{"id":"58aa17ac-758a-4a6d-941f-161a227fabae","arxiv_id":"2607.14469","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A perturbation bound for maximal quantum leakage is proposed, but its central proof rests on a false projector-trace inequality.","lead":"Maximal quantum leakage measures how much an adversary can learn from a noisy quantum encoding of a secret. This paper claims a worst-case bound on how that leakage changes under small perturbations, but the proof of the central bound has a demonstrable gap.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's proof fails at the step 'rank of Σ_x P_x ≤ min{|X|,d}': non-orthogonal projectors make both the rank and trace claims false, so the min{|X|,d}/2 Lipschitz constant is unproven.","rationale":"I read the paper in good faith. The central claim is Theorem 1, a Lipschitz bound for 2^Q under trace-distance perturbations. The reader's objection is correct and load-bearing: the proof's last step, where the min{|X|,d}/2 constant emerges, relies on a false rank/trace assertion for a sum of non-orthogonal projectors. I independently verified the explicit counterexample with d=3 and |X|=2. This is an internal algebraic error in the proof, not a disagreement with consensus. The tightness example uses orthogonal rank-one projectors, where the bound happens to hold, so it does not cover the general case; the numerical looseness study is irrelevant to the proof gap. The theorem may be true, but the argument as written does not establish it. Because Corollaries 1 and 2 depend directly on Theorem 1, the paper's central results are unsupported. I therefore see no reason to change the reader's REJECT verdict.","tokens_in":7531,"tokens_out":22645,"duration_ms":209155,"concrete_test":"Directly verify the disputed assertion: set d=3, |X|=2, P_1=diag(1,1,0), P_2=diag(1,0,1). Then Tr(P_1+P_2)=4 and rank(P_1+P_2)=3, both exceeding min(2,3)=2. These are valid positive spectral projectors of Hermitian trace-zero differences, so the proof's final step cannot be correct. To test whether Theorem 1 itself survives, optimize |2^{Q_ρ}−2^{Q_ρ'}| over d=3, |X|=2 ensembles with ||ρ_x−ρ'_x||_1=ε by SDP; a violation of the ε/2·2 bound would refute the theorem, while absence would show only that a new proof is needed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central proof bounds D by (ε/2) Tr(Σ_x P_x) and then asserts that Σ_x P_x has rank at most min{|X|,d}, from which D ≤ (ε/2)·min{|X|,d} is concluded (Section III-A). This is invalid in two ways. First, the rank bound is false when |X| < d: e.g., d=3, |X|=2, P_1=|0⟩⟨0|+|1⟩⟨1|, P_2=|0⟩⟨0|+|2⟩⟨2| gives rank(P_1+P_2)=3 > 2. Second, even when the rank bound happens to hold, the trace is not controlled: Tr(Σ_x P_x)=Σ_x rank(P_x), which can exceed both d and |X| (the same example gives trace 4). Since the preceding bound Tr(P_x E_x) ≤ Tr(P_x)=rank(P_x) is the only route to the constant, the theorem's min{|X|,d}/2 factor is not established. Corollaries 1 and 2 inherit this gap because they invoke Theorem 1. The tightness example and numerical study concern orthogonal rank-one projectors and do not repair the general non-orthogonal case.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the robustness of maximal quantum leakage (MQL) under perturbations of the quantum encoding. Its main result, Theorem 1, claims a Lipschitz-type continuity bound: if each state in an ensemble is perturbed by at most ε in trace distance, then the change in 2^{Q_ρ} is bounded by (ε/2)·min{|X|,d}. The authors provide an example that attains the bound in the regime |X| ≤ d, and derive corollary bounds in terms of quantum fidelity and quantum relative entropy via standard inequalities. Numerical experiments are used to illustrate that the fidelity- and relative-entropy-based bounds are loose in practice. The paper is clearly written and the result, if properly established, is a clean stability statement for an operational quantum leakage measure.","tokens_in":7832,"tokens_out":29286,"duration_ms":236608,"significance":"If Theorem 1 is correctly established, it provides a simple, interpretable Lipschitz constant for MQL as a function of the encoding states, depending only on alphabet size and Hilbert-space dimension. The tightness example is elegant and correctly