{"id":"94d53d08-5442-4922-a187-0728b474f4f2","arxiv_id":"1909.01943","paper_version":2,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":8.0,"correctness_risk":"low","formal_verification":"none","parameter_count":1,"one_line_summary":"A general verification framework shows that pure quantum states can be certified against adversarial state preparation with at most a constant-factor overhead over nonadversarial verification.","lead":"The authors develop a mathematical framework for verifying that a quantum device produces a target pure state even when an adversary controls the device and can entangle different runs. Their main finding is that with a simple 'hedged' verification recipe, adversarial verification costs at most about three times as many tests as ordinary nonadversarial verification at high precision.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The proof hinges on secrecy of the random choice of which system is kept; under the standard timing convention it is sound, but the paper leaves that convention implicit.","rationale":"The paper's central mathematical claim is a high-precision overhead bound of at most three for hedged verification in the adversarial scenario. The detailed derivations in the appendices are substantial and, on inspection, the key inequalities in Theorem 7 and Lemma 12 are consistent: the ratio bound is monotone in nu, eps, and delta, and the worst case at nu=1, eps=delta=0.1 gives a ratio below 3. The reader's weakest-assumption analysis correctly identifies the permutation-invariance reduction as the load-bearing point. My reading agrees with that identification: the proof is sound only if the adversary cannot learn or influence which of the N+1 systems is kept. The paper states the random choice but does not formalize the timing and secrecy of that choice relative to the adversary. This is a real gap in presentation, but it is a standard assumption in adversarial quantum information, not an error in the derivation. If the assumption is made explicit, the theorem as stated holds; therefore I do not see a reason to change the ACCEPT verdict, only to require that the modeling convention be stated clearly.","tokens_in":67787,"tokens_out":20343,"duration_ms":220380,"concrete_test":"Add to Sec. IV A an explicit game ordering: (1) the adversary chooses rho on H^{otimes(N+1)}; (2) the verifier samples a uniformly random subset S of N systems, unknown to the adversary; (3) tests are performed. Then verify directly that for any fixed rho, the acceptance probability averaged over S equals p_{rho_sym} and the averaged accepted fidelity equals f_{rho_sym}/p_{rho_sym}, where rho_sym is the symmetrized state, closing the WLOG step. As a negative control, exhibit the reversed-ordering attack with rho = |Psi><Psi|^{otimes N} otimes sigma_garbage on a known system ordering, which passes with probability 1 and leaves fidelity 0; this demonstrates that the secrecy/timing assumption is exactly what the theorem needs.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central guarantee F(N,delta,Omega) in Sec. IV B is derived after the statement in Sec. IV A that 'we may assume that rho is permutation invariant without loss of generality' because the verifier randomly chooses N of the N+1 systems to test. This reduction is valid only if the adversary fixes rho before the verifier samples the random subset and does not learn which system is retained. If the order is reversed, the framework collapses: for a known kept system, the adversary can supply |Psi><Psi| on all systems that will be tested and arbitrary garbage on the kept system, so every test passes with probability 1 while the accepted state has fidelity 0. The figures of merit in Eq. (20) optimize over permutation-invariant rho, so they do not bound this attack. This is a modeling assumption about the security game rather than an internal mathematical inconsistency; under the standard convention that the verifier's private randomness is hidden and the state is fixed first, the derivations in Appendices A-H appear to support the claimed three-fold overhead. The paper would be improved by stating this timing and secrecy assumption explicitly.