# LongBench v2 / 66ed4274821e116aacb1f8f1

task_id: 46afaf42-42b2-53b0-b75b-9ed1e6f16d88
task_key: train--66ed4274821e116aacb1f8f1
task_revision_id: 2

{"choice_A":"Multi-prover proof system for QMA with long questions and answers","choice_B":"Reduce the question size","choice_C":"Compile multi-prover proof system into single-prover argument system","choice_D":"Reduce answer size using generic compiler","context":"Succinct arguments for QMA from standard assumptions\nvia compiled nonlocal games\nTony Metger*1, Anand Natarajan†2, and Tina Zhang‡2\n1ETH Zurich\n2MIT\nAbstract\nWe construct a succinct classical argument system for QMA, the quantum analogue of NP, from generic and\nstandard cryptographic assumptions. Previously, building on the prior work of Mahadev (FOCS ’18), Bartusek et\nal. (CRYPTO ’22) also constructed a succinct classical argument system for QMA. However, their construction\nrelied on post-quantumly secure indistinguishability obfuscation, a very strong primitive which is not known from\nstandard cryptographic assumptions. In contrast, the primitives we use (namely, collapsing hash functions and a mild\nversion of quantum homomorphic encryption) are much weaker and are implied by standard assumptions such as\nLWE. Our protocol is constructed using a general transformation which was designed by Kalai et al. (STOC ’23) as a\ncandidate method to compile any quantum nonlocal game into an argument system. Our main technical contribution\nis to analyze the soundness of this transformation when it is applied to a succinct self-test for Pauli measurements on\nmaximally entangled states, the latter of which is a key component in the proof of MIP∗= RE in quantum complexity.\n*Email: tmetger@ethz.ch\n†Email: anandn@mit.edu\n‡Email: tinaz@mit.edu\n1\narXiv:2404.19754v1  [quant-ph]  30 Apr 2024\n\n\nContents\n1\nIntroduction\n3\n1.1\nTechnical overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n6\n2\nPreliminaries\n12\n2.1\nNotation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n12\n2.2\nNonlocal games . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n12\n2.3\nPauli matrices and Heisenberg-Weyl group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n12\n2.4\nReduced measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n13\n2.5\nState dependent norm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n14\n2.6\nEfficient observables and computational indistinguishability\n. . . . . . . . . . . . . . . . . . . . . .\n15\n2.7\nQuantum homomorphic encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n15\n3\nApproximate representation theory\n16\n3.1\nGowers-Hatami theorem with non-uniform measures . . . . . . . . . . . . . . . . . . . . . . . . . .\n16\n3.2\nSwitching distributions for approximate Heisenberg-Weyl group representations . . . . . . . . . . . .\n18\n3.3\nLifting (anti-)commutation from small-bias sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n20\n4\nDescription of the question-succinct protocol\n23\n4.1\nCompiling nonlocal games using cryptography: the KLVY transformation . . . . . . . . . . . . . . .\n23\n4.2\nDescription of question-succinct protocol for QMA . . . . . . . . . . . . . . . . . . . . . . . . . . .\n23\n4.3\nQuestion types\n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n27\n5\nModeling and state-dependent norms for the compiled game\n28\n5.1\nModelling the prover in any compiled game . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n28\n5.2\nModelling the prover in Protocol 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n31\n6\nAnalysis of the question-succinct protocol\n32\n6.1\nConsistency test and “prover switching” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n32\n6.2\nAnalysis of compiled Pauli braiding test: obtaining the group relations . . . . . . . . . . . . . . . . .\n34\n6.3\nAnalysis of compiled mixed-vs-pure basis test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n35\n6.4\nSubsampled Hamiltonian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n39\n6.5\nAnalysis of the compiled Hamiltonian test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n43\n6.6\nAnalysis of full compiled protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n44\n7\nCompiling from a question-succinct protocol into a fully succinct protocol using succinct arguments of\nknowledge\n45\n7.1\nPost-quantum succinct arguments of knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n46\n7.2\n[LMS22] extraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n47\n7.3\nA fully succinct version of Protocol 2\n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n51\n2\n\n\n1\nIntroduction\nSuccinct verification of computation is a notion that has been extensively studied in the classical setting. A weak\nclassical client may delegate a classical computation to a powerful server, and may then wish to check whether the\nserver performed the computation correctly without having to compute the answer for itself. In this case, the client\ncan ask the server to execute a succinct interactive argument, in which the server (efficiently) convinces the client\nbeyond reasonable doubt that the computation was performed correctly, and the client only has to do work scaling\nwith polylogT in order to be convinced, where T is the time that it took to do the computation itself. The messages in\nthis succinct interactive protocol should also be polylogT in length.\nNot long after it came to light that quantum algorithms could outperform the best known classical algorithms in\ncertain computational tasks, the question was posed of whether a quantum prover could convince a classical verifier of\nthe answer to a problem in BQP without requiring the classical verifier to simulate the computation itself. For certain\nproblems, like factoring, a classical verifier can check correctness by exploiting the fact that the problem lies in NP;\nhowever, NP is not known to contain BQP, and for some problems this may be infeasible. This line of inquiry was\ninitiated by Gottesman in 2004 [Aar07], and has led to a long line of work on the problem now known as quantum\nverification.\nSuccinct quantum verification with a single cryptographically bounded prover.\nMahadev’s work in 2018 [Mah18]\nshowed that it is indeed possible for an efficient quantum prover to convince a classical verifier of the answer to any\nproblem in BQP, given that the quantum prover is subject to certain (post-quantum) cryptographic assumptions. (In\nfact, her work also showed that it is possible for an efficient quantum prover to convince a classical verifier of the\nanswer to any problem in QMA, assuming the prover is given polynomially many copies of the witness state for the\nQMA problem.) Mahadev’s quantum verification protocol inspired a slew of followup work in which her techniques\nwere used to design other cryptographic quantum verification protocols with desirable additional properties, e.g. the\nproperty of being non-interactive [BKVV20] or composable [GV19] or linear-time [Zha22]. In 2022, Bartusek et\nal. [BKL+22] showed, assuming post-quantum iO, that some version of Mahadev’s protocol can be made succinct, in\nthe same sense that we described in the opening paragraph: the classical verifier only needs to read messages that are\npolylogn bits long, where n is the size of the instance, and do work scaling with polylogT + ˜\nO(n), where T is the\ntime required to execute the verification circuit.\niO, or indistinguishability obfuscation, is an immensely powerful and subtle primitive that has recently been con-\nstructed from a combination of several standard assumptions [JLS21]. However, some of these assumptions are not\npost-quantum, and there is currently no construction of post-quantum iO from standard assumptions. Post-quantum\niO is known to imply other elusive cryptographic objects, e.g. public-key quantum money [Zha21], and constructing\nit from standard post-quantum assumptions remains a difficult and important open problem.\nThe essential difficulty, and the reason for the use of iO in [BKL+22], is that Mahadev’s approach to verification is\nin some sense a qubit-by-qubit approach, and requires Ω(𝜆) bits of communication (where 𝜆is the security parameter)\nfor every qubit in the prover’s witness state, because the verifier needs to send the prover as many Ω(𝜆)-sized public\nkeys as the witness has qubits. As a result, Mahadev’s approach is difficult to make succinct, since setting up the keys\nalready requires at least n·Ω(𝜆) bits of communication, where n is the number of qubits in the prover’s witness. The\nauthors of [BKL+22] use iO in a clever way to compress the keys and thus reduce the amount of required commu-\nnication to poly(𝜆) · polylogn; this is the bulk of their work. More specifically, the authors begin by constructing a\nquestion-succinct (short questions, long answers) protocol for verifying QMA using iO. Then they present a general\ncompiler which uses a recent post-quantum analysis of Killian’s succinct arguments of knowledge [CMSZ22, LMS22]\nto turn any question-succinct protocol that satisfies certain properties into a fully succinct protocol.\nOur result.\nOur main contribution in this paper is to construct succinct classical-verifier arguments for QMA from\nstandard (and even relatively general) assumptions, without relying on post-quantum iO. More specifically, we prove\nthe following theorem:\nTheorem 1.1 (Informal version of Theorem 7.5). Assume that a quantum levelled homomorphic encryption scheme\n3\n\n\nexists which specialises to a classical encryption scheme when it is used on classical plaintexts.1 Assume also that\npost-quantum succinct arguments of classical knowledge exist.2 Then a constant-round classical-verifier argument\nsystem for any promise problem in QMA exists, in which:\n(i) the honest quantum prover runs in quantum polynomial time, given polynomially many copies of an accepting\nQMA witness state,\n(ii) the completeness-soundness gap is a constant, and\n(iii) the total communication required is of length polylogn·poly𝜆, where n is the instance size and 𝜆is the security\nparameter. The verifier runs in time poly(logT,𝜆)+ ˜\nO(n), where T is the size of the QMA verification circuit.\nThe main advantage of our protocol compared with Bartusek et al.’s protocol [BKL+22] is that our protocol does\nnot use post-quantum iO, which at this time cannot be instantiated from standard assumptions. Even setting aside the\nissue of post-quantum iO, however, we remark that the non-iO assumptions that our approach relies on are more generic\nthan the Learning With Errors (LWE)–based assumptions which Bartusek et al. use. For example, our approach avoids\nusing the delicate ‘adaptive hardcore bit’ property of LWE-based trapdoor claw-free functions (TCFs), which was\nintroduced in [BCM+21] and used in Mahadev’s original verification protocol (as well as Bartusek et al.’s protocol).\nThe main primitive we rely on, quantum homomorphic encryption (QHE), can be constructed in its usual form from\nLWE without the adaptive hardcore bit assumption [Mah17]. Moreover, we do not in fact need all the properties of\nstandard QHE: for example, we do not use the standard notion of compactness, which says that decryption time cannot\ndepend on the size of the circuit being evaluated. Instead, we only need a weak notion of compactness which says that\nclassical ciphertexts encrypted under the QHE scheme should be classically decryptable (in any polynomial time, even\nif the decryption time depends on the evaluated circuit). This more general notion of non-compact QHE with classical\ndecryption for classical ciphertexts plausibly exists from assumptions other than LWE: for instance, [GV24] represents\nrecent progress in this direction. As such, our approach shows that the important primitive of quantum verification—\nand even succinct verification—may exist from a wider range of assumptions than LWE only. (In contrast, a large\nnumber of post-quantum primitives that use techniques from Mahadev’s original verification protocol can only, as far\nas we can see, be constructed from LWE.)\nWe achieve Theorem 1.1 by combining powerful information-theoretic tools which originate in the study of non-\nlocal games (e.g. those found in [dlS22]) with tools that cryptography offers (in particular, cryptographic succinct\narguments of knowledge turn out to be very useful for us). The resulting protocol is (compared with the protocol\ndesigned by Bartusek et al.) a remarkably clean object which has a natural intuitive interpretation. The tool that allows\nus to combine self-testing techniques with cryptographic techniques is a compilation procedure introduced by Kalai,\nLombardi, Vaikuntanathan, and Yang [KLVY21], which Natarajan and Zhang [NZ23a] recently exploited in order to\nachieve classical-verifier quantum verification using a different approach from Mahadev’s original approach.\nA different approach to verification based on nonlocal games.\nSince Bell’s historical observation [Bel64] that\nthere are certain nonlocal games which quantum entangled players can win with higher probability than classical\nplayers, the entangled two-prover model of computation has been a model of great interest in quantum complexity\ntheory and quantum foundations [Sca13]. A nonlocal game is a game played between a single efficient classical\nreferee (or verifier) and two or more unbounded players (or provers) who cannot communicate with each other but are\nallowed to share entanglement. The study of the computational power of nonlocal games (i.e. what can the verifier\ncompute efficiently with the help of the provers, if the verifier doesn’t trust the provers?) has led to a fruitful line\nof work which, in particular, has shown that the verifier in this setting can decide any problem in RE [JNV+20]. In\naddition, it is known [Gri17] that, even if the honest provers are required to be efficient, the verifier can still decide any\n1In fact, we do not need all the properties of a typical QHE scheme: for example, we do not use the standard notion of compactness, which\nsays that decryption time cannot depend on the size of the circuit being evaluated. Instead, we only need a weak notion of compactness which says\nthat classical ciphertexts encrypted under the QHE scheme should be classically decryptable (in any polynomial time, even if the decryption time\ndepends on the evaluated circuit). We also expect that the weaker primitive of classical-client quantum blind delegation (in which interaction is\nallowed) would likely suffice. These weaker primitives could plausibly be instantiated from weaker assumptions than LWE, since they do not imply\nclassical FHE, which is only known assuming LWE to date. For recent progress towards this, see [GV24].\n2These can be constructed from any collapsing hash function.\n4\n\n\nproblem in BQP (or QMA, if one of the provers gets access to polynomially many copies of a witness). Put another\nway, quantum verification in the entangled two-prover setting is known to exist.\nIn 2023 Natarajan and Zhang [NZ23a] presented a reproof of Mahadev’s result which took a different approach\nto her original approach, building on previous work on quantum blind delegation [Mah17] and the work of Kalai,\nLombardi, Vaikuntanathan, and Yang [KLVY21]. Kalai, Lombardi, Vaikuntanathan, and Yang used quantum blind\ndelegation (in particular, quantum homomorphic encryption) in order to design a compilation scheme which maps any\nentangled two-prover proof system to a single-prover argument, using cryptography to enforce the no-communication\nassumption between the provers. Kalai et al. showed that their compilation scheme preserves quantum completeness\nand classical soundness, and Natarajan and Zhang showed that it also preserves quantum soundness for a certain\nrestricted class of two-prover nonlocal games, which was sufficient to compile a two-prover quantum verification\nprotocol into a single-prover cryptographic protocol and thus recover Mahadev’s result.\nFrom the point of view of designing succinct arguments, this approach is more attractive than Mahadev’s original\napproach as a starting point, because the verifier only needs to send the prover a single public key of length poly(𝜆)\nin order to allow it to do homomorphic evaluations. One might then hope to construct a succinct cryptographic\nverification protocol for QMA in the following way: start with a succinct two-prover quantum verification protocol,\npass it through the KLVY compiler, and prove soundness using similar techniques to those which Natarajan and Zhang\nused in [NZ23a]. This approach avoids using iO entirely, because the KLVY compiler is ‘naturally’ succinct when\napplied to a succinct protocol.\nSuccinct quantum verification in the entangled two-prover setting.\nIt is therefore natural to ask whether succinct\nquantum verification in the entangled two-prover setting is known. The answer to this question is—unfortunately—no,\nbut for surprisingly complicated reasons. Below is a list of the partial results in this area which are known:\n(i) If the honest provers are allowed to be inefficient, and if the (classical) verifier is allowed to take polyn time,\nthen there is a protocol with polylogn total communication in the entangled two-prover setting to decide QMA\n(in fact, to decide all of RE). This was shown by [NZ23b].\nUnfortunately, this result is not useful to us if our goal is to compile a succinct two-prover proof system into a\nsuccinct one-prover quantum verification protocol, since we want the honest prover to be efficient.\n(ii) In a setting where the verifier interacts with seven provers instead of two, [NV18] claimed to show that efficient-\nprover quantum verification of QMA is possible. However, the proof of this result had two substantial errors\nin it. One of these errors has been resolved by [JNV+22]. The other one remains unresolved: see this erratum\nnotice with an explanation of the error [NN24].\nEven assuming the errors in [NV18] can be fixed, a seven-prover protocol is not useful to us because the tech-\nniques from [KLVY21, NZ23a] were only designed for nonlocal games with two provers. It seems difficult to\nextend these techniques to a larger number of provers, which would be necessary to compile the seven-prover\nprotocol from [NV18].\n(iii) Examining the proof of MIP∗= RE from [JNV+20] shows that it relies on two so-called compression theorems:\na question reduction theorem which takes a two-prover nonlocal game with long questions (messages from the\nverifier to the provers) and maps it to a nonlocal game with exponentially smaller questions while preserving\nmost other properties of the game, and an answer reduction theorem which takes a two-prover nonlocal game\nwith long answers (messages from the provers to the verifier) and maps it to a nonlocal game with exponentially\nsmaller answers.\nOne would think that these theorems would make proving succinctness in the nonlocal setting easy. Unfortu-\nnately, these compression theorems come with caveats: in particular, the answer reduction theorem can only\nbe applied to so-called oracularisable protocols, and no one has come up with a two-prover verification pro-\ntocol for QMA with efficient honest provers which satisfies this property. Moreover, even supposing that we\nhad a protocol to which we could apply answer reduction, the answer reduction procedure itself happens to be\nso complicated and delicate that there is no clear way to analyse its soundness in the compiled setting, even\ngiven the techniques from [NZ23a] and the additional techniques for compiling nonlocal games which have\nbeen developed since then [CMM+24].\n5\n\n\nQuestion reduction is both simpler and more lenient, however: while it has never been published, question-\nsuccinct quantum verification for QMA in the two-prover setting can be elegantly obtained from known res-\nults [dlS22, Gri17].\nThe best of both worlds.\nThe essential reason that two-prover succinct verification remains an open problem is that\nnonlocal answer reduction is hard. The only known way to make the answers in a nonlocal game shorter is to use\nan ‘entanglement-sound’ classical PCPP, and constructing this object is arguably the most technical and delicate part\nof the proof that MIP∗= RE. On the other hand, one can make the questions in certain (useful) classes of nonlocal\ngames shorter using only the elegant machinery of de la Salle [dlS22], who simplified the question reduction theorems\nof [JNV+20] by rephrasing them in terms of sampling from 𝜖-biased sets. Therefore, in the nonlocal world, question\nreduction is now considered to be relatively easy, and answer reduction remains hard.\nIn Bartusek et al.’s approach to succinct verification, meanwhile, the situation was just the opposite: shortening the\nquestions in the Mahadev protocol using only cryptography was a significant challenge, and shortening the answers\ncould be done using known techniques in a relatively black-box manner. Given that this is the case, one might hope to\ncombine the Bartusek et al. approach with the compilation approach in order that the strengths of each might cancel\nout the weaknesses of the other.\nThis is precisely what we do in this work. We construct a succinct verification protocol for QMA by firstly\ncompiling, using the KLVY compiler, a question-succinct two-prover protocol for QMA, and then compressing the\nanswers in a generic way using Bartusek et al.’s Killian-based compiler.\nThe success of this approach makes a case for using the KLVY compiler as a general way to translate techniques\nthat are well-understood in the entangled two-prover world into the single-prover cryptographic world. Once this has\nbeen done, they can be combined with ‘natively’ cryptographic techniques in order to marry the desirable properties\nof both. It seems plausible that many of the existing results in the sphere of classical-client quantum delegation and\nverification could have been obtained in a more unified way and from milder or more generic assumptions if the KLVY\ncompiler had been known at the time of their genesis, because many tasks that appear difficult in the cryptographic\nsingle-prover setting are well-studied already in the nonlocal setting (and vice versa).\n1.1\nTechnical overview\nWe focus here on how we obtain question-succinct quantum verification in the single-prover cryptographic setting,\nsince the Killian-based answer compression protocol and its analysis were already presented in [BKL+22, Section 9],\nand we include an exposition-oriented sketch of these results in Section 7 only for completeness.\n1.1.1\nThe basic template from [NZ23a]\nLike [NZ23a], our starting point is a basic framework for QMA verification in the two-prover setting due to Grilo [Gri17].\nThe verifier and the two provers (who we will call Alice and Bob) receive as input an instance of the QMA-complete\npromise problem 2-local XZ Hamiltonian [BL08]. In other words, the problem that the verifier is trying to decide is\nwhether a certain Hamiltonian H on n qubits, expressed as a sum of polynomially many 2-local X/Z Pauli terms (where\neach term is a tensor product of n operators, each of which is chosen from {1,𝜎X,𝜎Z}, such that all but 2 factors in\nthe tensor product are 1), has lowest eigenvalue ≤𝛼or ≥𝛽for two real numbers (𝛼, 𝛽), where we are promised that\n𝛽−𝛼≥\n1\npoly(n).\nHonest Alice and Bob start out by sharing n EPR pairs. The two-prover protocol underlying [NZ23a] for deciding\nwhether H has lowest eigenvalue ≤𝛼or ≥𝛽consists of two subtests, the Pauli braiding test and the energy test:\nProtocol 1 (informal).\n(i) Pauli braiding. Alice and Bob execute a version of the Pauli braiding protocol from [NV17], in which they\nplay interleaved copies of CHSH (or another similar game, like Magic Square) and a simple game known as the\n‘commutation test’. This protocol is a robust self-test for the n-qubit Pauli group3, in the sense that entangled\n3More precisely the Heisenberg-Weyl group, the group consisting of tensor products of 1, 𝜎X, 𝜎Z with ±1 signs, but we ignore this distinction\nin this introduction.\n6\n\n\nplayers who win with high probability in this game must both be playing with measurement operators that are\nclose (up to local isometries) to actual Pauli measurements. In other words, the Pauli braiding test allows the\nverifier to ‘force’ entangled provers to perform Pauli measurements when requested to do so, even without\ntrusting the provers. The most modular analysis of this protocol proceeds via a theorem from approximate\nrepresentation theory that was first proven by Gowers and Hatami [GH15].\n(ii) Energy testing via teleportation. Alice is asked to teleport the n-qubit witness state to Bob using their n\nshared EPR pairs. She then reports the teleportation corrections to the verifier. Bob is asked to measure certain\nPauli operators and report the outcomes. The verifier corrects Bob’s reported outcomes using Alice’s reported\nteleportation corrections, and interprets the result as a measurement of a term from H. It accepts or rejects\ndepending on whether this measurement indicates that the state which Alice was meant to teleport to Bob is\nlow-energy or high-energy.\nThe intuition for the soundness of Protocol 1 is as follows: the Pauli braiding test guarantees in some sense, through\nthe use of the Gowers-Hatami theorem [GH15], that all successful Bobs are in fact equivalent to honest Bob; and the\nenergy test is straightforward to analyse if Bob is honest. In order to translate the intuition into reality, we have to\nmake sure that Bob uses the same strategy in both subtests so that the guarantee on Bob in the Pauli braiding test also\napplies to Bob in the energy test. That is, we must make sure he cannot play honestly only in the Pauli braiding test\nand then deviate however he likes in the energy test.\nSuppose for the moment that the two subtests can be made perfectly indistinguishable to Bob: that is, suppose\nthat Bob’s questions in both subtests are drawn from the same distribution. This would ensure that he does the same\nmeasurements in both subtests, since he does not know which subtest is being performed. The Pauli braiding subtest\nthen guarantees that these measurements are ‘close’ to honest measurements, and the soundness of subtest (ii) follows\ndirectly from the soundness of subtest (ii) with an honest Bob.\nIn [NZ23a], following a template laid out by Vidick in [Vid20], the two subtests were indistinguishable because\nBob’s questions are very simple: in both subtests, Bob only ever receives one of two questions, each with 1\n2 probability.\nOne of these two questions is an instruction to measure all of his qubits in the Z basis (and report all n outcomes), and\nthe other is an instruction to measure all his qubits in the X basis. Slightly more formally, honest Bob will in one case\napply the projective measurement {|z⟩⟨z| : z ∈{0,1}n}, and in the other case he will apply the projective measurement\n{H⊗n|x⟩⟨x|H⊗n : x ∈{0,1}n}.\nMeasurements of this form, as it turns out, are particularly ‘compatible’ with the Gowers-Hatami-based analysis\nof the Pauli braiding test, in a sense that we will make somewhat more precise later (when we explain our ‘mixed-vs-\npure basis test’ later in this overview). It would therefore be convenient if this question structure was also sufficient\nfor the energy test. Fortunately, this happens to be the case in the non-succinct setting: it turns out that 2-local X/Z\nHamiltonian with inverse polynomial gap is complete for QMA even if we restrict the 2-local terms to XX and ZZ\nterms, i.e., terms where the two non-identity components of the n-fold tensor product are always of the same type\n(𝜎X or 𝜎Z). Note that the verifier can reconstruct a measurement of any XX-type term from the outcomes of an all-X\nmeasurement performed by Bob, and any ZZ-type term from the outcomes of an all-Z measurement performed by\nBob. This means that in [NZ23a], it was sufficient in both subtests to ask Bob the same two questions (all-X and\nall-Z), each with 1\n2 probability. Perfect indistinguishability of the two subtests in Protocol 1 then follows.\n1.1.2\nObtaining succinctness\nIn designing a (question-)succinct protocol with two entangled provers (which we will later compile into a crypo-\ngraphically secure single-prover protocol), we are faced with two new challenges compared with [NZ23a]:\n(i) The Pauli braiding test (subtest (i) of Protocol 1) does not have succinct questions. In particular, while Bob’s\nquestions can easily be made succinct (as we just described, it suffices to have only two Bob questions), Alice’s\nquestions are more complicated.\n(ii) In the non-succinct setting,\n1\npoly(n) completeness-soundness gap is generally tolerated because it is assumed\nthat poly(n) many rounds of sequential repetition can be performed in order to boost the gap. In the succinct\nsetting, this is not feasible, since repeating a succinct protocol poly(n) times results in polylog(n) · poly(n)\n7\n\n\ncommunication; therefore, in the succinct setting, we must design a protocol which has constant soundness gap\neven without any repetition. This means that we cannot start with a 2-local XX/ZZ Hamiltonian, since it is not\nknown whether this problem is QMA-complete with a constant promise gap. If we are to take the same approach\nof starting from some Hamiltonian problem, then it has to be a Hamiltonian problem with constant promise gap\nsuch that the terms can be grouped into a small number of subsets (at most 2polylogn subsets), each of which\ncontains only terms that commute. If this is the case, then Bob can measure all the terms in a single subset\nsimultaneously and report all the outcomes together, and the verifier only needs to use polylogn bits to tell Bob\nwhich subset to measure. If this is not the case, then the energy testing template from subtest (ii) of Protocol 1\nwill not work, since the verifier will not be able to tell Bob which terms he should measure in a succinct way.\nSubsampling Hamiltonians.\nWe take a similar approach to Bartusek et al. [BKL+22] in order to deal with the\nsecond issue. We use naïve QMA parallel amplification (first written down in [KSV02]; the procedure simply repeats\nthe QMA verifier in parallel a polynomial number of times) in order to boost the promise gap to a constant; this\nresults in a Hamiltonian that is a sum of exponentially many terms, each of which can be efficiently measured by\nmeasuring each of the n qubits of the witness in either the X or the Z Pauli basis (with potentially different basis\nchoices for different qubits). We then use a generic PRG with soundness against adversaries with quantum advice in\norder to ‘subsample’ these terms and emerge with a Hamiltonian that is a sum of 2polylogn terms, each of which can be\nefficiently measured by measuring each of the n qubits of the witness in either the X or the Z Pauli basis. This part of\nthe work is done in Section 6.4.\nThe mixed-vs-pure basis test and a new self-testing-oriented proof of Gowers-Hatami.\nAt this point we have\ncreated a new problem: the terms of the Hamiltonian we want to use in the energy subtest can no longer be measured by\na Bob who only ever measures every qubit of his state in either the X basis or the Z basis. This is because the amplified\nHamiltonian contains tensor products of arbitrary combinations of XX and ZZ terms from the original Hamiltonian,\nand not only tensor products of terms in the same basis. These mixed terms can be measured by a Bob who does\nwhat we call mixed basis measurements (measurements that involve measuring each of n qubits in either the X or the\nZ basis, with potentially different basis choices for different qubits). However, if the verifier picks the mixed bases\ndepending on the distribution induced by the constant-gap Hamiltonian, the resulting distribution over Bob questions\nis not necessarily ‘compatible’ with even the regular Pauli braiding test. Moreover, it becomes even more difficult to\nuse anything other than the all-X and all-Z measurements when we consider the succinct version of Pauli braiding, for\nreasons that we will elaborate on shortly (in the section ‘Succinct Pauli braiding’).\nThe natural solution is to use the all-X and all-Z measurements when we play Pauli braiding, use the mixed basis\nmeasurements when we do the energy test, and introduce some sort of consistency test to ensure that the operators that\nBob uses in the energy test are in some sense the same ones as the ones he uses in Pauli braiding. (We call this test\nthe mixed-vs-pure basis test; the protocol is described in Protocol 7.) Such tests have been analysed in the nonlocal\nsetting before [NW19], but we are the first to attempt to analyse such a test in the compiled setting, and the compilation\nintroduces unforeseen difficulties (see ‘Difficulties in the analysis of the mixed-vs-pure basis test’ below).\nThe easiest solution to the difficulties that we were able to come up with involves reproving the Gowers-Hatami\ntheorem (or, rather, the parts of the theorem relevant for self-testing) in a way that supports arbitrary non-uniform\nexpectations. The (informal) theorem statement for our version of Gowers-Hatami is as follows:\nTheorem 1.2 (informal). Let f : G →U(H) be a function from a finite group G to the set of unitaries on some\nHilbert space H. Then there exists a finite-dimensional Hilbert space H′, an isometry V : H →H′, and a unitary\nrepresentation 𝜋: G →U(H′) of G such that for all measures 𝜇over G,\nE\ng∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2 ≤𝜖=\n⇒\nE\ng∼𝜇∥f(g)−V †𝜋(g)V∥2 ≤𝜖,\nwhere we are being purposefully vague about the norm.\nThe difference between this theorem and the more typical formulation is that the typical formulation has uniform\nexpectations over the group everywhere. A version of Gowers-Hatami similar to Theorem 1.2 is often needed in\nthe self-testing setting when 𝜇is in particular the uniform distribution over {𝜎Z(a) : a ∈{0,1}n} or {𝜎X(b) : b ∈\n{0,1}n}, and it is plausible that Theorem 1.2 could also be proven by modifying in some way Gowers and Hatami’s\n8\n\n\noriginal proof of their theorem. Nonetheless, the proof that we present under Theorem 3.1 (the formal version of\nTheorem 1.2) is an entirely different proof that only uses basic tools from quantum information, namely Stinespring\ndilation (instead of matrix Fourier analysis on non-Abelian groups [GH15]). We emphasise that our proof is not a\nreproof of the full Gowers-Hatami theorem, because the original theorem gets bounds on the dimension of the ‘post-\nrounding’ Hilbert space H′ (which one typically does not need in self-testing-related applications of Gowers-Hatami).\nHowever, our proof has the advantage that it is completely elementary and self-contained. We believe this proof may\nbe of independent interest, because the fact that it is simple and self-contained makes it easier to modify the statement\nwhen necessary to incorporate additional desirable properties (such as, for example, the tolerance for non-uniform\nexpectations that we needed for this work). Together with a ‘distribution-switching’ trick presented in Lemma 3.3, we\nare able to use this version of Gowers-Hatami to work out an analysis of the mixed-vs-pure basis test. We give more\ndetails about how we did this at the end of the following section.\nDifficulties in the analysis of the mixed-vs-pure basis test.\nNow we elaborate more thoroughly on the nature of\nthe difficulties that we encountered in analysing the mixed-vs-pure basis test, which we finally resolved by using\nTheorem 3.1 and Lemma 3.3. We firstly justify the sense in which the all-X and all-Z measurements are particularly\n‘compatible’ with Pauli braiding, in order to clarify why the consistency test is necessary in the first place.\nWhy the mixed-vs-pure basis test is necessary.\nThe reason why the all-X and all-Z measurements are particularly suit-\nable for use in the Pauli braiding protocol is that the all-Z question can be interpreted as a simultaneous measurement\nof the 2n binary observables {𝜎Z(a) : a ∈{0,1}n}, where 𝜎Z(a) is the binary observable that is the tensor product of\n𝜎Z on all the qubits i where ai = 1 and identity otherwise; and, similarly, the all-X question can be interpreted as a sim-\nultaneous measurement of the 2n binary observables {𝜎X(b) : b ∈{0,1}n}. Another (more precise) way to say this is\nthat, given the (potentially cheating) projective measurement {PZ\nu : u ∈{0,1}n} that Bob applies when he receives the\ninstruction to measure everything in the Z basis, we can construct a set of 2n binary observables {Z(a) : a ∈{0,1}n}\nwhich are exactly linear, in the sense that\nZ(a)Z(a′) = Z(a+a′),\n(1.1)\neven if Bob is dishonest: simply take\nZ(a) :=\n∑\nu∈{0,1}n\n(−1)u·aPZ\nu .\nA similar statement holds true for the all-X measurement: we can define a set of 2n binary observables {X(b) : b ∈\n{0,1}n} such that\nX(b)X(b′) = X(b+b′).\n(1.2)\nWe can use the CHSH game and the commutation test in order to certify that these 2·2n binary observables {Z(a),X(b) :\na,b ∈{0,1}n} satisfy the commutation relations that would hold if they were genuine Paulis, i.e.\n∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2 ≤O(𝜖).\n(1.3)\nTaking the linearity (Equation (1.1) and Equation (1.2)) and commutation (Equation (1.3)) relations together, we can\nprove that {Z(a) : a ∈{0,1}n} and {X(b) : b ∈{0,1}n} approximately satisfy the relations satisfied by the corres-\nponding elements of the Pauli group. Moreover, by taking products, we can extend Z(a) and X(b) to a matrix-valued\nfunction f(s,a,b) = (−1)sZ(a)X(b) that approximately obeys the multiplication law of the Pauli group. The Gowers-\nHatami theorem then implies that there is a rounding of f which exactly satisfies the Pauli group relations (up to\nisometry). That is, there exists a representation 𝜌of the Pauli group such that, on average over s,a,b, f(s,a,b) is close\nto 𝜌(s,a,b) conjugated by the isometry.\nZooming back out to the level of designing Bob’s questions, note that the all-Z and all-X questions were par-\nticularly nice for the Pauli braiding test because (1) the sets {𝜎Z(a) : a ∈{0,1}n} and {𝜎X(b) : b ∈{0,1}n} taken\ntogether generate the entire n-qubit Pauli group, and (2) the trick of constructing many binary observables from a\n9\n\n\nsingle projective measurement gave us exact linearity on the Z side and the X side individually almost for free: that is,\n{Z(a) : a ∈{0,1}n} is automatically an exact representation of Zn\n2, and the same is true of {X(b) : b ∈{0,1}n}.\nThere is no guarantee that these nice properties hold if we consider (instead of the all-X and all-Z questions) the\nset of mixed-basis questions induced by the energy test for our constant-gap Hamiltonian. In particular, there is no\nguarantee that the binary observables which can be constructed from Bob’s set of mixed basis measurements will\ngenerate the whole Pauli group, in the way that {𝜎Z(a) : a ∈{0,1}n} and {𝜎X(b) : b ∈{0,1}n} generate the whole\nPauli group. It becomes even more important to use the all-X and all-Z questions if we want to eventually make the\nPauli braiding test question-succinct: we give some intuition as to why this is the case in the section ‘Succinct Pauli\nbraiding’.\nThe easiest solution seems to be to introduce a consistency test between Bob’s mixed basis measurements (that\nwe would like Bob to use when he plays the energy test) and Bob’s pure basis measurements (that we would like\nBob to use when he plays the Pauli braiding test). More specifically—following the standard template for designing\ntests of this form—we will introduce two new questions into Alice’s question set that are identical to Bob’s pure basis\nquestions (i.e. ‘measure all in X’ and ‘measure all in Z’); we will ask Bob to play his pure basis operators against\nAlice’s pure basis operators, in order to check that Bob’s pure basis operators are consistent with Alice’s pure basis\noperators; and then we will ask Bob to play his mixed basis operators against Alice’s pure basis operators, and check\nthat they agree whenever the bases align, which (since we checked that Bob’s and Alice’s pure basis operators agree) is\nessentially equivalent to checking that Bob’s mixed basis operators are consistent with Bob’s pure basis operators. We\nmight hope that this test, combined with the usual analysis, will be sufficient to allow us to ‘round’ Bob’s mixed operat-\nors in the same way that we can round Bob’s all-X and all-Z measurements by using the usual Gowers-Hatami analysis.\nDifficulties in the analysis.\nUnfortunately, instantiating this intuition proves to be nontrivial in the compiled setting,\neven though the analysis is fairly routine in the nonlocal setting. The tensor product structure of the provers’ Hilbert\nspace in the nonlocal setting is useful because it supports a large range of convenient operations that are loosely\ngrouped together under the name of ‘prover-switching’. The ordinary nonlocal analysis of a consistency test like this\none would proceed primarily through prover-switching calculations. While we did find it necessary to prove some\nlemmas which capture certain applications of prover-switching in the compiled setting (see Section 6.1), we found\nthat these lemmas were insufficient in order to analyse the mixed-vs-pure basis test.\nMore specifically, the main difficulty we encountered was the following. The statement we would like to show, in\norder to make the energy test work in the presence of mixed terms, is of the following form. Let w ∈{1,X,Z}n be a\nstring indicating which Pauli bases to measure n qubits in. We want to show that, if Alice and Bob win in our protocol\nwith high probability, then there exists an isometry V such that, for the distribution D on Pauli basis choices induced\nby the constant-gap Hamiltonian,\nE\nw∼D\nE\na∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2 ≤small,\nwhere 𝜎w(a) is the honest Pauli observable that corresponds to the tensor product\n𝜎w(a) =\nO\ni\n𝜎ai\nwi .\nand Ow(a) is Bob’s potentially cheating version of 𝜎w(a).\nNormal pure-basis Gowers-Hatami tells us that, if Alice and Bob win with high probability in Pauli braiding, then\nfor any W ∈{X,Z} it is the case that\nE\na∈{0,1}n ∥W(a)−V †(𝜎W(a)⊗1aux)V∥2 ≤small,\n(1.4)\nfor some fixed isometry V. One idea for proceeding with the analysis might be to show that Ow(a) ≈Z(c)X(d) using\nthe mixed-vs-pure basis test (with c being the string such that ci = 1 iff ai = 1 and wi = W, and similarly for d),\nand then to ‘round’ Z(c) and X(d) separately using Equation (1.4). Unfortunately, rounding something of the form\nZ(c)X(d) naïvely using Equation (1.4) produces something of the form\nV †(𝜎Z(c)⊗1aux)VV †(𝜎X(d)⊗1aux)V.\n10\n\n\nSince V is an isometry and not a unitary, VV † is not necessarily 1, and it is unclear how to get rid of it: we call this\nthe ‘VV † problem’. There are ways to bypass this problem in the nonlocal setting using tensor product structure, but\nwe were not able to replicate these techniques in the compiled setting.\nInstead, we bypass the problem by ‘directly’ proving a form of Gowers-Hatami that, perhaps surprisingly, allows\nus to round in expectation over any distribution over the Pauli group, even though the Pauli braiding test is only played\nwith the uniform distribution. More specifically, we prove our version of Gowers-Hatami (Theorem 3.1, stated earlier\ninformally as Theorem 1.2), which can be used to round arbitrary distributions over the underlying group, provided\nwith the right hypothesis; and then we prove, using a ‘distribution-switching’ trick (Lemma 3.3), that the hypothesis\nof Theorem 3.1 can be obtained for any distribution 𝜇even if we only start with commutation relations that hold on\nuniform average over pure-basis elements (and a few other conditions, such as exact linearity), which is what we have\naccess to through the pure-basis Pauli braiding test.\nSuccinct Pauli braiding.