Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations

Fengxia Liu; Kun Tian; Yi Zhang; Zixian Gong

arxiv: 2606.27994 · v1 · pith:FDUWIN4Mnew · submitted 2026-06-26 · 🪐 quant-ph · cs.CR

Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations

Zixian Gong , Kun Tian , Yi Zhang , Fengxia Liu This is my paper

Pith reviewed 2026-06-29 04:23 UTC · model grok-4.3

classification 🪐 quant-ph cs.CR

keywords quantum private set intersectionthreshold private set intersectionmultiparty quantum protocolhidden-label measurementoblivious linear evaluationgarbled circuitquantum cryptographycardinality testing

0 comments

The pith

A quantum protocol uses sequential photon rotations to let multiple parties test intersection size against a threshold while keeping measurement meanings hidden from the third party.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper constructs a multiparty threshold private set intersection protocol on quantum hardware. Single-photon sequences pass through participant data rotations, third-party masking rotations, and aggregate rotations to generate hidden-label measurement vectors. The third party performs the final measurement but cannot extract semantic content from the outcomes. An oblivious linear evaluation computes an inner product and a garbled circuit evaluates the threshold predicate, revealing only whether the intersection cardinality meets the preset value before any conditional reconstruction occurs. Correctness and security are established by direct proof, with circuit simulations confirming operational feasibility.

Core claim

The protocol develops a rotation-based quantum construction in which single-photon sequences are sequentially processed through participant-side data rotations, TP-participant masking rotations, and correlated aggregate rotations. This design produces hidden-label measurement vectors: TP can complete the final measurement, but cannot interpret the semantic meaning of the outcomes. Based on these hidden measurements, the protocol realizes the threshold decision through an OLE-based inner product procedure and a lightweight garbled circuit, revealing only 1[|∩Xi| ≥ τ] before conditional intersection reconstruction.

What carries the argument

The rotation-based quantum construction on single-photon sequences that yields hidden-label measurement vectors, followed by OLE inner-product evaluation and garbled-circuit threshold testing.

If this is right

Only the boolean threshold indicator is released; the actual intersection set remains unrevealed until the threshold is confirmed.
Security holds against collusion between the third party and any subset of participants.
The protocol supports an arbitrary number of parties without requiring the third party to learn private inputs.
Quantum-circuit simulations on standard platforms confirm that the rotation sequence and post-processing steps execute as specified.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The hidden-label technique could be reused for other cardinality-dependent predicates in quantum multiparty computation.
Replacing the classical OLE and garbled circuit with fully quantum subroutines might eliminate the hybrid classical-quantum boundary.
The same masking structure may apply to verifiable quantum set-union or set-difference operations under threshold conditions.

Load-bearing premise

Sequential masking rotations must render the final measurement outcomes semantically uninterpretable to the third party while still permitting correct threshold computation.

What would settle it

An explicit demonstration that the third party can recover the intersection cardinality or any element identities directly from the measurement statistics would falsify the hidden-label security property.

Figures

Figures reproduced from arXiv: 2606.27994 by Fengxia Liu, Kun Tian, Yi Zhang, Zixian Gong.

**Figure 1.** Figure 1: Overview of the proposed MP-QPSI protocol. QOTP Traps |σ ′ 1 ⟩ |σ ′ 2 ⟩ . . . . . . |σ ′m⟩ |0⟩ . . . . . . |0⟩ |+⟩ . . . . . . |+⟩ |σ⟩ CSS Encode Permutationπ Xa1 Z b1 σe |0⟩ Xa2 Z b2 . . . |0⟩ Xam Z bm |0⟩⊗m ⊗ |+⟩⊗m Xam+1 Z bm+1 Xa2m Z b2m Xa2m+1 Z b2m+1 Xa3m Z b3m [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

