LongBench v2 / 66ed4274821e116aacb1f8f1 / In 2404.19574, the paper divided the construction of the succinct argument into…

Succinct arguments for QMA from standard assumptions
via compiled nonlocal games
Tony Metger*1, Anand Natarajan†2, and Tina Zhang‡2
1ETH Zurich
2MIT
Abstract
We construct a succinct classical argument system for QMA, the quantum analogue of NP, from generic and
standard cryptographic assumptions. Previously, building on the prior work of Mahadev (FOCS ’18), Bartusek et
al. (CRYPTO ’22) also constructed a succinct classical argument system for QMA. However, their construction
relied on post-quantumly secure indistinguishability obfuscation, a very strong primitive which is not known from
standard cryptographic assumptions. In contrast, the primitives we use (namely, collapsing hash functions and a mild
version of quantum homomorphic encryption) are much weaker and are implied by standard assumptions such as
LWE. Our protocol is constructed using a general transformation which was designed by Kalai et al. (STOC ’23) as a
candidate method to compile any quantum nonlocal game into an argument system. Our main technical contribution
is to analyze the soundness of this transformation when it is applied to a succinct self-test for Pauli measurements on
maximally entangled states, the latter of which is a key component in the proof of MIP∗= RE in quantum complexity.
*Email: tmetger@ethz.ch
†Email: anandn@mit.edu
‡Email: tinaz@mit.edu
1
arXiv:2404.19754v1  [quant-ph]  30 Apr 2024


Contents
1
Introduction
3
1.1
Technical overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6
2
Preliminaries
12
2.1
Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
2.2
Nonlocal games . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
2.3
Pauli matrices and Heisenberg-Weyl group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
2.4
Reduced measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
13
2.5
State dependent norm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
2.6
Efficient observables and computational indistinguishability
. . . . . . . . . . . . . . . . . . . . . .
15
2.7
Quantum homomorphic encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
15
3
Approximate representation theory
16
3.1
Gowers-Hatami theorem with non-uniform measures . . . . . . . . . . . . . . . . . . . . . . . . . .
16
3.2
Switching distributions for approximate Heisenberg-Weyl group representations . . . . . . . . . . . .
18
3.3
Lifting (anti-)commutation from small-bias sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
20
4
Description of the question-succinct protocol
23
4.1
Compiling nonlocal games using cryptography: the KLVY transformation . . . . . . . . . . . . . . .
23
4.2
Description of question-succinct protocol for QMA . . . . . . . . . . . . . . . . . . . . . . . . . . .
23
4.3
Question types
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
27
5
Modeling and state-dependent norms for the compiled game
28
5.1
Modelling the prover in any compiled game . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
28
5.2
Modelling the prover in Protocol 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
6
Analysis of the question-succinct protocol
32
6.1
Consistency test and “prover switching” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
32
6.2
Analysis of compiled Pauli braiding test: obtaining the group relations . . . . . . . . . . . . . . . . .
34
6.3
Analysis of compiled mixed-vs-pure basis test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
6.4
Subsampled Hamiltonian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
39
6.5
Analysis of the compiled Hamiltonian test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
43
6.6
Analysis of full compiled protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
44
7
Compiling from a question-succinct protocol into a fully succinct protocol using succinct arguments of
knowledge
45
7.1
Post-quantum succinct arguments of knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
46
7.2
[LMS22] extraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
47
7.3
A fully succinct version of Protocol 2
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
51
2


1
Introduction
Succinct verification of computation is a notion that has been extensively studied in the classical setting. A weak
classical client may delegate a classical computation to a powerful server, and may then wish to check whether the
server performed the computation correctly without having to compute the answer for itself. In this case, the client
can ask the server to execute a succinct interactive argument, in which the server (efficiently) convinces the client
beyond reasonable doubt that the computation was performed correctly, and the client only has to do work scaling
with polylogT in order to be convinced, where T is the time that it took to do the computation itself. The messages in
this succinct interactive protocol should also be polylogT in length.
Not long after it came to light that quantum algorithms could outperform the best known classical algorithms in
certain computational tasks, the question was posed of whether a quantum prover could convince a classical verifier of
the answer to a problem in BQP without requiring the classical verifier to simulate the computation itself. For certain
problems, like factoring, a classical verifier can check correctness by exploiting the fact that the problem lies in NP;
however, NP is not known to contain BQP, and for some problems this may be infeasible. This line of inquiry was
initiated by Gottesman in 2004 [Aar07], and has led to a long line of work on the problem now known as quantum
verification.
Succinct quantum verification with a single cryptographically bounded prover.
Mahadev’s work in 2018 [Mah18]
showed that it is indeed possible for an efficient quantum prover to convince a classical verifier of the answer to any
problem in BQP, given that the quantum prover is subject to certain (post-quantum) cryptographic assumptions. (In
fact, her work also showed that it is possible for an efficient quantum prover to convince a classical verifier of the
answer to any problem in QMA, assuming the prover is given polynomially many copies of the witness state for the
QMA problem.) Mahadev’s quantum verification protocol inspired a slew of followup work in which her techniques
were used to design other cryptographic quantum verification protocols with desirable additional properties, e.g. the
property of being non-interactive [BKVV20] or composable [GV19] or linear-time [Zha22]. In 2022, Bartusek et
al. [BKL+22] showed, assuming post-quantum iO, that some version of Mahadev’s protocol can be made succinct, in
the same sense that we described in the opening paragraph: the classical verifier only needs to read messages that are
polylogn bits long, where n is the size of the instance, and do work scaling with polylogT + ˜
O(n), where T is the
time required to execute the verification circuit.
iO, or indistinguishability obfuscation, is an immensely powerful and subtle primitive that has recently been con-
structed from a combination of several standard assumptions [JLS21]. However, some of these assumptions are not
post-quantum, and there is currently no construction of post-quantum iO from standard assumptions. Post-quantum
iO is known to imply other elusive cryptographic objects, e.g. public-key quantum money [Zha21], and constructing
it from standard post-quantum assumptions remains a difficult and important open problem.
The essential difficulty, and the reason for the use of iO in [BKL+22], is that Mahadev’s approach to verification is
in some sense a qubit-by-qubit approach, and requires Ω(𝜆) bits of communication (where 𝜆is the security parameter)
for every qubit in the prover’s witness state, because the verifier needs to send the prover as many Ω(𝜆)-sized public
keys as the witness has qubits. As a result, Mahadev’s approach is difficult to make succinct, since setting up the keys
already requires at least n·Ω(𝜆) bits of communication, where n is the number of qubits in the prover’s witness. The
authors of [BKL+22] use iO in a clever way to compress the keys and thus reduce the amount of required commu-
nication to poly(𝜆) · polylogn; this is the bulk of their work. More specifically, the authors begin by constructing a
question-succinct (short questions, long answers) protocol for verifying QMA using iO. Then they present a general
compiler which uses a recent post-quantum analysis of Killian’s succinct arguments of knowledge [CMSZ22, LMS22]
to turn any question-succinct protocol that satisfies certain properties into a fully succinct protocol.
Our result.
Our main contribution in this paper is to construct succinct classical-verifier arguments for QMA from
standard (and even relatively general) assumptions, without relying on post-quantum iO. More specifically, we prove
the following theorem:
Theorem 1.1 (Informal version of Theorem 7.5). Assume that a quantum levelled homomorphic encryption scheme
3


exists which specialises to a classical encryption scheme when it is used on classical plaintexts.1 Assume also that
post-quantum succinct arguments of classical knowledge exist.2 Then a constant-round classical-verifier argument
system for any promise problem in QMA exists, in which:
(i) the honest quantum prover runs in quantum polynomial time, given polynomially many copies of an accepting
QMA witness state,
(ii) the completeness-soundness gap is a constant, and
(iii) the total communication required is of length polylogn·poly𝜆, where n is the instance size and 𝜆is the security
parameter. The verifier runs in time poly(logT,𝜆)+ ˜
O(n), where T is the size of the QMA verification circuit.
The main advantage of our protocol compared with Bartusek et al.’s protocol [BKL+22] is that our protocol does
not use post-quantum iO, which at this time cannot be instantiated from standard assumptions. Even setting aside the
issue of post-quantum iO, however, we remark that the non-iO assumptions that our approach relies on are more generic
than the Learning With Errors (LWE)–based assumptions which Bartusek et al. use. For example, our approach avoids
using the delicate ‘adaptive hardcore bit’ property of LWE-based trapdoor claw-free functions (TCFs), which was
introduced in [BCM+21] and used in Mahadev’s original verification protocol (as well as Bartusek et al.’s protocol).
The main primitive we rely on, quantum homomorphic encryption (QHE), can be constructed in its usual form from
LWE without the adaptive hardcore bit assumption [Mah17]. Moreover, we do not in fact need all the properties of
standard QHE: for example, we do not use the standard notion of compactness, which says that decryption time cannot
depend on the size of the circuit being evaluated. Instead, we only need a weak notion of compactness which says that
classical ciphertexts encrypted under the QHE scheme should be classically decryptable (in any polynomial time, even
if the decryption time depends on the evaluated circuit). This more general notion of non-compact QHE with classical
decryption for classical ciphertexts plausibly exists from assumptions other than LWE: for instance, [GV24] represents
recent progress in this direction. As such, our approach shows that the important primitive of quantum verification—
and even succinct verification—may exist from a wider range of assumptions than LWE only. (In contrast, a large
number of post-quantum primitives that use techniques from Mahadev’s original verification protocol can only, as far
as we can see, be constructed from LWE.)
We achieve Theorem 1.1 by combining powerful information-theoretic tools which originate in the study of non-
local games (e.g. those found in [dlS22]) with tools that cryptography offers (in particular, cryptographic succinct
arguments of knowledge turn out to be very useful for us). The resulting protocol is (compared with the protocol
designed by Bartusek et al.) a remarkably clean object which has a natural intuitive interpretation. The tool that allows
us to combine self-testing techniques with cryptographic techniques is a compilation procedure introduced by Kalai,
Lombardi, Vaikuntanathan, and Yang [KLVY21], which Natarajan and Zhang [NZ23a] recently exploited in order to
achieve classical-verifier quantum verification using a different approach from Mahadev’s original approach.
A different approach to verification based on nonlocal games.
Since Bell’s historical observation [Bel64] that
there are certain nonlocal games which quantum entangled players can win with higher probability than classical
players, the entangled two-prover model of computation has been a model of great interest in quantum complexity
theory and quantum foundations [Sca13]. A nonlocal game is a game played between a single efficient classical
referee (or verifier) and two or more unbounded players (or provers) who cannot communicate with each other but are
allowed to share entanglement. The study of the computational power of nonlocal games (i.e. what can the verifier
compute efficiently with the help of the provers, if the verifier doesn’t trust the provers?) has led to a fruitful line
of work which, in particular, has shown that the verifier in this setting can decide any problem in RE [JNV+20]. In
addition, it is known [Gri17] that, even if the honest provers are required to be efficient, the verifier can still decide any
1In fact, we do not need all the properties of a typical QHE scheme: for example, we do not use the standard notion of compactness, which
says that decryption time cannot depend on the size of the circuit being evaluated. Instead, we only need a weak notion of compactness which says
that classical ciphertexts encrypted under the QHE scheme should be classically decryptable (in any polynomial time, even if the decryption time
depends on the evaluated circuit). We also expect that the weaker primitive of classical-client quantum blind delegation (in which interaction is
allowed) would likely suffice. These weaker primitives could plausibly be instantiated from weaker assumptions than LWE, since they do not imply
classical FHE, which is only known assuming LWE to date. For recent progress towards this, see [GV24].
2These can be constructed from any collapsing hash function.
4


problem in BQP (or QMA, if one of the provers gets access to polynomially many copies of a witness). Put another
way, quantum verification in the entangled two-prover setting is known to exist.
In 2023 Natarajan and Zhang [NZ23a] presented a reproof of Mahadev’s result which took a different approach
to her original approach, building on previous work on quantum blind delegation [Mah17] and the work of Kalai,
Lombardi, Vaikuntanathan, and Yang [KLVY21]. Kalai, Lombardi, Vaikuntanathan, and Yang used quantum blind
delegation (in particular, quantum homomorphic encryption) in order to design a compilation scheme which maps any
entangled two-prover proof system to a single-prover argument, using cryptography to enforce the no-communication
assumption between the provers. Kalai et al. showed that their compilation scheme preserves quantum completeness
and classical soundness, and Natarajan and Zhang showed that it also preserves quantum soundness for a certain
restricted class of two-prover nonlocal games, which was sufficient to compile a two-prover quantum verification
protocol into a single-prover cryptographic protocol and thus recover Mahadev’s result.
From the point of view of designing succinct arguments, this approach is more attractive than Mahadev’s original
approach as a starting point, because the verifier only needs to send the prover a single public key of length poly(𝜆)
in order to allow it to do homomorphic evaluations. One might then hope to construct a succinct cryptographic
verification protocol for QMA in the following way: start with a succinct two-prover quantum verification protocol,
pass it through the KLVY compiler, and prove soundness using similar techniques to those which Natarajan and Zhang
used in [NZ23a]. This approach avoids using iO entirely, because the KLVY compiler is ‘naturally’ succinct when
applied to a succinct protocol.
Succinct quantum verification in the entangled two-prover setting.
It is therefore natural to ask whether succinct
quantum verification in the entangled two-prover setting is known. The answer to this question is—unfortunately—no,
but for surprisingly complicated reasons. Below is a list of the partial results in this area which are known:
(i) If the honest provers are allowed to be inefficient, and if the (classical) verifier is allowed to take polyn time,
then there is a protocol with polylogn total communication in the entangled two-prover setting to decide QMA
(in fact, to decide all of RE). This was shown by [NZ23b].
Unfortunately, this result is not useful to us if our goal is to compile a succinct two-prover proof system into a
succinct one-prover quantum verification protocol, since we want the honest prover to be efficient.
(ii) In a setting where the verifier interacts with seven provers instead of two, [NV18] claimed to show that efficient-
prover quantum verification of QMA is possible. However, the proof of this result had two substantial errors
in it. One of these errors has been resolved by [JNV+22]. The other one remains unresolved: see this erratum
notice with an explanation of the error [NN24].
Even assuming the errors in [NV18] can be fixed, a seven-prover protocol is not useful to us because the tech-
niques from [KLVY21, NZ23a] were only designed for nonlocal games with two provers. It seems difficult to
extend these techniques to a larger number of provers, which would be necessary to compile the seven-prover
protocol from [NV18].
(iii) Examining the proof of MIP∗= RE from [JNV+20] shows that it relies on two so-called compression theorems:
a question reduction theorem which takes a two-prover nonlocal game with long questions (messages from the
verifier to the provers) and maps it to a nonlocal game with exponentially smaller questions while preserving
most other properties of the game, and an answer reduction theorem which takes a two-prover nonlocal game
with long answers (messages from the provers to the verifier) and maps it to a nonlocal game with exponentially
smaller answers.
One would think that these theorems would make proving succinctness in the nonlocal setting easy. Unfortu-
nately, these compression theorems come with caveats: in particular, the answer reduction theorem can only
be applied to so-called oracularisable protocols, and no one has come up with a two-prover verification pro-
tocol for QMA with efficient honest provers which satisfies this property. Moreover, even supposing that we
had a protocol to which we could apply answer reduction, the answer reduction procedure itself happens to be
so complicated and delicate that there is no clear way to analyse its soundness in the compiled setting, even
given the techniques from [NZ23a] and the additional techniques for compiling nonlocal games which have
been developed since then [CMM+24].
5


Question reduction is both simpler and more lenient, however: while it has never been published, question-
succinct quantum verification for QMA in the two-prover setting can be elegantly obtained from known res-
ults [dlS22, Gri17].
The best of both worlds.
The essential reason that two-prover succinct verification remains an open problem is that
nonlocal answer reduction is hard. The only known way to make the answers in a nonlocal game shorter is to use
an ‘entanglement-sound’ classical PCPP, and constructing this object is arguably the most technical and delicate part
of the proof that MIP∗= RE. On the other hand, one can make the questions in certain (useful) classes of nonlocal
games shorter using only the elegant machinery of de la Salle [dlS22], who simplified the question reduction theorems
of [JNV+20] by rephrasing them in terms of sampling from 𝜖-biased sets. Therefore, in the nonlocal world, question
reduction is now considered to be relatively easy, and answer reduction remains hard.
In Bartusek et al.’s approach to succinct verification, meanwhile, the situation was just the opposite: shortening the
questions in the Mahadev protocol using only cryptography was a significant challenge, and shortening the answers
could be done using known techniques in a relatively black-box manner. Given that this is the case, one might hope to
combine the Bartusek et al. approach with the compilation approach in order that the strengths of each might cancel
out the weaknesses of the other.
This is precisely what we do in this work. We construct a succinct verification protocol for QMA by firstly
compiling, using the KLVY compiler, a question-succinct two-prover protocol for QMA, and then compressing the
answers in a generic way using Bartusek et al.’s Killian-based compiler.
The success of this approach makes a case for using the KLVY compiler as a general way to translate techniques
that are well-understood in the entangled two-prover world into the single-prover cryptographic world. Once this has
been done, they can be combined with ‘natively’ cryptographic techniques in order to marry the desirable properties
of both. It seems plausible that many of the existing results in the sphere of classical-client quantum delegation and
verification could have been obtained in a more unified way and from milder or more generic assumptions if the KLVY
compiler had been known at the time of their genesis, because many tasks that appear difficult in the cryptographic
single-prover setting are well-studied already in the nonlocal setting (and vice versa).
1.1
Technical overview
We focus here on how we obtain question-succinct quantum verification in the single-prover cryptographic setting,
since the Killian-based answer compression protocol and its analysis were already presented in [BKL+22, Section 9],
and we include an exposition-oriented sketch of these results in Section 7 only for completeness.
1.1.1
The basic template from [NZ23a]
Like [NZ23a], our starting point is a basic framework for QMA verification in the two-prover setting due to Grilo [Gri17].
The verifier and the two provers (who we will call Alice and Bob) receive as input an instance of the QMA-complete
promise problem 2-local XZ Hamiltonian [BL08]. In other words, the problem that the verifier is trying to decide is
whether a certain Hamiltonian H on n qubits, expressed as a sum of polynomially many 2-local X/Z Pauli terms (where
each term is a tensor product of n operators, each of which is chosen from {1,𝜎X,𝜎Z}, such that all but 2 factors in
the tensor product are 1), has lowest eigenvalue ≤𝛼or ≥𝛽for two real numbers (𝛼, 𝛽), where we are promised that
𝛽−𝛼≥
1
poly(n).
Honest Alice and Bob start out by sharing n EPR pairs. The two-prover protocol underlying [NZ23a] for deciding
whether H has lowest eigenvalue ≤𝛼or ≥𝛽consists of two subtests, the Pauli braiding test and the energy test:
Protocol 1 (informal).
(i) Pauli braiding. Alice and Bob execute a version of the Pauli braiding protocol from [NV17], in which they
play interleaved copies of CHSH (or another similar game, like Magic Square) and a simple game known as the
‘commutation test’. This protocol is a robust self-test for the n-qubit Pauli group3, in the sense that entangled
3More precisely the Heisenberg-Weyl group, the group consisting of tensor products of 1, 𝜎X, 𝜎Z with ±1 signs, but we ignore this distinction
in this introduction.
6


players who win with high probability in this game must both be playing with measurement operators that are
close (up to local isometries) to actual Pauli measurements. In other words, the Pauli braiding test allows the
verifier to ‘force’ entangled provers to perform Pauli measurements when requested to do so, even without
trusting the provers. The most modular analysis of this protocol proceeds via a theorem from approximate
representation theory that was first proven by Gowers and Hatami [GH15].
(ii) Energy testing via teleportation. Alice is asked to teleport the n-qubit witness state to Bob using their n
shared EPR pairs. She then reports the teleportation corrections to the verifier. Bob is asked to measure certain
Pauli operators and report the outcomes. The verifier corrects Bob’s reported outcomes using Alice’s reported
teleportation corrections, and interprets the result as a measurement of a term from H. It accepts or rejects
depending on whether this measurement indicates that the state which Alice was meant to teleport to Bob is
low-energy or high-energy.
The intuition for the soundness of Protocol 1 is as follows: the Pauli braiding test guarantees in some sense, through
the use of the Gowers-Hatami theorem [GH15], that all successful Bobs are in fact equivalent to honest Bob; and the
energy test is straightforward to analyse if Bob is honest. In order to translate the intuition into reality, we have to
make sure that Bob uses the same strategy in both subtests so that the guarantee on Bob in the Pauli braiding test also
applies to Bob in the energy test. That is, we must make sure he cannot play honestly only in the Pauli braiding test
and then deviate however he likes in the energy test.
Suppose for the moment that the two subtests can be made perfectly indistinguishable to Bob: that is, suppose
that Bob’s questions in both subtests are drawn from the same distribution. This would ensure that he does the same
measurements in both subtests, since he does not know which subtest is being performed. The Pauli braiding subtest
then guarantees that these measurements are ‘close’ to honest measurements, and the soundness of subtest (ii) follows
directly from the soundness of subtest (ii) with an honest Bob.
In [NZ23a], following a template laid out by Vidick in [Vid20], the two subtests were indistinguishable because
Bob’s questions are very simple: in both subtests, Bob only ever receives one of two questions, each with 1
2 probability.
One of these two questions is an instruction to measure all of his qubits in the Z basis (and report all n outcomes), and
the other is an instruction to measure all his qubits in the X basis. Slightly more formally, honest Bob will in one case
apply the projective measurement {|z⟩⟨z| : z ∈{0,1}n}, and in the other case he will apply the projective measurement
{H⊗n|x⟩⟨x|H⊗n : x ∈{0,1}n}.
Measurements of this form, as it turns out, are particularly ‘compatible’ with the Gowers-Hatami-based analysis
of the Pauli braiding test, in a sense that we will make somewhat more precise later (when we explain our ‘mixed-vs-
pure basis test’ later in this overview). It would therefore be convenient if this question structure was also sufficient
for the energy test. Fortunately, this happens to be the case in the non-succinct setting: it turns out that 2-local X/Z
Hamiltonian with inverse polynomial gap is complete for QMA even if we restrict the 2-local terms to XX and ZZ
terms, i.e., terms where the two non-identity components of the n-fold tensor product are always of the same type
(𝜎X or 𝜎Z). Note that the verifier can reconstruct a measurement of any XX-type term from the outcomes of an all-X
measurement performed by Bob, and any ZZ-type term from the outcomes of an all-Z measurement performed by
Bob. This means that in [NZ23a], it was sufficient in both subtests to ask Bob the same two questions (all-X and
all-Z), each with 1
2 probability. Perfect indistinguishability of the two subtests in Protocol 1 then follows.
1.1.2
Obtaining succinctness
In designing a (question-)succinct protocol with two entangled provers (which we will later compile into a crypo-
graphically secure single-prover protocol), we are faced with two new challenges compared with [NZ23a]:
(i) The Pauli braiding test (subtest (i) of Protocol 1) does not have succinct questions. In particular, while Bob’s
questions can easily be made succinct (as we just described, it suffices to have only two Bob questions), Alice’s
questions are more complicated.
(ii) In the non-succinct setting,
1
poly(n) completeness-soundness gap is generally tolerated because it is assumed
that poly(n) many rounds of sequential repetition can be performed in order to boost the gap. In the succinct
setting, this is not feasible, since repeating a succinct protocol poly(n) times results in polylog(n) · poly(n)
7


communication; therefore, in the succinct setting, we must design a protocol which has constant soundness gap
even without any repetition. This means that we cannot start with a 2-local XX/ZZ Hamiltonian, since it is not
known whether this problem is QMA-complete with a constant promise gap. If we are to take the same approach
of starting from some Hamiltonian problem, then it has to be a Hamiltonian problem with constant promise gap
such that the terms can be grouped into a small number of subsets (at most 2polylogn subsets), each of which
contains only terms that commute. If this is the case, then Bob can measure all the terms in a single subset
simultaneously and report all the outcomes together, and the verifier only needs to use polylogn bits to tell Bob
which subset to measure. If this is not the case, then the energy testing template from subtest (ii) of Protocol 1
will not work, since the verifier will not be able to tell Bob which terms he should measure in a succinct way.
Subsampling Hamiltonians.
We take a similar approach to Bartusek et al. [BKL+22] in order to deal with the
second issue. We use naïve QMA parallel amplification (first written down in [KSV02]; the procedure simply repeats
the QMA verifier in parallel a polynomial number of times) in order to boost the promise gap to a constant; this
results in a Hamiltonian that is a sum of exponentially many terms, each of which can be efficiently measured by
measuring each of the n qubits of the witness in either the X or the Z Pauli basis (with potentially different basis
choices for different qubits). We then use a generic PRG with soundness against adversaries with quantum advice in
order to ‘subsample’ these terms and emerge with a Hamiltonian that is a sum of 2polylogn terms, each of which can be
efficiently measured by measuring each of the n qubits of the witness in either the X or the Z Pauli basis. This part of
the work is done in Section 6.4.
The mixed-vs-pure basis test and a new self-testing-oriented proof of Gowers-Hatami.
At this point we have
created a new problem: the terms of the Hamiltonian we want to use in the energy subtest can no longer be measured by
a Bob who only ever measures every qubit of his state in either the X basis or the Z basis. This is because the amplified
Hamiltonian contains tensor products of arbitrary combinations of XX and ZZ terms from the original Hamiltonian,
and not only tensor products of terms in the same basis. These mixed terms can be measured by a Bob who does
what we call mixed basis measurements (measurements that involve measuring each of n qubits in either the X or the
Z basis, with potentially different basis choices for different qubits). However, if the verifier picks the mixed bases
depending on the distribution induced by the constant-gap Hamiltonian, the resulting distribution over Bob questions
is not necessarily ‘compatible’ with even the regular Pauli braiding test. Moreover, it becomes even more difficult to
use anything other than the all-X and all-Z measurements when we consider the succinct version of Pauli braiding, for
reasons that we will elaborate on shortly (in the section ‘Succinct Pauli braiding’).
The natural solution is to use the all-X and all-Z measurements when we play Pauli braiding, use the mixed basis
measurements when we do the energy test, and introduce some sort of consistency test to ensure that the operators that
Bob uses in the energy test are in some sense the same ones as the ones he uses in Pauli braiding. (We call this test
the mixed-vs-pure basis test; the protocol is described in Protocol 7.) Such tests have been analysed in the nonlocal
setting before [NW19], but we are the first to attempt to analyse such a test in the compiled setting, and the compilation
introduces unforeseen difficulties (see ‘Difficulties in the analysis of the mixed-vs-pure basis test’ below).
The easiest solution to the difficulties that we were able to come up with involves reproving the Gowers-Hatami
theorem (or, rather, the parts of the theorem relevant for self-testing) in a way that supports arbitrary non-uniform
expectations. The (informal) theorem statement for our version of Gowers-Hatami is as follows:
Theorem 1.2 (informal). Let f : G →U(H) be a function from a finite group G to the set of unitaries on some
Hilbert space H. Then there exists a finite-dimensional Hilbert space H′, an isometry V : H →H′, and a unitary
representation 𝜋: G →U(H′) of G such that for all measures 𝜇over G,
E
g∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2 ≤𝜖=
⇒
E
g∼𝜇∥f(g)−V †𝜋(g)V∥2 ≤𝜖,
where we are being purposefully vague about the norm.
The difference between this theorem and the more typical formulation is that the typical formulation has uniform
expectations over the group everywhere. A version of Gowers-Hatami similar to Theorem 1.2 is often needed in
the self-testing setting when 𝜇is in particular the uniform distribution over {𝜎Z(a) : a ∈{0,1}n} or {𝜎X(b) : b ∈
{0,1}n}, and it is plausible that Theorem 1.2 could also be proven by modifying in some way Gowers and Hatami’s
8


original proof of their theorem. Nonetheless, the proof that we present under Theorem 3.1 (the formal version of
Theorem 1.2) is an entirely different proof that only uses basic tools from quantum information, namely Stinespring
dilation (instead of matrix Fourier analysis on non-Abelian groups [GH15]). We emphasise that our proof is not a
reproof of the full Gowers-Hatami theorem, because the original theorem gets bounds on the dimension of the ‘post-
rounding’ Hilbert space H′ (which one typically does not need in self-testing-related applications of Gowers-Hatami).
However, our proof has the advantage that it is completely elementary and self-contained. We believe this proof may
be of independent interest, because the fact that it is simple and self-contained makes it easier to modify the statement
when necessary to incorporate additional desirable properties (such as, for example, the tolerance for non-uniform
expectations that we needed for this work). Together with a ‘distribution-switching’ trick presented in Lemma 3.3, we
are able to use this version of Gowers-Hatami to work out an analysis of the mixed-vs-pure basis test. We give more
details about how we did this at the end of the following section.
Difficulties in the analysis of the mixed-vs-pure basis test.
Now we elaborate more thoroughly on the nature of
the difficulties that we encountered in analysing the mixed-vs-pure basis test, which we finally resolved by using
Theorem 3.1 and Lemma 3.3. We firstly justify the sense in which the all-X and all-Z measurements are particularly
‘compatible’ with Pauli braiding, in order to clarify why the consistency test is necessary in the first place.
Why the mixed-vs-pure basis test is necessary.
The reason why the all-X and all-Z measurements are particularly suit-
able for use in the Pauli braiding protocol is that the all-Z question can be interpreted as a simultaneous measurement
of the 2n binary observables {𝜎Z(a) : a ∈{0,1}n}, where 𝜎Z(a) is the binary observable that is the tensor product of
𝜎Z on all the qubits i where ai = 1 and identity otherwise; and, similarly, the all-X question can be interpreted as a sim-
ultaneous measurement of the 2n binary observables {𝜎X(b) : b ∈{0,1}n}. Another (more precise) way to say this is
that, given the (potentially cheating) projective measurement {PZ
u : u ∈{0,1}n} that Bob applies when he receives the
instruction to measure everything in the Z basis, we can construct a set of 2n binary observables {Z(a) : a ∈{0,1}n}
which are exactly linear, in the sense that
Z(a)Z(a′) = Z(a+a′),
(1.1)
even if Bob is dishonest: simply take
Z(a) :=
∑
u∈{0,1}n
(−1)u·aPZ
u .
A similar statement holds true for the all-X measurement: we can define a set of 2n binary observables {X(b) : b ∈
{0,1}n} such that
X(b)X(b′) = X(b+b′).
(1.2)
We can use the CHSH game and the commutation test in order to certify that these 2·2n binary observables {Z(a),X(b) :
a,b ∈{0,1}n} satisfy the commutation relations that would hold if they were genuine Paulis, i.e.
∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2 ≤O(𝜖).
(1.3)
Taking the linearity (Equation (1.1) and Equation (1.2)) and commutation (Equation (1.3)) relations together, we can
prove that {Z(a) : a ∈{0,1}n} and {X(b) : b ∈{0,1}n} approximately satisfy the relations satisfied by the corres-
ponding elements of the Pauli group. Moreover, by taking products, we can extend Z(a) and X(b) to a matrix-valued
function f(s,a,b) = (−1)sZ(a)X(b) that approximately obeys the multiplication law of the Pauli group. The Gowers-
Hatami theorem then implies that there is a rounding of f which exactly satisfies the Pauli group relations (up to
isometry). That is, there exists a representation 𝜌of the Pauli group such that, on average over s,a,b, f(s,a,b) is close
to 𝜌(s,a,b) conjugated by the isometry.
Zooming back out to the level of designing Bob’s questions, note that the all-Z and all-X questions were par-
ticularly nice for the Pauli braiding test because (1) the sets {𝜎Z(a) : a ∈{0,1}n} and {𝜎X(b) : b ∈{0,1}n} taken
together generate the entire n-qubit Pauli group, and (2) the trick of constructing many binary observables from a
9


single projective measurement gave us exact linearity on the Z side and the X side individually almost for free: that is,
{Z(a) : a ∈{0,1}n} is automatically an exact representation of Zn
2, and the same is true of {X(b) : b ∈{0,1}n}.
There is no guarantee that these nice properties hold if we consider (instead of the all-X and all-Z questions) the
set of mixed-basis questions induced by the energy test for our constant-gap Hamiltonian. In particular, there is no
guarantee that the binary observables which can be constructed from Bob’s set of mixed basis measurements will
generate the whole Pauli group, in the way that {𝜎Z(a) : a ∈{0,1}n} and {𝜎X(b) : b ∈{0,1}n} generate the whole
Pauli group. It becomes even more important to use the all-X and all-Z questions if we want to eventually make the
Pauli braiding test question-succinct: we give some intuition as to why this is the case in the section ‘Succinct Pauli
braiding’.
The easiest solution seems to be to introduce a consistency test between Bob’s mixed basis measurements (that
we would like Bob to use when he plays the energy test) and Bob’s pure basis measurements (that we would like
Bob to use when he plays the Pauli braiding test). More specifically—following the standard template for designing
tests of this form—we will introduce two new questions into Alice’s question set that are identical to Bob’s pure basis
questions (i.e. ‘measure all in X’ and ‘measure all in Z’); we will ask Bob to play his pure basis operators against
Alice’s pure basis operators, in order to check that Bob’s pure basis operators are consistent with Alice’s pure basis
operators; and then we will ask Bob to play his mixed basis operators against Alice’s pure basis operators, and check
that they agree whenever the bases align, which (since we checked that Bob’s and Alice’s pure basis operators agree) is
essentially equivalent to checking that Bob’s mixed basis operators are consistent with Bob’s pure basis operators. We
might hope that this test, combined with the usual analysis, will be sufficient to allow us to ‘round’ Bob’s mixed operat-
ors in the same way that we can round Bob’s all-X and all-Z measurements by using the usual Gowers-Hatami analysis.
Difficulties in the analysis.
Unfortunately, instantiating this intuition proves to be nontrivial in the compiled setting,
even though the analysis is fairly routine in the nonlocal setting. The tensor product structure of the provers’ Hilbert
space in the nonlocal setting is useful because it supports a large range of convenient operations that are loosely
grouped together under the name of ‘prover-switching’. The ordinary nonlocal analysis of a consistency test like this
one would proceed primarily through prover-switching calculations. While we did find it necessary to prove some
lemmas which capture certain applications of prover-switching in the compiled setting (see Section 6.1), we found
that these lemmas were insufficient in order to analyse the mixed-vs-pure basis test.
More specifically, the main difficulty we encountered was the following. The statement we would like to show, in
order to make the energy test work in the presence of mixed terms, is of the following form. Let w ∈{1,X,Z}n be a
string indicating which Pauli bases to measure n qubits in. We want to show that, if Alice and Bob win in our protocol
with high probability, then there exists an isometry V such that, for the distribution D on Pauli basis choices induced
by the constant-gap Hamiltonian,
E
w∼D
E
a∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2 ≤small,
where 𝜎w(a) is the honest Pauli observable that corresponds to the tensor product
𝜎w(a) =
O
i
𝜎ai
wi .
and Ow(a) is Bob’s potentially cheating version of 𝜎w(a).
Normal pure-basis Gowers-Hatami tells us that, if Alice and Bob win with high probability in Pauli braiding, then
for any W ∈{X,Z} it is the case that
E
a∈{0,1}n ∥W(a)−V †(𝜎W(a)⊗1aux)V∥2 ≤small,
(1.4)
for some fixed isometry V. One idea for proceeding with the analysis might be to show that Ow(a) ≈Z(c)X(d) using
the mixed-vs-pure basis test (with c being the string such that ci = 1 iff ai = 1 and wi = W, and similarly for d),
and then to ‘round’ Z(c) and X(d) separately using Equation (1.4). Unfortunately, rounding something of the form
Z(c)X(d) naïvely using Equation (1.4) produces something of the form
V †(𝜎Z(c)⊗1aux)VV †(𝜎X(d)⊗1aux)V.
10


Since V is an isometry and not a unitary, VV † is not necessarily 1, and it is unclear how to get rid of it: we call this
the ‘VV † problem’. There are ways to bypass this problem in the nonlocal setting using tensor product structure, but
we were not able to replicate these techniques in the compiled setting.
Instead, we bypass the problem by ‘directly’ proving a form of Gowers-Hatami that, perhaps surprisingly, allows
us to round in expectation over any distribution over the Pauli group, even though the Pauli braiding test is only played
with the uniform distribution. More specifically, we prove our version of Gowers-Hatami (Theorem 3.1, stated earlier
informally as Theorem 1.2), which can be used to round arbitrary distributions over the underlying group, provided
with the right hypothesis; and then we prove, using a ‘distribution-switching’ trick (Lemma 3.3), that the hypothesis
of Theorem 3.1 can be obtained for any distribution 𝜇even if we only start with commutation relations that hold on
uniform average over pure-basis elements (and a few other conditions, such as exact linearity), which is what we have
access to through the pure-basis Pauli braiding test.
Succinct Pauli braiding.
Finally, armed with the mixed-vs-pure basis test, we can focus on making the Pauli braid-
ing test succinct (where, by ‘Pauli braiding test’, we mean the version in which Bob always gets asked either the all-X
or the all-Z question). Our starting point for this mission is de la Salle’s elegant simplification [dlS22] of ‘question
reduction’ from [JNV+20], in which he introduces a version of Pauli braiding where Alice’s questions are sampled
from 𝜖-biased sets. The normal Pauli braiding game proceeds as follows:
• The verifier chooses two strings a,b ∈{0,1}n uniformly at random.
• The verifier decides what to do next based on the parity of a·b:
– If a·b = 0, the verifier referees a commutation game (in which honest Alice plays with 𝜎Z(a) and 𝜎X(b)).
– If a·b = 1, the verifier referees an anticommutation game (in which, again, honest Alice plays by embed-
ding 𝜎Z(a) and 𝜎X(b) into her strategy).
The commutation game is designed to test that two particular operators commute, and the anticommutation game
(based on CHSH or Magic Square) is designed to test that two particular operators anticommute.
Note that the verifier has to send a,b to Alice for this protocol to work. The protocol was made succinct by de
la Salle simply by choosing a,b from 𝜖-biased sets instead of from all of {0,1}n. This is a natural idea, but it is at
first surprising that it works at all: after all, the sets of Paulis {𝜎Z(a) : a ∈S} and {𝜎X(b) : b ∈S} for some 𝜖-biased
S, where |S| = poly(n), only cover an exponentially small fraction of the Pauli group! All that the protocol directly
certifies is commutation and anticommutation relations among pairs of operators in these sets. Naïvely, to deduce
relations about representations of general group elements, one would need to write these elements as poly(n)-length
words in the group elements from the 𝜖-biased sets, and apply the relations on the 𝜖-biased sets poly(n)-many times.
This would seemingly rule out a test with constant soundness.
Miraculously, however, everything still works as before, and the reason is that we do probe the entire group through
Bob, who still measures the all-X and all-Z mesaurements. In particular, we have ‘for free’ (or by construction)
that Bob’s X(b) operators, taken as a set, form an exact representation of Zn
2, and the same for his Z(a) operators.
Meanwhile, all elements of the Pauli group can be written as words of constant length in the operators {𝜎Z(a) : a ∈
{0,1}n} and {𝜎X(b) : b ∈{0,1}n}. In some sense, de la Salle’s test works because probing the commutation relations
between two exact representations of Zn
2 on only an 𝜖-biased set is sufficient to establish the commutation relations
everywhere, because the function of 𝜖-biased sets is precisely to ‘fool’ exactly linear functions. In fact, de la Salle’s
test and its analysis are analogous to the “derandomized BLR test” for linear functions and the Fourier-based analysis
of it presented in Section 6.4 of [O’D14].
In order to use the succinct version of Pauli braiding in our protocol, we have to come up with a version of the
analysis that works in the compiled setting. Unfortunately, de la Salle’s original proof in the nonlocal case is written in
the ‘synchronous’ setting, in which the provers (even malicious provers) are assumed to start out by sharing EPR pairs.
This assumption simplifies the calculations because it allows us to move (‘prover switch’) measurements freely from
one prover to the other. The synchronicity assumption is without loss of generality in the nonlocal setting by [Vid22],
but no compiled version of this result exists. Therefore, we have to redo the proof in our setting using the state-
dependent distance, and come up with ways to use the cryptography to simulate the “prover switching" steps in de
la Salle’s analysis. (At the time of [NZ23a] it was not known whether the cryptography could in fact simulate these
11


properties.) In the process, we pare down de la Salle’s proof to the parts that are essential for analysing succinct Pauli
braiding and state it in more computer-science-like language, which may be useful for future readers with a computer
science background. Our version of de la Salle’s analysis is presented as Lemma 3.5.
Related work.
Simultaneously, a succinct argument system for QMA based only on the post-quantum security
of LWE (a standard assumption) was achieved by [GKNV24]. Both of these works use tools from [BKL+22], in
particular the technique of “subsampling” a Hamiltonian using a PRG, and the technique of transforming a semi-
succinct protocol into a fully succinct one by using succinct arguments of knowledge. However, the methods they use
to solve the key technical challenge of succinctly delegating many-qubit Pauli measurements are essentially disjoint.
In particular, for us, the “heavy lifting" to achieve question-succinctness is performed information theoretically, in
our question-succinct two-prover self-test for EPR pairs, whereas for them, succinctness is achieved by using specific
technical features of a cryptographic construction using LWE.
Acknowledgements.
We are grateful to Fermi Ma for allowing us to rewind him until we could extract an under-
standing from the succinct arguments in Section 9 of [BKL+22]. We also thank Yael Kalai, Alex Lombardi, and
Thomas Vidick for useful discussions. TM acknowledges support from the ETH Zurich Quantum Center and an ETH
Doc.Mobility Fellowship.
2
Preliminaries
2.1
Notation
We assume basic familiarity with quantum states and measurements. We consider finite dimensional Hilbert spaces,
which we commonly denote by H. The set of linear operator A : H →H is L(H), the set of positive semidefinite
A : H →H is Pos(H), and the set of unitaries U : H →H is U(H). For A ∈L(H), we use ∥A∥p := Tr[(A†A)p/2]1/p to
denote its Schatten p-norm. For any (subnormalised) pure state |𝜓⟩, we denote the (subnormalised) density matrix by
𝜓.
For a probability distribution D over some set X, we write x ∼D to denote a sample drawn according to D. We
write x ∼X to denote a sample drawn uniformly from X.
For a,b ∈C and 𝛿> 0, we write a ≈𝛿b if |a−b| ≤𝛿.
2.2
Nonlocal games
In a non-local game, a verifier (or referee) sends questions to multiple non-communicating provers, receives an answer
from each prover, and evaluates the question-answer combination using a verification predicate to decide whether the
provers “win” or “lose” the game. Formally, a two-prover non-local game is specified by the following.
Definition 2.1. A nonlocal game G is given by natural numbers n1,n2,m1,m2, a distribution Q over pairs (x,y) ∈
{0,1}n1 × {0,1}n2, and a polynomial-time verification predicate V(x,y,a,b) ∈{0,1}, where a ∈{0,1}m1 and b ∈
{0,1}m2.
2.3
Pauli matrices and Heisenberg-Weyl group
We use the usual Pauli matrices 𝜎X,𝜎Y,𝜎Z. We will also find it convenient to set 𝜎1 = 1. For w ∈{1,X,Z}n and
a ∈{0,1}n, we define
𝜎w(a) =
O
i
𝜎ai
wi .
We also write 𝜎w = 𝜎w(
⃗
1) = ⊗i𝜎wi.
12


In addition, we define the Pauli projections 𝜋w
a as
𝜋w
u =
O
i
1+(−1)ui𝜎wi
2

=
E
a∈{0,1}n(−1)u·a𝜎w(a).
(2.1)
The Heisenberg-Weyl group on n qubits, denoted Wn, is the group generated by {𝜎X(a),𝜎Z(b)}a,b∈{0,1}n, where the
group operation is induced by matrix multiplication. More formally, to differentiate between the group in the abstract
and its concrete representation in terms of Pauli matrices, we view Wn as a group with generators X1,...,Xn,Z1,...,Zn,
with the multiplication rule given by associating Xi with 𝜎X(ei) and Zj with 𝜎X(ej) (where ei ∈{0,1}n is 0 everywhere
except on position i, where it is 1). We record the representations of Wn in the following lemma.
Lemma 2.2. The irreducible representations of the Heisenberg-Weyl group Wn consist of
• The one-dimensional representations, given by choosing an assignment of 1 or −1 for each of the generators
X1,Z1,...,Xn,Zn
and filling out the rest of the multiplication table accordingly. Note that for any one-dimension irrep 𝜋, 𝜋(−id) =
𝜋(X1Z1X1Z1) = 1, where the first equality uses that X1Z1X1Z1 = −id according to the group relations, and the
second equality uses the representation property and the fact that multiplication of scalars is commutative.
• The ‘fundamental representation’ given by the 2n-dimensional Pauli matrices: that is,
∀j,
Xj 7→𝜎X(e j),
Zj 7→𝜎Z(ej).
2.4
Reduced measurements
We will frequently consider measurements that return tuples as outcomes. For those measurements, it is convenient to
define reduced (or marginalised) measurements, where we only care about some of the elements of the outcome tuple
and ignore the others. For this, we define the following notation.
Definition 2.3. For any alphabet Σ, let u ∈Σn, and let S = {i1,i2,...,ik} ⊆[n]. Then u|S := (ui1,...,uik) ∈Σk is the
restriction of u to S.
Definition 2.4. For any alphabet Σ, w ∈Σn, and W ∈Σ, the set {w = W} is defined as {i ∈[n] : wi = W}.
Definition 2.5 (Reduced measurements). For any alphabet Σ, measurement {Qu}u∈Σn, and set S ⊆[n], we define the
reduced measurement
(Q|S)v∈Σ|S| = ∑
u:u|S=v
Qu.
We will often apply this definition to measurements that measure many qubits, each in one of the Pauli bases, to
select the outcomes corresponding to a single basis. Specifically, for Σ = {0,1}, and for any Pauli string w ∈{X,Z}n,
basis choice W ∈{X,Z}, and string v ∈{0,1}|{w=W}|, we have
(Q|{w=W})v =
∑
u:u|{w=W}=v
Qu ,
In other words (Q|{w=W})v is the marginalisation over all outcomes on indices where wi ̸= W.
13


2.5
State dependent norm
Definition 2.6 (State-dependent inner product and norm). Let H be a finite-dimensional Hilbert space and A,B ∈L(H)
be linear operators on H. Let 𝜓∈Pos(H). We define the state-dependent (semi) inner product of A and B w.r.t 𝜓as
⟨A,B⟩𝜓= Tr[A†B𝜓].
This induces the state-dependent (semi) norm
∥A∥2
𝜓= ⟨A,A⟩𝜓= Tr[A†A𝜓].
Remark 2.7. The state dependent (semi) norm can also be expressed as a Schatten 2-norm (also called the Hilbert-
Schmidt norm):
∥A∥𝜓=



