{"id":"125cdc84-f29b-4f7d-ab89-6d9643935c4e","arxiv_id":"2607.26734","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"VRS turns RCS-based certified randomness plus a timed bulletin board into a composable, publicly verifiable sampler of fresh samples from any target distribution.","lead":"The paper defines verifiable random sampling (VRS) and builds it from random quantum circuit sampling so a public transcript yields a fresh sample from a target distribution. It targets blockchain and multiparty settings where VRFs allow collusion and grinding.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Security of Theorem 9 rests on a restricted adversary and an incomplete hybrid that does not fully discharge the public-verifiability claim under the stated corruptions.","rationale":"The Reader correctly flags Assumption 1 / the imported entropy bound of Theorem 4 as load-bearing; that is necessary. The more immediate gap for the paper’s own strongest claim (Theorem 9) is that the CC proof never discharges that bound against the adversary the ideal resource is supposed to tolerate, and the hybrid argument remains a sketch without an explicit reduction. This keeps the verdict CONDITIONAL and the confidence moderate, but shifts the primary concern from “the external hardness assumption might be false” to “the reduction that would make the hardness assumption imply the claimed ideal-resource security is missing / incomplete.” The definitional contribution and the architectural packaging remain intact; the soundness risk is precisely the unfinished proof under the stated corruption pattern.","tokens_in":28932,"tokens_out":723,"duration_ms":14846,"concrete_test":"Instantiate the full hybrid sequence of Appendix E with the concrete parameters of the trapped-ion experiment in [36] (n, M, χ, α, Q_min, T, E) and write an explicit reduction: given any classical distinguisher D that breaks the H2\to H3 step with advantage ε, construct an algorithm that either spoofs XEB above χ with fewer than Q_min honest samples or distinguishes the two-source extractor output from uniform. If no such reduction exists (or the resulting ε is only inverse-polynomial), the security claim of Theorem 9 does not go through even inside the restricted model.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that π_V (B3 || AUT || Seed_V) ≈ VRS^{B3}_U σ_{{P,E,T}} (Theorem 9), so an honest verifier obtains a publicly verifiable sample statistically close to U even when T and P are fully corrupted. The deferred proof (Appendix E) only treats a classical PPT distinguisher whose classical power is capped exactly as in the one-shot model of [36]: at most Q_C oracle queries to an honest quantum sampler, with the remainder of the string forced to be genuine quantum samples by the XEB abort of Hybrid H2. The paper itself states (Section 3.1 and Conclusion) that this is narrower than the general adversary of [37] and leaves the extension to future work. Consequently the smooth-min-entropy lower bound imported into Hybrid H3 (and therefore the extractor guarantee that makes the ideal-resource sample indistinguishable) is not shown for any adversary that can, for example, classically post-process, share quantum side-information across sessions, or exploit the multi-client / multi-block setting that the public-verifiability rules (domain separation, earliest-transcript selection, BIDmin) are meant to handle. The hybrid sketch also never exhibits an explicit reduction from a distinguishing advantage against the ideal resource to a violation of Assumption 1 or of the blockchain timing/entropy bounds; it only argues that each hybrid step is “negligible.” If those gaps are material, the strongest claim does not hold for the adversary class the paper advertises.","agreement_with_reader":"partial"},"referee_report":{"model":"grok-4.5","summary":"The paper introduces verifiable random sampling (VRS), a primitive that outputs a fresh sample statistically close to a target distribution D together with a publicly verifiable transcript, addressing collusion and grinding limitations of VRFs. It gives a concrete construction VRS^{B3^{T,E}}_U based on random circuit sampling (RCS) certified randomness, a timed batched bulletin board B3^{T,E} (instantiated by blockchain), domain separation, and a quantum-proof two-source extractor; a lift to arbitrary D uses a new rejection-sampling-with-error lemma. Security is argued in the constructive cryptography framework: correctness (Theorem 8) and the main claim that an honest verifier with corrupted client and provider obtains an ideal-resource sample (Theorem 9), with hybrids sketched in Appendix E reducing to an imported smooth min-entropy bound (Theorem 4) under Assumption 1 and block timing T ≤ τ_res.","tokens_in":29297,"tokens_out":1707,"duration_ms":37049,"significance":"If the security claim holds at the advertised strength, VRS would be a useful