Pith. sign in

REVIEW 3 major objections 4 minor 19 references

Pauli Encodings & Unclonable Encryption

T0 review · 3 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proves that every Pauli Encoding with K keys has optimal monogamy-of-entanglement winning probability at least 1/2+1/(2√K), and obtains a ≈0.5556 asymptotic upper bound for the anticommuting scheme via a level-three relaxation.

desk verdict Solid framework and several clean results, but the headline 0.5556 bound is conditional on an unproven numerical pipeline. read the letter →

arxiv 2607.28602 v2 pith:YV5N5NPL submitted 2026-07-30 quant-ph

Pierre Botteron , Sébastien Designolle , Omar Fawzi This is my paper
classification quant-ph MSC 81P4581P9490C22 PACS 03.67.Dd03.67.-a
keywords unclonablebitPauliencodingsmonogamy-of-entanglementgamessemidefiniteprogramminghierarchyquantumcryptographyno-cloningtheoremsymmetryreduction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks a sharp version of the unclonable bit question: can a simple quantum encryption scheme keep a classical bit uncloneable once the key is revealed? It introduces Pauli Encodings, where the ciphertext is a normalized eigenspace projector of a Pauli string, and proves a universal lower bound on the optimal monogamy-of-entanglement winning probability: for K keys, at least 1/2 + 1/(2√K). It also shows that two natural attack-relaxation strategies cannot prove security: the BB84-style X/Z tensor-product encoding is exactly insecure, and any argument using only pairwise guessing marginals is blocked by a universal 3/4 obstruction. For the pairwise anticommuting encoding, the paper uses a symmetric level-three semidefinite relaxation to push the asymptotic winning-probability upper bound down to approximately 0.5556, substantially tightening the previously known 5/8. A sympathetic reader cares because these bounds map which simple quantum encodings could plausibly achieve the unclonable bit.

What carries the argument

The central object is the Pauli Encoding, a one-bit encryption scheme defined by POVMs A_{x|P} = (I + (-1)^x P)/2 for Pauli strings P. The load-bearing reduction rewrites the cloning game as a monogamy-of-entanglement game, so security bounds reduce to bounding the largest eigenvalue of the operator T_V = (1/K)Σ_P (P⊗V_P⊗I + P⊗I⊗V_P + I⊗V_P⊗V_P). The universal lower bound comes from the operator norm of the sum Σ_P P: for anticommuting strings the square is K I, giving exactly 1/2 + 1/(2√K). For the anticommuting upper bound, the paper exploits the S_K × C_2 symmetry of the protocol and a block decomposition of the invariant moment matrix into irreducible symmetry sectors, producing semidefi

What would settle it

Compute the exact level-three semidefinite optimum for the anticommuting protocol at K=9: if it falls below 1/2+1/(2√9)=2/3, the universal lower bound of Proposition 4.3 would be false. Alternatively, find any Pauli Encoding with K keys whose optimal MoE winning probability is provably below 1/2+1/(2√K).

Watch

Extended reading notes

Core claim

For any multiset K of non-identity Pauli strings, the Pauli Encoding encrypts bit x as ρ_{x|P} = (I + (-1)^x P)/2^n and the cloning game reduces to a monogamy-of-entanglement game. The paper proves that every such scheme has optimal MoE winning probability at least 1/2 + 1/(2√K), matching the conjectured optimum of the anticommuting family and therefore making that family optimal among Pauli Encodings at fixed K if the conjecture holds. It also proves a no-go result: for every correct binary encryption scheme, the pairwise MoE winning probability is at least 3/4, so pairwise marginal arguments cannot establish unclonable-indistinguishable security. The BB84 encoding, based on {X,Z}⊗n, has ex

Load-bearing premise

The 0.5556 upper bound depends on a computer-assisted symmetry-reduction and interpolation pipeline — full-rank stable seed matrices and certified coefficient-wise limits as K goes to infinity — that the paper delegates to its accompanying code rather than proving in full; the level-two and level-three values are numerical optima of rigorously specified semidefinite programs, and the paper itself notes the level-four extension is currently too slow to complete.

