Time-space lower bounds for breaking quantum cryptography

Time-space lower bounds for breaking quantum cryptography

arXiv:2610.02101v1 [quant-ph] 1 Oct 2026

Fangqi Dong Princeton

Alex Lombardi Princeton

October 1, 2026

Abstract We prove near-optimal time-space lower bounds for breaking quantum cryptography in the random oracle model. Specifically, we prove that a 𝑇 -query adversary with 𝑆 qubits of non-uniform advice can recover a random key √ 𝑘 from the 𝑛-qubit binary phase state |𝜓𝑘 ⟩ ∝ ∑︀ 𝑇 2 + 𝑆𝑇 ) for 𝑁 = 2𝑛 . In contrast, the best known 𝑥 𝑅(𝑘, 𝑥) |𝑥⟩ with probability at most 𝑂( 𝑁 𝑇 2 +𝑆𝑇 bound for post-quantum one-way functions is 𝑂( 𝑁 ), and indeed there is a trivial attack with 𝑆 = 𝑁 . This demonstrates a new advantage of quantum cryptography over classical cryptography: 𝑛 qubits of communication suffice for security against preprocessing attacks with space up to 𝑁 2 rather than 𝑁 . We achieve this result by making use of a simple methodology: express the optimal preprocessing attack as the operator norm of a random matrix, and bound this value in expectation over the random oracle via the trace-moment method. Bounding these trace moments turns out to have a natural interpretation using the compressed oracle methodology [Zhandry, Crypto 2019], which we then analyze. This can be viewed as a simplification and generalization of the approach of Liu [Eurocrypt 2023] for proving time-space tradeoffs for breaking post-quantum cryptography. We use this methodology to prove several additional results. • We tighten Liu’s analysis of post-quantum PRGs in the QROM, achieving a distinguishing √︁ 2

advantage bound of 𝑂( 𝑇𝑁 +

𝑆𝑇 𝑁 ).

• We apply this methodology in the context of unitary synthesis, extending the one-query lower bound of Lombardi-Ma-Wright [STOC 2024] to hold against adversaries that can make one arbitrary function query along with polynomially many (adaptive) queries to the random oracle, either before or after the function query. This also gives a way to interpret the original LMW24 result in terms of compressed oracles. √

• Finally, we prove a tight 𝑂( 𝑁𝑆 ) bound for the pseudorandomness of random binary phase states against space 𝑆 distinguishers.

Contents 1 Introduction 1.1 Our Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Acknowledgements and AI use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1 2 5

2 Technical Overview 2.1 One-way states with no online queries . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Adding online queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Sketches of our additional results . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5 6 9 9

3 Preliminaries 3.1 Quantum random oracle model and compressed oracles . . . . . . . . . . . . . . . . . 3.2 Canonical quantum bit commitments . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 1OWS and 1PRS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 The unitary synthesis problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 One-query oracle algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 The weight-vector decomposition . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11 11 12 12 13 14 15

4 Our use of the trace moment method

15

5 Non-uniform security of 1OWS in QROM 5.1 1OWS trace-moment setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Bounding the trace moment on small databases . . . . . . . . . . . . . . . . . . . . . 5.3 Proof of the 1OWS bound for states with initial database . . . . . . . . . . . . . . .

16 17 18 20

6 Non-uniform security of 1OWS in QROM, with classical advice 6.1 1OWS scalar-moment setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Bounding the scalar moment on small databases . . . . . . . . . . . . . . . . . . . . 6.3 Proof of the 1OWS bound for an initial database state . . . . . . . . . . . . . . . . .

23 24 25 25

7 Quantum bit commitments in QROM

28

8 Non-uniform security of PRGs in QROM 30 8.1 PRG trace-moment setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 8.2 Bounding the trace moment on small databases . . . . . . . . . . . . . . . . . . . . . 32 9 One-query unitary synthesis lower bound from compressed oracles 33 9.1 Oracle state search game hardness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 9.2 Oracle state distinguishing game hardness . . . . . . . . . . . . . . . . . . . . . . . . 37 10 One-query unitary synthesis with additional query access to 𝑅 10.1 Oracle state search game with post-query access . . . . . . . . . . . . . . . . . . . . 10.2 Oracle state distinguishing game with post-query access . . . . . . . . . . . . . . . . 10.3 Extension to the setting with both post-query and pre-query access . . . . . . . . . .

2

43 43 48 49

11 Quantum advice lower bound for 1PRS 11.1 1PRS trace-moment setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Proof of the small-database bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3 An elementary bound for the swap operator . . . . . . . . . . . . . . . . . . . . . . .

52 53 54 56

References

58

A A matching zero-query attack for 1OWS and 1PRS

60

B Proof of Lemma 6.3

62

C Proof of Lemma 8.3 65 C.1 A weaker but simpler bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

1

Introduction

We study the security of quantum cryptography against preprocessing attacks with time-space complexity (𝑇, 𝑆) in the quantum random oracle model [BDF+ 11]. In a preprocessing attack [Hel80, FN91, Unr07], the adversary may perform an unbounded amount of work before receiving its challenge, storing information in the form of an 𝑆-bit (or 𝑆-qubit) advice string (or quantum state). It then receives the challenge and makes 𝑇 queries to the random oracle as usual. The question is to understand the resulting time-space security tradeoffs: given 𝑆 qubits of advice, how many queries are necessary to break cryptosystems of interest? The study of preprocessing attacks in classical cryptography dates back to the 1980s [Hel80, FN91], where (︁Hellman showed how to break the one-wayness of an 𝑛-bit random oracle with success )︁ 𝑆 2 𝑇 1/3 probability 𝑂 ( 𝑁 2 ) , i.e., a complete break with 𝑁 2/3 time and advice length. Famously, there is no matching lower bound: while a sequence of recent works [Unr07, DGK17, CDGS18] (building on a seminal work of Yao [Yao90]) establish that algorithms with time-space complexity (𝑇, 𝑆) achieve inversion probability at most 𝑂( 𝑆𝑇 𝑁 ), it is known that sharpening the tradeoff 𝑆𝑇 = Ω(𝑁 ) would imply new circuit lower bounds [CK19]. Preprocessing attacks have also received significant attention in the post-quantum setting [HXY19, CLQ20, CGLQ20, GLLZ21, Liu23, DLW24], where we study the security of classical cryptosystems against quantum attacks. In this setting, quantum attackers have two notable sources of additional power: an adversary can query the oracle in superposition, and it can store a quantum state during the preprocessing phase. For our two most foundational symmetric-key cryptographic primitives, one-way functions and pseudorandom generators, the state-of-the-art security bounds in the aux-input QROM are due to Liu [Liu23], who showed that a random oracle can be inverted (as a one-way function) with probability at most (︃ )︃ 𝑇 2 + 𝑆𝑇 𝜀OWF ≤ 𝑂 , 𝑁 while a random oracle can be broken as a PRG with distinguishing advantage at most (︁ 𝑆𝑇 )︁1/3 𝑇 . 𝜀PRG ≤ 𝑂 √ + 𝑁 𝑁 These results concern the security of classical primitives against quantum preprocessing attacks. In this work, we study the analogous problem in the context of fully quantum cryptography, where the cryptosystem itself involves quantum computation and communication. In particular, we focus on single-copy one-way states [MY24] and pseudorandom states [JLS18], natural lightweight forms of quantum cryptography that can be used to build quantum bit commitments [MY22] and therefore other quantum cryptographic primitives such as oblivious transfer, zero-knowledge proofs, and secure computation [BCKM21, GLSV21]. We therefore ask: )︂

(︂

What is the achievable quantitative security of these quantum cryptographic primitives? To study this question in the random oracle model, we consider the standard instantiation using binary phase states. For a random oracle 𝑅 : [𝐾] × [𝑁 ] → {±1}, we define the family of pure states 1 ∑︁ 𝑅(𝑘, 𝑥) |𝑥⟩ . |𝜓𝑅,𝑘 ⟩ = √ 𝑁 𝑥∈[𝑁 ] 1

For one-wayness, we ask that it is hard to recover a random key 𝑘 1 from the state |𝜓𝑅,𝑘 ⟩, while for pseudorandomness (with 𝐾 < 𝑁/2) we ask that the mixed state E𝑘 |𝜓𝑅,𝑘 ⟩⟨𝜓𝑅,𝑘 | is computationally indistinguishable from maximally mixed. Interestingly, there is also a fascinating connection between these cryptographic primitives and the unitary synthesis problem [AK07, LMW24, DLM26]; indeed, breaking the one-wayness or pseudorandomness of random binary phase states implies a unitary synthesis algorithm for an associated family of unitaries in the following hybrid query model: • The algorithm can make one query to an arbitrary boolean function 𝑓𝑅 depending on 𝑅, and • The algorithm can make up to 𝑇 (sequential) queries to the random oracle 𝑅 itself. This is a hybrid model lying in between one-query unitary synthesis and full-fledged polynomialquery unitary synthesis. Note that just as one-query algorithms are more powerful than “quantum programs” (0-query algorithms with quantum advice), this hybrid model is more powerful than (𝑇, 𝑆)-preprocessing algorithms.

1.1

Our Results

For our first result, we prove a quantitatively strong security bound for OWS in the aux-input QROM for the binary phase state family |𝜓𝑅,𝑘 ⟩ defined above. Theorem 1.1 (Informal; see Theorem 5.2). Any adversary with 𝑆 qubits of advice that makes 𝑇 queries to 𝑅 recovers the random key 𝑘 from |𝜓𝑅,𝑘 ⟩ with probability at most (︃

𝑂

1 + 𝑇2 +

𝑆(𝑇 + 1)

√︀

)︃

.

𝐾

In particular, this bound simplifies to 𝑂

(︂

1+𝑇 2 +

√

𝑆(𝑇 +1)

)︂

𝑁

when 𝐾 = 𝑁 . This bound is tight in

two important settings: • 𝑆 = 0: in this case, the bound 𝑂(𝑇 2 /𝑁 ) matches a Grover-style search algorithm [Ros26] √ • 𝑇 = 0: in this case, the bound 𝑂( 𝑆/𝑁 ) matches (up to logarithmic factors) √ √ a folklore attack [LMW24] in which the preprocessing algorithm stores 𝑂( 𝑆) copies of 𝑆 of the |𝜓𝑘 ⟩ and applies a sequence of symmetric subspace tests to recover the key whenever the challenge key lies in the memorized set (see Appendix A). √

Whether the mixed term 𝑁𝑆𝑇 is tight remains an open problem; in particular, it would be interesting to understand whether there are barriers (like in the classical setting [CK19]) to identifying this term. We obtain a stronger bound when the advice is classical. Specifically, Theorem 6.1 bounds the success probability of an adversary with 𝑆 bits of advice by 1 𝑇 2 𝑆(𝑇 + 1) 𝑂 + + . 𝐾 𝐾 𝐾𝑁 (︃

)︃

1 In this paper, we consider the regime 𝐾 ≤ 𝑁 ; while this inversion problem is not information-theoretically solvable with probability 1, it is solvable with high probability when 𝐾 ≤ 𝑐𝑁 for a sufficiently small constant 𝑐, while it is solvable with constant probability when 𝐾 = 𝑁 .

2

√ For 𝑇 = 𝑜( 𝐾), this requires 𝑆𝑇 = Ω(𝐾𝑁 ) for constant success, compared with 𝑆𝑇 = Ω(𝐾 2 ) for quantum advice. These thresholds coincide when 𝐾 = 𝑁 , but the classical advice bound is stronger for 𝐾 ≪ 𝑁 . Advantage over classical cryptography. We particularly note that Theorem 1.1 demonstrates a fascinating advantage of quantum cryptography over classical cryptography: a cryptosystem with 𝑛 qubits of communication2 can have security against preprocessing attacks with space up to 𝑆 = 𝑁 2 rather than 𝑆 = 𝑁 in the classical setting! In general, we √ obtain a time-space security tradeoff beating the classical (post-quantum) setting for all 𝑇 ≪ 𝑁 . This identifies a new advantage of quantum cryptography over classical cryptography: the achievable security level for a fixed (e.g.) commitment length. Methodology and additional results. As we explain in the technical overview, we prove Theorem 1.1 using a simple methodology inspired by a combination of the prior work [Liu23] and recent results on unitary synthesis [LMW24, DLM26]: • express the success probability of the optimal preprocessing algorithm as the maximum eigenvalue of a random matrix defined in terms of 𝑅, • bound this eigenvalue using the trace moment method • bound the trace moments via a natural interpretation using the compressed oracle methodology [Zha19]. This paradigm turns out to be quite powerful, leading to several additional results in this paper. Post-quantum PRGs. As a byproduct of this methodology, we obtain an improvement on the state-of-the-art security of PRGs in the aux-input QROM [Liu23]. Theorem 1.2 (Informal; see Theorem 8.2). Any 𝑇 -query adversary with 𝑆 qubits of advice has distinguishing advantage at most ⎛ ⎞ √︃ 𝑂⎝

𝑇2 + 𝑁

𝑆𝑇 ⎠ 𝑁

for breaking a PRG with seed length 𝑛 = log 𝑁 . √ As mentioned earlier, the prior known bound was 𝑂(𝑇 / 𝑁 + (𝑆𝑇 /𝑁 )1/3 ). In a nutshell, while [Liu23] consider a sequential repeated variant of PRG distinguishing, the operator norm method enables considering a “centered” random matrix governing the distinguishing advantage rather than the win probability; via the trace moment method, this enables reducing the bound to a variant of uniform PRG security. 2 For example, one can convert this OWS into a quantum bit commitment scheme with similar security with 𝑛-qubit commitments. See Section 7 for more details.

3

Single-copy pseudorandom states. We also prove a tight bound for 1-copy PRS in the special case 𝑇 = 0. Specifically, we show (see Theorem 11.2) that an adversary with 𝑆 qubits of advice has (︃ √ )︃ 𝑆 𝜀PRS ≤ 𝑂 (𝑇 = 0). 𝐾 Thus, in this setting, we obtain the same quantitative security for pseudorandomness as for onewayness. The symmetric subspace attack described above also gives a matching distinguishing attack up to logarithmic factors. In particular, Theorem 11.2 gives a formal hardness-of-approximation result for quantum programs [Yue22], which are unitary synthesis algorithms that consist only of an advice state (and are otherwise independent of the unitary being implemented). Yang, Renner, and Chiribella [YRC20] proved that 2−poly(𝑛) -accurate quantum programs require advice states of length Ω(𝑁 2 ); our result extends the tradeoff to rule out algorithms with low (or even just constant) fidelity (see [LMW24, DLM26] for formal definitions). Table 1 summarizes the known time-space-probability tradeoffs for breaking OWFs, PRGs, 1OWS, and 1PRS, respectively. Primitive Post-quantum OWFs Post-quantum PRGs One-way states (1OWS) Pseudorandom states (1PRS)

Security (︂ 2 )︂ 𝑇 + 𝑆(𝑇 + 1) 𝜀≤𝑂 (︃ )︃ √︂𝑁 𝑇2 𝑆(𝑇 + 1) 𝜀≤𝑂 + 𝑁 𝑁 (︃ )︃ √︀ 2 𝑇 + 𝑆(𝑇 + 1) 𝜀≤𝑂 𝑁 (︃ √ )︃ 𝑆 𝜀≤𝑂 (𝑇 = 0) 𝑁

Reference [Liu23] This work This work This work

Table 1: Security bounds against (𝑇, 𝑆)-preprocessing attacks in the aux-input QROM. We set 𝐾 = Θ(𝑁 ) in this comparison. 2 For the classical primitives, the OWF and PRG bounds have √︀ the same online query term 𝑇 /𝑁 , but the preprocessing term increases from 𝑆(𝑇 + 1)/𝑁 √︀ to 𝑆(𝑇 + 1)/𝑁 . This is inherent, as for 3 𝑇 = 0, a simple distinguisher achieves advantage Ω( 𝑆/𝑁 ). √ In contrast, at 𝑇 = 0, both our (tight) 1OWS and 1PRS bounds are 𝑂( 𝑆/𝑁 ); pseudorandomness does not incur an analogous square root loss.

Unitary synthesis with random oracle queries Finally, we analyze the hybrid query unitary synthesis model described above: a 1OWS or 1PRS attacker that can make polynomially many queries to the random oracle 𝑅 as well as one arbitrary function query 𝑓𝑅 depending on 𝑅. Without any extra queries to 𝑅, the results of [LMW24, DLM26] bound the search success probability and 3

For a fixed oracle 𝐺, memorize the optimal statistical distinguisher between the distribution 𝐺(𝑘)|[1:log 𝑆] ) and √︀ the uniform distribution. This requires 𝑆 bits of advice and achieves expected distinguishing advantage Ω( 𝑆/𝑁 ) for a random 𝐺. This is closely related to more sophisticated distinguishers studied in [DTT10].

4

(︁

)︁

) distinguishing advantage by 𝑂 log(2𝑀 and 𝑂 𝐾

(︂√︁

log(2𝑀 ) 𝐾

)︂

, respectively, where 𝑀 is the workspace

dimension. Using our methodology, we extend these results to the setting of additional adaptive queries to the random oracle. Theorem 1.3 (Informal; see Theorems 10.1 and 10.4). Consider an adversary with workspace dimension 𝑀 that makes one query to an arbitrary Boolean function 𝑓𝑅 , followed by 𝑇 queries to 𝑅. Its search success probability and distinguishing advantage are at most 𝑇 2 + (𝑇 + 1) log(2𝑀 ) 𝑂 𝐾 (︃

⎛√︃

)︃

and

𝑂⎝

⎞

𝑇 2 + (𝑇 + 1) log(2𝑀 ) ⎠ , 𝐾

respectively.4 We also obtain lower bounds when the adversary makes queries to 𝑅 both before and after its query to 𝑓𝑅 ; see Theorem 10.5. The quantitative bounds are weaker in this case, but still give negligible success probability/advantage when 𝐾 is exponential and the algorithm uses polynomially many queries and workspace qubits. Our proof also gives a new interpretation of the original results of [LMW24, DLM26]. After applying their spectral relaxation to remove the arbitrary function query, we can analyze the resulting operator using the trace moment method (rather than appealing to a generic matrix concentration inequality). The key point is that the rescaling matrices introduced by their spectral relaxation are linear in the coefficients of 𝑅. This is why a compressed oracle appears even though the original algorithm queries an arbitrary function of 𝑅, rather than 𝑅 itself. The same interpretation then accommodates actual queries to 𝑅.

1.2

Acknowledgements and AI use

A.L. thanks Fermi Ma, John Wright, and John Bostanci for helpful conversations in the early stages of this project. The research process leading to our main results included several interactive sessions with GPT5.5 Pro and GPT-5.6 Sol during April-August 2026. The main ideas behind several of the results were provided by the authors, but ChatGPT was used to help work out proof details. Theorem 6.1 was one-shot proved by ChatGPT given our previously obtained results, and ChatGPT is primarily responsible for the proof of Lemma 11.3 (the main lemma used to prove Theorem 11.2). All results and proofs have been post-processed by humans and the authors take full responsibility for the contents of this paper. GPT-5.6 Sol and GPT-6 Astra were used to help with the writing and preparation of this manuscript.

2

Technical Overview

We now describe the techniques behind our results, focusing on the special case of Theorem 1.1. We then describe some key modifications and innovations required to apply the technique to our other settings of interest. 4

We note that the distinguishing bound is likely not tight and can be improved to 𝑂

(︀ 𝑇 2 )︀ 𝐾

by a similar trick used in the proof of Theorem 1.2, but we have not worked out the details.

5

+𝑂

(︂√︁

(𝑇 +1) log(2𝑀 ) 𝐾

)︂

2.1

One-way states with no online queries

To show how we prove Theorem 1.1, we primarily consider the special case of 𝑇 = 0; here, an adversary is given one copy of the state 1 ∑︁ |𝜓𝑘 ⟩ = √ 𝑅(𝑘, 𝑥) |𝑥⟩ 𝑁 𝑥∈[𝑁 ] as well as an 𝑆-qubit advice state |𝜑𝑅 ⟩ depending on 𝑅, and wants to recover the string 𝑘. We wish to prove that any such adversary succeeds with probability at most √ (︁ 𝑆 )︁ . 𝑂 𝐾 𝑆 We note that in this 𝑇 = 0 special case, [DLM26] already prove the suboptimal bound 𝑂 𝐾 , but we will nevertheless use this case to demonstrate our new approach (and obtain the tight bound).

(︀

)︀

Operator norm captures advice. Fix the adversary’s oracle-independent algorithm. Roughly following [LMW24, DLM26], we can describe its computation as a fixed projective measurement {Π𝑘 }𝑘∈[𝐾] on the advice register A, the challenge register X, and an additional workspace register W initialized to |0⟩. Then, using an arbitrary advice state |𝜙⟩, the adversary’s success probability is given by E𝑘 ⟨𝜙|A ⟨0|W ⟨𝜓𝑅,𝑘 |X Π𝑘 |𝜙⟩A |0⟩W |𝜓𝑅,𝑘 ⟩X = ⟨𝜙| 𝑌𝑅 |𝜙⟩ , where we have defined the matrix 𝑌𝑅 := E𝑘 (𝐼A ⊗ ⟨0|W ⊗ ⟨𝜓𝑅,𝑘 |X ) · Π𝑘 · (𝐼A ⊗ |0⟩W ⊗ |𝜓𝑅,𝑘 ⟩X ). By construction, 𝑌𝑅 is positive semidefinite and acts on the 𝑆-qubit advice register. Since the |0⟩W dilation term is irrelevant for our arguments, we will drop it for the rest of this overview. With this setup, we can express the adversary’s win probability in the aux-input random oracle model as the expected operator norm E max ⟨𝜙| 𝑌𝑅 |𝜙⟩ = E‖𝑌𝑅 ‖op . 𝑅 |𝜙⟩

(1)

𝑅

Thus, we now ask: how do we prove tight bounds on this expected operator norm? [DLM26] expressed ‖𝑌𝑅 ‖op as the squared operator norm of a rectangular square root of 𝑌𝑅 and applied a concentration inequality for matrix Rademacher series, but this yields a suboptimal bound and does not generalize to 𝑇 > 0. The trace moment method. Rather than making black-box use of existing concentration inequalities, we apply one of the most common general-purpose methodologies for bounding the operator norm of a random matrix: the trace moment method. In particular, we consider the 2𝑆th trace moments and bound (︁

E𝑅 ‖𝑌𝑅 ‖op ≤ E𝑅 ‖𝑌𝑅 ‖2𝑆 op

)︁1/2𝑆

6

(︁

≤ E𝑅 Tr(𝑌𝑅2𝑆 )

)︁1/2𝑆

.

(2)

We choose a moment of order 𝑆 because the trace sums over 2𝑆 basis vectors, so the second inequality only incurs a constant factor loss. We thus focus on bounding E𝑅 Tr(𝑌𝑅2𝑆 ) =

∑︁

E𝑅 ⟨𝑧| 𝑌𝑅2𝑆 |𝑧⟩ ,

𝑧∈{0,1}𝑆

so every term now starts from an oracle-independent state |𝑧⟩. Enter compressed oracles. The entries of the matrix 𝑌𝑅2𝑆 are degree 4𝑆 polynomials in the coefficients of 𝑅; in such situations, in order to understand E𝑅 𝑌𝑅2𝑆 it is often fruitful to purify the random 𝑅 and study the resulting matrix using the compressed oracle framework [Zha19]. In more detail, in the uncompressed purification, the preparation of |𝜓𝑅,𝐾 ⟩ is the isometry 1 ∑︁ |𝑥⟩X ⊗ 𝑅(𝑘, 𝑥) |𝑅⟩ . |𝑅⟩ ↦−→ |𝜓𝑅,𝑘 ⟩X |𝑅⟩ = √ 𝑁 𝑥∈[𝑁 ] In the compressed oracle view, multiplication by 𝑅(𝑘, 𝑥) is replaced by the operator 𝑇𝑘,𝑥 that toggles the corresponding database entry: 𝑇𝑘,𝑥 |𝐷⟩ := |𝐷 ⊕ {(𝑘, 𝑥)}⟩ . Thus, the purified challenge preparation map given intial database |𝐷⟩db is given by 1 ∑︁ 𝐶̂︀𝑘 : |𝐷⟩db ↦−→ √ |𝑥⟩X ⊗ 𝑇𝑘,𝑥 |𝐷⟩db . 𝑁 𝑥∈[𝑁 ] The compressed version of 𝑌𝑅 is therefore 𝑌̂︀ := E𝑘 𝐶̂︀𝑘† (Π𝑘 ⊗ 𝐼db )𝐶̂︀𝑘 . This operator acts on the advice register A and the database register db. As initially a uniformly random 𝑅 is sampled, the initial compressed oracle database is |∅⟩ and the expression we are trying to bound is equal to E𝑅 Tr(𝑌𝑅2𝑆 ) =

∑︁

⟨𝑧, ∅| 𝑌̂︀ 2𝑆 |𝑧, ∅⟩ =

𝑧∈{0,1}𝑆

∑︁

⃦ ⃦2 ⃦ ̂︀ 𝑆 ⃦ ⃦𝑌 |𝑧, ∅⟩⃦ .

(3)

𝑧∈{0,1}𝑆

In a nutshell, there is hope for bounding this expression because (fixing a choice of 𝑧) |𝜑𝑆 ⟩ = 𝑌̂︀ 𝑆 |𝑧, ∅⟩ is a state supported on compressed oracle databases of size at most 2𝑆. Indeed, by considering the sequence of states |𝜑0 ⟩ , |𝜑1 ⟩ , . . . , |𝜑𝑆 ⟩ and applying a simple induction, our desired (︁ (︀ √ )︀)︁2𝑆 𝑆 follows from the following main technical claim:

bound ‖ |𝜑𝑆 ⟩ ‖2 ≤ 𝑂

𝐾

Claim 2.1. Let |𝜑⟩ on registers A, db be supported on compressed oracle databases of size at most ℓ. Then, √ (︁ 1 + ℓ )︁ ̂︀ ⟨𝜑| 𝑌 |𝜑⟩ ≤ 𝑂 . 𝐾 Informally, we view this type of argument as an abstract generalization of the alternating measurement game in [Liu23] where a (potentially non-physical) process is repeated, maintaining a joint advice-database state supported on sparse databases. The expression ⟨𝜑| 𝑌̂︀ |𝜑⟩ exactly corresponds to playing the OWS inversion game with a partially filled database register (entangled with the challenge state). 7

A simple small database bound. To complete the proof, it remains to prove the claim, bounding ⟨𝜑| 𝑌̂︀ |𝜑⟩ over databases of size at most√ℓ. We emphasize that in order to get the tight final result, we must currently prove a bound of ℓ/𝐾 (rather than a simpler ℓ/𝐾). Take any normalized state ∑︁ |𝜑𝐷 ⟩A |𝐷⟩db |𝜑⟩ = 𝐷

supported on databases of size at most ℓ. For a fixed key 𝑘, the state after challenge preparation is 𝐶̂︀𝑘 |𝜑⟩, so the quantity we want to bound is ⟨𝜑| 𝑌̂︀ |𝜑⟩ =

⃦2 1 ∑︁ ⃦ ⃦ ̂︀𝑘 |𝜑⟩⃦ ⃦(Π𝑘 ⊗ 𝐼db )𝐶 ⃦ . 𝐾 𝑘

To make the expression more convenient, we now also purify the random key 𝑘. The joint state after coherent challenge preparation is ∑︁ )︀ 1 ∑︁(︀ ̂︀ 1 |Ψ⟩ := √ 𝐶𝑘 |𝜑⟩ |𝑘⟩K = √ |𝜑𝐷 ⟩A |𝑥⟩X |𝐷 ⊕ {(𝑘, 𝑥)}⟩db |𝑘⟩K . 𝐾 𝑘 𝐾𝑁 𝑘,𝐷,𝑥

The event that the adversary’s output equals the purified hidden key is represented by Πwin :=

∑︁

Π𝑘 ⊗ 𝐼db ⊗ |𝑘⟩⟨𝑘|K ,

𝑘

so that

⟨𝜑| 𝑌̂︀ |𝜑⟩ = ‖Πwin |Ψ⟩‖2 .