\nFinally, armed with the mixed-vs-pure basis test, we can focus on making the Pauli braid-\ning test succinct (where, by ‘Pauli braiding test’, we mean the version in which Bob always gets asked either the all-X\nor the all-Z question). Our starting point for this mission is de la Salle’s elegant simplification [dlS22] of ‘question\nreduction’ from [JNV+20], in which he introduces a version of Pauli braiding where Alice’s questions are sampled\nfrom 𝜖-biased sets. The normal Pauli braiding game proceeds as follows:\n• The verifier chooses two strings a,b ∈{0,1}n uniformly at random.\n• The verifier decides what to do next based on the parity of a·b:\n– If a·b = 0, the verifier referees a commutation game (in which honest Alice plays with 𝜎Z(a) and 𝜎X(b)).\n– If a·b = 1, the verifier referees an anticommutation game (in which, again, honest Alice plays by embed-\nding 𝜎Z(a) and 𝜎X(b) into her strategy).\nThe commutation game is designed to test that two particular operators commute, and the anticommutation game\n(based on CHSH or Magic Square) is designed to test that two particular operators anticommute.\nNote that the verifier has to send a,b to Alice for this protocol to work. The protocol was made succinct by de\nla Salle simply by choosing a,b from 𝜖-biased sets instead of from all of {0,1}n. This is a natural idea, but it is at\nfirst surprising that it works at all: after all, the sets of Paulis {𝜎Z(a) : a ∈S} and {𝜎X(b) : b ∈S} for some 𝜖-biased\nS, where |S| = poly(n), only cover an exponentially small fraction of the Pauli group! All that the protocol directly\ncertifies is commutation and anticommutation relations among pairs of operators in these sets. Naïvely, to deduce\nrelations about representations of general group elements, one would need to write these elements as poly(n)-length\nwords in the group elements from the 𝜖-biased sets, and apply the relations on the 𝜖-biased sets poly(n)-many times.\nThis would seemingly rule out a test with constant soundness.\nMiraculously, however, everything still works as before, and the reason is that we do probe the entire group through\nBob, who still measures the all-X and all-Z mesaurements. In particular, we have ‘for free’ (or by construction)\nthat Bob’s X(b) operators, taken as a set, form an exact representation of Zn\n2, and the same for his Z(a) operators.\nMeanwhile, all elements of the Pauli group can be written as words of constant length in the operators {𝜎Z(a) : a ∈\n{0,1}n} and {𝜎X(b) : b ∈{0,1}n}. In some sense, de la Salle’s test works because probing the commutation relations\nbetween two exact representations of Zn\n2 on only an 𝜖-biased set is sufficient to establish the commutation relations\neverywhere, because the function of 𝜖-biased sets is precisely to ‘fool’ exactly linear functions. In fact, de la Salle’s\ntest and its analysis are analogous to the “derandomized BLR test” for linear functions and the Fourier-based analysis\nof it presented in Section 6.4 of [O’D14].\nIn order to use the succinct version of Pauli braiding in our protocol, we have to come up with a version of the\nanalysis that works in the compiled setting. Unfortunately, de la Salle’s original proof in the nonlocal case is written in\nthe ‘synchronous’ setting, in which the provers (even malicious provers) are assumed to start out by sharing EPR pairs.\nThis assumption simplifies the calculations because it allows us to move (‘prover switch’) measurements freely from\none prover to the other. The synchronicity assumption is without loss of generality in the nonlocal setting by [Vid22],\nbut no compiled version of this result exists. Therefore, we have to redo the proof in our setting using the state-\ndependent distance, and come up with ways to use the cryptography to simulate the “prover switching\" steps in de\nla Salle’s analysis. (At the time of [NZ23a] it was not known whether the cryptography could in fact simulate these\n11\n\n\nproperties.) In the process, we pare down de la Salle’s proof to the parts that are essential for analysing succinct Pauli\nbraiding and state it in more computer-science-like language, which may be useful for future readers with a computer\nscience background. Our version of de la Salle’s analysis is presented as Lemma 3.5.\nRelated work.\nSimultaneously, a succinct argument system for QMA based only on the post-quantum security\nof LWE (a standard assumption) was achieved by [GKNV24]. Both of these works use tools from [BKL+22], in\nparticular the technique of “subsampling” a Hamiltonian using a PRG, and the technique of transforming a semi-\nsuccinct protocol into a fully succinct one by using succinct arguments of knowledge. However, the methods they use\nto solve the key technical challenge of succinctly delegating many-qubit Pauli measurements are essentially disjoint.\nIn particular, for us, the “heavy lifting\" to achieve question-succinctness is performed information theoretically, in\nour question-succinct two-prover self-test for EPR pairs, whereas for them, succinctness is achieved by using specific\ntechnical features of a cryptographic construction using LWE.\nAcknowledgements.\nWe are grateful to Fermi Ma for allowing us to rewind him until we could extract an under-\nstanding from the succinct arguments in Section 9 of [BKL+22]. We also thank Yael Kalai, Alex Lombardi, and\nThomas Vidick for useful discussions. TM acknowledges support from the ETH Zurich Quantum Center and an ETH\nDoc.Mobility Fellowship.\n2\nPreliminaries\n2.1\nNotation\nWe assume basic familiarity with quantum states and measurements. We consider finite dimensional Hilbert spaces,\nwhich we commonly denote by H. The set of linear operator A : H →H is L(H), the set of positive semidefinite\nA : H →H is Pos(H), and the set of unitaries U : H →H is U(H). For A ∈L(H), we use ∥A∥p := Tr[(A†A)p/2]1/p to\ndenote its Schatten p-norm. For any (subnormalised) pure state |𝜓⟩, we denote the (subnormalised) density matrix by\n𝜓.\nFor a probability distribution D over some set X, we write x ∼D to denote a sample drawn according to D. We\nwrite x ∼X to denote a sample drawn uniformly from X.\nFor a,b ∈C and 𝛿> 0, we write a ≈𝛿b if |a−b| ≤𝛿.\n2.2\nNonlocal games\nIn a non-local game, a verifier (or referee) sends questions to multiple non-communicating provers, receives an answer\nfrom each prover, and evaluates the question-answer combination using a verification predicate to decide whether the\nprovers “win” or “lose” the game. Formally, a two-prover non-local game is specified by the following.\nDefinition 2.1. A nonlocal game G is given by natural numbers n1,n2,m1,m2, a distribution Q over pairs (x,y) ∈\n{0,1}n1 × {0,1}n2, and a polynomial-time verification predicate V(x,y,a,b) ∈{0,1}, where a ∈{0,1}m1 and b ∈\n{0,1}m2.\n2.3\nPauli matrices and Heisenberg-Weyl group\nWe use the usual Pauli matrices 𝜎X,𝜎Y,𝜎Z. We will also find it convenient to set 𝜎1 = 1. For w ∈{1,X,Z}n and\na ∈{0,1}n, we define\n𝜎w(a) =\nO\ni\n𝜎ai\nwi .\nWe also write 𝜎w = 𝜎w(\n⃗\n1) = ⊗i𝜎wi.\n12\n\n\nIn addition, we define the Pauli projections 𝜋w\na as\n𝜋w\nu =\nO\ni\n\u00121+(−1)ui𝜎wi\n2\n\u0013\n=\nE\na∈{0,1}n(−1)u·a𝜎w(a).\n(2.1)\nThe Heisenberg-Weyl group on n qubits, denoted Wn, is the group generated by {𝜎X(a),𝜎Z(b)}a,b∈{0,1}n, where the\ngroup operation is induced by matrix multiplication. More formally, to differentiate between the group in the abstract\nand its concrete representation in terms of Pauli matrices, we view Wn as a group with generators X1,...,Xn,Z1,...,Zn,\nwith the multiplication rule given by associating Xi with 𝜎X(ei) and Zj with 𝜎X(ej) (where ei ∈{0,1}n is 0 everywhere\nexcept on position i, where it is 1). We record the representations of Wn in the following lemma.\nLemma 2.2. The irreducible representations of the Heisenberg-Weyl group Wn consist of\n• The one-dimensional representations, given by choosing an assignment of 1 or −1 for each of the generators\nX1,Z1,...,Xn,Zn\nand filling out the rest of the multiplication table accordingly. Note that for any one-dimension irrep 𝜋, 𝜋(−id) =\n𝜋(X1Z1X1Z1) = 1, where the first equality uses that X1Z1X1Z1 = −id according to the group relations, and the\nsecond equality uses the representation property and the fact that multiplication of scalars is commutative.\n• The ‘fundamental representation’ given by the 2n-dimensional Pauli matrices: that is,\n∀j,\nXj 7→𝜎X(e j),\nZj 7→𝜎Z(ej).\n2.4\nReduced measurements\nWe will frequently consider measurements that return tuples as outcomes. For those measurements, it is convenient to\ndefine reduced (or marginalised) measurements, where we only care about some of the elements of the outcome tuple\nand ignore the others. For this, we define the following notation.\nDefinition 2.3. For any alphabet Σ, let u ∈Σn, and let S = {i1,i2,...,ik} ⊆[n]. Then u|S := (ui1,...,uik) ∈Σk is the\nrestriction of u to S.\nDefinition 2.4. For any alphabet Σ, w ∈Σn, and W ∈Σ, the set {w = W} is defined as {i ∈[n] : wi = W}.\nDefinition 2.5 (Reduced measurements). For any alphabet Σ, measurement {Qu}u∈Σn, and set S ⊆[n], we define the\nreduced measurement\n(Q|S)v∈Σ|S| = ∑\nu:u|S=v\nQu.\nWe will often apply this definition to measurements that measure many qubits, each in one of the Pauli bases, to\nselect the outcomes corresponding to a single basis. Specifically, for Σ = {0,1}, and for any Pauli string w ∈{X,Z}n,\nbasis choice W ∈{X,Z}, and string v ∈{0,1}|{w=W}|, we have\n(Q|{w=W})v =\n∑\nu:u|{w=W}=v\nQu ,\nIn other words (Q|{w=W})v is the marginalisation over all outcomes on indices where wi ̸= W.\n13\n\n\n2.5\nState dependent norm\nDefinition 2.6 (State-dependent inner product and norm). Let H be a finite-dimensional Hilbert space and A,B ∈L(H)\nbe linear operators on H. Let 𝜓∈Pos(H). We define the state-dependent (semi) inner product of A and B w.r.t 𝜓as\n⟨A,B⟩𝜓= Tr[A†B𝜓].\nThis induces the state-dependent (semi) norm\n∥A∥2\n𝜓= ⟨A,A⟩𝜓= Tr[A†A𝜓].\nRemark 2.7. The state dependent (semi) norm can also be expressed as a Schatten 2-norm (also called the Hilbert-\nSchmidt norm):\n∥A∥𝜓=\n\n\n\nA𝜓1/2\n\n\n2 .\nWe collect a number of basic properties of the state dependent norm. These are standard properties and easy to\nprove from the definitions.\nLemma 2.8 (Basic properties of the state dependent norm). For all (not necessarily normalised) states 𝜓,𝜓′ ∈Pos(H)\nand linear operators A,B ∈L(H) on some finite-dimensional Hilbert space H:\n(i) ∥A∥B𝜓B† = ∥AB∥𝜓.\n(ii) ∥AB∥𝜓≤∥A∥∞∥B∥𝜓.\n(iii) For any unitary U, ∥UA∥𝜓= ∥A∥𝜓.\n(iv) Linearity of the squared norm in the state: ∥A∥2\n𝜓+𝜓′ = ∥A∥2\n𝜓+∥A∥2\n𝜓′.\n(v) Triangle inequality for the squared norm: ∥A+B∥2\n𝜓≤2∥A∥2\n𝜓+2∥B∥2\n𝜓.\nLemma 2.9. For an observable A on H and two states 𝜓,𝜓on H with ∥𝜓−𝜓′∥1 ≤𝜖, we have that\n∥A∥2\n𝜓≈∥A∥2\n∞𝜖∥A∥2\n𝜓′ .\nProof. This follows immediately from the definition of the state dependent norm and Hölder’s inequality.\nLemma 2.10. For all i ∈I (for some index set I) let Ai ∈L(H) and 𝜓i ∈Pos(H) such that ∑i Tr[𝜓i] ≤1. Then\n∑\ni\n∥Ai𝜓i∥1 ≤\nr\n∑\ni\n∥Ai∥2\n𝜓i .\nProof. We first split 𝜓i = 𝜓1/2\ni\n𝜓1/2\ni\nand apply Hölder’s inequality:\n∑\ni\n∥Ai𝜓i∥1 ≤∑\ni\n\n\n\nAi𝜓1/2\ni\n\n\n\n2\n\n\n\n𝜓1/2\ni\n\n\n\n2 .\nNow applying Cauchy Schwarz:\n≤\ns\n∑\ni\n\n\n\nAi𝜓1/2\ni\n\n\n\n2\n2 ·\ns\n∑\ni\n\n\n\n𝜓1/2\ni\n\n\n\n2\n2 ≤\nr\n∑\ni\n∥Ai∥2\n𝜓i ,\nwhere in the last line we rewrote the first factor as a state-dependent norm and for the second factor] observed that\n∑i\n\n\n\n𝜓1/2\ni\n\n\n\n2\n2 = ∑i Tr[𝜓i] ≤1.\n14\n\n\n2.6\nEfficient observables and computational indistinguishability\nDefinition 2.11 (Computational indistinguishability). Two families of (subnormalized) states {𝜓1(𝜆)}𝜆and {𝜓2(𝜆)}𝜆,\nindexed by a security parameter 𝜆, are compuationally indistinguishable if for any family of computationally eficient\ntwo-outcome POVMs {M(𝜆),1−M(𝜆)}𝜆indexed by 𝜆, it holds that\nTr[M(𝜆)(𝜓1(𝜆)−𝜓2(𝜆)] ≤negl(𝜆).\nWe typically indicate this by\n𝜓1\nc\n≈𝜓2,\nsuppressing the dependence on 𝜆in the notation.\nLemma 2.12. Let {U1\na }a∈A,...,{Uk\na}a∈A and {V 1\nb }b∈B,...,{V ℓ\nb }b∈B be families of efficient unitaries on some Hilbert\nspace H, s : Ak × Bℓ→{0,1} an efficiently computable function, and 𝜇an efficiently sampleable distribution over\nA×k ×B×ℓ.\nConsider two states 𝜓\nc\n≈𝛿𝜓′. Then\nE\n(a1,...,ak,b1,...,bℓ)∼𝜇\n\n\n\nU1\na1 ···Uk\nak −(−1)s(a1,...,ak,b1,...,bℓ)V 1\nb1 ···V ℓ\nbℓ\n\n\n\n2\n𝜓\n≈𝛿\nE\n(a1,...,ak,b1,...,bℓ)∼𝜇\n\n\n\nU1\na1 ···Uk\nak −(−1)s(a1,...,ak,b1,...,bℓ)V 1\nb1 ···V ℓ\nbℓ\n\n\n\n2\n𝜓′ .\nProof. Note that the product of efficient unitaries is another efficient unitary. Then this follows directly from the\ndefinition of computational indistinguishability (Definition 2.11), linearity of expectation, and [MV21, Lemma 2.6].\n2.7\nQuantum homomorphic encryption\nThe following definitions are taken with some modifications from [KLVY21]. Note that this definition of quantum\nhomomorphic encryption requires, among other specialised requirements, that the scheme specialises to a classical\nencryption scheme when applied to classical messages: we need this property in our constructions.\nDefinition 2.13 (Quantum Homomorphic Encryption (QHE)). A quantum homomorphic encryption scheme QHE =\n(Gen,Enc,Eval,Dec) for a class of quantum circuits C is a tuple of algorithms with the following syntax:\n• Gen is a PPT algorithm that takes as input the security parameter 1𝜆and outputs a (classical) secret key sk of\npoly(𝜆) bits;\n• Enc is a PPT algorithm that takes as input a secret key sk and a classical input x, and outputs a classical\nciphertext ct;\n• Eval is a QPT algorithm that takes as input a tuple (C,|Ψ⟩,ctin), where C : H×(C2)⊗n →(C2)⊗m is a quantum\ncircuit, |Ψ⟩∈H is a quantum state, and ctin is a ciphertext corresponding to an n-bit classical plaintext. Eval\ncomputes a quantum circuit EvalC(|Ψ⟩⊗|0⟩⊗poly(𝜆,n),ctin) which outputs a ciphertext ctout. If C has classical\noutput, we require that EvalC also has classical output.\n• Dec is a QPT algorithm that takes as input a secret key sk and ciphertext ct, and outputs a state |𝜙⟩. Additionally,\nif ct is a classical ciphertext, the decryption algorithm outputs a classical string y.\nWe require the following three properties from (Gen,Enc,Eval,Dec):\n• Correctness with auxiliary input: For every security parameter 𝜆∈N, any quantum circuitC : HA×(C2)⊗n →\n{0,1}∗(with classical output), any quantum state |Ψ⟩AB ∈HA ⊗HB, any message x ∈{0,1}n, any secret key\nsk ←Gen(1𝜆) and any ciphertext ct ←Enc(sk,x), the following states have negligible trace distance:\n15\n\n\nGame 1. Start with (x,|Ψ⟩AB). Evaluate C on x and register A, obtaining classical string y. Output y and the\ncontents of register B.\nGame 2. Start with ct ←Enc(sk,x) and |Ψ⟩AB. Compute ct′ ←EvalC(·⊗|0⟩poly(𝜆,n),ct) on register A. Compute\ny′ = Dec(sk,ct′). Output y′ and the contents of register B.\nIn words, “correctness with auxiliary input” requires that if QHE evaluation is applied to a register A that is\na part of a joint (entangled) state in HA ⊗HB, the entanglement between the QHE evaluated output and B is\npreserved.\n• IND-CPA security against quantum distinguishers: For any two messages x0,x1 and any QPT adversary A:\n\f\n\f\n\f\n\fPr\n\u0014\nAEncsk(·)(ct0) = 1\n\f\n\f\n\f\n\f\nsk ←Gen(1𝜆)\nct0 ←Enc(sk,x0)\n\u0015\n−Pr\n\u0014\nAEncsk(·)(ct1) = 1\n\f\n\f\n\f\n\f\nsk ←Gen(1𝜆)\nct1 ←Enc(sk,x1)\n\u0015\f\n\f\n\f\n\f\n≤negl(𝜆) .\n• Relaxed compactness: We do not need the typical notion of homomorphic encryption compactness, which\nstates that decryption must not depend on the evaluated circuit. However, we do require the following (much\nweaker) properties:\n– Classical-quantum (CQ) compactness. There is a PPT algorithm DecClassical which, for any entirely\nclassical ciphertext ct′ originating from the experiment ‘Game 2’ described in ‘Correctness with auxiliary\ninput’, satisfies the definition of correctness with auxiliary input when substituted for Dec.\n– Compactness of encryption. The running time of Enc on input single-bit messages should not be larger\nthan poly(L)·polylog(S)·poly(𝜆), where L is a depth upper bound on the circuits that need to be evaluated\nand S is a size upper bound. (Note that this restriction does not apply to Eval.)\nCompactness of encryption, which we require in order to achieve the question-succinctness of Protocol 2, is a\nproperty satisfied by most levelled homomorphic encryption schemes. This property suffices for us because all of the\n‘Alice’ computations in Protocol 3 can be done by log depth circuits (log in the instance size n), and for question\nsuccinctness we just need the verifier’s questions to be polylogn in length (and computable in the same time).\n3\nApproximate representation theory\n3.1\nGowers-Hatami theorem with non-uniform measures\nThe Gowers-Hatami theorem [GH15] states that if a function f : G →U(H) from a finite group to unitary matrices\napproximately behaves like a representation, then it can be “rounded” to an exact representation. The formulation of\nthis statement in [GH15] required that the “approximate representation behaviour” hold on average over uniformly\nsampled pairs of group elements. As explained in the introduction, we require a similar statement, but for arbitrary\nmeasures over the group. Formally, we show the following.\nTheorem 3.1. Let f : G →U(H). Then there exists a finite-dimensional Hilbert space H′, an isometry V : H →H′,\nand a unitary representation 𝜋: G →U(H′) of G such that for all measures 𝜇over G and all normalised states 𝜓,\nE\ng∼𝜇,h∼Wn ∥f(h)f(g)−f(hg)∥2\n𝜓≤𝜖=\n⇒\nE\ng∼𝜇∥f(g)−V †𝜋(g)V∥2\n𝜓≤𝜖.\nProof. Let HG be the complex space of formal sums of group elements and define a representation 𝜋: G →L(HG) by\n𝜋(g) = ∑\nh∼Wn\n|h⟩⟨hg|.\n16\n\n\nIt is clear that 𝜋is a unitary representation of G (in fact, 𝜋is just the regular representation, written in Dirac notation).\nWe define the convolution of f with itself as\nf ∗(g) = E\nh∼Wn f(h)† f(hg).\nWith this, we can define a superoperator 𝜙: L(HG) →L(H) by taking the linear extension of\n𝜙(|g⟩⟨h|) = 1\n|G| f ∗(g−1h).\nSince f(g) is always unitary, it follows immediately that 𝜙is unital, i.e. 𝜙(1) = 1. We further claim that 𝜙is completely\npositive. To show this, it suffices to show that the Choi operator\nC = ∑\ng,h\n𝜙(|g⟩⟨h|)⊗|g⟩⟨h| ∈L(H⊗HG)\nis positive. For this, take any |x⟩∈H⊗HG and decompose it as\n|x⟩= ∑\ng\n|xg⟩|g⟩.\nHere, |xg⟩are not necessarily orthogonal or normalised. Then,\n⟨x|C|x⟩= ∑\ng,h\n⟨xg|𝜙(|g⟩⟨h|)|xh⟩\n= 1\n|G| ∑\ng,h\n⟨xg|f ∗(g−1h)|xh⟩\n=\n1\n|G|2 ∑\ng,h,l\n⟨xg|f(l)† f(lg−1h)|xh⟩\n=\n1\n|G|2 ∑\ng,h,l\n⟨xg|f(lg)† f(lh)|xh⟩\n=\n1\n|G|2 ∑\nl\n⟨𝜉l|𝜉l⟩≥0,\nwith |𝜉l⟩= ∑g f(lg)|xg⟩, where we relabelled l 7→lg in the fourth line.\nHaving shown that 𝜙is unital and completely positive, we can apply Stinespring’s dilation theorem to deduce that\nthere exists some auxiliary space K and an isometry V : H →HG ⊗K such that for all A ∈L(HG),\n𝜙(A) = V †(A⊗1K)V .\nTo relate this back to the original question of rounding the approximate representation f, we observe that\nf ∗(g) = 𝜙(𝜋(g)) = V †(𝜋(g)⊗1K)V .\nTaking the isometry in the theorem statement to be V and the exact representation 𝜋(g)⊗1K (which, in a slight abuse\nof notation, we again just call 𝜋), we can therefore bound\nE\ng∼𝜇∥f(g)−V †𝜋(g)V∥2\n𝜓= E\ng∼𝜇∥f(g)−f ∗(g)∥2\n𝜓\n= E\ng∼𝜇∥E\nh∼Wn( f(g)−f(h)† f(hg))∥2\n𝜓\n≤\nE\ng∼𝜇,h∼Wn ∥f(g)−f(h)† f(hg)∥2\n𝜓\n=\nE\ng∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2\n𝜓≤𝜖,\nwhere the inequality follows from Cauchy-Schwarz and the last line uses left-unitary invariance of the state dependent\nnorm (Item (iii)) and the assumption that f is an approximate representation.\nRemark 3.2. Observe that if f is exactly left-multiplicative over some 𝜇, i.e. if f(g) f(h) = f(gh) for all g ∈supp(𝜇)\nand for all h ∈G, then f(g) = V †𝜋(g)V for all g ∈supp(𝜇).\n17\n\n\n3.2\nSwitching distributions for approximate Heisenberg-Weyl group representations\nWe will be particularly concerned with approximate representations of the Heisenberg-Weyl group. The following\nlemma shows that if a collection of operators {Z(a),X(b)}a,b∈{0,1}n satisfies certain properties for uniform expectations\nover the group, these operators can be rounded to Pauli operators for arbitrary expectations. We note that this switch\nfrom uniform to arbitrary measures does not work in general and crucially relies on each of {Z(a)} and {X(b)} being\nan exact representation of Zn\n2.\nLemma 3.3. Suppose we have collections of efficient binary observables {Z(a)}a∈{0,1}n and {X(b)}b∈{0,1}n on a\nHilbert space H that each form exact representations of Zn\n2, i.e. for all a,b ∈{0,1}n, Z(a + b) = Z(a)Z(b) and\nX(a+b) = X(a)X(b). Consider a state 𝜓and suppose that the following conditions hold: Suppose that\nE\na Z(a)𝜓Z(a)\nc\n≈𝜓,\n(3.1)\nE\na X(a)𝜓X(a)\nc\n≈𝜓,\n(3.2)\nE\na,b∈{0,1}n\n\n\n\nZ(a)X(b)−(−1)a·bX(b)Z(a)\n\n\n\n2\n𝜓≤𝜖.\n(3.3)\nThen there exists an isometry V : H →C2n ⊗Haux such that for all distributions 𝜇on {0,1}n ×{0,1}n,\nE\n(a,b)∼𝜇\n\n\nZ(a)X(b)−V †(𝜎Z(a)𝜎X(b)⊗1Haux)V\n\n\n2\n𝜓≤O(𝜖).\nProof. Define the following function from the Heisenberg-Weyl group to U(H):\nf(±𝜎Z(a)𝜎X(b)) = ±Z(a)X(b).\nOur proof strategy is as follows: first show that f is an approximate representation over arbitrary measures 𝜇, i.e. that\nit satisfies the hypothesis of Theorem 3.1; then use Theorem 3.1 and the structure of the irreps of the Heisenberg-Weyl\ngroup to round Z(a) and X(b) to the corresponding Pauli operators.\nTo show that f is an approximate representation, we first bound the following quantity for an arbitrary measure 𝜇\non {0,1}n ×{0,1}n.\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\nX(a)Z(b)X(c)Z(d)−(−1)b·cX(a+c)Z(b+d)\n\n\n\n2\n𝜓\nBy Lemma 2.12 and Lemma 2.8 Item (iv):\n≈negl\nE\nu∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\nX(a)Z(b)X(c)Z(d)−(−1)b·cX(a+c)Z(b+d)\n\n\n\n2\nZ(u)𝜓Z(u)\nBy Lemma 2.8 Item (i):\n=\nE\nu∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\nX(a)Z(b)X(c)Z(d +u)−(−1)b·cX(a+c)Z(b+d +u)\n\n\n\n2\n𝜓\nAgain applying Lemma 2.12 and Lemma 2.8 Item (i) and Item (iv) to Ev X(v)𝜓X(v)\nc\n≈𝜓:\n≈negl\nE\nu,v∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\nX(a)Z(b)X(c)Z(d +u)X(v)−(−1)b·cX(a+c)Z(b+d +u)X(v)\n\n\n\n2\n𝜓\nBy Equation (3.3) (noting that the marginal distributions of d +u and b+d +u are both uniform and independent from\nv) and Lemma 2.8 Item (ii):\n=\nE\nu,v∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\n(−1)v·(d+u)X(a)Z(b)X(c+v)Z(d +u)−(−1)b·c+v·(b+d+u)X(a+c+v)Z(b+d +u)\n\n\n\n2\n𝜓+O(𝜖)\n18\n\n\nRepeating the same step (now noting that c+v and d +u are independent and uniform, and likewise for a+c+v and\nb+d +u) and cancelling phases:\n=\nE\nu,v∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇\n\n\n\n(−1)c·(d+u)X(a)Z(b+d +u)X(c+v)−(−1)b·c+v·(b+d+u)X(a+c+v)Z(b+d +u)\n\n\n\n2\n𝜓+O(𝜖)\nWith one more repetition of the same step, we finally get:\n=\nE\nu,v∈{0,1}n\nE\na,b∈{0,1}n\nE\n(c,d)∼𝜇∥X(a+c+v)Z(b+d +u)−X(a+c+v)Z(b+d +u)∥2\n𝜓+O(𝜖) = O(𝜖).\nFrom the above calculation and the fact that f is exactly multiplicative under ±1 we get that f is an approximate\nrepresentation of the Heisenberg-Weyl group Wn for any distribution 𝜇over the group. Expressed in equations, we\nhave shown that for any distribution 𝜇on Wn,\nE\ng∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2\n𝜓≤O(𝜖).\nFurthermore from the definition of f we have that f is exactly multiplicative under ±1, which we can also write\n(slightly cumbersomely) as\nE\ng∼𝜇−,h∼Wn ∥f(h)f(g)−f(hg)∥2\nf = 0,\nwhere 𝜇−is the point distribution that has all its weight on the −1-element of Wn.\nWe can therefore apply Theorem 3.1 and, noting that in that theorem the representation 𝜋and the isometry V are\nindependent of the distribution 𝜇, get that there exists an isometry V : H →H′ and a unitary representation 𝜋of Wn on\nH′ such that\nE\ng∼𝜇\n\n\nf(g)−V †𝜋(g)V\n\n\n2\n𝜓≤O(𝜖),\n(3.4)\nE\ng∼𝜇−\n\n\n f(g)−V †𝜋(g)V\n\n\n2\n𝜓=\n\n\n1+V †𝜋(−1)V\n\n\n2\n𝜓= 0.\n(3.5)\nFor Equation (3.5), we used that f(−1) = −1.\nEquation (3.4) shows that f can be rounded to some representation of the Heisenberg-Weyl group. However, we\nwant a stronger statement: we want to show that we can round f to the actual Pauli matrices (tensored with identity),\nwhereas an arbitrary representation might contain other representations of Wn.\nFor this, we write 𝜋(g) = 𝜋+(g) ⊕𝜋−(g) where 𝜋±(·) is a representation satisfying 𝜋±(−g) = ±𝜋±(g) for all g.\nBy Lemma 2.2, any representation of the Pauli group can be written this way, by decomposing it into a direct sum\nof irreducible representations, and grouping together all the one-dimensional irreps into 𝜋+, and all the copies of the\nfundamental representation into 𝜋−. Moreover, by padding with copies of the trivial representation (and adding all-0\nrows to V appropriately), we can ensure that dim(𝜋+) = kdim(𝜋−). As such, we assume without loss of generality\nthat dim(𝜋+) = kdim(𝜋−).\nThe intuition for the remainder of the proof is as follows: we will simply replace the 𝜋+-part of the representation\nwith k copies of the 𝜋−-part; call this modified representation 𝜋′. Of course 𝜋and 𝜋′ now differ a lot as representations,\nbut we need to show that after applying the isometry V and in the state-dependent norm, this difference does not matter.\nThis will follow from Equation (3.5).\nMore formally, we define\n𝜋′(g) :=\n\u0012\n𝜋−(g)⊗Ik\n𝜋−(g)\n\u0013\nh′(g) := V †𝜋′(g)V .\nWe will also use the notational shorthand\nh(g) = V †𝜋(g)V.\n19\n\n\nNote that because 𝜋−only consists of copies of the fundamental representation (the Pauli matrices), so does 𝜋′.\nThis means that 𝜋′ is of the form we claimed in the theorem, i.e. it is a tensor product of the Pauli matrices with\nidentities.\nIt therefore suffices to show that ∥h′(g)−h(g)∥𝜓= 0. To see that this is the case, note that since 𝜋−(g) ≤1,\n∥h′(g)−h(g)∥2\n𝜓= ∥V †\n\u0012\n𝜋−(g)⊗Ik −𝜋+(g)\n0\n\u0013\nV∥2\n𝜓\n≤\n\n\n\n\nV †\n\u0012\n2·1\n0\n\u0013\nV\n\n\n\n\n2\n𝜓\n=\n\n\nV †(𝜋(1)+ 𝜋(−1))V\n\n\n2\n𝜓\n=\n\n\n1+V †𝜋(−1)V\n\n\n2\n𝜓= 0.\nThe last line uses Equation (3.5). This completes the proof.\n3.3\nLifting (anti-)commutation from small-bias sets\nIn [dlS22], de la Salle gave a question-succinct version of the Pauli braiding test of [NV17]. The key step in his proof is\nto show that if (anti-)commutation statements for a certain set of observables hold on average over a 𝜆-biased set, they\nalso hold on average over all observables (up to small corrections). We need a similar statement, but unfortunately\nwe cannot use the result from [dlS22] directly since it is proven in the Frobenius norm, whereas we need it in the\nstate-dependent norm. Additionally, since we want to use this step for compiled games, we cannot use the full suite of\ntechniques from non-local games (in particular, we cannot use prover switching). We remedy this situation by proving\nthe following variant of de la Salle’s result. This also gives a more elementary proof of de la Salle’s original result.\nDefinition 3.4. A set S ⊆{0,1}n is 𝜆-biased if for all b ∈{0,1}n such that b ̸= 0n,\n| E\na∈S(−1)a·b| ≤𝜆.\nIt is known how to efficiently construct a 𝜆-biased set S of size O(n/poly(𝜆)) using error correcting codes [NN90].\nIn our applications, 𝜆will always be a universal constant.\nLemma 3.5. Let M and {W(a)}a∈{0,1}n be efficient binary observables acting on a Hilbert space H satisfying\nW(a)W(b) = W(a+b) and 𝜌a state on H such that\n𝜌\nc\n≈𝛿E\na W(a)𝜌W(a).\nFurther let S ∈{0,1}n be a 𝜆-biased set. Then\nE\na∈{0,1}n ∥W(a)M −MW(a)∥2\n𝜌≤\n1\n1−𝜆E\na∈T ∥W(a)M −MW(a)∥2\n𝜌+\n2𝛿\n1−𝜆.\nProof. Let T ⊆{0,1}n be an arbitrary set (later we will set T = S or T = {0,1}n). Define ˜\n𝜌= EaW(a)𝜌W(a). By\nLemma 2.12, for any a ∈{0,1}n it holds that\n∥W(a)M −MW(a)∥2\n𝜌≥∥W(a)M −MW(a)∥2\n˜\n𝜌−𝛿.\nConsequently, this also holds on average over a ∈T, i.e.\nE\na∈T ∥W(a)M −MW(a)∥2\n𝜌≥E\na∈T ∥W(a)M −MW(a)∥2\n˜\n𝜌−𝛿.\n(3.6)\nUsing that M and Z(a) are binary observables,\nE\na∈T ∥W(a)M −MW(a)∥2\n˜\n𝜌= 2−2ℜE\na∈T Tr[MW(a)MW(a) ˜\n𝜌] .\n20\n\n\nOur goal is therefore to relate the trace expression for T = Zn\n2 and T = S. For this, observe that W(a) forms a unitary\nrepresentation of Zn\n2, which we can decompose into a direct sum of irreducible representations:\nW(a) = ˜\nUD(a) ˜\nU† ,\nD(a) = ⊕i ((−1)𝛾i·a ⊗1mi)\nfor U ∈U(H) and distinct strings 𝛾i ∈Zn\n2 with multiplicities mi such that ∑i mi = dimH. In this basis, ˜\n𝜌has a\nblock-diagonal structure made up of blocks of size mi, i.e.\n˜\nU† ˜\n𝜌˜\nU = ⊕i𝜌i\nfor positive semi-definite blocks 𝜌i of dimension mi. For each i, let Wi ∈U(mi) be a unitary that diagonalises 𝜌i and\ndefine\nU = ˜\nU(⊕iWi).\nThis is a unitary and by construction,\n𝜎:= U† ˜\n𝜌U = diag(𝜎1,...,𝜎dimH)\nis diagonal. Furthermore, (⊕iWi) commutes with all matrices D(a), so that we also have\nW(a) = UD(a)U† ,\nD(a) = ⊕dimH\ni\n((−1)ci·a) ,\nwhere ci ∈{0,1}n are the same as the 𝛾i above, except that for the rest of the proof we find it more convenient to\nrepeat strings rather than keeping track of their multiplicities by tensoring with identity.\nFor convenience, we define\nΓ = U†MU .\nThen, we can rewrite\nE\na∈T Tr[MW(a)MW(a) ˜\n𝜌] = E\na∈T Tr[ΓD(a)ΓD(a)𝜎]\n= E\na∈T ∑\ni, j,k\nΓij(−1)c j·aΓ jk(−1)ck·a𝜎ki\n= ∑\ni, j,k\n\u0012\nE\na∈T(−1)(c j+ck)·a\n\u0013\nΓijΓ jk𝜎ki\nSince 𝜎= diag(𝜎i):\n= ∑\ni, j\n\u0012\nE\na∈T(−1)(c j+ci)·a\n\u0013\nΓijΓ ji𝜎i\nSince M is Hermitian, so is Γ, so that Γji = Γ∗\ni j:\n= ∑\ni, j\n\u0012\nE\na∈T(−1)(c j+ci)·a\n\u0013\n|Γij|2𝜎i .\nWe now divide up the indices i, j over which we sum into two sets:\nC = {(i, j) | ci ̸= cj},\n¯\nC = [dimH]2 \\C.\nIf (i, j) ∈¯\nC, then\nE\na∈Zn\n2\n(−1)(c j+ci)·a = E\na∈S(−1)(c j+ci)·a = 1.\n21\n\n\nOn the other hand, if (i, j) ∈C, then since S is 𝜆-biased we have that\nE\na∈Zn\n2\n(−1)(c j+ci)·a = 0,\n| E\na∈S(−1)(c j+ci)·a| ≤𝜆.\nWe therefore get\nE\na∈{0,1}n ∥W(a)M −MW(a)∥2\n˜\n𝜌= 2−2 ∑\ni, j∈¯\nC\n|Γij|2𝜎i\nand, since |Γij|2𝜎i ≥0,\nE\na∈S∥W(a)M −MW(a)∥2\n˜\n𝜌≥2−2 ∑\ni, j∈¯\nC\n|Γij|2𝜎i −2𝜆∑\ni, j∈C\n|Γij|2𝜎i .\nWe can simplify this by observing that since Γ is a binary observable,\n∑\ni j\n|Γij|2𝜎i = Tr[Γ†Γ𝜎] = 1.\nAs a result,\nE\na∈S∥W(a)M −MW(a)∥2\n˜\n𝜌≥2−2 ∑\ni, j∈¯\nC\n|Γij|2𝜎i −2𝜆\n \n1−∑\ni, j∈¯\nC\n|Γij|2𝜎i\n!\n= (1−𝜆) E\na∈Zn\n2\n∥W(a)M −MW(a)∥2\n˜\n𝜌.\nThe lemma now follows by first switching from 𝜌to ˜\n𝜌on both sides using Equation (3.6) (incurring an error 𝛿+\n𝛿\n1−𝜆≤\n2𝛿\n1−𝜆) and then using the above bound.\nLemma 3.5 implies the following corollary on anti-commutation relations.\nCorollary 3.6. Let {X(a)}a∈{0,1}n and {Z(a)}a∈{0,1}n be families of efficient binary observables acting on a Hilbert\nspace H satisfying W(a)W(b) = W(a+b) for all W ∈{X,Z} and a,b ∈{0,1}n. Let 𝜌be a state on H such that\n𝜌\nc\n≈𝛿E\na W(a)𝜌W(a).\nfor all W ∈{X,Z}. Further, let S ∈{0,1}n be a 𝜆-biased set. Then\nE\na,b∈{0,1}n ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜌≤\n1\n(1−𝜆)2\nE\na,b∈S∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜌+ 2𝛿(2−𝜆)\n(1−𝜆)2 .\nProof. Let 𝜌′\nAB = 𝜌A ⊗1\n2n IB. For W ∈{X,Z}, define\n˜\nW(a)AB = W(a)A ⊗𝜎W(a)B.\nObserve that\n[ ˜\nZ(a), ˜\nX(b)] = (Z(a)X(b)−(−1)a,bX(b)Z(a))⊗𝜎Z(b)𝜎X(a).\nMoreover, for any operators M on the A system and N on the B system, it holds that\n∥M ⊗N∥2\n𝜌′ = Tr[M†M ⊗N†N𝜌′]\n= 1\n2n Tr[M†M𝜌]·Tr[N†N]\n= ∥M∥2\n𝜌· 1\n2n Tr[N†N].\n22\n\n\nThus, we have\nE\na,b∈{0,1}n∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜌\n=\nE\na,b∈{0,1}n ∥[ ˜\nZ(a), ˜\nX(b)]∥2\n𝜌′\n≤\n1\n1−𝜆E\na∈S\nE\nb∈{0,1}n ∥[ ˜\nZ(a), ˜\nX(b)]∥2\n𝜌′ +\n2𝛿\n1−𝜆\n≤\n1\n(1−𝜆)2\nE\na,b∈S∥[ ˜\nZ(a), ˜\nX(b)]∥2\n𝜌′ +2𝛿\n\u0012\n1\n1−𝜆+\n1\n(1−𝜆)2\n\u0013\n=\n1\n(1−𝜆)2\nE\na,b∈S∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜌+2𝛿\n\u0012\n1\n1−𝜆+\n1\n(1−𝜆)2\n\u0013\n.\n4\nDescription of the question-succinct protocol\n4.1\nCompiling nonlocal games using cryptography: the KLVY transformation\nKalai, Lombardi, Vaikuntanathan and Yang give a transformation that maps a k-player 1-round nonlocal game into a\n2k-message (k-round) interactive protocol between a single prover and verifier. For simplicity, we will only present\ntheir transformation as it is applied to two-player nonlocal games, because this is the only context in which we need\nto use it. The general transformation, applicable to k-player nonlocal games for arbitrary k, is described in [KLVY21,\nSection 3.2]. The following presentation is taken with some modifications from [KLVY21, Section 3.1].\n[KLVY21] presents a PPT-computable transformation that converts any 2-prover non-local game G with question\nset Q and verification predicate V into a single-prover protocol (associated with security parameter 𝜆), defined as\nfollows. Fix a quantum homomorphic encryption scheme QHE = (Gen,Enc,Eval,Dec).\n(i) The verifier samples (x,y) ←Q, sk ←Gen(1𝜆), and c ←Enc(sk,x). The verifier then sends c to the prover as\nits first message.\n(ii) The prover replies with a message 𝛼.\n(iii) The verifier sends y to the prover in the clear.\n(iv) The prover replies with a message b.\n(v) Define a := Dec(sk,𝛼). The verifier accepts if and only if V(x,y,a,b) = 1.\n4.2\nDescription of question-succinct protocol for QMA\nIn the following, we will denote the syntax of the protocol in regular font, and we will denote the actions of the honest\nprover(s) in italics.\nProtocol 2. Question-succinct argument system for QMA\nInputs: An instance x ∈{0,1}∗, an algorithm C which is the verifier for a QMA promise problem A =\n(Ayes,Ano) such that A ∈QMA, and a security parameter 𝜆∈N. The protocol is given by applying the KLVY\ncompiler (described in Section 4.1) with security parameter 𝜆to Protocol 3.\n23\n\n\nProtocol 3. Question-succinct (two-prover) proof system for QMA\nInputs: An instance x ∈{0,1}∗and an algorithm C which is the verifier for a QMA promise problem\nA = (Ayes,Ano) such that A ∈QMA.\nOn input x,C, execute the reduction given in Theorem 6.21 to produce a Hamiltonian problem (H,𝛼(n), 𝛽(n))\n(see Definition 6.12) with 𝛽(n)−𝛼(n) = 1−negl(n), where H is an n-qubit operator (n = poly(|x|)) with the\nfollowing form:\nH = 1−E\nw∈D ∑\nu∈Q(w)\n𝜋w\nu\nwhere\n• w ∈{1,X,Z}n is a Pauli string,\n• {𝜋w\nu }u is the projective measurement corresponding to measuring n qubits in the natural way in the Pauli\nbases specified by w (see Equation (2.1) for a formal definition),\n• Q(w) ⊆{0,1}n is a set for which membership can be decided in polynomial time in n given w, and\n• D is a distribution over {1,X,Z}n which can be efficiently sampled from using sampling randomness of\nlength 2polylog(n).\nIn words, if H is of this form, then the quantity 1−Tr[H𝜌] for any n-qubit state 𝜌can be estimated by a QPT\n(in n) verifier who samples a w from D, measures the n qubits of 𝜌in the Pauli bases specified by w, obtains\noutcomes a, and accepts iff a ∈Q(w).\nAssume that we are considering a yes-instance x ∈Ayes. Honest Alice receives a witness that x ∈Ayes as\ninput, and converts it in polynomial time to a n-qubit witness 𝜌that the ground energy of H is ≤𝛼(n). Honest\nAlice and Bob then share n+1 EPR pairs between themselves; most of the tests in the following protocol use\nonly the last n EPR pairs, but the first EPR pair will be used in Protocol 6.\nThe verifier executes each of the following tests with Alice and Bob with equal probability.\n(i) Pauli braiding test. Described in Protocol 4; n will be the number of qubits on which H acts.\n(ii) Mixed-versus-pure basis test. Described in Protocol 7; the distribution D will be the D such that\nH = 1−E\nw∼D∑u∈Q(w) 𝜋w\nu .\n(iii) Hamiltonian test. Described in Protocol 8; the distribution D and the sets {Q(w)}w will be those such\nthat H = 1−E\nw∼D∑u∈Q(w) 𝜋w\nu .\n24\n\n\nProtocol 4. Pauli braiding test with succinct questions\nInput: an integer n.\nLet S ⊆{0,1}n be a 𝜇-biased set. The verifier picks a,b uniformly at random from S ⊆{0,1}n. Assuming\nthat |S| = poly(n), this process takes O(logn) bits of randomness. Let the randomness which the verifier uses\nin this process be denoted r = (ra,rb), where ra determines a and rb determines b.\n(i) (Commutation): If a·b = 0, the verifier executes the commutation test (Protocol 5) with questions ra,rb.\n(ii) (Anticommutation): If a·b = 1, the verifier executes the anticommutation test (Protocol 6) with ques-\ntions ra,rb.\nProtocol 5. Commutation test\nInput: questions ra and rb which index two elements a and b in S ⊆{0,1}n.\n1. The verifier sends (com,ra,rb) to Alice, and recieves responses (ua,ub) with ua,ub ∈{0,1}. Honest Alice\ncomputes a and b from ra and rb, measures 𝜎Z(a) and 𝜎X(b) on her last n qubits, and returns the results\nas ua and ub respectively.\n2. The verifier picks W ∈{X,Z} uniformly at random and sends W to Bob. Bob responds with v ∈{0,1}n.\nNote that Bob is not told that he is playing the commutation test: he receives only the question label W.\nHonest Bob measures his last n qubits in the W basis.\n3. If W = Z, the verifier accepts iff ∏i:ai=1 vi = ua. If W = X, the verifier accepts iff ∏i:bi=1 vi = ub.\n25\n\n\nProtocol 6. Anticommutation test\nInput: questions ra and rb which index two elements a and b in S ⊆{0,1}n.\nIn this protocol, the verifier plays a version of the Mermin-Peres Magic Square game [Ara02, Mer90, Per90]\nwith the provers, in which Alice is asked to measure three observables forming a row or column of the square,\nand Bob is asked to measure an observable from a single cell of the square. Both provers are instructed to use\nthe observables labeled by ra and rb for two specific cells in the square (the top centre and centre left cells), as\nindicated below.\n1. The verifier chooses a cell index j ∈[9] uniformly at random; it then chooses uniformly at random a row\nor a column on a 3×3 grid which contains cell j. Suppose that the cell indices of the 3 cells in this row\nor column are (i1,i2,i3) (one of these will be equal to j).\n2. The verifier sends (MS,ra,rb,i1,i2,i3) to Alice, and receives responses u1,u2,u3 ∈{0,1}. Honest Alice\ncomputes a and b from ra,rb. Then she measures the three (n + 1)-qubit observables associated with\ncells i1,i2,i3 in the following grid, and returns all three 1-bit outcomes to the verifier:\n𝜎Z ⊗1\n1⊗𝜎Z(a)\n𝜎Z ⊗𝜎Z(a)\n1⊗𝜎X(b)\n𝜎X ⊗1\n𝜎X ⊗𝜎X(b)\n−𝜎Z ⊗𝜎X(b)\n−𝜎X ⊗𝜎Z(a)\n−𝜎Z𝜎X ⊗𝜎Z(a)𝜎X(b)\nOperators before the tensor product are understood always to act on the first qubit of Alice’s halves of\nthe shared EPR pairs, and operators after the tensor product on the last n qubits.\n3. If j = 2 (i.e. Bob’s question indicates the top centre cell), the verifier sends Z to Bob, receives v ∈{0,1}n\nas an answer, and accepts iff ∏i:ai=1 vi is equal to u2 (if Alice was asked a row question) or u1 (if Alice\nwas asked a column question). If j = 4 (i.e. Bob’s question indicates the centre left cell), the verifier\nsends X to Bob, receives v ∈{0,1}n as an answer, and accepts iff ∏i:bi=1 vi is equal to u1 (if Alice was\nasked a row question) or u2 (if Alice was asked a column question. In all other cases, the verifier sends\n(MS,ra,rb, j) to Bob, receives a single-bit answer v ∈{0,1}, and accepts iff v = uk for the k ∈[3] such\nthat uk = j. Honest Bob measures all his qubits in the W basis when he receives a single bit question W,\nand in all other cases uses the same strategy as honest Alice, except that he only measures a single cell\ninstead of 3.\n26\n\n\nProtocol 7. Mixed-versus-pure basis test\nInput: a distribution D over {1,X,Z}n which can be sampled from using no more than 2polylogn random\nbits.\n1. The verifier selects a basis W from {X,Z} uniformly at random and sends W to Alice. It receives answer\nu ∈{0,1}n. Honest Alice measures all of her qubits in the W basis.\n2. The verifier selects a uniformly random b ←{0,1}.\n(i) If b = 0, the verifier sends W to Bob, and receives answer v ∈{0,1}n. It accepts iff u = v. Honest\nBob measures all of his qubits in the W basis.\n(ii) If b = 1, the verifier samples a Pauli string w from D and sends its sampling randomness (which is\npolylogn bits in length) to Bob. It accepts iff for all i where wi =W, it is the case that ui = vi. Honest\nBob measures his last n qubits in the Pauli bases designated by w and reports all the measurement\nresults. For qubits where wi = 1, he always reports the measurement result 0.\nProtocol 8. Hamiltonian test\nInput: a distribution D over {1,X,Z}n which can be sampled from using no more than 2polylogn random\nbits, along with a collection of sets {Q(w) : w ∈{1,X,Z}n} such that Q(w) ⊆{0,1}n (described in a way such\nthat membership in Q(w) can be efficiently decided given w).\n1. The verifier sends question tele to Alice, and receives in response two strings, ux,uz ∈{0,1}n. Honest\nAlice teleports her ground state to Bob through their last n shared EPR pairs and reports the teleportation\ncorrections.\n2. The verifier samples a Pauli string w from D and sends its sampling randomness (which is polylogn bits\nin length) to Bob. The verifier then receives measurement outcomes from Bob, corrects Bob’s outcomes\nusing Alice’s reported teleportation corrections, and does the appropriate energy test. More specifically,\nthe verifier receives answer v from Bob, and computes for every i such that wi ̸= 1\nsi =\nvi\n|{z}\nBob’s measurement\n⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X]\n|\n{z\n}\ncorrection from Alice\nThen the verifier sets si = 0 for every i such that wi = 1, and accepts iff s ∈Q(w). Honest Bob measures\nhis last n qubits in the Pauli bases designated by w and reports all the measurement results. For qubits\nwhere wi = 1, he always reports the measurement result 0.\n4.3\nQuestion types\nFor convenience, we summarise the different question types that Alice and Bob may each see in Protocol 3 here.\n(These are not necessarily in one-to-one correspondence with the subgames of the protocol, since some subgames are\nindistinguishable from Bob’s point of view.)\nWe denote the set of Alice questions by QA and the set of Bob questions by QB.\nAlice questions:\n27\n\n\n• (com,ra,rb): compute a and b from ra and rb and measure 𝜎Z(a) and 𝜎X(b).\n• (MS,ra,rb,i1,i2,i3): compute a and b and play magic square for the cells indicated by i1,i2,i3 with the operators\nfor cells 1 and 5 coinciding with the 𝜎X(a) and 𝜎Z(b) operators.\n• X or Z: measure all qubits in 𝜎X or 𝜎Z basis.\n• w for Pauli string w ∈{1,X,Z}n: do mixed basis measurement in Pauli bases given by w.\n• tele: do teleportation measurement.\nBob questions:\n• X or Z: measure all qubits in 𝜎X or 𝜎Z basis.\n• (MS,ra,rb, j): compute a and b and play magic square for the cell indicated by j with the operators for cells 1\nand 5 coinciding with the 𝜎X(a) and 𝜎Z(b) operators.\n• w for Pauli string w ∈{1,X,Z}n: do mixed basis measurement in Pauli bases given by w.\n5\nModeling and state-dependent norms for the compiled game\n5.1\nModelling the prover in any compiled game\nWe recall the formalism used by [NZ23a] to model the prover’s strategy in a compiled nonlocal game. In general, the\nprover’s actions in any compiled game can be modeled as follows. The prover starts with some initial (pure) state |𝜓⟩.\nIn the first round, it performs a projective measurement depending on the ciphertext question c to obtain an outcome\n𝛼, followed by a unitary depending on c and 𝛼, to obtain a post-measurement state. In the second round, it performs a\nprojective measurement on its residual state depending on the plaintext question y, to obtain an outcome b.\nWe note that both measurements can be assumed to be projective without loss of generality, by the Naimark dilation\ntheorem. We also note that the post-measurement unitary is necessary in the compiled case, since both “provers\" act\nsequentially on the same register; it is usually ignored in the case of nonlocal games, since the provers act on separate\nsubsystems.\nMathematically, we model the strategy of the prover as follows:\n(i) The initial pure state is denoted |𝜓⟩. We often write 𝜓for |𝜓⟩⟨𝜓|.\n(ii) The first measurement (the “Alice measurement\") is modeled by a collection of non-Hermitian operators Ac\n𝛼.\nThese satisfy the condition that for each c, the collection of operators {(Ac\n𝛼)†(Ac\n𝛼)} forms a projective measure-\nment. Thus, the probability that Alice returns outcome 𝛼in response to question c is\nPr[𝛼] = ⟨𝜓|(Ac\n𝛼)†(Ac\n𝛼)|𝜓⟩.\n(iii) The un-normalized post-measurement state after receiving question c and responding with answer 𝛼is\n|𝜓c\n𝛼⟩= Ac\n𝛼|𝜓⟩.\n(5.1)\nNote that ∥|𝜓c\n𝛼⟩∥2 = Pr[𝛼]. The post-measurement state marginalizing over outcomes for question c is the mixed\nstate\n𝜓c = ∑\n𝛼\n𝜓c\n𝛼= ∑\n𝛼\n|𝜓c\n𝛼⟩⟨𝜓c\n𝛼|.\n(iv) The second measurement (the “Bob measurement\") is modeled by a POVM measurement {By\nb} for each question\ny. While this measurement can always be taken to be projective without loss of generality, in the analysis it will\nsometimes be convenient to construct strategies where this measurement is a POVM.