8]. The numerical methods that certify key rates answer a static question. Given one observed behaviour, the relative-entropy method of Winick, Lütkenhaus and Coles [9] and the semidefinite hierarchy of Navascués, Pironio and Acín [10, 11] bound how much Eve can know. A drifting channel poses a sequential question in addition, since an eavesdropper who reads the public record may change her strategy from round to round, must commit to each round’s strategy before that round’s statistic is announced, and seeks the largest expected information over the trajectories of the channel subject to a constraint in every round. A relaxation evaluated at one frozen behaviour describes no such policy, and the value that adaptation confers on an attacker confined to the physical noise process has, to the authors’ knowledge, not been quantified. The margin carried across a recalibration interval therefore rests on an untested assumption about the attacker, which leaves the user unable to tell whether a link is over-provisioned, at a loss of secret-key rate, or exposed to a leak that a stationary trusted-noise analysis does not count. The question concerns the operating margin and leaves the validity of security proofs intact. A proof that attributes the entire observed disturbance to Eve bounds her information from the statistics actually recorded, and entropy-accumulation arguments extend such bounds to strategies that adapt from round to round [4], so that under this convention no leak goes uncounted, whether or not the channel drifts. What drift alters is the dis-

2 tance between that bound and the information available to an attacker who cannot alter the channel’s own noise, which is the attacker assumed whenever part of the observed noise is characterised and treated as trusted [12]. That distance determines how conservative the provisioned margin is. While sectors such as banking, government, and civil telecommunications increasingly seek to deploy QKD, these ambitions are stalled by the prohibitive costs of maintaining continuous secure links. Without effective optimisation approaches to rigorously bound an adaptive eavesdropper, network operators must rely on worst-case static assumptions. This forces them to provision excessively conservative margins, resulting in frequent network downtime for unnecessary recalibrations, artificially depressed secret-key rates, and severe underutilisation of expensive hardware. Resolving this ambiguity is therefore a practical necessity: translating dynamic threats into measurable, optimisable quantities allows operators to safely extend recalibration intervals and maximise throughput, thereby clearing one of the primary economic barriers to the commercial adoption of quantumsecure infrastructure. B.

Prior work

Decker et al. [13] observed that an attack on BB84 is itself a parametrised quantum circuit and can therefore be learnt. In their formulation, the eavesdropper applies a unitary U (Θ) to the travelling qubit together with an ancilla she retains, and a second unitary V (Λ) after the public basis announcement, both drawn from a hardwareefficient template of rotations and cnots. Gradient descent on 2

L(Θ, Λ) = α(FAB − f ) − FAE

(1)

pins Bob’s fidelity FAB to a target f through the first term while maximising the eavesdropper’s fidelity FAE through the second. Three of their results serve as the starting point here. Firstly, the learner recovers the analytical cloner on an ideal channel. Secondly, under a bitflip channel, an imbalanced cloner carrying two free parameters exceeds it by giving up fidelity in the damaged basis to preserve fidelity in the untouched one. Thirdly, when the parity information leaked by Cascade reconciliation [14] is treated as available to the attacker, a joint measurement raises her recovery probability from 0.810 to the Helstrom value 0.894 [15] at the 11% error bound. Section S1 of the Supplemental Material reviews the construction in the notation used here. For a stationary Pauli channel, whose noise applies each Pauli operator with a fixed probability, the eavesdropper’s side is well charted. The optimal individual attack on the noiseless channel is the phase-covariant cloner [16, 17], Cerf’s Pauli cloning machines supply the asymmetric family natural to Pauli noise [18], the underlying cloners admit explicit circuit realisations [19, 20],

and a result from the group of Ref. [13] gives explicit constructions on a fixed Niu–Griffiths circuit for asymmetric cloners tailored to Pauli noise, the biased cloner among them [21]. On the key-rate side, the Shor–Preskill rate 1 − h(QZ ) − h(QX ), in which QZ and QX are the error rates observed in the key basis and in the complementary basis and h is the binary entropy, governs independent bit and phase errors [22], and for a family of imperfect BB84 sources an explicit attack attains the corresponding collective-attack bound with equality [23]. Upper bounds on device-dependent rates follow from entropies of two-qubit states [24, 25], including for imperfect detectors [26]. In the device-independent setting, the Acín– Brunner–Gisin–Massar–Pironio–Scarani envelope [27] is saturated by an explicit attack [28, 29], and convexcombination attacks place constructive upper bounds on device-independent rates at arbitrary visibility and detection efficiency [30, 31]. The search introduced below recovers these results where they apply, and the recovery serves here as validation (Sec. S3). Learning has also been applied to eavesdropping directly: variational quantum cloning casts the attack as a trained circuit [32], the formulation of Ref. [13] is the point of departure here, and a recent study trains a tabular agent to modulate a fixed intercept-resend attack against the broadcast error rate [33]. The latter shares the present premise that an eavesdropper reading the public record is a sequential learner, but its actions are one physical attack at a chosen rate rather than a library of constructed circuits, and its channel is stationary rather than drifting (as elaborated in Sec. S11). The present work uses the learnt formulation of Ref. [13] as a tool for a different question, and two of its restrictions must be lifted for that purpose. The circuit template is fixed in advance, so that only angles are explored within a topology chosen for tractability, and the channel is held at one stationary noise level, so that no statement about a drifting device follows. For Pauli noise, the first restriction is benign, because a fixed template already reaches the optimum [21], and a searched topology is justified where no template is known (e.g., amplitude damping) as in Sec. III C. The second restriction excludes the drifting channel of Sec. I A, for which neither the learnt nor the analytical treatment returns a strategy, since each evaluates one fixed observed behaviour.

C.

Methodology

The learnt formulation is extended under two noise conventions. The channel sweeps and the drift experiments treat the noise as trusted, meaning that the eavesdropper is assigned a physical noise process she cannot alter, together with an ancilla of bounded size, and the quantity of interest is what she extracts under those constraints. The key-rate comparisons of Secs. S3 and S5 adopt the standard untrusted convention, which attributes

3 the entire observed disturbance to the eavesdropper [3]. The first convention measures what a physically restricted attacker achieves on a degrading link, and hence how conservative a provisioned margin is, whereas the second measures what a formal security proof must bound. Results under the trusted convention are therefore statements about the margin and never about the soundness of a proof. Every value reported under either convention is a constructive lower bound on her power, since an explicit circuit exhibits it, and through the Devetak–Winter relation [34] each collective attack yields an upper bound on the key rate. The first departure from the learnt formulation abandons the fixed template. A template selected for tractability under one noise model presupposes the form of the attack, since the extremal circuit under another model is not obliged to share its gate structure. The topology is therefore treated as an unknown on the same footing as the angles, giving min f (T, θ), T, θ

(2)

where T is a gate sequence over {RX , RY , RZ , cnot} subject to no symmetry, depth or structural constraint, θ collects its angles, and f is the negative of the eavesdropper’s information measure. The publicly monitored statistic enters as a strict feasibility constraint, so that a circuit exceeding the abort threshold is excluded outright and can never outrank a feasible one. A soft penalty would allow a larger leak to be reported at a detection probability the defender does not tolerate, and such a leak could not be sustained against a user who aborts. Equation (2) is solved by nesting two loops. An evolutionary outer loop proposes gate sequences through moves that add, remove or replace one gate [35, 36], and for each candidate an inner loop tunes the angles by a gradient-free optimiser at a fixed evaluation budget, covariance-matrix adaptation [37, 38] for the BB84 sweeps and simultaneous-perturbation stochastic approximation [39] for the E91 library. The two are interchangeable at fixed budget (Sec. S2), so the choice affects neither the returned circuits nor the reported values; the gate alphabet and the fitness are what change between the protocols, and Sec. S2 gives the architecture, hyperparameters and cost. The procedure returns a circuit that achieves a stated leak at a stated disturbance, which is a weaker guarantee than a proof of optimality but is available where no proof is. The second departure replaces the stationary channel by a drifting one. The noise parameter follows an Ornstein–Uhlenbeck process, a mean-reverting Gaussian process [40], and the legitimate parties abort when the monitored statistic, averaged over a block of rounds, crosses its threshold. Because the returned circuits are small, of four to nine gates, a library of them forms a discrete action set, and adaptive eavesdropping becomes a constrained Markov decision process, a sequential decision problem in which every action yields a reward and the actions of a block share one constraint

(Sec. IV A). Solving it with a value-based reinforcementlearning agent [41] measures the information that adaptation yields to the attacker, and comparing the result with the best fixed circuit and with a dynamic-programming upper bound bounds that value from both sides (Proposition 1). This sequential formulation is the principal departure from Ref. [13] and from the static analyses of Sec. I B, which evaluate one channel at a time and return no policy.

D.

Contributions

The contributions are five. Firstly, the attainable information of an attacker confined to a stationary noisy channel is mapped across channel families at a fixed abort threshold, together with its separation from the noiseless cloning figure a user would quote (Sec. III A). Secondly, the sign of the attacker’s gain from basis asymmetry is shown to depend on the monitoring convention, positive under an error-rate constraint averaged over the two bases and negative once each basis is constrained separately (Sec. III B), and the search is applied without modification to amplitude damping, for which the Pauli-channel cloning solutions do not apply (Sec. III C). Thirdly, the bilateral structure of the channel in the entanglement-based protocol is derived, which fixes a noise level beyond which even an undisturbed link yields no key (Sec. III D). Fourthly, adaptive eavesdropping under drift is posed as a constrained Markov decision process over libraries of learnt circuits and solved for BB84 and for device-independent E91, with the value of adaptation bounded between fixed play and a dynamic-programming upper bound; on E91 adaptation multiplies the attacker’s information by about 2.6 at unchanged detection (Secs. IV A–IV E). Fifthly, the role of tolerated detection is examined, and on both protocols the upper bound is shown to be reachable without it (Sec. IV F). The validation of the search against known closed forms and against a reliable numerical lower bound is collected in Sec. S3. The central quantity is the additional information an attacker obtains by adapting to the drift when she cannot alter the channel’s own noise. The choice of a recalibration interval depends on it, and to the authors’ knowledge no construction for it was previously available. The measurement requires no closed form for the channel, so the same apparatus applies to noise models and drift processes beyond those treated here.

II.

PROTOCOLS, CHANNELS AND FIGURES OF MERIT

In the BB84 protocol, Alice prepares one of the four states |0⟩, |1⟩, |+⟩, and |−⟩ with equal probability. The eavesdropper applies a unitary transformation, UE , to the travelling qubit together with an ancilla of na qubits

4 ⊗n

initialised in |0⟩ a (where na = 2 unless stated otherwise). Crucially, this interaction occurs before the signal passes through the noisy channel, meaning Eve interacts with the undegraded signal. Because the channel acts only after her interaction, her reduced state remains untouched. Consequently, Eve’s figure of merit depends solely on her attack circuit, whereas Bob’s depends on both the circuit and the channel. Bob’s fidelity FAB is the mean over the four states of his probability of recovering Alice’s bit when he measures in the matched basis. The eavesdropper’s fidelity FAE is the mean over the two bases of the Helstrom success probability (0)

(1)

PH = 21 + 14 ρE − ρE

,

(3)

1

which is the largest probability with which she can dis(0) criminate her two conditional memory states ρE and (1) ρE at equal priors once the basis is announced [15]. The abort threshold is FAB ⩾ 0.87 throughout. It corresponds to a basis-averaged error rate of 13%, beyond the 11% at which the symmetric Shor–Preskill rate vanishes [22], and beyond the 12.4% reached with noisy preprocessing [25]. Therefore, it is not an operational threshold for one-way post-processing under the untrusted convention, although two-way post-processing tolerates up to 18.9–20% [42, 43]. It is chosen to leave room for the channel error swept in Sec. III, since under the trusted convention the attacker’s reach is set by the interval between the honest fidelity and the threshold, and the search is validated at three further thresholds in Sec. S3. Two classes of attack appear in what follows. Because FAE is the success probability of a measurement performed on a single ancilla, results reported in FAE concern individual attacks, for which the closed form of Refs. [16, 18] is optimal. The Holevo quantity χ(A:E) bounds the information obtainable by a joint measurement over many stored ancillas, so results reported in χ concern collective attacks and are the ones converted into key rates (Sec. S5). Since the collective class contains the individual one and the class of coherent attacks contains both, an explicitly exhibited collective attack bounds from above the rate secure against coherent attacks as well, and no de Finetti or entropy-accumulation argument is required for such upper bounds to hold. In E91 and its device-independent form, Alice and Bob share entangled pairs and security rests on a Bell test [44]. The monitored statistic is the Clauser–Horne–Shimony– Holt (CHSH) value S [45], a combination of four correlators between Alice’s and Bob’s measurement outcomes √ that is at most 2 for local models and at most 2 2 in quantum theory [46], and the protocol aborts when S falls below a threshold τS . The attacker’s information is the Holevo quantity χ(A:E) between Alice’s key bit and the eavesdropper’s system [2, 27]. Table II of Sec. IV A sets the two protocols side by side.