A𝜓1/2


2 .
We collect a number of basic properties of the state dependent norm. These are standard properties and easy to
prove from the definitions.
Lemma 2.8 (Basic properties of the state dependent norm). For all (not necessarily normalised) states 𝜓,𝜓′ ∈Pos(H)
and linear operators A,B ∈L(H) on some finite-dimensional Hilbert space H:
(i) ∥A∥B𝜓B† = ∥AB∥𝜓.
(ii) ∥AB∥𝜓≤∥A∥∞∥B∥𝜓.
(iii) For any unitary U, ∥UA∥𝜓= ∥A∥𝜓.
(iv) Linearity of the squared norm in the state: ∥A∥2
𝜓+𝜓′ = ∥A∥2
𝜓+∥A∥2
𝜓′.
(v) Triangle inequality for the squared norm: ∥A+B∥2
𝜓≤2∥A∥2
𝜓+2∥B∥2
𝜓.
Lemma 2.9. For an observable A on H and two states 𝜓,𝜓on H with ∥𝜓−𝜓′∥1 ≤𝜖, we have that
∥A∥2
𝜓≈∥A∥2
∞𝜖∥A∥2
𝜓′ .
Proof. This follows immediately from the definition of the state dependent norm and Hölder’s inequality.
Lemma 2.10. For all i ∈I (for some index set I) let Ai ∈L(H) and 𝜓i ∈Pos(H) such that ∑i Tr[𝜓i] ≤1. Then
∑
i
∥Ai𝜓i∥1 ≤
r
∑
i
∥Ai∥2
𝜓i .
Proof. We first split 𝜓i = 𝜓1/2
i
𝜓1/2
i
and apply Hölder’s inequality:
∑
i
∥Ai𝜓i∥1 ≤∑
i



Ai𝜓1/2
i



2



𝜓1/2
i



2 .
Now applying Cauchy Schwarz:
≤
s
∑
i



Ai𝜓1/2
i



2
2 ·
s
∑
i



𝜓1/2
i



2
2 ≤
r
∑
i
∥Ai∥2
𝜓i ,
where in the last line we rewrote the first factor as a state-dependent norm and for the second factor] observed that
∑i



𝜓1/2
i



2
2 = ∑i Tr[𝜓i] ≤1.
14


2.6
Efficient observables and computational indistinguishability
Definition 2.11 (Computational indistinguishability). Two families of (subnormalized) states {𝜓1(𝜆)}𝜆and {𝜓2(𝜆)}𝜆,
indexed by a security parameter 𝜆, are compuationally indistinguishable if for any family of computationally eficient
two-outcome POVMs {M(𝜆),1−M(𝜆)}𝜆indexed by 𝜆, it holds that
Tr[M(𝜆)(𝜓1(𝜆)−𝜓2(𝜆)] ≤negl(𝜆).
We typically indicate this by
𝜓1
c
≈𝜓2,
suppressing the dependence on 𝜆in the notation.
Lemma 2.12. Let {U1
a }a∈A,...,{Uk
a}a∈A and {V 1
b }b∈B,...,{V ℓ
b }b∈B be families of efficient unitaries on some Hilbert
space H, s : Ak × Bℓ→{0,1} an efficiently computable function, and 𝜇an efficiently sampleable distribution over
A×k ×B×ℓ.
Consider two states 𝜓
c
≈𝛿𝜓′. Then
E
(a1,...,ak,b1,...,bℓ)∼𝜇



U1
a1 ···Uk
ak −(−1)s(a1,...,ak,b1,...,bℓ)V 1
b1 ···V ℓ
bℓ



2
𝜓
≈𝛿
E
(a1,...,ak,b1,...,bℓ)∼𝜇



U1
a1 ···Uk
ak −(−1)s(a1,...,ak,b1,...,bℓ)V 1
b1 ···V ℓ
bℓ



2
𝜓′ .
Proof. Note that the product of efficient unitaries is another efficient unitary. Then this follows directly from the
definition of computational indistinguishability (Definition 2.11), linearity of expectation, and [MV21, Lemma 2.6].
2.7
Quantum homomorphic encryption
The following definitions are taken with some modifications from [KLVY21]. Note that this definition of quantum
homomorphic encryption requires, among other specialised requirements, that the scheme specialises to a classical
encryption scheme when applied to classical messages: we need this property in our constructions.
Definition 2.13 (Quantum Homomorphic Encryption (QHE)). A quantum homomorphic encryption scheme QHE =
(Gen,Enc,Eval,Dec) for a class of quantum circuits C is a tuple of algorithms with the following syntax:
• Gen is a PPT algorithm that takes as input the security parameter 1𝜆and outputs a (classical) secret key sk of
poly(𝜆) bits;
• Enc is a PPT algorithm that takes as input a secret key sk and a classical input x, and outputs a classical
ciphertext ct;
• Eval is a QPT algorithm that takes as input a tuple (C,|Ψ⟩,ctin), where C : H×(C2)⊗n →(C2)⊗m is a quantum
circuit, |Ψ⟩∈H is a quantum state, and ctin is a ciphertext corresponding to an n-bit classical plaintext. Eval
computes a quantum circuit EvalC(|Ψ⟩⊗|0⟩⊗poly(𝜆,n),ctin) which outputs a ciphertext ctout. If C has classical
output, we require that EvalC also has classical output.
• Dec is a QPT algorithm that takes as input a secret key sk and ciphertext ct, and outputs a state |𝜙⟩. Additionally,
if ct is a classical ciphertext, the decryption algorithm outputs a classical string y.
We require the following three properties from (Gen,Enc,Eval,Dec):
• Correctness with auxiliary input: For every security parameter 𝜆∈N, any quantum circuitC : HA×(C2)⊗n →
{0,1}∗(with classical output), any quantum state |Ψ⟩AB ∈HA ⊗HB, any message x ∈{0,1}n, any secret key
sk ←Gen(1𝜆) and any ciphertext ct ←Enc(sk,x), the following states have negligible trace distance:
15


Game 1. Start with (x,|Ψ⟩AB). Evaluate C on x and register A, obtaining classical string y. Output y and the
contents of register B.
Game 2. Start with ct ←Enc(sk,x) and |Ψ⟩AB. Compute ct′ ←EvalC(·⊗|0⟩poly(𝜆,n),ct) on register A. Compute
y′ = Dec(sk,ct′). Output y′ and the contents of register B.
In words, “correctness with auxiliary input” requires that if QHE evaluation is applied to a register A that is
a part of a joint (entangled) state in HA ⊗HB, the entanglement between the QHE evaluated output and B is
preserved.
• IND-CPA security against quantum distinguishers: For any two messages x0,x1 and any QPT adversary A:



Pr

AEncsk(·)(ct0) = 1




sk ←Gen(1𝜆)
ct0 ←Enc(sk,x0)

−Pr

AEncsk(·)(ct1) = 1




sk ←Gen(1𝜆)
ct1 ←Enc(sk,x1)




≤negl(𝜆) .
• Relaxed compactness: We do not need the typical notion of homomorphic encryption compactness, which
states that decryption must not depend on the evaluated circuit. However, we do require the following (much
weaker) properties:
– Classical-quantum (CQ) compactness. There is a PPT algorithm DecClassical which, for any entirely
classical ciphertext ct′ originating from the experiment ‘Game 2’ described in ‘Correctness with auxiliary
input’, satisfies the definition of correctness with auxiliary input when substituted for Dec.
– Compactness of encryption. The running time of Enc on input single-bit messages should not be larger
than poly(L)·polylog(S)·poly(𝜆), where L is a depth upper bound on the circuits that need to be evaluated
and S is a size upper bound. (Note that this restriction does not apply to Eval.)
Compactness of encryption, which we require in order to achieve the question-succinctness of Protocol 2, is a
property satisfied by most levelled homomorphic encryption schemes. This property suffices for us because all of the
‘Alice’ computations in Protocol 3 can be done by log depth circuits (log in the instance size n), and for question
succinctness we just need the verifier’s questions to be polylogn in length (and computable in the same time).
3
Approximate representation theory
3.1
Gowers-Hatami theorem with non-uniform measures
The Gowers-Hatami theorem [GH15] states that if a function f : G →U(H) from a finite group to unitary matrices
approximately behaves like a representation, then it can be “rounded” to an exact representation. The formulation of
this statement in [GH15] required that the “approximate representation behaviour” hold on average over uniformly
sampled pairs of group elements. As explained in the introduction, we require a similar statement, but for arbitrary
measures over the group. Formally, we show the following.
Theorem 3.1. Let f : G →U(H). Then there exists a finite-dimensional Hilbert space H′, an isometry V : H →H′,
and a unitary representation 𝜋: G →U(H′) of G such that for all measures 𝜇over G and all normalised states 𝜓,
E
g∼𝜇,h∼Wn ∥f(h)f(g)−f(hg)∥2
𝜓≤𝜖=
⇒
E
g∼𝜇∥f(g)−V †𝜋(g)V∥2
𝜓≤𝜖.
Proof. Let HG be the complex space of formal sums of group elements and define a representation 𝜋: G →L(HG) by
𝜋(g) = ∑
h∼Wn
|h⟩⟨hg|.
16


It is clear that 𝜋is a unitary representation of G (in fact, 𝜋is just the regular representation, written in Dirac notation).
We define the convolution of f with itself as
f ∗(g) = E
h∼Wn f(h)† f(hg).
With this, we can define a superoperator 𝜙: L(HG) →L(H) by taking the linear extension of
𝜙(|g⟩⟨h|) = 1
|G| f ∗(g−1h).
Since f(g) is always unitary, it follows immediately that 𝜙is unital, i.e. 𝜙(1) = 1. We further claim that 𝜙is completely
positive. To show this, it suffices to show that the Choi operator
C = ∑
g,h
𝜙(|g⟩⟨h|)⊗|g⟩⟨h| ∈L(H⊗HG)
is positive. For this, take any |x⟩∈H⊗HG and decompose it as
|x⟩= ∑
g
|xg⟩|g⟩.
Here, |xg⟩are not necessarily orthogonal or normalised. Then,
⟨x|C|x⟩= ∑
g,h
⟨xg|𝜙(|g⟩⟨h|)|xh⟩
= 1
|G| ∑
g,h
⟨xg|f ∗(g−1h)|xh⟩
=
1
|G|2 ∑
g,h,l
⟨xg|f(l)† f(lg−1h)|xh⟩
=
1
|G|2 ∑
g,h,l
⟨xg|f(lg)† f(lh)|xh⟩
=
1
|G|2 ∑
l
⟨𝜉l|𝜉l⟩≥0,
with |𝜉l⟩= ∑g f(lg)|xg⟩, where we relabelled l 7→lg in the fourth line.
Having shown that 𝜙is unital and completely positive, we can apply Stinespring’s dilation theorem to deduce that
there exists some auxiliary space K and an isometry V : H →HG ⊗K such that for all A ∈L(HG),
𝜙(A) = V †(A⊗1K)V .
To relate this back to the original question of rounding the approximate representation f, we observe that
f ∗(g) = 𝜙(𝜋(g)) = V †(𝜋(g)⊗1K)V .
Taking the isometry in the theorem statement to be V and the exact representation 𝜋(g)⊗1K (which, in a slight abuse
of notation, we again just call 𝜋), we can therefore bound
E
g∼𝜇∥f(g)−V †𝜋(g)V∥2
𝜓= E
g∼𝜇∥f(g)−f ∗(g)∥2
𝜓
= E
g∼𝜇∥E
h∼Wn( f(g)−f(h)† f(hg))∥2
𝜓
≤
E
g∼𝜇,h∼Wn ∥f(g)−f(h)† f(hg)∥2
𝜓
=
E
g∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2
𝜓≤𝜖,
where the inequality follows from Cauchy-Schwarz and the last line uses left-unitary invariance of the state dependent
norm (Item (iii)) and the assumption that f is an approximate representation.
Remark 3.2. Observe that if f is exactly left-multiplicative over some 𝜇, i.e. if f(g) f(h) = f(gh) for all g ∈supp(𝜇)
and for all h ∈G, then f(g) = V †𝜋(g)V for all g ∈supp(𝜇).
17


3.2
Switching distributions for approximate Heisenberg-Weyl group representations
We will be particularly concerned with approximate representations of the Heisenberg-Weyl group. The following
lemma shows that if a collection of operators {Z(a),X(b)}a,b∈{0,1}n satisfies certain properties for uniform expectations
over the group, these operators can be rounded to Pauli operators for arbitrary expectations. We note that this switch
from uniform to arbitrary measures does not work in general and crucially relies on each of {Z(a)} and {X(b)} being
an exact representation of Zn
2.
Lemma 3.3. Suppose we have collections of efficient binary observables {Z(a)}a∈{0,1}n and {X(b)}b∈{0,1}n on a
Hilbert space H that each form exact representations of Zn
2, i.e. for all a,b ∈{0,1}n, Z(a + b) = Z(a)Z(b) and
X(a+b) = X(a)X(b). Consider a state 𝜓and suppose that the following conditions hold: Suppose that
E
a Z(a)𝜓Z(a)
c
≈𝜓,
(3.1)
E
a X(a)𝜓X(a)
c
≈𝜓,
(3.2)
E
a,b∈{0,1}n



Z(a)X(b)−(−1)a·bX(b)Z(a)



2
𝜓≤𝜖.
(3.3)
Then there exists an isometry V : H →C2n ⊗Haux such that for all distributions 𝜇on {0,1}n ×{0,1}n,
E
(a,b)∼𝜇


Z(a)X(b)−V †(𝜎Z(a)𝜎X(b)⊗1Haux)V


2
𝜓≤O(𝜖).
Proof. Define the following function from the Heisenberg-Weyl group to U(H):
f(±𝜎Z(a)𝜎X(b)) = ±Z(a)X(b).
Our proof strategy is as follows: first show that f is an approximate representation over arbitrary measures 𝜇, i.e. that
it satisfies the hypothesis of Theorem 3.1; then use Theorem 3.1 and the structure of the irreps of the Heisenberg-Weyl
group to round Z(a) and X(b) to the corresponding Pauli operators.
To show that f is an approximate representation, we first bound the following quantity for an arbitrary measure 𝜇
on {0,1}n ×{0,1}n.
E
a,b∈{0,1}n
E
(c,d)∼𝜇



X(a)Z(b)X(c)Z(d)−(−1)b·cX(a+c)Z(b+d)



2
𝜓
By Lemma 2.12 and Lemma 2.8 Item (iv):
≈negl
E
u∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇



X(a)Z(b)X(c)Z(d)−(−1)b·cX(a+c)Z(b+d)



2
Z(u)𝜓Z(u)
By Lemma 2.8 Item (i):
=
E
u∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇



X(a)Z(b)X(c)Z(d +u)−(−1)b·cX(a+c)Z(b+d +u)



2
𝜓
Again applying Lemma 2.12 and Lemma 2.8 Item (i) and Item (iv) to Ev X(v)𝜓X(v)
c
≈𝜓:
≈negl
E
u,v∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇



X(a)Z(b)X(c)Z(d +u)X(v)−(−1)b·cX(a+c)Z(b+d +u)X(v)



2
𝜓
By Equation (3.3) (noting that the marginal distributions of d +u and b+d +u are both uniform and independent from
v) and Lemma 2.8 Item (ii):
=
E
u,v∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇



(−1)v·(d+u)X(a)Z(b)X(c+v)Z(d +u)−(−1)b·c+v·(b+d+u)X(a+c+v)Z(b+d +u)



2
𝜓+O(𝜖)
18


Repeating the same step (now noting that c+v and d +u are independent and uniform, and likewise for a+c+v and
b+d +u) and cancelling phases:
=
E
u,v∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇



(−1)c·(d+u)X(a)Z(b+d +u)X(c+v)−(−1)b·c+v·(b+d+u)X(a+c+v)Z(b+d +u)



2
𝜓+O(𝜖)
With one more repetition of the same step, we finally get:
=
E
u,v∈{0,1}n
E
a,b∈{0,1}n
E
(c,d)∼𝜇∥X(a+c+v)Z(b+d +u)−X(a+c+v)Z(b+d +u)∥2
𝜓+O(𝜖) = O(𝜖).
From the above calculation and the fact that f is exactly multiplicative under ±1 we get that f is an approximate
representation of the Heisenberg-Weyl group Wn for any distribution 𝜇over the group. Expressed in equations, we
have shown that for any distribution 𝜇on Wn,
E
g∼𝜇,h∼Wn ∥f(h) f(g)−f(hg)∥2
𝜓≤O(𝜖).
Furthermore from the definition of f we have that f is exactly multiplicative under ±1, which we can also write
(slightly cumbersomely) as
E
g∼𝜇−,h∼Wn ∥f(h)f(g)−f(hg)∥2
f = 0,
where 𝜇−is the point distribution that has all its weight on the −1-element of Wn.
We can therefore apply Theorem 3.1 and, noting that in that theorem the representation 𝜋and the isometry V are
independent of the distribution 𝜇, get that there exists an isometry V : H →H′ and a unitary representation 𝜋of Wn on
H′ such that
E
g∼𝜇


f(g)−V †𝜋(g)V


2
𝜓≤O(𝜖),
(3.4)
E
g∼𝜇−


 f(g)−V †𝜋(g)V


2
𝜓=


1+V †𝜋(−1)V


2
𝜓= 0.
(3.5)
For Equation (3.5), we used that f(−1) = −1.
Equation (3.4) shows that f can be rounded to some representation of the Heisenberg-Weyl group. However, we
want a stronger statement: we want to show that we can round f to the actual Pauli matrices (tensored with identity),
whereas an arbitrary representation might contain other representations of Wn.
For this, we write 𝜋(g) = 𝜋+(g) ⊕𝜋−(g) where 𝜋±(·) is a representation satisfying 𝜋±(−g) = ±𝜋±(g) for all g.
By Lemma 2.2, any representation of the Pauli group can be written this way, by decomposing it into a direct sum
of irreducible representations, and grouping together all the one-dimensional irreps into 𝜋+, and all the copies of the
fundamental representation into 𝜋−. Moreover, by padding with copies of the trivial representation (and adding all-0
rows to V appropriately), we can ensure that dim(𝜋+) = kdim(𝜋−). As such, we assume without loss of generality
that dim(𝜋+) = kdim(𝜋−).
The intuition for the remainder of the proof is as follows: we will simply replace the 𝜋+-part of the representation
with k copies of the 𝜋−-part; call this modified representation 𝜋′. Of course 𝜋and 𝜋′ now differ a lot as representations,
but we need to show that after applying the isometry V and in the state-dependent norm, this difference does not matter.
This will follow from Equation (3.5).
More formally, we define
𝜋′(g) :=

𝜋−(g)⊗Ik
𝜋−(g)

h′(g) := V †𝜋′(g)V .
We will also use the notational shorthand
h(g) = V †𝜋(g)V.
19


Note that because 𝜋−only consists of copies of the fundamental representation (the Pauli matrices), so does 𝜋′.
This means that 𝜋′ is of the form we claimed in the theorem, i.e. it is a tensor product of the Pauli matrices with
identities.
It therefore suffices to show that ∥h′(g)−h(g)∥𝜓= 0. To see that this is the case, note that since 𝜋−(g) ≤1,
∥h′(g)−h(g)∥2
𝜓= ∥V †

𝜋−(g)⊗Ik −𝜋+(g)
0

V∥2
𝜓
≤




V †

2·1
0

V




2
𝜓
=


V †(𝜋(1)+ 𝜋(−1))V


2
𝜓
=


1+V †𝜋(−1)V


2
𝜓= 0.
The last line uses Equation (3.5). This completes the proof.
3.3
Lifting (anti-)commutation from small-bias sets
In [dlS22], de la Salle gave a question-succinct version of the Pauli braiding test of [NV17]. The key step in his proof is
to show that if (anti-)commutation statements for a certain set of observables hold on average over a 𝜆-biased set, they
also hold on average over all observables (up to small corrections). We need a similar statement, but unfortunately
we cannot use the result from [dlS22] directly since it is proven in the Frobenius norm, whereas we need it in the
state-dependent norm. Additionally, since we want to use this step for compiled games, we cannot use the full suite of
techniques from non-local games (in particular, we cannot use prover switching). We remedy this situation by proving
the following variant of de la Salle’s result. This also gives a more elementary proof of de la Salle’s original result.
Definition 3.4. A set S ⊆{0,1}n is 𝜆-biased if for all b ∈{0,1}n such that b ̸= 0n,
| E
a∈S(−1)a·b| ≤𝜆.
It is known how to efficiently construct a 𝜆-biased set S of size O(n/poly(𝜆)) using error correcting codes [NN90].
In our applications, 𝜆will always be a universal constant.
Lemma 3.5. Let M and {W(a)}a∈{0,1}n be efficient binary observables acting on a Hilbert space H satisfying
W(a)W(b) = W(a+b) and 𝜌a state on H such that
𝜌
c
≈𝛿E
a W(a)𝜌W(a).
Further let S ∈{0,1}n be a 𝜆-biased set. Then
E
a∈{0,1}n ∥W(a)M −MW(a)∥2
𝜌≤
1
1−𝜆E
a∈T ∥W(a)M −MW(a)∥2
𝜌+
2𝛿
1−𝜆.
Proof. Let T ⊆{0,1}n be an arbitrary set (later we will set T = S or T = {0,1}n). Define ˜
𝜌= EaW(a)𝜌W(a). By
Lemma 2.12, for any a ∈{0,1}n it holds that
∥W(a)M −MW(a)∥2
𝜌≥∥W(a)M −MW(a)∥2
˜
𝜌−𝛿.
Consequently, this also holds on average over a ∈T, i.e.
E
a∈T ∥W(a)M −MW(a)∥2
𝜌≥E
a∈T ∥W(a)M −MW(a)∥2
˜
𝜌−𝛿.
(3.6)
Using that M and Z(a) are binary observables,
E
a∈T ∥W(a)M −MW(a)∥2
˜
𝜌= 2−2ℜE
a∈T Tr[MW(a)MW(a) ˜
𝜌] .
20


Our goal is therefore to relate the trace expression for T = Zn
2 and T = S. For this, observe that W(a) forms a unitary
representation of Zn
2, which we can decompose into a direct sum of irreducible representations:
W(a) = ˜
UD(a) ˜
U† ,
D(a) = ⊕i ((−1)𝛾i·a ⊗1mi)
for U ∈U(H) and distinct strings 𝛾i ∈Zn
2 with multiplicities mi such that ∑i mi = dimH. In this basis, ˜
𝜌has a
block-diagonal structure made up of blocks of size mi, i.e.
˜
U† ˜
𝜌˜
U = ⊕i𝜌i
for positive semi-definite blocks 𝜌i of dimension mi. For each i, let Wi ∈U(mi) be a unitary that diagonalises 𝜌i and
define
U = ˜
U(⊕iWi).
This is a unitary and by construction,
𝜎:= U† ˜
𝜌U = diag(𝜎1,...,𝜎dimH)
is diagonal. Furthermore, (⊕iWi) commutes with all matrices D(a), so that we also have
W(a) = UD(a)U† ,
D(a) = ⊕dimH
i
((−1)ci·a) ,
where ci ∈{0,1}n are the same as the 𝛾i above, except that for the rest of the proof we find it more convenient to
repeat strings rather than keeping track of their multiplicities by tensoring with identity.
For convenience, we define
Γ = U†MU .
Then, we can rewrite
E
a∈T Tr[MW(a)MW(a) ˜
𝜌] = E
a∈T Tr[ΓD(a)ΓD(a)𝜎]
= E
a∈T ∑
i, j,k
Γij(−1)c j·aΓ jk(−1)ck·a𝜎ki
= ∑
i, j,k

E
a∈T(−1)(c j+ck)·a

ΓijΓ jk𝜎ki
Since 𝜎= diag(𝜎i):
= ∑
i, j

E
a∈T(−1)(c j+ci)·a

ΓijΓ ji𝜎i
Since M is Hermitian, so is Γ, so that Γji = Γ∗
i j:
= ∑
i, j

E
a∈T(−1)(c j+ci)·a

|Γij|2𝜎i .
We now divide up the indices i, j over which we sum into two sets:
C = {(i, j) | ci ̸= cj},
¯
C = [dimH]2 \C.
If (i, j) ∈¯
C, then
E
a∈Zn
2
(−1)(c j+ci)·a = E
a∈S(−1)(c j+ci)·a = 1.
21


On the other hand, if (i, j) ∈C, then since S is 𝜆-biased we have that
E
a∈Zn
2
(−1)(c j+ci)·a = 0,
| E
a∈S(−1)(c j+ci)·a| ≤𝜆.
We therefore get
E
a∈{0,1}n ∥W(a)M −MW(a)∥2
˜
𝜌= 2−2 ∑
i, j∈¯
C
|Γij|2𝜎i
and, since |Γij|2𝜎i ≥0,
E
a∈S∥W(a)M −MW(a)∥2
˜
𝜌≥2−2 ∑
i, j∈¯
C
|Γij|2𝜎i −2𝜆∑
i, j∈C
|Γij|2𝜎i .
We can simplify this by observing that since Γ is a binary observable,
∑
i j
|Γij|2𝜎i = Tr[Γ†Γ𝜎] = 1.
As a result,
E
a∈S∥W(a)M −MW(a)∥2
˜
𝜌≥2−2 ∑
i, j∈¯
C
|Γij|2𝜎i −2𝜆
 
1−∑
i, j∈¯
C
|Γij|2𝜎i
!
= (1−𝜆) E
a∈Zn
2
∥W(a)M −MW(a)∥2
˜
𝜌.
The lemma now follows by first switching from 𝜌to ˜
𝜌on both sides using Equation (3.6) (incurring an error 𝛿+
𝛿
1−𝜆≤
2𝛿
1−𝜆) and then using the above bound.
Lemma 3.5 implies the following corollary on anti-commutation relations.
Corollary 3.6. Let {X(a)}a∈{0,1}n and {Z(a)}a∈{0,1}n be families of efficient binary observables acting on a Hilbert
space H satisfying W(a)W(b) = W(a+b) for all W ∈{X,Z} and a,b ∈{0,1}n. Let 𝜌be a state on H such that
𝜌
c
≈𝛿E
a W(a)𝜌W(a).
for all W ∈{X,Z}. Further, let S ∈{0,1}n be a 𝜆-biased set. Then
E
a,b∈{0,1}n ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜌≤
1
(1−𝜆)2
E
a,b∈S∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜌+ 2𝛿(2−𝜆)
(1−𝜆)2 .
Proof. Let 𝜌′
AB = 𝜌A ⊗1
2n IB. For W ∈{X,Z}, define
˜
W(a)AB = W(a)A ⊗𝜎W(a)B.
Observe that
[ ˜
Z(a), ˜
X(b)] = (Z(a)X(b)−(−1)a,bX(b)Z(a))⊗𝜎Z(b)𝜎X(a).
Moreover, for any operators M on the A system and N on the B system, it holds that
∥M ⊗N∥2
𝜌′ = Tr[M†M ⊗N†N𝜌′]
= 1
2n Tr[M†M𝜌]·Tr[N†N]
= ∥M∥2
𝜌· 1
2n Tr[N†N].
22


Thus, we have
E
a,b∈{0,1}n∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜌
=
E
a,b∈{0,1}n ∥[ ˜
Z(a), ˜
X(b)]∥2
𝜌′
≤
1
1−𝜆E
a∈S
E
b∈{0,1}n ∥[ ˜
Z(a), ˜
X(b)]∥2
𝜌′ +
2𝛿
1−𝜆
≤
1
(1−𝜆)2
E
a,b∈S∥[ ˜
Z(a), ˜
X(b)]∥2
𝜌′ +2𝛿

1
1−𝜆+
1
(1−𝜆)2

=
1
(1−𝜆)2
E
a,b∈S∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜌+2𝛿

1
1−𝜆+
1
(1−𝜆)2

.
4
Description of the question-succinct protocol
4.1
Compiling nonlocal games using cryptography: the KLVY transformation
Kalai, Lombardi, Vaikuntanathan and Yang give a transformation that maps a k-player 1-round nonlocal game into a
2k-message (k-round) interactive protocol between a single prover and verifier. For simplicity, we will only present
their transformation as it is applied to two-player nonlocal games, because this is the only context in which we need
to use it. The general transformation, applicable to k-player nonlocal games for arbitrary k, is described in [KLVY21,
Section 3.2]. The following presentation is taken with some modifications from [KLVY21, Section 3.1].
[KLVY21] presents a PPT-computable transformation that converts any 2-prover non-local game G with question
set Q and verification predicate V into a single-prover protocol (associated with security parameter 𝜆), defined as
follows. Fix a quantum homomorphic encryption scheme QHE = (Gen,Enc,Eval,Dec).
(i) The verifier samples (x,y) ←Q, sk ←Gen(1𝜆), and c ←Enc(sk,x). The verifier then sends c to the prover as
its first message.
(ii) The prover replies with a message 𝛼.
(iii) The verifier sends y to the prover in the clear.
(iv) The prover replies with a message b.
(v) Define a := Dec(sk,𝛼). The verifier accepts if and only if V(x,y,a,b) = 1.
4.2
Description of question-succinct protocol for QMA
In the following, we will denote the syntax of the protocol in regular font, and we will denote the actions of the honest
prover(s) in italics.
Protocol 2. Question-succinct argument system for QMA
Inputs: An instance x ∈{0,1}∗, an algorithm C which is the verifier for a QMA promise problem A =
(Ayes,Ano) such that A ∈QMA, and a security parameter 𝜆∈N. The protocol is given by applying the KLVY
compiler (described in Section 4.1) with security parameter 𝜆to Protocol 3.
23


Protocol 3. Question-succinct (two-prover) proof system for QMA
Inputs: An instance x ∈{0,1}∗and an algorithm C which is the verifier for a QMA promise problem
A = (Ayes,Ano) such that A ∈QMA.
On input x,C, execute the reduction given in Theorem 6.21 to produce a Hamiltonian problem (H,𝛼(n), 𝛽(n))
(see Definition 6.12) with 𝛽(n)−𝛼(n) = 1−negl(n), where H is an n-qubit operator (n = poly(|x|)) with the
following form:
H = 1−E
w∈D ∑
u∈Q(w)
𝜋w
u
where
• w ∈{1,X,Z}n is a Pauli string,
• {𝜋w
u }u is the projective measurement corresponding to measuring n qubits in the natural way in the Pauli
bases specified by w (see Equation (2.1) for a formal definition),
• Q(w) ⊆{0,1}n is a set for which membership can be decided in polynomial time in n given w, and
• D is a distribution over {1,X,Z}n which can be efficiently sampled from using sampling randomness of
length 2polylog(n).
In words, if H is of this form, then the quantity 1−Tr[H𝜌] for any n-qubit state 𝜌can be estimated by a QPT
(in n) verifier who samples a w from D, measures the n qubits of 𝜌in the Pauli bases specified by w, obtains
outcomes a, and accepts iff a ∈Q(w).
Assume that we are considering a yes-instance x ∈Ayes. Honest Alice receives a witness that x ∈Ayes as
input, and converts it in polynomial time to a n-qubit witness 𝜌that the ground energy of H is ≤𝛼(n). Honest
Alice and Bob then share n+1 EPR pairs between themselves; most of the tests in the following protocol use
only the last n EPR pairs, but the first EPR pair will be used in Protocol 6.
The verifier executes each of the following tests with Alice and Bob with equal probability.
(i) Pauli braiding test. Described in Protocol 4; n will be the number of qubits on which H acts.
(ii) Mixed-versus-pure basis test. Described in Protocol 7; the distribution D will be the D such that
H = 1−E
w∼D∑u∈Q(w) 𝜋w
u .
(iii) Hamiltonian test. Described in Protocol 8; the distribution D and the sets {Q(w)}w will be those such
that H = 1−E
w∼D∑u∈Q(w) 𝜋w
u .
24


Protocol 4. Pauli braiding test with succinct questions
Input: an integer n.
Let S ⊆{0,1}n be a 𝜇-biased set. The verifier picks a,b uniformly at random from S ⊆{0,1}n. Assuming
that |S| = poly(n), this process takes O(logn) bits of randomness. Let the randomness which the verifier uses
in this process be denoted r = (ra,rb), where ra determines a and rb determines b.
(i) (Commutation): If a·b = 0, the verifier executes the commutation test (Protocol 5) with questions ra,rb.
(ii) (Anticommutation): If a·b = 1, the verifier executes the anticommutation test (Protocol 6) with ques-
tions ra,rb.
Protocol 5. Commutation test
Input: questions ra and rb which index two elements a and b in S ⊆{0,1}n.
1. The verifier sends (com,ra,rb) to Alice, and recieves responses (ua,ub) with ua,ub ∈{0,1}. Honest Alice
computes a and b from ra and rb, measures 𝜎Z(a) and 𝜎X(b) on her last n qubits, and returns the results
as ua and ub respectively.
2. The verifier picks W ∈{X,Z} uniformly at random and sends W to Bob. Bob responds with v ∈{0,1}n.
Note that Bob is not told that he is playing the commutation test: he receives only the question label W.
Honest Bob measures his last n qubits in the W basis.
3. If W = Z, the verifier accepts iff ∏i:ai=1 vi = ua. If W = X, the verifier accepts iff ∏i:bi=1 vi = ub.
25


Protocol 6. Anticommutation test
Input: questions ra and rb which index two elements a and b in S ⊆{0,1}n.
In this protocol, the verifier plays a version of the Mermin-Peres Magic Square game [Ara02, Mer90, Per90]
with the provers, in which Alice is asked to measure three observables forming a row or column of the square,
and Bob is asked to measure an observable from a single cell of the square. Both provers are instructed to use
the observables labeled by ra and rb for two specific cells in the square (the top centre and centre left cells), as
indicated below.
1. The verifier chooses a cell index j ∈[9] uniformly at random; it then chooses uniformly at random a row
or a column on a 3×3 grid which contains cell j. Suppose that the cell indices of the 3 cells in this row
or column are (i1,i2,i3) (one of these will be equal to j).
2. The verifier sends (MS,ra,rb,i1,i2,i3) to Alice, and receives responses u1,u2,u3 ∈{0,1}. Honest Alice
computes a and b from ra,rb. Then she measures the three (n + 1)-qubit observables associated with
cells i1,i2,i3 in the following grid, and returns all three 1-bit outcomes to the verifier:
𝜎Z ⊗1
1⊗𝜎Z(a)
𝜎Z ⊗𝜎Z(a)
1⊗𝜎X(b)
𝜎X ⊗1
𝜎X ⊗𝜎X(b)
−𝜎Z ⊗𝜎X(b)
−𝜎X ⊗𝜎Z(a)
−𝜎Z𝜎X ⊗𝜎Z(a)𝜎X(b)
Operators before the tensor product are understood always to act on the first qubit of Alice’s halves of
the shared EPR pairs, and operators after the tensor product on the last n qubits.
3. If j = 2 (i.e. Bob’s question indicates the top centre cell), the verifier sends Z to Bob, receives v ∈{0,1}n
as an answer, and accepts iff ∏i:ai=1 vi is equal to u2 (if Alice was asked a row question) or u1 (if Alice
was asked a column question). If j = 4 (i.e. Bob’s question indicates the centre left cell), the verifier
sends X to Bob, receives v ∈{0,1}n as an answer, and accepts iff ∏i:bi=1 vi is equal to u1 (if Alice was
asked a row question) or u2 (if Alice was asked a column question. In all other cases, the verifier sends
(MS,ra,rb, j) to Bob, receives a single-bit answer v ∈{0,1}, and accepts iff v = uk for the k ∈[3] such
that uk = j. Honest Bob measures all his qubits in the W basis when he receives a single bit question W,
and in all other cases uses the same strategy as honest Alice, except that he only measures a single cell
instead of 3.
26


Protocol 7. Mixed-versus-pure basis test
Input: a distribution D over {1,X,Z}n which can be sampled from using no more than 2polylogn random
bits.
1. The verifier selects a basis W from {X,Z} uniformly at random and sends W to Alice. It receives answer
u ∈{0,1}n. Honest Alice measures all of her qubits in the W basis.
2. The verifier selects a uniformly random b ←{0,1}.
(i) If b = 0, the verifier sends W to Bob, and receives answer v ∈{0,1}n. It accepts iff u = v. Honest
Bob measures all of his qubits in the W basis.
(ii) If b = 1, the verifier samples a Pauli string w from D and sends its sampling randomness (which is
polylogn bits in length) to Bob. It accepts iff for all i where wi =W, it is the case that ui = vi. Honest
Bob measures his last n qubits in the Pauli bases designated by w and reports all the measurement
results. For qubits where wi = 1, he always reports the measurement result 0.
Protocol 8. Hamiltonian test
Input: a distribution D over {1,X,Z}n which can be sampled from using no more than 2polylogn random
bits, along with a collection of sets {Q(w) : w ∈{1,X,Z}n} such that Q(w) ⊆{0,1}n (described in a way such
that membership in Q(w) can be efficiently decided given w).
1. The verifier sends question tele to Alice, and receives in response two strings, ux,uz ∈{0,1}n. Honest
Alice teleports her ground state to Bob through their last n shared EPR pairs and reports the teleportation
corrections.
2. The verifier samples a Pauli string w from D and sends its sampling randomness (which is polylogn bits
in length) to Bob. The verifier then receives measurement outcomes from Bob, corrects Bob’s outcomes
using Alice’s reported teleportation corrections, and does the appropriate energy test. More specifically,
the verifier receives answer v from Bob, and computes for every i such that wi ̸= 1
si =
vi
|{z}
Bob’s measurement
⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X]
|
{z
}
correction from Alice
Then the verifier sets si = 0 for every i such that wi = 1, and accepts iff s ∈Q(w). Honest Bob measures
his last n qubits in the Pauli bases designated by w and reports all the measurement results. For qubits
where wi = 1, he always reports the measurement result 0.
4.3
Question types
For convenience, we summarise the different question types that Alice and Bob may each see in Protocol 3 here.
(These are not necessarily in one-to-one correspondence with the subgames of the protocol, since some subgames are
indistinguishable from Bob’s point of view.)
We denote the set of Alice questions by QA and the set of Bob questions by QB.
Alice questions:
27


• (com,ra,rb): compute a and b from ra and rb and measure 𝜎Z(a) and 𝜎X(b).
• (MS,ra,rb,i1,i2,i3): compute a and b and play magic square for the cells indicated by i1,i2,i3 with the operators
for cells 1 and 5 coinciding with the 𝜎X(a) and 𝜎Z(b) operators.
• X or Z: measure all qubits in 𝜎X or 𝜎Z basis.
• w for Pauli string w ∈{1,X,Z}n: do mixed basis measurement in Pauli bases given by w.
• tele: do teleportation measurement.
Bob questions:
• X or Z: measure all qubits in 𝜎X or 𝜎Z basis.
• (MS,ra,rb, j): compute a and b and play magic square for the cell indicated by j with the operators for cells 1
and 5 coinciding with the 𝜎X(a) and 𝜎Z(b) operators.
• w for Pauli string w ∈{1,X,Z}n: do mixed basis measurement in Pauli bases given by w.
5
Modeling and state-dependent norms for the compiled game
5.1
Modelling the prover in any compiled game
We recall the formalism used by [NZ23a] to model the prover’s strategy in a compiled nonlocal game. In general, the
prover’s actions in any compiled game can be modeled as follows. The prover starts with some initial (pure) state |𝜓⟩.
In the first round, it performs a projective measurement depending on the ciphertext question c to obtain an outcome
𝛼, followed by a unitary depending on c and 𝛼, to obtain a post-measurement state. In the second round, it performs a
projective measurement on its residual state depending on the plaintext question y, to obtain an outcome b.
We note that both measurements can be assumed to be projective without loss of generality, by the Naimark dilation
theorem. We also note that the post-measurement unitary is necessary in the compiled case, since both “provers" act
sequentially on the same register; it is usually ignored in the case of nonlocal games, since the provers act on separate
subsystems.
Mathematically, we model the strategy of the prover as follows:
(i) The initial pure state is denoted |𝜓⟩. We often write 𝜓for |𝜓⟩⟨𝜓|.
(ii) The first measurement (the “Alice measurement") is modeled by a collection of non-Hermitian operators Ac
𝛼.
These satisfy the condition that for each c, the collection of operators {(Ac
𝛼)†(Ac
𝛼)} forms a projective measure-
ment. Thus, the probability that Alice returns outcome 𝛼in response to question c is
Pr[𝛼] = ⟨𝜓|(Ac
𝛼)†(Ac
𝛼)|𝜓⟩.
(iii) The un-normalized post-measurement state after receiving question c and responding with answer 𝛼is
|𝜓c
𝛼⟩= Ac
𝛼|𝜓⟩.
(5.1)
Note that ∥|𝜓c
𝛼⟩∥2 = Pr[𝛼]. The post-measurement state marginalizing over outcomes for question c is the mixed
state
𝜓c = ∑
𝛼
𝜓c
𝛼= ∑
𝛼
|𝜓c
𝛼⟩⟨𝜓c
𝛼|.
(iv) The second measurement (the “Bob measurement") is modeled by a POVM measurement {By
b} for each question
y. While this measurement can always be taken to be projective without loss of generality, in the analysis it will
sometimes be convenient to construct strategies where this measurement is a POVM.
28


Altogether, then, we can specify a strategy for a compiled nonlocal game by a triple (|𝜓⟩,{Ac
𝛼},{By
b}), where each
element of the triple is implicitly a function of the security parameter 𝜆and the encryption key sk.
For notational convenience, given any Alice question q ∈QA, we sometimes use the shorthand
𝜓Enc(q)
𝛼
= E
sk
E
c←Encsk(q)𝜓c
𝛼,
𝜓Enc(q) = E
sk
E
c←Encsk(q)𝜓c
Remark 5.1 (Implicit expectation over keys). The security of an encryption scheme (Gen,Enc,Dec) requires the
encryption keys to be chosen randomly by Gen. In particular, this means that certain indistinguishability statements
we will want to make hold only in expectation over keys sk output by Gen: for example, when we claim that two
Alice post-measurement (mixed) states 𝜓Enc(q) and 𝜓Enc(q′) are indistinguishable to Bob, we really mean that, for any
two-outcome measurement {M,I −M} that can be implemented by a circuit with size poly(𝜆), there exists a negligible
function 𝜂(𝜆) such that
E
sk←Gen(𝜆)


Tr[M𝜓Enc(q)]−Tr[M𝜓Enc(q′)]


 ≤𝜂(𝜆).
(5.2)
We will frequently leave the expectation over these keys implicit: in other words, in the above example, we may
simply write


Tr[M𝜓Enc(q)]−Tr[M𝜓Enc(q′)]


 ≤𝜂(𝜆).
Whenever we have expressions that include both Enc and Dec, it is understood that both functions use the same keys,
i.e. that there is one global implicit expectation over keys. For example, when we write ∥O(Dec(𝛼))∥2
𝜓Enc(q)for some
observables O(·) that depend on the decryption of a ciphertext 𝛼, this is understood to mean
E
sk←Gen(𝜆)∥O(Decsk(𝛼))∥2
𝜓Encsk(q) ,
where, analogously to before, 𝜓Encsk(q) := Ec←Encsk(q) 𝜓c. We usually use this convention for the squared norm, where
it is justified by the linearity property (Lemma 2.8 Item (iv)).
We record the following fact, which follows directly from the security of the QHE scheme used in the KLVY
compiler in Protocol 2, as defined in Definition 2.13.
Lemma 5.2. For any two Alice questions q1,q2 ∈QA,
𝜓Enc(q1) c
≈𝜓Enc(q2) .
Measuring closeness of strategies.
In the analysis of a compiled nonlocal game, it often occurs that we wish to
show if we replace Bob’s measurements {By
b} with new measurements {Cy
b} that are close in the appropriate distance
metric, then the winning probability of the strategy is approximately preserved. Specifically, we will often measure
closeness in terms of the state-dependent norm on the post-measurement state, after Alice’s measurement has been
applied:
E
x,y∼DG∑
𝛼,y
∥By
b −Cy
b∥2
𝜓Enc(x)
𝛼
≤𝜖,
where DG is the distribution over questions sampled in the game.
In some special cases, Lemma 2.10 can be applied to relate this state-dependent distance bound to the winning
probability. Specifically, it applies for the case of unique games where every answer for Bob determines a unique
winning answer for Alice and vice versa; this lets us define 𝜓i in the lemma to be Alice’s post-measurement state
for this unique outcome, which satisfies the condition ∑i Tr𝜓i ≤1. However, for general games, the situation is
more complicated, and there is a nice relation between state-dependent distance and success probability only if one
of the two strategies being compared consists of projective measurements. The following lemma, based on Fact 4.31
from [NW19], gives us the statement we will need.
29


Lemma 5.3. Let G be a nonlocal game, |𝜓⟩a state, {Ac
𝛼} be a collection of compiled Alice measurements, and {By
b}
and {Cy
b} be two collections of Bob measurements such that By
b is projective, and
E
x,y∼DG∑
𝛼∑
b
∥By
b −Cy
b∥2
𝜓Enc(x)
𝛼
≤𝜖,
where DG is the distribution over question pairs in the game. Then the success probabilities of the strategy using
(|𝜓⟩,{Ac
𝛼},{By
b}) and the strategy using (|𝜓⟩,{Ac
𝛼},{Cy
b}) are O(√𝜖)-close.
Proof. Define
∆y
b = Cy
b −By
b.
For any c,𝛼,y, let S be a subset of Bob’s outcome space. Then we claim that
∑
b∈S
Tr[Cy
b𝜓c
𝛼] ≥∑
b∈S
Tr[By
b𝜓c
𝛼]−2
r
∑
b∈S
∥∆y
b∥2
𝜓c
𝛼.
(5.3)
Before we prove this claim, let us see why it implies the conclusion of the Lemma. For each c,𝛼,y, let Sc,𝛼,y be the
set of answers b such that (c,y,𝛼,b) is an accepting question and answer tuple for the compiled game verifier. Then
the success probability of the Bob strategy {Cy
b} is given by
𝜔∗({Cy
b}) =
E
x,y∼DG
E
c←Enc(x)∑
𝛼
∑
b∈Sb,𝛼,y
Tr[Cy
b𝜓c
𝛼]
≥
E
x,y∼DG
E
c←Enc(x)∑
𝛼

