{"id":"33d2aa10-d854-487a-96fd-c7017ede6bd7","arxiv_id":"2607.08070","paper_version":1,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":3,"one_line_summary":"A (2,m)-threshold quantum data-hiding scheme is constructed where any pair of m parties can perfectly recover a hidden bit via joint measurement, while LOCC by all parties reveals arbitrarily little information.","lead":"This paper presents a quantum data-hiding scheme where one secret bit is shared among m parties: any two parties can recover it perfectly, but all parties together using only local operations learn almost nothing. It matters because it bridges the gap between two-party and all-party quantum data hiding using only separable states.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"No significant objection identified. The additive PPT bound (Theorem 3) and scheme construction are sound.","rationale":"The reader correctly identifies the argumental structure: the LOCC hiding guarantee flows through p_L(E) ≤ p_PPT(E) and the additive decomposition in Theorem 3. The reader frames this as the 'weakest assumption,' but on careful examination it is not a vulnerability. The PPT bound being an upper bound on LOCC is the standard and correct approach in quantum data hiding — it can only overestimate the LOCC success probability, never underestimate it. The additive bound in Theorem 3 is rigorously proven (Appendix C), with each step — the telescoping identity, the PPT property of the building-block states, and the triangle inequality — checking out. The scheme construction is also correct: any pair can recover x via joint measurement plus the public string, and the public string itself leaks no information. The two-party building block comes from a published paper [17] with explicit numerical values (Tr|H| = 5/12, Tr|H^{PT}| = 7/12) yielding exponential convergence. The limitations (one bit, PPT vs LOCC gap, local dimension growing with m) are acknowledged and do not affect correctness. The reader's ACCEPT with HIGH confidence is appropriate.","tokens_in":14000,"tokens_out":4846,"duration_ms":225710,"concrete_test":"Independently verify the key step in Appendix C: for m=3, explicitly construct the operators E_0, E_1, E_2, E_3 from Eq. (C2) using the two-party building block of Example 1, confirm they satisfy Eq. (19) (i.e., E_0 + E_1^{PT_1} + E_2^{PT_2} + E_3^{PT_3} = Λ_E), and numerically compute p_PPT(E) via semidefinite programming to confirm it satisfies the bound 1/2 + 3ε from Inequality (34). If the SDP value exceeds this bound, Theorem 3's proof has an error.","verdict_should_be":"UNCHANGED","load_bearing_attack":"I traced the full argument and find no load-bearing concern. The scheme's recovery property is correct: any pair (k,k') can jointly measure τ_{b_{k,k'}} on their shared subsystem, then use the public string c⃗ to recover b_{α,α'} = c_{k,k'} ⊕ b_{k,k'} (for (k,k') ≠ (α,α')) and finally x = c_{α,α'} ⊕ b_{α,α'}. The LOCC hiding guarantee rests on the chain p_L(E) ≤ p_PPT(E) ≤ 1/2 + C(m,2)·ε (Inequality 34). The reader flags that this is an upper bound on an upper bound, but this is not a weakness: p_L ≤ p_PPT means if PPT discrimination is near-random, LOCC is also near-random. The additive decomposition in Theorem 3 (proven in Appendix C) is the key step. I verified its proof: the telescoping identity (C4) is standard, the construction of {E_k} in (C2) correctly satisfies (C19), and the triangle inequality bounds in (C5)–(C6) correctly exploit that PPT states have PSD partial transposes with trace 1, yielding Tr|σ^{PT_k}| = 1. The two-party building block (Example 1, from published [17]) gives exponential convergence to 1/2 via Proposition 1. For any fixed m, ε can be chosen small enough that C(m,2)·ε is negligible, with sequence length L growing only logarithmically in m. The public bit string c⃗ leaks no information about x because each c_{k,k'} is a function of uniformly random b values. No internal inconsistency or gap found.","agreement_with_reader":"agree"},"referee_report":{"model":"glm-5.2","summary":"This paper proposes the first (2,m)-threshold quantum data-hiding scheme for one classical bit shared among m parties. In the scheme, any pair of parties can perfectly recover the hidden bit via a joint measurement on their shared two-party subsystem, while LOCC measurements by all m parties reveal only an arbitrarily small amount of information. The construction uses only separable states of low-dimensional (qutrit) quantum systems. The technical core consists of three theorems: Theorem 1 gives a dual (SDP) characterization of the optimal PPT discrimination