**Figure 2.** Figure 2: Quantum Circuit of Encryption. one gadget generated by GadgetGen based on the gardenhose model [BFS+13]. At the same time, the corresponding classical QOTP-key ciphertexts are homomorphically recrypted, so that after processing all 𝑡 𝖳-gates the final keys are encrypted under the last-level public key 𝑝𝑘𝑡 . To maintain authentication security in the sense of [BW16], due to the introduction of the trap co… view at source ↗

**Figure 3.** Figure 3: Decomposition of the three-controlled AND with v-chain ancilla. 0000 0010 0100 0110 1000 1010 1100 1111 Measurement Outcome 0.0 0.2 0.4 0.6 0.8 1.0 Quasi Probability 0.140 0.122 0.142 0.128 0.113 0.118 0.125 0.113 [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

**Figure 4.** Figure 4: The Measurement outcome of 𝑞4 together with the 𝑞0 , 𝑞1 , 𝑞2 in uniform superposition. (1) TP learns nothing about the private sets of 𝑃𝑖 ; (2) Any outside eavesdropper is unable to learn anything about the private sets of 𝑃𝑖 ; (3) 𝑃𝑖 cannot obtain extra information about the private sets of other participants beyond the intersection, even when conspiring with other participants or TP. Theorem 1 (Privacy a… view at source ↗

**Figure 5.** Figure 5: The Real-world (left) and Ideal-world (right) model. not reveal meaningful information due to the maximally mixed states. Theorem 3. Let 𝐶 be any subset of corrupted participants with |𝐶| < 𝑡. Even if the parties in 𝐶 collude with the TP, they obtain no information about the honest parties’ private sets beyond the intersection. Proof. (1) Intercepting honest channels to TP. The coalition 𝐶 may try to i… view at source ↗

**Figure 6.** Figure 6: Modularly encapsulated hybrid of 𝐻0 . adversary  = (𝖳𝖯, 𝐶 ) who controls both the TP and the corrupted parties. By Theorem 3 and SS privacy (Definition 5), any information about the honest private sets that can be obtained jointly by 𝖳𝖯 and 𝐶 can be closely simulated from the view of the unified adversary . For 𝖠𝖽𝗏𝖧𝗒𝖻H2 H1 (): | | | Pr[ (𝗏𝗂𝖾𝗐H1  ( ⋅)) = 1] −Pr[ (𝗏𝗂𝖾𝗐H2  ( ⋅ , {𝑘𝑖 , 𝑠𝑘𝑖 }𝑖∈𝐶)) … view at source ↗

**Figure 7.** Figure 7: CCCZ circuit built using only 6 T gates. can be seen as the composition of a small number of blackbox modules: (i) a threshold layer makes the scheme resistant to collusion of the participants; (ii) a vQFHE layer against any deviation from the target circuit; (iii) a logical quantum circuit implementing the desired set operation. Consequently, different circuit instantiations or alternative QHE construct… view at source ↗

**Figure 8.** Figure 8: Multi-Open-Controlled X Gate 5.3. Alternative vQHE Instantiations The verifiability of the underlying vQFHE scheme is what gives our MP-QPSI protocol its distinguishing ability to detect a TP that deviates from the prescribed circuit. In Protocol 1 we instantiate this layer with TrapTP [ADS+17], the first vQFHE construction, whose complicate encoding and trap structure yield very strong security guarantees… view at source ↗

read the original abstract

Threshold private set intersection (TPSI) allows parties to reveal their intersection only when its cardinality reaches a prescribed threshold. Existing quantum TPSI protocols typically rely on a third party (TP) to interpret the final results, which deviates from the cardinality-testing paradigm of TPSI. In this paper, we propose a quantum multiparty TPSI protocol with explicit cardinality testing. Our protocol develops a rotation-based quantum construction in which single-photon sequences are sequentially processed through participant-side data rotations, TP--participant masking rotations, and correlated aggregate rotations. This design produces hidden-label measurement vectors: TP can complete the final measurement, but cannot interpret the semantic meaning of the outcomes. Based on these hidden measurements, we further realize the threshold decision through an oblivious linear evaluation (OLE)-based inner product procedure and a lightweight garbled circuit, revealing only \(\mathbf 1[|\bigcap_i X_i|\ge \tau]\) before conditional intersection reconstruction. We prove the correctness and security of the proposed protocol, and further validate its feasibility through quantum-circuit simulations implemented on the IBM \textsf{Qiskit} platform.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper gives a rotation-based quantum multi-party TPSI construction that hides labels from the TP before an OLE-plus-garbled-circuit threshold step, but the security argument for those hidden measurements is the part that needs the most checking.

