{"id":"1515aede-7d83-4701-8bd3-4164eb53fa9c","arxiv_id":"1908.05584","paper_version":6,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Checked quantum preprocessing generates one-time tables and gives asymptotically secure two-party computation, including interactive quantum homomorphic encryption, without a trusted initializer.","lead":"This paper proposes quantum protocols that let two parties generate cryptographic one-time tables without a trusted third party, using random checks and aborts to enforce security. If correct, the method offers information-theoretically secure two-party computation, including interactive quantum homomorphic encryption, under assumptions weaker than fully honest parties.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Security of Protocols 3-6 rests on an unproved multi-copy tradeoff: the extension of Eq. (5) to correlated cheating is asserted, not derived, and the checked-instance sampling argument does not directly bound leakage on the unchecked tables actually used.","rationale":"The reader's verdict is CONDITIONAL, and my stress-test agrees with that verdict: the protocol stack is coherent, the single-copy numerical evidence is real, and the main constructions are valuable. The reader identified the conservative-party and weakly-cooperating assumptions as the weakest assumption; I agree those are genuine limitations, but they are explicitly stated and are part of the claimed model, so they are not by themselves an internal inconsistency. The more technically load-bearing weakness is the unproved extension of the security argument to correlated, multi-instance cheating in Theorem 1. The paper's own text uses the language of 'should hold' and 'the one-copy tradeoff curve still holds' at exactly the point where the asymptotic security claim becomes quantitative. That is a proof sketch, not a proof. This does not invalidate the contribution; it means the central claim is currently conditional on a nontrivial entropic inequality. The concrete numerical/analytic check proposed above would either close the gap or demonstrate that the correlated-attack regime needs a separate argument. Since the reader already marked the verdict CONDITIONAL and my concern reinforces that status rather than overturning it, the appropriate verdict remains UNCHANGED.","tokens_in":28374,"tokens_out":9625,"duration_ms":104505,"concrete_test":"Compute the m-copy analogue of Eq. (B3) for m = 2 and m = 3: parametrize Alice's joint initial state across m instances (with a 4m-dimensional purification ancilla, as in Appendix B), and numerically maximize chi_y^{(m)} + max(chi_r^{(m)}, chi_{y⊕r}^{(m)}) subject to max(chi_r^{(m)}, chi_{y⊕r}^{(m)}) ≥ 1 - epsilon, for epsilon = 0.01, 0.001, 0.0001. If the supremum exceeds the single-copy bound 1 + f(epsilon) by a non-vanishing amount as epsilon → 0, Theorem 1's correlated-attack extension fails. An analytic companion test: attempt to prove the multi-copy inequality from Eq. (3) via the chain rule for conditional min-/max-entropy under a joint POVM; if the derivation cannot be completed without an additional assumption, the security proof should explicitly mark the correlated-cheating case as unproved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that Protocols 3, 4, 5, and 6 generate one-time tables with asymptotically vanishing leakage—depends on the one-copy Holevo tradeoff in Eq. (5), used in Theorem 1 to conclude that if Alice passes Bob's checks at rate 1−epsilon then her accessible information about Bob's input y is at most epsilon + f(epsilon). The proof's transition from the single-instance inequality (3) to the multi-instance, correlated-cheating case is the load-bearing step. In the paragraph beginning 'In the following we consider the general case that Alice's operations are not necessarily independent,' the paper asserts that the generalization of Eq. (6) 'should hold,' that the multi-copy analogue of Eq. (5) 'should hold approximately,' and that Alice's states in other instances merely 'serve as auxiliary systems' so the one-copy tradeoff curve 'still holds.' This is precisely what needs proof: with joint entangled initial states and joint final measurements across m instances, the marginal accessible information about y_i can in principle be larger than the single-copy Holevo bound predicts, and the subadditivity of accessible information does not follow from the classical-looking inequalities (1)-(3). The same paragraph also asserts that 'the same quantitative levels' hold near the extreme point without giving a derivation. The issue is not merely aesthetic: Protocol 3 uses Bob's random check to infer an average cheating rate from the checked subset, but the tables that are actually used are the unchecked ones, and Alice may delay her measurements until after Bob announces which positions are checked. The proof does not formalize why passing checks on a random subset bounds the Holevo information available on the