probability p_PPT(E); Theorem 2 reformulates this for two-state ensembles as a trace-norm minimization; and Theorem 3 provides an additive upper bound on the multiparty PPT discrimination probability in terms of two-party PPT bounds. The hiding guarantee follows from the chain p_L(E) ≤ p_PPT(E) ≤ 1/2 + C(m,2)·ε (Inequality 34), where ε can be made arbitrarily small by increasing the sequence length L of the two-party building-block ensemble (Proposition 1, Example 1, from the authors' prior work [17]).","tokens_in":14208,"tokens_out":2428,"duration_ms":105687,"significance":"The paper addresses a natural and previously open problem: prior work established (m,m)-threshold schemes (requiring all parties to collaborate), and this work fills the gap for k=2. The (2,m)-threshold property is a meaningful intermediate collaboration requirement. The use of separable states is a notable practical advantage, as it avoids the need for entangled resources. The proofs in Appendices A–C are complete and rigorous: the SDP duality argument in Appendix A is standard but correctly executed, the trace-norm reformulation in Appendix B is clean, and the multiparty decomposition in Appendix C via the telescoping identity (Eq. C4) and triangle inequality is the key technical step and is sound. The two-party building block from [17] provides explicit states with verifiable trace-norm values (Tr|H|=5/12, Tr|H^PT|=7/12, Eq. D12) and exponential convergence to random guessing (Eq. D13).","major_comments":[],"minor_comments":[{"comment":"Section III, Inequality (34): The bound is 1/2 + C(m,2)·ε. While the text correctly notes that ε can be chosen arbitrarily small, it would help the reader to state explicitly that for a target hiding gap δ, one needs ε = δ/C(m,2), and since ε decreases exponentially in L (Proposition 1, Eq. D13), the required sequence length L grows only as O(log m). This scaling is implicit but never made explicit, and it is relevant to the practical feasibility claim.","section":null},{"comment":"Section III, Eq. (32): The encoding rule for c_{k,k'} distinguishes the cases (k,k') = (α,α') and (k,k') ≠ (α,α'). It would improve readability to briefly restate the recovery procedure for an arbitrary pair (k,k') ≠ (α,α') in the main text (not just in the figure caption), since the mechanism — measure b_{k,k'} from the shared state, compute b_{α,α'} = c_{k,k'} ⊕ b_{k,k'}, then x = c_{α,α'} ⊕ b_{α,α'} — is central to understanding why any pair suffices.","section":null},{"comment":"Figure 2: The figure caption for panel (b) uses (α,α') = (1,2), which is helpful. However, the connection between the bit string c⃗ and the recovery procedure could be made more explicit in the figure or its caption, as the current description requires the reader to reconstruct the recovery logic from Eq. (32).","section":null},{"comment":"Appendix D, Proposition 1: The proposition is stated without proof and attributed to [17, 19]. Since this is a load-bearing ingredient, a brief proof sketch or a more precise reference to where the proof appears would strengthen the self-containedness of the paper.","section":null},{"comment":"Section IV (Discussion): The paper mentions that analogous constructions are possible for arbitrary local dimension d ≥ 2 [17–19]. It would be useful to briefly state whether the qutrit construction (Example 1) is optimal in any sense (e.g., minimal local dimension), or whether d=2 (qubit) constructions also exist.","section":null},{"comment":"Typographical: In Eq. (D13), the expression (35/36)^{L/2} should perhaps be written as ((35/36)^{1/2})^L or (35/36)^{L/2} with explicit parentheses to avoid ambiguity about whether the exponent L/2 applies to the full fraction.","section":null}],"recommendation":"minor_revision","confidential_remarks":"The paper is mathematically sound and the central claim is well-supported. The recommendation of minor revision reflects only presentation improvements; no load-bearing issue was identified. The reliance on the authors' own prior work [17] for the two-party building block is transparent and appropriate, as [17] provides explicit constructions with verifiable parameters. The novelty here is in the multiparty threshold construction and the additive PPT bound (Theorem 3), which is a genuine contribution."