saturates the bound when |X| ≤ d. The corollaries are straightforward but connect the result to physically natural perturbation metrics. A strength of the paper is its transparency: it builds directly on the prior exact characterization of MQL in [12]. However, the proof of the main theorem contains a genuine mathematical error in the step that generates the min{|X|,d} constant. I verified that the theorem statement is nevertheless true, via a short alternative grouping argument, so the gap is repairable rather than fatal.","major_comments":[{"comment":"The final step of the proof is invalid. The text asserts that Σ_x P_x has rank at most min{|X|,d} and concludes D ≤ (ε/2)min{|X|,d}. The rank bound is false: for d=3, |X|=2, P_1=|0⟩⟨0|+|1⟩⟨1| and P_2=|0⟩⟨0|+|2⟩⟨2|, rank(Σ_x P_x)=3>2. Moreover, even a valid rank bound would not control the trace, since Tr(Σ_x P_x)=Σ_x rank(P_x) (trace is 4 in the same example). The constant min{|X|,d} is produced by exactly this step, so the proof as written does not establish Theorem 1, and Corollaries 1–2 inherit the gap. I verified that the theorem is true: for fixed F, f(F)−g(F) ≤ Σ_y max_x Tr(A_x F_y) = Σ_x Tr(A_x G_x) with G_x = Σ_{y:x_y=x}F_y; then Tr(A_x G_x) ≤ Tr(A_x^+) ≤ ε/2 and also ≤ (ε/2)Tr(G_x), giving (ε/2)min{|X|,d}. Replacing the faulty block with this argument would repair the proof.","section":"Section III-A, proof of Theorem 1"},{"comment":"The tightness example only treats |X| ≤ d, so it demonstrates attainability only when min{|X|,d} = |X|. Since Theorem 1 is stated for all |X| and d, the claim that the bound is tight in general requires a construction for |X|>d as well; such a construction exists (for instance, d=2, |X|=3 with ρ_x=I/2, ρ'_1=I/2+(ε/2)σ_z, ρ'_2=I/2−(ε/2)σ_z, ρ'_3=I/2, and the projective measurement in the eigenbasis of σ_z gives 2^{Q_ρ'}=1+ε). The authors should add an example for this regime or explicitly restrict the tightness statement.","section":"Section III-A, tightness example"}],"minor_comments":[{"comment":"Equations are unnumbered, which makes precise cross-referencing difficult.","section":"Throughout"},{"comment":"Typo: 'decomposition decomposition'. Also, the Jordan–Hahn decomposition is cited to a probability text [20]; a matrix-analysis reference would be more appropriate.","section":"Section III-A, proof of Theorem 1"},{"comment":"The wording 'for any x ∈ X and ε > 0, if ||ρ_x−ρ'_x||_1 ≤ ε' should read 'if ||ρ_x−ρ'_x||_1 ≤ ε for all x ∈ X', since ε is a uniform perturbation radius.","section":"Theorem 1"},{"comment":"The phrasing 'some ε > 0' is unclear; suggest 'for some ε > 0 such that 1−ε < F(ρ_x,ρ'_x) ≤ 1 for all x'.","section":"Corollary 1"},{"comment":"Figs. 1 and 2 appear as captions only; the numerical section should state the optimizer tolerance and sample sizes so the reported maximum deviations are reproducible.","section":"Section III-D"},{"comment":"The MQL characterization and the bound 2^{Q_ρ} ≤ |X| are imported from [12]; these should be listed as explicit preliminary facts for self-containedness.","section":"Section II-C"}],"recommendation":"major_revision","confidential_remarks":"The reader's report recommended rejection based on the rank/trace error. I agree the printed proof is invalid, but the theorem is correct: a short grouping argument proves the same bound. The error is therefore locally repairable and I recommend major revision rather than rejection. Note also that the tightness example covers only |X| ≤ d, another repairable gap. The reliance on the author's own [12] for the definition and for 2^{Q_ρ} ≤ |X| is a normal use of prior work, not circular."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper asks a sensible question—how maximal quantum leakage behaves under small perturbations of the encoding—and the proposed answer is likely correct. But the proof of the main theorem has a concrete mathematical error that is not cosmetic. The step \"Since the operator Σ_x P_x has rank at most min{|X|, d}\" is false: the P_x are projectors onto the positive eigenspaces of ρ_x − ρ'_x, and these subspaces need not be mutually orthogonal. A sum of two rank-(d−1) projectors in d dimensions can easily have rank exceeding min{|X|, d} (e.g., d=3, |X|=2, with P_1 and P_2 as the complementary rank-2 projectors from the stress-test note). The trace claim is even worse: Tr(Σ_x P_x) = Σ_x rank(P_x), which can exceed both |X| and d. Since the bound D ≤ (ε/2) Tr(Σ_x P_x) and the rank claim together produce the min{|X|, d}/2 constant, the theorem is unproven as written. Corollaries 1 and 2 inherit the gap because they invoke Theorem 1. The tightness construction and the numerical study use orthogonal rank-one projectors, so they do not cover the general non-orthogonal case.