{"id":"f5880c25-60df-4c74-85d6-16bf1d9ac871","arxiv_id":"2504.17612","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper defines Selectively Blind Quantum Computing (SBQC), which hides one of a set of known computations from a quantum server while reducing qubit communication, and argues that server-side state expansion cannot lower the cost of full blindness.","lead":"Quantum clients can hide a computation from a server, but full blindness normally costs one quantum message per gate. This paper introduces a protocol that hides only which computation from a known pair is being run, potentially sending far fewer quantum qubits, and also claims impossibility results for cheaper full blindness.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's condition (3) demands zero leakage from the RSE output, whereas UBQC blindness only requires the full transcript to hide the computation; Proposition 1 is therefore unproven.","rationale":"The reader's weakest assumption aligns with the central gap. In UBQC, θ is a one-time pad key; the server may have partial information about it from the received |+θ> state, and blindness holds because the pair (δ,b) is distributed independently of φ. Condition (3) is therefore a sufficient but not necessary condition for a useful RSE; a server-side expander could in principle output states with correlated parameters, and whether it breaks blindness must be decided by the full transcript distribution, not by the output state alone. Lemma 4's differential-attack claim is not a proof: correlated one-time-pad keys can sometimes be secure if the correlation is already known and the message space is structured; the paper does not exhibit a distinguisher or quantify the leakage. Lemma 3 additionally mishandles the fact that θ1 and θ2 are not independent degrees of freedom in a single map. Because Proposition 1 is the paper's main impossibility and motivates the claimed trade-off, the reader's REJECT verdict remains appropriate; the SBQC construction may be salvageable, but as written the central claim is not established. The 'communication-optimal' label is also unsupported by any matching lower bound, a secondary issue that would need to be addressed in revision.","tokens_in":31268,"tokens_out":20023,"duration_ms":199015,"concrete_test":"Re-derive Proposition 1 under UBQC's actual blindness condition (transcript independence) rather than condition (3). As a witness, instantiate the local map D(|+θ>) = CNOT(|+θ>|0>) = (|00> + e^{iθ}|11>)/√2 as a two-node resource with client angles δ_i = φ_i + θ + r_iπ for i = 1,2, and compute the server's transcript distribution for two computations, e.g. (φ_1,φ_2) = (0,π/4) and (π/4,0). If the two transcript distributions are equal, Proposition 1 is false; if they differ, exhibit the distinguishing event (e.g. δ_1 − δ_2 mod π) and identify which completeness or blindness condition fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing weakness is the gap between Theorem 1's condition (3) and the blindness notion actually used by UBQC. Condition (3) of Eq. (8) requires that, for unknown θ, no information about θ1 and θ2 is accessible from the output ρA,B. But UBQC (Protocol 1, Section 2.3) does not require the transmitted |+θ> states to hide θ; the paper itself notes that a measurement of |+θ> leaks partial information about θ and compensates by one-time-padding the outcome with rπ. Blindness is the statement that the server's full transcript—including the received states, the classical angles δ_i = φ_i + θ_i + r_iπ, and the returned outcomes b_i = s_i ⊕ r_i—is independent of the computation {φ_i}. That joint distribution can be independent of φ_i even when the individual resource states leak θ_i. Hence an RSE whose output leaks θ1,θ2 or correlates them is not ruled out by Theorem 1. Lemma 4 tries to close this gap but only asserts a differential attack; it never constructs a distinguisher and ignores that the fresh bits r_i are independent of the θ_i. Lemma 3's entropy argument further assumes θ1 and θ2 vary independently, whereas in a single map D they are both determined by the single input θ; S(ρA) = S(ρB) need not force a constant. Proposition 1 therefore does not follow from the stated theorems.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies the communication complexity of blind quantum computing. In the first part, the authors propose an impossibility result (Theorem 1, Proposition 1) claiming that no server-side local quantum operation can map a single |+θ> resource state into two or more states usable as independent UBQC resource states, and therefore that such 'remote state expanders' cannot reduce the quantum communication of UBQC. The argument proceeds through a series of lemmas covering isometries, channels, and entangled outputs, plus a lemma on differential attacks against correlated parameters and a counting lower bound. In the second part, the authors introduce Selectively Blind Quantum Computing (SBQC), a functionality that hides which of a set of