III.

ATTACKS UNDER STATIONARY CHANNEL NOISE

Before introducing channel drift, the search evaluates stationary channels with a fixed amount of inherent error. The maximum information attainable at each noise level establishes a frontier. As the noise level changes, the adaptive attacker detailed in Sec. IV exploits movement along this frontier.

A.

Attainable information on noisy channels

With the abort threshold fixed at FAB ⩾ 0.87 and a total channel error weight ε distributed between the two bases, the largest FAE attained by any feasible circuitp lies well below the noiseless cloning envelope FAE = 1 + FAB (1 − FAB ) of Refs. [16, 18] evaluated at the ob2 served fidelity. That envelope depends only on FAB and returns 0.836 at the threshold, whereas the attainable value falls from 0.828 at ε = 0.02 to 0.786 at ε = 0.10 and 0.664 at ε = 0.22, so the separation grows from 0.0085 through 0.050 to 0.172 as in Fig. 1(a) and Table S4. Two qualifications contextualise this separation. Firstly, the comparison assumes the trusted-noise convention (Sec. I C), which models the channel as a fixed process the eavesdropper cannot alter. The theoretical envelope, however, was derived assuming she has full access to a noiseless channel. Consequently, the separation measures the conservatism of the quoted figure for a physically restricted attacker, rather than implying any looseness in published bounds. Secondly, for Pauli noise, the attainable values have an analytical counterpart tied to the imbalanced and biased cloners of Refs. [13, 21]. A disturbance Db introduced by the attacker in basis b is observed as Qb = pb + (1 − 2pb )Db , where pb is the channel’s inherent error rate in that basis. Composing this observation with the per-basis cloning trade-off gives X p FAE = 12 + 12 Db (1 − Db ), (4) b∈{Z,X}

maximised over (DZ , DX ) subject to the feasibility constraint. Every entry of Table S4 agrees with this expression to within 2 × 10−4 , although the search is not supplied with it. The Pauli sweeps therefore validate the search on noisy channels. The constructive content of Fig. 1(a) lies in the magnitude of the separation and in the returned circuits, which populate the library of Sec. IV. Furthermore, the search is essential where no such expression is known, such as for amplitude damping (Sec. III C). The underlying mechanism is the interval between the honest fidelity (which is 1 − ε/2 for these channels) and the threshold. At ε = 0.22, the honest channel already sits at FAB = 0.89, leaving the attacker just 0.02 of fidelity to disturb. In contrast, the theoretical envelope attributes the entire distance from FAB = 1 down to the threshold to her. This interval

5

achievable FAE

0.85 0.80 0.75 0.70 0.65

asymmetry gain in FAE

margin the quoted bound assigns Eve

(a)

closed form at FAB = symmetric channel one-basis channel

(b)

0.02

ε constraint Noise Symmetric FAE One-basis FAE Gain 0.10 averaged trusted 0.7846 0.7858 +0.0012 0.10 per-basis trusted∗ 0.7846 0.7631 −0.0214 0.10 per-basis untrusted 0.7220 0.6737 −0.0483 0.22 averaged trusted 0.6581 0.6640 +0.0059 0.22 per-basis trusted∗ 0.6581 abort — 0.22 per-basis untrusted 0.8153 0.7301 −0.0853

0.00 0.02 0.04 0.06 0.08 0.10 0.00

averaged QBER wall per-basis QBER wall

0.05

0.10

0.15

total honest error weight

0.20

Figure 1. Attainable attacks under stationary channel noise at an abort threshold of FAB ⩾ 0.87. (a) The maximum attainable FAE under the trusted-noise convention as the channel’s total honest error weight, ε, increases. This is plotted for two scenarios: a channel concentrating all its error in a single basis, and one splitting the error evenly. Because both channels produce the same observed disturbance, the noiseless closed-form solution (dashed line) assigns them identical values. The shaded region highlights the gap between this theoretical limit and the actual attainable FAE . Each data point represents the best outcome from three random seeds, with a cross-seed spread of approximately 0.001 at ε = 0.10 (Sec. S4). (b) The attacker’s gain from basis asymmetry under two different monitoring conventions. When constrained by the basis-averaged quantum bit error rate (QBER), the gain is small and positive. However, when constraints are applied to the per-basis rates separately (shown here under the untrusted convention where the attacker must reproduce each observed rate), the gain changes sign and increases by more than an order of magnitude. The trusted per-basis values in Table I exhibit this same sign change.

shifts whenever the channel’s error changes, and Sec. IV measures what an attacker obtains by tracking it.

B.

Table I. Basis asymmetry evaluated across two feasibility constraints and two noise conventions. Under the averaged constraint, the attacker can redistribute the disturbance between the bases, provided that FAB ⩾ 0.87. Under the trusted perbasis constraint, each observed error rate must independently remain at or below 0.13. These specific rows (marked ∗ ) are evaluated using Eq. (4) – a result that the search independently reproduces in the averaged rows. Notably, at ε = 0.22, the one-basis channel already fails this per-basis test. Under the untrusted per-basis constraint, the attacker supplies the entire disturbance and must reproduce each observed rate to within a tolerance of 2 × 10−3 . Finally, absolute values should only be compared between rows that share the same noise convention.

Monitoring conventions and basis asymmetry

Holding ε fixed while shifting the error between the bases produces two quantum channels. A user monitoring only the basis-averaged quantum bit error rate (QBER) cannot distinguish between them, as both yield

the same FAB . Under this convention, the attainable leak differs slightly between the two channels. This occurs because any disturbance the attacker introduces in an already damaged basis is scaled by 1 − 2pb in Eq. (4) and is partially masked by the channel’s intrinsic error. Consequently, her gain from this basis asymmetry rises from below 10−4 at ε = 0.02, to 0.0012 at ε = 0.10, and reaches 0.0059 at ε = 0.22. Security proofs and most implementations instead estimate the error rate in each basis separately, and under a per-basis constraint the sign of the gain reverses, with a magnitude larger by more than an order of magnitude. Two versions of that constraint are reported in Table I. Under the trusted convention, with the key-basis rate QZ and the complementary rate QX each held at or below the same 13%, Eq. (4) gives a gain of −0.0049 at ε = 0.06 and −0.0214 at ε = 0.10, and for ε > 0.13 the one-basis channel fails the per-basis test with no attacker present. Under the untrusted convention of a security proof, in which the attacker supplies the whole disturbance and must reproduce each observed rate to within 2×10−3 , the search returns a gain of −0.048 at ε = 0.10 and −0.085 at ε = 0.22 as p in Fig. 1(b), in agreement to within 10−4 P 1 1 with 2 + 2 b Qb (1 − Qb ) evaluated at the edge of the tolerance. Absolute values in the untrusted rows are not comparable with those in the trusted rows, since the untrusted attacker is credited with the channel’s noise as her own, and only the difference within a pair of rows is compared. The mechanism is the concavity of Eq. (4), whose two terms reward spreading a given amount of disturbance over both bases. An averaged constraint lets the attacker place disturbance wherever it is cheapest, so an asymmetric channel incurs no additional cost for her, and the

6 masking effect gives her a small gain. A per-basis constraint ties each disturbance to the room left in its own basis, and a one-basis channel leaves that room unevenly: under the trusted convention the damaged basis admits only DZ ⩽ 0.0375 at ε = 0.10, and under the untrusted convention the clean basis pins QX ≈ 0.002, which caps her key-basis Holevo information at h(QX ) = 0.0204 however much error the key basis carries (Sec. S6). The asymmetry advantage is therefore a property of the monitoring convention. Per-basis estimation is already the convention of security proofs, and the results quantify what an averaged threshold would concede on an asymmetric channel. At ε = 0.10 on the one-basis channel, replacing the averaged constraint by per-basis constraints at the same 13% lowers the attainable fidelity from 0.7858 to 0.7631, by 0.023, which requires no additional measurement, since the two rates are already collected. C.

Non-Pauli noise and ancilla size

The search is not restricted to Pauli noise. Amplitude damping, the process by which an excited state relaxes towards the ground state, is not a Pauli channel and lies outside the Pauli-channel cloning solutions of Refs. [18, 21], and the same search treats it without modification. It returns circuits of four to five gates whose attainable leak declines from 0.820 to 0.744 as the damping parameter γ runs from 0.05 to 0.20 (Table S5). Enlarging the attacker’s quantum memory at the one-basis operating point ε = 0.10 changes the attainable value by less than 10−3 , from 0.7850 with one ancilla qubit to 0.7858 with two, and a third qubit produces no change at four-decimal resolution. The two-qubit ancilla used throughout is therefore adequate at that operating point, and since the ancilla size enters the search as an initialisation parameter, larger memories require no change to the solver. D.

Bilateral noise in the entanglement-based protocol

with Q the error rate between the measurements from which the key is formed, vanishes at Ssec ≈ 2.4240 when evaluated on √ the honest depolarised pair, for which Q = 1 (1 − S/2 2), and a finite-statistics buffer places the 2 operational threshold at τS ≈ 2.444. Since the bilateral √ channel lowers the honest CHSH value to (1 − p)2 2 2, an undisturbed Bell pair reaches Ssec at q √ (7) pcliff = 1 − Ssec /2 2 ≈ 0.0742, above which even an undisturbed channel yields no key, and it falls below τS at the slightly smaller noise level p ≈ 0.070. The attacker therefore operates within a band that closes at a noise level fixed by quantum theory and by the key-rate formula, whereas in the prepare-andmeasure case the user chooses the threshold independently of the channel. The extent to which a drifting channel can be exploited is accordingly determined by this geometry together with the abort threshold (Sec. IV F). IV.

