{"id":"25c687ba-956c-4f97-83cf-3110b18a859e","arxiv_id":"2607.28561","paper_version":1,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"Clifford-based one-time uncloneable encryption extends from one bit to arbitrary-length messages with statistical security and polynomial-time encoding.","lead":"One-time uncloneable encryption now works for messages of any length with statistical (information-theoretic) security, not just single bits. The upgrade uses Clifford-group structure so encryption stays efficient in the message length and security parameter.","discovery_kind":"extension","skeptic_critique":{"model":"grok-4.5","headline":"No significant objection identified","rationale":"The Reader correctly isolates Theorem 3.1 as the structural hinge and correctly judges that the hinge is standard finite-group Haar invariance plus the well-known fact that Cliffords act transitively on computational-basis states of fixed Hamming weight. The subsequent observable-overlap analysis (Theorem 4.2 and the Pauli calculation in §5) is self-contained and yields the optimal 1/√d scaling already known to be tight by the matching lower bound cited from BCR26. No correctness risk beyond ordinary algebraic transcription error is visible; the paper therefore supports an ACCEPT verdict with high confidence. The suggested concrete test simply double-checks the reduction on the smallest interesting parameters and does not alter the overall assessment.","tokens_in":10728,"tokens_out":501,"duration_ms":9049,"concrete_test":"Independently re-derive the equality chain in the proof of Theorem 3.1 for the concrete case n=3,m=2 (so the reduced game is on 2 qubits): expand the average over C_3 explicitly, insert the embedding I⊗U for U∈C_2, and verify that the resulting success probability is at most cd(Q_{C_2,1}). If the numerical values match the claimed inequality, the reduction is confirmed for the smallest non-trivial parameters.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim rests on two clean pieces: the Clifford-group Haar reduction of Theorem 3.1 (cd(Q_{C_n,m}) ≤ cd(Q_{C_{n-m+1},1})) and the refined observable-overlap bound of Theorem 4.2 applied to the Pauli observables of the 1-bit Clifford MoE game. Both steps are elementary and fully written out. The reduction uses only left-invariance of the uniform measure on a finite group together with the existence of a Clifford that maps any pair of distinct messages to 0^m versus 0^{m-1}1 and the embedding I⊗U; the overlap argument is a short power-series plus Cauchy-Schwarz calculation that does not rely on external black boxes. No hidden assumption or algebraic gap appears that would invalidate the multi-bit statistical-security statement when n-m=ω(log λ).","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper shows that the Clifford-based quantum encryption of classical messages (QECM) scheme, already known to give unconditional uncloneable encryption of a single bit, extends to messages of arbitrary length while retaining statistical (information-theoretic) security and efficient encryption/decryption. The argument proceeds in three steps: a group-invariance reduction (Theorem 3.1) that bounds the m-bit cloning-distinguishing value by the 1-bit value on n-m+1 qubits; a refined monogamy-of-entanglement bound for unitary observables via an observable-overlap quantity and a conditional-overlap lemma (Theorem 4.2); and an evaluation of that bound on the Pauli observables of the Clifford game, yielding cd(Q_{C_n,m}) ≤ 1/2 + (d^{3/2}-1)/(2(d^2-1)) ≤ 1/2 + 1/(2√d) with d = 2^{n-m+1} (Theorem 5.1) and the cloning-value corollary c(Q_{C_n,m}) ≤ 2^{-m} + 2^{-(n-m+1)/2}. Consequently, whenever the pad length n-m is ω(log λ), the efficient family is strongly uncloneable and strongly uncloneable-indistinguishable secure.","tokens_in":10795,"tokens_out":1114,"duration_ms":33856,"significance":"The result closes a natural open question left by the recent unconditional single-bit constructions and by computational multi-bit schemes: one-time uncloneable encryption of arbitrary-length messages admits statistical security with polynomial encoding. The reduction exploits only the Clifford group structure and Haar invariance, and the overlap analysis is elementary and self-contained; together they give a clean, essentially optimal security bound (matching the known Ω(1/√d) lower-order term). The work therefore completes the information-theoretic picture for the one-time primitive and supplies a reusable technical lemma (Theorem 4.2) of independent interest for monogamy games.","major_comments":[],"minor_comments":[{"comment":"Definitions 2.5–2.6 both introduce the symbol Q_{V,m} (once for the QECM, once for the MoE game); the subsequent text then switches to G_{V,m}. Please adopt a single consistent