∑
b∈Sb,𝛼,y
Tr[By
b𝜓c
𝛼]−2
s
∑
b∈S(b,𝛼,y)
∥∆y
b∥2
𝜓c
𝛼


≥𝜔∗({By
b})−2
E
x,y∼DG
E
c←Enc(x)∑
𝛼
s
∑
b∈S(b,𝛼,y)
∥∆y
b∥2
𝜓c
𝛼
≥𝜔∗({By
b})−2
r
E
x,y∼DG
E
c←Enc(x)∑
𝛼∑
b
∥∆y
b∥2
𝜓c
𝛼
= 𝜔∗({By
b})−2√𝜖.
Applying the same logic with Sc,y,𝛼taken to be the set of rejecting Bob answers b yields the statement
1−𝜔∗({Cy
b}) ≥(1−𝜔∗({By
b}))−2√𝜖
𝜔∗({Cy
b}) ≤𝜔∗({By
b})+2√𝜖.
Thus, the conclusion of the Lemma follows.
Now it remains to prove Equation (5.3). First, let us observe that
Cy
b ⪰(Cy
b)2
= By
b +(∆y
b)2 +By
b∆y
b +∆y
bBy
b.
Here, the first line follows from the fact that, as a valid POVM element, CY
b ⪯I, and the second line uses the projectivity
of By
b to replace (By
b)2 by By
b. We will now prove Equation (5.3) by lower-bounding the success probability of a
30


“subnormalized” strategy using the squared operators (Cy
b)2 as POVM elements.
∑
b∈S
Tr[Cy
b𝜓c
𝛼] ≥∑
b∈S
Tr[(Cy
b)2𝜓c
𝛼]
= ∑
b∈S
Tr[By
b𝜓c
𝛼]+ ∑
b∈S
∥∆y
b∥2
𝜓c
𝛼+ ∑
b∈S
Tr[(By
b∆y
b +∆y
bBy
b)𝜓c
𝛼]
≥∑
b∈S
Tr[By
b𝜓c
𝛼]−2 ∑
b∈S
∥By
b(𝜓c
𝛼)1/2∥2∥∆y
b(𝜓c
𝛼)1/2∥2
≥∑
b∈S
Tr[By
b𝜓c
𝛼]−2
r
∑
b∈S
∥By
b(𝜓c
𝛼)1/2∥2
2
r
∑
b∈S
∥∆y
b(𝜓c
𝛼)1/2∥2
2
≥∑
b∈S
Tr[By
b𝜓c
𝛼]−2
r
∑
b∈S
∥∆y
b∥2
𝜓c
𝛼.
Here, we used Hölder for the first inequality, Cauchy-Schwarz for the second, and the fact that {By
b} is a normalized
measurement for the third.
5.2
Modelling the prover in Protocol 2
We will also need to establish some notation specific to the prover’s ‘Bob’ operators in Protocol 2.
Definition 5.4 (Projective measurements).
(i) Pure basis measurements. In the Pauli braiding test (Protocol 4), and also in the b = 0 case of the mixed versus
pure basis test (Protocol 7), Bob is asked a single bit question corresponding to a basis setting (X or Z). For
each basis setting W ∈{X,Z}, we notate Bob’s projective measurement after receiving question W as a set of
projectors {PW
u }u with outcomes u ∈{0,1}n.
(ii) Mixed basis measurements. In the mixed versus pure basis test (Protocol 7), Bob receives a question w ∈
{1,X,Z}n corresponding to n Pauli basis settings (one for each of n qubits). For each Pauli string w ∈{1,X,Z}n,
we notate Bob’s projective measurement after receiving question w as a set of projectors {Mw
u }u∈{0,1}n. We can
assume without loss of generality that Bob always answers “0” on indices where he was asked to measure the
identity, i.e. formally we can assume that Mw
u = 0 if there exists an index i ∈[n] for which wi = 1 but ui = 1.
The reason that this assumption is without loss of generality is that we can always replace Bob’s measurements
by a post-processed version that has this property; since the verifier ignores all indices for which wi = 1, this
post-processing affects neither Bob’s success probability nor any of the rigidity statements we show below.
Definition 5.5 (Pure basis observables). For W ∈{X,Z} and a ∈{0,1}n, define the binary observable
W(a) := ∑
u
(−1)u·aPW
u .
Definition 5.6 (Mixed basis observables). For w ∈{1,X,Z}n and a ∈{0,1}n, define the binary observables
Ow(a) =
∑
u∈{0,1}n
(−1)a·uMw
u ,
Ow
W(a) =
∑
u∈{0,1}n
(−1)
⃗
1w=W∧a=1·uMw
u .
We also write Ow = Ow(
⃗
1) and Ow
W = Ow
W(
⃗
1).
Remark 5.7. Recall that Mw
u = 0 if there exists an index i for which wi = 1 but ui = 1. This implies that if two bitstrings
a,a′ ∈{0,1}n only differ on indices i for which wi = 1, then Ow(a) = Ow(a′). By the same reasoning, if a,a′ ∈{0,1}n
only differ on indices i for which wi ̸= W, then Ow
W(a) = Ow
W(a′).
31


For the same reason, we can also restrict the sum over u only to those indices that matter, i.e. we can drop the sum
over those u for which Mw
u = 0. In particular, this yields another expression for Ow and Ow
W, which will occasionally
be more convenient to use:
Ow =
∑
u∈{0,1}|{u̸=1}|
(−1)
⃗
1·u(Mw|{w̸=1})u ,
Ow
W =
∑
u∈{0,1}|{w=W}|
(−1)
⃗
1·u(Mw|{w=W})u .
Lemma 5.8. For all w ∈{1,X,Z}n,
Ow = Ow
XOw
Z .
Proof. First observe that for any u ∈{0,1}|{w̸=1}|,
(Mw|{w=X})u|{w=X}(Mw|{w=Z})u|{w=Z} =


∑
a:a|{w=X}=u|{w=X}
Mw
a




∑
b:b|{w=Z}=u|{w=Z}
Mw
b


=
∑
a s.t.
a|{w=X}=u|{w=X}
∧a|{w=Z}=u|{w=Z}
Mw
a
=
∑
a:a|{w̸=1}=u
Mw
a
= (Mw|{w̸=1})u .
Here, the second equality uses orthogonality of the projectors {Mw
a }a. With the expressions from Remark 5.7, we get
that
Ow
XOw
Z =


∑
uX∈{0,1}|{w=X}|
(−1)
⃗
1·uX (Mw|{w=X})uX




∑
uZ∈{0,1}|{w=Z}|
(−1)
⃗
1·uZ(Mw|{w=Z})uZ


=
∑
u∈{0,1}|{u̸=1}|
(−1)
⃗
1·u(Mw|{w=X})u|{w=X}(Mw|{w=Z})u|{w=Z}
=
∑
u∈{0,1}|{u̸=1}|
(−1)
⃗
1·u(Mw|{w̸=1})u = Ow .
6
Analysis of the question-succinct protocol
6.1
Consistency test and “prover switching”
The following lemma shows that the consistency test (the b = 0 case in Protocol 7 that just checks whether Alice’s and
Bob’s answers are consistent) implies that on Alice’s post-measurement state, Bob’s measurement in the same basis
has a definite outcome. This is formalised by saying that Bob’s measurement operator is close to identity (with a sign
indicating the outcome) on Alice’s post-measurement state.
Lemma 6.1. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the
compiled version of Protocol 7. Then for all b ∈{0,1}n and W ∈{X,Z},
∑
𝛼



W(b)−(−1)Dec(𝛼)·b1



2
𝜓Enc(W)
𝛼
≤O(𝜖).
32


Proof. Expanding out the definition of the state-dependent distance, we see that it suffices to show that
E
c←Enc(W)∑
𝛼
(−1)Dec(𝛼)·b Tr[W(b)Ac
𝛼𝜓Ac
𝛼] ≥1−O(𝜖).
The winning condition of the pure-basis case in Protocol 7 (i.e. the b = 0 case in the notation of Protocol 7) implies
E
c←Enc(W)∑
𝛼
Tr[PW
Dec(𝛼)Ac
𝛼𝜓Ac
𝛼] ≥1−O(𝜖).
(6.1)
Since the prover’s measurements are normalised, this is equivalent to
E
c←Enc(W)∑
𝛼
∑
v̸=Dec(𝛼)
Tr[PW
v Ac
𝛼𝜓Ac
𝛼] ≤O(𝜖).
(6.2)
Inserting the definition of W(b):
E
c←Enc(W)∑
𝛼
(−1)Dec(𝛼)·b Tr[W(b)Ac
𝛼𝜓Ac
𝛼]
=
E
c←Enc(W)∑
𝛼∑
v
(−1)(Dec(𝛼)+v)·b Tr[PW
v Ac
𝛼𝜓Ac
𝛼]
=
E
c←Enc(W)∑
𝛼
Tr[PW
Dec(𝛼)Ac
𝛼𝜓Ac
𝛼]+
E
c←Enc(W)∑
𝛼
∑
v̸=Dec(𝛼)
(−1)(Dec(𝛼)+v)·b Tr[PW
v Ac
𝛼𝜓Ac
𝛼]
Since Tr[PW
v Ac
𝛼𝜓Ac
𝛼] ≥0:
≥
E
c←Enc(W)∑
𝛼
Tr[PW
Dec(𝛼)Ac
𝛼𝜓Ac
𝛼]−
E
c←Enc(W)∑
𝛼
∑
v̸=Dec(𝛼)
Tr[PW
v Ac
𝛼𝜓Ac
𝛼] ≥1−O(𝜖),
where in the last line we used Equation (6.1) to bound the first term and Equation (6.2) to bound the second term.
We can use Lemma 6.1 to show that Bob’s observables W(b) commute with Alice’s post-measurement state
𝜓Enc(W). This lemma can be seen as a substitute for the “prover switching” technique from the non-local games
literature.
Lemma 6.2. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the
compiled version of Protocol 7. Then for all b ∈{0,1}n and W ∈{X,Z},



W(b)𝜓Enc(W)W(b)−𝜓Enc(W)


1 ≤O(√𝜖).
Proof. We first use the triangle inequality:



W(b)𝜓Enc(W)W(b)−𝜓Enc(W)


1
≤∑
𝛼



W(b)𝜓Enc(W)
𝛼
W(b)−𝜓Enc(W)
𝛼



1
≤∑
𝛼



W(b)𝜓Enc(W)
𝛼
W(b)−(−1)Dec(𝛼)·b𝜓Enc(W)
𝛼
W(b)



1 +



(−1)Dec(𝛼)·b𝜓Enc(W)
𝛼
W(b)−𝜓Enc(W)
𝛼



1
For the first term, we use the unitary invariance of the 1-norm, and for the second term we use that the 1-norm is
invariant under taking the dagger (and W(b) and 𝜓c
𝛼are Hermitian):
= ∑
𝛼



W(b)𝜓Enc(W)
𝛼
−(−1)Dec(𝛼)·b𝜓Enc(W)
𝛼



1 +



W(b)𝜓Enc(W)
𝛼
−(−1)Dec(𝛼)·b𝜓Enc(W)
𝛼



1
= 2∑
𝛼



(W(b)−(−1)Dec(𝛼)·b)𝜓Enc(W)
𝛼



1
We can now apply Lemma 6.1 and Lemma 2.10:
≤O(√𝜖).
33


6.2
Analysis of compiled Pauli braiding test: obtaining the group relations
Lemma 6.3. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1−𝜖in the
compiled version of Protocol 4. Then the prover’s observables satisfy the following properties for any Alice question
q ∈QA:
E
a,b∈{0,1}n



Z(a)X(b)−(−1)a·bX(b)Z(a)



2
𝜓Enc(q) ≤O(𝜖)+negl(𝜆).
(6.3)
To prove this lemma, we first examine what each subtest of the Pauli braiding test lets us conclude.
Lemma 6.4. Suppose a computationally efficient prover P succeeds with probability 1−𝜖in the compiled anticommut-
ation test (Protocol 6) with inputs ra,rb, and let Bra and Brb be the Bob observables corresponding to these questions.
Then for any Alice question x ∈QA, there exists a negligible function 𝜂(𝜆) (depending on P and on x,ra,rb) such that
∥{Bra,Brb}∥2
𝜓Enc(x) ≤O(𝜖)+𝜂(𝜆).
Proof. In Theorem 5.7 of [CMM+24], essentially the same statement is shown for the Magic Square game. In that the-
orem, it is shown that for the Bob’s observables B2,B4 used for cells 2 and 4 in the square, the expected anticommutator
is bounded by
E
sk ←Gen(1𝜆)
E
c←Enc(x)∑
𝛼
∥{B2,B4}|𝜓c
𝛼⟩∥2
2 ≤17280𝜖+𝜂(𝜆).
In our setting, B2 = Bra and B4 = Brb, and the quantity on the left-hand side is exactly the average squared state-
dependent norm, by Definition 2.6.
Lemma 6.5 (Lemma 23 of [NZ23a]). Suppose a computationally efficient prover P modelled as in Section 5 succeeds
with probability 1 −𝜖in the compiled commutation test (Protocol 5) with inputs ra,rb, and let Bra,Brb be Bob’s
observables corresponding to the questions ra,rb. Then for any Alice question x ∈QA, there exists a negligible
function 𝜂(𝜆) (depending on P and on x,ra,rb) such that
∥[Bra,Brb]∥2
𝜓Enc(x) ≤O(𝜖)+𝜂(𝜆).
Proof. Lemma 23 of [NZ23a] shows that, for all (ra,rb),
∥[Bra,Brb]∥2
𝜓Enc((com,ra,rb)) ≤O(𝜖).
To obtain the conclusion of the lemma, it suffices to use computational indistinguishability together with the fact that
the commutator is efficiently measurable, which follows from Lemma 2.12.
Proof of Lemma 6.3. We are given that P succeeds with probability 1−𝜖in Protocol 4. This means that it holds that
∑
a,b∈S:a·b=0
1
|S|2 ·(1−Pr[P passes commutation on Z(a),X(b)])
+
∑
a,b∈S:a·b=1
1
|S|2 ·(1−Pr[P passes anticommutation on Z(a),X(b)])
≤𝜖.
For any given a,b, suppose a·b = 0, and let 1−𝜖a,b = Pr[P passes commutation on Z(a),X(b)]. Then by Lemma 6.5,
it holds that
∥[Z(a),X(b)]∥2
𝜓Enc(q) ≤O(𝜖a,b)+𝜂a,b(𝜆),
and O(·) is a convex function.
Likewise, suppose a·b = 1, and let 1−𝜖a,b = Pr[P passes anticommutation on Z(a),X(b)]. Then by Lemma 6.4,
it holds that
∥{Z(a),X(b)}∥2
𝜓Enc(q) ≤O(𝜖a,b)+𝜂a,b(𝜆),
34


and O(·) is a convex function.
Putting these relations together, we have
∑
a,b∈S
1
|S|2 ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜓Enc(q) ≤O(𝜖)+𝜂(𝜆),
where 𝜂(𝜆) = maxa,b 𝜂a,b(𝜆). Finally, applying Corollary 3.6, we get
E
a,b∈{0,1}n ∥Z(a)X(b)−(−1)a·bX(b)Z(a)∥2
𝜓Enc(q) ≤
1
(1−𝜆)2 O(𝜖)+𝜂′(𝜆),
where 𝜂′ is some negligible function. Here we have used that 𝜓Enc(q) c
≈negl Ea∈SW(a)𝜓Enc(q)W(a) for W ∈{X,Z},
which follows from Lemma 6.2.
6.3
Analysis of compiled mixed-vs-pure basis test
Theorem 6.6. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in
both Protocol 4 and Protocol 7. Then there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits
an honest prover would use) and an isometry V : H →H′ such that for every Alice question q ∈QA
E
w∼D
E
a∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2
𝜓Enc(q) ≤O(√𝜖)+negl(𝜆).
Theorem 6.6 also implies that the prover’s projective measurements {Mw
u } in the mixed vs pure basis test must
be close to the corresponding Pauli projectors. More formally, we show the following statement about the prover’s
measurements.
Corollary 6.7. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in
both Protocol 4 and Protocol 7. Then there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits an
honest prover would use) and an isometry V : H →H′ such that for every Alice question q ∈QA, and for any subset
S ⊆{0,1}n,
E
w∼D ∑
u∈S
∥Mw
u −V †(𝜋w
u ⊗1aux)V∥2
𝜓Enc(q) ≤O(√𝜖)+negl(𝜆).
(6.4)
Here, {Mw
u } are the prover’s measurements in the mixed vs pure basis test, and 𝜋w
a are the Pauli projectors, i.e.
𝜋w
u =
O
i
1+(−1)ui𝜎wi
2

=
E
a∈{0,1}n(−1)u·a𝜎w(a).
Proof. Since each of the terms in Equation (6.4) is non-negative, it suffices to show this for S = {0,1}n. Recall that
for any a ∈{0,1}n,
Ow(a) =
∑
u∈{0,1}n
(−1)a·uMw
u .
In other words, Ow(a) and {Mw
u }u are related by a Fourier transform. We can invert this Fourier transform to get that
Mw
u =
E
a∈{0,1}n(−1)u·aOw(a).
The proof now is essentially that of Parseval’s identity, but we spell out the details for completeness: inserting this and
35


the expansion of 𝜋w
u in terms of Pauli observables, we get that for any w ∈{1,X,Z}n,
∑
u∈{0,1}n
∥Mw
u −V †(𝜋w
u ⊗1aux)V∥2
𝜓Enc(q) =
∑
u∈{0,1}n
∥
E
a∈{0,1}n(−1)u·a Ow(a)−V †(𝜎w(a)⊗1aux)V


|
{z
}
:=Γ(a)
∥2
𝜓Enc(q)
=
∑
u∈{0,1}n

E
a∈{0,1}n(−1)u·aΓ(a),
E
a′∈{0,1}n(−1)u·aΓ(a′)

𝜓Enc(q)
=
E
a,a′∈{0,1}n
 
∑
u∈{0,1}n
(−1)u·(a+a′)
!

Γ(a),Γ(a′)

𝜓Enc(q)
=
E
a,a′∈{0,1}n 2n𝛿a,a′ 
Γ(a),Γ(a′)

𝜓Enc(q)
=
E
a∈{0,1}n ∥Γ(a)∥2
𝜓Enc(q)
=
E
a∈{0,1}n ∥Ow(a)−V †(𝜎w(a)⊗1aux)V∥2
𝜓Enc(q)
Here, ⟨·,·⟩𝜓is the state-dependent inner product defined in Definition 2.6. Taking V to be the isometry from The-
orem 6.6 and inserting the expectation over w ∼D, the result now follows directly from Theorem 6.6.
Before proving Theorem 6.6, we introduce a piece of notation that will be useful throughout the rest of the section.
Definition 6.8. Let D be the distribution over Pauli strings in {1,X,Z}n from Protocol 7. Then we define D′ to be
distribution over Pauli strings in {1,X,Z}n induced by the following sampling procedure: to sample w′ ∼D′, first
sample w ∼D and a ∼{0,1}n, then set
w′
i =
(
wi
if ai = 1,
1
otherwise.
The utility of this notation is that we can now collapse the expectations Ew∼D Ea∼{0,1}n into one expectation.
Concretely, this allows us to restate the conclusion of Theorem 6.6 as
E
w∼D′ ∥Ow −V †(𝜎w ⊗1aux)V∥2
𝜓Enc(q) ≤O(√𝜖).
(6.5)
Proof of Theorem 6.6. We will show that Equation (6.5) holds.
By the triangle inequality for the squared norm
(Lemma 2.8 Item (v)) we have that
E
w∼D′ ∥Ow −V †(𝜎w ⊗Id)V∥2
𝜓Enc(q)
≤2 E
w∼D′


Ow −X(1{w=X})Z(1{w=Z})


2
𝜓Enc(q) +2 E
w∼D′


X(1{w=X})Z(1{w=Z})−V †(𝜎w ⊗Id)V


2
𝜓Enc(q) .
The first term is at most O(√𝜖) by Lemma 6.11, which we prove below. The second term is at most O(𝜖) by combining
Lemma 6.3 and Lemma 3.3.
It remains to prove Lemma 6.11. For this, we first establish a few auxiliary lemmas.
Lemma 6.9. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in
Protocol 7. Then for all W ∈{X,Z},
E
w∼D′∑
𝛼



Ow
W −(−1)Dec(𝛼)·1{w=W}1



2
𝜓Enc(W)
𝛼
≤O(𝜖).
36


Proof. The proof is similar to Lemma 6.1. Expanding out the definition of the state dependent distance, we see that it
suffices to show
E
w∼D′
E
c←Enc(W)∑
𝛼
(−1)Dec(𝛼)·1{w=W} Tr[Ow
ZAc
𝛼𝜓Ac
𝛼] ≥1−O(𝜖).
Recalling the definition of D′ from Definition 6.8, this is equivalent to
E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
(−1)Dec(𝛼)·1{w=W∧a=1} Tr[Ow
Z(a)Ac
𝛼𝜓Ac
𝛼] ≥1−O(𝜖).
(6.6)
The winning condition of Protocol 7 implies that
E
w∼D
E
c←Enc(W)∑
𝛼
Tr[(Mw|{w=W}])Dec(𝛼)|{w=W}Ac
𝛼𝜓Ac
𝛼] ≥1−O(𝜖).
(6.7)
We now need to use Equation (6.7) to show Equation (6.6). For this, first recall that
Ow
W(a) =
∑
u∈{0,1}n
(−1)
⃗
1w=W∧a=1·uMw
u .
Inserting this definition into the l.h.s. of Equation (6.6), we get that
E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
(−1)Dec(𝛼)·
⃗
1{w=W∧a=1} Tr[Ow
Z(a)Ac
𝛼𝜓Ac
𝛼]
= E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
∑
u∈{0,1}n
(−1)(Dec(𝛼)+u)·
⃗
1{w=W∧a=1} Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]
We now split the sum over u into the terms for which u|{w=W∧a=1} = Dec(𝛼)|{w=W∧a=1} and the remaining terms, and
note that the phase (−1)(Dec(𝛼)+u)·
⃗
1{w=W∧a=1} disappears when u|{w=W∧a=1} = Dec(𝛼)|{w=W∧a=1}:
= E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
∑
u∈{0,1}n s.t.
u|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}
Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]
+ E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
∑
u∈{0,1}n s.t.
u|{w=W∧a=1}̸=Dec(𝛼)|{w=W∧a=1}
(−1)(Dec(𝛼)+u)·
⃗
1{w=W∧a=1} Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]
For the second term we note that the trace expression is always non-negative, so we can bound
≥E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
∑
u∈{0,1}n s.t.
u|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}
Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]
−E
w∼D
E
a∼{0,1}n
E
c←Enc(W)∑
𝛼
∑
u∈{0,1}n s.t.
u|{w=W∧a=1}̸=Dec(𝛼)|{w=W∧a=1}
Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]
Using the normalisation of the measurements, we can see that (second term) = 1 - (first term). Using this and changing
the order of sums and expectations, we can simplify this to
=

2
E
c←Enc(W)∑
𝛼
E
w∼D
E
a∼{0,1}n
∑
u∈{0,1}n s.t.
u|{w=W∧a=1}=Dec(𝛼)|{w=W∧a=1}
Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]

−1
Restricting the sum over u to a subset of the summands and using that each summand Tr[Mw
u Ac
𝛼𝜓Ac
𝛼] is non-negative,
we can bound
≥

2
E
c←Enc(W)∑
𝛼
E
w∼D
E
a∼{0,1}n
∑
u∈{0,1}n s.t.
u|{w=W}=Dec(𝛼)|{w=W}
Tr[Mw
u Ac
𝛼𝜓Ac
𝛼]

−1
37


Since there is no remaining dependence on a, we can simply remove the expectation over a. We can also rewrite this
more compactly using the notation from Definition 2.5:
=

2
E
c←Enc(W)∑
𝛼
E
w∼DTr[(Mw|{w=W})Dec(𝛼)|{w=W}Ac
𝛼𝜓Ac
𝛼]

−1
Finally, we note that the term in parentheses is bounded in Equation (6.7), so we get
≥1−O(𝜖).
This proves Equation (6.6).
Lemma 6.10. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in
Protocol 7. Then for all W ∈{X,Z},
E
w∼D′


W(1{w=W})−Ow
W


2
𝜓Enc(W) = O(𝜖).
Proof. By Lemma 2.8 Item (iv):
E
w∼D′


W(1{w=W})−Ow
W


2
𝜓Enc(W)
= E
w∼D′∑
𝛼


W(1{w=W})−Ow
W


2
𝜓Enc(W)
𝛼
By Lemma 2.8 Item (v):
≤2 E
w∼D′∑
𝛼



W(1{w=W})−(−1)Dec(𝛼)·1{w=W}1



2
𝜓Enc(W)
𝛼
+2 E
w∼D′∑
𝛼



Ow
W −(−1)Dec(𝛼)·1{w=W}1



2
𝜓Enc(W)
𝛼
These are exactly the terms we bounded in Lemma 6.1 (which holds for every choice of w and consequently also in
expectation over w ∼D′) and Lemma 6.9, so we get:
= O(𝜖).
We are now in a position to prove Lemma 6.11, the missing ingredient in the proof of Theorem 6.6.
Lemma 6.11. Suppose a computationally efficient prover P modelled as in Section 5 wins with probability 1 −𝜖in
both Protocol 4 and Protocol 7. Then for any Alice question q ∈QA,
E
w∼D′


Ow −X(1{w=X})Z(1{w=Z})


2
𝜓Enc(q) = O(√𝜖)+negl(𝜆).
Proof. By Lemma 5.2, for all q ∈QA we have that 𝜓Enc(q) c
≈negl(𝜆) 𝜓Enc(Z). We can therefore use Lemma 2.12 to get
that
E
w∼D′


Ow −X(1{w=X})Z(1{w=Z})


2
𝜓Enc(q)
≤E
w∼D′


Ow −X(1{w=X})Z(1{w=Z})


2
𝜓Enc(Z) +negl(𝜆)
By Lemma 6.2 and Lemma 2.9:
≤E
w∼D′


Ow −X(1{w=X})Z(1{w=Z})


2
Ea∈{0,1}n Z(a)𝜓Enc(Z)Z(a) +negl(𝜆)+O(√𝜖)
38


By Lemma 2.8 Item (iv) and Lemma 2.8 Item (i):
= E
w∼D′
E
a∈{0,1}n


OwZ(a)−X(1{w=X})Z(1{w=Z} +a)


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
Since the expectation over a is uniform, we can shift it by 1{w=Z}:
= E
w∼D′
E
a∈{0,1}n


OwZ(1{w=Z} +a)−X(1{w=X})Z(a)


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
= E
w∼D′
E
a∈{0,1}n


OwZ(1{w=Z})Z(a)−X(1{w=X})Z(a)


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
Now performing the same steps in reverse:
= E
w∼D′
E
a∈{0,1}n


OwZ(1{w=Z})−X(1{w=X})


2
Z(a)𝜓Enc(Z)Z(a) +negl(𝜆)+O(√𝜖)
≤E
w∼D′


OwZ(1{w=Z})−X(1{w=X})


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
From Lemma 5.8 we have that Ow = Ow
XOw
Z. Inserting this and using Lemma 2.8 Item (iii), we get that:
= E
w∼D′


Ow
ZZ(1{w=Z})−Ow
XX(1{w=X})


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
By Lemma 2.8 Item (v):
≤2 E
w∼D′


Ow
ZZ(1{w=Z})−1


2
𝜓Enc(Z) +


Ow
XX(1{w=X})−1


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
By Lemma 2.8 Item (iii):
≤2 E
w∼D′


Z(1{w=Z})−Ow
Z


2
𝜓Enc(Z) +


X(1{w=X})−Ow
X


2
𝜓Enc(Z) +negl(𝜆)+O(√𝜖)
By Lemma 6.10:
≤negl(𝜆)+O(√𝜖).
6.4
Subsampled Hamiltonian
Definition 6.12 (Hamiltonian problem). We refer to a tuple of the form (H,𝛼, 𝛽), where H is a Hermitian operator
and 𝛼and 𝛽are both real numbers, as a Hamiltonian problem. We may refer to such a tuple where H acts on n qubits
as n-qubit Hamiltonian problems.
Definition 6.13 (deciding a Hamiltonian problem). Given a tuple of the form (H,𝛼, 𝛽), where H is a Hermitian
operator and 𝛼and 𝛽are both real numbers, we refer to the problem of deciding whether the ground energy of H is
≤𝛼(yes case) or ≥𝛽(no case) as the problem of deciding (H,𝛼, 𝛽).
Definition 6.14 (family of Hamiltonians). We will use the notation H = {H(n)}n∈N to refer to a family of Hamilto-
nians, i.e., a collection of sets H(n) (one for every value of n ∈N) such that the nth set H(n) contains only n-qubit
Hamiltonian problems. We assume that the length of the binary description of (H,𝛼, 𝛽) for any (H,𝛼, 𝛽) ∈H(n) is
poly(n).
Definition 6.15 (QMA-completeness of a family of Hamiltonians). We say a family of Hamiltonians H = {H(n)}n∈N
is QMA-complete if, for every promise problem A = (Ayes,Ano) in QMA, and every instance x ∈{0,1}∗, the problem
of deciding whether x ∈Ayes or x ∈Ano can be Karp reduced in polynomial time (in |x|, given as input x and also the
algorithm C which characterises the verifier for A) to the problem of deciding some element of H(n) for n = poly(|x|).
39


Definition 6.16 (2-local X/Z Hamiltonian family with inverse polynomial promise gap). A 2-local X/Z Hamiltonian
family is a family of Hamiltonians where H(n) contains only (H,𝛼, 𝛽) such that H is a sum of at most m(n) terms for
m(n) = poly(n), each one of which is an n-qubit tensor product of 𝜎Z, 𝜎X and 1 such that at most 2 of the n factors in
the tensor product are not 1. If, in addition, the tuples in H(n) all have the same values of 𝛼and 𝛽(for every n), and it
is the case that 𝛽(n)−𝛼(n) (where 𝛼and 𝛽are considered as functions of n) is lower bounded by
1
poly(n), then we say
H = {H(n)}n∈N is a 2-local X/Z Hamiltonian family with inverse-polynomial promise gap.
Lemma 6.17. There is a family of 2-local X/Z Hamiltonians with inverse-polynomial promise gap which is QMA-
complete.
Proof. This is Theorem 2 of [BL08].
Lemma 6.18. Let H = {H(n)}n∈N be a QMA-complete 2-local X/Z Hamiltonian family. Then there exists a poly-
nomial t(n) (the amplification parameter) such that deciding any (H,𝛼(n), 𝛽(n)) ∈H(n) can be efficiently reduced
to deciding a problem of the form (H′,𝛼′(n), 𝛽′(n)), where there exists a negligible function negl(·) such that 𝛽′(n)−
𝛼′(n) ≥1−negl(n), and H′ (which acts on t(n)·n qubits) has the following form:
H′ = 1−E
w∼D ∑
a∈T(w)
𝜋w
a
where D is a distribution over {1,X,Z}t(n)·n which can be efficiently sampled from, and membership in T(w) ⊆
{0,1}t(n)·n can be decided in time polynomial in n given w.
Proof. We do this reduction in two stages. Firstly, we note that instead of taking a 2-local X/Z Hamiltonian problem
(H,𝛼(n), 𝛽(n)) as our starting point, we can take a tuple (H′′,𝛼′′(n), 𝛽′′(n)) where H′′ is in the form
H′′ = 1−E
w∼D′′ ∑
a∈S(w)
𝜋w
a
where D′′ is an efficiently sampleable distribution over {1,X,Z}n, and S(w) ⊆{0,1}n is a set for which membership
can be decided efficiently given w. (The ‘1−’ is merely to make sure that the yes case is the low-energy case.) The
promise gap will decrease at most by a factor of
1
poly(n) as a result of this conversion (so that 𝛽′′(n)−𝛼′′(n) is still at
least
1
poly(n)). To get H′′, we will use the Morimae-Fitzsimons energy test [MF16]. This procedure will have an inverse-
polynomial promise gap if the original Hamiltonian had an inverse-polynomial promise gap and constant locality, as
Morimae and Fitzsimons calculate. It is straightforward to see that the success probability of the procedure on any
given pure state |𝜓⟩can be expressed as 1−⟨𝜓|H′′|𝜓⟩for some H′′ of the form above.
Then, to amplify the gap, we apply the technique from Lemma 14.1 in Kitaev, Shen and Vyalyi [KSV02] to H′′,
to obtain the desired Hamiltonian H′. The amplification technique is to measure a independent randomly chosen term
from H′′ on t(n) many n-qubit registers, and to accept if the number of accepting outcomes is above a certain threshold.
Concretely,
H′ = 1−E
w∼D ∑
a∈T(w)
𝜋w
a ,
where D = (D′′)⊗t(n), and T(w) is defined implicitly by the following algorithm to decide membership in it:
(i) Divide up the answer string a into t(n) blocks Bi of n bits each. Also divide up w into t(n) blocks wi such that
each wi is in {1,X,Z}n.
(ii) For each block Bi,i ∈[t(n)], compute the quantity (in {−1,+1}, for notational convenience) bi = (−1)1[a|Bi∈S(wi)].
This results in t(n) quantities b1,··· ,bt(n) ∈{−1,+1}.
(iii) a is in T(w) iff
t(n)
∑
i=1
bi < t(n)· 𝛼′′(n)+ 𝛽′′(n)
2
.
40


It is clear that this algorithm runs in time poly(n). As for the condition on eigenvalues of H′, it is shown in [KSV02]
that the bound 𝛽′(n)−𝛼′(n) ≥1−negl(n) holds if t(n) is chosen to be polynomial in n.
Lemma 6.19. Fix a PRG family F = { f𝜆: {0,1}𝜆→{0,1}𝜆}𝜆∈N. Assuming that F is secure against (non-uniform)
QPT adversaries, and for any function ℓ(·) such that ℓ(x) = 𝜔(log(x)), there exists a PRG family G = {g𝜆: {0,1}ℓ(𝜆) →
{0,1}𝜆}𝜆∈N which is secure against (non-uniform) QPT adversaries.
Proof. Standard arguments to show that PRGs can be used to construct PRFs [GGM86] suffice.
Theorem 6.20. Let H = {H(n)}n∈N be a QMA-complete 2-local X/Z Hamiltonian family.
Then there exists a
polynomial t(n) (the amplification parameter) such that deciding any (H,𝛼(n), 𝛽(n)) ∈H(n) can be efficiently re-
duced to deciding a problem of the form (H′,𝛼′(n), 𝛽′(n)), where there exists a negligible function negl(·) such that
𝛽′(n)−𝛼′(n) ≥1−negl(n), and H′ (which acts on t(n)·n qubits) has the following form:
H′ = 1−E
w∼D ∑
a∈T(w)
𝜋w
a
where membership in T(w) ⊆{0,1}t(n)·n can be decided in time polynomial in n given w, and D is a distribution over
{1,X,Z}t(n)·n which can be efficiently sampled from using sampling randomness of length 2polylog(n).
Proof. Fix a PRG family G = {g𝜆: {0,1}ℓ(𝜆) →{0,1}𝜆}𝜆∈N with ℓ(𝜆) = polylog(𝜆) which is secure against non-
uniform QPT adversaries. (Such a family exists by Lemma 6.19.) Take an X/Z Hamiltonian family H = {H(n)}n∈N
with gap 𝛽(n) −𝛼(n) = 1 −negl(n) which is QMA-complete, such that any H such that (H,𝛼(n), 𝛽(n)) ∈H(n) is a
Hamiltonian on t(n)·n qubits with the following form:
H = 1−E
w∼∆∑
a∈T(w)
𝜋w
a
(6.8)
where ∆is a distribution over {1,X,Z}t(n)·n which can be efficiently sampled from, and membership in T(w) ⊆
{0,1}t(n)·n can be decided in time polynomial in n given w. (Such a family exists by Lemma 6.18.)
The following algorithm accepts any given state 𝜌with probability exactly 1−Tr[H𝜌]:
Process 1.
(i) Sample w from D. We will assume this takes R(n) bits of randomness for some polynomial R.
(ii) Measure every qubit of 𝜌in the Pauli bases determined by w. Let the outcome be a ∈{0,1}t(n)·n.
(iii) Accept iff a ∈T(w).
Now consider the following derandomised version of this algorithm:
Process 2 (Derandomised version of Process 1).
(i) Use the PRG gℓ(R(n)) (i.e. the ℓ(R(n))th PRG in the family G) in order to generate a pseudorandom seed s of
length R(n) using ℓ(R(n)) bits of true randomness. Use s to sample w from D.
(ii) Measure every qubit of 𝜌in the Pauli bases determined by w. Let the outcome be a ∈{0,1}t(n)·n.
(iii) Accept iff a ∈T(w).
It is clear that this algorithm accepts any given state 𝜌with probability exactly 1 −Tr[H′𝜌], where H′ is the
following Hamiltonian:
H′ = 1−E
w∼D ∑
a∈T(w)
𝜋w
a
(6.9)
41


where we define D to be the distribution which step (i) in Process 2 samples from. Since R is a polynomial and
ℓ(n) = polylog(n), this setting of parameters yields sampling randomness for D of 2polylog(n), as desired.
Now we show that there exist 𝛼′(·), 𝛽′(·) with 𝛽′(n)−𝛼′(n) ≥1−𝜇(n) for some negligible function 𝜇(·) such that
the problem of deciding H′ is QMA-complete. Consider a sequence of Hamiltonians {H(n) : n ∈N} such that, for all
n, (H(n),𝛼(n), 𝛽(n)) ∈H(n). (We fix a single Hamiltonian per value of n for notational simplicity; the same argument
can be applied to all the elements of H(n).) For each n, let H′(n) be the Hamiltonian defined by the ‘subsampling’
procedure above applied to H(n), i.e. the Hamiltonian defined in Equation (6.9). We will show that there exists a
negligible function negl(·) such that the lowest eigenvalue of H′(n) differs from the lowest eigenvalue of H(n) by at
most a negl(n) amount.
Suppose, for contradiction’s sake, that this is not the case; then, defining v(n) to be the lowest eigenvalue of H(n)
and v′(n) to be the lowest eigenvalue of H′(n), (wlog) it is the case that v′(n) −v(n) ≥p(n) for some non-negligible
function p(n). Then we construct a QPT adversary A taking non-uniform quantum advice which can break the security
of G. Let r(·) be a sufficiently large polynomial, to be set later. We assume (wlog by standard reductions) that, on
input security parameter 𝜆, A either receives a challenge consisting of r(𝜆) samples from the range of the PRG g𝜆
or r(𝜆) uniformly random strings of length 𝜆. On input security parameter 𝜆, A gets as advice the following. Let n
be such that R(n) = 𝜆. A gets r(𝜆) many copies of a ground state for the Hamiltonian H(n); the value of v(n), the
lowest eigenvalue of H(n); and the value of p(n) = v′(n) −v(n). It then receives its challenge strings s1,...,sr, and
does the following for each string si: use si to sample a term from H(n); measure this term of H(n) on the ith copy
of the ground state it was given as advice; compute the average of all its measurement outcomes; output ‘PRG’ if the
average is greater than v(n)+ p(n)
2 , and ‘uniform’ otherwise.
This procedure is clearly polynomial time in 𝜆. We now analyse A’s success probability. In the case where s
is a uniformly random string, the average energy of a term in H(n) measured against the ground state of H(n) is at
most v(n). Then, by a Chernoff bound, the probability that A guesses wrongly in this case is upper bounded by the
following calculation (letting X be the random variable associated with the sum of A’s measurement outcomes):
Pr[X ≥(1+ 𝛿)𝜇] ≤exp

−2𝛿2𝜇2
r(𝜆)

Pr[X ≥(v(n)+ 1
2 p(n))r(𝜆)] ≤exp

−2
1
2
p(n)
v(n)
2
·(v(n)·r(𝜆))2/r(𝜆)

≤exp
1
2 p(n)2r(𝜆)

.
Therefore, setting r(𝜆) to be a sufficiently large polynomial (i.e. sufficiently larger than
1
p(n)
2), we can ensure that the
probability that A guesses wrongly in the uniform case is negligible.
The calculation for the PRG case is similar. By a union bound, then, we can conclude that A distinguishes between
the PRG and the uniform cases with 1 −negl(𝜆) probability, which contradicts the non-uniform security of the PRG
family G. It follows that the lowest eigenvalue of H′(n) differs from the lowest eigenvalue of H(n) by at most a negl(n)
amount.
Theorem 6.21. Let C be a QMA verification algorithm for a QMA promise problem A = (Ayes,Ano), and let x be an
input of length n. Then there is a Hamiltonian problem (H,𝛼(n), 𝛽(n)) that can be efficiently computed from the input
(x,C), such that if x ∈Ayes, then H is a YES instance of the Hamiltonian problem, and if x ∈Ano, then H is a NO
instance, and 𝛽(n)−𝛼(n) = 1−negl(n).
H has the form
H′ = 1−E
w∼D ∑
a∈T(w)
𝜋w
a
Proof. The statement of QMA completeness in Lemma 6.17 implies that there is an efficient mapping (x,C) to a 2-
local X/Z Hamiltonian problem (HXZ,𝛼XZ(n), 𝛽XZ(n)). Applying Theorem 6.20 to this family of Hamiltonians yields
the result.
42


6.5
Analysis of the compiled Hamiltonian test
Lemma 6.22. Given an instance x, let H(n) be the corresponding Hamiltonian generated in Protocol 2, and let P be
a prover that succeeds in the compiled Pauli braiding and mixed-versus-pure tests (Protocol 4 and Protocol 7) with
probability 1−𝛿, and in the Hamiltonian test (Protocol 8) with probability pH. Then there exists a state 𝜌such that
Tr[𝜌H(n)] ≤(1−pH)+O(𝛿1/4)+negl(𝜆).
Proof. First, since P succeeds with probability 1−𝛿in the Pauli braiding and mixed-versus-pure tests, by Corollary 6.7
it holds that there exists a Hilbert space H′ = C2n ⊗Haux (where n is the number of qubits an honest prover would
use) and an isometry V : H →H′ such that for every Alice question q ∈QA, and for any subset S ⊆{0,1}n,
E
w∼D ∑
u∈S
∥Mw
u −V †(𝜋w
u ⊗1aux)V∥2
𝜓Enc(q) ≤O(
√
𝛿)+negl(𝜆).
(6.10)
where D is the set of Pauli strings D(n) corresponding to the Hamiltonian H(n).
In particular, setting q = tele, we have that
E
w∼D ∑
u∈S
E
c←Enc(tele)∑
𝛼
∥Mw
u −V †(𝜋w
u ⊗1aux)V∥2
𝜓c
𝛼≤O(
√
𝛿)+negl(𝜆).
(6.11)
where 𝜓c
𝛼= Ac
𝛼𝜓(Ac
𝛼)†.
Now, recall that the Hamiltonian H(n) has the form
H(n) = 1−E
w∼D ∑
u∈Q(w)
𝜋w
u ,
where 𝜋w
u is a Pauli basis projector. From the success in the Hamiltonian test, we know that
E
w∼D∑
u
E
c=Enc(tele)∑
𝛼
Tr[Mw
u Ac
𝛼𝜓(Ac
𝛼)†]·1[correct(w,u,Dec(𝛼)) ∈Q(w)] = pH,
(6.12)
where the function correct implements the Pauli corrections from the teleportation step, and is defined by
correct(w,u,(ux,uz))i =
(
ui ⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X]
wi ̸= 1
0
wi = 1
Also note that the right hand side of Equation (6.12) is 1 −pH, because of the left we are summing over corrected
outcomes that are contained in Q(w); the test was defined to accept if the outcome is not in Q(w). (This is so that a
high success probability corresponds to a low energy according to the Hamiltonian.)
By Equation (6.11) together with Lemma 5.3, with By
b taken to be Mw
u and Cy
b taken to be V †(𝜋w
u ⊗1aux)V, it thus
follows that
E
w∼D∑
u
E
c←Enc(tele)∑
𝛼
Tr[V †(𝜋w
u ⊗1aux)VAc
𝛼𝜓(Ac
𝛼)†]·1[correct(w,u,Dec(𝛼)) ∈Q(w)] ≥pH −O(𝛿1/4)−negl(𝜆).
We will now show how to construct the desired state 𝜌. We will do this by simulating the effect of the Pauli
corrections by actual Pauli operators applied to Alice’s post-measurement state.
First, we need to deal with a technical inconvenience: the function correct is defined differently for wi = 1 and for
wi ̸= 1, and in the wi = 1 case, it acts by replacing the measurement outcome with 0. Fortunately, we recall that by
the definition of
𝜋w
u =
n
O
i=1
I +(−1)ui𝜎wi
2

,
it follows that whenever wi = 1 and ui ̸= 0 for any i, the corresponding projector 𝜋w
u = 0. Thus, we may freely assume
that whenever wi = 1, ui = 0. This enables us to replace correct with the modified function correct′ defined by
correct′(w,u,(ux,uz))i = ui ⊕[(ux)i]1[wi=Z] ⊕[(uz)i]1[wi=X].
43


With respect to this modified function, we have
E
w∼D∑
u
E
c←Enc(tele)∑
𝛼
Tr[V †(𝜋w
u ⊗1aux)VAc
𝛼𝜓(Ac
𝛼)†]·1[correct′(w,u,Dec(𝛼)) ∈Q(w)]
≥pH −O(𝛿1/4)−negl(𝜆).
By shifting the sum over u, this may be equivalently rewritten as
E
w∼D ∑
u∈Q(w)
E
c←Enc(tele)∑
𝛼
Tr[V †(𝜋w
correct′(w,u,(ux,uz)) ⊗1aux)VAc
𝛼𝜓(Ac
𝛼)†] ≥pH −O(𝛿1/4)−negl(𝜆).
Now, we observe that the Pauli corrections have the following simple form:
𝜋w
correct′(w,u,(ux,uz)) = 𝜎Z(uz)𝜎X(ux)𝜋w
u 𝜎X(ux)𝜎Z(uz).
Applying this observation, plus the cyclicity of the trace, we get
E
w∼D ∑
u∈Q(w)
E
c←Enc(tele)∑
𝛼
Tr[(𝜋w
u ⊗1aux)𝜎X(ux)𝜎Z(uz)VAc
𝛼𝜓(Ac
𝛼)†V †𝜎Z(uz)𝜎X(ux)]
≥pH −O(𝛿1/4)−negl(𝜆),
where (ux,uz) = Dec(𝛼). Now, let us define
𝜌= Traux
E
c←tele∑
𝛼
𝜎X(ux)𝜎Z(uz)VAc
𝛼𝜓(Ac
𝛼)†V †𝜎Z(uz)𝜎X(ux).
It is clear that 𝜌is a normalized quantum state. Moreover, we have that
Tr[H(n)𝜌] = 1−E
w∼D ∑
u∈Q(w)
Tr[𝜋w
u 𝜌] ≤(1−ph)+O(𝛿1/4)+negl(𝜆),
which was the desired conclusion.
6.6
Analysis of full compiled protocol
Theorem 6.23. The protocol Protocol 2 is a question-succinct argument system for QMA assuming a QHE scheme
satisfying the definition given in Definition 2.13.
More precisely, let V be the verifier, and P be the honest prover described in the protocol. Then for any promise
problem A = (Ayes,Ano) in QMA with verification algorithm C, the following hold:
• Completeness: Let x ∈Ayes , and let |𝜓⟩be an accepting QMA witness for x. Then the verifier V on input
(x,C,1𝜆), in interaction with the honest prover P on input (x,C,|𝜓⟩polyn,1𝜆), accepts with probability ≥1 −
negl(n).
• Soundness: Let x ∈Ano, and let |𝜙⟩be any state on poly(n+𝜆) qubits. Then the verifier V on input (x,C,1𝜆), in
interaction with any QPT prover P∗on input (x,C,|𝜙⟩,1𝜆), accepts with probability at most s for some universal
constant s < 1.
• Question-succinctness: On any input x and for security parameter 𝜆, the number of bits sent by V to P is
O(polylogn+poly(𝜆)).
Proof. We recall that the protocol Protocol 2 is obtained by applying the KLVY compilation to Protocol 3. This in
turn consists of three subtests: the Pauli braiding test (Protocol 4), the mixed-versus-pure basis test (Protocol 7), and
the Hamiltonian test (Protocol 8).
44