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper develops a general framework for verifying pure quantum states in the adversarial scenario, where an untrusted device may produce arbitrarily correlated or entangled states. The verifier receives N+1 systems, randomly chooses N of them to test, and accepts the remaining system only if all tests pass. The main figures of merit are defined in Eq. (20), and the central results are: analytical formulas for homogeneous strategies (Theorems 1-3), conditions for single-copy verification (Theorem 4), general bounds for arbitrary verification operators (Theorems 5-6), and a hedging recipe in which the trivial test is added with probability p to obtain the operator Ω_p = (1-p)Ω + p1 (Sec. IX). Theorem 7 shows that with p = ν/e, the number of tests is within a constant factor of the nonadversarial benchmark, with overhead at most three times when ε, δ ≤ 1/10. The framework is applied to bipartite pure states, GHZ states, stabilizer states, hypergraph states, weighted graph states, and Dicke states, with the results summarized in Table I. Explicit proofs of the main theorems and lemmas are provided in Appendices A-H.","tokens_in":68004,"tokens_out":12356,"duration_ms":139488,"significance":"If the central claims hold, this is a substantial advance: it reduces adversarial-scenario verification of arbitrary pure states to nonadversarial protocols, with only a constant overhead in the high-precision regime. The paper is self-contained and gives explicit, detailed derivations rather than numerical evidence alone: Theorems 1-7 are proved in the appendices, the figures of merit are computed by transparent linear-programming and geometric arguments, and the overhead bound in Theorem 7 is a concrete, falsifiable quantitative statement. The applications to hypergraph states and Dicke states are particularly valuable because previous adversarial protocols for these families were extremely resource-intensive. The main caveat is a security-model assumption about the timing and secrecy of the verifier's random choice of tested systems, which is discussed below; under the standard convention that the adversary fixes the joint state before the private random permutation is chosen, the derivations appear sound.","major_comments":[{"comment":"The reduction 'we may assume that ρ is permutation invariant without loss of generality' is valid only if the adversary fixes the joint state ρ before the verifier samples the random N-subset and if the adversary never learns which system is retained. This timing and secrecy convention is not stated explicitly. If the order is reversed, the framework collapses: for a known kept system, the adversary can prepare |Ψ⟩ on all systems that will be tested and arbitrary garbage on the kept system, so every test passes with probability 1 while the accepted state has fidelity 0. The figures of merit in Eq. (20) are therefore defined for a specific security game. I recommend adding a short paragraph in Sec. IV A that states the game explicitly: the adversary chooses ρ first; the verifier then draws a private uniformly random permutation and tests all but one system; the figures of merit are defined with respect to the induced permutation-invariant state. Under that standard convention, the subsequent derivations in Appendices A-H appear to support the claimed guarantees.","section":"Sec. IV A, Eqs. (14)-(20)"}],"minor_comments":[{"comment":"The phrase 'with significance level at least δ' is easy to misread. Since any state with p_ρ < δ already has false-acceptance probability below δ, only states with p_ρ ≥ δ need to be constrained; a one-sentence clarification after Eq. (20) would prevent confusion about the direction of the threshold.","section":"Sec. IV B, Eq. (20)"},{"comment":"In the rows for hypergraph states, weighted graph states, and Dicke states, the adversarial numbers are written with floor brackets, although the text derives upper bounds on N. Use a ceiling or an explicit '≤' notation so that the entries are not read as exact minimal values.","section":"Table I"},{"comment":"The comparison with the protocol of Ref. [42] quotes a test number 'more than (2 ln 2)n^3 ε^{-18}' in a restricted parameter range; please state the precise parameter range and check the exponent, since the typography makes it easy to misread the exponent of ε.","section":"Sec. X F"},{"comment":"The statement 'the overhead becomes negligible when ν, ε, δ approach zero' is supported by Lemma 11(4), but the displayed bound in Eq. (152) is not tight in that limit. A brief note that the threefold bound is an upper bound on a worst-case ratio, rather than an exact asymptotic constant, would improve the presentation.","section":"Sec. IX C, Eq. (152)"}],"recommendation":"minor_revision","confidential_remarks":"This is a strong and important paper. The only substantive concern is the implicit security-game timing associated with the random choice of tested systems; this is a local clarification rather than a mathematical flaw, and the central theorem appears sound under the standard convention. I would be comfortable with acceptance once that assumption is stated explicitly. The applications section leans partly on the authors' own prior verification protocols, but those applications are not needed for the main overhead theorem."