Quantum Man-in-the-middle Attacks: a Game-theoretic Approach with Applications to Radars

We now introduce the scenario (as in Figure 1) of adversarial quantum detection in which an attacker (She) stands between the target system and detector, intercepts the quantum state $|\varphi\rangle\in\mathcal{H}$ from the target systems and sends out strategically distorted signal $|\varphi^{\prime}\rangle\in\mathcal{H}$ to the detector to undermine his performance. We assume that the detector is passive and ‘naive’ about the distortion and designs his optimal measurement operation as if the quantum state $|\varphi^{\prime}\rangle$ were directly generated from the target system. Upon receiving $|\varphi^{\prime}\rangle$, the detector designs an optimal decision rule $\hat{\delta}^{*}:\mathcal{H}\rightarrow[0,1]$ by measuring the quantum state $|\varphi^{\prime}\rangle$ from attacker with measurement, denoted as $\Pi_{1}$ as follows:

Thus we let the detector’s cost function $u_{B}:\mathcal{V}\times\mathcal{S}\times\mathcal{S}\rightarrow\mathbb{R}$ be the Bayesian risk, which is a weight sum of counterfactual miss rate and counterfactual false alarm rate in (2) as if the quantum state were untainted:

which leads to his optimal measurement $\Pi^{*}_{1}$ as in (3). The attacker, after observing the true hypothesis ($H_{1}$ or $H_{0}$) on the target systems, obtains the quantum state $|\varphi\rangle\in\mathcal{H}$. Based on his observation on the true density state ($\rho_{1}$ or $\rho_{0}$), the attacker designs quantum noisy operations ${E}^{1},E^{0}\in B(\mathcal{H})$ acting upon the received state $|\varphi\rangle$ to create a distorted quantum state $|\varphi^{\prime}\rangle$. According to [11], we formulate the resulting noisy density operators $E^{0},E^{1}$ as the ‘operator-sum’ representation as follows:

We could treat the space $\mathcal{E}$ in (5) as the attacker’s action space. Yet we argue through the following lemma that it is equivalent to characterize the attacker’s strategies as a pair of density operators $\rho^{\prime}_{1},\rho^{\prime}_{0}$.

Knowing detector’s strategy (3) the detector designs her optimal strategies $\rho^{\prime*}_{1},\rho^{\prime*}_{0}$ by minimizing her utility function $u_{A}:\mathcal{S}\times\mathcal{S}\times\mathcal{V}\rightarrow\mathbb{R}$ as follows:

where we adopt the Von-Neumann relative entropy [11] for any two density operators $\nu_{1},\nu_{0}\in\mathcal{S}$ as $S(\nu_{1}\|\nu_{0}):=\text{Tr}(\nu_{1}(\ln\nu_{1}-\ln\nu_{0}))$, and $\Pi^{*}_{1}$ is the solution to detector’s optimization problem (4).

In the objective function of (6), the attacker trades off between undermining the genuine detection rate (the first term) and minimizing the loss incurred from distorting quantum states through noisy gates (the second term). Such a loss term originates from the detector’s awareness of the distortion if the received quantum states deviate significantly from the ‘normal’ ones. The parameter $\lambda\in\mathbb{R}_{+}$ is a regularization parameter characterizing the attacker’s intentions.

Summarizing the formulations raised in (4) and (6), we arrive at the game between passive quantum detector and the attacker $\mathcal{G}$, which is a Stackelberg game [8] defined as follows.

We now state the attacker’s optimal design of distorted mixed densities $\rho^{\prime*}_{1},\rho^{\prime*}_{0}$ into the following proposition:

We have several remarks on the attacker’s and the detector’s optimal strategies. First, as $\lambda\rightarrow 0$, the penalty for distorting the mixed state vanishes, and the attacker manages to suppress all the components in $\Pi_{1}$. On the other hand, when $\lambda\rightarrow\infty$, the attacker’s optimal strategies $\rho^{\prime*}_{1}=\rho_{1}$, meaning the attacker does not distort the original density operator at all because the penalty for distorting the mixed states becomes infinitely high.

Secondly, we can interpret the attacker’s optimal manipulation of mixed density states as in Proposition (1) as the attenuation of the components of the original quantum state $\rho_{1}$ upon the subspace spanned by the base states $\{|\eta_{i}\rangle\}_{i}$ lying in the region of detection. Applying Baker-Campbell-Hausdorf formula to the nominator of the RHS, of (9) we obtain

where “$\dots$” refers to additional terms involving iterative Poisson brackets of $\ln\rho_{1}$ and $\frac{1}{\lambda}\Pi_{1}$. The product $\rho_{1}e^{-\frac{1}{\lambda}\Pi^{*}_{1}}$ indicates the attenuation of the original mixed state $\rho_{1}$ on the subspace controlled by the parameter $\frac{1}{\lambda}$. The the remaining factor $e^{-\frac{1}{2\lambda}[\ln\rho_{1},\Pi_{1}]+\dots}$, where the commutator $[\ln\rho_{1},\Pi_{1}]$ is included in the exponent, implies that the quantum uncertainty principle also affects attacker’s optimal strategies.

