(2,m)-threshold quantum data hiding

Donghoon Ha; Jeong San Kim

(2,m)-threshold quantum data hiding

T0 review · 0 major / 6 minor · reviewed 2026-07-10 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Any pair of parties can unlock a hidden quantum bit

desk verdict First (2,m)-threshold quantum data hiding scheme; proofs check out, one-bit limitation is the main drawback read the letter →

arxiv 2607.08070 v1 pith:LMNY76EU submitted 2026-07-09 quant-ph

Donghoon Ha , Jeong San Kim This is my paper

classification quant-ph PACS 03.67.Dd03.67.Hk03.67.-a

keywords quantumdatahidingthresholdschemestatediscriminationLOCCPPTboundseparablestatesmultipartyinformation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper constructs a quantum data-hiding scheme for one classical bit shared among m parties where the threshold for recovery is set at just two: any pair of parties, by performing a joint quantum measurement on their shared subsystem, can perfectly recover the hidden bit, while all m parties together using only local operations and classical communication (LOCC) learn arbitrarily little. The construction works by having every pair of parties share a copy of a two-party state ensemble whose PPT discrimination probability (an upper bound on LOCC discrimination) is exponentially close to random guessing. The hidden bit is encoded via a classical one-time-pad structure on the publicly broadcast bit-strings, so that recovering the bit reduces to discriminating one two-party subsystem. The multiparty LOCC bound is obtained by decomposing the PPT discrimination probability of the full tensor-product ensemble into an additive sum of two-party PPT bounds (Theorem 3), which then inherits the near-random-guessing property of each building-block pair. Crucially, the entire construction uses only separable (unentangled) states of low-dimensional systems, such as two-qutrit states, showing that entanglement is not a necessary resource for multiparty quantum data hiding.

What carries the argument

The key machinery is Theorem 3, which bounds the optimal PPT discrimination probability of a multiparty tensor-product ensemble by the sum of the PPT discrimination probabilities of its two-party components. This is combined with a two-party orthogonal separable state ensemble (Example 1, based on 3x3 systems) whose PPT discrimination probability converges exponentially to 1/2 as the sequence length L increases (Proposition 1), yielding the near-random-guessing guarantee. The encoding uses a one-time-pad-like classical bit-string broadcast so that recovering the hidden bit x is equivalent to discriminating one specific two-party subsystem.

What would settle it

The scheme would fail if there existed an LOCC measurement (or even a PPT measurement) on the full multiparty state that discriminates the hidden bit with probability significantly exceeding 1/2 + C(m,2)*epsilon, which would require the additive bound of Theorem 3 to be violated or the two-party PPT building blocks to not achieve near-random-guessing discrimination.

Watch

Extended reading notes

Core claim

The central result is that a (2,m)-threshold quantum data-hiding scheme exists for one classical bit: any two parties can perfectly recover the bit via joint measurement, while LOCC by all m parties is bounded by p_L(E) <= 1/2 + C(m,2)*epsilon for arbitrarily small epsilon. This is achieved by tensoring two-party PPT-state ensembles whose optimal PPT discrimination is near random guessing, and proving that the multiparty PPT bound decomposes additively over the two-party subsystems. The scheme is realizable with separable states only.

Load-bearing premise

The security proof bounds the LOCC discrimination probability by the PPT discrimination probability, and then bounds the latter via an additive decomposition over two-party subsystems. This additive upper bound is proven but may not be tight; the actual LOCC leakage could be lower than proven, meaning the scheme may be more secure than the proof establishes but the guarantee rests on the bound holding.

