Adaptive BB84 Eavesdropping Models

• Adaptive BB84 eavesdropping is a suite of attack models where Eve exploits side-channel information, timing, and disturbance budgeting to condition her measurement strategy.
• It encompasses techniques from memoryless immediate measurements to quantum-memory-based and sequential feedback adaptations, each yielding distinct QBER thresholds and security implications.
• These methods directly impact BB84 security analysis by demonstrating trade-offs between attack strength and detection risk, informing both protocol design and implementation.

Searching arXiv for primary and related papers on BB84 eavesdropping models, adaptive attacks, and side-channel/general-attack security. Adaptive BB84 eavesdropping denotes a family of BB84 attack models in which Eve exploits side information, timing, disturbance budgets, or feedback to condition either her measurement or her attack strength. In the literature, this label does not refer to a single canonical construction. It can mean a memoryless immediate measurement whose classical decoding is deferred until basis revelation, an individual attack with quantum memory and delayed basis-dependent readout, a continuously tunable partial-measurement or cloning attack, a side-channel-conditioned attack that changes the signal interaction after learning source leakage, or a sequential policy that updates qubit-by-qubit from public QBER feedback (Bocquet et al., 2011, Pigott et al., 2024, Bagunu, 22 Jun 2026).

1. Terminology and attack taxonomy

In the papers considered here, “adaptive” has several distinct technical meanings. The narrowest meaning is the one used for memoryless BB84: Eve must measure immediately, but she designs a single POVM whose outcomes can later be reinterpreted after sifting. A broader meaning appears in individual attacks with quantum memory: Eve stores a probe or clone until basis reconciliation and then performs the now-correct measurement. A still broader operational meaning appears in variable-strength attacks, where Eve tunes an attacked fraction or coupling parameter to fit an allowable disturbance budget. The strongest practical meaning is sequential feedback adaptation, where Eve conditions future attack decisions on publicly revealed QBER statistics (Bocquet et al., 2011, Idan et al., 30 Sep 2025, Bagunu, 22 Jun 2026).

Usage of “adaptive”	Mechanism	Representative result
Memoryless BB84	Immediate POVM, later classical decoding using $\Theta$	secure up to $Q_{\max}\approx 15.4\%$ (Bocquet et al., 2011)
Individual attack with quantum memory	Store probe/clone, measure after basis revelation	$$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$ in ideal phase-covariant cloning (Pigott et al., 2024)
Variable-strength attack	Tune attacked fraction or coupling	$Q=\frac{\epsilon}{4}$, $G=\frac{1}{2}+\frac{\epsilon}{4}$ (Idan et al., 30 Sep 2025)
Sequential feedback attack	Per-qubit pass/intercept decisions from checkpoint QBER	detection $0.28\%\pm0.27\%$ at $\mu_{ch}=1\%$ in simulation (Bagunu, 22 Jun 2026)
Side-channel-conditioned attack	Measure leakage, then condition filtering/cloning	soft filtering with two-state cloning overtakes phase-covariant cloning near $V\approx 0.4$ (Babukhin et al., 2022)
General/coherent-attack setting	Security proof against arbitrary attacks in the decoy-state model	$1{,}128{,}172$ bps at $50$ km under general attacks (Lucamarini et al., 2015)

This diversity matters because thresholds that are valid in one model generally do not transfer to another. A memoryless adversary, an individual adversary with quantum memory, and a general coherent adversary occupy different points in the BB84 security hierarchy. A plausible implication is that discussions of “adaptive BB84 eavesdropping” are meaningful only if the resource model—especially quantum memory, side-channel access, and public-feedback access—is specified explicitly.

2. Memoryless adaptation without quantum memory

The most precise use of the term in the BB84 literature is the memoryless attack analyzed in “Optimal eavesdropping on QKD without quantum memory” (Bocquet et al., 2011). Alice runs BB84 in prepare-and-measure form, equivalently analyzed through the entanglement-based picture. Eve interacts independently with each transmitted qubit by an ancilla and a unitary $Q_{\max}\approx 15.4\%$0, but she has no quantum memory: after the interaction she must measure her ancilla immediately, before basis reconciliation. By the time sifting occurs she holds only a classical outcome $Q_{\max}\approx 15.4\%$1, not a quantum system.