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version is that this is a substantial piece of work. It gives the first general framework for adversarial pure-state verification with a constant-factor overhead over nonadversarial protocols, and the threefold bound for high precision is a real advance. The analytical formula for homogeneous strategies and the hedged verification recipe are new, and the application sections cover an impressive range of states.\n\nThe proofs are the main event. Theorems 1-7 have explicit derivations in Appendices A-H, and the arguments look self-contained. I didn't machine-check every inequality, but the structure is sound. The geometric picture of the region R_{N,Omega} is helpful, and the linear-programming characterization of the figures of merit is clean. The paper also does the right thing by comparing against the PLM benchmark and showing the overhead ratio.\n\nThe one soft spot is the permutation-invariance reduction in Sec. IV A. The statement \"we may assume that rho is permutation invariant without loss of generality\" requires that the adversary fixes the joint state before the verifier samples the random subset of N systems to test, and that the adversary never learns which system is kept. If the kept system is known in advance, an adversary could pass all tests with garbage on the kept system. This is a standard timing/secrecy assumption in security proofs, and the paper would be improved by stating it explicitly. It is not an internal contradiction; the math in the appendices is consistent with the standard convention. That said, the paper does not flag this assumption, so a careful reader should note it.\n\nThe citation pattern is fine. Section X uses several of the authors' own protocols as input examples, but those are not load-bearing for the central overhead theorem. The companion PRL is properly cited.\n\nWho is this for? Anyone working on verification of quantum states, blind MBQC, or quantum networks. The recipes are directly usable if you have a nonadversarial protocol. I'd send this to a serious referee; the framework deserves to be in the literature even if some refinements are needed on the assumption-stating front.","headline":"Strong, well-proven framework for adversarial pure-state verification; the only real weakness is an implicit secrecy assumption on the verifier's random choice.","tokens_in":68494,"tokens_out":1594,"would_cite":true,"duration_ms":17629,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P68","81P45","81P40"],"pacs":["03.67.-a"],"model":"deepseek-v4-flash","headline":"Verifying quantum states under attack costs at most 3x more","keywords":["quantum state verification","adversarial scenario","pure-state fidelity","verification operator","homogeneous strategies","hedged verification","local projective measurements","entangled states"],"falsifier":"For a homogeneous strategy with $\\lambda = 1/e$ and target precision $\\epsilon = \\delta = 0.1$, evaluate the exact number of tests from Theorem 2 and compare it with the nonadversarial benchmark $\\lceil \\ln \\delta / \\ln(1-\\epsilon)\\rceil$. The paper predicts the ratio is below $3$ and tends to $e$ as $\\epsilon$ and $\\delta$ go to zero; a ratio at or above $3$ at this point would refute the threefold-overhead theorem.","tokens_in":67595,"feed_emoji":"⚛️","tokens_out":8675,"duration_ms":85581,"temperature":0.7,"pith_summary":"The paper establishes that verifying a pure quantum state against an adversary—one who may prepare arbitrarily correlated or entangled states—costs at most three times as many tests as verifying the same state when the preparer is honest, provided the precision is high ($\\epsilon,\\delta \\le 1/10$). It supplies a general method for computing the exact minimal number of tests for a given strategy, analytical formulas for homogeneous strategies, and a universal recipe: take any nonadversarial verification strategy and perform a trivial always-pass test with probability $p = \\nu/e$, where $\\nu$ is the spectral gap of the strategy. This hedged strategy matches the nonadversarial scaling in $\\epsilon$ and $\\delta$, with the overhead shrinking to $1$ in the high-precision limit. The recipe immediately gives efficient adversarial verifiers for bipartite entangled states, GHZ states, stabilizer states, hypergraph states, weighted graph states, and Dicke states using only local projective measurements.","feed_headline":"Verifying quantum states under attack costs at most 3x more","feed_subtitle":"Adding a trivial always-pass test at the right rate lets honest-device protocols withstand a malicious preparer.","key_machinery":"The load-bearing object is the hedged verification operator $\\Omega_p = (1-p)\\Omega + p\\mathbb{1}$, formed by performing the original tests with probability $1-p$ and a trivial always-pass test with probability $p$. Hedging lifts the smallest eigenvalue from $\\tau$ to $\\tau_p = (1-p)\\tau + p$, removing the singular small-eigenvalue behavior that would otherwise make the required number of tests scale poorly with $1/\\delta$. Efficiency is controlled by the function $h(p,\\nu,\\tau) = [\\min\\{\\beta_p \\ln \\beta_p^{-1},\\ \\tau_p \\ln \\tau_p^{-1}\\}]^{-1}$ with $\\beta_p = 1 - \\nu + p\\nu$; the optimum is nearly achieved at $p = \\nu/e$. The other main tool is the convex-polygon region $R_{N,\\Omega}$ of pairs (passing probability, fidelity contribution) over permutation-invariant states, which reduces the figures of merit to linear programs and yields closed forms for homogeneous strategies.","core_discovery":"The central claim is that every pure state can be verified in the adversarial scenario at essentially the same resource cost as in the nonadversarial scenario. For a verification operator $\\Omega$ with spectral gap $\\nu$, the paper constructs the hedged operator $\\Omega_p = (1-p)\\Omega + p\\mathbb{1}$ (the original test with probability $1-p$ and a trivial always-pass test with probability $p$). Theorem 7 proves that for $p = \\nu/e$ the number of tests obeys $N(\\epsilon,\\delta,\\Omega_p) < h(e^{-1}\\nu,\\nu,\\tau)\\ \\ln[(F\\delta)^{-1}]/\\epsilon$, and comparing with the nonadversarial benchmark $N_{\\mathrm{NA}}(\\epsilon,\\delta,\\Omega)$ yields an overhead ratio bounded by a constant; in particular the ratio is below three whenever $\\epsilon,\\delta \\le 1/10$ and approaches $1$ as $\\nu$, $\\epsilon$, and $\\delta$ tend to zero. The paper also derives exact expressions for homogeneous strategies, clarifies when a single test suffices, and shows that entangling measurements are often unnecessary for optimal adversarial verification.","pith_inferences":["If the secrecy of the random selection of tested systems is ever compromised, the central bound collapses: hedging does not help because the adversary can place the target state on the tested systems and garbage on the kept one. Securing that random choice is a natural practical prerequisite that the paper leaves implicit.","Because the overhead depends only on the spectral gap and the smallest eigenvalue, protocol designers may safely optimize the spectral gap alone and ignore the rest of the eigenvalue spectrum; this makes the recipe a plug-in for future nonadversarial protocols.","A testable extension would allow $p$ to adapt as data accumulate; the fixed choice $p = \\nu/e$ is proven near-optimal, but adaptive policies might reduce the constant at moderate precision, which this paper does not analyze.","The same hedged construction may transfer to device-independent or semi-device-independent settings if a spectral gap can be certified without trusting the measurement devices; that is an extrapolation beyond the paper's trusted-measurement assumption."],"forward_implications":["Any pure state with an efficient nonadversarial verification protocol automatically gets an efficient adversarial protocol by mixing in the trivial test with probability $p = \\nu/e$; no entangling measurements are required beyond the original protocol.","For high-precision verification, the overhead ratio is bounded by a constant that approaches $1$ as $\\nu$, $\\epsilon$, and $\\delta$ tend to zero, so adversarial verification becomes essentially as cheap as honest verification.","Bipartite pure states, GHZ states, qubit and qudit stabilizer states, hypergraph states, weighted graph states, and Dicke states can all be verified in the adversarial scenario with $O(\\epsilon^{-1}\\ln \\delta^{-1})$ tests using local projective measurements.","The optimal homogeneous strategy in the high-precision adversarial limit has $\\beta = 1/e$, giving an overhead of $e$ over the ideal nonadversarial strategy; singular strategies with $\\beta = 0$ are inefficient in the adversarial