Completeness:
For the completeness, we observe that the honest prover passes the Pauli braiding test (Protocol 4)
and the mixed-versus-pure basis test (Protocol 7) with certainty, and, using a state |𝜙⟩, passes the Hamiltonian test
(Protocol 8) with probability equal to 1−⟨𝜙|H(n)|𝜙⟩. Taking H(n) to be the Hamiltonian computed in Protocol 2, and
|𝜙⟩to be the appropriate polynomial number of copies of |𝜓⟩, we have ⟨𝜙|H|𝜙⟩= 1−negl(n).
Soundness:
We now establish soundness of this protocol. Suppose x is a NO instance of the QMA language. Then
the Hamiltonian H from Protocol 3 has minimum eigenvalue at least
𝜆min(H) ≥1−negl(n).
Moreover, we can assume by a padding argument that without loss of generality, that 𝜆min(H) ≥2/3 for all n.
Now, suppose that P′ is a prover that succeeds in Protocol 2 with probability 1−𝛿. This means that P′ succeeds in
the KLVY compilations of the Pauli braiding test (Protocol 4), the mixed-versus-pure basis test (Protocol 7), and the
Hamiltonian test (Protocol 8) each with probability at least 1−3𝛿. By Lemma 6.22, this means that there exists a state
𝜌such that
tr[𝜌H] ≤3𝛿+O(𝛿1/4).
For any 𝛿below some universal 𝛿0, the RHS of the expression above will be at most 1/2, and thus in contradiction
with the fact that 𝜆min(H) ≥2/3.
Succinctness:
The question-succinctness property is evident from the description of the protocol. We note that the
longest messages are sent in the mixed-versus-pure basis test (Protocol 7), and the Hamiltonian test Protocol 8, where
to describe a term in H the verifier must send polylog(n) bits. In all other tests, the verifier sends at most O(log(n))
bits to the prover.
7
Compiling from a question-succinct protocol into a fully succinct protocol
using succinct arguments of knowledge
Protocol 2 is a question-succinct cryptographic single-prover protocol, in the sense that the messages the verifier sends
to the prover are polylogn · poly𝜆bits long, where n is the size of the instance and 𝜆is the security parameter. In
[BKL+22, Section 9], Bartusek et al. present two compilers which map any question-succinct single-prover argument
system for QMA satisfying a certain obliviousness property into a fully succinct single-prover argument system for
QMA. More specifically, for their compilers to work, Bartusek et al. require that the verifier’s questions in the question-
succinct protocol can be computed independently of the prover’s answers and also the QMA instance (except for its
length). They also require implicitly that the verifier’s questions can be generated extremely efficiently, namely, in
time ˜
O(n)+polylog(n)·poly(𝜆).
It can be easily verified that Protocol 2 satisfies the obliviousness property. However, the efficiency property is not
quite satisfied because of the commutation and anticommutation tests. Specifically, the choice of which test to execute
is a function of a · b, where a and b are strings of length poly(n), and so naïvely, computing this inner product takes
time poly(n). However, there is an easy fix for this: after sampling ra,rb, the verifier decides uniformly at random
whether to run the commutation or anticommutation test, and then afterwards, if it chose wrongly, it automatically
accepts. This affects the soundness gap by at most a constant factor.
With this modification made, the verifier of Protocol 2 is indeed oblivious and efficient. In fact, all the information
the verifier sends to the prover in this modified version of Protocol 2 takes one of the following forms:
• Encryptions of uniform randomness of some predetermined length.
• Non-encrypted uniform randomness of some predetermined length.
Its decision process about which messages to send can also be made completely independent of the prover’s answers.
As such, the compilers presented in [BKL+22, Section 9] apply in a black-box fashion to the modified version of
Protocol 2. Nonetheless, because the presentation of the analysis in [BKL+22, Section 9] is fairly terse, we present
for the reader’s benefit some additional intuition about how Bartusek et al.’s first compiler works when applied to
45


Protocol 2 in particular. We emphasise that this is only for intuition and not meant as a full (re-)proof of the [BKL+22]
compiler.
7.1
Post-quantum succinct arguments of knowledge
The central building block for Bartusek et al.’s first compiler is a post-quantum succinct argument of knowledge (based
on Killian’s work [Kil92]) with the following commit-and-open structure. Fix some instance x, some NP language
L, and some associated predicate RL(·,·) (that is, RL(x,w) checks whether w is a valid witness that x ∈L, and can be
computed in polynomial time). Suppose also that the verifier has already sent the prover the hash key hk for some
collapsing4 hash function family. Then the following protocol allows the prover to succinctly prove knowledge of
some w such that RL(x,w) = 1:
Protocol 9 (Three-message succinct argument of knowledge).
1. The prover encodes the witness w under an error correcting code E (with corresponding decoding D) to
obtain a string ˜
w = E(w). The prover also constructs a PCPP proof 𝜋that R(x,D( ˜
w)) = 1. The prover
then constructs a Merkle tree [Mer87] on m = ( ˜
w,𝜋) using hk, computes the root of this tree rtm, and
sends the verifier rtm. The prover also constructs a Merkle tree on w itself, computes the root of this tree
rtw, and sends the verifier rtw. For notational convenience, we will call the algorithm that constructs rt
using hk by the name Merklehk(·). We will also use rt to denote the combination rt = (rtm,rtw).
2. The verifier sends the prover a challenge string j = (j1,..., jk) which indicates a set of indices for which
it wants the prover to reveal m j1,...,m jk.
3. The prover reveals m j1,...,m jk and also some auxiliary information (namely, the path of hashes in the
Merkle tree leading from the root to m ji), which allows the verifier to verify whether or not (m j1,...,m jk)
were valid openings and also to compute the verification predicate for the PCPP proof that R(x,D( ˜
w)) =
1.
Clarifying information about Merkle trees and their uses in commit-and-open protocols like this can be found in
[CMSZ22, Section 2.1], but for us the important part is the message structure of this protocol. In particular, note that
all the messages in this protocol are polylog|x|·poly𝜆in length, where 𝜆is the security parameter for hk.
Protocol 9 is similar to Killian’s classic protocol [Kil92] (instantiated in a form that allows for extraction of the
witness w): the only change which must be made to the protocol to make it post-quantum (apart from using a collapsing
instead of a collision-resistant hash function) is the ‘extra’ Merkle commitment to w in the first message in addition
to the commitment to m = ( ˜
w,𝜋).5 However, the analysis of this protocol in the post-quantum setting is significantly
more subtle than its analysis in the classical setting. In particular, the soundness statement for Protocol 9—which says
that, given a prover who wins with high probability, there is an efficient extractor that extracts w given black-box access
to the prover—is usually proven in the classical setting via a rewinding argument, in which the extractor reconstructs
some significant fraction of m by choosing an index j, obtaining mj, rewinding the prover, choosing another index
j′, obtaining m j′, etc., and finally using the ‘error robustness’ properties of both the PCPP and of the encoding E in
order to extract w and to be sure that it satisfies R(x,·) despite the missing indices. Rewinding arguments that are
secure against quantum adversaries with quantum auxiliary input tend to be much more difficult than their classical
counterparts, because of the possibility that executing the protocol even once will destroy the auxiliary input and
prevent rewinding from succeeding.
In [CMSZ22], it was shown how to analyse Protocol 9 in the post-quantum setting using a clever technique in-
volving alternating projections. However, the analysis of Protocol 9 presented in [CMSZ22] was not particularly
composable. If the succinct argument of knowledge in Protocol 9 is used as a subprotocol in some longer protocol,
4Collapsing is a post-quantum strengthening of collision resistance; see [Unr16] for a definition.
5It is not clear whether this additional commitment is necessary; however, the authors of [LMS22] were not able to make the state-preserving
extraction analysis work without it, although for the analysis in the setting of [CMSZ22] the original Killian protocol is sufficient.
46


and there are other tests in the full protocol which follow after the succinct argument of knowledge—this is the case
for us—then it may be necessary to ensure that running extraction does not hinder the prover’s ability to pass in
the remainder of the protocol. To motivate this requirement, consider a situation in which we are trying to design
a reduction R which reduces the security of a succinct protocol called SuccinctProtocol, in which Protocol 9 is used
as a subprotocol, to the security of a non-succinct protocol OriginalProtocol. OriginalProtocol requires the prover to
output a full witness w instead of merely passing in a succinct argument of knowledge for w; therefore, given some
prover P who is successful in SuccinctProtocol, the reduction has to run extraction on P in order to recover w, so that
it can succeed with the challenger/verifier for OriginalProtocol. However, if OriginalProtocol contains tests (mirrored in
SuccinctProtocol) that happen after its prover is supposed to output w, the reduction R will not necessarily succeed
if extracting w destroys P’s ability to succeed in the remainder of SuccinctProtocol, because then R may be unable to
answer the remaining questions in OriginalProtocol.
In order to ensure that, even after extraction has been performed, the prover continues to pass with high prob-
ability in the rest of the protocol, the prescribed extractor from [CMSZ22] was required to measure a projector that
corresponded to coherently computing whether or not the verifier would accept in the remainder of the protocol and
conditioning on the accept outcome. The issue is that the verifier’s final decision predicate might depend on secret
information (that is: the entire protocol might not be public-coin, even though Protocol 9 is public-coin), and so an
efficient extractor might be unable to do this.
In followup work [LMS22], it was shown how to analyse Protocol 9 in a more composable way, so that the extractor
only needs to measure the projection which corresponds to the verifier of Protocol 9 accepting (note that this verifier’s
decision predicate is public, so the extractor will always be able to do this), but even so the extractor’s activity is
essentially undetectable to the prover, meaning that the prover (who uses the extractor’s ‘leftover state’ instead of its
original state) will continue to succeed in the rest of the protocol (if it succeeded with high probability to begin with)
even after extraction has been performed. This condition on the extractor is true by default in the classical setting,
but it is nontrivial in the quantum setting. Because this guarantee may be somewhat surprising, we sketch in the next
section how this guarantee is shown.
7.2
[LMS22] extraction
The following (taken largely from [BKL+22, Definition 9.1]) is the formal statement of succinctness and security
for Protocol 9 for which we will sketch a proof in this section.
Lemma 7.1. Protocol 9 satisfies the following properties:
• Succinctness. When invoked on security parameter 𝜆for the hash function family, instance size |x| = n, and a
relation R decidable in time T, the communication complexity of the protocol is poly(𝜆,logT). The verifier’s
computational complexity is poly(𝜆,logT)+ ˜
O(n).
• 𝜖-state-preserving extraction. There exists an extractor E(·)(x,𝜖) with the following properties.
– Efficiency: E(·)(x,𝜖) runs in time poly(n,𝜆,1/𝜖) as a quantum oracle algorithm (with the ability to apply
controlled U-gates given an oracle U(·)), outputting a classical transcript ˜
𝜏and a classical string w.
– State-preserving: Let |𝜓⟩∈A⊗I be any poly(𝜆)-qubit pure state and let 𝜌= TrA(|𝜓⟩) ∈D(I).6 Consider
the following two games:
* Game 0 (real): Generate a transcript 𝜏by running P∗(𝜌I,x) with the honest verifier V. Output 𝜏
along with the residual state on A⊗I.
* Game 1 (simulated): Generate a transcript-witness pair ( ˜
𝜏,w) ←EP∗(𝜌I,x). Output ˜
𝜏and the residual
state on A⊗I.
Then, we have that the output distributions of Game 0 and Game 1 are computationally 𝜀-indistinguishable
to any quantum distinguisher.
6In general, the prover’s input state on I may be entangled with some external register A, and we ask that computational indistinguishability
holds even given A. Our definition is stated this way for maximal generality, though we remark that the applications in this section do not require
indistinguishability in the presence of an entangled external register.
47


– Extraction correctness: for any P∗as above, the probability that ˜
𝜏is an accepting transcript but w is not
in Rx is at most 𝜖+negl(𝜆).
In order to describe the extractor which is guaranteed by Lemma 7.1, we firstly fix some notation related to the
prover’s state and actions in Protocol 9. We can model any prover P∗in Protocol 9 as a process which does the
following:
Process 3.
(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private
register P).
(ii) Receive a challenge j from the verifier. We assume that j is provided as a state |j⟩in a message register M
which is accessible both to the verifier and to the prover.
(iii) Apply some unitary UP∗which acts on both P and M.
(iv) Measure some part of the resulting state (wlog in the standard basis) to get a response z, and send this to the
verifier.
The verifier will then check its decision predicate Vrt( j,z), and accept iff Vrt( j,z) evaluates to 1. If Protocol 9 is a
subprotocol in some longer protocol, then the verifier rejects immediately if Vrt( j,z) = 0.
Now we will ‘purify’ the prover in order to make the [LMS22] extraction procedure easier to state. It is easy to
see that the state left over in all registers at the end of the process below is exactly equivalent to the state which is left
over at the end of Process 3:
Process 4.
(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private
register P).
(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message
register M. Also create a new register Z initialised to the all zero state which will be used in step (iv).
(iii) Apply the prover’s unitary UP∗jointly to P and M.
(iv) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of
Process 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary that
does this copying CNOTz.
(v) Coherently compute the verifier’s predicate Vrt( j,z) into yet another new register A.
(vi) Measure registers M and Z; obtain outcomes j and z.
(vii) Measure register A; obtain Vrt(j,z), and accept iff it is 1.
As before, if Protocol 9 is a subprotocol in some longer protocol, then the verifier rejects immediately if Vrt( j,z)
measures to 0. In other words, conditioning on continuing in the protocol essentially projects into the subspace where
Vrt(j,z) = 1.
Note that steps (vi) and (vii) can be switched, because they act on different registers and therefore commute. As
such, we could also have stated Process 4 in the following way:
Process 5.
(i) Send some message rt to the verifier. Let the state that P∗has left over after sending rt be |𝜓P∗⟩(held in a private
register P).
48


(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message
register M. Also create a new register Z initialised to the all zero state which will be used in step (iii).
(iii) This step can be stated in words as a series of substeps:
(i) Apply the prover’s unitary UP∗jointly to P and M.
(ii) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of
Process 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary
that does this copying CNOTz.
(iii) Project the state in registers P, M and Z into the subspace whereVrt( j,z) = 1. If the projective measurement
results in Vrt( j,z) = 0, reject.
(iv) Undo CNOTz and UP∗in that order.
In other words, in this step, apply the projective measurement where one of the projectors in the measurement is
Πc := U†
P∗CNOT†
z

∑
Vrt(j,z)=1
1P ⊗|j,z⟩MZ⟨j,z|MZ

CNOTzUP∗
and the other is I −Πc; reject if the outcome is I −Πc.
(iv) Redo CNOTz and UP∗(to counteract substep (iv) of the previous step, step (iii)). Measure registers M and Z;
obtain outcomes j and z.
The [LMS22] extractor will set up the state which exists after step (iii) in Process 5 (it can do this given an appropriate
notion of black-box access to P∗: see e.g. [Unr16]), and then it will insert an extra step (E) in between steps (iii) and
(iv) in Process 5, in which it extracts w in a way that is undetectable, in the sense that the state left over after the whole
of Process 5 with (E) inserted between (iii) and (iv) is computationally indistinguishable from the state left over after
the whole of Process 5 without (E). We will now describe in two stages how it accomplishes this.
[CMSZ22] extraction
In [CMSZ22], an algorithm was written down that, for any P∗in Protocol 9, takes in the
state in registers P, M and Z after step (ii) in Process 5 and alternates the following two projectors Πu and Πc (u for
‘uniform’ and c for ‘correct’) in order to attempt to extract a witness w such that Merklehk(w) = rtw, where rtw is the
second part of the message rt = (rtm,rtw) that P∗sent in step (i).
Πu = 1P ⊗|+m⟩M⟨+m|M ⊗|0⟩⟨0|Z,
where |+m⟩:= ∑
j
|j⟩with the appropriate normalisation
Πc = U†
P∗CNOT†
z

∑
Vrt( j,z)=1
1P ⊗|j,z⟩MZ⟨j,z|MZ

CNOTzUP∗
Note that Πc coincides with the Πc we wrote down in Process 5. The analysis involves decomposing the joint space
of P, M and Z into the Jordan subspaces (for more information about the Jordan decomposition and how it is usually
used in quantum computing, see [Vid20, Section 1.2.3]) of Πu and Πc. We establish some notation in order to state
the extraction guarantee which [CMSZ22] prove.
Let the set of Jordan subspaces of Πu and Πc be {Si}i. Let |ui⟩be the rank-1 projector associated with Πu in
subspace i, and let |ci⟩be the rank-1 projector associated with Πc in subspace i: that is, for any |𝜙⟩∈Si, Πu|𝜙⟩=
|ui⟩⟨ui| · |𝜙⟩, and similarly Πc|𝜙⟩= |ci⟩⟨ci| · |𝜙⟩. Since the state in registers P, M and Z after step (ii) in Process 5,
which we will name |𝜙start⟩for notational convenience, lies inside Πu, it can be decomposed as
|𝜙start⟩= ∑
i
𝛼i|ui⟩.
The extraction guarantee which [CMSZ22] prove is the following.
49


Lemma 7.2 ([CMSZ22]; informal). For any state |𝜙⟩∈Πu with a decomposition |𝜙⟩= ∑i(𝛼i|ci⟩+ 𝛽i|ui⟩), and
given the ability to implement the two projectors Πu and Πc (note that Πc implicitly depends on rt through Vrt),
the [CMSZ22] rewinding algorithm takes as input |𝜙⟩and outputs w such that Merklehk(w) = rtw with probability
1−𝜖in time poly(1/𝜖), if the following condition holds:
∑
i
(|𝛼i|2 +|𝛽i|2)·1

|⟨ci|ui⟩|2 is non-negligible

≥1−negl(𝜆).
(7.1)
In other words, if the weight in the superposition ∑i(𝛼i|ci⟩+ 𝛽i|ui⟩) is overwhelmingly in Jordan subspaces where
|⟨ci|ui⟩|2 is non-negligible, then [CMSZ22] extraction will succeed with probability 1−
1
poly(𝜆).
Coherent [CMSZ22] extraction.
In [LMS22], it is shown how to accomplish ‘undetectable extraction’, i.e. how to
insert an extra step (E) in between steps (iii) and (iv) in Process 5, corresponding with the execution of the extractor,
such that the state left over after the whole of Process 5 with (E) inserted between (iii) and (iv) is computationally
indistinguishable from the state left over after the whole of Process 5 without (E).
Lombardi, Ma and Spooner begin by considering the entire [CMSZ22] process as a black-box unitaryUCMSZ which
takes as input a state |𝜙⟩∈Πu and outputs some state ∑w′ |w′⟩|auxw′⟩(ignoring normalisation) which is a superposition
over candidate witnesses w′ and associated auxiliary states. It can be shown that, if the superposition ∑w′ |w′⟩|auxw′⟩
has its weight only on terms with candidates w′ such that Merklehk(w′) = rtw, then measuring w′ at this point is
computationally undetectable: this is because Merklehk(·) is a collapse-binding commitment, and the statement that
no efficient algorithm can tell the difference between ∑w′ |w′⟩W|auxw′⟩aux and MeasW
∑w′ |w′⟩W|auxw′⟩aux


, when the
superposition is only over w′ such that Merklehk(w′) = rtw, is precisely the definition of collapse-binding. (This is the
only step in the analysis where the ‘extra’ commitment to w which the prover sends in step (i) of Protocol 9 in addition
to the commitment to the PCPP is used.)
In other words, if the success condition for [CMSZ22] rewinding stated in Lemma 7.2 is true, namely, the starting
state |𝜙⟩∈Πu,|𝜙⟩= ∑i 𝛼i|ui⟩on which UCMSZ is run is such that
∑
i
|𝛼i|2 ·1

|⟨ci|ui⟩|2 is non-negligible

≥1−negl(𝜆),
then (except with at most
1
poly(𝜆) probability for any poly of our choice) the extractor can run UCMSZ and then meas-
ure the W register in the resulting superposition, and this will output a successful witness candidate w′ such that
Merklehk(w′) = rtw and the measurement will be undetectable to the prover.
Our first hope might be that, if P∗succeeds in Protocol 9 with high probability, then the CMSZ success condition
Equation (7.1) is true for the total state lying in registers P, M and Z after step (ii) in Process 5. Unfortunately, this
turns out not to be (necessarily) true; we will not go into why here.
However, one can guarantee the condition for the success of the CMSZ procedure for the total state in registers P,
M and Z after step (iii) of Process 5. Note that the state after step (iii) is precisely the state after step (ii) after Πc has
been applied to it once. The effect of applying Πc to a superposition ∑i 𝛼i|ui⟩is as follows:
Πc
∑
i
𝛼i|ui⟩


∝∑
i
𝛼i
|ci⟩⟨ci|·|ui⟩


(7.2)
= ∑
i
𝛼i⟨ci|ui⟩


|ci⟩
(7.3)
Note that this (subnormalised) state now has a decomposition of the form ∑i 𝛽i|ci⟩; and, moreover, if |⟨ci|ui⟩|2 is
negligible, then the weight on |ci⟩(i.e. the squared norm of the coefficient of |ci⟩) in the superposition will be negligibly
small. For brevity’s sake we will ignore the issue of the normalisation, but the intuition that the coefficients where
|⟨ci|ui⟩|2 is small get suppressed holds even in the presence of the correct renormalisation.
Therefore, the entire ‘undetectable extraction’ procedure, given black-box access to a prover P∗for Protocol 9, is
as follows:
Process 6 (extraction).
50


(i) Run P∗normally in order to generate its first message rt to the verifier. Let the state that P∗has left over after
sending rt be |𝜓P∗⟩(held in a private register P).
(ii) Prepare a state ∑j |j⟩(we will ignore normalisation) that is a uniform superposition over challenges in a message
register M. Also create a new register Z initialised to the all zero state which will be used in step (iii).
(iii) This step can be stated in words as a series of substeps:
(i) Apply the prover’s unitary UP∗jointly to P and M.
(ii) Coherently copy (in the standard basis) the part of the state that would have been measured in step (iv) of
Process 3 above to obtain a superposition over responses z into register Z. For short we will call the unitary
that does this copying CNOTz.
(iii) Project the state in registers P, M and Z into the subspace whereVrt( j,z) = 1. If the projective measurement
results in Vrt( j,z) = 0, output fail.
(iv) Undo CNOTz and UP∗in that order.
In other words, in this step, apply the projective measurement where one of the projectors in the measurement is
Πc := U†
P∗CNOT†
z

∑
Vrt(j,z)=1
1P ⊗|j,z⟩MZ⟨j,z|MZ

CNOTzUP∗
and the other is I −Πc; output fail if the outcome is I −Πc.
(E) Perform UCMSZ, the unitary that does the CMSZ rewinding procedure coherently, which results in a state
∑w′ |w′⟩W|auxw′⟩aux. Measure the W register and check if the outcome is a string w such that Merklehk(w) = rtw.
If no, output fail. If yes, apply U†
CMSZ.
(iv) Redo CNOTz and UP∗(to counteract substep (iv) of step (iii)). Measure registers M and Z; obtain outcomes j
and z.
Conditioned on the extractor not outputting fail, the state that remains in registers P and M (note that Z is a work
register for the extractor) after Process 6 is computationally indistinguishable from the state which would remain
in those same registers after a real (successful) execution of Protocol 9. Note that the probability that the extractor
outputs fail in step (iii) is the same as the probability that the prover fails the real execution of Protocol 9, and that
the probability the extractor outputs fail in step (E) is at most 𝜖if the extractor runs for time poly(1/𝜖). As such,
if Protocol 9 is a sub-protocol in a longer protocol, then extraction can be performed while affecting the prover’s
probability of passing in the rest of the longer protocol by only 𝜖+negl(𝜆).
7.3
A fully succinct version of Protocol 2
The intuition for compiling Protocol 2 (which is already question-succinct) into a fully succinct protocol is as follows.
Every time the prover P is supposed to send a message to the verifier V in Protocol 2, we ask the prover ˜
P in the
succinct version of Protocol 2 to commit (using some succinct computationally binding commitment) to the answer
that P would have provided, and then execute Protocol 9 in order to prove succinctly that it ‘knows’ a valid opening to
that commitment. At the end of the protocol, V in Protocol 2 takes the answers that it receives and evaluates a decision
predicate. Since ˜
V, the succinct protocol’s verifier, does not have the prover’s answers (instead it only experienced a
short interactive proof that the prover ‘knew’ answers of some description), it cannot evaluate the decision predicate
for itself. Instead, the verifier ˜
V reveals all of its secret randomness at the end of the protocol, and asks ˜
P to execute
Protocol 9 one more time to prove that it knows full-length answers which are ‘consistent’ with its ( ˜
P’s) earlier
commitments, and moreover that these full-length answers satisfy V’s decision predicate.
More specifically, the fully succinct version of Protocol 2 is as follows:
51


Protocol 10 (Fully succinct version of Protocol 2).
Inputs: an instance x, a description of the verification algorithm C of a promise problem A ∈QMA, a
security parameter 𝜆, and (for the honest prover ˜
P) polynomially many copies of a witness that x ∈Ayes.
(i) Phase 1: hash key, ‘Alice’ question and answer
(i) The verifier ˜
V of Protocol 10 samples a hash key hk from some collapsing hash function family. It
also runs V, the verifier of Protocol 2, on the inputs x, C, 𝜆in order to generate the two questions
of Protocol 2, one of which is a ciphertext ˆ
q1 encrypting some ‘Alice’ question q1, and the other of
which is a plaintext ‘Bob’ question q2. ˜
V sends hk and ˆ
q1 to the prover ˜
P.
(ii) Honest ˜
P responds with a succinct commitment7 to the answer that P would have given V. We will
call ˜
P’s response here com1.
(iii) ˜
P and ˜
V execute Protocol 9 so that ˜
P can prove that it knows a valid opening to its commitment
com1. The property of being a valid opening can be phrased as an NP relation R1(com1,w1) =
(Merklehk(w1) = com1).
(ii) Phase 2: ‘Bob’ question and answer
(i) ˜
V sends q2 (which it generated earlier along with ˆ
q1) to ˜
P.
(ii) Honest ˜
P responds with a succinct commitment to the answer that P would have given V. We will
call ˜
P’s response here com2.
(iii) ˜
P and ˜
V execute Protocol 9 so that ˜
P can prove that it knows a valid opening to its commitment
com2. As before, this can be phrased as an NP relation R2(com2,w2) = (Merklehk(w2) = com2).
(iii) Phase 3: Proof of knowledge that V would have accepted
(i) ˜
V now reveals the secret key sk of the quantum homomorphic encryption scheme under which ˆ
q1
was encrypted.
(ii) ˜
V and ˜
P execute Protocol 9 so that ˜
P can prove that it knows ˆ
a1 and a2 such that:
(i) ˆ
a1 is a valid opening of com1,
(ii) a2 is a valid opening of com2,
(iii) V(x,C,1𝜆,Decsk( ˆ
q1),Decsk( ˆ
a1),q2,a2) = 1.
Formally, this can be expressed as an NP relation R3((com1,com2,x,C,1𝜆, ˆ
q1,q2,sk)
|
{z
}
instance
,( ˆ
a1,a2)
| {z }
witness
), in
the standard way.
Theorem 7.3. There exists a negligible function negl(·) such that, for any (x,C,𝜆), and any 𝜖=
1
poly(𝜆), if there exists
an efficient prover ˜
P which causes ˜
V (the verifier of Protocol 10) to accept on input (x,C,𝜆) with probability ˜
p, then
there exists an efficient prover P which causes V (the verifier of Protocol 2) to accept (x,C,𝜆) with probability p, such
that p ≥˜
p−negl(𝜆)−O(𝜖).
Proof sketch. The analysis proceeds via reduction to Protocol 2. In particular, we consider a reduction R that plays
the part of the verifier ˜
V with ˜
P in Protocol 10 and the part of the prover P with V in Protocol 2, and show that R
passes in Protocol 2 with about the same probability that ˜
P passes in Protocol 10. We assume that R gets the same
kind of black-box access to ˜
P that the extractor of Process 6 does.
R does the following:
7Succinct computationally binding commitments can be constructed from collapsing hash functions using Merkle trees.
52


(i) Phase 1: ‘Alice’ question and answer
(i) Receives ˆ
q1 from V; samples hk for itself; inputs hk, ˆ
q1 into ˜
P.
(ii) Gets com1 from ˜
P.
(iii) Gets rt1, the first message of the first execution of Protocol 9 in Protocol 10, from ˜
P.
(iv) Runs Process 6 on ˜
P in order to extract a witness w1 such that w1 is a valid opening for com1. (Note that,
in the case of honest ˜
P, w1 is an encryption of an ‘Alice’ answer a1.)
(v) Returns w1 to V as its ‘Alice’ answer.
(ii) Phase 2: ‘Bob’ question and answer
(i) Receives q2 from V; inputs q2 into ˜
P.
(ii) Gets com2 from ˜
P.
(iii) Gets rt2, the first message of the second execution of Protocol 9 in Protocol 10, from ˜
P.
(iv) Runs Process 6 on ˜
P in order to extract a witness w2 such that w2 is a valid opening for com2. (Note that,
in the case of honest ˜
P, w2 is a ‘Bob’ answer a2.)
(v) Returns w2 to V as its ‘Bob’ answer.
(iii) R ignores Phase 3 of Protocol 10 and aborts after Phase 2.
Note that R does not use the third execution of Protocol 9 in Protocol 10; in fact, R cannot continue playing with
˜
P after Phase 2 because it does not know the secret key for the homomorphic encryption which V generated. However,
the third execution of Protocol 9 in Protocol 10 will be used in the analysis. In particular, in order to prove that R
succeeds in Protocol 2 with about the same probability that ˜
P succeeds in Protocol 10, we will consider the following
mental experiment. Consider an R′ which behaves identically to R in Phase 1 and Phase 2 of Protocol 10, and in
Phase 3, instead of aborting, does an inefficient brute force search for the secret key of the encryption.
Process 7 (A mental experiment: R′’s execution).
(i) Phase 1: ‘Alice’ question and answer
(i) Receives ˆ
q1 from V; samples hk for itself; inputs hk, ˆ
q1 into ˜
P.
(ii) Gets com1 from ˜
P.
(iii) Gets rt1, the first message of the first execution of Protocol 9 in Protocol 10, from ˜
P.
(iv) Runs Process 6 on ˜
P in order to extract a witness w1 such that w1 is a valid opening for com1. (Note that,
in the case of honest ˜
P, w1 is an encryption of an ‘Alice’ answer a1.)
(v) Returns w1 to V as its ‘Alice’ answer.
(ii) Phase 2: ‘Bob’ question and answer
(i) Receives q2 from V; inputs q2 into ˜
P.
(ii) Gets com2 from ˜
P.
(iii) Gets rt2, the first message of the second execution of Protocol 9 in Protocol 10, from ˜
P.
(iv) Runs Process 6 on ˜
P in order to extract a witness w2 such that w2 is a valid opening for com2. (Note that,
in the case of honest ˜
P, w2 is a ‘Bob’ answer a2.)
(v) Returns w2 to V as its ‘Bob’ answer.
(iii) Phase 3: proof of knowledge that V would have accepted
(i) Finds the secret key sk of the quantum homomorphic encryption scheme being used by V (by brute force,
let’s say) and inputs this key into ˜
P.
53


(ii) Gets rt3, the first message of the third and last execution of Protocol 9 in Protocol 10, from ˜
P.
(iii) Runs Process 6 on ˜
P in order to extract a witness w3 such that w3 = ( ˆ
a1,a2), where
(i) ˆ
a1 is a valid opening of com1,
(ii) a2 is a valid opening of com2,
(iii) V(Decsk( ˆ
q1),Decsk( ˆ
a1),q2,a2) = 1.
R′ is, of course, inefficient; however, it is efficient given the secret key of the homomorphic encryption. Moreover,
suppose we condition on all three extractions in Process 7 succeeding. Then, if w1 (the witness that R′ extracts from
˜
P during Phase 1) is equal to ˆ
a1 (which is our name for the first part of the witness w3 extracted by R′ from ˜
P during
Phase 3) except with negligible probability in the mental experiment, and similarly w2 = a2 except with negligible
probability, then it is the case that R will be accepted by V with probability at least 1 −negl(𝜆). (This is because,
if extraction succeeds, then w3 consists of a pair of answers which, by definition, causes V to accept.) The event
that all three extractions succeed happens with probability at least ˜
p−3𝜖−negl(𝜆) by a union bound, where ˜
p is the
probability that ˜
P passes overall. Therefore, it is sufficient to prove the following lemma:
Lemma 7.4. In Process 7, except with negligible probability, w1 = ˆ
a1 and w2 = a2.
Proof sketch. Consider an adversary A for the security for the collapsing hash function family from which hk was
drawn. A can generate its own homomorphic encryption keys and then simulate the entire interaction between V,
R′ and ˜
P efficiently. If w1 ̸= ˆ
a1 or w2 ̸= ˆ
a2, then A has generated two valid openings of a computationally binding8
commitment (either two valid openings to com1 or two valid openings to com2); this can only happen with negligible
probability by the definition of computational binding. The claim follows.
Therefore, w1 = ˆ
a1 and w2 = a2 except with negligible probability, and so R will be accepted by V with probability
at least ˜
p−negl(𝜆)−O(𝜖).
Theorem 7.5. The protocol Protocol 10 is a succinct argument system for QMA assuming a QHE scheme satisfying
the definition given in Definition 2.13, and assuming the existence of collapsing hash functions (see [BKL+22, Section
3.6] for a definition of these objects).
More precisely, let V be the verifier, and P be the honest prover described in the protocol. Then for any promise
problem A = (Ayes,Ano) in QMA with verification algorithm C, the following hold:
• Completeness: Let x ∈Ayes , and let |𝜓⟩be an accepting QMA witness for x. Then the verifier V on input
(x,C,1𝜆), in interaction with the honest prover P on input (x,C,|𝜓⟩polyn,1𝜆), accepts with probability ≥1 −
negl(n).
• Soundness: Let x ∈Ano, and let |𝜙⟩be any state on poly(n+𝜆) qubits. Then the verifier V on input (x,C,1𝜆), in
interaction with any QPT prover P∗on input (x,C,|𝜙⟩,1𝜆), accepts with probability at most s′ for some universal
constant s′ < 1.
• Succinctness: On any input x and for security parameter 𝜆, the runtime of the verifier V is ˜
O(n)+O(polylogn·
poly(𝜆)), and the total number of bits communicated between the prover and verifier is O(polylogn·poly(𝜆)).
Proof. Completeness, soundness, and the communication bound in succinctness all follow from Theorem 6.23 and
Theorem 7.3. For the runtime part of succinctness, we must be slightly more careful. Recall that the verifier V of
Protocol 2 satisfies the obliviousness and efficiency properties that (1) the challenges it generates depend only on the
algorithm C and on the length of the instance x, not on the instance itself, and (2) all the challenges can be generated
in time polylogn·poly𝜆+ ˜
O(n). Specifically, the questions generated by V were of the following form:
• Encryptions of uniform randomness of some predetermined length scaling as polylog(|x|), or
• Non-encrypted uniform randomness of some predetermined length scaling as polylog(|x|),
8We note that, in this particular situation, classical binding actually suffices; collapse-binding is not necessary.
54


where the length depends on |x| and C. For our current purposes, we would like to claim that this means that V can
generate its challenges in time ˜
O(|x|) + polylog|x| · poly(𝜆), and in particular does not need to run the potentially
costly reduction from x to a Hamiltonian problem (H,𝛼, 𝛽). In order to ensure that this is the case, let us specify that
C is given as a description of the algorithm, together with an explicit polynomial upper-bounding the runtime of C.
Then, the length of the randomness to be generated in the challenges depends only on the number of qubits and terms
in the Hamiltonian H, which in turn can be efficiently computed given |x|, and the explicit polynomial. This means it
can be computed in ˜
O(|x|) time.
Now, let us calculate the runtime for the succinct verifier ˜
V in Phase 1. First, the runtime to generate the questions
ˆ
q1,q2 is ˜
O(n) +polylogn·poly𝜆by the previous paragraph. Moreover, since these questions come from a question-
succinct protocol, their length is polylogn · poly𝜆—we will need this later when we analyse Phase 3. Next, let us
compute the runtime for the succinct argument of knowledge at the end of Phase 1. The relation R1 has instance length
equal to ℓ1 = |com1| = poly(logn)·poly(𝜆), and R1 can be decided in time T1 = poly(n,𝜆). Thus, by Lemma 7.1, the
runtime of the succinct argument is ˜
O(ℓ1)+poly(log(T1))·poly(𝜆) = poly(logn)·poly(𝜆).
Now we move on to Phases 2 and 3. Here we can see that the runtime is dominated by the runtime of the succinct
arguments of knowledge. In Phase 2, the runtime is identical to that of Phase 1. For Phase 3, the relation R3 has
instance length
ℓ3 = |com1|+|com2|+|x|+|C|+𝜆+| ˆ
q1|+|q2|+|sk|
= n+poly(𝜆)·polylogn.
It can be decided in time T3 = poly(n,𝜆). Thus, again applying Lemma 7.1, the runtime of the succinct argument is
˜
O(ℓ3)+poly(logT3)·poly𝜆= ˜
O(n)+poly(logn)·poly(𝜆).
All together, the total runtime of ˜
V is ˜
O(n)+polylog(n)·poly(𝜆) as desired.
References
[Aar07]
Scott Aaronson. The Aaronson $25.00 prize, 2007. https://scottaaronson.blog/?p=284.
[Ara02]
PK Aravind. A simple demonstration of Bell’s theorem involving two observers and no probabilities or
inequalities. 2002, arXiv:quant-ph/0206070.
[BCM+21] Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh Vazirani, and Thomas Vidick. A crypto-
graphic test of quantumness and certifiable randomness from a single quantum device. Journal of the
ACM (JACM), 68(5):1–47, 2021, arXiv:1804.00640.
[Bel64]
John S Bell. On the Einstein Podolsky Rosen paradox. Physics Physique Fizika, 1(3):195, 1964.
[BKL+22]
James Bartusek, Yael Tauman Kalai, Alex Lombardi, Fermi Ma, Giulio Malavolta, Vinod Vaikuntan-
athan, Thomas Vidick, and Lisa Yang.
Succinct classical verification of quantum computation.
In
Advances in Cryptology–CRYPTO 2022: 42nd Annual International Cryptology Conference, CRYPTO
2022, Santa Barbara, CA, USA, August 15–18, 2022, Proceedings, Part II, pages 195–211. Springer,
2022. https://eprint.iacr.org/2022/857.
[BKVV20] Zvika Brakerski, Venkata Koppula, Umesh Vazirani, and Thomas Vidick. Simpler proofs of quantumness.
2020, arXiv:2005.04826.
[BL08]
Jacob D Biamonte and Peter J Love. Realizable hamiltonians for universal adiabatic quantum computers.
Physical Review A, 78(1):012352, 2008, arXiv:0704.1287.
[CMM+24] David Cui, Giulio Malavolta, Arthur Mehta, Anand Natarajan, Connor Paddock, Simon Schmidt, Michael
Walter, and Tina Zhang. A computational Tsirelson’s theorem for the value of compiled XOR games.
2024, arXiv:2402.17301.
55


[CMSZ22]
Alessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandry. Post-quantum succinct arguments:
breaking the quantum rewinding barrier.
In 2021 IEEE 62nd Annual Symposium on Foundations of
Computer Science (FOCS), pages 49–58. IEEE, 2022, arXiv:2103.08140.
[dlS22]
Mikael de la Salle. Spectral gap and stability for groups and non-local games. 2022, arXiv:2204.07084.
[GGM86]
Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions. Journal of
the ACM (JACM), 33(4):792–807, 1986.
[GH15]
W. T. Gowers and O. Hatami. Inverse and stability theorems for approximate representations of finite
groups. Sbornik: Mathematics, 208(12):1784, 2015, arXiv:1510.04085.
[GKNV24] Sam Gunn, Yael Kalai, Anand Natarajan, and Ági Villányi. Classical commitments to quantum states.
2024. To appear.
[Gri17]
Alex B Grilo. A simple protocol for verifiable delegation of quantum computation in one round. 2017,
arXiv:1711.09585.
[GV19]
Alexandru Gheorghiu and Thomas Vidick. Computationally-secure and composable remote state pre-
paration. In 2019 IEEE 60th Annual Symposium on Foundations of Computer Science (FOCS), pages
1024–1033. IEEE, 2019, arXiv:1904.06320.
[GV24]
Aparna Gupte and Vinod Vaikuntanathan. How to construct QFHE, generically, 2024. To appear.
[JLS21]
Aayush Jain, Huijia Lin, and Amit Sahai. Indistinguishability obfuscation from well-founded assump-
tions. In Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, pages
60–73, 2021, arXiv:2008.09317.
[JNV+20]
Zhengfeng Ji, Anand Natarajan, Thomas Vidick, John Wright, and Henry Yuen. MIP* = RE. 2020,
arXiv:2001.04383.
[JNV+22]
Zhengfeng Ji, Anand Natarajan, Thomas Vidick, John Wright, and Henry Yuen. Quantum soundness
of testing tensor codes. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science
(FOCS), pages 586–597. IEEE, 2022.
[Kil92]
Joe Kilian. A note on efficient zero-knowledge proofs and arguments. In Proceedings of the twenty-fourth
annual ACM symposium on Theory of computing, pages 723–732, 1992.
[KLVY21]
Yael Kalai, Alex Lombardi, Vinod Vaikuntanathan, and Lisa Yang. Quantum advantage from any non-
local game. 2021, arXiv:2203.15877.
[KSV02]
Alexei Yu Kitaev, Alexander Shen, and Mikhail N Vyalyi. Classical and quantum computation. Num-
ber 47. American Mathematical Soc., 2002.
[LMS22]
Alex Lombardi, Fermi Ma, and Nicholas Spooner. Post-quantum zero knowledge, revisited or: How to
do quantum rewinding undetectably. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer
Science (FOCS), pages 851–859. IEEE, 2022, arXiv:2111.12257.
[Mah17]
Urmila Mahadev. Classical homomorphic encryption for quantum circuits. SIAM Journal on Computing,
(0):FOCS18–189, 2017, arXiv:1708.02130.
[Mah18]
Urmila Mahadev. Classical verification of quantum computations. In 2018 IEEE 59th Annual Symposium
on Foundations of Computer Science (FOCS), pages 259–267. IEEE, 2018, arXiv:1804.01082.
[Mer87]
Ralph C Merkle. A digital signature based on a conventional encryption function. In Conference on the
theory and application of cryptographic techniques, pages 369–378. Springer, 1987.
56


[Mer90]
David Mermin. Simple unified form for the major no-hidden-variables theorems. Physical Review Let-
ters, 65(27):3373, 1990.
[MF16]
Tomoyuki Morimae and Joseph F Fitzsimons.
Post hoc verification with a single prover.
2016,
arXiv:1603.06046.
[MV21]
Tony Metger and Thomas Vidick. Self-testing of a single quantum device under computational assump-
tions. Quantum, 5:544, 2021, arXiv:2001.09161.
[NN90]
Joseph Naor and Moni Naor. Small-bias probability spaces: Efficient constructions and applications.
In Proceedings of the twenty-second annual ACM symposium on Theory of computing, pages 213–223,
1990.
[NN24]
Anand Natarajan and Chinmay Nirkhe. The status of the quantum pcp conjecture (games version). 2024,
arXiv:2403.13084.
[NV17]
Anand Natarajan and Thomas Vidick. A quantum linearity test for robustly verifying entanglement. In
Proceedings of the 49th Annual ACM SIGACT Symposium on Theory of Computing, pages 1003–1015,
2017.
[NV18]
Anand Natarajan and Thomas Vidick. Low-degree testing for quantum states, and a quantum entangled
games PCP for QMA. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science
(FOCS), pages 731–742. IEEE, 2018, arXiv:1801.03821.
[NW19]
Anand Natarajan and John Wright. NEEXP ⊆MIP∗. 2019, arXiv:1904.05870v3.
[NZ23a]
Anand Natarajan and Tina Zhang. Bounding the quantum value of compiled nonlocal games: From
CHSH to BQP verification. In 2023 IEEE 64th Annual Symposium on Foundations of Computer Science
(FOCS), pages 1342–1348, 2023, arXiv:2303.01545.
[NZ23b]
Anand Natarajan and Tina Zhang. Quantum free games. In Proceedings of the 55th Annual ACM Sym-
posium on Theory of Computing, pages 1603–1616, 2023, arXiv:2302.04322.
[O’D14]
Ryan
O’Donnell.
Analysis
of
Boolean
Functions.
Cambridge
University
Press,
2014,
arXiv:2105.10386.
[Per90]
Asher Peres. Incompatible results of quantum measurements. Physics Letters A, 151(3-4):107–108,
1990.
[Sca13]
Valerio Scarani. The device-independent outlook on quantum physics (lecture notes on the power of
Bell’s theorem). Acta Physica Slovaca, 62(4):347–409, 2013, arXiv:1303.3081.
[Unr16]
Dominique Unruh.
Computationally binding quantum commitments.
In Advances in Cryptology–
EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Crypto-
graphic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II 35, pages 497–527. Springer,
2016.
[Vid20]
Thomas Vidick. Interactions with quantum devices (course), 2020. http://users.cms.caltech.
edu/~vidick/teaching/fsmp/fsmp.pdf.
[Vid22]
Thomas Vidick. Almost synchronous quantum correlations. Journal of mathematical physics, 63(2),
2022, arXiv:2103.02468.
[Zha21]
Mark Zhandry. Quantum lightning never strikes the same state twice. or: quantum money from crypto-
graphic assumptions. Journal of Cryptology, 34:1–56, 2021, arXiv:1711.02276.
[Zha22]
Jiayu Zhang.
Classical verification of quantum computations in linear time.
In 2022 IEEE
63rd Annual Symposium on Foundations of Computer Science (FOCS), pages 46–57. IEEE, 2022,
arXiv:2202.13997.
57


Succinct Classical Verification of Quantum Computation
James Bartusek∗
Yael Tauman Kalai†
Alex Lombardi‡
Fermi Ma§
Giulio Malavolta¶
Vinod Vaikuntanathan‖
Thomas Vidick∗∗
Lisa Yang††
June 28, 2022
Abstract
We construct a classically verifiable succinct interactive argument for quantum computation
(BQP) with communication complexity and verifier runtime that are poly-logarithmic in the
runtime of the BQP computation (and polynomial in the security parameter). Our protocol is
secure assuming the post-quantum security of indistinguishability obfuscation (iO) and Learning
with Errors (LWE). This is the first succinct argument for quantum computation in the plain
model; prior work (Chia-Chung-Yamakawa, TCC ’20) requires both a long common reference
string and non-black-box use of a hash function modeled as a random oracle.
At a technical level, we revisit the framework for constructing classically verifiable quantum
computation (Mahadev, FOCS ’18). We give a self-contained, modular proof of security for
Mahadev’s protocol, which we believe is of independent interest. Our proof readily generalizes to
a setting in which the verifier’s first message (which consists of many public keys) is compressed.
Next, we formalize this notion of compressed public keys; we view the object as a generalization
of constrained/programmable PRFs and instantiate it based on indistinguishability obfuscation.
Finally, we compile the above protocol into a fully succinct argument using a (sufficiently
composable) succinct argument of knowledge for NP. Using our framework, we achieve several
additional results, including
• Succinct arguments for QMA (given multiple copies of the witness),
• Succinct non-interactive arguments for BQP (or QMA) in the quantum random oracle
model, and
• Succinct batch arguments for BQP (or QMA) assuming post-quantum LWE (without iO).
∗UC Berkeley. Email:
bartusek.james@gmail.com.
†Microsoft Research and MIT. Email: yael@microsoft.com.
‡MIT. Email: alexjl@mit.edu.
§Simons Institute and UC Berkeley. Email: fermima@alum.mit.edu.
¶Max Planck Institute for Security and Privacy. Email: giulio.malavolta@hotmail.it.
‖MIT. Email: vinodv@mit.edu.
∗∗Caltech. Email: vidick@caltech.edu.
††MIT. Email; lisayang@mit.edu.


