{"id":"286d0e8e-b5d2-43a2-8f0d-2edac3312a77","arxiv_id":"2411.12297","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Claims a general-purpose quantum indistinguishability obfuscation (QiO) scheme based on identity-subpath insertion and Schwartz-Zippel equivalence testing, without credible security evidence.","lead":"The paper proposes a quantum indistinguishability obfuscation scheme that inserts identity subpaths into quantum circuits and tests equivalence with polynomial identity checking. It claims to achieve general-purpose obfuscation, but the construction appears to add only trivial identity gates and the security proof contains invalid steps.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's proof fails in Hybrid 1: the 'average over all unitaries' is not a valid physical operation, so Lemma 2 and the Clifford-twirl reduction do not apply.","rationale":"The reader's weakest-assumption diagnosis is on target: Hybrid 1's uniform average over all unitaries is mathematically and physically invalid, and the statement that the unitary set is closed under averages is simply false. This is load-bearing because the entire security chain (Hybrid 0 through Hybrid 4) depends on Lemma 2's bound, and no later hybrid introduces an independent argument for indistinguishability. I also agree that the construction's security would require an unproven hiding property for identity-equivalent subpaths; however, the invalid averaging is the more direct and decisive defect, so I did not need to rely on that additional concern. The experimental section only demonstrates that the path-sum equivalence checker can verify functional equivalence after identity insertions, which does not address indistinguishability. A careful reviewer should not accept the central claim on the present proof. Since the reader already recommended REJECT, my read leaves the verdict unchanged.","tokens_in":24169,"tokens_out":7623,"duration_ms":85696,"concrete_test":"Symbolically test the closure assertion on a single qubit: take C1 = I, C2 = X, and compute M = (I+X)/2 and M M†. Since M M† ≠ I, the set of unitaries is not closed under the claimed average, so the Hybrid 1 map is not a valid quantum operation. This two-line calculation settles that the proof as written has no valid Lemma 2; if the authors instead intend the Haar measure or the finite Clifford twirl, the proof must be rewritten to state that operation explicitly and re-derive Lemmas 1-4 in that setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is Theorem 3 (Section 4.2): any two quantum implementations of f under QceQiO are indistinguishable in the QROM. The first substantive step, Hybrid 1, defines |Ψ1⟩ = (1/|Ct|) Σ_{C∈C} C(|ψb⟩⊗|flag⟩) and asserts that applying the average of all possible unitary units is equivalent to applying a random unitary because the set of unitary units is closed under average operations. Both claims are false. There is no uniform probability distribution on the uncountable unitary group, and the average of two unitaries is not generally unitary (e.g., (I+X)/2 is not unitary). The only setting in which Lemma 3 (Clifford twirl) is valid is a finite average over the Clifford group, which is not what Hybrid 1 defines. Since Lemma 2 is the only bridge from the oracle game to the bound Pr[A wins in Hybrid1] ≤ 1/2^λ, the indistinguishability conclusion of Theorem 3 is unsupported. Hybrids 2 and 4 cannot repair this: Lemma 4 asserts that identity-equivalent subpaths sampled from D_ΔSP are statistically indistinguishable from the U,U† pairs they replace, yet this is precisely the indistinguishability property to be proved and is not implied by the Schwartz-Zippel test in Theorem 2. The benchmarks in Section 5 validate equivalence checking, not obfuscation security.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes QceQiO, a scheme for quantum indistinguishability obfuscation (QiO) of general quantum circuits. The construction represents quantum circuits as subpath sums, inserts identity-equivalent subpaths ('loops') into the circuit and its input state, and claims that two obfuscated implementations of the same classical function are computationally indistinguishable in the quantum random oracle model. The main theoretical result is Theorem 3, whose proof proceeds through Hybrids 0–4 using a Clifford-twirl argument, an admissible-oracle lemma, and a Schwartz–Zippel-based probability test. Section 5 reports runtime and equivalence-checking benchmarks for several quantum circuits.","tokens_in":24454,"tokens_out":5302,"duration_ms":56889,"significance":"If Theorem 3 were sound, the paper would present the first general-purpose QiO construction from no cryptographic assumptions, resolving a central open question in quantum cryptography. The