\n\nWhat is genuinely new is the formulation: I do not know of a continuity bound for worst-case maximal quantum leakage in the prior literature, and the fidelity and relative-entropy corollaries are natural and correctly derived from Theorem 1—they would be useful if the trace bound held. The paper is clearly written, and the numerical section is honest about the looseness of the derived sufficient conditions. The reliance on Farokhi's earlier characterization [12] for the definition and the 2^Q ≤ |X| bound is legitimate, since that is the prior result being perturbed.\n\nThe fix is not obvious. One could try to bound D more carefully using the Jordan-Hahn decomposition and the structure of POVMs, but the current route through Σ Tr(P_x E_x) with a rank argument does not work. Perhaps a different inequality could salvage the min{|X|, d} factor, but the submitted proof does not deliver it.\n\nThe paper deserves a serious referee: the question is real, and the result is plausibly true. But based on this version, the authors should revise the proof or provide an alternative argument before publication. Reject in current form, with a clear path to resubmission.","headline":"The continuity bound is plausible and the question is well placed, but Theorem 1's proof relies on a false rank bound for a sum of non-orthogonal projectors, so the central result is not established as written.","tokens_in":8329,"tokens_out":2023,"would_cite":false,"duration_ms":17994,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P45","94A17"],"pacs":[],"model":"deepseek-v4-flash","headline":"Small perturbations of quantum encodings can change maximal quantum leakage only linearly.","keywords":["maximal quantum leakage","quantum encoding perturbation","trace distance continuity bound","worst-case guessing advantage","POVM","quantum fidelity","quantum relative entropy","stability analysis"],"falsifier":"Take d=3, |X|=2, and the four diagonal states ρ1=diag(0.4,0.4,0.2), ρ1'=diag(0.2,0.2,0.6), ρ2=diag(0.4,0.2,0.4), ρ2'=diag(0.2,0.6,0.2), each pair at trace distance 0.8. The positive-eigenspace projectors are P1=diag(1,1,0) and P2=diag(1,0,1), so Tr(P1+P2)=4 > 2 = min{|X|,d}; this single calculation disproves the proof's key lemma, so any valid proof of the claimed bound must replace that step.","tokens_in":7383,"feed_emoji":"🔐","tokens_out":9185,"duration_ms":80588,"temperature":0.7,"pith_summary":"This paper asks how a worst-case quantum information-leakage measure — maximal quantum leakage — responds when the quantum states encoding a secret are slightly wrong. Its central claim is a tight continuity bound: if each ideal state differs from its perturbed version by at most ε in trace distance, then the adversary's multiplicative guessing advantage can change by no more than (ε/2)·min{|X|,d}, where |X| is the alphabet size and d the Hilbert-space dimension. The bound is shown to be attainable by an explicit pair of ensembles, and the same argument yields looser sufficient conditions based on quantum fidelity and quantum relative entropy. Establishing such stability matters because real quantum devices never prepare states exactly as intended, so leakage guarantees must tolerate implementation errors.","feed_headline":"Small state errors shift quantum leakage at most linearly","feed_subtitle":"Worst-case adversary guessing advantage changes by at most ε·min{|X|,d}/2 when states drift by ε in trace distance.","key_machinery":"The engine of the proof is the identity 2^{Q_ρ} = sup_{POVM {F_y}} Σ_y max_x Tr(ρ_x F_y), which converts the leakage measure into an optimization over measurements. Perturbation is then analyzed via the Jordan–Hahn decomposition of each Hermitian difference ρ_x − ρ'_x = Δ_x^+ − Δ_x^−, with Tr(Δ_x^+) = Tr(Δ_x^−) ≤ ε/2. The step that produces the clean linear constant is the assertion that the