## 4 Attack Detection and Security Analysis
The recovered ghost images and their binarized results of the interactive superposed CKD protocol under global attacks are presented in Figure 6e1,e2,g1,g2,i1,i2,k1,k2, and the corresponding results of the proposed protocol under these attacks are given in Figure 6f1,f2,h1,h2,j1,j2,l1,l2. It can be seen that after binarization, the results of these two CKD protocols are completely disorganized. However, in our protocol, the legitimate user knows that a recognizable \"watermark\" label should be recovered in the watermark-embedding region under normal circumstances, according to which the attack self-detection can be carried out. While in the interactive superposed CKD protocol, users cannot perform self-detection of attacks. Figure 7: Results under six different kinds of local attacks. (**a1,a2,c1,c2,e1,e2,g1,g2,i1,i2,k1,k2**) in the brown dotted box and (**b1,b2,d1,d2,f1,f2,h1,h2,j1,j2,l1,l2**) in the green dotted box are the recovered ghost images and their binarized results obtained using the interactive superposed CKD protocol and the proposed protocol under six different types of local attacks: tampering, zero-setting, deletion, random cropping, shifting and re-quantization, respectively. **(2) Local attacks: tampering, zero-setting deletion, random cropping, shifting and re-quantization. ** When [PERSON] only acquires some part of the bucket value sequence, she can also perform local attacks to disrupt communication. Concretely, she can change partial bucket values to their adjacent values (tampering), replace them with zeros (zero-setting), simply erase them to make them disappear from the original sequence but without complement (deletion and random cropping), shift a portion of bucket values as a whole to other positions (shifting) or re-quantize the bucket values with a minimum unit (re-quantization). Here, the deletion attack will delete a continuous segment of the bucket value sequence, and the random cropping attack will randomly delete some bucket values. Both of them will cause a reduction in the total length of the bucket value sequence, but the legitimate user is not aware of it and will still use the modulated patterns in the original order for reconstruction. The re-quantization attack rounds the bucket values to the minimum unit, so the fluctuation trend of bucket values is roughly retained. The corresponding results of the interactive superposed CKD protocol and our protocol under these attacks (each with the same attack operations) can be found in Figure 7. It can be clearly seen that the numbers of wrong points in binarized images of the interactive superposed CKD protocol (see Figure 7a2,c2,e2,g2,i2,k2) are generally larger than those of our protocol (see Figure 7b2,d2,f2,h2,j2,l2), and the positions of wrong points in the former are randomly dispersed, while those in the latter are more concentrated in or around the watermark-embedding region. For the tampering attack, the wrong points started to appear in our protocol when we tampered with 20 bucket values. As for the zero-setting attack, only setting any bucket value to zero would cause wrong points to appear in the binarized image. Additionally, the number of wrong points will increase with the number of the bucket values being set to zero. For the deletion and random cropping attacks, deleting the values would directly destroy the one-to-one correspondence between the bucket values and modulated patterns after deletion of locations. The further the deletion positions are in the front of the bucket sequence, the greater the impact will be. Here, we kept the total numbers of deleted bucket values in both deletion and random cropping attacks the same: 10. As for the shifting attack, we shifted the 1000 th to 1199 th bucket values in the sequence back by 200 positions, which means 400 bucket values in total swapped their positions. For the re-quantization attack, since the magnitude of the recorded bucket values was in order of \(10^{4}\), we set the minimum unit of quantization to 100.