read the letter

The core contribution is a quantum protocol for threshold private set intersection across multiple parties that produces measurement vectors the third party can obtain but cannot map back to set elements or cardinalities. It does this with sequential data rotations by participants, masking rotations involving the TP, and aggregate rotations on single-photon sequences, then feeds the hidden outcomes into an OLE inner-product step followed by a lightweight garbled circuit that outputs only the threshold bit before any conditional reconstruction.

This addresses a specific gap noted in prior quantum TPSI work where the TP ends up interpreting results directly. The approach stays within standard quantum optics primitives and classical secure computation tools, and the abstract states that correctness and security proofs are supplied along with Qiskit circuit simulations.

The weakest part is the claim that the final states after all rotations are semantically inaccessible to the TP. The abstract asserts this produces hidden-label vectors whose statistics are simulatable given only the threshold output, but without the actual reduction or concrete argument showing independence from the private labels, it is difficult to judge whether any residual correlation survives the masking. The simulation mention is also thin—no error rates, output distributions, or comparison to ideal behavior are visible.

The paper is aimed at the quantum cryptography community working on private set operations and multi-party protocols. It deserves a serious referee because the construction is explicit, the target problem is well-defined, and the combination of quantum rotations with OLE and garbled circuits is a concrete attempt at a new design point, even if the central security step requires careful verification.

Referee Report

1 major / 0 minor

Summary. The manuscript proposes a quantum multi-party threshold private set intersection (TPSI) protocol. It constructs hidden-label measurement vectors via sequential participant data rotations, TP masking rotations, and aggregate rotations on single-photon sequences. A third party (TP) performs the final measurement but cannot recover semantic meaning; an OLE-based inner-product step followed by a lightweight garbled circuit then reveals only the threshold bit 1[|∩Xi| ≥ τ] before conditional reconstruction. The authors assert proofs of correctness and security together with Qiskit circuit simulations.

Significance. If the security reduction for the hidden-label vectors is valid, the work would supply a concrete quantum construction for explicit-cardinality TPSI that avoids the TP learning more than the threshold indicator, combining quantum rotations with standard classical primitives (OLE, garbled circuits). The claimed Qiskit validation would provide initial feasibility evidence for the rotation-based masking step.

major comments (1)

[Abstract / security analysis] Abstract (protocol-design paragraph) and security analysis: the central claim that sequential masking rotations produce measurement vectors whose statistics are simulatable given only the threshold output (i.e., TP obtains no extra information about set elements or cardinalities) is load-bearing for both the “explicit cardinality testing” and “collusion-resistant” properties. No concrete simulation argument, reduction, or equation establishing independence from private labels is visible; any surviving correlation would invalidate the security assertions.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the careful review and constructive feedback on our manuscript. The major comment concerns the level of detail in the security analysis for the hidden-label measurement vectors. We respond point-by-point below and will revise the manuscript to strengthen the explicit simulation argument.

read point-by-point responses

Referee: [Abstract / security analysis] Abstract (protocol-design paragraph) and security analysis: the central claim that sequential masking rotations produce measurement vectors whose statistics are simulatable given only the threshold output (i.e., TP obtains no extra information about set elements or cardinalities) is load-bearing for both the “explicit cardinality testing” and “collusion-resistant” properties. No concrete simulation argument, reduction, or equation establishing independence from private labels is visible; any surviving correlation would invalidate the security assertions.

