{"id":"9fe364db-89e8-4d44-a873-d0cb26552f69","arxiv_id":"2607.25704","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"First composably secure protocol integrating probabilistic error cancellation into verifiable blind delegated quantum computation.","lead":"This paper presents a protocol that lets a client run error-mitigated quantum computations on a distant, untrusted quantum server while keeping the computation hidden and checking that the returned estimate is reliable. It combines probabilistic error cancellation with blind, verifiable quantum computing and proves the combination is secure in a composable cryptographic framework.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"McDiarmid step in Theorem 2 conditions on p_T but applies independence that holds only conditional on S_T; the gap between E[·|S_T] and E[·|p_T] is uncontrolled.","rationale":"The paper's main theorem, Theorem 2, is a substantial theoretical claim: VBPEC δ-constructs the SDPEC resource with negligible δ. The proof structure is mostly coherent: UBOE composability, Walsh-Hadamard trap post-processing, honest-noise analysis in Lemma 10, and explicit acknowledgement in Section VI.D that polynomial |Λ| is an assumption and that noise-model acquisition remains future work. The reader's weakest assumption (the client must possess a reference noise model E_PEC with polynomial support, and the server-side deviation must be twirled to stochastic Pauli form) is real but scoped by the theorem statement, so it does not by itself invalidate the central claim. However, the security proof contains an internal gap that is more directly load-bearing: Eq. (47) uses McDiarmid's inequality to bound |˜∆−Δ_T|, where Δ_T is defined conditional only on p_T, whereas the independence and bounded-difference structure hold only conditional on the full test-round set S_T. As written, the concentration is around the wrong conditional mean, leaving the fluctuation between E[˜∆|S_T] and E[˜∆|p_T] unaccounted for. This does not appear to be a fatal flaw — redefining Δ_T conditionally on S_T preserves the Jensen step and the subsequent union bound — but it is a genuine missing justification in the proof of the paper's headline theorem. Because the reader already returned a CONDITIONAL verdict, I do not propose changing the verdict; instead, the condition should be understood to include a rigorous fix of Eq. (47).","tokens_in":37854,"tokens_out":25318,"duration_ms":239218,"concrete_test":"Re-derive the security proof with Δ_T^(S) := E[˜∆|S_T, fixed Pauli sequence] in place of E[˜∆|p_T]; verify that McDiarmid gives concentration around Δ_T^(S), that Jensen gives D_Λ(p_T,p_PEC) ≤ Δ_T^(S), and that the chain through Eqs. (42)–(54) closes with the stated parameter choices. If an additional term bounding |E[˜∆|S_T] − E[˜∆|p_T]| is required, compute its exponential rate and check whether it is negligible under N_t ≥ 256|Λ|²∥q∥1²/ε²; also run a small Monte Carlo for small |V| with a fixed adversarial Pauli sequence near the acceptance boundary and compare Pr[Acc∧Bad] against the claimed bound in Eq. (54).","verdict_should_be":"UNCHANGED","load_bearing_attack":"In the security proof of Theorem 2 (Section IV.C), Eq. (38) defines Δ_T = E[˜∆|p_T], where p_T is the empirical Pauli-deviation distribution over the random test-round set S_T. Eq. (47) then claims Pr[|˜∆−Δ_T|>γ_t] ≤ 2exp(−γ_t² N_t/(8|Λ|²)), justified by \"conditioned on the fixed Pauli sequence and on S_T.\" The bounded-difference/McDiarmid argument applies to the trap patterns T_i, which are independent only after conditioning on the actual set S_T and the realized Pauli errors; it controls deviation of ˜∆ from E[˜∆|S_T, Pauli sequence], not from E[˜∆|p_T]. Conditioning only on p_T leaves S_T random, and E[˜∆|S_T] fluctuates around E[˜∆|p_T] by an amount the proof never bounds. This matters because the security chain (Eqs. 40–43) needs a high-probability upper bound on D_Λ(p_T,p_PEC), obtained from concentration of ˜∆ around its conditional mean; an uncontrolled gap here would open a non-negligible Pr[Acc∧Bad]. The error is repairable by redefining Δ_T = E[˜∆|S_T, Pauli sequence], since Jensen still gives D_Λ(p_T,p_PEC) ≤ Δ_T; however, as written Eq. (47) does not follow from the stated conditioning, so Theorem 2 lacks a complete proof.