We bound this squared norm by splitting Πwin |Ψ⟩ into three parts. Write 𝐷𝑘 = {𝑥 : (𝑘, 𝑥) ∈ 𝐷} and choose a threshold ℎ ≥ 1. Our three parts are then given by: • The triples (𝑘, 𝐷, 𝑥) with |𝐷𝑘 | > ℎ (“heavy rows”). This component |Ψ1 ⟩ of |Ψ⟩ has squared norm at most ℓ/(𝐾ℎ), because a database with ℓ entries has at most ℓ/ℎ such rows, and 𝑘 is uniform. • Among the remaining 𝑘, consider the part satisfying (𝑘, 𝑥) ∈ 𝐷 (where the challenge preparation actually removes an entry from 𝐷). This component |Ψ2 ⟩ of |Ψ⟩ has squared norm at most ℓ/(𝐾𝑁 ), since a uniform pair (𝑘, 𝑥) hits the database with at most this probability. In the remaining new entry (and main) part |Ψ3 ⟩ of |Ψ⟩, challenge preparation adds (𝑘, 𝑥) to a row of size at most ℎ. We group its amplitudes by the final database 𝐹 = 𝐷 ∪ {(𝑘, 𝑥)}. For a fixed final database 𝐹 and key 𝑘, the only possible histories are obtained by declaring one of the entries (𝑘, 𝑥) ∈ 𝐹 to be the newly added challenge entry; hence there are at most ℎ + 1 coherently interfering histories. Cauchy–Schwarz therefore bounds its success contribution by ‖ΠWin |Ψ3 ⟩ ‖2 ≤

ℎ + 1 ∑︁ ℎ+1 . ⟨𝜑𝐷 |A ⟨𝑥|X Π𝑘 |𝜑𝐷 ⟩A |𝑥⟩X = 𝐾𝑁 𝐷,𝑘,𝑥 𝐾

Combining the three parts using the triangle inequality gives ⟨𝜑| 𝑌̂︀ |𝜑⟩ ≤ 3 Setting ℎ =

√

(︂

ℓ ℓ ℎ+1 + + . 𝐾ℎ 𝐾𝑁 𝐾 )︂

ℓ yields the desired bound. 8

2.2

Adding online queries

Fortunately, the 𝑇 = 0 case captures most of our full proof of Theorem 1.1. To handle the case of 𝑇 > 0, we let 𝐴𝑅 denote the adversary’s 𝑇 -query algorithm. The matrix of interest then becomes 𝑌𝑅 = E𝑘 ⟨𝜓𝑅,𝑘 | 𝐴†𝑅 Π𝑘 𝐴𝑅 |𝜓𝑅,𝑘 ⟩ , with fixed ancillas suppressed. Indeed, the matrix 𝑌𝑅 still has the property that ⟨𝜙| 𝑌𝑅 |𝜙⟩ is equal to the probability that the adversary successfully inverts on a random challenge with advice state |𝜙⟩. Crucially, 𝑌𝑅 still has the property that its entries have low degree in 𝑅, namely degree 2(𝑇 + 1). As a result, when we purify 𝑌𝑅 to 𝑌̂︀ , the resulting matrix can increase a compressed oracle database size by at most 2(𝑇 + 1). With this setup, our proof from earlier goes through unchanged up until the key claim, which now becomes: Claim 2.2. Let |𝜑⟩ on registers A, db be supported on compressed oracle databases of size at most ℓ. Then, √ (︁ 1 + 𝑇 2 + ℓ )︁ ⟨𝜑| 𝑌̂︀ |𝜑⟩ ≤ 𝑂 . 𝐾 In other words, the 𝑇 queries to (the purified) 𝑅 help with inversion only so much as Grover’s algorithm moves a state towards the desired solution. We prove this claim (Lemma 5.3), by generalizing our 𝑇 = 0 analysis. The main new difficulty concerns contributions for which the entry (𝑘, 𝑥) associated with the original |𝑥⟩ summand of the challenge is absent from the final database. In the 𝑇 = 0 case, this can happen only if (𝑘, 𝑥) was already present in the initial database, so challenge preparation deleted it. With online queries, however, an entry added by challenge preparation can also be removed by a subsequent online query √ contributions inductively: their norm starts √︀ to the same position. We bound these at most ℓ/(𝐾𝑁 ) and increases by at most 𝑂(1/ 𝐾) per query, giving a squared norm bound of (︀ ℓ 2 )︀ 𝑂 𝐾𝑁 + 𝑇𝐾 . Substituting ℓ = 𝑂(𝑆(𝑇 + 1)) into the claim yields (︃

𝜀OWS ≤ 𝑂

𝑇2 +

𝑆(𝑇 + 1) , 𝐾

√︀

)︃

completing our proof of Theorem 1.1.

2.3

Sketches of our additional results

We defer detailed discussions of our additional results to their respective technical sections, but we briefly summarize the additional ideas required to obtain them. We emphasize that for each result below, we apply the high-level strategy of bounding the trace moments of an appropriate matrix 𝑌𝑅 . Post-quantum PRGs. For a random oracle 𝑅 : [𝑁 ] → [𝑀 ], let 𝐴𝑅 = (𝑂𝑅 𝑈 )𝑇 denote the adversary’s online computation and let 0 ⪯ Π ⪯ 𝐼 be its final acceptance operator. The matrix of interest is now 𝑌𝑅 := E𝑥∈[𝑁 ] ⟨𝑅(𝑥)| 𝐴†𝑅 Π𝐴𝑅 |𝑅(𝑥)⟩ − E𝑟∈[𝑀 ] ⟨𝑟| 𝐴†𝑅 Π𝐴𝑅 |𝑟⟩ . 9

In particular, | ⟨𝜙| 𝑌𝑅 |𝜙⟩ | is equal to the adversary’s distinguishing advantage using advice |𝜙⟩, so optimizing over advice again gives E𝑅 ‖𝑌𝑅 ‖op . Compared to the OWS (or OWF) setting, there is not an obvious operational interpretation of “repeating 𝑌𝑅 ”, but we can nevertheless apply the trace moment method (and inductive analysis from earlier) to bound its operator norm! As before, each application of the compressed operator 𝑌̂︀ increases the database size by at most 2𝑇 + 2. The analogue of our key claim is that, for any normalized state |𝜑⟩ on the advice and database registers supported on databases of size at most ℓ, ⎛ √︃ ⎞ ⃒ ⃒ 2 𝑇 ℓ⎠ ⃒ ⃒ . + ⃒⟨𝜑| 𝑌̂︀ |𝜑⟩⃒ ≤ 𝑂 ⎝

𝑁

𝑁

To prove this bound, we introduce a resampling hybrid: instead of providing 𝑅(𝑥) as the challenge, we sample an independent 𝑟 ∈ [𝑀 ] and replace √︀ the oracle value at the hidden seed 𝑥 by 𝑟. The contribution from the initial database is 𝑂( ℓ/𝑁 ), while the change in the average acceptance probability caused by reprogramming a uniform position is 𝑂(𝑇 2 /𝑁 ). Substituting ℓ = 𝑂(𝑆(𝑇 +1)) into the small database bound gives ⎛

𝑇2 𝜀PRG ≤ 𝑂⎝ + 𝑁

√︃

⎞

𝑆(𝑇 + 1) ⎠ , 𝑁

proving Theorem 1.2. 1PRS with 𝑇 = 0. This setting follows the setup from the 1OWS case but works with a single test Π (rather than a measurement {Π𝑘 }) and considers the centered matrix 𝑌𝑅 := E𝑘 ⟨𝜓𝑅,𝑘 | Π |𝜓𝑅,𝑘 ⟩ −

1 ∑︁ ⟨𝑥| Π |𝑥⟩ . 𝑁 𝑥∈[𝑁 ]

This is the difference between the real and ideal acceptance operators on the 𝑆-qubit advice register, so maximizing | ⟨𝜑| 𝑌𝑅 |𝜑⟩ | over advice gives ‖𝑌𝑅 ‖op . The corresponding “small database” bound, presented in Section 11.2, is a significant departure from the other proof techniques in this paper. Specifically, we introduce an alternative purification of compressed oracle databases as uniform superpositions of ordered databases, and describe the effect of challenge generation in terms of swaps between the existing database positions and a new one, increasing the database size by one. We refer the reader to Section 11 for more details. One-query unitary synthesis. To recover the random binary phase state result from [DLM26], we apply their spectral relaxation but give a new compressed oracle analysis of the resulting expected operator norm. Writing the adversary as a fixed isometry 𝑉 : C𝑁 → C𝑀 , a phase query 𝑂𝑓𝑅 , and a final measurement, the weight vector decomposition of [LMW24, DLM26] gives 𝑉 |𝜓𝑅,𝑘 ⟩ = 𝐷𝑅,𝑘 |wt𝑉 ⟩, where |wt𝑉 ⟩ is fixed and 𝐷𝑅,𝑘 is diagonal. Since 𝐷𝑅,𝑘 commutes with 𝑂𝑓𝑅 , search success is a quadratic form in 𝑂𝑓𝑅 |wt𝑉 ⟩ with matrix † 𝑌𝑅 := E𝑘 𝐷𝑅,𝑘 Π𝑘 𝐷𝑅,𝑘 .

Thus, it suffices to bound E𝑅 ‖𝑌𝑅 ‖op . Crucially, 𝐷𝑅,𝑘 = 𝑥 𝑅(𝑘, 𝑥)𝐷𝑥 for fixed diagonal matrices 𝐷𝑥 , so the matrix 𝑌𝑅 is Hermitian PSD and quadratic in 𝑅! Thus, we can apply the same methodology and attempt to purify 𝑅 and bound the resulting trace moments in the compressed oracle ∑︀

10

basis. For the small database bound, we (similarly to the 1OWS case with 𝑇 = 0) split the rescaling ∑︀ ∑︀ into addition and deletion terms and use 𝑥 𝐷𝑥† 𝐷𝑥 = 𝑥 𝐷𝑥 𝐷𝑥† ⪯ 𝐼 in place of normalization of challenge preparation. This gives a small database search bound of 𝑂((ℓ + 1)/𝐾). We refer the reader to Section 9 for more details. The hybrid unitary synthesis model. In the hybrid unitary synthesis model, there are two types of queries to the random oracle 𝑅 that must be treated differently. For queries to 𝑅 that occur before the function query 𝑓𝑅 , we generically remove them with a sub-optimal but polynomial security loss, and leave a tight analysis of these queries for future work. The main part of the analysis is handling the combination of one function query 𝑓𝑅 with 𝑇 queries to 𝑅 afterwards. Letting 𝐴𝑅 be the adversary’s 𝑇 -query algorithm, we arrive at the matrix † 𝑌𝑅 := E𝑘 𝐷𝑅,𝑘 𝐴†𝑅 Π𝑘 𝐴𝑅 𝐷𝑅,𝑘 .

Crucially, 𝑌𝑅 still has degree at most 2𝑇 + 2 in 𝑅, so the methodology (conceivably) applies. The key idea in the small database bound √︀ is to swap the challenge row with an unused independent row. The initial swap contributes 𝑂( ℓ/𝐾) to the success amplitude, while the subsequent query √ hybrid contributes 𝑂(𝑇 / 𝐾). This gives the desired bound 𝑂((1 + 𝑇 2 + ℓ)/𝐾).

3

Preliminaries

We use 𝑁 = 2𝑛 for the dimension of the main 𝑛-qubit register and 𝑀 = 2𝑚 for the dimension of the adversary’s post-isometry workspace. For a positive integer 𝐾, we write [𝐾] := {1, . . . , 𝐾}. When we write 𝑥 + 𝑦 or 𝑥 · 𝑦 for 𝑥, 𝑦 ∈ {0, 1}𝑛 , the operations are taken over F𝑛2 .

3.1

Quantum random oracle model and compressed oracles

In the quantum random oracle model, a hash function is modeled as a random classical function 𝑅 : {0, 1}𝑛1 → {0, 1}𝑛2 (with the below sections, we might consider different input and output lengths). The function 𝑅 is sampled at the beginning of any considered game and then fixed. A quantum oracle algorithm with oracle access to 𝑅 can make queries to 𝑅, with oracle access defined by a unitary 𝑂𝑅 : |𝑥, 𝑦⟩ ↦→ |𝑥, 𝑦 ⊕ 𝑅(𝑥)⟩, together with intermediate unitaries between queries as 𝑈1 , ..., 𝑈𝑡+1 . That is, a quantum oracle algorithm with access to 𝑅 can be defined as a sequence of unitaries: 𝑈1 , 𝑂𝑅 , 𝑈2 , 𝑂𝑅 , ..., 𝑈𝑡 , 𝑂𝑅 , 𝑈𝑡+1 . The number of queries in this case is 𝑡. Without loss of generality (by adding a register as a counter), we can assume that the intermediate unitaries are the same 𝑈 . Compressed oracles [Zha19]. We use the Fourier representation of the compressed oracle. That is, we consider both the uncompressed phase oracle |𝑥⟩ ⊗ |𝑅⟩ ↦→ 𝑅(𝑥) |𝑥⟩ ⊗ |𝑅⟩ for 𝑅 : [𝑁 ] → {±1}, and the uncompressed standard oracle |𝑥, 𝑦⟩ ⊗ |𝑅⟩ ↦→ |𝑥, 𝑦 ⊕ 𝑅(𝑥)⟩ ⊗ |𝑅⟩ , and convert the purification register of each of these into the Fourier basis. In the Fourier basis, we describe the purification register as containing a database, and we have that a compressed oracle 11

query changes at most one entry in a database. We refer the reader to the original paper [Zha19] for more details.

3.2

Canonical quantum bit commitments

We follow the canonical quantum bit commitments as defined from [Yan22, HMY23]. We use the formulation with quantum auxiliary inputs, and later consider its quantitative security in the quantum random oracle model. This section is mostly taken verbatim from Section 3.2 of [HMY23]. Definition 3.1 (Canonical quantum bit commitments). A canonical quantum bit commitment scheme is specified by polynomial-time computable unitaries {𝑄0 (𝜆), 𝑄1 (𝜆)}𝜆∈N on polynomialsize registers C (commit) and W (decommit, as witness). For 𝑏 ∈ {0, 1}, define |𝜓𝑏 ⟩CW := 𝑄𝑏 |0⟩CW ,

Π𝑏 := |𝜓𝑏 ⟩⟨𝜓𝑏 |CW ,

𝜌𝑏 := TrW (Π𝑏 ).

(For simplification we omit 𝜆 and simply write 𝑄0 , 𝑄1 to mean 𝑄0 (𝜆) and 𝑄1 (𝜆).) Remark 3.2 (Protocol). To commit to 𝑏, the sender prepares |𝜓𝑏 ⟩CW , transmits C, and retains W. To open, the sender transmits (𝑏, W); the receiver accepts according to the projector Π𝑏 . Definition 3.3 (Hiding). For computational hiding, every non-uniform quantum polynomial-time distinguisher 𝒜 with polynomial-size quantum advice must satisfy ⃒ [︀ ]︀ [︀ ]︀⃒⃒ ⃒ ⃒Pr 𝒜(1𝜆 , 𝜌0 ) = 1 − Pr 𝒜(1𝜆 , 𝜌1 ) = 1 ⃒ = negl(𝜆).

Statistical hiding and perfect hiding require, respectively, 1 ‖𝜌0 − 𝜌1 ‖1 = negl(𝜆) 2

and

𝜌0 = 𝜌1 .

Definition 3.4 (Binding). Computational binding requires every polynomial-time computable unitary 𝑈WZ and every normalized auxiliary state |𝜏 ⟩Z on polynomially many qubits to satisfy ⃦ (︀ ⃦(Π1 ⊗ 𝐼Z )(𝐼C ⊗ 𝑈WZ ) |𝜓0 ⟩

CW ⊗ |𝜏 ⟩Z

)︀⃦ ⃦ = negl(𝜆). 2

Statistical binding removes the efficiency restriction on 𝑈 . Perfect binding requires the norm to equal zero for every such 𝑈 and |𝜏 ⟩.

3.3

1OWS and 1PRS

Let StateGen be a quantum polynomial-time algorithm that, on input (1𝜆 , 𝑘) for 𝑘 ∈ [𝐾], outputs an 𝑛(𝜆)-qubit pure state |𝜓𝑘 ⟩, where 𝐾 = 2𝜅(𝜆) and 𝑁 = 2𝑛(𝜆) . Here 𝜅 and 𝑛 are polynomially bounded. We consider non-uniform quantum polynomial-time adversaries with polynomial-size quantum advice independent of the challenge. For simplicity, we omit 𝜆 from the notation when it is clear. One-way state generators were introduced by Morimae and Yamakawa [MY22]. Their standard definition uses verification of the adversary’s output key, while [MY22, Remark 4.1] also considers the alternative requirement of recovering the sampled key itself. We use the single-copy version of this key-recovery formulation. Its success condition also matches that of the oracle state search game in [DLM26, Definition 4.1]. 12

Definition 3.5 (Single-copy one-way states, 1OWS). We say that StateGen generates single-copy one-way states (1OWS), in the key-recovery sense, if every such adversary 𝒜 satisfies Pr [𝒜(1𝜆 , |𝜓𝑘 ⟩) = 𝑘] = negl(𝜆).

𝑘←[𝐾]

The adversary receives one copy of |𝜓𝑘 ⟩ and succeeds if it outputs the sampled key 𝑘. The above definition allows 1OWS to be information-theoretically secure. For the random binary phase states considered in this paper, each pair of distinct states has expected squared overlap 1/𝑁 . Summing over the 𝐾 − 1 wrong keys gives a total expected squared overlap of (𝐾 − 1)/𝑁 ≤ 1. The overlap bound for the pretty-good measurement (or quantum union bound on testing a constant fraction of all possible keys) therefore implies that an adversary knowing the full oracle table can recover the key with constant probability, averaged over 𝑅. Thus, this family is informationtheoretically insecure, and we study the resources (queries, advice) required to recover the key. A distinguishing version gives pseudorandom states. Pseudorandom quantum states were introduced by Ji, Liu, and Song [JLS18], whose definition requires computational indistinguishability from Haar-random states even given polynomially many copies. We consider the singlecopy variant studied by Morimae and Yamakawa [MY22, Definition 2.2] and Lombardi, Ma, and Wright [LMW24, Definition 5.1], where the adversary receives only one copy of the challenge state. Definition 3.6 (Single-copy pseudorandom states, 1PRS). We say that StateGen generates singlecopy pseudorandom states (1PRS) if 𝑛(𝜆) ≥ 𝜅(𝜆) + 1 and every such adversary 𝒜 satisfies ⃒ ⃒ ⃒ ⃒ ⃒ ⃒ ⃒ Pr [𝒜(1𝜆 , |𝜓𝑘 ⟩) = 1] − Pr [𝒜(1𝜆 , |𝜓⟩) = 1]⃒ = negl(𝜆), ⃒ ⃒𝑘←[𝐾] |𝜓⟩←𝜇𝑁

where 𝜇𝑁 is the Haar distribution on pure states in C𝑁 . In both experiments the adversary receives one copy of the challenge state. In this paper, we consider the binary phase state family [LMW24] generated from a random ∑︀ oracle 𝑅 : [𝐾] × [𝑁 ] → {±1}, |𝜓𝑅,𝑘 ⟩ := √1𝑁 𝑥∈[𝑁 ] 𝑅(𝑘, 𝑥)|𝑥⟩. For a known key 𝑘, this state can be generated using one query to 𝑅. We study the key-recovery probability and distinguishing advantage for this family under non-uniform (with advice) oracle-access bounds specified in each game.

3.4

The unitary synthesis problem

The unitary synthesis problem asks whether an arbitrary quantum unitary can be (approximately) implemented efficiently given oracle access to a suitable Boolean function [LMW24]. We recall the oracle-circuit formulation from [LMW24]. Definition 3.7 (Approximating a unitary, [LMW24]). Let 𝑈 be an 𝑛-qubit unitary, and let Φ𝑈 be the associated quantum channel. Let Φapprox be a quantum channel with 𝑛-qubit input and output registers. We say that Φapprox 𝜀-approximates 𝑈 if 𝐷◇ (Φapprox , Φ𝑈 ) ≤ 𝜀. 13

Definition 3.8 (Channel implemented by an oracle circuit, [LMW24]). Given a 𝑡-query oracle circuit 𝒜(·) with an 𝑛-qubit input register, an (𝑚 − 𝑛)-qubit ancilla register, intermediate unitaries 𝑈1 , . . . , 𝑈𝑡+1 on 𝑚 qubits, and a Boolean function 𝑓 : {0, 1}𝑚 → {±1}, the induced 𝑛-qubit channel Φ𝒜𝑓 acts as follows. 1. On input |𝜓⟩, prepare 𝑈𝑡+1 · 𝑂𝑓 · 𝑈𝑡 · · · 𝑂𝑓 · 𝑈2 · 𝑂𝑓 · 𝑈1 ( |𝜓⟩ |0𝑚−𝑛 ⟩). 2. Output the first 𝑛 qubits and discard the remaining (𝑚 − 𝑛) qubits. Definition 3.9 (The unitary synthesis problem, [LMW24]). Fix an error parameter 𝜀(𝑛) = 2−Ω(𝑛) . The unitary synthesis problem asks whether there exists a universal oracle circuit 𝒜(·) , computable by a poly(𝑛)-size quantum circuit and making poly(𝑛) oracle queries, such that for every 𝑛-qubit unitary 𝑈 there exists a Boolean function 𝑓 : {0, 1}* → {±1} with 𝐷◇ (Φ𝒜𝑓 , Φ𝑈 ) ≤ 𝜀(𝑛). In terms of proving unitary synthesis hardness, instead of dealing with diamond norm hardness, we study through two related oracle state games: the oracle state distinguishing game from [LMW24] and the oracle state search game from [DLM26]. The reductions in [LMW24, Section 3.3] and [DLM26, Section 4.1] connect hardness of these games, for suitable state families, to the hardness of unitary synthesis. We formally define the search and distinguishing games in Sections 9.1 and 9.2, respectively, and analyze them for random binary phase states.

3.5

One-query oracle algorithms

The lower bounds in this paper all concern one-query algorithms in terms of the arbitrary phase oracle, so we record a normal form. This also helps capture one-query algorithms when additional access to the underlying random oracle is allowed. Definition 3.10 (One-query unitary synthesis algorithm). A one-query unitary synthesis algorithm on 𝑛-qubit inputs is specified by • an oracle 𝑂𝑓 , • an isometry 𝑉 : C𝑁 → C𝑀 , representing the computation before the oracle query, and • a unitary 𝑈 on C𝑀 , representing the computation after the oracle query. On input |𝜓⟩ ∈ C𝑁 , the algorithm prepares 𝑈 𝑂𝑓 𝑉 |𝜓⟩ and then outputs the designated 𝑛-qubit subsystem. Fixing the computational basis on the 𝑀 -dimensional workspace, every isometry 𝑉 : C𝑁 → C𝑀 can be written as ∑︁ 𝑉 = |𝑖⟩ ⟨𝑣𝑖 | , 𝑖∈[𝑀 ]

where the vectors |𝑣𝑖 ⟩ ∈ C𝑁 satisfy

∑︁

|𝑣𝑖 ⟩⟨𝑣𝑖 | = I𝑁 .

𝑖∈[𝑀 ]

We will repeatedly use this row-vector description of 𝑉 below. 14

3.6

The weight-vector decomposition

We now record the diagonal decomposition of the pre-query isometry. This is mostly taken verbatim from Section 3.3 of [DLM26]. While [DLM26, Lemma 3.10] uses a weight vector attached to both 𝑉 and a distribution on the input states, here we consider the distribution as Haar random, since the input state from this paper is mostly a random binary phase state. Lemma 3.11 (Weight-vector decomposition, modified from [DLM26, Lemma 3.10]). Let 𝑉 : C𝑁 → C𝑀 be an isometry, and write ∑︁ 𝑉 = |𝑖⟩ ⟨𝑣𝑖 | . 𝑖∈[𝑀 ]

Let 𝜇 be the Haar random distribution on pure states in C𝑁 , and define 𝑝𝑖 := E𝜓∼𝜇 |⟨𝑣𝑖 | 𝜓⟩|2 = [︀

]︀

⟨𝑣𝑖 |𝑣𝑖 ⟩ , 𝑁

∑︁ √

|wt𝑉 ⟩ :=

𝑝𝑖 |𝑖⟩ .

𝑖∈[𝑀 ]

For each pure state |𝜓⟩, define the diagonal matrix 𝐷𝑉,𝜓 :=

⟨𝑣𝑖 | 𝜓⟩ |𝑖⟩⟨𝑖| , √ 𝑝𝑖 𝑖∈[𝑀 ]: 𝑝 >0 ∑︁

𝑖

with diagonal entry 0 when 𝑝𝑖 = 0. Then |wt𝑉 ⟩ is a unit vector, and for every |𝜓⟩ we have 𝑉 |𝜓⟩ = 𝐷𝑉,𝜓 |wt𝑉 ⟩ . Proof. Since 𝑉 is an isometry, ⎛

⎞

|⟨𝑣𝑖 | 𝜓⟩|2 = ⟨𝜓| ⎝

∑︁ 𝑖∈[𝑀 ]

∑︁

|𝑣𝑖 ⟩⟨𝑣𝑖 |⎠ |𝜓⟩ = ⟨𝜓| 𝜓⟩ = 1

𝑖∈[𝑀 ]

for every unit vector |𝜓⟩. From the definition of 𝑝𝑖 , 𝑖 𝑝𝑖 = 1, so |wt𝑉 ⟩ has unit norm. For the decomposition itself, if 𝑝𝑖 = 0 then the nonnegative random variable |⟨𝑣𝑖 | 𝜓⟩|2 has expectation 0, and hence vanishes for every |𝜓⟩. Therefore, for every |𝜓⟩, ∑︀

𝐷𝑉,𝜓 |wt𝑉 ⟩ =

∑︁ ⟨𝑣𝑖 | 𝜓⟩

√

𝑖∈[𝑀 ]

4

𝑝𝑖

⎛

|𝑖⟩⟨𝑖| ⎝

∑︁ √

⎞

𝑝𝑗 |𝑗⟩⎠ =

𝑗∈[𝑀 ]

∑︁

⟨𝑣𝑖 | 𝜓⟩ |𝑖⟩ = 𝑉 |𝜓⟩ .

𝑖∈[𝑀 ]

Our use of the trace moment method

All of our proofs follow the same high-level strategy: bound the winning probability (or distinguishing advantage) by the expected operator norm of a random Hermitian matrix. • For quantum advice, this matrix arises by optimizing over the advice state, and view the value as the operator norm. 15

• For one-query unitary synthesis lower bound, it arises from the spectral relaxation from the weight vector decomposition trick in Section 3.6. This expresses the maximum over all 𝑓𝑅 as the maximum quadratic form over a diagonally updated weight vector, which is upper bounded by an operator norm. Once this reduction is made, the same trace-moment argument applies: Let 𝑌𝑅 be a random Hermitian matrix acting on a 𝑑-dimensional space. For every positive integer 𝑡, (︁

E𝑅 ‖𝑌𝑅 ‖ ≤ E𝑅 Tr(𝑌𝑅2𝑡 )

)︁1/2𝑡

.

