Physical cryptographic verification of nuclear warheads

Theory of a Single Projection.

The spectral exitance (photons emitted per unit energy per unit surface area) M(E,w) from some point w on the foil is closely described by Eq. 1. The integral term represents the projection made when the beam flux passes through the object, which is described by a 3D density map ρobj,i(r+sθ) of the object for each isotope i. The integral runs through the object along a ray r+θ=rw¯ connecting the X-ray source at point r to a point w on the foil along some direction vector θ, the length of which is parameterized by s. The rate of photon attenuation depends on the NRF cross-section σ NRF,i for isotope i at energy E. The second bracketed term describes the response of the encrypting foil based on the foil’s composition as described by the density ρfoil,i(w) of isotope i at point w, and its effective thickness zi (SI Appendix, Eq. S10c).M(E,w)≈ϕoAnrexp[∑i(−σ NRF,i∫rw¯ρ obj,i(r+sθ) ds)]×[1−exp(∑i−σ NRF,i ρ foil,i(w)zi)].[1]

Note that the spectrum of photons exiting from the foil is a function of both ρobj,i and ρfoil,i. By changing the object being measured (ρobj) but holding the foil (ρfoil) constant, the inspector can compare two measurements of M to determine whether the projection for a candidate warhead is identical to the same projection for a template warhead. Note that it is impossible to solve for the sensitive information in ρobj without knowledge of ρfoil. Because the host can provide the foil without revealing its isotopic composition to the inspector, the vector of isotopes in the foil acts like a one-time-pad encryption key that prevents the inspector from learning the warhead’s composition. Although the inspector does not know the amount of each isotope in the foil, each of which can vary by orders of magnitude, the inspector can still be certain that the foil is sensitive to each isotope of interest, for if the foil lacks a sufficient amount of an isotope, the corresponding fluorescence signal will not be adequately observed within the agreed measurement duration. In this respect, the foil is self-validating. The foil’s gamma fluorescence can be measured using high-purity germanium (HPGe) detectors. Placing the detectors in shielded cavities that view the surface of the foil packet from angles that are large (typically >135°) relative to the beam direction will minimize the background flux from nonresonant processes in the foil, such as secondary bremsstrahlung, multiple Compton scatters, and X-ray fluorescence (XRF). The information security aspects of these non-NRF processes are discussed below.

Simulating a Single Projection.

A measurement was simulated using the Geant4 Monte Carlo simulation toolkit with the G4NRF NRF-physics package (14, 15), which tracks each photon and its interaction daughters through the warhead, foil, and detector geometries and simulates all relevant photon interactions in these materials. The test objects were illuminated with a pencil beam of bremsstrahlung X-rays. A total of 8×1011 photons with a 2.7-MeV endpoint bremsstrahlung energy distribution was incident on each test object (SI Appendix, section 5.1). The template-warhead (Table 1) model is loosely based on approximate Soviet design information revealed during the Black Sea experiment, taking the median estimate for the thicknesses of weapons-grade plutonium, high-explosive, and highly enriched uranium; and applying the simplifying assumption that these materials are arranged as concentric spherical shells (16). The result is an object with the correct materials in approximately the correct quantities; it does not reflect the design of a real warhead.

The photons emitted from the encrypting foil at angles >135° from the forward-going beam are tallied. The resulting full-spectrum histogram as seen by the detector is shown in Fig. 2. For the simulation, the “foil” used was 2 cm thick and made from equal parts by mass ²³⁵U, ²³⁸U, ²³⁹Pu, and ²⁴⁰Pu, at a homogeneous overall density of 19 g/cm³. This choice was made strictly to conserve computational time. In a practical environment, the foil would be thinner, varying from micrometers to centimeters, providing about 4 orders of magnitude in dynamic range while staying within reasonable measurement times (SI Appendix, section 5.4). This dynamic range is what allows the foil to perform a meaningful encrypting function.

Tomographic Uniqueness from Projections.