In E91, the constraint becomes a margin on the CHSH value and the leakage measure is χ(A:E). The channel B acts on both subsystems as ΛA p ⊗ Λp , with Λp the singlequbit depolarising channel of strength p. Depolarising noise multiplies every non-identity Pauli component of a state by (1 − p), and each CHSH correlator is bilinear in traceless Pauli operators on A and B, so each correlator collects two factors, Sobs (UE , p) = (1 − p)2 Spre (UE ),

pre remains independent of ΛB (so that ρobs E = ρE ). This independence is confirmed numerically to four decimal places across p ∈ {0, 0.05, 0.1, 0.2, 0.5}. Consequently, the two subsystems constrain the attacker through distinctly separate mechanisms: ΛA lowers χ via data processing on Alice’s measured qubit, whereas ΛB leaves χ unchanged but tightens the CHSH margin through Eq. (5). Modelling only a single subsystem incorrectly degrades this margin by (1 − p) instead of (1 − p)2 . At small p, this error halves the noise-induced loss of the CHSH value and estimates the failure point of the honest link at roughly twice its true noise level. Therefore, a single-subsystem noise model miscalculates the valid operating range by a factor of about two. A second feature of the entanglement-based case bounds the attacker from the honest side. The asymptotic key rate [27]   p r(S) = 1 − h(Q) − h 21 + 12 (S/2)2 − 1 , (6)

(5)

where Spre (UE ) is the CHSH value of the state prepared by the attacker’s interaction, UE , before the channel acts. Tracing out Bob leaves only Pauli coefficients that act as the identity on B. Because ΛB does not damp these identity components, the eavesdropper’s observed state

ATTACKS UNDER DEVICE DRIFT

A drifting noise lower bound is typically treated as a benign operational error that merely reduces the key rate. Because the closed-form solutions of Sec. I B and the relaxations used to certify key rates evaluate only a single, frozen channel state, neither can determine whether an adversary gains an advantage by adapting to the channel’s drift. To address this, this section frames adaptive eavesdropping as a sequential decision problem (Sec. IV A). It constructs the libraries of quantum circuits from which the attacker selects their actions (Sec. IV B), and describes the adaptive agent alongside its baselines (Sec. IV C). Finally, it quantifies the value of this adaptation for both BB84 (Sec. IV D) and E91 (Sec. IV E), exploring its dependence on the threshold geometry (Sec. IV F).

7 A.

Adaptive eavesdropping as a constrained decision process

The channel parameter pt , which is the bit-flip rate for BB84 and the depolarising strength for E91, follows an Ornstein–Uhlenbeck process [40], dpt = κ (µ − pt ) dt + σ dWt ,

(8)

which reverts at rate κ towards the mean µ under fluctuations of volatility σ driven by a Wiener process Wt . It is integrated exactly with one round as the time step and clipped to the ranges of Table II. An episode comprises T = 50 rounds. In each round the attacker selects one circuit at from a library A and receives the reward r(at , pt ), equal to FAE for BB84 and to χ(A:E) for E91. The single-round value of the monitored statistic, FAB for BB84 and S for E91, is fixed by at and pt , since the statistic is evaluated asymptotically, and the legitimate parties abort when its mean over the episode falls below the threshold. In other words, the constraint is a budget over the entire episode and not a single round. The attacker observes the current noise level pt together with its three previous values, her previous action, the mean of the monitored statistic over the last ten rounds, her mean reward so far and the number of rounds remaining. Knowledge of pt idealises an attacker who infers the channel’s own noise from the public errorrate record, which she can do because she knows the disturbance she contributes. The idealisation removes the lag of that inference and so favours the attacker, which is the conservative direction for a defender. A policy π maps observations to library circuits, and the attacker maximises " T # X Jλ (π) = E r(at , pt ) − λ Pr[Dπ ] , (9) t=1

where Dπ represents the event of detection (when the episode mean falls below the threshold) and λ ⩾ 0 is the detection penalty, tuned for either strict or tolerated settings. The results below report the mean reward per round alongside the observed detection frequency. Crucially, the compactness of the generated circuits allows us to build small, discrete libraries (24 circuits for BB84 and 26 for E91, plus the identity, as detailed in Sec. IV B). This reduces an otherwise intractable continuum of eavesdropping strategies into a finite action set, casting Eq. (9) as a constrained Markov decision process solvable by standard methods. The contrast with a semidefinite relaxation is one of formulation. A relaxation characterises the correlations compatible with one fixed observed behaviour and answers a static question, namely how much the eavesdropper can know given that behaviour. In the adaptive problem the channel parameter evolves stochastically, so the constraint changes from round to round, the abort condition is a budget shared across the rounds of an episode,

and the objective is an expectation over channel trajectories. Deciding how much of the budget to spend at the current noise level requires anticipating the noise levels to come, which no evaluation at a frozen behaviour supplies, so a semidefinite treatment would have to be embedded in a sequential optimisation that it does not itself provide. Three reference policies bound the adaptive attacker. A fixed circuit plays the same library element in every round of an episode. The greedy oracle myopically selects the highest-reward circuit that keeps the ten-round mean above the threshold; it avoids detection but ignores future rounds. Finally, dynamic programming solves Eq. (9) over the augmented state st = (t, pt , Et ), where Et tracks the accumulated threshold excess. By applying a penalty strict enough to guarantee zero detection, its value, VDP , establishes the absolute performance upper bound for the library. Proposition 1. Let Vfix be the mean reward per round of the best fixed circuit that incurs no detection, Vπ that of any policy π that acts on the observations above and incurs no detection, and VDP the value of dynamic programming over st under the constraint that no trajectory ends in detection. Then, Vfix ⩽ Vπ ⩽ VDP . Proof. A fixed circuit is a policy that ignores its observations, which gives the first inequality. The drift is Markov and pt is observed, and detection depends on the trajectory only through ET , so st is a sufficient statistic for the constrained problem. Every observation available to π is a function of the history, and a history-dependent policy is dominated in a finite-horizon Markov decision process by the optimal policy over a sufficient state [47], which gives the second inequality. As feasible policies, both the greedy oracle and a zerodetection trained agent fall below this optimal upper bound. The agent’s shortfall from VDP reveals its unexploited potential, while the oracle’s gap to VDP quantifies the value of anticipating the episode budget.

B.

Libraries of learnt circuits

The BB84 drift library was built before the stationary sweeps of Sec. III, in the setting of Ref. [13]. The bit-flip acts on the travelling qubit before the attacker’s interaction, so the noise also degrades her copy; she holds one ancilla qubit; and FAE is the probability that her ancilla, measured in the announced basis, returns Alice’s bit, which lies below the Helstrom value of Eq. (3). The library comprises four levels of aggressiveness, each optimised at six noise anchors p ∈ {0.02, 0.05, 0.10, 0.15, 0.20, 0.25}, giving 24 circuits (Sec. S9). The drift results for BB84 therefore concern this weaker, noise-degraded attacker, and their absolute values are not comparable with those of Sec. III A. The E91 library constrains the CHSH value

8 Table II. Component-by-component correspondence between the two drift environments. The monitored statistic is averaged over each episode of T = 50 rounds, and the drift is the discretised Ornstein–Uhlenbeck process of Eq. (8) with one round as the time step. The cliff is the noise level at which the undisturbed channel alone reaches the abort threshold for BB84 and the zero-key-rate value Ssec for E91 (Eq. (7)).

Attacker’s memory

BB84 Prepare-and-measure Bit-flip of rate pbf , before the attacker’s interaction One qubit

Honest reference Abort threshold (episode mean) Attacker’s information Drift parameters √ Stationary spread σ/ 2κ Library

FAB = 1 − pbf /2 FAB ⩾ 0.87

Cliff

pbf = 0.26

FAE , memory measured in the announced basis µ = 0.10, σ = 0.03, κ = 0.1, p ∈ [0.01, 0.30] 0.067 24 circuits (4 levels × 6 anchors) + identity

alone, which follows the convention of the envelope it is compared against [27] and is the weaker of the two possible constraints (the stronger one is the full behaviour p(ab|xy), the set of outcome probabilities given the measurement settings). It spans seven absolute CHSH targets, Starget ∈ {2.55, 2.50, 2.43, 2.30, 2.20, 2.00, 1.80}, and four noise anchors, p ∈ {0, 0.0214, 0.0428, 0.0642}. By Eq. (5), no preparation yields a CHSH value above √ 2 shonest (p) = (1 − p) 2 2, the value of the undisturbed channel, so cells with Starget > shonest (p) − 0.01 are infeasible and are skipped, which leaves 26 cells of five to nine gates. Each is built by the procedure of Sec. S2 on a three-qubit hardware-efficient preparation with fitness χ − α(S − Starget )2 and α = 100, which drives the cell to its prescribed CHSH value. The drift range for E91 is narrow by necessity, since its upper edge p = 0.0642 lies 0.01 below the value pcliff of Eq. (7). The library cells at p = 0 lie on the noiseless Acín envelope (Fig. 2), which at S = τS permits χ ⩽ 0.607, so the search saturates the analytical frontier where one exists. Averaged over the operating noise distribution, the attainable value is χ ≈ 0.35: the zero-detection upper bound over the library is VDP ≈ 0.356, and a warmstarted sequential-quadratic Pareto search over the attacker’s full three-qubit pre-channel state, 16 real parameters, returns 0.36, so the library captures nearly all that this dimension-restricted attacker achieves. The separation between 0.35 and 0.607 does not indicate looseness of the envelope for two reasons. The envelope is evaluated at p = 0 whereas the attainable value is averaged over p > 0, so a noiseless upper bound is placed beside a noisy lower bound, and the bilateral channel of Eq. (5) accounts for most of the difference. In addition, the attacks are constructed on a fixed threequbit preparation, whereas a device-independent state-

E91/DIQKD Entanglement-based, CHSH game B Bilateral depolarising ΛA p ⊗ Λp , after the preparation One qubit (three-qubit preparation on A, B, E) √ Sobs = (1 − p)2 · 2 2 Sobs ⩾ τS ≈ 2.444 χ(A:E) µ = 0.03, σ = 0.015, κ = 0.1, p ∈ [0, 0.0642] 0.034 26 circuits (7 levels × 4 anchors, 2 infeasible) + identity pcliff ≈ 0.0742

E91 Pareto: EvoluCMAES library vs Acín envelope (at p = 0) 1.0

Eves information χ(A : E)

Component Protocol family Channel

Acín envelope (noiseless) EvoluCMAES library cells (at p = 0) DET_THRESH (E91) Library DP (OU-averaged)

0.8

0.6

0.4

0.2

0.0

1.6

1.8

2.0

2.2

2.4

2.6

2.8

CHSH violation S

Figure 2. Disturbance versus information in the deviceindependent setting. At p = 0, the discovered attacks trace the noiseless Acín envelope [27, 28], demonstrating that the search successfully saturates the analytical frontier where one exists. However, when averaged over the drifting noise, the attainable value (marked by the star) drops to χ ≈ 0.35, falling short of the 0.607 permitted by the theoretical envelope at the threshold. This gap occurs for two reasons: the theoretical envelope assumes a strictly noiseless channel (p = 0) while the attainable value averages over active noise (p > 0), and the constructed attacks are restricted to a fixed threequbit preparation.

ment admits an eavesdropper of unbounded dimension, so the value is a constructive lower bound on what a dimension-restricted attacker achieves at operating noise. Section S5 places both numbers beside the upper bound returned by a semidefinite relaxation.

9 Adaptive agent and baselines

The adaptive attacker is a value-based reinforcementlearning agent featuring double and duelling value estimation, n-step returns, and prioritised replay [41]. It employs invalid-action masking [48] to dynamically exclude circuits that would drop the ten-round mean below the threshold. Sharing this filter with the greedy oracle, the agent must optimally select among the remaining safe actions to maximise future rewards. Hyperparameters are identical across both protocols, which differ only by channel, threshold, and information measure. Training applies either a strict (heavy) or tolerated (moderate) detection penalty. As is standard, results report the best evaluation checkpoint, with variance detailed in Sec. S8. Baselines include a passive attacker, the reference policies defined above, and for E91, a masked policy-gradient agent [48, 49] alongside behavioural cloning of the dynamic programming policy [50]. Unmasked policy-gradient agents are compared in Figs. 4 and 6.

E91

% of VDP 96 99 99 99 100 38 99 98 99 100

Det. 0% 0% 0% 4% 0% 0% 0% 0% 7% 0%

Value of adaptation on BB84

As detailed in Table III, the strict adaptive agent on BB84 reaches FAE = 0.7434 with zero detection. This matches the greedy oracle and achieves 98.8% of the zerodetection upper bound, VDP = 0.7527 (Figs. 3 and 4). The “static” baseline in the released environment actually adapts to drift by selecting the most conservative library level nearest the current noise anchor, reaching FAE = 0.7197. The adaptive agent outperforms this conservative rule by 0.024, capturing roughly three-quarters of the theoretical 0.033 headroom available up to VDP . The remaining 0.009 gap represents the value of anticipating the episode budget. The best genuinely fixed circuit scores below 0.7197. Finally, unmasked policy-gradient agents plateau roughly 0.02 below the oracle. This 0.024 separation between the conservative rule and the adaptive agent quantifies the impact of drift on BB84. A threat model that confines the attacker to the safest circuit at each noise level undercounts her information by 0.024 in FAE , and assuming a single fixed circuit undercounts it even further. Furthermore, these drift experiments enforce the basis-averaged constraint FAB ⩾ 0.87. Because per-basis monitoring substantially alters the attacker’s attainable information (Sec. III B), evaluating this separation under per-basis constraints is left for future measurements.