We express the trace moment using the compressed oracle representation of 𝑌𝑅 , with the database initially empty. • The trace can be viewed as an algorithm that starts with a uniformly random classical input, and each application of 𝑌 changes the database size by a bounded amount. • It therefore suffices to control the corresponding operator on states supported on small databases, as this will help us bound the growth of the norm. • Taking 𝑡 on the order of the input qubits will make the factor contributed by the trace dimension constant (or say, cancel out the union bound or guessing of the starting classical input).

5

Non-uniform security of 1OWS in QROM

In this section, we prove a non-uniform security of single-copy one-way states (specifically, the binary phase states) in the quantum random oracle model, via the trace moment method. Specifically, we show that any 𝑇 -query quantum algorithm with 𝑆-qubit advice can (︂ √ invert )︂a single copy of a random binary phase state with winning probability at most 𝑂

𝑇 2 +1+

𝑆(𝑇 +1)

𝐾

.

Definition 5.1 (1OWS security game). In the non-uniform security game of 1OWS: • In the offline stage, a hash function 𝑅 : [𝐾]×[𝑁 ] → {±1} is sampled and fixed (here 𝐾 ≤ 𝑁 ), and an algorithm is allowed to have an 𝑆-qubit advice that depends arbitrarily on 𝑅 before receiving the challenge. • Then, in the online stage, a challenger will sample a random key 𝑘 ← [𝐾], and generate a ∑︀ single-copy of state |𝜓𝑅,𝑘 ⟩ := √1𝑁 𝑥 𝑅(𝑘, 𝑥) |𝑥⟩, and send it to the algorithm. • The algorithm, after receiving the challenge |𝜓𝑅,𝑘 ⟩, is allowed to make 𝑇 queries to 𝑅 and is asked to output a guess 𝑘 ′ . It succeeds if 𝑘 ′ = 𝑘. We consider security game in QROM, for 𝑅 as a random oracle, and the algorithm can have oracle access to 𝑂𝑅 . The non-uniform security (in terms of 𝑆-qubit, 𝑇 -query) of 1OWS in QROM is defined as the maximum winning probability, parametrized by (𝑆, 𝑇, 𝐾, 𝑁 ). Theorem 5.2 (Non-uniform security of 1OWS in QROM). For integer 𝑆, 𝑇 ≥ 0,(︂𝐾 ≤ 𝑁√ , the non)︂ uniform security (with 𝑆-qubit advice and 𝑇 -query) of 1OWS in QROM is 𝑂 (︂ )︂ √ 𝑇 2 +1+ 𝑆(𝑇 +1) . that is, the maximum winning probability is bounded by 𝑂 𝐾 16

𝑇 2 +1+

𝑆(𝑇 +1)

𝐾

;

Proof overview. Via the trace-moment method, we first express the search probability as the expected norm of an operator on the advice register, bound it by a trace moment, and also view them in the compressed oracle database mode (Section 5.1). Then, the main step is to bound the corresponding search probability when the algorithm starts with an arbitrary state entangled with a compressed database of size ≤ ℓ (Section 5.2). For the search case with initial database of size ≤ ℓ, a weaker bound of 𝑂((𝑇 2 + ℓ)/𝐾) would be easy to obtain, by introducing a hybrid that resamples the challenge key row (resampling the 𝑅(𝑘, ·)√︀part). Compared to the real case, the difference (in terms of amplitude) can be bounded by 𝑂( ℓ/𝐾) for the initial database where the database on challenge key row 𝑘 is non-empty. Compared to an ideal case where the challenge is fully random, the difference can be bounded by √ 𝑂(𝑇 / 𝐾) through a modified BBBV-style √ hybrid argument. 2 To prove this stronger bound 𝑂((𝑇 + ℓ)/𝐾) (Lemma 5.4, proof in Section 5.3), we use a finer analysis that checks contributions from the following components: • Is the final database on the challenge key 𝑘 large (or not)? – If the final database on the challenge key 𝑘 is large, then the initial database on 𝑘 should also be large. Then this can be bounded by the size of the initial database. Specifically, for each initial database bounded by size ℓ, it cannot have ℎ-size databases on ≥ ℓ/ℎ √ keys. We set ℎ = ℓ here. • Does the “challenge entry” stay in the final database? Or say, for the 𝑥 part in the final state, where it is from |𝑥⟩ in the superposition of the initial challenge state, is (𝑘, 𝑥) in the final database? – If (𝑘, 𝑥) is in the final database, note that the final database on challenge key 𝑘 is small now (if large, it lands in the case already discussed above). Therefore, in the corresponding coherent sum over 𝑥 inside the final database, paying only that small number can make it into a sum of individual squared norms, which would be easy to upper bound by completeness of the output measurement and unitarity. – If (𝑘, 𝑥) is not in the final database, this means (𝑘, 𝑥) is in the initial database (which would be expected to bound by 𝑂(ℓ/𝐾𝑁 )), or is queried within the 𝑇 queries (which would be expected to bound by 𝑂(𝑇 2 /𝐾)). This is because (𝑘, 𝑥) is added (by ⊕) to the database from the challenge state before the first query.

5.1

1OWS trace-moment setup

For any quantum oracle algorithm in the 1OWS security (search) game, denote its intermediate unitary between queries as 𝑈 , final projective measurement as {Π𝑘 }𝑘∈[𝐾] , and suppose of hash function 𝑅 its advice is |𝜑𝑅 ⟩. We can write its maximum winning probability as the following: † 𝑇 E𝑅 max E𝑘 ⟨𝜑𝑅 | ⟨𝜓𝑅,𝑘 | ⟨0𝑤 |W (𝑈 † 𝑂𝑅 ) Π𝑘 (𝑂𝑅 𝑈 )𝑇 |𝜓𝑅,𝑘 ⟩ |𝜑𝑅 ⟩ |0𝑤 ⟩W . 𝜑𝑅

Here |0𝑤 ⟩W denotes the algorithm’s workspace of 𝑤 qubits, which starts with an all 0 state. From the definition of the operator norm, this is exactly equal to ⃦ ⃦

⃦ ⃦

† 𝑇 ) Π𝑘 (𝑂𝑅 𝑈 )𝑇 |𝜓𝑅,𝑘 ⟩ |0⟩W ⃦ . E𝑅 ‖𝑌𝑅 ‖ := E𝑅 ⃦E𝑘 ⟨𝜓𝑅,𝑘 | ⟨0|W (𝑈 † 𝑂𝑅

17

(4)

Here we define 𝑌𝑅 as the matrix inside the norm. Now our goal is to bound E𝑅 ‖𝑌𝑅 ‖. Via the trace moment method, by Jensen’s inequality, we have (︁

E𝑅 ‖𝑌𝑅 ‖ ≤ E𝑅 ‖𝑌𝑅 ‖2𝑡

)︁1/2𝑡

≤ E𝑅 Tr 𝑌𝑅2𝑡

∑︁

E𝑅 ⟨𝑧| 𝑌𝑅2𝑡 |𝑧⟩ .

(︁

(︁

)︁)︁1/2𝑡

.

Therefore, now our goal is to upper bound (︁

)︁

E𝑅 Tr 𝑌𝑅2𝑡 =

(5)

𝑧∈[2𝑆 ]

Rewrite in compressed oracle framework. For random function 𝑅, we can write all things above in the compressed oracle framework. Note that in the un-compressed world, the isometry that writes |𝜓𝑅,𝑘 ⟩ into a fresh challenge register can be viewed as 1 ∑︁ |𝑅⟩ ↦→ |𝜓𝑅,𝑘 ⟩ ⊗ |𝑅⟩ = √ |𝑥⟩ ⊗ 𝑅(𝑘, 𝑥) |𝑅⟩ . 𝑁 𝑥 Define 𝑇𝑘,𝑥 on the compressed oracle register that flips the presence of the database entry (𝑘, 𝑥); that is, 𝑇𝑘,𝑥 |𝐷⟩ = |𝐷 ⊕ {(𝑘, 𝑥)}⟩. Now the isometry that generates the fresh challenge using one compressed query can be viewed as (︃

|𝐷⟩ ↦→

1 ∑︁ √ |𝑥⟩ ⊗ 𝑇𝑘,𝑥 𝑁 𝑥

)︃

|𝐷⟩ .

Therefore, we can define 𝑌̂︀ in the compressed oracle database mode as 𝑌̂︀ =

∑︁ 1 · E𝑘 ⟨𝑥1 | ⟨0𝑤 | (𝑈 † cO† )𝑇 Π𝑘 (cO 𝑈 )𝑇 |𝑥2 ⟩ |0𝑤 ⟩ ⊗ 𝑇𝑘,𝑥1 𝑇𝑘,𝑥2 𝑁 𝑥1 ,𝑥2

with compressed phase oracle cO. This will help us rewrite (5) as (︁

)︁

E𝑅 Tr 𝑌𝑅2𝑡 =

∑︁

⟨𝑧| ⟨∅| 𝑌̂︀ 2𝑡 |𝑧⟩ |∅⟩ .

(6)

𝑧∈[2𝑆 ]

5.2

Bounding the trace moment on small databases

Lemma 5.3. For 𝑌̂︀ defined from the 1OWS security game, if normalized state |𝜓⟩ (with both the algorithm’s register and the database register) is supported on databases of size ≤ ℓ, then √ 𝑇2 + ℓ ̂︀ | ⟨𝜓| 𝑌 |𝜓⟩ | ≤ 𝑐 · 𝐾 √ for 1 √ ≤ ℓ ≤ 𝐾 2 and constant 𝑐 (actually we can have 𝑐 = 10; for ℓ = 0, we can replace ℓ by max{ ℓ, 1} from the ℓ = 1 case). With Lemma 5.3, now we can bound (6).

18

Proof of Theorem 5.2. For each 𝑧, each 𝑌̂︀ will append the database by size at most (2𝑇 + 2). Therefore, |𝜓𝑧𝑖 ⟩ := 𝑌̂︀ 𝑖 |𝑧⟩ |∅⟩ is supported on database of size ≤ (2𝑇 + 2)𝑖, and for 𝑃≤𝑖 defined as the projector on database of size ≤ 𝑖, ⃦ ⃦

⃦ ⃦

‖ |𝜓𝑧𝑖 ⟩ ‖ ≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀ 𝑃≤(2𝑇 +2)(𝑖−1) |𝜓𝑧𝑖−1 ⟩⃦ ⃦ ⃦

⃦ ⃦ ⃦ ⃦

⃦ ⃦

≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀ 𝑃≤(2𝑇 +2)𝑖 ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ ≤𝑐·

𝑇2 +

⃦ (2𝑇 + 2)𝑖 ⃦ ⃦ ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ 𝐾

√︀

Therefore, for each 𝑧 ∈ [2𝑆 ], ⟨𝑧| ⟨∅| 𝑌 2𝑡 |𝑧⟩ |∅⟩ = ‖ |𝜓𝑧𝑡 ⟩ ‖2 , and we can upper bound (6) by (︃ ∑︁

⟨𝑧| ⟨∅| 𝑌 2𝑡 |𝑧⟩ |∅⟩ ≤ 2𝑆 · 𝑐 ·

𝑇2 +

𝑧∈[2𝑆 ]

𝑡(2𝑇 + 2) 𝐾

√︀

)︃2𝑡

.

This will help us upper bound the winning probability in (4) as E𝑅 ‖𝑌𝑅 ‖ ≤ 2

𝑆/2𝑡

·𝑐·

𝑇2 +

𝑡(2𝑇 + 2) . 𝐾

√︀

By setting 𝑡 = max{𝑆/2, 1}, we have winning probability upper bounded by 𝑂

(︂

√

𝑇 2 +1+

𝑆(𝑇 +1)

𝐾

)︂

.

Now we are only left to prove Lemma 5.3. Reformulation of Lemma 5.3. For normalized state |𝜓⟩ (with both the algorithm’s register and the database register), by our definition of 𝑌̂︀ in the compressed oracle database mode: ⃒ ⃒ ⃒ ⃒ ⃒ ⃒ ∑︁ 1 ⃒ ⃒ ⃒ ⃒ 𝑤 † † 𝑇 𝑇 𝑤 · E𝑘 ⟨𝑥1 | ⟨0 | (𝑈 cO ) Π𝑘 (cO 𝑈 ) |𝑥2 ⟩ |0 ⟩ ⊗ 𝑇𝑘,(𝑥1 ⊕𝑥2 ) |𝜓⟩⃒ ⃒⟨𝜓| 𝑌̂︀ |𝜓⟩⃒ = ⃒⟨𝜓| ⃒ ⃒ 𝑁 𝑥1 ,𝑥2 ⃦ ⃦ (︃ )︃ ⃦ ⃦2 1 ∑︁ ⃦ 𝑇 𝑤 ⃦ √ = E𝑘 ⃦Π𝑘 (cO 𝑈 ) |𝑥⟩ ⊗ 𝑇𝑘,𝑥 |𝜓⟩ |0 ⟩⃦ . ⃦ ⃦ 𝑁 𝑥

This is exactly the winning probability of the following 1OWS search game: 1. The algorithm starts with a normalized state |𝜓⟩ with support on databases of size ≤ ℓ. 2. The algorithm will receive a challenge input state, which is a single copy of |𝜓𝑅,𝑘 ⟩, for a uniformly random unknown 𝑘 ← [𝐾]. 3. Then the algorithm is allowed to make 𝑇 queries to the (compressed) oracle 𝑅 (𝑂𝑅 ), and it needs to guess the underlying challenge key 𝑘. Therefore, now we only need to prove the maximum winning probability of this game, and this will give a proof of Lemma 5.3. That is, now we only need to prove the following Lemma 5.4: Lemma 5.4 (Reformulation of Lemma 5.3). In the 1OWS security game where the algorithm starts ∑︀ with state 𝐷 𝛼𝐷 |𝜙𝐷 ⟩ |𝐷⟩ supported on databases of size ≤ ℓ in the √compressed oracle database 2+ ℓ . mode, the winning probability of the 1OWS game is bounded by 𝑐 · 𝑇 𝐾 19

5.3

Proof of the 1OWS bound for states with initial database

In this section, we will prove Lemma 5.4 (and thus Lemma 5.3). ∑︀ That is, start with state |𝜓⟩ = 𝐷 𝛼𝐷 |𝜙𝐷 ⟩ |𝐷⟩ in the compressed oracle database mode, where ∑︀ 2 𝐷 |𝛼𝐷 | = 1, { |𝜙𝐷 ⟩}𝐷 is a set of normalized states on the algorithm’s register, and |𝐷⟩ is the database register, now the goal is to upper bound ⃦2 ⃦ (︃ )︃ ⃦ ⃦ 1 ∑︁ ⃦ ⃦ 𝑇 √ |𝑥⟩ ⊗ 𝑇𝑘,𝑥 |𝜓⟩⃦ E𝑘 ⃦Π𝑘 (cO 𝑈 ) ⃦ ⃦ 𝑁 𝑥 ⃦2 ⃦ ⃦ ⃦ ∑︁ ⃦ 1 ⃦ 𝑇 ⃦ Π𝑘 (cO · 𝑈 ) · 𝛼𝐷 |𝑥⟩ |𝜙𝐷 ⟩ |𝐷 ⊕ (𝑘, 𝑥)⟩ |𝑘⟩⃦ = ⃦ , ⃦ 𝐾𝑁 ⃦𝑘,𝐷,𝑥 ⃦

(7)

where {Π𝑘 } are the final measurement projectors with 𝑘 Π𝑘 = 𝐼 and will only apply on the first 2 registers, and we also introduce a 𝐾-dimensional key register K with basis { |𝑘⟩ : 𝑘 ∈ [𝐾]} as the last register. As mentioned, we are summing over 𝐷 such that |𝐷| ≤ ℓ. ∑︀

Feynman path formulation. For cO as the compressed oracle query, it is defined as cO |𝑎, 𝑦⟩ |𝐷⟩ = |𝑎, 𝑦⟩ |𝐷 ⊕ (𝑎, 𝑦)⟩ for a query on key 𝑎 and input 𝑦. Write 𝑄𝑎,𝑦 := |𝑎, 𝑦⟩ ⟨𝑎, 𝑦| ⊗ 𝐼. We define 𝑝𝑡 = (𝑎𝑗 , 𝑦𝑗 )𝑡𝑗=1 as a Feynman path (for the query part) of length 𝑡, and define 𝒪𝑝𝑡 := 𝑄𝑎𝑡 ,𝑦𝑡 𝑈 · · · 𝑄𝑎1 ,𝑦1 𝑈,

𝑆𝑝𝑡 :=

𝑡 ⨁︁

(𝑎𝑖 , 𝑦𝑖 ).

𝑖=1

This operator 𝒪𝑝𝑡 never touches the database register. From this, we can rewrite the state after 𝑡 queries as ∑︁ 1 √ (cO · 𝑈 )𝑡 · 𝛼𝐷 |𝑥⟩ |𝜙𝐷 ⟩ |𝐷 ⊕ (𝑘, 𝑥)⟩ |𝑘⟩ 𝐾𝑁 𝑘,𝐷,𝑥 ∑︁ ∑︁ 1 =√ 𝐾𝑁 𝑘,𝐷,𝑥 (𝑎𝑗 ,𝑦𝑗 )𝑗

[︃(︃ 𝑡 ∏︁

)︃

cO · ( |𝑎𝑖 , 𝑦𝑖 ⟩⟨𝑎𝑖 , 𝑦𝑖 | ⊗ 𝐼) · 𝑈

]︃

· 𝛼𝐷 |𝑥⟩ |𝜙𝐷 ⟩ |𝐷 ⊕ (𝑘, 𝑥)⟩ |𝑘⟩

𝑖=1

=√

∑︁ ∑︁ 1 (𝒪𝑝𝑡 · 𝛼𝐷 |𝑥⟩ |𝜙𝐷 ⟩) |𝐷 ⊕ (𝑘, 𝑥) ⊕ 𝑆𝑝𝑡 ⟩ |𝑘⟩ 𝐾𝑁 𝑘,𝐷,𝑥 𝑝𝑡

=√

)︁ ∑︁ ∑︁ (︁ 1 𝒪𝑝𝑡 · 𝛼𝑆⊕𝑆𝑝𝑡 |𝑥⟩ |𝜙𝑆⊕𝑆𝑝𝑡 ⟩ |𝑆 ⊕ (𝑘, 𝑥)⟩ |𝑘⟩ . 𝐾𝑁 𝑘,𝑆,𝑥 𝑝𝑡

For simplicity, we define |𝑣𝑡,𝑆,𝑥 ⟩ :=

∑︁

𝒪𝑝𝑡 · 𝛼𝑆⊕𝑆𝑝𝑡 |𝑥⟩ |𝜙𝑆⊕𝑆𝑝𝑡 ⟩ .

𝑝𝑡

Here the empty path, as the initial state, gives |𝑣0,𝑆,𝑥 ⟩ = 𝛼𝑆 |𝑥⟩ |𝜙𝑆 ⟩. By unitarity, and by writing the last query separately, we have ∑︁

‖ |𝑣𝑡,𝑆,𝑥 ⟩‖2 = 1,

|𝑣𝑡,𝑆,𝑥 ⟩ =

∑︁ 𝑎,𝑦

𝑆

20

𝑄𝑎,𝑦 𝑈 |𝑣𝑡−1,𝑆⊕(𝑎,𝑦),𝑥 ⟩ .

By orthogonality on the last 2 registers, we can rewrite our goal (7) as ⃦2

⃦

⃦ ∑︁ 1 ∑︁ ⃦ ⃦ ⃦ |𝑣𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ . ⃦Π𝑘 ⃦ ⃦ 𝐾𝑁 𝑘,𝑆 𝑥

(8)

Getting √ rid of “large 𝑆𝑘 ”. Write 𝑆𝑘 := {𝑥 : (𝑘, 𝑥) ∈ 𝑆}. For the sum over 𝑘, 𝑆 such that |𝑆𝑘 | > ℓ + 𝑇 , we can upper bound it by first getting rid of Π𝑘 . Write this upper bound as 𝐻𝑇 , where we define 𝐻𝑡 as ⃦2 ⃦ ⃦ ⃦∑︁ ∑︁ 1 ⃦ ⃦ |𝑣𝑡,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ . 𝐻𝑡 := ⃦ ⃦ ⃦ 𝐾𝑁 𝑥 𝑘,𝑆 √ |𝑆𝑘 |> ℓ+𝑡

We can write it as a sum by the last query, due to orthogonality. By letting 𝑆 ′ = 𝑆 ⊕ (𝑎, 𝑦), as one query changes |𝑆𝑘 | by at most 1, we get 1 𝐻𝑡 = 𝐾𝑁 1 ≤ 𝐾𝑁

∑︁ 𝑘,𝑆 ′ ,(𝑎,𝑦)√ |(𝑆 ′ ⊕(𝑎,𝑦))𝑘 |> ℓ+𝑡

∑︁ ′ 𝑘,𝑆 √ |𝑆𝑘′ |> ℓ+𝑡−1

⃦ ⃦2 ⃦ ⃦ ∑︁ ⃦ ⃦ |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦𝑄𝑎,𝑦 𝑈 ⃦ ⃦ 𝑥

⃦ ⃦2 ⃦∑︁ ⃦ ⃦ ⃦ |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ = 𝐻𝑡−1 . ⃦ ⃦ 𝑥 ⃦

This gives us a way to go from path of length 𝑡 to 𝑡 − 1. Initially, the |𝑥⟩’s are orthogonal, so √ ∑︁ 1 2 ℓ ℓ 2 √ ≤ 𝐻𝑇 ≤ 𝐻0 = . (9) |𝛼𝑆⊕(𝑘,𝑥) | ≤ 𝐾𝑁 𝑘,𝑆,𝑥 𝐾 𝐾⌊ ℓ⌋ √ |𝑆𝑘 |> ℓ

√ Here √ 𝐷 = 𝑆 ⊕ (𝑘, 𝑥) must satisfy |𝐷𝑘 | ≥ ⌊ ℓ⌋, and since |𝐷| ≤ ℓ, each 𝐷 is counted for at most ℓ/⌊ ℓ⌋ such keys. Getting rid of “final database with 𝑥”. By triangle inequality, the sum over all 𝑥 can be divided into√2 parts, based on whether 𝑥 ∈ 𝑆𝑘 . For the part where we sum over 𝑥 such that 𝑥 ∈ 𝑆𝑘 and |𝑆𝑘 | ≤ ℓ + 𝑇 , by Cauchy–Schwarz, we have 1 𝐾𝑁

∑︁ 𝑘,𝑆 √ |𝑆𝑘 |≤ ℓ+𝑇

⃦ ⃦2 √ ⃦ ⃦ ⃦2 ∑︁ ⃦ ⃦ ℓ + 𝑇 ∑︁ ⃦ ⃦ ⃦ ⃦Π𝑘 |𝑣𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦Π𝑘 |𝑣𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦ ⃦ ≤ 𝐾𝑁 ⃦ ⃦ 𝑥∈𝑆𝑘 𝑘,𝑆,𝑥

√ =

⃦ ℓ + 𝑇 ∑︁ ⃦ ⃦ |𝑣𝑇,𝑆 ′ ,𝑥 ⟩⃦2 = 𝐾𝑁 𝑆 ′ ,𝑥

√

Here we let 𝑆 ′ = 𝑆 ⊕ (𝑘, 𝑥), and then sum over the measurement projectors Π𝑘 .

21

ℓ+𝑇 . 𝐾

(10)

For the last part of “final database without 𝑥”. We will upper bound the remaining part by getting rid of Π𝑘 and the restriction on |𝑆𝑘 |. Define 𝐺𝑡 as the following, and write it as a sum by the last query: ⃦2 ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ ∑︁ ∑︁ ⃦ ⃦ ⃦ ⃦ 1 1 ⃦ ⃦ ⃦ ⃦ = |𝑣 ⟩ |𝑣 ⟩ 𝑄 𝑈 𝐺𝑡 := 𝑎,𝑦 𝑡−1,𝑆⊕(𝑎,𝑦)⊕(𝑘,𝑥),𝑥 ⃦ . 𝑡,𝑆⊕(𝑘,𝑥),𝑥 ⃦ ⃦ ⃦ 𝐾𝑁 𝑘,𝑆 ⃦𝑥∈𝑆 𝐾𝑁 ⃦ ⃦ ⃦ 𝑥∈𝑆 / / 𝑘,𝑆,(𝑎,𝑦) 𝑘

𝑘

We can write the sum over 𝑥 ∈ / 𝑆𝑘 as a sum of 2 parts, according to whether (𝑘, 𝑥) is the same as the last query (𝑎, 𝑦). Write 𝐴𝑡 and 𝐵𝑡 for the corresponding squared norms (including the factor 1/(𝐾𝑁 )) according to 𝑥, for {𝑥 : (𝑘, 𝑥) ̸= (𝑎, 𝑦)} and {𝑥 : (𝑘, 𝑥) = (𝑎, 𝑦)}, respectively. That is, ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ ⃦ 1 ⃦ 𝐴𝑡 := |𝑣𝑡−1,𝑆⊕(𝑎,𝑦)⊕(𝑘,𝑥),𝑥 ⟩⃦ , ⃦𝑄𝑎,𝑦 𝑈 ⃦ 𝐾𝑁 𝑘,𝑆,(𝑎,𝑦) ⃦ ⃦ ⃦ 𝑥∈𝑆 / 𝑘, ⃦ ⃦ (𝑘,𝑥)̸=(𝑎,𝑦) ⃦ ⃦2 ⃦ ⃦ ⃦ ⃦2 ⃦ ⃦ ⃦ ∑︁ ⃦ ⃦ ⃦ ∑︁ ∑︁ ∑︁ ⃦ ⃦ 1 1 ⃦ ⃦ ⃦ ⃦ 𝐵𝑡 := 𝑄 𝑈 |𝑣 ⟩ = 𝑄 𝑈 |𝑣 ⟩ ⃦ 𝑎,𝑦 𝑡−1,𝑆,𝑥 ⃦ . 𝑘,𝑥 𝑡−1,𝑆⊕(𝑎,𝑦)⊕(𝑘,𝑥),𝑥 ⃦ ⃦ ⃦ 𝐾𝑁 𝑘,𝑆,(𝑎,𝑦) ⃦ 𝐾𝑁 ⃦ ⃦ ⃦ ⃦ 𝑘,𝑆 𝑥∈𝑆 𝑥∈𝑆 / 𝑘, / 𝑘 ⃦ ⃦ (𝑘,𝑥)=(𝑎,𝑦)

√ √ √ By triangle inequality, this gives 𝐺𝑡 ≤ 𝐴𝑡 + 𝐵𝑡 . For the part (𝑘, 𝑥) ̸= (𝑎, 𝑦) in 𝐴𝑡 : We first go one query back by letting 𝑆 ′ = 𝑆 ⊕ (𝑎, 𝑦). Then 𝑥 ∈ / 𝑆𝑘 is the same as 𝑥 ∈ / 𝑆𝑘′ . Write the sum with (𝑘, 𝑥) ̸= (𝑎, 𝑦) as the unrestricted sum ′ over 𝑥 ∈ / 𝑆𝑘 (which will correspond to 𝐺𝑡−1 ) minus the {𝑥 : 𝑥 ∈ 𝑆𝑘′ , (𝑘, 𝑥) = (𝑎, 𝑦)} part (which will correspond to a newly defined term 𝐶𝑡 ): ⃦2 ⃦

⃦ ⃦

⃦2 ⃦

⃦ ⃦

∑︁ ∑︁ ∑︁ ⃦ ⃦ ⃦ 1 ∑︁ ⃦ 1 ⃦ ⃦𝑄𝑎,𝑦 𝑈 𝐺𝑡−1 := = |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦ , ⃦ ⃦ ⃦ 𝐾𝑁 𝑘,𝑆 ′ ⃦ ′ 𝐾𝑁 𝑘,𝑆 ′ ,(𝑎,𝑦) ⃦ ⃦ ⃦ ′ 𝑥∈𝑆 / 𝑘

𝑥∈𝑆 / 𝑘

⃦2 ⃦ ⃦ ⃦ ⃦ ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ ∑︁ ∑︁ ⃦ ⃦ 1 1 ⃦ ⃦ ⃦ ⃦ ′ ′ 𝐶𝑡 := = 𝑄 𝑈 |𝑣 ⟩ 𝑄 𝑈 |𝑣 ⟩ ⃦ 𝑎,𝑦 𝑘,𝑥 𝑡−1,𝑆 ⊕(𝑘,𝑥),𝑥 ⃦ 𝑡−1,𝑆 ⊕(𝑘,𝑥),𝑥 ⃦ . ⃦ ⃦ 𝐾𝑁 𝑘,𝑆 ′ ,(𝑎,𝑦) ⃦ 𝐾𝑁 ⃦ ⃦ ′ ′ ′ ⃦ ⃦ / 𝑘 𝑥∈𝑆 / 𝑘, 𝑘,𝑆 𝑥∈𝑆 ⃦ ⃦ (𝑘,𝑥)=(𝑎,𝑦)

√ √ √ By triangle inequality and orthogonality of the query projectors, this gives 𝐴𝑡 ≤ 𝐺𝑡−1 + 𝐶𝑡 . For the part (𝑘, 𝑥) = (𝑎, 𝑦) in 𝐵𝑡 : By letting 𝑆 ′ = 𝑆 ⊕ (𝑘, 𝑥), where this (𝑘, 𝑥) is from the last query, we get ⃦ ⃦ ⃦2

∑︁ ⃦ 1 ∑︁ ⃦ ⃦ 𝐵𝑡 = 𝑄𝑘,𝑥 𝑈 |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦ ⃦ . 𝐾𝑁 ⃦ ′⃦ ′ ⃦

𝑘,𝑆

𝑥∈𝑆𝑘

Observation for 𝐵𝑡 + 𝐶𝑡 : By letting 𝑆 ′′ = 𝑆 ′ ⊕ (𝑘, 𝑥), as 𝐵𝑡 + 𝐶𝑡 = ≤

1 𝐾𝑁 𝑘,𝑆 ′ ,𝑥

⃦2 ∑︁ ⃦ ⃦ ⃦ ⃦𝑄𝑘,𝑥 𝑈 |𝑣𝑡−1,𝑆 ′ ⊕(𝑘,𝑥),𝑥 ⟩⃦ =

⃦ 1 ∑︁ ⃦ ⃦ |𝑣𝑡−1,𝑆 ′′ ,𝑥 ⟩⃦2 = 1 . 𝐾𝑁 𝑆 ′′ ,𝑥 𝐾

22

𝑘 𝑄𝑘,𝑥 ⪯ 𝐼 for every 𝑥, we have

∑︀

⃦ 1 ∑︁ ⃦ ⃦𝑄𝑘,𝑥 𝑈 |𝑣𝑡−1,𝑆 ′′ ,𝑥 ⟩⃦2 𝐾𝑁 𝑘,𝑆 ′′ ,𝑥

Concluding the induction of 𝐺𝑇 : Now we can get an upper bound of 𝐺𝑇 : √︀

𝐺𝑡 ≤

√︀

𝐺𝑡−1 +

√︀

𝐶𝑡 +

√︀

𝐵𝑡 ≤

√︀

𝐺𝑡−1 +

√︁

2(𝐵𝑡 + 𝐶𝑡 ) ≤

𝐺𝑡−1 +

√︂

√︀

2 . 𝐾

Since we can also bound 𝐺0 as 𝐺0 =

∑︁ 1 ∑︁ ℓ 1 |𝛼𝐷 |2 = |𝛼𝐷 |2 · |𝐷| ≤ , 𝐾𝑁 𝑘,𝐷,𝑥∈𝐷 𝐾𝑁 𝐷 𝐾𝑁 𝑘

this will give an upper bound for 𝐺𝑇 : 𝐺𝑇 ≤

(︃ √︀

𝐺0 + 𝑇 ·

√︂

2 𝐾

)︃2

(︃

≤2·

ℓ 2𝑇 2 + 𝐾𝑁 𝐾

)︃

(11)

.