Editorial extensions

If this is right

  • No Pauli Encoding with K keys can have a cloning advantage below 1/(2√K), and the anticommuting protocol attains this value for K up to 7 exactly and numerically beyond, so it is plausibly optimal among all Pauli Encodings at a fixed key count.
  • Pairwise marginal monogamy-of-entanglement relaxations cannot prove unclonable-indistinguishable security for any correct binary encryption scheme, because the pairwise winning probability is always at least 3/4; higher-level or genuinely tripartite constraints are necessary.
  • The BB84 (X/Z tensor-product) encoding has exact winning probability cos²(π/8), so it is neither weakly nor strongly unclonable-indistinguishable secure, while remaining strongly indistinguishable-secure — a concrete separation between the two notions.
  • The level-three relaxation for the anticommuting protocol yields an asymptotic upper bound of roughly 0.5556, tightening the previous 5/8 level-one bound and providing evidence toward the conjectured 1/2 limit.
  • Several efficient Pauli families achieve strong indistinguishability security, and a Frobenius-norm argument gives strong unclonable security against adversaries with local dimension bounded independently of n.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test would be to push the symmetry-reduced level-four relaxation to a tractable form: the paper reports the exact level-four construction is currently too slow, so a practical level-four compression would either confirm the trend toward 1/2 or reveal a plateau.
  • The universal 3/4 obstruction suggests that any successful proof of unclonable-indistinguishable security must exploit correlations across both Bob and Charlie together, not just their pairwise overlaps; this could guide the design of new encryption schemes with built-in tripartite constraints.
  • The universal 1/(2√K) lower bound implies a trade-off: to push cloning advantage below ε, one needs K ~ 1/(4ε²) keys, so efficient schemes must rely on structured families with faster-decaying bounds rather than on simply increasing key count.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces Pauli Encodings, a class of one-bit quantum encryption schemes built from eigenspace projectors of Pauli strings, and analyzes their monogamy-of-entanglement (MoE) cloning-game security. The main results are: a universal lower bound P*_win(MoE) ≥ 1/2 + 1/(2√K) for every K-key Pauli Encoding (Prop. 4.3); a no-go result showing that pairwise guessing-marginal arguments cannot prove strong security, with optimal pairwise MoE value at least 3/4 (Prop. 4.2); an exact evaluation of the BB84 encoding value cos²(π/8) (Prop. 5.1); a bounded-local-dimension security bound (Prop. 5.2); strong indistinguishability security for several Pauli families (Prop. 5.9); a level-one optimality result for the anticommuting commutation pattern (Prop. 5.15); and an asymptotic level-three NPA upper bound of approximately 0.555608131 for the anticommuting protocol (Prop. 5.18, Sec. 5.4.3).

Significance. If the results as stated are fully established, the paper is a substantial contribution to the unclonable-encryption literature. The universal lower bound, the exact BB84 analysis, the 3/4 obstruction, and the bounded-dimension and indistinguishability results are concrete and mostly self-contained, with explicit attack constructions and, in several cases, exact algebraic derivations. The accompanying code is a clear asset. The headline asymptotic improvement over 5/8 for the anticommuting protocol, however, currently rests on a symmetry-reduction and interpolation pipeline whose certification is not fully proved in the manuscript. This gap does not affect the lower-bound, no-go, and bounded-dimension contributions, but it does affect the central advertised upper-bound result.

major comments (3)
  1. [Prop. 5.18 and Appendix A.3–A.5] The claimed asymptotic upper bound ω_3^∞ ≈ 0.555608131 depends on three unproven premises: (i) the seed matrices V^{(K)}_{λ,ε} of Prop. A.4 have full column rank for all relevant K; (ii) the rational-function interpolation of block coefficients is certified at enough independent K values; (iii) the coefficientwise K→∞ limit is a feasible PSD block of the limiting SDP. The manuscript states that the code checks these conditions at selected K and interpolates, but it does not provide a proof or a machine-checkable certificate that the checks cover all coefficients and all K in the stable range. Without (i)–(iii), the limiting SDP is not a valid relaxation, so Result 7 does not rigorously imply any upper bound below 5/8. This is load-bearing for the advertised improvement.
  2. [Sec. 5.4.3, Table of ω_t^(∞)] Even if the limiting SDPs were rigorously derived, the reported values 0.579982991 and 0.555608131 are described as "numerical optima of rigorously specified limiting SDPs." A numerical SDP optimum is not, by itself, a certified upper bound on the true SDP optimum unless validated with rigorous error bounds (e.g., interval arithmetic or exact rational rounding). The paper should either provide certified bounds or explicitly downgrade the 0.5556 claim from a theorem to numerical evidence.
  3. [Prop. A.4] The full-column-rank assumption on the projected seed matrix V^{(K)}_{λ,ε} is stated as an assumption ('assume that this matrix has full column rank'), not proved. The equivalence in Eq. (32) is valid only under that assumption. Since the later interpolation and limit steps use this equivalence for all occurring (λ,ε) and all K in the stable range, the assumption is not a harmless technicality. The authors should either prove the rank condition for the specific seed convention or provide a certificate that can be independently verified.
minor comments (4)
  1. [Sec. 1.1.3 / Result 7] The informal Result 7 states an asymptotic upper bound, but the body correctly notes that levels two and three are numerical. The abstract and introduction should consistently use 'numerical evidence' or 'upper bound modulo certified computation' rather than presenting 0.5556 as a proven value.
  2. [Table 1] The column 'Conjectured exact value' is appropriate, but the rows marked with '≈' and '≠' would benefit from a statement that these conjectures are not proven in the paper, to avoid any appearance that they are established results.
  3. [Eq. (10)] The norm notation ‖∑_P P‖_op has a typographical glitch in the displayed equation (the norm bars render as four vertical strokes). This is purely cosmetic but should be fixed.
  4. [Sec. 5.4.4] The discussion of level four is honest about the computational obstruction, but the sentence 'This computational obstruction is not evidence of a failure of the method' is speculative. It is fine as a remark, but it should be phrased as the authors' assessment rather than a mathematical claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: central bounds are derived from explicit attacks and algebraic identities; self-citations are published and not used to force the main predictions.