E.

BB84

FAE /χ 0.7197 0.7434 0.7434 0.7477 0.7527 0.135 0.3507 0.3484 0.3540 0.356

Policy Conservative lookup Greedy oracle Adaptive, strict Adaptive, tolerated Dyn. prog., VDP Best fixed circuit Greedy oracle Adaptive Dyn. prog., coarse Dyn. prog., VDP

Value of adaptation on E91

On E91, adaptation provides a massive advantage. To survive all 2000 evaluation episodes without detection, the best fixed circuit must conservatively keep the episode mean of S above τS even on the noisiest trajector-

BB84 Rainbow-DQN: FAE over training

Detection rate during training

0.75 0.70 0.65 0.60 Rainbow-DQN Oracle Identity

0.55 0.50 0.0

0.2

0.4

0.6

Training steps

0.8

1.0 1e6

Detection rate (\%)

D.

Table III. Value of adaptation. Mean information per round and detection rate, alongside percentages of the zero-detection dynamic-programming upper bound, VDP , evaluated over the same library. BB84 values are averaged over 50 evaluation episodes. E91 agent and oracle values are averaged over 200 episodes, while its fixed-circuit and dynamic-programming baselines are evaluated over 2000 episodes. The E91 upper bound is resolved computationally to a grid precision of 0.001 (Sec. S8). The BB84 conservative lookup policy is not a fixed circuit; it dynamically selects the safest library level anchored nearest the current noise level.

FAE

C.

0.04 0.02 0.00 −0.02 −0.04 0.0

0.2

0.4

0.6

Training steps

0.8

1.0 1e6

Figure 3. Adaptive attack on BB84 under a drifting device. Upper panel: attacker information FAE during evaluation, reaching the greedy oracle (dashed) at its best checkpoints and well above the passive baseline (dotted). Lower panel: detection rate, which stays at zero at those checkpoints.

ies, yielding only χ = 0.135. In contrast, the adaptive agent reaches 0.3484 at zero detection – within 2% of the VDP ≈ 0.356 upper bound (Figs. 5 and 6). Adaptation thus multiplies the attacker’s extracted information by approximately 2.6 without increasing detection risk. The agent’s slight 0.0023 shortfall compared to the greedy oracle requires paired statistical analysis. Because all E91 policies evaluate the same per-episode channel realisations, paired observations eliminate the channelto-channel variance that would otherwise obscure such small effect sizes. Across n = 200 paired episodes, the agent trails the greedy oracle by 0.0023 (95% confidence interval [0.0018, 0.0028]) and outperforms the masked policy-gradient agent by 0.0017 ([0.0012, 0.0022]). Both differences are highly significant under a two-sided Wilcoxon signed-rank test [51] (Table IV). Meanwhile, unmasked policy-gradient agents collapse to χ ≈ 0.26–0.28, failing to explore effectively and confining themselves to just three or four distinct actions.

10 BB84 / bit-flip channel — RL methods on the EvoluCMAES library 0.723

PPO (exp_5)

0.712

Static safe 0.500

Identity RecurrentPPO (exp_6)

0.726

MPC (exp_6)

0.726

Rainbow-DQN (exp_7)

0.743

Oracle

0.743

E91 / DIQKD — RL methods on the EvoluCMAES library MPC (exp_6)

0.351

DP

0.350

BC + DAgger (exp_5)

0.350

Rainbow-DQN (exp_7)

0.348

Oracle

0.347

MaskablePPO (exp_7)

0.347

RecurrentPPO (exp_6)

0.45

0.50

0.55

0.60

0.65

0.70

0.75

Eves mean Alice-Eve fidelity FAE (50-episode mean)

0.280

PPO (exp_5) Identity

0.256 0.000

0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

Eve's Holevo information χ(A : E) (200-episode mean)

Figure 4. BB84 under a drifting bit-flip channel: final evaluation FAE across policies, strict-feasibility variants only. The value-based agent matches the greedy oracle at 0.7434, unmasked policy-gradient methods plateau around 0.02 below it, and the noise-indexed conservative lookup (“Static safe”) reaches 0.7197. 0.40

E91 / bilateral depolarising channel — Rainbow-DQN training

Figure 6. E91/DIQKD: final evaluation χ across policies. The masked value-based agent reaches 0.3484 against a greedy oracle at 0.3507 and a coarse-grid dynamic-programming run at 0.3540 with 7% detection, whereas unmasked policy-gradient methods collapse to χ ≈ 0.26–0.28 by confining themselves to three or four distinct actions.

0.35 0.30

χ(A : E)

0.25 0.20 0.15 0.10

Rainbow-DQN Oracle DP Identity

0.05

Det. rate (\%)

0.00

5

0 100000

200000

300000

400000

500000

Training steps

Figure 5. E91 under the bilateral depolarising channel: training curve for the adaptive attack. Upper panel, Holevo information during evaluation against the greedy oracle (dashed), the coarse-grid dynamic-programming run (dotted) and the passive baseline (grey); lower panel, detection rate.

Finally, the released dynamic-programming experiments reach 0.3540 but incur a 7% detection rate. This detection is strictly an artefact of discretising the accumulated statistic onto a coarse grid. Recalculating on a fine grid yields a zero-detection optimum of 0.356 ± 0.001 (Sec. S8). Because this fine-grid upper bound sits above the coarse run, it confirms that dynamic programming outperforms the agent through optimal decision-making, not by trivially tolerating detection.

F.

Tolerance for detection

On BB84 the agent trained with the tolerated penalty reaches FAE = 0.7477 at a 4% detection rate, 0.0043 above the strict agent. Since VDP = 0.7527 is reached without detection, accepting detection is not required to

obtain that information; the gain reflects the easier learning problem posed by a softer penalty and not a trade-off inherent to the task. On E91 the tolerated agent coincides with the strict one. The drift range there stops 0.006 short of p ≈ 0.070, where the honest CHSH value falls to τS , just below the noise level pcliff of Eq. (7) that quantum theory and the key-rate formula fix, whereas on BB84 the user chooses the threshold independently of the channel. It remains untested whether this difference in threshold geometry dictates how an attacker trades detection risk for information gain. Sweeping the detection penalty within a fine-grid dynamic programme would resolve this question.

V.

DISCUSSION

Explicit attacks serve the defender by providing empirically testable provisioning margins, whereas margins calibrated against conjectured strategies cannot be directly verified. However, this framework is designed to complement, rather than replace, formal security proofs. Because the search identifies feasible points without providing formal certificates, it yields constructive lower bounds on the eavesdropper’s information. Semidefinite relaxations and entropic bounds remain the appropriate instruments for proving rigorous upper bounds on the key rate. The adaptive threat models evaluated here are deliberately scoped. Our values assume asymptotic detection statistics and an attacker who perfectly tracks the current noise level. The impact of delayed noise estimation or finite-sample fluctuations on the adaptive advantage remains an open question for future work. Furthermore, the specific BB84 drift library evaluated here restricts the attacker to a one-qubit memory and imposes a basisaveraged constraint. While Proposition 1 structurally accommodates per-basis constraints, Sec. III B demonstrates that per-basis monitoring alters the attacker’s at-

11 Table IV. Paired per-episode comparisons on E91, n = 200 episodes with shared channel seeds. Two-sided Wilcoxon signed-rank p-values [51]. Comparison Adaptive − greedy oracle Adaptive − masked policy gradient Adaptive − dynamic programming (7% det.)

Mean difference −0.0023 +0.0017 −0.0056

tainable information, making the quantification of this separation an important next step. Finally, establishing constructive bounds is established practice, validating theoretical limits such as the deviceindependent collective-attack rate [27, 28] and devicedependent rates for imperfect sources [23]. Our analysis aligns with standard theoretical conventions: it assumes flawless physical implementation (leaving existing sidechannel security proofs intact), operates strictly at the qubit level, and weights the four sifted states equally, corresponding to an unbiased basis choice.

VI.

PRACTICAL CONSEQUENCES

Historically, device drift has entered the provisioning of a QKD link merely as a source of error that reduces the secure key rate. However, under the trusted-noise threat model, our measurements demonstrate that drift also dynamically dictates the amount of information an attacker can extract. For device-independent E91, an attacker adapting across 26 compact circuits holds 2.6 times the Holevo information of the best single circuit at zero detection. On BB84, she outperforms a conservative noise-indexed rule by 0.024 in fidelity. A committed attacker is constrained by the noisiest stretch of the channel she must traverse undetected. When this operational requirement spans a full recalibration interval, the relevant excursion is the largest one within that window – a value that scales with the in-

[1] C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing (Bangalore, India, 1984) pp. 175– 179. [2] A. K. Ekert, Physical Review Letters 67, 661 (1991). [3] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, Reviews of Modern Physics 81, 1301 (2009). [4] T. Metger and R. Renner, Nature Communications 14, 5272 (2023). [5] M. Tomamichel and A. Leverrier, Quantum 1, 14 (2017). [6] A. Trushechkin, Quantum 6, 771 (2022). [7] R.-Q. Wang, Z.-Q. Yin, X.-H. Jin, R. Wang, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han, Entropy 25, 258 (2023). [8] I. George, J. Lin, T. van Himbeeck, K. Fang, and

95% CI [−0.0028, −0.0018] [+0.0012, +0.0022] [−0.0065, −0.0047]

Wilcoxon p 2.5 × 10−15 1.0 × 10−8 1.3 × 10−21

terval’s length for an Ornstein–Uhlenbeck process. Consequently, the recalibration interval heavily impacts the attacker’s attainable information, a vulnerability that static analyses overlook. The chosen monitoring convention exerts a comparable impact. On a stationary channel concentrating its error in one basis at ε = 0.10, enforcing individual per-basis thresholds rather than an averaged threshold lowers the attacker’s attainable fidelity by 0.023 and reverses her gain from basis asymmetry – all without requiring additional measurements by the legitimate parties. Ultimately, this computational sequential-decision apparatus applies to operating points that lack closedform analyses, including alternative drift processes and finite-key regimes constrained by confidence intervals. Wherever a formal security proof establishes an upper bound on an eavesdropper’s information, explicit adaptive constructions of this kind provide the rigorous lower bound beneath it.

ACKNOWLEDGMENTS

The authors thank N. Lütkenhaus for advice on security models and P. Brown for connecting the work to upper bounds on key rates. Code, analysis notebooks and the channel sweeps reported here are available upon request and will be released under the MIT licence at the end of peer review. Generative AI tools assisted with implementing experiments and editing the text.