known computations is performed, and give protocols (Protocols 4 and 5) that mask angle differences, graph differences, and g-flow differences, with a claimed perfect construction of a 1-of-2 Delegated Quantum Computation resource in the Abstract Cryptography framework (Theorem 2).","tokens_in":31513,"tokens_out":12303,"duration_ms":108226,"significance":"The SBQC framework is a genuinely useful way to think about partial blindness, and the masking techniques (future cones, bridge/break operations, merger graphs) are creative and potentially applicable beyond this paper. The abstract-cryptography security proof, while sketched, is an appropriate goal for composable security. However, the impossibility result, which is one of the two headline contributions, is not established: Theorem 1's condition (3) does not match the blindness notion of UBQC, and the supporting lemmas contain invalid steps. If the no-go were correct, it would be a significant conceptual result; as it stands, the first half of the paper does not meet the standards needed to support Proposition 1. The 'communication-optimal' claim for SBQC also lacks a formal lower-bound statement.","major_comments":[{"comment":"Condition (3) of Theorem 1 requires that, when θ is unknown, no information about θ1 and θ2 is accessible from the output state ρA,B. This is substantially stronger than the blindness guarantee of UBQC. In Protocol 1 (Sec. 2.3), the resource states |+θ> are sent to the server, and the server may measure them and learn partial information about θ; blindness holds because the full transcript—states, angles δ = φ' + θ + rπ, and outcomes—is independent of the computation φ. The paper itself notes this leakage and compensates with the random bit r. Consequently, a resource state that leaks or correlates θ1 and θ2 is not automatically ruled out by the requirements of a secure UBQC protocol. Proposition 1, which is the central impossibility claim, is derived from Theorem 1 and therefore does not follow. This is the main gap in the paper's first contribution.","section":"Sec. 3, Eq. (8)"},{"comment":"The entropy argument in Lemma 3 is invalid. The proof invokes the Schmidt decomposition S(ρA)=S(ρB) and then claims that, because the left side depends only on θ1 and the right side only on θ2, both must equal a constant s independent of θ1 and θ2. But in the map D, θ1 and θ2 are not independent variables; they are both functions of the single input θ. The equality S(ρA(θ1(θ)))=S(ρB(θ2(θ))) is perfectly consistent with both sides varying with θ (e.g., θ1=θ2=θ). The conclusion that ρA and ρB are constant with respect to their parameters is not justified. Since Lemma 3 is the step that extends the no-go to entangled outputs, Theorem 1 is not proven.","section":"Sec. 3, Lemma 3"},{"comment":"Lemma 4 asserts that a known functional dependency θj = f(θi) enables a differential attack on the one-time-padded angles δi and δj, but it does not construct a distinguisher or quantify the advantage. The claim must account for the fact that ri and rj are fresh, independent, uniform bits unknown to the server; a concrete analysis of the joint distribution of (δi,δj) under the two candidate computations is needed. For some dependencies (e.g., f(θ)=θ and φ differences that are multiples of π), the attack may work, but for others it may not; as written, the lemma is an assertion, not a proof. This matters because the lemma is used to argue that the assumptions of Theorem 1 are minimal for UBQC, i.e., that relaxing condition (3) inevitably breaks blindness.","section":"Sec. 3, Lemma 4"},{"comment":"The proof of Lemma 2 reduces the channel case to Lemma 1 via Stinespring dilation, claiming that the existence of Λ implies an isometry G with G|+θ> = |ψθ1>⊗|ψθ2> where the marginals are ρ(θ1) and ρ(θ2). However, Lemma 1 only rules out isometries with pure product outputs of the specific form |+θ1>⊗|+θ2>. A general purification of two mixed states need not be of this form, so the contradiction is not established. This is a further gap in the proof chain of Theorem 1.","section":"Sec. 3, Lemma 2"},{"comment":"The abstract and introduction state that the SBQC protocol is 'communication-optimal,' but no theorem or lower bound supporting this optimality is provided. Section 4 gives an explicit construction and analyzes its cost, but there is no matching lower bound showing that any protocol with the same selective-blindness guarantees must send at least as many qubits. The optimality claim should either be proven or removed.","section":"Abstract and Sec. 4"}],"minor_comments":[{"comment":"The matrix representation of the isometry D2 uses coefficients cosδ and sinδ for the state |+δ>, which is inconsistent with the definition |+θ> = (|0>+e^{iθ}|1>)/√2 given in Sec. 2.1; the correct coefficients are (1+e^{iδ})/2 and (1-e^{iδ})/2. The conclusion of the lemma is unaffected, but the calculation should be corrected.","section":"Eq. (15)-(16)"},{"comment":"The name 'Stinespring' is misspelled as 'Steinspring' in