Editorial extensions

If this is right

The existence of a (2,m)-threshold scheme with separable states opens a path to (k,m)-threshold schemes for general 2 <= k < m, bridging the gap between the existing (m,m)-threshold schemes and this (2,m) result.
Since the construction uses only separable states of low dimension, it may be more experimentally accessible than entanglement-based hiding schemes, potentially enabling near-term demonstrations.
The additive PPT bound decomposition (Theorem 3) may be applicable to other multiparty state discrimination problems beyond data hiding, wherever tensor-product ensembles of PPT states arise.
Extending the scheme from one bit to multiple bits while preserving the (2,m)-threshold property is identified by the authors as a natural open question.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the additive PPT bound in Theorem 3 is tight or near-tight for certain ensembles, the scheme's security could be characterized more precisely, potentially revealing a tradeoff between the number of parties m and the achievable LOCC leakage.
The use of separable states suggests that the hiding phenomenon here is fundamentally about the nonlocality of state discrimination rather than entanglement per se, which could reframe the resource-theoretic understanding of quantum data hiding.
A (k,m)-threshold generalization might be constructible by replacing the pairwise-sharing structure with a k-wise sharing structure, though the additive bound decomposition would need a corresponding generalization.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The headline: this paper constructs the first (2,m)-threshold quantum data-hiding scheme, meaning any two of m parties can jointly recover a hidden bit while all m parties together learn almost nothing via LOCC. That fills a real gap between two-party hiding and the (m,m)-threshold case from the authors' earlier work. The core idea is clean: tensor two-party PPT hiding ensembles across all pairs of parties, then use XOR-encoded public bit strings to control who can recover what. Any pair measures their shared subsystem and combines with the public string; LOCC is bounded away because the PPT discrimination probability decomposes additively across pairs. The math is solid. Theorems 1 and 2 give a dual characterization of PPT discrimination and a trace-norm reformulation for two-state ensembles, both proven in full in the appendices. Theorem 3 is the key multiparty bound, and its proof in Appendix C uses a standard telescoping identity plus triangle inequality arguments that I checked step by step. The two-party building block comes from the authors' own published work (Example 1, from [17]) with explicit qutrit states and verifiable trace-norm values, so there's no circularity concern. The stress-test note confirming no load-bearing flaw is accurate. The soft spots are real but minor. First, the scheme hides exactly one bit, and the paper acknowledges this without suggesting how to extend to multiple bits. Second, the LOCC bound goes through PPT (p_L ≤ p_PPT), so it's an upper bound on an upper bound. This is standard in the data-hiding literature and not a weakness per se, but it means the actual LOCC information leakage could be even smaller than proven. Third, the number of subsystems each party holds grows as m-1, so the scheme doesn't scale gracefully to large m, though for fixed m the security parameter only needs logarithmic growth in the sequence length. This is a well-constructed paper that does what it claims. It's for researchers in quantum state discrimination and quantum cryptography who care about the threshold structure of data hiding. The open questions about multi-bit encoding and k > 2 thresholds are natural next steps that the paper correctly identifies. It deserves a serious referee.

Referee Report

0 major / 6 minor

Summary. This paper proposes the first (2,m)-threshold quantum data-hiding scheme for one classical bit shared among m parties. In the scheme, any pair of parties can perfectly recover the hidden bit via a joint measurement on their shared two-party subsystem, while LOCC measurements by all m parties reveal only an arbitrarily small amount of information. The construction uses only separable states of low-dimensional (qutrit) quantum systems. The technical core consists of three theorems: Theorem 1 gives a dual (SDP) characterization of the optimal PPT discrimination probability p_PPT(E); Theorem 2 reformulates this for two-state ensembles as a trace-norm minimization; and Theorem 3 provides an additive upper bound on the multiparty PPT discrimination probability in terms of two-party PPT bounds. The hiding guarantee follows from the chain p_L(E) ≤ p_PPT(E) ≤ 1/2 + C(m,2)·ε (Inequality 34), where ε can be made arbitrarily small by increasing the sequence length L of the two-party building-block ensemble (Proposition 1, Example 1, from the authors' prior work [17]).