Authors: We agree that the current security analysis states the high-level claim and proof outline but does not supply the explicit simulation equations or reduction steps establishing that the measurement-vector distribution is independent of private labels given only the threshold output. In the revised manuscript we will add a dedicated subsection in the security analysis that provides the missing simulation argument: we will explicitly derive the joint state after the sequence of participant data rotations, TP masking rotations, and aggregate rotations, show that the resulting density operator on the measurement vectors is independent of the individual labels conditional on the threshold bit, and give the corresponding simulator that samples from this distribution using only the threshold indicator. This addition will be placed immediately after the protocol description and will reference the relevant rotation-angle randomness and the properties of single-photon states. revision: yes

Circularity Check

0 steps flagged

No circularity; forward construction from quantum rotations and standard primitives

full rationale

The provided abstract and description present a protocol built from sequential single-photon rotations, OLE inner-product, and garbled circuits to compute only the threshold bit. No equations, self-citations, or reductions are exhibited that define a quantity in terms of itself or rename a fitted input as a prediction. The correctness and security proofs are asserted as independent of the construction itself, and Qiskit simulation provides external validation. This is the normal case of a self-contained derivation with no load-bearing circular steps.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

Central claim rests on standard quantum mechanics for photon rotations/measurements and cryptographic assumptions for OLE and garbled circuits; no free parameters or invented entities are described in the abstract.

axioms (2)

standard math Quantum mechanics principles governing single-photon rotations, masking, and measurements
Invoked for the sequential processing that produces hidden-label vectors.
domain assumption Security properties of oblivious linear evaluation and lightweight garbled circuits
Used to implement the threshold decision 1[|∩Xi| ≥ τ] without leakage.

pith-pipeline@v0.9.1-grok · 5723 in / 1469 out tokens · 57637 ms · 2026-06-29T04:23:59.844758+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages

[1]

Angelou and A

[ABC+20] Nick Angelou, Ayoub Benaissa, Bogdan Cebere, William Clark, Adam James Hall, Michael A. Hoeh, Daniel Liu, Pav- los Papadopoulos, Robin Roehm, Robert Sandmann, Phillipp Schoppmann, and Tom Titcombe. Asymmetric private set intersection with applications to contact tracing and private vertical federated machine learning.ArXiv, abs/2011.09350,

work page arXiv 2011
[2]

Quantum fully homomorphic encryption with verification

[ADS+17] Gorjan Alagic, Yfke Dulek, Christian Schaffner, and Florian Speelman. Quantum fully homomorphic encryption with verification. InAdvances in Cryptology – ASIACRYPT 2017, pages 438–467,

2017
[3]

Multi- partycomputationwithlowcommunication,computationand interaction via threshold fhe

[AJLA+12] Gilad Asharov, Abhishek Jain, Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan, and Daniel Wichs. Multi- partycomputationwithlowcommunication,computationand interaction via threshold fhe. InAdvances in Cryptology – EUROCRYPT 2012, pages 483–501,

2012
[4]

Quantum-access-secure message authentication viablind-unforgeability

[AMR+20] Gorjan Alagic, Christian Majenz, Alexander Russell, and Fang Song. Quantum-access-secure message authentication viablind-unforgeability. InAdvancesinCryptology–EURO- CRYPT 2020, pages 788–817,

2020
[5]

Threshold cryptosystemsfromthresholdfullyhomomorphicencryption

[BGG+18] DanBoneh,RosarioGennaro,StevenGoldfeder,AayushJain, SamKim,PeterM.R.Rasmussen,andAmitSahai. Threshold cryptosystemsfromthresholdfullyhomomorphicencryption. InAdvances in Cryptology – CRYPTO 2018, pages 565–596,

2018
[6]

Quantum one-time programs

[BGS13] AnneBroadbent,GusGutoski,andDouglasStebila. Quantum one-time programs. InAdvances in Cryptology – CRYPTO 2013, pages 344–360,

2013
[7]