complement, especially when the adversary's operations are correlated across instances. Because Protocols 5, 8, and the QHE schemes inherit this asymptotic security claim, the gap is load-bearing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes replacing a trusted initializer in two-party computation by bipartite quantum preprocessing with aborts. Protocol 1 implements a distributed AND gate with partial privacy, and Protocols 3-6 add checking and combining steps to generate one-time tables with claimed asymptotically vanishing leakage, under the assumptions that one party is \"conservative\" and the other is weakly cooperating. Applications are given to classical two-party computation, 1-out-of-2 oblivious transfer, bit commitment, interactive and constant-round quantum homomorphic encryption, and check-based implementations of no-signaling correlations. The security analysis is built on Propositions 1-2 and Theorems 1-2, with numerical support in Appendix B.","tokens_in":28641,"tokens_out":7525,"duration_ms":76643,"significance":"If the central security claims were established, the paper would be significant: it offers a concrete route to information-theoretic security in generic two-party computation without a trusted initializer, under assumptions weaker than full honesty, and it connects this primitive to quantum homomorphic encryption and no-signaling correlations. The paper is commendably explicit about its assumptions, including the conservative-party requirement, weak cooperation, and abort behavior, and it fully specifies the base protocol. The honest-but-curious analysis and the application sections are useful contributions in their own right. However, because the multi-copy tradeoff that carries the security proofs is asserted rather than proved, the significance is conditional on closing that gap.","major_comments":[{"comment":"The extension of the single-instance tradeoff Eq. (5) to correlated, jointly entangled cheating over m instances is asserted rather than proved. The text says that the generalization of Eq. (6) \"should hold\" and that other instances \"serve as auxiliary systems,\" but accessible information is not subadditive, and a joint final measurement over m systems can in principle extract more than the one-copy Holevo tradeoff curve. The one-bit communication bound in Prop. 1 is a single-round bound on classical mutual information with a fixed measurement M, so it does not control the marginal Holevo quantities under joint attacks. The same gap appears in the corresponding step of Theorem 2. Since Protocols 3-6 and all applications inherit this step, the central claim of asymptotically vanishing leakage is not established.","section":"Sec. III, Theorem 1 proof, paragraph after Eq. (6)"},{"comment":"The quantitative form of the tradeoff is not established analytically. Appendix B reports only that the Holevo sum is at most a constant c \"somewhat larger than 1.388\" that is \"yet to be precisely determined,\" and gives numerical values f(0.1)≈0.3, f(0.01)≈0.06. Uniform continuity from the extreme point max=1 ⇒ χy=0 yields only existence of some f(ε) with f(0)=0; it does not yield the specific bound χy≤ε+f(ε) used in the proof. Moreover, the argument for the implication (6) invokes Prop. 1, but Prop. 1 bounds single-measurement mutual informations rather than Holevo quantities, so the step \"the latter implies χy=0\" requires a separate proof. Without Eq. (5), the claimed leakage rate is unsupported.","section":"Appendix B, Eq. (B3), and Eq. (5) in Theorem 1"},{"comment":"The random-check sampling argument does not by itself bound leakage on the m−K unchecked tables that are actually used. From K checked instances Bob estimates an average cheating rate ε, and the proof transfers the bound ε+f(ε) to all remaining instances. This transfer presupposes a well-defined per-instance cheating rate and either independence or the unproved multi-copy tradeoff of the first major comment. A cheating Alice can keep checked instances statistically clean while placing information about y in unchecked instances, and the text explicitly acknowledges that Alice can choose different measurements on the remaining instances. The statement that the expected information about y in the remaining instances is arbitrarily small therefore requires a proof; the per-instance checking statistics alone do not imply it.","section":"Protocol 3, Steps 2-4, and Theorem 1"}],"minor_comments":[{"comment":"Bob's output bit is introduced as h = h1⊕h2, but the protocol specification and all later text use r; please use a single symbol throughout.","section":"Protocol 1, Step 3"},{"comment":"The sentence \"The Protocol 2 is quite resistent to such attack\" contains a typo: \"resistent\" should be \"resistant\".","section":"Appendix A, last paragraph"},{"comment":"The claim that it \"suffices to assume either one of the parties is conservative\" is argued informally; since applications depend on this assumption, a