notation (e.g., always G for games) and fix the sentence after Def. 2.6 that still writes w(G_{V,m}).","section":"§2"},{"comment":"Opening sentence of §5: “we shown unconditional” → “we show unconditional”.","section":"§5"},{"comment":"Corollary 5.2 display: the second term is rendered as “1/2^{n-m+1}_2” in the source text; it should read 2^{-(n-m+1)/2} (or 1/2^{(n-m+1)/2}) to match the proof calculation that uses the looser 1/(2√d) bound of Theorem 5.1.","section":"Corollary 5.2"},{"comment":"In the proof of Theorem 4.2 the appeal to density of invertible matrices when handling (B-Γ) and (I-Δ) is correct but terse; a one-sentence remark that the operator-norm bound is continuous under norm-limits would make the approximation step fully explicit.","section":"§4, proof of Thm. 4.2"},{"comment":"Theorem 3.1: the reduction first replaces an arbitrary pair (x_0,x_1) by (0^m,0^{m-1}1) via a Clifford C. It would help the reader to record that conjugation by C merely relabels the attack POVMs and therefore does not change the success probability.","section":"§3"},{"comment":"References: several arXiv identifiers appear with “DOI: doi.org/...”; standardize to either arXiv: or a proper DOI link. Also “E-print arXiv:” vs “arXiv preprint” is inconsistent.","section":"References"}],"recommendation":"minor_revision","confidential_remarks":"The manuscript is short, self-contained, and appears free of load-bearing gaps; the heavy citation of the authors’ own recent preprints (BBC26a, BC26, BCR26) is natural given the rapid sequence of results but is worth a quick editorial check that the present contribution is cleanly delineated from those works. Fit for a quantum-information / cryptography journal is excellent."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"This paper finishes the one-time story: once you have efficient unconditional security for a single uncloneable bit via Cliffords, the same scheme extends to arbitrary-length messages with statistical security and poly-time encode/decode, provided you pad by ω(log λ) qubits.\n\nWhat is new is short and useful. Theorem 3.1 uses left-invariance of the uniform measure on the finite Clifford group (plus the existence of a Clifford that maps any pair of messages to 0^m vs 0^{m-1}1 and the embedding I⊗U) to reduce the m-bit cloning-distinguishing value to the 1-bit value on n-m+1 qubits. Section 4 then gives a streamlined observable-overlap bound for unitary-observable MoE games (conditional-overlap lemma + power-series control of the resolvent), which is applied in §5 to the Pauli observables excluding identity. The resulting distinguishing bound matches the order of the BCR26 lower bound, and the cloning-value corollary follows by a simple random-message reduction. The algebra is elementary and fully written out; no free parameters, no black-box leaps.\n\nSoft spots are minor. The argument inherits whatever residual risk lives in the single-bit Clifford analyses it cites, and the paper is almost entirely self-referential to the authors’ recent sequence, but the new theorems stand on their own and the lower-bound citation is appropriate. Efficiency is claimed via standard Clifford generation; nothing is machine-checked, but the proofs are short enough to verify by hand.\n\nThis is for people already working on uncloneable encryption, monogamy games, or Clifford twirling. A serious referee should see it. I would cite the reduction and the optimal-order bound, and I would accept it for peer review without hesitation.","headline":"Clean group-invariance reduction plus a tight MoE bound closes statistical multi-bit uncloneable encryption for the Clifford scheme.","tokens_in":11552,"tokens_out":461,"would_cite":true,"duration_ms":8411,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":["03.67.Dd","03.67.Hk"],"model":"grok-4.5","headline":"One-time uncloneable encryption of messages of any length is statistically secure, with efficient Clifford encoding.","keywords":["uncloneable encryption","Clifford group","monogamy of entanglement","statistical security","quantum encryption of classical messages","cloning-distinguishing attacks","observable overlap"],"falsifier":"Exhibit an explicit cloning or cloning-distinguishing attack on the n-qubit m-bit Clifford scheme whose success probability exceeds 1/2 + 1/(2√(2^{n-m+1})), or show that some attack family cannot be reduced via the Clifford group action to a one-bit instance.","tokens_in":11503,"feed_emoji":"🔐","tokens_out":946,"duration_ms":22696,"temperature":0.7,"pith_summary":"Uncloneable encryption lets a sender encode a classical message as a quantum state so that an adversary who tries to split the ciphertext between two receivers cannot make both recover the message. Single-bit schemes with unconditional security and efficient