The bridge axiom between observables and the conclusion of authenticity requires more than a statement about integrated densities along a single line of projection; it requires that all of the materials in the candidate object be identically distributed to those in the template object. The internal geometry must be somehow sampled to satisfy the bridge axiom, otherwise the system admits the possibility of a geometric hoax, an object that has all of the correct materials and is able to elicit the same NRF spectrum, but with a different geometric configuration. Such a hoax is illustrated in SI Appendix, Fig. S5.

The projection-slice theorem, which underpins tomographic imaging, holds that all 3D manifolds can be uniquely mapped from an infinite set of 2D projections, although a finite set of projections is usually adequate in practice (17). However, projection images of this type would reveal classified information about the warhead’s structure, such as the diameter of the plutonium pit. To avoid this problem, we limit the system to a uniform foil that operates as a single-pixel camera with zero spatial-dimension sensitivity. However, this presents a challenge: the mathematical formalism for tomographic imaging from dimensionless single-pixel images has not been previously developed.

We devised an integral transform that is able to uniquely map a 3D geometry from a set of zero-dimensional projections of the type made by the single-pixel camera (SI Appendix, section 2). This transform is shown in Eq. 2.Kρobj(r,θ)≡∫S2exp(−∫ρobj(r+sθ) ds) dθ∝∫foilM(E,w) dw,[2]where ρobj(r+sθ) is the density along the ray r+θ running through the object being mapped. The exterior integral runs over the entire 2D projection space S2, collapsing the 2D image into a scalar value—the same process as occurs in a single-pixel camera when the detector integrates photons from the entire foil. The inner integral over ds is the X-ray transform used in conventional tomography. The transform is unique and invertible for any object ρobj, which implies that any difference in the candidate object’s structure can be resolved and no two structures will produce the same transform signal (see proof in SI Appendix, section 2.2). Although no inversion formula has been identified for the K transform, the inversion formula is not needed as the candidate and template geometries can be compared in the transform space.

Soundness Under Limited Sampling.

Perfect soundness in tomographic systems is only guaranteed for infinite projections; for any finite number there arises the possibility that variations in the object may go undetected. These undetectable differences are called ghosts. Physically, ghosts can be thought of as a map of density variations that coincide spatially with ρobj, consisting of both positive and negative density-change values. A map g is a ghost if it has the property K(ρobj+g)=K(ρobj) for all projections considered. The objects h=ρobj+g for each valid g constitute the complete set of all possible geometric hoax objects that are not the same as the authentic weapon, but which the system is unable to reject as mismatched. It has been shown that a smooth, continuous, and nontrivial g can be constructed for any finite set of projections (18). If one of the corresponding geometric hoaxes (h) can be practically manufactured, the system can be cheated.

Louis and Törnig showed that for the Radon transform, ghost functions on the unit disk can be described as a superposition of orthogonal Zernike polynomials (19). Importantly, the lowest-order polynomial in the set must have order H equal to or greater than the number of projections N (19). Therefore, whereas ghosts capable of spoofing the system always exist, if N is large the ghosts and corresponding hoax objects h will be highly oscillatory, geometrically complex, and eventually more difficult to manufacture than a true warhead. To illustrate this, example ghost functions with order H=15 and H=78 are shown in Fig. 3. Whereas it is impractical to test for the absence of all ghost objects, one can eliminate to an arbitrarily high level of confidence all of the low-order hoaxes that constitute the set of strategically useful cheats.

• Download figure
• Open in new tab
• Download powerpoint

Fig. 3.

Two-dimensional Zernike polynomials on the unit disk showing density modulations in a planar cross-section characteristic of a hoax that is able to be assured of escaping detection for 15 and 78 projections, respectively.