N. Lütkenhaus, arXiv preprint arXiv:2203.06554 (2022). [9] A. Winick, N. Lütkenhaus, and P. J. Coles, Quantum 2, 77 (2018), arXiv:1710.05511 [quant-ph]. [10] M. Navascués, S. Pironio, and A. Acín, New Journal of Physics 10, 073013 (2008), arXiv:0803.4290 [quant-ph]. [11] P. Brown, H. Fawzi, and O. Fawzi, Quantum 8, 1445 (2024), arXiv preprint posted 2021., arXiv:2106.13692 [quant-ph]. [12] J. Lin and N. Lütkenhaus, Physical Review Applied 14, 064030 (2020), arXiv:2006.06166 [quant-ph]. [13] T. Decker, M. Gallezot, S. F. Kerstan, A. Paesano, A. Ginter, and W. Wormsbecher, npj Quantum Information 11, 140 (2025), arXiv:2410.01904 [quant-ph]. [14] G. Brassard and L. Salvail, in Advances in Cryptology— EUROCRYPT’93 (Springer, 1994) pp. 410–423. [15] C. W. Helstrom, Journal of Statistical Physics 1, 231

12 (1969). [16] C. A. Fuchs, N. Gisin, R. B. Griffiths, C.-S. Niu, and A. Peres, Physical Review A 56, 1163 (1997), arXiv:quant-ph/9701039. [17] D. Bruß, M. Cinchetti, G. M. D’Ariano, and C. Macchiavello, Physical Review A 62, 012302 (2000). [18] N. J. Cerf, Physical Review Letters 84, 4497 (2000). [19] R. B. Griffiths and C.-S. Niu, Physical Review A 56, 1173 (1997), arXiv:quant-ph/9702015. [20] C.-S. Niu and R. B. Griffiths, Physical Review A 58, 4377 (1998). [21] S. F. Kerstan, M. Gallezot, T. Decker, M. Braun, and N. Hegemann, arXiv preprint arXiv:2602.00646 (2026), arXiv:2602.00646 [quant-ph]. [22] P. W. Shor and J. Preskill, Physical Review Letters 85, 441 (2000), arXiv:quant-ph/0003004. [23] E. Woodhead, Physical Review A 90, 022306 (2014), arXiv:1405.5625 [quant-ph]. [24] B. Kraus, N. Gisin, and R. Renner, Physical Review Letters 95, 080501 (2005), arXiv:quant-ph/0410215. [25] R. Renner, N. Gisin, and B. Kraus, Physical Review A 72, 012332 (2005), arXiv:quant-ph/0502064. [26] T. Moroder, M. Curty, and N. Lütkenhaus, Physical Review A 73, 012311 (2006), arXiv:quant-ph/0507235. [27] A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani, Physical Review Letters 98, 230501 (2007). [28] S. Pironio, A. Acín, N. Brunner, N. Gisin, S. Massar, and V. Scarani, New Journal of Physics 11, 045021 (2009). [29] I. W. Primaatmaja, K. T. Goh, E. Y.-Z. Tan, J. T.-F. Khoo, S. Ghorai, and C. C.-W. Lim, Quantum 7, 932 (2023), arXiv:2206.04960 [quant-ph]. [30] K. Łukanowski, M. Balanzó-Juandó, M. Farkas, A. Acín, and J. Kołodyński, Quantum 7, 1199 (2023), arXiv:2206.06245 [quant-ph]. [31] M. Farkas, M. Balanzó-Juandó, K. Łukanowski, J. Kołodyński, and A. Acín, Physical Review Letters 127, 050503 (2021), arXiv:2103.02639 [quant-ph]. [32] B. Coyle, M. Doosti, E. Kashefi, and N. Kumar, Physical Review A 105, 042604 (2022), arXiv:2012.11424 [quantph]. [33] R. J. C. Bagunu, arXiv preprint arXiv:2606.22962 (2026), arXiv:2606.22962 [quant-ph]. [34] I. Devetak and A. Winter, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences 461, 207 (2005). [35] E. Real, A. Aggarwal, Y. Huang, and Q. V. Le, in Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 33 (2019) pp. 4780–4789, arXiv:1802.01548. [36] D. Chivilikhin, A. Samarin, V. Ulyantsev, I. Iorsh, A. R. Oganov, and O. Kyriienko, arXiv preprint arXiv:2007.04424 (2020), arXiv:2007.04424 [quant-ph]. [37] N. Hansen and A. Ostermeier, Evolutionary Computation 9, 159 (2001). [38] N. Hansen, arXiv preprint arXiv:1604.00772 (2016), arXiv:1604.00772 [cs.LG]. [39] J. C. Spall, IEEE Transactions on Automatic Control 37, 332 (1992). [40] G. E. Uhlenbeck and L. S. Ornstein, Physical Review 36, 823 (1930). [41] M. Hessel, J. Modayil, H. van Hasselt, T. Schaul, G. Ostrovski, W. Dabney, D. Horgan, B. Piot, M. Azar, and D. Silver, in Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 32 (2018) arXiv:1710.02298 [cs.AI].

[42] D. Gottesman and H.-K. Lo, IEEE Transactions on Information Theory 49, 457 (2003). [43] H. F. Chau, Physical Review A 66, 060302 (2002). [44] J. S. Bell, Physics Physique Fizika 1, 195 (1964). [45] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Physical Review Letters 23, 880 (1969). [46] B. S. Cirel’son, Letters in Mathematical Physics 4, 93 (1980). [47] M. L. Puterman, Markov Decision Processes: Discrete Stochastic Dynamic Programming (Wiley, New York, 1994). [48] S. Huang and S. Ontañón, in Proceedings of the ThirtyFifth International Florida Artificial Intelligence Research Society Conference (FLAIRS-35), Vol. 35 (2022) arXiv:2006.14171 [cs.LG]. [49] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, arXiv preprint arXiv:1707.06347 (2017), arXiv:1707.06347 [cs.LG]. [50] S. Ross, G. J. Gordon, and J. A. Bagnell, in Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (AISTATS), Proceedings of Machine Learning Research, Vol. 15 (PMLR, 2011) pp. 627–635. [51] F. Wilcoxon, Biometrics Bulletin 1, 80 (1945). [52] D. P. Kingma and J. Ba, arXiv preprint arXiv:1412.6980 10.48550/arXiv.1412.6980 (2014). [53] N. Hansen, S. D. Müller, and P. Koumoutsakos, Evolutionary Computation 11, 1 (2003). [54] B. O’Donoghue, E. Chu, N. Parikh, and S. Boyd, Journal of Optimization Theory and Applications 169, 1042 (2016). [55] R. Arnon-Friedman and F. Leditzky, IEEE Transactions on Information Theory 67, 6606 (2021), arXiv:2005.12325 [quant-ph]. [56] S. P. Kish, P. J. Gleeson, A. Walsh, P. K. Lam, and S. M. Assad, Quantum 8, 1382 (2024). [57] Y. Mao, Y. Zhu, Y. Wang, and Y. Guo, Symmetry 14, 2128 (2022). [58] H. Shu, C.-Y. Zhang, Y.-Q. Chen, Z.-J. Zheng, and S.-M. Fei, International Journal of Theoretical Physics 62, 181 (2023). [59] W. F. Stinespring, Proceedings of the American Mathematical Society 6, 211 (1955). [60] D. Bruß, Physical Review Letters 81, 3018 (1998), arXiv:quant-ph/9805019.

13

Supplemental Material Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift Marcel Mordarski, Daniel Budina, Benjamin Gras, Abdelrahman Shehata, and Roberto Bondesan

S1.

LEARNT ATTACKS ON A FIXED TEMPLATE: A REVIEW OF REF. [13]

As the present work extends Ref. [13] directly, that work is summarised here in the notation of the main text. That work recasts eavesdropping on BB84 as a variational learning problem. Alice sends one of the four BB84 states, and the attacker applies a unitary U (Θ) jointly to the travelling qubit and an ancilla she keeps, forwards the travelling qubit to Bob, and after the public basis announcement applies a second unitary V (Λ) to her memory before measuring it. Both unitaries come from a hardware-efficient template, a fixed alternation of single-qubit rotations and cnots whose depth and connectivity are chosen in advance. Only the rotation angles (Θ, Λ) vary during training, which proceeds by Adam [52] on the loss of Eq. (1) of the main text, the quadratic term pinning FAB to a chosen p√ √
2 ρA ρB ρA , with FAB averaged target f and the linear term maximising FAE . Fidelities follow F (ρA , ρB ) = Tr over the four sifted states. Three findings are relevant here. Firstly, on an ideal channel the learner converges to the phase-covariant cloning machine [17], which validates the variational apparatus against a known answer. Secondly, adding a bit-flip to the channel, applied before the attacker’s interaction in that work, breaks that cloner’s optimality, since an imbalanced construction with cloning coefficients CAB,Z = sin ψ and CAB,X = cos ϕ, carrying two free parameters in place of one, overtakes it whenever the channel’s Kraus weights satisfy αγ ̸= βδ in the notation of Ref. [13], giving up fidelity in the damaged basis for fidelity in the untouched one. Thirdly, treating the parity information leaked during Cascade reconciliation [14] as available to the attacker permits a joint measurement over stored ancilla pairs, which raises her recovery probability from 0.810 to the Helstrom optimum 0.894 at FAB = 0.892, the 11% error bound [15]. The present work retains the threat model and the figures of merit, with the fidelities evaluated as the recovery probabilities defined in Sec. II, and modifies two elements. The circuit template is removed, so that gate structure is searched (Sec. S2), and the single stationary noise level is replaced by a sweep over channel families (Secs. III and S4) and by an explicitly time-varying channel (Sec. IV). Reference [13] demonstrated particular departures from the textbook attack at one noise level. The objective here is different, namely to measure what an attacker gains by adapting to a channel that moves, and the learnt attacks enter as the actions of that sequential problem. That use requires an optimiser that does not presuppose the structure of the solution and a library of solutions small enough to select from round by round. S2.

THE TWO-LOOP SEARCH PROCEDURE

The outer loop maintains a population of {Ti , θi } pairs. Individuals are ranked by fitness each generation, the top-ranked are retained under elitism, and the individuals retained by the selection step are perturbed by a topologymutation operator that adds, removes or replaces one gate, with addition and removal matched so that the operator carries no net growth bias. The inner loop optimises the angles of each new or modified topology by a gradient-free routine at a fixed budget of B fitness evaluations, covariance-matrix adaptation [37, 38, 53] for the BB84 sweeps and simultaneous-perturbation stochastic approximation [39] for the E91 library. Each query is a density-matrix simulation of a non-convex objective without available gradients, which favours this class of inner optimiser [53]; Table S1 confirms that the two routines, and uniform random sampling, return the same fidelity and gate count on a shared task. The gate alphabet, the fitness and the inner optimiser are the only elements that change between the protocols. For BB84 the fitness is FAE subject to FAB ⩾ 0.87 enforced as a feasibility mask, with covariance-matrix adaptation on the angles; for E91 it is χ − α(S − Starget )2 with α = 100 on a three-qubit hardware-efficient preparation, with simultaneous-perturbation stochastic approximation on the angles, which drives each library cell to a prescribed CHSH value. The population dynamics, selection and elitism of the outer loop are shared, and Table S1 shows that the inner optimiser is immaterial at fixed budget, the two reaching the same FAE and the same equilibrium gate count on the BB84 cloning task. The evaluation budget also sets how large the returned circuits are, which keeps the library small enough to serve as a discrete action set in Sec. IV. Enlarging T at fixed B enlarges dim(θ), so the inner loop covers more dimensions with the same number of queries, and the fitness estimate returned to the outer loop is noisier for larger topologies. Rankbased selection comparing noisy estimates then favours the smaller of two topologies sharing a noiseless optimum,

14 and the population settles below the dense baseline without an explicit size penalty. The size at which it settles is measured (Table S1) and not derived; the mechanism suggests that it is set by the size at which the variance of the fitness estimate at budget B becomes comparable to the fitness separation that selection must resolve. Circuits from the exact-evaluation sweeps of Sec. S4 run slightly larger, four to eight gates against four to six, since exact evaluation removes the selection pressure towards small circuits. Table S1 reports the BB84 cloning task under three inner-loop optimisers with the outer loop, mutation operator and selection rule held fixed, with one fitness query counting as one unit for every method. Random sampling receives twice the budget to offset its lack of adaptation. Table S1. Inner-loop optimiser comparison on the BB84 cloning task; mean ± standard deviation over five seeds. All three recover FAE to within 0.01 of one another and reach the same equilibrium of four to six gates, so the discovered circuit size is set by the budget and is insensitive to the choice of algorithm. FAE 0.764 ± 0.001 0.760 ± 0.003 0.756 ± 0.006

Inner optimiser CMA-ES Stochastic perturbation (SPSA) [39] Uniform random

S3.

