## 4 Attack Detection and Security Analysis
It is worth mentioning that for these local attack tests, we only present the results with minimal attacks that allowed the wrong points to start appearing, i.e., the maximum limits of these six types of local attacks that our protocol could withstand. When the aforementioned local attacks are more serious, the number of wrong points will be larger, and in our protocol these wrong points will always appear preferentially in the watermark-embedding region. Thus, in our protocol, the local attacks can be easily detected by the legitimate users when they find the wrong points in their recovered binarized FPs. Once a user finds that there is one or more wrong point, all CKs distributed in this round of communication should be discarded immediately and a new round of CKD requires a reboot. In addition, since there is a one-to-one correspondence between \"watermark\" labels and users, which channel is under attack can be immediately determined according to the \"watermark\" label of the binarized image with wrong points. While in the interactive superposed CKD protocol, since each FP is purely random and does not have any watermark-embedding region, the user cannot determine whether there is an attack or locate the attacked channel according to the restored binarized image. Therefore, in addition to providing identity authentication, the watermarking technology in this protocol also adds an extra layer of protection and attack self-detection to the system. Apart from the aforementioned attacks, the noise that may exist in the public channels will also have a certain impact on the transmitted bucket value sequence. Unlike the aforesaid deliberate attacks, the channel noise is generally independent and identically distributed. Here, we tested two types of common additive noise, i.e., white Gaussian noise and Poisson noise. We made some performance comparisons between traditionalCGI-based CKD protocol [21; 22] and our protocol. The former utilizes the parity of some particular digits after the decimal point of each gray value on the recovered ghost image to form a bit sequence as the distributed CK. In the following, we took the 8 th decimal place of the grayscale value of the pixel at (60,90) of the ghost image for parity judgment, which can generate a bit, 0 or 1. The ghost image and binarized image under noise-free condition are given in Figure 8a1,a2 as a reference. Figure 8b1,b2,c1,c2,d1,d2 and 8e1,e2,f1,f2,g1,g2 present the results of the above two CKD protocols under Gaussian noise (with a standard deviation of 20, 22 and 50) and Poisson noise (with a standard deviation of 20, 25 and 50), respectively. It can be seen that the gray values are very sensitive to channel noise, which directly affects the values of the generated bits. In our protocol, when the standard deviation is less than 20, there are no wrong points in the binarized images (see Figure 8b2,e2) for both Gaussian and Poisson noise. When the standard deviation is greater than or equal to 22 under Gaussian noise, wrong points begin to appear first in the watermark-embedding region (see Figure 8c2,d2), and the number of wrong points increases with the standard deviation of noise. For Poisson noise, it is found that the wrong points begin to appear stably when the standard deviation is greater than or equal to 25 (see Figure 8f2,g2). This test proved that our protocol has a certain tolerance for noise existing in the public channels, whereas the traditional CKD protocol based on the parity of decimals does not. Figure 8: Performance comparisons between traditional CGI-based CKD protocol that utilizes the parity of decimals and our protocol, in the presence of additive white Gaussian noise and Poisson noise.