Conclusion. From all of above, we can bound (7) through (8) and ⃦2

⃦

⃦ ∑︁ 1 1 ∑︁ ⃦ ⃦ ⃦ |𝑣𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ = 𝐻𝑇 + · ⃦Π𝑘 ⃦ 𝐾𝑁 𝑘,𝑆 ⃦ 𝐾𝑁 𝑥

∑︁ 𝑘,𝑆 √ |𝑆𝑘 |≤ ℓ+𝑇

⃦2 ⃦ ⃦ ⃦ ∑︁ ⃦ ⃦ |𝑣𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⟩⃦ ⃦Π𝑘 ⃦ ⃦ 𝑥

⎛

√ 2 ℓ 2 ⎜ ⎜ ≤ + ·⎜ 𝐾 𝐾𝑁 ⎝

∑︁

𝑘,𝑆 √ |𝑆𝑘 |≤ ℓ+𝑇

⃦2 ⃦ ⃦ ⃦ ∑︁ ⃦ ⃦ ⃦ ⃦Π𝑘 |𝑣 ⟩ 𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⃦ + ⃦ ⃦ ⃦ 𝑥∈𝑆𝑘

√ √ √ 2 ℓ 2( ℓ + 𝑇 ) 10𝑇 2 4 ℓ 4ℓ ≤ + + 2 · 𝐺𝑇 ≤ + + . 𝐾 𝐾 𝐾 𝐾 𝐾𝑁

6

∑︁ 𝑘,𝑆 √ |𝑆𝑘 |≤ ℓ+𝑇

⎞ ⃦2 ⃦ ⃦ ⎟ ⃦ ∑︁ ⃦ ⎟ ⃦ ⃦ ⃦Π𝑘 |𝑣 ⟩ 𝑇,𝑆⊕(𝑘,𝑥),𝑥 ⃦ ⎟ ⃦ ⃦ ⎠ ⃦ 𝑥∈𝑆 / 𝑘

(by (9) and triangle inequality) (by (10) and (11))

Non-uniform security of 1OWS in QROM, with classical advice

In this section, we bound the non-uniform security of 1OWS in QROM with classical advice. That is, the security game follows the same as in definition 5.1, but in the offline stage, an algorithm can only prepare an 𝑆-bit classical advice string that depends on 𝑅, before the online stage. The non-uniform security (in terms of 𝑆-bit, 𝑇 -query) of 1OWS in QROM is defined as the maximum winning probability in this case, parametrized by 𝑆, 𝑇, 𝐾, 𝑁 . we show that any 𝑇 -query quantum algorithm with 𝑆-bit classical advice (︁ 2 can invert)︁ a single copy of a random binary phase state with +1) winning probability at most 𝑂 𝑇 𝐾+1 + 𝑆(𝑇 . 𝐾𝑁 Theorem 6.1 (Non-uniform security of 1OWS in QROM, with classical advice). For integer 𝑆, 𝑇 ≥ 0 and in QROM (︁ 2 𝐾 ≤ 𝑁 , the )︁ non-uniform security (with 𝑆-bit advice and 𝑇 -query) of 1OWS (︁ 2 )︁ is 𝑆(𝑇 +1) 𝑆(𝑇 +1) 𝑇 +1 𝑇 +1 𝑂 𝐾 + 𝐾𝑁 ; that is, the maximum winning probability is bounded by 𝑂 𝐾 + 𝐾𝑁 . √ When 𝑇 = 𝑜( 𝐾), Theorem 6.1 implies that constant success probability requires 𝑆𝑇 = Ω(𝐾𝑁 ) with classical advice, whereas Theorem 5.2 gives the necessary condition 𝑆𝑇 = Ω(𝐾 2 ) with quantum advice. These conditions agree when 𝐾 = 𝑁 . When 𝐾 < 𝑁 , the classical-advice lower bound is stronger by a factor of 𝑁/𝐾. 23

Proof overview. The improvement for classical advice comes from fixing the advice string before applying the moment argument. For each fixed string 𝑧, the success probability is a scalar, and its compressed-oracle representation acts only on the database register. Thus, although the database may be in an arbitrary superposition, the algorithm’s initial state is fixed and unentangled with it. For the key step (Lemma 6.2), the key observation is, there is a controlled change of purification on inaccessible registers (database register and challenge key register) that allows us to compare the challenge with a maximally mixed state independent of the hidden key (Lemma 6.3). • From that, for a database of size at most ℓ, the resulting initial-state error is 𝑂( ℓ/(𝐾𝑁 )). √︀

• The change of purification also conjugates the oracle used by the online algorithm, but the two oracles differ√only on queries to the hidden row 𝑘. A query-by-query hybrid therefore contributes 𝑂(𝑇 / 𝐾) to the success amplitude.

6.1

1OWS scalar-moment setup

For any quantum oracle algorithm in the 1OWS security (search) game, denote its intermediate unitary between queries as 𝑈 , final projective measurement as {Π𝑘 }𝑘∈[𝐾] , and suppose of hash function 𝑅 its advice is |𝑧𝑅 ⟩, where 𝑧𝑅 ∈ {0, 1}𝑆 is a classical string of length 𝑆. We can write its maximum winning probability as the following (with algorithm’s workspace initialized as |0𝑤 ⟩): † 𝑇 ) Π𝑘 (𝑂𝑅 𝑈 )𝑇 |0𝑤 ⟩ |𝜓𝑅,𝑘 ⟩ |𝑧𝑅 ⟩ . E𝑅 max E𝑘 ⟨𝑧𝑅 | ⟨𝜓𝑅,𝑘 | ⟨0𝑤 | (𝑈 † 𝑂𝑅 𝑧𝑅

† 𝑇 ) Π𝑘 (𝑂𝑅 𝑈 )𝑇 |0𝑤 ⟩ |𝜓𝑅,𝑘 ⟩ |𝑧⟩, and by Jensen’s inequality, Define 𝑌𝑅,𝑧 := E𝑘 ⟨𝑧| ⟨𝜓𝑅,𝑘 | ⟨0𝑤 | (𝑈 † 𝑂𝑅

⎞1/2𝑡

⎛ (︁

2𝑡 E𝑅 max 𝑌𝑅,𝑧 ≤ E𝑅 max 𝑌𝑅,𝑧 𝑧

)︁1/2𝑡

𝑧

≤⎝

∑︁

2𝑡 ⎠ E𝑅 𝑌𝑅,𝑧

.

(12)

𝑧∈{0,1}𝑆

Rewrite in compressed oracle framework. For random function 𝑅, we can write all things above in the compressed oracle framework. Similarly we define 𝑇𝑘,𝑥 : |𝐷⟩ ↦→ |𝐷 ⊕ {(𝑘, 𝑥)}⟩. We also define 𝐶𝑘,𝑧 for any fixed advice string 𝑧, where (︃

𝐶𝑘,𝑧 : |𝐷⟩ ↦→

1 ∑︁ √ |𝑥⟩ |𝑧⟩ |0𝑤 ⟩ 𝑇𝑘,𝑥 𝑁 𝑥

)︃

|𝐷⟩ .

Then we can define 𝑌̂︀𝑧 in the compressed oracle database mode as † 𝑌̂︀𝑧 = E𝑘 𝐶𝑘,𝑧 (𝑈 † cO† )𝑇 Π𝑘 (cO 𝑈 )𝑇 𝐶𝑘,𝑧

with compressed phase oracle cO. This will help us rewrite the scalar moment as 2𝑡 E𝑅 𝑌𝑅,𝑧 = ⟨∅| 𝑌̂︀𝑧2𝑡 |∅⟩ .

24

(13)

6.2

Bounding the scalar moment on small databases

Lemma 6.2. For 𝑌̂︀𝑧 defined from the 1OWS security game with fixed classical advice string 𝑧, if normalized state |𝜒⟩ (only on the database register) is supported on databases of size ≤ ℓ, then (︃

| ⟨𝜒| 𝑌̂︀𝑧 |𝜒⟩ | ≤ 𝑐 ·

ℓ 𝑇2 + 1 + 𝐾 𝐾𝑁

)︃

for constant 𝑐 (actually we can have 𝑐 = 18). With Lemma 6.2, now we can bound (13). Proof of Theorem 6.1. Each 𝑌̂︀𝑧 will append the database by size at most (2𝑇 + 2). Therefore, |𝜒𝑖 ⟩ := 𝑌̂︀𝑧𝑖 |∅⟩ is supported on database of size ≤ (2𝑇 + 2)𝑖, and for 𝑃≤𝑖 defined as the projector on database of size ≤ 𝑖, ⃦ ⃦

⃦ ⃦

‖ |𝜒𝑖 ⟩ ‖ ≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀𝑧 𝑃≤(2𝑇 +2)(𝑖−1) |𝜒𝑖−1 ⟩⃦ ⃦ ⃦

⃦ ⃦ ⃦ ⃦

⃦ ⃦

≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀𝑧 𝑃≤(2𝑇 +2)𝑖 ⃦ · ⃦ |𝜒𝑖−1 ⟩⃦ 𝑇 2 + 1 (2𝑇 + 2)𝑖 + 𝐾 𝐾𝑁

(︃

≤𝑐·

)︃

⃦ ⃦

⃦ ⃦

· ⃦ |𝜒𝑖−1 ⟩⃦

Therefore, ⟨∅| 𝑌̂︀𝑧2𝑡 |∅⟩ = ‖ |𝜒𝑡 ⟩ ‖2 , and we can upper bound (13) by (𝑇 2 + 1) · 𝑁 + 𝑡(2𝑇 + 2) 𝑐· 𝐾𝑁

(︃

⟨∅| 𝑌̂︀𝑧2𝑡 |∅⟩ ≤

)︃2𝑡

.

This will help us upper bound the winning probability in (12) as (︃

E𝑅 max 𝑌𝑅,𝑧 ≤ 2

𝑆/2𝑡

𝑧

·𝑐·

𝑇 2 + 1 𝑡(2𝑇 + 2) + . 𝐾 𝐾𝑁

By setting 𝑡 = 𝑆/2, we have winning probability upper bounded by 𝑂

)︃

(︁

𝑆(𝑇 +1) 𝑇 2 +1 𝐾 + 𝐾𝑁

)︁

.

Now we are only left to prove Lemma 6.2.

6.3

Proof of the 1OWS bound for an initial database state

For normalized state |𝜒⟩ only on the database register, we can write it as |𝜒⟩ := our definition of 𝑌̂︀𝑧 in the compressed oracle database mode, we have

𝐷 𝛼𝐷 |𝐷⟩. With

∑︀

⃒ ⃒ ⃒ ⃒ ⃒ ⃒ ⃒ ⃒ † ⃒⟨𝜒| 𝑌̂︀𝑧 |𝜒⟩⃒ = ⃒⟨𝜒| E𝑘 𝐶𝑘,𝑧 (𝑈 † cO† )𝑇 Π𝑘 (cO 𝑈 )𝑇 𝐶𝑘,𝑧 |𝜒⟩⃒ ⃦ )︃ (︃ )︃⃦2 (︃ ⃦ ⃦ ∑︁ 1 ∑︁ ⃦ ⃦ 𝑤 𝑇 √ |𝑥⟩ |𝑧⟩ |0 ⟩ ⊗ 𝑇𝑘,𝑥 𝛼𝐷 |𝐷⟩ ⃦ . = E𝑘 ⃦Π𝑘 (cO 𝑈 ) ⃦ ⃦ 𝑁 𝑥

𝐷

That is, now the goal is to upper bound the winning probability of this search game, starting with |𝑧⟩ |0𝑤 ⟩ ⊗ |𝜒⟩ in the database mode before receiving the challenge. Below we can view |𝑧⟩ as |𝑧, 0𝑤 ⟩, since the upper bound we prove here in Lemma 6.2 is independent of the length of 𝑧. 25

Real and reference states. Introduce an additional 𝑁 -dimensional register B, initially in a fixed unit vector |0⟩, and a 𝐾-dimensional key register K with basis { |𝑘⟩ : 𝑘 ∈ [𝐾]}. Together with the database register, these three registers are inaccessible to the algorithm. Define the following two normalized states, with registers: |𝜉real ⟩ := √

1 ∑︁ |𝑥⟩ |𝑧⟩ ⊗ 𝑇𝑘,𝑥 |𝜒⟩ |0⟩B |𝑘⟩K , 𝐾𝑁 𝑘,𝑥

(14)

|𝜉ref ⟩ := √

1 ∑︁ |𝑥⟩ |𝑧⟩ ⊗ |𝜒⟩ |𝑥⟩B |𝑘⟩K . 𝐾𝑁 𝑘,𝑥

(15)

The real state generates the challenge from 𝑘 (from K), while in the reference state the challenge is maximally mixed and independent of the database (in particular, the reference state is a product ∑︀ with √1𝐾 𝑘 |𝑘⟩K ). ∑︀ The success projector on all the registers can be defined as Π := 𝑘 Π𝑘 ⊗ 𝐼 ⊗ |𝑘⟩ ⟨𝑘|K , where 𝐼 acts as the identity on the database register and B. Thus the probability we want to bound is ⃒ ⃒

⃒ ⃒

⃦2 ⃦

⃦ ⃦

𝑝 := ⃒⟨𝜒| 𝑌̂︀𝑧 |𝜒⟩⃒ = ⃦Π(cO 𝑈 )𝑇 |𝜉real ⟩⃦ .

(16)

For comparison, as the reference computation does not touch K, its success probability is ⃦ )︃⃦2 (︃ ⃦ ⃦ ⃦2 1 ∑︁ ⃦ 1 1 ∑︁ ⃦ ⃦ ⃦ ⃦ 𝑇 𝑇 √ |𝑥⟩ |𝑧⟩ |𝜒⟩ |𝑥⟩ ⃦ = . ⃦Π(cO𝑈 ) |𝜉ref ⟩⃦ = ⃦Π𝑘 (cO 𝑈 ) ⃦ ⃦ 𝐾 𝐾 𝑁

(17)

𝑥

𝑘

A controlled change of purification. For a database 𝐷, define 𝐷𝑘 := {𝑥 : (𝑘, 𝑥) ∈ 𝐷} as the database on 𝑘, and define ∑︁ |𝛼𝐷 |2 |𝐷| ≤ ℓ. 𝜇 := 𝐷

Thus 𝜇 is the expected total number of entries in the initial database. Lemma 6.3 (Controlled change of purification). For every normalized database vector |𝜒⟩ = ∑︀ 𝐷 𝛼𝐷 |𝐷⟩, there exist unitaries {𝑊𝑘 }𝑘 acting on the database register and B, such that the unitary 𝑊 :=

∑︁

𝑊𝑘 ⊗ |𝑘⟩ ⟨𝑘|K

𝑘∈[𝐾]

has the following properties: 1. For every 𝑎 ̸= 𝑘 and 𝑥 ∈ [𝑁 ], [𝑊𝑘 , 𝑇𝑎,𝑥 ] = 0, [𝑊, 𝑈 ] = 0, [𝑊, Π] = 0. Here [𝐴, 𝐵] := 𝐴𝐵 −𝐵𝐴 is the commutator. In particular, conjugating the oracle by 𝑊 (that is, 𝑊 cO𝑊 † ) can change a query only when its queried key agrees with the key in K. 2. The initial-state distance satisfies √ √︂ 𝜇 ‖𝑊 |𝜉real ⟩ − |𝜉ref ⟩‖ ≤ (1 + 3) . 𝐾𝑁 Proof of Lemma 6.3 will be left to Appendix B. From Lemma 6.3, now we can prove Lemma 6.2. 26

(18)

Proof of Lemma 6.2. Let 𝑄𝑎,𝑦 be the projector on the algorithm’s query registers at address (𝑎, 𝑦). Within the compressed oracle framework (with compressed phase oracle), cO =

∑︁

𝑄𝑎,𝑦 ⊗ 𝑇𝑎,𝑦 .

𝑎∈[𝐾], 𝑦∈[𝑁 ]

Define the projectors {𝑄𝑘 }𝑘 on the queried key and the controlled matching projector 𝑄 as 𝑄𝑘 :=

∑︁

𝑄 :=

𝑄𝑘,𝑦 ,

𝑦

Then

∑︁

𝑄𝑘 ⊗ 𝐼 ⊗ |𝑘⟩ ⟨𝑘|K .

𝑘

𝑘 𝑄𝑘 ⪯ 𝐼. Write

∑︀

̃︁ := 𝑊 cO𝑊 † . cO

It is a unitary. By the first property in Lemma 6.3, it agrees with cO on the complement of 𝑄, ̃︁ − cO = (cO ̃︁ − cO)𝑄. Thus for every vector |𝑣⟩, by triangle inequality, cO ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ̃︁ ⃦ ̃︁ − cO)𝑄 |𝑣⟩⃦ ≤ 2‖𝑄 |𝑣⟩‖. ⃦(cO − cO) |𝑣⟩⃦ = ⃦(cO

(19)

̃︁ )𝑇 𝑊 . Also, since [𝑊, 𝑈 ] = 0, 𝑊 (cO𝑈 )𝑇 = (cO𝑈

The query hybrid. For 0 ≤ 𝑖 ≤ 𝑇 , define |Ψ0 ⟩ := (cO𝑈 )𝑇 |𝜉ref ⟩ , ̃︁ )𝑖 (cO𝑈 )𝑇 −𝑖 |𝜉 ⟩ , |Ψ𝑖 ⟩ := (cO𝑈 ref

|Ψ𝑇 +1 ⟩ := 𝑊 (cO𝑈 )𝑇 |𝜉real ⟩ . For 0 ≤ 𝑖 < 𝑇 , cancelling the common unitary suffix and using (19), we have ⃦ ⃦

⃦ ⃦

̃︁ − cO)𝑈 (cO𝑈 )𝑇 −𝑖−1 |𝜉 ⟩⃦ ‖ |Ψ𝑖+1 ⟩ − |Ψ𝑖 ⟩‖ = ⃦(cO ref ⃦ ⃦

⃦ ⃦

≤ 2⃦𝑄𝑈 (cO𝑈 )𝑇 −𝑖−1 |𝜉ref ⟩⃦. Since the reference computation never touches K before 𝑄, on register K is still a product with ∑︀ √1 𝑘 |𝑘⟩. Therefore, 𝐾 ⃦ ⃦2 ⃦2 ∑︁ ⃦ 1 ⃦ ⃦ ⃦ ⃦ . ⃦𝑄𝑈 (cO𝑈 )𝑇 −𝑖−1 |𝜉ref ⟩⃦ = ⃦(𝑄𝑘 ⊗ |𝑘⟩⟨𝑘|)𝑈 (cO𝑈 )𝑇 −𝑖−1 |𝜉ref ⟩⃦ ≤

𝐾

𝑘

Summing over {𝑖 : 0 ≤ 𝑖 < 𝑇 }, we have ‖ |Ψ𝑇 ⟩ − |Ψ0 ⟩‖ ≤

𝑇∑︁ −1

2𝑇 ‖ |Ψ𝑖+1 ⟩ − |Ψ𝑖 ⟩‖ ≤ √ . 𝐾 𝑖=0

(20)

For the last step, (18) gives ‖ |Ψ𝑇 +1 ⟩ − |Ψ𝑇 ⟩‖ = ‖𝑊 |𝑒real ⟩ − |𝑒ref ⟩‖ √ √︂ 𝜇 ≤ (1 + 3) . 𝐾𝑁 27

(21)

Conclusion. Since 𝑊 commutes with Π, the real success amplitude is fore, by (17), (20) and (21),

√

𝑝 = ‖Π |Ψ𝑇 +1 ⟩‖. There-

√ 𝑝 ≤ ‖Π |Ψ0 ⟩‖ + ‖ |Ψ𝑇 +1 ⟩ − |Ψ0 ⟩‖ √ √︂ 𝜇 2𝑇 + 1 ≤ √ + (1 + 3) 𝐾𝑁 𝐾 √︃

√ 2𝑇 + 1 + (1 + 3) ≤ √ 𝐾 √︃

≤

7

18 ·

(︂ 2 𝑇 +1

𝐾

ℓ 𝐾𝑁

ℓ . + 𝐾𝑁 )︂

Quantum bit commitments in QROM

In this section, we construct a computationally binding and statistically hiding canonical quantum bit commitment scheme in QROM, from the non-uniform security of single-copy one-way states in Section 5. Applying the conversion of [HMY23, Theorem 6.1], this will also give a computationally hiding and statistically binding canonical quantum bit commitment scheme. Construction. Let 𝑅 : [𝐾] × [𝑁 ] → {±1} be the random function, where 𝐾 = 𝑁 1−Ω(1) . Let C and W be polynomial-size registers as the commitment register and the reveal register, respectively. 𝑅 We define polynomial-time computable unitaries 𝑄𝑅 0 and 𝑄1 on CW as 1 ∑︁ 𝑅 𝑄𝑅 |𝑘⟩C |𝜓𝑅,𝑘 ⟩W , 0 |0⟩CW = |Ψ0 ⟩CW := √ 𝐾 𝑘∈𝒦 1 ∑︁ 𝑅 𝑄𝑅 |𝑘⟩C |𝑘⟩W . 1 |0⟩CW = |Ψ1 ⟩CW := √ 𝐾 𝑘∈𝒦

(22)

where { |𝜓𝑅,𝑘 ⟩}𝑘∈𝒦 are the set of binary phase random states defined from the 1OWS security game 𝑅 𝑅 Definition 5.1. Both 𝑄𝑅 0 and 𝑄1 are efficiently computable: for 𝑄0 |0⟩, one would only need to ∑︀ prepare ∝ 𝑘,𝑥 |𝑘, 𝑥⟩ and then make 1 query to 𝑅. To commit to 𝑏 ∈ {0, 1}, the sender prepares |Ψ𝑅 𝑏 ⟩CW , sends C to the receiver, and keeps W. To † open, the sender sends 𝑏 together with witness register W. The receiver applies (𝑄𝑅 𝑏 ) to CW and accepts if measuring all qubits in the computational basis gives the all-zero outcome. Equivalently, 𝑅 𝑅 the acceptance projector is Π𝑅 𝑏 := |Ψ𝑏 ⟩⟨Ψ𝑏 |CW . 𝑅 Theorem 7.1. The scheme (𝑄𝑅 0 , 𝑄1 ) is a perfectly correct, statistically hiding, and computationally binding canonical quantum bit commitment in QROM. Specifically, any adversary breaking binding that starts with 𝑆-qubit advice and makes 𝑇 (︂ √ an )︂

queries to 𝑂𝑅 can win with probability no more than 𝑂

𝑇 2+

𝑆(𝑇 +1) 𝐾

.

† 𝑅 Proof. For correctness, an honest opening is accepted with probability one, since (𝑄𝑅 𝑏 ) |Ψ𝑏 ⟩ = |0⟩.