It is not necessary to measure N>H projections to rule out all ghosts of polynomial order H. It is sufficient if the system can resolve N>H projections and then sample only a few randomly selected projections. For a projection system limited to spherical rotations of the test object, the number of distinct projections can be approximated by the solid angle of circular cones as N≈2/(1−⁡cos⁡δθ), where δθ is the effective angular resolution of the system. For example, a system able to resolve rotations of δθ=10° has N≈132 distinct projections. Given a system able to resolve N distinct projections, the probability that a hoax of minimum polynomial order H survives undetected by the system after k trials of randomly selected projections is bounded by Eq. 3.B≤∏j=1k[(1−α)HN+βj(1−HN)],[3]where α is the probability of erroneously rejecting a projection of a true warhead (type I error) because of statistical fluctuations, and βj is the probability of failing to reject a nonmatching projection of a hoax because it could not be statistically differentiated from a matching projection (type II error) (SI Appendix, section 6.2). Note that βj is specific to each hoax and projection, but in general it will increase as the hoax becomes more sophisticated in design, which also implies increasing H, and can be decreased by increasing measurement times, which also increases the number of resolvable projections N.

Test Thresholds.

The discrepancy between the counts for energy bin i and projection j can be restated in SDs as Δi,j=(ccan,i,j−ctem,i,j)/σcan,i,j2+σtem,i,j2, where ccan,i,j and ctem,i,j are the counts in bin i for the candidate and template, respectively, and σcan,i,j2 and σtem,i,j2 are their variances. The decision rule used here is to alarm if the absolute difference |Δi,j| for any of the chosen NRF bins exceeds the selected test threshold Δt. The probability that a true matching projection is rejected because of random fluctuation (the false-alarm rate) is α=1−[Φ(Δt)−Φ(−Δt)]n, where n is the number of NRF bins evaluated per projection and Φ is the cumulative distribution function of the normal distribution centered at zero with variance unity (or cumulative Skellam distribution if total counts are small). For the simulation examples below, Δt=4.2σ and n=4, giving α=1×10−4. A more considered protocol might aim for a higher false-alarm rate to intentionally exercise a procedure for occasionally retesting authentic weapons. This would minimize the political repercussions of a false alarm if an innocent mistake had been made, while simultaneously improving the probability of detecting a genuine hoax object.

With the alarm threshold chosen, the probability of failing to detect an unmatched projection can be estimated as βj=min∀i(Φ(Δt−|Δi,j|)), where Δi,j are now the discrepancies in the units of SD for a particular hoax, at projection j, and NRF bin i. Values of βj are reported for each hoax in Table 2. If the object is sampled at multiple projections, then the overall system probability of failing to reject a hoax after all k projections is B, and is bounded by Eq. 3, where N and H are functions of the measurement time and the quality of the hoax, respectively. Note that the system is able to perform to arbitrarily high levels of accuracy for any hoax by measuring for an increased amount of time or by increasing the number of projections k.

Simulation Results for a Practical System.

The results in Table 2 show what could be achieved with a practical system built using commercial off-the-shelf components: the Ion-Beam Applications Ltd. TT100 Rhodotron (an electron accelerator with beam energy adjustable up to 10 MeV at 4 mA; higher current models are also made), and an array of 30 idealized HPGe detectors [having 20% intrinsic efficiency for 2-MeV photons, better known as “100%” detectors based on their performance relative to the ANSI/IEEE-325–1996 standard for NaI (20); see also SI Appendix, section 8.3]. The results indicate that the described technique is able to reject all of the posited material-substitution hoaxes with greater than 99.9% probability in a 21-s measurement. See SI Appendix, section 5.4 on scaling to thinner foils.

To make a statement about the probability of detecting a geometric hoax, some estimate of the system’s performance under random rotations of the hoax is required. A simulation was performed for a 10° rotation of a geometric hoax of polynomial order H=2 and achieving β10°=6.82×10−7 for one projection. This indicates it is conservative to assume that a δθ=10° rotation constitutes the smallest statistically discernible change in projection possible. Rotation through a larger angle would lead to a smaller βj, which implies βj≤β10° for the H=2 hoax when the system is restricted to a 10° minimum rotation. Under this assumption, and restricting projections to rotations around the unit sphere, N≈2/(1−cos⁡δθ)=132. Using Eq. 3, we can then bound the probability of cheating the example system with an H=2 hoax after one, two, and three 21-s measurements at random angles as being less than 0.0152, 2.30×10−4, and 3.48×10−7, respectively.