},"author_rebuttal":null,"desk_editor":{"model":"glm-5.2","letter":"The headline: this paper constructs the first (2,m)-threshold quantum data-hiding scheme, meaning any two of m parties can jointly recover a hidden bit while all m parties together learn almost nothing via LOCC. That fills a real gap between two-party hiding and the (m,m)-threshold case from the authors' earlier work. The core idea is clean: tensor two-party PPT hiding ensembles across all pairs of parties, then use XOR-encoded public bit strings to control who can recover what. Any pair measures their shared subsystem and combines with the public string; LOCC is bounded away because the PPT discrimination probability decomposes additively across pairs. The math is solid. Theorems 1 and 2 give a dual characterization of PPT discrimination and a trace-norm reformulation for two-state ensembles, both proven in full in the appendices. Theorem 3 is the key multiparty bound, and its proof in Appendix C uses a standard telescoping identity plus triangle inequality arguments that I checked step by step. The two-party building block comes from the authors' own published work (Example 1, from [17]) with explicit qutrit states and verifiable trace-norm values, so there's no circularity concern. The stress-test note confirming no load-bearing flaw is accurate. The soft spots are real but minor. First, the scheme hides exactly one bit, and the paper acknowledges this without suggesting how to extend to multiple bits. Second, the LOCC bound goes through PPT (p_L ≤ p_PPT), so it's an upper bound on an upper bound. This is standard in the data-hiding literature and not a weakness per se, but it means the actual LOCC information leakage could be even smaller than proven. Third, the number of subsystems each party holds grows as m-1, so the scheme doesn't scale gracefully to large m, though for fixed m the security parameter only needs logarithmic growth in the sequence length. This is a well-constructed paper that does what it claims. It's for researchers in quantum state discrimination and quantum cryptography who care about the threshold structure of data hiding. The open questions about multi-bit encoding and k > 2 thresholds are natural next steps that the paper correctly identifies. It deserves a serious referee.","headline":"First (2,m)-threshold quantum data hiding scheme; proofs check out, one-bit limitation is the main drawback","tokens_in":15060,"tokens_out":527,"would_cite":true,"duration_ms":83013,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":["03.67.Dd","03.67.Hk","03.67.-a"],"model":"glm-5.2","headline":"Any pair of parties can unlock a hidden quantum bit","keywords":["quantum data hiding","threshold scheme","state discrimination","LOCC","PPT bound","separable states","multiparty quantum information"],"falsifier":"The scheme would fail if there existed an LOCC measurement (or even a PPT measurement) on the full multiparty state that discriminates the hidden bit with probability significantly exceeding 1/2 + C(m,2)*epsilon, which would require the additive bound of Theorem 3 to be violated or the two-party PPT building blocks to not achieve near-random-guessing discrimination.","tokens_in":14211,"feed_emoji":"🔓","tokens_out":1173,"duration_ms":187163,"temperature":0.7,"pith_summary":"The paper constructs a quantum data-hiding scheme for one classical bit shared among m parties where the threshold for recovery is set at just two: any pair of parties, by performing a joint quantum measurement on their shared subsystem, can perfectly recover the hidden bit, while all m parties together using only local operations and classical communication (LOCC) learn arbitrarily little. The construction works by having every pair of parties share a copy of a two-party state ensemble whose PPT discrimination probability (an upper bound on LOCC discrimination) is exponentially close to random guessing. The hidden bit is encoded via a classical one-time-pad structure on the publicly broadcast bit-strings, so that recovering the bit reduces to discriminating one two-party subsystem. The multiparty LOCC bound is obtained by decomposing the PPT discrimination probability of the full tensor-product ensemble into an additive sum of two-party PPT bounds (Theorem 3), which then inherits the near-random-guessing property of each building-block pair. Crucially, the entire construction uses only separable (unentangled) states of low-dimensional systems, such as two-qutrit states, showing that entanglement is not a necessary resource for multiparty quantum data hiding.","feed_headline":"Any pair of parties can unlock a hidden quantum bit","feed_subtitle":"A new (2,m)-threshold scheme hides one classical bit among m parties: two suffice to recover it perfectly, but all together via LOCC learn几乎","key_machinery":"The key machinery is Theorem 3, which bounds the optimal PPT discrimination probability of a multiparty tensor-product