Significance. The paper addresses a natural and previously open problem: prior work established (m,m)-threshold schemes (requiring all parties to collaborate), and this work fills the gap for k=2. The (2,m)-threshold property is a meaningful intermediate collaboration requirement. The use of separable states is a notable practical advantage, as it avoids the need for entangled resources. The proofs in Appendices A–C are complete and rigorous: the SDP duality argument in Appendix A is standard but correctly executed, the trace-norm reformulation in Appendix B is clean, and the multiparty decomposition in Appendix C via the telescoping identity (Eq. C4) and triangle inequality is the key technical step and is sound. The two-party building block from [17] provides explicit states with verifiable trace-norm values (Tr|H|=5/12, Tr|H^PT|=7/12, Eq. D12) and exponential convergence to random guessing (Eq. D13).

minor comments (6)

Section III, Inequality (34): The bound is 1/2 + C(m,2)·ε. While the text correctly notes that ε can be chosen arbitrarily small, it would help the reader to state explicitly that for a target hiding gap δ, one needs ε = δ/C(m,2), and since ε decreases exponentially in L (Proposition 1, Eq. D13), the required sequence length L grows only as O(log m). This scaling is implicit but never made explicit, and it is relevant to the practical feasibility claim.
Section III, Eq. (32): The encoding rule for c_{k,k'} distinguishes the cases (k,k') = (α,α') and (k,k') ≠ (α,α'). It would improve readability to briefly restate the recovery procedure for an arbitrary pair (k,k') ≠ (α,α') in the main text (not just in the figure caption), since the mechanism — measure b_{k,k'} from the shared state, compute b_{α,α'} = c_{k,k'} ⊕ b_{k,k'}, then x = c_{α,α'} ⊕ b_{α,α'} — is central to understanding why any pair suffices.
Figure 2: The figure caption for panel (b) uses (α,α') = (1,2), which is helpful. However, the connection between the bit string c⃗ and the recovery procedure could be made more explicit in the figure or its caption, as the current description requires the reader to reconstruct the recovery logic from Eq. (32).
Appendix D, Proposition 1: The proposition is stated without proof and attributed to [17, 19]. Since this is a load-bearing ingredient, a brief proof sketch or a more precise reference to where the proof appears would strengthen the self-containedness of the paper.
Section IV (Discussion): The paper mentions that analogous constructions are possible for arbitrary local dimension d ≥ 2 [17–19]. It would be useful to briefly state whether the qutrit construction (Example 1) is optimal in any sense (e.g., minimal local dimension), or whether d=2 (qubit) constructions also exist.
Typographical: In Eq. (D13), the expression (35/36)^{L/2} should perhaps be written as ((35/36)^{1/2})^L or (35/36)^{L/2} with explicit parentheses to avoid ambiguity about whether the exponent L/2 applies to the full fraction.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity found; one minor self-citation that is not load-bearing

full rationale

The paper's central derivation chain is self-contained. The main result (Inequality 34) follows from: (1) the standard fact p_L(E) ≤ p_PPT(E), (2) Theorem 3's additive decomposition of multiparty PPT discrimination into two-party bounds (proven in Appendix C via a telescoping identity and triangle inequality), and (3) the existence of two-party orthogonal PPT states with near-random PPT discrimination. For ingredient (3), the paper cites the authors' own work [17] (Example 1, Eq. D10-D13), but this citation provides explicit, verifiable states with concrete trace-norm values (Tr|H|=5/12, Tr|H^PT|=7/12) and a parameter-free exponential convergence bound (Eq. D13). The cited result is externally falsifiable: one can independently verify the states are orthogonal PPT separable states and check the trace-norm computation. This is not a case where the cited result is defined in terms of the target conclusion. The multiparty bound (Theorem 3) is proven from first principles within the paper. The scheme construction (Eqs. 24, 33) and recovery protocol are straightforward and do not reduce to their own inputs. The only self-citation ([17]) provides a building block with independently checkable parameters, not a circular definition. This warrants a score of 2, not higher, because the self-citation is not load-bearing in the circular sense — it provides concrete states with verifiable properties rather than an unverified uniqueness claim or a fitted parameter renamed as prediction.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical entities, particles, or forces. The scheme uses standard quantum states (separable qutrit states) and standard mathematical objects (PPT cones, density operators). All constructions are explicit. The free parameters (epsilon, L, alpha pair) are protocol parameters, not fitted constants.