two places; please correct.","section":"Sec. 3, Lemma 2 and before Lemma 3"},{"comment":"The sentence beginning 'In lemma 1 We also show...' appears to be a formatting or editing artifact; the reference to Lemma 1 is out of place and should be rephrased.","section":"Sec. 1.2"},{"comment":"The proof of Theorem 2 is presented as a sequence of reductions and a simulator description rather than a formal AC proof; in particular, the indistinguishability claims in Reduction 1 rely on the no-communication theorem but do not spell out the distinguisher's interface and the simulator's full transcript. The authors should expand this to a complete proof or clearly mark it as a proof sketch.","section":"Sec. 4.4.2, Theorem 2 proof"},{"comment":"The generalization of the counting argument to continuous parameter sets is described as 'approximately' valid but not formalized; the discretization argument should be made precise or removed.","section":"Sec. 3.1, Lemma 5"}],"recommendation":"reject","confidential_remarks":"The paper contains a potentially interesting SBQC protocol, but the impossibility section is not sound. If the authors were to split the paper, the SBQC part could be considered separately after a rigorous AC proof and with the 'communication-optimal' claim removed or replaced by a proven statement. However, as submitted, the central claim of the paper is not established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The two halves of this paper are not of equal quality. The SBQC construction in Sections 4–5 is a genuine contribution: a composable definition of selective blindness, a merger-graph condition with a clean proof, and concrete masking techniques for angle differences and graph shape. The angle-masking part is honestly disclosed as a rediscovery of Broadbent's result, but the graph-merging and bridge/break masking are new, and the connection between the size of the differences between candidate computations and the qubit cost is a useful, practical observation. The AC proof is a sketch in places, but the reduction structure is plausible and the protocol itself deserves referee time.\n\nThe no-go half is where the trouble is. The reader's stress-test note is right: Theorem 1's condition (3) requires zero leakage from the output state about θ1 and θ2, but UBQC blindness never requires the transmitted |+θ> states to hide θ individually. UBQC one-time-pads the measurement transcript rπ and the returned outcomes; that joint distribution is blind even though individual states leak. So Proposition 1 is not established by the stated theorem. Lemma 3's entropy argument also assumes θ1 and θ2 vary independently, which they do not if both are functions of a single input θ; S(ρA)=S(ρB) does not force the constant-entropy conclusion. And Lemma 4 asserts differential attacks without constructing a distinguisher, and silently drops the fresh random bits r_i that are independent of the θ_i. These are not minor omissions: the impossibility claim is the advertised headline of the first half.\n\nThe counting lower bound m=ω(log n) is fine but modest; it does not support the 'communication-optimal' claim for SBQC, which would need a matching lower bound for the selective-setting cost.\n\nNet: this is a paper with one solid half and one unproven half. The honest move is to treat the impossibility claims as conjecture, not as established theorem, and let the SBQC protocol stand as the paper's substance. There is real value in the constructive part, and the open questions about optimal merger graphs and scalability are worth asking.\n\nFor peer review: yes, serious referees should see this. The paper is important enough and the protocol idea is concrete enough to merit work. But it needs a major revision that either removes or carefully re-scopes the impossibility claims. My own verdict would be revise-and-resubmit, not accept.","headline":"The SBQC construction is a real, useful protocol idea, but the impossibility half of the paper is not proven as stated; refocus the paper on the selective-blindness construction and it will be worth serious engagement.","tokens_in":32085,"tokens_out":1211,"would_cite":true,"duration_ms":10634,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper establishes that universal blind quantum computing cannot be made cheaper by any server-side local expansion of encrypted resource states, and that hiding one of a known set of computations instead can drastically cut the qubits…","keywords":["blind quantum computing","UBQC","selectively blind quantum computation","measurement-based quantum computation","remote state expander","quantum communication complexity","abstract cryptography","no-go theorem"],"falsifier":"Find any CPTP map $\\Lambda$ with $\\Lambda(|+\\theta\\rangle\\langle+\\theta|) = \\rho_A(\\theta_1)\\otimes\\rho_B(\\theta_2)$ satisfying conditions (1)-(3) of Theorem 1 for all $\\theta$ in the UBQC angle set; an explicit construction would refute the claimed no-go, and a UBQC protocol built from