## 4 Attack Detection and Security Analysis  
Next, we analyze the role of the watermark-embedding region of the FP on attack detection. For a fair comparison, we picked a CGI-based CKD protocol [27] that is the most similar to this proposed protocol in the recent literature and acquired its experimental results as a reference. This recently developed protocol also generates different FPs (mutually exclusive) for multiple legitimate users and determines whether there exists an attack by checking whether the superposed result of FPs (by simple addition) recovered by users is a regular pattern. However, it does not use the watermarking technology; it cannot tell which channel the attack occurred in. Let us call it the interactive superposed CKD protocol. It should be mentioned that its synthesized regular image does not have a functional region as in the QR code image, so the overall pixel resolution of modulated patterns used for it should be consistent and each FP should be purely random. We took \(FP_{4}\) as an example and directly filled the functional region of \(FP_{4}\) with 0-1 random speckles to form a certain FP of the interactive superposed CKD protocol, denoted as \(FP_{random}\). Since the FP in our protocol has a watermark-embedding region and non-watermark-embedding region, we specially designed the following experiment by setting different spatial resolutions for these two regions. In this experiment, we set the image size of both \(FP_{4}\) and \(FP_{random}\) to \(25\times 25\) pixel-units. In the above, we assumed that each pixel-unit of the FP was sampled by a 0-1 random matrix of \(\
u\times\
u\) pixels in each modulation. We set the values of \(\
u\) in the entire modulated patterns with respect to \(FP_{random}\) and those in the non-watermark-embedding region of the  
Figure 5: Correctness analysis of the binarized FPs. (**a,b**) The variation trends of contrast-to-noise ratios (CNRs) and the number of wrong points with the increase in the attenuation coefficient optical density (OD), corresponding to the five recovered results, respectively. (**c**) The photon counts of background noise as a function of the OD value. (**d,e**) The trends of CNRs and the number of wrong points with the increase in the sampling rate. The corresponding ratios of the numbers of ones in five original FPs to the total \(25\times 25\) pixel-units are listed in the legend. modulated patterns with respect to \(FP_{4}\) to 8, and we set the values of \(\
u^{\prime}\) in the watermark-embedding region of \(FP_{4}\) to 8, 4 and 2. The reconstructed ghost image and corresponding binarized result (showing no wrong points) of the interactive superposed CKD protocol are given in Figure 6a1,a2. The enlarged watermark-embedding regions of the modulated patterns for \(FP_{4}\) and their complete matrices are presented in Figure 6b1-d1 and 6b2-d2, respectively. In Figure 6b3-d3, we provide the corresponding recovered ghost images of \(FP_{4}\) under full sampling (i.e., \(N=40\),000). In \(\
u^{\prime}=8\) and \(\
u^{\prime}=4\) cases, there were no wrong points in binarized results of \(FP_{4}\) (see Figure 6b4,c4). In the binarized image shown in Figure 6d4, the number of wrong points increased dramatically, and there were seven wrong points in the watermark-embedding region of \(8\times 8=64\) pixel-units and 11 wrong points in the non-watermark-embedding region of \(25\times 25-8\times 8=561\) pixel-units. Thereby, it is easy to find that the percentage of wrong points in the watermark-embedding region (\(7/64=10.9375\%\)) is much greater than that in the non-watermark-embedding region (\(11/561=1.9608\%\)). Additionally, in non-watermark-embedding region, the wrong points always concentrated around the watermark-embedding region.