paper's path-sum formalism and the benchmarked equivalence-checking tool (Section 5) are potentially useful engineering contributions. However, the central security proof is invalid: the averaging operation in Hybrid 1 is not a physical quantum operation, the Clifford-twirl lemma is applied to the wrong ensemble, and Lemma 4 assumes exactly the indistinguishability property that is to be proved. The construction itself, which adds identity-equivalent subpaths in the clear, does not hide the original circuit structure. I therefore cannot regard the main claim as supported.","major_comments":[{"comment":"The definition |Ψ1⟩ = (1/|Ct|) Σ_{C∈C} C(|ψb⟩⊗|flag⟩) is not a valid quantum operation. There is no uniform probability distribution over the uncountable set of all t-qubit unitaries for which |Ct| is finite, and the set of unitary matrices is not closed under averaging: (I+X)/2 is not unitary. The assertion that 'the set of unitary units is closed under average operations' is therefore false. Since this averaging is the first substantive step of the proof and is used to define the state seen by the adversary in Hybrid 1, Lemma 2 and hence Theorem 3 are unsupported at this point.","section":"Section 4.2, Hybrid 1"},{"comment":"Lemma 3 (Clifford twirl) is valid only for a finite average over the Clifford group C_n, but the state in Hybrid 1 is defined as an average over all unitary units, not over the Clifford group. The proof of Lemma 2 replaces the challenger's average with a Clifford-group average without justification. Moreover, the oracle operation in the proof is described as 'the reversal of the Clifford applied by the challenger', yet the quantum random oracle in Definition 9 selects a Haar-random unitary U_k independently of the challenger's choice; there is no mechanism for the oracle to know and invert the specific C used by the challenger. Thus the claimed transfer from an arbitrary adversary's attack to the Clifford-twirl bound does not follow.","section":"Section 4.2, Lemmas 2 and 3"},{"comment":"Lemma 4 asserts that the distribution D_ΔSP over identity-equivalent subpaths is 'statistically indistinguishable from the identity effect of U and U† pairs' and that the statistical distance is 'at most negligible in λ'. This is precisely the indistinguishability property that Theorem 3 must prove: the obfuscator adds identity-equivalent subpaths, and the security claim is that these additions hide the underlying circuit. The proof does not derive this fact from Theorem 2, which only bounds the probability that two phase polynomials agree at a random point (Schwartz–Zippel), nor from any other stated assumption. The argument is therefore circular and does not establish that Hybrid 1 and Hybrid 2 are indistinguishable to a quantum adversary.","section":"Section 4.2, Lemma 4"},{"comment":"The construction inserts half of an identity-equivalent subpath into the input state and the other half into the circuit, yielding C' = U_{ΔSP_i/2}(C⊗I^λ) and ρ' = U_{ΔSP_i/2}(ρ⊗|flag⟩). No proof is given that the composed implementation (ρ', C') is functionally equivalent to (ρ, C); this would require U_{ΔSP_i/2} C U_{ΔSP_i/2} = C (up to global phase) for the chosen halves, which is not shown and need not hold for arbitrary identity-equivalent subpaths. Furthermore, even if functional equivalence held, the identity-equivalent subpaths are inserted as explicit, recognizable gate sequences in the description of C'. An adversary can remove these identity subpaths in polynomial time and recover the original circuit C, so the construction does not hide the circuit structure. The security proof never addresses the information contained in the obfuscated circuit description itself; it analyzes only oracle interactions.","section":"Section 3.3, Definition 8, Steps 2–3"},{"comment":"The benchmarks in Section 5 measure runtime and equivalence verification of circuits before and after the QceQiO transformation. They demonstrate only that the equivalence checker can determine that the transformed circuit is functionally equivalent to the original (or that a randomly modified circuit is not). They do not test indistinguishability against any adversary, nor do they measure whether the original circuit structure can be recovered from the obfuscated circuit. These experiments therefore do not provide evidence for the security claim of Theorem 3.","section":"Section 5"}],"minor_comments":[{"comment":"There are numerous typos and grammatical errors, including 'proprietary' for 'propriety' in the abstract, 'Researchs' in Table 1, and 'wel compare' in Section 5. The paper would benefit from a careful language edit.","section":"Throughout"},{"comment":"The symbol C_t is used both for the set of all t-qubit unitary