## 4 Attack Detection and Security Analysis
This is because as the watermark in the embedding region becomes brighter, the contrast of the bright and dark pixels in the non-watermark-embedding region becomes worse (see Figure 6b3-d3), which will inevitably lead to some misjudgments in the binarization process, especially in and around the watermark-embedding region. It is worth mentioning that, according to practical needs, we can arbitrarily adjust the values of \(\
u\) and \(\
u^{\prime}\) in these two regions. Additionally, based on the above results, in the following tests we set \(\
u^{\prime}\) in the watermark-embedding region and \(\
u\) in non-watermark-embedding region to 4 and 8, respectively. Next, we discuss the attack detection performance of this protocol. It is assumed that the illegal attacker [PERSON] is unable to acquire any pre-shared initial keys \(IK_{j}\). She can only obtain the bucket value sequences \(\{S_{B_{j}}\}_{j}\) that are transmitted in the public channels. Therefore, exhaustive guesses about the pre-shared modulated patterns have to be made to  
Figure 6: Results of two CKD protocols based on computational ghost imaging (CGI) under different \(\
u^{\prime}\) values and different global attacks. (**a1**,**a2**) The recovered ghost image and binarized result of \(FP_{random}\) by using the interactive superposed CKD protocol. (**b1–b4**,**c1–c4**,**d1–d4**) are the enlarged watermark-embedding regions of the modulated patterns; the complete matrices of these patterns; and recovered ghost images of \(FP_{4}\) and their binarized results, acquired using the proposed protocol, with different \(\
u^{\prime}\) values in the watermark-embedding region—8, 4 and 2, respectively. (**e1**,**e2**,**g1**,**g2**,**i1**,**i2**,**k1**,**k2**) in the brown dotted box and (**f1**,**f2**,**h1**,**h2**,**j1**,**j2**,**l1**,**l2**) in the green dotted box are the restored ghost images and their binarized images corresponding to the interactive superposed CKD protocol and our protocol under different global attacks (disordering, forging, resampling (sub-resampling) and resampling (over-resampling)), respectively. acquire the correct CKs. The larger the signal dimension of \(IK_{j}\), the lower the probability of deciphering. Although [PERSON] cannot acquire any useful information from eavesdropped random bucket value sequences, she can still disrupt the CKD process by attacking these bucket value sequences. Without loss of generality, in the following experiment we used the bucket value sequence of User 4 as the target to attack and made comparisons between the results of the interactive superposed CKD protocol and our protocol. We tested a total of 10 types of common attacks: disordering, forging, sub-resampling, over-resampling, tampering, zero-setting, deletion, random cropping, shifting and re-quantization. All these attacks can be divided into two categories: global attacks (see Figure 6) and local attacks (see Figure 7). It should be noted that cutting off the transmission channels and hacking into computers are beyond the scope of consideration, because no protocols can withstand these attacks. **(1) Global attacks: disordering, forging and resampling. ** Assume that [PERSON] can acquire the entire bucket value sequence of User 4. She can disrupt the original order of the entire sequence (disordering), completely fabricate a new sequence to replace the original one (forging) or resample the bucket value sequence by interpolation to obtain a new one. Here, for the resampling attack, we used bilinear interpolation to perform 95% sub-resampling and 105% over-resampling on the original bucket sequence. We knew all these attacks would cause serve damage to the recovered watermarks and make them unrecognizable in both the interactive superposed CKD protocol and our protocol.