free parameters (3)

epsilon = arbitrarily small > 0
Controls the LOCC leakage bound; chosen by selecting the sequence length L in the two-party building block ensemble (Proposition 1, Eq. D9). Not fitted to data but a tunable security parameter.
L (sequence length) = positive integer, chosen to achieve desired epsilon
Determines the two-party PPT discrimination bound via (35/36)^{L/2} (Eq. D13). Larger L gives smaller epsilon but larger quantum systems.
(alpha, alpha') pair = fixed but arbitrary, e.g. (1,2)
Selects which pair's quantum state directly encodes the hidden bit x in the broadcast protocol (Eq. 32). Arbitrary choice that does not affect security.

assumptions (3)

standard math Every LOCC measurement is a PPT measurement (p_L(E) <= p_PPT(E))
Standard result in quantum information [9, 16], invoked in Inequality (14) to bound LOCC discrimination by PPT discrimination.
domain assumption Existence of two-party orthogonal PPT states with p_PPT arbitrarily close to 1/2
Invoked in Eq. (27) and Appendix D, based on [17-19]. The specific construction (Example 1) is verified but the existence result is a prerequisite for the scheme.
standard math Self-duality of the PPT cone (PPT*_k = PPT_k)
Used in Eq. (5) and (7) to derive the dual cone structure underlying Theorem 1. Standard result from convex analysis and quantum information.

how reviews work

0 comments

Cite this review

Pith. "Pith review of (2,m)-threshold quantum data hiding." pith.science (2026). https://pith.science/paper/LMNY76EU

@misc{pith2026260708070,
  author       = {Pith},
  title        = {Pith review of: (2,m)-threshold quantum data hiding},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LMNY76EU}},
  note         = {Machine review of arXiv:2607.08070}
}

read the original abstract

We consider multiparty quantum state discrimination and present a multiparty quantum data-hiding scheme for one classical bit to be shared among multiple parties. In the proposed scheme, any pair of parties can collaborate to perfectly recover the hidden bit through a joint measurement, whereas measurements based on local operations and classical communication(LOCC) performed even by all parties reveal only an arbitrarily small amount of information. We further provide bounds on the optimal LOCC discrimination of multiparty quantum states. The proposed scheme can be implemented using only separable states of low-dimensional quantum systems, enhancing its practical feasibility.

Figures

Figures reproduced from arXiv: 2607.08070 by the authors.

**Figure 2.** FIG. 2 [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 25 canonical work pages

[17]

Sandgren, On convex cones, Math

L. Sandgren, On convex cones, Math. Scand.2, 19 (1954)

work page 1954
[1]

Figure 2 illustrates the proposed(2, m)-threshold data-hiding scheme for the case ofm= 3with(α, α ′) = (1,2)

(31) defined by ck,k′ = bα,α′ ⊕x ,(k, k ′) = (α, α′), bα,α′ ⊕b k,k′ ,(k, k ′)̸= (α, α ′), (32) where ⊕ is the modulo-2addition and( α, α′)is a fixed but arbitrary pair satisfying1 ⩽α < α ′ ⩽m . Figure 2 illustrates the proposed(2, m)-threshold data-hiding scheme for the case ofm= 3with(α, α ′) = (1,2). As the bitcα,α′ is publicly revealed, determining the...

work page 2025
[2]

Now, let us consider the situation of guessing the parityω2(⃗ s)for a quantum sequenceρ⃗ sprepared from the ensemble E ⊗L in Eq