full rationale

The main advertised results are derived from explicit constructions and algebraic identities rather than from fitted parameters renamed as predictions. Proposition 4.3 proves the universal lower bound by evaluating the explicit V_P=±I attack and using Hilbert–Schmidt orthogonality to show ||sum P||_op >= sqrt(K); no input is reused as output. Proposition 4.2 and Proposition 5.1 are self-contained (the BB84 proof is given in full and only acknowledges [CLX26]). The bounded-dimension and indistinguishability bounds are direct norm estimates. The NPA part cites [Bot+26, Theorem 9] for the exact level-one anticommuting value; this is a self-citation with overlapping authorship, but it is a published, externally checkable theorem and does not by itself establish the paper's new asymptotic limits. The level-three asymptotic bound (Prop. 5.18) rests on the symmetry-reduction/interpolation pipeline in Appendix A, including the explicit full-column-rank assumption in Prop. A.4 and code-certified rational interpolation; the paper labels levels two and three as numerical and delegates exact certificates to the repository. That is a reproducibility/certificate gap, not a case where the conclusion equals an input by construction. No fitted constant is recycled as a prediction, and the lower-bound results are independent of the self-citations. Overall no circular step is exhibited.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No fitted parameters are present: K and the NPA level t are design variables, not fitted to data. The crucial assumptions are the MoE reduction and the representation-theoretic stability/seed-rank conditions behind the numerical level-3 bound. No invented physical entities are introduced.

assumptions (4)
  • domain assumption The no-cloning theorem and the standard reduction from cloning games to monogamy-of-entanglement games with POVMs {A_x|k} (Eq. (4)).
    The paper's upper bounds on MoE winning probability are tied to the fact that A_x|P = (I+(-1)^x P)/2 forms a valid POVM; if this normalization failed the reduction would not apply.
  • standard math Lemma 4.1: WLOG Bob and Charlie use identical projective dichotomic measurements and a B-C symmetric state, via Naimark dilation and symmetrization.
    Needed to reduce the MoE game to eq. (7); the proof is sketched and follows standard arguments.
  • standard math Convergence of the bounded noncommutative moment hierarchy (NPA) to the universal C*-algebraic optimum (Proposition 5.13).
    Uses [NPA08;PNA10]; needed to justify that finite-level values are valid upper bounds.
  • ad hoc to paper Representation stability/Specht multiplicity formulas for the S_K x C2 symmetry reduction, including the full-column-rank seed assumption in Appendix A.3-A.5.
    The paper presents these as implementation-certified rather than giving general proofs for all K; the numerical upper bounds depend on them.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Pauli Encodings & Unclonable Encryption." pith.science (2026). https://pith.science/paper/YV5N5NPL

@misc{pith2026260728602,
  author       = {Pith},
  title        = {Pith review of: Pauli Encodings & Unclonable Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YV5N5NPL}},
  note         = {Machine review of arXiv:2607.28602}
}
abstract