Contents
1
Introduction
1
2
Technical Overview
4
2.1
Recap: Mahadev’s Measurement Protocol . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2
Defining a (Succinct) Measurement Protocol . . . . . . . . . . . . . . . . . . . . . . .
6
2.3
Constructing a Verifier-Succinct Measurement Protocol
. . . . . . . . . . . . . . . .
7
2.4
Proof of Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8
2.5
From a Verifier-Succinct Measurement Protocol to Succinct Arguments for BQP
. .
13
3
Preliminaries
14
3.1
Quantum Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
3.2
Black-Box Access to Quantum Algorithms . . . . . . . . . . . . . . . . . . . . . . . .
15
3.3
Interactive Arguments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
16
3.4
Computational Indistinguishability . . . . . . . . . . . . . . . . . . . . . . . . . . . .
17
3.5
Mahadev Randomized TCFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18
3.6
Collapsing Hash Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
20
3.7
Fully Homomorphic Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
21
3.8
Indistinguishability Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
21
3.9
Puncturable PRFs
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
22
4
Commit-and-Measure Protocols
23
4.1
Defining Commit-and-Measure Protocols . . . . . . . . . . . . . . . . . . . . . . . . .
23
5
A Measurement Protocol Template
26
5.1
Measurement Protocol Description . . . . . . . . . . . . . . . . . . . . . . . . . . . .
27
6
Soundness of Mahadev’s Protocol
29
6.1
The Verifier’s Output Distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . .
29
6.2
The Protocol Observables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
6.3
The Extracted State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
33
6.4
Indistinguishability of Measurement Outcomes
. . . . . . . . . . . . . . . . . . . . .
36
7
Succinct Key Generation from iO
41
7.1
Batch Key Generation: Definition and Construction
. . . . . . . . . . . . . . . . . .
41
7.2
Combining Succinct Key Generation with Mahadev rTCFs
. . . . . . . . . . . . . .
45
8
A Verifier-Succinct Protocol
47
8.1
Quantum commit-challenge-response protocols
. . . . . . . . . . . . . . . . . . . . .
47
8.2
Non-Interactive Post Hoc Verification of QMA . . . . . . . . . . . . . . . . . . . . .
48
8.3
Semi-Succinct Delegation for QMA . . . . . . . . . . . . . . . . . . . . . . . . . . . .
48
i


9
The Fully Succinct Protocol
50
9.1
State-Preserving Succinct Arguments of Knowledge . . . . . . . . . . . . . . . . . . .
51
9.2
The QMA Protocol, Version 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
52
9.3
The QMA Protocol, Version 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
54
10 Additional Results
56
10.1 Succinct Non-interactive Arguments in the QROM . . . . . . . . . . . . . . . . . . .
56
10.2 Batch Arguments for QMA
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
58
10.3 Zero Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
59
A Proofs from Section 8
64
B Proof of Claim 6.4
67
C Proof of Claim 6.7
68
ii


1
Introduction
Efficient verification of computation is one of the most fundamental and intriguing concepts in
computer science, and lies at the heart of the P vs. NP question.
It has been studied in the
classical setting for over three decades, giving rise to beautiful notions such as interactive proofs
[GMR85], multi-prover interactive proofs [BGKW88], probabilistically checkable proofs [BFL90,
ALM+92, AS92], and culminating with the notion of a succinct (interactive and non-interactive)
argument [Kil92, Mic94]. Roughly speaking, a succinct argument for a T-time computation enables
a prover running in poly(T) time to convince a polylog(T)-time verifier of the correctness of the
computation using only polylog(T) bits of communication, with soundness against all polynomial-
time cheating provers.
In a breakthrough result in 2018, Mahadev [Mah18] presented an interactive argument system
that enables a classical verifier to check the correctness of an arbitrary quantum computation.
Mahadev’s protocol represents a different kind of interactive argument — unlike the traditional
setting in which the prover simply has more computational resources (i.e., running time) than
the verifier, the prover in Mahadev’s protocol works in a qualitatively more powerful computa-
tional model. More precisely, for any T-time quantum computation, Mahadev’s protocol enables a
quantum prover running in time poly(T) to convince a classical poly(T)-time verifier with poly(T)
bits of classical communication. Soundness holds against all quantum polynomial-time cheating
provers under the post-quantum hardness of the learning with errors (LWE) problem.
A fundamental question is whether we can get the best of both worlds: can the prover have both
a more powerful computational model and significantly greater computational resources? Namely,
we want an interactive argument system for T-time quantum computation in which the quantum
prover runs in poly(T) time and convinces a polylog(T)-time classical verifier with polylog(T) bits
of classical communication.
We answer this question affirmatively, both for poly(T)-time quantum computations, corre-
sponding to the complexity class BQP, and also for the non-deterministic analog QMA.
Theorem 1.1 (Succinct Arguments for BQP). Let λ be a security parameter. Assuming the
existence of a post-quantum secure indistinguishability obfuscation scheme (iO) and the post-
quantum hardness of the learning with errors problem (LWE), there is an interactive argument
system for any T-time quantum computation on input x,1 where
• the prover is quantum and runs in time poly(T, λ),
• the verifier is classical and runs in time poly(log T, λ) + ˜
O(|x|),2 and
• the protocol uses poly(log T, λ) bits of classical communication.
Theorem 1.2 (Succinct Arguments for QMA). Assuming the existence of a post-quantum
secure indistinguishability obfuscation scheme (iO) and the post-quantum hardness of the
1A T-time quantum computation is a language L decidable by a bounded-error T-time quantum Turing machine
[BV97]. We leave it to future work to address more complex tasks such as sampling problems (as in [CLLW20]).
2As in the classical setting, some dependence on |x| is necessary at least to read the input; as in [Kil92], we achieve
a fairly minimal |x|-dependence.
1


learning with errors problem (LWE), there is an interactive argument system for any T-time
quantum computation on input x and a poly(T)-qubit witness, where
• the prover is quantum and runs in time poly(T, λ), using polynomially many copies of
the witness,3
• the verifier is classical and runs in time poly(log T, λ) + ˜
O(x), and
• the protocol uses poly(log T, λ) bits of classical communication.
A New Proof of Security for the [Mah18] Protocol.
One might hope to prove Theorems 1.1
and 1.2 by treating the Mahadev result as a “black box” and showing that any (classical) interac-
tive argument for quantum computations can be compressed into a succinct protocol via a suitable
cryptographic compiler. This is especially appealing given the extremely technical nature of Ma-
hadev’s security proof. Unfortunately, for reasons that will become clear in the technical overview,
this kind of generic compilation seems unlikely to be achievable in our setting. Even worse, there
does not appear to be any easily formalized property of the Mahadev protocol that would enable
such a compilation.
Instead, our solution consists of two steps.
(1) We build a modified variant of the [Mah18] protocol and give an entirely self-contained proof of
security. This modified protocol satisfies a few technical conditions that the original [Mah18]
does not; most prominently, the first verifier message of our modified protocol is already
succinct.
(2) We give a generic compiler that converts the protocol from Step (1) into a succinct argument
system.
Our Step (1) also results in a self-contained proof of security of the original [Mah18] protocol
that is more modular and amenable to further modification and generalization, which we believe
will be useful for future work. Our analysis builds upon [Mah18] itself as well as an alternative
approach described in Vidick’s (unpublished) lecture notes [Vid20]. A concrete consequence of our
new proof is that one of the two “hardcore bit” security requirements of the main building block
primitive (“extended noisy trapdoor claw-free functions”) in [Mah18] is not necessary.
Additional Results.
Beyond our main result of succinct arguments for BQP and QMA, we
explore a number of extensions and obtain various new protocols with additional properties.
• Non-Interactive: Although our protocols are not public-coin, we show how to modify them in
order to apply the Fiat-Shamir transformation and round-collapse our protocols. As a result,
we obtain designated-verifier non-interactive arguments for BQP (and the non-deterministic
analog QMA) with security in the quantum random oracle model (QROM).
3We inherit the need for polynomially-many copies of the witness from prior works. This is a feature common to
all previous classical verification protocols, and even to the quantum verification protocol of [FHM18].
2


• Zero-Knowledge: We show how to lift both variants of our protocol (interactive and non-
interactive) to achieve zero-knowledge. We show a generic transformation based on classical
two-party computation for reactive functionalities that makes our protocols simulatable. This
transformation does not add any new computational assumption to the starting protocol.
• Batch Arguments from LWE: For the case of batch arguments, i.e., where the parties engage
in the parallel verification of n statements, we show a succinct protocol that only assumes
the post-quantum hardness of LWE (without iO). In this context, succinctness requires that
the verifier’s complexity scales with the size of a single instance, but is independent of n.
Prior Work.
As discussed above, Mahadev [Mah18] constructs a non-succinct argument sys-
tem for BQP/QMA under LWE. The only prior work addressing succinct classical arguments for
quantum computation is the recent work of Chia, Chung and Yamakawa [CCY20]. [CCY20] con-
structs a classically verifiable argument system for quantum computation in the following setting:
• The prover and verifier share a poly(T)-bits long, structured reference string (which requires
a trusted setup to instantiate) along with a hash function h (e.g. SHA-3).
• The “online communication” of the protocol is succinct (poly(log T)).
• Security is heuristic: it can be proved when h is modeled as a random oracle, but the protocol
description itself explicitly requires the code of h (i.e. uses h in a non-black-box way).
We specifically note that when viewed in the plain model (i.e., without setup), the verifier must
send the structured reference string to the prover, resulting in a protocol that is not succinct.
We note that [CCY20] was specifically optimizing for a two-message protocol, but their approach
seems incapable of achieving succinctness in the plain model even if further interaction is allowed.
By contrast, our succinct interactive arguments are in the plain model and are secure based on
well-formed cryptographic assumptions, and our succinct 2-message arguments are proved secure
in the QROM (and do not require a long common reference string).
Finally, we remark that our approach to achieving succinct arguments fundamentally (and
likely necessarily) differs from [CCY20] because we manipulate the “inner workings” of the [Mah18]
protocol; by contrast [CCY20] makes “black-box” use of a specific soundness property of the [Mah18]
protocol (referred to as “computational orthogonality” by [ACGH20]) and is otherwise agnostic to
how the protocol is constructed.
Acknowledgments.
AL is supported in part by a Charles M. Vest fellowship. GM is partially
supported by the German Federal Ministry of Education and Research BMBF (grant 16K15K042,
project 6GEM). TV is supported by AFOSR YIP award number FA9550-16-1-0495, a grant from
the Simons Foundation (828076, TV), MURI Grant FA9550-18-1-0161, the NSF QLCI program
through grant number OMA-2016245 and the IQIM, an NSF Physics Frontiers Center (NSF Grant
PHY-1125565) with support of the Gordon and Betty Moore Foundation (GBMF-12500028). AL,
VV, and LY are supported in part by DARPA under Agreement No. HR00112020023, a grant from
MIT-IBM Watson AI, a grant from Analog Devices, a Microsoft Trustworthy AI grant and the
3


Thornton Family Faculty Research Innovation Fellowship. Any opinions, findings and conclusions
or recommendations expressed in this material are those of the author(s) and do not necessarily
reflect the views of the United States Government or DARPA. LY was supported in part by an
NSF graduate research fellowship.
2
Technical Overview
Our starting point is Mahadev’s protocol for classical verification of quantum computation [Mah18],
the core ingredient of which is a measurement protocol.
2.1
Recap: Mahadev’s Measurement Protocol
We begin by reviewing Mahadev’s N-qubit measurement protocol. In Mahadev’s protocol, a quan-
tum prover holding an N-qubit quantum state ρ interacts with a classical verifier, who wants to
obtain the result of measuring ρ according to measurement bases h ∈{0, 1}N (hi specifies a basis
choice for the ith qubit, with hi = 1 corresponding to the Hadamard basis and hi = 0 corresponding
to the standard basis).
Trapdoor Claw-Free Functions.
At the heart of the protocol is a cryptographic primitive
known as an injective/claw-free trapdoor function (a variant of lossy trapdoor functions [PW08,
PVW08, GVW15]), which consists of two trapdoor function families Inj (for injective) and Cf (for
claw-free), with the following syntactic requirements:4
• Each function in Cf ∪Inj is indexed by a public-key pk, where functions fpk ∈Inj are injective
and functions fpk ∈Cf are two-to-one. Moreover, pk can be sampled along with a secret key
sk that enables computing f−1
pk (i.e., f−1
pk (y) consists of a single pre-image if fpk ∈Inj, and two
pre-images if fpk ∈Cf).
• All functions in Inj and Cf have domain {0, 1}ℓ+1 (for some ℓ) and the two pre-images of y
under fpk ∈Cf are of the form (0, x0) and (1, x1) for some x0, x1 ∈{0, 1}ℓ.
An injective/claw-free trapdoor function must satisfy the following security properties:5
1. Claw-Free/Injective Indistinguishability. A random function in fpk ←Cf is computa-
tionally indistinguishable from a random function fpk ←Inj.
2. Adaptive Hardcore Bit. Given fpk ←Cf, it is computationally infeasible to output both
(1) a pair (x, y) satisfying fpk(x) = y and (2) a non-zero string d ∈{0, 1}ℓ+1 such that
d · (1, x0 ⊕x1) = 0, where (0, x0) and (1, x1) are the two preimages of y.6
4The actual syntactic requirements, described in Section 3.5, are somewhat more complex due to the fact that
the functions in question are probabilistic.
5In fact, Mahadev’s proof relies on two different hardcore bit properties, but we show in this work that only the
adaptive hardcore bit property is needed.
6The full definition places a slightly stronger restriction on d than simply being non-zero. However, this simplified
version will suffice for this overview.
4


To build some intuition about the usefulness of such function families, notice that they can be
used to commit to a single classical bit quite easily. The commitment key is a function fpk ∈Inj,
and commitment to a bit b is y = fpk(b, x) for a random x ∈{0, 1}n. It is not hard to verify that
this is a statistically binding and computationally hiding commitment of b. On the other hand, if
fpk ∈Cf, it is a statistically hiding and computationally binding commitment of b.7
Protocol Description.
With this intuition in mind, we now describe a (slightly simplified version
of) the Mahadev measurement protocol. Mahadev’s protocol is a many-fold sequential repetition
of the following one-bit challenge protocol.
V →P: The verifier samples N pairs of functions and their trapdoors: for every i ∈[ℓ], he samples
(pki, ski) ←Inj if hi = 0 and (pki, ski) ←Cf if hi = 1. He sends the N-tuple of public keys
(function descriptions) (pk1, . . . , pkN) to the prover.
P →V: The prover holds an N-qubit state ρ on register B = B1 ⊗· · · BN. She initializes registers
X = X1 ⊗· · · XN so that each Xi is an ℓ-qubit register in uniform superposition. Then she
evaluates each fpki on the ℓ+ 1 qubit register Bi ⊗Xi and measures the output to obtain yi.
Finally, she sends (y1, . . . , yN) to the verifier, keeping the registers B, X for herself.
V →P: The verifier picks a random challenge bit c ←{0, 1} and sends it to the prover. c = 0
indicates a “test round” and c = 1 indicates a “measurement round”.
P →V: If c = 0 (“test”), the prover measures each Bi ⊗Xi in the standard basis, obtaining
(bi, xi) ∈{0, 1} × {0, 1}ℓ, and sends (bi, xi)N
i=1 to the verifier.
If c = 1 (“measure”), she measures each Bi ⊗Xi in the Hadamard basis (i.e., she applies
the Hadamard gate H on each qubit and then measures in the standard basis), obtaining
di ∈{0, 1}ℓ+1, and sends (di)N
i=1 to the verifier.
V (output): If c = 0 (“test”), V either accepts or rejects the interaction but outputs nothing. In
particular, V checks that fpki(bi, xi) = yi. If any of the checks fail, reject.
If c = 1 (“measure”), proceed as follows. Let R ⊆[N] be the set of indices where hi = 1,
corresponding to Hadamard basis measurements, and let S = [N] \ R be the set of indices
corresponding to standard basis measurements.
For each i ∈R, V computes the two inverses (0, xi,0) and (1, xi,1) of yi (which are guaranteed
to exist since fpk,i ∈Cf) using ski. V sets ui := d · (1, xi,0 ⊕xi,1) as the ith measurement
outcome. For every i ∈S, V ignores di, and sets vi to be the first bit of f−1
pki(yi), computed
using the trapdoor ski (this is well-defined since fpk,i ∈Inj). Finally V outputs the N-bit
string (u, v) ∈{0, 1}R × {0, 1}S.
Mahadev [Mah18] proves that if a malicious prover P∗passes the test round with probability 1,
then there exists an N-qubit quantum state ρ∗— independent of the verifier’s measurement basis
h — such that the result of measuring ρ∗according to h is computationally indistinguishable from
7In particular, fpk ∈Cf satisfies Unruh’s definition of collapse-binding [Unr16b].
5


the verifier’s N-bit output distribution in the measurement round.8 While her definition requires
that such a ρ∗exists, Vidick and Zhang [VZ21] showed that Mahadev’s proof steps implicitly define
an extractor that efficiently produces ρ∗using black-box access to P∗.
2.2
Defining a (Succinct) Measurement Protocol
Our first (straightforward but helpful) step is to give an explicit definition of a commit-and-
measure protocol that abstracts the completeness and soundness properties of Mahadev’s mea-
surement protocol as established in [Mah18, VZ21].
Roughly speaking, a commit-and-measure
protocol is sound if, for any malicious prover P∗that passes the test round with probability 1 and
any basis choice h, there exists an efficient extractor that (without knowledge of h) interacts with
prover and outputs an extracted state τ such that the following are indistinguishable:
• the distribution of verifier outputs obtained in the measurement round from interacting with
P∗using basis choice h, and
• the distribution of measurement outcomes obtained from measuring τ according to h.
This abstraction will be particularly helpful for reasoning about our eventual succinct measurement
protocols, which will necessitate modifying Mahadev’s original protocol.
Can a Measurement Protocol be Succinct?
Given the definition of a measurement protocol,
an immediate concern arises with respect to obtaining succinct arguments: the verifier’s input to
the measurement protocol – the basis vector h – is inherently non-succinct. Since the number of
qubits N grows with the runtime of the BQP computation when used to obtain quantum verification
[FHM18], this poses an immediate problem.
Our solution to this problem is to only consider basis vectors h that are succinct; our formal-
ization is that h must be the truth table of an efficiently computable function f : [log N] →{0, 1}.
For any such h, we can represent the verifier’s input as a circuit C that computes h, removing the
above obstacle.
However, in order for there to be any hope of this idea working, it must be the case that
measurement protocols for bases with succinct representations are still useful for constructing dele-
gation for BQP. Fortunately, it has been shown [ACGH20] that classically verifiable (non-succinct)
arguments for BQP can be constructed by invoking Mahadev’s measurement protocol (and, by in-
spection of the proof, any measurement protocol satisfying our definition) on a uniformly random
basis string h ←{0, 1}N. Then, by computational indistinguishability, it is also possible to use a
pseudorandom string h that has a succinct representation, i.e., h = (PRFs(1), . . . , PRFs(N)) for
some (post-quantum) pseudorandom function PRF.
Thus, we focus for the moment on constructing a succinct measurement protocol for h with
succinct representation, and return to the full delegation problem later.
8This can be extended to provers that pass the test round with probability 1 −ε by the gentle measurement
lemma. In particular, an efficient distinguisher can only distinguish the verifier’s output distribution from the result
of measuring some ρ∗with advantage poly(ε).
6


2.3
Constructing a Verifier-Succinct Measurement Protocol
Inspecting the description of the [Mah18] protocol, there are three distinct reasons that the protocol
is not succinct:
1. The verifier’s first message, which consists of N TCF public keys, is non-succinct.
2. The prover’s two messages, consisting of the commitments yi and openings zi respectively,
are non-succinct.
3. The verifier’s decision predicate, as it is a function of these commitments and openings,
requires poly(N) time to evaluate.
The latter two issues turn out to be not too difficult to resolve (although there is an important
subtlety that we discuss later); for now, we focus on resolving (1), which is our main technical
contribution. Concretely, we want to construct a measurement protocol for succinct bases h where
the verifier’s first message is succinct.
Idea: Compress the Verifier’s message with iO.
Given the problem formulation, a natural
idea presents itself: instead of having V send over N i.i.d. public keys pki, perhaps V can send
a succinct program PK that contains the description of N public keys pki that are in some sense
“pseudoindependent!” Using the machinery of obfuscation and the “punctured programs” technique
[SW14], it is straightforward to write down a candidate program for this task: simply obfuscate
the following code.
Input: index i ≤N
Hardwired Values: Puncturable PRF seed s. Circuit C.
• Compute mode = C(i) and r = PRFs(i).
• Compute (pki, ski) ←Gen(1λ, mode; r).
• Output pki.
Here, C is an efficient circuit with truth table h, and Gen(1λ, mode) indicates sampling either
from Inj or Cf depending on whether hi = C(i) = 0 or hi = C(i) = 1.
Letting PK denote an obfuscation of the above program, V could send PK to P and allow the
prover to compute each pki = PK(i) on its own, and the protocol could essentially proceed as
before, except that the verifier will have to expand its PRF seed s into (sk1, . . . , skN) in order to
compute its final output.
7


Problem: Proving Soundness.
While it is not hard to describe this plausible modification to
the [Mah18] protocol that compresses the verifier’s message, it is very unclear how to argue that
the modified protocol is sound. The obfuscation literature has no shortage of proof techniques
developed over the last 10 years, but since we have made a “non-black-box” modification of the
[Mah18] protocol, a deep understanding of the [Mah18] proof of soundness is required in order to
understand to what extent these techniques are compatible with the application at hand.
We believe it should be possible to incorporate punctured programming techniques into Ma-
hadev’s proof of soundness in [Mah18] and conclude the desired soundness property of the new
protocol. However, doing so would result in an extremely complex proof that would require the
reader to verify the entirety of the [Mah18] (already very complicated) original security proof with
our modifications in mind.
2.4
Proof of Soundness
Given the complicated nature of the [Mah18] proof of soundness, we instead give a simpler and
more modular proof of soundness for the [Mah18] measurement protocol. Moreover, we give this
proof for a generic variant of the [Mah18] protocol where the prover is given an arbitrary represen-
tation PK of N TCF public keys and show that precisely two properties of this representation PK
are required in order for the proof to go through:
• An appropriate generalization of the “dual-mode” property of individual TCFs must hold for
PK: for any two circuits C1, C2, it should be that PK1 generated from basis C1 is compu-
tationally indistinguishable from PK2 generated from basis C2. In fact, a stronger variant
of this indistinguishability must hold: it should be the case that PK1 ≈c PK2 even if the
distinguisher is given all secret keys skj such that C1(j) = C2(j).
• For every i, the adaptive hardcore bit property of fpki should hold even given skj for all
j ̸= i.
Since these two properties are (essentially) all that is required for our proof to go through, in
order to obtain a verifier-succinct protocol, it suffices to show that the obfuscated program PK
above satisfies these two properties, which follows from standard techniques.
Thus, we proceed by describing our new soundness proof for the [Mah18] measurement protocol,
which transparently generalizes to the verifier-succinct setting.
The “Operational Qubits” Approach.
Let P ∗denote a prover that passes the test round (i.e.,
makes the verifier accept on the 0 challenge) with probability 1. Our goal is to show that the prover
in some sense “has an N-qubit state” such that measuring this state in the h-bases produces the
same (or an indistinguishable) distribution as the verifier’s protocol output, which we will denote
DP ∗,Out. This N-qubit state should be efficiently computable from the prover’s internal state |ψ⟩;
specifically, we use |ψ⟩to denote the prover’s state after its first message y has been sent.
In order to show this, taking inspiration from [Vid20],9 we will proceed in two steps:
9[Vid20] gives a soundness proof for a variant of the [Mah18] protocol, but in a qualitatively weaker setting.
8


1. Identify N “operational qubits” within |ψ⟩. That is, we will identify a set of 2N observables
Z1, . . . , ZN, X1, . . . , XN (analogous to the “Pauli observables” σz,1, . . . , σz,N, σx,1, . . . σx,N)
such that measuring |ψ⟩with these observables gives the outcome distribution DP ∗,Out.
Provided that these 2N observables roughly “behave like” Pauli observables with respect
to |ψ⟩(e.g. satisfy the X/Z uncertainty principle), one could then hope to:
2. Extract a related state |ψ′⟩such that measuring |ψ′⟩in the actual standard/Hadamard bases
matches the “pseudo-Pauli” {Zj}, {Xi}, measurements of |ψ⟩(and therefore DP ∗,Out).
Relating the Verifier’s Output to Measuring |ψ⟩.
Our current goal is to achieve Step (1)
above. Let |ψ⟩denote P ∗’s post-commitment state and let U denote the unitary such that P ∗’s
opening is a measurement of U |ψ⟩in the Hadamard basis.
Now, let us consider the verifier’s output distribution. The ith bit of the verifier’s output when
hi = 1 is defined to be d · (x0,i ⊕x1,i) (where d is the opening sent by the prover) of U |ψ⟩in the
Hadamard basis. For each such i, we can define an observable Xi characterizing this measurement,
that roughly takes the form
Xi ≈U †(HZi ⊗Id)
 X
d
(−1)d·(1,x0,i⊕x1,i) |d⟩
⟨d|Zi ⊗IdI,{Zj}j̸=i
!
(HZi ⊗Id)U.
Here we have slightly simplified the expression for Xi for the sake of presentation; the correct
definition of Xi (see Section 6.2) must account for the case where d is rejected by the verifier. To
reiterate, the observable Xi is a syntactic interpretation of the verifier’s output mi as a function of
|ψ⟩.
On the other hand, when hi = 0, the verifier’s output mi is not a priori a measurement of |ψ⟩;
indeed, the verifier ignores the prover’s second message and just inverts yi. However, under the
assumption that the prover P ∗passes the test round with probability 1 −negl(λ), making use of
the fact that fpki is injective, this yi-inverse must be equal to what the prover would have sent in
the test round. This defines another observable on |ψ⟩that we call Zi:
Zi =
X
b,x
(−1)b |b, x⟩
⟨b, x|Zi ⊗IdI,{Zj}j̸=i.
Finally, note that the operator Zi syntactically makes sense even when hi = 1. However, Xi
cannot even be defined when fpki is injective, corresponding to hi = 0, since Xi explicitly requires
two inverses of yi. Therefore, from now on, we sample all (pki, ski) ←Cf (forcing all TCFs to be
2-to-1).
This brings us to the punchline of this step: by invoking a computational assumption (the
indistinguishability of Cf and Inj), we can define observables (Xi, Zi) for all i ∈[N] such that for
every i and every basis choice h, the distribution resulting from measuring |ψ⟩with Xi (resp. Zi)
matches the ith bit of the verifier’s output distribution.
[Vid20] only proves indistinguishability of N-qubit measurements that are either all in the standard basis or all in
the Hadamard basis, and only proves indistinguishability with respect to linear tests of the distribution (that is,
[Vid20] proves small-bias rather than full indistinguishability). Both of these relaxations are unacceptable in our
setting, and achieving the latter specifically requires a different proof strategy.
9


With a little more work, one can actually show that the verifier’s entire output distribution in
the h-basis is computationally indistinguishable from the following distribution DP ∗,2-to-1:
• Sample keys (pki, ski) ←Cf. Run P ∗to obtain y, |ψ⟩.
• For each i such that hi = 0, measure the first bit of the prover’s ith response register in the
standard basis to obtain (and output) a bit bi.
• Measure U |ψ⟩in the Hadamard basis, obtaining strings (d1, . . . , dN).
• For each i such that hi = 1, compute (and output) di · (1, x0,i ⊕x1,i).
Aside: Why are these Zj and Xi helpful?
As alluded to earlier, this approach is inspired
by operational definitions of “having an N-qubit state,” which consists of a state |ψ⟩and 2N
“pseudo-Pauli” observables Z1, . . . , ZN, X1, . . . XN that behave “like Pauli observables” on |ψ⟩. For
example, it is possible to prove that many of the “Pauli group relations” hold approximately on
these Xi, Zj with respect to |ψ⟩, meaning that (for example)
⟨ψ| ZiXiZi + Xi |ψ⟩= negl(λ)
and
⟨ψ| ZjXiZj −Xi |ψ⟩= negl(λ)
for i ̸= j. In fact, these relations turn out to encode the two basic properties of the TCF fpki:
the adaptive hardcore bit property (encoded in the first relation) and that fpki is indistinguishable
from injective10 (encoded in the second relation)! We will not directly prove the relations here,
but they are implicit in our full security proof and are the motivation for this proof strategy.
The Extracted State.
Given these protocol observables Z1, . . . , ZN, X1, . . . , XN, it remains to
implement Step (2) of our overall proof strategy: extracting a state |ψ′⟩whose standard/Hadamard
measurement outcomes match DP ∗,Out. At a high level, this is achieved by “teleporting” the state
|ψ⟩onto a fresh N-qubit register in a way that transforms the “pseudo-Paulis" {Xi}, {Zj} into
real Pauli observables {σx,i}, {σz,j}.
Fix a choice of {Xi, Zi}, |ψ⟩←Samp. For ease of notation, write H = Z ⊗I ⊗U so that
|ψ⟩∈H. We would like an efficient extraction procedure that takes as input |ψ⟩∈H and generates
an N-qubit state τ such that, roughly speaking, measuring |ψ⟩with X/Z and measuring τ with
σX/σZ produce indistinguishable outcomes.
Intuition for the Extractor.
Before we describe our extractor, we first provide some underlying
intuition. For an arbitrary N-qubit Hilbert space, let σx,i/σz,i denote the Pauli σx/σz observable
acting on the ith qubit. For each r, s ∈{0, 1}N, define the N-qubit Pauli “parity” observables
σx(r) :=
Y
i:ri=1
σx,i , σz(s) :=
Y
i:ri=1
σz,i.
10Technically, the property encoded is the collapsing of fpki, which is implied by (but not equivalent to) being
indistinguishable from injective.
10


Suppose for a moment that |ψ⟩∈H is already an N-qubit state (i.e., H is an N-qubit Hilbert
space) and moreover, that each Xi/Zi observable is simply the corresponding Pauli observable
σx,i/σz,i. While these assumptions technically trivialize the task (the state already has the form
we want from the extracted state), it will be instructive to write down an extractor that
“teleports” this state into another N-qubit external register.
We can do this by initializing two N-qubit registers A1 ⊗A2 to |φ+⟩⊗N where |φ+⟩is the EPR
state (|00⟩+ |11⟩)/
√
2 (the ith EPR pair lives on the ith qubit of A1 and A2). Now consider the
following steps, which are inspired by the (N-qubit) quantum teleportation protocol
1. Initialize a 2N-qubit ancilla W to

02N
, and apply H⊗2N to obtain the uniform superposition.
2. Apply a “controlled-Pauli” unitary, which does the following for all r, s ∈{0, 1}N and all
|φ⟩∈H ⊗A1:
|r, s⟩W |φ⟩H,A1 →|r, s⟩W (σx(r)σz(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1
3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements11
on A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:
|u, v⟩W (σx(r)σz(s) ⊗Id)A1,A2

φ+⊗N
A1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)A1,A2

φ+⊗N
A1,A2 .
Finally, discard W.
One can show that the resulting state is
1
2N
X
r,s∈{0,1}N
(σx(r)σz(s) ⊗σx(r)σz(s) ⊗Id) |ψ⟩H

φ+
A1,A2 =

φ+
H,A1 |ψ⟩A2 ,
(1)
where |ψ⟩is now “teleported” into the A2 register.
The Full Extractor.
To generalize this idea to the setting where |ψ⟩∈H is an arbitrary quantum
state and {Xi, Zi}i are an arbitrary collection of 2N observables, we simply replace each σx(r)
and σz(s) acting on H above with the corresponding parity observables X(r), Z(s), defined
analogously (for r, s ∈{0, 1}N as
Z(s) =
N
Y
i=1
Zsi
i
and X(r) =
N
Y
i=1
Xri
i .
The rough intuition is that as long as the {Xi} and {Zi} observables “behave like” Pauli observables
with respect to |ψ⟩, the resulting procedure will “teleport” |ψ⟩into the N-qubit register A2.
11The Bell basis consists of the 4 states (σa
xσb
z ⊗Id)

φ+
for a, b ∈{0, 1} on 2 qubits.
11


Relating Extracted State Measurements to Verifier Outputs.
With the extracted state
defined to be the state on A2 after performing the “generalized teleportation” described above, it
remains to prove that the distribution DP ∗,Ext resulting from measuring the extracted state on A2
in the h-bases is indistinguishable from DP ∗,2-to-1.
One can show (by a calculation) that DP ∗,Ext is the following distribution (differences from
DP ∗,2-to-1 in red)
1. Sample keys (pki, ski) ←Cf. Run P ∗to obtain y, |ψ⟩.
2. For each i such that hi = 0, measure the first bit of the prover’s ith response register in the
standard basis to obtain (and output) a bit bi.
3. For each i such that hi = 1, flip a random bit wi and apply the unitary Zwi
i .
4. Measure U |ψ⟩in the Hadamard basis, obtaining strings (d1, . . . , dN).
5. For each i such that hi = 1, compute (and output) di · (1, x0,i ⊕x1,i) ⊕wi.
We prove indistinguishability between the N-bit distributions DP ∗,Ext and DP ∗,2-to-1 by con-
sidering N hybrid distributions, where the difference between Hybrid j −1 and Hybrid j is:
• an additional application of the unitary Zj in Item 3, and
• an additional XOR of ej (the jth standard basis vector) in Item 5.
To conclude the soundness proof, we show that Hybrid j −1 and Hybrid j in the following
three steps.
• First, we prove that the marginal distributions of Hybrid (j −1) and Hybrid j on N \{j} are
indistinguishable due to the collapsing property of fpkj. Intuitively this holds because the
marginal distributions on N \ {j} only differ by the application of Zj, which is undetectable
by collapsing.
• By invoking an elementary lemma about N-bit indistinguishability, the task reduces to prov-
ing a 1-bit indistinguishability of the jth bit of Hybrid (j −1) and Hybrid j, conditioned on
an efficiently computable property of the marginal distributions on N \ {j}.
• Finally, we show that the indistinguishability of the jth bit holds due to the adaptive hardcore
bit property of fpkj. At a very high level, the above jth bit property involves a measurement
of Xj, and the two hybrids differ in whether a random Zb
j is applied before Xj is measured;
in words, this exactly captures the adaptive hardcore bit security game.
We refer the reader to Section 6.4 for a full proof of indistinguishability.
12


2.5
From a Verifier-Succinct Measurement Protocol to Succinct Arguments for
BQP
Using Sections 2.3 and 2.4, we have constructed a verifier-succinct measurement protocol, for
succinctly represented basis strings, with a single bit verifier challenge. What remains is to convert
this into a (fully) succinct argument system for BQP (or QMA). This is accomplished via the
following transformations:
• Converting a measurement protocol into a quantum verification protocol. As described ear-
lier, this is achieved by combining the [FHM18] protocol for BQP verification with a lim-
ited quantum verifier (as modified by [ACGH20]) with our measurement protocol, using a
PRF to generate a pseudorandom basis choice instead of a uniformly random basis choice
for the [FHM18, ACGH20] verifier. This results in a verifier-succinct argument system for
BQP/QMA with constant soundness error.
• Parallel repetition to reduce the soundness error.
This follows from the “computational
orthogonal projectors” property of the 1-bit challenge protocol and follows from [ACGH20]
(we give a somewhat more abstract formulation of their idea in Appendix A). This results in
a verifier-succinct argument system for BQP/QMA with negligible soundness error.
• Converting a verifier-succinct argument system into a fully succinct argument system. We
elaborate on this last transformation below, as a few difficulties come up in this step.
Assume that we are given a (for simplicity, 4-message) verifier-succinct argument system for
BQP/QMA. Let m1, m2, m3, m4 denote the four messages in such an argument system. In order to
obtain a fully succinct argument system, we must reduce (1) the prover communication complexity
|m2| + |m4|, and (2) the runtime of the verifier’s decision predicate.
The first idea that comes to mind is to ask the prover to send short (e.g. Merkle tree) com-
mitments σ2 and σ4 of m2 and m4, respectively, instead of sending m2 and m4 directly. At the
end of the interaction, the prover and verifier could then engage in a succinct interactive argument
(of knowledge) for a (classical) NP statement that “the verifier would have accepted the commit-
ted messages underlying σ2 and σ4”. One could potentially employ Kilian’s succinct interactive
argument of knowledge for NP which was recently shown to be post-quantum secure under the
post-quantum LWE assumption [CMSZ21].
There are a few issues with this naive idea. First of all, the verifier’s decision predicate is private
(it depends on the secret key SK in the measurement protocol and the PRF seed for its basis),
so the NP statement above is not well-formed. One reasonable solution to this issue is to simply
have the verifier send this secret information st after the verifier-succinct protocol emulation has
occurred and before the NP-succinct argument has started. For certain applications (e.g. obtaining
a non-interactive protocol in the QROM) we would like to have a public-coin protocol; this can
be achieved by using fully homomorphic encryption to encrypt this secret information in the first
round rather than sending it in the clear in a later round. For this overview, we focus on the
private-coin variant of the protocol.
13


Now, we can indeed write down the appropriate NP relation12
RV ={((h, m1, σ2, m3, σ4, st), (m2, m4)) : σ2 = h(m2) and
σ4 = h(m4) and V (st, m1, m2, c, m4) = accept}
and execute the aforementioned strategy. However, this construction turns out not to work. Specif-
ically, it does not seem possible to convert a cheating prover P ∗in the above fully succinct protocol
into a cheating prover P ∗∗for the verifier-succinct protocol; for example, P ∗∗needs to be able to
produce a message m2 given only m1 from the verifier; meanwhile, the message m1 can only be ex-
tracted from P ∗by repeatedly rewinding P ∗’s last message algorithm, which requires the verifier’s
secret information st as input! This does not correspond to a valid P ∗∗, who does not have access
to st when computing m2.
Our refined compiler is to execute several arguments of knowledge: one right after the prover
sends σ2, proving knowledge of m2; another one right after she sends σ4, proving knowledge of m4
(both before receiving the secret state st from the verifier); and a third one for the relation RV
described above. The first two arguments of knowledge are for the relation
RH = {(h, σ), m) : h(m) = σ}
This allows for immediate extraction of m2 and m3 and appears to clear the way for a reduction
between the verifier-succinct and fully succinct protocol soundness properties.
However, there is one remaining problem: the argument-of-knowledge property of Kilian’s pro-
tocol proved by [CMSZ21] is insufficiently composable to be used in our compiler. They demon-
strate an extractor for Kilian’s protocol that takes any quantum cheating prover that convinces
the verifier and extracts a witness from them. However, their post-quantum extractor might sig-
nificantly disturb the prover’s state, meaning that once we extract m2 above, we may not be able
to continue the prover execution in our reduction.
Fortunately, a recent work [LMS21] shows that a slight variant of Kilian’s protocol is a suc-
cinct argument of knowledge for NP satisfying a composable extraction property called “state-
preservation.” This security property is exactly what is required for our compiler to extract a valid
cheating prover strategy P ∗∗for the verifier-succinct argument given a cheating prover P ∗for the
compiled protocol. A full discussion of this is given in Section 9.
This completes our construction of a succinct argument system for BQP (and QMA). We discuss
additional results (2-message protocols, zero knowledge, batch arguments) in Section 10.
3
Preliminaries
3.1
Quantum Information
Let H be a finite-dimensional Hilbert space. A pure state is a unit vector |ψ⟩∈H. Let D(H)
denote the set of all positive semidefinite operators on H with trace 1.
A mixed state is an
operator ρ ∈D(H), and is often called a density matrix. We sometimes divide H into named
registers written in uppercase calligraphic font, e.g., H = A ⊗B ⊗C.
12Note that the verifier also takes as input the QMA instance, but we suppress it here for clarity.
14


For a density matrix ρ ∈D(H), where H ≃(C2)⊗ℓ, we sometimes use the shortcut M(h, ρ) to
denote the distribution resulting from measuring each qubit of ρ (where the qubits are specified
by the isomorphism H ≃(C2)⊗ℓ) in the basis determined by h ∈{0, 1}ℓ. By convention, hi = 0
corresponds to measuring the i-th register in the standard basis {|0⟩, |1⟩} and hi = 1 corresponds
to measuring the i-th register in the Hadamard basis {|+⟩, |−⟩}.
An observable is represented by a Hermitian operator O on H. In particular, any observable O
can be written in the form P
i λiΠi where {λi} are real numbers and P
i Πi = Id. The measurement
corresponding to an observable O is the projective measurement {Πi} with corresponding outcomes
{λi}. A binary observable satisfies the additional requirement that O2 = Id. Notice that for any
binary observable, O is a unitary matrix with eigenvalues in {1, −1}. In this case we sometimes
treat the outcomes as bits through the usual correspondence 1 →0, −1 →1.
Given a binary observable O, we define its corresponding projection operators O+ = 1
2(Id+O)
and O−= 1
2(Id −O). O+ and O−correspond to projecting onto the +1 and −1 eigenspaces of O,
respectively, and thus form a binary projective measurement.
The Class QMA.
A language L = (Lyes, Lno) is in QMA if and only if there is a uniformly
generated family of polynomial-size quantum circuits V = {Vλ}λ∈N such that for every λ, Vλ takes
as input a string x ∈{0, 1}λ and a quantum state |φ⟩on p(λ) qubits and returns a single bit and
moreover the following conditions hold.
• For all x ∈Lyes of length λ, there exists a quantum state |ψ⟩on at most p(λ) qubits such
that the probability that Vλ accepts (x, |φ⟩) is at least 2/3. We denote the (possibly infinite)
set of quantum states (which we will also refer to as quantum witnesses) that make Vλ accept
x by R(x).
• For all x ∈Lno of length λ, and all quantum states |ψ⟩on at most p(λ) qubits, it holds that
Vλ accepts on input (x, |ψ⟩) with probability at most 1/3.
3.2
Black-Box Access to Quantum Algorithms
Let A be a polynomial-time quantum algorithm with internal state ρ ∈D(I) that takes a classical
input r and produces a classical output z. Without loss of generality, the behavior of A can be
described as follows:
1. Apply an efficient classical algorithm to r to generate the description of a unitary U(r).
2. Initialize registers Z ⊗I to |0⟩
⟨0|Z ⊗ρI.
3. Apply U(r) to Z ⊗I, measure Z in the computational basis, and return the outcome z.
A quantum oracle algorithm SA with black-box access to (A, ρ) does not have direct access to
the adversary’s internal registers I, and can only operate on the state ρ ∈D(I) by applying U(r)
or U(r)† for any r. In more detail, black-box access to (A, ρ) means the following:
• The registers Z ⊗I are initialized to |0⟩
⟨0|Z ⊗ρI.
15