it that remains blind under an unbounded server would refute Proposition 1 directly.","tokens_in":31019,"feed_emoji":"🔐","tokens_out":6431,"duration_ms":56654,"temperature":0.7,"pith_summary":"The paper tries to establish two things about blind quantum computing, where a client with a small quantum device delegates a computation to a powerful server without revealing it. First, it claims that no server-side local quantum operation can take one encrypted resource qubit $|+\\theta\\rangle$ and expand it into two or more independent resource qubits, so the linear-in-circuit quantum communication of UBQC cannot be reduced this way; the no-go is stated as Proposition 1 and Theorem 1. Second, it claims that if the client only needs to hide which of a known set of computations is performed, communication can drop dramatically: the new SBQC protocols hide the choice by masking measurement-angle and graph differences, and are proven perfectly composable in the Abstract Cryptography framework (Theorem 2). The practical point is a trade-off: reveal more about the computation class and pay far fewer qubits.","feed_headline":"No server-side shortcut cuts UBQC's quantum communication","feed_subtitle":"New no-go blocks resource-state expansion; a selectively blind protocol hides one of two computations at far lower qubit cost.","key_machinery":"The argument runs on two machines. The no-go side is the 'remote state expander' (RSE): a hypothetical server-side CPTP map that turns one encrypted qubit $|+\\theta\\rangle$ into two resource qubits with independent hidden angles $\\rho_A(\\theta_1), \\rho_B(\\theta_2)$; the impossibility is driven by linearity (an isometry would have to map a two-dimensional input span into a restricted subspace) and, for entangled outputs, by Schmidt decomposition forcing equal subsystem entropies. The constructive side is hiding by difference: the future cone of a target node collects every measurement angle that depends on the target's outcome, and only qubit-masked nodes (those in the cone with non-Clifford default angles) require an extra physical qubit from the client; graph differences are concealed by merging $G_0$ and $G_1$ into a common graph $G_M$ and using bridge-and-break operations so the server cannot tell which edges were deleted.","core_discovery":"On the paper's own terms, the central discovery is a matched pair of limits. Proposition 1 states that in any UBQC protocol there is no server-side local operation that maps a resource state $|+\\theta\\rangle$ to states used on two or more graph nodes while preserving completeness and blindness; Theorem 1 backs this with a no-go for any map whose outputs have independent angle parameters and whose output state reveals nothing about $\\theta_1$ and $\\theta_2$ when $\\theta$ is unknown, proved for isometries, quantum channels, and entangled outputs. Lemma 4 extends the damage: even approximate expanders that produce correlated angles allow differential attacks on the angle one-time pad. On the positive side, the paper defines Selectively Blind Quantum Computing (SBQC), where the client chooses one of a publicly known set of unitaries, and gives protocols that mask only the differences: angle masking via future cones (only nodes with non-Clifford angles need physical qubits) and graph masking via merger graphs with bridge-and-break operations. Theorem 2 states that these protocols perfectly construct the 1-of-2 Delegated Quantum Computation resource, so the protection is composable.","pith_inferences":["The no-go may be narrower than it appears: condition (3) is stricter than the blindness UBQC actually enjoys, so the impossibility result leaves open server-side processes that reduce communication while leaking some information about the resource angles, as long as the computation itself stays hidden.","SBQC's cost rule suggests a new circuit-compilation objective: arrange non-Clifford gates so their future cones overlap as little as possible with the client's secret parameters, reducing the number of physical qubits the client must send.","A natural test is to instantiate SBQC for a practical family such as parameterized quantum circuits where only weights are secret; the protocol predicts the quantum communication cost should scale with the number of weight-dependent non-Clifford gates rather than circuit width.","The paper's merged-graph construction is not yet optimized; an efficient algorithm for optimal merger graphs, at least for brickwork or square lattices, would turn the asymptotic savings into concrete resource estimates."],"forward_implications":["UBQC's quantum communication cannot be reduced by any server-side local expansion or recycling of encrypted resource states in the plain, information-theoretic model.","Any approximate or correlated resource-state distributor is unusable in UBQC: known functional dependencies among angles open a differential attack on the angle one-time pad.","The number of encrypted qubits a client must send for full blindness is