Because the post-interaction object is already classical on Eve’s side, the secret-key analysis is written with a Csiszár–Körner-style formula rather than a Devetak–Winter one. Per signal,

$Q_{\max}\approx 15.4\%$2

so the key fraction is

$Q_{\max}\approx 15.4\%$3

Here Alice and Bob share a binary symmetric channel with

$Q_{\max}\approx 15.4\%$4

and the BB84 disturbance is the QBER $Q_{\max}\approx 15.4\%$5.

For BB84, symmetry reduces the admissible Alice–Bob state to a Bell-diagonal family,

$Q_{\max}\approx 15.4\%$6

with $Q_{\max}\approx 15.4\%$7. Eve is assigned a purification of this state and must immediately measure her subsystem with a POVM $Q_{\max}\approx 15.4\%$8. The adaptive element is not delayed quantum measurement, which is forbidden, but basis-conditioned classical decoding. Following the state-discrimination construction used in the paper, the relevant POVM can be taken to have four outcomes $Q_{\max}\approx 15.4\%$9. Once the basis $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$0 is publicly announced, Eve outputs $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$1 as her guess. This is adaptive only in the sense that the POVM is optimized in anticipation of future side information.

The optimization is over the Bell-diagonal parameter $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$2 and the immediate POVM, with semidefinite constraints

$$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$3

Numerically, the optimum reproduces the earlier Lütkenhaus BB84 result and yields the memoryless-security threshold

$$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$4

The same paper notes that BB84 is secure up to about $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$5 against collective attacks and about $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$6 against individual attacks with quantum memory, so the memoryless restriction raises the tolerable QBER relative to stronger adversaries, but does not improve unconditional security (Bocquet et al., 2011).

Two clarifications are central. First, intercept-resend is only one memoryless strategy; the optimized attack is strictly more general because Eve may use arbitrary ancilla interactions and arbitrary immediate POVMs. Second, the result is model-tight but assumption-sensitive: if Eve can store quantum states until basis revelation, the memoryless threshold no longer applies.

3. Delayed measurement, optimal individual attacks, and cloning

In the standard individual-attack model, Eve may attack each qubit separately but postpone measurement until after basis revelation. This requires quantum memory and is stronger than the memoryless model. The modern experimental representation of this regime is asymmetric phase-covariant cloning on equatorial BB84 states, which the 2024 study writes in the $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$7 and $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$8 bases rather than the usual $$e_B < \frac{1}{2}-\frac{\sqrt{2}}{4}\approx 0.14645$$9 form (Pigott et al., 2024).

The asymmetric phase-covariant cloner allocates different clone qualities to Bob and Eve. For shrinking factors $Q=\frac{\epsilon}{4}$0, the optimized tradeoff is

$Q=\frac{\epsilon}{4}$1

equivalently

$Q=\frac{\epsilon}{4}$2

with Bob’s and Eve’s error rates

$Q=\frac{\epsilon}{4}$3

and

$Q=\frac{\epsilon}{4}$4

The corresponding mutual informations are

$Q=\frac{\epsilon}{4}$5

A secure key is possible when $Q=\frac{\epsilon}{4}$6, which for this attack gives

$Q=\frac{\epsilon}{4}$7

At this threshold the paper states

$Q=\frac{\epsilon}{4}$8

The asymmetry angle $Q=\frac{\epsilon}{4}$9 provides an explicit attack knob through

$G=\frac{1}{2}+\frac{\epsilon}{4}$0

so the attack is adaptive in the practical sense of choosing a disturbance-compatible operating point rather than in a real-time feedback sense (Pigott et al., 2024).

The structural theory of such optimal individual attacks is sharpened in “Revisiting optimal eavesdropping in quantum cryptography,” which proves that the optimal BB84 interaction is unique up to orthogonal rotation of the underlying probe basis (Acharyya et al., 2016). In that framework,

$G=\frac{1}{2}+\frac{\epsilon}{4}$1

and in the eigenbasis $G=\frac{1}{2}+\frac{\epsilon}{4}$2 of Eve’s optimal Helstrom-type measurement operator, the optimal interaction always has the canonical coefficient pattern

$G=\frac{1}{2}+\frac{\epsilon}{4}$3

$G=\frac{1}{2}+\frac{\epsilon}{4}$4

This result narrows the design space of optimal delayed-measurement attacks: the genuine degree of freedom is the disturbance parameter, while remaining basis changes are gauge-equivalent rotations.