projectors P_x onto the positive eigenspaces of the differences satisfy Tr(Σ_x P_x) ≤ min{|X|,d}; this is the load-bearing step that fixes the bound's dependence on the alphabet size and dimension.","core_discovery":"In the paper's own terms, the discovery is that maximal quantum leakage is stable under small perturbations of the encoding: for two ensembles with the same alphabet and Hilbert space satisfying ||ρ_x − ρ'_x||_1 ≤ ε for every x, the variation of the leakage exponent satisfies |2^{Q_ρ} − 2^{Q_ρ'}| ≤ (ε/2)·min{|X|,d}. Here 2^{Q_ρ} is the optimal worst-case multiplicative increase in guessing probability, computed as the supremum over POVMs of Σ_y max_x Tr(ρ_x F_y). The proof decomposes each difference ρ_x − ρ'_x into positive and negative parts and bounds the contribution of the positive parts; an explicit construction with states on a d-dimensional space attains equality, indicating that the","pith_inferences":["The projector-trace assertion used to obtain the min{|X|,d} constant is not valid when the positive eigenspaces of the state differences overlap; a corrected proof or a counterexample would determine whether the stated constant survives or needs a geometry-dependent correction.","One can test the claimed bound numerically by sampling random ensembles whose state differences have heavily overlapping positive eigenspaces and computing the leakage exponent; any pair violating the bound would force a restatement of the theorem.","The same perturbation framework could be adapted to neighbouring operational leakage measures, such as pointwise maximal leakage or Rényi variants, where the worst-case guessing advantage takes a different functional form."],"forward_implications":["If Theorem 1 is correct, a quantum device whose state preparations are ε-accurate in trace distance can change an adversary's multiplicative guessing advantage by at most (ε/2)·min{|X|,d}.","The saturation example implies that the dependence on |X| and d in the bound cannot be improved in general.","The fidelity and relative-entropy corollaries give easy-to-check sufficient conditions: squared fidelity above 1−ε or relative entropy below ε yield leakage changes bounded by √ε·min{|X|,d} and √(2 ln 2 ε)/2 · min{|X|,d}, respectively.","The numerical experiments indicate that the fidelity- and relative-entropy-based sufficient conditions can be loose, so trace-distance-based control is preferable when available."],"fun_headline_variants":["Small state errors shift quantum leakage at most linearly","Quantum leakage perturbation bound is tight and linear","Worst-case quantum leakage changes at most ε·min{|X|,d}/2","Leakage advantage over adversary varies at most linearly with drift","Maximal quantum leakage has linear sensitivity to encoding noise"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The proof's central constant rests on the assertion that the sum of the positive-eigenspace projectors of the state differences has trace at most min{|X|,d}; this assertion is not true in general, so the theorem is not established as written.","fun_headline_variants_meta":{"raw":{"variants":["Small state errors shift quantum leakage at most linearly","Quantum leakage perturbation bound is tight and linear","Worst-case quantum leakage changes at most ε·min{|X|,d}/2","Leakage advantage over adversary varies at most linearly with drift","Maximal quantum leakage has linear sensitivity to encoding noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1315,"prompt_tokens":673,"completion_tokens":642,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":417,"completion_tokens_details":{"reasoning_tokens":559}},"tokens_in":417,"tokens_out":642,"duration_ms":7221,"temperature":1.0,"reasoning_tokens":559,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T02:01:14.324960+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take d=3, |X|=2, and the four diagonal states ρ1=diag(0.4,0.4,0.2), ρ1'=diag(0.2,0.2,0.6), ρ2=diag(0.4,0.2,0.4), ρ2'=diag(0.2,0.6,0.2), each pair at trace distance 0.8. The positive-eigenspace projectors are P1=diag(1,1,0) and P2=diag(1,0,1), so Tr(P1+P2)=4 > 2 = min{|X|,d}; this single calculation disproves the proof's key lemma, so any valid proof of the claimed bound must replace that step.","supporting_citations":[],"review_version":1}