encoding were already known; this paper shows the same holds for messages of arbitrary length. The authors take the Clifford unitary encoding used for one bit and, using the group structure of the Cliffords, reduce any multi-bit cloning-distinguishing attack to a one-bit attack on fewer qubits. A refined monogamy-of-entanglement bound then gives a security advantage that vanishes as the number of extra qubits grows. The result is an efficient one-time scheme whose cloning success probability is at most the trivial guessing probability plus a term that is negligible whenever the padding is super-logarithmic in the security parameter.","feed_headline":"Uncloneable encryption now works for any message length","feed_subtitle":"Clifford encoding gives statistical security with only polynomial encoding time","key_machinery":"Haar invariance of the uniform measure on the finite Clifford group (Theorem 3.1): any cloning-distinguishing attack on m-bit Clifford ciphertexts translates into a one-bit attack against the Clifford group on n-m+1 qubits, after which an observable-overlap bound on monogamy-of-entanglement games controls the advantage.","core_discovery":"For the Clifford quantum encryption scheme on n qubits encrypting m-bit messages, the cloning-distinguishing value is at most 1/2 + (d^{3/2}-1)/(2(d^2-1)) where d = 2^{n-m+1}, which is at most 1/2 + 1/(2√d). Consequently the cloning value itself is at most 2^{-m} + 2^{-(n-m+1)/2}. Whenever n-m grows faster than the log of the security parameter, the efficient family is therefore strongly uncloneable and strongly uncloneable-indistinguishable secure.","pith_inferences":["The same group-invariance reduction should apply to other unitary designs that contain a large Clifford subgroup, potentially yielding uncloneable schemes from weaker randomness sources.","Because the bound is tight up to constants, practical parameter selection reduces to choosing padding length slightly larger than twice the security parameter in bits.","The technique separates the combinatorial structure of the Clifford group from the analytic monogamy bound, suggesting a modular template for other uncloneable primitives built on designs."],"forward_implications":["One-time uncloneable encryption of arbitrary-length classical messages admits statistical security with polynomial-time encryption and decryption.","The security gap matches the known optimal lower-bound order Θ(2^{-(n-m)/2}), so the Clifford scheme is essentially tight.","Reusable uncloneable encryption remains only computationally secure; the information-theoretic barrier is confined to the multi-use setting.","Any further improvement in single-bit Clifford monogamy bounds immediately upgrades the multi-bit security parameter via the same reduction."],"fun_headline_variants":["Statistical uncloneable encryption reaches arbitrary message lengths","Clifford encoding upgrades uncloneable encryption to any message size","Uncloneable encryption of arbitrary messages now statistically secure","Polynomial-time Clifford scheme secures uncloneable encryption for any length","Arbitrary messages gain statistical uncloneable encryption via Cliffords"],"cache_read_input_tokens":128,"weakest_assumption_plain":"The reduction step assumes that the uniform distribution over Clifford unitaries is invariant under left group action in a way that faithfully converts every multi-bit attack into a one-bit attack on a smaller Clifford subgroup; if that translation fails for some attacks, the multi-bit bound does not follow.","fun_headline_variants_meta":{"raw":{"variants":["Statistical uncloneable encryption reaches arbitrary message lengths","Clifford encoding upgrades uncloneable encryption to any message size","Uncloneable encryption of arbitrary messages now statistically secure","Polynomial-time Clifford scheme secures uncloneable encryption for any length","Arbitrary messages gain statistical uncloneable encryption via Cliffords"]},"model":"grok-4.5","effort":"low","cost_usd":0.004654,"raw_usage":{"total_tokens":1268,"prompt_tokens":684,"num_sources_used":0,"completion_tokens":65,"cost_in_usd_ticks":46544000,"prompt_tokens_details":{"text_tokens":684,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":519,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":684,"tokens_out":65,"duration_ms":8102,"temperature":1.0,"reasoning_tokens":519,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T03:39:51.939108+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Exhibit an explicit cloning or cloning-distinguishing attack on the n-qubit m-bit Clifford scheme whose success probability exceeds 1/2 + 1/(2√(2^{n-m+1})), or show that some attack family cannot be reduced via the Clifford group action to a one-bit instance.","supporting_citations":[],"review_version":1}