Experimentally, the 2012 photonic cloning attack implements an optimal quantum cloner with a two-level probe and delayed measurement after basis reconciliation (Bartkiewicz et al., 2012). For BB84 it identifies the cloner parameters

$G=\frac{1}{2}+\frac{\epsilon}{4}$5

for which

$G=\frac{1}{2}+\frac{\epsilon}{4}$6

and the theoretical secret-key rate

$G=\frac{1}{2}+\frac{\epsilon}{4}$7

The same paper distinguishes this from the lower crossing

$G=\frac{1}{2}+\frac{\epsilon}{4}$8

which occurs at

$G=\frac{1}{2}+\frac{\epsilon}{4}$9

This distinction helps explain why different BB84 individual-attack thresholds coexist in the literature: they correspond to different criteria.

4. Variable-strength and sequentially learned adaptation

A distinct line of work treats BB84 eavesdropping as a continuously tunable control problem. In “Probeless vs Probe-Based Variable-Strength Eavesdropping in Quantum Key Distribution,” the probe-based model is a weak measurement with

$0.28\%\pm0.27\%$0

while the probeless model attacks only a tunable fraction of pulses (Idan et al., 30 Sep 2025). In the latter case,

$0.28\%\pm0.27\%$1

and the paper identifies a unified strength parameter

$0.28\%\pm0.27\%$2

For simplified time-bin BB84, this yields the exact linear tradeoff

$0.28\%\pm0.27\%$3

Here $0.28\%\pm0.27\%$4 is Eve’s success fraction and $0.28\%\pm0.27\%$5 is Alice–Bob QBER. This gives a direct operational meaning to adaptive eavesdropping: Eve tunes $0.28\%\pm0.27\%$6 to remain inside an allowed QBER budget. The same paper experimentally realizes the partial-measurement attack in a time-bin-encoded, fiber-based simplified BB84 system and reports that measured information gain and QBER follow the theoretical curves across the full coupling range (Idan et al., 30 Sep 2025).

The strongest notion of adaptivity in the current BB84 eavesdropping literature appears in the 2026 reinforcement-learning paper (Bagunu, 22 Jun 2026). There Eve is modeled as an agent in an MDP that observes checkpoint QBER, current-block attack count, and block index, yielding

$0.28\%\pm0.27\%$7

tabular states. The action space is binary, pass or intercept, and the reward is

$0.28\%\pm0.27\%$8

with Q-Learning, SARSA, and Double Q-Learning updates evaluated over $0.28\%\pm0.27\%$9 episodes and five seeds. Against the fixed-rate analytical baseline

$\mu_{ch}=1\%$0

the paper reports that Q-Learning reduces detection from $\mu_{ch}=1\%$1 to

$\mu_{ch}=1\%$2

at

$\mu_{ch}=1\%$3

while extracting approximately $\mu_{ch}=1\%$4 correct bits per episode. It also reports a spontaneous “end-game burst,” where the learned policy surges attack rate in the final block, and shows that randomized checkpoint intervals remove this exploit while leaving stealth performance statistically indistinguishable (Bagunu, 22 Jun 2026).

This suggests a useful distinction. Variable-strength attacks adapt to a disturbance budget fixed in advance; reinforcement-learning attacks adapt to public protocol feedback during the run. The former is parametric optimization; the latter is sequential control.

5. Side-channel-conditioned and photon-number-conditioned attacks

When BB84 signals leak information in non-operational degrees of freedom, adaptivity can arise from side-channel measurement before the signal attack is chosen. “Explicit attacks on BB84 with distinguishable photons” gives a binary side-channel model in which the emitted states are

$\mu_{ch}=1\%$5

with

$\mu_{ch}=1\%$6

A minimum-error measurement of the side channel biases Eve’s posterior over the four BB84 states, after which she can either keep the standard phase-covariant cloner or, more effectively, apply soft filtering followed by an optimal two-state cloner adapted to the now-more-likely pair (Babukhin et al., 2022). The paper’s central conclusion is that phase-covariant cloning, optimal without side channels, is no longer generally optimal once source distinguishability is present. It further reports that

$\mu_{ch}=1\%$7

marks the regime where soft filtering with two-state cloning becomes more efficient than phase-covariant cloning without soft filtering (Babukhin et al., 2022).