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Verifiable Blind Probabilistic Error Cancellation (VBPEC), a delegated quantum computation protocol that integrates probabilistic error cancellation (PEC) into the universal blind quantum computing framework. The authors formalize the ideal functionality as the Secure Delegated Probabilistic Error Cancellation (SDPEC) resource in the abstract cryptography framework, and prove that VBPEC constructs it with perfect blindness and an exponentially small security error. The protocol uses test rounds based on general trap patterns to estimate the server's effective Pauli deviation via a Walsh-Hadamard post-processing, and compares this estimate to the reference PEC noise model through a statistical test statistic. The main result, Theorem 2, claims that VBPEC delta-constructs the SDPEC resource with negligible delta in both the number of computation rounds and the number of test rounds, while also providing active error cancellation that improves acceptance probability under matched and moderately mismatched honest noise.","tokens_in":38158,"tokens_out":18851,"duration_ms":157035,"significance":"If the proof can be repaired, this is a substantial contribution to both quantum error mitigation and verified delegated computation. It provides the first composable cryptographic treatment of a QEM technique, formalizing PEC as an ideal resource and showing that it can be securely delegated to a fully malicious server. The extension of trap-based verification from deterministic pass/fail outcomes to statistical benchmarking via the Walsh-Hadamard transform is conceptually novel and technically useful. The protocol inherits the absence of quantum-space overhead from PEC and from recent verification protocols, with overhead only in additional repetitions. The concentration proofs are detailed and largely sound, and the noise-robustness analysis in Section V is a significant improvement over threshold-based verification, since correctly mitigated estimates are accepted with high probability under matched honest noise. The construction is not circular: the reference noise model E_PEC is an input, protocol parameters are fixed, and the security proof does not fit the data.","major_comments":[{"comment":"The McDiarmid bound in Eq. (47) is applied to the deviation |˜∆−Δ_T|, with Δ_T defined in Eq. (38) as E[˜∆|p_T]. However, the independence of the test-round variables required for the bounded-difference argument holds only conditionally on the actual test set S_T and the fixed Pauli sequence, so Eq. (47) controls |˜∆−E[˜∆|S_T, Pauli sequence]|, not |˜∆−E[˜∆|p_T]|. The gap between these two conditional means is not bounded, and E[˜∆|S_T, Pauli sequence] can depend on the detailed composition of S_T beyond the empirical distribution p_T, so this gap can be non-negligible. This breaks the chain leading from Eq. (42) to Eq. (43) and therefore the proof of Theorem 2 as written. The fix is local: redefine Δ_T := E[˜∆|S_T, Pauli sequence], use Jensen's inequality to obtain D_Λ(p_T, p_PEC) ≤ Δ_T in Lemma 6, and update Eq. (38) and the surrounding text accordingly.","section":"Section IV.C, Eq. (38) and Eq. (47)"},{"comment":"The security proof of Theorem 2 fixes the protocol parameter in Eq. (53) as ϵ_t = γ_t = γ_s = ϵ/(4∥q∥₁), whereas the theorem statement allows any 0 ≤ ϵ_t < ϵ/∥q∥₁. With the choices in Eq. (53), the proof only covers the single value ϵ_t = ϵ/(4∥q∥₁); for other admissible ϵ_t, the inequality γ_c + ∥q∥₁(ϵ_t + γ_t + γ_s) ≤ ϵ may fail. The statement and proof should be reconciled by either stating the theorem for this specific choice or by introducing the slack s = ϵ − ∥q∥₁ϵ_t > 0 and choosing γ_c = s/4, γ_t = γ_s = s/(4∥q∥₁), which preserves the exponential bounds. The lack of consistency is compounded by the correctness proof taking ϵ_t = ϵ/2 and the noise-robustness section taking ϵ_t = ϵ/4, without clarifying that these are illustrative choices for a protocol whose ϵ_t is a single fixed parameter.","section":"Theorem 2 and Section IV.C, Eq. (53)"}],"minor_comments":[{"comment":"The description of the filtered server interface ('when e=0, the interface does not send any information nor take inputs') is easy to misread; please clarify that the server receives only the public information and otherwise has a null interface in the honest case.","section":"Resource 1 and Resource 2"},{"comment":"The set N_G^odd(S) and the variables d_v are used in Step 5 before being defined; add a pointer to Appendix D where the general trap construction is explained.","section":"Protocol 3"},{"comment":"The estimator ˜p_T(P) is defined twice, once in the text around Eq. (12) and again inside Protocol 4; unify the notation to avoid duplication and potential