superlogarithmic in the size of the computation, so some quantum communication is provably necessary.","In SBQC, computations that differ by only a few gates require qubits only for the differing nodes and for non-Clifford nodes in their future cones; Clifford-only differences can be hidden classically.","The 1-of-2 SBQC protocol is composably secure: it perfectly constructs the 1-of-2 Delegated Quantum Computation resource, so it can be run alongside other protocols without losing blindness."],"supporting_citations":[{"why":"Defines UBQC, the protocol whose communication cost the impossibility results target and whose blindness SBQC relaxes.","marker":"[1]"},{"why":"Stinespring dilation is used in Lemma 2 to lift the no-go from isometries to general quantum channels.","marker":"[26]"},{"why":"No-cloning theorem is the benchmark the paper distinguishes from its stronger no-distribution result.","marker":"[35]"},{"why":"Bridge-and-break operations supply the edge-masking mechanism in SBQC's graph-hiding subroutine.","marker":"[22]"},{"why":"Prior circuit-model observation that only non-Clifford gates need hiding, rediscovered in MBQC for angle masking.","marker":"[24]"},{"why":"G-flow determinism defines measurement corrections and underlies the future-cone analysis of angle propagation.","marker":"[29]"},{"why":"Abstract Cryptography framework in which Theorem 2 proves composable security of SBQC.","marker":"[33]"},{"why":"Efficient blind computation upper bound O(J log n) used to calibrate the lower bound from Lemma 5.","marker":"[43]"}],"fun_headline_variants":["No local fix cuts blind QC's quantum cost; SBQC hides one","Selective blindness hides one computation at lower qubit cost","No-go blocks expansions; SBQC hides one computation","Blind QC no-go: no local fix; selective blindness saves qubits"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The impossibility result hinges on condition (3) of Theorem 1, which demands that when the input angle $\\theta$ is unknown the output state $\\rho_{A,B}$ reveals no information about $\\theta_1$ and $\\theta_2$; this is stronger than UBQC's actual blindness requirement, where the transmitted $|+\\theta\\rangle$ states themselves leak some information about $\\theta$ and security comes from masking the measurement transcript.","fun_headline_variants_meta":{"raw":{"variants":["No local fix cuts blind QC's quantum cost; SBQC hides one","Selective blindness hides one computation at lower qubit cost","No-go blocks expansions; SBQC hides one computation","Blind QC no-go: no local fix; selective blindness saves qubits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001942,"raw_usage":{"total_tokens":7578,"prompt_tokens":908,"completion_tokens":6670,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":524,"completion_tokens_details":{"reasoning_tokens":6597}},"tokens_in":524,"tokens_out":6670,"duration_ms":41870,"temperature":1.0,"reasoning_tokens":6597,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:36:08.050221+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find any CPTP map $\\Lambda$ with $\\Lambda(|+\\theta\\rangle\\langle+\\theta|) = \\rho_A(\\theta_1)\\otimes\\rho_B(\\theta_2)$ satisfying conditions (1)-(3) of Theorem 1 for all $\\theta$ in the UBQC angle set; an explicit construction would refute the claimed no-go, and a UBQC protocol built from it that remains blind under an unbounded server would refute Proposition 1 directly.","supporting_citations":[{"cited_title":"Universal blind quantum com- putation,","cited_arxiv_id":null,"evidence_quote":"Defines UBQC, the protocol whose communication cost the impossibility results target and whose blindness SBQC relaxes."},{"cited_title":"Positive functions on c*-algebras,","cited_arxiv_id":null,"evidence_quote":"Stinespring dilation is used in Lemma 2 to lift the no-go from isometries to general quantum channels."},{"cited_title":"Information theoreti- cally secure hypothesis test for temporally unstructured quantum computation (extended abstract),","cited_arxiv_id":null,"evidence_quote":"Bridge-and-break operations supply the edge-masking mechanism in SBQC's graph-hiding subroutine."},{"cited_title":"Delegating private quantum computations,","cited_arxiv_id":null,"evidence_quote":"Prior circuit-model observation that only non-Clifford gates need hiding, rediscovered in MBQC for angle masking."},{"cited_title":"Generalized flow and determinism in measurement-based quantum computation,","cited_arxiv_id":null,"evidence_quote":"G-flow determinism defines measurement corrections and underlies the future-cone analysis of angle propagation."},{"cited_title":"Abstract cryptography,","cited_arxiv_id":null,"evidence_quote":"Abstract Cryptography framework in which Theorem 2 proves composable security of SBQC."},{"cited_title":"Efficient uni- versal blind quantum computation,","cited_arxiv_id":null,"evidence_quote":"Efficient blind computation upper bound O(J log n) used to calibrate the lower bound from Lemma 5."}],"review_version":1}