Cryptanalysis of a controller-independent controlled bidirectional QSDC protocol

A recent protocol by Cai et al. [J. Korean Phys. Soc. (2026)] proposed a controller-independent controlled bidirectional quantum secure direct communication (CICBQSDC) scheme based on four-particle cluster states, claiming provable unconditional security via Wyner's wiretap channel theory. In this paper, we demonstrate that the protocol is vulnerable to a quantum Trojan-horse attack that is entirely consistent with the threat model assumed by the original authors; namely, the controller Charlie is an untrusted party with the same capabilities as the strongest possible eavesdropper. Specifically, this paper shows that Charlie uses Trojan-horse probes to steal k0, k1, k2, and k3 independently, and then he combines the measurement results and initial states of the four-particle cluster states to completely recover all four secret message bits encoded by Alice and Bob. Crucially, this attack introduces no disturbance to the legitimate qubits and therefore produces no increase in the ZX or XZ error rates, rendering it undetectable by the protocol's security-check mechanism. This paper concludes that the unconditional security claim of Cai et al. fails to hold because it relies on a critical blind spot: a fundamental contradiction between modeling the controller as a maximally powerful eavesdropper and implicitly restricting their capabilities to a side-channel-free, ideal single-photon framework. This result highlights the general inadequacy of wiretap-channel-based security proof in the absence of rigorous physical-layer constraints, underscoring the critical need for implementation security in future QSDC designs.