• Once the Z ⊗I registers are initialized, the algorithm is permitted to perform arbitrary
operations on the Z register, but can only act on the I registers by applying U(r) or U(r)†
for any r. We explicitly permit the U(r) and U(r)† gates to be controlled on any external
registers (i.e., any registers other than the registers Z ⊗I to which U(r) is applied).
We note that this definition is consistent with the notions of interactive quantum machines
and oracle access to an interactive quantum machine used in e.g. [Unr12] and other works on
post-quantum zero-knowledge.
The Binary Input Case.
Following [Mah18], in the special case where r ∈{0, 1}, it will be
convenient to re-define the internal state to be ρ := U(0)(|0⟩
⟨0|Z ⊗ρ′
I)U(0)† (where ρ′
I ∈D(I)
denotes the “original” internal state), so that the behavior of A on r = 0 is to simply measure Z
in the computational basis, and on r = 1 it applies the unitary U := U(1)U(0)† to its state and
then measures the Z register. Notice that in this case, the internal state is technically on Z ⊗I
instead of just I. Thus, black-box access to a quantum algorithm with binary input is formalized
as follows:
• The registers Z ⊗I are initialized to ρ := U(0)(|0⟩
⟨0|Z ⊗ρ′
I)U(0)†.
• Once the Z ⊗I registers are initialized, the algorithm is permitted to perform arbitrary
operations on the Z register, but can only act on the I registers by applying (possibly
controlled) U or U † gates.
In this special case, an algorithm with black-box access to A is denoted SU,ρ.
We remark that these definitions are tailored to the two-message challenge-response setting,
whereas the protocols we consider in this paper have more rounds of interaction. However, our
analysis will typically focus on a single back-and-forth round of interaction (e.g., the last two mes-
sages of the [Mah18] protocol), so ρ will be the intermediate state of the interactive algorithm right
before the next challenge is sent.13 Moreover, the unitaries {U(r)}r can be treated as independent
of the (classical) protocol transcript before challenge r is sent, since we can assume this transcript
is saved in ρ.
3.3
Interactive Arguments
In what follows we define the notion of an interactive argument for QMA languages. We denote
such arguments by (P, V ), and denote the output bit of the verifier by Out(P, V ).
Definition 3.1. An interactive argument (P, V ) for a language L = (Lyes, Lno) ∈QMA with
relation R(x) is a (classical) 2-party interactive protocol between a QPT prover P and a
p.p.t. verifier V , with the following completeness and soundness guarantees:
13In the multi-round setting, “re-defining” the intermediate state to be ρ = U(0)(|0⟩
⟨0|Z ⊗ρ′
I)U(0)† can be imple-
mented by replacing any unitary W applied in the previous round with U(0)W; this follows the conventions used
in [Mah18].
16


Completeness.
For all λ ∈N, there exists a polynomial k = k(λ)
such that for all x ∈Lyes,
and all |φ⟩∈R(x), it holds that
Pr
h
Out

P(|φ⟩⊗k(λ) , x), V (x)

= 1
i
≥1 −negl(λ).
Computational Soundness.
For all λ ∈N, all x ∈Lno, and all non-uniform QPT provers
P ∗, it holds that
Pr [Out(P ∗(x), V (x)) = 1] ≤negl(λ).
Batch Arguments.
We also consider a sub-class of interactive arguments where the prover
simultaneously engages the verifier on n sub-instances (x1, . . . , xn), where each xi is supposed to
be a Yes-instance of a fixed language Li.
We require the following notion of (computational)
soundness.
Definition 3.2 (Soundness). An interactive argument (P, V ) for a batch language L = L1 ×
. . . × Ln ∈QMA with relation R(x) is sound if for all λ ∈N, all polynomials n = n(λ), all
indices i ∈[n], all statements (x1, . . . , xn), where xi ∈Lno, and all non-uniform QPT provers
P ∗, it holds that
Pr [Out(P ∗(x1, . . . , xn), V ((x1, . . . , xn))) = 1] ≤negl(λ).
3.4
Computational Indistinguishability
Two classical distribution ensembles {(X(λ), Y (λ))}λ are said to be post-quantum computationally
indistinguishable if for every non-uniform QPT algorithm A = {(A(λ), ρ(λ))}λ (that outputs a bit
b), we have that


E
h
A(λ)(X(λ), ρ(λ))
i
−E
h
A(λ)(Y (λ), ρ(λ))
i

 = negl(λ).
Two quantum state ensembles {ρ(λ)
0 , ρ(λ)
1 }λ are said to be computationally indistinguishable
if for every non-uniform QPT algorithm A = {A(λ), ρ(λ)} (that outputs a bit b), we have that


E
h
A(λ)(ρ(λ), ρ(λ)
0 )
i
−E
h
A(λ)(ρ(λ), ρ(λ)
1 )
i 

 = negl(λ).
Equivalently, {ρ(λ)
0 , ρ(λ)
1 }λ are computationally indistinguishable if for every efficiently com-
putable non-uniform binary observable (R, σ), we have that


 Tr(R(ρ0 ⊗σ)) −Tr(R(ρ1 ⊗σ))


 = negl(λ).
We will occasionally use the notation ρ0 ≈c ρ1 to denote computational indistinguishability of
{ρ(λ)
0 , ρ(λ)
1 }λ.
More generally, we use (T(λ), ε(λ))-indistinguishability to denote computational indistiguisha-
bility as above where the distinguisher is allowed to run in time T and the advantage is required
to be at most ε.
17


3.5
Mahadev Randomized TCFs
In this section, we define the cryptographic primitive used by Mahadev [Mah18] to obtain a (non-
succinct) delegation scheme for QMA with classical verification. The primitive is closely related
to Regev encryption [Reg05] and LWE-based “lossy” trapdoor functions [PW08, PVW08, GVW15],
but makes use of special-purpose structure relevant for quantum functionality. Most of this special-
purpose structure, in particular, the “adaptive hardcore bit”, was introduced in the work of Braker-
ski, Christiano, Mahadev, Vazirani and Vidick [BCM+18], but [Mah18] further requires “dual-mode
key generation” in addition to the [BCM+18] properties.
Given the numerous special-purpose
requirements, we refer to the primitive as “Mahadev randomized trapdoor claw-free functions
(rTCFs).”14
Definition 3.3. A Mahadev randomized trapdoor claw-free function family (Mahadev rTCF)
ClawFree is described by a tuple of efficient classical algorithms (Gen, Eval, Invert, Check, Good)
with the following syntax:
• Gen(1λ, mode) is a dual-mode PPT key generation algorithm that takes as input a secu-
rity parameter λ in unary, and a bit mode ∈{0, 1}, and it outputs a public key pk and
a private key sk. The description of the public key implicitly defines a domain of the
form {0, 1}×Dpk for the randomized function fpk. We view Dpk as an explicit (efficiently
verifiable and samplable) subset of {0, 1}ℓ(λ), so that applying bit operations to elements
of Dpk is well-defined.
In our context, mode = 0 samples keys for an injective function and mode = 1 samples
keys for a two-to-one function. For the sake of readability, we use a descriptive notation
by which mode ∈{injective, 2-to-1}, where mode = injective corresponds to mode = 0 and
mode = 2-to-1 corresponds to mode = 1.
• Eval(pk, b, x) is a (possibly probabilistic) algorithm that takes as input a public key pk, a
bit b ∈{0, 1} and an element x ∈Dpk, and outputs a string y with distribution χ.
• Invert(mode, sk, y) is a deterministic algorithm that takes as input mode ∈{injective, 2-to-1},
a secret key sk, and an element y in the range. If mode = injective then it outputs a pair
(b, x) ∈{0, 1} × Dpk or ⊥. If mode = 2-to-1 then it outputs two pairs (0, x0) and (1, x1)
with x0, x1 ∈Dpk, or ⊥.
• Check(pk, b, x, y) is a deterministic algorithm takes as input a public key pk, a bit b ∈
{0, 1}, an element x ∈Dpk, and an element y in the range, and it outputs a bit.
• Good(x0, x1, d) is a deterministic poly-time algorithm that takes as input two domain
elements x0, x1 ∈Dpk and a string d ∈{0, 1}ℓ+1.
It outputs a bit that characterizes
membership in a set that we call
Goodx0,x1 := {d : Good(x0, x1, d) = 1}.
14Actually, [Mah18] requires an extra (second) hardcore bit property (Property 2 of Definition 4.4 in [Mah18]) that
we drop from our definition, as our proof does not require it.
18


Moreover, we stipulate that Good(x0, x1, d) ignores the first bit of d.15
We require that the following properties are satisfied.
1. Correctness:
(a) For all (pk, sk) in the support of Gen(injective, 1λ): For every b ∈{0, 1}, every x ∈
Dpk, and every y ∈Supp(Eval(pk, (b, x))),
Invert(injective, sk, y) = (b, x).16
(b) For all (pk, sk) in the support of Gen(2-to-1, 1λ): For every b ∈{0, 1}, every x ∈Dpk,
and every y ∈Supp(Eval(pk, (b, x))),
Invert(2-to-1, sk, y) = ((0, x0), (1, x1))
such that xb = x and y ∈Supp(Eval(pk, (β, xβ))) for every β ∈{0, 1}.
(c) For every (pk, sk) ∈Supp(Gen(2-to-1, 1λ)) ∪Supp(Gen(injective, 1λ)), every b ∈{0, 1}
and every x ∈D,
Pr[Check(pk, (b, x), y) = 1] = 1
if and only if y ∈Supp(Eval(pk, (b, x))).
(d) For every (pk, sk) in the support of Gen(2-to-1, 1λ) and every pair of domain elements
x0, x1, the density of Goodx0,x1 is 1 −negl(λ).
2. Key Indistinguishability:
{pk : (pk, sk) ←Gen(2-to-1, 1λ)} ≈c {pk : (pk, sk) ←Gen(injective, 1λ)}
3. Adaptive Hardcore Bit: For every BQP adversary A = (A′, A∞) there exists a negli-
gible function µ such that for every λ ∈N, the following difference of probabilities is
equal to µ(λ):


 Pr[A1(pk, y) = (d, (b, x)) : Check(pk, b, x, y) = 1
∧
d · (1, x0 ⊕x1) = 0
∧
d ∈Goodx0,x1]
−Pr[A1(pk, y) = (d, (b, x)) : Check(pk, b, x, y) = 1
∧
d · (1, x0 ⊕x1) = 1
∧
d ∈Goodx0,x1]



where the probabilities are over the experiment that generates (pk, sk) ←Gen(2-to-1, 1λ),
y ←A0(pk), and where ((0, x0), (1, x1)) = Invert(2-to-1, sk, y).
Lemma 3.4 ([BCM+18, Mah18]). Assuming LWE, there is a collection of Mahadev randomized
TCFs.
15We depart slightly from notation in prior work, which defines d to be an element of {0, 1}ℓ(corresponding to
the last ℓbits of our d).
16Note that this implies that Supp(Eval(pk, (b1, x1))) ∩Supp(Eval(pk, (b2, x2))) = ∅for every (b1, x1) ̸= (b2, x2).
This can be enforced in the LWE-based instantiation by using truncated discrete Gaussian errors
19


Remark 3.5. For some of our applications (and for simplicity of proofs), we will actually
require an rTCF that is perfectly correct, which means that the correctness properties (a)
and (b) hold with probability 1.
That is, they hold for all (pk, sk) ∈Gen(injective, 1λ) and
(pk, sk) ∈Gen(2-to-1, 1λ) respectively. We briefly argue that this is possible. In the injective
mode case, this is possible because the sampling procedure for injective keys given in [Mah18,
Section 9.2] can determine whether the key it sampled is indeed injective and if not, output
a fixed hard-coded injective key. In the 2-to-1 mode case, the sampling procedure given in
[BCM+18, Section 4.1] is perfect except for when s = 0n. Thus, we can again hard-code a
fixed 2-to-1 key to output instead whenever s = 0n.
3.6
Collapsing Hash Functions
Collapsing Hash Functions.
Let H = {Hλ}λ∈N be a hash function family where each Hλ is a
distribution over functions h : {0, 1}n(λ) →{0, 1}ℓ(λ).
Define the collapsing experiment CollapseExptH,λ,b(D) on quantum distinguisher D as follows.
CollapseExptH,λ,b(D):
1. The challenger samples h ←Hλ and sends h to the distinguisher D.
2. The distinguisher replies with a classical binary string y ∈{0, 1}ℓ(λ) and an n(λ)-qubit quan-
tum state on the register X. Note that the requirement that y be classical can be enforced
by having the challenger immediately measure these registers upon receiving them.
3. The challenger computes h in superposition on the n(λ)-qubit quantum state, and measures
the bit indicating whether the output of h equals y. If the output does not equal y, the
challenger aborts and outputs ⊥.
4. If b = 0, the challenger does nothing. If b = 1, the challenger measures the n(λ)-qubit state
in the standard basis.
5. The challenger returns the contents of the X register to the distinguisher.
6. The distinguisher outputs a bit b′.
Definition 3.6 ([Unr16b]). H = {Hλ}λ is collapsing if for every security parameter λ ∈N and
any polynomial-size quantum distinguisher D = {Dλ}λ, there exists a negligible function µ
such that

Pr

CollapseExptH,λ,0(Dλ) = 1

−Pr

CollapseExptH,λ,1(Dλ) = 1

 ≤µ(λ).
Unruh [Unr16a] constructs collapsing hash functions from lossy functions, which can be based
on LWE [PW08].
Lemma 3.7 ([PW08, Unr16a]). Assuming LWE, a family of collapsing hash functions {Hλ :
{0, 1}∗→{0, 1}λ}λ exists.
20


3.7
Fully Homomorphic Encryption
We define fully homomorphic encryption (FHE), which is used in Section 9. A fully homomorphic
encryption scheme FHE = (FHE.Gen, FHE.Enc, FHE.Dec, FHE.Eval) for (classical) polynomial-time
computation is a tuple of four PPT algorithms.
• Gen(1λ) takes as input the security parameter and outputs a key pair (pk, sk).
• Enc(pk, m) takes as input a message m and outputs a ciphertext ct.
• Eval(f, ct) takes as input a ciphertext ct corresponding to an n-bit plaintext as well as a
function f : {0, 1}n →{0, 1}. It outputs a ciphertext ctf.
• Dec(sk, ct) takes as input the secret key and a ciphertext. It outputs a message.
We require the following properties.
• Evaluation/Decryption Correctness: for any (polynomial-size circuit) function f : {0, 1}n →
{0, 1} and any message m ∈{0, 1}n, we have that
Dec(sk, Eval(f, Enc(pk, m))) = f(m)
with probability 1 −negl(λ) over the parameter sampling.
• Compactness: we require that FHE.Eval(f, Enc(pk, m)) has a fixed size poly(λ) independent
of |f|, |m|.
• Semantic Security: For any pair of messages (m0, m1), we have that (pk, FHE.Enc(pk, m0)) ≈c
(pk, FHE.Enc(pk, m1)).
Theorem 3.8 ([Gen09, BV11, BGV12, BV14]). Under circular-secure variants of the Learn-
ing with Errors assumption, there exists a fully homomorphic encryption scheme for all
polynomial-time computable functions. If the circular LWE variant is post-quantum, then so
is the FHE scheme.
Under the standard LWE assumption, there exists a FHE scheme for all polynomial-size
circuits of depth d(λ), where the scheme has compactness poly(λ, d).
3.8
Indistinguishability Obfuscation
An indistinguishability obfuscator (iO) is an algorithm iO that takes as input a circuit C and
satisfies the following properties.
• Functional Equivalence: for any (polynomial-size) circuit circuit C : {0, 1}n →{0, 1}m
and any input x ∈{0, 1}n, we have that
iO(C)(x) = C(x).
21


• Security: For any pair of functionally equivalent circuits (C0, C1), we have that
iO(C0) ≈c iO(C1).
We mention that, while some recent candidates for iO (such as [JLS21]) can be broken using
quantum algorithms, others, such as [BGMZ18, CVW18, BDGM20, WW21, GP21, DQV+21],
are plausibly post-quantum secure. Furthermore, it will be convenient for us to assume iO with
perfect correctness to simplify our analysis (in particular the argument in Section 10.3). We point
out that this property is already satisfied by most candidates and can also be attained via generic
transformations [BV17].
3.9
Puncturable PRFs
Definition 3.9 (Puncturable PRF [BW13, BGI14, KPTZ13, SW14]). A puncturable PRF family
is a family of functions
F =
n
Fλ,s : {0, 1}ν(λ) →{0, 1}µ(λ)o
λ∈N,s∈{0,1}ℓ(λ)
with associated (deterministic) polynomial-time algorithms (F.Eval, F.Puncture, F.PuncEval)
satisfying
• For all x ∈{0, 1}ν(λ) and all s ∈{0, 1}ℓ(λ), F.Eval(s, x) = Fλ,s(x).
• For all distinct x, x′ ∈{0, 1}ν(λ) and all s ∈{0, 1}ℓ(λ),
F.PuncEval(F.Puncture(s, x), x′) = F.Eval(s, x′)
For ease of notation, we write Fs(x) and F.Eval(s, x) interchangeably, and we write s{x} to
denote F.Puncture(s, x).
F is said to be (s, δ)-secure if for every {x(λ) ∈{0, 1}ν(λ)}λ∈N, the following two distribution
ensembles (indexed by λ) are δ(λ)-indistinguishable to circuits of size s(λ):
(S{x(λ)}, FS(x(λ))) where S ←{0, 1}ℓ(λ)
and
(S{x(λ)}, U) where S ←{0, 1}ℓ(λ), U ←{0, 1}µ(λ).
Theorem 3.10 ([GGM84, KPTZ13, BW13, BGI14, SW14]). If {polynomially secure, subex-
ponentially secure} one-way functions exist, then for all functions µ : N →N (with 1µ(ν)
polynomial-time computable from 1ν), and all δ : N →[0, 1] with δ(ν) ≥2−poly(ν), there are
polynomials ℓ(λ), ν(λ) and a {polynomially secure, (
1
δ(ν(λ)), δ(ν(λ)))-secure} puncturable PRF
family
Fµ =
n
Fλ,s : {0, 1}ν(λ) →{0, 1}µ(ν(λ))}λ∈N,s∈{0,1}ℓ(λ)
o
.
22


4
Commit-and-Measure Protocols
4.1
Defining Commit-and-Measure Protocols
In this section, we formalize the notion of a commit-and-measure protocol, which was informally
described in [Mah18]. A commit-and-measure protocol enables a classical verifier to obtain the
results of measuring, in the standard or Hadamard basis, each qubit of an N-qubit quantum state
σ held by the prover. More precisely, the verifier encodes its choice of basis with a classical circuit
C : [N] = {0, 1}log N →{0, 1}, where C(i) = b specifies the basis for the measurement of the ith
qubit. We adopt the convention that b = 0 corresponds to the standard basis and b = 1 corresponds
to the Hadamard basis. Note that in Mahadev’s original protocol, C is given as an explicit string
(C(0), C(1), . . . , C(N −1)), but our eventual succinct protocols will require circuits C with size
much smaller than N.
Definition 4.1 (Commit-and-Measure Protocol Syntax). An N-qubit commit-and-measure pro-
tocol between a quantum polynomial-time prover P = (Commit, Open) and a classical proba-
bilistic polynomial-time verifier V = (Gen, Test, Out) has the following syntax.
1. The verifier samples (pk, sk) ←Gen(1λ, C), where C : [N] = {0, 1}log N →{0, 1} represents
a basis vector h ∈{0, 1}N, obtaining public parameters pk and secret parameters sk. It
sends the public parameters pk to the prover.
2. The prover computes (y, ρ) ←Commit(pk, σ), obtaining a classical “commitment” string
y and a private quantum state ρ. It sends y to the verifier.
3. The verifier samples a random challenge bit c ←{0, 1} and sends c to the prover; c = 0
corresponds to a “test round” and c = 1 corresponds to a “measurement round”.
4. The prover computes z ←Open(ρ, c), obtaining a classical string z that it sends to the
verifier.
5. If c = 0, the verifier computes {acc, rej} ←Test(pk, (y, z)).
If c = 1, the verifier computes m ←Out(sk, (y, z)) to obtain a classical string m ∈{0, 1}N
of measurement outcomes.
The protocol is required to satisfy the following completeness (Definition 4.2) and soundness
(Definition 4.5) properties. For the definitions below, we write M(h, σ) to denote the distribution
of outcomes from measuring σ in the basis h.
Definition 4.2 (Completeness). A commit-and-measure protocol is required to satisfy two
completeness properties.
1. (Test Round Completeness) For all C : [N] →{0, 1} and N-qubit states σ:
Pr

acc ←Test(pk, (y, z)) :
(pk, sk) ←Gen(1λ, C)
(y, ρ) ←Commit(pk, σ)
z ←Open(ρ, 0)

= 1 −negl(λ).
23


2. (Measurement Round Completeness) For all C : [N] →{0, 1} and N-qubit states σ:


m ←Out(sk, (y, z)) :
(pk, sk) ←Gen(1λ, C)
(y, ρ) ←Commit(pk, σ)
z ←Open(ρ, 1)


≈c M(h, σ),
where h ∈{0, 1}N is such that hi = C(i) for all i ∈[N] = {0, 1}log N.
Remark 4.3. The [Mah18] protocol satisfies statistical measurement round completeness, but
our verifier-succinct commit-and-measure protocol will not.
Remark 4.4. One of our applications will require a measurement protocol with perfect com-
pleteness, which stipulates that the above completeness guarantees hold over all (pk, sk) ∈
Gen(1λ, C) (and where the measurement round completeness is statistical rather than compu-
tational). This can be achieved by using an rTCF with perfect correctness, which we discuss
in Section 3.5, and, in the succinct case, an indistinguishability obfuscation scheme with
perfect correctness (Section 3.8).
To state our soundness definition (Definition 4.5), we first specify the registers that any non-
uniform cheating prover acts on:
• P contains the public parameters pk,
• Y contains the classical commitment string y,
• Z contains the classical opening string z,
• I contains the prover’s initial state and its internal work registers.
In a protocol execution, P is initialized with |pk⟩
⟨pk|. A non-uniform cheating prover
P ∗= (ρ0, UCommit∗, UOpen∗,0, UOpen∗,1)
is parameterized by:
• An arbitrary quantum state ρ0 ∈D(Y ⊗Z ⊗I). In a protocol execution with e
P, Y ⊗Z ⊗I
is initialized with ρ0.
• An adversarial commitment unitary UCommit∗on P ⊗Y ⊗Z ⊗I of the form
X
pk
|pk⟩
⟨pk|P ⊗(UCommit∗,pk)Y,Z,I.
That is, UCommit∗is classically controlled on P. In particular, the adversarial prover’s com-
mitment on verifier message pk is obtained by measuring register Y of
UCommit∗(|pk⟩
⟨pk|P ⊗(ρ0)Y,Z,I)
in the computational basis to obtain y.
24


• An adversarial opening unitary UOpen∗,0 on P ⊗Y ⊗Z ⊗I corresponding to the prover’s
behavior in the test round (b = 0) of the form:
X
pk,y
|pk, y⟩
⟨pk, y|P,Y ⊗(UOpen∗,0,pk,y)Z,I.
That is, UOpen∗,0 is classically controlled on P and Y. In particular, given a commitment
string y and residual prover state ρ ∈D(Z ⊗I), the prover’s response on challenge c = 0 is
obtained by measuring register Z of
UOpen∗,0(|pk, y⟩
⟨pk, y|P,Y ⊗ρZ,I)
in the computational basis to obtain z.
• An adversarial opening unitary UOpen∗,1 on P ⊗Y ⊗Z ⊗I corresponding to the prover’s
behavior in the measurement round (b = 1) of the form:
X
pk,y
|pk, y⟩
⟨pk, y|P,Y ⊗(UOpen∗,1,pk,y)Z,I.
In particular, given a commitment string y and residual prover state ρ ∈D(Z ⊗I), the
prover’s response on challenge c = 1 is obtained by measuring register Z of
UOpen∗,1(|pk, y⟩
⟨pk, y|P,Y ⊗ρZ,I)
in the Hadamard basis to obtain z.
Following [Mah18], we can assume without loss of generality that UOpen∗,0 is the identity (refer
to Section 3.2 for additional details). We will therefore write U to describe the prover’s “attack
unitary” for the measurement round (c = 1).
For defining soundness, we informally require that a prover P ∗that passes the test round with
probability 1 −negl(λ) (this could alternatively be enforced by applying a measurement in the
security game) implicitly defines17 an N-qubit state τ whose measurement outcome distribution
matches the output distribution of Out(·) (up to computational indistinguishability).
Definition 4.5 (Soundness). There exists an efficient classical algorithm SimGen(1λ) and an
efficient quantum algorithm ExtU,ρ(pk, sk, y) with black-box access to an attacker parameterized
by a state ρ and a unitary U (see Section 3.2 for more details on how we formalize quantum
black-box access), that takes as input classical strings (pk, sk, y), and satisfies the following
properties:
• Consider any non-uniform QPT cheating prover P ∗= (ρ0, UCommit∗, U) that passes the
test round with probability 1 −negl(λ) for all h ∈{0, 1}N.
Then, for all h ∈{0, 1}N with circuit representation C, the following two distributions
are computationally indistinguishable:
Real:
17In fact, we require that τ can be extracted efficiently from P ∗.
25


1. Sample parameters (pk, sk) ←Gen(1λ, C).
2. Run the attacker P ∗on pk to obtain a classical commitment string y (i.e., apply
UCommit∗and then measure the register containing y). Denote the post-measurement
state as ρ ∈D(Z ⊗I), where Z corresponds to the registers that will eventually
be measured to obtain the prover’s final message, and I contains all of the other
internal registers of the prover.18
3. Apply the prover’s attack unitary U. This yields the state ρ′ := UρZ,IU †. Measure
the Z register of ρ′ in the Hadamard basis to obtain the prover’s opening string z.
4. Compute m ←Out(sk, (y, z)) and output m.
Sim:
1. Sample parameters (pk, sk) ←SimGen(1λ).
2. Run the attacker P ∗on pk to obtain a classical commitment string y (i.e., apply
UCommit∗and then measure the register containing y). Denote the post-measurement
state as ρ ∈D(Z ⊗I).
3. Run ExtU,ρ(pk, sk, y) →τ to obtain an N-qubit state τ.
4. Measure each qubit of τ according to the bases specified by h ∈{0, 1}N (i.e., qubit
i is measured in the Hadamard basis if hi = 1 and the standard basis if hi = 0) and
output the result.
5
A Measurement Protocol Template
In this section, we describe a generic construction of a N-qubit commit-and-measure protocol
(Section 4) using two building blocks: (1) a family of Mahadev rTCFs (Definition 3.3), and (2) a
“batch key generation” scheme (fully defined in Section 7) whose syntax we describe below. We
consider two different instantiations of this template:
• Using a “trivial” batch key generation scheme in which the N rTCF keys are sampled i.i.d.,
we recover Mahadev’s original protocol [Mah18].
• Using a succinct key generation scheme (constructed in Sections 7 and 7.2, we obtain a
measurement protocol in which the verifier’s messages are succinct. We refer to this as a
verifier-succinct measurement protocol.
Batch Key Generation.
For our construction, we make use of what we call a “batch key genera-
tion scheme” for the Mahadev rTCF. Let TCF.Gen(1λ, mode) denote the “standard” key generation
algorithm for a Mahadev rTCF. Informally, a batch key generation scheme for TCF.Gen(1λ, mode)
is a mechanism that produces a joint representation of N TCF pairs (pki, ski), from which any
18We will also assume, without loss of generality, that the prover always copies pk and y into its internal state
registers I.
26


individual pki, ski can be computed, such that the pairs (pki, ski) are sufficiently “independent” of
each other.
A full definition of a batch key generation scheme is given in Definition 7.2, but we formally
state here the relevant syntax and security properties. Syntactically, a batch key generation scheme
includes three algorithms (Gen, ExtPk, ExtSk), where:
• Gen(1λ, C) takes as input a security parameter λ and a circuit C : [N] →{0, 1} representing
(through its truth table) an N-bit string. It outputs a master public key PK and master
secret key SK.
• ExtPk(PK, i) is a deterministic algorithm that takes as input PK and an index i ∈N, and
outputs a public key pki.
• ExtSk(SK, i) is a deterministic algorithm that takes as input SK and an index i ∈N, and
outputs a secret key ski.
When instantiated for a Mahadev rTCF family, we require the following properties to hold for
such a procedure:
• Correctness: for (PK, SK) ←Gen(1λ, N, C) and (pki, ski) = (ExtPk(PK, i), ExtSk(SK, i)), we
have that (pki, ski) is in the range of TCF.Gen(1λ, C(i)) (i.e. they are a valid key pair in mode
C(i)).
• Key Indistinguishability: if C1 and C2 represent functions that agree on a set T of in-
puts, then PK output by Gen(1λ, C1) is computationally indistinguishable from PK output
by Gen(1λ, C2), even in the presence of all {ski, i ∈T}.
• Collapsing at a single index: For any index j, the function fpkj is collapsing even given
all secret keys ski for i ̸= j.
• Adaptive hardcore bit at a single index: For any index j, the function fpkj satisfies the
rTCF adaptive hardcore bit property even given all secret keys ski for i ̸= j.
Our protocol is a variant of the Mahadev protocol [Mah18] in which the verifier’s first message
(pk1, . . . , pkN) is replaced by the output PK of a batch key generation procedure.
5.1
Measurement Protocol Description
Let ClawFree = (TCF.Gen, Eval, Invert, Check, Good) denote a family of [Mah18] randomized TCFs
(Definition 3.3). For simplicity of the analysis, we assume that on a fixed security parameter 1λ,
Gen outputs keys defining functions from {0, 1}×D to R, where D is a fixed-size subset of {0, 1}ℓ(λ)
independent of pk.19 We denote the size of D by L(λ). Let (Gen, ExtPk, ExtSk) denote a batch key
generation algorithm for TCF.Gen satisfying the requirements described above.
19The LWE-based instantiation from [BCM+18] satisfies this property. However, with more complicated expres-
sions, our proof should go through without this simplifying assumption.
27


For simplicity, we assume the honest prover P has an N-qubit pure state of the form
|ψ⟩W =
X
w1,...,wN
αw1,...,wN |w1 . . . wN⟩
on its internal N-qubit register W; the protocol completeness immediately extends to mixed states
by linearity.
The verifier has a basis string h ∈{0, 1}N, represented by a circuit C : [N] →
{0, 1}, and wants to obtain a measurement of |ψ⟩in this basis (where hi = 0 denotes a standard
basis measurement and hi = 1 denotes a Hadamard basis measurement). The protocol MP (for
measurement protocol), with prover algorithm P = (MP.Commit, MP.Open) and verifier algorithm
V = (MP.Gen, MP.Test, MP.Out), is executed as follows.
• MP.Gen: On input 1λ, N and C, the verifier samples a representation of N TCF key pairs by
computing (PK, SK) ←Gen(1λ, N, C), where C is circuit computing C(i) = hi. The verifier
sends PK to the prover.
• MP.Commit: Given PK and its input state |ψ⟩W, the prover computes public keys pki ←
ExtPk(PK, i) for 1 ≤i ≤N. From now on, P operates directly on (pki) and ignores PK.
The prover coherently (with respect to |ψ⟩) computes a “range superposition”
1
√
LN
X
x1,...,xN∈D
y1,...,yN∈R
w∈{0,1}N
 
αw
Y
i
q
ppki(wi, xi, yi) |w⟩W |x1⟩X1 . . . |xN⟩XN |y1⟩Y1 . . . |yN⟩YN
!
where each Xi is an ℓ(λ)-qubit register (where D ⊂{0, 1}ℓ), and each Yi has basis {|y⟩}y∈R.
Here, ppk(b, x, y) denotes the probability density of y in the distribution fpk(b, x), where
ppk(b, x, y) := 0 for x ∈{0, 1}ℓ\ D.
Following [BCM+18, Section 4.3] the honest prover
algorithm can efficiently prepare this state up to exponentially small trace distance.
After preparing this state, the prover measures Y1, . . . , YN in the standard (R-)basis and
sends the outcome (y1, . . . , yN) to the verifier.
• The verifier sends a uniformly random challenge bit c. After receiving the prover response,
the verifier computes each public key pki ←ExtPk(PK, i) and secret key ski ←ExtSk(SK, i)
in order to evaluate either MP.Test or MP.Out.
• MP.Open: On challenge bit c, the prover operates as follows.
– If c = 0, the prover measures W ⊗X1 ⊗. . . ⊗XN in the standard basis and sends the
outcome (b1, . . . , bN, x1, . . . , xN) to the verifier.
– If c = 1, the prover instead measures W ⊗X1⊗. . .⊗XN in the Hadamard basis, returning
strings d1, . . . dN.
• MP.Test: Given (b1, . . . , bN, x1, . . . , xN), the verifier computes (for every i) Check(pki, bi, xi, yi)
and rejects if any of these checks do not pass.
• MP.Out: Given d1, . . . dN, the verifier outputs N bits as follows. For each i ∈[N]:
28


– If hi = 0, the verifier ignores di, computes (bi, xi) = Invert(injective, ski, yi), and outputs
bi.
– If hi = 1, the verifier computes the two inverses {(0, x0,i), (1, x1,i)} ←Invert(2-to-1, ski, yi).
For each i, the verifier checks whether di ∈Goodx0,i,x1,i (corresponding to a valid equa-
tion in the ith slot), and if so, the verifier outputs di · (1, x0,i ⊕x1,i). If di ̸∈Goodx0,i,x1,i,
the verifier samples a uniformly random bit and outputs it.
Completeness of this protocol follows immediately from [Mah18] and the correctness property
of Gen. Specifically, the correctness property of Gen implies that each (pki, ski) in our protocol
is in the range of TCF.Gen(1λ, C(i)), in which case (as shown in [Mah18]) the verifier’s output
distribution is statistically close to h = (C(0), . . . , C(N))-measurement outcome on |ψ⟩.
6
Soundness of Mahadev’s Protocol
In this section, we prove that the measurement protocol from Section 5 a computationally sound
(Definition 4.5) commit-and-measure protocol. As a consequence, we obtain a new, self-contained
proof of soundness of the [Mah18] protocol. Later (Section 7.1), we will instead instantiate our
protocol with a succinct key generation algorithm to obtain a verifier-succinct measurement pro-
tocol.
Our soundness proof is based in part on both [Mah18] itself as well as a proof strategy suggested
in [Vid20].
Notation.
Throughout this section, we will fix the verifier’s choice of basis h ∈{0, 1}N. We
write R := {i ∈[N] : hi = 1} and S := {i ∈[N] : hi = 0}, where R ⊂[N] denotes the set of indices
that the verifier wants to measure in the Hadamard basis, and S ⊂[N] denotes the set of indices
the verifier wants to measure in the standard basis.
Finally, we will decompose the state space of the prover as Z ⊗I, where:
• Z = Z1 ⊗· · · ⊗ZN. 1 ≤i ≤N, Zi is an (ℓ(λ) + 1)-qubit register that contains the classical
opening string zi. We will sometimes write Z as shorthand for Z1 ⊗. . . ⊗ZN.
• Each Zi can be written as Zi = Bi ⊗Xi, where Bi is a one-bit register and Xi is an ℓ(λ)-bit
register.
• I denotes any additional registers the prover uses.
6.1
The Verifier’s Output Distribution
Our goal is to characterize the N-bit distribution DP ∗,Out corresponding to the verifier’s output
in the measurement protocol when interacting with a malicious prover P ∗using h ∈{0, 1}N as
its choice of bases. In particular, we want to prove that if P ∗succeeds in passing the test round
with probability 1 −negl(λ), then DP ∗,Out is computationally indistinguishable from DP ∗,Ext, a
distribution obtained from (1) running an efficient extractor ExtP ∗to obtain an N-qubit quantum
state τ, and (2) measuring τ in the verifier’s specified bases.
The distribution DP ∗,Out produces a sample according to the following steps:
29


1. Sample keys (PK, SK) ←MP.Gen(1λ, N, C) (where C specifies the choice of bases R, S).
2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩∈Z ⊗I
denote the prover’s residual state.
3. For each i ∈S, compute (bi, xi) ←Invert(injective, ski, yi). Let v ∈{0, 1}S be the vector
whose ith entry is bi.
4. Next, apply the prover’s attack unitary U on Z ⊗I, and then measure Z in the Hadamard
basis to obtain a response z = (d1, . . . , dN).
5. For each i ∈R, compute (0, x0,i), (1, x1,i) ←Invert(2-to-1, ski, yi). If di ∈Goodx0,i,x1,i, set
ui = di · (1, x0,i ⊕x1,i). Otherwise, set ui to be a uniformly random bit. This results in a
string u ∈{0, 1}R
6. Output (u, v) ∈{0, 1}R × {0, 1}S.
Our first step is to show that DP ∗,Out is computationally indistinguishable from a distribution
DP ∗,2-to-1 that does not require running the Invert algorithm for any key pair (pki, ski) in injective
mode. Instead, this second distribution can be produced by directly measuring the register Bi
(i.e., the first bit of Zi) of the prover’s state |ψ⟩). Since {ski}i∈S will no longer be required at this
point, we are also able to switch all key pairs (pki, ski) to be in two-to-one mode by invoking key
indistinguishability.
Formally, DP ∗,2-to-1 produces outcomes as follows (differences from DP ∗,Out highlighted in red):
1. Sample keys (PK, SK) ←MP.Gen(1λ, N, 1) (where 1 denotes the constant 1 function, corre-
sponding to two-to-one mode)
2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩∈Z ⊗I
denote the prover’s residual state.
3. For each i ∈S, measure Bi to obtain a bit vi; the result of this step is a string v ∈{0, 1}S.
4. Next, apply the prover’s attack unitary U on Z ⊗I, and then measure Z in the Hadamard
basis to obtain a response z = (d1, . . . , dN).
5. For each i ∈R, compute (0, x0,i), (1, x1,i) ←Invert(2-to-1, ski, yi). If di ∈Goodx0,i,x1,i, set
ui = di · (1, x0,i ⊕x1,i). Otherwise, set ui to be a uniformly random bit. This results in a
string u ∈{0, 1}R
6. Output (u, v) ∈{0, 1}R × {0, 1}S.
Lemma 6.1. DP ∗,2-to-1 is computationally indistinguishable from DP ∗,Out.
We prove Lemma 6.1 by first switching the keys sampled in DP ∗,2-to-1 to match the verifier’s
basis choice h. That is, we define the distribution DP ∗,h to be the same distribution as DP ∗,2-to-1,
except that the keys (pki, ski) are sampled in mode hi, i.e., Step 1 is replaced with:
1. Sample keys (PK, SK) ←MP.Gen(1λ, N, C) (where C(i) = hi for all i).
30


This is well-defined because the ith bit of the output is still obtained by measuring Bi, which can
be done regardless of how (pki, ski) is sampled.
Claim 6.2. For every basis choice h, DP ∗,h is computationally indistinguishable from DP ∗,2-to-1.
Proof. This follows by invoking the following key indistinguishability property of Gen:
n
(PK, SK) ←Gen(1λ, 1) : (PK, {ski}i̸∈S)
o
≈c
n
(PK, SK) ←Gen(1λ, C) : (PK, {ski}i̸∈S)
o
.
Since the distributions are sampled without use of ski for all i ∈S, Claim 6.2 follows from this
indistinguishability.
To conclude that DP ∗,2-to-1 ≈c DP ∗,Out, we note:
Claim 6.3. If DP ∗,Out is instantiated with basis choice h, then DP ∗,Out is statistically indis-
tinguishable from DP ∗,h.
Proof. Claim 6.3 follows from the injectivity of fpki for each i ∈S; by the correctness of Gen,
we have that each pki (for i ∈S) is in the support of TCF.Gen(1λ, injective). Therefore, since |ψ⟩
is guaranteed to pass the test round with probability 1 −negl(λ), we have that with probability
1 −negl(λ), measuring Bi gives the same result as computing the first bit of Invert(skj, yj) (which
is the verifier’s output).
6.2
The Protocol Observables
Defining the Protocol Observables.
In DP ∗,2-to-1, the entire N-bit output (u, v) is the result
of performing measurements on |ψ⟩, the prover’s residual state after it sends its commitment y.
We now define a collection of binary observables {Xi, Zi}i∈[N], parameterized by (PK, SK, y) and
the malicious prover’s attack unitary U, such that the following process is equivalent to sampling
from DP ∗,2-to-1:
1. Sample keys (PK, SK) ←MP.Gen(1λ, N, 1).
2. Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ⟩denote
the prover’s residual state.
3. For each i ∈S, measure |ψ⟩with the observable Zi to obtain a bit vi.
4. Next, for each i ∈R, measure the observable Xi to obtain a bit ui.
5. Output (u, v) ∈{0, 1}R × {0, 1}S.
The definition of the Zi observable is straightforward: since each vi is obtained by measuring
Bi in the standard basis, Zi is simply the Pauli-Z observable Zi := (σZ)Bi.
Defining the Xi observable requires more care. In DP ∗,2-to-1, the string u ∈{0, 1}R is obtained
by applying the following steps (after v ∈{0, 1}S is measured)
1. Apply the prover’s attack unitary U on Z ⊗I.
31


2. For each i ∈R:
(a) Apply H⊗ℓ+1 to the register Zi containing the prover’s response in the ith slot.
(b) Measure Zi to obtain di. If di ∈Good(x0,i, x1,i), set ui = di · (1, x0,i ⊕x1,i). If di ̸∈
Good(x0,i, x1,i), set ui to be a uniformly random bit.
In order to output a uniformly random bit, we will prepare fresh one-qubit ancilla registers
U1, . . . , UN, so that in the event that the prover returns an invalid di in slot i, the verifier can
generate a random bit by measuring Ui (initialized to |0⟩) in the Hadamard basis. Note that the
U = U1, . . . , UN register is not part of the malicious prover’s state.
We therefore redefine |ψ⟩:= |ψ⟩Z,I |0⟩U to denote the global state on Z ⊗I ⊗U including the
ancilla U registers initialized to |0⟩U.
Finally, the Xi observable is defined as
Xi = (U ⊗IdU)†(H⊗ℓ+1
Zi
⊗Id ⊗HUi)X′
i(H⊗ℓ+1
Zi
⊗Id ⊗HUi)(U ⊗IdU).
where
X′
i =
X
d∈Good(x0,i,x1,i)
(−1)d·(1,x0,i⊕x1,i) |d⟩
⟨d|Zi ⊗IdI,{Zj}j̸=i,U
+
X
d̸∈Good(x0,i,x1,i),u∈{0,1}
(−1)u |d, u⟩
⟨d, u|Zi,Ui ⊗IdI,{Zj}j̸=i,{Uj}j̸=i.
Note that the Xi observables are defined so that each pair of Xi, Xj commute. Moreover, one
can verify that measuring Xi for each i ∈R exactly corresponds to measuring u ∈{0, 1}R as
described above.
The description of Xi depends on (yi, ski) because of the appearance of xi,0, xi,1 in X′
i. Moreover,
note that each Xi is efficiently computable given ski.
For convenience, we define a procedure {Xi, Zi}i, |ψ⟩Z,I,U ←Samp that works as follows:
• Sample keys (PK, SK) ←MP.Gen(1λ, N, 1).
• Run the malicious prover on PK to obtain a classical commitment string y. Let |ψ′⟩denote
the prover’s residual state on Z ⊗I.
• Output the observables {Xi, Zi} parameterized by (PK, SK, y) and malicious prover’s unitary
U, along with the state |ψ⟩:= |ψ′⟩⊗|0⟩U.
For the remainder of this section, we will write DP ∗,2-to-1 as a two-step sampling process:
1. Run {Xi, Zi}i, |ψ⟩Z,I,U ←Samp.
2. Starting with |ψ⟩, measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then measure each Xi
for i ∈R to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.
32


6.3
The Extracted State
Recall that our definition of measurement protocol soundness (Definition 4.5) requires us to give
an extractor that:
1. Generates keys (PK, SK) according to an algorithm SimGen(1λ) (independently of the verifier’s
basis choice h).
2. Runs the malicious prover P ∗on PK to obtain y; as usual, |ψ⟩∈Z ⊗I ⊗U denotes the
residual prover state with U initialized to |0⟩U.20
3. Generates an extracted state τ ←ExtU,|ψ⟩(PK, SK, y) (the superscript denotes black-box
access to a unitary U and state |ψ⟩, see Section 3.2).
We define SimGen(1λ) to be MP.Gen(1λ, N, 1), which exactly corresponds to how keys are
sampled in DP ∗,2-to-1.
To establish soundness, it remains to (1) describe how to generate the extracted state τ given
(PK, SK, y), U, and (2) prove that the distribution that arises from measuring τ with the Pauli-X
and Pauli-Z observables in the verifier’s chosen bases h is computationally indistinguishable from
DP ∗,2-to-1.
We handle (1) in Section 6.3.1. We then describe the distribution DP ∗,Ext that arises from
measuring our extracted state in Section 6.3.2 and prove that indistinguishability from DP ∗,2-to-1
in Section 6.4.
6.3.1
A Teleportation-Inspired Extraction Procedure
Fix a choice of {Xi, Zi}, |ψ⟩←Samp. For ease of notation, write H = Z ⊗I ⊗U so that |ψ⟩∈H.
We would like an efficient extraction procedure that takes as input |ψ⟩∈H and generates an N-
qubit state τ such that, roughly speaking, measuring |ψ⟩with X/Z and measuring τ with σX/σZ
produce indistinguishable outcomes.
Intuition for the Extractor.
Before we describe our extractor, we first provide some underlying
intuition. For an arbitrary N-qubit Hilbert space, let σx,i/σz,i denote the Pauli σx/σz observable
acting on the ith qubit. For each r, s ∈{0, 1}N, define the N-qubit Pauli “parity” observables
σx(r) :=
Y
i:ri=1
σx,i , σz(s) :=
Y
i:si=1
σz,i.
Suppose for a moment that |ψ⟩∈H is already an N-qubit state (i.e., H is an N-qubit Hilbert
space) and moreover, that each Xi/Zi observable is simply the corresponding Pauli observable
σx,i/σz,i. While these assumptions technically trivialize the task (the state already has the form
we want from the extracted state), it will be instructive to write down an extractor that
“teleports” this state into another N-qubit external register.
20To match the syntax of our definition in Definition 4.5, the register U should be viewed as an internal register
initialized by the extractor.
33


We can do this by initializing two N-qubit registers A1 ⊗A2 to |φ+⟩⊗N where |φ+⟩is the EPR
state (|00⟩+ |11⟩)/
√
2 (the ith EPR pair lives on the ith qubit of A1 and A2). Now consider the
following steps, which are inspired by the (N-qubit) quantum teleportation protocol
1. Initialize a 2N-qubit ancilla W to

02N
, and apply H⊗2N to obtain the uniform superposition.
2. Apply a “controlled-Pauli” unitary, which does the following for all r, s ∈{0, 1}N and all
|φ⟩∈H ⊗A1:
|r, s⟩W |φ⟩H,A1 →|r, s⟩W (σx(r)σz(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1
3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements21
on A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:
|u, v⟩W (σx(r)σz(s) ⊗Id)A1,A2

φ+⊗N
A1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)A1,A2

φ+⊗N
A1,A2 .
Finally, discard W.
One can show that the resulting state is
1
2N
X
r,s∈{0,1}N
(σx(r)σz(s) ⊗σx(r)σz(s) ⊗Id) |ψ⟩H