formal statement of which party must be conservative in each protocol and application would be helpful.","section":"Sec. III, after Protocol 4"},{"comment":"Statements such as \"the allowed circuit depth is a constant\" are qualitative; please make them quantitative or asymptotic, since the noise model and the security parameter are not formally specified.","section":"Sec. VII.3"},{"comment":"The EPR-pair testing procedure is described only in prose; please specify the test and explain how its abort behavior composes with the checks used in Protocol 4.","section":"Protocol 11, Appendix A"}],"recommendation":"major_revision","confidential_remarks":"The paper is interesting conditionally, and the main reason for major revision is the unproved multi-copy tradeoff on which the security of Protocols 3-6 rests. I see no novelty or attribution problems. The authors should either prove the multi-copy bound under a formally defined adversarial model or restrict the security claims to independent instances and state the resulting limitation explicitly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read this if you care about removing trusted initializers in two-party computation. The paper's real content is a family of quantum preprocessing protocols—Protocols 3 through 6—that generate Beaver one-time tables using only two-party quantum communication with checks and aborts, then wire those tables into classical function evaluation, oblivious transfer, bit commitment, and quantum homomorphic encryption. That protocol stack, and the accompanying resource estimates, are new relative to the cited literature. The base Protocol 1 is a revised subprocedure from the author's own earlier work, but it is fully specified here, and the entanglement-based variant plus numerical checks are useful. The paper also deserves credit for being unusually explicit about its assumptions: conservative parties, weak cooperation, forced security, and the distinction between checked and unchecked tables.\n\nThe soft spot is the one the stress-test flags, and it is real. The whole security story depends on bounding the leakage of a cheating Alice on the unchecked one-time tables, given that she passes Bob's random checks at rate 1-epsilon. Propositions 1 and 2 give single-instance mutual-information tradeoffs, argued from the effective one-bit communication; those are plausible. But Theorem 1 extends Eq. (5) to correlated attacks by saying the multi-copy generalization \"should hold\" and that other instances \"serve as auxiliary systems.\" That is exactly the step that needs proof. Joint entangled initial states and joint final measurements can produce marginal accessible information that does not follow from one-copy Holevo bounds, and the random-check argument does not automatically bound information on the complement, because Alice can delay measurements until she knows which positions are checked. The numerical constant c is undetermined, and the security definitions are informal—there is no composable security model for \"conservative\" or \"weakly cooperating.\" These are not cosmetic issues; the QHE and OT applications inherit the same gap.\n\nTo be fair, the paper does not hide the gap. It labels the extension as expected behavior rather than pretending it was proved, and the arguments for Propositions 1 and 2 are real arguments even if compressed. The central idea is likely right, but at the moment the asymptotic security claim is closer to a well-supported conjecture than a theorem.\n\nWho is this for? Researchers working on quantum homomorphic encryption or on protocols that replace trusted initializers. It deserves a serious referee: send it to peer review, and make the referee's main job closing—or clearly qualifying—the correlated-cheating step. I would not cite the security claim as established until that is done.","headline":"A genuinely new protocol stack for replacing a trusted initializer with checked quantum preprocessing, but the central security claim rests on an asserted multi-copy tradeoff that needs a real proof before it is load-bearing.","tokens_in":758,"tokens_out":1340,"would_cite":true,"duration_ms":39554,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":["03.67.Dd","03.67.Lx"],"model":"deepseek-v4-flash","headline":"The paper claims that two parties can replace a trusted initializer by running abort-checked quantum preprocessing protocols, so that the generated one-time tables leak asymptotically vanishing information about private inputs when at…","keywords":["quantum preprocessing","one-time tables","two-party computation","information-theoretic security","quantum homomorphic encryption","oblivious transfer","no-signaling correlations","forced security"],"falsifier":"Search the space of Bob's received two-qubit states—modelled as pure states on four qubits via Schmidt decomposition—for a violation of the Holevo tradeoff $\\chi_y + \\max(\\chi_r, \\chi_{y\\oplus r}) \\le c$ with c near the