composable primitive for blockchain randomness, e-lotteries, and smart-contract sampling: it targets information-theoretic freshness and public verifiability where VRFs are deterministic and beacons lack strong consumer-side proofs. Strengths include a clean ideal-resource formulation in CC, an explicit multiparty protocol with on-chain timing and anti-post-selection checks, a nontrivial error-tolerant rejection-sampling lemma (Lemma 10), and grounding in experimentally demonstrated RCS certified-randomness work. The contribution is primarily definitional and architectural rather than a new hardness result; its lasting value depends on whether the security reduction can be completed for a realistic adversary class and whether the RCS/XEB assumptions and verification cost are acceptable in the intended deployments.","major_comments":[{"comment":"Theorem 9 / Appendix E: The central indistinguishability π_V(B3||AUT||Seed_V) ≈ VRS_U σ_{{P,E,T}} is only sketched. Hybrids H2–H3 import the smooth min-entropy bound of Theorem 4 for a classical PPT distinguisher limited to at most Q_C honest quantum-oracle queries (the one-shot model of [36]). The manuscript itself states (Section 3.1, Conclusion) that this is narrower than the general adversary of [37] and leaves the extension open. Without an explicit reduction from distinguishing advantage to a violation of Assumption 1 or of the B3 timing/entropy bounds—and without treating classical post-processing, cross-session quantum side information, or multi-client/multi-block interaction—the public-verifiability claim under fully corrupted T and P is not discharged at the strength advertised. Complete the proof or sharply restate the adversary class in the theorem statement and abstract.","section":"Theorem 9, Appendix E, Section 3.1"},{"comment":"Section 3.1, Assumption 1 and Theorem 4: The extractor step (Hybrid H3) and ideal-resource sample quality rest entirely on unstructuredness of RCS / hardness of spoofing XEB so that frugal rejection sampling is optimal, plus T ≤ τ_res. This is a strong, non-standard cryptographic assumption (related to but not identical to LLHA). The paper should state quantitative parameter regimes (n, M, χ, α, Q_min, E, BIDτ) under which κ_2 is large enough for a concrete extractor error, and clarify what breaks if the adversary has more classical simulation power than the frugal strategy or if block intervals are adversarially jittered within the consensus rules.","section":"Section 3.1, Assumption 1, Theorem 4"},{"comment":"Section 5.4 Figure 4 and Section A.2: Public verifiability for third-party observers and alternate corruption patterns (malicious V; all of T,P,V malicious) is handled by informal seed instantiations (future block hash, NIZK, attached seed). These are not modeled inside the ideal resource or the proven converter π_V; Theorem 9 only covers honest V with private Seed_V. Either extend the CC statement to these setups or clearly separate “core theorem” from “deployment sketches,” and specify how earliest-transcript / BIDmin / CTX checks compose when the observer is not V.","section":"Section 5.4, Section A.2, Section 2.2"},{"comment":"Section 5.3 / A.7: Security uses H^comp_min(Hash(B,aux)) ≥ E and honest mining for timestamps. Brief remarks on few-bit biasability are insufficient for a composable ideal resource: biased or withheld block entropy can correlate challenge circuits with a grinding client, and miner timestamp flexibility can stretch the effective response window beyond τ_res. The ideal B3^{T,E} should state precise failure conditions, and Theorem 9 should quantify degradation when E is reduced or T is only an honest-majority statistical bound.","section":"Section 5.3, Section A.7"}],"minor_comments":[{"comment":"Table 1 marks RB as not publicly verifiable and CR-RCS as not publicly verifiable; a short footnote defining the exact comparison criteria (who verifies, against what trust) would avoid ambiguity with existing beacon literature.","section":"Table 1"},{"comment":"Figure 1 and the Step 0–3 summary are helpful but the mapping from T/P/V interfaces in Figure 6 to the ideal resource commands in Figure 4 could be tabulated once for readability.","section":"Figure 1, Figure 4, Figure 6"},{"comment":"Notation: both Seed_chl / Seed_ext (Definition 6) and the ideal Seed^ℓ_I resource appear; unify naming. Also clarify whether Measure(⃗C|0^{n·M}⟩) is sequential single-circuit measurement or a joint measurement.","section":"Definition 6, Section 3"},{"comment":"Lemma 10: state whether M in the rejection bound is the usual envelope constant and give a short concrete example (e.g., sampling a biased bit or a small discrete D) so implementers can see 2Mε_u/(1−2Mε_u).","section":"Lemma 10, Section 6.1"},{"comment":"Related work: briefly position against other blockchain randomness designs (e.g., RANDAO + VDF, drand, threshold BLS beacons) beyond the high-level