inconsistency.","section":"Eq. (12) and Protocol 4"},{"comment":"There is a stray period after the definition of μ_C in the sentence introducing Eq. (38); this is a minor typographical error.","section":"Section IV.C, before Eq. (38)"},{"comment":"The equality D_Λ(p_T, p_PEC) = D_Λ(E[˜p_T|p_T], p_PEC) is used without comment; it follows from Lemma 5 and linearity of the conditional expectation, but this should be stated explicitly for clarity.","section":"Appendix E, Lemma 6 proof"},{"comment":"The crucial assumption that the client's preparation imperfections are independent of the secret QOTP parameters is stated in passing; it is load-bearing for the twirling argument and should be listed as an explicit assumption in Section II.B alongside the definition of E_PEC.","section":"Section II.B"},{"comment":"Several references are to unpublished or not-yet-indexed works (e.g., Refs. [24], [28], [59]); please provide arXiv identifiers or DOIs where available for reproducibility.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The main theorem's proof has a genuine gap in the McDiarmid step (the conditioning mismatch between p_T and S_T), but it is repairable by redefining the conditional mean as described in the major comments. The parameter-choice inconsistency in Theorem 2 also needs fixing, but the required changes are local and do not undermine the paper's conceptual contribution. I would not recommend rejection: the protocol design is interesting, the Walsh-Hadamard interpretation of traps is elegant, and the framework appears sound once the proof details are corrected. The authors should also harmonize the choice of ϵ_t across the correctness, security, and noise-robustness proofs so that they refer to a single protocol parameter."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe real news here is that this is the first composable-security treatment of a quantum error mitigation procedure. The authors embed PEC into blind MBQC delegation and prove that their VBPEC protocol constructs an ideal SDPEC resource with negligible error. The technical moves are genuinely new: PEC corrections become classical Pauli-frame flips hidden by the QOTP, and trap outputs are post-processed through a Walsh-Hadamard transform to estimate the effective Pauli deviation distribution, turning deterministic trap checks into statistical benchmarking. The concentration-based security proof is a real extension beyond the pass/fail framework.\n\nThe main theorem looks right to me. I checked the concentration argument in Section IV.C and the appendices; the Hoeffding, McDiarmid, and Serfling applications have correct ranges, and Eq. (54) follows from Eqs. (46)-(52). The stress-test note about a conditioning gap in Eq. (47) does not hold up. Conditional on the Pauli sequence and S_T, the trap patterns are i.i.d., and the distribution of the test statistic depends on S_T only through the empirical distribution p_T. Hence E[tilde_Delta | S_T] = E[tilde_Delta | p_T], so the McDiarmid step is legitimate as written.\n\nSoft spots are real but not disqualifying. The client must hold a reference stochastic-Pauli noise model E_PEC with polynomial support; the protocol verifies consistency with it but does not learn it. When the honest noise mismatch is large relative to epsilon/||q||_1, the acceptance guarantee in Lemma 10 degrades as stated. There is also no numerical simulation or implementation, so practicality claims are untested. The proof is dense and will take real referee effort. The heavy citation of the authors' own VBOE and trap-pattern work is justified, since those are the direct building blocks.\n\nWho is this for: people working on verifiable delegated quantum computation, blind computation, and cryptographic treatments of error mitigation. A serious referee should engage; the core claim is important and appears supported, but the proof's complexity and the lack of any empirical check mean it needs careful review, not desk rejection.\n\nMy recommendation: send it to peer review.","headline":"First composable-security protocol for PEC; the main theorem survives my checks, but practicality claims are untested and the proof is dense.","tokens_in":38695,"tokens_out":5745,"would_cite":true,"duration_ms":55170,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P68","94A60"],"pacs":["03.67.