FAB 0.794 ± 0.000 0.794 ± 0.002 0.796 ± 0.002

Gates 5.2 ± 0.7 6.4 ± 0.8 5.6 ± 1.0

Evaluations 2000 2000 4000

Best gates 4 6 6

VALIDATION AGAINST KNOWN CLOSED FORMS

This section collects the controls that fix the accuracy of the search against analytically known answers. None of the closed forms below is supplied to the search, which starts from random gate sequences in every run, and the results validate the apparatus used in the main text.

S3.1.

Reproduction of analytical cloners

p On a noiseless channel the optimal individual attack satisfies FAE = 21 + FAB (1 − FAB ), the one-angle family of Refs. [16, 18], which balances at FAB = FAE ≈ 0.853. The expression holds along the whole family, so the thresholds tested lie on one analytically known curve and the exercise constitutes one control repeated at four abscissae. Starting from random gate sequences, the search saturates the envelope to four decimal places at every threshold tested, attaining 100.00% of the analytical value at FAB ∈ {0.95, 0.90, 0.87, 0.85} (Table S2). The objective contains no gate-count penalty, and the solutions nonetheless occupy four to eight gates drawn from a space admitting arbitrary depth, for the reason given in Sec. S2. Table S2. Validation on the noiseless symmetric channel. The search receives no analytical input and recovers the closed form p FAE = 21 + FAB (1 − FAB ) at every threshold tested. Threshold τ 0.95 0.90 0.87 0.85

FAB attained 0.9500 0.9000 0.8700 0.8500

S3.2.

FAE attained 0.7179 0.8000 0.8363 0.8571

Closed form 0.7179 0.8000 0.8363 0.8571

Ratio 1.0000 1.0000 1.0000 1.0000

Collective attacks and the asymptotic key rate

Any attack consistent with the observed statistics is a valid eavesdropping strategy, so the key rate that remains under a specific attack bounds the universally secure rate from above, r ⩽ 1 − h(Q) − χ(A:E) by the Devetak–Winter relation [34] (Sec. S5). Running the search to maximise χ in place of FAE on the symmetric channel, whose quantum bit error rate is Q in each basis, returns χ = h(Q) to four decimal places at Q ∈ {0.02, 0.04, 0.06, 0.11}, hence r ⩽ 1 − 2h(Q) with a residual below 10−4 and the rate vanishing at Q = 0.11 (Table S3). The rate 1 − 2h(Q) is

15 the symmetric case of the Shor–Preskill rate [22], which the construction reproduces from above without having been supplied with it. Table S3. Key-rate upper bounds from constructed attacks on the symmetric channel. The search maximises χ behind the same feasibility constraint and is given no analytical input; it returns χ = h(Q) at every Q tested, so the upper bound it produces coincides with the symmetric Shor–Preskill rate 1 − 2h(Q) [22] to within 10−4 . Q 0.02 0.04 0.06 0.11

χ attained 0.1414 0.2423 0.3274 0.4999

S3.3.

h(Q) 0.1414 0.2423 0.3274 0.4999

r ⩽ 1 − h(Q) − χ 0.7171 0.5155 0.3451 0.0002

1 − 2h(Q) 0.7171 0.5154 0.3451 0.0002

Comparison with a reliable numerical lower bound

The natural test of a key-rate upper bound is whether it meets the lower bound that reliable numerical methods supply. Winick, Lütkenhaus and Coles [9] bound the device-dependent rate from below by minimising the relative entropy between the post-interaction state and its pinching in the key basis, over every state compatible with the observed statistics. Given the same input, namely the per-basis error rates (QZ , QX ) of a BB84 round with the eavesdropper held responsible for all of the disturbance, the two methods bound the same quantity from opposite sides. Across four operating points running from the symmetric channel to one carrying almost all of its error in a single basis, the constructed attack extracts χ(AZ :E) = h(QX ), and the upper bound it certifies agrees with the numerical lower bound to within 3 × 10−4 in rate (Table S10). Both bounds reproduce the Shor–Preskill rate 1 − h(QZ ) − h(QX ) [22], which the Bell-diagonal reduction of Sec. S6 returns analytically and which an eavesdropper holding a purification of the minimising state attains, so the agreement validates both methods against a known answer along the whole asymmetry axis. In a first pass, two of the four operating points yielded upper bounds above the numerical lower bound by 0.07 and 0.04 in rate. Because the lower bound is a rigorous bound, the discrepancy could lie only in the search, and raising the evaluation budget from 400 to 900 evaluations per candidate and the outer loop from 18 to 24 generations closed both gaps to below 10−4 and returned smaller circuits. Computing an upper bound and a lower bound through independent methods therefore yields a convergence diagnostic that neither approach offers alone, and Sec. S6 details the comparison.

S4.

CHANNEL SWEEPS: SPECIFICATION AND RESULTS

These sweeps use exact density-matrix evaluation, so the frontier they trace carries no estimator noise. Alice’s four sifted states are prepared in turn, the attacker’s unitary acts on the travelling qubit together with a two-qubit ancilla unless stated otherwise, and the channel then acts on the travelling qubit alone, leaving the attacker’s reduced state untouched, so that the two figures of merit decouple and follow from the two marginals separately. Bob’s fidelity is the mean over the four states of his recovery probability in the matched basis, and the attacker’s fidelity is the mean over the two bases of the Helstrom success probability of Eq. (3). Each configuration runs from three seeds at population 14, 18 generations, elitism 4 and inner budget B = 350, and the best feasible run is reported. The attainable values agree with the closed form of Eq. (4) to within 2 × 10−4 at every entry, the largest deviation being a shortfall of 2 × 10−4 on the symmetric channel at ε = 0.06, where the closed form gives 0.8083. Sweeping the split of a fixed ε = 0.10 between the bases in six steps moves the attainable value monotonically from 0.7846 to 0.7858, with a cross-seed spread near 0.001 on the best-of-three statistic. Transplanting the circuit optimised on the symmetric channel onto the one-basis channel leaves it feasible at FAB = 0.8700 and yields FAE = 0.7846, short of the re-optimised 0.7858 by 0.0012.

S4.1.

Per-basis repetition

Every value in Table S4 is obtained under a constraint on the basis-averaged fidelity, FAB ⩾ 0.87, with the channel noise trusted. The untrusted per-basis rows of Table I in the main text use the same search configuration with the

16 Table S4. Attainable FAE against total honest channel error ε at threshold FAB ⩾ 0.87, for a channel placing all error in one basis (px = ε) and one splitting it evenly (px = pz = ε/2). Both present honest fidelity 1 − ε/2, so the noiseless closed form evaluated at the observed FAB assigns both the same value, 0.8363. The final column is the excess of that closed form over the attainable value under the trusted-noise convention, and measures the conservatism of the closed form for a physically restricted attacker. ε 0.02 0.06 0.10 0.16 0.22

Honest FAB 0.990 0.970 0.950 0.920 0.890

Symmetric 0.8278 0.8081 0.7846 0.7366 0.6581

One-basis 0.8278 0.8087 0.7858 0.7400 0.6640

Asymmetry gain < 0.0001 +0.0006 +0.0012 +0.0034 +0.0059

Closed-form excess +0.0085 +0.0276 +0.0505 +0.0963 +0.1723

constraint applied to both rates independently and the attacker held responsible for the whole disturbance, so that −3 her circuit must reproduce the observed per-basis P p rates QZ = px and QX = pz to within 2 × 10 . The values 1 1 −4 returned coincide to within 10 with 2 + 2 b Qb (1 − Qb ) evaluated with each observed rate raised by 2 × 10−3 , the untrusted counterpart of Eq. (4). The trusted per-basis rows are evaluated from Eq. (4) with QZ ⩽ 0.13 and QX ⩽ 0.13 imposed separately. At ε = 0.10 this gives DZ ⩽ 0.0375 and DX ⩽ 0.13 on the one-basis channel, hence FAE = 0.7631, against 0.7846 on the symmetric channel, where the two constraints coincide. Because the untrusted attacker is credited with the channel’s noise as her own, absolute values are compared only between rows sharing a noise convention. Table S5. Amplitude damping, a non-Pauli channel outside the Pauli-channel cloning solutions of Refs. [18, 21], and attacker ancilla size at the one-basis operating point (ε = 0.10). Both at threshold FAB ⩾ 0.87. γ 0.05 0.10 0.15 0.20

Honest FAB 0.9812 0.9622 0.9430 0.9236

S5.

FAE 0.8197 0.7997 0.7751 0.7437

Gates 5 4 4 5

Ancilla 1 qubit 2 qubits 3 qubits

FAE 0.7850 0.7858 0.7858

Gates 6 8 5

KEY-RATE UPPER BOUNDS AND THE EXISTING LITERATURE S5.1.

Constructed attacks as upper bounds

Let ρABE be the state after the eavesdropper’s interaction, with Alice’s sifted bit A uniform. Against collective attacks, the asymptotic one-way rate is the Devetak–Winter quantity [34] r = inf [H(A|E)E − H(A|B)E ] , E∈C

(S1)

in which the infimum is taken over the set C of eavesdropping strategies compatible with the statistics Alice and Bob observe. A proof establishes a lower bound on that infimum by bounding H(A|E) from below for every admissible E. A constructed attack proceeds in the opposite direction, since exhibiting one particular E ⋆ ∈ C evaluates the bound at a single point, and an infimum never exceeds any of its arguments, so that r ⩽ H(A|E)E ⋆ − H(A|B)E ⋆ = 1 − h(Q) − χ(A:E)E ⋆ .

(S2)

The last equality uses H(A|E) = H(A) − χ(A:E) = 1 − χ for a uniform sifted bit and H(A|B) = h(Q) for a binary symmetric reconciliation channel at error rate Q. Every attack exhibited therefore certifies an upper bound on the key rate, and a stronger attack yields a lower upper bound. No feasibility question arises, because E ⋆ is compatible with the observed statistics by construction, the feasibility constraint of the search enforcing that compatibility. The Holevo quantity is computed directly from the simulator. For each basis the attacker’s two conditional memory (0) (1) states ρE and ρE are obtained as marginals of the post-interaction pure state, and       (0) (1) (0) (1) χ = S 12 ρE + 12 ρE − 21 S ρE − 12 S ρE , (S3)

17 averaged over the two sifted bases, with S(·) the von Neumann entropy. Running the outer search against χ in place of FAE , behind the same feasibility constraint, returns the values of Table S3, with χ = h(Q) at every Q tested, so that Eq. (S2) collapses onto r ⩽ 1 − 2h(Q) and the rate is driven to zero at Q = 0.11. Neither the closed form nor the 11% threshold was supplied to the search. Constructive upper bounds of this kind are established practice. Explicit attacks saturate the device-independent collective-attack rate [27–29], attain device-dependent rates for families of imperfect sources [23], and bound deviceindependent rates through convex combinations of local and nonlocal behaviours [30], and entropic upper bounds on device-dependent rates are available in closed form [24–26]. The present construction differs from those works in obtaining the attack by a search over circuits that takes no analytical input, which is what allows the same apparatus to operate on channels and drift processes for which no closed form exists.

S5.2.