\n28\n\n\nAltogether, then, we can specify a strategy for a compiled nonlocal game by a triple (|𝜓⟩,{Ac\n𝛼},{By\nb}), where each\nelement of the triple is implicitly a function of the security parameter 𝜆and the encryption key sk.\nFor notational convenience, given any Alice question q ∈QA, we sometimes use the shorthand\n𝜓Enc(q)\n𝛼\n= E\nsk\nE\nc←Encsk(q)𝜓c\n𝛼,\n𝜓Enc(q) = E\nsk\nE\nc←Encsk(q)𝜓c\nRemark 5.1 (Implicit expectation over keys). The security of an encryption scheme (Gen,Enc,Dec) requires the\nencryption keys to be chosen randomly by Gen. In particular, this means that certain indistinguishability statements\nwe will want to make hold only in expectation over keys sk output by Gen: for example, when we claim that two\nAlice post-measurement (mixed) states 𝜓Enc(q) and 𝜓Enc(q′) are indistinguishable to Bob, we really mean that, for any\ntwo-outcome measurement {M,I −M} that can be implemented by a circuit with size poly(𝜆), there exists a negligible\nfunction 𝜂(𝜆) such that\nE\nsk←Gen(𝜆)\n\f\n\f\n\fTr[M𝜓Enc(q)]−Tr[M𝜓Enc(q′)]\n\f\n\f\n\f ≤𝜂(𝜆).\n(5.2)\nWe will frequently leave the expectation over these keys implicit: in other words, in the above example, we may\nsimply write\n\f\n\f\n\fTr[M𝜓Enc(q)]−Tr[M𝜓Enc(q′)]\n\f\n\f\n\f ≤𝜂(𝜆).\nWhenever we have expressions that include both Enc and Dec, it is understood that both functions use the same keys,\ni.e. that there is one global implicit expectation over keys. For example, when we write ∥O(Dec(𝛼))∥2\n𝜓Enc(q)for some\nobservables O(·) that depend on the decryption of a ciphertext 𝛼, this is understood to mean\nE\nsk←Gen(𝜆)∥O(Decsk(𝛼))∥2\n𝜓Encsk(q) ,\nwhere, analogously to before, 𝜓Encsk(q) := Ec←Encsk(q) 𝜓c. We usually use this convention for the squared norm, where\nit is justified by the linearity property (Lemma 2.8 Item (iv)).\nWe record the following fact, which follows directly from the security of the QHE scheme used in the KLVY\ncompiler in Protocol 2, as defined in Definition 2.13.\nLemma 5.2. For any two Alice questions q1,q2 ∈QA,\n𝜓Enc(q1) c\n≈𝜓Enc(q2) .\nMeasuring closeness of strategies.\nIn the analysis of a compiled nonlocal game, it often occurs that we wish to\nshow if we replace Bob’s measurements {By\nb} with new measurements {Cy\nb} that are close in the appropriate distance\nmetric, then the winning probability of the strategy is approximately preserved. Specifically, we will often measure\ncloseness in terms of the state-dependent norm on the post-measurement state, after Alice’s measurement has been\napplied:\nE\nx,y∼DG∑\n𝛼,y\n∥By\nb −Cy\nb∥2\n𝜓Enc(x)\n𝛼\n≤𝜖,\nwhere DG is the distribution over questions sampled in the game.\nIn some special cases, Lemma 2.10 can be applied to relate this state-dependent distance bound to the winning\nprobability. Specifically, it applies for the case of unique games where every answer for Bob determines a unique\nwinning answer for Alice and vice versa; this lets us define 𝜓i in the lemma to be Alice’s post-measurement state\nfor this unique outcome, which satisfies the condition ∑i Tr𝜓i ≤1. However, for general games, the situation is\nmore complicated, and there is a nice relation between state-dependent distance and success probability only if one\nof the two strategies being compared consists of projective measurements. The following lemma, based on Fact 4.31\nfrom [NW19], gives us the statement we will need.\n29\n\n\nLemma 5.3. Let G be a nonlocal game, |𝜓⟩a state, {Ac\n𝛼} be a collection of compiled Alice measurements, and {By\nb}\nand {Cy\nb} be two collections of Bob measurements such that By\nb is projective, and\nE\nx,y∼DG∑\n𝛼∑\nb\n∥By\nb −Cy\nb∥2\n𝜓Enc(x)\n𝛼\n≤𝜖,\nwhere DG is the distribution over question pairs in the game. Then the success probabilities of the strategy using\n(|𝜓⟩,{Ac\n𝛼},{By\nb}) and the strategy using (|𝜓⟩,{Ac\n𝛼},{Cy\nb}) are O(√𝜖)-close.\nProof. Define\n∆y\nb = Cy\nb −By\nb.\nFor any c,𝛼,y, let S be a subset of Bob’s outcome space. Then we claim that\n∑\nb∈S\nTr[Cy\nb𝜓c\n𝛼] ≥∑\nb∈S\nTr[By\nb𝜓c\n𝛼]−2\nr\n∑\nb∈S\n∥∆y\nb∥2\n𝜓c\n𝛼.\n(5.3)\nBefore we prove this claim, let us see why it implies the conclusion of the Lemma. For each c,𝛼,y, let Sc,𝛼,y be the\nset of answers b such that (c,y,𝛼,b) is an accepting question and answer tuple for the compiled game verifier. Then\nthe success probability of the Bob strategy {Cy\nb} is given by\n𝜔∗({Cy\nb}) =\nE\nx,y∼DG\nE\nc←Enc(x)∑\n𝛼\n∑\nb∈Sb,𝛼,y\nTr[Cy\nb𝜓c\n𝛼]\n≥\nE\nx,y∼DG\nE\nc←Enc(x)∑\n𝛼\n\n∑\nb∈Sb,𝛼,y\nTr[By\nb𝜓c\n𝛼]−2\ns\n∑\nb∈S(b,𝛼,y)\n∥∆y\nb∥2\n𝜓c\n𝛼\n\n\n≥𝜔∗({By\nb})−2\nE\nx,y∼DG\nE\nc←Enc(x)∑\n𝛼\ns\n∑\nb∈S(b,𝛼,y)\n∥∆y\nb∥2\n𝜓c\n𝛼\n≥𝜔∗({By\nb})−2\nr\nE\nx,y∼DG\nE\nc←Enc(x)∑\n𝛼∑\nb\n∥∆y\nb∥2\n𝜓c\n𝛼\n= 𝜔∗({By\nb})−2√𝜖.\nApplying the same logic with Sc,y,𝛼taken to be the set of rejecting Bob answers b yields the statement\n1−𝜔∗({Cy\nb}) ≥(1−𝜔∗({By\nb}))−2√𝜖\n𝜔∗({Cy\nb}) ≤𝜔∗({By\nb})+2√𝜖.\nThus, the conclusion of the Lemma follows.\nNow it remains to prove Equation (5.3). First, let us observe that\nCy\nb ⪰(Cy\nb)2\n= By\nb +(∆y\nb)2 +By\nb∆y\nb +∆y\nbBy\nb.\nHere, the first line follows from the fact that, as a valid POVM element, CY\nb ⪯I, and the second line uses the projectivity\nof By\nb to replace (By\nb)2 by By\nb. We will now prove Equation (5.3) by lower-bounding the success probability of a\n30\n\n\n“subnormalized” strategy using the squared operators (Cy\nb)2 as POVM elements.\n∑\nb∈S\nTr[Cy\nb𝜓c\n𝛼] ≥∑\nb∈S\nTr[(Cy\nb)2𝜓c\n𝛼]\n= ∑\nb∈S\nTr[By\nb𝜓c\n𝛼]+ ∑\nb∈S\n∥∆y\nb∥2\n𝜓c\n𝛼+ ∑\nb∈S\nTr[(By\nb∆y\nb +∆y\nbBy\nb)𝜓c\n𝛼]\n≥∑\nb∈S\nTr[By\nb𝜓c\n𝛼]−2 ∑\nb∈S\n∥By\nb(𝜓c\n𝛼)1/2∥2∥∆y\nb(𝜓c\n𝛼)1/2∥2\n≥∑\nb∈S\nTr[By\nb𝜓c\n𝛼]−2\nr\n∑\nb∈S\n∥By\nb(𝜓c\n𝛼)1/2∥2\n2\nr\n∑\nb∈S\n∥∆y\nb(𝜓c\n𝛼)1/2∥2\n2\n≥∑\nb∈S\nTr[By\nb𝜓c\n𝛼]−2\nr\n∑\nb∈S\n∥∆y\nb∥2\n𝜓c\n𝛼.\nHere, we used Hölder for the first inequality, Cauchy-Schwarz for the second, and the fact that {By\nb} is a normalized\nmeasurement for the third.\n5.2\nModelling the prover in Protocol 2\nWe will also need to establish some notation specific to the prover’s ‘Bob’ operators in Protocol 2.\nDefinition 5.4 (Projective measurements).\n(i) Pure basis measurements. In the Pauli braiding test (Protocol 4), and also in the b = 0 case of the mixed versus\npure basis test (Protocol 7), Bob is asked a single bit question corresponding to a basis setting (X or Z). For\neach basis setting W ∈{X,Z}, we notate Bob’s projective measurement after receiving question W as a set of\nprojectors {PW\nu }u with outcomes u ∈{0,1}n.\n(ii) Mixed basis measurements. In the mixed versus pure basis test (Protocol 7), Bob receives a question w ∈\n{1,X,Z}n corresponding to n Pauli basis settings (one for each of n qubits). For each Pauli string w ∈{1,X,Z}n,\nwe notate Bob’s projective measurement after receiving question w as a set of projectors {Mw\nu }u∈{0,1}n. We can\nassume without loss of generality that Bob always answers “0” on indices where he was asked to measure the\nidentity, i.e. formally we can assume that Mw\nu = 0 if there exists an index i ∈[n] for which wi = 1 but ui = 1.\nThe reason that this assumption is without loss of generality is that we can always replace Bob’s measurements\nby a post-processed version that has this property; since the verifier ignores all indices for which wi = 1, this\npost-processing affects neither Bob’s success probability nor any of the rigidity statements we show below.\nDefinition 5.5 (Pure basis observables). For W ∈{X,Z} and a ∈{0,1}n, define the binary observable\nW(a) := ∑\nu\n(−1)u·aPW\nu .\nDefinition 5.6 (Mixed basis observables). For w ∈{1,X,Z}n and a ∈{0,1}n, define the binary observables\nOw(a) =\n∑\nu∈{0,1}n\n(−1)a·uMw\nu ,\nOw\nW(a) =\n∑\nu∈{0,1}n\n(−1)\n⃗\n1w=W∧a=1·uMw\nu .\nWe also write Ow = Ow(\n⃗\n1) and Ow\nW = Ow\nW(\n⃗\n1).\nRemark 5.7. Recall that Mw\nu = 0 if there exists an index i for which wi = 1 but ui = 1. This implies that if two bitstrings\na,a′ ∈{0,1}n only differ on indices i for which wi = 1, then Ow(a) = Ow(a′). By the same reasoning, if a,a′ ∈{0,1}n\nonly differ on indices i for which wi ̸= W, then Ow\nW(a) = Ow\nW(a′).\n31\n\n\nFor the same reason, we can also restrict the sum over u only to those indices that matter, i.e. we can drop the sum\nover those u for which Mw\nu = 0. In particular, this yields another expression for Ow and Ow\nW, which will occasionally\nbe more convenient to use:\nOw =\n∑\nu∈{0,1}|{u̸=1}|\n(−1)\n⃗\n1·u(Mw|{w̸=1})u ,\nOw\nW =\n∑\nu∈{0,1}|{w=W}|\n(−1)\n⃗\n1·u(Mw|{w=W})u .\nLemma 5.8. For all w ∈{1,X,Z}n,\nOw = Ow\nXOw\nZ .\nProof. First observe that for any u ∈{0,1}|{w̸=1}|,\n(Mw|{w=X})u|{w=X}(Mw|{w=Z})u|{w=Z} =\n\n\n∑\na:a|{w=X}=u|{w=X}\nMw\na\n\n\n\n\n∑\nb:b|{w=Z}=u|{w=Z}\nMw\nb\n\n\n=\n∑\na s.t.\na|{w=X}=u|{w=X}\n∧a|{w=Z}=u|{w=Z}\nMw\na\n=\n∑\na:a|{w̸=1}=u\nMw\na\n= (Mw|{w̸=1})u .\nHere, the second equality uses orthogonality of the projectors {Mw\na }a. With the expressions from Remark 5.7, we get\nthat\nOw\nXOw\nZ =\n\n\n∑\nuX∈{0,1}|{w=X}|\n(−1)\n⃗\n1·uX (Mw|{w=X})uX\n\n\n\n\n∑\nuZ∈{0,1}|{w=Z}|\n(−1)\n⃗\n1·uZ(Mw|{w=Z})uZ\n\n\n=\n∑\nu∈{0,1}|{u̸=1}|\n(−1)\n⃗\n1·u(Mw|{w=X})u|{w=X}(Mw|{w=Z})u|{w=Z}\n=\n∑\nu∈{0,1}|{u̸=1}|\n(−1)\n⃗\n1·u(Mw|{w̸=1})u = Ow .\n6\nAnalysis of the question-succinct protocol\n6.1\nConsistency test and “prover switching”\nThe following lemma shows that the consistency test (the b = 0 case in Protocol 7 that just checks whether Alice’s and\nBob’s answers are consistent) implies that on Alice’s post-measurement state, Bob’s measurement in the same basis\nhas a definite outcome. This is formalised by saying that Bob’s measurement operator is close to identity (with a sign\nindicating the outcome) on Alice’s post-measurement state.\nLemma 6.1. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the\ncompiled version of Protocol 7. Then for all b ∈{0,1}n and W ∈{X,Z},\n∑\n𝛼\n\n\n\nW(b)−(−1)Dec(𝛼)·b1\n\n\n\n2\n𝜓Enc(W)\n𝛼\n≤O(𝜖).\n32\n\n\nProof. Expanding out the definition of the state-dependent distance, we see that it suffices to show that\nE\nc←Enc(W)∑\n𝛼\n(−1)Dec(𝛼)·b Tr[W(b)Ac\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖).\nThe winning condition of the pure-basis case in Protocol 7 (i.e. the b = 0 case in the notation of Protocol 7) implies\nE\nc←Enc(W)∑\n𝛼\nTr[PW\nDec(𝛼)Ac\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖).\n(6.1)\nSince the prover’s measurements are normalised, this is equivalent to\nE\nc←Enc(W)∑\n𝛼\n∑\nv̸=Dec(𝛼)\nTr[PW\nv Ac\n𝛼𝜓Ac\n𝛼] ≤O(𝜖).\n(6.2)\nInserting the definition of W(b):\nE\nc←Enc(W)∑\n𝛼\n(−1)Dec(𝛼)·b Tr[W(b)Ac\n𝛼𝜓Ac\n𝛼]\n=\nE\nc←Enc(W)∑\n𝛼∑\nv\n(−1)(Dec(𝛼)+v)·b Tr[PW\nv Ac\n𝛼𝜓Ac\n𝛼]\n=\nE\nc←Enc(W)∑\n𝛼\nTr[PW\nDec(𝛼)Ac\n𝛼𝜓Ac\n𝛼]+\nE\nc←Enc(W)∑\n𝛼\n∑\nv̸=Dec(𝛼)\n(−1)(Dec(𝛼)+v)·b Tr[PW\nv Ac\n𝛼𝜓Ac\n𝛼]\nSince Tr[PW\nv Ac\n𝛼𝜓Ac\n𝛼] ≥0:\n≥\nE\nc←Enc(W)∑\n𝛼\nTr[PW\nDec(𝛼)Ac\n𝛼𝜓Ac\n𝛼]−\nE\nc←Enc(W)∑\n𝛼\n∑\nv̸=Dec(𝛼)\nTr[PW\nv Ac\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖),\nwhere in the last line we used Equation (6.1) to bound the first term and Equation (6.2) to bound the second term.\nWe can use Lemma 6.1 to show that Bob’s observables W(b) commute with Alice’s post-measurement state\n𝜓Enc(W). This lemma can be seen as a substitute for the “prover switching” technique from the non-local games\nliterature.\nLemma 6.2. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the\ncompiled version of Protocol 7. Then for all b ∈{0,1}n and W ∈{X,Z},\n\n\n\nW(b)𝜓Enc(W)W(b)−𝜓Enc(W)\n\n\n1 ≤O(√𝜖).\nProof. We first use the triangle inequality:\n\n\n\nW(b)𝜓Enc(W)W(b)−𝜓Enc(W)\n\n\n1\n≤∑\n𝛼\n\n\n\nW(b)𝜓Enc(W)\n𝛼\nW(b)−𝜓Enc(W)\n𝛼\n\n\n\n1\n≤∑\n𝛼\n\n\n\nW(b)𝜓Enc(W)\n𝛼\nW(b)−(−1)Dec(𝛼)·b𝜓Enc(W)\n𝛼\nW(b)\n\n\n\n1 +\n\n\n\n(−1)Dec(𝛼)·b𝜓Enc(W)\n𝛼\nW(b)−𝜓Enc(W)\n𝛼\n\n\n\n1\nFor the first term, we use the unitary invariance of the 1-norm, and for the second term we use that the 1-norm is\ninvariant under taking the dagger (and W(b) and 𝜓c\n𝛼are Hermitian):\n= ∑\n𝛼\n\n\n\nW(b)𝜓Enc(W)\n𝛼\n−(−1)Dec(𝛼)·b𝜓Enc(W)\n𝛼\n\n\n\n1 +\n\n\n\nW(b)𝜓Enc(W)\n𝛼\n−(−1)Dec(𝛼)·b𝜓Enc(W)\n𝛼\n\n\n\n1\n= 2∑\n𝛼\n\n\n\n(W(b)−(−1)Dec(𝛼)·b)𝜓Enc(W)\n𝛼\n\n\n\n1\nWe can now apply Lemma 6.1 and Lemma 2.10:\n≤O(√𝜖).\n33\n\n\n6.2\nAnalysis of compiled Pauli braiding test: obtaining the group relations\nLemma 6.3. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the\ncompiled version of Protocol 4. Then the prover’s observables satisfy the following properties for any Alice question\nq ∈QA:\nE\na,b∈{0,1}n\n\n\n\nZ(a)X(b)−(−1)a·bX(b)Z(a)\n\n\n\n2\n𝜓Enc(q) ≤O(𝜖)+negl(𝜆).\n(6.3)\nTo prove this lemma, we first examine what each subtest of the Pauli braiding test lets us conclude.\nLemma 6.4. Suppose a computationally efficient prover P succeeds with probability 1−𝜖in the compiled anticommut-\nation test (Protocol 6) with inputs ra,rb, and let Bra and Brb be the Bob observables corresponding to these questions.\nThen for any Alice question x ∈QA, there exists a negligible function 𝜂(𝜆) (depending on P and on x,ra,rb) such that\n∥{Bra,Brb}∥2\n𝜓Enc(x) ≤O(𝜖)+𝜂(𝜆).\nProof. In Theorem 5.7 of [CMM+24], essentially the same statement is shown for the Magic Square game. In that the-\norem, it is shown that for the Bob’s observables B2,B4 used for cells 2 and 4 in the square, the expected anticommutator\nis bounded by\nE\nsk ←Gen(1𝜆)\nE\nc←Enc(x)∑\n𝛼\n∥{B2,B4}|𝜓c\n𝛼⟩∥2\n2 ≤17280𝜖+𝜂(𝜆).\nIn our setting, B2 = Bra and B4 = Brb, and the quantity on the left-hand side is exactly the average squared state-\ndependent norm, by Definition 2.6.\nLemma 6.5 (Lemma 23 of [NZ23a]). Suppose a computationally efficient prover P modelled as in Section 5 succeeds\nwith probability 1 −𝜖in the compiled commutation test (Protocol 5) with inputs ra,rb, and let Bra,Brb be Bob’s\nobservables corresponding to the questions ra,rb. Then for any Alice question x ∈QA, there exists a negligible\nfunction 𝜂(𝜆) (depending on P and on x,ra,rb) such that\n∥[Bra,Brb]∥2\n𝜓Enc(x) ≤O(𝜖)+𝜂(𝜆).\nProof. Lemma 23 of [NZ23a] shows that, for all (ra,rb),\n∥[Bra,Brb]∥2\n𝜓Enc((com,ra,rb)) ≤O(𝜖).\nTo obtain the conclusion of the lemma, it suffices to use computational indistinguishability together with the fact that\nthe commutator is efficiently measurable, which follows from Lemma 2.12.\nProof of Lemma 6.3. We are given that P succeeds with probability 1−𝜖in Protocol 4. This means that it holds that\n∑\na,b∈S:a·b=0\n1\n|S|2 ·(1−Pr[P passes commutation on Z(a),X(b)])\n+\n∑\na,b∈S:a·b=1\n1\n|S|2 ·(1−Pr[P passes anticommutation on Z(a),X(b)])\n≤𝜖.\nFor any given a,b, suppose a·b = 0, and let 1−𝜖a,b = Pr[P passes commutation on Z(a),X(b)]. Then by Lemma 6.5,\nit holds that\n∥[Z(a),X(b)]∥2\n𝜓Enc(q) ≤O(𝜖a,b)+𝜂a,b(𝜆),\nand O(·) is a convex function.\nLikewise, suppose a·b = 1, and let 1−𝜖a,b = Pr[P passes anticommutation on Z(a),X(b)]. Then by Lemma 6.4,\nit holds that\n∥{Z(a),X(b)}∥2\n𝜓Enc(q) ≤O(𝜖a,b)+𝜂a,b(𝜆),\n34\n\n\nand O(·) is a convex function.\nPutting these relations together, we have\n∑\na,b∈S\n1\n|S|2 ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜓Enc(q) ≤O(𝜖)+𝜂(𝜆),\nwhere 𝜂(𝜆) = maxa,b 𝜂a,b(𝜆). Finally, applying Corollary 3.6, we get\nE\na,b∈{0,1}n ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2\n𝜓Enc(q) ≤\n1\n(1−𝜆)2 O(𝜖)+𝜂′(𝜆),\nwhere 𝜂′ is some negligible function. Here we have used that 𝜓Enc(q) c\n≈negl Ea∈SW(a)𝜓Enc(q)W(a) for W ∈{X,Z},\nwhich follows from Lemma 6.2.\n6.3\nAnalysis of compiled mixed-vs-pure basis test\nTheorem 6.6. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in\nboth Protocol 4 and Protocol 7. Then there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits\nan honest prover would use) and an isometry V : H →H′ such that for every Alice question q ∈QA\nE\nw∼D\nE\na∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2\n𝜓Enc(q) ≤O(√𝜖)+negl(𝜆).\nTheorem 6.6 also implies that the prover’s projective measurements {Mw\nu } in the mixed vs pure basis test must\nbe close to the corresponding Pauli projectors. More formally, we show the following statement about the prover’s\nmeasurements.\nCorollary 6.7. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in\nboth Protocol 4 and Protocol 7. Then there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits an\nhonest prover would use) and an isometry V : H →H′ such that for every Alice question q ∈QA, and for any subset\nS ⊆{0,1}n,\nE\nw∼D ∑\nu∈S\n∥Mw\nu −V †(𝜋w\nu ⊗1aux)V∥2\n𝜓Enc(q) ≤O(√𝜖)+negl(𝜆).\n(6.4)\nHere, {Mw\nu } are the prover’s measurements in the mixed vs pure basis test, and 𝜋w\na are the Pauli projectors, i.e.\n𝜋w\nu =\nO\ni\n\u00121+(−1)ui𝜎wi\n2\n\u0013\n=\nE\na∈{0,1}n(−1)u·a𝜎w(a).\nProof. Since each of the terms in Equation (6.4) is non-negative, it suffices to show this for S = {0,1}n. Recall that\nfor any a ∈{0,1}n,\nOw(a) =\n∑\nu∈{0,1}n\n(−1)a·uMw\nu .\nIn other words, Ow(a) and {Mw\nu }u are related by a Fourier transform. We can invert this Fourier transform to get that\nMw\nu =\nE\na∈{0,1}n(−1)u·aOw(a).\nThe proof now is essentially that of Parseval’s identity, but we spell out the details for completeness: inserting this and\n35\n\n\nthe expansion of 𝜋w\nu in terms of Pauli observables, we get that for any w ∈{1,X,Z}n,\n∑\nu∈{0,1}n\n∥Mw\nu −V †(𝜋w\nu ⊗1aux)V∥2\n𝜓Enc(q) =\n∑\nu∈{0,1}n\n∥\nE\na∈{0,1}n(−1)u·a Ow(a)−V †(𝜎w(a)⊗1aux)V\n\u0001\n|\n{z\n}\n:=Γ(a)\n∥2\n𝜓Enc(q)\n=\n∑\nu∈{0,1}n\n\u001c\nE\na∈{0,1}n(−1)u·aΓ(a),\nE\na′∈{0,1}n(−1)u·aΓ(a′)\n\u001d\n𝜓Enc(q)\n=\nE\na,a′∈{0,1}n\n \n∑\nu∈{0,1}n\n(−1)u·(a+a′)\n!\n\nΓ(a),Γ(a′)\n\u000b\n𝜓Enc(q)\n=\nE\na,a′∈{0,1}n 2n𝛿a,a′ \nΓ(a),Γ(a′)\n\u000b\n𝜓Enc(q)\n=\nE\na∈{0,1}n ∥Γ(a)∥2\n𝜓Enc(q)\n=\nE\na∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2\n𝜓Enc(q)\nHere, ⟨·,·⟩𝜓is the state-dependent inner product defined in Definition 2.6. Taking V to be the isometry from The-\norem 6.6 and inserting the expectation over w ∼D, the result now follows directly from Theorem 6.6.\nBefore proving Theorem 6.6, we introduce a piece of notation that will be useful throughout the rest of the section.\nDefinition 6.8. Let D be the distribution over Pauli strings in {1,X,Z}n from Protocol 7. Then we define D′ to be\ndistribution over Pauli strings in {1,X,Z}n induced by the following sampling procedure: to sample w′ ∼D′, first\nsample w ∼D and a ∼{0,1}n, then set\nw′\ni =\n(\nwi\nif ai = 1,\n1\notherwise.\nThe utility of this notation is that we can now collapse the expectations Ew∼D Ea∼{0,1}n into one expectation.\nConcretely, this allows us to restate the conclusion of Theorem 6.6 as\nE\nw∼D′ ∥Ow −V †(𝜎w ⊗1aux)V∥2\n𝜓Enc(q) ≤O(√𝜖).\n(6.5)\nProof of Theorem 6.6. We will show that Equation (6.5) holds.\nBy the triangle inequality for the squared norm\n(Lemma 2.8 Item (v)) we have that\nE\nw∼D′ ∥Ow −V †(𝜎w ⊗Id)V∥2\n𝜓Enc(q)\n≤2 E\nw∼D′\n\n\nOw −X(1{w=X})Z(1{w=Z})\n\n\n2\n𝜓Enc(q) +2 E\nw∼D′\n\n\nX(1{w=X})Z(1{w=Z})−V †(𝜎w ⊗Id)V\n\n\n2\n𝜓Enc(q) .\nThe first term is at most O(√𝜖) by Lemma 6.11, which we prove below. The second term is at most O(𝜖) by combining\nLemma 6.3 and Lemma 3.3.\nIt remains to prove Lemma 6.11. For this, we first establish a few auxiliary lemmas.\nLemma 6.9. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in\nProtocol 7. Then for all W ∈{X,Z},\nE\nw∼D′∑\n𝛼\n\n\n\nOw\nW −(−1)Dec(𝛼)·1{w=W}1\n\n\n\n2\n𝜓Enc(W)\n𝛼\n≤O(𝜖).\n36\n\n\nProof. The proof is similar to Lemma 6.1. Expanding out the definition of the state dependent distance, we see that it\nsuffices to show\nE\nw∼D′\nE\nc←Enc(W)∑\n𝛼\n(−1)Dec(𝛼)·1{w=W} Tr[Ow\nZAc\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖).\nRecalling the definition of D′ from Definition 6.8, this is equivalent to\nE\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n(−1)Dec(𝛼)·1{w=W∧a=1} Tr[Ow\nZ(a)Ac\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖).\n(6.6)\nThe winning condition of Protocol 7 implies that\nE\nw∼D\nE\nc←Enc(W)∑\n𝛼\nTr[(Mw|{w=W}])Dec(𝛼)|{w=W}Ac\n𝛼𝜓Ac\n𝛼] ≥1−O(𝜖).\n(6.7)\nWe now need to use Equation (6.7) to show Equation (6.6). For this, first recall that\nOw\nW(a) =\n∑\nu∈{0,1}n\n(−1)\n⃗\n1w=W∧a=1·uMw\nu .\nInserting this definition into the l.h.s. of Equation (6.6), we get that\nE\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n(−1)Dec(𝛼)·\n⃗\n1{w=W∧a=1} Tr[Ow\nZ(a)Ac\n𝛼𝜓Ac\n𝛼]\n= E\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n∑\nu∈{0,1}n\n(−1)(Dec(𝛼)+u)·\n⃗\n1{w=W∧a=1} Tr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\nWe now split the sum over u into the terms for which u|{w=W∧a=1} = Dec(𝛼)|{w=W∧a=1} and the remaining terms, and\nnote that the phase (−1)(Dec(𝛼)+u)·\n⃗\n1{w=W∧a=1} disappears when u|{w=W∧a=1} = Dec(𝛼)|{w=W∧a=1}:\n= E\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n∑\nu∈{0,1}n s.t.\nu|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}\nTr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\n+ E\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n∑\nu∈{0,1}n s.t.\nu|{w=W∧a=1}̸=Dec(𝛼)|{w=W∧a=1}\n(−1)(Dec(𝛼)+u)·\n⃗\n1{w=W∧a=1} Tr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\nFor the second term we note that the trace expression is always non-negative, so we can bound\n≥E\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n∑\nu∈{0,1}n s.t.\nu|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}\nTr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\n−E\nw∼D\nE\na∼{0,1}n\nE\nc←Enc(W)∑\n𝛼\n∑\nu∈{0,1}n s.t.\nu|{w=W∧a=1}̸=Dec(𝛼)|{w=W∧a=1}\nTr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\nUsing the normalisation of the measurements, we can see that (second term) = 1 - (first term). Using this and changing\nthe order of sums and expectations, we can simplify this to\n=\n\u0010\n2\nE\nc←Enc(W)∑\n𝛼\nE\nw∼D\nE\na∼{0,1}n\n∑\nu∈{0,1}n s.t.\nu|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}\nTr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\n\u0011\n−1\nRestricting the sum over u to a subset of the summands and using that each summand Tr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼] is non-negative,\nwe can bound\n≥\n\u0010\n2\nE\nc←Enc(W)∑\n𝛼\nE\nw∼D\nE\na∼{0,1}n\n∑\nu∈{0,1}n s.t.\nu|{w=W}=Dec(𝛼)|{w=W}\nTr[Mw\nu Ac\n𝛼𝜓Ac\n𝛼]\n\u0011\n−1\n37\n\n\nSince there is no remaining dependence on a, we can simply remove the expectation over a. We can also rewrite this\nmore compactly using the notation from Definition 2.5:\n=\n\u0010\n2\nE\nc←Enc(W)∑\n𝛼\nE\nw∼DTr[(Mw|{w=W})Dec(𝛼)|{w=W}Ac\n𝛼𝜓Ac\n𝛼]\n\u0011\n−1\nFinally, we note that the term in parentheses is bounded in Equation (6.7), so we get\n≥1−O(𝜖).\nThis proves Equation (6.6).\nLemma 6.10. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in\nProtocol 7. Then for all W ∈{X,Z},\nE\nw∼D′\n\n\nW(1{w=W})−Ow\nW\n\n\n2\n𝜓Enc(W) = O(𝜖).\nProof. By Lemma 2.8 Item (iv):\nE\nw∼D′\n\n\nW(1{w=W})−Ow\nW\n\n\n2\n𝜓Enc(W)\n= E\nw∼D′∑\n𝛼\n\n\nW(1{w=W})−Ow\nW\n\n\n2\n𝜓Enc(W)\n𝛼\nBy Lemma 2.8 Item (v):\n≤2 E\nw∼D′∑\n𝛼\n\n\n\nW(1{w=W})−(−1)Dec(𝛼)·1{w=W}1\n\n\n\n2\n𝜓Enc(W)\n𝛼\n+2 E\nw∼D′∑\n𝛼\n\n\n\nOw\nW −(−1)Dec(𝛼)·1{w=W}1\n\n\n\n2\n𝜓Enc(W)\n𝛼\nThese are exactly the terms we bounded in Lemma 6.1 (which holds for every choice of w and consequently also in\nexpectation over w ∼D′) and Lemma 6.9, so we get:\n= O(𝜖).\nWe are now in a position to prove Lemma 6.11, the missing ingredient in the proof of Theorem 6.6.\nLemma 6.11. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in\nboth Protocol 4 and Protocol 7. Then for any Alice question q ∈QA,\nE\nw∼D′\n\n\nOw −X(1{w=X})Z(1{w=Z})\n\n\n2\n𝜓Enc(q) = O(√𝜖)+negl(𝜆).\nProof. By Lemma 5.2, for all q ∈QA we have that 𝜓Enc(q) c\n≈negl(𝜆) 𝜓Enc(Z). We can therefore use Lemma 2.12 to get\nthat\nE\nw∼D′\n\n\nOw −X(1{w=X})Z(1{w=Z})\n\n\n2\n𝜓Enc(q)\n≤E\nw∼D′\n\n\nOw −X(1{w=X})Z(1{w=Z})\n\n\n2\n𝜓Enc(Z) +negl(𝜆)\nBy Lemma 6.2 and Lemma 2.9:\n≤E\nw∼D′\n\n\nOw −X(1{w=X})Z(1{w=Z})\n\n\n2\nEa∈{0,1}n Z(a)𝜓Enc(Z)Z(a) +negl(𝜆)+O(√𝜖)\n38\n\n\nBy Lemma 2.8 Item (iv) and Lemma 2.8 Item (i):\n= E\nw∼D′\nE\na∈{0,1}n\n\n\nOwZ(a)−X(1{w=X})Z(1{w=Z} +a)\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nSince the expectation over a is uniform, we can shift it by 1{w=Z}:\n= E\nw∼D′\nE\na∈{0,1}n\n\n\nOwZ(1{w=Z} +a)−X(1{w=X})Z(a)\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\n= E\nw∼D′\nE\na∈{0,1}n\n\n\nOwZ(1{w=Z})Z(a)−X(1{w=X})Z(a)\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nNow performing the same steps in reverse:\n= E\nw∼D′\nE\na∈{0,1}n\n\n\nOwZ(1{w=Z})−X(1{w=X})\n\n\n2\nZ(a)𝜓Enc(Z)Z(a) +negl(𝜆)+O(√𝜖)\n≤E\nw∼D′\n\n\nOwZ(1{w=Z})−X(1{w=X})\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nFrom Lemma 5.8 we have that Ow = Ow\nXOw\nZ. Inserting this and using Lemma 2.8 Item (iii), we get that:\n= E\nw∼D′\n\n\nOw\nZZ(1{w=Z})−Ow\nXX(1{w=X})\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nBy Lemma 2.8 Item (v):\n≤2 E\nw∼D′\n\n\nOw\nZZ(1{w=Z})−1\n\n\n2\n𝜓Enc(Z) +\n\n\nOw\nXX(1{w=X})−1\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nBy Lemma 2.8 Item (iii):\n≤2 E\nw∼D′\n\n\nZ(1{w=Z})−Ow\nZ\n\n\n2\n𝜓Enc(Z) +\n\n\nX(1{w=X})−Ow\nX\n\n\n2\n𝜓Enc(Z) +negl(𝜆)+O(√𝜖)\nBy Lemma 6.10:\n≤negl(𝜆)+O(√𝜖).\n6.4\nSubsampled Hamiltonian\nDefinition 6.12 (Hamiltonian problem). We refer to a tuple of the form (H,𝛼, 𝛽), where H is a Hermitian operator\nand 𝛼and 𝛽are both real numbers, as a Hamiltonian problem. We may refer to such a tuple where H acts on n qubits\nas n-qubit Hamiltonian problems.\nDefinition 6.13 (deciding a Hamiltonian problem). Given a tuple of the form (H,𝛼, 𝛽), where H is a Hermitian\noperator and 𝛼and 𝛽are both real numbers, we refer to the problem of deciding whether the ground energy of H is\n≤𝛼(yes case) or ≥𝛽(no case) as the problem of deciding (H,𝛼, 𝛽).\nDefinition 6.14 (family of Hamiltonians). We will use the notation H = {H(n)}n∈N to refer to a family of Hamilto-\nnians, i.e., a collection of sets H(n) (one for every value of n ∈N) such that the nth set H(n) contains only n-qubit\nHamiltonian problems. We assume that the length of the binary description of (H,𝛼, 𝛽) for any (H,𝛼, 𝛽) ∈H(n) is\npoly(n).\nDefinition 6.15 (QMA-completeness of a family of Hamiltonians). We say a family of Hamiltonians H = {H(n)}n∈N\nis QMA-complete if, for every promise problem A = (Ayes,Ano) in QMA, and every instance x ∈{0,1}∗, the problem\nof deciding whether x ∈Ayes or x ∈Ano can be Karp reduced in polynomial time (in |x|, given as input x and also the\nalgorithm C which characterises the verifier for A) to the problem of deciding some element of H(n) for n = poly(|x|).\n39\n\n\nDefinition 6.16 (2-local X/Z Hamiltonian family with inverse polynomial promise gap). A 2-local X/Z Hamiltonian\nfamily is a family of Hamiltonians where H(n) contains only (H,𝛼, 𝛽) such that H is a sum of at most m(n) terms for\nm(n) = poly(n), each one of which is an n-qubit tensor product of 𝜎Z, 𝜎X and 1 such that at most 2 of the n factors in\nthe tensor product are not 1. If, in addition, the tuples in H(n) all have the same values of 𝛼and 𝛽(for every n), and it\nis the case that 𝛽(n)−𝛼(n) (where 𝛼and 𝛽are considered as functions of n) is lower bounded by\n1\npoly(n), then we say\nH = {H(n)}n∈N is a 2-local X/Z Hamiltonian family with inverse-polynomial promise gap.\nLemma 6.17. There is a family of 2-local X/Z Hamiltonians with inverse-polynomial promise gap which is QMA-\ncomplete.\nProof. This is Theorem 2 of [BL08].\nLemma 6.18. Let H = {H(n)}n∈N be a QMA-complete 2-local X/Z Hamiltonian family. Then there exists a poly-\nnomial t(n) (the amplification parameter) such that deciding any (H,𝛼(n), 𝛽(n)) ∈H(n) can be efficiently reduced\nto deciding a problem of the form (H′,𝛼′(n), 𝛽′(n)), where there exists a negligible function negl(·) such that 𝛽′(n)−\n𝛼′(n) ≥1−negl(n), and H′ (which acts on t(n)·n qubits) has the following form:\nH′ = 1−E\nw∼D ∑\na∈T(w)\n𝜋w\na\nwhere D is a distribution over {1,X,Z}t(n)·n which can be efficiently sampled from, and membership in T(w) ⊆\n{0,1}t(n)·n can be decided in time polynomial in n given w.\nProof. We do this reduction in two stages. Firstly, we note that instead of taking a 2-local X/Z Hamiltonian problem\n(H,𝛼(n), 𝛽(n)) as our starting point, we can take a tuple (H′′,𝛼′′(n), 𝛽′′(n)) where H′′ is in the form\nH′′ = 1−E\nw∼D′′ ∑\na∈S(w)\n𝜋w\na\nwhere D′′ is an efficiently sampleable distribution over {1,X,Z}n, and S(w) ⊆{0,1}n is a set for which membership\ncan be decided efficiently given w. (The ‘1−’ is merely to make sure that the yes case is the low-energy case.) The\npromise gap will decrease at most by a factor of\n1\npoly(n) as a result of this conversion (so that 𝛽′′(n)−𝛼′′(n) is still at\nleast\n1\npoly(n)). To get H′′, we will use the Morimae-Fitzsimons energy test [MF16]. This procedure will have an inverse-\npolynomial promise gap if the original Hamiltonian had an inverse-polynomial promise gap and constant locality, as\nMorimae and Fitzsimons calculate. It is straightforward to see that the success probability of the procedure on any\ngiven pure state |𝜓⟩can be expressed as 1−⟨𝜓|H′′|𝜓⟩for some H′′ of the form above.\nThen, to amplify the gap, we apply the technique from Lemma 14.1 in Kitaev, Shen and Vyalyi [KSV02] to H′′,\nto obtain the desired Hamiltonian H′. The amplification technique is to measure a independent randomly chosen term\nfrom H′′ on t(n) many n-qubit registers, and to accept if the number of accepting outcomes is above a certain threshold.\nConcretely,\nH′ = 1−E\nw∼D ∑\na∈T(w)\n𝜋w\na ,\nwhere D = (D′′)⊗t(n), and T(w) is defined implicitly by the following algorithm to decide membership in it:\n(i) Divide up the answer string a into t(n) blocks Bi of n bits each. Also divide up w into t(n) blocks wi such that\neach wi is in {1,X,Z}n.\n(ii) For each block Bi,i ∈[t(n)], compute the quantity (in {−1,+1}, for notational convenience) bi = (−1)1[a|Bi∈S(wi)].\nThis results in t(n) quantities b1,··· ,bt(n) ∈{−1,+1}.\n(iii) a is in T(w) iff\nt(n)\n∑\ni=1\nbi < t(n)· 𝛼′′(n)+ 𝛽′′(n)\n2\n.\n40\n\n\nIt is clear that this algorithm runs in time poly(n). As for the condition on eigenvalues of H′, it is shown in [KSV02]\nthat the bound 𝛽′(n)−𝛼′(n) ≥1−negl(n) holds if t(n) is chosen to be polynomial in n.\nLemma 6.19. Fix a PRG family F = { f𝜆: {0,1}𝜆→{0,1}𝜆}𝜆∈N. Assuming that F is secure against (non-uniform)\nQPT adversaries, and for any function ℓ(·) such that ℓ(x) = 𝜔(log(x)), there exists a PRG family G = {g𝜆: {0,1}ℓ(𝜆) →\n{0,1}𝜆}𝜆∈N which is secure against (non-uniform) QPT adversaries.\nProof. Standard arguments to show that PRGs can be used to construct PRFs [GGM86] suffice.\nTheorem 6.20. Let H = {H(n)}n∈N be a QMA-complete 2-local X/Z Hamiltonian family.\nThen there exists a\npolynomial t(n) (the amplification parameter) such that deciding any (H,𝛼(n), 𝛽(n)) ∈H(n) can be efficiently re-\nduced to deciding a problem of the form (H′,𝛼′(n), 𝛽′(n)), where there exists a negligible function negl(·) such that\n𝛽′(n)−𝛼′(n) ≥1−negl(n), and H′ (which acts on t(n)·n qubits) has the following form:\nH′ = 1−E\nw∼D ∑\na∈T(w)\n𝜋w\na\nwhere membership in T(w) ⊆{0,1}t(n)·n can be decided in time polynomial in n given w, and D is a distribution over\n{1,X,Z}t(n)·n which can be efficiently sampled from using sampling randomness of length 2polylog(n).\nProof. Fix a PRG family G = {g𝜆: {0,1}ℓ(𝜆) →{0,1}𝜆}𝜆∈N with ℓ(𝜆) = polylog(𝜆) which is secure against non-\nuniform QPT adversaries. (Such a family exists by Lemma 6.19.) Take an X/Z Hamiltonian family H = {H(n)}n∈N\nwith gap 𝛽(n) −𝛼(n) = 1 −negl(n) which is QMA-complete, such that any H such that (H,𝛼(n), 𝛽(n)) ∈H(n) is a\nHamiltonian on t(n)·n qubits with the following form:\nH = 1−E\nw∼∆∑\na∈T(w)\n𝜋w\na\n(6.8)\nwhere ∆is a distribution over {1,X,Z}t(n)·n which can be efficiently sampled from, and membership in T(w) ⊆\n{0,1}t(n)·n can be decided in time polynomial in n given w. (Such a family exists by Lemma 6.18.)\nThe following algorithm accepts any given state 𝜌with probability exactly 1−Tr[H𝜌]:\nProcess 1.\n(i) Sample w from D. We will assume this takes R(n) bits of randomness for some polynomial R.\n(ii) Measure every qubit of 𝜌in the Pauli bases determined by w. Let the outcome be a ∈{0,1}t(n)·n.\n(iii) Accept iff a ∈T(w).\nNow consider the following derandomised version of this algorithm:\nProcess 2 (Derandomised version of Process 1).\n(i) Use the PRG gℓ(R(n)) (i.e. the ℓ(R(n))th PRG in the family G) in order to generate a pseudorandom seed s of\nlength R(n) using ℓ(R(n)) bits of true randomness. Use s to sample w from D.\n(ii) Measure every qubit of 𝜌in the Pauli bases determined by w. Let the outcome be a ∈{0,1}t(n)·n.\n(iii) Accept iff a ∈T(w).\nIt is clear that this algorithm accepts any given state 𝜌with probability exactly 1 −Tr[H′𝜌], where H′ is the\nfollowing Hamiltonian:\nH′ = 1−E\nw∼D ∑\na∈T(w)\n𝜋w\na\n(6.9)\n41\n\n\nwhere we define D to be the distribution which step (i) in Process 2 samples from. Since R is a polynomial and\nℓ(n) = polylog(n), this setting of parameters yields sampling randomness for D of 2polylog(n), as desired.\nNow we show that there exist 𝛼′(·), 𝛽′(·) with 𝛽′(n)−𝛼′(n) ≥1−𝜇(n) for some negligible function 𝜇(·) such that\nthe problem of deciding H′ is QMA-complete. Consider a sequence of Hamiltonians {H(n) : n ∈N} such that, for all\nn, (H(n),𝛼(n), 𝛽(n)) ∈H(n). (We fix a single Hamiltonian per value of n for notational simplicity; the same argument\ncan be applied to all the elements of H(n).) For each n, let H′(n) be the Hamiltonian defined by the ‘subsampling’\nprocedure above applied to H(n), i.e. the Hamiltonian defined in Equation (6.9). We will show that there exists a\nnegligible function negl(·) such that the lowest eigenvalue of H′(n) differs from the lowest eigenvalue of H(n) by at\nmost a negl(n) amount.\nSuppose, for contradiction’s sake, that this is not the case; then, defining v(n) to be the lowest eigenvalue of H(n)\nand v′(n) to be the lowest eigenvalue of H′(n), (wlog) it is the case that v′(n) −v(n) ≥p(n) for some non-negligible\nfunction p(n). Then we construct a QPT adversary A taking non-uniform quantum advice which can break the security\nof G. Let r(·) be a sufficiently large polynomial, to be set later. We assume (wlog by standard reductions) that, on\ninput security parameter 𝜆, A either receives a challenge consisting of r(𝜆) samples from the range of the PRG g𝜆\nor r(𝜆) uniformly random strings of length 𝜆. On input security parameter 𝜆, A gets as advice the following. Let n\nbe such that R(n) = 𝜆. A gets r(𝜆) many copies of a ground state for the Hamiltonian H(n); the value of v(n), the\nlowest eigenvalue of H(n); and the value of p(n) = v′(n) −v(n). It then receives its challenge strings s1,...,sr, and\ndoes the following for each string si: use si to sample a term from H(n); measure this term of H(n) on the ith copy\nof the ground state it was given as advice; compute the average of all its measurement outcomes; output ‘PRG’ if the\naverage is greater than v(n)+ p(n)\n2 , and ‘uniform’ otherwise.\nThis procedure is clearly polynomial time in 𝜆. We now analyse A’s success probability. In the case where s\nis a uniformly random string, the average energy of a term in H(n) measured against the ground state of H(n) is at\nmost v(n). Then, by a Chernoff bound, the probability that A guesses wrongly in this case is upper bounded by the\nfollowing calculation (letting X be the random variable associated with the sum of A’s measurement outcomes):\nPr[X ≥(1+ 𝛿)𝜇] ≤exp\n\u0010\n−2𝛿2𝜇2\nr(𝜆)\n\u0011\nPr[X ≥(v(n)+ 1\n2 p(n))r(𝜆)] ≤exp\n\u0012\n−2\n\u00101\n2\np(n)\nv(n)\n\u00112\n·(v(n)·r(𝜆))2/r(𝜆)\n\u0013\n≤exp\n\u00101\n2 p(n)2r(𝜆)\n\u0011\n.\nTherefore, setting r(𝜆) to be a sufficiently large polynomial (i.e. sufficiently larger than\n1\np(n)\n2), we can ensure that the\nprobability that A guesses wrongly in the uniform case is negligible.\nThe calculation for the PRG case is similar. By a union bound, then, we can conclude that A distinguishes between\nthe PRG and the uniform cases with 1 −negl(𝜆) probability, which contradicts the non-uniform security of the PRG\nfamily G. It follows that the lowest eigenvalue of H′(n) differs from the lowest eigenvalue of H(n) by at most a negl(n)\namount.\nTheorem 6.21. Let C be a QMA verification algorithm for a QMA promise problem A = (Ayes,Ano), and let x be an\ninput of length n. Then there is a Hamiltonian problem (H,𝛼(n), 𝛽(n)) that can be efficiently computed from the input\n(x,C), such that if x ∈Ayes, then H is a YES instance of the Hamiltonian problem, and if x ∈Ano, then H is a NO\ninstance, and 𝛽(n)−𝛼(n) = 1−negl(n).\nH has the form\nH′ = 1−E\nw∼D ∑\na∈T(w)\n𝜋w\na\nProof. The statement of QMA completeness in Lemma 6.17 implies that there is an efficient mapping (x,C) to a 2-\nlocal X/Z Hamiltonian problem (HXZ,𝛼XZ(n), 𝛽XZ(n)). Applying Theorem 6.20 to this family of Hamiltonians yields\nthe result.\n42\n\n\n6.5\nAnalysis of the compiled Hamiltonian test\nLemma 6.22. Given an instance x, let H(n) be the corresponding Hamiltonian generated in Protocol 2, and let P be\na prover that succeeds in the compiled Pauli braiding and mixed-versus-pure tests (Protocol 4 and Protocol 7) with\nprobability 1−𝛿, and in the Hamiltonian test (Protocol 8) with probability pH. Then there exists a state 𝜌such that\nTr[𝜌H(n)] ≤(1−pH)+O(𝛿1/4)+negl(𝜆).\nProof. First, since P succeeds with probability 1−𝛿in the Pauli braiding and mixed-versus-pure tests, by Corollary 6.7\nit holds that there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits an honest prover would\nuse) and an isometry V : H →H′ such that for every Alice question q ∈QA, and for any subset S ⊆{0,1}n,\nE\nw∼D ∑\nu∈S\n∥Mw\nu −V †(𝜋w\nu ⊗1aux)V∥2\n𝜓Enc(q) ≤O(\n√\n𝛿)+negl(𝜆).\n(6.10)\nwhere D is the set of Pauli strings D(n) corresponding to the Hamiltonian H(n).\nIn particular, setting q = tele, we have that\nE\nw∼D ∑\nu∈S\nE\nc←Enc(tele)∑\n𝛼\n∥Mw\nu −V †(𝜋w\nu ⊗1aux)V∥2\n𝜓c\n𝛼≤O(\n√\n𝛿)+negl(𝜆).\n(6.11)\nwhere 𝜓c\n𝛼= Ac\n𝛼𝜓(Ac\n𝛼)†.\nNow, recall that the Hamiltonian H(n) has the form\nH(n) = 1−E\nw∼D ∑\nu∈Q(w)\n𝜋w\nu ,\nwhere 𝜋w\nu is a Pauli basis projector. From the success in the Hamiltonian test, we know that\nE\nw∼D∑\nu\nE\nc=Enc(tele)∑\n𝛼\nTr[Mw\nu Ac\n𝛼𝜓(Ac\n𝛼)†]·1[correct(w,u,Dec(𝛼)) ∈Q(w)] = pH,\n(6.12)\nwhere the function correct implements the Pauli corrections from the teleportation step, and is defined by\ncorrect(w,u,(ux,uz))i =\n(\nui ⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X]\nwi ̸= 1\n0\nwi = 1\nAlso note that the right hand side of Equation (6.12) is 1 −pH, because of the left we are summing over corrected\noutcomes that are contained in Q(w); the test was defined to accept if the outcome is not in Q(w). (This is so that a\nhigh success probability corresponds to a low energy according to the Hamiltonian.)\nBy Equation (6.11) together with Lemma 5.3, with By\nb taken to be Mw\nu and Cy\nb taken to be V †(𝜋w\nu ⊗1aux)V, it thus\nfollows that\nE\nw∼D∑\nu\nE\nc←Enc(tele)∑\n𝛼\nTr[V †(𝜋w\nu ⊗1aux)VAc\n𝛼𝜓(Ac\n𝛼)†]·1[correct(w,u,Dec(𝛼)) ∈Q(w)] ≥pH −O(𝛿1/4)−negl(𝜆).\nWe will now show how to construct the desired state 𝜌. We will do this by simulating the effect of the Pauli\ncorrections by actual Pauli operators applied to Alice’s post-measurement state.\nFirst, we need to deal with a technical inconvenience: the function correct is defined differently for wi = 1 and for\nwi ̸= 1, and in the wi = 1 case, it acts by replacing the measurement outcome with 0. Fortunately, we recall that by\nthe definition of\n𝜋w\nu =\nn\nO\ni=1\n\u0012I +(−1)ui𝜎wi\n2\n\u0013\n,\nit follows that whenever wi = 1 and ui ̸= 0 for any i, the corresponding projector 𝜋w\nu = 0. Thus, we may freely assume\nthat whenever wi = 1, ui = 0. This enables us to replace correct with the modified function correct′ defined by\ncorrect′(w,u,(ux,uz))i = ui ⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X].\n43\n\n\nWith respect to this modified function, we have\nE\nw∼D∑\nu\nE\nc←Enc(tele)∑\n𝛼\nTr[V †(𝜋w\nu ⊗1aux)VAc\n𝛼𝜓(Ac\n𝛼)†]·1[correct′(w,u,Dec(𝛼)) ∈Q(w)]\n≥pH −O(𝛿1/4)−negl(𝜆).\nBy shifting the sum over u, this may be equivalently rewritten as\nE\nw∼D ∑\nu∈Q(w)\nE\nc←Enc(tele)∑\n𝛼\nTr[V †(𝜋w\ncorrect′(w,u,(ux,uz)) ⊗1aux)VAc\n𝛼𝜓(Ac\n𝛼)†] ≥pH −O(𝛿1/4)−negl(𝜆).\nNow, we observe that the Pauli corrections have the following simple form:\n𝜋w\ncorrect′(w,u,(ux,uz)) = 𝜎Z(uz)𝜎X(ux)𝜋w\nu 𝜎X(ux)𝜎Z(uz).\nApplying this observation, plus the cyclicity of the trace, we get\nE\nw∼D ∑\nu∈Q(w)\nE\nc←Enc(tele)∑\n𝛼\nTr[(𝜋w\nu ⊗1aux)𝜎X(ux)𝜎Z(uz)VAc\n𝛼𝜓(Ac\n𝛼)†V †𝜎Z(uz)𝜎X(ux)]\n≥pH −O(𝛿1/4)−negl(𝜆),\nwhere (ux,uz) = Dec(𝛼). Now, let us define\n𝜌= Traux\nE\nc←tele∑\n𝛼\n𝜎X(ux)𝜎Z(uz)VAc\n𝛼𝜓(Ac\n𝛼)†V †𝜎Z(uz)𝜎X(ux).\nIt is clear that 𝜌is a normalized quantum state. Moreover, we have that\nTr[H(n)𝜌] = 1−E\nw∼D ∑\nu∈Q(w)\nTr[𝜋w\nu 𝜌] ≤(1−ph)+O(𝛿1/4)+negl(𝜆),\nwhich was the desired conclusion.\n6.6\nAnalysis of full compiled protocol\nTheorem 6.23. The protocol Protocol 2 is a question-succinct argument system for QMA assuming a QHE scheme\nsatisfying the definition given in Definition 2.13.\nMore precisely, let V be the verifier, and P be the honest prover described in the protocol. Then for any promise\nproblem A = (Ayes,Ano) in QMA with verification algorithm C, the following hold:\n• Completeness: Let x ∈Ayes , and let |𝜓⟩be an accepting QMA witness for x. Then the verifier V on input\n(x,C,1𝜆), in interaction with the honest prover P on input (x,C,|𝜓⟩polyn,1𝜆), accepts with probability ≥1 −\nnegl(n).\n• Soundness: Let x ∈Ano, and let |𝜙⟩be any state on poly(n+𝜆) qubits. Then the verifier V on input (x,C,1𝜆), in\ninteraction with any QPT prover P∗on input (x,C,|𝜙⟩,1𝜆), accepts with probability at most s for some universal\nconstant s < 1.\n• Question-succinctness: On any input x and for security parameter 𝜆, the number of bits sent by V to P is\nO(polylogn+poly(𝜆)).\nProof. We recall that the protocol Protocol 2 is obtained by applying the KLVY compilation to Protocol 3. This in\nturn consists of three subtests: the Pauli braiding test (Protocol 4), the mixed-versus-pure basis test (Protocol 7), and\nthe Hamiltonian test (Protocol 8).\n44\n\n\nCompleteness:\nFor the completeness, we observe that the honest prover passes the Pauli braiding test (Protocol 4)\nand the mixed-versus-pure basis test (Protocol 7) with certainty, and, using a state |𝜙⟩, passes the Hamiltonian test\n(Protocol 8) with probability equal to 1−⟨𝜙|H(n)|𝜙⟩. Taking H(n) to be the Hamiltonian computed in Protocol 2, and\n|𝜙⟩to be the appropriate polynomial number of copies of |𝜓⟩, we have ⟨𝜙|H|𝜙⟩= 1−negl(n).\nSoundness:\nWe now establish soundness of this protocol. Suppose x is a NO instance of the QMA language. Then\nthe Hamiltonian H from Protocol 3 has minimum eigenvalue at least\n𝜆min(H) ≥1−negl(n).\nMoreover, we can assume by a padding argument that without loss of generality, that 𝜆min(H) ≥2/3 for all n.\nNow, suppose that P′ is a prover that succeeds in Protocol 2 with probability 1−𝛿. This means that P′ succeeds in\nthe KLVY compilations of the Pauli braiding test (Protocol 4), the mixed-versus-pure basis test (Protocol 7), and the\nHamiltonian test (Protocol 8) each with probability at least 1−3𝛿. By Lemma 6.22, this means that there exists a state\n𝜌such that\ntr[𝜌H] ≤3𝛿+O(𝛿1/4).\nFor any 𝛿below some universal 𝛿0, the RHS of the expression above will be at most 1/2, and thus in contradiction\nwith the fact that 𝜆min(H) ≥2/3.\nSuccinctness:\nThe question-succinctness property is evident from the description of the protocol. We note that the\nlongest messages are sent in the mixed-versus-pure basis test (Protocol 7), and the Hamiltonian test Protocol 8, where\nto describe a term in H the verifier must send polylog(n) bits. In all other tests, the verifier sends at most O(log(n))\nbits to the prover.\n7\nCompiling from a question-succinct protocol into a fully succinct protocol\nusing succinct arguments of knowledge\nProtocol 2 is a question-succinct cryptographic single-prover protocol, in the sense that the messages the verifier sends\nto the prover are polylogn · poly𝜆bits long, where n is the size of the instance and 𝜆is the security parameter. In\n[BKL+22, Section 9], Bartusek et al. present two compilers which map any question-succinct single-prover argument\nsystem for QMA satisfying a certain obliviousness property into a fully succinct single-prover argument system for\nQMA. More specifically, for their compilers to work, Bartusek et al. require that the verifier’s questions in the question-\nsuccinct protocol can be computed independently of the prover’s answers and also the QMA instance (except for its\nlength). They also require implicitly that the verifier’s questions can be generated extremely efficiently, namely, in\ntime ˜\nO(n)+polylog(n)·poly(𝜆).