operations and later for the Clifford group, which is confusing. The paper should use distinct notation, e.g., U(2^t) for the unitary group and C_t for the Clifford group.","section":"Section 4.2"},{"comment":"The Schwartz–Zippel lemma is applied to polynomials over C with a finite subset R⊂C, but the phase polynomials ϕ∈DM[x,y] are not explicitly defined over a field where the bound d/|R| holds with a finite |R|; the relationship between the complex field and the chosen finite set should be clarified.","section":"Section 3.4, Theorem 2"},{"comment":"The statement 'the statistical distance between these probabilities is governed by the distance between D_ΔSP and the identity path distribution I(U_rand)' is vague: I(U_rand) is not defined, and no distance measure is specified.","section":"Section 4.2, Lemma 4"},{"comment":"Table 1 lists 'Our Work' as having 'Polynomial' security loss, but no formal definition of security loss is given, and the comparison with exponential security loss in prior work is not quantified.","section":"Section 1, Table 1"}],"recommendation":"reject","confidential_remarks":"The paper's central result, if true, would be a landmark. However, the proof of Theorem 3 breaks at the first hybrid: the average over all unitaries is not a valid operation, and the Clifford-twirl lemma is inapplicable. The construction's reliance on inserting identity subpaths in the clear also appears fundamentally unable to provide indistinguishability for general circuits. The benchmarking section is technically useful but does not address security. In my view the errors are load-bearing and cannot be fixed within the scope of this manuscript, so rejection is appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Plainly: the central claim is unsupported, and the first hybrid of the security proof is not a valid quantum operation. But the paper ships real code and benchmarks for path-sum equivalence checking, and those results stand on their own.\n\nWhat's actually new: the definition of delta-subpath equivalence and the QceQiO construction, which obfuscates by inserting identity-equivalent subpaths and checking functional equivalence via Schwartz-Zippel on phase polynomials. That's a reasonable way to do equivalence checking, and the experiments show it scales: the HWB8 benchmark with 26k gates checks in a few hours, and the negative tests correctly detect altered circuits. If the paper were framed as an equivalence-checking tool, it would be a modest but solid systems contribution.\n\nThe soft spots are load-bearing. The proof of Theorem 3 starts by defining |Ψ1⟩ = (1/|Ct|) Σ_C C|Ψin⟩ and claiming this is 'applying a random unitary' because the set of unitaries is closed under averaging. That is false in two ways: there is no uniform distribution on the unitary group, and the average of two unitaries is not generally unitary. The Clifford twirl in Lemma 3 only works for finite averages over the Clifford group, so Lemma 2's bound does not follow. Lemma 4 then asserts that identity-equivalent subpaths sampled from D_ΔSP are statistically indistinguishable from U-U† pairs — that is exactly the indistinguishability property to be proven, and it is not implied by the Schwartz-Zippel test. The construction itself inserts identity gates; an adversary can just strip them or read the circuit structure. The Schwartz-Zippel probability test applies to polynomial phase functions, which the paper acknowledges does not cover arbitrary circuits. So the abstract's claim of general-purpose QiO from no cryptographic assumptions is not supported by the proof.\n\nThis is a case of a real engineering contribution in a wrapper of an unsupported crypto claim. The right move is to reject the current paper but encourage a rewrite that sells the equivalence checker as a tool, and drops or clearly separates the obfuscation claims.\n\nFor peer review: send it out. A serious referee will quickly identify the broken hybrid, but the benchmarks and the path-sum formalism deserve scrutiny. It's not desk-reject material because the systems part is real. Just don't expect the crypto claim to survive.