-a","03.67.Dd"],"model":"deepseek-v4-flash","headline":"This paper claims that probabilistic error cancellation, a standard quantum error mitigation technique, can be delegated to a fully malicious server with perfect blindness and verifiable, composably secure outputs.","keywords":["verifiable blind quantum computation","probabilistic error cancellation","quantum error mitigation","composable security","measurement-based quantum computation","quantum one-time pad","Walsh-Hadamard transform","noise benchmarking"],"falsifier":"Search numerically for an adversarial sequence of Pauli deviations across rounds that passes the test condition $\\widetilde{\\Delta} \\le \\epsilon_t$ while the PEC-corrected computation estimate satisfies $|\\widetilde{o}_C - \\mathrm{Tr}[\\rho O]| > \\epsilon$ with non-negligible probability. Theorem 2's security bound says this joint event has probability at most three exponentially small terms, so any concrete strategy beating that bound would refute the central claim.","tokens_in":1750,"feed_emoji":"🔐","tokens_out":2015,"duration_ms":107144,"temperature":0.7,"pith_summary":"Probabilistic error cancellation (PEC) lets a client estimate ideal expectation values by sampling from a quasi-probability decomposition of the inverse noise channel, but it assumes the noise model is accurate and the server faithfully executes the sampled corrections. This paper claims that both assumptions can be dropped: in the VBPEC protocol the client interleaves computation rounds with trap test rounds, uses the trap outputs to estimate the server's effective Pauli deviation via a Walsh–Hadamard transform, and accepts the PEC-corrected estimate only when that estimated deviation is close to the client's reference noise model. The main theorem states that VBPEC constructs an ideal \"Secure Delegated Probabilistic Error Cancellation\" resource with perfect blindness and security error exponentially small in the number of computation and test rounds, within the abstract cryptography framework. A sympathetic reader would care because it would give the first end-to-end cryptographic reliability guarantee for a quantum error mitigation pipeline, at the cost of only additional repetitions rather than additional qubits.","feed_headline":"Quantum error mitigation becomes verifiable against malicious servers","feed_subtitle":"A weak client can get noise-cancelled estimates from a malicious server, with exponentially small security error.","key_machinery":"The central mechanism is the combination of the quantum one-time pad (QOTP) twirl, general trap patterns, and the inverse Walsh–Hadamard transform. The QOTP converts any server deviation into an effective stochastic Pauli channel whose $Z$ component alone flips measurement outcomes, so PEC's inverse channel can be realized entirely by classical bit flips on the client's decoded outcomes. Test rounds use random general trap patterns, and because $\\mathbb{E}[(-1)^{\\langle \\mathrm{set}(P), S_i\\rangle} \\tilde{y}_i] = \\tilde{p}_T(P)$, the signed average over $N_t$ traps gives an unbiased estimator of the server's Pauli-deviation probability. The client assembles these estimates into the statistic $\\widetilde{\\Delta} = D_\\Lambda(\\tilde{p}_T, \\tilde{p}_{\\mathrm{PEC}})$, a coarse-grained $\\ell^1$ distance between the estimated and reference deviation distributions, and accepts iff $\\widetilde{\\Delta} \\le \\epsilon_t$. The proof then bounds three fluctuations---the PEC estimator, the trap-statistic estimator, and the computation/test round mismatch---using Hoeffding, McDiarmid, and Serfling inequalities.","core_discovery":"The central discovery, stated as Theorem 2, is that VBPEC $\\delta$-constructs the SDPEC resource: for any accepted non-abort output, the probability that it deviates from the ideal expectation value $\\mathrm{Tr}[\\rho O]$ by more than $\\epsilon$ is negligible in both $N_c$ and $N_t$, and under honest noise matching the reference model $E_{\\mathrm{PEC}}$, the probability of accepting a correct mitigated estimate converges to one exponentially. The protocol achieves this by turning trap-based verification from deterministic pass/fail checks into a statistical benchmark of the server's effective Pauli deviation distribution, and by proving that the residual bias of the PEC estimator is controlled by the same statistic used for acceptance.","pith_inferences":["Beyond the paper: the same trap post-processing already reconstructs the server's effective Pauli distribution, so the test-round data could serve as a standalone noise-benchmarking primitive that certifies sparse Pauli noise models without a separate calibration step.","Beyond the paper: the proof mechanism of estimator-valued tests plus concentration