The unclonable bit question asks whether quantum encryption can prevent an adversary from producing two systems that both reveal the plaintext once the key is disclosed. We introduce and study Pauli Encodings, a simple class of one-bit encryption schemes whose ciphertexts are normalized eigenspace projectors of Pauli strings. For every Pauli Encoding with K Pauli strings, we prove a universal lower bound $1/2+1/(2\sqrt{K})$ on the optimal monogamy-of-entanglement winning probability, together with sharper bounds for several structured families. We then establish two limitations of natural approaches to unclonable security. First, if the Pauli strings are restricted to strings of X and Z of length n, the encoding is not secure. Second, we identify a universal 3/4 obstruction showing that arguments based only on pairwise guessing marginals cannot establish unclonable-indistinguishable security. When the Pauli strings all pairwise anticommute, the protocol becomes the one studied in [Quantum 10, 2157 (2026)]. We exploit the symmetry of this protocol to solve the third level of the natural semidefinite programming relaxation obtaining an asymptotic upper bound of approximately 0.5556 on the winning probability. Finally, we prove strong unclonable-indistinguishable security against bounded-local-dimension adversaries and strong indistinguishability security for several efficient Pauli families. First-level NPA computations provide additional numerical evidence towards the strong unclonable-indistinguishable security.

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

19 extracted references · 2 canonical work pages

  1. [1]

    A Modular Approach to Unclonable Cryptography

    [AB24] Prabhanjan Ananth and Amit Behera. “A Modular Approach to Unclonable Cryptography”. In: Ad- vances in Cryptology – CRYPTO 2024, Part VII. Vol. 14926. Lecture Notes in Computer Science. Springer Nature Switzerland, 2024, pp. 3–37. DOI: 10.1007/978-3-031-68394-7_1 (cited on p. 2). [AK21] Prabhanjan Ananth and Fatih Kaleoglu. “Unclonable Encryption, R...

    doi:10.1007/978-3-031-68394-7_1 2024

  2. [4]

    arXiv: 2603.08916 [quant-ph] (cited on pp. 2, 5). [BC23] Anne Broadbent and Eric Culf. Uncloneable Cryptographic Primitives with Interaction

    arXiv

  3. [7]

    Uncloneable Quantum Encryption via Oracles

    arXiv: 2603.11437 [cs.CR] (cited on p. 2). [BL20] Anne Broadbent and Sébastien Lord. “Uncloneable Quantum Encryption via Oracles”. In: 15th Confer- ence on the Theory of Quantum Computation, Communication and Cryptography (TQC 2020). Vol

    arXiv 2020

  4. [10]

    The Curious Case of “XOR Repetition

    arXiv: 2403.16874 [math.MG] (cited on p. 5). [CLX26] Andrea Coladangelo, Qipeng Liu, and Ziyi Xie. “The Curious Case of “XOR Repetition” of Monogamy- of-Entanglement Games”. In:17th Innovations in Theoretical Computer Science Conference (ITCS 2026). Vol

    arXiv 2026

  5. [12]

    Probabilistic Encryption

    URL: https://github.com/sebastiendesignolle/arXiv-2607.28602 (visited on 07/31/2026) (cited on pp. 4, 23, 25, 29). [GM84] Shafi Goldwasser and Silvio Micali. “Probabilistic Encryption”. In: Journal of Computer and System Sciences 28.2 (1984), pp. 270–299. DOI: 10.1016/0022-0000(84)90070-9 (cited on p. 18). [Got03] Daniel Gottesman. “Uncloneable Encryption...

    arXiv 2026

  6. [15]

    arXiv: 2410.06029[quant-ph] (cited on p. 2). [MST21] Christian Majenz, Christian Schaffner, and Mehrdad Tahmasbi. Limitations on Uncloneable Encryption and Simultaneous One-Way-to-Hiding

    arXiv

  7. [17]

    4743211 (cited on p

    DOI: 10.5281/zenodo. 4743211 (cited on p. 5). [Sag01] Bruce E. Sagan. The Symmetric Group: Representations, Combinatorial Algorithms, and Symmetric Func- tions. 2nd ed. Vol

    doi:10.5281/zenodo

  8. [158]

    Towards Unconditional Uncloneable Encryption

    Leibniz International Proceedings in Informatics (LIPIcs). Schloss Dagstuhl – Leibniz-Zentrum für In- formatik, 2020, 4:1–4:22. DOI: 10.4230/LIPIcs.TQC.2020.4 (cited on pp. 2, 7). 26 [Bot+26] Pierre Botteron, Anne Broadbent, Eric Culf, Ion Nechita, Clément Pellegrini, and Denis Rochette. “Towards Unconditional Uncloneable Encryption”. In:Quantum 10 (2026)...

    doi:10.4230/lipics.tqc.2020.4 2020

Show all 19 references
  1. [203]