Comparison with semidefinite relaxations

To render the comparison with certified methods quantitative, a small Navascués–Pironio–Acín relaxation for the CHSH scenario was implemented directly [10]. Alice and Bob hold dichotomic observables A0 , A1 , B0 , B1 with A2i = Bj2 = I and [Ai , Bj ] = 0. A monomial is a pair of words over the two alphabets, reduced by cancelling adjacent repeated letters, and the moment matrix carries entries Γuv = ⟨u† v⟩ indexed by a monomial set. Moments are taken real, the usual relaxation for CHSH. Requiring Γ ⪰ 0 with Γ11 = 1 and maximising ⟨A0 B0 ⟩+⟨A0 B1 ⟩+⟨A1 B0 ⟩−⟨A1 B1 ⟩ gives the results of Table S6. √ Table S6. The relaxation reproduces Tsirelson’s bound 2 2 [46] at three monomial sets, which validates the implementation. The dimension is the side of the moment matrix, and the unknowns are the number of distinct moments. Solved with SCS [54] at ε = 10−9 on one core. Level 1 1+AB 2

Dimension 5 9 13

S⩽ 2.828427 2.828427 2.828427

Unknowns 13 25 41

Solve time 0.02 s 0.03 s 0.05 s

The quantity of relevance here is the device-independent limit on what the eavesdropper learns, and the Tsirelson bound serves only as a check. Her guessing probability for Alice’s outcome on input x = 0 is computed at a fixed observed CHSH value in the standard formulation, in which the observed behaviour is decomposed into two subnormalised behaviours, one per guess, each required to carry its own positive semidefinite moment matrix, with the two summing to a behaviour of CHSH value S. Maximising the success probability over that decomposition p returns the values of Table S7, which agree with the analytical Pguess (S) = 12 + 12 2 − S 2 /4 to one part in 1010 . Table S7. Device-independent guessing probability at level 1+AB, with two moment-matrix blocks of dimension nine. Agreement with the closed form holds at the solver tolerance, which validates the implementation. S 2.828 2.750 2.600 2.444 2.200

Pguess ⩽ 0.51229 0.66536 0.77839 0.85592 0.94441

Analytical 0.51229 0.66536 0.77839 0.85592 0.94441

S5.3.

Residual 6.9 × 10−10 1.9 × 10−12 7.3 × 10−12 8.8 × 10−11 5.0 × 10−11

Solve time 0.25 s 0.05 s 0.08 s 0.04 s 0.05 s

upper bounds and lower bounds

Semidefinite relaxations of the Navascués–Pironio–Acín hierarchy bound the eavesdropper’s information from above at any Hilbert-space dimension [10, 11], and they return an upper bound without an attack. Converting the guessing probability into the Holevo quantity uses H(A|E) ⩾ Hmin (A|E) = − log2 Pguess , so that χ = 1 − H(A|E) ⩽ 1 + log2 Pguess . At the operational threshold S = τS the guessing-probability relaxation gives χ ⩽ 0.776 and the Acín

18 envelope, restricted to collective attacks, gives χ ⩽ 0.607, whereas the attacks constructed in Sec. IV B attain χ ≈ 0.350 averaged over the operating noise (Table S8). The min-entropy upper bound is looser than the envelope at every S, as it must be, since the min-entropy bounds the conditional von Neumann entropy from below whereas the envelope is the tight bound on the von Neumann quantity itself. A tighter device-independent upper bound would follow from the conditional-entropy relaxation of Ref. [11], which solves a sequence of programmes at one quadrature node each and was not evaluated here. The recomputed envelope at S = τS returns χ ⩽ 0.6069, which reproduces the value quoted in the main text from an independent implementation. The interval between the upper bounds and the lower bound arises for the two reasons given in Sec. IV B, the lower bound being averaged over the operating noise and restricted to a three-qubit preparation, and it does not measure looseness in either upper bound. Table S8. Upper and lower bounds on the eavesdropper’s Holevo information. The first two columns hold without reference to Hilbert-space dimension, the first through the min-entropy and the second as the tight collective-attack bound on the von Neumann quantity, and the third is exhibited by a circuit. The attained value is averaged over the operating noise distribution, which is why it sits furthest below. S 2.828 2.600 2.444

NPA via min-entropy 0.0350 0.6386 0.7755

S5.4.

Acín envelope 0.0021 0.4184 0.6069

Attained by construction — — ≈ 0.350

Distribution of computational cost

The main text records that a relaxation is the cheaper instrument for the static device-independent quantity, and that comparison rests on direct measurement. Enlarging the Bell scenario in the direction that enlarges the moment matrix, namely the number of measurement settings m per party, gives Table S9. Solve time grows as m4.7 and the number of distinct moments as m4.3 at level two, so the relaxation does become expensive, and at eight settings it reaches 42.6 s, which is parity with a single operating point of the circuit search. Table S9. Growth of the relaxation with the number of measurement settings per party, at two monomial sets. Dimension is the side of the moment matrix. The circuit search costs 43–49 s per operating point independently of m, since it optimises over circuits and not over correlations. m 2 3 4 5 6 8

dim 9 16 25 36 49 81

level 1+AB moments 25 100 289 676 1369 4225

time 0.10 s 0.14 s 0.33 s 0.59 s 1.20 s 4.78 s

dim 13 28 49 76 109 193

level 2 moments 41 244 865 2276 4969 16769

time 0.06 s 0.24 s 0.80 s 2.17 s 8.66 s 42.64 s

These figures support parity and nothing stronger. In the CHSH scenario studied here the relaxation is three orders of magnitude cheaper than the search, and a crossover obtained by growing the scenario until the convex problem becomes hard is not an argument for the search. Two observations remain after that qualification. The scaling directions differ, since the relaxation grows with the complexity of the correlation whereas the search grows with the ancilla dimension and the circuit depth, so the two are cheap in different places. In addition, the search returns an explicit attack, an object the relaxation does not produce, and the sequential problem of Sec. IV A requires such objects as its actions.

S5.5.

Comparison with device-independent upper bounds

Two families of upper bounds are established for CHSH-based device-independent key rates. Arnon-Friedman and Leditzky [55] bound the rate in terms of the observed violation alone, using entropic and entanglement-measure

19 arguments that do not refer to any particular attack, which yields a bound holding uniformly over all devices producing that violation. Łukanowski, Balanzó-Juandó, Farkas, Acín and Kołodyński [30] instead construct an explicit adversary, decomposing the observed correlation as a convex mixture of a local part, which the eavesdropper prepares and therefore knows completely, and a nonlocal remainder, so that the key rate is bounded by the weight of the local component. The related result of Ref. [31] uses the same machinery to show that Bell nonlocality alone does not suffice for security of the standard protocols. Both are upper bounds, and the present construction supplies a lower bound beneath them, being closest in approach to the second family while differing in the quantity optimised. A convex-combination attack fixes the form of the adversary, a local-deterministic mixture, and optimises the decomposition weight, whereas the search reported here fixes nothing about the form and optimises over circuits realising the strategy. The two are complementary in an operational sense. A convex-combination bound applies to any device reproducing the correlation and is therefore device-independent in the full sense, whereas the present bound applies to an adversary restricted to the stated ancilla dimension and noise model, so it is the weaker statement, although a physically specified attacker attains it. Where the two overlap, the convex-combination bound should be the tighter, and confirming that on shared CHSH values is the natural first check. Since all three quantities are functions of the CHSH value S, the comparison requires no protocol translation. Each library cell yields an upper bound through Eqs. (S3) and (S2), the bound of Ref. [55] overlays as a closed-form function of S, and the convex-combination bound of Ref. [30] follows from the local weight returned by the linear programme of that work. A crossing at intermediate S would locate correlations for which an explicit quantum strategy of bounded memory improves on the local-mixture adversary. The comparison has not been carried out here, and no claim is made regarding its outcome. One qualification applies. The attacks reported here are constrained to a fixed ancilla dimension, so the upper bound they certify is not device-independent, and a device outside that specification could leak more. The comparison is therefore diagnostic of how much of the device-independent bound is reachable by a quantum adversary with bounded memory, and a large residual gap at a given S would indicate that attaining the device-independent bound at that point requires a larger adversarial memory than the one granted here, not that the bound is loose.

S6.

BENCHMARKING AGAINST NUMERICAL KEY-RATE METHODS S6.1.

Comparison parameters

The method of Winick, Lütkenhaus and Coles [9] is the established route to reliable key rates for device-dependent protocols whose statistics admit no closed form. It bounds the asymptotic collective-attack rate from below by r ⩾

min D(ρAB ∥ ZA (ρAB )) − leakEC ,

ρAB ∈S

(S4)

where S is the set of states compatible with the observed statistics, ZA pinches Alice’s qubit in the key basis, and leakEC = h(QZ ) for one-way reconciliation at the Shannon limit. A practical reconciliation efficiency f > 1 scales that term identically on both sides of the comparison, so it shifts both bounds by the same amount and leaves the gap unchanged. The present work bounds the same rate from above by exhibiting an attack. The two become directly comparable once both are given the same input, taken here to be the per-basis error rates (QZ , QX ) with the eavesdropper held responsible for the whole disturbance, which is the standard conservative convention.

S6.2.

Evaluation of the lower bound

Pauli twirling maps any two-qubit state to a Bell-diagonal one without altering the per-basis error rates or raising the key rate, so the minimisation in Eq. (S4) may be restricted to Bell-diagonal states. Writing the Bell weights as (a, b, c, d) for (Φ+ , Φ− , Ψ+ , Ψ− ) gives QZ = c + d and QX = b + d, and pinching Alice’s qubit removes the coherences between the two blocks the key basis selects, leaving D(ρ ∥ ZA (ρ)) = 1 + h(QZ ) − H(a, b, c, d)

(S5)

in bits, with H the Shannon entropy of the Bell weights. Subtracting the leakage leaves r ⩾ 1 − max H(a, b, c, d), a one-dimensional maximisation in the free parameter d carried out on a grid. The optimum sits at d = QZ QX , so the procedure returns 1 − h(QZ ) − h(QX ), and that identity serves as a check on the numerics without being assumed by them. Each evaluation takes about one second.

20 S6.3.

Evaluation of the upper bound

The attack search of Sec. S2 is run with the feasibility constraint placed on both per-basis rates simultaneously, so that a circuit counts as feasible only when it reproduces (QZ , QX ) to within 2 × 10−3 , and with the objective set to the Holevo information the eavesdropper holds about the key-basis bit alone. Resolving the Holevo quantity per basis is essential here. An attack may hold considerable information about the complementary basis while learning nothing about the key, so averaging the two would credit the eavesdropper with information that never enters the rate and would yield an upper bound below the proved lower bound. The upper bound is then evaluated at the rates the circuit produces, which may differ from the targets within the tolerance, so that what is certified is a statement about the statistics the circuit presents.

Table S10. Constructed attacks against the reliable numerical lower bound of Ref. [9] at matched per-basis error rates. Attacks use a two-qubit ancilla and are matched to the per-basis rates shown. χ(AZ :E) is the information the circuit holds about the key-basis bit and h(QX ) the largest value any attack could hold at that phase error rate. The final columns bound the asymptotic key rate from above, as 1 − h(QZ ) − χ(AZ :E) for the circuit found, and from below by the numerical minimisation. QZ 0.0501 0.0684 0.0895 0.0992

QX 0.0519 0.0320 0.0120 0.0020

χ(AZ :E) 0.2941 0.2043 0.0938 0.0202

h(QX ) 0.2944 0.2043 0.0938 0.0204

S6.4.

Gates 11 5 4 6

r⩽ 0.4191 0.4356 0.4716 0.5135

r⩾ 0.4188 0.4356 0.4716 0.5132

Gap 3 × 10−4 < 10−4 < 10−4 3 × 10−4

Convergence diagnostics

At the two intermediate points, a first pass run at 400 evaluations per candidate and 18 generations returned χ(AZ :E) = 0.1308 against h(QX ) = 0.2040 and 0.0573 against 0.0936, leaving upper bounds above the lower bound by 0.073 and 0.036 in rate. Because the lower bound is a proven lower bound, the discrepancy could lie only in the search. Raising the evaluation budget from 400 to 900 per candidate and the outer loop from 18 to 24 generations closed both gaps to below 10−4 . The converged runs also returned smaller circuits, of five and four gates against the earlier six and eight, consistent with the budget argument of Sec. S2. The comparison supplies the practical argument for computing both bounds. A constructive upper bound on its own cannot distinguish an attack that saturates the truth from one that a limited budget has failed to improve. Placed against a proved lower bound, the same number acquires a convergence criterion, since where the gap closes the search has converged and where it remains open the search requires more budget. Neither method supplies that diagnostic alone, and the diagnostic allows a heuristic search to be reported as a bound.