A related but explicitly nonadaptive construction appears in the 2022 decoy-state side-channel paper (Babukhin et al., 2022). There Eve attacks both the operational qubit and the passive light-source side channel jointly, but does not use the side-channel information to alter the in-flight signal conditionally. Instead, she performs optimal phase-covariant cloning on the signal and then a joint collective measurement on the clone state and side-channel state after basis reconciliation. The security impact is captured by the “effective error” identity

$\mu_{ch}=1\%$8

This converts additional side-channel leakage into an effective Bob error $\mu_{ch}=1\%$9 that can be inserted into standard decoy-state analysis. The same paper reports that the side-channel-only explicit attack drives the key rate to almost zero around $V\approx 0.4$0 km, while the side-channel plus cloning attack does so around $V\approx 0.4$1 km under its chosen parameters (Babukhin et al., 2022). The attack is stronger than separate side-channel measurements, but the authors classify it as nonadaptive because the signal attack is not changed in response to the side-channel outcome.

Photon-number-splitting is another practically important adaptive BB84 attack, now conditioned on photon number rather than source distinguishability. In the weak-laser-pulse setting of “Thwarting the Photon Number Splitting Attack with Entanglement Enhanced BB84 Quantum Key Distribution,” Eve performs a QND photon-number measurement, blocks some single-photon pulses, splits one photon from multiphoton pulses, stores it, and measures only after basis revelation (Sabottke et al., 2011). The multiphoton probability is

$V\approx 0.4$2

and the protocol proposed there detects the QND/PNS mechanism by monitoring phase coherence in entanglement-enhanced decoy pulses. In the idealized hypothesis test used in that paper, $V\approx 0.4$3 confidence requires only about $V\approx 0.4$4 detected photons (Sabottke et al., 2011). This is adaptive eavesdropping in a particularly clear sense: Eve’s action depends on the measured photon number and on the expected channel loss.

6. Security proofs, thresholds, and common misconceptions

The broadest cryptographic framework relevant to adaptive BB84 eavesdropping is not an attack construction but a security proof against general attacks. In the efficient decoy-state BB84 analysis of (Lucamarini et al., 2015), the earlier collective-attack assumption is replaced by security against “the most general attack allowed by the laws of physics.” The proof combines the smooth-entropy uncertainty relation

$V\approx 0.4$5

with a finite-key treatment of sampling without replacement through the Hypergeometric-to-Binomial Ahrens map,

$V\approx 0.4$6

For the key length,

$V\approx 0.4$7

At $V\approx 0.4$8 km, the paper reports

$V\approx 0.4$9

under general attacks versus

$1{,}128{,}172$0

under collective attacks, a degradation of about $1{,}128{,}172$1 (Lucamarini et al., 2015). In this framework, cross-round correlations, delayed measurement, and attack adaptation are already subsumed by the general adversarial model, within the stated source and detector assumptions.

A common misconception is to interpret higher BB84 QBER thresholds obtained under weaker adversarial models as improvements of unconditional security. The memoryless BB84 result does not do this. Its $1{,}128{,}172$2 threshold is explicitly a security statement under the assumption that Eve has no quantum memory; if that assumption is removed, the stronger standard thresholds again become relevant (Bocquet et al., 2011).

Another misconception is that QBER alone always captures Eve’s threat. For partial intercept-resend in an idealized noiseless channel, the 2026 QBER review gives the linear relation

$1{,}128{,}172$3

where $1{,}128{,}172$4 is the attacked fraction, and reiterates the standard full intercept-resend limit near $1{,}128{,}172$5 QBER (Rath et al., 28 Mar 2026). But the same review emphasizes that distinguishing natural noise-induced errors from adversarially introduced errors remains a central research challenge. This is exactly why low-QBER attacks based on side channels, PNS, or disturbance budgeting remain relevant even when the raw BB84 disturbance principle is not in doubt.

The resulting picture is layered. Under ideal, source-faithful BB84, delayed-measurement individual attacks and their optimal interactions are well characterized. Under weaker assumptions on Eve’s memory, BB84 admits slightly higher tolerable QBER. Under realistic implementation assumptions, source leakage, multiphoton pulses, and public finite-key feedback create additional attack surfaces on which “adaptive” can mean conditional state discrimination, parameter tuning, or fully sequential feedback control. Under composable finite-key proofs against general attacks, these operational notions are absorbed into a worst-case quantum adversary, but only within the device model actually proved secure (Lucamarini et al., 2015, Rath et al., 28 Mar 2026).

Adaptive BB84 eavesdropping is therefore best understood not as one attack but as a hierarchy of conditioning mechanisms. The weakest form is classical reinterpretation of an immediate measurement after sifting; the strongest is sequential policy optimization from live protocol feedback. Between these extremes lie the attacks that dominate the implementation literature: delayed measurement with quantum memory, disturbance-tuned cloning, photon-number-conditioned PNS, and source-side-channel-conditioned filtering and cloning.