ensemble by the sum of the PPT discrimination probabilities of its two-party components. This is combined with a two-party orthogonal separable state ensemble (Example 1, based on 3x3 systems) whose PPT discrimination probability converges exponentially to 1/2 as the sequence length L increases (Proposition 1), yielding the near-random-guessing guarantee. The encoding uses a one-time-pad-like classical bit-string broadcast so that recovering the hidden bit x is equivalent to discriminating one specific two-party subsystem.","core_discovery":"The central result is that a (2,m)-threshold quantum data-hiding scheme exists for one classical bit: any two parties can perfectly recover the bit via joint measurement, while LOCC by all m parties is bounded by p_L(E) <= 1/2 + C(m,2)*epsilon for arbitrarily small epsilon. This is achieved by tensoring two-party PPT-state ensembles whose optimal PPT discrimination is near random guessing, and proving that the multiparty PPT bound decomposes additively over the two-party subsystems. The scheme is realizable with separable states only.","pith_inferences":["If the additive PPT bound in Theorem 3 is tight or near-tight for certain ensembles, the scheme's security could be characterized more precisely, potentially revealing a tradeoff between the number of parties m and the achievable LOCC leakage.","The use of separable states suggests that the hiding phenomenon here is fundamentally about the nonlocality of state discrimination rather than entanglement per se, which could reframe the resource-theoretic understanding of quantum data hiding.","A (k,m)-threshold generalization might be constructible by replacing the pairwise-sharing structure with a k-wise sharing structure, though the additive bound decomposition would need a corresponding generalization."],"forward_implications":["The existence of a (2,m)-threshold scheme with separable states opens a path to (k,m)-threshold schemes for general 2 <= k < m, bridging the gap between the existing (m,m)-threshold schemes and this (2,m) result.","Since the construction uses only separable states of low dimension, it may be more experimentally accessible than entanglement-based hiding schemes, potentially enabling near-term demonstrations.","The additive PPT bound decomposition (Theorem 3) may be applicable to other multiparty state discrimination problems beyond data hiding, wherever tensor-product ensembles of PPT states arise.","Extending the scheme from one bit to multiple bits while preserving the (2,m)-threshold property is identified by the authors as a natural open question."],"fun_headline_variants":["Two parties recover a hidden bit that all parties together cannot find","Separable states hide one bit: any pair recovers it, all LOCC cannot","(2,m)-threshold scheme hides a bit using only separable quantum states","Any two parties unlock hidden bit while all-party LOCC stays near random","Multiparty data hiding: two suffice to recover a bit, all cannot extract it"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The security proof bounds the LOCC discrimination probability by the PPT discrimination probability, and then bounds the latter via an additive decomposition over two-party subsystems. This additive upper bound is proven but may not be tight; the actual LOCC leakage could be lower than proven, meaning the scheme may be more secure than the proof establishes but the guarantee rests on the bound holding.","fun_headline_variants_meta":{"raw":{"variants":["Two parties recover a hidden bit that all parties together cannot find","Separable states hide one bit: any pair recovers it, all LOCC cannot","(2,m)-threshold scheme hides a bit using only separable quantum states","Any two parties unlock hidden bit while all-party LOCC stays near random","Multiparty data hiding: two suffice to recover a bit, all cannot extract it"]},"model":"glm-5.2","effort":"low","cost_usd":0.0,"raw_usage":{"total_tokens":529,"prompt_tokens":431,"completion_tokens":98,"prompt_tokens_details":null},"tokens_in":431,"tokens_out":98,"duration_ms":20959,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-10T00:36:46.927116+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"The scheme would fail if there existed an LOCC measurement (or even a PPT measurement) on the full multiparty state that discriminates the hidden bit with probability significantly exceeding 1/2 + C(m,2)*epsilon, which would require the additive bound of Theorem 3 to be violated or the two-party PPT building blocks to not achieve near-random-guessing discrimination.","supporting_citations":[],"review_version":1}