This representation gives rise to thequantum sequence ensemble E ⊗L ={η ⃗ s, ρ⃗ s}⃗ s∈ZL 2 .(D4) We note that the quantum sequences ofE ⊗L are PPT whenever the statesρ0 and ρ1 of the ensembleE are PPT, and are mutually orthogonal wheneverρ0 andρ 1 are orthogonal. Now, let us consider the situation of guessing the parityω2(⃗ s)for a quantum sequenceρ⃗ spre...

work page
[3]

The following proposition provides a sufficient condition under which the optimal PPT discrimination ofE (L) in Eq

This situation is equivalent to discriminating the states from the two-state ensemble E (L) ={η (L) 0 , ρ(L) 0 ;η (L) 1 , ρ(L) 1 }(D6) where each stateρ(L) i is prepared with probabilityη(L) i , and η(L) i = X ⃗ s∈ZL 2 ω2(⃗ s)=i η⃗ s, ρ (L) i = 1 η(L) i X ⃗ s∈ZL 2 ω2(⃗ s)=i η⃗ sρ⃗ s,(D7) fori∈ {0,1}. The following proposition provides a sufficient conditi...

work page
[4]

Shamir, How to share a secret, Commun

A. Shamir, How to share a secret, Commun. ACM22, 612 (1979). 13

work page 1979
[5]

B. M. Terhal, D. P. DiVincenzo, and D. W. Leung, Hiding bits in Bell states, Phys. Rev. Lett.86, 5801 (2001)

work page 2001
[6]

D. P. DiVincenzo, D. W. Leung, and B. M. Terhal, Quantum data hiding, IEEE Trans. Inf. Theory48, 580 (2002)

work page 2002
[7]

Eggeling and R

T. Eggeling and R. F. Werner, Hiding classical data in multipartite quantum states, Phys. Rev. Lett.89, 097905 (2002)

work page 2002

Show all 25 references

[8]

C. Lupo, M. M. Wilde, and S. Lloyd, Quantum Data Hiding in the Presence of Noise, IEEE Trans. Inf. Theory62, 3745 (2016)

2016
[9]

L. Lami, C. Palazuelos, and A. Winter, Ultimate Data Hiding in Quantum Mechanics and Beyond, Commun. Math. Phys. 361, 661 (2018)

2018
[10]

Lami, Quantum data hiding with continuous-variable systems, Phys

L. Lami, Quantum data hiding with continuous-variable systems, Phys. Rev. A104, 052428 (2021)

2021
[11]

Ha and J

D. Ha and J. S. Kim, Nonlocal quantum state ensembles and quantum data hiding, Phys. Rev. A109, 052418 (2024)

2024
[12]

Ha and J

D. Ha and J. S. Kim, Multi-player quantum data hiding by nonlocal quantum state ensembles, Quantum Inf. Process.24, 132 (2025)

2025
[13]

Boyd and L

S. Boyd and L. Vandenberghe,Convex Optimization(Cambridge University Press, Cambridge, 2004)

2004
[14]

When C is a cone in a real vector spaceV equipped with an inner product⟨·,·⟩, the dual cone ofC is defined as the set of all vectorsv∈Vsatisfying⟨v, w⟩⩾0for allw∈C
[15]

Peres, Separability criterion for density matrices, Phys

A. Peres, Separability criterion for density matrices, Phys. Rev. Lett.77, 1413 (1996)

1996
[16]

In two-party quantum systems, the eigenvalues of a partially transposed operator do not depend on the choice of basis or on the subsystem to be transposed
[18]

C. W. Helstrom, Quantum detection and estimation theory, J. Stat. Phys.1, 231 (1969)

1969
[19]

Chitambar, D

E. Chitambar, D. Leung, L. Mančinska, M. Ozols, and A. Winter, Everything you always wanted to know about LOCC (but were afraid to ask), Commun. Math. Phys.328, 303 (2014)

2014
[20]

Ha and J

D. Ha and J. S. Kim, Quantum data-hiding scheme using orthogonal separable states, Phys. Rev. A111, 052405 (2025)

2025
[21]