\n\nI'd bring the benchmarks to a reading group, but not the proof.","headline":"The obfuscation proof collapses at the first hybrid, but the path-sum equivalence checker behind it is real and worth a look.","tokens_in":24944,"tokens_out":2455,"would_cite":false,"duration_ms":26540,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P68","94A60","81P94"],"pacs":["03.67.Lx","03.67.Dd"],"model":"deepseek-v4-flash","headline":"The paper claims that quantum indistinguishability obfuscation for general circuits can be built from quantum circuit equivalence, subpath-sum transformations, and a polynomial probability test.","keywords":["quantum indistinguishability obfuscation","quantum circuit equivalence","subpath sum","polynomial identity testing","delegated quantum computing","Clifford twirl","quantum copy protection"],"falsifier":"For any two distinct unitary matrices U1 and U2, compute (U1+U2)/2 and test unitarity; the result will generally fail, falsifying the 'closed under average operations' claim used in Hybrid 1 of the proof. A second check: obfuscate the same circuit twice with different identity-loop insertions and run a distinguisher to see whether the insertion pattern leaks; if it does, the obfuscation fails to hide circuit structure.","tokens_in":23944,"feed_emoji":"🌀","tokens_out":8236,"duration_ms":75007,"temperature":0.7,"pith_summary":"QceQiO, a new scheme, aims to obfuscate any quantum implementation of a classical function by rewriting it as a subpath sum and then inserting identity-equivalent subpath loops that preserve function while altering circuit structure. The paper claims this yields quantum indistinguishability obfuscation (QiO) for general circuits, breaking past restrictions to limited gate sets or trivial functions and avoiding the exponential security loss of exhaustive equivalence checking. Equivalence of the original and obfuscated circuits is verified probabilistically through a Schwartz-Zippel-based polynomial identity test on phase polynomials, which also bounds the distinguisher. Security is argued in the quantum random oracle model via Clifford twirl and an admissible oracle lemma, though the proof rests on an averaging step over unitaries that is not a valid physical operation.","feed_headline":"Quantum obfuscation for all circuits claimed feasible","feed_subtitle":"Scheme hides circuits with identity loops and cuts exponential verification cost, pending proof of the averaging step.","key_machinery":"The central object is the subpath sum SP of a quantum circuit: a compact path-integral-style description listing input variables, phase polynomials, and output basis vectors, along with the unitary operator it induces. Two circuits are delta-subpath-equivalent when they agree everywhere except a small replaced region whose subpath-sum operators are equivalent. The obfuscator uses identity-equivalent subpath loops as incremental units, applying one half to the quantum state and inserting the other half as gates into the circuit, so each step preserves functionality while changing the representation. The proof's load-bearing tools are the Clifford twirl (averaging over the Clifford group to depolarize the adversary's deviation) and the admissible oracle lemma (lifting security from one oracle query to many), plus the Schwartz-Zippel lemma, which turns functional-equivalence checking into a polynomial identity test and bounds the probability of false equivalence.","core_discovery":"The central claim, stated as Theorem 3, is that the two quantum implementations of a classical function f, after obfuscation by QceQiO, are computationally indistinguishable in the quantum random oracle model. The construction defines an obfuscator that maps a quantum implementation to a new pair by repeatedly applying halves of identity-subpath loops: half to the state, half to the circuit. Two circuits are said to be delta-subpath-equivalent if they share identical subpath sums outside a polynomial-size region and have equivalent subpath-sum operators inside it. By chaining a polynomial number of such incremental transformations, any two equivalent implementations are shown to converge to indistinguishable obfuscations. The paper further claims this is the first general-purpose QiO construction, meaning it works for universal quantum circuits rather than restricted classes.","pith_inferences":["Even if the averaging step is repaired, the construction's security would still need a proof that identity-subpath insertions hide the circuit's structure; inserting loops at arbitrary points might leave detectable traces.","A natural test is to run QceQiO on two circuits that differ only by a known loop and check whether any polynomial-time adversary can recover which loop was inserted.","If the equivalence result holds, the same subpath-sum identity test could be reused as a standalone tool for quantum circuit equivalence checking in optimization and verification pipelines.","The paper's security model (quantum random oracle) is strong; transferring the result to the plain model would require removing the Haar-random oracle dependence."],"forward_implications":["If QceQiO is sound, general-purpose quantum indistinguishability obfuscation exists in the quantum random oracle model without additional cryptographic assumptions.","Obfuscated quantum circuits would become usable in delegated computing while protecting