\nIt can be easily verified that Protocol 2 satisfies the obliviousness property. However, the efficiency property is not\nquite satisfied because of the commutation and anticommutation tests. Specifically, the choice of which test to execute\nis a function of a · b, where a and b are strings of length poly(n), and so naïvely, computing this inner product takes\ntime poly(n). However, there is an easy fix for this: after sampling ra,rb, the verifier decides uniformly at random\nwhether to run the commutation or anticommutation test, and then afterwards, if it chose wrongly, it automatically\naccepts. This affects the soundness gap by at most a constant factor.\nWith this modification made, the verifier of Protocol 2 is indeed oblivious and efficient. In fact, all the information\nthe verifier sends to the prover in this modified version of Protocol 2 takes one of the following forms:\n• Encryptions of uniform randomness of some predetermined length.\n• Non-encrypted uniform randomness of some predetermined length.\nIts decision process about which messages to send can also be made completely independent of the prover’s answers.\nAs such, the compilers presented in [BKL+22, Section 9] apply in a black-box fashion to the modified version of\nProtocol 2. Nonetheless, because the presentation of the analysis in [BKL+22, Section 9] is fairly terse, we present\nfor the reader’s benefit some additional intuition about how Bartusek et al.’s first compiler works when applied to\n45\n\n\nProtocol 2 in particular. We emphasise that this is only for intuition and not meant as a full (re-)proof of the [BKL+22]\ncompiler.\n7.1\nPost-quantum succinct arguments of knowledge\nThe central building block for Bartusek et al.’s first compiler is a post-quantum succinct argument of knowledge (based\non Killian’s work [Kil92]) with the following commit-and-open structure. Fix some instance x, some NP language\nL, and some associated predicate RL(·,·) (that is, RL(x,w) checks whether w is a valid witness that x ∈L, and can be\ncomputed in polynomial time). Suppose also that the verifier has already sent the prover the hash key hk for some\ncollapsing4 hash function family. Then the following protocol allows the prover to succinctly prove knowledge of\nsome w such that RL(x,w) = 1:\nProtocol 9 (Three-message succinct argument of knowledge).\n1. The prover encodes the witness w under an error correcting code E (with corresponding decoding D) to\nobtain a string ˜\nw = E(w). The prover also constructs a PCPP proof 𝜋that R(x,D( ˜\nw)) = 1. The prover\nthen constructs a Merkle tree [Mer87] on m = ( ˜\nw,𝜋) using hk, computes the root of this tree rtm, and\nsends the verifier rtm. The prover also constructs a Merkle tree on w itself, computes the root of this tree\nrtw, and sends the verifier rtw. For notational convenience, we will call the algorithm that constructs rt\nusing hk by the name Merklehk(·). We will also use rt to denote the combination rt = (rtm,rtw).\n2. The verifier sends the prover a challenge string j = (j1,..., jk) which indicates a set of indices for which\nit wants the prover to reveal m j1,...,m jk.\n3. The prover reveals m j1,...,m jk and also some auxiliary information (namely, the path of hashes in the\nMerkle tree leading from the root to m ji), which allows the verifier to verify whether or not (m j1,...,m jk)\nwere valid openings and also to compute the verification predicate for the PCPP proof that R(x,D( ˜\nw)) =\n1.\nClarifying information about Merkle trees and their uses in commit-and-open protocols like this can be found in\n[CMSZ22, Section 2.1], but for us the important part is the message structure of this protocol. In particular, note that\nall the messages in this protocol are polylog|x|·poly𝜆in length, where 𝜆is the security parameter for hk.\nProtocol 9 is similar to Killian’s classic protocol [Kil92] (instantiated in a form that allows for extraction of the\nwitness w): the only change which must be made to the protocol to make it post-quantum (apart from using a collapsing\ninstead of a collision-resistant hash function) is the ‘extra’ Merkle commitment to w in the first message in addition\nto the commitment to m = ( ˜\nw,𝜋).5 However, the analysis of this protocol in the post-quantum setting is significantly\nmore subtle than its analysis in the classical setting. In particular, the soundness statement for Protocol 9—which says\nthat, given a prover who wins with high probability, there is an efficient extractor that extracts w given black-box access\nto the prover—is usually proven in the classical setting via a rewinding argument, in which the extractor reconstructs\nsome significant fraction of m by choosing an index j, obtaining mj, rewinding the prover, choosing another index\nj′, obtaining m j′, etc., and finally using the ‘error robustness’ properties of both the PCPP and of the encoding E in\norder to extract w and to be sure that it satisfies R(x,·) despite the missing indices. Rewinding arguments that are\nsecure against quantum adversaries with quantum auxiliary input tend to be much more difficult than their classical\ncounterparts, because of the possibility that executing the protocol even once will destroy the auxiliary input and\nprevent rewinding from succeeding.\nIn [CMSZ22], it was shown how to analyse Protocol 9 in the post-quantum setting using a clever technique in-\nvolving alternating projections. However, the analysis of Protocol 9 presented in [CMSZ22] was not particularly\ncomposable. If the succinct argument of knowledge in Protocol 9 is used as a subprotocol in some longer protocol,\n4Collapsing is a post-quantum strengthening of collision resistance; see [Unr16] for a definition.\n5It is not clear whether this additional commitment is necessary; however, the authors of [LMS22] were not able to make the state-preserving\nextraction analysis work without it, although for the analysis in the setting of [CMSZ22] the original Killian protocol is sufficient.\n46\n\n\nand there are other tests in the full protocol which follow after the succinct argument of knowledge—this is the case\nfor us—then it may be necessary to ensure that running extraction does not hinder the prover’s ability to pass in\nthe remainder of the protocol. To motivate this requirement, consider a situation in which we are trying to design\na reduction R which reduces the security of a succinct protocol called SuccinctProtocol, in which Protocol 9 is used\nas a subprotocol, to the security of a non-succinct protocol OriginalProtocol. OriginalProtocol requires the prover to\noutput a full witness w instead of merely passing in a succinct argument of knowledge for w; therefore, given some\nprover P who is successful in SuccinctProtocol, the reduction has to run extraction on P in order to recover w, so that\nit can succeed with the challenger/verifier for OriginalProtocol. However, if OriginalProtocol contains tests (mirrored in\nSuccinctProtocol) that happen after its prover is supposed to output w, the reduction R will not necessarily succeed\nif extracting w destroys P’s ability to succeed in the remainder of SuccinctProtocol, because then R may be unable to\nanswer the remaining questions in OriginalProtocol.\nIn order to ensure that, even after extraction has been performed, the prover continues to pass with high prob-\nability in the rest of the protocol, the prescribed extractor from [CMSZ22] was required to measure a projector that\ncorresponded to coherently computing whether or not the verifier would accept in the remainder of the protocol and\nconditioning on the accept outcome. The issue is that the verifier’s final decision predicate might depend on secret\ninformation (that is: the entire protocol might not be public-coin, even though Protocol 9 is public-coin), and so an\nefficient extractor might be unable to do this.\nIn followup work [LMS22], it was shown how to analyse Protocol 9 in a more composable way, so that the extractor\nonly needs to measure the projection which corresponds to the verifier of Protocol 9 accepting (note that this verifier’s\ndecision predicate is public, so the extractor will always be able to do this), but even so the extractor’s activity is\nessentially undetectable to the prover, meaning that the prover (who uses the extractor’s ‘leftover state’ instead of its\noriginal state) will continue to succeed in the rest of the protocol (if it succeeded with high probability to begin with)\neven after extraction has been performed. This condition on the extractor is true by default in the classical setting,\nbut it is nontrivial in the quantum setting. Because this guarantee may be somewhat surprising, we sketch in the next\nsection how this guarantee is shown.\n7.2\n[LMS22] extraction\nThe following (taken largely from [BKL+22, Definition 9.1]) is the formal statement of succinctness and security\nfor Protocol 9 for which we will sketch a proof in this section.\nLemma 7.1. Protocol 9 satisfies the following properties:\n• Succinctness. When invoked on security parameter 𝜆for the hash function family, instance size |x| = n, and a\nrelation R decidable in time T, the communication complexity of the protocol is poly(𝜆,logT). The verifier’s\ncomputational complexity is poly(𝜆,logT)+ ˜\nO(n).\n• 𝜖-state-preserving extraction. There exists an extractor E(·)(x,𝜖) with the following properties.\n– Efficiency: E(·)(x,𝜖) runs in time poly(n,𝜆,1/𝜖) as a quantum oracle algorithm (with the ability to apply\ncontrolled U-gates given an oracle U(·)), outputting a classical transcript ˜\n𝜏and a classical string w.\n– State-preserving: Let |𝜓⟩∈A⊗I be any poly(𝜆)-qubit pure state and let 𝜌= TrA(|𝜓⟩) ∈D(I).6 Consider\nthe following two games:\n* Game 0 (real): Generate a transcript 𝜏by running P∗(𝜌I,x) with the honest verifier V. Output 𝜏\nalong with the residual state on A⊗I.\n* Game 1 (simulated): Generate a transcript-witness pair ( ˜\n𝜏,w) ←EP∗(𝜌I,x). Output ˜\n𝜏and the residual\nstate on A⊗I.\nThen, we have that the output distributions of Game 0 and Game 1 are computationally 𝜀-indistinguishable\nto any quantum distinguisher.\n6In general, the prover’s input state on I may be entangled with some external register A, and we ask that computational indistinguishability\nholds even given A. Our definition is stated this way for maximal generality, though we remark that the applications in this section do not require\nindistinguishability in the presence of an entangled external register.\n47\n\n\n– Extraction correctness: for any P∗as above, the probability that ˜\n𝜏is an accepting transcript but w is not\nin Rx is at most 𝜖+negl(𝜆).\nIn order to describe the extractor which is guaranteed by Lemma 7.1, we firstly fix some notation related to the\nprover’s state and actions in Protocol 9. We can model any prover P∗in Protocol 9 as a process which does the\nfollowing:\nProcess 3.\n(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private\nregister P).\n(ii) Receive a challenge j from the verifier. We assume that j is provided as a state |j⟩in a message register M\nwhich is accessible both to the verifier and to the prover.\n(iii) Apply some unitary UP∗which acts on both P and M.\n(iv) Measure some part of the resulting state (wlog in the standard basis) to get a response z, and send this to the\nverifier.\nThe verifier will then check its decision predicate Vrt( j,z), and accept iff Vrt( j,z) evaluates to 1. If Protocol 9 is a\nsubprotocol in some longer protocol, then the verifier rejects immediately if Vrt( j,z) = 0.\nNow we will ‘purify’ the prover in order to make the [LMS22] extraction procedure easier to state. It is easy to\nsee that the state left over in all registers at the end of the process below is exactly equivalent to the state which is left\nover at the end of Process 3:\nProcess 4.\n(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private\nregister P).\n(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message\nregister M. Also create a new register Z initialised to the all zero state which will be used in step (iv).\n(iii) Apply the prover’s unitary UP∗jointly to P and M.\n(iv) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of\nProcess 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary that\ndoes this copying CNOTz.\n(v) Coherently compute the verifier’s predicate Vrt( j,z) into yet another new register A.\n(vi) Measure registers M and Z; obtain outcomes j and z.\n(vii) Measure register A; obtain Vrt(j,z), and accept iff it is 1.\nAs before, if Protocol 9 is a subprotocol in some longer protocol, then the verifier rejects immediately if Vrt( j,z)\nmeasures to 0. In other words, conditioning on continuing in the protocol essentially projects into the subspace where\nVrt(j,z) = 1.\nNote that steps (vi) and (vii) can be switched, because they act on different registers and therefore commute. As\nsuch, we could also have stated Process 4 in the following way:\nProcess 5.\n(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private\nregister P).\n48\n\n\n(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message\nregister M. Also create a new register Z initialised to the all zero state which will be used in step (iii).\n(iii) This step can be stated in words as a series of substeps:\n(i) Apply the prover’s unitary UP∗jointly to P and M.\n(ii) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of\nProcess 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary\nthat does this copying CNOTz.\n(iii) Project the state in registers P, M and Z into the subspace whereVrt( j,z) = 1. If the projective measurement\nresults in Vrt( j,z) = 0, reject.\n(iv) Undo CNOTz and UP∗in that order.\nIn other words, in this step, apply the projective measurement where one of the projectors in the measurement is\nΠc := U†\nP∗CNOT†\nz\n\u0010\n∑\nVrt(j,z)=1\n1P ⊗|j,z⟩MZ⟨j,z|MZ\n\u0011\nCNOTzUP∗\nand the other is I −Πc; reject if the outcome is I −Πc.\n(iv) Redo CNOTz and UP∗(to counteract substep (iv) of the previous step, step (iii)). Measure registers M and Z;\nobtain outcomes j and z.\nThe [LMS22] extractor will set up the state which exists after step (iii) in Process 5 (it can do this given an appropriate\nnotion of black-box access to P∗: see e.g. [Unr16]), and then it will insert an extra step (E) in between steps (iii) and\n(iv) in Process 5, in which it extracts w in a way that is undetectable, in the sense that the state left over after the whole\nof Process 5 with (E) inserted between (iii) and (iv) is computationally indistinguishable from the state left over after\nthe whole of Process 5 without (E). We will now describe in two stages how it accomplishes this.\n[CMSZ22] extraction\nIn [CMSZ22], an algorithm was written down that, for any P∗in Protocol 9, takes in the\nstate in registers P, M and Z after step (ii) in Process 5 and alternates the following two projectors Πu and Πc (u for\n‘uniform’ and c for ‘correct’) in order to attempt to extract a witness w such that Merklehk(w) = rtw, where rtw is the\nsecond part of the message rt = (rtm,rtw) that P∗sent in step (i).\nΠu = 1P ⊗|+m⟩M⟨+m|M ⊗|0⟩⟨0|Z,\nwhere |+m⟩:= ∑\nj\n|j⟩with the appropriate normalisation\nΠc = U†\nP∗CNOT†\nz\n\u0010\n∑\nVrt( j,z)=1\n1P ⊗|j,z⟩MZ⟨j,z|MZ\n\u0011\nCNOTzUP∗\nNote that Πc coincides with the Πc we wrote down in Process 5. The analysis involves decomposing the joint space\nof P, M and Z into the Jordan subspaces (for more information about the Jordan decomposition and how it is usually\nused in quantum computing, see [Vid20, Section 1.2.3]) of Πu and Πc. We establish some notation in order to state\nthe extraction guarantee which [CMSZ22] prove.\nLet the set of Jordan subspaces of Πu and Πc be {Si}i. Let |ui⟩be the rank-1 projector associated with Πu in\nsubspace i, and let |ci⟩be the rank-1 projector associated with Πc in subspace i: that is, for any |𝜙⟩∈Si, Πu|𝜙⟩=\n|ui⟩⟨ui| · |𝜙⟩, and similarly Πc|𝜙⟩= |ci⟩⟨ci| · |𝜙⟩. Since the state in registers P, M and Z after step (ii) in Process 5,\nwhich we will name |𝜙start⟩for notational convenience, lies inside Πu, it can be decomposed as\n|𝜙start⟩= ∑\ni\n𝛼i|ui⟩.\nThe extraction guarantee which [CMSZ22] prove is the following.\n49\n\n\nLemma 7.2 ([CMSZ22]; informal). For any state |𝜙⟩∈Πu with a decomposition |𝜙⟩= ∑i(𝛼i|ci⟩+ 𝛽i|ui⟩), and\ngiven the ability to implement the two projectors Πu and Πc (note that Πc implicitly depends on rt through Vrt),\nthe [CMSZ22] rewinding algorithm takes as input |𝜙⟩and outputs w such that Merklehk(w) = rtw with probability\n1−𝜖in time poly(1/𝜖), if the following condition holds:\n∑\ni\n(|𝛼i|2 +|𝛽i|2)·1\n\u0002\n|⟨ci|ui⟩|2 is non-negligible\n\u0003\n≥1−negl(𝜆).\n(7.1)\nIn other words, if the weight in the superposition ∑i(𝛼i|ci⟩+ 𝛽i|ui⟩) is overwhelmingly in Jordan subspaces where\n|⟨ci|ui⟩|2 is non-negligible, then [CMSZ22] extraction will succeed with probability 1−\n1\npoly(𝜆).\nCoherent [CMSZ22] extraction.\nIn [LMS22], it is shown how to accomplish ‘undetectable extraction’, i.e. how to\ninsert an extra step (E) in between steps (iii) and (iv) in Process 5, corresponding with the execution of the extractor,\nsuch that the state left over after the whole of Process 5 with (E) inserted between (iii) and (iv) is computationally\nindistinguishable from the state left over after the whole of Process 5 without (E).\nLombardi, Ma and Spooner begin by considering the entire [CMSZ22] process as a black-box unitaryUCMSZ which\ntakes as input a state |𝜙⟩∈Πu and outputs some state ∑w′ |w′⟩|auxw′⟩(ignoring normalisation) which is a superposition\nover candidate witnesses w′ and associated auxiliary states. It can be shown that, if the superposition ∑w′ |w′⟩|auxw′⟩\nhas its weight only on terms with candidates w′ such that Merklehk(w′) = rtw, then measuring w′ at this point is\ncomputationally undetectable: this is because Merklehk(·) is a collapse-binding commitment, and the statement that\nno efficient algorithm can tell the difference between ∑w′ |w′⟩W|auxw′⟩aux and MeasW\n∑w′ |w′⟩W|auxw′⟩aux\n\u0001\n, when the\nsuperposition is only over w′ such that Merklehk(w′) = rtw, is precisely the definition of collapse-binding. (This is the\nonly step in the analysis where the ‘extra’ commitment to w which the prover sends in step (i) of Protocol 9 in addition\nto the commitment to the PCPP is used.)\nIn other words, if the success condition for [CMSZ22] rewinding stated in Lemma 7.2 is true, namely, the starting\nstate |𝜙⟩∈Πu,|𝜙⟩= ∑i 𝛼i|ui⟩on which UCMSZ is run is such that\n∑\ni\n|𝛼i|2 ·1\n\u0002\n|⟨ci|ui⟩|2 is non-negligible\n\u0003\n≥1−negl(𝜆),\nthen (except with at most\n1\npoly(𝜆) probability for any poly of our choice) the extractor can run UCMSZ and then meas-\nure the W register in the resulting superposition, and this will output a successful witness candidate w′ such that\nMerklehk(w′) = rtw and the measurement will be undetectable to the prover.\nOur first hope might be that, if P∗succeeds in Protocol 9 with high probability, then the CMSZ success condition\nEquation (7.1) is true for the total state lying in registers P, M and Z after step (ii) in Process 5. Unfortunately, this\nturns out not to be (necessarily) true; we will not go into why here.\nHowever, one can guarantee the condition for the success of the CMSZ procedure for the total state in registers P,\nM and Z after step (iii) of Process 5. Note that the state after step (iii) is precisely the state after step (ii) after Πc has\nbeen applied to it once. The effect of applying Πc to a superposition ∑i 𝛼i|ui⟩is as follows:\nΠc\n∑\ni\n𝛼i|ui⟩\n\u0001\n∝∑\ni\n𝛼i\n|ci⟩⟨ci|·|ui⟩\n\u0001\n(7.2)\n= ∑\ni\n𝛼i⟨ci|ui⟩\n\u0001\n|ci⟩\n(7.3)\nNote that this (subnormalised) state now has a decomposition of the form ∑i 𝛽i|ci⟩; and, moreover, if |⟨ci|ui⟩|2 is\nnegligible, then the weight on |ci⟩(i.e. the squared norm of the coefficient of |ci⟩) in the superposition will be negligibly\nsmall. For brevity’s sake we will ignore the issue of the normalisation, but the intuition that the coefficients where\n|⟨ci|ui⟩|2 is small get suppressed holds even in the presence of the correct renormalisation.\nTherefore, the entire ‘undetectable extraction’ procedure, given black-box access to a prover P∗for Protocol 9, is\nas follows:\nProcess 6 (extraction).\n50\n\n\n(i) Run P∗normally in order to generate its first message rt to the verifier. Let the state that P∗has left over after\nsending rt be |𝜓P∗⟩(held in a private register P).\n(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message\nregister M. Also create a new register Z initialised to the all zero state which will be used in step (iii).\n(iii) This step can be stated in words as a series of substeps:\n(i) Apply the prover’s unitary UP∗jointly to P and M.\n(ii) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of\nProcess 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary\nthat does this copying CNOTz.\n(iii) Project the state in registers P, M and Z into the subspace whereVrt( j,z) = 1. If the projective measurement\nresults in Vrt( j,z) = 0, output fail.\n(iv) Undo CNOTz and UP∗in that order.\nIn other words, in this step, apply the projective measurement where one of the projectors in the measurement is\nΠc := U†\nP∗CNOT†\nz\n\u0010\n∑\nVrt(j,z)=1\n1P ⊗|j,z⟩MZ⟨j,z|MZ\n\u0011\nCNOTzUP∗\nand the other is I −Πc; output fail if the outcome is I −Πc.\n(E) Perform UCMSZ, the unitary that does the CMSZ rewinding procedure coherently, which results in a state\n∑w′ |w′⟩W|auxw′⟩aux. Measure the W register and check if the outcome is a string w such that Merklehk(w) = rtw.\nIf no, output fail. If yes, apply U†\nCMSZ.\n(iv) Redo CNOTz and UP∗(to counteract substep (iv) of step (iii)). Measure registers M and Z; obtain outcomes j\nand z.\nConditioned on the extractor not outputting fail, the state that remains in registers P and M (note that Z is a work\nregister for the extractor) after Process 6 is computationally indistinguishable from the state which would remain\nin those same registers after a real (successful) execution of Protocol 9. Note that the probability that the extractor\noutputs fail in step (iii) is the same as the probability that the prover fails the real execution of Protocol 9, and that\nthe probability the extractor outputs fail in step (E) is at most 𝜖if the extractor runs for time poly(1/𝜖). As such,\nif Protocol 9 is a sub-protocol in a longer protocol, then extraction can be performed while affecting the prover’s\nprobability of passing in the rest of the longer protocol by only 𝜖+negl(𝜆).\n7.3\nA fully succinct version of Protocol 2\nThe intuition for compiling Protocol 2 (which is already question-succinct) into a fully succinct protocol is as follows.\nEvery time the prover P is supposed to send a message to the verifier V in Protocol 2, we ask the prover ˜\nP in the\nsuccinct version of Protocol 2 to commit (using some succinct computationally binding commitment) to the answer\nthat P would have provided, and then execute Protocol 9 in order to prove succinctly that it ‘knows’ a valid opening to\nthat commitment. At the end of the protocol, V in Protocol 2 takes the answers that it receives and evaluates a decision\npredicate. Since ˜\nV, the succinct protocol’s verifier, does not have the prover’s answers (instead it only experienced a\nshort interactive proof that the prover ‘knew’ answers of some description), it cannot evaluate the decision predicate\nfor itself. Instead, the verifier ˜\nV reveals all of its secret randomness at the end of the protocol, and asks ˜\nP to execute\nProtocol 9 one more time to prove that it knows full-length answers which are ‘consistent’ with its ( ˜\nP’s) earlier\ncommitments, and moreover that these full-length answers satisfy V’s decision predicate.\nMore specifically, the fully succinct version of Protocol 2 is as follows:\n51\n\n\nProtocol 10 (Fully succinct version of Protocol 2).\nInputs: an instance x, a description of the verification algorithm C of a promise problem A ∈QMA, a\nsecurity parameter 𝜆, and (for the honest prover ˜\nP) polynomially many copies of a witness that x ∈Ayes.\n(i) Phase 1: hash key, ‘Alice’ question and answer\n(i) The verifier ˜\nV of Protocol 10 samples a hash key hk from some collapsing hash function family. It\nalso runs V, the verifier of Protocol 2, on the inputs x, C, 𝜆in order to generate the two questions\nof Protocol 2, one of which is a ciphertext ˆ\nq1 encrypting some ‘Alice’ question q1, and the other of\nwhich is a plaintext ‘Bob’ question q2. ˜\nV sends hk and ˆ\nq1 to the prover ˜\nP.\n(ii) Honest ˜\nP responds with a succinct commitment7 to the answer that P would have given V. We will\ncall ˜\nP’s response here com1.\n(iii) ˜\nP and ˜\nV execute Protocol 9 so that ˜\nP can prove that it knows a valid opening to its commitment\ncom1. The property of being a valid opening can be phrased as an NP relation R1(com1,w1) =\n(Merklehk(w1) = com1).\n(ii) Phase 2: ‘Bob’ question and answer\n(i) ˜\nV sends q2 (which it generated earlier along with ˆ\nq1) to ˜\nP.\n(ii) Honest ˜\nP responds with a succinct commitment to the answer that P would have given V. We will\ncall ˜\nP’s response here com2.\n(iii) ˜\nP and ˜\nV execute Protocol 9 so that ˜\nP can prove that it knows a valid opening to its commitment\ncom2. As before, this can be phrased as an NP relation R2(com2,w2) = (Merklehk(w2) = com2).\n(iii) Phase 3: Proof of knowledge that V would have accepted\n(i) ˜\nV now reveals the secret key sk of the quantum homomorphic encryption scheme under which ˆ\nq1\nwas encrypted.\n(ii) ˜\nV and ˜\nP execute Protocol 9 so that ˜\nP can prove that it knows ˆ\na1 and a2 such that:\n(i) ˆ\na1 is a valid opening of com1,\n(ii) a2 is a valid opening of com2,\n(iii) V(x,C,1𝜆,Decsk( ˆ\nq1),Decsk( ˆ\na1),q2,a2) = 1.\nFormally, this can be expressed as an NP relation R3((com1,com2,x,C,1𝜆, ˆ\nq1,q2,sk)\n|\n{z\n}\ninstance\n,( ˆ\na1,a2)\n| {z }\nwitness\n), in\nthe standard way.\nTheorem 7.3. There exists a negligible function negl(·) such that, for any (x,C,𝜆), and any 𝜖=\n1\npoly(𝜆), if there exists\nan efficient prover ˜\nP which causes ˜\nV (the verifier of Protocol 10) to accept on input (x,C,𝜆) with probability ˜\np, then\nthere exists an efficient prover P which causes V (the verifier of Protocol 2) to accept (x,C,𝜆) with probability p, such\nthat p ≥˜\np−negl(𝜆)−O(𝜖).\nProof sketch. The analysis proceeds via reduction to Protocol 2. In particular, we consider a reduction R that plays\nthe part of the verifier ˜\nV with ˜\nP in Protocol 10 and the part of the prover P with V in Protocol 2, and show that R\npasses in Protocol 2 with about the same probability that ˜\nP passes in Protocol 10. We assume that R gets the same\nkind of black-box access to ˜\nP that the extractor of Process 6 does.\nR does the following:\n7Succinct computationally binding commitments can be constructed from collapsing hash functions using Merkle trees.\n52\n\n\n(i) Phase 1: ‘Alice’ question and answer\n(i) Receives ˆ\nq1 from V; samples hk for itself; inputs hk, ˆ\nq1 into ˜\nP.\n(ii) Gets com1 from ˜\nP.\n(iii) Gets rt1, the first message of the first execution of Protocol 9 in Protocol 10, from ˜\nP.\n(iv) Runs Process 6 on ˜\nP in order to extract a witness w1 such that w1 is a valid opening for com1. (Note that,\nin the case of honest ˜\nP, w1 is an encryption of an ‘Alice’ answer a1.)\n(v) Returns w1 to V as its ‘Alice’ answer.\n(ii) Phase 2: ‘Bob’ question and answer\n(i) Receives q2 from V; inputs q2 into ˜\nP.\n(ii) Gets com2 from ˜\nP.\n(iii) Gets rt2, the first message of the second execution of Protocol 9 in Protocol 10, from ˜\nP.\n(iv) Runs Process 6 on ˜\nP in order to extract a witness w2 such that w2 is a valid opening for com2. (Note that,\nin the case of honest ˜\nP, w2 is a ‘Bob’ answer a2.)\n(v) Returns w2 to V as its ‘Bob’ answer.\n(iii) R ignores Phase 3 of Protocol 10 and aborts after Phase 2.\nNote that R does not use the third execution of Protocol 9 in Protocol 10; in fact, R cannot continue playing with\n˜\nP after Phase 2 because it does not know the secret key for the homomorphic encryption which V generated. However,\nthe third execution of Protocol 9 in Protocol 10 will be used in the analysis. In particular, in order to prove that R\nsucceeds in Protocol 2 with about the same probability that ˜\nP succeeds in Protocol 10, we will consider the following\nmental experiment. Consider an R′ which behaves identically to R in Phase 1 and Phase 2 of Protocol 10, and in\nPhase 3, instead of aborting, does an inefficient brute force search for the secret key of the encryption.\nProcess 7 (A mental experiment: R′’s execution).\n(i) Phase 1: ‘Alice’ question and answer\n(i) Receives ˆ\nq1 from V; samples hk for itself; inputs hk, ˆ\nq1 into ˜\nP.\n(ii) Gets com1 from ˜\nP.\n(iii) Gets rt1, the first message of the first execution of Protocol 9 in Protocol 10, from ˜\nP.\n(iv) Runs Process 6 on ˜\nP in order to extract a witness w1 such that w1 is a valid opening for com1. (Note that,\nin the case of honest ˜\nP, w1 is an encryption of an ‘Alice’ answer a1.)\n(v) Returns w1 to V as its ‘Alice’ answer.\n(ii) Phase 2: ‘Bob’ question and answer\n(i) Receives q2 from V; inputs q2 into ˜\nP.\n(ii) Gets com2 from ˜\nP.\n(iii) Gets rt2, the first message of the second execution of Protocol 9 in Protocol 10, from ˜\nP.\n(iv) Runs Process 6 on ˜\nP in order to extract a witness w2 such that w2 is a valid opening for com2. (Note that,\nin the case of honest ˜\nP, w2 is a ‘Bob’ answer a2.)\n(v) Returns w2 to V as its ‘Bob’ answer.\n(iii) Phase 3: proof of knowledge that V would have accepted\n(i) Finds the secret key sk of the quantum homomorphic encryption scheme being used by V (by brute force,\nlet’s say) and inputs this key into ˜\nP.\n53\n\n\n(ii) Gets rt3, the first message of the third and last execution of Protocol 9 in Protocol 10, from ˜\nP.\n(iii) Runs Process 6 on ˜\nP in order to extract a witness w3 such that w3 = ( ˆ\na1,a2), where\n(i) ˆ\na1 is a valid opening of com1,\n(ii) a2 is a valid opening of com2,\n(iii) V(Decsk( ˆ\nq1),Decsk( ˆ\na1),q2,a2) = 1.\nR′ is, of course, inefficient; however, it is efficient given the secret key of the homomorphic encryption. Moreover,\nsuppose we condition on all three extractions in Process 7 succeeding. Then, if w1 (the witness that R′ extracts from\n˜\nP during Phase 1) is equal to ˆ\na1 (which is our name for the first part of the witness w3 extracted by R′ from ˜\nP during\nPhase 3) except with negligible probability in the mental experiment, and similarly w2 = a2 except with negligible\nprobability, then it is the case that R will be accepted by V with probability at least 1 −negl(𝜆). (This is because,\nif extraction succeeds, then w3 consists of a pair of answers which, by definition, causes V to accept.) The event\nthat all three extractions succeed happens with probability at least ˜\np−3𝜖−negl(𝜆) by a union bound, where ˜\np is the\nprobability that ˜\nP passes overall. Therefore, it is sufficient to prove the following lemma:\nLemma 7.4. In Process 7, except with negligible probability, w1 = ˆ\na1 and w2 = a2.\nProof sketch. Consider an adversary A for the security for the collapsing hash function family from which hk was\ndrawn. A can generate its own homomorphic encryption keys and then simulate the entire interaction between V,\nR′ and ˜\nP efficiently. If w1 ̸= ˆ\na1 or w2 ̸= ˆ\na2, then A has generated two valid openings of a computationally binding8\ncommitment (either two valid openings to com1 or two valid openings to com2); this can only happen with negligible\nprobability by the definition of computational binding. The claim follows.\nTherefore, w1 = ˆ\na1 and w2 = a2 except with negligible probability, and so R will be accepted by V with probability\nat least ˜\np−negl(𝜆)−O(𝜖).\nTheorem 7.5. The protocol Protocol 10 is a succinct argument system for QMA assuming a QHE scheme satisfying\nthe definition given in Definition 2.13, and assuming the existence of collapsing hash functions (see [BKL+22, Section\n3.6] for a definition of these objects).\nMore precisely, let V be the verifier, and P be the honest prover described in the protocol. Then for any promise\nproblem A = (Ayes,Ano) in QMA with verification algorithm C, the following hold:\n• Completeness: Let x ∈Ayes , and let |𝜓⟩be an accepting QMA witness for x. Then the verifier V on input\n(x,C,1𝜆), in interaction with the honest prover P on input (x,C,|𝜓⟩polyn,1𝜆), accepts with probability ≥1 −\nnegl(n).\n• Soundness: Let x ∈Ano, and let |𝜙⟩be any state on poly(n+𝜆) qubits. Then the verifier V on input (x,C,1𝜆), in\ninteraction with any QPT prover P∗on input (x,C,|𝜙⟩,1𝜆), accepts with probability at most s′ for some universal\nconstant s′ < 1.\n• Succinctness: On any input x and for security parameter 𝜆, the runtime of the verifier V is ˜\nO(n)+O(polylogn·\npoly(𝜆)), and the total number of bits communicated between the prover and verifier is O(polylogn·poly(𝜆)).\nProof. Completeness, soundness, and the communication bound in succinctness all follow from Theorem 6.23 and\nTheorem 7.3. For the runtime part of succinctness, we must be slightly more careful. Recall that the verifier V of\nProtocol 2 satisfies the obliviousness and efficiency properties that (1) the challenges it generates depend only on the\nalgorithm C and on the length of the instance x, not on the instance itself, and (2) all the challenges can be generated\nin time polylogn·poly𝜆+ ˜\nO(n). Specifically, the questions generated by V were of the following form:\n• Encryptions of uniform randomness of some predetermined length scaling as polylog(|x|), or\n• Non-encrypted uniform randomness of some predetermined length scaling as polylog(|x|),\n8We note that, in this particular situation, classical binding actually suffices; collapse-binding is not necessary.\n54\n\n\nwhere the length depends on |x| and C. For our current purposes, we would like to claim that this means that V can\ngenerate its challenges in time ˜\nO(|x|) + polylog|x| · poly(𝜆), and in particular does not need to run the potentially\ncostly reduction from x to a Hamiltonian problem (H,𝛼, 𝛽). In order to ensure that this is the case, let us specify that\nC is given as a description of the algorithm, together with an explicit polynomial upper-bounding the runtime of C.\nThen, the length of the randomness to be generated in the challenges depends only on the number of qubits and terms\nin the Hamiltonian H, which in turn can be efficiently computed given |x|, and the explicit polynomial. This means it\ncan be computed in ˜\nO(|x|) time.\nNow, let us calculate the runtime for the succinct verifier ˜\nV in Phase 1. First, the runtime to generate the questions\nˆ\nq1,q2 is ˜\nO(n) +polylogn·poly𝜆by the previous paragraph. Moreover, since these questions come from a question-\nsuccinct protocol, their length is polylogn · poly𝜆—we will need this later when we analyse Phase 3. Next, let us\ncompute the runtime for the succinct argument of knowledge at the end of Phase 1. The relation R1 has instance length\nequal to ℓ1 = |com1| = poly(logn)·poly(𝜆), and R1 can be decided in time T1 = poly(n,𝜆). Thus, by Lemma 7.1, the\nruntime of the succinct argument is ˜\nO(ℓ1)+poly(log(T1))·poly(𝜆) = poly(logn)·poly(𝜆).\nNow we move on to Phases 2 and 3. Here we can see that the runtime is dominated by the runtime of the succinct\narguments of knowledge. In Phase 2, the runtime is identical to that of Phase 1. For Phase 3, the relation R3 has\ninstance length\nℓ3 = |com1|+|com2|+|x|+|C|+𝜆+| ˆ\nq1|+|q2|+|sk|\n= n+poly(𝜆)·polylogn.\nIt can be decided in time T3 = poly(n,𝜆). Thus, again applying Lemma 7.1, the runtime of the succinct argument is\n˜\nO(ℓ3)+poly(logT3)·poly𝜆= ˜\nO(n)+poly(logn)·poly(𝜆).\nAll together, the total runtime of ˜\nV is ˜\nO(n)+polylog(n)·poly(𝜆) as desired.\nReferences\n[Aar07]\nScott Aaronson. The Aaronson $25.00 prize, 2007. https://scottaaronson.blog/?p=284.\n[Ara02]\nPK Aravind. A simple demonstration of Bell’s theorem involving two observers and no probabilities or\ninequalities. 2002, arXiv:quant-ph/0206070.\n[BCM+21] Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh Vazirani, and Thomas Vidick. A crypto-\ngraphic test of quantumness and certifiable randomness from a single quantum device. Journal of the\nACM (JACM), 68(5):1–47, 2021, arXiv:1804.00640.\n[Bel64]\nJohn S Bell. On the Einstein Podolsky Rosen paradox. Physics Physique Fizika, 1(3):195, 1964.\n[BKL+22]\nJames Bartusek, Yael Tauman Kalai, Alex Lombardi, Fermi Ma, Giulio Malavolta, Vinod Vaikuntan-\nathan, Thomas Vidick, and Lisa Yang.\nSuccinct classical verification of quantum computation.\nIn\nAdvances in Cryptology–CRYPTO 2022: 42nd Annual International Cryptology Conference, CRYPTO\n2022, Santa Barbara, CA, USA, August 15–18, 2022, Proceedings, Part II, pages 195–211. Springer,\n2022. https://eprint.iacr.org/2022/857.\n[BKVV20] Zvika Brakerski, Venkata Koppula, Umesh Vazirani, and Thomas Vidick. Simpler proofs of quantumness.\n2020, arXiv:2005.04826.\n[BL08]\nJacob D Biamonte and Peter J Love. Realizable hamiltonians for universal adiabatic quantum computers.\nPhysical Review A, 78(1):012352, 2008, arXiv:0704.1287.\n[CMM+24] David Cui, Giulio Malavolta, Arthur Mehta, Anand Natarajan, Connor Paddock, Simon Schmidt, Michael\nWalter, and Tina Zhang. A computational Tsirelson’s theorem for the value of compiled XOR games.\n2024, arXiv:2402.17301.\n55\n\n\n[CMSZ22]\nAlessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandry. Post-quantum succinct arguments:\nbreaking the quantum rewinding barrier.\nIn 2021 IEEE 62nd Annual Symposium on Foundations of\nComputer Science (FOCS), pages 49–58. IEEE, 2022, arXiv:2103.08140.\n[dlS22]\nMikael de la Salle. Spectral gap and stability for groups and non-local games. 2022, arXiv:2204.07084.\n[GGM86]\nOded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions. Journal of\nthe ACM (JACM), 33(4):792–807, 1986.\n[GH15]\nW. T. Gowers and O. Hatami. Inverse and stability theorems for approximate representations of finite\ngroups. Sbornik: Mathematics, 208(12):1784, 2015, arXiv:1510.04085.\n[GKNV24] Sam Gunn, Yael Kalai, Anand Natarajan, and Ági Villányi. Classical commitments to quantum states.\n2024. To appear.\n[Gri17]\nAlex B Grilo. A simple protocol for verifiable delegation of quantum computation in one round. 2017,\narXiv:1711.09585.\n[GV19]\nAlexandru Gheorghiu and Thomas Vidick. Computationally-secure and composable remote state pre-\nparation. In 2019 IEEE 60th Annual Symposium on Foundations of Computer Science (FOCS), pages\n1024–1033. IEEE, 2019, arXiv:1904.06320.\n[GV24]\nAparna Gupte and Vinod Vaikuntanathan. How to construct QFHE, generically, 2024. To appear.\n[JLS21]\nAayush Jain, Huijia Lin, and Amit Sahai. Indistinguishability obfuscation from well-founded assump-\ntions. In Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, pages\n60–73, 2021, arXiv:2008.09317.\n[JNV+20]\nZhengfeng Ji, Anand Natarajan, Thomas Vidick, John Wright, and Henry Yuen. MIP* = RE. 2020,\narXiv:2001.04383.\n[JNV+22]\nZhengfeng Ji, Anand Natarajan, Thomas Vidick, John Wright, and Henry Yuen. Quantum soundness\nof testing tensor codes. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science\n(FOCS), pages 586–597. IEEE, 2022.\n[Kil92]\nJoe Kilian. A note on efficient zero-knowledge proofs and arguments. In Proceedings of the twenty-fourth\nannual ACM symposium on Theory of computing, pages 723–732, 1992.\n[KLVY21]\nYael Kalai, Alex Lombardi, Vinod Vaikuntanathan, and Lisa Yang. Quantum advantage from any non-\nlocal game. 2021, arXiv:2203.15877.\n[KSV02]\nAlexei Yu Kitaev, Alexander Shen, and Mikhail N Vyalyi. Classical and quantum computation. Num-\nber 47. American Mathematical Soc., 2002.\n[LMS22]\nAlex Lombardi, Fermi Ma, and Nicholas Spooner. Post-quantum zero knowledge, revisited or: How to\ndo quantum rewinding undetectably. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer\nScience (FOCS), pages 851–859. IEEE, 2022, arXiv:2111.12257.\n[Mah17]\nUrmila Mahadev. Classical homomorphic encryption for quantum circuits. SIAM Journal on Computing,\n(0):FOCS18–189, 2017, arXiv:1708.02130.\n[Mah18]\nUrmila Mahadev. Classical verification of quantum computations. In 2018 IEEE 59th Annual Symposium\non Foundations of Computer Science (FOCS), pages 259–267. IEEE, 2018, arXiv:1804.01082.\n[Mer87]\nRalph C Merkle. A digital signature based on a conventional encryption function. In Conference on the\ntheory and application of cryptographic techniques, pages 369–378. Springer, 1987.\n56\n\n\n[Mer90]\nDavid Mermin. Simple unified form for the major no-hidden-variables theorems. Physical Review Let-\nters, 65(27):3373, 1990.\n[MF16]\nTomoyuki Morimae and Joseph F Fitzsimons.\nPost hoc verification with a single prover.\n2016,\narXiv:1603.06046.\n[MV21]\nTony Metger and Thomas Vidick. Self-testing of a single quantum device under computational assump-\ntions. Quantum, 5:544, 2021, arXiv:2001.09161.\n[NN90]\nJoseph Naor and Moni Naor. Small-bias probability spaces: Efficient constructions and applications.\nIn Proceedings of the twenty-second annual ACM symposium on Theory of computing, pages 213–223,\n1990.\n[NN24]\nAnand Natarajan and Chinmay Nirkhe. The status of the quantum pcp conjecture (games version). 2024,\narXiv:2403.13084.\n[NV17]\nAnand Natarajan and Thomas Vidick. A quantum linearity test for robustly verifying entanglement. In\nProceedings of the 49th Annual ACM SIGACT Symposium on Theory of Computing, pages 1003–1015,\n2017.\n[NV18]\nAnand Natarajan and Thomas Vidick. Low-degree testing for quantum states, and a quantum entangled\ngames PCP for QMA. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science\n(FOCS), pages 731–742. IEEE, 2018, arXiv:1801.03821.\n[NW19]\nAnand Natarajan and John Wright. NEEXP ⊆MIP∗. 2019, arXiv:1904.05870v3.\n[NZ23a]\nAnand Natarajan and Tina Zhang. Bounding the quantum value of compiled nonlocal games: From\nCHSH to BQP verification. In 2023 IEEE 64th Annual Symposium on Foundations of Computer Science\n(FOCS), pages 1342–1348, 2023, arXiv:2303.01545.\n[NZ23b]\nAnand Natarajan and Tina Zhang. Quantum free games. In Proceedings of the 55th Annual ACM Sym-\nposium on Theory of Computing, pages 1603–1616, 2023, arXiv:2302.04322.\n[O’D14]\nRyan\nO’Donnell.\nAnalysis\nof\nBoolean\nFunctions.\nCambridge\nUniversity\nPress,\n2014,\narXiv:2105.10386.\n[Per90]\nAsher Peres. Incompatible results of quantum measurements. Physics Letters A, 151(3-4):107–108,\n1990.\n[Sca13]\nValerio Scarani. The device-independent outlook on quantum physics (lecture notes on the power of\nBell’s theorem). Acta Physica Slovaca, 62(4):347–409, 2013, arXiv:1303.3081.\n[Unr16]\nDominique Unruh.\nComputationally binding quantum commitments.\nIn Advances in Cryptology–\nEUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Crypto-\ngraphic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II 35, pages 497–527. Springer,\n2016.\n[Vid20]\nThomas Vidick. Interactions with quantum devices (course), 2020. http://users.cms.caltech.\nedu/~vidick/teaching/fsmp/fsmp.pdf.\n[Vid22]\nThomas Vidick. Almost synchronous quantum correlations. Journal of mathematical physics, 63(2),\n2022, arXiv:2103.02468.\n[Zha21]\nMark Zhandry. Quantum lightning never strikes the same state twice. or: quantum money from crypto-\ngraphic assumptions. Journal of Cryptology, 34:1–56, 2021, arXiv:1711.02276.\n[Zha22]\nJiayu Zhang.\nClassical verification of quantum computations in linear time.\nIn 2022 IEEE\n63rd Annual Symposium on Foundations of Computer Science (FOCS), pages 46–57. IEEE, 2022,\narXiv:2202.13997.\n57\n\n\nSuccinct Classical Verification of Quantum Computation\nJames Bartusek∗\nYael Tauman Kalai†\nAlex Lombardi‡\nFermi Ma§\nGiulio Malavolta¶\nVinod Vaikuntanathan‖\nThomas Vidick∗∗\nLisa Yang††\nJune 28, 2022\nAbstract\nWe construct a classically verifiable succinct interactive argument for quantum computation\n(BQP) with communication complexity and verifier runtime that are poly-logarithmic in the\nruntime of the BQP computation (and polynomial in the security parameter). Our protocol is\nsecure assuming the post-quantum security of indistinguishability obfuscation (iO) and Learning\nwith Errors (LWE). This is the first succinct argument for quantum computation in the plain\nmodel; prior work (Chia-Chung-Yamakawa, TCC ’20) requires both a long common reference\nstring and non-black-box use of a hash function modeled as a random oracle.