S6.5.

Relation to noisy-channel key-rate studies

A body of recent work computes key rates for specific noisy channels in place of the abstract statistics considered here. Kish et al. compare discrete- and continuous-variable protocols under phase noise in the thermal-loss channel [56], Mao et al. treat passive continuous-variable operation over a turbulent atmospheric link [57], and Shu et al. obtain rates over noisy channels by a testing-state construction [58]. All three compute achievable rates, so all three lie on the same side of the gap as Ref. [9] and are complementary to the upper bounds reported here. Two obstacles prevent a like-for-like numerical comparison at present. The continuous-variable results are stated for an infinite-dimensional carrier under a Gaussian or near-Gaussian modulation, whereas the search operates on a finitedimensional ancilla, so the two are not evaluated on a common state space. In addition, the channel models differ, since thermal loss and atmospheric turbulence are not Pauli maps, and although the search extends to non-Pauli noise, as Table S5 shows for amplitude damping, it has not been run on either channel. Extending the construction to the thermal-loss channel and placing an upper bound beside the rates of Ref. [56] at matched excess noise and transmissivity is the natural next comparison, and requires no change to the apparatus beyond the channel model.

21 S7.

TRANSLATION OF DISCOVERED CIRCUITS TO EAVESDROPPING STRATEGIES

No property of a discovered attack depends on its expression as a gate sequence. This section provides the translation into the conventional language of channels and measurements, so that the output of the search may be used by methods that take a strategy as input.

S7.1.

Circuit representation as an isometry ⊗n

The search returns a unitary UE (T, θ) acting on the travelling qubit together with an ancilla initialised in |0⟩ a . Fixing the ancilla input defines an isometry   ⊗n (S6) V : HA → HB ⊗ HE , V |ψ⟩ = UE |ψ⟩ ⊗ |0⟩ a , with V † V = I. The map V is the Stinespring dilation [59] of the channel Bob sees, and the eavesdropper’s strategy is fully specified by V , the gate decomposition being one factorisation among many and carrying no physical content.

S7.2.

Kraus operators and induced channels

E Choosing a basis {|ek ⟩}dk=1 for HE , with dE = 2na , gives Kraus operators X † Kk = (IB ⊗ ⟨ek |) V, Kk Kk = I,

(S7)

k

P each a 2 × 2 matrix. Bob’s channelis N (ρ)= k Kk ρKk† and the complementary channel carrying the attacker’s P side information is N c (ρ) = k,l Tr Kl† Kk ρ |ek ⟩⟨el |. For a two-qubit ancilla this gives four Kraus operators of size 2 × 2, a description of at most 32 real parameters that replaces the gate list entirely. The composition with the physical noise process is Λ ◦ N on Bob’s side, while the attacker’s marginal is N c alone, which is the formal statement of the decoupling used throughout Secs. II and S4. The BB84 drift library of Sec. IV B places the channel before the interaction instead, N ◦ Λ, and there the attacker’s marginal depends on the noise. Because the algorithmic architecture treats the ancilla size na as an initialisation parameter, the framework accommodates a larger adversarial dimension dE without structural modification of the solver. S7.3.

Measurements and resulting correlations

The strategy is completed by the measurement the attacker performs after the public announcement. For a prepare(b) (b) and-measure protocol the announcement of basis b selects a two-outcome measurement {M0 , M1 } on HE , and the (0) (1) c b b optimal choice is the Helstrom measurement [15] for discriminating ρE = N ( ψ0 ψ0 ) from ρE , namely the (0) (1) projector onto the positive part of ρE − ρE . Her success probability is then given by Eq. (3), which is how the main text’s figure of merit arises without reference to any circuit. For the entanglement-based case, the same isometry acts on one half of the shared pair, the correlation is 
 ab|xy p(ab|xy) = Tr Aa|x ⊗ Bb|y ρAB with ρAB the post-interaction reduced state, and the attacker retains ρE as classical-quantum side information. A CHSH value and a Holevo quantity follow from these by the Born rule alone. The object handed to a relaxation is thus the triple (ρAB , {Aa|x }, {Bb|y }) together with the Kraus set of Eq. (S7), all in the standard form.

S7.4.

Application as an ansatz

A discovered circuit, translated in this way, is a feasible point for the conventional methods, and three applications follow from the translation. Firstly, a see-saw optimisation over states and measurements requires an initial point, and a discovered circuit supplies one that already meets the constraint, which is material because see-saw optimisation is sensitive to initialisation. Secondly, a lower-bounding computation of the conditional entropy requires a candidate attack against which to check its output, and any separation between the certified bound and the value of an explicit

22 attack localises the region in which the relaxation is loose. Thirdly, a feasibility question of the form “is this correlation attainable at this noise level with an ancilla of this size” is answered affirmatively by exhibiting the circuit, the isometry constituting an explicit witness. In each case the search contributes structure and the relaxation contributes certification.

S8.

DRIFT ENVIRONMENTS, REFERENCE POLICIES AND REPRODUCIBILITY S8.1.

Environment specification

Both environments are episodic with T = 50 rounds. The noise level is initialised from N (µ, σ 2 ) and advanced by p the exact one-round update of Eq. (8), pt+1 = µ + (pt − µ)e−κ + σ (1 − e−2κ )/2κ ξt with ξt ∼ N (0, 1), and clipped to the ranges of Table II. For each library circuit the single-round statistic and reward are tabulated on a grid in p and interpolated linearly. Detection is declared at the end of an episode if the mean of the single-round statistic over its 50 rounds lies below the threshold. The observation comprises the current pt , the three preceding values, the previous action, the mean statistic over the last ten rounds, the mean reward so far and the fraction of rounds remaining. The feasibility mask admits the circuits whose statistic, appended to the preceding nine rounds, keeps the ten-round mean above the threshold, with a slack of 10−3 on E91; the greedy oracle picks the admissible circuit of largest reward under the same rule. In the BB84 environment the bit-flip channel acts on Alice’s state before the attacker’s two-qubit unitary on the travelling qubit and one ancilla, following Ref. [13]; FAB is the mean over the four sifted states of Bob’s matched-basis recovery probability, which gives 1 − p/2 for the passive attacker, and FAE is the corresponding probability for the ancilla measured in the announced basis. The noise-indexed conservative lookup plays the most conservative of the four library levels at the anchor nearest pt , and so selects among six circuits. In the E91 environment the attacker B prepares a three-qubit state on A, B and E, the channel ΛA p ⊗ Λp acts on it, S is evaluated at the settings stored with each cell, and χ is computed for Alice’s Z outcome.

S8.2.

Checkpoint selection and spread

Agent values in Table III are those of the best checkpoint on evaluation. On BB84 the three best strict checkpoints reach 0.7434, 0.7433 and 0.7432, all without detection in 50 episodes, and the three best tolerated checkpoints 0.7477, 0.7463 and 0.7462 at 4%, 14% and 4% detection. A retraining of the strict agent for 5 × 105 steps in a refactored copy of the environment reached 0.7348 at 2% detection, and a policy-gradient agent 0.6687 without detection, so the match between the agent and the greedy oracle on BB84 is a best-case outcome of training, whereas the ordering of Table III is robust to it.

S8.3.

Values computed for this work

The E91 rows marked † in Table III were computed from the released E91 library with an independent reimplementation of the environment, which reproduces the stored (S, χ) value of every library cell to 10−6 . On 2000 episodes (seeds 1000–2999), each of the 27 actions was played in every round, and the best circuit without detection in any episode is the “safe” cell anchored at p = 0.0642, with χ = 0.135; the next is the “safer” cell anchored at p = 0.0428, with 0.125. The greedy oracle reaches 0.345 on the same episodes. The zero-detection upper bound was obtained by backward induction over (t, pt , Et ) on 100 noise levels with a Gaussian transition matrix and a grid of spacing 0.002 in the accumulated excess Et , with terminal value −∞ for ET < 0. Rounding Et+1 up to the grid, which favours the attacker, gives 0.3575, and rounding it down gives 0.3550, so VDP = 0.356 ± 0.001. The dynamic-programming run of the released experiments discretised the accumulated statistic far more coarsely, which is why it both falls below this upper bound and incurs detection. For BB84 the released dynamic programme uses 100 noise levels and 2000 bins of accumulated FAB and incurred no detection in 200 evaluation episodes, and its value 0.7527 is reported unchanged. The best genuinely fixed BB84 circuit could not be evaluated, because the library files of that environment are not in the released artefact; the accompanying script best_fixed_and_dp.py computes it, together with the E91 values above, once they are supplied.

23 S9.

NUMERICAL COST AND REPRODUCIBILITY

All results were produced on commodity CPU hardware without accelerators, the inner-loop arithmetic being dominated by density-matrix simulation of two to four qubits. The BB84 library required roughly 20 CPU-hours across 24 cells, the E91 library 60–100 CPU-hours across 26 cells, and adaptive-attack training 30–50 CPU-hours per protocol across the full policy comparison, for a total near 150–250 CPU-hours. The channel sweeps of Sec. S4, including the per-basis repetition of Sec. S4.1, add about 0.6 CPU-hours, and the semidefinite relaxations of Sec. S5.2 add a few seconds in total. Peak memory stayed below 2 GB. The released artefact contains the search framework, the BB84 and E91/DIQKD simulation harnesses, the sweep scripts, the key-rate and semidefinite-relaxation scripts, the training and evaluation scripts, the analysis notebooks, the random seeds, an environment specification and a top-level script regenerating every reported value from stored results.

S10.

SCOPE AND DUAL-USE CONSIDERATIONS

The circuits reported here are attack strategies on QKD protocols, published openly in accordance with the disclosure norms of academic cryptography. Three considerations limit the realistic risk. Firstly, the experiments run at the analytical reference scale of the public literature, with two-qubit ancillas, idealised Pauli, amplitude-damping and bilateral depolarising channels, and targets that are published bounds [16, 18, 27, 60], and no result exceeds those bounds, so the information-theoretic upper bound constraining a deployed attacker is untouched. Secondly, the distance between a simulated attack in idealised noise and an attack on a fielded link is dominated by physical-layer factors not modelled here, among them detector control, finite-key statistics, decoy-state calibration, source imperfections and authenticated post-processing, which is historically where operationally usable attacks have originated. Thirdly, adaptive eavesdropping under channel drift is the threat model that informs how users choose abort thresholds and recalibration intervals, so characterising what such an attacker extracts serves the defender. The release contains no hardware drivers, side-channel primitives or post-processing attack code.

S11.

NOTE ON CONCURRENT WORK

A preliminary version of this work was presented at QCrypt 2026. During the preparation of this manuscript, we also became aware of independent, concurrent work by Bagunu (2026) [33]. While both studies model adaptive eavesdropping in quantum key distribution as a sequential decision process, their scopes and methodologies differ significantly. Bagunu employs tabular reinforcement learning to modulate a fixed intercept-resend attack against a stationary channel. In contrast, our approach addresses a more advanced threat model: our deep reinforcement learning agent dynamically selects from a library of variationally constructed quantum circuits (where gate topology and rotation angles are jointly optimised) to exploit a continuously drifting channel.

Related documents

• Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift#1157063
• Routing Anonymity and Identifiability of Noisy Quantum Hardware#343475
• Apparatus for quantum key distribution on a quantum network and method using … — Electronics And Telecommunications Research Institute (US10958428B2)#607396
• Secure multi-party communication with quantum key distribution managed by … — Los Alamos National Security, Llc (US8929554B2)#607381
• High-Dimensional Deterministic Secure Quantum Communication with Reed-Solomon Erasure Coding#780978