φ+
A1,A2 =

φ+
H,A1 |ψ⟩A2 ,
(2)
where |ψ⟩is now “teleported” into the A2 register.
To generalize this idea to the setting where |ψ⟩∈H is an arbitrary quantum state and {Xi, Zi}i
are an arbitrary collection of 2N observables, we simply replace each σx(r) and σz(s) acting on
H above with the corresponding parity observables for {Xi, Zi}. That is for each r, s ∈{0, 1}N,
define
Z(s) =
N
Y
i=1
Zsi
i
and X(r) =
N
Y
i=1
Xri
i .
The rough intuition is that as long as the {Xi} and {Zi} observables “behave like” Pauli observables
with respect to |ψ⟩, the resulting procedure will “teleport” |ψ⟩into the N-qubit register A2.
The Full Extractor.
In more detail, we have the state |ψ⟩H = |ψ⟩Z,I,U, and we initialize two
N-qubit registers A1 ⊗A2 to |φ⟩⊗N. We run the following steps (the changes from the above
procedure are highlighted in red):
1. Initialize a 2N-qubit ancilla W to

02N
, and apply H⊗2N.
2. Apply a unitary that does the following for all r, s ∈{0, 1}N:
|r, s⟩W |φ⟩H,A1 →|r, s⟩W (X(r)Z(s)H ⊗σx(r)σz(s)A1) |φ⟩H,A1
21The Bell basis consists of the 4 states (σa
xσb
z ⊗Id)

φ+
for a, b ∈{0, 1} on 2 qubits.
34


3. Apply the unitary that XORs onto W the outcome of performing N Bell-basis measurements
on A1 ⊗A2 onto W, i.e., for all u, v, r, s ∈{0, 1}N:
|u, v⟩W (σx(r)σz(s) ⊗Id)

φ+⊗N
A1,A2 →|u ⊕r, v ⊕s⟩W (σx(r)σz(s) ⊗Id)

φ+⊗N
A1,A2 .
Finally, discard W.
All of these steps can be efficiently implemented given black-box access to {Xi, Zi}i.
The
resulting state is
1
2N
X
r,s∈{0,1}N
X(r)Z(s) |ψ⟩H ⊗σx(r)σz(s)

φ+⊗N
A1,A2 ,
and we define the extracted state τ := Ext{Xi},{Zi}(|ψ⟩) to be the residual state on A2 after tracing
out H and A1.22
6.3.2
Measuring the Extracted State
We now consider the N-bit distribution of measurement outcomes that arise from measuring the
extracted state τ using the Pauli observables σx, σz. In particular, we consider performing the
measurements according to the verifier’s basis choice, so that we measure σz,i for each i ∈S and
σx,i for each i ∈R.
Formally, we define the distribution DP ∗,Ext on {0, 1}N obtained by the following process:
• Run {Xi, Zi}, |ψ⟩←Samp.
• Let τ = Ext{Xi},{Zi}(|ψ⟩) be the N-qubit extracted state.
• Measure the Pauli-Z observable σz,i for all i ∈S, obtaining v ∈{0, 1}S.
• Measure the Pauli-X observable σx,i for all i ∈R, obtaining u ∈{0, 1}R.
• Output (u, v) ∈{0, 1}R × {0, 1}S.
It will be convenient to define the following projection operators. For each u ∈{0, 1}R and
v ∈{0, 1}S let
Πσx
u =
E
u′∈{0,1}R(−1)u·u′σx(u′)
and
Πσz
v =
E
v′∈{0,1}S(−1)v·v′σz(v′)
(3)
In words, Πσx
u
is the projection that corresponds to measuring σx,i for each i ∈R and obtaining
the string of outcomes u ∈{0, 1}R, and Πσz
v
is the projection that corresponds to measuring σz,i
for each i ∈S and obtaining the string of outcomes v ∈{0, 1}S.
Then the probability DP ∗,Ext outputs any (u, v) ∈{0, 1}R × {0, 1}S can be written as
DP ∗,Ext(u, v) =
E
{Xi,Zi},|ψ⟩←Samp[Tr
Πσx
u Πσz
v τ


: τ = Ext{Xi},{Zi}(|ψ⟩)].
22The same extracted state is defined in Vidick’s lecture notes [Vid20], although the notes do not give an explicit
procedure for generating it.
35


We define a set of analogous projection operators for the {Xi} and {Zi} observables. For each
u ∈{0, 1}R and v ∈{0, 1}S, let
ΠX
u =
E
u′∈{0,1}R(−1)u·u′X(u′)
and
ΠZ
v =
E
v′∈{0,1}S(−1)v·v′Z(v′)
(4)
In words, ΠX
u is the projection that corresponds to measuring Xi for each i ∈R and obtaining the
string of outcomes u ∈{0, 1}R, and ΠZ
v is the projection that corresponds to measuring Zi for each
i ∈S and obtaining the string of outcomes v ∈{0, 1}S.
With these definitions in mind, we state a claim that allows us to characterize the result of
measuring the extracted state τ with the Pauli observables.
Claim 6.4. Fix any choice of {Xi, Zi}i∈[N] and state |ψ⟩, and let τ = Ext{Xi},{Zi}(|ψ⟩). For all
(u, v) ∈{0, 1}R × {0, 1}S it holds that
Tr
Πσx
u Πσz
v τ


=
E
u′∈{0,1}R ⟨ψ| ΠZ
v Z(u′)ΠX
u′⊕uZ(u′)ΠZ
v |ψ⟩.
(5)
The proof of Claim 6.4 is a straightforward (but slightly tedious) computation and is deferred
to Appendix B.
Importantly, Claim 6.4 gives a clear understanding of how DP ∗,2-to-1 and DP ∗,Ext relate to each
other, since it allows us to view the distribution DP ∗,Ext (which arises from Pauli measurements
on the extracted state τ) as the result of performing certain protocol observable measurements
{Xi, Zi} on |ψ⟩.
Recall that the distribution DP ∗,2-to-1 is the following distribution:
1. Run {Xi, Zi}i, |ψ⟩Z,I,U ←Samp.
2. Starting with |ψ⟩, measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then measure each Xi
for i ∈R to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.
By Claim 6.4, we can write DP ∗,Ext as follows (differences from DP ∗,2-to-1 are in red):
1. Run {Xi, Zi}, |ψ⟩←Samp.
2. Starting with |ψ⟩measure each Zi for i ∈S to obtain v ∈{0, 1}S. Then sample a uniformly
random string u′ ←{0, 1}R and apply the unitary Z(u′). Finally, measure each Xi for i ∈R
and XOR the output with u′ to obtain u ∈{0, 1}R. Output (u, v) ∈{0, 1}R × {0, 1}S.
With this key difference in mind, it remains to prove indistinguishability of these two distribu-
tions.
6.4
Indistinguishability of Measurement Outcomes
In this subsection, we complete the proof that DP ∗,2-to-1 and DP ∗,Ext are computationally indistin-
guishable. We first write out their probability mass functions:
• DP ∗,2-to-1 outputs (u, v) ∈{0, 1}R × {0, 1}S with probability
DP ∗,2-to-1(u, v) =
E
{Xi,Zi},|ψ⟩←Samp

⟨ψ| ΠZ
v ΠX
u ΠZ
v |ψ⟩

.
36


• DP ∗,Ext outputs (u, v) ∈{0, 1}R × {0, 1}S with probability
DP ∗,Ext(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R

⟨ψ| ΠZ
v Z(u′)ΠX
u′⊕uZ(u′)ΠZ
v |ψ⟩

.
At this point, the reader may find it helpful to convince themselves that probability mass
functions above exactly correspond to the descriptions of these distributions given at the end
of Section 6.3. The equivalence between these two representations will be a key component of the
upcoming proofs.
For convenience, we will reorder the indices so that the indices in R are labeled 1, 2, . . . , |R|.
Let u≤j ∈{0, 1}R be the vector equal to u on the first j indices, and is 0 on the remaining
indices. For each j ∈{0, 1, . . . , |R|}, define hybrid Hybj to be the distribution that outputs (u, v) ∈
{0, 1}R × {0, 1}S with probability
Hybj(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R
h
⟨ψ| ΠZ
v Z(u′
≤j)ΠX
u⊕u′
≤jZ(u′
≤j)ΠZ
v |ψ⟩
i
.
Additionally, for each j ∈{1, . . . , |R|}, and b ∈{0, 1} define hybrid Hybj,b to be the distribution
that outputs (u, v) ∈{0, 1}R × {0, 1}S with probability
Hybj,b(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R
h
⟨ψ| ΠZ
v Z(u′
≤j−1)Zb
jΠX
u⊕u′
≤j−1⊕b·ejZb
jZ(u′
≤j−1)ΠZ
v |ψ⟩
i
,
where ej ∈{0, 1}R denotes the jth standard basis vector.
Claim 6.5. For all j ∈{1, . . . , |R|}, the distributions Hybj,0 and Hybj,1 are computationally
indistinguishable.
Observe that for j ∈{1, 2, . . . , |R|}, Hybj,0 = Hybj−1, and that Hybj,0 is the uniform mixture of
Hybj,0 and Hybj,1. Since Hyb0 = DP ∗,2-to-1 and Hyb|R| = DP ∗,Ext, Claim 6.5 implies that DP ∗,2-to-1
and DP ∗,Ext are computationally indistinguishable.
We now prove Claim 6.5, which will complete the proof of measurement protocol soundness.
Our proof involves the following steps:
• First, we prove Claim 6.6, which states that the marginal distributions of Hybj,0 and Hybj,1
on N \ {j} are indistinguishable due to the collapsing property of fpkj.
• We then state Claim 6.7, which (together with Claim 6.6) shows that if Hybj,0 and Hybj,1 are
efficiently distinguishable, then they can be distinguished as follows:
1. Given a sample x (from either Hybj,0 or Hybj,1) run an efficient algorithm A on x\{j} (x
without the jth bit).
2. If A outputs 0, guess a random bit b. If A outputs 1, guess b = xj.
Roughly speaking, this reduces the task to arguing about the indistinguishability of the single
bit xj (conditioned on A outputting 1).
37


• Finally, we show that the 1-bit conditional distributions must be indistinguishable by ap-
pealing to the adaptive hardcore bit property of fpkj.
Claim 6.6. Let R′ = R \ {j} and let (Hybj,0)[N]\{j} and (Hybj,1)[N]\{j} be the marginal distri-
butions of Hybj,0 and Hybj,1 on [N]\{j} = R′ ∪S. Then (Hybj,0)[N]\{j} and (Hybj,1)[N]\{j} are
computationally indistinguishable.
Proof. Any quantum algorithm for distinguishing (Hybj,0)[N]\{j} and (Hybj,1)[N]\{j} can be rep-
resented as an N −1 qubit binary POVM (A, Id −A), where the distinguisher outputs 1 on x
with probability ⟨x| A |x⟩. We show that this contradicts the collapsing property of fpkj (given
PK, {ski}i̸=j).
Consider the following adversary for the fpkj collapsing security game:
• Given PK, {ski}i̸=j, the adversary runs the prover P ∗on PK to obtain (y, |ψ⟩). Recall that
|ψ⟩is guaranteed to contain a valid pre-image in register Zj. The adversary submits y to the
collapsing game challenger.
• The challenger flips a random bit and either applies Zj or does nothing.23
• Then the adversary performs the following steps:
1. Measure Zi for every i ∈S obtaining outcomes v ∈{0, 1}S.
2. Sample a random string u′ ←{0, 1}R and apply the unitary Z(u′
≤j−1).
3. Measure Xi for every i ∈R′, and XOR the outcomes with u′
≤j−1 to obtain an output
string u ∈{0, 1}R′.
4. Finally, measure |u, v⟩with the POVM {A, Id −A}, and output 1 if and only if the
measurement outcome is A.
All of the adversary’s steps can be efficiently performed given (PK, {ski}i̸=j). Moreover, the above
adversary’s advantage in the collapsing game is polynomially related to the advantage the POVM
(A, Id −A) attains in distinguishing (Hybj,0)[N]\{j} and (Hybj,1)[N]\{j}.
Given that the marginal distributions of Hybj,0 and Hybj,1 on [N]\{j} are computationally
indistinguishable (Claim 6.6), we next invoke a general property of N-bit distributions implying
that a distinguisher between Hybj,0 and Hybj,1 must be distinguishing some (efficiently computable)
property of the jth bit of Hybj,0 and Hybj,1 conditioned on an efficiently computable property of
the [N]\{j}-marginal distributions.
Claim 6.7. Let k = k(λ) be a positive integer-valued function of a security parameter λ.
Let {D0,λ}λ≥1 and {D1,λ}λ≥1 be families of distributions on {0, 1}k+1 such that the marginal
23This version of the collapsing game is equivalent to the standard formulation in which the challenger either
does/does not perform a measurement. This follows from the fact that measuring a qubit in the computational basis
(and discarding the outcome) is equivalent to applying Zb for a random b ←{0, 1}. Thus, the challenger’s measure-
ment (in the b = 1 experiment) is equivalent to applying Z with probability 1/2; for simplicity, our formulation has
the challenger (in the b = 1 experiment) apply Z with probability 1, which increases the adversary’s distinguishing
advantage by a factor of 2.
38


distributions D′
0,λ and D′
1,λ of D0,λ and D1,λ respectively on the first k bits are computationally
indistinguishable. Suppose that D0,λ and D1,λ are computationally distinguishable. Then there
is an efficiently computable binary-outcome POVM {M, Id −M} acting on k qubits such that



E
x∼D0,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩−
E
x∼D1,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩


 >
1
poly(λ).
We defer the proof to Appendix C.
Finally, we show that the jth bit distinguisher of Hybj,0 and Hybj,1 discussed by Claim 6.7
cannot exist by the adaptive hardcore bit property of fpkj (given PK, {ski}i̸=j}).
Claim 6.8. For any efficiently computable binary outcome POVM {M, Id −M},



E
(u,v)∼Hybj,0
(−1)uj 
u\{j}, v

 M

u\{j}, v

−
E
(u,v)∼Hybj,1
(−1)uj 
u\{j}, v

 M

u\{j}, v
 

 = negl(λ). (6)
Proof. For the reader’s convenience, we write out the probability mass functions of Hybj,0 and
Hybj,1 explicitly, with the differences highlighted in red
Hybj,0(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R
h
⟨ψ| ΠZ
v Z(u′
≤j−1)ΠX
u⊕u′
≤j−1Z(u′
≤j−1)ΠZ
v |ψ⟩
i
Hybj,1(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R
h
⟨ψ| ΠZ
v Z(u′
≤j−1)ZjΠX
u⊕u′
≤j−1⊕ejZjZ(u′
≤j−1)ΠZ
v |ψ⟩
i
.
We define one more distribution (with the difference relative to Hybj,0 highlighted in red)
Hybj,1(u, v) =
E
{Xi,Zi},|ψ⟩←Samp
u′∈{0,1}R
h
⟨ψ| ΠZ
v Z(u′
≤j−1)ZjΠX
u⊕u′
≤j−1ZjZ(u′
≤j−1)ΠZ
v |ψ⟩
i
.
We now rewrite the left-hand-side of Eq. (6), where in the second expectation we sample from
Hybj,1 instead of Hybj,1. Note that these distributions are identical except that uj is flipped, so we
have



E
(u,v)∼Hybj,0
(−1)uj 
u\{j}, v

 M

u\{j}, v

−
E
(u,v)∼Hybj,1
(−1)uj 
u\{j}, v

 M

u\{j}, v
 


=



E
(u,v)∼Hybj,0
(−1)uj 
u\{j}, v

 M

u\{j}, v

+
E
(u,v)∼Hybj,1
(−1)uj 
u\{j}, v

 M

u\{j}, v
 

.
Dividing the right-hand-side by 2 gives an expression equal to the (absolute value of) the expecta-
tion of the output in the following process:
• Prepare {Xi, Zi}, |ψ⟩←Samp.
• Sample b ←{0, 1} and prepare Zb
j |ψ⟩(the b = 0 case corresponds to Hybj,0 and the b = 1
case corresponds to Hybj,1).
• Then measure Zi for all i ∈S to obtain v ∈{0, 1}S. Sample a random u′ ←{0, 1}R and
apply Z(u′
≤j−1), and finally measure Xi for all i ∈R and XOR the result with u′
≤j−1 to
obtain u ∈{0, 1}R.
39


• Prepare the state

u\{j}, v

and measure it with the POVM {M, Id −M}. If the output is
Id −M, stop at this point and output 0.
• Otherwise, if the output is M, output (−1)uj.
Notice that the second step is equivalent to measuring |ψ⟩with Zj, since (writing Zj = Z+
j −Z−
j ,
where Z+
j is the projection onto the 1 eigenstate of Zj and Z−
j = Id −Z+
j is the projection onto
the −1 eigenstate of Zj):
1
2(Zj |ψ⟩
⟨ψ| Zj + |ψ⟩
⟨ψ|) = Z+
j |ψ⟩
⟨ψ| Z+
j + Z−
j |ψ⟩
⟨ψ| Z−
j .
It follows that



E
(u,v)∼Hybj,0
(−1)uj 
u\{j}, v

 M

u\{j}, v

+
E
(u,v)∼Hybj,1
(−1)uj 
u\{j}, v

 M

u\{j}, v
 

/2
is polynomially-related to the advantage of the following adversary for the adaptive hardcore bit
game:
• Given PK, {ski}i̸=j, the adversary runs the prover P ∗on PK to obtain (y, |ψ⟩). Recall that
|ψ⟩is guaranteed to contain a valid pre-image in register Zj with probability 1 −negl(λ).
• The adversary measures the register Zj of |ψ⟩in the standard basis, obtaining a string (bj, xj).
By the assumption that |ψ⟩contains valid pre-images and the fact that pkj is in the range of
TCF.Gen(1λ, 2-to-1), this is equivalent to measuring the observable Zj (which just measures
bj).
• Next, the adversary measures Zi for all i ∈S, obtaining a string of outcomes v ∈{0, 1}S.
• Then the adversary samples random u′ ←{0, 1}R and applies the unitary Z(u′
≤j−1) to its
state.
• The adversary measures Xi for all i ∈R′ and XORs the outcome with u′
≤j−1, obtaining a
string u ∈{0, 1}R′.
• The adversary prepares the state |u, v⟩and measures it with {M, Id −M}. Depending on the
outcome, it does the following:
– If the measurement outcome is Id −M, it samples a uniformly random string dj ←
{0, 1}ℓ+1 and sends (bj, xj, dj) to the challenger (in this case obtaining negl(λ) advan-
tage).
– If the measurement outcome is M, it applies U to its state, followed by H⊗ℓ+1 to Zj. It
then measures Zj to obtain a string dj ∈{0, 1}ℓ+1 and sends (bj, xj, dj) to the challenger.
Note that the challenger’s output bit (i.e., whether the adversary wins or loses) exactly
corresponds to the bit uj.
By assumption, this adversary outputs a valid pre-image (bj, xj) with probability 1−negl(λ). Since
all of the adversary’s steps are efficient given (PK, {ski}i̸=j), the claim follows from the adaptive
hardcore bit property of fpkj.
40


This completes the proof of Claim 6.5, which in turn implies the soundness of the measurement
protocol.
7
Succinct Key Generation from iO
In this section, we construct a cryptographic primitive that provides a succinct representation
of N key pairs. We call this primitive a “succinct batch key generation algorithm,” and provide
definitions and a construction based on iO in Section 7.1. In Section 7.2, we compose our succinct
key generation primitive with Mahadev randomized TCFs [Mah18] and prove that the composition
satisfies the hypotheses stated in Section 5, while also having succinct keys (PK, SK).
7.1
Batch Key Generation: Definition and Construction
A batch key generation algorithm is an algorithm that outputs a description of many (pk, sk)-pairs;
a succinct batch key generation algorithm produces a short such description. Formally, we will
define this primitive relative to any dual-mode key generation algorithm.
Definition 7.1. An algorithm Gen is said to be a dual-mode key generation algorithm if it
takes as input a security parameter 1λ and a bit mode ∈{0, 1}, and it outputs a pair of keys
(pk, sk). Moreover, we require key indistinguishability: public keys sampled using Gen(1λ, 0)
are computationally indistinguishable from public keys sampled using Gen(1λ, 1).
Definition 7.2. Let (pk, sk) ←Gen(1λ, mode) denote a dual-mode key generation algorithm.
A (succinct) batch key generation algorithm BatchGen for Gen is a tuple of p.p.t. algorithms
(Setup, ExtPk, ExtSk, Program) with the following syntax.
• Setup(1λ, N, f) takes as input a security parameter λ in unary; the number of indices N
in binary; and the description of a circuit f : [N] →{0, 1}. It outputs a master public
key PK and a master secret key SK.
• ExtPk(PK, i) is a deterministic algorithm that takes as input a master public key PK and
an index i ∈[N]. It outputs a public key pki.
• ExtSk(SK, i) is a deterministic algorithm takes as input a master secret key SK and an
index i ∈[N]. It outputs a secret key ski.
• Program(1λ, N, f, i, pk) takes as input (1λ, N, f) just as Setup does, along with two addi-
tional inputs: an index i ∈[N] and a public key pk. It outputs a master public key PK
and (an implicitly restricted) master secret key SK.
We require that the following three properties are satisfied. Informally, we require that (0)
Setup(1λ, N, f) always outputs a representation of valid key pairs, (1) Program(1λ, N, f, i, pk)
successfully programs pk into the ith “slot” of PK, (2) if (pk, sk) ←Gen(1λ, mode = f(i)) this
programming is undetectable (even given all secret keys), and (3) mode indistinguishability
continues to hold for batched keys, even in the presence of “irrelevant secret keys.”
41


1. Setup Correctness. For any λ, N ∈N, any circuit f : [N] →{0, 1}, any index i ∈[N],
we have that for (PK, SK) ←Setup(1λ, N, f) and (pki, ski) = (ExtPk(PK, i), ExtSk(SK, i)),
(pki, ski) is in the range of Gen(1λ, mode = f(i)).
2. Programming Correctness. For any λ, N ∈N, any circuit f : [N] →{0, 1}, any index
i ∈[N], and any bit mode, we have the following guarantee: for (pk, sk) ←Gen(1λ, mode)
and (PK, SK) ←Program(1λ, N, f, i, pk),
ExtPk(PK, i) = pk.
with probability 1.
3. Programming Indistinguishability. For any N = N(λ), any circuit f : [N] →{0, 1}
and any index i ∈[N], the following distributions are (poly(λ, N), negl(λ, N))-indistinguishable:
n
(PK, SK) ←Setup(1λ, N, f), skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)
o
λ∈N
≈c
n
(pk, sk) ←Gen(1λ, mode = f(i)), (PK, SK) ←Program(1λ, N, f, pk, i),
ski = sk and ∀j ̸= i, skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)
o
λ∈N
While we let the circuit be arbitrary in this definition, we note that it will be instantiated
with an efficient circuit of size poly(log N, λ) in our eventual constructions.
4. Key Indistinguishability: For any N = N(λ), for any subset S ⊂[N], and for any
two circuits f0, f1 : [N] →{0, 1} such that f0(i) = f1(i) for all i ∈S, for (PKb, SKb) ←
Setup(1λ, N, fb), the distributions of keys
n
PKb,

ski ←ExtSk(SKb, i)

i∈S
o
λ∈N
are computationally (poly(λ, N), negl(λ, N))-indistinguishable.
We now construct succinct key generation from iO and puncturable PRFs using standard punc-
turing techniques.
Theorem 7.3. For any N(λ), assuming a (poly(λ, N), negl(λ, N))-secure iO scheme and a
(poly(λ, N), negl(λ, N))-secure puncturable PRF, there exists a succinct batch key generation
algorithm
(Setup, ExtPk, ExtSk, Program)
where Setup supports batch sizes up to N(λ) and runs in time poly(λ, log N).
In particular, when N(λ) = 2λ we rely on the sub-exponential hardness of iO and punc-
turable PRFs, while for any N(λ) = poly(λ) we rely on polynomial hardness.
Proof. Given a dual-mode key generation algorithm Gen, an iO scheme iO, and a puncturable PRF
family PRF, we define our batch key generation procedure SuccGen = (Setup, ExtPk, ExtSk, Program)
as follows.
42


• Setup(1λ, N, f) samples a PRF seed s and outputs (as the public key) an obfuscated program
e
P = iO(Ps,f), where P is defined in Fig. 1, and (as the secret key) the PRF seed s and the
function f.
• ExtPk(PK, i) computes and outputs pki = e
P(i) (for e
P = PK).
• ExtSk(SK, i) computes r = PRFs(i) and mode = f(i). It then computes (pki, ski) ←Gen(1λ, mode; r)
and outputs ski.
• Program(1λ, N, f, pk, i∗) samples a PRF seed s and outputs (as the public key) an obfuscated
program iO(Ppk,i∗,s,f), where Ppk,i∗,s,f is defined in Fig. 2, and (as the secret key) the PRF
seed s and the function f.
Input: index i ≤N
Hardwired Values: Puncturable PRF seed s. Circuit f.
• Compute mode = f(i) and r = PRFs(i).
• Compute (pki, ski) ←Gen(1λ, mode; r).
• Output pki.
Figure 1: The program P.
Input: index i ≤N
Hardwired Values: Puncturable PRF seed s. Public key pk. Index i∗. Circuit f.
• If i = i∗, output pk and terminate.
• Compute mode = f(i) and r = PRFs(i).
• Compute (pki, ski) ←Gen(1λ, mode; r).
• Output pki.
Figure 2: The program Ppk,i∗,s,f.
Succinctness, setup correctness and programming correctness are immediate from the defini-
tions. We now prove programming indistinguishability.
43


Claim 7.4. For any circuit f and any index i ∈[N], the following distributions are (poly(λ, N),
negl(λ, N))- computationally indistinguishable:
n
(PK, SK) ←Setup(1λ, N, f), skj ←ExtSk(SK, j) : (PK, sk1, . . . , skN)
o
≈c
n
(pk, sk) ←Gen(1λ, mode = f(i)), (PK, SK) ←Program(1λ, N, f, pk, i),
skj ←ExtSk(SK, j)(j ̸= i), ski = sk : (PK, sk1, . . . , skN)
o
Proof. We know that (iO(Ps,f), s) ≈c (iO(Ppk,i∗,s,f), s) for (pk, sk) ←Gen(1λ, mode = f(i∗); PRFs(i∗))
by iO security because these two circuits Ps,f, Ppk,i∗,s,f are functionally equivalent.
Moreover, (iO(Ppk,i∗,s,f), {ski}1≤i≤N) for pseudorandom (pk, ski∗) is computationally indistin-
guishable from (iO(Ppk,i∗,s,f), {ski}1≤i≤N) for truly random (pk, ski∗) by puncturing s at i∗(invoking
iO security to do so) and then invoking PRF security.
Finally, we prove key indistinguishability.
Claim 7.5. For any N = N(λ), for any subset S ⊂[N(λ)], and for any two circuits f0, f1 :
[N] →{0, 1} such that f0(i) = f1(i) for all i ∈S, for (PKb, SKb) ←Setup(1λ, N, fb), the
distributions of keys
n
PKb,

ski ←ExtSk(SKb, i)

i∈S
o
λ∈N
are computationally (poly(λ, N), negl(λ, N))- indistinguishable.
Proof. Consider the following hybrid circuits f′
j for 0 ≤j ≤N:
f′
j(i) = f0(i) if i ≥j and f′
j(i) = f1(i) if i > j.
Note that f′
0 = f0 and f′
N = f1. Now, we consider the N + 1 distributions
Hybj =
n
PK,

ski ←ExtSk(SK, i)

i∈S
o
λ∈N
for (PK, SK) ←Setup(1λ, N, f′
j). The claim holds as long as Hybj−1 ≈c Hybj for all j ≥1. To see
that this indistinguishability holds, it suffices to consider two further hybrid distributions:
Hybj,1 =
n
PK,

ski ←ExtSk(SK, i)

i̸=j∈S, skj (included if j ∈S)
o
λ∈N
for (pkj, skj) ←Gen(1λ, mode = f0(j)) and (PK, SK) ←Program(1λ, N, f′
j−1, j, pkj), and
Hybj,2 =
n
PK,

ski ←ExtSk(SK, i)

i̸=j∈S, skj (included if j ∈S)
o
λ∈N
for (pkj, skj) ←Gen(1λ, mode = f1(j)) and (PK, SK) ←Program(1λ, N, f′
j, j, pkj).
We have that Hybj−1 ≈c Hybj,1 by programming indistinguishability (Claim 7.4). We have that
Hybj,1 ≈c Hybj,2 by considering two cases: if f0(j) = f1(j) then (pkj, skj) are sampled from identical
distributions in the hybrid and f′
j−1 = f′
j, so indistinguishability follows from a single invocation
of iO security. If f0(j) ̸= f1(j), then skj is not included in the hybrid distributions; moreover, pkj
44


in Hybj,1 is computationally indistinguishable from pkj in Hybj,2 by the key indistinguishability
of Gen. Finally, note that for a fixed pkj, the programs Ppkj,j,s,f′
j−1 and Ppkj,j,s,f′
j are functionally
equivalent (as index j is being programmed to pkj in both cases), so the claimed indistinguishability
now follows from iO security.
Finally, we have Hybj,2 ≈c Hybj by programming indistinguishability. This completes the proof
of the claim.
This completes the proof that (Setup, ExtPk, ExtSk, Program) is a succinct batch key generation
algorithm for Gen.
7.2
Combining Succinct Key Generation with Mahadev rTCFs
In our protocols, we compose a batch key generation algorithm (Definition 7.2) with a family of
Mahadev randomized TCFs (Definition 3.3). The composition is simple: use a batch key generation
procedure BatchGen = (Setup, ExtPk, ExtSk, Program) to batch the procedure TCF.Gen(1λ, mode)
for many Mahadev rTCFs fpk1, . . . , fpkN . The composition has the following syntax:
• Setup(1λ, N, C) takes as input the security parameter λ, the batch size N (in binary), and a
circuit C computing a function mapping [N] →{0, 1}. It outputs a public key PK and secret
key SK.
• ExtPk(PK, i) then outputs a public key pki that can be used to evaluate a randomized TCF
fpki.
• ExtSk(SK, i) outputs a secret key ski that can be used to invert a TCF evaluation yi.
• Program, as defined above, can be used to program a fresh (pki, ski) ←Gen(1λ, mode = C(i))
into a succinct program generated using circuit C. Program is an auxiliary algorithm used
only for analysis.
We now establish that all of the necessary properties listed in Section 5 are satisfied by this
composition.
Correctness of the composition (i.e., that key pairs (pki, ski) are in the range of TCF.Gen(1λ, mode =
f(i))) follows immediately from the correctness of Setup. Key indistinguishability of the composi-
tion is also inherited directly from the key indistinguishability of BatchGen.
We next prove that collapsing of fpkj holds in the presence of PK and all {ski}i̸=j.
Lemma 7.6. [Collapsing] For any circuit C, any index j, and (PK, SK) ←Setup(1λ, N, C),
the TCF fpkj is collapsing, even to an adversary given PK along with all secret keys {ski}i̸=j
besides skj.
Formally, a computationally bounded adversary cannot win the following distinguishing
game with non-negligible advantage:
1. The adversary chooses an index j ∈[N] and a circuit C : [N] →{0, 1}.
2. The challenger samples (PK, SK) ←Setup(1λ, N, C).
45


3. The challenger sends (PK, {ski}i̸=j) to the adversary.
4. The adversary prepares a quantum state |ψ⟩on registers B, X along with a string y and
sends both to the challenger.
5. The challenger computes, in superposition, whether Check(pkj, b, x, y) = 1.
• If Check fails, the challenger samples a random bit c and stops.
• If Check passes, the challenger samples a random bit c; if c = 1, the challenger
measures B.
6. The adversary, given access to the modified (B, X), outputs a bit c′ and wins if c′ = c.
Proof. We consider the following hybrid experiments.
• Hyb0: this is the actual security game.
• Hyb1: In step (2), challenger samples (pk, sk) ←Gen(1λ, C(j)) and samples (PK, SK) ←
Program(1λ, N, C, pk, j).
Hyb0 and Hyb1 are computationally indistinguishable by the programming indistinguishabil-
ity of SuccGen.
• Hyb2: In step (2), the challenger instead samples (pk, sk) ←Gen(1λ, injective).
Hyb1 and Hyb2 are computationally indistinguishable by the key indistinguishability of the
injective/claw-free trapdoor functions.
Finally, in Hyb3, even a computationally unbounded adversary cannot guess the challenge bit
c, as with all but negligible probability, pkj = ExtPk(PK, j) defines an injective function (by
Definition 3.3), so after verifying that Check(pkj, b, x, y) = 1, the register B is already a standard
basis state. This completes the proof of Lemma 7.6.
Finally, we prove that the adaptive hardcore bit property of fpkj holds given PK and all {ski}i̸=j
Lemma 7.7. [Adaptive Hardcore Bit] For any j and any circuit C such that C(j) = 1 =
2-to-1, for (PK, SK) ←Setup(1λ, N, C), the adaptive hardcore bit property (see Definition 3.3)
holds for the function fpkj (with associated secret key skj), even if the adversary is given
(PK, {ski}i̸=j).
Proof. We consider the following hybrid experiments.
• Hyb0: this is the adaptive hardcore bit security game for (pkj, skj) as sampled above.
• Hyb1: this is the adaptive hardcore bit security game for (pk, sk) ←Gen(1λ, 2-to-1), (PK, SK) ←
Program(1λ, N, C, pk, j). The adversary is additionally given PK and ski = ExtSk(SK, i) for
all i ̸= j.
Hyb0 and Hyb1 are computationally indistinguishable by the programming indistinguishability
property. Moreover, the adversary’s advantage in Hyb1 is negligible by the adaptive hardcore bit
property of the freshly generated key pair (pk, sk) ←Gen(1λ, 2-to-1), as a reduction given pk can
simulate Hyb1 by sampling all other parameters given to the Hyb1 adversary itself.
This completes the proof of Lemma 7.7.
46


8
A Verifier-Succinct Protocol
In this section, we present a delegation protocol for QMA with succinct verifier messages. First, in
Section 8.1, we describe results due to [ACGH20] about the parallel repetition of certain commit-
challenge-response protocols with a quantum prover. Our treatment is somewhat more abstract
than [ACGH20], so for completeness we provide proofs of all claims (based on proofs appearing
in [ACGH20]).
Next, in Section 8.2, we describe the syntax of a non-interactive, information-
theoretic QMA verification protocol (with quantum verifier) that we will use, due to [FHM18].
In Section 8.3, we describe a verifier-succinct protocol for QMA delegation, where the verifier
messages (but not the prover messages) are succinct.
8.1
Quantum commit-challenge-response protocols
Consider any commit-challenge-response protocol between a quantum prover P and a classical
verifier V , with the following three phases.
• Commit: P(1λ) and V (1λ; r) engage in a (potentially interactive) commitment protocol,
where r are the random coins used by V .
• Challenge: V samples a random bit b ←{0, 1} and sends it to P.
• Response: P computes a (classical) response z and sends it to V .
After receiving the response, V decides to accept or reject the execution.
Consider any non-uniform QPT prover P ∗, and let


ψP ∗
λ,r
E
A,C be the (purified) state of the prover
after interacting with V (1λ; r) in the commit phase, where C holds the (classical) prover messages
output during this phase, and A holds the remaining state.
The remaining strategy of the prover can be described by family of unitaries
n
U P ∗
λ,0, UP ∗
λ,1
o
λ∈N+,
where U P ∗
λ,0 is applied to


ψP ∗
λ,r
E
on challenge 0 (followed by a measurement of z), and U P ∗
λ,1 is applied
to


ψP ∗
λ,r
E
on challenge 1 (followed by a measurement of z).
Let Vλ,r,0 denote the accept/reject predicate applied by the verifier to the prover messages when
b = 0, written as a projection to be applied to the registers holding the prover messages, and define
Vλ,r,1 analogously. Then define the following projectors on A ⊗C :
ΠP ∗
λ,r,0 := U P ∗
λ,0
†Vλ,r,0U P ∗
λ,0,
ΠP ∗
λ,r,1 := U P ∗
λ,1
†Vλ,r,1U P ∗
λ,1.
Definition 8.1. A commit-challenge-response protocol has computationally orthogonal projectors
if for any QPT prover P ∗,
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
Ei
= negl(λ).
Proofs of the following are given in Appendix A.
Lemma 8.2 ([ACGH20]). Consider a commit-challenge-response protocol with the following
properties.
47


1. Vλ,r,0 does not depend on r (that is, it is publicly computable given the transcript).
2. For any P ∗, if Er
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,0


ψP ∗
λ,r
Ei
= 1−negl(λ), then Er
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,1


ψP ∗
λ,r
Ei
= negl(λ).
Then, the protocol has computationally orthogonal projectors.
Theorem 8.3 ([ACGH20]). Consider the λ-fold parallel repetition of any commit-challenge-
response protocol with computationally orthogonal projectors. The probability that the verifier
accepts all λ parallel repetitions of the protocol is negl(λ).
8.2
Non-Interactive Post Hoc Verification of QMA
We recall a useful information-theoretic QMA verification protocol of Fitzsimons, Hajdušek, and
Morimae [FHM18]. In fact, we will use an “instance-independent” version due to [ACGH20].
Lemma 8.4 ([FHM18, ACGH20]). For all languages L = (Lyes, Lno) ∈QMA there exists
a polynomial k(λ), a function ℓ(λ) that is polynomial in the time T(λ) required to verify
instances of size λ, a QPT algorithm PFHM, and a PPT algorithm VFHM such that the following
holds.
• PFHM(x, |ψ⟩) →|π⟩: on input an instance x ∈{0, 1}λ and a quantum state |ψ⟩, PFHM
outputs an ℓ(λ)-qubit state |π⟩.
• Completeness. For all x ∈Lyes and |φ⟩∈RL(x) it holds that
Pr
h
VFHM(x, M(h, |π⟩)) = acc : |π⟩←PFHM

x, |φ⟩⊗k(λ)i
≥1 −negl(λ)
where h ←{0, 1}ℓ(λ).
• Soundness. For all x ∈Lno and all ℓ-qubit states |π∗⟩it holds that
Pr[VFHM(x, M(h, |π∗⟩)) = acc] ≤negl(λ)
where h ←{0, 1}ℓ(λ).
Moreover, when L ∈BQP, the honest prover algorithm PFHM is also a BQP algorithm.
While the result was originally stated in [FHM18, ACGH20] to have an inverse polynomial
soundness gap, we have driven the soundness gap to negligible by standard QMA amplification.
Finally, we remark that although the algorithm VFHM is completely classical, the entire verification
procedure is quantum since it involves measuring the quantum state sent by the prover.
8.3
Semi-Succinct Delegation for QMA
We describe a protocol for verifying any QMA language L.
48


Ingredients:
• Let (PFHM, VFHM) be the non-interactive protocol described in Lemma 8.4 for language L
with associated polynomials k(λ), ℓ(λ).
• Let PRF : {0, 1}λ × {0, 1}log ℓ(λ) →{0, 1} be a pseudo-random function.
• Let PMeas = (Commit, Open) and VMeas = (Gen, Test, Out) be the prover and verifier algorithms
for an ℓ(λ)-qubit (verifier succinct) commit-and-measure protocol, defined in Section 4 and
constructed in Section 5.1.
The Protocol:
• The verifier is initialized with an instance x ∈{0, 1}λ and the prover is initialized with x and
k(λ) copies of a witness |φ⟩∈RL(x).
• The verifier samples s ←{0, 1}λ, defines C so that C(i) = PRFs(i), and computes (pk, sk) ←
Gen(1λ, C). It sends pk to the prover.
• The prover first computes |ψ⟩←PFHM

x, |φ⟩⊗k(λ)
, and then computes (y, |st⟩) ←Commit(pk, |ψ⟩).
It sends y to the verifier.
• The verifier samples a random challenge c ←{0, 1} and sends c to the prover.
• The prover computes z ←Open(|st⟩, c) and sends z to the verifier.
• If c = 0, the verifier checks whether Test(pk, (y, z)) = acc and rejects if the test fails. If c = 1,
the verifier computes m ←Out(sk, (y, z)) and checks whether VFHM(x, m) = acc. The verifier
accepts if and only the verification is successful.
Theorem 8.5. Let (PSS, VSS) be the λ-fold parallel repetition of the above protocol.
Then,
(PSS, VSS) satisfies completeness and soundness as defined in Definition 3.1. Moreover, for an
instance x with QMA verification time T, the total size of verifier messages is poly(λ, log T).
Proof. First, the verifier message size guarantee follows from the fact that the verifier initializes
the commit-and-measure protocol with a circuit C that succinctly encodes ℓ(λ) bits using a PRF
with input size log(ℓ(λ)), where ℓ(λ) is polynomially related to the QMA verification time T.
Next, we argue completeness. For any x ∈L, we show that a single repetition of the protocol
accepts with 1−negl(λ) probability, and so completeness of the λ-fold parallel repetition then follows
by a union bound. In the case of a test round, this follows from the test round completeness of the
commit-and-measure protocol (Definition 4.2). In the case of a measurement round, we first see that
measurement round completeness of the commit-and-measure protocol (Definition 4.2) implies that
the probability that the verifier outputs 1 is negl(λ)-close to the probability that the FHM protocol
(PFHM, VFHM) accepts when run with an honest prover, but where h = (PRFs(1), . . . , PRFs(ℓ)) for
s ←{0, 1}λ. Then, the security of the PRF implies that this probability is negl(λ)-close to the
probability that the FHM protocol accepts when h ←{0, 1}ℓ. Finally, this is negl(λ)-close to 1 by
the completeness of the FHM protocol (Lemma 8.4).
49


Finally, we argue soundness. Consider any x /
∈L. By Theorem 8.3, it suffices to show that
the single repetition of the protocol satisfies the conditions of Lemma 8.2. We define Vλ,r,0 to be
the verifier’s accept projection on a test round, and Vλ,r,1 to be the verifier’s accept projection
on a measurement round. Condition 1 of Lemma 8.2 follows immediately from the structure of
the commit-and-measure protocol. Now, consider any prover P ∗such that the first expectation in
condition 2 is 1 −negl(λ), meaning that P ∗passes the test round with 1 −negl(λ) probability. By
the soundness of the commit-and-measure protocol, there exists a state ρ such that the probability
that the verifier accepts on a measurement round is negl(λ)-close to the probability that VFHM
accepts given x, h, and M(h, ρ), where h = (PRFs(1), . . . , PRFs(ℓ)) for s ←{0, 1}λ. By security
of the PRF, this probability is negl(λ)-close to the probability that VFHM accepts given x, h, and
M(h, ρ), where h ←{0, 1}. Since x /
∈L, soundness of the FHM protocol implies that this is negl(λ).
Thus, the second expectation in condition 2 of Lemma 8.2 is negl(λ), which establishes that this
condition is satisfied, and completes the proof.
9
The Fully Succinct Protocol
In this section, we compile the verifier-succinct delegation scheme from Section 8 into a full-fledged
delegation scheme for QMA. Formally, we assume the existence of a delegation scheme for QMA
satisfying the following properties:
1. All verifier messages can be computed in time poly(λ, log N). (This is the definition of verifier
succinctness.)
2. Moreover, the verifier messages can be computed obliviously to the QMA instance and the
prover messages (this holds for the Section 8 protocol).
We present two compilers enabling this:
1. The first (and simpler) compiler only additionally assumes the existence of a collapsing hash
function, which is implied by LWE (Lemma 3.7). It converts a 2r-round verifier-succinct
protocol into a 4(r + 1) round fully succinct protocol.
In particular, the protocol from
Section 8 is compiled into a 12-round succinct argument for QMA.
2. The second compiler additionally assumes collapsing hash function and a (classical, post-
quantum) fully homomorphic encryption (FHE) scheme.
It converts a 2r round verifier-
succinct protocol to a 4r round fully succinct protocol. Moreover, if the verifier-succinct
protocol is public-coin (except for the first message), then so is the fully succinct protocol.
This results in an 8 round succinct argument system for QMA that is public-coin except for
the first message.
For simplicity, we write down the compiled protocols in the case r = 2, corresponding to the
protocols from Section 8.
Our main tool for these compilers are post-quantum succinct arguments of knowledge for NP
[CMSZ21, LMS21]. Specifically, the security guarantees proved in [CMSZ21] are insufficient for
50


the compilers, because the post-quantum extraction algorithm from [CMSZ21] is not sufficiently
composable since their extractor might significantly disturb the prover’s state. Instead, we make
use of a composable variant of the [CMSZ21] extractor due to [LMS21] called “state-preserving
succinct arguments of knowledge,”24 which we now define.
9.1
State-Preserving Succinct Arguments of Knowledge
Definition 9.1. A publicly verifiable argument system Π for an NP language L (with witness
relation R) is an ϵ-state-preserving succinct argument-of-knowledge if it satisfies the following
properties.
• Succinctness: when invoked on a security parameter λ and instance size n and a relation
decidable in time T, the communication complexity of the protocol is poly(λ, log T). The
verifier computational complexity is poly(λ, log T) + ˜
O(n).
• ϵ-State-Preserving Extraction.
There exists an extractor E(·)(x, ϵ) with the following
properties
– Efficiency: E(·)(x, ϵ) runs in time poly(n, λ, 1/ϵ) as a quantum oracle algorithm
(with the ability to apply controlled U-gates given an oracle U(·)), outputting a
classical transcript ˜
τ and a classical string w.
– State-preserving:
Let |ψ⟩∈A ⊗I be any poly(λ)-qubit pure state and let ρ =
TrA(|ψ⟩) ∈D(I).25 Consider the following two games:
∗Game 0 (Real) Generate a transcript τ by running P ∗(ρI, x) with the honest
verifier V . Output τ along with the residual state on A ⊗I.
∗Game 1 (Simulated) Generate a transcript-witness pair (˜
τ, w) ←EP ∗(ρI,x).
Output ˜
τ and the residual state on A ⊗I.
Then, we have that the output distributions of Game 0 and Game 1 are computa-
tionally ε-indistinguishable to any quantum distinguisher.
– Extraction correctness: for any P ∗as above, the probability that ˜
τ is an accepting
transcript but w is not in Rx is at most ϵ + negl(λ).
Theorem 9.2 ([LMS21]). Assuming the post-quantum poly(λ, 1/ϵ) hardness of learning with
errors, there exists a (4-message, public coin) ϵ-state preserving succinct argument of knowl-
edge for NP.
24We only require a weak variant of what was constructed in [LMS21], where state preservation is allowed an
inverse polynomial ϵ error.
25In general, the prover’s input state on I may be entangled with some external register A, and we ask that
computational indistinguishability holds even given A. Our definition is stated this way for maximal generality,
though we remark that the applications in this section do not require indistinguishability in the presence of an
entangled external register.
51