F. A. Mele and L. Lami, Optimising quantum data hiding, arXiv:2510.03538
[22]

Ha and J

D. Ha and J. S. Kim, Quantum data hiding with two-qubit separable states, arXiv:2512.15095
[23]

When S and S′ are disjoint convex sets in a real vector spaceV with an inner product⟨·,·⟩, there existx∈R and ⃗ y∈V\ {⃗0} such that⟨⃗ v, ⃗ y⟩⩽x⩽⟨⃗ w, ⃗ y⟩for all⃗ v∈Sand all⃗ w∈S′
[24]

Ha and J

D. Ha and J. S. Kim, Factorizability of multi-party quantum sequence discrimination under local operations and classical communication, arXiv:2508.05050
[25]

Ha and J

D. Ha and J. S. Kim, Factorizability of optimal quantum sequence discrimination under maximum-confidence measurements, Phys. Rev. A113, 022453 (2026)

2026

Pith tools

Reviewed July 10, 2026 · model on record in the stance chip above.

[1] [17]

Sandgren, On convex cones, Math

L. Sandgren, On convex cones, Math. Scand.2, 19 (1954)

work page 1954

[2] [1]

Figure 2 illustrates the proposed(2, m)-threshold data-hiding scheme for the case ofm= 3with(α, α ′) = (1,2)

(31) defined by ck,k′ = bα,α′ ⊕x ,(k, k ′) = (α, α′), bα,α′ ⊕b k,k′ ,(k, k ′)̸= (α, α ′), (32) where ⊕ is the modulo-2addition and( α, α′)is a fixed but arbitrary pair satisfying1 ⩽α < α ′ ⩽m . Figure 2 illustrates the proposed(2, m)-threshold data-hiding scheme for the case ofm= 3with(α, α ′) = (1,2). As the bitcα,α′ is publicly revealed, determining the...

work page 2025

[3] [2]

Now, let us consider the situation of guessing the parityω2(⃗ s)for a quantum sequenceρ⃗ sprepared from the ensemble E ⊗L in Eq

This representation gives rise to thequantum sequence ensemble E ⊗L ={η ⃗ s, ρ⃗ s}⃗ s∈ZL 2 .(D4) We note that the quantum sequences ofE ⊗L are PPT whenever the statesρ0 and ρ1 of the ensembleE are PPT, and are mutually orthogonal wheneverρ0 andρ 1 are orthogonal. Now, let us consider the situation of guessing the parityω2(⃗ s)for a quantum sequenceρ⃗ spre...

work page

[4] [3]

The following proposition provides a sufficient condition under which the optimal PPT discrimination ofE (L) in Eq

This situation is equivalent to discriminating the states from the two-state ensemble E (L) ={η (L) 0 , ρ(L) 0 ;η (L) 1 , ρ(L) 1 }(D6) where each stateρ(L) i is prepared with probabilityη(L) i , and η(L) i = X ⃗ s∈ZL 2 ω2(⃗ s)=i η⃗ s, ρ (L) i = 1 η(L) i X ⃗ s∈ZL 2 ω2(⃗ s)=i η⃗ sρ⃗ s,(D7) fori∈ {0,1}. The following proposition provides a sufficient conditi...

work page

[5] [4]

Shamir, How to share a secret, Commun

A. Shamir, How to share a secret, Commun. ACM22, 612 (1979). 13

work page 1979

[6] [5]

B. M. Terhal, D. P. DiVincenzo, and D. W. Leung, Hiding bits in Bell states, Phys. Rev. Lett.86, 5801 (2001)

work page 2001

[7] [6]

D. P. DiVincenzo, D. W. Leung, and B. M. Terhal, Quantum data hiding, IEEE Trans. Inf. Theory48, 580 (2002)

work page 2002

[8] [7]

Eggeling and R

T. Eggeling and R. F. Werner, Hiding classical data in multipartite quantum states, Phys. Rev. Lett.89, 097905 (2002)

work page 2002