28

𝑅 𝑅 For statistical hiding, let 𝜌𝑅 𝑏 := TrW |Ψ𝑏 ⟩⟨Ψ𝑏 | be the receiver’s state after the commitment 1 𝑅 𝑅 𝑅 phase. We show that 𝐷(𝜌𝑅 0 , 𝜌1 ) := 2 ‖𝜌0 − 𝜌1 ‖1 = negl(𝜆). Note that

(︀

𝑅 𝜌𝑅 0 − 𝜌1 =

)︀

1 ∑︁ ⟨𝜓𝑅,ℓ |𝜓𝑅,𝑘 ⟩ |𝑘⟩⟨ℓ|. 𝐾 𝑘̸=ℓ

Using ‖𝐴‖21 ≤ 𝐾 Tr(𝐴† 𝐴) for a 𝐾 × 𝐾 matrix, we obtain ⃦2 𝐾 1 ∑︁ 𝐾 −1 1⃦ ⃦ 𝑅⃦ 𝑅 𝑅 2 − 𝜌 ≤ E Tr[(𝜌 − 𝜌 ) ] = E𝑅 |⟨𝜓𝑅,ℓ |𝜓𝑅,𝑘 ⟩|2 = . E𝑅 ⃦𝜌𝑅 ⃦ 𝑅 0 1 0 1 1 4 4 4𝐾 𝑘̸=ℓ 4𝑁 𝐾−1 1−Ω(1) , 𝐷(𝜌𝑅 , 𝜌𝑅 ) = 𝑅 By Markov’s inequality, Pr𝑅 [𝐷(𝜌𝑅 0 , 𝜌1 ) > 𝜀] ≤ 4𝑁 𝜀2 , and thus for 𝐾 = 𝑁 0 1 negl(𝑛) with 1 − negl(𝑛) probability. For computational binding, for any polynomial-time computable unitary 𝑈 𝑅 (with oracle access to 𝑅) acting on WZ, where Z is an arbitrary polynomial-size auxiliary register, and any auxiliary state |𝜏 𝑅 ⟩Z , from Definition 3.4, it suffices to show that

⃦ ⃦ ⃦ ⃦ 𝑅 𝑅 𝑅 | ⊗ 𝐼 )(𝐼 ⊗ 𝑈 )(|Ψ ⟩ ⊗ |𝜏 ⟩ ) ⃦(⟨Ψ𝑅 Z C Z ⃦ = negl(𝜆). 1 CW WZ 0 CW

From (22), by Cauchy-Schwarz, ⃦2 ⃦ ⃦2 1 ∑︁ ⃦ ⃦ ⃦ ⃦ ⃦ 𝑅 𝑅 𝑅 𝑅 (|𝜓𝑅,𝑘 ⟩W ⊗ |𝜏 𝑅 ⟩Z )⃦ . ⃦(⟨𝑘|W ⊗ 𝐼Z )𝑈WZ ⃦(⟨Ψ𝑅 1 |CW ⊗ 𝐼Z )(𝐼C ⊗ 𝑈WZ )(|Ψ0 ⟩CW ⊗ |𝜏 ⟩Z )⃦ ≤

𝐾

𝑘

If we write 𝑈 𝑅 in terms of an oracle query algorithm with 𝑇 queries to 𝑂𝑅 , this is exactly the nonuniform security of the 1OWS game defined in Definition 5.1. Therefore, from Theorem 5.2, for 𝑅 any 𝑇(︂-query )︂ in QROM, with auxiliary register |𝜏 ⟩Z of 𝑆 qubits, this is upper bounded √ algorithm

by 𝑂

𝑇 2+

𝑆(𝑇 +1) 𝐾

.

Similarly from Theorem 6.1, we can bound the security when the adversary’s auxiliary register |𝜏 𝑅 ⟩ is restricted to a classical string. 𝑅 Theorem 7.2 (Binding security with classical auxiliary input). The scheme (𝑄𝑅 0 , 𝑄1 ) is a perfectly correct, statistically hiding, and computationally binding canonical quantum bit commitment in QROM. Any adversary breaking binding that(︁ starts with an )︁ 𝑆-bit advice and makes 𝑇 queries to 𝑆(𝑇 +1) 𝑇2 𝑂𝑅 can win with probability no more than 𝑂 𝐾 + 𝐾𝑁 .

Obtaining computational hiding. The flavor-conversion theorem [HMY23, Theorem 6.1] converts a computationally binding and statistically hiding canonical quantum bit commitment scheme into a computationally hiding and statistically binding canonical quantum bit commitment scheme, √ where the computational security goes from 𝜀 to 𝜀. Hence we obtain the following consequence. Corollary 7.3. There exists a computationally hiding and statistically binding canonical quantum bit commitment scheme. Specifically, any adversary breaking hiding that starts advice and makes 𝑇 )︁ (︁ with an1/4𝑆-qubit 𝑇 +(𝑆(𝑇 +1)) √ queries to 𝑂𝑅 can win with advantage no more than 𝑂 . If the advice is restricted 𝐾 to an 𝑆-bit classical string, the advantage over 1/2 is bounded by 𝑂 29

(︂

√𝑇 + 𝐾

√︁

𝑆(𝑇 +1) 𝐾𝑁

)︂

.

Proof. Apply [HMY23, Theorem 6.1] to the scheme of Theorem 7.1. Computational binding of the original scheme gives computational hiding of the converted scheme, while statistical hiding of the original scheme gives statistical binding of the converted scheme. Then the security follows from Theorem 7.1 and Theorem 7.2.

8

Non-uniform security of PRGs in QROM

In this section, we prove a tighter non-uniform security of pseudorandom generators in the quantum random oracle model via the trace moment method. Specifically, we show that any 𝑇 -query quantum algorithm with 𝑆-qubit advice can distinguish between image )︂ and a random (︂ a random √︁

element in the range, with an winning probability at most 12 + 𝑂

𝑇2 𝑁 +

𝑆(𝑇 +1) 𝑁

, which improves

the bound in [Liu23]. √︀In particular, the current best classical result (distinguishing advantage bounded by 𝑂(𝑇 /𝑁 + 𝑆(𝑇 + √︀ 1)/𝑁 ) for classical queries and classical advice, from [CDGS18]), it recovers the same dependence 𝑆(𝑇 + 1)/𝑁 , while allowing both quantum advice and quantum oracle access. Definition 8.1 (PRG security game). In the non-uniform security game of PRG: • In the offline stage, a hash function 𝑅 : [𝑁 ] → [𝑀 ] is sampled and fixed, and an algorithm is allowed to have an 𝑆-qubit advice state that depends arbitrarily on 𝑅 before receiving the challenge. • Then, in the online stage, a challenger will sample a challenge bit 𝑏 ← {0, 1}. – If 𝑏 = 0, the challenger samples 𝑥 ← [𝑁 ] and sends 𝑅(𝑥) to the algorithm. – If 𝑏 = 1, the challenger samples 𝑦 ← [𝑀 ] and sends 𝑦 to the algorithm. • The algorithm, after receiving the challenge, is allowed to make 𝑇 queries to 𝑅 and is asked to output a guess 𝑏′ . It succeeds if 𝑏′ = 𝑏. We consider security game in QROM, for 𝑅 as a random oracle, and the algorithm can have oracle access to 𝑂𝑅 . The non-uniform security (in terms of 𝑆-qubit, 𝑇 -query) of PRG in QROM is defined as the maximum distinguishing advantage, parametrized by (𝑆, 𝑇, 𝑁, 𝑀 ). Theorem 8.2 (Non-uniform security of PRG (︂ in QROM). The )︂ non-uniform security (with 𝑆-qubit 𝑇2 𝑁 +

advice and 𝑇 -query) of PRG in QROM is 𝑂 (︂

advantage is bounded by 𝑂

𝑇2 𝑁 +

√︁

𝑆(𝑇 +1) 𝑁

√︁

𝑆(𝑇 +1) 𝑁

; that is, the maximum distinguishing

)︂

.

Proof overview. Via the trace-moment method, we first express the distinguishing advantage as the expected norm of a Hermitian operator on the advice register and bound it by a trace moment (Section 8.1). Then, viewing everything in the compressed oracle database mode, the main step is to bound the corresponding distinguishing gap when the algorithm starts with a state with compressed databases of size at most ℓ (Section 8.2). To prove this bound (Lemma 8.3), we introduce a resampling hybrid: instead of generating the challenge as 𝑅(𝑥), we sample an independent challenge 𝑟 and replace the oracle value at the hidden seed 𝑥 by 𝑟. 30

• Compared with the real experiment, one can tell the difference only in the case where the initial √︀ database contains 𝑥. Averaging over the hidden seed bounds this contribution by 𝑂( ℓ/𝑁 ) for database of size ≤ ℓ. • Compared with an ideal experiment, where the challenge is independent of the oracle, a modified BBBV-style [BBBV97] hybrid argument will give a 𝑂(𝑇 2 /𝑁 ) bound. Finally, a trace moment of order 𝑆 gives databases of size about 𝑂(𝑆𝑇 ), and this gives our bound.

8.1

PRG trace-moment setup

For any quantum oracle algorithm in the distinguishing game, denote its intermediate unitary between queries as 𝑈 , final distinguishing measurement as 0 ⪯ Π ⪯ 𝐼, and suppose on hash function 𝑅 its advice is |𝜑𝑅 ⟩. Define 𝐴𝑅 = (𝑂𝑅 𝑈 )𝑇 , we can write its maximum distinguishing advantage as the following (with algorithm’s workspace of 𝑤 qubits initialized as |0𝑤 ⟩W ): ⃒ ⃒

⃒ ⃒

E𝑅 max ⃒E𝑥 ⟨𝜑𝑅 , 0𝑤 | ⟨𝑅(𝑥)| 𝐴†𝑅 Π𝐴𝑅 |𝑅(𝑥)⟩ |𝜑𝑅 , 0𝑤 ⟩ − E𝑟 ⟨𝜑𝑅 , 0𝑤 | ⟨𝑟| 𝐴†𝑅 Π𝐴𝑅 |𝑟⟩ |𝜑𝑅 , 0𝑤 ⟩⃒ . 𝜑𝑅

From the definition of the operator norm, this is exactly equal to ⃦ ⃦

⃦ ⃦

E𝑅 ‖𝑌𝑅 ‖ := E𝑅 ⃦E𝑥 ⟨𝑅(𝑥), 0𝑤 | 𝐴†𝑅 Π𝐴𝑅 |𝑅(𝑥), 0𝑤 ⟩ − E𝑟 ⟨𝑟, 0𝑤 | 𝐴†𝑅 Π𝐴𝑅 |𝑟, 0𝑤 ⟩⃦ .

(23)

Here we define 𝑌𝑅 as the matrix inside the norm. Now our goal is to bound E𝑅 ‖𝑌𝑅 ‖. Via the trace moment method, by Jensen’s inequality, we have (︁

E𝑅 ‖𝑌𝑅 ‖ ≤ E𝑅 ‖𝑌𝑅 ‖2𝑡

)︁1/2𝑡

≤ E𝑅 Tr 𝑌𝑅2𝑡

∑︁

E𝑅 ⟨𝑧| 𝑌𝑅2𝑡 |𝑧⟩ .

(︁

(︁

)︁)︁1/2𝑡

.

Therefore, now our goal is to upper bound (︁

)︁

E𝑅 Tr 𝑌𝑅2𝑡 =

(24)

𝑧∈[2𝑆 ]

Rewrite in compressed oracle framework. For random function 𝑅, we can write all things above in the compressed oracle framework. Note that in the un-compressed world, the isometry that writes 𝑅(𝑥) into a fresh challenge register can be viewed as 1 ∑︁ |𝑅⟩ ↦→ |𝑅(𝑥)⟩ ⊗ |𝑅⟩ = √ 𝐻 |𝑦⟩ ⊗ (−1)𝑦·𝑅(𝑥) |𝑅⟩ . 𝑀 𝑦 Define 𝑇𝑥,𝑦 on the compressed oracle register that flips the presence of the database entry (𝑥, 𝑦), that is, 𝑇𝑥,𝑦 |𝐷⟩ = |𝐷 ⊕ {(𝑥, 𝑦)}⟩. Now the isometry that generates the fresh challenge using one compressed query can be viewed as (︃

|𝐷⟩ ↦→

1 ∑︁ √ 𝐻 |𝑦⟩ |0𝑤 ⟩ ⊗ 𝑇𝑥,𝑦 𝑀 𝑦

31

)︃

|𝐷⟩ .

Therefore, by having 𝐴̂︀ := (cO · 𝑈 )𝑇 , we can define 𝑌̂︀ in the compressed oracle database mode as 𝑌̂︀ =

∑︁ 1 𝑤 ̂︀† ̂︀ 𝑤 ̂︀ |𝑦2 , 0𝑤 ⟩ ⊗ 𝑇 · E𝑥 ⟨𝑦1 , 0𝑤 | 𝐻 𝐴̂︀† Π𝐴𝐻 𝑥,(𝑦1 ⊕𝑦2 ) − E𝑟 ⟨𝑟, 0 | 𝐴 Π𝐴 |𝑟, 0 ⟩ ⊗ 𝐼𝐷 𝑀 𝑦1 ,𝑦2

with compressed phase oracle cO. This will help us rewrite (24) as (︁

)︁

E𝑅 Tr 𝑌𝑅2𝑡 =

∑︁

(25)

⟨𝑧| ⟨∅| 𝑌̂︀ 2𝑡 |𝑧⟩ |∅⟩ .

𝑧∈[2𝑆 ]

8.2

Bounding the trace moment on small databases

Lemma 8.3. For 𝑌̂︀ defined from the PRG security game, if normalized state |𝜓⟩ (with both the algorithm’s register and the database register) is supported on databases of size ≤ ℓ, then 𝑇2 +4· | ⟨𝜓| 𝑌̂︀ |𝜓⟩ | ≤ 8 · 𝑁

√︃

⎛

𝑇2 ℓ = 𝑂⎝ + 𝑁 𝑁

√︃

⎞

ℓ⎠ 𝑁

With Lemma 8.3, now we can bound (25). Proof of Theorem 8.2. For each 𝑧, each 𝑌 will append the database by size at most (2𝑇 + 2). Therefore, |𝜓𝑧𝑖 ⟩ := 𝑌̂︀ 𝑖 |𝑧⟩ |∅⟩ is supported on database of size ≤ (2𝑇 + 2)𝑖, and for 𝑃≤𝑖 defined as the projector on database of size ≤ 𝑖, ⃦ ⃦

⃦ ⃦

‖ |𝜓𝑧𝑖 ⟩ ‖ ≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀ 𝑃≤(2𝑇 +2)(𝑖−1) |𝜓𝑧𝑖−1 ⟩⃦ ⃦ ⃦

⃦ ⃦ ⃦ ⃦

⃦ ⃦

≤ ⃦𝑃≤(2𝑇 +2)𝑖 𝑌̂︀ 𝑃≤(2𝑇 +2)𝑖 ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ ⎛

𝑇2 + ≤8·⎝ 𝑁

√︃

⎞

⃦ (2𝑇 + 2)𝑖 ⎠ ⃦ ⃦ ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ 𝑁

Therefore, for each 𝑧 ∈ [2𝑆 ], ⟨𝑧| ⟨∅| 𝑌 2𝑡 |𝑧⟩ |∅⟩ = ‖ |𝜓𝑧𝑡 ⟩ ‖2 , and we can upper bound (25) by ⎛ ∑︁

⟨𝑧| ⟨∅| 𝑌 2𝑡 |𝑧⟩ |∅⟩ ≤ 2𝑆 · 82𝑡 ⎝

𝑇2

𝑧∈[2𝑆 ]

𝑁

√︃

+

⎞2𝑡

𝑡(2𝑇 + 2) ⎠ . 𝑁

This will help us upper bound the distinguishing advantage in (23) as ⎛

E𝑅 ‖𝑌𝑅 ‖ ≤ 2𝑆/2𝑡 · 8 · ⎝

𝑇2 𝑁

⎞

√︃

𝑡(2𝑇 + 2) ⎠ . 𝑁

(︂

𝑇2 𝑁 +

+

By setting 𝑡 = 𝑆/2, we have distinguishing advantage 𝑂

√︁

𝑆(𝑇 +1) 𝑁

)︂

.

Now we are only left to prove Lemma 8.3, which is left to Appendix C.

32

9

One-query unitary synthesis lower bound from compressed oracles

In this section, we apply the trace-moment method to two oracle state games to reprove onequery unitary synthesis lower bounds: the oracle state search game [DLM26] and the oracle state distinguishing game [LMW24]. We give a common compressed-oracle approach to bounding those security, recovering the asymptotic bounds of [DLM26, LMW24]. To apply the trace moment method, both arguments begin with the weight-vector decomposition, which converts the optimization over the arbitrary phase oracle into a spectral relaxation. We then bound the resulting operator norm through trace moments in the compressed-oracle representation.

9.1

Oracle state search game hardness

In this subsection, we upper bound a search game winning probability of a one-query (unitary synthesis) adversary, which gives an alternate proof for Theorem A.1 in [DLM26]. Instead of using matrix concentration inequalities for matrix Rademacher series, we upper bound the winning probability via the compressed oracle techniques. Together with the reduction in [DLM26, Section 4.1], this will give a one-query unitary synthesis lower bound by the compressed oracle techniques. Definition 9.1 (Oracle state search game, from [DLM26, Definition 4.1]). Fix a random }︀variable {︀ R and, for every 𝑅 in its support, define a family of normalized states |𝜓𝑅,𝑘 ⟩ : 𝑘 ∈ [𝐾] ⊆ C𝑁 . Without loss of generality, we may describe |𝜓𝑅,𝑘 ⟩ in the computational basis with the following normalization: 1 ∑︁ |𝜓𝑅,𝑘 ⟩ = √ 𝑅(𝑘, 𝑥) |𝑥⟩ 𝑁 𝑥∈[𝑁 ] for some random variables {R(𝑘, 𝑥) ∈ C}𝑘∈[𝐾],𝑥∈[𝑁 ] . In the oracle state search game, the challenger samples 𝑅 together with a uniformly random key 𝑘 ∈ [𝐾], gives the adversary one copy of |𝜓𝑅,𝑘 ⟩, and the adversary must output 𝑘 after making one oracle query. The oracle can depend on the variable 𝑅 but not on 𝑘. Together with the one-query normal form of a unitary synthesis algorithm as in Definition 3.10, now we can denote the winning probability of this search game conditioned on sampling 𝑅 as Win(𝒜 | 𝑅) := max E𝑘 ‖Π𝑘 · 𝑂𝑓 · 𝑉 |𝜓𝑅,𝑘 ⟩‖2 , 𝑓

where the final projective measurement {Π𝑘 }𝑘∈[𝐾] is also independent of 𝑅, and the post query unitary 𝑈 can be absorbed in the projective measurement by defining {Π′𝑘 := 𝑈 † Π𝑘 𝑈 }𝑘 . 𝑂𝑓 is the arbitrary phase oracle, where the underlying boolean function is 𝑓 . Theorem 9.2 (One-query search bound for binary phase states, [DLM26, Theorem A.1]). For the oracle state search game associated with the family { |𝜓𝑅,𝑘 ⟩}𝑘∈[𝐾] defined as in Definition 9.1 with 𝑅 = (𝑅(𝑘, 𝑥))𝑘∈[𝐾], 𝑥∈[𝑁 ] as a family of independent Rademacher random variables, every one-query adversary with workspace dimension 𝑀 satisfies 2 1 + log(2𝑀 ) E𝑅 Win(𝒜 | 𝑅) ≤ . 𝐾 (︀

[︀

]︀

33

)︀

Proof overview. By the weight-vector decomposition together with the spectral relaxation, the search probability can be upper bounded by the expected norm of an operator on the algorithm’s register. Via the trace-moment method and rewriting in the compressed oracle database mode, the key remaining step is the small-database analysis (Lemma 9.3). After the weight vector decomposition, we can view the reweighting diagonal operator 𝐷𝑉,𝑅,𝑘 ̂︀ 𝑘 in compressed database mode) as generating a challenge, and similarly, we can group terms (or 𝐷 ̂︀ 𝑘 as a sum of operators by whether the final database contains the “challenge entry”; that is, view 𝐷 𝐷𝑥 for different 𝑥, and for the 𝑥 part with 𝐷𝑥 applying on states, we group according to whether (𝑘, 𝑥) is in the final database. • If (𝑘, 𝑥) is in the final database, note that the final database on challenge key 𝑘 is bounded by ℓ. Therefore, in the corresponding coherent sum over 𝑥 inside the final database, paying only 𝑂(ℓ) can make it into a sum of individual squared norms, which would be easy to upper bound. • If (𝑘, 𝑥) is not in the final database, this means (𝑘, 𝑥) should appear in the initial database, where one would expect to bound it by ℓ/𝐾. Since each application of the moment operator changes the database size by at most two, a moment of order 1 + log 𝑀 gives the desired asymptotic search bound. 9.1.1

Spectral relaxation and the compressed oracle trace moment

Our goal is to upper bound the search game success probability of a one-query adversary, which is to upper bound E𝑅 [Win(𝒜 | 𝑅)] = E𝑅 max E𝑘 ‖Π𝑘 · 𝑂𝑓 · 𝑉 |𝜓𝑅,𝑘 ⟩‖2 . 𝑓

By Lemma 3.11, we can apply a generic spectral relaxation as in [DLM26, Section 6.1]: E𝑅 max E𝑘 ‖Π𝑘 · 𝑂𝑓 · 𝑉 |𝜓𝑅,𝑘 ⟩‖2 = E𝑅 max E𝑘 ‖Π𝑘 𝐷𝑅,𝑘 · 𝑂𝑓 |wt𝑉 ⟩‖2 𝑓

𝑓

(︁

)︁

† = E𝑅 max ⟨wt𝑉 | 𝑂𝑓† · E𝑘 𝐷𝑅,𝑘 Π𝑘 𝐷𝑅,𝑘 · 𝑂𝑓 |wt𝑉 ⟩ 𝑓

⃦ ⃦ ⃦ ⃦ † ≤ E𝑅 ⃦E𝑘 𝐷𝑅,𝑘 Π𝑘 𝐷𝑅,𝑘 ⃦.

here we omit 𝑉 in 𝐷𝑅,𝑘 := 𝐷𝑉,𝑅,𝑘 from Lemma 3.11. Define 𝑊𝑅 :=

𝐾 1 ∑︁ † 𝐷𝑅,𝑘 Π𝑘 𝐷𝑅,𝑘 . 𝐾 𝑘=1

Then 𝑊𝑅 ⪰ 0, and for every positive integer 𝑡, (︁

E𝑅 ‖𝑊𝑅 ‖ ≤ E𝑅 ‖𝑊𝑅 ‖2𝑡

)︁1/(2𝑡)

(︁

(︁

≤ E𝑅 Tr 𝑊𝑅2𝑡

)︁)︁1/(2𝑡)

.

(26)

Now we only need to upper bound this trace moment, and we rewrite it within the compressed oracle methodology.

34

First we write 𝐷𝑅,𝑘 as

Rewrite in compressed oracle framework. 𝐷𝑅,𝑘 =

∑︁

𝑅(𝑘, 𝑥)𝐷𝑥 ,

𝑥∈[𝑁 ] † where the fixed diagonal matrices {𝐷𝑥 }𝑥 satisfy 𝑥 𝐷𝑥 𝐷𝑥† = 𝑥 𝐷𝑥† 𝐷𝑥 = E𝑅 𝐷𝑅,𝑘 𝐷𝑅,𝑘 ⪯ I. Define 𝑇𝑘,𝑥 on the compressed oracle register that flips the presence of the database entry (𝑘, 𝑥); that is, 𝑇𝑘,𝑥 |𝑆⟩ = |𝑆 ⊕ {(𝑘, 𝑥)}⟩, and thus define

∑︀

̂︀ 𝑘 := 𝐷

∑︁

∑︀

(27)

𝐷𝑥 ⊗ 𝑇𝑘,𝑥 .

𝑥∈[𝑁 ]

̂︀ 𝑘 |𝜑⟩ |𝑆⟩ = This means that 𝐷 𝑥 𝐷𝑥 |𝜑⟩ ⊗ |𝑆 ⊕ {(𝑘, 𝑥)}⟩. Therefore, the compressed oracle purification of 𝑊𝑅 is then expressed as ∑︀

̂︁ := 𝑊

𝐾 1 ∑︁ ̂︀ † (Π𝑘 ⊗ I)𝐷 ̂︀ 𝑘 , 𝐷 𝐾 𝑘=1 𝑘

and our goal from (26) can be written as E𝑅 Tr 𝑊𝑅2𝑡 = (︀

)︀

∑︁

⟨𝑧| E𝑅 𝑊𝑅2𝑡 |𝑧⟩ = (︀

)︀

∑︁

̂︁ 2𝑡 |𝑧⟩ |∅⟩ . ⟨𝑧| ⟨∅| 𝑊

(28)

𝑧∈[𝑀 ]

𝑧∈[𝑀 ]

It remains to bound the last quantity for each fixed 𝑧. 9.1.2

Bounding the trace moment on small databases

̂︁ defined as above, if normalized state |𝜓⟩ (with both the algorithm’s register Lemma 9.3. For 𝑊 and the database register) is supported on databases of size ≤ ℓ, then ̂︁ |𝜓⟩ ≤ ⟨𝜓| 𝑊

4(ℓ + 1) . 𝐾

With Lemma 9.3, now we can bound (28). ̂︁ will append the database by size at most 2. Therefore, Proof of Theorem 9.2. For each 𝑧, each 𝑊 𝑖 𝑖 ̂︁ |𝜓𝑧 ⟩ := 𝑊 |𝑧⟩ |∅⟩ is supported on database of size ≤ 2𝑖, and for 𝑃≤𝑖 defined as the projector on database of size ≤ 𝑖, ⃦ ⃦ ⃦ ⃦ ⃦ 𝑖 ⃦ ⃦ ̂︁ 𝑃≤2𝑖−2 |𝜓 𝑖−1 ⟩⃦ ⃦ |𝜓𝑧 ⟩⃦ = ⃦𝑃≤2𝑖 𝑊 ⃦ 𝑧 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ̂︁ 𝑃≤2𝑖 ⃦ ≤ ⃦𝑃≤2𝑖 𝑊 ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ ⃦ 4(2𝑖 + 1) ⃦ ⃦ 𝑖−1 ⃦ ≤ ⃦ |𝜓𝑧 ⟩⃦.

𝐾

Therefore, for each 𝑧 ∈ [𝑀 ], ̂︁ 2𝑡 |𝑧⟩ |∅⟩ = ‖ |𝜓𝑡 ⟩‖2 ≤ ⟨𝑧| ⟨∅| 𝑊

)︂ 𝑡 (︂ ∏︁ 4(2𝑖 + 1) 2 𝑖=1

35

𝐾

(︂

≤

8𝑡 + 4 𝐾

)︂2𝑡

.

From (26) and (28), this gives (︃

E𝑅 ‖𝑊𝑅 ‖ ≤

(︂

𝑀·

8𝑡 + 4 𝐾

)︂2𝑡 )︃1/2𝑡

Taking 𝑡 = log 𝑀 gives

(︂

E𝑅 ‖𝑊𝑅 ‖ ≤ 𝑂

= 𝑀 1/2𝑡 ·

log 𝑀 𝐾

8𝑡 + 4 . 𝐾

)︂

.

Now we are left to prove Lemma 9.3. 9.1.3

Proof of the small database search bound

Proof of Lemma 9.3. By definition, ̂︁ |𝜓⟩ = ⟨𝜓| 𝑊

Write

⃦2 1 ∑︁ ⃦ ⃦ ̂︀ 𝑘 |𝜓⟩⃦ ⃦(Π𝑘 ⊗ I)𝐷 ⃦ . 𝐾 𝑘

|𝜓⟩ =

∑︁

𝛼𝑆 |𝜙𝑆 ⟩ |𝑆⟩ ,

𝑆

̂︀ 𝑘 and by the where each |𝜙𝑆 ⟩ is normalized, and where 𝛼𝑆 = 0 whenever |𝑆| > ℓ. Expanding 𝐷 + orthogonality of the final database 𝑆 , this gives ⃦2 ⃦ ⃦ 𝛼𝑆 𝐷𝑥 |𝜙𝑆 ⟩⃦ ⃦ ⃦ 𝑥,𝑆: 𝑆 + =𝑆⊕{(𝑘,𝑥)} 𝑘,𝑆 ⃦2 ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ )︃ ⃦ (︃⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ 2 ∑︁ ⃦ ⃦ ⃦ ⃦ 𝛼𝑆 𝐷𝑥 |𝜙𝑆 ⟩⃦ . ≤ 𝛼𝑆 𝐷𝑥 |𝜙𝑆 ⟩⃦ + ⃦Π𝑘 ⃦Π𝑘 ⃦ ⃦ ⃦ 𝐾 + ⃦ ⃦ ⃦ ⃦ ⃦ 𝑘,𝑆 𝑥:(𝑘,𝑥)∈𝑆 / + 𝑥:(𝑘,𝑥)∈𝑆 + ⃦ ⃦ ⃦ ⃦ + + ⃦ ⃦

∑︁ ⃦ ̂︁ |𝜓⟩ = 1 ⃦Π𝑘 ⟨𝜓| 𝑊 ⃦ 𝐾 +⃦

∑︁

𝑆=𝑆 ∪{(𝑘,𝑥)}

𝑆=𝑆 ∖{(𝑘,𝑥)}

We bound the two sums separately. For the first sum.