9.2
The QMA Protocol, Version 1
Let SemiSuccinct denote a verifier-succinct QMA delegation scheme additionally satisfying verifier
obliviousness. For simplicity, we assume that SemiSuccinct is a four-round protocol. We formalize
the execution of SemiSuccinct on a QMA instance x as follows:
• The verifier computes and sends pk ←SemiSuccinct.V1(1λ, 1|x|; r) (obliviously to the instance
x) with randomness r ←{0, 1}λ.
• The prover, on initial state |ψ⟩, computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩), which results
in a message y and residual state ρ.
• The verifier computes and sends β = SemiSuccinct.V2(r), obliviously to the instance x and
the prover message y.
• The prover computes and sends z ←SemiSuccinct.P(ρ, β).
• The verifier computes and outputs a (potentially expensive) predicate V (x, y, z, r).
Finally, let AoK denote the state-preserving succinct argument of knowledge of Theorem 9.2,
and let H denote a collapsing hash function family mapping {0, 1}∗to {0, 1}λ. Our succinct QMA
delegation protocol QMArg is defined as follows.
1. The verifier computes and sends pk = SemiSuccinct.V1(1λ, 1|x|; r) with randomness r ←
{0, 1}λ, along with a hash function h ←Hλ.
2. The prover computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩) and sends ˆ
y = h(y).
3. The prover and verifier execute AoK on the statement “∃w such that ˆ
y = h(w).”
4. The verifier computes and sends β = SemiSuccinct.V2(r). Note that SemiSuccinct.V2 is obliv-
ious to the prover message and so can be computed without it.
5. The prover computes z ←SemiSuccinct.P(ρ, β) and sends ˆ
z = h(z).
6. The prover and verifier execute AoK on the statement “∃w such that ˆ
z = h(w).”
7. The verifier sends r.
8. The prover and verifier execute AoK on the statement ∃w1, w2 such that ˆ
y = h(w1), ˆ
z = h(w2),
and V (x, w1, w2, r) = 1.
Completeness of the protocol follows directly from the completeness of SemiSuccinct and AoK.
Moreover, succinctness follows directly from the compression of H, the verifier succinctness of
SemiSuccinct, and the succinctness of AoK.
Since AoK has a round complexity of 4 and the first message can be re-used (indeed, h can be
used as the first message for AoK), the round complexity of QMArg is 12.
52


9.2.1
Proof of Soundness
Theorem 9.3. Assume that SemiSuccinct is (post-quantum) computationally sound, H is col-
lapsing,26 and that AoK is an ϵ-state-preserving argument of knowledge.
Then, QMArg is
(post-quantum) computationally sound.
Proof. Let x ̸∈L and suppose that a QPT P ∗(ρ, x) breaks the soundness of QMArg with probability
ϵ∗. We use P ∗, together with the soundness guarantees of AoK and the collision resistance property
of H, to break the soundness of SemiSuccinct. In particular, consider the following attack on the
soundness of SemiSuccinct:
• Set an accuracy parameter ϵ =
ϵ∗
10.
Whenever we call the AoK extractor E, we will use
accuracy parameter ϵ.
• Given a verifier message pk, we feed (h, pk) to P ∗(ρ, x) and obtain a hash value ˆ
y. Then, we
run the AoK extractor E on P ∗’s execution of step (3) (the first execution of AoK), outputting
a triple (˜
τ1, ˜
ρ1, y). We send y to the verifier.
• Given the verifier challenge β, we run P ∗( ˜
ρ1, pk, h, ˜
τ1) to obtain a message ˆ
z. Then, we run
the AoK extractor E on P ∗’s execution of step (6), obtaining a triple (˜
τ2, ˜
ρ2, z). We send z
to the verifier.
Finally, to analyze the behavior of this attack, we consider the following additional step (this
is only a mental experiment).
• Given the secret verifier randomness r, run the AoK extractor E on P ∗’s execution of step
(8) to obtain a triple (˜
τ3, ˜
ρ3, y′, z′).
Claim 9.4. With probability at least ϵ over the attack experiment, we have that SemiSuccinct.V (x,
y, z, r) = 1.
Note that this claim contradicts the soundness of SemiSuccinct.
Proof. The equation SemiSuccinct.V (x, y, z, r) = 1 follows from the following properties of an
execution of the mental experiment:
• h(y) = ˆ
y
• h(z) = ˆ
z
• h(y′) = ˆ
y
• h(z′) = ˆ
z
• SemiSuccinct.V (x, y′, z′, r) = 1.
26Collision-resistance of H suffices.
53


The above suffices because it implies that (y, z) = (y′, z′) except with negligible probabil-
ity by the collapsing (or just collision-resistance) of H, and so the last equation implies that
SemiSuccinct.V (x, y, z, r) = 1 (except with negligible probability).
Finally, we note that all five of the above conditions simultaneously hold with probability at
least ϵ by the state-preservation and correctness of E.
More specifically,
• The transcript (x, pk, h, ˆ
y, ˜
τ1, β, ˆ
z, ˜
τ2, r, ˜
τ3) is accepting (according to the QMArg verifier) with
probability at least ϵ∗−3ϵ. This follows by a hybrid argument invoking the state preservation
of E∗on the three executions of AoK (first w.r.t. ˜
τ1, then ˜
τ2, then ˜
τ3).
• Then, the correctness property of E implies that all five conditions hold simultaneously with
probability at least ϵ∗−6ϵ −negl(λ).
This completes the proof of soundness of QMArg.
9.3
The QMA Protocol, Version 2
We now describe a public-coin variant of the Section 9.2 transformation that additionally uses a
Fully Homomorphic Encryption (FHE) scheme FHE = (FHE.Gen, FHE.Enc, FHE.Dec, FHE.Eval).
Let SemiSuccinct and AoK denote the argument systems from Section 9.2. Then, our second
succinct argument system QMArg2 is defined as follows.
1. The verifier computes and sends pk = SemiSuccinct.V1(1λ, 1|x|; r) with randomness r ←
{0, 1}λ, along with a hash function h ←Hλ.
2. The verifier also samples (FHE.pk, FHE.sk) ←FHE.Gen(1λ) and computes FHE ciphertext
ctV = FHE.Enc(FHE.pk, r). The verifier sends FHE.pk, ctV to the prover.
3. The prover computes (y, ρ) ←SemiSuccinct.P(1λ, pk, |ψ⟩) and sends ˆ
y = h(y).
4. The prover and verifier execute AoK on the statement “∃w such that ˆ
y = h(w).”
5. The verifier computes and sends β = SemiSuccinct.V2(r). Note that SemiSuccinct.V2 is obliv-
ious to the prover message and so can be computed without it.
6. The prover computes z ←SemiSuccinct.P(ρ, β) and sends ˆ
z = h(z). The prover also com-
putes ctP = FHE.Eval(V (x, y, z, ·), ctV ) and sends ctP to the verifier.
7. The prover and verifier execute AoK on the statement ∃w1, w2 such that ˆ
y = h(w1), ˆ
z = h(w2),
and ctP = FHE.Eval(V (x, y, z, ·), ctV ).
8. The verifier checks that FHE.Dec(ctP ) = 1.
As before, completeness and succinctness follow immediately from the definitions. Additionally,
we note that the round complexity has been reduced to 8 because AoK is only invoked twice.
Finally, we note that as long as SemiSuccinct and AoK are public-coin (except for the first message
of SemiSuccinct), then QMArg2 is also public-coin (except for the first verifier message).
54


9.3.1
Proof of Soundness
Theorem 9.5. Assume that SemiSuccinct is (post-quantum) computationally sound, H is col-
lapsing, FHE is semantically secure, and that AoK is an ϵ-state-preserving argument of knowl-
edge. Then, QMArg2 is (post-quantum) computationally sound.
Proof. Let x ̸∈L and suppose that a QPT P ∗(ρ, x) breaks the soundness of QMArg2 with proba-
bility ϵ∗. We use P ∗, together with the soundness guarantees of AoK, the semantic security of FHE,
and the collision resistance property of H, to break the soundness of SemiSuccinct. In particular,
consider the following attack on the soundness of SemiSuccinct:
• Set an accuracy parameter ϵ =
ϵ∗
10.
Whenever we call the AoK extractor E, we will use
accuracy parameter ϵ.
• Given a verifier message pk, we sample h, FHE.pk ourselves and feed (h, pk, FHE.pk, ctV =
FHE.Enc(FHE.pk, 0)) to P ∗(ρ, x) and obtain a hash value ˆ
y. Then, we run the AoK extractor
E on P ∗’s execution of step (3) (the first execution of AoK), outputting a triple (˜
τ1, ˜
ρ1, y).
We send y to the verifier.
• Given the verifier challenge β, we run P ∗( ˜
ρ1, pk, h, ˜
τ1) to obtain a message ˆ
z, ctP . Then, we
run the AoK extractor E on P ∗’s execution of step (6), obtaining a triple (˜
τ2, ˜
ρ2, y′, z). We
send z to the verifier.
We claim that this attack breaks the soundness of SemiSuccinct – meaning that V (x, y, z, r) = 1
– with probability at least ϵ∗−4ϵ −negl(λ). To prove this, by FHE semantic security, it suffices to
show the same thing when ctV is instead sampled as FHE.Enc(FHE.pk, r).
From here, the proof proceeds similarly to the proof of Theorem 9.3. In particular, the equation
SemiSuccinct.V (x, y, z, r) = 1 follows from the following properties of the hybrid attack execution:
• h(y) = ˆ
y
• h(y′) = ˆ
y
• h(z) = ˆ
z
• FHE.Eval(V (x, y′, z, ·), ctV ) = ctP
• FHE.Dec(FHE.sk, ctP ) = 1.
This suffices due to the collapsing of H and the correctness of FHE.Eval. By the same argument
as in the proof of Theorem 9.3, these properties simultaneously hold with probabiltiy at least
ϵ∗−4ϵ −negl(λ) by the state-preserving extraction properties of AoK.
This completes the proof of soundness of QMArg2.
55


10
Additional Results
In this section, we describe a number of additional new results that follow from our template
for building succinct arguments for QMA. First, we show how to compile the protocol from Sec-
tion 9.3 into a two-message succinct argument for QMA in the quantum random oracle model.
We sometimes refer to such argument systems as designated-verifier SNARGs (dvSNARGs) in the
QROM. Next, we show how to obtain batch arguments for QMA (where the communication size
only depends on a single instance size) from only the quantum hardness of learning with errors
(i.e. without indistinguishability obfuscation). Finally, we describe how to add zero-knowledge to
our succinct argument in the plain model and to our dvSNARG in the QROM.
10.1
Succinct Non-interactive Arguments in the QROM
Consider any constant-round protocol (P, V ) for language L that is public-coin except for the first
message. That is, the verifier is defined by two circuits (V0, V1). Given instance x, the verifier first
samples random coins r and computes a first message s0 = V0(x, r). Then, the subsequent verifier
message are uniformly random strings s1, . . . , sc of at least λ bits. Finally, the verifier computes a
circuit V1(x, r, s0, t0, s1, t1, . . . , sc, tc) that determines whether it accepts or rejects, where t0, . . . , tc
are the prover messages. Let H : ((I × S) ∪S) × ([c] × T) →S be a random oracle, where I is the
space of instances, S is the space of verifier messages, and T is the space of prover messages. Let
(PFS, VFS) be the following protocol.
• Given x, VFS samples r and outputs s0 = V0(x, r).
• PFS runs P on (x, s0) to obtain t0. Then it computes s1 = H((x, s0), (0, t0)) and continues to
run P on s1 to obtain t1. Then for i ∈[c], it computes si = H(si−1, (i, ti−1)) and continues
to run P on si to obtain ti. Finally, it sends (t0, . . . , tc).
• VFS checks that s1 = H((x, s0), (0, t0)) and that for each i ∈[2, . . . , c], si = H(si−1, (i −
1, ti−1)). If so, it outputs V (x, r, s0, t0, . . . , sc, tc).
Theorem 10.1 (Multi-input measure-and-reprogram [DFM20]). Let c be an integer, and W, X, Y
be finite sets. There exists a polynomial-time quantum algorithm S such that the following
holds. Let A be an arbitrary quantum oracle algorithm that makes q queries to a uniformly
random H : (W ∪Y )×X →Y and outputs a tuple (x0, . . . , xc). Then for any b
x ∈Xc+1 without
duplicate entries, any predicate V , and any w ∈W,
Pr
y1,...,yc

(x0, . . . , xc) = b
x ∧V (w, x0, y1, x1, . . . , yc, xc) = 1 : (x0, . . . , xc) ←SA(y1, . . . , yc)

≥
c!
(q + c + 1)2c Pr
H




(x0, . . . , xc) = b
x ∧V





w, x0,
y1 := H(w, x0), x1,
y2 := H(y1, x1), x2, . . . ,
yc := H(yc−1, xc−1), xc




= 1 : (x0, . . . , xc) ←AH




−ϵb
x,
56


where P
b
x ϵb
x = c!/|Y |, and SA is an algorithm that has black-box access to the algorithms
of A and for each i ∈[c], receives yi and only after outputting xi−1.27
Theorem 10.2. If (P, V ) is a sound protocol for L, then (PFS, VFS) is a sound protocol for L
in the quantum random oracle model.
The following corollary then follows immediately from the protocol given in Section 9.3.
Corollary 10.3. Assuming post-quantum indistinguishability obfuscation, the post-quantum
hardness of the learning with errors problem, and post-quantum fully homomorphic encryp-
tion, there exists a designated verifier succinct non-interactive argument system (dvSNARG)
for QMA in the quantum random oracle model.
Proof. (of Theorem 10.2) Let H : ((I × S) ∪S) × ([c] × T) →S be the random oracle used in
(PFS, VFS). Consider an adversary A in the protocol (PFS, VFS) that makes q = poly(λ) queries to
H and consider any x /
∈L. For any r, let V1,r be the predicate V1 with r hard-coded, and let Ar be
the adversary A initialized with (x, V0(x, r)). Define ϵ(r) to be the success probability of Ar (that
is, the probability it makes VFS output 1). Then for any fixed r,
ϵ(r) = Pr
H

V1,r


x, t0,
s1 := H((x, V0(x, r), (0, t0)), t1, . . . ,
sc := H(sc−1, (c −1, tc−1)), tc

= 1 : (t0, . . . , tn) ←AH
r

.
Note that the overall success probability A is ϵ := Er[ϵ(r)]. Now, by setting W = (I × S), X =
([c] × T), Y = S, and w = (x, V0(x, r)), Theorem 10.1 implies that for any fixed r, the success
probability δ(r) of the simulator SAr(s1, . . . , sc) is
δ(r) ≥
1
poly(λ)ϵ(r) −negl(λ),
which follows by (i) summing over all t0, . . . , t1 and noting that (0, t0), . . . , (c, tc) contain no dupli-
cates, and (ii) the fact that q = poly(λ) and c is a constant. Finally, observe that by the soundness
of (P, V ), Er[δ(r)] = negl(λ). Indeed, by definition SA is a valid cheating prover in the protocol
(P, V ) since it only receives random si after outputting ti−1. This establishes that
1
poly(λ) E
r [ϵ(r)] −negl(λ) ≤negl(λ),
which implies that ϵ = negl(λ).
27This theorem as stated is actually a special case of [DFM20, Theorem 7], where w is fixed. In other words, it
corresponds to [DFM20, Theorem 7] where the class of adversaries considered all produce a fixed w as the first part
of their output.
57


10.2
Batch Arguments for QMA
Now, we show how to obtain batch arguments for QMA from the post-quantum hardness of learning
with errors. We first describe a verifier-succinct protocol for verifying n QMA instances, where the
verifier message size only grows with the time T needed for QMA verification of a single instance.
Note that here we do not use the succinct key generation protocol from Section 7.1, and thus do
not rely on indistinguishability obfuscation.
Ingredients:
• Let (PFHM, VFHM) be the non-interactive protocol described in Lemma 8.4 for language L
with associated polynomials k(λ), ℓ(λ).
• Let PMeas = (Commit, Open) and VMeas = (Gen, Test, Out) be the prover and verifier algo-
rithms for an ℓ(λ)-qubit commit-and-open measurement protocol, defined in Section 4 and
constructed in [Mah18].
The Protocol:
• The verifier is initialized with n instances (x1, . . . , xn) ∈{0, 1}λ and the prover is initialized
with (x1, . . . , xn) and k(λ) copies of each witness |φj⟩∈RL(xj).
• The verifier samples h ←{0, 1}ℓ(λ) and defines C such that C(i) = hi. The verifier computes
(pk, sk) ←Gen(1λ, C) and sends pk to the prover.
• For each j ∈[n], the prover first computes |ψj⟩←PFHM

xj, |φj⟩⊗k(λ)
, and then computes
(yj, |stj⟩) ←Commit(pk, |ψj⟩). It sends (y1, . . . , yn) to the verifier.
• The verifier samples a random challenge c ←{0, 1} and sends c to the prover.
• For each j ∈[n], the prover computes zj ←Open(|stj⟩, c) and sends (z1, . . . , zn) to the verifier.
• If c = 0, the verifier checks whether Test(pk, (yj, zj)) = acc and rejects if the test fails
on any index. If c = 1, the verifier computes mj ←Out(sk, (yj, zj)) and checks whether
VFHM(xj, mj) = acc. The verifier accepts if and only if all of the verifications are successful.
Theorem 10.4. Let (PBatch, VBatch) be the λ-fold parallel repetition of the above protocol. Then,
(PBatch, VBatch) satisfies completeness as in Definition 3.1 and soundness as in Definition 3.2.
Moreover, for instances (x1, . . . , xn) where T is the maximum QMA verification time for any
individual xi, the total size of verifier messages is poly(λ, T).
Proof. First, the verifier message guarantee follows immediately from the description of the pro-
tocol. Completeness follows via the same argument used to prove completeness in Theorem 8.5
(without the additional step involving the PRF). Soundness also follows along the same lines, ex-
cept that, if xi /
∈L, we define V (i)
λ,r,0 to be the verifier’s accept projection on instance i on a test
round, and V (i)
λ,r,1 to be the verifier’s accept projection on instance i on a measurement round.
58


Finally, we observe that Theorem 9.3 holds when the verifier-succinct protocol is replaced with
the batch protocol above, with no change in analysis. This results in the following corollary.
Corollary 10.5. Assuming the post-quantum hardness of the learning with errors problem,
there exists a batch argument for QMA, where the total communication is polynomial in the
QMA verification time for a single QMA instance.
10.3
Zero Knowledge
In this section, we provide sketches for how to obtain the following results.
• A (non-adaptive) zero-knowledge succinct argument for QMA (in the plain model).
• A (non-adaptive) zero-knowledge dvSNARG for QMA in the quantum random oracle model.
In both of our sketches, we will make use of secure two-party computation for reactive func-
tionalities, which are interactive functionalities where multiple public circuits may be computed
sequentially over private inputs, and where the description of these public circuits may be deter-
mined after some of the private inputs are submitted to the functionality and may even depend on
the outputs of previously computed circuits.
The plain model.
Here, we can start with the protocol in Section 9.2. This protocol as such
does not provide any hiding property for the prover’s witness. However, we can use secure two-
party computation for the following reactive functionality to hide all information about the prover’s
witness from the verifier, while preserving soundness.
• Take as input random coins rP , rV from each party, compute the verifier’s first message of
the protocol using randomness r := rP ⊕rV , and output this message to the prover.
• For each subsequent round, take as input the prover’s message, and then compute and output
the next verifier’s message (using random coins r) to the prover.
• After the final prover’s message, compute and output the verifier’s verdict (based on all prover
messages and r) to the verifier.
Note that, since the verifier is classical, this functionality can be implemented by a protocol
for (post-quantum) secure two-party computation of classical (reactive) functionalities, such as
[HSS11].28 To argue soundness (for any fixed no instance), we can run the two-party computation
simulator for a malicious prover in order to extract inputs from the prover and reduce to soundness
of the underlying protocol.
To argue zero-knowledge (for any fixed yes instance), we can run
the two-party computation simulator for a malicious verifier, programming the final output to 1.
Note that the verifier only receives this single bit of information from the functionality, which is
internally running an honest verifier. Thus, this simulation and output is indistinguishable from
the real interaction with an honest prover.
28Note that [HSS11] is based on Watrous rewinding, and thus requires polynomially many rounds of interaction.
We do not attempt to optimize the round-complexity of our zero-knowledge protocol, but note that non-black-box
techniques such as those of [BS20] (with additional assumptions), or a relaxation to ϵ-zero-knowledge [CCLY21] could
result in a constant-round protocol.
59


The QROM.
In order to add zero-knowledge to our two-message succinct argument in the
QROM, we have to be careful in order to avoid using the random oracle in a non-black-box manner.
We achieve this in two steps: We first construct a constant-round honest-verifier zero-knowledge
argument where, (i) the verifier is public-coin except for the first message, and (ii) the protocol
remains zero-knowledge even against a verifier that computes its first message maliciously. Second,
we compress this protocol into a two-message protocol in the QROM using the same arguments
in Section 10.1. Since the protocol has constant rounds and is public-coin after the first verifier
message, soundness holds via the same argument. Zero-knowledge holds because we have zero-
knowledge against a malicious first message, and honest-verifier zero-knowledge with respect to all
subsequent messages, which will be sampled uniformly at random by the random oracle.
We now turn our attention to the construction of the constant-round honest-verifier zero-
knowledge argument. We are going to assume the existence of a post-quantum secure two-message
two-party computation protocol for reactive (classical) functionalities. One can instantiate this
with the two-message secure computation protocol of [IPS08] based on (post-quantum) two-message
oblivious transfer in the common random string (CRS) model, which we can instantiate from the
post-quantum hardness of learning with errors [PVW08]. Note that when we later compress this
protocol in the QROM, the CRS can be sampled by querying the random oracle on a fixed input.
We will use such a protocol to implement the following reactive functionality.
• Take as input random coins r from the verifier.
• The verifier’s first message is sampled by the verifier given to the functionality as a public
input.
• Take as input the prover’s first message.
• The verifier’s second message is sampled by the verifier and given to the functionality as a
public input.
• . . .
• Take as input the prover’s final message.
• Check that the verifier’s first message is computed honestly from random coins r, and if so,
compute the verifier’s verdict using r, the prover messages, and the verifier’s messages, and
deliver this output to the verifier.
Note that all the verifier messages are still sampled publicly and as in the protocol from Section 9.3,
so the prover can still compute its responses given these messages.
Now, we argue that the resulting protocol satisfies the required properties. To argue soundness,
we can run the two-party computation simulator for a malicious prover in order to extract inputs
from the prover and reduce to soundness of the original protocol. To argue honest-verifier zero-
knowledge with a malicious first message, we can run the two-party computation simulator for a
malicious verifier, programming the final output to 1. However, since we are allowing the verifier
to choose its first message maliciously, we have to argue that for any choice of randomness used to
generate the verifier’s first message, the subsequent interaction between honest prover (on input a
60


valid witness for a true statement) and an honest verifier results in the verifier outputting 1 with
overwhelming probability. Recalling the structure of the verifier’s first message in the Section 9.3
protocol, we see that this requires perfectly correct FHE and a perfectly correct measurement pro-
tocol. Achieving FHE with perfect correctness is standard by truncating the error distribution, and
we can obtain a perfectly correct measurement protocol as discussed in Section 3.5 and Section 4.1.
References
[ACGH20]
Gorjan Alagic, Andrew M. Childs, Alex B. Grilo, and Shih-Han Hung. Non-interactive
classical verification of quantum computation. pages 153–180, 2020. 3, 6, 13, 47, 48,
65
[ALM+92]
Sanjeev Arora, Carsten Lund, Rajeev Motwani, Madhu Sudan, and Mario Szegedy.
Proof verification and hardness of approximation problems. pages 14–23, 1992. 1
[AS92]
Sanjeev Arora and Shmuel Safra. Probabilistic checking of proofs; A new characteri-
zation of NP. pages 2–13, 1992. 1
[BCM+18] Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh V. Vazirani, and Thomas
Vidick. A cryptographic test of quantumness and certifiable randomness from a single
quantum device. pages 320–331, 2018. 18, 19, 20, 27, 28
[BDGM20] Zvika Brakerski, Nico Döttling, Sanjam Garg, and Giulio Malavolta. Factoring and
pairings are not necessary for io:
Circular-secure lwe suffices.
Cryptology ePrint
Archive, Report 2020/1024, 2020. https://ia.cr/2020/1024. 22
[BFL90]
László Babai, Lance Fortnow, and Carsten Lund. Non-deterministic exponential time
has two-prover interactive protocols. pages 16–25, 1990. 1
[BGI14]
Elette Boyle, ShafiGoldwasser, and Ioana Ivan. Functional signatures and pseudoran-
dom functions. pages 501–519, 2014. 22
[BGKW88] Michael Ben-Or, ShafiGoldwasser, Joe Kilian, and Avi Wigderson. Multi-prover in-
teractive proofs: How to remove intractability assumptions. pages 113–131, 1988. 1
[BGMZ18] James Bartusek, Jiaxin Guan, Fermi Ma, and Mark Zhandry.
Return of GGH15:
Provable security against zeroizing attacks. pages 544–574, 2018. 22
[BGV12]
Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (Leveled) fully homomor-
phic encryption without bootstrapping. pages 309–325, 2012. 21
[BS20]
Nir Bitansky and Omri Shmueli. Post-quantum zero knowledge in constant rounds.
pages 269–279, 2020. 59
[BV97]
Ethan Bernstein and Umesh Vazirani. Quantum complexity theory. SIAM Journal
on computing, 26(5):1411–1473, 1997. 1
61


[BV11]
Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption
from (standard) LWE. pages 97–106, 2011. 21
[BV14]
Zvika Brakerski and Vinod Vaikuntanathan. Lattice-based FHE as secure as PKE.
pages 1–12, 2014. 21
[BV17]
Nir Bitansky and Vinod Vaikuntanathan. A note on perfect correctness by derandom-
ization. pages 592–606, 2017. 22
[BW13]
Dan Boneh and Brent Waters. Constrained pseudorandom functions and their appli-
cations. pages 280–300, 2013. 22
[CCLY21]
Nai-Hui Chia, Kai-Min Chung, Xiao Liang, and Takashi Yamakawa. Post-quantum sim-
ulatable extraction with minimal assumptions: Black-box and constant-round. Cryp-
tology ePrint Archive, Report 2021/1516, 2021. https://ia.cr/2021/1516. 59
[CCY20]
Nai-Hui Chia, Kai-Min Chung, and Takashi Yamakawa. Classical verification of quan-
tum computations with efficient verifier. pages 181–206, 2020. 3
[CLLW20]
Kai-Min Chung, Yi Lee, Han-Hsuan Lin, and Xiaodi Wu. Constant-round blind clas-
sical verification of quantum sampling. arXiv preprint arXiv:2012.04848, 2020. 1
[CMSZ21]
Alessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandry. Post-quantum
succinct arguments: breaking the quantum rewinding barrier. FOCS ’21, 2021. 13, 14,
50, 51
[CVW18]
Yilei Chen, Vinod Vaikuntanathan, and Hoeteck Wee. GGH15 beyond permutation
branching programs: Proofs, attacks, and candidates. pages 577–607, 2018. 22
[DFM20]
Jelle Don, Serge Fehr, and Christian Majenz. The measure-and-reprogram technique
2.0: Multi-round fiat-shamir and more. pages 602–631, 2020. 56, 57
[DQV+21]
Lalita Devadas, Willy Quach, Vinod Vaikuntanathan, Hoeteck Wee, and Daniel Wichs.
Succinct lwe sampling, random polynomials, and obfuscation.
Cryptology ePrint
Archive, Report 2021/1226, 2021. https://ia.cr/2021/1226. 22
[FHM18]
Joseph F. Fitzsimons, Michal Hajdusek, and Tomoyuki Morimae. Post hoc verification
of quantum computation. Phys. Rev. Lett., 120:040501, Jan 2018. 2, 6, 13, 47, 48
[Gen09]
Craig Gentry. Fully homomorphic encryption using ideal lattices. pages 169–178, 2009.
21
[GGM84]
Oded Goldreich, ShafiGoldwasser, and Silvio Micali. How to construct random func-
tions (extended abstract). pages 464–479, 1984. 22
[GMR85]
ShafiGoldwasser, Silvio Micali, and Charles Rackoff. The knowledge complexity of
interactive proof-systems (extended abstract). pages 291–304, 1985. 1
62


[GP21]
Romain Gay and Rafael Pass. Indistinguishability obfuscation from circular security.
In Samir Khuller and Virginia Vassilevska Williams, editors, STOC ’21: 53rd Annual
ACM SIGACT Symposium on Theory of Computing, Virtual Event, Italy, June
21-25, 2021, pages 736–749. ACM, 2021. 22
[GVW15]
Sergey Gorbunov, Vinod Vaikuntanathan, and Daniel Wichs. Leveled fully homomor-
phic signatures from standard lattices. pages 469–477, 2015. 4, 18
[HSS11]
Sean Hallgren, Adam Smith, and Fang Song. Classical cryptographic protocols in a
quantum world. pages 411–428, 2011. 59
[IPS08]
Yuval Ishai, Manoj Prabhakaran, and Amit Sahai. Founding cryptography on oblivious
transfer - efficiently. pages 572–591, 2008. 60
[JLS21]
Aayush Jain, Huijia Lin, and Amit Sahai. Indistinguishability obfuscation from well-
founded assumptions. In Samir Khuller and Virginia Vassilevska Williams, editors,
STOC ’21: 53rd Annual ACM SIGACT Symposium on Theory of Computing,
Virtual Event, Italy, June 21-25, 2021, pages 60–73. ACM, 2021. 22
[Kil92]
Joe Kilian. A note on efficient zero-knowledge proofs and arguments (extended ab-
stract). pages 723–732, 1992. 1
[KPTZ13]
Aggelos Kiayias, Stavros Papadopoulos, Nikos Triandopoulos, and Thomas Zacharias.
Delegatable pseudorandom functions and applications. pages 669–684, 2013. 22
[LMS21]
Alex Lombardi, Fermi Ma, and Nicholas Spooner.
Post-quantum zero knowledge,
revisited (or: How to do quantum rewinding undetectably). Cryptology ePrint Archive,
Report 2021/1543, 2021. https://ia.cr/2021/1543. 14, 50, 51
[Mah18]
Urmila Mahadev. Classical verification of quantum computations. pages 259–267, 2018.
1, 2, 3, 4, 5, 6, 7, 8, 16, 18, 19, 20, 23, 24, 25, 26, 27, 29, 41, 58
[Mic94]
Silvio Micali.
A secure and efficient digital signature algorithm.
Technical Memo
MIT/LCS/TM-501b, Massachusetts Institute of Technology, Laboratory for Computer
Science, April 1994. 1
[PVW08]
Chris Peikert, Vinod Vaikuntanathan, and Brent Waters. A framework for efficient
and composable oblivious transfer. pages 554–571, 2008. 4, 18, 60
[PW08]
Chris Peikert and Brent Waters. Lossy trapdoor functions and their applications. pages
187–196, 2008. 4, 18, 20
[Reg05]
Oded Regev. On lattices, learning with errors, random linear codes, and cryptography.
pages 84–93, 2005. 18
[SW14]
Amit Sahai and Brent Waters. How to use indistinguishability obfuscation: deniable
encryption, and more. pages 475–484, 2014. 7, 22
63


[Unr12]
Dominique Unruh. Quantum proofs of knowledge. In Annual international confer-
ence on the theory and applications of cryptographic techniques, pages 135–152.
Springer, 2012. 16
[Unr16a]
Dominique Unruh. Collapse-binding quantum commitments without random oracles.
pages 166–195, 2016. 20
[Unr16b]
Dominique Unruh. Computationally binding quantum commitments. pages 497–527,
2016. 5, 20
[Vid20]
Thomas Vidick. Interactions with quantum devices (course), 2020. http://users.
cms.caltech.edu/~vidick/teaching/fsmp/fsmp.pdf. 2, 8, 9, 29, 35
[VZ21]
Thomas Vidick and Tina Zhang. Classical proofs of quantum knowledge. pages 630–
660, 2021. 6
[WW21]
Hoeteck Wee and Daniel Wichs. Candidate obfuscation via oblivious LWE sampling.
pages 127–156, 2021. 22
A
Proofs from Section 8
Lemma A.1. Consider a commit-challenge-response protocol with the following properties.
1. Vλ,r,0 does not depend on r (that is, it is publicly computable given the transcript).
2. For any P ∗, if Er
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,0


ψP ∗
λ,r
Ei
= 1−negl(λ), then Er
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,1


ψP ∗
λ,r
Ei
= negl(λ).
Then, the protocol has computationally orthogonal projectors.
Proof. Suppose there exists a prover P ∗and a polynomial p(λ) such that for infinitely many λ,
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
Ei
≥1/p(λ).
Define an alternate prover b
P ∗as follows.
1. b
P ∗takes as input p(λ)4 copies of P ∗’s auxiliary advice, and pk sampled by the verifier.
2. Repeat the following at most p(λ)4 times:
(a) Prepare the state


ψP ∗
λ,r
E
using a copy of P ∗’s auxiliary advice.
(b) Apply the projective measurement
n
ΠP ∗
λ,r,0, I −ΠP ∗
λ,r,0
o
, which is efficient due to property
1 of the commit-challenge-response protocol.
(c) If the first outcome is observed, output the resulting state. Otherwise, repeat.
3. If b
P ∗has not terminated, output a dummy state |φ⟩such that ⟨φ| ΠP ∗
λ,r,0 |φ⟩= 1.
64


Let


ψ b
P ∗
λ,r
E
be the state that results from the above procedure. Finally, let b
P ∗act identically to
P ∗after this point.
Next, let Rterm,λ :=
n
r :
D
ψP ∗
λ,r


 ΠP ∗
λ,r,0


ψP ∗
λ,r
E
> 1/p(λ)2o
, and note that for any r ∈Rterm,λ,
Pr




ψ
b
P ∗
λ,r
E
̸=
ΠP ∗
λ,r,0


ψP ∗
λ,r
E
∥ΠP ∗
λ,r,0


ψP ∗
λ,r
E
∥

≤
1 −1/p(λ)2
p(λ)4
≤e−p(λ)2 = negl(λ).
Now, on the one hand,
1
|R|
X
r∈Rterm,λ
D
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
E
≤1
|R|
X
r∈Rterm,λ
D
ψ
b
P ∗
λ,r


 Π
b
P ∗
λ,r,1


ψ
b
P ∗
λ,r
E
+ negl(λ)
≤E
r
hD
ψ
b
P ∗
λ,r


 Π
b
P ∗
λ,r,1


ψ
b
P ∗
λ,r
Ei
+ negl(λ)
≤negl(λ),
where the third inequality follows from property 2 of the commit-challenge-response protocol,
since by definition Er
hD
ψ b
P ∗
λ,r


 Π b
P ∗
λ,r,0


ψ b
P ∗
λ,r
Ei
= 1. On the other hand,
1
|R|
X
r∈Rterm,λ
D
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
E
= E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
Ei
−1
|R|
X
r/
∈Rterm,λ
D
ψP ∗
λ,r


 ΠP ∗
λ,r,0ΠP ∗
λ,r,1ΠP ∗
λ,r,0


ψP ∗
λ,r
E
≥1/p(λ) −1/p(λ)2,
which is a contradiction, completing the proof.
Theorem A.2 ([ACGH20]). Consider the λ-fold parallel repetition of any commit-challenge-
response protocol with computationally orthogonal projectors. The probability that the verifier
accepts all λ parallel repetitions of the protocol is negl(λ).
Proof. Let R be the randomness space of the single repetition protocol, and r = (r1, . . . , rλ) ∈R⊗λ
be verifier randomness for the λ-fold parallel repetition. Now, any non-uniform prover P ∗can be
described by states
n

ψP ∗
λ,r
Eo
λ,r and families of unitaries
n
U P ∗
λ,c
o
λ,c, where c ∈{0, 1}λ ranges over
all of the verifier challenges.
For each c ∈{0, 1}λ, define
ΠP ∗
λ,r,c := U P ∗
λ,c
† (Vλ,r1,c1 ⊗· · · ⊗Vλ,rλ,cλ) U P ∗
λ,c.
Claim A.3. For any c1 ̸= c2 ∈{0, 1}λ,
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,c2ΠP ∗
λ,r,c1 + ΠP ∗
λ,r,c1ΠP ∗
λ,r,c2


ψP ∗
λ,r
Ei
= negl(λ).
65


Proof. Suppose there exists i ∈[λ] such that (c1)i = 1 and (c2)i = 0 (the other case is symmetric).
Since for any quantum state |ψ⟩and two projectors Π1, Π2,
⟨ψ| Π2Π1 + Π1Π2 |ψ⟩≤2| ⟨ψ| Π2Π1 |ψ⟩| ≤2 ⟨ψ| Π2Π1Π2 |ψ⟩1/2 ,
it then suffices (by Jensen’s inequality) to show that
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,c2ΠP ∗
λ,r,c1ΠP ∗
λ,r,c2


ψP ∗
λ,r
Ei
= negl(λ).
To see this, let
V (i)
λ,ri,b := I ⊗· · · ⊗I ⊗Vλ,ri,b ⊗I ⊗· · · ⊗I,
for i ∈[λ], b ∈{0, 1}, and observe that
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,r,c2ΠP ∗
λ,r,c1ΠP ∗
λ,r,c2


ψP ∗
λ,r
Ei
≤E
r
hD
ψP ∗
λ,r


 U P ∗
λ,c2
†V (i)
λ,ri,0U P ∗
λ,c2U P ∗
λ,c1
†V (i)
λ,ri,1U P ∗
λ,c1U P ∗
λ,c2
†V (i)
λ,ri,0U P ∗
λ,c2


ψP ∗
λ,r
Ei
= E
ri
hD
b
ψP ∗
λ,ri


 U P ∗
λ,c2
†V (i)
λ,ri,0U P ∗
λ,c2U P ∗
λ,c1
†V (i)
λ,ri,1U P ∗
λ,c1U P ∗
λ,c2
†V (i)
λ,ri,0U P ∗
λ,c2


 b
ψP ∗
λ,ri
Ei
=negl(λ),
where for each ri ∈R,


 b
ψP ∗
λ,ri
E
is the purification of the mixed state (written in ensemble form)

1
|R|λ−1 ,


ψP ∗
λ,(r1,...,rλ)
E
(r1,...,ri−1,ri+1,...,rλ)∈R⊗λ−1 ,
and the final equality follows from the computational orthogonal projectors property of the commit-
challenge-response protocol. Indeed, one can define an efficient prover P ∗
i for the i’th iteration of
the commit-challenge-response protocol by defining U P ∗
i
λ,0 := U P ∗
λ,c2 and U P ∗
i
λ,1 := U P ∗
λ,c1 and noting that


 b
ψP ∗
λ,ri
E
is efficient to prepare while interacting with the i’th iteration of V, by running P ∗and λ−1
coherently executed copies of V.
Now observe that the probability the verifier accepts the parallel repeated protocol is
66


1
2λ E
r


D
ψP ∗
λ,r



X
c∈{0,1}λ
ΠP ∗
λ,c,r


ψP ∗
λ,r
E


≤1
2λ E
r





D
ψP ∗
λ,r





X
c∈{0,1}λ
ΠP ∗
λ,c,r


2 

ψP ∗
λ,r
E


1/2


≤1
2λ E
r





X
c∈{0,1}λ
D
ψP ∗
λ,r


 ΠP ∗
λ,c,r


ψP ∗
λ,r
E


1/2


+ 1
2λ


X
{c1,c2}∈({0,1}λ)2
E
r
hD
ψP ∗
λ,r


 ΠP ∗
λ,c2,rΠP ∗
λ,c1,r + ΠP ∗
λ,c1,rΠP ∗
λ,c2,r


ψP ∗
λ,r
Ei


1/2
≤1
2λ/2 + 1
2λ


X
{c1,c2}∈({0,1}λ)2
negl(λ)


1/2
= negl(λ),
where the first inequality holds because


ψP ∗
λ,r
E D
ψP ∗
λ,r


 ⪯I, the second inequality uses Jensen’s
inequality and the fact that projectors are idempotent, and the third inequality follows from
Claim A.3.
B
Proof of Claim 6.4
We now prove Claim 6.4, which is restated below for convenience.
Claim B.1. For all (u, v) ∈{0, 1}R × {0, 1}S it holds that
Tr
Πσx
u Πσz
v τ


=
E
u′∈{0,1}R ⟨ψ| ΠZ
v Z(u′)ΠX
u′⊕uZ(u′)ΠZ
v |ψ⟩.
(7)
Proof. Using the definition of τ, we get
Tr(Πσx
u Πσz
v τ) = 2−2N
X
r′,s′,r′′,s′′∈{0,1}N

⟨ψ| Z(s′)X(r′ ⊕r′′)Z(s′′) |ψ⟩H

φ+
⊗N σz(s′)σx(r′ ⊕r′′)σz(s′′)


A1 ⊗(Πσx
u Πσz
v )A2

φ+⊗N 
= 2−2N
X
r′,s′,r′′,s′′∈{0,1}N
(−1)(r′⊕r′′)·s′′
⟨ψ| Z(s′)X(r′ ⊕r′′)Z(s′′) |ψ⟩H

φ+
⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)


A1 ⊗(Πσx
u Πσz
v )A2

φ+⊗N 
.
(8)
However, most of the terms in Eq. (8) are zero: observe that when (r′ ⊕r′′)j ̸= 0 for any j ∈S, or
(s′ ⊕s′′)j ̸= 0 for any j ∈R, we have

φ+
⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)


A1 ⊗(σx(u)σz(v))A2

φ+⊗N = 0.
67


We can therefore rewrite Eq. (8) using the following change of variables:
• Since s′ ⊕s′′ must be 0 on R, the restriction of s′ and s′′ to R must be the same vector
u′ ∈{0, 1}R. Let the restriction of s′ and s′′ to indices in S be v′, v′′ ∈{0, 1}S respectively.
• Since r′ ⊕r′′ must be 0 on S, let u′′ ∈{0, 1}R denote the restriction of r′ ⊕r′′ to indices in
R. Note that for each u′′, there are 2N choices of (r′, r′′) satisfying u′′ = r′ ⊕r′′.
By a straightforward calculation, we have for all u′′ ∈{0, 1}R and all s′, s′′ ∈{0, 1}N that
X
r′,r′′∈{0,1}N
(r′⊕r′′)=u′′

φ+
⊗N σz(s′ ⊕s′′)σx(r′ ⊕r′′)


A1 ⊗(Πσx
u Πσz
v )A2

φ+⊗N = (−1)u′′·u+(s′⊕s′′)v.
Plugging this into Eq. (8), and using the fact that (−1)(s′⊕s′′)v = (−1)(v′⊕v′′)v, we obtain
Tr(Πσx
u Πσz
v τ) = 2−2N
X
u′,u′′∈{0,1}R
v′,v′′∈{0,1}S
(−1)(u⊕u′)·u′′+(v′⊕v′′)v
⟨ψ| Z(v′)Z(u′)X(u′′)Z(u′)Z(v′′) |ψ⟩H

=
E
u′∈{0,1}R ⟨ψ| ΠZ
v Z(u′)ΠX
u⊕u′Z(u′)ΠZ
v |ψ⟩
where the second equality follows from plugging in the definitions of ΠZ
v and ΠX
u⊕u′.
C
Proof of Claim 6.7
We now prove Claim 6.7, which we restate below for convenience.
Claim C.1. Let k = k(λ) be a positive integer-valued function of a security parameter λ.
Let {D0,λ}λ≥1 and {D1,λ}λ≥1 be families of distributions on {0, 1}k+1 such that the marginal
distributions D′
0,λ and D′
1,λ of D0,λ and D1,λ respectively on the first k bits are computationally
indistinguishable. Suppose that D0,λ and D1,λ are computationally distinguishable. Then there
is an efficiently computable binary-outcome POVM {M, Id −M} acting on k qubits such that



E
x∼D0,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩−
E
x∼D1,λ(−1)xk+1 ⟨x≤k| M |x≤k⟩


 >
1
poly(λ).
Proof. By assumption there exists an efficient distinguisher between D0 and D1 (for simplicity we
omit the index λ from the notation). Let A be a circuit for the distinguisher: A has (k + 1) input
qubits as well as m ancilla qubits, and a designated output qubit. Let Π1 be the projection on the
output qubit being equal to 1. Suppose without loss of generality that
E
x∼D0 ⟨x, 0m| A†Π1A |x, 0m⟩>
E
x∼D1 ⟨x, 0m| A†Π1A |x, 0m⟩+ 1
q ,
(9)
for some polynomial q = q(λ). Letting |b⟩k+1 denote the (k + 1)-st qubit, we can write
E
x∼D1 ⟨x, 0m| A†Π1A |x, 0m⟩=
E
x∼D1 xk+1 ⟨x≤k, 0m| ⟨1|k+1 A†Π1A |1⟩k+1 |x≤k, 0m⟩
+
E
x∼D1(1 −xk+1) ⟨x≤k, 0m| ⟨0|k+1 A†Π1A |0⟩k+1 |x≤k, 0m⟩.
68


Let Mb := ⟨b, 0m| A†Π1A |b, 0m⟩(where b corresponds to the (k + 1)-st qubit); note that Mb is a
positive semi-define. We can rewrite the right-hand-side as
E
x∼D1 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩+
E
x∼D1 ⟨x≤k| M0 |x≤k⟩.
(10)
Using a similar expansion while taking the expectation under D0 yields
E
x∼D0 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩+
E
x∼D0 ⟨x≤k| M0 |x≤k⟩.
(11)
Plugging Eqs. (10) and (11) into Eq. (9) gives
E
x∼D0 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩−
E
x∼D1 xk+1 ⟨x≤k| (M1 −M0) |x≤k⟩
>
E
x∼D1 ⟨x≤k| M0 |x≤k⟩−
E
x∼D0 ⟨x≤k| M0 |x≤k⟩+ 1
q .
For b ∈{0, 1}, note that {Mb, Id−Mb} is an efficiently computable POVM since it can be performed
by initializing the (k + 1)-st qubit to |b⟩, the ancilla qubits to |0m⟩, applying A, and measuring
whether the output qubit is 1. Since D′
0 and D′
1 are computationally indistinguishable, we have
E
x∼D0 xk+1 ⟨x≤k, 0m| (M1 −M0) |x≤k, 0m⟩−
E
x∼D1 xk+1 ⟨x≤k, 0m| (M1 −M0) |x≤k, 0m⟩
> 1
q −negl(λ).
We observe that there must exist b ∈{0, 1} such that when M = Mb, we have



E
x∼D0 xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩−
E
x∼D1 xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩



>
1
poly(λ).
Finally, by plugging in the identity (−1)b = 1 −2b for b ∈{0, 1} and appealing once again to the
indistinguishability of D′
0 and D′
1, we conclude that



E
x∼D0(−1)xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩−
E
x∼D1(−1)xk+1 ⟨x≤k, 0m| M |x≤k, 0m⟩



>
1
poly(λ).
69