Table 1 categories.","section":"Section 1.1"},{"comment":"Typos / polish: “Prover P” vs “Provider P” in Section 5.5; “relabeling and inspection” in Theorem 8 proof is too thin even for correctness—cite extractor parameters explicitly; arXiv ID formatting and repeated author-affiliation blocks are fine for preprint but should be cleaned for journal submission.","section":"Section 5.5, Theorem 8"}],"recommendation":"major_revision","confidential_remarks":"The work is a plausible systems-crypto contribution from an industry lab building on their own RCS experiments; novelty is real at the primitive/architecture level but the security theorem is currently over-claimed relative to the deferred restricted-adversary sketch. I would not reject on assumption grounds alone—RCS certified randomness is an active line—but I would not accept until Theorem 9’s adversary model and hybrid reduction are written to journal standard. Fit is appropriate for a crypto venue that takes composable protocol design; less so if the venue expects fully reduced standard-model proofs without experimental hardness assumptions."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The useful takeaway is definitional and architectural. They name VRS, give a CC ideal resource, and wrap existing RCS certified randomness (Aaronson–Hung, Liu et al.) with a timed bulletin board so a third party can check freshness and XEB without a private challenge or local clock. Domain separation, earliest-transcript selection, and the rejection-sampling-with-error lift to arbitrary D are the concrete engineering moves. That is genuinely new relative to VRF, beacons, and plain certified randomness, and it targets a real pain point: grinding and collusion once a VRF key is fixed.\n\nWhat they do well: the threat model and use cases (smart contracts, e-lottery) are clear; the comparison table is honest; they flag that the adversary is the restricted one-shot model of [36], not the general one in [37], and leave the extension open. Correctness and the main hybrid sketch reduce cleanly to the imported smooth min-entropy bound plus a standard quantum-proof two-source extractor. The rejection-sampling-with-error lemma is a small but usable technical contribution.\n\nSoft spots, in proportion: Theorem 9’s proof is a deferred hybrid sketch, not a full reduction that discharges every public-verifiability rule under multi-session side information. Security sits on Assumption 1 (unstructured RCS / XEB hardness) and on blockchain timing and computational entropy bounds. Those are load-bearing and external; the paper does not strengthen them. No new experiment or formal-verification artifact—feasibility rides on prior RCS demos. None of that sinks the contribution; it means the strongest claim holds inside a stated, restricted model, not for every adversary the conclusion gestures at.\n\nWho it’s for: people building verifiable randomness for chains or composing quantum entropy sources in CC/UC-style frameworks. A serious editor should send it to referees. I’d engage—read the hybrids and the entropy import carefully—rather than dismiss or oversell it.","headline":"Solid packaging of RCS certified randomness into a publicly verifiable, composable sampling primitive; the security claim is real but narrower than the abstract suggests.","tokens_in":30003,"tokens_out":496,"would_cite":true,"duration_ms":16340,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Verifiable random sampling produces fresh, publicly checkable samples from any target distribution using quantum circuit sampling and a timed public ledger.","keywords":["verifiable random sampling","random circuit sampling","certified randomness","constructive cryptography","quantum-proof extractor","blockchain randomness","cross-entropy benchmarking","rejection sampling"],"falsifier":"Exhibit a classical algorithm that, within one block interval after the challenge circuits are fixed by the block hash, returns strings that pass the protocol’s XEB threshold while the smooth min-entropy of the response falls below the extractor’s requirement; the ideal-resource indistinguishability would then fail.","tokens_in":29785,"feed_emoji":"🎲","tokens_out":953,"duration_ms":21594,"temperature":0.7,"pith_summary":"Standard verifiable random functions fix a deterministic map once the public key is published, so colluding parties or grinders can precompute favorable input-output pairs. This paper defines verifiable random sampling (VRS): a multiparty protocol whose output is a fresh sample statistically close to a chosen target distribution, together with a transcript any third party can check. The concrete construction derives challenge circuits from a blockchain block hash, has a quantum provider run random circuit sampling under a block-interval deadline, and lets an honest verifier extract a near-uniform sample (then lift it to any distribution by rejection sampling