Quantum homomorphic encryption for circuits of low t-gate complexity

[BJ15] Anne Broadbent and Stacey Jeffery. Quantum homomorphic encryption for circuits of low t-gate complexity. InAdvances in Cryptology – CRYPTO 2015, pages 609–629,

2015
[8]

Fast private set intersection from homomorphic encryption.Proceedings of the 2017 ACM SIGSAC Conference on Computer and Com- munications Security,

[CLR17] Hao Chen, Kim Laine, and Peter Rindal. Fast private set intersection from homomorphic encryption.Proceedings of the 2017 ACM SIGSAC Conference on Computer and Com- munications Security,

2017
[9]

Ac- tively secure two-party evaluation of any quantum operation

[DNS12] FrédéricDupuis,JesperBuusNielsen,andLouisSalvail. Ac- tively secure two-party evaluation of any quantum operation. InAdvances in Cryptology – CRYPTO 2012, pages 794–811,

2012
[10]

Pir-psi: Scaling private contact discovery.Proceedings on Privacy Enhancing Technologies, 2018:159 – 178,

[DRR+18] Daniel Demmler, Peter Rindal, Mike Rosulek, and Ni Trieu. Pir-psi: Scaling private contact discovery.Proceedings on Privacy Enhancing Technologies, 2018:159 – 178,

2018
[11]

Quantum homomorphic encryption for polynomial-sized cir- cuits

[DSS16] Yfke Dulek, Christian Schaffner, and Florian Speelman. Quantum homomorphic encryption for polynomial-sized cir- cuits. InProceedings, Part III, of the 36th Annual Interna- tional Cryptology Conference on Advances in Cryptology — CRYPTO 2016 - Volume 9816, page 3–32,

2016
[12]

Freedman, Kobbi Nissim, and Benny Pinkas

[FNP04] Michael J. Freedman, Kobbi Nissim, and Benny Pinkas. Ef- ficient private matching and set intersection. InAdvances in Cryptology - EUROCRYPT 2004, pages 1–19,

2004
[13]

[KS05] Lea Kissner and Dawn Song

Springer International Publishing. [KS05] Lea Kissner and Dawn Song. Privacy-preserving set oper- ations. InAdvances in Cryptology – CRYPTO 2005, pages 241–257,

2005
[14]

[Mea86] Catherine A. Meadows. A more efficient cryptographic matchmakingprotocolforuseintheabsenceofacontinuously available third party.1986 IEEE Symposium on Security and Privacy, pages 134–134,

1986
[15]

Efficient and private set intersection of human genomes.2018 IEEE International Conference on Bioinfor- matics and Biomedicine (BIBM), pages 761–764,

[SCW+18] Liyan Shen, Xiaojun Chen, Dakui Wang, Binxing Fang, and Ye Dong. Efficient and private set intersection of human genomes.2018 IEEE International Conference on Bioinfor- matics and Biomedicine (BIBM), pages 761–764,

2018

[1] [1]

Angelou and A

[ABC+20] Nick Angelou, Ayoub Benaissa, Bogdan Cebere, William Clark, Adam James Hall, Michael A. Hoeh, Daniel Liu, Pav- los Papadopoulos, Robin Roehm, Robert Sandmann, Phillipp Schoppmann, and Tom Titcombe. Asymmetric private set intersection with applications to contact tracing and private vertical federated machine learning.ArXiv, abs/2011.09350,

work page arXiv 2011

[2] [2]

Quantum fully homomorphic encryption with verification

[ADS+17] Gorjan Alagic, Yfke Dulek, Christian Schaffner, and Florian Speelman. Quantum fully homomorphic encryption with verification. InAdvances in Cryptology – ASIACRYPT 2017, pages 438–467,

2017

[3] [3]

Multi- partycomputationwithlowcommunication,computationand interaction via threshold fhe

[AJLA+12] Gilad Asharov, Abhishek Jain, Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan, and Daniel Wichs. Multi- partycomputationwithlowcommunication,computationand interaction via threshold fhe. InAdvances in Cryptology – EUROCRYPT 2012, pages 483–501,

2012

[4] [4]