scenario.","A single test can verify a pure state within infidelity $\\epsilon$ and significance level $\\delta$ exactly when $\\delta$ satisfies a simple closed-form condition, which is relevant to single-copy entanglement detection."],"supporting_citations":[{"why":"Supplies the nonadversarial verification framework and the benchmark formula $N_{\\mathrm{NA}}(\\epsilon,\\delta,\\Omega)$ that the adversarial overhead is measured against.","marker":"[43]"},{"why":"Companion letter announcing efficient adversarial verification, of which this paper is the extended systematic version.","marker":"[54]"},{"why":"Constructs optimal verification and fidelity estimation of maximally entangled states, used as the nonadversarial strategy adapted by the recipe.","marker":"[44]"},{"why":"Provides efficient homogeneous-verification strategies for general bipartite pure states, which the recipe converts into adversarial protocols.","marker":"[45]"},{"why":"Supplies optimal GHZ-state verification strategies used in the adversarial applications.","marker":"[48]"},{"why":"Introduces the cover/colouring protocol for hypergraph states whose spectral gap $\\nu = \\chi(G)^{-1}$ feeds the hedged colouring protocol.","marker":"[49]"},{"why":"Gives the efficient Dicke-state verification protocol whose spectral gap is used in the adversarial Dicke-state bounds.","marker":"[51]"}],"fun_headline_variants":["Quantum state verification resists attackers with ≤3x overhead","Adversarial proof: pure states verified with triple cost at worst","Triple-test recipe defeats quantum state spoofers","Hedged verification: secure pure states with just 3x more tests","Verifying pure states under attack: ≤3x overhead"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee assumes the verifier's random choice of which $N$ of the $N+1$ systems to test is made after the adversary fixes the joint state and is not known to the adversary, so the effective state may be taken permutation-invariant; if the adversary can anticipate or influence which system will be kept, it can pass all tests while leaving that system garbage.","fun_headline_variants_meta":{"raw":{"variants":["Quantum state verification resists attackers with ≤3x overhead","Adversarial proof: pure states verified with triple cost at worst","Triple-test recipe defeats quantum state spoofers","Hedged verification: secure pure states with just 3x more tests","Verifying pure states under attack: ≤3x overhead"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001469,"raw_usage":{"total_tokens":5944,"prompt_tokens":1018,"completion_tokens":4926,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":634,"completion_tokens_details":{"reasoning_tokens":4840}},"tokens_in":634,"tokens_out":4926,"duration_ms":34129,"temperature":1.0,"reasoning_tokens":4840,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T05:04:13.814439+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a homogeneous strategy with $\\lambda = 1/e$ and target precision $\\epsilon = \\delta = 0.1$, evaluate the exact number of tests from Theorem 2 and compare it with the nonadversarial benchmark $\\lceil \\ln \\delta / \\ln(1-\\epsilon)\\rceil$. The paper predicts the ratio is below $3$ and tends to $e$ as $\\epsilon$ and $\\delta$ go to zero; a ratio at or above $3$ at this point would refute the threefold-overhead theorem.","supporting_citations":[{"cited_title":"Quantum metrol- ogy with nonclassical states of atomic ensembles,","cited_arxiv_id":null,"evidence_quote":"Supplies the nonadversarial verification framework and the benchmark formula $N_{\\mathrm{NA}}(\\epsilon,\\delta,\\Omega)$ that the adversarial overhead is measured against."},{"cited_title":"Matrix product states, projected entangled pair states, and variational renormalization group methods for quantum spin sys- tems,","cited_arxiv_id":null,"evidence_quote":"Constructs optimal verification and fidelity estimation of maximally entangled states, used as the nonadversarial strategy adapted by the recipe."},{"cited_title":"A practical introduction to tensor networks: Matrix product states and projected entangled pair states,","cited_arxiv_id":null,"evidence_quote":"Provides efficient homogeneous-verification strategies for general bipartite pure states, which the recipe converts into adversarial protocols."},{"cited_title":"Self testing quantum apparatus,","cited_arxiv_id":null,"evidence_quote":"Introduces the cover/colouring protocol for hypergraph states whose spectral gap $\\nu = \\chi(G)^{-1}$ feeds the hedged colouring protocol."}],"review_version":1}