The inner sum has at most |𝑆 + | ≤ ℓ + 1 terms, so by Cauchy-Schwarz,

⃦ ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ⃦ ∑︁ ∑︁ ∑︁ ⃦ 𝛼𝑆 𝐷𝑥 |𝜙𝑆 ⟩⃦ ≤ (ℓ + 1) |𝛼𝑆 |2 ‖Π𝑘 𝐷𝑥 |𝜙𝑆 ⟩‖2 ⃦Π𝑘 ⃦ ⃦ ⃦ 𝑘,𝑆 + ⃦ 𝑘,𝑆 + 𝑥:(𝑘,𝑥)∈𝑆 + 𝑥:(𝑘,𝑥)∈𝑆 + ⃦ ⃦ 𝑆=𝑆 + ∖{(𝑘,𝑥)} 𝑆=𝑆 + ∖{(𝑘,𝑥)} ∑︁ 2

≤ (ℓ + 1)

|𝛼𝑆 |2 ‖Π𝑘 𝐷𝑥 |𝜙𝑆 ⟩‖

𝑘,𝑥,𝑆

= (ℓ + 1)

∑︁

≤ (ℓ + 1)

∑︁

|𝛼𝑆 |2 ⟨𝜙𝑆 | 𝐷𝑥†

(︁ ∑︁

𝑥,𝑆

𝑆

≤ ℓ + 1. 36

)︁

Π𝑘 𝐷𝑥 |𝜙𝑆 ⟩

𝑘 2

|𝛼𝑆 | ⟨𝜙𝑆 |

(︁ ∑︁ 𝑥

)︁

𝐷𝑥† 𝐷𝑥 |𝜙𝑆 ⟩

For the second sum.

We use the operator-valued Cauchy-Schwarz inequality ⃦ ⃦ ⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ⃦∑︁ ⃦ ⃦∑︁ †⃦ ⃦ ⃦ ⃦ ⃦ ‖𝑣𝑗 ‖2 . 𝐵 𝐵 ≤ 𝐵 𝑣 𝑗 𝑗⃦ 𝑗 𝑗⃦ ⃦ ⃦ ⃦ 𝑗 ⃦ 𝑗 ⃦ ⃦ 𝑗

Applying this with 𝐵𝑥 = Π𝑘 𝐷𝑥 and using

† 𝑥 Π𝑘 𝐷𝑥 𝐷𝑥 Π𝑘 ⪯ Π𝑘 ⪯ 𝐼, we will obtain

∑︀

⃦2 ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ ∑︁ ∑︁ ∑︁ ⃦ ⃦ |𝛼𝑆 |2 ‖ |𝜙𝑆 ⟩ ‖2 = |𝑆| |𝛼𝑆 |2 ≤ ℓ. 𝛼𝑆 𝐷𝑥 |𝜙𝑆 ⟩⃦ ≤ ⃦Π𝑘 ⃦ ⃦ ⃦ 𝑆 𝑘,𝑆 + 𝑥:(𝑘,𝑥)∈𝑆 𝑘,𝑆 + ⃦ / + 𝑥:(𝑘,𝑥)∈𝑆 / + ⃦ ⃦ + + 𝑆=𝑆 ∪{(𝑘,𝑥)}

𝑆=𝑆 ∪{(𝑘,𝑥)}

Combining the two sums.

From the above upper bounds,

̂︁ |𝜓⟩ ≤ ⟨𝜓| 𝑊

9.2

)︀ 2 (︀ 4(ℓ + 1) (ℓ + 1) + ℓ ≤ . 𝐾 𝐾

Oracle state distinguishing game hardness

In this subsection, we upper bound a distinguishing game winning probability of a one-query (unitary synthesis) adversary, which gives an alternate proof for Theorem 2.2 in [LMW24] (and thus an alternate proof of a one-query unitary synthesis lower bound). Instead of using matrix concentration inequalities for matrix Rademacher series, we upper bound the winning probability via the compressed oracle techniques. Definition 9.4 (Oracle state distinguishing game, from [LMW24, Definition 3.8]). {︀Fix a random variable R and, for every 𝑅 in its support, define a family of normalized states |𝜓𝑅,𝑘 ⟩ : 𝑘 ∈ }︀ [𝐾] ⊆ C𝑁 . Without loss of generality, we may describe |𝜓𝑅,𝑘 ⟩ in the computational basis with the following normalization: 1 ∑︁ |𝜓𝑅,𝑘 ⟩ = √ 𝑅(𝑘, 𝑥) |𝑥⟩ 𝑁 𝑥∈[𝑁 ] for some random variables {R(𝑘, 𝑥) ∈ C}𝑘∈[𝐾], 𝑥∈[𝑁 ] . In the oracle state distinguishing game, the challenger samples 𝑅 together with an independent uniformly random bit 𝑏 ∈ {0, 1}. If 𝑏 = 0, the challenger samples a uniformly random key 𝑘 ∈ [𝐾] and gives the adversary one copy of |𝜓𝑅,𝑘 ⟩. If 𝑏 = 1, the challenger samples a uniformly random 𝑥 ∈ [𝑁 ] and gives the adversary |𝑥⟩. The adversary must output a bit 𝑏′ ∈ {0, 1} after making one oracle query, and wins if 𝑏′ = 𝑏. The oracle can depend on 𝑅 but not on the challenge bit 𝑏, the sampled key 𝑘, or the sampled basis index 𝑥. Together with the one-query normal form of a unitary synthesis algorithm as in Definition 3.10, now we can denote the distinguishing advantage conditioned on sampling 𝑅 as ⃒ ⃒

⃒ ⃒

Δ𝒜 (𝑅) := max ⃒E𝑘 ⟨𝜓𝑅,𝑘 | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓𝑅,𝑘 ⟩ − Eℎ ⟨𝜓ℎ | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓ℎ ⟩⃒ , 𝑓

37

where the final projective measurement {Π, 𝐼 − Π} for distinguishing is also independent of 𝑅, and the post query unitary 𝑈 can be absorbed in the projective measurement by defining Π′ := 𝑈 † Π𝑈 . 𝑂𝑓 is the arbitrary phase oracle, where the underlying boolean function is 𝑓 . ℎ is an independent random binary phase vector, and defines |𝜓ℎ ⟩ as a random binary phase state. Theorem 9.5 (One-query distinguishing bound for binary phase states, [LMW24, Theorem 4.17]). For the oracle state distinguishing game associated with the family { |𝜓𝑅,𝑘 ⟩}𝑘∈[𝐾] defined as in Definition 9.4 with 𝑅 = (𝑅(𝑘, 𝑥))𝑘∈[𝐾], 𝑥∈[𝑁 ] as a family of independent Rademacher random variables, every one-query adversary with workspace dimension 𝑀 satisfies ⎛√︃

E𝑅 Δ𝒜 (𝑅) ≤ 𝑂 ⎝ [︀

]︀

⎞

log 𝑀 ⎠ 𝐾

for Δ𝒜 (𝑅) as the distinguishing advantage when 𝑅 is sampled. Proof overview. By the weight-vector decomposition together with the spectral relaxation, the distinguishing advantage can be upper bounded by the expected norm of an operator on the algorithm’s register. • For distinguishing, the operator is centered. To keep this cancellation, we introduce an independent copy of the oracle. By symmetrization and convexity of the operator norm, it then suffices to bound the expected norm of the difference between the two associated acceptance operators. Via the trace-moment method and rewriting in the compressed oracle database mode, the key remaining step is the small-database analysis (Lemma 9.6). In the compressed-oracle representation, we compare these operators by swapping the two copies of the challenge key row. • This swap leaves any database component unchanged when both rows are empty, so its effect can be charged to components in which at least one of the rows is occupied. Therefore, averaging over the hidden key, one would expect to bound some squared difference by√︀𝑂(ℓ/𝐾) (and later Cauchy-Schwarz would give a small-database distinguishing bound of 𝑂( ℓ/𝐾)). Applying the trace-moment argument at order 1 + log 𝑀 proves the theorem. 9.2.1

Spectral relaxation and the compressed oracle trace moment

Our goal is to upper bound the distinguishing advantage of a one-query adversary, which is to upper bound ⃒ ⃒

⃒ ⃒

E𝑅 [Δ𝒜 (𝑅)] = E𝑅 max ⃒E𝑘 ⟨𝜓𝑅,𝑘 | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓𝑅,𝑘 ⟩ − Eℎ ⟨𝜓ℎ | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓ℎ ⟩⃒ . 𝑓

By Lemma 3.11, we can apply a generic spectral relaxation similar to the search case in Section 9.1.1: ⃒ ⃒

⃒ ⃒

E𝑅 max ⃒E𝑘 ⟨𝜓𝑅,𝑘 | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓𝑅,𝑘 ⟩ − Eℎ ⟨𝜓ℎ | 𝑉 † 𝑂𝑓† Π𝑂𝑓 𝑉 |𝜓ℎ ⟩⃒ 𝑓

⃒ ⃒

(︁

)︁

⃒ ⃒

† = E𝑅 max ⃒⟨wt𝑉 | 𝑂𝑓† · E𝑘 𝐷𝑅,𝑘 Π𝐷𝑅,𝑘 − Eℎ 𝐷ℎ† Π𝐷ℎ · 𝑂𝑓 |wt𝑉 ⟩⃒ 𝑓

38

⃦ ⃦

⃦ ⃦

† ≤ E𝑅 ⃦E𝑘 𝐷𝑅,𝑘 Π𝐷𝑅,𝑘 − Γ⃦,

Define

for Γ := Eℎ 𝐷ℎ† Π𝐷ℎ ,

† 𝑋𝑅 := E𝑘 𝐷𝑅,𝑘 Π𝐷𝑅,𝑘 − Γ.

† By symmetrization with an independent copy 𝑅′ , with 𝑊𝑅 := E𝑘 𝐷𝑅,𝑘 Π𝐷𝑅,𝑘 and by convexity of the operator norm, we have

E𝑅 ‖𝑋𝑅 ‖ = E𝑅 ‖𝑊𝑅 − E𝑅′ 𝑊𝑅′ ‖ ≤ E𝑅,𝑅′ ‖𝑊𝑅 − 𝑊𝑅′ ‖. Therefore, define

† † 𝑌𝑅,𝑅′ := 𝑊𝑅 − 𝑊𝑅′ = E𝑘 𝐷𝑅,𝑘 Π𝐷𝑅,𝑘 − 𝐷𝑅 ′ ,𝑘 Π𝐷𝑅′ ,𝑘 ,

(︀

)︀

now it suffices to bound E𝑅,𝑅′ ⃦𝑌𝑅,𝑅′ ⃦. Now 𝑌𝑅,𝑅′ is Hermitian. As before, we use an even trace power. For every positive integer 𝑡, ⃦

⃦

⃦

(︁

⃦

⃦2𝑡 )︁1/2𝑡

⃦

E𝑅,𝑅′ ⃦𝑌𝑅,𝑅′ ⃦ ≤ E𝑅,𝑅′ ⃦𝑌𝑅,𝑅′ ⃦

(︁

(︁

2𝑡 ≤ E𝑅,𝑅′ Tr 𝑌𝑅,𝑅 ′

)︁)︁1/2𝑡

.

(29)

We will now upper bound this trace moment using the compressed oracle methodology. Rewrite in the compressed oracle framework. Similarly as in (27), for key 𝑘, define ̂︀ 𝑘 := 𝐷

∑︁

̂︀ ′ = 𝐷 𝑘

𝐷𝑥 ⊗ 𝑇𝑘,𝑥 ,

∑︁

′ 𝐷𝑥 ⊗ 𝑇𝑘,𝑥 .

𝑥

𝑥∈[𝑁 ]

This allows us to define the compressed oracle purification 1 𝑌̂︀ :=

𝐾 ∑︁ (︀ † (︀ ′ )︀† )︀ ̂︀ Π𝐷 ̂︀ 𝑘 − 𝐷 ̂︀ Π𝐷 ̂︀ ′ . 𝐷

𝐾 𝑘=1

𝑘

𝑘

𝑘

Then, similarly (29) can be written as 2𝑡 E𝑅,𝑅′ Tr 𝑌𝑅,𝑅 ′ =

(︀

)︀

∑︁

⟨𝑧| ⟨∅| 𝑌̂︀ 2𝑡 |𝑧⟩ |∅⟩ ,

(30)

𝑧∈[𝑀 ]

where now |∅⟩ denotes the empty compressed database for the two independent copies 𝑅 and 𝑅′ . It remains to bound the last quantity for each fixed 𝑧. 9.2.2

Bounding the trace moment on small databases

Lemma 9.6. For 𝑌̂︀ defined as above, if normalized state is supported on databases of size ≤ ℓ, where ℓ + 1 ≤ 𝐾, then √︃ ⃒ ⃒ ℓ+1 ⃒ ⃒ . ⃒⟨𝜓| 𝑌̂︀ |𝜓⟩⃒ ≤ 20

𝐾

With Lemma 9.6, now we can bound (30).

39

Proof of Theorem 9.5. This proceeds exactly as in Section 9.1.2. For each 𝑧, each 𝑌̂︀ will append the database by size at most 2. Therefore, |𝜓𝑧𝑖 ⟩ := 𝑌̂︀ 𝑖 |𝑧⟩ |∅⟩ is supported on database of size ≤ 2𝑖, and for 𝑃≤𝑖 defined as the projector on database of size ≤ 𝑖, as long as 2𝑖 + 1 ≤ 𝐾, ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ 𝑖 ⃦ ⃦ ⃦ |𝜓𝑧 ⟩⃦ = ⃦𝑃≤2𝑖 𝑌̂︀ 𝑃≤2𝑖−2 |𝜓𝑧𝑖−1 ⟩⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ⃦ ≤ ⃦𝑃≤2𝑖 𝑌̂︀ 𝑃≤2𝑖 ⃦ · ⃦ |𝜓𝑧𝑖−1 ⟩⃦ √︃ ⃦ 2𝑖 + 1 ⃦ ⃦ 𝑖−1 ⃦ ≤ 20 ⃦ |𝜓𝑧 ⟩⃦.

𝐾

Suppose that 𝐾 > 2 log 𝑀 (or we will trivially bound the distinguishing advantage in the regime 𝐾 ≤ 2 log 𝑀 by 1). Then we set 𝑡 = log 𝑀 , and ⟨𝑧| ⟨∅| 𝑌̂︀ 2𝑡 |𝑧⟩ |∅⟩ = ‖ |𝜓𝑡 ⟩‖2 ≤

𝑡 ∏︁ 400(2𝑖 + 1)

𝐾

𝑖=1

(︂

≤

1600𝑡 𝐾

)︂𝑡

.

Summing over 𝑧 ∈ [𝑀 ], this gives (︃ ⃦ ⃦ E𝑅 ‖𝑋𝑅 ‖ ≤ E𝑅,𝑅′ ⃦𝑌𝑅,𝑅′ ⃦ ≤

9.2.3

(︂

𝑀·

1600𝑡 𝐾

⎛√︃

)︂𝑡 )︃1/2𝑡

⎞

≤ 𝑂⎝

log 𝑀 ⎠ . 𝐾

⃦ ⃦

⃦2 ⃦

Proof of the small database distinguishing bound ⃦2 ⃦

⃦ ⃦

̂︀ ′ |𝜓⟩⃦ , so that ̂︀ 𝑘 |𝜓⟩⃦ and 𝑞𝑘 := ⃦Π𝐷 Proof of Lemma 9.6. For each 𝑘, define 𝑝𝑘 := ⃦Π𝐷 𝑘

⟨𝜓| 𝑌̂︀ |𝜓⟩ =

1 ∑︁ (𝑝𝑘 − 𝑞𝑘 ). 𝐾 𝑘

For a fixed choice of 𝑘 and for 𝑏 ∈ {0, 1}, define (𝑏)

𝑛𝑘 (𝑆) := #{𝑥 : (𝑏, 𝑘, 𝑥) ∈ 𝑆}. We first prove the following bound. Claim 9.7. Suppose |𝜓⟩ =

𝑆 𝛼𝑆 |𝜙𝑆 ⟩ |𝑆⟩. Then for every 𝑘 ∈ [𝐾], 𝑏 ∈ {0, 1}, we have

∑︀

⃦ ⃦2 ∑︁ (𝑏) ⃦ ̂︀ (𝑏) ⃦ (2𝑛𝑘 (𝑆) + 1) · |𝛼𝑆 |2 , ⃦Π𝐷𝑘 |𝜓⟩⃦ ≤ 2 𝑆 (0)

(1)

̂︀ ̂︀ ̂︀ ̂︀ ′ where 𝐷 𝑘 = 𝐷𝑘 and 𝐷𝑘 = 𝐷𝑘 .

Proof of Claim 9.7. The 𝑏 = 0 and 𝑏 = 1 cases are symmetric, so we only need to analyze the case (0) for 𝑏 = 0. Set 𝑛𝑘 (𝑆) = 𝑛𝑘 (𝑆). For 𝑆 + defined as the final database, we expand ⃦ ⃦ ⃦2 ∑︁ ⃦ ⃦ ̂︀ ⃦ ⃦Π · ⃦Π𝐷𝑘 |𝜑⟩⃦ = ⃦ 𝑆+

⃦2 ⃦

∑︁ 𝑥,𝑆:𝑆 + =𝑆⊕{(𝑘,𝑥)}

40

𝛼𝑆 𝐷𝑥 |𝜑𝑆 ⟩ ⃦ ⃦ ≤ 2(𝐴𝑘 + 𝐵𝑘 ),

where 𝐴𝑘 :=

∑︁ ⃦ ⃦ ⃦Π · ⃦ 𝑆+

∑︁ 𝑥:(𝑘,𝑥)∈𝑆 + 𝑆=𝑆 + ∖{(𝑘,𝑥)}

⃦2 ⃦ 𝛼𝑆 𝐷𝑥 |𝜑𝑆 ⟩ ⃦ ⃦ ,

𝐵𝑘 :=

∑︁ ⃦ ⃦ ⃦Π · ⃦ 𝑆+

∑︁ 𝑥:(𝑘,𝑥)∈𝑆 / + 𝑆=𝑆 + ∪{(𝑘,𝑥)}

⃦2 ⃦ 𝛼𝑆 𝐷𝑥 |𝜑𝑆 ⟩ ⃦ ⃦ .

Bound 𝐴𝑘 . Note that for fixed 𝑆 + , the inner sum contains exactly 𝑛𝑘 (𝑆 + ) terms, and thus, ∑︁

𝐴𝑘 ≤

𝑛𝑘 (𝑆 + ) ·

𝑆+

|𝛼𝑆 |2 · ‖Π𝐷𝑥 |𝜑𝑆 ⟩‖2

∑︁ 𝑥:(𝑘,𝑥)∈𝑆 + 𝑆=𝑆 + ∖{(𝑘,𝑥)}

(𝑛𝑘 (𝑆) + 1) ·

≤

∑︁

∑︁

𝑆

𝑥

=

∑︁

≤

∑︁

|𝛼𝑆 |2 · ‖Π𝐷𝑥 |𝜑𝑆 ⟩‖2

(𝑛𝑘 (𝑆) + 1) · |𝛼𝑆 |2 · ⟨𝜑𝑆 |

∑︁

𝐷𝑥† Π𝐷𝑥 |𝜑𝑆 ⟩

𝑥

𝑆

(𝑛𝑘 (𝑆) + 1) · |𝛼𝑆 | , 2

𝑆

where in the last line we used Π ⪯ 𝐼 together with

† 𝑥 𝐷𝑥 𝐷𝑥 ⪯ 𝐼.

∑︀

Bound 𝐵𝑘 . We use the same operator-valued Cauchy-Schwarz as in the proof of Lemma 9.3: ⃦ ⃦ ⃦ ⃦ ∑︁ ∑︁ ⃦ ∑︁ ⃦ † ⃦ ⃦ |𝛼𝑆 |2 𝐵𝑘 ≤ Π𝐷𝑥 𝐷𝑥 Π⃦ · ⃦ ⃦ ⃦ 𝑆 + 𝑥:(𝑘,𝑥)∈𝑆 𝑥:(𝑘,𝑥)∈𝑆 / + / + 𝑆=𝑆 + ∪{(𝑘,𝑥)}

≤

=

∑︁

∑︁

𝑆+

𝑥:(𝑘,𝑥)∈𝑆 / + 𝑆=𝑆 + ∪{(𝑘,𝑥)}

∑︁

𝑛𝑘 (𝑆) · |𝛼𝑆 |2 ,

|𝛼𝑆 |2

𝑆

where we used that the 𝐷𝑥 are diagonal, and therefore Combining the two estimates.

∑︀ † † 𝑥 𝐷𝑥 𝐷𝑥 = 𝑥 𝐷𝑥 𝐷𝑥 ⪯ I.

∑︀

This will give

⃦ ⃦2 ∑︁ ⃦ ̂︀ ⃦ (2𝑛𝑘 (𝑆) + 1) · |𝛼𝑆 |2 , ⃦Π𝐷𝑘 |𝜑⟩⃦ ≤ 2 𝑆

which proves Claim 9.7. We now return to the proof of the lemma. Applying Cauchy-Schwarz exactly as in the first section, ⃒ ⃒ (︃ )︃1/2 (︃ )︃1/2 ⃒ ⃒ ⃒∑︁ ⃒ 1 ∑︁ √ 1 1 ∑︁ √ √ 2 √ 2 ⃒ ⃒ ⃒ ⃒ ̂︀ ( 𝑝𝑘 − 𝑞𝑘 ) · ( 𝑝𝑘 + 𝑞𝑘 ) . ⃒⟨𝜓| 𝑌 |𝜓⟩⃒ = ⃒ (𝑝𝑘 − 𝑞𝑘 )⃒ ≤ ⃒ 𝐾⃒ 𝐾 𝐾 𝑘

𝑘

𝑘

We bound the two factors separately. 41

The second factor. Applying Claim 9.7 with 𝑏 = 0 and 𝑏 = 1 respectively, we obtain ∑︁ 1 ∑︁ 2 ∑︁ ∑︁ 4ℓ 2 ∑︁ 𝑝𝑘 ≤ (2𝑛𝑘 (𝑆) + 1) · |𝛼𝑆 |2 = 2 𝑛𝑘 (𝑆) |𝛼𝑆 |2 ≤ 2 + , 1+ 𝐾 𝑘 𝐾 𝑘 𝑆 𝐾 𝑘 𝐾 𝑆 )︃

(︃

and this holds similarly for 𝑞𝑘 , with 𝐾1

4ℓ 𝑘 𝑞𝑘 ≤ 2 + 𝐾 . Therefore, for ℓ + 1 ≤ 𝐾,

∑︀

2 ∑︁ 16ℓ 1 ∑︁ √ √ ( 𝑝𝑘 + 𝑞𝑘 )2 ≤ (𝑝𝑘 + 𝑞𝑘 ) ≤ 8 + ≤ 24. 𝐾 𝑘 𝐾 𝑘 𝐾 The first factor. For each 𝑘, let 𝑆𝑘 be the unitary that swaps (0, 𝑘) and (1, 𝑘) in the compressed database; that is, swapping the database 𝐷𝑘 and 𝐷𝑘′ . Let 𝐵𝑘 denote the projector onto database (0) (1) states 𝑆 satisfying 𝑛𝑘 (𝑆) + 𝑛𝑘 (𝑆) > 0; that is, projecting on database with 𝐷𝑘 ∪ 𝐷𝑘′ non-empty. ̂︀ ′ = 𝐷 ̂︀ 𝑘 𝑆𝑘 . This Write |𝑎𝑘 ⟩ := (𝐼 − 𝐵𝑘 ) |𝜓⟩ and |𝑏𝑘 ⟩ := 𝐵𝑘 |𝜓⟩. Then 𝑆𝑘 |𝑎𝑘 ⟩ = |𝑎𝑘 ⟩, and 𝑆𝑘 𝐷 𝑘 implies √

⃦ ⃦

⃦ ⃦

⃦ ⃦

⃦ ⃦

̂︀ ′ ( |𝑎𝑘 ⟩ + 𝑆𝑘 |𝑏𝑘 ⟩)⃦, ̂︀ 𝑘 ( |𝑎𝑘 ⟩ + |𝑏𝑘 ⟩)⃦ = ⃦Π𝐷 𝑝𝑘 = ⃦Π𝐷 𝑘

while √

⃦ ⃦

⃦ ⃦

̂︀ ′ ( |𝑎𝑘 ⟩ + |𝑏𝑘 ⟩)⃦. 𝑞𝑘 = ⃦Π𝐷 𝑘

Therefore, ⃦2 ⃦ ⃦2 ⃦ ⃦2 ⃦ √ √ ⃦ ⃦ ̂︀ ′ ⃦ ⃦ ̂︀ ′ ⃦ ⃦ ̂︀ ′ Π 𝐷 𝑆 |𝑏 ⟩ + 2 Π 𝐷 |𝑏 ⟩ ≤ 2 (𝑆 |𝑏 ⟩ − |𝑏 ⟩) | 𝑝𝑘 − 𝑞𝑘 |2 ≤ ⃦Π𝐷 ⃦ ⃦ ⃦ ⃦ ⃦ 𝑘 𝑘 𝑘 𝑘 𝑘 𝑘 𝑘 𝑘 𝑘 ⃦2 ⃦

⃦ ⃦

⃦2 ⃦

⃦ ⃦

̂︀ 𝑘 |𝑏𝑘 ⟩⃦ + 2⃦Π𝐷 ̂︀ ′ |𝑏𝑘 ⟩⃦ . = 2⃦Π𝐷 𝑘

Applying Claim 9.7 to state |𝑏𝑘 ⟩, we have ⃦ ⃦2 ∑︁ (0) (0) (1) ⃦ ̂︀ ⃦ (2𝑛𝑘 (𝑆) + 1) · 1[𝑛𝑘 (𝑆) + 𝑛𝑘 (𝑆) > 0] · |𝛼𝑆 |2 , ⃦Π𝐷𝑘 |𝑏𝑘 ⟩⃦ ≤ 2 𝑆

̂︀ ′ . Therefore and similarly for 𝐷 𝑘

1 ∑︁ √ 4 ∑︁ √ ( 𝑝 𝑘 − 𝑞𝑘 ) 2 ≤ |𝛼𝑆 |2 · 𝐾 𝑘 𝐾 𝑆 ≤

∑︁ (0)

(︀

(0)

(1)

𝑘:𝑛𝑘 (𝑆)+𝑛𝑘 (𝑆)>0

4 ∑︁ 16ℓ . |𝛼𝑆 |2 · 4|𝑆| ≤ 𝐾 𝑆 𝐾

Combining the two factors. This will give √︃ ⃒ ⃒ ⃒ ⃒ ⃒⟨𝜓| 𝑌̂︀ |𝜓⟩⃒ ≤

√︃

16ℓ √ · 24 ≤ 20 𝐾

which proves Lemma 9.6. 42

(1)

2𝑛𝑘 (𝑆) + 1 + 2𝑛𝑘 (𝑆) + 1

ℓ+1 , 𝐾

)︀

10

One-query unitary synthesis with additional query access to 𝑅

In this section, we extend the oracle state search and distinguishing bounds of Section 9 to adversaries with additional access to the underlying random oracle 𝑅. After receiving the challenge, the adversary may make 𝑡 queries to 𝑅, one query to an arbitrary phase oracle 𝑂𝑓𝑅 , and then 𝑇 further queries to 𝑅. As before, 𝑓𝑅 may depend arbitrarily on 𝑅 but not on the challenge, while all non-oracle operations are fixed independently of 𝑅. We first consider the post-query setting, where 𝑡 = 0. Here the isometry preceding the arbitrary phase query remains independent of 𝑅, so the spectral relaxation from Section 9 still applies. We extend the compressed-oracle analysis to handle the subsequent queries, proving the search bound in Section 10.1 and the distinguishing bound in Section 10.2. Pre-queries make the preceding isometry depend on 𝑅, so this analysis no longer applies directly. In Section 10.3, we use a resampling argument to reduce that setting to the post-query case. The resulting bounds are quantitatively weaker, but still give negligible success probability and distinguishing advantage when 𝐾 is exponential and the numbers of queries and workspace qubits are polynomial. With some abuse of notation, in the post-query proofs of Sections 10.1 and 10.2, the number of pre-queries is 0, and 𝑡 denotes a freely chosen trace-moment parameter, with moments of order 2𝑡; in Section 10.3, we reuse 𝑡 for the number of queries to 𝑅 before the arbitrary phase query.