the logical structure of proprietary algorithms.","The polynomial identity test replaces exhaustive input enumeration, turning exponential security loss into a polynomial failure probability.","The subpath-sum representation also gives a memory-efficient way to store and verify circuits, with complexity O(n+h) rather than O(2^n).","The scheme could serve as a building block for quantum functional encryption and quantum copy protection."],"supporting_citations":[{"why":"Supplies the definition of quantum implementation of a classical function and the best-possible copy protection baseline that QceQiO builds on.","marker":"[18]"},{"why":"Introduces equivalence-proof-based iO and names the exponential security loss this scheme aims to avoid.","marker":"[21]"},{"why":"Provides the Feynman path-sum framework used to define subpath sums and circuit equivalence checking.","marker":"[22]"},{"why":"Extends polynomial identity testing to quantum semantics optimization, grounding the probability test on phase polynomials.","marker":"[24]"},{"why":"Provides the Schwartz-Zippel lemma that bounds the probability of false equivalence in the probability test.","marker":"[25]"},{"why":"Supplies the Clifford twirl lemma used to depolarize the adversary's operation in the security proof.","marker":"[26]"},{"why":"Provides the admissible oracle lemma that lifts single-query security to many-query security.","marker":"[27]"}],"fun_headline_variants":["General quantum obfuscation claimed via subpath equivalence","Universal quantum obfuscation via circuit equivalence","Quantum obfuscation for any circuit—averaging proof pending","Subpath equivalence yields general-purpose quantum obfuscation","Quantum obfuscation goes general with equivalence"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The security proof assumes that the average of all possible unitary operators is itself a legitimate unitary operation, so the challenger can 'apply the average of all possible unitary units' to the state; since the average of distinct unitaries is generally not unitary, and averaging over an uncountable set is not a physical quantum channel, this step is not valid.","fun_headline_variants_meta":{"raw":{"variants":["General quantum obfuscation claimed via subpath equivalence","Universal quantum obfuscation via circuit equivalence","Quantum obfuscation for any circuit—averaging proof pending","Subpath equivalence yields general-purpose quantum obfuscation","Quantum obfuscation goes general with equivalence"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001132,"raw_usage":{"total_tokens":4672,"prompt_tokens":885,"completion_tokens":3787,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":501,"completion_tokens_details":{"reasoning_tokens":3708}},"tokens_in":501,"tokens_out":3787,"duration_ms":28373,"temperature":1.0,"reasoning_tokens":3708,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T17:41:31.085836+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For any two distinct unitary matrices U1 and U2, compute (U1+U2)/2 and test unitarity; the result will generally fail, falsifying the 'closed under average operations' claim used in Hybrid 1 of the proof. A second check: obfuscate the same circuit twice with different identity-loop insertions and run a distinguisher to see whether the insertion pattern leaks; if it does, the obfuscation fails to hide circuit structure.","supporting_citations":[{"cited_title":"How to use quantum indistinguishability obfusca- tion","cited_arxiv_id":null,"evidence_quote":"Supplies the definition of quantum implementation of a classical function and the best-possible copy protection baseline that QceQiO builds on."},{"cited_title":"Association for Computing Machinery","cited_arxiv_id":null,"evidence_quote":"Introduces equivalence-proof-based iO and names the exponential security loss this scheme aims to avoid."},{"cited_title":"Indis- tinguishability obfuscation via mathematical proofs of equivalence","cited_arxiv_id":null,"evidence_quote":"Provides the Feynman path-sum framework used to define subpath sums and circuit equivalence checking."},{"cited_title":"Quantum circuits and low-degree polynomials over F2","cited_arxiv_id":null,"evidence_quote":"Extends polynomial identity testing to quantum semantics optimization, grounding the probability test on phase polynomials."},{"cited_title":"Synthesizing quantum-circuit optimizers","cited_arxiv_id":null,"evidence_quote":"Provides the Schwartz-Zippel lemma that bounds the probability of false equivalence in the probability test."},{"cited_title":"Randomized algorithms","cited_arxiv_id":null,"evidence_quote":"Supplies the Clifford twirl lemma used to depolarize the adversary's operation in the security proof."}],"review_version":1}