claimed bound; any state with max near 1 while $\\chi_y$ remains bounded away from 0 falsifies Theorem 1, and an experimental implementation of Protocol 1 where Bob's checks are passed with high probability while Alice's accessible information about y exceeds the predicted $\\epsilon$-dependent bound would do the same.","tokens_in":28093,"feed_emoji":"🔐","tokens_out":8854,"duration_ms":82121,"temperature":0.7,"pith_summary":"Two-party cryptographic tasks normally need either computational assumptions or a trusted initializer who pre-distributes correlated random bits, the one-time tables. This paper argues that the two parties themselves can generate those tables by short quantum protocols that allow aborts: any detected cheating causes the batch to be rejected before it touches real data. With at least one party 'conservative'—willing to sacrifice the chance of learning the other's input by actually performing the checks—the leakage is asymptotically vanishing in the noiseless case and controllable in the noisy case. Because the security is forced by verification, the probability that some useful tables are produced can approach one even though the protocols may abort. If right, the scheme supplies nontrivial information-theoretic security for generic two-party classical and quantum computation, including interactive quantum homomorphic encryption.","feed_headline":"Quantum checks expose cheating before any useful data leaks","feed_subtitle":"Two parties can build information-theoretically secure one-time tables without a trusted third party.","key_machinery":"The load-bearing object is the one-time table produced by Protocol 1: a two-message quantum procedure that takes random bits x and y and returns (x·y)⊕r to Alice and r to Bob, with the CNOT gate's basis-switching property ensuring the distributed AND. Around it, the checking Protocols 3, 4, and 6 impose verification: Bob (or both parties) randomly select instances, demand that the revealed inputs and outputs satisfy $a_j b_j = e_j \\oplus f_j$, and abort when failures exceed a threshold. The security argument rests on information-tradeoff inequalities such as $I^M_y + I^M_r \\le 1$ and $I^M_y + I^M_{y\\oplus r} \\le 1$, together with Holevo-bound versions $\\chi_y + \\max(\\chi_r, \\chi_{y\\oplus r}) \\le 1 + f(\\epsilon)$, which say that a cheating Alice who must pass Bob's checks can learn almost nothing about y; analogous inequalities protect Alice in Protocol 4. This is 'forced security': useful tables exist only if the checks pass, so the data-independent preprocessing stage can abort safely without leaking meaningful data.","core_discovery":"The central discovery is that the ideal resource of one-time tables—random bits x and y on the two sides together with (x·y)⊕r and r—need not be assumed from a trusted party: Protocols 1 and 11 realize the underlying nonlocal AND gate with partial privacy, and Protocols 3 through 6 verify those raw instances so that a cheating party who wants the generated tables to be correct and usable must give up almost all information about the other party's input. The security statements are asymptotic: Protocol 3 makes Bob's input asymptotically secure against a cheating Alice, Protocol 4 gives both parties asymptotic security when both sides check, Protocol 5 makes Alice's leakage exponentially small by combining tables, and Protocol 6 suppresses output error while keeping security comparable to Protocol 4. In the ideal noiseless case, the abort-based checks force the cheater's average cheating rate to be arbitrarily small, so with weak cooperation and a conservative checker, useful tables are generated with probability approaching one.","pith_inferences":["If the conservative-party assumption is acceptable in client-server settings, interactive quantum homomorphic encryption could be built with information-theoretic security and polynomial resources, avoiding the computational assumptions of standard fully homomorphic encryption.","Because Protocol 5 makes one party's leakage almost noise-independent, a hybrid deployment could use Protocol 5 for high-sensitivity inputs and Protocol 6 for low-noise correctness, a trade-off the paper does not quantify.","The check-based PR-box implementation with inert communication suggests an experimental route: certify no-signaling correlations by timing and message-content checks rather than spacelike separation; one could test whether the correlation parameter E can be device-independently estimated from the check statistics.","The information-tradeoff inequalities likely generalize to qudits and multipartite tables; a concrete next step would be to derive the analogue of Eq. (5) for d-dimensional inputs and see whether the 1+f(ε) bound persists."],"forward_implications":["Generic two-party boolean circuits with private inputs can be evaluated with asymptotically vanishing leakage in the noiseless case; the main computation needs about circuit-depth rounds and only