\nAt a technical level, we revisit the framework for constructing classically verifiable quantum\ncomputation (Mahadev, FOCS ’18). We give a self-contained, modular proof of security for\nMahadev’s protocol, which we believe is of independent interest. Our proof readily generalizes to\na setting in which the verifier’s first message (which consists of many public keys) is compressed.\nNext, we formalize this notion of compressed public keys; we view the object as a generalization\nof constrained/programmable PRFs and instantiate it based on indistinguishability obfuscation.\nFinally, we compile the above protocol into a fully succinct argument using a (sufficiently\ncomposable) succinct argument of knowledge for NP. Using our framework, we achieve several\nadditional results, including\n• Succinct arguments for QMA (given multiple copies of the witness),\n• Succinct non-interactive arguments for BQP (or QMA) in the quantum random oracle\nmodel, and\n• Succinct batch arguments for BQP (or QMA) assuming post-quantum LWE (without iO).\n∗UC Berkeley. Email:\nbartusek.james@gmail.com.\n†Microsoft Research and MIT. Email: yael@microsoft.com.\n‡MIT. Email: alexjl@mit.edu.\n§Simons Institute and UC Berkeley. Email: fermima@alum.mit.edu.\n¶Max Planck Institute for Security and Privacy. Email: giulio.malavolta@hotmail.it.\n‖MIT. Email: vinodv@mit.edu.\n∗∗Caltech. Email: vidick@caltech.edu.\n††MIT. Email; lisayang@mit.edu.\n\n\nContents\n1\nIntroduction\n1\n2\nTechnical Overview\n4\n2.1\nRecap: Mahadev’s Measurement Protocol . . . . . . . . . . . . . . . . . . . . . . . .\n4\n2.2\nDefining a (Succinct) Measurement Protocol . . . . . . . . . . . . . . . . . . . . . . .\n6\n2.3\nConstructing a Verifier-Succinct Measurement Protocol\n. . . . . . . . . . . . . . . .\n7\n2.4\nProof of Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n8\n2.5\nFrom a Verifier-Succinct Measurement Protocol to Succinct Arguments for BQP\n. .\n13\n3\nPreliminaries\n14\n3.1\nQuantum Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n14\n3.2\nBlack-Box Access to Quantum Algorithms . . . . . . . . . . . . . . . . . . . . . . . .\n15\n3.3\nInteractive Arguments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n16\n3.4\nComputational Indistinguishability . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n17\n3.5\nMahadev Randomized TCFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n18\n3.6\nCollapsing Hash Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n20\n3.7\nFully Homomorphic Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n21\n3.8\nIndistinguishability Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n21\n3.9\nPuncturable PRFs\n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n22\n4\nCommit-and-Measure Protocols\n23\n4.1\nDefining Commit-and-Measure Protocols . . . . . . . . . . . . . . . . . . . . . . . . .\n23\n5\nA Measurement Protocol Template\n26\n5.1\nMeasurement Protocol Description . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n27\n6\nSoundness of Mahadev’s Protocol\n29\n6.1\nThe Verifier’s Output Distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n29\n6.2\nThe Protocol Observables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n31\n6.3\nThe Extracted State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n33\n6.4\nIndistinguishability of Measurement Outcomes\n. . . . . . . . . . . . . . . . . . . . .\n36\n7\nSuccinct Key Generation from iO\n41\n7.1\nBatch Key Generation: Definition and Construction\n. . . . . . . . . . . . . . . . . .\n41\n7.2\nCombining Succinct Key Generation with Mahadev rTCFs\n. . . . . . . . . . . . . .\n45\n8\nA Verifier-Succinct Protocol\n47\n8.1\nQuantum commit-challenge-response protocols\n. . . . . . . . . . . . . . . . . . . . .\n47\n8.2\nNon-Interactive Post Hoc Verification of QMA . . . . . . . . . . . . . . . . . . . . .\n48\n8.3\nSemi-Succinct Delegation for QMA . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n48\ni\n\n\n9\nThe Fully Succinct Protocol\n50\n9.1\nState-Preserving Succinct Arguments of Knowledge . . . . . . . . . . . . . . . . . . .\n51\n9.2\nThe QMA Protocol, Version 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n52\n9.3\nThe QMA Protocol, Version 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n54\n10 Additional Results\n56\n10.1 Succinct Non-interactive Arguments in the QROM . . . . . . . . . . . . . . . . . . .\n56\n10.2 Batch Arguments for QMA\n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n58\n10.3 Zero Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n59\nA Proofs from Section 8\n64\nB Proof of Claim 6.4\n67\nC Proof of Claim 6.7\n68\nii\n\n\n1\nIntroduction\nEfficient verification of computation is one of the most fundamental and intriguing concepts in\ncomputer science, and lies at the heart of the P vs. NP question.\nIt has been studied in the\nclassical setting for over three decades, giving rise to beautiful notions such as interactive proofs\n[GMR85], multi-prover interactive proofs [BGKW88], probabilistically checkable proofs [BFL90,\nALM+92, AS92], and culminating with the notion of a succinct (interactive and non-interactive)\nargument [Kil92, Mic94]. Roughly speaking, a succinct argument for a T-time computation enables\na prover running in poly(T) time to convince a polylog(T)-time verifier of the correctness of the\ncomputation using only polylog(T) bits of communication, with soundness against all polynomial-\ntime cheating provers.\nIn a breakthrough result in 2018, Mahadev [Mah18] presented an interactive argument system\nthat enables a classical verifier to check the correctness of an arbitrary quantum computation.\nMahadev’s protocol represents a different kind of interactive argument — unlike the traditional\nsetting in which the prover simply has more computational resources (i.e., running time) than\nthe verifier, the prover in Mahadev’s protocol works in a qualitatively more powerful computa-\ntional model. More precisely, for any T-time quantum computation, Mahadev’s protocol enables a\nquantum prover running in time poly(T) to convince a classical poly(T)-time verifier with poly(T)\nbits of classical communication. Soundness holds against all quantum polynomial-time cheating\nprovers under the post-quantum hardness of the learning with errors (LWE) problem.\nA fundamental question is whether we can get the best of both worlds: can the prover have both\na more powerful computational model and significantly greater computational resources? Namely,\nwe want an interactive argument system for T-time quantum computation in which the quantum\nprover runs in poly(T) time and convinces a polylog(T)-time classical verifier with polylog(T) bits\nof classical communication.\nWe answer this question affirmatively, both for poly(T)-time quantum computations, corre-\nsponding to the complexity class BQP, and also for the non-deterministic analog QMA.\nTheorem 1.1 (Succinct Arguments for BQP). Let λ be a security parameter. Assuming the\nexistence of a post-quantum secure indistinguishability obfuscation scheme (iO) and the post-\nquantum hardness of the learning with errors problem (LWE), there is an interactive argument\nsystem for any T-time quantum computation on input x,1 where\n• the prover is quantum and runs in time poly(T, λ),\n• the verifier is classical and runs in time poly(log T, λ) + ˜\nO(|x|),2 and\n• the protocol uses poly(log T, λ) bits of classical communication.\nTheorem 1.2 (Succinct Arguments for QMA). Assuming the existence of a post-quantum\nsecure indistinguishability obfuscation scheme (iO) and the post-quantum hardness of the\n1A T-time quantum computation is a language L decidable by a bounded-error T-time quantum Turing machine\n[BV97]. We leave it to future work to address more complex tasks such as sampling problems (as in [CLLW20]).\n2As in the classical setting, some dependence on |x| is necessary at least to read the input; as in [Kil92], we achieve\na fairly minimal |x|-dependence.\n1\n\n\nlearning with errors problem (LWE), there is an interactive argument system for any T-time\nquantum computation on input x and a poly(T)-qubit witness, where\n• the prover is quantum and runs in time poly(T, λ), using polynomially many copies of\nthe witness,3\n• the verifier is classical and runs in time poly(log T, λ) + ˜\nO(x), and\n• the protocol uses poly(log T, λ) bits of classical communication.\nA New Proof of Security for the [Mah18] Protocol.\nOne might hope to prove Theorems 1.1\nand 1.2 by treating the Mahadev result as a “black box” and showing that any (classical) interac-\ntive argument for quantum computations can be compressed into a succinct protocol via a suitable\ncryptographic compiler. This is especially appealing given the extremely technical nature of Ma-\nhadev’s security proof. Unfortunately, for reasons that will become clear in the technical overview,\nthis kind of generic compilation seems unlikely to be achievable in our setting. Even worse, there\ndoes not appear to be any easily formalized property of the Mahadev protocol that would enable\nsuch a compilation.\nInstead, our solution consists of two steps.\n(1) We build a modified variant of the [Mah18] protocol and give an entirely self-contained proof of\nsecurity. This modified protocol satisfies a few technical conditions that the original [Mah18]\ndoes not; most prominently, the first verifier message of our modified protocol is already\nsuccinct.\n(2) We give a generic compiler that converts the protocol from Step (1) into a succinct argument\nsystem.\nOur Step (1) also results in a self-contained proof of security of the original [Mah18] protocol\nthat is more modular and amenable to further modification and generalization, which we believe\nwill be useful for future work. Our analysis builds upon [Mah18] itself as well as an alternative\napproach described in Vidick’s (unpublished) lecture notes [Vid20]. A concrete consequence of our\nnew proof is that one of the two “hardcore bit” security requirements of the main building block\nprimitive (“extended noisy trapdoor claw-free functions”) in [Mah18] is not necessary.\nAdditional Results.\nBeyond our main result of succinct arguments for BQP and QMA, we\nexplore a number of extensions and obtain various new protocols with additional properties.\n• Non-Interactive: Although our protocols are not public-coin, we show how to modify them in\norder to apply the Fiat-Shamir transformation and round-collapse our protocols. As a result,\nwe obtain designated-verifier non-interactive arguments for BQP (and the non-deterministic\nanalog QMA) with security in the quantum random oracle model (QROM).\n3We inherit the need for polynomially-many copies of the witness from prior works. This is a feature common to\nall previous classical verification protocols, and even to the quantum verification protocol of [FHM18].\n2\n\n\n• Zero-Knowledge: We show how to lift both variants of our protocol (interactive and non-\ninteractive) to achieve zero-knowledge. We show a generic transformation based on classical\ntwo-party computation for reactive functionalities that makes our protocols simulatable. This\ntransformation does not add any new computational assumption to the starting protocol.\n• Batch Arguments from LWE: For the case of batch arguments, i.e., where the parties engage\nin the parallel verification of n statements, we show a succinct protocol that only assumes\nthe post-quantum hardness of LWE (without iO). In this context, succinctness requires that\nthe verifier’s complexity scales with the size of a single instance, but is independent of n.\nPrior Work.\nAs discussed above, Mahadev [Mah18] constructs a non-succinct argument sys-\ntem for BQP/QMA under LWE. The only prior work addressing succinct classical arguments for\nquantum computation is the recent work of Chia, Chung and Yamakawa [CCY20]. [CCY20] con-\nstructs a classically verifiable argument system for quantum computation in the following setting:\n• The prover and verifier share a poly(T)-bits long, structured reference string (which requires\na trusted setup to instantiate) along with a hash function h (e.g. SHA-3).\n• The “online communication” of the protocol is succinct (poly(log T)).\n• Security is heuristic: it can be proved when h is modeled as a random oracle, but the protocol\ndescription itself explicitly requires the code of h (i.e. uses h in a non-black-box way).\nWe specifically note that when viewed in the plain model (i.e., without setup), the verifier must\nsend the structured reference string to the prover, resulting in a protocol that is not succinct.\nWe note that [CCY20] was specifically optimizing for a two-message protocol, but their approach\nseems incapable of achieving succinctness in the plain model even if further interaction is allowed.\nBy contrast, our succinct interactive arguments are in the plain model and are secure based on\nwell-formed cryptographic assumptions, and our succinct 2-message arguments are proved secure\nin the QROM (and do not require a long common reference string).\nFinally, we remark that our approach to achieving succinct arguments fundamentally (and\nlikely necessarily) differs from [CCY20] because we manipulate the “inner workings” of the [Mah18]\nprotocol; by contrast [CCY20] makes “black-box” use of a specific soundness property of the [Mah18]\nprotocol (referred to as “computational orthogonality” by [ACGH20]) and is otherwise agnostic to\nhow the protocol is constructed.\nAcknowledgments.\nAL is supported in part by a Charles M. Vest fellowship. GM is partially\nsupported by the German Federal Ministry of Education and Research BMBF (grant 16K15K042,\nproject 6GEM). TV is supported by AFOSR YIP award number FA9550-16-1-0495, a grant from\nthe Simons Foundation (828076, TV), MURI Grant FA9550-18-1-0161, the NSF QLCI program\nthrough grant number OMA-2016245 and the IQIM, an NSF Physics Frontiers Center (NSF Grant\nPHY-1125565) with support of the Gordon and Betty Moore Foundation (GBMF-12500028). AL,\nVV, and LY are supported in part by DARPA under Agreement No. HR00112020023, a grant from\nMIT-IBM Watson AI, a grant from Analog Devices, a Microsoft Trustworthy AI grant and the\n3\n\n\nThornton Family Faculty Research Innovation Fellowship. Any opinions, findings and conclusions\nor recommendations expressed in this material are those of the author(s) and do not necessarily\nreflect the views of the United States Government or DARPA. LY was supported in part by an\nNSF graduate research fellowship.\n2\nTechnical Overview\nOur starting point is Mahadev’s protocol for classical verification of quantum computation [Mah18],\nthe core ingredient of which is a measurement protocol.\n2.1\nRecap: Mahadev’s Measurement Protocol\nWe begin by reviewing Mahadev’s N-qubit measurement protocol. In Mahadev’s protocol, a quan-\ntum prover holding an N-qubit quantum state ρ interacts with a classical verifier, who wants to\nobtain the result of measuring ρ according to measurement bases h ∈{0, 1}N (hi specifies a basis\nchoice for the ith qubit, with hi = 1 corresponding to the Hadamard basis and hi = 0 corresponding\nto the standard basis).\nTrapdoor Claw-Free Functions.\nAt the heart of the protocol is a cryptographic primitive\nknown as an injective/claw-free trapdoor function (a variant of lossy trapdoor functions [PW08,\nPVW08, GVW15]), which consists of two trapdoor function families Inj (for injective) and Cf (for\nclaw-free), with the following syntactic requirements:4\n• Each function in Cf ∪Inj is indexed by a public-key pk, where functions fpk ∈Inj are injective\nand functions fpk ∈Cf are two-to-one. Moreover, pk can be sampled along with a secret key\nsk that enables computing f−1\npk (i.e., f−1\npk (y) consists of a single pre-image if fpk ∈Inj, and two\npre-images if fpk ∈Cf).\n• All functions in Inj and Cf have domain {0, 1}ℓ+1 (for some ℓ) and the two pre-images of y\nunder fpk ∈Cf are of the form (0, x0) and (1, x1) for some x0, x1 ∈{0, 1}ℓ.\nAn injective/claw-free trapdoor function must satisfy the following security properties:5\n1. Claw-Free/Injective Indistinguishability. A random function in fpk ←Cf is computa-\ntionally indistinguishable from a random function fpk ←Inj.\n2. Adaptive Hardcore Bit. Given fpk ←Cf, it is computationally infeasible to output both\n(1) a pair (x, y) satisfying fpk(x) = y and (2) a non-zero string d ∈{0, 1}ℓ+1 such that\nd · (1, x0 ⊕x1) = 0, where (0, x0) and (1, x1) are the two preimages of y.6\n4The actual syntactic requirements, described in Section 3.5, are somewhat more complex due to the fact that\nthe functions in question are probabilistic.\n5In fact, Mahadev’s proof relies on two different hardcore bit properties, but we show in this work that only the\nadaptive hardcore bit property is needed.\n6The full definition places a slightly stronger restriction on d than simply being non-zero. However, this simplified\nversion will suffice for this overview.\n4\n\n\nTo build some intuition about the usefulness of such function families, notice that they can be\nused to commit to a single classical bit quite easily. The commitment key is a function fpk ∈Inj,\nand commitment to a bit b is y = fpk(b, x) for a random x ∈{0, 1}n. It is not hard to verify that\nthis is a statistically binding and computationally hiding commitment of b. On the other hand, if\nfpk ∈Cf, it is a statistically hiding and computationally binding commitment of b.7\nProtocol Description.\nWith this intuition in mind, we now describe a (slightly simplified version\nof) the Mahadev measurement protocol. Mahadev’s protocol is a many-fold sequential repetition\nof the following one-bit challenge protocol.\nV →P: The verifier samples N pairs of functions and their trapdoors: for every i ∈[ℓ], he samples\n(pki, ski) ←Inj if hi = 0 and (pki, ski) ←Cf if hi = 1. He sends the N-tuple of public keys\n(function descriptions) (pk1, . . . , pkN) to the prover.\nP →V: The prover holds an N-qubit state ρ on register B = B1 ⊗· · · BN. She initializes registers\nX = X1 ⊗· · · XN so that each Xi is an ℓ-qubit register in uniform superposition. Then she\nevaluates each fpki on the ℓ+ 1 qubit register Bi ⊗Xi and measures the output to obtain yi.\nFinally, she sends (y1, . . . , yN) to the verifier, keeping the registers B, X for herself.\nV →P: The verifier picks a random challenge bit c ←{0, 1} and sends it to the prover. c = 0\nindicates a “test round” and c = 1 indicates a “measurement round”.\nP →V: If c = 0 (“test”), the prover measures each Bi ⊗Xi in the standard basis, obtaining\n(bi, xi) ∈{0, 1} × {0, 1}ℓ, and sends (bi, xi)N\ni=1 to the verifier.\nIf c = 1 (“measure”), she measures each Bi ⊗Xi in the Hadamard basis (i.e., she applies\nthe Hadamard gate H on each qubit and then measures in the standard basis), obtaining\ndi ∈{0, 1}ℓ+1, and sends (di)N\ni=1 to the verifier.\nV (output): If c = 0 (“test”), V either accepts or rejects the interaction but outputs nothing. In\nparticular, V checks that fpki(bi, xi) = yi. If any of the checks fail, reject.\nIf c = 1 (“measure”), proceed as follows. Let R ⊆[N] be the set of indices where hi = 1,\ncorresponding to Hadamard basis measurements, and let S = [N] \\ R be the set of indices\ncorresponding to standard basis measurements.\nFor each i ∈R, V computes the two inverses (0, xi,0) and (1, xi,1) of yi (which are guaranteed\nto exist since fpk,i ∈Cf) using ski. V sets ui := d · (1, xi,0 ⊕xi,1) as the ith measurement\noutcome. For every i ∈S, V ignores di, and sets vi to be the first bit of f−1\npki(yi), computed\nusing the trapdoor ski (this is well-defined since fpk,i ∈Inj). Finally V outputs the N-bit\nstring (u, v) ∈{0, 1}R × {0, 1}S.\nMahadev [Mah18] proves that if a malicious prover P∗passes the test round with probability 1,\nthen there exists an N-qubit quantum state ρ∗— independent of the verifier’s measurement basis\nh — such that the result of measuring ρ∗according to h is computationally indistinguishable from\n7In particular, fpk ∈Cf satisfies Unruh’s definition of collapse-binding [Unr16b].\n5\n\n\nthe verifier’s N-bit output distribution in the measurement round.8 While her definition requires\nthat such a ρ∗exists, Vidick and Zhang [VZ21] showed that Mahadev’s proof steps implicitly define\nan extractor that efficiently produces ρ∗using black-box access to P∗.\n2.2\nDefining a (Succinct) Measurement Protocol\nOur first (straightforward but helpful) step is to give an explicit definition of a commit-and-\nmeasure protocol that abstracts the completeness and soundness properties of Mahadev’s mea-\nsurement protocol as established in [Mah18, VZ21].\nRoughly speaking, a commit-and-measure\nprotocol is sound if, for any malicious prover P∗that passes the test round with probability 1 and\nany basis choice h, there exists an efficient extractor that (without knowledge of h) interacts with\nprover and outputs an extracted state τ such that the following are indistinguishable:\n• the distribution of verifier outputs obtained in the measurement round from interacting with\nP∗using basis choice h, and\n• the distribution of measurement outcomes obtained from measuring τ according to h.\nThis abstraction will be particularly helpful for reasoning about our eventual succinct measurement\nprotocols, which will necessitate modifying Mahadev’s original protocol.\nCan a Measurement Protocol be Succinct?\nGiven the definition of a measurement protocol,\nan immediate concern arises with respect to obtaining succinct arguments: the verifier’s input to\nthe measurement protocol – the basis vector h – is inherently non-succinct. Since the number of\nqubits N grows with the runtime of the BQP computation when used to obtain quantum verification\n[FHM18], this poses an immediate problem.\nOur solution to this problem is to only consider basis vectors h that are succinct; our formal-\nization is that h must be the truth table of an efficiently computable function f : [log N] →{0, 1}.\nFor any such h, we can represent the verifier’s input as a circuit C that computes h, removing the\nabove obstacle.\nHowever, in order for there to be any hope of this idea working, it must be the case that\nmeasurement protocols for bases with succinct representations are still useful for constructing dele-\ngation for BQP. Fortunately, it has been shown [ACGH20] that classically verifiable (non-succinct)\narguments for BQP can be constructed by invoking Mahadev’s measurement protocol (and, by in-\nspection of the proof, any measurement protocol satisfying our definition) on a uniformly random\nbasis string h ←{0, 1}N. Then, by computational indistinguishability, it is also possible to use a\npseudorandom string h that has a succinct representation, i.e., h = (PRFs(1), . . . , PRFs(N)) for\nsome (post-quantum) pseudorandom function PRF.\nThus, we focus for the moment on constructing a succinct measurement protocol for h with\nsuccinct representation, and return to the full delegation problem later.\n8This can be extended to provers that pass the test round with probability 1 −ε by the gentle measurement\nlemma. In particular, an efficient distinguisher can only distinguish the verifier’s output distribution from the result\nof measuring some ρ∗with advantage poly(ε).\n6\n\n\n2.3\nConstructing a Verifier-Succinct Measurement Protocol\nInspecting the description of the [Mah18] protocol, there are three distinct reasons that the protocol\nis not succinct:\n1. The verifier’s first message, which consists of N TCF public keys, is non-succinct.\n2. The prover’s two messages, consisting of the commitments yi and openings zi respectively,\nare non-succinct.\n3. The verifier’s decision predicate, as it is a function of these commitments and openings,\nrequires poly(N) time to evaluate.\nThe latter two issues turn out to be not too difficult to resolve (although there is an important\nsubtlety that we discuss later); for now, we focus on resolving (1), which is our main technical\ncontribution. Concretely, we want to construct a measurement protocol for succinct bases h where\nthe verifier’s first message is succinct.\nIdea: Compress the Verifier’s message with iO.\nGiven the problem formulation, a natural\nidea presents itself: instead of having V send over N i.i.d. public keys pki, perhaps V can send\na succinct program PK that contains the description of N public keys pki that are in some sense\n“pseudoindependent!” Using the machinery of obfuscation and the “punctured programs” technique\n[SW14], it is straightforward to write down a candidate program for this task: simply obfuscate\nthe following code.\nInput: index i ≤N\nHardwired Values: Puncturable PRF seed s. Circuit C.\n• Compute mode = C(i) and r = PRFs(i).\n• Compute (pki, ski) ←Gen(1λ, mode; r).\n• Output pki.\nHere, C is an efficient circuit with truth table h, and Gen(1λ, mode) indicates sampling either\nfrom Inj or Cf depending on whether hi = C(i) = 0 or hi = C(i) = 1.\nLetting PK denote an obfuscation of the above program, V could send PK to P and allow the\nprover to compute each pki = PK(i) on its own, and the protocol could essentially proceed as\nbefore, except that the verifier will have to expand its PRF seed s into (sk1, . . . , skN) in order to\ncompute its final output.\n7\n\n\nProblem: Proving Soundness.\nWhile it is not hard to describe this plausible modification to\nthe [Mah18] protocol that compresses the verifier’s message, it is very unclear how to argue that\nthe modified protocol is sound. The obfuscation literature has no shortage of proof techniques\ndeveloped over the last 10 years, but since we have made a “non-black-box” modification of the\n[Mah18] protocol, a deep understanding of the [Mah18] proof of soundness is required in order to\nunderstand to what extent these techniques are compatible with the application at hand.\nWe believe it should be possible to incorporate punctured programming techniques into Ma-\nhadev’s proof of soundness in [Mah18] and conclude the desired soundness property of the new\nprotocol. However, doing so would result in an extremely complex proof that would require the\nreader to verify the entirety of the [Mah18] (already very complicated) original security proof with\nour modifications in mind.\n2.4\nProof of Soundness\nGiven the complicated nature of the [Mah18] proof of soundness, we instead give a simpler and\nmore modular proof of soundness for the [Mah18] measurement protocol. Moreover, we give this\nproof for a generic variant of the [Mah18] protocol where the prover is given an arbitrary represen-\ntation PK of N TCF public keys and show that precisely two properties of this representation PK\nare required in order for the proof to go through:\n• An appropriate generalization of the “dual-mode” property of individual TCFs must hold for\nPK: for any two circuits C1, C2, it should be that PK1 generated from basis C1 is compu-\ntationally indistinguishable from PK2 generated from basis C2. In fact, a stronger variant\nof this indistinguishability must hold: it should be the case that PK1 ≈c PK2 even if the\ndistinguisher is given all secret keys skj such that C1(j) = C2(j).\n• For every i, the adaptive hardcore bit property of fpki should hold even given skj for all\nj ̸= i.\nSince these two properties are (essentially) all that is required for our proof to go through, in\norder to obtain a verifier-succinct protocol, it suffices to show that the obfuscated program PK\nabove satisfies these two properties, which follows from standard techniques.\nThus, we proceed by describing our new soundness proof for the [Mah18] measurement protocol,\nwhich transparently generalizes to the verifier-succinct setting.\nThe “Operational Qubits” Approach.\nLet P ∗denote a prover that passes the test round (i.e.,\nmakes the verifier accept on the 0 challenge) with probability 1. Our goal is to show that the prover\nin some sense “has an N-qubit state” such that measuring this state in the h-bases produces the\nsame (or an indistinguishable) distribution as the verifier’s protocol output, which we will denote\nDP ∗,Out. This N-qubit state should be efficiently computable from the prover’s internal state |ψ⟩;\nspecifically, we use |ψ⟩to denote the prover’s state after its first message y has been sent.\nIn order to show this, taking inspiration from [Vid20],9 we will proceed in two steps:\n9[Vid20] gives a soundness proof for a variant of the [Mah18] protocol, but in a qualitatively weaker setting.\n8\n\n\n1. Identify N “operational qubits” within |ψ⟩. That is, we will identify a set of 2N observables\nZ1, . . . , ZN, X1, . . . , XN (analogous to the “Pauli observables” σz,1, . . . , σz,N, σx,1, . . . σx,N)\nsuch that measuring |ψ⟩with these observables gives the outcome distribution DP ∗,Out.\nProvided that these 2N observables roughly “behave like” Pauli observables with respect\nto |ψ⟩(e.g. satisfy the X/Z uncertainty principle), one could then hope to:\n2. Extract a related state |ψ′⟩such that measuring |ψ′⟩in the actual standard/Hadamard bases\nmatches the “pseudo-Pauli” {Zj}, {Xi}, measurements of |ψ⟩(and therefore DP ∗,Out).\nRelating the Verifier’s Output to Measuring |ψ⟩.\nOur current goal is to achieve Step (1)\nabove. Let |ψ⟩denote P ∗’s post-commitment state and let U denote the unitary such that P ∗’s\nopening is a measurement of U |ψ⟩in the Hadamard basis.\nNow, let us consider the verifier’s output distribution. The ith bit of the verifier’s output when\nhi = 1 is defined to be d · (x0,i ⊕x1,i) (where d is the opening sent by the prover) of U |ψ⟩in the\nHadamard basis. For each such i, we can define an observable Xi characterizing this measurement,\nthat roughly takes the form\nXi ≈U †(HZi ⊗Id)\n X\nd\n(−1)d·(1,x0,i⊕x1,i) |d⟩\n⟨d|Zi ⊗IdI,{Zj}j̸=i\n!\n(HZi ⊗Id)U.\nHere we have slightly simplified the expression for Xi for the sake of presentation; the correct\ndefinition of Xi (see Section 6.2) must account for the case where d is rejected by the verifier. To\nreiterate, the observable Xi is a syntactic interpretation of the verifier’s output mi as a function of\n|ψ⟩.\nOn the other hand, when hi = 0, the verifier’s output mi is not a priori a measurement of |ψ⟩;\nindeed, the verifier ignores the prover’s second message and just inverts yi. However, under the\nassumption that the prover P ∗passes the test round with probability 1 −negl(λ), making use of\nthe fact that fpki is injective, this yi-inverse must be equal to what the prover would have sent in\nthe test round. This defines another observable on |ψ⟩that we call Zi:\nZi =\nX\nb,x\n(−1)b |b, x⟩\n⟨b, x|Zi ⊗IdI,{Zj}j̸=i.\nFinally, note that the operator Zi syntactically makes sense even when hi = 1. However, Xi\ncannot even be defined when fpki is injective, corresponding to hi = 0, since Xi explicitly requires\ntwo inverses of yi. Therefore, from now on, we sample all (pki, ski) ←Cf (forcing all TCFs to be\n2-to-1).\nThis brings us to the punchline of this step: by invoking a computational assumption (the\nindistinguishability of Cf and Inj), we can define observables (Xi, Zi) for all i ∈[N] such that for\nevery i and every basis choice h, the distribution resulting from measuring |ψ⟩with Xi (resp. Zi)\nmatches the ith bit of the verifier’s output distribution.\n[Vid20] only proves indistinguishability of N-qubit measurements that are either all in the standard basis or all in\nthe Hadamard basis, and only proves indistinguishability with respect to linear tests of the distribution (that is,\n[Vid20] proves small-bias rather than full indistinguishability). Both of these relaxations are unacceptable in our\nsetting, and achieving the latter specifically requires a different proof strategy.\n9\n\n\nWith a little more work, one can actually show that the verifier’s entire output distribution in\nthe h-basis is computationally indistinguishable from the following distribution DP ∗,2-to-1:\n• Sample keys (pki, ski) ←Cf. Run P ∗to obtain y, |ψ⟩.\n• For each i such that hi = 0, measure the first bit of the prover’s ith response register in the\nstandard basis to obtain (and output) a bit bi.\n• Measure U |ψ⟩in the Hadamard basis, obtaining strings (d1, . . . , dN).\n• For each i such that hi = 1, compute (and output) di · (1, x0,i ⊕x1,i).\nAside: Why are these Zj and Xi helpful?\nAs alluded to earlier, this approach is inspired\nby operational definitions of “having an N-qubit state,” which consists of a state |ψ⟩and 2N\n“pseudo-Pauli” observables Z1, . . . , ZN, X1, . . . XN that behave “like Pauli observables” on |ψ⟩. For\nexample, it is possible to prove that many of the “Pauli group relations” hold approximately on\nthese Xi, Zj with respect to |ψ⟩, meaning that (for example)\n⟨ψ| ZiXiZi + Xi |ψ⟩= negl(λ)\nand\n⟨ψ| ZjXiZj −Xi |ψ⟩= negl(λ)\nfor i ̸= j. In fact, these relations turn out to encode the two basic properties of the TCF fpki:\nthe adaptive hardcore bit property (encoded in the first relation) and that fpki is indistinguishable\nfrom injective10 (encoded in the second relation)! We will not directly prove the relations here,\nbut they are implicit in our full security proof and are the motivation for this proof strategy.\nThe Extracted State.\nGiven these protocol observables Z1, . . . , ZN, X1, . . . , XN, it remains to\nimplement Step (2) of our overall proof strategy: extracting a state |ψ′⟩whose standard/Hadamard\nmeasurement outcomes match DP ∗,Out. At a high level, this is achieved by “teleporting” the state\n|ψ⟩onto a fresh N-qubit register in a way that transforms the “pseudo-Paulis\" {Xi}, {Zj} into\nreal Pauli observables {σx,i}, {σz,j}.\nFix a choice of {Xi, Zi}, |ψ⟩←Samp. For ease of notation, write H = Z ⊗I ⊗U so that\n|ψ⟩∈H. We would like an efficient extraction procedure that takes as input |ψ⟩∈H and generates\nan N-qubit state τ such that, roughly speaking, measuring |ψ⟩with X/Z and measuring τ with\nσX/σZ produce indistinguishable outcomes.\nIntuition for the Extractor.\nBefore we describe our extractor, we first provide some underlying\nintuition. For an arbitrary N-qubit Hilbert space, let σx,i/σz,i denote the Pauli σx/σz observable\nacting on the ith qubit. For each r, s ∈{0, 1}N, define the N-qubit Pauli “parity” observables\nσx(r) :=\nY\ni:ri=1\nσx,i , σz(s) :=\nY\ni:ri=1\nσz,i.\n10Technically, the property encoded is the collapsing of fpki, which is implied by (but not equivalent to) being\nindistinguishable from injective.\n10\n\n\nSuppose for a moment that |ψ⟩∈H is already an N-qubit state (i.e., H is an N-qubit Hilbert\nspace) and moreover, that each Xi/Zi observable is simply the corresponding Pauli observable\nσx,i/σz,i. While these assumptions technically trivialize the task (the state already has the form\nwe want from the extracted state), it will be instructive to write down an extractor that\n“teleports” this state into another N-qubit external register.\nWe can do this by initializing two N-qubit registers A1 ⊗A2 to |φ+⟩⊗N where |φ+⟩is the EPR\nstate (|00⟩+ |11⟩)/\n√\n2 (the ith EPR pair lives on the ith qubit of A1 and A2). Now consider the\nfollowing steps, which are inspired by the (N-qubit) quantum teleportation protocol\n1. Initialize a 2N-qubit ancilla W to\n\f\n\f02N\u000b\n, and apply H⊗2N to obtain the uniform superposition.\n2. Apply a “controlled-Pauli” unitary, which does the following for all r, s ∈{0, 1}N and all\n|φ⟩∈H ⊗A1:\n|r, s⟩W |φ⟩H,A1 →|r, s⟩W (σx(r)σz(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1\n3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements11\non A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:\n|u, v⟩W (σx(r)σz(s) ⊗Id)A1,A2\n\f\n\fφ+\u000b⊗N\nA1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)A1,A2\n\f\n\fφ+\u000b⊗N\nA1,A2 .\nFinally, discard W.\nOne can show that the resulting state is\n1\n2N\nX\nr,s∈{0,1}N\n(σx(r)σz(s) ⊗σx(r)σz(s) ⊗Id) |ψ⟩H\n\f\n\fφ+\u000b\nA1,A2 =\n\f\n\fφ+\u000b\nH,A1 |ψ⟩A2 ,\n(1)\nwhere |ψ⟩is now “teleported” into the A2 register.\nThe Full Extractor.\nTo generalize this idea to the setting where |ψ⟩∈H is an arbitrary quantum\nstate and {Xi, Zi}i are an arbitrary collection of 2N observables, we simply replace each σx(r)\nand σz(s) acting on H above with the corresponding parity observables X(r), Z(s), defined\nanalogously (for r, s ∈{0, 1}N as\nZ(s) =\nN\nY\ni=1\nZsi\ni\nand X(r) =\nN\nY\ni=1\nXri\ni .\nThe rough intuition is that as long as the {Xi} and {Zi} observables “behave like” Pauli observables\nwith respect to |ψ⟩, the resulting procedure will “teleport” |ψ⟩into the N-qubit register A2.\n11The Bell basis consists of the 4 states (σa\nxσb\nz ⊗Id)\n\f\n\fφ+\u000b\nfor a, b ∈{0, 1} on 2 qubits.\n11\n\n\nRelating Extracted State Measurements to Verifier Outputs.\nWith the extracted state\ndefined to be the state on A2 after performing the “generalized teleportation” described above, it\nremains to prove that the distribution DP ∗,Ext resulting from measuring the extracted state on A2\nin the h-bases is indistinguishable from DP ∗,2-to-1.\nOne can show (by a calculation) that DP ∗,Ext is the following distribution (differences from\nDP ∗,2-to-1 in red)\n1. Sample keys (pki, ski) ←Cf. Run P ∗to obtain y, |ψ⟩.\n2. For each i such that hi = 0, measure the first bit of the prover’s ith response register in the\nstandard basis to obtain (and output) a bit bi.\n3. For each i such that hi = 1, flip a random bit wi and apply the unitary Zwi\ni .\n4. Measure U |ψ⟩in the Hadamard basis, obtaining strings (d1, . . . , dN).\n5. For each i such that hi = 1, compute (and output) di · (1, x0,i ⊕x1,i) ⊕wi.\nWe prove indistinguishability between the N-bit distributions DP ∗,Ext and DP ∗,2-to-1 by con-\nsidering N hybrid distributions, where the difference between Hybrid j −1 and Hybrid j is:\n• an additional application of the unitary Zj in Item 3, and\n• an additional XOR of ej (the jth standard basis vector) in Item 5.\nTo conclude the soundness proof, we show that Hybrid j −1 and Hybrid j in the following\nthree steps.\n• First, we prove that the marginal distributions of Hybrid (j −1) and Hybrid j on N \\{j} are\nindistinguishable due to the collapsing property of fpkj. Intuitively this holds because the\nmarginal distributions on N \\ {j} only differ by the application of Zj, which is undetectable\nby collapsing.\n• By invoking an elementary lemma about N-bit indistinguishability, the task reduces to prov-\ning a 1-bit indistinguishability of the jth bit of Hybrid (j −1) and Hybrid j, conditioned on\nan efficiently computable property of the marginal distributions on N \\ {j}.\n• Finally, we show that the indistinguishability of the jth bit holds due to the adaptive hardcore\nbit property of fpkj. At a very high level, the above jth bit property involves a measurement\nof Xj, and the two hybrids differ in whether a random Zb\nj is applied before Xj is measured;\nin words, this exactly captures the adaptive hardcore bit security game.\nWe refer the reader to Section 6.4 for a full proof of indistinguishability.\n12\n\n\n2.5\nFrom a Verifier-Succinct Measurement Protocol to Succinct Arguments for\nBQP\nUsing Sections 2.3 and 2.4, we have constructed a verifier-succinct measurement protocol, for\nsuccinctly represented basis strings, with a single bit verifier challenge. What remains is to convert\nthis into a (fully) succinct argument system for BQP (or QMA). This is accomplished via the\nfollowing transformations:\n• Converting a measurement protocol into a quantum verification protocol. As described ear-\nlier, this is achieved by combining the [FHM18] protocol for BQP verification with a lim-\nited quantum verifier (as modified by [ACGH20]) with our measurement protocol, using a\nPRF to generate a pseudorandom basis choice instead of a uniformly random basis choice\nfor the [FHM18, ACGH20] verifier. This results in a verifier-succinct argument system for\nBQP/QMA with constant soundness error.\n• Parallel repetition to reduce the soundness error.\nThis follows from the “computational\northogonal projectors” property of the 1-bit challenge protocol and follows from [ACGH20]\n(we give a somewhat more abstract formulation of their idea in Appendix A). This results in\na verifier-succinct argument system for BQP/QMA with negligible soundness error.\n• Converting a verifier-succinct argument system into a fully succinct argument system. We\nelaborate on this last transformation below, as a few difficulties come up in this step.\nAssume that we are given a (for simplicity, 4-message) verifier-succinct argument system for\nBQP/QMA. Let m1, m2, m3, m4 denote the four messages in such an argument system. In order to\nobtain a fully succinct argument system, we must reduce (1) the prover communication complexity\n|m2| + |m4|, and (2) the runtime of the verifier’s decision predicate.\nThe first idea that comes to mind is to ask the prover to send short (e.g. Merkle tree) com-\nmitments σ2 and σ4 of m2 and m4, respectively, instead of sending m2 and m4 directly. At the\nend of the interaction, the prover and verifier could then engage in a succinct interactive argument\n(of knowledge) for a (classical) NP statement that “the verifier would have accepted the commit-\nted messages underlying σ2 and σ4”. One could potentially employ Kilian’s succinct interactive\nargument of knowledge for NP which was recently shown to be post-quantum secure under the\npost-quantum LWE assumption [CMSZ21].\nThere are a few issues with this naive idea. First of all, the verifier’s decision predicate is private\n(it depends on the secret key SK in the measurement protocol and the PRF seed for its basis),\nso the NP statement above is not well-formed. One reasonable solution to this issue is to simply\nhave the verifier send this secret information st after the verifier-succinct protocol emulation has\noccurred and before the NP-succinct argument has started. For certain applications (e.g. obtaining\na non-interactive protocol in the QROM) we would like to have a public-coin protocol; this can\nbe achieved by using fully homomorphic encryption to encrypt this secret information in the first\nround rather than sending it in the clear in a later round. For this overview, we focus on the\nprivate-coin variant of the protocol.\n13\n\n\nNow, we can indeed write down the appropriate NP relation12\nRV ={((h, m1, σ2, m3, σ4, st), (m2, m4)) : σ2 = h(m2) and\nσ4 = h(m4) and V (st, m1, m2, c, m4) = accept}\nand execute the aforementioned strategy. However, this construction turns out not to work. Specif-\nically, it does not seem possible to convert a cheating prover P ∗in the above fully succinct protocol\ninto a cheating prover P ∗∗for the verifier-succinct protocol; for example, P ∗∗needs to be able to\nproduce a message m2 given only m1 from the verifier; meanwhile, the message m1 can only be ex-\ntracted from P ∗by repeatedly rewinding P ∗’s last message algorithm, which requires the verifier’s\nsecret information st as input! This does not correspond to a valid P ∗∗, who does not have access\nto st when computing m2.\nOur refined compiler is to execute several arguments of knowledge: one right after the prover\nsends σ2, proving knowledge of m2; another one right after she sends σ4, proving knowledge of m4\n(both before receiving the secret state st from the verifier); and a third one for the relation RV\ndescribed above. The first two arguments of knowledge are for the relation\nRH = {(h, σ), m) : h(m) = σ}\nThis allows for immediate extraction of m2 and m3 and appears to clear the way for a reduction\nbetween the verifier-succinct and fully succinct protocol soundness properties.\nHowever, there is one remaining problem: the argument-of-knowledge property of Kilian’s pro-\ntocol proved by [CMSZ21] is insufficiently composable to be used in our compiler. They demon-\nstrate an extractor for Kilian’s protocol that takes any quantum cheating prover that convinces\nthe verifier and extracts a witness from them. However, their post-quantum extractor might sig-\nnificantly disturb the prover’s state, meaning that once we extract m2 above, we may not be able\nto continue the prover execution in our reduction.\nFortunately, a recent work [LMS21] shows that a slight variant of Kilian’s protocol is a suc-\ncinct argument of knowledge for NP satisfying a composable extraction property called “state-\npreservation.” This security property is exactly what is required for our compiler to extract a valid\ncheating prover strategy P ∗∗for the verifier-succinct argument given a cheating prover P ∗for the\ncompiled protocol. A full discussion of this is given in Section 9.