Thirdly, when $\rho_{1},\Pi^{*}_{1}$ commute (a sufficient condition would be $\rho_{1},\rho_{0}$ commute), the attacker’s optimal strategies (8)(9) reduce to the strategies in classical Stackelberg hypothesis testing games as formulated in Section II of [12].

We can now compute the genuine detection rate $\bar{P}_{D}:\mathcal{V}\rightarrow[0,1]$ under the attacker’s manipulation:

where $\rho^{\prime*}_{1}$ is obtained from (9). We have the following statement:

Proposition 2 characterizes an upper and lower bound of the genuine detection rate under strategically designed quantum operations.

Proof of Claim 1. Since we assume $\text{dim}(\mathcal{H})=d$, we know the distorted density operator $\rho^{\prime}_{1}$ has $d^{2}$ degrees of freedom. Since $\rho^{\prime}_{1}\in\mathcal{S}$, we can parameterize them in the basis $|\varphi_{i}\rangle$ as well with the coefficients $a^{\prime}_{ij}$. We can express them in terms of the basis $\{|\varphi_{j}\rangle\}^{d}_{1}$ as follows:

The impact of the quantum operations upon $\rho_{1}$can be characterized by the change of coordinates of $\rho_{1}$ into the ones of $\rho^{\prime}_{1}$ under the basis $|\varphi_{i}\rangle\langle\varphi_{j}|$. Now the operations $\{E^{1}_{k}\}$ turn the coordinates from $a_{ij}$ into $a^{\prime}_{ij}$, respectively. Under the representation (or basis) of $\{|\varphi_{j}\rangle\}^{d}_{1}$, we can select the matrix representation of $E^{1}_{k},E^{0}_{k}$, where $k=1,2,\dots,d^{2}$ as follows:

$(E^{1}_{k})_{i(k),j(k)}=\sqrt{\frac{a^{\prime}_{ij}}{a_{ij}}}\;$ where $i(k),j(k)$ refers to the row index and column index corresponding to the subscript $k$. The rest of the entries for $E^{1}_{k}$ are all zero. Then it is clear to verify that

as claimed.

Also, we have the following conclusion.

Proof of claim 2. Our goal is to prove that $\rho^{\prime}_{1}$ obtained in (18) meets the requirements of a density operator, that is, it has a trace of $1$; it is positive definite; it is symmetric (or Hermitian). We first of all notice

Noticing that $\sum_{k=1}^{d^{2}}{E^{1\dagger}_{k}}E^{1}_{k}=\mathbf{1}$, we conclude

Next we prove symmetry of $\rho^{\prime}_{1}$. For convenience we denote $\rho_{ij},\rho_{ij}$ as the matrix entries of $\rho_{1},\rho^{\prime}_{1}$ respectively. It suffices to assume that every matrix $E^{1}_{k}$ is written in the form similar as the one in (16). We want to show that

is also symmetric for all choices of $i_{1},i_{2},j_{1},j_{2}\leqslant d$. Here $E_{i_{1}j_{1}}$ is a $d$ by $d$ matrix where every entry is zero except $(i_{1},j_{1})$. By computing entry-wisely, we notice that

Similarly,

Substituting (22) and (23) into (21) and considering $\rho_{i_{1}i_{2}}=\rho_{i_{2}i_{1}}$ due to symmetry of $\rho_{1}$, we get $\omega(j,k)$ is indeed symmetric. Since every matrix can be written as a linear combination of $\{E_{j}\}_{1\leqslant j\leqslant d^{2}}$, we get that $E^{1}_{k}\rho_{1}E^{1}_{k}$ is symmetric for all $1\leqslant k\leqslant d^{2}$. As a consequence, $\rho^{\prime}_{1}$ as expressed in (14) is symmetric too.

Finally we can show that $\rho^{\prime}_{1}\geqslant 0$. Denote $\gamma_{k}=E^{1}_{k}\rho_{1}E^{1\dagger}_{k}$. Since $\rho_{1}\geqslant 0$, we know by the property of positive definite matrix [18] that $\gamma_{k}$ are all positive definite matrices for all $k$. Again by the property of closure under additivity we conclude that $\rho^{\prime}_{1}=\sum_{k=1}^{d^{2}}{\gamma_{k}}$ is a positive definite operator.

Summarizing claim 1 and claim 2, we conclude that it is equivalent to characterize the attacker’s action by $E^{1}\in B(\mathcal{H})$ or by $\rho^{\prime}_{1}\in\mathcal{S}$. Similar arguments can be made regarding $E^{0}\in B(\mathcal{H})$ and $\rho^{\prime}_{0}\in\mathcal{S}$. This concludes the proof of lemma 1.   

We make the following assumptions:

The assumptions above make sense since $\rho_{1}$ is positive definite, symmetric operator. Also, the detector’s optimal strategy $\Pi^{*}_{1}$ is a projection operator with finite rank. We can now state the proof.