XOR/AND decompositions.","Interactive quantum homomorphic encryption becomes possible with quantum preprocessing: the number of one-time tables is O(n²+R²) for n input qubits and R T gates, giving almost-optimal information-theoretic data and circuit privacy.","A constant-round QHE scheme exists at exponential cost, and interpolating between the two schemes trades rounds against table count.","Check-based implementations of PR-box-type and more general no-signaling correlations can be built with inert classical communication, and 1-out-of-2 oblivious transfer and bit commitment follow under the conservative-party assumption.","Physical noise makes leakage in Protocols 3 and 4 linear in the noise level, while Protocol 5 keeps Alice's privacy exponentially good at polynomial overhead; Protocol 6 reduces output error to polynomially small at polynomial cost."],"supporting_citations":[{"why":"Defines the one-time table resource and the trusted-initializer model that the protocols replace.","marker":"[4]"},{"why":"Supplies the basic nonlocal-AND subprocedure and the interactive QHE scheme that become Protocol 1 and Scheme 1.","marker":"[27]"},{"why":"Gives the QHE key-update framework and definitions that the paper's polynomial-coefficient updates extend.","marker":"[10]"},{"why":"Provides the garden-hose gadget used to correct P gates in the QHE schemes.","marker":"[11]"},{"why":"Shows how to convert PR-box-type correlations into oblivious transfer, used in Protocol 9.","marker":"[32]"},{"why":"Defines the PR-box, the no-signaling correlation whose check-based implementation the paper gives.","marker":"[39]"},{"why":"Supplies the general form of two-bit no-signaling correlations that the protocol implements with an added random flip.","marker":"[40]"},{"why":"Provides the entanglement-testing method used in the entanglement-based variant Protocol 11.","marker":"[45]"}],"fun_headline_variants":["Quantum checks force cheaters to leak their secrets","No trusted party needed for secure two-party computation","Abort-based protocols generate one-time tables securely","Trustless quantum setup achieves info-theoretic security","Quantum preprocessing makes cheaters leak information"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The protocols' security collapses if no party is conservative: someone must actually run the prescribed checks and abort on failures, prizing their own privacy over the chance to learn the other's input, because the checks are what force a cheating counterpart to give up information.","fun_headline_variants_meta":{"raw":{"variants":["Quantum checks force cheaters to leak their secrets","No trusted party needed for secure two-party computation","Abort-based protocols generate one-time tables securely","Trustless quantum setup achieves info-theoretic security","Quantum preprocessing makes cheaters leak information"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000351,"raw_usage":{"total_tokens":1913,"prompt_tokens":940,"completion_tokens":973,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":556,"completion_tokens_details":{"reasoning_tokens":904}},"tokens_in":556,"tokens_out":973,"duration_ms":9309,"temperature":1.0,"reasoning_tokens":904,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:09:05.996039+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Search the space of Bob's received two-qubit states—modelled as pure states on four qubits via Schmidt decomposition—for a violation of the Holevo tradeoff $\\chi_y + \\max(\\chi_r, \\chi_{y\\oplus r}) \\le c$ with c near the claimed bound; any state with max near 1 while $\\chi_y$ remains bounded away from 0 falsifies Theorem 1, and an experimental implementation of Protocol 1 where Bob's checks are passed with high probability while Alice's accessible information about y exceeds the predicted $\\epsilon$-dependent bound would do the same.","supporting_citations":[{"cited_title":"The coefficient- update rules for the variables under the T gate can be obtained from the relations TZ = ZT, TX =e−πi/4PXZT","cited_arxiv_id":null,"evidence_quote":"Supplies the basic nonlocal-AND subprocedure and the interactive QHE scheme that become Protocol 1 and Scheme 1."},{"cited_title":"The resulting state is the final quantum output","cited_arxiv_id":null,"evidence_quote":"Shows how to convert PR-box-type correlations into oblivious transfer, used in Protocol 9."},{"cited_title":"This is inspired by the classical case in [4]","cited_arxiv_id":null,"evidence_quote":"Defines the PR-box, the no-signaling correlation whose check-based implementation the paper gives."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the general form of two-bit no-signaling correlations that the protocol implements with an added random flip."},{"cited_title":"One-time tables for two-party compu- tation","cited_arxiv_id":null,"evidence_quote":"Provides the entanglement-testing method used in the entanglement-based variant Protocol 11."}],"review_version":1}