\nThis completes our construction of a succinct argument system for BQP (and QMA). We discuss\nadditional results (2-message protocols, zero knowledge, batch arguments) in Section 10.\n3\nPreliminaries\n3.1\nQuantum Information\nLet H be a finite-dimensional Hilbert space. A pure state is a unit vector |ψ⟩∈H. Let D(H)\ndenote the set of all positive semidefinite operators on H with trace 1.\nA mixed state is an\noperator ρ ∈D(H), and is often called a density matrix. We sometimes divide H into named\nregisters written in uppercase calligraphic font, e.g., H = A ⊗B ⊗C.\n12Note that the verifier also takes as input the QMA instance, but we suppress it here for clarity.\n14\n\n\nFor a density matrix ρ ∈D(H), where H ≃(C2)⊗ℓ, we sometimes use the shortcut M(h, ρ) to\ndenote the distribution resulting from measuring each qubit of ρ (where the qubits are specified\nby the isomorphism H ≃(C2)⊗ℓ) in the basis determined by h ∈{0, 1}ℓ. By convention, hi = 0\ncorresponds to measuring the i-th register in the standard basis {|0⟩, |1⟩} and hi = 1 corresponds\nto measuring the i-th register in the Hadamard basis {|+⟩, |−⟩}.\nAn observable is represented by a Hermitian operator O on H. In particular, any observable O\ncan be written in the form P\ni λiΠi where {λi} are real numbers and P\ni Πi = Id. The measurement\ncorresponding to an observable O is the projective measurement {Πi} with corresponding outcomes\n{λi}. A binary observable satisfies the additional requirement that O2 = Id. Notice that for any\nbinary observable, O is a unitary matrix with eigenvalues in {1, −1}. In this case we sometimes\ntreat the outcomes as bits through the usual correspondence 1 →0, −1 →1.\nGiven a binary observable O, we define its corresponding projection operators O+ = 1\n2(Id+O)\nand O−= 1\n2(Id −O). O+ and O−correspond to projecting onto the +1 and −1 eigenspaces of O,\nrespectively, and thus form a binary projective measurement.\nThe Class QMA.\nA language L = (Lyes, Lno) is in QMA if and only if there is a uniformly\ngenerated family of polynomial-size quantum circuits V = {Vλ}λ∈N such that for every λ, Vλ takes\nas input a string x ∈{0, 1}λ and a quantum state |φ⟩on p(λ) qubits and returns a single bit and\nmoreover the following conditions hold.\n• For all x ∈Lyes of length λ, there exists a quantum state |ψ⟩on at most p(λ) qubits such\nthat the probability that Vλ accepts (x, |φ⟩) is at least 2/3. We denote the (possibly infinite)\nset of quantum states (which we will also refer to as quantum witnesses) that make Vλ accept\nx by R(x).\n• For all x ∈Lno of length λ, and all quantum states |ψ⟩on at most p(λ) qubits, it holds that\nVλ accepts on input (x, |ψ⟩) with probability at most 1/3.\n3.2\nBlack-Box Access to Quantum Algorithms\nLet A be a polynomial-time quantum algorithm with internal state ρ ∈D(I) that takes a classical\ninput r and produces a classical output z. Without loss of generality, the behavior of A can be\ndescribed as follows:\n1. Apply an efficient classical algorithm to r to generate the description of a unitary U(r).\n2. Initialize registers Z ⊗I to |0⟩\n⟨0|Z ⊗ρI.\n3. Apply U(r) to Z ⊗I, measure Z in the computational basis, and return the outcome z.\nA quantum oracle algorithm SA with black-box access to (A, ρ) does not have direct access to\nthe adversary’s internal registers I, and can only operate on the state ρ ∈D(I) by applying U(r)\nor U(r)† for any r. In more detail, black-box access to (A, ρ) means the following:\n• The registers Z ⊗I are initialized to |0⟩\n⟨0|Z ⊗ρI.\n15\n\n\n• Once the Z ⊗I registers are initialized, the algorithm is permitted to perform arbitrary\noperations on the Z register, but can only act on the I registers by applying U(r) or U(r)†\nfor any r. We explicitly permit the U(r) and U(r)† gates to be controlled on any external\nregisters (i.e., any registers other than the registers Z ⊗I to which U(r) is applied).\nWe note that this definition is consistent with the notions of interactive quantum machines\nand oracle access to an interactive quantum machine used in e.g. [Unr12] and other works on\npost-quantum zero-knowledge.\nThe Binary Input Case.\nFollowing [Mah18], in the special case where r ∈{0, 1}, it will be\nconvenient to re-define the internal state to be ρ := U(0)(|0⟩\n⟨0|Z ⊗ρ′\nI)U(0)† (where ρ′\nI ∈D(I)\ndenotes the “original” internal state), so that the behavior of A on r = 0 is to simply measure Z\nin the computational basis, and on r = 1 it applies the unitary U := U(1)U(0)† to its state and\nthen measures the Z register. Notice that in this case, the internal state is technically on Z ⊗I\ninstead of just I. Thus, black-box access to a quantum algorithm with binary input is formalized\nas follows:\n• The registers Z ⊗I are initialized to ρ := U(0)(|0⟩\n⟨0|Z ⊗ρ′\nI)U(0)†.\n• Once the Z ⊗I registers are initialized, the algorithm is permitted to perform arbitrary\noperations on the Z register, but can only act on the I registers by applying (possibly\ncontrolled) U or U † gates.\nIn this special case, an algorithm with black-box access to A is denoted SU,ρ.\nWe remark that these definitions are tailored to the two-message challenge-response setting,\nwhereas the protocols we consider in this paper have more rounds of interaction. However, our\nanalysis will typically focus on a single back-and-forth round of interaction (e.g., the last two mes-\nsages of the [Mah18] protocol), so ρ will be the intermediate state of the interactive algorithm right\nbefore the next challenge is sent.13 Moreover, the unitaries {U(r)}r can be treated as independent\nof the (classical) protocol transcript before challenge r is sent, since we can assume this transcript\nis saved in ρ.\n3.3\nInteractive Arguments\nIn what follows we define the notion of an interactive argument for QMA languages. We denote\nsuch arguments by (P, V ), and denote the output bit of the verifier by Out(P, V ).\nDefinition 3.1. An interactive argument (P, V ) for a language L = (Lyes, Lno) ∈QMA with\nrelation R(x) is a (classical) 2-party interactive protocol between a QPT prover P and a\np.p.t. verifier V , with the following completeness and soundness guarantees:\n13In the multi-round setting, “re-defining” the intermediate state to be ρ = U(0)(|0⟩\n⟨0|Z ⊗ρ′\nI)U(0)† can be imple-\nmented by replacing any unitary W applied in the previous round with U(0)W; this follows the conventions used\nin [Mah18].\n16\n\n\nCompleteness.\nFor all λ ∈N, there exists a polynomial k = k(λ)\nsuch that for all x ∈Lyes,\nand all |φ⟩∈R(x), it holds that\nPr\nh\nOut\n\u0010\nP(|φ⟩⊗k(λ) , x), V (x)\n\u0011\n= 1\ni\n≥1 −negl(λ).\nComputational Soundness.\nFor all λ ∈N, all x ∈Lno, and all non-uniform QPT provers\nP ∗, it holds that\nPr [Out(P ∗(x), V (x)) = 1] ≤negl(λ).\nBatch Arguments.\nWe also consider a sub-class of interactive arguments where the prover\nsimultaneously engages the verifier on n sub-instances (x1, . . . , xn), where each xi is supposed to\nbe a Yes-instance of a fixed language Li.\nWe require the following notion of (computational)\nsoundness.\nDefinition 3.2 (Soundness). An interactive argument (P, V ) for a batch language L = L1 ×\n. . . × Ln ∈QMA with relation R(x) is sound if for all λ ∈N, all polynomials n = n(λ), all\nindices i ∈[n], all statements (x1, . . . , xn), where xi ∈Lno, and all non-uniform QPT provers\nP ∗, it holds that\nPr [Out(P ∗(x1, . . . , xn), V ((x1, . . . , xn))) = 1] ≤negl(λ).\n3.4\nComputational Indistinguishability\nTwo classical distribution ensembles {(X(λ), Y (λ))}λ are said to be post-quantum computationally\nindistinguishable if for every non-uniform QPT algorithm A = {(A(λ), ρ(λ))}λ (that outputs a bit\nb), we have that\n\f\n\f\n\fE\nh\nA(λ)(X(λ), ρ(λ))\ni\n−E\nh\nA(λ)(Y (λ), ρ(λ))\ni\f\n\f\n\f = negl(λ).\nTwo quantum state ensembles {ρ(λ)\n0 , ρ(λ)\n1 }λ are said to be computationally indistinguishable\nif for every non-uniform QPT algorithm A = {A(λ), ρ(λ)} (that outputs a bit b), we have that\n\f\n\f\n\fE\nh\nA(λ)(ρ(λ), ρ(λ)\n0 )\ni\n−E\nh\nA(λ)(ρ(λ), ρ(λ)\n1 )\ni \f\n\f\n\f = negl(λ).\nEquivalently, {ρ(λ)\n0 , ρ(λ)\n1 }λ are computationally indistinguishable if for every efficiently com-\nputable non-uniform binary observable (R, σ), we have that\n\f\n\f\n\f Tr(R(ρ0 ⊗σ)) −Tr(R(ρ1 ⊗σ))\n\f\n\f\n\f = negl(λ).\nWe will occasionally use the notation ρ0 ≈c ρ1 to denote computational indistinguishability of\n{ρ(λ)\n0 , ρ(λ)\n1 }λ.\nMore generally, we use (T(λ), ε(λ))-indistinguishability to denote computational indistiguisha-\nbility as above where the distinguisher is allowed to run in time T and the advantage is required\nto be at most ε.\n17\n\n\n3.5\nMahadev Randomized TCFs\nIn this section, we define the cryptographic primitive used by Mahadev [Mah18] to obtain a (non-\nsuccinct) delegation scheme for QMA with classical verification. The primitive is closely related\nto Regev encryption [Reg05] and LWE-based “lossy” trapdoor functions [PW08, PVW08, GVW15],\nbut makes use of special-purpose structure relevant for quantum functionality. Most of this special-\npurpose structure, in particular, the “adaptive hardcore bit”, was introduced in the work of Braker-\nski, Christiano, Mahadev, Vazirani and Vidick [BCM+18], but [Mah18] further requires “dual-mode\nkey generation” in addition to the [BCM+18] properties.\nGiven the numerous special-purpose\nrequirements, we refer to the primitive as “Mahadev randomized trapdoor claw-free functions\n(rTCFs).”14\nDefinition 3.3. A Mahadev randomized trapdoor claw-free function family (Mahadev rTCF)\nClawFree is described by a tuple of efficient classical algorithms (Gen, Eval, Invert, Check, Good)\nwith the following syntax:\n• Gen(1λ, mode) is a dual-mode PPT key generation algorithm that takes as input a secu-\nrity parameter λ in unary, and a bit mode ∈{0, 1}, and it outputs a public key pk and\na private key sk. The description of the public key implicitly defines a domain of the\nform {0, 1}×Dpk for the randomized function fpk. We view Dpk as an explicit (efficiently\nverifiable and samplable) subset of {0, 1}ℓ(λ), so that applying bit operations to elements\nof Dpk is well-defined.\nIn our context, mode = 0 samples keys for an injective function and mode = 1 samples\nkeys for a two-to-one function. For the sake of readability, we use a descriptive notation\nby which mode ∈{injective, 2-to-1}, where mode = injective corresponds to mode = 0 and\nmode = 2-to-1 corresponds to mode = 1.\n• Eval(pk, b, x) is a (possibly probabilistic) algorithm that takes as input a public key pk, a\nbit b ∈{0, 1} and an element x ∈Dpk, and outputs a string y with distribution χ.\n• Invert(mode, sk, y) is a deterministic algorithm that takes as input mode ∈{injective, 2-to-1},\na secret key sk, and an element y in the range. If mode = injective then it outputs a pair\n(b, x) ∈{0, 1} × Dpk or ⊥. If mode = 2-to-1 then it outputs two pairs (0, x0) and (1, x1)\nwith x0, x1 ∈Dpk, or ⊥.\n• Check(pk, b, x, y) is a deterministic algorithm takes as input a public key pk, a bit b ∈\n{0, 1}, an element x ∈Dpk, and an element y in the range, and it outputs a bit.\n• Good(x0, x1, d) is a deterministic poly-time algorithm that takes as input two domain\nelements x0, x1 ∈Dpk and a string d ∈{0, 1}ℓ+1.\nIt outputs a bit that characterizes\nmembership in a set that we call\nGoodx0,x1 := {d : Good(x0, x1, d) = 1}.\n14Actually, [Mah18] requires an extra (second) hardcore bit property (Property 2 of Definition 4.4 in [Mah18]) that\nwe drop from our definition, as our proof does not require it.\n18\n\n\nMoreover, we stipulate that Good(x0, x1, d) ignores the first bit of d.15\nWe require that the following properties are satisfied.\n1. Correctness:\n(a) For all (pk, sk) in the support of Gen(injective, 1λ): For every b ∈{0, 1}, every x ∈\nDpk, and every y ∈Supp(Eval(pk, (b, x))),\nInvert(injective, sk, y) = (b, x).16\n(b) For all (pk, sk) in the support of Gen(2-to-1, 1λ): For every b ∈{0, 1}, every x ∈Dpk,\nand every y ∈Supp(Eval(pk, (b, x))),\nInvert(2-to-1, sk, y) = ((0, x0), (1, x1))\nsuch that xb = x and y ∈Supp(Eval(pk, (β, xβ))) for every β ∈{0, 1}.\n(c) For every (pk, sk) ∈Supp(Gen(2-to-1, 1λ)) ∪Supp(Gen(injective, 1λ)), every b ∈{0, 1}\nand every x ∈D,\nPr[Check(pk, (b, x), y) = 1] = 1\nif and only if y ∈Supp(Eval(pk, (b, x))).\n(d) For every (pk, sk) in the support of Gen(2-to-1, 1λ) and every pair of domain elements\nx0, x1, the density of Goodx0,x1 is 1 −negl(λ).\n2. Key Indistinguishability:\n{pk : (pk, sk) ←Gen(2-to-1, 1λ)} ≈c {pk : (pk, sk) ←Gen(injective, 1λ)}\n3. Adaptive Hardcore Bit: For every BQP adversary A = (A′, A∞) there exists a negli-\ngible function µ such that for every λ ∈N, the following difference of probabilities is\nequal to µ(λ):\n\f\n\f\n\f Pr[A1(pk, y) = (d, (b, x)) : Check(pk, b, x, y) = 1\n∧\nd · (1, x0 ⊕x1) = 0\n∧\nd ∈Goodx0,x1]\n−Pr[A1(pk, y) = (d, (b, x)) : Check(pk, b, x, y) = 1\n∧\nd · (1, x0 ⊕x1) = 1\n∧\nd ∈Goodx0,x1]\n\f\n\f\n\f\nwhere the probabilities are over the experiment that generates (pk, sk) ←Gen(2-to-1, 1λ),\ny ←A0(pk), and where ((0, x0), (1, x1)) = Invert(2-to-1, sk, y).\nLemma 3.4 ([BCM+18, Mah18]). Assuming LWE, there is a collection of Mahadev randomized\nTCFs.\n15We depart slightly from notation in prior work, which defines d to be an element of {0, 1}ℓ(corresponding to\nthe last ℓbits of our d).\n16Note that this implies that Supp(Eval(pk, (b1, x1))) ∩Supp(Eval(pk, (b2, x2))) = ∅for every (b1, x1) ̸= (b2, x2).\nThis can be enforced in the LWE-based instantiation by using truncated discrete Gaussian errors\n19\n\n\nRemark 3.5. For some of our applications (and for simplicity of proofs), we will actually\nrequire an rTCF that is perfectly correct, which means that the correctness properties (a)\nand (b) hold with probability 1.\nThat is, they hold for all (pk, sk) ∈Gen(injective, 1λ) and\n(pk, sk) ∈Gen(2-to-1, 1λ) respectively. We briefly argue that this is possible. In the injective\nmode case, this is possible because the sampling procedure for injective keys given in [Mah18,\nSection 9.2] can determine whether the key it sampled is indeed injective and if not, output\na fixed hard-coded injective key. In the 2-to-1 mode case, the sampling procedure given in\n[BCM+18, Section 4.1] is perfect except for when s = 0n. Thus, we can again hard-code a\nfixed 2-to-1 key to output instead whenever s = 0n.\n3.6\nCollapsing Hash Functions\nCollapsing Hash Functions.\nLet H = {Hλ}λ∈N be a hash function family where each Hλ is a\ndistribution over functions h : {0, 1}n(λ) →{0, 1}ℓ(λ).\nDefine the collapsing experiment CollapseExptH,λ,b(D) on quantum distinguisher D as follows.\nCollapseExptH,λ,b(D):\n1. The challenger samples h ←Hλ and sends h to the distinguisher D.\n2. The distinguisher replies with a classical binary string y ∈{0, 1}ℓ(λ) and an n(λ)-qubit quan-\ntum state on the register X. Note that the requirement that y be classical can be enforced\nby having the challenger immediately measure these registers upon receiving them.\n3. The challenger computes h in superposition on the n(λ)-qubit quantum state, and measures\nthe bit indicating whether the output of h equals y. If the output does not equal y, the\nchallenger aborts and outputs ⊥.\n4. If b = 0, the challenger does nothing. If b = 1, the challenger measures the n(λ)-qubit state\nin the standard basis.\n5. The challenger returns the contents of the X register to the distinguisher.\n6. The distinguisher outputs a bit b′.\nDefinition 3.6 ([Unr16b]). H = {Hλ}λ is collapsing if for every security parameter λ ∈N and\nany polynomial-size quantum distinguisher D = {Dλ}λ, there exists a negligible function µ\nsuch that\n\f\n\fPr\n\u0002\nCollapseExptH,λ,0(Dλ) = 1\n\u0003\n−Pr\n\u0002\nCollapseExptH,λ,1(Dλ) = 1\n\u0003\f\n\f ≤µ(λ).\nUnruh [Unr16a] constructs collapsing hash functions from lossy functions, which can be based\non LWE [PW08].\nLemma 3.7 ([PW08, Unr16a]). Assuming LWE, a family of collapsing hash functions {Hλ :\n{0, 1}∗→{0, 1}λ}λ exists.\n20\n\n\n3.7\nFully Homomorphic Encryption\nWe define fully homomorphic encryption (FHE), which is used in Section 9. A fully homomorphic\nencryption scheme FHE = (FHE.Gen, FHE.Enc, FHE.Dec, FHE.Eval) for (classical) polynomial-time\ncomputation is a tuple of four PPT algorithms.\n• Gen(1λ) takes as input the security parameter and outputs a key pair (pk, sk).\n• Enc(pk, m) takes as input a message m and outputs a ciphertext ct.\n• Eval(f, ct) takes as input a ciphertext ct corresponding to an n-bit plaintext as well as a\nfunction f : {0, 1}n →{0, 1}. It outputs a ciphertext ctf.\n• Dec(sk, ct) takes as input the secret key and a ciphertext. It outputs a message.\nWe require the following properties.\n• Evaluation/Decryption Correctness: for any (polynomial-size circuit) function f : {0, 1}n →\n{0, 1} and any message m ∈{0, 1}n, we have that\nDec(sk, Eval(f, Enc(pk, m))) = f(m)\nwith probability 1 −negl(λ) over the parameter sampling.\n• Compactness: we require that FHE.Eval(f, Enc(pk, m)) has a fixed size poly(λ) independent\nof |f|, |m|.\n• Semantic Security: For any pair of messages (m0, m1), we have that (pk, FHE.Enc(pk, m0)) ≈c\n(pk, FHE.Enc(pk, m1)).\nTheorem 3.8 ([Gen09, BV11, BGV12, BV14]). Under circular-secure variants of the Learn-\ning with Errors assumption, there exists a fully homomorphic encryption scheme for all\npolynomial-time computable functions. If the circular LWE variant is post-quantum, then so\nis the FHE scheme.\nUnder the standard LWE assumption, there exists a FHE scheme for all polynomial-size\ncircuits of depth d(λ), where the scheme has compactness poly(λ, d).\n3.8\nIndistinguishability Obfuscation\nAn indistinguishability obfuscator (iO) is an algorithm iO that takes as input a circuit C and\nsatisfies the following properties.\n• Functional Equivalence: for any (polynomial-size) circuit circuit C : {0, 1}n →{0, 1}m\nand any input x ∈{0, 1}n, we have that\niO(C)(x) = C(x).\n21\n\n\n• Security: For any pair of functionally equivalent circuits (C0, C1), we have that\niO(C0) ≈c iO(C1).\nWe mention that, while some recent candidates for iO (such as [JLS21]) can be broken using\nquantum algorithms, others, such as [BGMZ18, CVW18, BDGM20, WW21, GP21, DQV+21],\nare plausibly post-quantum secure. Furthermore, it will be convenient for us to assume iO with\nperfect correctness to simplify our analysis (in particular the argument in Section 10.3). We point\nout that this property is already satisfied by most candidates and can also be attained via generic\ntransformations [BV17].\n3.9\nPuncturable PRFs\nDefinition 3.9 (Puncturable PRF [BW13, BGI14, KPTZ13, SW14]). A puncturable PRF family\nis a family of functions\nF =\nn\nFλ,s : {0, 1}ν(λ) →{0, 1}µ(λ)o\nλ∈N,s∈{0,1}ℓ(λ)\nwith associated (deterministic) polynomial-time algorithms (F.Eval, F.Puncture, F.PuncEval)\nsatisfying\n• For all x ∈{0, 1}ν(λ) and all s ∈{0, 1}ℓ(λ), F.Eval(s, x) = Fλ,s(x).\n• For all distinct x, x′ ∈{0, 1}ν(λ) and all s ∈{0, 1}ℓ(λ),\nF.PuncEval(F.Puncture(s, x), x′) = F.Eval(s, x′)\nFor ease of notation, we write Fs(x) and F.Eval(s, x) interchangeably, and we write s{x} to\ndenote F.Puncture(s, x).\nF is said to be (s, δ)-secure if for every {x(λ) ∈{0, 1}ν(λ)}λ∈N, the following two distribution\nensembles (indexed by λ) are δ(λ)-indistinguishable to circuits of size s(λ):\n(S{x(λ)}, FS(x(λ))) where S ←{0, 1}ℓ(λ)\nand\n(S{x(λ)}, U) where S ←{0, 1}ℓ(λ), U ←{0, 1}µ(λ).\nTheorem 3.10 ([GGM84, KPTZ13, BW13, BGI14, SW14]). If {polynomially secure, subex-\nponentially secure} one-way functions exist, then for all functions µ : N →N (with 1µ(ν)\npolynomial-time computable from 1ν), and all δ : N →[0, 1] with δ(ν) ≥2−poly(ν), there are\npolynomials ℓ(λ), ν(λ) and a {polynomially secure, (\n1\nδ(ν(λ)), δ(ν(λ)))-secure} puncturable PRF\nfamily\nFµ =\nn\nFλ,s : {0, 1}ν(λ) →{0, 1}µ(ν(λ))}λ∈N,s∈{0,1}ℓ(λ)\no\n.\n22\n\n\n4\nCommit-and-Measure Protocols\n4.1\nDefining Commit-and-Measure Protocols\nIn this section, we formalize the notion of a commit-and-measure protocol, which was informally\ndescribed in [Mah18]. A commit-and-measure protocol enables a classical verifier to obtain the\nresults of measuring, in the standard or Hadamard basis, each qubit of an N-qubit quantum state\nσ held by the prover. More precisely, the verifier encodes its choice of basis with a classical circuit\nC : [N] = {0, 1}log N →{0, 1}, where C(i) = b specifies the basis for the measurement of the ith\nqubit. We adopt the convention that b = 0 corresponds to the standard basis and b = 1 corresponds\nto the Hadamard basis. Note that in Mahadev’s original protocol, C is given as an explicit string\n(C(0), C(1), . . . , C(N −1)), but our eventual succinct protocols will require circuits C with size\nmuch smaller than N.\nDefinition 4.1 (Commit-and-Measure Protocol Syntax). An N-qubit commit-and-measure pro-\ntocol between a quantum polynomial-time prover P = (Commit, Open) and a classical proba-\nbilistic polynomial-time verifier V = (Gen, Test, Out) has the following syntax.\n1. The verifier samples (pk, sk) ←Gen(1λ, C), where C : [N] = {0, 1}log N →{0, 1} represents\na basis vector h ∈{0, 1}N, obtaining public parameters pk and secret parameters sk. It\nsends the public parameters pk to the prover.\n2. The prover computes (y, ρ) ←Commit(pk, σ), obtaining a classical “commitment” string\ny and a private quantum state ρ. It sends y to the verifier.\n3. The verifier samples a random challenge bit c ←{0, 1} and sends c to the prover; c = 0\ncorresponds to a “test round” and c = 1 corresponds to a “measurement round”.\n4. The prover computes z ←Open(ρ, c), obtaining a classical string z that it sends to the\nverifier.\n5. If c = 0, the verifier computes {acc, rej} ←Test(pk, (y, z)).\nIf c = 1, the verifier computes m ←Out(sk, (y, z)) to obtain a classical string m ∈{0, 1}N\nof measurement outcomes.\nThe protocol is required to satisfy the following completeness (Definition 4.2) and soundness\n(Definition 4.5) properties. For the definitions below, we write M(h, σ) to denote the distribution\nof outcomes from measuring σ in the basis h.\nDefinition 4.2 (Completeness). A commit-and-measure protocol is required to satisfy two\ncompleteness properties.\n1. (Test Round Completeness) For all C : [N] →{0, 1} and N-qubit states σ:\nPr\n\nacc ←Test(pk, (y, z)) :\n(pk, sk) ←Gen(1λ, C)\n(y, ρ) ←Commit(pk, σ)\nz ←Open(ρ, 0)\n\n= 1 −negl(λ).\n23\n\n\n2. (Measurement Round Completeness) For all C : [N] →{0, 1} and N-qubit states σ:\n\n\nm ←Out(sk, (y, z)) :\n(pk, sk) ←Gen(1λ, C)\n(y, ρ) ←Commit(pk, σ)\nz ←Open(ρ, 1)\n\n\n≈c M(h, σ),\nwhere h ∈{0, 1}N is such that hi = C(i) for all i ∈[N] = {0, 1}log N.\nRemark 4.3. The [Mah18] protocol satisfies statistical measurement round completeness, but\nour verifier-succinct commit-and-measure protocol will not.\nRemark 4.4. One of our applications will require a measurement protocol with perfect com-\npleteness, which stipulates that the above completeness guarantees hold over all (pk, sk) ∈\nGen(1λ, C) (and where the measurement round completeness is statistical rather than compu-\ntational). This can be achieved by using an rTCF with perfect correctness, which we discuss\nin Section 3.5, and, in the succinct case, an indistinguishability obfuscation scheme with\nperfect correctness (Section 3.8).\nTo state our soundness definition (Definition 4.5), we first specify the registers that any non-\nuniform cheating prover acts on:\n• P contains the public parameters pk,\n• Y contains the classical commitment string y,\n• Z contains the classical opening string z,\n• I contains the prover’s initial state and its internal work registers.\nIn a protocol execution, P is initialized with |pk⟩\n⟨pk|. A non-uniform cheating prover\nP ∗= (ρ0, UCommit∗, UOpen∗,0, UOpen∗,1)\nis parameterized by:\n• An arbitrary quantum state ρ0 ∈D(Y ⊗Z ⊗I). In a protocol execution with e\nP, Y ⊗Z ⊗I\nis initialized with ρ0.\n• An adversarial commitment unitary UCommit∗on P ⊗Y ⊗Z ⊗I of the form\nX\npk\n|pk⟩\n⟨pk|P ⊗(UCommit∗,pk)Y,Z,I.\nThat is, UCommit∗is classically controlled on P. In particular, the adversarial prover’s com-\nmitment on verifier message pk is obtained by measuring register Y of\nUCommit∗(|pk⟩\n⟨pk|P ⊗(ρ0)Y,Z,I)\nin the computational basis to obtain y.\n24\n\n\n• An adversarial opening unitary UOpen∗,0 on P ⊗Y ⊗Z ⊗I corresponding to the prover’s\nbehavior in the test round (b = 0) of the form:\nX\npk,y\n|pk, y⟩\n⟨pk, y|P,Y ⊗(UOpen∗,0,pk,y)Z,I.\nThat is, UOpen∗,0 is classically controlled on P and Y. In particular, given a commitment\nstring y and residual prover state ρ ∈D(Z ⊗I), the prover’s response on challenge c = 0 is\nobtained by measuring register Z of\nUOpen∗,0(|pk, y⟩\n⟨pk, y|P,Y ⊗ρZ,I)\nin the computational basis to obtain z.\n• An adversarial opening unitary UOpen∗,1 on P ⊗Y ⊗Z ⊗I corresponding to the prover’s\nbehavior in the measurement round (b = 1) of the form:\nX\npk,y\n|pk, y⟩\n⟨pk, y|P,Y ⊗(UOpen∗,1,pk,y)Z,I.\nIn particular, given a commitment string y and residual prover state ρ ∈D(Z ⊗I), the\nprover’s response on challenge c = 1 is obtained by measuring register Z of\nUOpen∗,1(|pk, y⟩\n⟨pk, y|P,Y ⊗ρZ,I)\nin the Hadamard basis to obtain z.\nFollowing [Mah18], we can assume without loss of generality that UOpen∗,0 is the identity (refer\nto Section 3.2 for additional details). We will therefore write U to describe the prover’s “attack\nunitary” for the measurement round (c = 1).\nFor defining soundness, we informally require that a prover P ∗that passes the test round with\nprobability 1 −negl(λ) (this could alternatively be enforced by applying a measurement in the\nsecurity game) implicitly defines17 an N-qubit state τ whose measurement outcome distribution\nmatches the output distribution of Out(·) (up to computational indistinguishability).\nDefinition 4.5 (Soundness). There exists an efficient classical algorithm SimGen(1λ) and an\nefficient quantum algorithm ExtU,ρ(pk, sk, y) with black-box access to an attacker parameterized\nby a state ρ and a unitary U (see Section 3.2 for more details on how we formalize quantum\nblack-box access), that takes as input classical strings (pk, sk, y), and satisfies the following\nproperties:\n• Consider any non-uniform QPT cheating prover P ∗= (ρ0, UCommit∗, U) that passes the\ntest round with probability 1 −negl(λ) for all h ∈{0, 1}N.\nThen, for all h ∈{0, 1}N with circuit representation C, the following two distributions\nare computationally indistinguishable:\nReal:\n17In fact, we require that τ can be extracted efficiently from P ∗.\n25\n\n\n1. Sample parameters (pk, sk) ←Gen(1λ, C).\n2. Run the attacker P ∗on pk to obtain a classical commitment string y (i.e., apply\nUCommit∗and then measure the register containing y). Denote the post-measurement\nstate as ρ ∈D(Z ⊗I), where Z corresponds to the registers that will eventually\nbe measured to obtain the prover’s final message, and I contains all of the other\ninternal registers of the prover.18\n3. Apply the prover’s attack unitary U. This yields the state ρ′ := UρZ,IU †. Measure\nthe Z register of ρ′ in the Hadamard basis to obtain the prover’s opening string z.\n4. Compute m ←Out(sk, (y, z)) and output m.\nSim:\n1. Sample parameters (pk, sk) ←SimGen(1λ).\n2. Run the attacker P ∗on pk to obtain a classical commitment string y (i.e., apply\nUCommit∗and then measure the register containing y). Denote the post-measurement\nstate as ρ ∈D(Z ⊗I).\n3. Run ExtU,ρ(pk, sk, y) →τ to obtain an N-qubit state τ.\n4. Measure each qubit of τ according to the bases specified by h ∈{0, 1}N (i.e., qubit\ni is measured in the Hadamard basis if hi = 1 and the standard basis if hi = 0) and\noutput the result.\n5\nA Measurement Protocol Template\nIn this section, we describe a generic construction of a N-qubit commit-and-measure protocol\n(Section 4) using two building blocks: (1) a family of Mahadev rTCFs (Definition 3.3), and (2) a\n“batch key generation” scheme (fully defined in Section 7) whose syntax we describe below. We\nconsider two different instantiations of this template:\n• Using a “trivial” batch key generation scheme in which the N rTCF keys are sampled i.i.d.,\nwe recover Mahadev’s original protocol [Mah18].\n• Using a succinct key generation scheme (constructed in Sections 7 and 7.2, we obtain a\nmeasurement protocol in which the verifier’s messages are succinct. We refer to this as a\nverifier-succinct measurement protocol.\nBatch Key Generation.\nFor our construction, we make use of what we call a “batch key genera-\ntion scheme” for the Mahadev rTCF. Let TCF.Gen(1λ, mode) denote the “standard” key generation\nalgorithm for a Mahadev rTCF. Informally, a batch key generation scheme for TCF.Gen(1λ, mode)\nis a mechanism that produces a joint representation of N TCF pairs (pki, ski), from which any\n18We will also assume, without loss of generality, that the prover always copies pk and y into its internal state\nregisters I.\n26\n\n\nindividual pki, ski can be computed, such that the pairs (pki, ski) are sufficiently “independent” of\neach other.\nA full definition of a batch key generation scheme is given in Definition 7.2, but we formally\nstate here the relevant syntax and security properties. Syntactically, a batch key generation scheme\nincludes three algorithms (Gen, ExtPk, ExtSk), where:\n• Gen(1λ, C) takes as input a security parameter λ and a circuit C : [N] →{0, 1} representing\n(through its truth table) an N-bit string. It outputs a master public key PK and master\nsecret key SK.\n• ExtPk(PK, i) is a deterministic algorithm that takes as input PK and an index i ∈N, and\noutputs a public key pki.\n• ExtSk(SK, i) is a deterministic algorithm that takes as input SK and an index i ∈N, and\noutputs a secret key ski.\nWhen instantiated for a Mahadev rTCF family, we require the following properties to hold for\nsuch a procedure:\n• Correctness: for (PK, SK) ←Gen(1λ, N, C) and (pki, ski) = (ExtPk(PK, i), ExtSk(SK, i)), we\nhave that (pki, ski) is in the range of TCF.Gen(1λ, C(i)) (i.e. they are a valid key pair in mode\nC(i)).\n• Key Indistinguishability: if C1 and C2 represent functions that agree on a set T of in-\nputs, then PK output by Gen(1λ, C1) is computationally indistinguishable from PK output\nby Gen(1λ, C2), even in the presence of all {ski, i ∈T}.\n• Collapsing at a single index: For any index j, the function fpkj is collapsing even given\nall secret keys ski for i ̸= j.\n• Adaptive hardcore bit at a single index: For any index j, the function fpkj satisfies the\nrTCF adaptive hardcore bit property even given all secret keys ski for i ̸= j.\nOur protocol is a variant of the Mahadev protocol [Mah18] in which the verifier’s first message\n(pk1, . . . , pkN) is replaced by the output PK of a batch key generation procedure.\n5.1\nMeasurement Protocol Description\nLet ClawFree = (TCF.Gen, Eval, Invert, Check, Good) denote a family of [Mah18] randomized TCFs\n(Definition 3.3). For simplicity of the analysis, we assume that on a fixed security parameter 1λ,\nGen outputs keys defining functions from {0, 1}×D to R, where D is a fixed-size subset of {0, 1}ℓ(λ)\nindependent of pk.19 We denote the size of D by L(λ). Let (Gen, ExtPk, ExtSk) denote a batch key\ngeneration algorithm for TCF.Gen satisfying the requirements described above.\n19The LWE-based instantiation from [BCM+18] satisfies this property. However, with more complicated expres-\nsions, our proof should go through without this simplifying assumption.\n27\n\n\nFor simplicity, we assume the honest prover P has an N-qubit pure state of the form\n|ψ⟩W =\nX\nw1,...,wN\nαw1,...,wN |w1 . . . wN⟩\non its internal N-qubit register W; the protocol completeness immediately extends to mixed states\nby linearity.\nThe verifier has a basis string h ∈{0, 1}N, represented by a circuit C : [N] →\n{0, 1}, and wants to obtain a measurement of |ψ⟩in this basis (where hi = 0 denotes a standard\nbasis measurement and hi = 1 denotes a Hadamard basis measurement). The protocol MP (for\nmeasurement protocol), with prover algorithm P = (MP.Commit, MP.Open) and verifier algorithm\nV = (MP.Gen, MP.Test, MP.Out), is executed as follows.\n• MP.Gen: On input 1λ, N and C, the verifier samples a representation of N TCF key pairs by\ncomputing (PK, SK) ←Gen(1λ, N, C), where C is circuit computing C(i) = hi. The verifier\nsends PK to the prover.\n• MP.Commit: Given PK and its input state |ψ⟩W, the prover computes public keys pki ←\nExtPk(PK, i) for 1 ≤i ≤N. From now on, P operates directly on (pki) and ignores PK.\nThe prover coherently (with respect to |ψ⟩) computes a “range superposition”\n1\n√\nLN\nX\nx1,...,xN∈D\ny1,...,yN∈R\nw∈{0,1}N\n \nαw\nY\ni\nq\nppki(wi, xi, yi) |w⟩W |x1⟩X1 . . . |xN⟩XN |y1⟩Y1 . . . |yN⟩YN\n!\nwhere each Xi is an ℓ(λ)-qubit register (where D ⊂{0, 1}ℓ), and each Yi has basis {|y⟩}y∈R.\nHere, ppk(b, x, y) denotes the probability density of y in the distribution fpk(b, x), where\nppk(b, x, y) := 0 for x ∈{0, 1}ℓ\\ D.\nFollowing [BCM+18, Section 4.3] the honest prover\nalgorithm can efficiently prepare this state up to exponentially small trace distance.\nAfter preparing this state, the prover measures Y1, . . . , YN in the standard (R-)basis and\nsends the outcome (y1, . . . , yN) to the verifier.\n• The verifier sends a uniformly random challenge bit c. After receiving the prover response,\nthe verifier computes each public key pki ←ExtPk(PK, i) and secret key ski ←ExtSk(SK, i)\nin order to evaluate either MP.Test or MP.Out.\n• MP.Open: On challenge bit c, the prover operates as follows.\n– If c = 0, the prover measures W ⊗X1 ⊗. . . ⊗XN in the standard basis and sends the\noutcome (b1, . . . , bN, x1, . . . , xN) to the verifier.\n– If c = 1, the prover instead measures W ⊗X1⊗. . .⊗XN in the Hadamard basis, returning\nstrings d1, . . . dN.\n• MP.Test: Given (b1, . . . , bN, x1, . . . , xN), the verifier computes (for every i) Check(pki, bi, xi, yi)\nand rejects if any of these checks do not pass.\n• MP.Out: Given d1, . . . dN, the verifier outputs N bits as follows. For each i ∈[N]:\n28\n\n\n– If hi = 0, the verifier ignores di, computes (bi, xi) = Invert(injective, ski, yi), and outputs\nbi.\n– If hi = 1, the verifier computes the two inverses {(0, x0,i), (1, x1,i)} ←Invert(2-to-1, ski, yi).\nFor each i, the verifier checks whether di ∈Goodx0,i,x1,i (corresponding to a valid equa-\ntion in the ith slot), and if so, the verifier outputs di · (1, x0,i ⊕x1,i). If di ̸∈Goodx0,i,x1,i,\nthe verifier samples a uniformly random bit and outputs it.\nCompleteness of this protocol follows immediately from [Mah18] and the correctness property\nof Gen. Specifically, the correctness property of Gen implies that each (pki, ski) in our protocol\nis in the range of TCF.Gen(1λ, C(i)), in which case (as shown in [Mah18]) the verifier’s output\ndistribution is statistically close to h = (C(0), . . . , C(N))-measurement outcome on |ψ⟩.\n6\nSoundness of Mahadev’s Protocol\nIn this section, we prove that the measurement protocol from Section 5 a computationally sound\n(Definition 4.5) commit-and-measure protocol. As a consequence, we obtain a new, self-contained\nproof of soundness of the [Mah18] protocol. Later (Section 7.1), we will instead instantiate our\nprotocol with a succinct key generation algorithm to obtain a verifier-succinct measurement pro-\ntocol.\nOur soundness proof is based in part on both [Mah18] itself as well as a proof strategy suggested\nin [Vid20].\nNotation.\nThroughout this section, we will fix the verifier’s choice of basis h ∈{0, 1}N. We\nwrite R := {i ∈[N] : hi = 1} and S := {i ∈[N] : hi = 0}, where R ⊂[N] denotes the set of indices\nthat the verifier wants to measure in the Hadamard basis, and S ⊂[N] denotes the set of indices\nthe verifier wants to measure in the standard basis.\nFinally, we will decompose the state space of the prover as Z ⊗I, where:\n• Z = Z1 ⊗· · · ⊗ZN. 1 ≤i ≤N, Zi is an (ℓ(λ) + 1)-qubit register that contains the classical\nopening string zi. We will sometimes write Z as shorthand for Z1 ⊗. . . ⊗ZN.\n• Each Zi can be written as Zi = Bi ⊗Xi, where Bi is a one-bit register and Xi is an ℓ(λ)-bit\nregister.\n• I denotes any additional registers the prover uses.\n6.1\nThe Verifier’s Output Distribution\nOur goal is to characterize the N-bit distribution DP ∗,Out corresponding to the verifier’s output\nin the measurement protocol when interacting with a malicious prover P ∗using h ∈{0, 1}N as\nits choice of bases. In particular, we want to prove that if P ∗succeeds in passing the test round\nwith probability 1 −negl(λ), then DP ∗,Out is computationally indistinguishable from DP ∗,Ext, a\ndistribution obtained from (1) running an efficient extractor ExtP ∗to obtain an N-qubit quantum\nstate τ, and (2) measuring τ in the verifier’s specified bases.\nThe distribution DP ∗,Out produces a sample according to the following steps:\n29\n\n\n1. Sample keys (PK, SK) ←MP.Gen(1λ, N, C) (where C specifies the choice of bases R, S).\n2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩∈Z ⊗I\ndenote the prover’s residual state.\n3. For each i ∈S, compute (bi, xi) ←Invert(injective, ski, yi). Let v ∈{0, 1}S be the vector\nwhose ith entry is bi.\n4. Next, apply the prover’s attack unitary U on Z ⊗I, and then measure Z in the Hadamard\nbasis to obtain a response z = (d1, . . . , dN).\n5. For each i ∈R, compute (0, x0,i), (1, x1,i) ←Invert(2-to-1, ski, yi). If di ∈Goodx0,i,x1,i, set\nui = di · (1, x0,i ⊕x1,i). Otherwise, set ui to be a uniformly random bit. This results in a\nstring u ∈{0, 1}R\n6. Output (u, v) ∈{0, 1}R × {0, 1}S.\nOur first step is to show that DP ∗,Out is computationally indistinguishable from a distribution\nDP ∗,2-to-1 that does not require running the Invert algorithm for any key pair (pki, ski) in injective\nmode. Instead, this second distribution can be produced by directly measuring the register Bi\n(i.e., the first bit of Zi) of the prover’s state |ψ⟩). Since {ski}i∈S will no longer be required at this\npoint, we are also able to switch all key pairs (pki, ski) to be in two-to-one mode by invoking key\nindistinguishability.\nFormally, DP ∗,2-to-1 produces outcomes as follows (differences from DP ∗,Out highlighted in red):\n1. Sample keys (PK, SK) ←MP.Gen(1λ, N, 1) (where 1 denotes the constant 1 function, corre-\nsponding to two-to-one mode)\n2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩∈Z ⊗I\ndenote the prover’s residual state.\n3. For each i ∈S, measure Bi to obtain a bit vi; the result of this step is a string v ∈{0, 1}S.\n4. Next, apply the prover’s attack unitary U on Z ⊗I, and then measure Z in the Hadamard\nbasis to obtain a response z = (d1, . . . , dN).\n5. For each i ∈R, compute (0, x0,i), (1, x1,i) ←Invert(2-to-1, ski, yi). If di ∈Goodx0,i,x1,i, set\nui = di · (1, x0,i ⊕x1,i). Otherwise, set ui to be a uniformly random bit. This results in a\nstring u ∈{0, 1}R\n6. Output (u, v) ∈{0, 1}R × {0, 1}S.\nLemma 6.1. DP ∗,2-to-1 is computationally indistinguishable from DP ∗,Out.\nWe prove Lemma 6.1 by first switching the keys sampled in DP ∗,2-to-1 to match the verifier’s\nbasis choice h. That is, we define the distribution DP ∗,h to be the same distribution as DP ∗,2-to-1,\nexcept that the keys (pki, ski) are sampled in mode hi, i.e., Step 1 is replaced with:\n1. Sample keys (PK, SK) ←MP.Gen(1λ, N, C) (where C(i) = hi for all i).\n30\n\n\nThis is well-defined because the ith bit of the output is still obtained by measuring Bi, which can\nbe done regardless of how (pki, ski) is sampled.\nClaim 6.2. For every basis choice h, DP ∗,h is computationally indistinguishable from DP ∗,2-to-1.\nProof. This follows by invoking the following key indistinguishability property of Gen:\nn\n(PK, SK) ←Gen(1λ, 1) : (PK, {ski}i̸∈S)\no\n≈c\nn\n(PK, SK) ←Gen(1λ, C) : (PK, {ski}i̸∈S)\no\n.\nSince the distributions are sampled without use of ski for all i ∈S, Claim 6.2 follows from this\nindistinguishability.\nTo conclude that DP ∗,2-to-1 ≈c DP ∗,Out, we note:\nClaim 6.3. If DP ∗,Out is instantiated with basis choice h, then DP ∗,Out is statistically indis-\ntinguishable from DP ∗,h.\nProof. Claim 6.3 follows from the injectivity of fpki for each i ∈S; by the correctness of Gen,\nwe have that each pki (for i ∈S) is in the support of TCF.Gen(1λ, injective). Therefore, since |ψ⟩\nis guaranteed to pass the test round with probability 1 −negl(λ), we have that with probability\n1 −negl(λ), measuring Bi gives the same result as computing the first bit of Invert(skj, yj) (which\nis the verifier’s output).\n6.2\nThe Protocol Observables\nDefining the Protocol Observables.\nIn DP ∗,2-to-1, the entire N-bit output (u, v) is the result\nof performing measurements on |ψ⟩, the prover’s residual state after it sends its commitment y.\nWe now define a collection of binary observables {Xi, Zi}i∈[N], parameterized by (PK, SK, y) and\nthe malicious prover’s attack unitary U, such that the following process is equivalent to sampling\nfrom DP ∗,2-to-1:\n1. Sample keys (PK, SK) ←MP.Gen(1λ, N, 1).\n2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩denote\nthe prover’s residual state.\n3. For each i ∈S, measure |ψ⟩with the observable Zi to obtain a bit vi.\n4. Next, for each i ∈R, measure the observable Xi to obtain a bit ui.\n5. Output (u, v) ∈{0, 1}R × {0, 1}S.\nThe definition of the Zi observable is straightforward: since each vi is obtained by measuring\nBi in the standard basis, Zi is simply the Pauli-Z observable Zi := (σZ)Bi.\nDefining the Xi observable requires more care. In DP ∗,2-to-1, the string u ∈{0, 1}R is obtained\nby applying the following steps (after v ∈{0, 1}S is measured)\n1. Apply the prover’s attack unitary U on Z ⊗I.\n31\n\n\n2. For each i ∈R:\n(a) Apply H⊗ℓ+1 to the register Zi containing the prover’s response in the ith slot.\n(b) Measure Zi to obtain di. If di ∈Good(x0,i, x1,i), set ui = di · (1, x0,i ⊕x1,i). If di ̸∈\nGood(x0,i, x1,i), set ui to be a uniformly random bit.\nIn order to output a uniformly random bit, we will prepare fresh one-qubit ancilla registers\nU1, . . . , UN, so that in the event that the prover returns an invalid di in slot i, the verifier can\ngenerate a random bit by measuring Ui (initialized to |0⟩) in the Hadamard basis. Note that the\nU = U1, . . . , UN register is not part of the malicious prover’s state.\nWe therefore redefine |ψ⟩:= |ψ⟩Z,I |0⟩U to denote the global state on Z ⊗I ⊗U including the\nancilla U registers initialized to |0⟩U.\nFinally, the Xi observable is defined as\nXi = (U ⊗IdU)†(H⊗ℓ+1\nZi\n⊗Id ⊗HUi)X′\ni(H⊗ℓ+1\nZi\n⊗Id ⊗HUi)(U ⊗IdU).\nwhere\nX′\ni =\nX\nd∈Good(x0,i,x1,i)\n(−1)d·(1,x0,i⊕x1,i) |d⟩\n⟨d|Zi ⊗IdI,{Zj}j̸=i,U\n+\nX\nd̸∈Good(x0,i,x1,i),u∈{0,1}\n(−1)u |d, u⟩\n⟨d, u|Zi,Ui ⊗IdI,{Zj}j̸=i,{Uj}j̸=i.\nNote that the Xi observables are defined so that each pair of Xi, Xj commute. Moreover, one\ncan verify that measuring Xi for each i ∈R exactly corresponds to measuring u ∈{0, 1}R as\ndescribed above.\nThe description of Xi depends on (yi, ski) because of the appearance of xi,0, xi,1 in X′\ni. Moreover,\nnote that each Xi is efficiently computable given ski.\nFor convenience, we define a procedure {Xi, Zi}i, |ψ⟩Z,I,U ←Samp that works as follows:\n• Sample keys (PK, SK) ←MP.Gen(1λ, N, 1).\n• Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ′⟩denote\nthe prover’s residual state on Z ⊗I.\n• Output the observables {Xi, Zi} parameterized by (PK, SK, y) and malicious prover’s unitary\nU, along with the state |ψ⟩:= |ψ′⟩⊗|0⟩U.\nFor the remainder of this section, we will write DP ∗,2-to-1 as a two-step sampling process:\n1. Run {Xi, Zi}i, |ψ⟩Z,I,U ←Samp.\n2. Starting with |ψ⟩, measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then measure each Xi\nfor i ∈R to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.\n32\n\n\n6.3\nThe Extracted State\nRecall that our definition of measurement protocol soundness (Definition 4.5) requires us to give\nan extractor that:\n1. Generates keys (PK, SK) according to an algorithm SimGen(1λ) (independently of the verifier’s\nbasis choice h).\n2. Runs the malicious prover P ∗on PK to obtain y; as usual, |ψ⟩∈Z ⊗I ⊗U denotes the\nresidual prover state with U initialized to |0⟩U.20\n3. Generates an extracted state τ ←ExtU,|ψ⟩(PK, SK, y) (the superscript denotes black-box\naccess to a unitary U and state |ψ⟩, see Section 3.2).\nWe define SimGen(1λ) to be MP.Gen(1λ, N, 1), which exactly corresponds to how keys are\nsampled in DP ∗,2-to-1.