    New York: Springer, 2001.DOI: 10.1007/978- 1-4757-6804-6 (cited on pp

    Graduate Texts in Mathematics. New York: Springer, 2001.DOI: 10.1007/978- 1-4757-6804-6 (cited on pp. 23, 30). [Ser77] Jean-Pierre Serre. Linear Representations of Finite Groups . Vol

    2001 doi

  2. [325]

    Computational Security of Quantum Encryption

    Leibniz International Proceedings in Informatics (LIPIcs). Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2025, 7:1–7:23. DOI: 10.4230/LIPIcs.ITCS.2025.7 (cited on p. 2). [Ala+16] Gorjan Alagic, Anne Broadbent, Bill Fefferman, Tommaso Gagliardoni, Christian Schaffner, and ...

    2025 doi

  3. [362]

    Communication by EPR Devices

    Leibniz International Proceedings in Informatics (LIPIcs). Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2026, 41:1–41:20. DOI: 10.4230/LIPIcs.ITCS.2026.41 (cited on pp. 2, 3, 16). [Die82] Dennis Dieks. “Communication by EPR Devices”. In: Physics Letters A 92.6 (1982), pp...

    2026 doi

  4. [1582]

    DOI: 10.22331/q-2025-01-08-1582 (cited on p. 2). [Mac95] I. G. Macdonald. Symmetric Functions and Hall Polynomials. 2nd ed. Oxford: Oxford University Press, 1995 (cited on pp. 23, 30). [MM24] Arthur Mehta and Anne Müller. Unclonable Functional Encryption

    2025 doi

  5. [1977]

    DOI: 10.1007/978-1-4684-9458-7 (cited on pp. 23, 30). [SW22] Or Sattath and Shai Wyborski. Uncloneable Decryptors from Quantum Copy-Protection

    doi

  6. [2021]

    A New Construction of Young’s Seminormal Representation of the Symmetric Groups

    arXiv: 2103.14510 [quant-ph] (cited on pp. 2, 12). [Mur81] G. E. Murphy. “A New Construction of Young’s Seminormal Representation of the Symmetric Groups”. In: Journal of Algebra 69.2 (1981), pp. 287–297. DOI: 10.1016/0021- 8693(81)90205- 6 (cited on pp. 23, 30). [NPA08] Migue...

    1981 arXiv

  7. [2022]

    A Monogamy-of-Entanglement Game with Applications to Device-Independent Quantum Cryptography

    arXiv: 2203.05866 [quant-ph] (cited on p. 2). [Tom+13] Marco Tomamichel, Serge Fehr, J˛ edrzej Kaniewski, and Stephanie Wehner. “A Monogamy-of-Entanglement Game with Applications to Device-Independent Quantum Cryptography”. In: New Journal of Physics 15.10 (2013), p. 103002. D...

    2013 arXiv

  8. [2023]

    Uncloneable Encryption from Decoupling

    arXiv: 2303.00048 [quant-ph] (cited on p. 2). [BC26] Archishna Bhattacharyya and Eric Culf. “Uncloneable Encryption from Decoupling”. In: Nature Physics 22.2 (2026), pp. 315–318. DOI: 10.1038/s41567-025-03154-7 (cited on pp. 2, 5). [BCR25] Anne Broadbent, Eric Culf, and Denis ...

    2026 arXiv

  9. [2024]

    arXiv: 2311.16663 [quant-ph] (cited on p. 2). [CLL24] Henry Cohn, David de Laat, and Nando Leijenhorst. Optimality of Spherical Codes via Exact Semidefinite Programming Bounds

    arXiv

  10. [2025]

    The Diamond Lemma for Ring Theory

    arXiv: 2510.00903 [quant-ph] (cited on pp. 2, 12). [Ber78] George M. Bergman. “The Diamond Lemma for Ring Theory”. In: Advances in Mathematics 29.2 (1978), pp. 178–218. DOI: 10.1016/0001-8708(78)90010-5 (cited on p. 29). [BG26] James Bartusek and Eli Goldin. Unclonable Encrypt...

    1978

  11. [2026]

    Quantum Cryptography: Public Key Distribution and Coin Tossing

    arXiv: 2607.21551 [quant-ph] (cited on pp. 2, 4, 5). [BB14] Charles H. Bennett and Gilles Brassard. “Quantum Cryptography: Public Key Distribution and Coin Tossing”. In: Theoretical Computer Science 560 (2014), pp. 7–11. DOI: 10.1016/j.tcs.2014.05.025 (cited on p. 8). [BBC26] ...

    2014 arXiv

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.