10.1

Oracle state search game with post-query access

We begin with the search game in the post-query setting, where there is no pre-query. The following theorem extends the bound from Section 9.1 to adversaries making 𝑇 queries to 𝑅 after the arbitrary phase query. Theorem 10.1 (One-query search bound for binary phase states, with post queries). For the variant of the oracle state search game associated with the family { |𝜓𝑅,𝑘 ⟩}𝑘∈[𝐾] with 𝑅 = (𝑅(𝑘, 𝑥))𝑘∈[𝐾], 𝑥∈[𝑁 ] as a family of independent Rademacher random variables, where the adversary is also allowed to make 𝑇 queries to 𝑅 after the arbitrary phase query, every such adversary with workspace dimension 𝑀 satisfies (︃ )︃ [︀ ]︀ 𝑇 2 + (𝑇 + 1) log 𝑀 E𝑅 Win(𝒜 | 𝑅) ≤ 𝑂 . 𝐾 Proof overview. The spectral relaxation from the one-query search game Section 9.1 still applies, since the isometry preceding the arbitrary phase query is independent of 𝑅. It therefore remains to prove the corresponding small-database estimate in the presence of post-queries (Lemma 10.2). The main additional difficulty is that the subsequent 𝑇 queries can use the correlation between the challenge state and the random oracle. We handle this correlation by introducing a fresh auxiliary row 0 ∈ / [𝐾], which is never queried by the algorithm, and swapping it with the challenge row 𝑘. This helps us compare in these ways: • The swap changes the initial compressed database only on components √︀ where database on key 𝑘 is nonempty. For a database of size at most ℓ, this contributes 𝑂( ℓ/𝐾) to the success amplitude. • Conjugating the post-query computation by the swap, this changes the oracle only √ on queries with address on row 𝑘. Replacing these queries one at a time contributes 𝑂(𝑇 / 𝐾). 43

Also, in the ideal challenge case where the challenge is generated from the fresh row, the computation is independent of the hidden key, so its success probability is at most 1/𝐾. Combining the three amplitude contributions gives the small-database bound 𝑂((ℓ + 𝑇 2 + 1)/𝐾). This extends to the distinguishing case in Section 10.2, as we can follow the same hybrids in the analysis for the centered distinguishing operator. 10.1.1

Spectral relaxation with post-query access

We define

(𝑇 )

𝐴𝑅 := 𝐴𝑅 = (𝑂𝑅 · 𝑈 )𝑇

as the 𝑇 -query post-processing unitary, where 𝑈 is a fixed unitary independent of 𝑅. The weight vector decomposition in Section 3.6 still holds, since all 𝑇 queries are applied after the arbitrary phase oracle query 𝑂𝑓 . Therefore, the corresponding spectral relaxation, modified from Section 9.1.1 by adding 𝐴𝑅 , is the spectral norm of the matrix (𝑇 )

(𝑇 )

Since 𝑊𝑅

𝐾 1 ∑︁ 𝐷† 𝐴† Π𝑘 𝐴𝑅 𝐷𝑅,𝑘 . 𝐾 𝑘=1 𝑅,𝑘 𝑅

:=

𝑊𝑅

⪰ 0, for every positive integer 𝑡, ⃦ ⃦

⃦

(︁

(𝑇 ) ⃦

(𝑇 )

E𝑅 ⃦𝑊𝑅 ⃦ ≤ E𝑅 Tr (𝑊𝑅 )2𝑡 (︀

)︀)︁1/2𝑡

.

(31)

For random 𝑅, we can write all things in the compressed oracle framework. For compressed (𝑇 ) (𝑇 ) phase oracle cO, we can rewrite 𝐴𝑅 and 𝑊𝑅 by 𝐴̂︀ = (cO 𝑈 )𝑇 ,

̂︁ := 𝑊

𝐾 1 ∑︁ ̂︀ † 𝐴 ̂︀† (Π𝑘 ⊗ I)𝐴 ̂︀𝐷 ̂︀ 𝑘 . 𝐷 𝐾 𝑘=1 𝑘

And therefore, our goal from (31) can be written as (𝑇 )

Tr E𝑅 (𝑊𝑅 )2𝑡 = (︀

)︀

∑︁

̂︁ 2𝑡 |𝑧⟩ |∅⟩ . ⟨𝑧| ⟨∅| 𝑊

(32)

𝑧∈[𝑀 ]

10.1.2

From the small-database estimate to the trace moment

Lemma 10.2. Let |𝑢⟩K = 𝐾 −1/2 𝑃win :=

𝐾 ∑︁

∑︀

𝑘∈[𝐾] |𝑘⟩K , and define

|𝑘⟩⟨𝑘|K ⊗ (Π𝑘 ⊗ I),

𝐷ctrl :=

𝑘=1

𝐾 ∑︁

̂︀ 𝑘 . |𝑘⟩⟨𝑘|K ⊗ 𝐷

𝑘=1

If |𝜓⟩ is normalized, supported on databases of size at most ℓ, and has no support on row 0, then √ ⃦ ⃦2 (1 + 2𝑇 + 14ℓ)2 ⃦ ⃦ ̂︀ 𝑝 := ⃦𝑃win (IK ⊗ 𝐴)𝐷ctrl ( |𝑢⟩K ⊗ |𝜓⟩)⃦ ≤ . 𝐾 In particular, (︃

𝑝=𝑂

ℓ + 𝑇2 + 1 . 𝐾 )︃

44

̂︁ , Lemma 10.2 gives an upper bound for ⟨𝜓| 𝑊 ̂︁ |𝜓⟩. Similarly, this gives From the definition of 𝑊 us a way to bound (32). ̂︁ will append (or change) the database by size at Proof of Theorem 10.1. For each 𝑧 ∈ [𝑀 ], each 𝑊 † ̂︀ 𝑘 and 𝐷 ̂︀ , and 2𝑇 in 𝐴 ̂︀ and 𝐴 ̂︀† . Therefore, |𝜓 𝑖 ⟩ := 𝑊 ̂︁ 𝑖 |𝑧⟩ |∅⟩ is supported most 2(𝑇 + 1): 2 in 𝐷 𝑧 𝑘 on database of size ≤ 2𝑖(𝑇 + 1). no0 defined as the projector onto databases of size at most ℓ that contain no entry in row For 𝑃≤ℓ 0 (row 0 will be used only as a fresh auxiliary row in the proof), we have ⃦ ⃦ ⃦ ⃦ ⃦ 𝑖 ⃦ ⃦ no0 𝑖−1 ⃦ ̂︁ 𝑃 no0 |𝜓 ⟩ ⃦ |𝜓𝑧 ⟩⃦ = ⃦𝑃≤2𝑖(𝑇 +1) 𝑊 ⃦ 𝑧 ≤2(𝑖−1)(𝑇 +1) ⃦ ⃦ ⃦ ⃦ ⃦ no0 ⃦ ⃦ 𝑖−1 ⃦ ̂︁ 𝑃 no0 ≤ ⃦𝑃≤2𝑖(𝑇 𝑊 · |𝜓 ⟩ ⃦ ⃦ ⃦ 𝑧 +1) ≤2𝑖(𝑇 +1) √︀ ⃦ (1 + 2𝑇 + 28𝑖(𝑇 + 1))2 ⃦ ⃦ 𝑖−1 ⃦ ≤ ⃦ |𝜓𝑧 ⟩⃦.

𝐾 Therefore, for each 𝑧 ∈ [𝑀 ], for some universal constant 𝐶, ⃦ ⃦2 ⃦ ̂︁ )2𝑡 |𝑧⟩ |∅⟩ = ⃦ ⟨𝑧| ⟨∅| (𝑊 ⃦𝜓 𝑡 ⃦ ≤

(︃

𝑧

𝐶(𝑇 2 + (𝑇 + 1)𝑡) 𝐾

)︃2𝑡

.

From (31) and (32), and taking 𝑡 = log 𝑀 , this gives ⃦ ⃦ ⃦ (𝑇 ) ⃦ E𝑅 ⃦𝑊𝑅 ⃦ ≤ 𝑂

(︃

𝑇 2 + (𝑇 + 1) log 𝑀 𝐾

)︃

.

Now we are left to prove Lemma 10.2. 10.1.3

Proof of the search bound with post-query

We first prove the following bound. As above, row 0 is an auxiliary row and is not queried by cO. Claim 10.3. Let ̂︀ 0 := 𝐷

∑︁

𝑛0 (𝑆) := #{𝑥 : (0, 𝑥) ∈ 𝑆}.

𝐷𝑥 ⊗ 𝑇0,𝑥 ,

𝑥

For any state |𝜓⟩ =

∑︀

𝑆 𝛽𝑆 |𝜙𝑆 ⟩ |𝑆⟩, where each

|𝜙𝑆 ⟩ is normalized, we have

⃦ ⃦2 ∑︁ ⃦ ̂︀ ⃦ (2𝑛0 (𝑆) + 1)|𝛽𝑆 |2 . ⃦𝐷0 |𝜓⟩⃦ ≤ 2

(33)

𝑆

Moreover, if every database in the support of |𝜙⟩ has row 0 empty, then ⃦ ⃦2 ⃦ ̂︀ ⃦ 2 ⃦𝐷0 |𝜓⟩⃦ ≤ ‖ |𝜓⟩‖ .

(34)

Proof of Claim 10.3. The proof of (33) is the same as the proof of Claim 9.7, with Π = Id and row 0 in place of row 𝑘. For (34), since row 0 is empty, the final databases 𝑆 ∪ {(0, 𝑥)} are distinct for distinct pairs (𝑆, 𝑥). Therefore, ⃦ ⃦2 ∑︁ ∑︁ ∑︁ ⃦ ̂︀ ⃦ |𝛽𝑆 |2 ‖𝐷𝑥 |𝜙𝑆 ⟩‖2 ≤ |𝛽𝑆 |2 = ‖ |𝜓⟩‖2 , ⃦𝐷0 |𝜓⟩⃦ = 𝑆

where we used

𝑥

𝑆

† 𝑥 𝐷𝑥 𝐷𝑥 ⪯ Id.

∑︀

45

We now return to the proof of Lemma 10.2. Proof of Lemma 10.2. Set |Ψ⟩ := |𝑢⟩K ⊗ |𝜓⟩. For each 𝑘 ∈ [𝐾], let 𝑆𝑘 be the unitary that swaps rows 0 and key 𝑘 part in the compressed database. Define 𝑆 :=

𝐾 ∑︁

|𝑘⟩⟨𝑘|K ⊗ 𝑆𝑘 ,

̂︀ 𝐴̂︀′ := 𝑆(IdK ⊗ 𝐴)𝑆.

𝑘=1

̂︀ 0 ). Since 𝑃win acts trivially on the database, it commutes with By definition, 𝐷ctrl 𝑆 = 𝑆(IdK ⊗ 𝐷 𝑆. Therefore, from the definition of 𝑝 as in Lemma 10.2, it can be rewritten as ⃦2 ⃦

⃦ ⃦

⃦2 ⃦

⃦ ⃦

̂︀′ (IdK ⊗ 𝐷 ̂︀ 0 )𝑆 |Ψ⟩⃦ . ̂︀ ctrl |Ψ⟩⃦ = ⃦𝑃win 𝐴 𝑝 = ⃦𝑃win (IdK ⊗ 𝐴)𝐷

(35)

Define modified winning probability 𝑝0 (for acting always on row 0) and 𝑝* (for starting unentangled with the challenge key): ⃦2 ⃦

⃦ ⃦

By triangle inequality,

̂︀ 0 ) |Ψ⟩⃦ , 𝑝0 := ⃦𝑃win 𝐴̂︀′ (IdK ⊗ 𝐷

(36)

⃦2 ⃦ ⃦ ⃦ ̂︀ ̂︀ ⊗ 𝐷 ) |Ψ⟩ 𝑝* := ⃦𝑃win (IdK ⊗ 𝐴)(Id ⃦ . 0 K

(37)

√ √ √ √ √ √ 𝑝 ≤ | 𝑝 − 𝑝0 | + | 𝑝0 − 𝑝* | + 𝑝* .

We bound the three terms separately. √ √ The first term | 𝑝 − 𝑝0 |. By triangle inequality and unitarity of 𝐴̂︀′ , ⃦ ⃦ √ √ ⃦ ̂︀ 0 )(𝑆 − Id) |Ψ⟩⃦ | 𝑝 − 𝑝0 | ≤ ⃦(IdK ⊗ 𝐷 ⃦.

Write |𝜓⟩ = 𝑆 𝛼𝑆 |𝜙𝑆 ⟩ |𝑆⟩, 𝑛𝑘 (𝑆) := #{𝑥 : (𝑘, 𝑥) ∈ 𝑆}, where each |𝜙𝑆 ⟩ is normalized, and 𝛼𝑆 = 0 whenever |𝑆| > ℓ or 𝑛0 (𝑆) > 0. Let 𝐵𝑘 be the projector onto databases with row 𝑘 (key 𝑘 part) non-empty. Since row 0 is empty in the support of |𝜓⟩, we have ∑︀

(𝑆𝑘 − Id) |𝜓⟩ = (𝑆𝑘 − Id)𝐵𝑘 |𝜓⟩ . The state 𝐵𝑘 |𝜓⟩ has row 0 empty, while 𝑆𝑘 𝐵𝑘 |𝜓⟩ has 𝑛𝑘 (𝑆) entries in row 0 for each original database 𝑆. Applying Claim 10.3, this gives ⃦ ⃦2 ⃦ ⃦2 ⃦ ⃦2 ⃦ ̂︀ ⃦ ⃦ ̂︀ ⃦ ⃦ ̂︀ ⃦ 𝑆 𝐵 |𝜓⟩ + 2 𝐷 𝐵 |𝜓⟩ ⃦𝐷0 (𝑆𝑘 − Id) |𝜓⟩⃦ ≤ 2⃦𝐷 ⃦ ⃦ ⃦ 0 𝑘 𝑘 0 𝑘 ∑︁

≤4

(2𝑛𝑘 (𝑆) + 1)|𝛼𝑆 |2 + 2

𝑆:𝑛𝑘 (𝑆)>0

≤ 14

∑︁

∑︁

|𝛼𝑆 |2

𝑆:𝑛𝑘 (𝑆)>0

𝑛𝑘 (𝑆)|𝛼𝑆 | . 2

𝑆

Therefore, by orthogonality of the register 𝐾, 𝐾 ⃦ ⃦ ⃦2 ⃦2 1 ∑︁ 14 ∑︁ 14ℓ ⃦ ⃦ ̂︀ ⃦ ̂︀ 0 )(𝑆 − Id) |Ψ⟩⃦ |𝑆| |𝛼𝑆 |2 ≤ . ⃦(IdK ⊗ 𝐷 ⃦ = ⃦𝐷0 (𝑆𝑘 − Id) |𝜓⟩⃦ ≤

𝐾 𝑘=1

𝐾

√︀ √ √ This gives | 𝑝 − 𝑝0 | ≤ 14ℓ/𝐾.

46

𝑆

𝐾

√ √ The second term | 𝑝0 − 𝑝* |. We compare 𝑝0 and 𝑝* by replacing the 𝑇 queries one at a time. Define cO′ := 𝑆(IdK ⊗ cO)𝑆. Since IdK ⊗ 𝑈 commutes with 𝑆, the circuit 𝐴̂︀′ is obtained from IdK ⊗ 𝐴̂︀ by replacing each IdK ⊗ cO with cO′ . For 𝑗 = 0, 1, . . . , 𝑇 , let 𝐴̂︀𝑗 be the circuit in which the first 𝑗 queries are IdK ⊗ cO, and the remaining 𝑇 − 𝑗 queries are cO′ . Then 𝐴̂︀0 = 𝐴̂︀′ and ̂︀ Therefore, 𝐴̂︀𝑇 = IdK ⊗ 𝐴. 𝑇∑︁ −1 ⃦ ⃦ √ √ ⃦ ̂︀ ̂︀𝑗+1 )(IdK ⊗ 𝐷 ̂︀ 0 ) |Ψ⟩⃦ | 𝑝0 − 𝑝* | ≤ ⃦(𝐴𝑗 − 𝐴 ⃦. 𝑗=0

For a fixed 𝑗, immediately before the differing query, all previous queries are IdK ⊗ cO. Thus the operations already applied act trivially on register K, and the state has the form ‖ |Θ⟩‖ ≤ 1,

|𝑢⟩K ⊗ |Θ⟩ ,

where the norm bound follows from unitarity of the previous operations. Note that the two oracle calls cO, cO′ differ only when the queried row 𝑟 equals the challenge key 𝑘. For 𝐵 :=

𝐾 ∑︁

|𝑘⟩⟨𝑘|K ⊗ |𝑘⟩⟨𝑘|Q ,

𝑘=1

for the queried row register Q, we will see ⃦ ⃦ 2 ⃦ ̂︀ ̂︀𝑗+1 )(IdK ⊗ 𝐷 ̂︀ 0 ) |Ψ⟩⃦ ⃦(𝐴𝑗 − 𝐴 ⃦ ≤ 2‖𝐵( |𝑢⟩K ⊗ |Θ⟩)‖ ≤ √ .

𝐾

Therefore, by summing over 𝑗 = 0 to 𝑇 − 1, we will obtain 2𝑇 √ √ | 𝑝0 − 𝑝* | ≤ √ . 𝐾 The third term

√

̂︀ 0 and 𝐴 ̂︀ act trivially on register 𝐾, 𝑝* . Since 𝐷 ̂︀ ̂︀ (IdK ⊗ 𝐴)(Id K ⊗ 𝐷0 ) |Ψ⟩ = |𝑢⟩K ⊗ |𝜉⟩

for some |𝜉⟩ with ‖ |𝜉⟩‖ ≤ 1. Therefore, as

𝑘 Π𝑘 ⪯ Id,

∑︀

𝐾 1 ∑︁ 1 ‖(Π𝑘 ⊗ Id) |𝜉⟩‖2 ≤ . 𝑝* = ‖𝑃win ( |𝑢⟩K ⊗ |𝜉⟩)‖ = 𝐾 𝑘=1 𝐾 2

Combining the three terms. From the above upper bounds, √ 2𝑇 14ℓ 1 1 + 2𝑇 + 14ℓ √ 𝑝≤ +√ +√ = . 𝐾 𝐾 𝐾 𝐾 √ Squaring both sides, this gives 𝑝 ≤ (1 + 2𝑇 + 14ℓ)2 /𝐾, which proves Lemma 10.2. √

√︃

47

10.2

Oracle state distinguishing game with post-query access

From the proof of Theorem 10.1 for the search case, in fact we can simply obtain a bound for the corresponding distinguishing case. This extends the one-query distinguishing lower bound in [LMW24] to hold even when the adversary is allowed to make polynomial queries to 𝑅 after the one query. Theorem 10.4 (One-query distinguishing bound for binary phase states, with post queries). For variant of the oracle state distinguishing game associated with the family { |𝜓𝑅,𝑘 ⟩}𝑘∈[𝐾] with 𝑅 = (𝑅(𝑘, 𝑥))𝑘∈[𝐾], 𝑥∈[𝑁 ] as a family of independent Rademacher random variables, where the adversary is also allowed to make 𝑇 queries to 𝑅 after the arbitrary phase query, every such adversary with workspace dimension 𝑀 satisfies ⎛√︃

E𝑅 Δ𝒜 (𝑅) ≤ 𝑂 ⎝ [︀

]︀

⎞

𝑇 2 + (𝑇 + 1) log 𝑀 ⎠ 𝐾

for Δ𝒜 (𝑅) as the distinguishing advantage when 𝑅 is sampled. Proof sketch. For the distinguishing game, the advantage is upper bounded by E𝑅 ‖𝑋𝑅 ‖, where 𝑋𝑅 :=

𝐾 1 ∑︁ 𝐷† 𝐴† Π𝐴𝑅 𝐷𝑅,𝑘 − Γ𝑅 , 𝐾 𝑘=1 𝑅,𝑘 𝑅

Γ𝑅 := Eℎ 𝐷ℎ† 𝐴†𝑅 Π𝐴𝑅 𝐷ℎ =

∑︁

𝐷𝑥† 𝐴†𝑅 Π𝐴𝑅 𝐷𝑥 .

𝑥

Here Π is the distinguishing projector and ℎ is an independent random binary phase vector, and the spectral relaxation is modified from Section 9.2.1 by adding 𝐴𝑅 . In particular, both experiments ̂︀ be the compressed-oracle representation of use the same oracle 𝑅 for the 𝑇 post-queries. Let 𝑋 𝑋𝑅 . Bounding through small database (as Lemma 9.6 for 𝑇 = 0). Let |𝜓⟩ be normalized, supported on databases of size at most ℓ, and have row 0 empty. Define 𝐾 ⃦ ⃦ 1 ∑︁ ̂︀𝐷 ̂︀ 𝑘 |𝜓⟩⃦2 , ⃦(Π ⊗ Id)𝐴 𝑝 := 𝐾 𝑘=1 ′

⃦2

̂︀ 0 |𝜓⟩⃦ . 𝑝′* := ⃦(Π ⊗ Id)𝐴̂︀𝐷 ⃦

⃒ ⃒

⃒ ⃒

̂︀ averaging over that row gives ⃒⟨𝜓|𝑋|𝜓⟩ ̂︀ Since row 0 is empty and is not queried by 𝐴, ⃒ = |𝑝′ − 𝑝′* |. Moreover, by (34), 𝑝′* ≤ 1. By defining 𝑃win = Id𝐾 ⊗ (Π ⊗ Id), 𝑝′ and 𝑝′* will correspond to the 𝑝 and 𝑝* as in (35) and (37) √ √ √ √ in Section 10.1.3. Moreover, since upper bounding | 𝑝 − 𝑝0 | and | 𝑝0 − 𝑝* | is independent of 𝑃win in Section 10.1.3, by triangle inequality, we can obtain √ ⃒ −1 ⃦ √︁ ⃒⃒ ⃦ ⃦ 𝑇∑︁ ⃦ ⃒√︀ + 2𝑇 ⃦ ⃦ ⃦ ⃦ ̂︀ 0 )(𝑆 − Id) |Ψ⟩⃦ + ̂︀𝑗 − 𝐴 ̂︀𝑗+1 )(IdK ⊗ 𝐷 ̂︀ 0 ) |Ψ⟩⃦ ≤ 14ℓ ⃒ 𝑝′ − 𝑝′ ⃒ ≤ ⃦(IdK ⊗ 𝐷 √ . ⃦(𝐴 *⃒ ⃒ 𝐾 𝑗=0 ̂︀ Therefore, we can upper bound ⟨𝜓|𝑋|𝜓⟩ by

(︃ √ )︃ ⃒ )︂ √︁ ⃒⃒ (︂⃒⃒√︀ √︁ ⃒⃒ ⃒ ⃒ ⃒√︀ ℓ + 𝑇 ⃒ ⃒ ′ ′ ̂︀ √ . ⃒⟨𝜓|𝑋|𝜓⟩ ⃒ = |𝑝 − 𝑝* | ≤ ⃒⃒ 𝑝′ − 𝑝′* ⃒⃒ · ⃒⃒ 𝑝′ − 𝑝′* ⃒⃒ + 2 = 𝑂

𝐾

48

̂︀ changes Bounding the trace moment (as Section 9.2.2 for 𝑇 = 0). Each application of 𝑋 the database size by at most 2(𝑇 + 1) and never changes row 0. Thus, by a similar induction as in Section 9.2.2, for every positive integer 𝑡, ⎞1/2𝑡 √︀ ∑︁ ⃦ ⃦ 2𝑡(𝑇 + 1) + 𝑇 2 1/2𝑡 𝑡 ̂︀ ⃦𝑋 |𝑧⟩|∅⟩⃦ ⎠ √ ≤𝑀 ·𝐶 · E𝑅 ‖𝑋𝑅 ‖ ≤ ⎝ . ⎛

𝐾

𝑧∈[𝑀 ]

Taking 𝑡 = log 𝑀 gives

⎛√︃

E𝑅 ‖𝑋𝑅 ‖ ≤ 𝑂 ⎝

⎞

𝑇 2 + (𝑇 + 1) log 𝑀 ⎠ . 𝐾 (︂

{︂

Therefore, the expected distinguishing advantage is at most 𝑂 min 1,

10.3

√︁

𝑇 2 +(𝑇 +1) log 𝑀 𝐾

}︂)︂

.