\nTo establish soundness, it remains to (1) describe how to generate the extracted state τ given\n(PK, SK, y), U, and (2) prove that the distribution that arises from measuring τ with the Pauli-X\nand Pauli-Z observables in the verifier’s chosen bases h is computationally indistinguishable from\nDP ∗,2-to-1.\nWe handle (1) in Section 6.3.1. We then describe the distribution DP ∗,Ext that arises from\nmeasuring our extracted state in Section 6.3.2 and prove that indistinguishability from DP ∗,2-to-1\nin Section 6.4.\n6.3.1\nA Teleportation-Inspired Extraction Procedure\nFix a choice of {Xi, Zi}, |ψ⟩←Samp. For ease of notation, write H = Z ⊗I ⊗U so that |ψ⟩∈H.\nWe would like an efficient extraction procedure that takes as input |ψ⟩∈H and generates an N-\nqubit state τ such that, roughly speaking, measuring |ψ⟩with X/Z and measuring τ with σX/σZ\nproduce indistinguishable outcomes.\nIntuition for the Extractor.\nBefore we describe our extractor, we first provide some underlying\nintuition. For an arbitrary N-qubit Hilbert space, let σx,i/σz,i denote the Pauli σx/σz observable\nacting on the ith qubit. For each r, s ∈{0, 1}N, define the N-qubit Pauli “parity” observables\nσx(r) :=\nY\ni:ri=1\nσx,i , σz(s) :=\nY\ni:si=1\nσz,i.\nSuppose for a moment that |ψ⟩∈H is already an N-qubit state (i.e., H is an N-qubit Hilbert\nspace) and moreover, that each Xi/Zi observable is simply the corresponding Pauli observable\nσx,i/σz,i. While these assumptions technically trivialize the task (the state already has the form\nwe want from the extracted state), it will be instructive to write down an extractor that\n“teleports” this state into another N-qubit external register.\n20To match the syntax of our definition in Definition 4.5, the register U should be viewed as an internal register\ninitialized by the extractor.\n33\n\n\nWe can do this by initializing two N-qubit registers A1 ⊗A2 to |φ+⟩⊗N where |φ+⟩is the EPR\nstate (|00⟩+ |11⟩)/\n√\n2 (the ith EPR pair lives on the ith qubit of A1 and A2). Now consider the\nfollowing steps, which are inspired by the (N-qubit) quantum teleportation protocol\n1. Initialize a 2N-qubit ancilla W to\n\f\n\f02N\u000b\n, and apply H⊗2N to obtain the uniform superposition.\n2. Apply a “controlled-Pauli” unitary, which does the following for all r, s ∈{0, 1}N and all\n|φ⟩∈H ⊗A1:\n|r, s⟩W |φ⟩H,A1 →|r, s⟩W (σx(r)σz(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1\n3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements21\non A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:\n|u, v⟩W (σx(r)σz(s) ⊗Id)A1,A2\n\f\n\fφ+\u000b⊗N\nA1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)A1,A2\n\f\n\fφ+\u000b⊗N\nA1,A2 .\nFinally, discard W.\nOne can show that the resulting state is\n1\n2N\nX\nr,s∈{0,1}N\n(σx(r)σz(s) ⊗σx(r)σz(s) ⊗Id) |ψ⟩H\n\f\n\fφ+\u000b\nA1,A2 =\n\f\n\fφ+\u000b\nH,A1 |ψ⟩A2 ,\n(2)\nwhere |ψ⟩is now “teleported” into the A2 register.\nTo generalize this idea to the setting where |ψ⟩∈H is an arbitrary quantum state and {Xi, Zi}i\nare an arbitrary collection of 2N observables, we simply replace each σx(r) and σz(s) acting on\nH above with the corresponding parity observables for {Xi, Zi}. That is for each r, s ∈{0, 1}N,\ndefine\nZ(s) =\nN\nY\ni=1\nZsi\ni\nand X(r) =\nN\nY\ni=1\nXri\ni .\nThe rough intuition is that as long as the {Xi} and {Zi} observables “behave like” Pauli observables\nwith respect to |ψ⟩, the resulting procedure will “teleport” |ψ⟩into the N-qubit register A2.\nThe Full Extractor.\nIn more detail, we have the state |ψ⟩H = |ψ⟩Z,I,U, and we initialize two\nN-qubit registers A1 ⊗A2 to |φ⟩⊗N. We run the following steps (the changes from the above\nprocedure are highlighted in red):\n1. Initialize a 2N-qubit ancilla W to\n\f\n\f02N\u000b\n, and apply H⊗2N.\n2. Apply a unitary that does the following for all r, s ∈{0, 1}N:\n|r, s⟩W |φ⟩H,A1 →|r, s⟩W (X(r)Z(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1\n21The Bell basis consists of the 4 states (σa\nxσb\nz ⊗Id)\n\f\n\fφ+\u000b\nfor a, b ∈{0, 1} on 2 qubits.\n34\n\n\n3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements\non A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:\n|u, v⟩W (σx(r)σz(s) ⊗Id)\n\f\n\fφ+\u000b⊗N\nA1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)\n\f\n\fφ+\u000b⊗N\nA1,A2 .\nFinally, discard W.\nAll of these steps can be efficiently implemented given black-box access to {Xi, Zi}i.\nThe\nresulting state is\n1\n2N\nX\nr,s∈{0,1}N\nX(r)Z(s) |ψ⟩H ⊗σx(r)σz(s)\n\f\n\fφ+\u000b⊗N\nA1,A2 ,\nand we define the extracted state τ := Ext{Xi},{Zi}(|ψ⟩) to be the residual state on A2 after tracing\nout H and A1.22\n6.3.2\nMeasuring the Extracted State\nWe now consider the N-bit distribution of measurement outcomes that arise from measuring the\nextracted state τ using the Pauli observables σx, σz. In particular, we consider performing the\nmeasurements according to the verifier’s basis choice, so that we measure σz,i for each i ∈S and\nσx,i for each i ∈R.\nFormally, we define the distribution DP ∗,Ext on {0, 1}N obtained by the following process:\n• Run {Xi, Zi}, |ψ⟩←Samp.\n• Let τ = Ext{Xi},{Zi}(|ψ⟩) be the N-qubit extracted state.\n• Measure the Pauli-Z observable σz,i for all i ∈S, obtaining v ∈{0, 1}S.\n• Measure the Pauli-X observable σx,i for all i ∈R, obtaining u ∈{0, 1}R.\n• Output (u, v) ∈{0, 1}R × {0, 1}S.\nIt will be convenient to define the following projection operators. For each u ∈{0, 1}R and\nv ∈{0, 1}S let\nΠσx\nu =\nE\nu′∈{0,1}R(−1)u·u′σx(u′)\nand\nΠσz\nv =\nE\nv′∈{0,1}S(−1)v·v′σz(v′)\n(3)\nIn words, Πσx\nu\nis the projection that corresponds to measuring σx,i for each i ∈R and obtaining\nthe string of outcomes u ∈{0, 1}R, and Πσz\nv\nis the projection that corresponds to measuring σz,i\nfor each i ∈S and obtaining the string of outcomes v ∈{0, 1}S.\nThen the probability DP ∗,Ext outputs any (u, v) ∈{0, 1}R × {0, 1}S can be written as\nDP ∗,Ext(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp[Tr\nΠσx\nu Πσz\nv τ\n\u0001\n: τ = Ext{Xi},{Zi}(|ψ⟩)].\n22The same extracted state is defined in Vidick’s lecture notes [Vid20], although the notes do not give an explicit\nprocedure for generating it.\n35\n\n\nWe define a set of analogous projection operators for the {Xi} and {Zi} observables. For each\nu ∈{0, 1}R and v ∈{0, 1}S, let\nΠX\nu =\nE\nu′∈{0,1}R(−1)u·u′X(u′)\nand\nΠZ\nv =\nE\nv′∈{0,1}S(−1)v·v′Z(v′)\n(4)\nIn words, ΠX\nu is the projection that corresponds to measuring Xi for each i ∈R and obtaining the\nstring of outcomes u ∈{0, 1}R, and ΠZ\nv is the projection that corresponds to measuring Zi for each\ni ∈S and obtaining the string of outcomes v ∈{0, 1}S.\nWith these definitions in mind, we state a claim that allows us to characterize the result of\nmeasuring the extracted state τ with the Pauli observables.\nClaim 6.4. Fix any choice of {Xi, Zi}i∈[N] and state |ψ⟩, and let τ = Ext{Xi},{Zi}(|ψ⟩). For all\n(u, v) ∈{0, 1}R × {0, 1}S it holds that\nTr\nΠσx\nu Πσz\nv τ\n\u0001\n=\nE\nu′∈{0,1}R ⟨ψ| ΠZ\nv Z(u′)ΠX\nu′⊕uZ(u′)ΠZ\nv |ψ⟩.\n(5)\nThe proof of Claim 6.4 is a straightforward (but slightly tedious) computation and is deferred\nto Appendix B.\nImportantly, Claim 6.4 gives a clear understanding of how DP ∗,2-to-1 and DP ∗,Ext relate to each\nother, since it allows us to view the distribution DP ∗,Ext (which arises from Pauli measurements\non the extracted state τ) as the result of performing certain protocol observable measurements\n{Xi, Zi} on |ψ⟩.\nRecall that the distribution DP ∗,2-to-1 is the following distribution:\n1. Run {Xi, Zi}i, |ψ⟩Z,I,U ←Samp.\n2. Starting with |ψ⟩, measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then measure each Xi\nfor i ∈R to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.\nBy Claim 6.4, we can write DP ∗,Ext as follows (differences from DP ∗,2-to-1 are in red):\n1. Run {Xi, Zi}, |ψ⟩←Samp.\n2. Starting with |ψ⟩measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then sample a uniformly\nrandom string u′ ←{0, 1}R and apply the unitary Z(u′). Finally, measure each Xi for i ∈R\nand XOR the output with u′ to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.\nWith this key difference in mind, it remains to prove indistinguishability of these two distribu-\ntions.\n6.4\nIndistinguishability of Measurement Outcomes\nIn this subsection, we complete the proof that DP ∗,2-to-1 and DP ∗,Ext are computationally indistin-\nguishable. We first write out their probability mass functions:\n• DP ∗,2-to-1 outputs (u, v) ∈{0, 1}R × {0, 1}S with probability\nDP ∗,2-to-1(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\n\u0002\n⟨ψ| ΠZ\nv ΠX\nu ΠZ\nv |ψ⟩\n\u0003\n.\n36\n\n\n• DP ∗,Ext outputs (u, v) ∈{0, 1}R × {0, 1}S with probability\nDP ∗,Ext(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\n\u0002\n⟨ψ| ΠZ\nv Z(u′)ΠX\nu′⊕uZ(u′)ΠZ\nv |ψ⟩\n\u0003\n.\nAt this point, the reader may find it helpful to convince themselves that probability mass\nfunctions above exactly correspond to the descriptions of these distributions given at the end\nof Section 6.3. The equivalence between these two representations will be a key component of the\nupcoming proofs.\nFor convenience, we will reorder the indices so that the indices in R are labeled 1, 2, . . . , |R|.\nLet u≤j ∈{0, 1}R be the vector equal to u on the first j indices, and is 0 on the remaining\nindices. For each j ∈{0, 1, . . . , |R|}, define hybrid Hybj to be the distribution that outputs (u, v) ∈\n{0, 1}R × {0, 1}S with probability\nHybj(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\nh\n⟨ψ| ΠZ\nv Z(u′\n≤j)ΠX\nu⊕u′\n≤jZ(u′\n≤j)ΠZ\nv |ψ⟩\ni\n.\nAdditionally, for each j ∈{1, . . . , |R|}, and b ∈{0, 1} define hybrid Hybj,b to be the distribution\nthat outputs (u, v) ∈{0, 1}R × {0, 1}S with probability\nHybj,b(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\nh\n⟨ψ| ΠZ\nv Z(u′\n≤j−1)Zb\njΠX\nu⊕u′\n≤j−1⊕b·ejZb\njZ(u′\n≤j−1)ΠZ\nv |ψ⟩\ni\n,\nwhere ej ∈{0, 1}R denotes the jth standard basis vector.\nClaim 6.5. For all j ∈{1, . . . , |R|}, the distributions Hybj,0 and Hybj,1 are computationally\nindistinguishable.\nObserve that for j ∈{1, 2, . . . , |R|}, Hybj,0 = Hybj−1, and that Hybj,0 is the uniform mixture of\nHybj,0 and Hybj,1. Since Hyb0 = DP ∗,2-to-1 and Hyb|R| = DP ∗,Ext, Claim 6.5 implies that DP ∗,2-to-1\nand DP ∗,Ext are computationally indistinguishable.\nWe now prove Claim 6.5, which will complete the proof of measurement protocol soundness.\nOur proof involves the following steps:\n• First, we prove Claim 6.6, which states that the marginal distributions of Hybj,0 and Hybj,1\non N \\ {j} are indistinguishable due to the collapsing property of fpkj.\n• We then state Claim 6.7, which (together with Claim 6.6) shows that if Hybj,0 and Hybj,1 are\nefficiently distinguishable, then they can be distinguished as follows:\n1. Given a sample x (from either Hybj,0 or Hybj,1) run an efficient algorithm A on x\\{j} (x\nwithout the jth bit).\n2. If A outputs 0, guess a random bit b. If A outputs 1, guess b = xj.\nRoughly speaking, this reduces the task to arguing about the indistinguishability of the single\nbit xj (conditioned on A outputting 1).\n37\n\n\n• Finally, we show that the 1-bit conditional distributions must be indistinguishable by ap-\npealing to the adaptive hardcore bit property of fpkj.\nClaim 6.6. Let R′ = R \\ {j} and let (Hybj,0)[N]\\{j} and (Hybj,1)[N]\\{j} be the marginal distri-\nbutions of Hybj,0 and Hybj,1 on [N]\\{j} = R′ ∪S. Then (Hybj,0)[N]\\{j} and (Hybj,1)[N]\\{j} are\ncomputationally indistinguishable.\nProof. Any quantum algorithm for distinguishing (Hybj,0)[N]\\{j} and (Hybj,1)[N]\\{j} can be rep-\nresented as an N −1 qubit binary POVM (A, Id −A), where the distinguisher outputs 1 on x\nwith probability ⟨x| A |x⟩. We show that this contradicts the collapsing property of fpkj (given\nPK, {ski}i̸=j).\nConsider the following adversary for the fpkj collapsing security game:\n• Given PK, {ski}i̸=j, the adversary runs the prover P ∗on PK to obtain (y, |ψ⟩). Recall that\n|ψ⟩is guaranteed to contain a valid pre-image in register Zj. The adversary submits y to the\ncollapsing game challenger.\n• The challenger flips a random bit and either applies Zj or does nothing.23\n• Then the adversary performs the following steps:\n1. Measure Zi for every i ∈S obtaining outcomes v ∈{0, 1}S.\n2. Sample a random string u′ ←{0, 1}R and apply the unitary Z(u′\n≤j−1).\n3. Measure Xi for every i ∈R′, and XOR the outcomes with u′\n≤j−1 to obtain an output\nstring u ∈{0, 1}R′.\n4. Finally, measure |u, v⟩with the POVM {A, Id −A}, and output 1 if and only if the\nmeasurement outcome is A.\nAll of the adversary’s steps can be efficiently performed given (PK, {ski}i̸=j). Moreover, the above\nadversary’s advantage in the collapsing game is polynomially related to the advantage the POVM\n(A, Id −A) attains in distinguishing (Hybj,0)[N]\\{j} and (Hybj,1)[N]\\{j}.\nGiven that the marginal distributions of Hybj,0 and Hybj,1 on [N]\\{j} are computationally\nindistinguishable (Claim 6.6), we next invoke a general property of N-bit distributions implying\nthat a distinguisher between Hybj,0 and Hybj,1 must be distinguishing some (efficiently computable)\nproperty of the jth bit of Hybj,0 and Hybj,1 conditioned on an efficiently computable property of\nthe [N]\\{j}-marginal distributions.\nClaim 6.7. Let k = k(λ) be a positive integer-valued function of a security parameter λ.\nLet {D0,λ}λ≥1 and {D1,λ}λ≥1 be families of distributions on {0, 1}k+1 such that the marginal\n23This version of the collapsing game is equivalent to the standard formulation in which the challenger either\ndoes/does not perform a measurement. This follows from the fact that measuring a qubit in the computational basis\n(and discarding the outcome) is equivalent to applying Zb for a random b ←{0, 1}. Thus, the challenger’s measure-\nment (in the b = 1 experiment) is equivalent to applying Z with probability 1/2; for simplicity, our formulation has\nthe challenger (in the b = 1 experiment) apply Z with probability 1, which increases the adversary’s distinguishing\nadvantage by a factor of 2.\n38\n\n\ndistributions D′\n0,λ and D′\n1,λ of D0,λ and D1,λ respectively on the first k bits are computationally\nindistinguishable. Suppose that D0,λ and D1,λ are computationally distinguishable. Then there\nis an efficiently computable binary-outcome POVM {M, Id −M} acting on k qubits such that\n\f\n\f\n\f\nE\nx∼D0,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩−\nE\nx∼D1,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩\n\f\n\f\n\f >\n1\npoly(λ).\nWe defer the proof to Appendix C.\nFinally, we show that the jth bit distinguisher of Hybj,0 and Hybj,1 discussed by Claim 6.7\ncannot exist by the adaptive hardcore bit property of fpkj (given PK, {ski}i̸=j}).\nClaim 6.8. For any efficiently computable binary outcome POVM {M, Id −M},\n\f\n\f\n\f\nE\n(u,v)∼Hybj,0\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b\n−\nE\n(u,v)∼Hybj,1\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b \f\n\f\n\f = negl(λ). (6)\nProof. For the reader’s convenience, we write out the probability mass functions of Hybj,0 and\nHybj,1 explicitly, with the differences highlighted in red\nHybj,0(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\nh\n⟨ψ| ΠZ\nv Z(u′\n≤j−1)ΠX\nu⊕u′\n≤j−1Z(u′\n≤j−1)ΠZ\nv |ψ⟩\ni\nHybj,1(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\nh\n⟨ψ| ΠZ\nv Z(u′\n≤j−1)ZjΠX\nu⊕u′\n≤j−1⊕ejZjZ(u′\n≤j−1)ΠZ\nv |ψ⟩\ni\n.\nWe define one more distribution (with the difference relative to Hybj,0 highlighted in red)\nHybj,1(u, v) =\nE\n{Xi,Zi},|ψ⟩←Samp\nu′∈{0,1}R\nh\n⟨ψ| ΠZ\nv Z(u′\n≤j−1)ZjΠX\nu⊕u′\n≤j−1ZjZ(u′\n≤j−1)ΠZ\nv |ψ⟩\ni\n.\nWe now rewrite the left-hand-side of Eq. (6), where in the second expectation we sample from\nHybj,1 instead of Hybj,1. Note that these distributions are identical except that uj is flipped, so we\nhave\n\f\n\f\n\f\nE\n(u,v)∼Hybj,0\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b\n−\nE\n(u,v)∼Hybj,1\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b \f\n\f\n\f\n=\n\f\n\f\n\f\nE\n(u,v)∼Hybj,0\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b\n+\nE\n(u,v)∼Hybj,1\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b \f\n\f\n\f.\nDividing the right-hand-side by 2 gives an expression equal to the (absolute value of) the expecta-\ntion of the output in the following process:\n• Prepare {Xi, Zi}, |ψ⟩←Samp.\n• Sample b ←{0, 1} and prepare Zb\nj |ψ⟩(the b = 0 case corresponds to Hybj,0 and the b = 1\ncase corresponds to Hybj,1).\n• Then measure Zi for all i ∈S to obtain v ∈{0, 1}S. Sample a random u′ ←{0, 1}R and\napply Z(u′\n≤j−1), and finally measure Xi for all i ∈R and XOR the result with u′\n≤j−1 to\nobtain u ∈{0, 1}R.\n39\n\n\n• Prepare the state\n\f\n\fu\\{j}, v\n\u000b\nand measure it with the POVM {M, Id −M}. If the output is\nId −M, stop at this point and output 0.\n• Otherwise, if the output is M, output (−1)uj.\nNotice that the second step is equivalent to measuring |ψ⟩with Zj, since (writing Zj = Z+\nj −Z−\nj ,\nwhere Z+\nj is the projection onto the 1 eigenstate of Zj and Z−\nj = Id −Z+\nj is the projection onto\nthe −1 eigenstate of Zj):\n1\n2(Zj |ψ⟩\n⟨ψ| Zj + |ψ⟩\n⟨ψ|) = Z+\nj |ψ⟩\n⟨ψ| Z+\nj + Z−\nj |ψ⟩\n⟨ψ| Z−\nj .\nIt follows that\n\f\n\f\n\f\nE\n(u,v)∼Hybj,0\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b\n+\nE\n(u,v)∼Hybj,1\n(−1)uj \nu\\{j}, v\n\f\n\f M\n\f\n\fu\\{j}, v\n\u000b \f\n\f\n\f/2\nis polynomially-related to the advantage of the following adversary for the adaptive hardcore bit\ngame:\n• Given PK, {ski}i̸=j, the adversary runs the prover P ∗on PK to obtain (y, |ψ⟩). Recall that\n|ψ⟩is guaranteed to contain a valid pre-image in register Zj with probability 1 −negl(λ).\n• The adversary measures the register Zj of |ψ⟩in the standard basis, obtaining a string (bj, xj).\nBy the assumption that |ψ⟩contains valid pre-images and the fact that pkj is in the range of\nTCF.Gen(1λ, 2-to-1), this is equivalent to measuring the observable Zj (which just measures\nbj).\n• Next, the adversary measures Zi for all i ∈S, obtaining a string of outcomes v ∈{0, 1}S.\n• Then the adversary samples random u′ ←{0, 1}R and applies the unitary Z(u′\n≤j−1) to its\nstate.\n• The adversary measures Xi for all i ∈R′ and XORs the outcome with u′\n≤j−1, obtaining a\nstring u ∈{0, 1}R′.\n• The adversary prepares the state |u, v⟩and measures it with {M, Id −M}. Depending on the\noutcome, it does the following:\n– If the measurement outcome is Id −M, it samples a uniformly random string dj ←\n{0, 1}ℓ+1 and sends (bj, xj, dj) to the challenger (in this case obtaining negl(λ) advan-\ntage).\n– If the measurement outcome is M, it applies U to its state, followed by H⊗ℓ+1 to Zj. It\nthen measures Zj to obtain a string dj ∈{0, 1}ℓ+1 and sends (bj, xj, dj) to the challenger.\nNote that the challenger’s output bit (i.e., whether the adversary wins or loses) exactly\ncorresponds to the bit uj.\nBy assumption, this adversary outputs a valid pre-image (bj, xj) with probability 1−negl(λ). Since\nall of the adversary’s steps are efficient given (PK, {ski}i̸=j), the claim follows from the adaptive\nhardcore bit property of fpkj.\n40\n\n\nThis completes the proof of Claim 6.5, which in turn implies the soundness of the measurement\nprotocol.\n7\nSuccinct Key Generation from iO\nIn this section, we construct a cryptographic primitive that provides a succinct representation\nof N key pairs. We call this primitive a “succinct batch key generation algorithm,” and provide\ndefinitions and a construction based on iO in Section 7.1. In Section 7.2, we compose our succinct\nkey generation primitive with Mahadev randomized TCFs [Mah18] and prove that the composition\nsatisfies the hypotheses stated in Section 5, while also having succinct keys (PK, SK).\n7.1\nBatch Key Generation: Definition and Construction\nA batch key generation algorithm is an algorithm that outputs a description of many (pk, sk)-pairs;\na succinct batch key generation algorithm produces a short such description. Formally, we will\ndefine this primitive relative to any dual-mode key generation algorithm.\nDefinition 7.1. An algorithm Gen is said to be a dual-mode key generation algorithm if it\ntakes as input a security parameter 1λ and a bit mode ∈{0, 1}, and it outputs a pair of keys\n(pk, sk). Moreover, we require key indistinguishability: public keys sampled using Gen(1λ, 0)\nare computationally indistinguishable from public keys sampled using Gen(1λ, 1).\nDefinition 7.2. Let (pk, sk) ←Gen(1λ, mode) denote a dual-mode key generation algorithm.\nA (succinct) batch key generation algorithm BatchGen for Gen is a tuple of p.p.t. algorithms\n(Setup, ExtPk, ExtSk, Program) with the following syntax.\n• Setup(1λ, N, f) takes as input a security parameter λ in unary; the number of indices N\nin binary; and the description of a circuit f : [N] →{0, 1}. It outputs a master public\nkey PK and a master secret key SK.\n• ExtPk(PK, i) is a deterministic algorithm that takes as input a master public key PK and\nan index i ∈[N]. It outputs a public key pki.\n• ExtSk(SK, i) is a deterministic algorithm takes as input a master secret key SK and an\nindex i ∈[N]. It outputs a secret key ski.\n• Program(1λ, N, f, i, pk) takes as input (1λ, N, f) just as Setup does, along with two addi-\ntional inputs: an index i ∈[N] and a public key pk. It outputs a master public key PK\nand (an implicitly restricted) master secret key SK.\nWe require that the following three properties are satisfied. Informally, we require that (0)\nSetup(1λ, N, f) always outputs a representation of valid key pairs, (1) Program(1λ, N, f, i, pk)\nsuccessfully programs pk into the ith “slot” of PK, (2) if (pk, sk) ←Gen(1λ, mode = f(i)) this\nprogramming is undetectable (even given all secret keys), and (3) mode indistinguishability\ncontinues to hold for batched keys, even in the presence of “irrelevant secret keys.”\n41\n\n\n1. Setup Correctness. For any λ, N ∈N, any circuit f : [N] →{0, 1}, any index i ∈[N],\nwe have that for (PK, SK) ←Setup(1λ, N, f) and (pki, ski) = (ExtPk(PK, i), ExtSk(SK, i)),\n(pki, ski) is in the range of Gen(1λ, mode = f(i)).\n2. Programming Correctness. For any λ, N ∈N, any circuit f : [N] →{0, 1}, any index\ni ∈[N], and any bit mode, we have the following guarantee: for (pk, sk) ←Gen(1λ, mode)\nand (PK, SK) ←Program(1λ, N, f, i, pk),\nExtPk(PK, i) = pk.\nwith probability 1.\n3. Programming Indistinguishability. For any N = N(λ), any circuit f : [N] →{0, 1}\nand any index i ∈[N], the following distributions are (poly(λ, N), negl(λ, N))-indistinguishable:\nn\n(PK, SK) ←Setup(1λ, N, f), skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)\no\nλ∈N\n≈c\nn\n(pk, sk) ←Gen(1λ, mode = f(i)), (PK, SK) ←Program(1λ, N, f, pk, i),\nski = sk and ∀j ̸= i, skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)\no\nλ∈N\nWhile we let the circuit be arbitrary in this definition, we note that it will be instantiated\nwith an efficient circuit of size poly(log N, λ) in our eventual constructions.\n4. Key Indistinguishability: For any N = N(λ), for any subset S ⊂[N], and for any\ntwo circuits f0, f1 : [N] →{0, 1} such that f0(i) = f1(i) for all i ∈S, for (PKb, SKb) ←\nSetup(1λ, N, fb), the distributions of keys\nn\nPKb,\n\u0010\nski ←ExtSk(SKb, i)\n\u0011\ni∈S\no\nλ∈N\nare computationally (poly(λ, N), negl(λ, N))-indistinguishable.\nWe now construct succinct key generation from iO and puncturable PRFs using standard punc-\nturing techniques.\nTheorem 7.3. For any N(λ), assuming a (poly(λ, N), negl(λ, N))-secure iO scheme and a\n(poly(λ, N), negl(λ, N))-secure puncturable PRF, there exists a succinct batch key generation\nalgorithm\n(Setup, ExtPk, ExtSk, Program)\nwhere Setup supports batch sizes up to N(λ) and runs in time poly(λ, log N).\nIn particular, when N(λ) = 2λ we rely on the sub-exponential hardness of iO and punc-\nturable PRFs, while for any N(λ) = poly(λ) we rely on polynomial hardness.\nProof. Given a dual-mode key generation algorithm Gen, an iO scheme iO, and a puncturable PRF\nfamily PRF, we define our batch key generation procedure SuccGen = (Setup, ExtPk, ExtSk, Program)\nas follows.\n42\n\n\n• Setup(1λ, N, f) samples a PRF seed s and outputs (as the public key) an obfuscated program\ne\nP = iO(Ps,f), where P is defined in Fig. 1, and (as the secret key) the PRF seed s and the\nfunction f.\n• ExtPk(PK, i) computes and outputs pki = e\nP(i) (for e\nP = PK).\n• ExtSk(SK, i) computes r = PRFs(i) and mode = f(i). It then computes (pki, ski) ←Gen(1λ, mode; r)\nand outputs ski.\n• Program(1λ, N, f, pk, i∗) samples a PRF seed s and outputs (as the public key) an obfuscated\nprogram iO(Ppk,i∗,s,f), where Ppk,i∗,s,f is defined in Fig. 2, and (as the secret key) the PRF\nseed s and the function f.\nInput: index i ≤N\nHardwired Values: Puncturable PRF seed s. Circuit f.\n• Compute mode = f(i) and r = PRFs(i).\n• Compute (pki, ski) ←Gen(1λ, mode; r).\n• Output pki.\nFigure 1: The program P.\nInput: index i ≤N\nHardwired Values: Puncturable PRF seed s. Public key pk. Index i∗. Circuit f.\n• If i = i∗, output pk and terminate.\n• Compute mode = f(i) and r = PRFs(i).\n• Compute (pki, ski) ←Gen(1λ, mode; r).\n• Output pki.\nFigure 2: The program Ppk,i∗,s,f.\nSuccinctness, setup correctness and programming correctness are immediate from the defini-\ntions. We now prove programming indistinguishability.\n43\n\n\nClaim 7.4. For any circuit f and any index i ∈[N], the following distributions are (poly(λ, N),\nnegl(λ, N))- computationally indistinguishable:\nn\n(PK, SK) ←Setup(1λ, N, f), skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)\no\n≈c\nn\n(pk, sk) ←Gen(1λ, mode = f(i)), (PK, SK) ←Program(1λ, N, f, pk, i),\nskj ←ExtSk(SK, j)(j ̸= i), ski = sk : (PK, sk1, . . . , skN)\no\nProof. We know that (iO(Ps,f), s) ≈c (iO(Ppk,i∗,s,f), s) for (pk, sk) ←Gen(1λ, mode = f(i∗); PRFs(i∗))\nby iO security because these two circuits Ps,f, Ppk,i∗,s,f are functionally equivalent.\nMoreover, (iO(Ppk,i∗,s,f), {ski}1≤i≤N) for pseudorandom (pk, ski∗) is computationally indistin-\nguishable from (iO(Ppk,i∗,s,f), {ski}1≤i≤N) for truly random (pk, ski∗) by puncturing s at i∗(invoking\niO security to do so) and then invoking PRF security.\nFinally, we prove key indistinguishability.\nClaim 7.5. For any N = N(λ), for any subset S ⊂[N(λ)], and for any two circuits f0, f1 :\n[N] →{0, 1} such that f0(i) = f1(i) for all i ∈S, for (PKb, SKb) ←Setup(1λ, N, fb), the\ndistributions of keys\nn\nPKb,\n\u0010\nski ←ExtSk(SKb, i)\n\u0011\ni∈S\no\nλ∈N\nare computationally (poly(λ, N), negl(λ, N))- indistinguishable.\nProof. Consider the following hybrid circuits f′\nj for 0 ≤j ≤N:\nf′\nj(i) = f0(i) if i ≥j and f′\nj(i) = f1(i) if i > j.\nNote that f′\n0 = f0 and f′\nN = f1. Now, we consider the N + 1 distributions\nHybj =\nn\nPK,\n\u0010\nski ←ExtSk(SK, i)\n\u0011\ni∈S\no\nλ∈N\nfor (PK, SK) ←Setup(1λ, N, f′\nj). The claim holds as long as Hybj−1 ≈c Hybj for all j ≥1. To see\nthat this indistinguishability holds, it suffices to consider two further hybrid distributions:\nHybj,1 =\nn\nPK,\n\u0010\nski ←ExtSk(SK, i)\n\u0011\ni̸=j∈S, skj (included if j ∈S)\no\nλ∈N\nfor (pkj, skj) ←Gen(1λ, mode = f0(j)) and (PK, SK) ←Program(1λ, N, f′\nj−1, j, pkj), and\nHybj,2 =\nn\nPK,\n\u0010\nski ←ExtSk(SK, i)\n\u0011\ni̸=j∈S, skj (included if j ∈S)\no\nλ∈N\nfor (pkj, skj) ←Gen(1λ, mode = f1(j)) and (PK, SK) ←Program(1λ, N, f′\nj, j, pkj).\nWe have that Hybj−1 ≈c Hybj,1 by programming indistinguishability (Claim 7.4). We have that\nHybj,1 ≈c Hybj,2 by considering two cases: if f0(j) = f1(j) then (pkj, skj) are sampled from identical\ndistributions in the hybrid and f′\nj−1 = f′\nj, so indistinguishability follows from a single invocation\nof iO security. If f0(j) ̸= f1(j), then skj is not included in the hybrid distributions; moreover, pkj\n44\n\n\nin Hybj,1 is computationally indistinguishable from pkj in Hybj,2 by the key indistinguishability\nof Gen. Finally, note that for a fixed pkj, the programs Ppkj,j,s,f′\nj−1 and Ppkj,j,s,f′\nj are functionally\nequivalent (as index j is being programmed to pkj in both cases), so the claimed indistinguishability\nnow follows from iO security.\nFinally, we have Hybj,2 ≈c Hybj by programming indistinguishability. This completes the proof\nof the claim.\nThis completes the proof that (Setup, ExtPk, ExtSk, Program) is a succinct batch key generation\nalgorithm for Gen.\n7.2\nCombining Succinct Key Generation with Mahadev rTCFs\nIn our protocols, we compose a batch key generation algorithm (Definition 7.2) with a family of\nMahadev randomized TCFs (Definition 3.3). The composition is simple: use a batch key generation\nprocedure BatchGen = (Setup, ExtPk, ExtSk, Program) to batch the procedure TCF.Gen(1λ, mode)\nfor many Mahadev rTCFs fpk1, . . . , fpkN . The composition has the following syntax:\n• Setup(1λ, N, C) takes as input the security parameter λ, the batch size N (in binary), and a\ncircuit C computing a function mapping [N] →{0, 1}. It outputs a public key PK and secret\nkey SK.\n• ExtPk(PK, i) then outputs a public key pki that can be used to evaluate a randomized TCF\nfpki.\n• ExtSk(SK, i) outputs a secret key ski that can be used to invert a TCF evaluation yi.\n• Program, as defined above, can be used to program a fresh (pki, ski) ←Gen(1λ, mode = C(i))\ninto a succinct program generated using circuit C. Program is an auxiliary algorithm used\nonly for analysis.\nWe now establish that all of the necessary properties listed in Section 5 are satisfied by this\ncomposition.\nCorrectness of the composition (i.e., that key pairs (pki, ski) are in the range of TCF.Gen(1λ, mode =\nf(i))) follows immediately from the correctness of Setup. Key indistinguishability of the composi-\ntion is also inherited directly from the key indistinguishability of BatchGen.\nWe next prove that collapsing of fpkj holds in the presence of PK and all {ski}i̸=j.\nLemma 7.6. [Collapsing] For any circuit C, any index j, and (PK, SK) ←Setup(1λ, N, C),\nthe TCF fpkj is collapsing, even to an adversary given PK along with all secret keys {ski}i̸=j\nbesides skj.\nFormally, a computationally bounded adversary cannot win the following distinguishing\ngame with non-negligible advantage:\n1. The adversary chooses an index j ∈[N] and a circuit C : [N] →{0, 1}.\n2. The challenger samples (PK, SK) ←Setup(1λ, N, C).\n45\n\n\n3. The challenger sends (PK, {ski}i̸=j) to the adversary.\n4. The adversary prepares a quantum state |ψ⟩on registers B, X along with a string y and\nsends both to the challenger.\n5. The challenger computes, in superposition, whether Check(pkj, b, x, y) = 1.\n• If Check fails, the challenger samples a random bit c and stops.\n• If Check passes, the challenger samples a random bit c; if c = 1, the challenger\nmeasures B.\n6. The adversary, given access to the modified (B, X), outputs a bit c′ and wins if c′ = c.\nProof. We consider the following hybrid experiments.\n• Hyb0: this is the actual security game.\n• Hyb1: In step (2), challenger samples (pk, sk) ←Gen(1λ, C(j)) and samples (PK, SK) ←\nProgram(1λ, N, C, pk, j).\nHyb0 and Hyb1 are computationally indistinguishable by the programming indistinguishabil-\nity of SuccGen.\n• Hyb2: In step (2), the challenger instead samples (pk, sk) ←Gen(1λ, injective).\nHyb1 and Hyb2 are computationally indistinguishable by the key indistinguishability of the\ninjective/claw-free trapdoor functions.\nFinally, in Hyb3, even a computationally unbounded adversary cannot guess the challenge bit\nc, as with all but negligible probability, pkj = ExtPk(PK, j) defines an injective function (by\nDefinition 3.3), so after verifying that Check(pkj, b, x, y) = 1, the register B is already a standard\nbasis state. This completes the proof of Lemma 7.6.\nFinally, we prove that the adaptive hardcore bit property of fpkj holds given PK and all {ski}i̸=j\nLemma 7.7. [Adaptive Hardcore Bit] For any j and any circuit C such that C(j) = 1 =\n2-to-1, for (PK, SK) ←Setup(1λ, N, C), the adaptive hardcore bit property (see Definition 3.3)\nholds for the function fpkj (with associated secret key skj), even if the adversary is given\n(PK, {ski}i̸=j).\nProof. We consider the following hybrid experiments.\n• Hyb0: this is the adaptive hardcore bit security game for (pkj, skj) as sampled above.\n• Hyb1: this is the adaptive hardcore bit security game for (pk, sk) ←Gen(1λ, 2-to-1), (PK, SK) ←\nProgram(1λ, N, C, pk, j). The adversary is additionally given PK and ski = ExtSk(SK, i) for\nall i ̸= j.\nHyb0 and Hyb1 are computationally indistinguishable by the programming indistinguishability\nproperty. Moreover, the adversary’s advantage in Hyb1 is negligible by the adaptive hardcore bit\nproperty of the freshly generated key pair (pk, sk) ←Gen(1λ, 2-to-1), as a reduction given pk can\nsimulate Hyb1 by sampling all other parameters given to the Hyb1 adversary itself.\nThis completes the proof of Lemma 7.7.\n46\n\n\n8\nA Verifier-Succinct Protocol\nIn this section, we present a delegation protocol for QMA with succinct verifier messages. First, in\nSection 8.1, we describe results due to [ACGH20] about the parallel repetition of certain commit-\nchallenge-response protocols with a quantum prover. Our treatment is somewhat more abstract\nthan [ACGH20], so for completeness we provide proofs of all claims (based on proofs appearing\nin [ACGH20]).\nNext, in Section 8.2, we describe the syntax of a non-interactive, information-\ntheoretic QMA verification protocol (with quantum verifier) that we will use, due to [FHM18].\nIn Section 8.3, we describe a verifier-succinct protocol for QMA delegation, where the verifier\nmessages (but not the prover messages) are succinct.\n8.1\nQuantum commit-challenge-response protocols\nConsider any commit-challenge-response protocol between a quantum prover P and a classical\nverifier V , with the following three phases.\n• Commit: P(1λ) and V (1λ; r) engage in a (potentially interactive) commitment protocol,\nwhere r are the random coins used by V .\n• Challenge: V samples a random bit b ←{0, 1} and sends it to P.\n• Response: P computes a (classical) response z and sends it to V .\nAfter receiving the response, V decides to accept or reject the execution.\nConsider any non-uniform QPT prover P ∗, and let\n\f\n\f\n\fψP ∗\nλ,r\nE\nA,C be the (purified) state of the prover\nafter interacting with V (1λ; r) in the commit phase, where C holds the (classical) prover messages\noutput during this phase, and A holds the remaining state.\nThe remaining strategy of the prover can be described by family of unitaries\nn\nU P ∗\nλ,0, UP ∗\nλ,1\no\nλ∈N+,\nwhere U P ∗\nλ,0 is applied to\n\f\n\f\n\fψP ∗\nλ,r\nE\non challenge 0 (followed by a measurement of z), and U P ∗\nλ,1 is applied\nto\n\f\n\f\n\fψP ∗\nλ,r\nE\non challenge 1 (followed by a measurement of z).\nLet Vλ,r,0 denote the accept/reject predicate applied by the verifier to the prover messages when\nb = 0, written as a projection to be applied to the registers holding the prover messages, and define\nVλ,r,1 analogously. Then define the following projectors on A ⊗C :\nΠP ∗\nλ,r,0 := U P ∗\nλ,0\n†Vλ,r,0U P ∗\nλ,0,\nΠP ∗\nλ,r,1 := U P ∗\nλ,1\n†Vλ,r,1U P ∗\nλ,1.\nDefinition 8.1. A commit-challenge-response protocol has computationally orthogonal projectors\nif for any QPT prover P ∗,\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= negl(λ).\nProofs of the following are given in Appendix A.\nLemma 8.2 ([ACGH20]). Consider a commit-challenge-response protocol with the following\nproperties.\n47\n\n\n1. Vλ,r,0 does not depend on r (that is, it is publicly computable given the transcript).\n2. For any P ∗, if Er\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= 1−negl(λ), then Er\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,1\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= negl(λ).\nThen, the protocol has computationally orthogonal projectors.\nTheorem 8.3 ([ACGH20]). Consider the λ-fold parallel repetition of any commit-challenge-\nresponse protocol with computationally orthogonal projectors. The probability that the verifier\naccepts all λ parallel repetitions of the protocol is negl(λ).\n8.2\nNon-Interactive Post Hoc Verification of QMA\nWe recall a useful information-theoretic QMA verification protocol of Fitzsimons, Hajdušek, and\nMorimae [FHM18]. In fact, we will use an “instance-independent” version due to [ACGH20].\nLemma 8.4 ([FHM18, ACGH20]). For all languages L = (Lyes, Lno) ∈QMA there exists\na polynomial k(λ), a function ℓ(λ) that is polynomial in the time T(λ) required to verify\ninstances of size λ, a QPT algorithm PFHM, and a PPT algorithm VFHM such that the following\nholds.\n• PFHM(x, |ψ⟩) →|π⟩: on input an instance x ∈{0, 1}λ and a quantum state |ψ⟩, PFHM\noutputs an ℓ(λ)-qubit state |π⟩.\n• Completeness. For all x ∈Lyes and |φ⟩∈RL(x) it holds that\nPr\nh\nVFHM(x, M(h, |π⟩)) = acc : |π⟩←PFHM\n\u0010\nx, |φ⟩⊗k(λ)\u0011i\n≥1 −negl(λ)\nwhere h ←{0, 1}ℓ(λ).\n• Soundness. For all x ∈Lno and all ℓ-qubit states |π∗⟩it holds that\nPr[VFHM(x, M(h, |π∗⟩)) = acc] ≤negl(λ)\nwhere h ←{0, 1}ℓ(λ).\nMoreover, when L ∈BQP, the honest prover algorithm PFHM is also a BQP algorithm.\nWhile the result was originally stated in [FHM18, ACGH20] to have an inverse polynomial\nsoundness gap, we have driven the soundness gap to negligible by standard QMA amplification.\nFinally, we remark that although the algorithm VFHM is completely classical, the entire verification\nprocedure is quantum since it involves measuring the quantum state sent by the prover.\n8.3\nSemi-Succinct Delegation for QMA\nWe describe a protocol for verifying any QMA language L.\n48\n\n\nIngredients:\n• Let (PFHM, VFHM) be the non-interactive protocol described in Lemma 8.4 for language L\nwith associated polynomials k(λ), ℓ(λ).\n• Let PRF : {0, 1}λ × {0, 1}log ℓ(λ) →{0, 1} be a pseudo-random function.\n• Let PMeas = (Commit, Open) and VMeas = (Gen, Test, Out) be the prover and verifier algorithms\nfor an ℓ(λ)-qubit (verifier succinct) commit-and-measure protocol, defined in Section 4 and\nconstructed in Section 5.1.\nThe Protocol:\n• The verifier is initialized with an instance x ∈{0, 1}λ and the prover is initialized with x and\nk(λ) copies of a witness |φ⟩∈RL(x).\n• The verifier samples s ←{0, 1}λ, defines C so that C(i) = PRFs(i), and computes (pk, sk) ←\nGen(1λ, C). It sends pk to the prover.\n• The prover first computes |ψ⟩←PFHM\n\u0010\nx, |φ⟩⊗k(λ)\u0011\n, and then computes (y, |st⟩) ←Commit(pk, |ψ⟩).\nIt sends y to the verifier.\n• The verifier samples a random challenge c ←{0, 1} and sends c to the prover.\n• The prover computes z ←Open(|st⟩, c) and sends z to the verifier.\n• If c = 0, the verifier checks whether Test(pk, (y, z)) = acc and rejects if the test fails. If c = 1,\nthe verifier computes m ←Out(sk, (y, z)) and checks whether VFHM(x, m) = acc. The verifier\naccepts if and only the verification is successful.\nTheorem 8.5. Let (PSS, VSS) be the λ-fold parallel repetition of the above protocol.\nThen,\n(PSS, VSS) satisfies completeness and soundness as defined in Definition 3.1. Moreover, for an\ninstance x with QMA verification time T, the total size of verifier messages is poly(λ, log T).\nProof. First, the verifier message size guarantee follows from the fact that the verifier initializes\nthe commit-and-measure protocol with a circuit C that succinctly encodes ℓ(λ) bits using a PRF\nwith input size log(ℓ(λ)), where ℓ(λ) is polynomially related to the QMA verification time T.\nNext, we argue completeness. For any x ∈L, we show that a single repetition of the protocol\naccepts with 1−negl(λ) probability, and so completeness of the λ-fold parallel repetition then follows\nby a union bound. In the case of a test round, this follows from the test round completeness of the\ncommit-and-measure protocol (Definition 4.2). In the case of a measurement round, we first see that\nmeasurement round completeness of the commit-and-measure protocol (Definition 4.2) implies that\nthe probability that the verifier outputs 1 is negl(λ)-close to the probability that the FHM protocol\n(PFHM, VFHM) accepts when run with an honest prover, but where h = (PRFs(1), . . . , PRFs(ℓ)) for\ns ←{0, 1}λ. Then, the security of the PRF implies that this probability is negl(λ)-close to the\nprobability that the FHM protocol accepts when h ←{0, 1}ℓ. Finally, this is negl(λ)-close to 1 by\nthe completeness of the FHM protocol (Lemma 8.4).\n49\n\n\nFinally, we argue soundness. Consider any x /\n∈L. By Theorem 8.3, it suffices to show that\nthe single repetition of the protocol satisfies the conditions of Lemma 8.2. We define Vλ,r,0 to be\nthe verifier’s accept projection on a test round, and Vλ,r,1 to be the verifier’s accept projection\non a measurement round. Condition 1 of Lemma 8.2 follows immediately from the structure of\nthe commit-and-measure protocol. Now, consider any prover P ∗such that the first expectation in\ncondition 2 is 1 −negl(λ), meaning that P ∗passes the test round with 1 −negl(λ) probability. By\nthe soundness of the commit-and-measure protocol, there exists a state ρ such that the probability\nthat the verifier accepts on a measurement round is negl(λ)-close to the probability that VFHM\naccepts given x, h, and M(h, ρ), where h = (PRFs(1), . . . , PRFs(ℓ)) for s ←{0, 1}λ. By security\nof the PRF, this probability is negl(λ)-close to the probability that VFHM accepts given x, h, and\nM(h, ρ), where h ←{0, 1}. Since x /\n∈L, soundness of the FHM protocol implies that this is negl(λ).\nThus, the second expectation in condition 2 of Lemma 8.2 is negl(λ), which establishes that this\ncondition is satisfied, and completes the proof.\n9\nThe Fully Succinct Protocol\nIn this section, we compile the verifier-succinct delegation scheme from Section 8 into a full-fledged\ndelegation scheme for QMA. Formally, we assume the existence of a delegation scheme for QMA\nsatisfying the following properties:\n1. All verifier messages can be computed in time poly(λ, log N). (This is the definition of verifier\nsuccinctness.)\n2. Moreover, the verifier messages can be computed obliviously to the QMA instance and the\nprover messages (this holds for the Section 8 protocol).\nWe present two compilers enabling this:\n1. The first (and simpler) compiler only additionally assumes the existence of a collapsing hash\nfunction, which is implied by LWE (Lemma 3.7). It converts a 2r-round verifier-succinct\nprotocol into a 4(r + 1) round fully succinct protocol.\nIn particular, the protocol from\nSection 8 is compiled into a 12-round succinct argument for QMA.\n2. The second compiler additionally assumes collapsing hash function and a (classical, post-\nquantum) fully homomorphic encryption (FHE) scheme.\nIt converts a 2r round verifier-\nsuccinct protocol to a 4r round fully succinct protocol. Moreover, if the verifier-succinct\nprotocol is public-coin (except for the first message), then so is the fully succinct protocol.\nThis results in an 8 round succinct argument system for QMA that is public-coin except for\nthe first message.\nFor simplicity, we write down the compiled protocols in the case r = 2, corresponding to the\nprotocols from Section 8.\nOur main tool for these compilers are post-quantum succinct arguments of knowledge for NP\n[CMSZ21, LMS21]. Specifically, the security guarantees proved in [CMSZ21] are insufficient for\n50\n\n\nthe compilers, because the post-quantum extraction algorithm from [CMSZ21] is not sufficiently\ncomposable since their extractor might significantly disturb the prover’s state. Instead, we make\nuse of a composable variant of the [CMSZ21] extractor due to [LMS21] called “state-preserving\nsuccinct arguments of knowledge,”24 which we now define.\n9.1\nState-Preserving Succinct Arguments of Knowledge\nDefinition 9.1. A publicly verifiable argument system Π for an NP language L (with witness\nrelation R) is an ϵ-state-preserving succinct argument-of-knowledge if it satisfies the following\nproperties.\n• Succinctness: when invoked on a security parameter λ and instance size n and a relation\ndecidable in time T, the communication complexity of the protocol is poly(λ, log T). The\nverifier computational complexity is poly(λ, log T) + ˜\nO(n).\n• ϵ-State-Preserving Extraction.\nThere exists an extractor E(·)(x, ϵ) with the following\nproperties\n– Efficiency: E(·)(x, ϵ) runs in time poly(n, λ, 1/ϵ) as a quantum oracle algorithm\n(with the ability to apply controlled U-gates given an oracle U(·)), outputting a\nclassical transcript ˜\nτ and a classical string w.