Quantum-access-secure message authentication viablind-unforgeability

[AMR+20] Gorjan Alagic, Christian Majenz, Alexander Russell, and Fang Song. Quantum-access-secure message authentication viablind-unforgeability. InAdvancesinCryptology–EURO- CRYPT 2020, pages 788–817,

2020

[5] [5]

Threshold cryptosystemsfromthresholdfullyhomomorphicencryption

[BGG+18] DanBoneh,RosarioGennaro,StevenGoldfeder,AayushJain, SamKim,PeterM.R.Rasmussen,andAmitSahai. Threshold cryptosystemsfromthresholdfullyhomomorphicencryption. InAdvances in Cryptology – CRYPTO 2018, pages 565–596,

2018

[6] [6]

Quantum one-time programs

[BGS13] AnneBroadbent,GusGutoski,andDouglasStebila. Quantum one-time programs. InAdvances in Cryptology – CRYPTO 2013, pages 344–360,

2013

[7] [7]

Quantum homomorphic encryption for circuits of low t-gate complexity

[BJ15] Anne Broadbent and Stacey Jeffery. Quantum homomorphic encryption for circuits of low t-gate complexity. InAdvances in Cryptology – CRYPTO 2015, pages 609–629,

2015

[8] [8]

Fast private set intersection from homomorphic encryption.Proceedings of the 2017 ACM SIGSAC Conference on Computer and Com- munications Security,

[CLR17] Hao Chen, Kim Laine, and Peter Rindal. Fast private set intersection from homomorphic encryption.Proceedings of the 2017 ACM SIGSAC Conference on Computer and Com- munications Security,

2017

[9] [9]

Ac- tively secure two-party evaluation of any quantum operation

[DNS12] FrédéricDupuis,JesperBuusNielsen,andLouisSalvail. Ac- tively secure two-party evaluation of any quantum operation. InAdvances in Cryptology – CRYPTO 2012, pages 794–811,

2012

[10] [10]

Pir-psi: Scaling private contact discovery.Proceedings on Privacy Enhancing Technologies, 2018:159 – 178,

[DRR+18] Daniel Demmler, Peter Rindal, Mike Rosulek, and Ni Trieu. Pir-psi: Scaling private contact discovery.Proceedings on Privacy Enhancing Technologies, 2018:159 – 178,

2018

[11] [11]

Quantum homomorphic encryption for polynomial-sized cir- cuits

[DSS16] Yfke Dulek, Christian Schaffner, and Florian Speelman. Quantum homomorphic encryption for polynomial-sized cir- cuits. InProceedings, Part III, of the 36th Annual Interna- tional Cryptology Conference on Advances in Cryptology — CRYPTO 2016 - Volume 9816, page 3–32,

2016

[12] [12]

Freedman, Kobbi Nissim, and Benny Pinkas

[FNP04] Michael J. Freedman, Kobbi Nissim, and Benny Pinkas. Ef- ficient private matching and set intersection. InAdvances in Cryptology - EUROCRYPT 2004, pages 1–19,

2004

[13] [13]

[KS05] Lea Kissner and Dawn Song

Springer International Publishing. [KS05] Lea Kissner and Dawn Song. Privacy-preserving set oper- ations. InAdvances in Cryptology – CRYPTO 2005, pages 241–257,

2005

[14] [14]

[Mea86] Catherine A. Meadows. A more efficient cryptographic matchmakingprotocolforuseintheabsenceofacontinuously available third party.1986 IEEE Symposium on Security and Privacy, pages 134–134,

1986

[15] [15]

Efficient and private set intersection of human genomes.2018 IEEE International Conference on Bioinfor- matics and Biomedicine (BIBM), pages 761–764,

[SCW+18] Liyan Shen, Xiaojun Chen, Dakui Wang, Binxing Fang, and Ye Dong. Efficient and private set intersection of human genomes.2018 IEEE International Conference on Bioinfor- matics and Biomedicine (BIBM), pages 761–764,

2018