with error). Security is proved in the constructive cryptography model so the protocol composes with other cryptography. The point is publicly verifiable freshness without relying on a secret key or trusting a beacon committee.","feed_headline":"Fresh public randomness from quantum circuits on-chain","feed_subtitle":"A timed ledger plus random circuit sampling yields checkable samples from any distribution.","key_machinery":"The ideal resource VRS together with the real converters that attach client, provider, and verifier to a timed bulletin board, authenticated channels, and a private extractor seed. The load-bearing step is that a timely, XEB-passing response carries enough smooth min-entropy for a quantum-proof extractor to produce a near-uniform sample that third parties can re-verify from the public transcript.","core_discovery":"The authors introduce VRS as a primitive and construct VRS from random quantum circuit sampling, a timed batched bulletin board with entropy, and a quantum-proof two-source extractor. With an honest verifier and a corrupted client and provider, the real protocol is indistinguishable from an ideal VRS resource that outputs a sample statistically close to the target distribution only when the transcript is timely, correctly derived, and passes the cross-entropy test. The same uniform sampler lifts to arbitrary distributions via a proved rejection-sampling-with-error lemma.","pith_inferences":["If block-interval timing is the only freshness clock, chain reorganizations or miner timestamp games become first-class attacks on the entropy bound and deserve explicit economic modeling.","Domain separation via context strings turns one public entropy drip into many independent per-application samples, which is a practical alternative to running many separate beacons.","Verification cost in GPU-hours remains the deployment bottleneck; parallelizing XEB checks or moving to preimage-sampling certified randomness would decide whether VRS is usable at high frequency.","The construction separates ‘prove quantum entropy existed’ from ‘expand to a named distribution,’ a split that could apply to other physical entropy sources once they have a public timing and scoring interface."],"forward_implications":["Smart contracts can derive near-uniform samples from on-chain transcripts without trusting a VRF key holder or a beacon committee.","e-lottery and leader-election protocols can enforce public fairness while keeping sample freshness against grinding and collusion.","Any distribution, not only uniform bits, becomes available by rejection sampling once a near-uniform VRS sample exists.","The same interface can later swap the RCS entropy source for a fault-tolerant NP-search certified-randomness protocol without redesigning the multiparty wrapping.","Composability in constructive cryptography lets VRS be plugged into larger multiparty protocols as a modular randomness resource."],"fun_headline_variants":["VRS from random quantum circuits keeps samples fresh and checkable","Timed ledger plus RCS yields verifiable draws from any distribution","Quantum circuit sampling for publicly verifiable fresh randomness","Verifiable random sampling defeats grinding via RCS and extractors","Composably secure VRS: timely transcripts, XEB checks, target distributions"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"Classical machines cannot usefully predict which random-circuit outputs are heavy versus light fast enough to spoof a high cross-entropy score inside the blockchain block deadline, so a passing response must still carry genuine quantum entropy.","fun_headline_variants_meta":{"raw":{"variants":["VRS from random quantum circuits keeps samples fresh and checkable","Timed ledger plus RCS yields verifiable draws from any distribution","Quantum circuit sampling for publicly verifiable fresh randomness","Verifiable random sampling defeats grinding via RCS and extractors","Composably secure VRS: timely transcripts, XEB checks, target distributions"]},"model":"grok-4.5","effort":"low","cost_usd":0.002814,"raw_usage":{"total_tokens":1010,"prompt_tokens":757,"num_sources_used":0,"completion_tokens":88,"cost_in_usd_ticks":28144000,"prompt_tokens_details":{"text_tokens":757,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":165,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":757,"tokens_out":88,"duration_ms":4690,"temperature":1.0,"reasoning_tokens":165,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-30T22:37:07.555754+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Exhibit a classical algorithm that, within one block interval after the challenge circuits are fixed by the block hash, returns strings that pass the protocol’s XEB threshold while the smooth min-entropy of the response falls below the extractor’s requirement; the ideal-resource indistinguishability would then fail.","supporting_citations":[],"review_version":1}