\n– State-preserving:\nLet |ψ⟩∈A ⊗I be any poly(λ)-qubit pure state and let ρ =\nTrA(|ψ⟩) ∈D(I).25 Consider the following two games:\n∗Game 0 (Real) Generate a transcript τ by running P ∗(ρI, x) with the honest\nverifier V . Output τ along with the residual state on A ⊗I.\n∗Game 1 (Simulated) Generate a transcript-witness pair (˜\nτ, w) ←EP ∗(ρI,x).\nOutput ˜\nτ and the residual state on A ⊗I.\nThen, we have that the output distributions of Game 0 and Game 1 are computa-\ntionally ε-indistinguishable to any quantum distinguisher.\n– Extraction correctness: for any P ∗as above, the probability that ˜\nτ is an accepting\ntranscript but w is not in Rx is at most ϵ + negl(λ).\nTheorem 9.2 ([LMS21]). Assuming the post-quantum poly(λ, 1/ϵ) hardness of learning with\nerrors, there exists a (4-message, public coin) ϵ-state preserving succinct argument of knowl-\nedge for NP.\n24We only require a weak variant of what was constructed in [LMS21], where state preservation is allowed an\ninverse polynomial ϵ error.\n25In general, the prover’s input state on I may be entangled with some external register A, and we ask that\ncomputational indistinguishability holds even given A. Our definition is stated this way for maximal generality,\nthough we remark that the applications in this section do not require indistinguishability in the presence of an\nentangled external register.\n51\n\n\n9.2\nThe QMA Protocol, Version 1\nLet SemiSuccinct denote a verifier-succinct QMA delegation scheme additionally satisfying verifier\nobliviousness. For simplicity, we assume that SemiSuccinct is a four-round protocol. We formalize\nthe execution of SemiSuccinct on a QMA instance x as follows:\n• The verifier computes and sends pk ←SemiSuccinct.V1(1λ, 1|x|; r) (obliviously to the instance\nx) with randomness r ←{0, 1}λ.\n• The prover, on initial state |ψ⟩, computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩), which results\nin a message y and residual state ρ.\n• The verifier computes and sends β = SemiSuccinct.V2(r), obliviously to the instance x and\nthe prover message y.\n• The prover computes and sends z ←SemiSuccinct.P(ρ, β).\n• The verifier computes and outputs a (potentially expensive) predicate V (x, y, z, r).\nFinally, let AoK denote the state-preserving succinct argument of knowledge of Theorem 9.2,\nand let H denote a collapsing hash function family mapping {0, 1}∗to {0, 1}λ. Our succinct QMA\ndelegation protocol QMArg is defined as follows.\n1. The verifier computes and sends pk = SemiSuccinct.V1(1λ, 1|x|; r) with randomness r ←\n{0, 1}λ, along with a hash function h ←Hλ.\n2. The prover computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩) and sends ˆ\ny = h(y).\n3. The prover and verifier execute AoK on the statement “∃w such that ˆ\ny = h(w).”\n4. The verifier computes and sends β = SemiSuccinct.V2(r). Note that SemiSuccinct.V2 is obliv-\nious to the prover message and so can be computed without it.\n5. The prover computes z ←SemiSuccinct.P(ρ, β) and sends ˆ\nz = h(z).\n6. The prover and verifier execute AoK on the statement “∃w such that ˆ\nz = h(w).”\n7. The verifier sends r.\n8. The prover and verifier execute AoK on the statement ∃w1, w2 such that ˆ\ny = h(w1), ˆ\nz = h(w2),\nand V (x, w1, w2, r) = 1.\nCompleteness of the protocol follows directly from the completeness of SemiSuccinct and AoK.\nMoreover, succinctness follows directly from the compression of H, the verifier succinctness of\nSemiSuccinct, and the succinctness of AoK.\nSince AoK has a round complexity of 4 and the first message can be re-used (indeed, h can be\nused as the first message for AoK), the round complexity of QMArg is 12.\n52\n\n\n9.2.1\nProof of Soundness\nTheorem 9.3. Assume that SemiSuccinct is (post-quantum) computationally sound, H is col-\nlapsing,26 and that AoK is an ϵ-state-preserving argument of knowledge.\nThen, QMArg is\n(post-quantum) computationally sound.\nProof. Let x ̸∈L and suppose that a QPT P ∗(ρ, x) breaks the soundness of QMArg with probability\nϵ∗. We use P ∗, together with the soundness guarantees of AoK and the collision resistance property\nof H, to break the soundness of SemiSuccinct. In particular, consider the following attack on the\nsoundness of SemiSuccinct:\n• Set an accuracy parameter ϵ =\nϵ∗\n10.\nWhenever we call the AoK extractor E, we will use\naccuracy parameter ϵ.\n• Given a verifier message pk, we feed (h, pk) to P ∗(ρ, x) and obtain a hash value ˆ\ny. Then, we\nrun the AoK extractor E on P ∗’s execution of step (3) (the first execution of AoK), outputting\na triple (˜\nτ1, ˜\nρ1, y). We send y to the verifier.\n• Given the verifier challenge β, we run P ∗( ˜\nρ1, pk, h, ˜\nτ1) to obtain a message ˆ\nz. Then, we run\nthe AoK extractor E on P ∗’s execution of step (6), obtaining a triple (˜\nτ2, ˜\nρ2, z). We send z\nto the verifier.\nFinally, to analyze the behavior of this attack, we consider the following additional step (this\nis only a mental experiment).\n• Given the secret verifier randomness r, run the AoK extractor E on P ∗’s execution of step\n(8) to obtain a triple (˜\nτ3, ˜\nρ3, y′, z′).\nClaim 9.4. With probability at least ϵ over the attack experiment, we have that SemiSuccinct.V (x,\ny, z, r) = 1.\nNote that this claim contradicts the soundness of SemiSuccinct.\nProof. The equation SemiSuccinct.V (x, y, z, r) = 1 follows from the following properties of an\nexecution of the mental experiment:\n• h(y) = ˆ\ny\n• h(z) = ˆ\nz\n• h(y′) = ˆ\ny\n• h(z′) = ˆ\nz\n• SemiSuccinct.V (x, y′, z′, r) = 1.\n26Collision-resistance of H suffices.\n53\n\n\nThe above suffices because it implies that (y, z) = (y′, z′) except with negligible probabil-\nity by the collapsing (or just collision-resistance) of H, and so the last equation implies that\nSemiSuccinct.V (x, y, z, r) = 1 (except with negligible probability).\nFinally, we note that all five of the above conditions simultaneously hold with probability at\nleast ϵ by the state-preservation and correctness of E.\nMore specifically,\n• The transcript (x, pk, h, ˆ\ny, ˜\nτ1, β, ˆ\nz, ˜\nτ2, r, ˜\nτ3) is accepting (according to the QMArg verifier) with\nprobability at least ϵ∗−3ϵ. This follows by a hybrid argument invoking the state preservation\nof E∗on the three executions of AoK (first w.r.t. ˜\nτ1, then ˜\nτ2, then ˜\nτ3).\n• Then, the correctness property of E implies that all five conditions hold simultaneously with\nprobability at least ϵ∗−6ϵ −negl(λ).\nThis completes the proof of soundness of QMArg.\n9.3\nThe QMA Protocol, Version 2\nWe now describe a public-coin variant of the Section 9.2 transformation that additionally uses a\nFully Homomorphic Encryption (FHE) scheme FHE = (FHE.Gen, FHE.Enc, FHE.Dec, FHE.Eval).\nLet SemiSuccinct and AoK denote the argument systems from Section 9.2. Then, our second\nsuccinct argument system QMArg2 is defined as follows.\n1. The verifier computes and sends pk = SemiSuccinct.V1(1λ, 1|x|; r) with randomness r ←\n{0, 1}λ, along with a hash function h ←Hλ.\n2. The verifier also samples (FHE.pk, FHE.sk) ←FHE.Gen(1λ) and computes FHE ciphertext\nctV = FHE.Enc(FHE.pk, r). The verifier sends FHE.pk, ctV to the prover.\n3. The prover computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩) and sends ˆ\ny = h(y).\n4. The prover and verifier execute AoK on the statement “∃w such that ˆ\ny = h(w).”\n5. The verifier computes and sends β = SemiSuccinct.V2(r). Note that SemiSuccinct.V2 is obliv-\nious to the prover message and so can be computed without it.\n6. The prover computes z ←SemiSuccinct.P(ρ, β) and sends ˆ\nz = h(z). The prover also com-\nputes ctP = FHE.Eval(V (x, y, z, ·), ctV ) and sends ctP to the verifier.\n7. The prover and verifier execute AoK on the statement ∃w1, w2 such that ˆ\ny = h(w1), ˆ\nz = h(w2),\nand ctP = FHE.Eval(V (x, y, z, ·), ctV ).\n8. The verifier checks that FHE.Dec(ctP ) = 1.\nAs before, completeness and succinctness follow immediately from the definitions. Additionally,\nwe note that the round complexity has been reduced to 8 because AoK is only invoked twice.\nFinally, we note that as long as SemiSuccinct and AoK are public-coin (except for the first message\nof SemiSuccinct), then QMArg2 is also public-coin (except for the first verifier message).\n54\n\n\n9.3.1\nProof of Soundness\nTheorem 9.5. Assume that SemiSuccinct is (post-quantum) computationally sound, H is col-\nlapsing, FHE is semantically secure, and that AoK is an ϵ-state-preserving argument of knowl-\nedge. Then, QMArg2 is (post-quantum) computationally sound.\nProof. Let x ̸∈L and suppose that a QPT P ∗(ρ, x) breaks the soundness of QMArg2 with proba-\nbility ϵ∗. We use P ∗, together with the soundness guarantees of AoK, the semantic security of FHE,\nand the collision resistance property of H, to break the soundness of SemiSuccinct. In particular,\nconsider the following attack on the soundness of SemiSuccinct:\n• Set an accuracy parameter ϵ =\nϵ∗\n10.\nWhenever we call the AoK extractor E, we will use\naccuracy parameter ϵ.\n• Given a verifier message pk, we sample h, FHE.pk ourselves and feed (h, pk, FHE.pk, ctV =\nFHE.Enc(FHE.pk, 0)) to P ∗(ρ, x) and obtain a hash value ˆ\ny. Then, we run the AoK extractor\nE on P ∗’s execution of step (3) (the first execution of AoK), outputting a triple (˜\nτ1, ˜\nρ1, y).\nWe send y to the verifier.\n• Given the verifier challenge β, we run P ∗( ˜\nρ1, pk, h, ˜\nτ1) to obtain a message ˆ\nz, ctP . Then, we\nrun the AoK extractor E on P ∗’s execution of step (6), obtaining a triple (˜\nτ2, ˜\nρ2, y′, z). We\nsend z to the verifier.\nWe claim that this attack breaks the soundness of SemiSuccinct – meaning that V (x, y, z, r) = 1\n– with probability at least ϵ∗−4ϵ −negl(λ). To prove this, by FHE semantic security, it suffices to\nshow the same thing when ctV is instead sampled as FHE.Enc(FHE.pk, r).\nFrom here, the proof proceeds similarly to the proof of Theorem 9.3. In particular, the equation\nSemiSuccinct.V (x, y, z, r) = 1 follows from the following properties of the hybrid attack execution:\n• h(y) = ˆ\ny\n• h(y′) = ˆ\ny\n• h(z) = ˆ\nz\n• FHE.Eval(V (x, y′, z, ·), ctV ) = ctP\n• FHE.Dec(FHE.sk, ctP ) = 1.\nThis suffices due to the collapsing of H and the correctness of FHE.Eval. By the same argument\nas in the proof of Theorem 9.3, these properties simultaneously hold with probabiltiy at least\nϵ∗−4ϵ −negl(λ) by the state-preserving extraction properties of AoK.\nThis completes the proof of soundness of QMArg2.\n55\n\n\n10\nAdditional Results\nIn this section, we describe a number of additional new results that follow from our template\nfor building succinct arguments for QMA. First, we show how to compile the protocol from Sec-\ntion 9.3 into a two-message succinct argument for QMA in the quantum random oracle model.\nWe sometimes refer to such argument systems as designated-verifier SNARGs (dvSNARGs) in the\nQROM. Next, we show how to obtain batch arguments for QMA (where the communication size\nonly depends on a single instance size) from only the quantum hardness of learning with errors\n(i.e. without indistinguishability obfuscation). Finally, we describe how to add zero-knowledge to\nour succinct argument in the plain model and to our dvSNARG in the QROM.\n10.1\nSuccinct Non-interactive Arguments in the QROM\nConsider any constant-round protocol (P, V ) for language L that is public-coin except for the first\nmessage. That is, the verifier is defined by two circuits (V0, V1). Given instance x, the verifier first\nsamples random coins r and computes a first message s0 = V0(x, r). Then, the subsequent verifier\nmessage are uniformly random strings s1, . . . , sc of at least λ bits. Finally, the verifier computes a\ncircuit V1(x, r, s0, t0, s1, t1, . . . , sc, tc) that determines whether it accepts or rejects, where t0, . . . , tc\nare the prover messages. Let H : ((I × S) ∪S) × ([c] × T) →S be a random oracle, where I is the\nspace of instances, S is the space of verifier messages, and T is the space of prover messages. Let\n(PFS, VFS) be the following protocol.\n• Given x, VFS samples r and outputs s0 = V0(x, r).\n• PFS runs P on (x, s0) to obtain t0. Then it computes s1 = H((x, s0), (0, t0)) and continues to\nrun P on s1 to obtain t1. Then for i ∈[c], it computes si = H(si−1, (i, ti−1)) and continues\nto run P on si to obtain ti. Finally, it sends (t0, . . . , tc).\n• VFS checks that s1 = H((x, s0), (0, t0)) and that for each i ∈[2, . . . , c], si = H(si−1, (i −\n1, ti−1)). If so, it outputs V (x, r, s0, t0, . . . , sc, tc).\nTheorem 10.1 (Multi-input measure-and-reprogram [DFM20]). Let c be an integer, and W, X, Y\nbe finite sets. There exists a polynomial-time quantum algorithm S such that the following\nholds. Let A be an arbitrary quantum oracle algorithm that makes q queries to a uniformly\nrandom H : (W ∪Y )×X →Y and outputs a tuple (x0, . . . , xc). Then for any b\nx ∈Xc+1 without\nduplicate entries, any predicate V , and any w ∈W,\nPr\ny1,...,yc\n\u0002\n(x0, . . . , xc) = b\nx ∧V (w, x0, y1, x1, . . . , yc, xc) = 1 : (x0, . . . , xc) ←SA(y1, . . . , yc)\n\u0003\n≥\nc!\n(q + c + 1)2c Pr\nH\n\n\n\n\n(x0, . . . , xc) = b\nx ∧V\n\n\n\n\n\nw, x0,\ny1 := H(w, x0), x1,\ny2 := H(y1, x1), x2, . . . ,\nyc := H(yc−1, xc−1), xc\n\n\n\n\n= 1 : (x0, . . . , xc) ←AH\n\n\n\n\n−ϵb\nx,\n56\n\n\nwhere P\nb\nx ϵb\nx = c!/|Y |, and SA is an algorithm that has black-box access to the algorithms\nof A and for each i ∈[c], receives yi and only after outputting xi−1.27\nTheorem 10.2. If (P, V ) is a sound protocol for L, then (PFS, VFS) is a sound protocol for L\nin the quantum random oracle model.\nThe following corollary then follows immediately from the protocol given in Section 9.3.\nCorollary 10.3. Assuming post-quantum indistinguishability obfuscation, the post-quantum\nhardness of the learning with errors problem, and post-quantum fully homomorphic encryp-\ntion, there exists a designated verifier succinct non-interactive argument system (dvSNARG)\nfor QMA in the quantum random oracle model.\nProof. (of Theorem 10.2) Let H : ((I × S) ∪S) × ([c] × T) →S be the random oracle used in\n(PFS, VFS). Consider an adversary A in the protocol (PFS, VFS) that makes q = poly(λ) queries to\nH and consider any x /\n∈L. For any r, let V1,r be the predicate V1 with r hard-coded, and let Ar be\nthe adversary A initialized with (x, V0(x, r)). Define ϵ(r) to be the success probability of Ar (that\nis, the probability it makes VFS output 1). Then for any fixed r,\nϵ(r) = Pr\nH\n\nV1,r\n\n\nx, t0,\ns1 := H((x, V0(x, r), (0, t0)), t1, . . . ,\nsc := H(sc−1, (c −1, tc−1)), tc\n\n= 1 : (t0, . . . , tn) ←AH\nr\n\n.\nNote that the overall success probability A is ϵ := Er[ϵ(r)]. Now, by setting W = (I × S), X =\n([c] × T), Y = S, and w = (x, V0(x, r)), Theorem 10.1 implies that for any fixed r, the success\nprobability δ(r) of the simulator SAr(s1, . . . , sc) is\nδ(r) ≥\n1\npoly(λ)ϵ(r) −negl(λ),\nwhich follows by (i) summing over all t0, . . . , t1 and noting that (0, t0), . . . , (c, tc) contain no dupli-\ncates, and (ii) the fact that q = poly(λ) and c is a constant. Finally, observe that by the soundness\nof (P, V ), Er[δ(r)] = negl(λ). Indeed, by definition SA is a valid cheating prover in the protocol\n(P, V ) since it only receives random si after outputting ti−1. This establishes that\n1\npoly(λ) E\nr [ϵ(r)] −negl(λ) ≤negl(λ),\nwhich implies that ϵ = negl(λ).\n27This theorem as stated is actually a special case of [DFM20, Theorem 7], where w is fixed. In other words, it\ncorresponds to [DFM20, Theorem 7] where the class of adversaries considered all produce a fixed w as the first part\nof their output.\n57\n\n\n10.2\nBatch Arguments for QMA\nNow, we show how to obtain batch arguments for QMA from the post-quantum hardness of learning\nwith errors. We first describe a verifier-succinct protocol for verifying n QMA instances, where the\nverifier message size only grows with the time T needed for QMA verification of a single instance.\nNote that here we do not use the succinct key generation protocol from Section 7.1, and thus do\nnot rely on indistinguishability obfuscation.\nIngredients:\n• Let (PFHM, VFHM) be the non-interactive protocol described in Lemma 8.4 for language L\nwith associated polynomials k(λ), ℓ(λ).\n• Let PMeas = (Commit, Open) and VMeas = (Gen, Test, Out) be the prover and verifier algo-\nrithms for an ℓ(λ)-qubit commit-and-open measurement protocol, defined in Section 4 and\nconstructed in [Mah18].\nThe Protocol:\n• The verifier is initialized with n instances (x1, . . . , xn) ∈{0, 1}λ and the prover is initialized\nwith (x1, . . . , xn) and k(λ) copies of each witness |φj⟩∈RL(xj).\n• The verifier samples h ←{0, 1}ℓ(λ) and defines C such that C(i) = hi. The verifier computes\n(pk, sk) ←Gen(1λ, C) and sends pk to the prover.\n• For each j ∈[n], the prover first computes |ψj⟩←PFHM\n\u0010\nxj, |φj⟩⊗k(λ)\u0011\n, and then computes\n(yj, |stj⟩) ←Commit(pk, |ψj⟩). It sends (y1, . . . , yn) to the verifier.\n• The verifier samples a random challenge c ←{0, 1} and sends c to the prover.\n• For each j ∈[n], the prover computes zj ←Open(|stj⟩, c) and sends (z1, . . . , zn) to the verifier.\n• If c = 0, the verifier checks whether Test(pk, (yj, zj)) = acc and rejects if the test fails\non any index. If c = 1, the verifier computes mj ←Out(sk, (yj, zj)) and checks whether\nVFHM(xj, mj) = acc. The verifier accepts if and only if all of the verifications are successful.\nTheorem 10.4. Let (PBatch, VBatch) be the λ-fold parallel repetition of the above protocol. Then,\n(PBatch, VBatch) satisfies completeness as in Definition 3.1 and soundness as in Definition 3.2.\nMoreover, for instances (x1, . . . , xn) where T is the maximum QMA verification time for any\nindividual xi, the total size of verifier messages is poly(λ, T).\nProof. First, the verifier message guarantee follows immediately from the description of the pro-\ntocol. Completeness follows via the same argument used to prove completeness in Theorem 8.5\n(without the additional step involving the PRF). Soundness also follows along the same lines, ex-\ncept that, if xi /\n∈L, we define V (i)\nλ,r,0 to be the verifier’s accept projection on instance i on a test\nround, and V (i)\nλ,r,1 to be the verifier’s accept projection on instance i on a measurement round.\n58\n\n\nFinally, we observe that Theorem 9.3 holds when the verifier-succinct protocol is replaced with\nthe batch protocol above, with no change in analysis. This results in the following corollary.\nCorollary 10.5. Assuming the post-quantum hardness of the learning with errors problem,\nthere exists a batch argument for QMA, where the total communication is polynomial in the\nQMA verification time for a single QMA instance.\n10.3\nZero Knowledge\nIn this section, we provide sketches for how to obtain the following results.\n• A (non-adaptive) zero-knowledge succinct argument for QMA (in the plain model).\n• A (non-adaptive) zero-knowledge dvSNARG for QMA in the quantum random oracle model.\nIn both of our sketches, we will make use of secure two-party computation for reactive func-\ntionalities, which are interactive functionalities where multiple public circuits may be computed\nsequentially over private inputs, and where the description of these public circuits may be deter-\nmined after some of the private inputs are submitted to the functionality and may even depend on\nthe outputs of previously computed circuits.\nThe plain model.\nHere, we can start with the protocol in Section 9.2. This protocol as such\ndoes not provide any hiding property for the prover’s witness. However, we can use secure two-\nparty computation for the following reactive functionality to hide all information about the prover’s\nwitness from the verifier, while preserving soundness.\n• Take as input random coins rP , rV from each party, compute the verifier’s first message of\nthe protocol using randomness r := rP ⊕rV , and output this message to the prover.\n• For each subsequent round, take as input the prover’s message, and then compute and output\nthe next verifier’s message (using random coins r) to the prover.\n• After the final prover’s message, compute and output the verifier’s verdict (based on all prover\nmessages and r) to the verifier.\nNote that, since the verifier is classical, this functionality can be implemented by a protocol\nfor (post-quantum) secure two-party computation of classical (reactive) functionalities, such as\n[HSS11].28 To argue soundness (for any fixed no instance), we can run the two-party computation\nsimulator for a malicious prover in order to extract inputs from the prover and reduce to soundness\nof the underlying protocol.\nTo argue zero-knowledge (for any fixed yes instance), we can run\nthe two-party computation simulator for a malicious verifier, programming the final output to 1.\nNote that the verifier only receives this single bit of information from the functionality, which is\ninternally running an honest verifier. Thus, this simulation and output is indistinguishable from\nthe real interaction with an honest prover.\n28Note that [HSS11] is based on Watrous rewinding, and thus requires polynomially many rounds of interaction.\nWe do not attempt to optimize the round-complexity of our zero-knowledge protocol, but note that non-black-box\ntechniques such as those of [BS20] (with additional assumptions), or a relaxation to ϵ-zero-knowledge [CCLY21] could\nresult in a constant-round protocol.\n59\n\n\nThe QROM.\nIn order to add zero-knowledge to our two-message succinct argument in the\nQROM, we have to be careful in order to avoid using the random oracle in a non-black-box manner.\nWe achieve this in two steps: We first construct a constant-round honest-verifier zero-knowledge\nargument where, (i) the verifier is public-coin except for the first message, and (ii) the protocol\nremains zero-knowledge even against a verifier that computes its first message maliciously. Second,\nwe compress this protocol into a two-message protocol in the QROM using the same arguments\nin Section 10.1. Since the protocol has constant rounds and is public-coin after the first verifier\nmessage, soundness holds via the same argument. Zero-knowledge holds because we have zero-\nknowledge against a malicious first message, and honest-verifier zero-knowledge with respect to all\nsubsequent messages, which will be sampled uniformly at random by the random oracle.\nWe now turn our attention to the construction of the constant-round honest-verifier zero-\nknowledge argument. We are going to assume the existence of a post-quantum secure two-message\ntwo-party computation protocol for reactive (classical) functionalities. One can instantiate this\nwith the two-message secure computation protocol of [IPS08] based on (post-quantum) two-message\noblivious transfer in the common random string (CRS) model, which we can instantiate from the\npost-quantum hardness of learning with errors [PVW08]. Note that when we later compress this\nprotocol in the QROM, the CRS can be sampled by querying the random oracle on a fixed input.\nWe will use such a protocol to implement the following reactive functionality.\n• Take as input random coins r from the verifier.\n• The verifier’s first message is sampled by the verifier given to the functionality as a public\ninput.\n• Take as input the prover’s first message.\n• The verifier’s second message is sampled by the verifier and given to the functionality as a\npublic input.\n• . . .\n• Take as input the prover’s final message.\n• Check that the verifier’s first message is computed honestly from random coins r, and if so,\ncompute the verifier’s verdict using r, the prover messages, and the verifier’s messages, and\ndeliver this output to the verifier.\nNote that all the verifier messages are still sampled publicly and as in the protocol from Section 9.3,\nso the prover can still compute its responses given these messages.\nNow, we argue that the resulting protocol satisfies the required properties. To argue soundness,\nwe can run the two-party computation simulator for a malicious prover in order to extract inputs\nfrom the prover and reduce to soundness of the original protocol. To argue honest-verifier zero-\nknowledge with a malicious first message, we can run the two-party computation simulator for a\nmalicious verifier, programming the final output to 1. However, since we are allowing the verifier\nto choose its first message maliciously, we have to argue that for any choice of randomness used to\ngenerate the verifier’s first message, the subsequent interaction between honest prover (on input a\n60\n\n\nvalid witness for a true statement) and an honest verifier results in the verifier outputting 1 with\noverwhelming probability. Recalling the structure of the verifier’s first message in the Section 9.3\nprotocol, we see that this requires perfectly correct FHE and a perfectly correct measurement pro-\ntocol. Achieving FHE with perfect correctness is standard by truncating the error distribution, and\nwe can obtain a perfectly correct measurement protocol as discussed in Section 3.5 and Section 4.1.\nReferences\n[ACGH20]\nGorjan Alagic, Andrew M. Childs, Alex B. Grilo, and Shih-Han Hung. Non-interactive\nclassical verification of quantum computation. pages 153–180, 2020. 3, 6, 13, 47, 48,\n65\n[ALM+92]\nSanjeev Arora, Carsten Lund, Rajeev Motwani, Madhu Sudan, and Mario Szegedy.\nProof verification and hardness of approximation problems. pages 14–23, 1992. 1\n[AS92]\nSanjeev Arora and Shmuel Safra. Probabilistic checking of proofs; A new characteri-\nzation of NP. pages 2–13, 1992. 1\n[BCM+18] Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh V. Vazirani, and Thomas\nVidick. A cryptographic test of quantumness and certifiable randomness from a single\nquantum device. pages 320–331, 2018. 18, 19, 20, 27, 28\n[BDGM20] Zvika Brakerski, Nico Döttling, Sanjam Garg, and Giulio Malavolta. Factoring and\npairings are not necessary for io:\nCircular-secure lwe suffices.\nCryptology ePrint\nArchive, Report 2020/1024, 2020. https://ia.cr/2020/1024. 22\n[BFL90]\nLászló Babai, Lance Fortnow, and Carsten Lund. Non-deterministic exponential time\nhas two-prover interactive protocols. pages 16–25, 1990. 1\n[BGI14]\nElette Boyle, ShafiGoldwasser, and Ioana Ivan. Functional signatures and pseudoran-\ndom functions. pages 501–519, 2014. 22\n[BGKW88] Michael Ben-Or, ShafiGoldwasser, Joe Kilian, and Avi Wigderson. Multi-prover in-\nteractive proofs: How to remove intractability assumptions. pages 113–131, 1988. 1\n[BGMZ18] James Bartusek, Jiaxin Guan, Fermi Ma, and Mark Zhandry.\nReturn of GGH15:\nProvable security against zeroizing attacks. pages 544–574, 2018. 22\n[BGV12]\nZvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (Leveled) fully homomor-\nphic encryption without bootstrapping. pages 309–325, 2012. 21\n[BS20]\nNir Bitansky and Omri Shmueli. Post-quantum zero knowledge in constant rounds.\npages 269–279, 2020. 59\n[BV97]\nEthan Bernstein and Umesh Vazirani. Quantum complexity theory. SIAM Journal\non computing, 26(5):1411–1473, 1997. 1\n61\n\n\n[BV11]\nZvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption\nfrom (standard) LWE. pages 97–106, 2011. 21\n[BV14]\nZvika Brakerski and Vinod Vaikuntanathan. Lattice-based FHE as secure as PKE.\npages 1–12, 2014. 21\n[BV17]\nNir Bitansky and Vinod Vaikuntanathan. A note on perfect correctness by derandom-\nization. pages 592–606, 2017. 22\n[BW13]\nDan Boneh and Brent Waters. Constrained pseudorandom functions and their appli-\ncations. pages 280–300, 2013. 22\n[CCLY21]\nNai-Hui Chia, Kai-Min Chung, Xiao Liang, and Takashi Yamakawa. Post-quantum sim-\nulatable extraction with minimal assumptions: Black-box and constant-round. Cryp-\ntology ePrint Archive, Report 2021/1516, 2021. https://ia.cr/2021/1516. 59\n[CCY20]\nNai-Hui Chia, Kai-Min Chung, and Takashi Yamakawa. Classical verification of quan-\ntum computations with efficient verifier. pages 181–206, 2020. 3\n[CLLW20]\nKai-Min Chung, Yi Lee, Han-Hsuan Lin, and Xiaodi Wu. Constant-round blind clas-\nsical verification of quantum sampling. arXiv preprint arXiv:2012.04848, 2020. 1\n[CMSZ21]\nAlessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandry. Post-quantum\nsuccinct arguments: breaking the quantum rewinding barrier. FOCS ’21, 2021. 13, 14,\n50, 51\n[CVW18]\nYilei Chen, Vinod Vaikuntanathan, and Hoeteck Wee. GGH15 beyond permutation\nbranching programs: Proofs, attacks, and candidates. pages 577–607, 2018. 22\n[DFM20]\nJelle Don, Serge Fehr, and Christian Majenz. The measure-and-reprogram technique\n2.0: Multi-round fiat-shamir and more. pages 602–631, 2020. 56, 57\n[DQV+21]\nLalita Devadas, Willy Quach, Vinod Vaikuntanathan, Hoeteck Wee, and Daniel Wichs.\nSuccinct lwe sampling, random polynomials, and obfuscation.\nCryptology ePrint\nArchive, Report 2021/1226, 2021. https://ia.cr/2021/1226. 22\n[FHM18]\nJoseph F. Fitzsimons, Michal Hajdusek, and Tomoyuki Morimae. Post hoc verification\nof quantum computation. Phys. Rev. Lett., 120:040501, Jan 2018. 2, 6, 13, 47, 48\n[Gen09]\nCraig Gentry. Fully homomorphic encryption using ideal lattices. pages 169–178, 2009.\n21\n[GGM84]\nOded Goldreich, ShafiGoldwasser, and Silvio Micali. How to construct random func-\ntions (extended abstract). pages 464–479, 1984. 22\n[GMR85]\nShafiGoldwasser, Silvio Micali, and Charles Rackoff. The knowledge complexity of\ninteractive proof-systems (extended abstract). pages 291–304, 1985. 1\n62\n\n\n[GP21]\nRomain Gay and Rafael Pass. Indistinguishability obfuscation from circular security.\nIn Samir Khuller and Virginia Vassilevska Williams, editors, STOC ’21: 53rd Annual\nACM SIGACT Symposium on Theory of Computing, Virtual Event, Italy, June\n21-25, 2021, pages 736–749. ACM, 2021. 22\n[GVW15]\nSergey Gorbunov, Vinod Vaikuntanathan, and Daniel Wichs. Leveled fully homomor-\nphic signatures from standard lattices. pages 469–477, 2015. 4, 18\n[HSS11]\nSean Hallgren, Adam Smith, and Fang Song. Classical cryptographic protocols in a\nquantum world. pages 411–428, 2011. 59\n[IPS08]\nYuval Ishai, Manoj Prabhakaran, and Amit Sahai. Founding cryptography on oblivious\ntransfer - efficiently. pages 572–591, 2008. 60\n[JLS21]\nAayush Jain, Huijia Lin, and Amit Sahai. Indistinguishability obfuscation from well-\nfounded assumptions. In Samir Khuller and Virginia Vassilevska Williams, editors,\nSTOC ’21: 53rd Annual ACM SIGACT Symposium on Theory of Computing,\nVirtual Event, Italy, June 21-25, 2021, pages 60–73. ACM, 2021. 22\n[Kil92]\nJoe Kilian. A note on efficient zero-knowledge proofs and arguments (extended ab-\nstract). pages 723–732, 1992. 1\n[KPTZ13]\nAggelos Kiayias, Stavros Papadopoulos, Nikos Triandopoulos, and Thomas Zacharias.\nDelegatable pseudorandom functions and applications. pages 669–684, 2013. 22\n[LMS21]\nAlex Lombardi, Fermi Ma, and Nicholas Spooner.\nPost-quantum zero knowledge,\nrevisited (or: How to do quantum rewinding undetectably). Cryptology ePrint Archive,\nReport 2021/1543, 2021. https://ia.cr/2021/1543. 14, 50, 51\n[Mah18]\nUrmila Mahadev. Classical verification of quantum computations. pages 259–267, 2018.\n1, 2, 3, 4, 5, 6, 7, 8, 16, 18, 19, 20, 23, 24, 25, 26, 27, 29, 41, 58\n[Mic94]\nSilvio Micali.\nA secure and efficient digital signature algorithm.\nTechnical Memo\nMIT/LCS/TM-501b, Massachusetts Institute of Technology, Laboratory for Computer\nScience, April 1994. 1\n[PVW08]\nChris Peikert, Vinod Vaikuntanathan, and Brent Waters. A framework for efficient\nand composable oblivious transfer. pages 554–571, 2008. 4, 18, 60\n[PW08]\nChris Peikert and Brent Waters. Lossy trapdoor functions and their applications. pages\n187–196, 2008. 4, 18, 20\n[Reg05]\nOded Regev. On lattices, learning with errors, random linear codes, and cryptography.\npages 84–93, 2005. 18\n[SW14]\nAmit Sahai and Brent Waters. How to use indistinguishability obfuscation: deniable\nencryption, and more. pages 475–484, 2014. 7, 22\n63\n\n\n[Unr12]\nDominique Unruh. Quantum proofs of knowledge. In Annual international confer-\nence on the theory and applications of cryptographic techniques, pages 135–152.\nSpringer, 2012. 16\n[Unr16a]\nDominique Unruh. Collapse-binding quantum commitments without random oracles.\npages 166–195, 2016. 20\n[Unr16b]\nDominique Unruh. Computationally binding quantum commitments. pages 497–527,\n2016. 5, 20\n[Vid20]\nThomas Vidick. Interactions with quantum devices (course), 2020. http://users.\ncms.caltech.edu/~vidick/teaching/fsmp/fsmp.pdf. 2, 8, 9, 29, 35\n[VZ21]\nThomas Vidick and Tina Zhang. Classical proofs of quantum knowledge. pages 630–\n660, 2021. 6\n[WW21]\nHoeteck Wee and Daniel Wichs. Candidate obfuscation via oblivious LWE sampling.\npages 127–156, 2021. 22\nA\nProofs from Section 8\nLemma A.1. Consider a commit-challenge-response protocol with the following properties.\n1. Vλ,r,0 does not depend on r (that is, it is publicly computable given the transcript).\n2. For any P ∗, if Er\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= 1−negl(λ), then Er\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,1\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= negl(λ).\nThen, the protocol has computationally orthogonal projectors.\nProof. Suppose there exists a prover P ∗and a polynomial p(λ) such that for infinitely many λ,\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nEi\n≥1/p(λ).\nDefine an alternate prover b\nP ∗as follows.\n1. b\nP ∗takes as input p(λ)4 copies of P ∗’s auxiliary advice, and pk sampled by the verifier.\n2. Repeat the following at most p(λ)4 times:\n(a) Prepare the state\n\f\n\f\n\fψP ∗\nλ,r\nE\nusing a copy of P ∗’s auxiliary advice.\n(b) Apply the projective measurement\nn\nΠP ∗\nλ,r,0, I −ΠP ∗\nλ,r,0\no\n, which is efficient due to property\n1 of the commit-challenge-response protocol.\n(c) If the first outcome is observed, output the resulting state. Otherwise, repeat.\n3. If b\nP ∗has not terminated, output a dummy state |φ⟩such that ⟨φ| ΠP ∗\nλ,r,0 |φ⟩= 1.\n64\n\n\nLet\n\f\n\f\n\fψ b\nP ∗\nλ,r\nE\nbe the state that results from the above procedure. Finally, let b\nP ∗act identically to\nP ∗after this point.\nNext, let Rterm,λ :=\nn\nr :\nD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n> 1/p(λ)2o\n, and note that for any r ∈Rterm,λ,\nPr\n\n\n\f\n\f\n\fψ\nb\nP ∗\nλ,r\nE\n̸=\nΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n∥ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n∥\n\n≤\n1 −1/p(λ)2\u0001p(λ)4\n≤e−p(λ)2 = negl(λ).\nNow, on the one hand,\n1\n|R|\nX\nr∈Rterm,λ\nD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n≤1\n|R|\nX\nr∈Rterm,λ\nD\nψ\nb\nP ∗\nλ,r\n\f\n\f\n\f Π\nb\nP ∗\nλ,r,1\n\f\n\f\n\fψ\nb\nP ∗\nλ,r\nE\n+ negl(λ)\n≤E\nr\nhD\nψ\nb\nP ∗\nλ,r\n\f\n\f\n\f Π\nb\nP ∗\nλ,r,1\n\f\n\f\n\fψ\nb\nP ∗\nλ,r\nEi\n+ negl(λ)\n≤negl(λ),\nwhere the third inequality follows from property 2 of the commit-challenge-response protocol,\nsince by definition Er\nhD\nψ b\nP ∗\nλ,r\n\f\n\f\n\f Π b\nP ∗\nλ,r,0\n\f\n\f\n\fψ b\nP ∗\nλ,r\nEi\n= 1. On the other hand,\n1\n|R|\nX\nr∈Rterm,λ\nD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n= E\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nEi\n−1\n|R|\nX\nr/\n∈Rterm,λ\nD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,0ΠP ∗\nλ,r,1ΠP ∗\nλ,r,0\n\f\n\f\n\fψP ∗\nλ,r\nE\n≥1/p(λ) −1/p(λ)2,\nwhich is a contradiction, completing the proof.\nTheorem A.2 ([ACGH20]). Consider the λ-fold parallel repetition of any commit-challenge-\nresponse protocol with computationally orthogonal projectors. The probability that the verifier\naccepts all λ parallel repetitions of the protocol is negl(λ).\nProof. Let R be the randomness space of the single repetition protocol, and r = (r1, . . . , rλ) ∈R⊗λ\nbe verifier randomness for the λ-fold parallel repetition. Now, any non-uniform prover P ∗can be\ndescribed by states\nn\f\n\f\n\fψP ∗\nλ,r\nEo\nλ,r and families of unitaries\nn\nU P ∗\nλ,c\no\nλ,c, where c ∈{0, 1}λ ranges over\nall of the verifier challenges.\nFor each c ∈{0, 1}λ, define\nΠP ∗\nλ,r,c := U P ∗\nλ,c\n† (Vλ,r1,c1 ⊗· · · ⊗Vλ,rλ,cλ) U P ∗\nλ,c.\nClaim A.3. For any c1 ̸= c2 ∈{0, 1}λ,\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,c2ΠP ∗\nλ,r,c1 + ΠP ∗\nλ,r,c1ΠP ∗\nλ,r,c2\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= negl(λ).\n65\n\n\nProof. Suppose there exists i ∈[λ] such that (c1)i = 1 and (c2)i = 0 (the other case is symmetric).\nSince for any quantum state |ψ⟩and two projectors Π1, Π2,\n⟨ψ| Π2Π1 + Π1Π2 |ψ⟩≤2| ⟨ψ| Π2Π1 |ψ⟩| ≤2 ⟨ψ| Π2Π1Π2 |ψ⟩1/2 ,\nit then suffices (by Jensen’s inequality) to show that\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,c2ΠP ∗\nλ,r,c1ΠP ∗\nλ,r,c2\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= negl(λ).\nTo see this, let\nV (i)\nλ,ri,b := I ⊗· · · ⊗I ⊗Vλ,ri,b ⊗I ⊗· · · ⊗I,\nfor i ∈[λ], b ∈{0, 1}, and observe that\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,r,c2ΠP ∗\nλ,r,c1ΠP ∗\nλ,r,c2\n\f\n\f\n\fψP ∗\nλ,r\nEi\n≤E\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f U P ∗\nλ,c2\n†V (i)\nλ,ri,0U P ∗\nλ,c2U P ∗\nλ,c1\n†V (i)\nλ,ri,1U P ∗\nλ,c1U P ∗\nλ,c2\n†V (i)\nλ,ri,0U P ∗\nλ,c2\n\f\n\f\n\fψP ∗\nλ,r\nEi\n= E\nri\nhD\nb\nψP ∗\nλ,ri\n\f\n\f\n\f U P ∗\nλ,c2\n†V (i)\nλ,ri,0U P ∗\nλ,c2U P ∗\nλ,c1\n†V (i)\nλ,ri,1U P ∗\nλ,c1U P ∗\nλ,c2\n†V (i)\nλ,ri,0U P ∗\nλ,c2\n\f\n\f\n\f b\nψP ∗\nλ,ri\nEi\n=negl(λ),\nwhere for each ri ∈R,\n\f\n\f\n\f b\nψP ∗\nλ,ri\nE\nis the purification of the mixed state (written in ensemble form)\n\u001a\n1\n|R|λ−1 ,\n\f\n\f\n\fψP ∗\nλ,(r1,...,rλ)\nE\u001b\n(r1,...,ri−1,ri+1,...,rλ)∈R⊗λ−1 ,\nand the final equality follows from the computational orthogonal projectors property of the commit-\nchallenge-response protocol. Indeed, one can define an efficient prover P ∗\ni for the i’th iteration of\nthe commit-challenge-response protocol by defining U P ∗\ni\nλ,0 := U P ∗\nλ,c2 and U P ∗\ni\nλ,1 := U P ∗\nλ,c1 and noting that\n\f\n\f\n\f b\nψP ∗\nλ,ri\nE\nis efficient to prepare while interacting with the i’th iteration of V, by running P ∗and λ−1\ncoherently executed copies of V.\nNow observe that the probability the verifier accepts the parallel repeated protocol is\n66\n\n\n1\n2λ E\nr\n\n\nD\nψP ∗\nλ,r\n\f\n\f\n\f\nX\nc∈{0,1}λ\nΠP ∗\nλ,c,r\n\f\n\f\n\fψP ∗\nλ,r\nE\n\n\n≤1\n2λ E\nr\n\n\n\n\n\nD\nψP ∗\nλ,r\n\f\n\f\n\f\n\n\nX\nc∈{0,1}λ\nΠP ∗\nλ,c,r\n\n\n2 \f\n\f\n\fψP ∗\nλ,r\nE\n\n\n1/2\n\n\n≤1\n2λ E\nr\n\n\n\n\n\nX\nc∈{0,1}λ\nD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,c,r\n\f\n\f\n\fψP ∗\nλ,r\nE\n\n\n1/2\n\n\n+ 1\n2λ\n\n\nX\n{c1,c2}∈({0,1}λ)2\nE\nr\nhD\nψP ∗\nλ,r\n\f\n\f\n\f ΠP ∗\nλ,c2,rΠP ∗\nλ,c1,r + ΠP ∗\nλ,c1,rΠP ∗\nλ,c2,r\n\f\n\f\n\fψP ∗\nλ,r\nEi\n\n\n1/2\n≤1\n2λ/2 + 1\n2λ\n\n\nX\n{c1,c2}∈({0,1}λ)2\nnegl(λ)\n\n\n1/2\n= negl(λ),\nwhere the first inequality holds because\n\f\n\f\n\fψP ∗\nλ,r\nE D\nψP ∗\nλ,r\n\f\n\f\n\f ⪯I, the second inequality uses Jensen’s\ninequality and the fact that projectors are idempotent, and the third inequality follows from\nClaim A.3.\nB\nProof of Claim 6.4\nWe now prove Claim 6.4, which is restated below for convenience.\nClaim B.1. For all (u, v) ∈{0, 1}R × {0, 1}S it holds that\nTr\nΠσx\nu Πσz\nv τ\n\u0001\n=\nE\nu′∈{0,1}R ⟨ψ| ΠZ\nv Z(u′)ΠX\nu′⊕uZ(u′)ΠZ\nv |ψ⟩.\n(7)\nProof. Using the definition of τ, we get\nTr(Πσx\nu Πσz\nv τ) = 2−2N\nX\nr′,s′,r′′,s′′∈{0,1}N\n\u0010\n⟨ψ| Z(s′)X(r′ ⊕r′′)Z(s′′) |ψ⟩H\n\nφ+\f\n\f⊗N σz(s′)σx(r′ ⊕r′′)σz(s′′)\n\u0001\nA1 ⊗(Πσx\nu Πσz\nv )A2\n\f\n\fφ+\u000b⊗N \u0011\n= 2−2N\nX\nr′,s′,r′′,s′′∈{0,1}N\n(−1)(r′⊕r′′)·s′′\u0010\n⟨ψ| Z(s′)X(r′ ⊕r′′)Z(s′′) |ψ⟩H\n\nφ+\f\n\f⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)\n\u0001\nA1 ⊗(Πσx\nu Πσz\nv )A2\n\f\n\fφ+\u000b⊗N \u0011\n.\n(8)\nHowever, most of the terms in Eq. (8) are zero: observe that when (r′ ⊕r′′)j ̸= 0 for any j ∈S, or\n(s′ ⊕s′′)j ̸= 0 for any j ∈R, we have\n\nφ+\f\n\f⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)\n\u0001\nA1 ⊗(σx(u)σz(v))A2\n\f\n\fφ+\u000b⊗N = 0.\n67\n\n\nWe can therefore rewrite Eq. (8) using the following change of variables:\n• Since s′ ⊕s′′ must be 0 on R, the restriction of s′ and s′′ to R must be the same vector\nu′ ∈{0, 1}R. Let the restriction of s′ and s′′ to indices in S be v′, v′′ ∈{0, 1}S respectively.\n• Since r′ ⊕r′′ must be 0 on S, let u′′ ∈{0, 1}R denote the restriction of r′ ⊕r′′ to indices in\nR. Note that for each u′′, there are 2N choices of (r′, r′′) satisfying u′′ = r′ ⊕r′′.\nBy a straightforward calculation, we have for all u′′ ∈{0, 1}R and all s′, s′′ ∈{0, 1}N that\nX\nr′,r′′∈{0,1}N\n(r′⊕r′′)=u′′\n\nφ+\f\n\f⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)\n\u0001\nA1 ⊗(Πσx\nu Πσz\nv )A2\n\f\n\fφ+\u000b⊗N = (−1)u′′·u+(s′⊕s′′)v.\nPlugging this into Eq. (8), and using the fact that (−1)(s′⊕s′′)v = (−1)(v′⊕v′′)v, we obtain\nTr(Πσx\nu Πσz\nv τ) = 2−2N\nX\nu′,u′′∈{0,1}R\nv′,v′′∈{0,1}S\n(−1)(u⊕u′)·u′′+(v′⊕v′′)v\u0010\n⟨ψ| Z(v′)Z(u′)X(u′′)Z(u′)Z(v′′) |ψ⟩H\n\u0011\n=\nE\nu′∈{0,1}R ⟨ψ| ΠZ\nv Z(u′)ΠX\nu⊕u′Z(u′)ΠZ\nv |ψ⟩\nwhere the second equality follows from plugging in the definitions of ΠZ\nv and ΠX\nu⊕u′.\nC\nProof of Claim 6.7\nWe now prove Claim 6.7, which we restate below for convenience.\nClaim C.1. Let k = k(λ) be a positive integer-valued function of a security parameter λ.\nLet {D0,λ}λ≥1 and {D1,λ}λ≥1 be families of distributions on {0, 1}k+1 such that the marginal\ndistributions D′\n0,λ and D′\n1,λ of D0,λ and D1,λ respectively on the first k bits are computationally\nindistinguishable. Suppose that D0,λ and D1,λ are computationally distinguishable. Then there\nis an efficiently computable binary-outcome POVM {M, Id −M} acting on k qubits such that\n\f\n\f\n\f\nE\nx∼D0,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩−\nE\nx∼D1,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩\n\f\n\f\n\f >\n1\npoly(λ).\nProof. By assumption there exists an efficient distinguisher between D0 and D1 (for simplicity we\nomit the index λ from the notation). Let A be a circuit for the distinguisher: A has (k + 1) input\nqubits as well as m ancilla qubits, and a designated output qubit. Let Π1 be the projection on the\noutput qubit being equal to 1. Suppose without loss of generality that\nE\nx∼D0 ⟨x, 0m| A†Π1A |x, 0m⟩>\nE\nx∼D1 ⟨x, 0m| A†Π1A |x, 0m⟩+ 1\nq ,\n(9)\nfor some polynomial q = q(λ). Letting |b⟩k+1 denote the (k + 1)-st qubit, we can write\nE\nx∼D1 ⟨x, 0m| A†Π1A |x, 0m⟩=\nE\nx∼D1 xk+1 ⟨x≤k, 0m| ⟨1|k+1 A†Π1A |1⟩k+1 |x≤k, 0m⟩\n+\nE\nx∼D1(1 −xk+1) ⟨x≤k, 0m| ⟨0|k+1 A†Π1A |0⟩k+1 |x≤k, 0m⟩.\n68\n\n\nLet Mb := ⟨b, 0m| A†Π1A |b, 0m⟩(where b corresponds to the (k + 1)-st qubit); note that Mb is a\npositive semi-define. We can rewrite the right-hand-side as\nE\nx∼D1 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩+\nE\nx∼D1 ⟨x≤k| M0 |x≤k⟩.\n(10)\nUsing a similar expansion while taking the expectation under D0 yields\nE\nx∼D0 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩+\nE\nx∼D0 ⟨x≤k| M0 |x≤k⟩.\n(11)\nPlugging Eqs. (10) and (11) into Eq. (9) gives\nE\nx∼D0 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩−\nE\nx∼D1 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩\n>\nE\nx∼D1 ⟨x≤k| M0 |x≤k⟩−\nE\nx∼D0 ⟨x≤k| M0 |x≤k⟩+ 1\nq .\nFor b ∈{0, 1}, note that {Mb, Id−Mb} is an efficiently computable POVM since it can be performed\nby initializing the (k + 1)-st qubit to |b⟩, the ancilla qubits to |0m⟩, applying A, and measuring\nwhether the output qubit is 1. Since D′\n0 and D′\n1 are computationally indistinguishable, we have\nE\nx∼D0 xk+1 ⟨x≤k, 0m| (M1 −M0) |x≤k, 0m⟩−\nE\nx∼D1 xk+1 ⟨x≤k, 0m| (M1 −M0) |x≤k, 0m⟩\n> 1\nq −negl(λ).\nWe observe that there must exist b ∈{0, 1} such that when M = Mb, we have\n\f\n\f\n\f\nE\nx∼D0 xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩−\nE\nx∼D1 xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩\n\f\n\f\n\f\n>\n1\npoly(λ).\nFinally, by plugging in the identity (−1)b = 1 −2b for b ∈{0, 1} and appealing once again to the\nindistinguishability of D′\n0 and D′\n1, we conclude that\n\f\n\f\n\f\nE\nx∼D0(−1)xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩−\nE\nx∼D1(−1)xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩\n\f\n\f\n\f\n>\n1\npoly(λ).\n69","difficulty":"hard","domain":"Multi-Document QA","length":"medium","question":"In 2404.19574, the paper divided the construction of the succinct argument into four steps. In one step, the main technique comes from 2022-857. Which step is that?","sub_domain":"Academic"}

Source: https://huggingface.co/datasets/zai-org/LongBench-v2

initial import

Posting: /agents

GET /api/v1/write?intent=publish&task_id=46afaf42-42b2-53b0-b75b-9ed1e6f16d88&body={url_encoded_text}&agent_name={optional_name}&nonce={optional_random_id}