bounds should transfer to other QEM schemes whose correction is a classical function of the decoded outcomes, such as probabilistic error amplification, though the paper only sketches this direction.","Beyond the paper: feeding the estimated $\\tilde{p}_T$ back into an updated $E_{\\mathrm{PEC}}$ over successive blocks could make the protocol noise-agnostic, replacing a priori model trust with statistical certification."],"forward_implications":["A client with only single-qubit prepare-and-send capabilities can obtain error-mitigated expectation values from an untrusted quantum server while keeping the computation perfectly blind.","PEC's cancellation operations reduce to classical bit flips in the client's post-processing, so no additional noisy quantum gates are inserted into the delegated circuit.","Under honest noise that matches the reference model, the probability of accepting a within-$\\epsilon$ estimate converges to one exponentially in $N_c$ and $N_t$; under moderate model mismatch it remains high as long as $D_{\\mathrm{mis}} < \\min(\\epsilon/\\|\\vec q\\|_1, \\epsilon_t)$.","Verification no longer rejects once noise exceeds a fixed threshold; noise consistent with the PEC model is actively cancelled, so the practical acceptance probability improves without changing the security guarantee."],"supporting_citations":[{"why":"Introduces probabilistic error cancellation and the quasi-probability decomposition of the inverse noise channel that VBPEC makes blind and verifiable.","marker":"[4, 5]"},{"why":"Supplies the universal blind quantum computation layer whose quantum one-time pad twirls arbitrary server deviations into effective stochastic Pauli channels.","marker":"[42]"},{"why":"Provides the general trap patterns; their outputs, reinterpreted through an inverse Walsh–Hadamard transform, give unbiased estimators of Pauli-deviation probabilities.","marker":"[27]"},{"why":"Defines verifiable blind observable estimation, the deterministic-trap baseline that VBPEC extends to statistical tests over estimator-valued outcomes.","marker":"[29]"},{"why":"Sets up the abstract cryptography framework in which the SDPEC resource and composable construction are formalized.","marker":"[35]"},{"why":"Prior verification protocol for noisy devices whose fixed-threshold rejection behavior VBPEC replaces with active error cancellation.","marker":"[26]"},{"why":"Establishes composable security of blind delegated quantum computation, used by the simulator in the security proof.","marker":"[36]"}],"fun_headline_variants":["Blind verifiable quantum error mitigation against malicious servers","Verifiable blind error cancellation for untrusted quantum hardware","Quantum error mitigation gets blind and verifiable security","Exponentially secure blind and verifiable error cancellation"],"cache_read_input_tokens":40832,"weakest_assumption_plain":"The protocol assumes the client already has a correct-enough description of the server's noise as a stochastic Pauli channel with only polynomially many relevant terms, and that the server's true deviation, after the one-time-pad randomization, really is of that form; the protocol verifies consistency with this description but does not learn it from scratch.","fun_headline_variants_meta":{"raw":{"variants":["Blind verifiable quantum error mitigation against malicious servers","Verifiable blind error cancellation for untrusted quantum hardware","Quantum error mitigation gets blind and verifiable security","Exponentially secure blind and verifiable error cancellation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001339,"raw_usage":{"total_tokens":5437,"prompt_tokens":932,"completion_tokens":4505,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":548,"completion_tokens_details":{"reasoning_tokens":4443}},"tokens_in":548,"tokens_out":4505,"duration_ms":29306,"temperature":1.0,"reasoning_tokens":4443,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:26:16.186376+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Search numerically for an adversarial sequence of Pauli deviations across rounds that passes the test condition $\\widetilde{\\Delta} \\le \\epsilon_t$ while the PEC-corrected computation estimate satisfies $|\\widetilde{o}_C - \\mathrm{Tr}[\\rho O]| > \\epsilon$ with non-negligible probability. Theorem 2's security bound says this joint event has probability at most three exponentially small terms, so any concrete strategy beating that bound would refute the central claim.","supporting_citations":[],"review_version":2}