Extension to the setting with both post-query and pre-query access

We now allow the adversary to make 𝑡 ordinary queries to 𝑅 after receiving the challenge but before making the one arbitrary phase query, followed by 𝑇 queries to 𝑅. With the post 𝑇 query part defined as 𝐴𝑅 , now the computation (before measurement) can be written as 𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅 |𝜓𝑅,𝑘 ⟩ for input |𝜓𝑅,𝑘 ⟩, where 𝑉𝑅 : C𝑁 → C𝑀 is the isometry that includes the 𝑡 pre-queries (with fixed ancillas absorbed in this isometry). All gates other than the oracle calls are fixed independently of 𝑅 and the hidden challenge key 𝑘. The function 𝑓𝑅 may depend arbitrarily on 𝑅, but not on the challenge. The dimension 𝑀 includes all workspace and retained environments. Theorem 10.5 (One-query lower bound with pre-queries and post-queries). Let { |𝜓𝑅,𝑘 ⟩}𝑘∈[𝐾] be a binary phase state family with 𝑅 = (𝑅(𝑘, 𝑥))𝑘∈[𝐾],𝑥∈[𝑁 ] as a family of independent Rademacher random variables. For the variants of the oracle state search game and distinguishing game, where the adversary is allowed to make 𝑡 (𝑡 ≥ 1) queries before and 𝑇 queries after the arbitrary phase query, the security satisfies: ⎛

⎧ ⎨

𝑡2 E𝑅 [Win(𝒜 | 𝑅)] ≤ 𝑂 ⎝min 1, + ⎩ 𝐾 ⎛

⎧ ⎨

√︃

𝑡 E𝑅 [Δ𝒜 (𝑅)] ≤ 𝑂 ⎝min 1, √ + ⎩ 𝐾

⎫⎞

𝑡𝑇 2 + 𝑡(𝑇 + 1) log 𝑀 ⎬⎠ ⎭ 𝐾

(︃

𝑡𝑇 2 + 𝑡(𝑇 + 1) log 𝑀 𝐾

)︃1/4 ⎫⎞ ⎬ ⎠ ⎭

(Search) (Distinguishing)

The case 𝑡 = 0 is covered separately by Theorems 10.1 and 10.4. Proof overview. We are going to reduce the 𝑡-pre-query case to a 0-pre-query case, so that we can apply Theorems 10.1 and 10.4. The proof uses a swapping or resampling trick similar to the hybrids introduced in the previous proofs, which helps reduce the security to the case where there are no pre-queries. More specifically, here we introduce two hybrids, by modifying only the pre-query part of the original algorithm: 49

• pre-queries to 𝑅 are replaced by 𝑅{𝑘} , and • pre-queries to 𝑅 are replaced by 𝑅𝐽 , for randomly sampled subset 𝐽, and 𝑘 ← 𝐽, and here 𝑅𝐽 denotes resampling 𝑅 by replacing every {𝑅(𝑘, 𝑥) : 𝑘 ∈ 𝐽} by a uniformly random ±1; that is, resampling the rows in 𝐽. The difference between hybrids can then be bounded according to the following intuitions. • When pre-queries to 𝑅 replaced by 𝑅{𝑘} , the difference only comes from the case √ when the query address is on 𝑘. This gives the difference of real and 𝑅(𝑘) bounded by 𝑡/ 𝐾. • For the 𝑅𝐽 where 𝑘 ∈ 𝐽, the difference only comes from the case when some row in 𝐽∖{𝑘} is √︀ queried, which can be managed in 𝑡(|𝐽| − 1)/𝐾. (This is different from the above difference, since 𝐽∖{𝑘} is randomly sampled and independent of the challenge state.) • When we are in the 𝑅𝐽 case, we can view the pre-query part as a fixed unitary by fixing all [𝐾]∖𝐽 parts and the resampling 𝐽 rows in 𝑅𝐽 . The security in this case is then reduced to the one-query with (only) post-query case, where we can apply Theorems 10.1 and 10.4. Proof of Theorem 10.5. Fix 1 ≤ 𝐿 ≤ 𝐾. Sample a uniform 𝐿-element subset 𝐽 ⊆ [𝐾], and then a uniform 𝑘 ∈ 𝐽, independently of 𝑅. The marginal distribution of 𝑘 is still uniform on [𝐾]. Independently sample another table 𝑅′ . For 𝐵 ⊆ [𝐾], let 𝑅𝐵 agree with 𝑅′ on 𝐵 and with 𝑅 outside 𝐵. Define the following three prefix output states: |𝛼real ⟩ = 𝑉𝑅 |𝜓𝑅,𝑘 ⟩ ,

|𝛼⟩1 = 𝑉𝑅{𝑘} |𝜓𝑅,𝑘 ⟩ ,

|𝛼⟩2 = 𝑉𝑅𝐽 |𝜓𝑅,𝑘 ⟩ .

Only the oracle used in the pre-𝑡-query is replaced; the challenge |𝜓𝑅,𝑘 ⟩, the arbitrary query 𝑂𝑓𝑅 , and the post-processing 𝐴𝑅 remain unchanged. For 𝑅{𝑘} , the joint distribution (𝑅{𝑘} , |𝜓𝑅,𝑘 ⟩) is independent of 𝑘. Let |𝑢𝑖 ⟩ be the state just before the 𝑖-th query of 𝑉𝑅{𝑘} on challenge |𝜓𝑅,𝑘 ⟩, and let 𝑄𝑘 be the projector onto query address with row (key) 𝑘. Then, since |𝑢𝑖 ⟩ remains independent of 𝑘, E𝑘 ‖𝑄𝑘 |𝑢𝑖 ⟩ ‖2 = 1/𝐾. Note that oracle to 𝑅{𝑘} and 𝑅 differ only at query address with row on 𝑘, by the triangle inequality, √︁

E𝑘 ‖ |𝛼real ⟩ − |𝛼1 ⟩‖2 ≤

𝑡 √︁ ∑︁

E𝑘 ‖(𝑂𝑅 − 𝑂𝑅{𝑘} ) |𝑢𝑖 ⟩‖2 ≤

𝑖=1

𝑡 ∑︁

1 2𝑡 2· √ = √ . 𝐾 𝐾 𝑖=1

(38)

For 𝑅𝐽 , consider the set 𝐽∖{𝑘}. Conditioned on (𝑘, 𝐽∖{𝑘}), now 𝑅{𝑘} , the challenge |𝜓𝑅,𝑘 ⟩, and the resampled rows (the 𝐽∖{𝑘} rows in 𝑅𝐽 ) are mutually independent. Write |𝜓𝑅,𝑘 ⟩ as |𝜑⟩. For each fixed normalized input |𝜑⟩, the 𝑡-query computation admits the Fourier expansion 𝑉𝐹 |𝜑⟩ =

∑︁

𝜒𝑆 (𝐹 ) |𝑎𝑆 (𝜑)⟩ ,

∑︁

‖ |𝑎𝑆 (𝜑)⟩ ‖2 = 1,

𝑆

|𝑆|≤𝑡

where 𝜒𝑆 (𝐹 ) = (𝑗,𝑥)∈𝑆 𝐹 (𝑗, 𝑥), and define rows(𝑆) = {𝑗 : ∃𝑥, (𝑗, 𝑥) ∈ 𝑆}. Indeed, each query increases the Fourier degree by at most one, and the normalization follows from Parseval. Conditional on ( |𝜑⟩ , 𝐽∖{𝑘}), the two oracle tables agree outside 𝐽∖{𝑘} and have independent uniform entries on 𝐽∖{𝑘}. Thus ∏︀

[︁

E 𝜒𝑆 (𝑅

{𝑘}

⃒ ]︁ ⃒ )𝜒𝑆 ′ (𝑅 ) ⃒ |𝜑⟩ , 𝐽∖{𝑘} = 𝐽

1, 𝑆 = 𝑆 ′ and rows(𝑆) ∩ 𝐽∖{𝑘} = ∅, 0, otherwise.

{︃

50

Therefore, averaging over |𝜑⟩ , 𝐽∖{𝑘}, E‖ |𝛼1 ⟩ − |𝛼2 ⟩ ‖2 = 2 − 2 · E Re ⟨𝛼1 |𝛼2 ⟩ = 2 · E|𝜑⟩

∑︁ 𝑆

Pr [rows(𝑆) ∩ 𝐽∖{𝑘} = ̸ ∅] · ‖ |𝑎𝑆 (𝜑)⟩‖2

𝐽∖{𝑘}

∑︁ 2(𝐿 − 1) ≤ E|𝜑⟩ | rows(𝑆)| · ‖ |𝑎𝑆 (𝜑)⟩‖2 𝐾 𝑆

≤

(union bound)

2𝑡(𝐿 − 1) . 𝐾

(39)

Combining (38) and (39), we conclude √︁

2𝑡 E‖ |𝛼real ⟩ − |𝛼2 ⟩ ‖2 ≤ √ + 𝐾

√︃

2𝑡(𝐿 − 1) . 𝐾

(40)

For the search game. For the winning probability of the search game, by the triangle inequality, E𝑅 [Win(𝒜 | 𝑅)] = E𝑅,𝑘 ‖Π𝑘 𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅 |𝜓𝑅,𝑘 ⟩‖2 ≤

(︂√︁

2

E𝑅,𝑘,𝐽,𝑅′ ‖𝛼real − |𝛼2 ⟩‖ +

√︁

2

E𝑅,𝑘,𝐽,𝑅′ ‖Π𝑘 𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅𝐽 |𝜓𝑅,𝑘 ⟩‖

)︂2

.

The first term can be bounded by (40). For the second term, now we fix 𝐽, 𝑅[𝐾]∖𝐽 , 𝑅𝐽′ . 𝑉𝑅𝐽 now is a fixed isometry, and queries outside of 𝐽 have fixed answers. Still, 𝑓𝑅 can depend arbitrarily on 𝑅𝐽 . Therefore, from Theorem 10.1, we can bound the term by 𝐶 · (𝑇 2 + (𝑇 + 1) log 𝑀 )/𝐿 on keys in 𝐽 (for constant 𝐶), and E𝑅 [Win(𝒜 | 𝑅)] ≤

(︂√︁

E𝑅,𝑘,𝐽,𝑅′ ‖𝛼real − |𝛼2 ⟩‖2 + (︃

≤ 𝐶′ · by setting 𝐿 =

√︀

√︁

E𝑅,𝑘,𝐽,𝑅′ ‖Π𝑘 𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅𝐽 |𝜓𝑅,𝑘 ⟩‖2

𝑡2 𝑡𝐿 𝑇 2 + (𝑇 + 1) log 𝑀 + + 𝐾 𝐾 𝐿

)︃

⎛

𝑡2 = 𝑂⎝ + 𝐾

√︃

)︂2 ⎞

𝑡(𝑇 2 + (𝑇 + 1) log 𝑀 ) ⎠ 𝐾

𝐾(𝑇 2 + (𝑇 + 1) log 𝑀 )/𝑡.

For the distinguishing game. Let Δ𝐽𝒜 (𝑅, 𝑅′ ) denote the gap after replacing 𝑉𝑅 by 𝑉𝑅𝐽 in both experiments: ⃒ ⃒

⃒ ⃒

Δ𝐽𝒜 (𝑅, 𝑅′ ) := ⃒E𝑘∈𝐽 ‖Π𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅𝐽 |𝜓𝑅,𝑘 ⟩‖2 − E𝑟∈[𝑁 ] ‖Π𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅𝐽 |𝑟⟩‖2 ⃒ . For each fixed 𝑅, the original distribution of 𝑘 can be viewed as taking the average over 𝐽 and then taking 𝑘 uniform in 𝐽. By convexity of absolute value, it therefore suffices to bound the average distinguishing gap in these restricted experiments on a random 𝐽. Thus, by the triangle inequality (adding and ⃒ subtracting the ⃒ acceptance probabilities of the two experiments with prefix 𝑉𝑅𝐽 ), together with ⃒‖Π𝑢‖2 − ‖Π𝑣‖2 ⃒ ≤ (‖Π𝑢‖ + ‖Π𝑣‖)‖Π(𝑢 − 𝑣)‖ ≤ 2‖Π(𝑢 − 𝑣)‖, ⃒ ⃒

⃒ ⃒

E𝑅 Δ𝒜 (𝑅) ≤ E𝑅,𝐽 ⃒E𝑘∈𝐽 ‖Π𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅 |𝜓𝑅,𝑘 ⟩‖2 − E𝑟∈[𝑁 ] ‖Π𝐴𝑅 𝑂𝑓𝑅 𝑉𝑅 |𝑟⟩‖2 ⃒ 51

≤ E𝑅,𝑅′ ,𝐽 Δ𝐽𝒜 (𝑅, 𝑅′ ) + 2 · E𝑅,𝑅′ ,𝐽,𝑘∈𝐽 ‖Π𝐴𝑅 𝑂𝑓𝑅 (𝑉𝑅 − 𝑉𝑅𝐽 ) |𝜓𝑅,𝑘 ⟩‖ + 2 · E𝑅,𝑅′ ,𝐽,𝑟∈[𝑁 ] ‖Π𝐴𝑅 𝑂𝑓𝑅 (𝑉𝑅 − 𝑉𝑅𝐽 ) |𝑟⟩‖ √︃

≤𝐶·

⎛

𝑇 2 + (𝑇 + 1) log 𝑀 𝑡 + 2 · ⎝√ + 𝐿 𝐾

√︃

⎞

2𝑡(𝐿 − 1) ⎠ + 2 · E𝑅,𝑅′ ,𝐽,𝑟 ‖(𝑉𝑅 − 𝑉𝑅𝐽 ) |𝑟⟩‖ 𝐾

(by Theorem 10.4, and Jensen’s inequality followed from (40)) Similar to the calculation in (39), we obtain E𝑅,𝑅′ ,𝐽,𝑟 ‖(𝑉𝑅 − 𝑉𝑅𝐽 ) |𝑟⟩‖2 = 2 · E𝑟

∑︁ 𝑆

Pr[rows(𝑆) ∩ 𝐽 ̸= ∅] ‖ |𝑎𝑆 (𝑟)⟩ ‖2 ≤ 𝐽

2𝑡𝐿 . 𝐾

By Jensen’s inequality, combining the above gives √︃

E𝑅 Δ𝒜 (𝑅) ≤ 𝐶 ⎛

4𝑡 𝑇 2 + (𝑇 + 1) log 𝑀 + √ +2 𝐿 𝐾

𝑡 = 𝑂 ⎝√ + 𝐾 by setting 𝐿 =

11

√︀

(︃

𝑡𝑇 2 + 𝑡(𝑇 + 1) log 𝑀

√︃

2𝑡(𝐿 − 1) +2 𝐾

√︃

2𝑡𝐿 𝐾

)︃1/4 ⎞

𝐾

⎠

𝐾(𝑇 2 + (𝑇 + 1) log 𝑀 )/𝑡.

Quantum advice lower bound for 1PRS

In this section, we prove a lower bound on the size of a quantum advice for distinguishing a single copy of a random binary phase state from a Haar-random state, when there are no online queries to the random oracle. This can be viewed as a distinguishing version of Theorem 5.2 with 𝑇 = 0. Specifically, we show that any 𝑆-qubit quantum advice (or say, quantum program) can distinguish (︁ √ )︁ a random binary phase state from Haar random with distinguishing advantage at most 𝑂 𝐾𝑆 . Definition 11.1 (1PRS security game). In the non-uniform security game of 1PRS: • In the offline stage, a hash function 𝑅 : [𝐾]×[𝑁 ] → {±1} is sampled and fixed (here 𝐾 ≤ 𝑁 ), and an algorithm is allowed to have an 𝑆-qubit advice that depends arbitrarily on 𝑅 before receiving the challenge. • Then, in the online stage, a challenger will sample a bit 𝑏 ← {0, 1}. – If 𝑏 = 0, the challenger will sample a random key 𝑘 ← [𝐾], generate a single-copy of ∑︀ state |𝜓𝑅,𝑘 ⟩ := √1𝑁 𝑥∈[𝑁 ] 𝑅(𝑘, 𝑥)|𝑥⟩, and send it to the algorithm. – If 𝑏 = 1, the challenger will sample a Haar random state and send it to the algorithm. • The algorithm, after receiving the challenge state, is allowed to make 𝑇 queries to 𝑅 and is asked to output a guess 𝑏′ . It succeeds if 𝑏′ = 𝑏. We consider security game in QROM, for 𝑅 as a random oracle, and the algorithm can have oracle access to 𝑂𝑅 . The non-uniform security (in terms of 𝑆-qubit, 𝑇 -query) of 1PRS in QROM is defined as the maximum distinguishing advantage, parametrized by (𝑆, 𝑇, 𝐾, 𝑁 ). 52

Note here we consider quantum advice lower bound, with zero online queries. That is, now we assume 𝑇 = 0. Theorem 11.2 (Quantum advice lower bound for 1PRS). (︁ √ )︁Any (zero-query) adversary with 𝑆 qubit of advice has distinguishing advantage bounded by 𝑂 𝐾𝑆 in QROM. Consequently, constant advantage requires Ω(𝐾 2 ) qubits (for 𝐾 = Θ(𝑁 ), this requires Ω(𝑁 2 ) qubits).

11.1

1PRS trace-moment setup

Let A be the advice register and X the challenge register. Absorb the fixed online computation into an acceptance operator 0 ⪯ Π ⪯ 𝐼 on A ⊗ X, and set Π𝑥,𝑦 := (𝐼A ⊗ ⟨𝑥|)Π(𝐼A ⊗ |𝑦⟩). The centered acceptance matrix on the advice register is 𝑌𝑅 := E𝑘 (𝐼A ⊗ ⟨𝜓𝑅,𝑘 |)Π(𝐼A ⊗ |𝜓𝑅,𝑘 ⟩) −

1 ∑︁ ∑︁ 1 ∑︁ Π𝑥,𝑥 = 𝑅(𝑘, 𝑥)𝑅(𝑘, 𝑦)Π𝑥,𝑦 . 𝑁 𝑥 𝐾𝑁 𝑘 𝑥̸=𝑦

(41)

Here the diagonal terms cancel because 𝑅(𝑘, 𝑥)2 = 1. Thus Δ𝒜 (𝑅) = | Tr(𝜌𝑅 𝑌𝑅 )| ≤ ‖𝑌𝑅 ‖, and now our goal is to bound E𝑅 ‖𝑌𝑅 ‖. In the compressed oracle database mode, for a database 𝐷 ⊆ [𝐾] × [𝑁 ], define the Fourier ∏︀ character as 𝜒𝐷 (𝑅) = (𝑘,𝑥)∈𝐷 𝑅(𝑘, 𝑥), and define 𝑇𝑘,𝑥 |𝐷⟩ := |𝐷 ⊕ {(𝑘, 𝑥)}⟩,

𝑌̂︀ :=

1 ∑︁ ∑︁ Π𝑥,𝑦 ⊗ 𝑇𝑘,𝑥 𝑇𝑘,𝑦 . 𝐾𝑁 𝑘 𝑥̸=𝑦

The usual trace-moment method gives, for every positive integer 𝑡, (︁

)︁1/2𝑡

E𝑅 ‖𝑌𝑅 ‖ ≤ E𝑅 Tr(𝑌𝑅2𝑡 )

E𝑅 Tr(𝑌𝑅2𝑡 ) =

,

∑︁

‖𝑌̂︀ 𝑡 |𝑧⟩|∅⟩‖2 .

(42)

𝑧∈[2𝑆 ]

We will use the following local bound. Lemma 11.3 (Small-database bound). For every normalized state |𝜑⟩ supported on databases of size at most ℓ, √︃ √ ⃒ ⃒ ℓ ℓ 3ℓ ⃒ ⃒ +2 + . (43) ⃒⟨𝜑|𝑌̂︀ |𝜑⟩⃒ ≤ 𝛽(ℓ) := 𝐾 𝐾𝑁 𝐾𝑁 Proof of Theorem 11.2. Let 𝑃≤ℓ project onto databases of size at most ℓ. Since 𝑌̂︀ is Hermitian, Lemma 11.3 implies ‖𝑃≤ℓ 𝑌̂︀ 𝑃≤ℓ ‖ ≤ 𝛽(ℓ). Each application of 𝑌̂︀ changes the database size by at most two. Therefore, 𝑌̂︀ 𝑡 |𝑧⟩|∅⟩ = (𝑃≤2𝑡 𝑌̂︀ 𝑃≤2𝑡 )𝑡 |𝑧⟩|∅⟩, 53

‖𝑌̂︀ 𝑡 |𝑧⟩|∅⟩‖ ≤ 𝛽(2𝑡)𝑡 .

setting 𝑡 = 𝑆/2 gives an upper bound for (42) as ⎛√

𝑆 E𝑅 ‖𝑌𝑅 ‖ ≤ 2𝑆/2𝑡 𝛽(2𝑡) ≤ 𝑂⎝ + 𝐾

√︃

When 𝐾 ≤ 𝑁 and 𝑆 ≤ 𝐾 2 , the last two terms are at most advantage bound 1.

11.2

⎞

𝑆 𝑆 ⎠ . + 𝐾𝑁 𝐾𝑁 √

𝑆/𝐾. For 𝑆 > 𝐾 2 , use the trivial

Proof of the small-database bound

We prove Lemma 11.3 by comparing the real challenge with an independent maximally mixed state. Note that challenge preparation either adds a new database entry or deletes an existing one, while deletions have small total weight. For additions, the main issue is that different choices of the newly added entry can lead to the same final database and hence interfere. We express this interference as a sum of swaps, which we bound in the next subsection. Proof of Lemma 11.3. Write the initial state as |𝜙⟩ =

∑︁

|𝜙𝐷 ⟩A |𝐷⟩db ,

∑︁⃦ ⃦ ⃦ |𝜙𝐷 ⟩ ⃦2 = 1, 𝐷

𝐷

where |𝜙𝐷 ⟩ = 0 when |𝐷| > ℓ. A purification of the real challenge is |Ψ⟩ = √

∑︁ 1 |𝜙𝐷 ⟩A |𝑥⟩X |𝐷 ⊕ {(𝑘, 𝑥)}⟩db |𝑘⟩key . 𝐾𝑁 𝐷,𝑘,𝑥

The algorithm sees only AX; the database and key registers are inaccessible. Separating deletions from new entries. Split |Ψ⟩ = |Ψ0 ⟩ + |Ψ1 ⟩ according to whether (𝑘, 𝑥) ∈ / 𝐷 or (𝑘, 𝑥) ∈ 𝐷, respectively. These two parts are orthogonal, and the deletion part has squared norm ⃦ ⃦2 ⃦ ⃦2 ⃦ ⃦ 1 ∑︁ ℓ ⃦ |Ψ0 ⟩ ⃦2 = 1 − 𝑞. 𝑞 := ⃦ |Ψ1 ⟩ ⃦ = |𝐷| ⃦ |𝜙𝐷 ⟩ ⃦ ≤ , 𝐾𝑁 𝐷 𝐾𝑁 Let 𝜎𝑏 be the reduced, subnormalized state of |Ψ𝑏 ⟩ on AX. The independent-challenge state on these registers is (︃ )︃ ∑︁ 𝐼X 𝜏 := |𝜙𝐷 ⟩⟨𝜙𝐷 | ⊗ . 𝑁 𝐷 Identifying the surviving interference. When we trace out the hidden registers, two newentry terms can interfere only if they have the same final database 𝑆 and key 𝑘. They may, however, have added different entries: adding (𝑘, 𝑥) to 𝑆 ∖ {(𝑘, 𝑥)} and adding (𝑘, 𝑦) to 𝑆 ∖ {(𝑘, 𝑦)} both produce 𝑆. Thus the two histories exchange the roles of the challenge column and a stored column. Write 𝑆𝑘 := {𝑥 : (𝑘, 𝑥) ∈ 𝑆} and |𝜙𝐷,𝑥 ⟩ := |𝜙𝐷 ⟩|𝑥⟩. The off-diagonal terms are collected in 𝐵𝜙 :=

∑︁ ∑︁

|𝜙𝑆∖{(𝑘,𝑦)},𝑦 ⟩⟨𝜙𝑆∖{(𝑘,𝑥)},𝑥 |.

𝑆,𝑘 𝑥,𝑦∈𝑆𝑘 𝑥̸=𝑦

54

The diagonal terms recover 𝜏 , except for the terms excluded by the new-entry condition. Thus 𝜎0 − 𝜏 =

𝐵𝜙 − 𝐻, 𝐾𝑁

𝐻 :=

1 𝐾𝑁

∑︁

|𝜙𝐷,𝑥 ⟩⟨𝜙𝐷,𝑥 |.

(44)

𝐷,𝑘,𝑥 (𝑘,𝑥)∈𝐷

Both 𝐻 and 𝜎1 are positive with trace 𝑞. Hence, for the acceptance operator 0 ⪯ Π ⪯ 𝐼,√︀| Tr(Π(𝜎1 − 𝐻))| ≤ 𝑞. The cross terms ⟨Ψ0 | Π ⊗ 𝐼 |Ψ1 ⟩ between |Ψ0 ⟩ and |Ψ1 ⟩ contribute at most 2 𝑞(1 − 𝑞) ≤ √ 2 𝑞, by Cauchy-Schwarz. Consequently, ⟨𝜙|𝑌̂︀ |𝜙⟩ = ⟨Ψ|(Π ⊗ 𝐼)|Ψ⟩ − Tr(Π𝜏 ) (︀ )︀ Tr(Π𝐵𝜙 ) = + Tr Π(𝜎1 − 𝐻) + 2 Re⟨Ψ0 |(Π ⊗ 𝐼)|Ψ1 ⟩ 𝐾𝑁 ‖𝐵𝜙 ‖1 √ + 𝑞 + 2 𝑞. ≤ 𝐾𝑁 √ Here ‖ · ‖1 denotes the trace norm. It remains to prove ‖𝐵𝜙 ‖1 ≤ 𝑁 ℓ + 2ℓ.

(45)

Writing the interference as swaps. First suppose the initial state is normalized and supported on databases of exactly size 𝑚 ≥ 1. To give each stored entry a slot, now we encode a database 𝐷 = {(𝑘1 , 𝑥1 ), . . . , (𝑘𝑚 , 𝑥𝑚 )} by the uniform superposition of its orderings (as a different purification of the database register): 1 ∑︁ | ord(𝐷)⟩ := √ |𝑘𝜋(1) , 𝑥𝜋(1) ⟩ · · · |𝑘𝜋(𝑚) , 𝑥𝜋(𝑚) ⟩. 𝑚! 𝜋∈𝑆𝑚 Define

𝐿 :=

∑︁

|𝜙𝐷 ⟩⟨ord(𝐷)|.

|𝐷|=𝑚

Thus 𝐿 maps the ordered encoding of 𝐷 to its advice amplitude |𝜙𝐷 ⟩. The ordered encodings are orthonormal, so Tr(𝐿† 𝐿) = 1. Let X0 be the challenge-column register and X1 , . . . , X𝑚 the stored column registers. Define 𝐽𝑚 :=

𝑚 ∑︁

Swap0𝑖 ,

𝐸𝑚 :=

𝑖=1

𝑚 ∑︁ ∑︁

|𝑥, 𝑥⟩⟨𝑥, 𝑥|X0 X𝑖 ,

𝑖=1 𝑥∈[𝑁 ]

with identities on all other registers, including the row registers. The operator 𝐽𝑚 sums all exchanges of the challenge column with a stored column; 𝐸𝑚 removes the equal-column exchanges, which are diagonal terms. We claim that 𝐵𝜙 = (𝐿 ⊗ 𝐼)(𝐽𝑚 − 𝐸𝑚 )(𝐿† ⊗ 𝐼).

(46)

Indeed, starting with 𝑆 ∖ {(𝑘, 𝑥)} and visible column 𝑥, swapping with the stored entry (𝑘, 𝑦) produces 𝑆 ∖ {(𝑘, 𝑦)} and visible column 𝑦. This is precisely the corresponding term of 𝐵𝜙 . The swap pairs the 𝑚! orderings bijectively, giving coefficient one. Equal-column swaps are canceled by 𝐸𝑚 , and a swap creating a repeated entry is killed by 𝐿, since the resulting tuple is not an encoding of a set. 55

The advantage of (46) is that all dependence on the advice is now contained in 𝐿. For any Hermitian 𝐽 and any 𝐶, ‖𝐶𝐽𝐶 † ‖1 ≤ Tr(𝐶 † 𝐶 |𝐽|), by splitting 𝐽 into its positive and negative parts. Also, 𝐸𝑚 ⪰ 0 and TrX0 𝐸𝑚 = 𝑚𝐼. Therefore, [︁

]︁

‖𝐵𝜙 ‖1 ≤ Tr 𝐿† 𝐿 TrX0 |𝐽𝑚 | + 𝑚. Since 𝐿† 𝐿 is positive with trace one, it suffices to bound the partial trace uniformly. Lemma 11.4, proved below, gives √ √ ‖𝐵𝜙 ‖1 ≤ 𝑁 𝑚 + 2𝑚. TrX0 |𝐽𝑚 | ⪯ (𝑁 𝑚 + 𝑚)𝐼, The case 𝑚 = 0 is immediate, since there are no off-diagonal terms. For a general state, let 𝑝𝑚 be its squared norm on databases of size 𝑚. Every term of 𝐵𝜙 pairs initial databases of the same size: both have size |𝑆| − 1. Applying the exact-size bound to each normalized component and then the triangle inequality gives √ ∑︁ √ 𝑝𝑚 (𝑁 𝑚 + 2𝑚) ≤ 𝑁 ℓ + 2ℓ. ‖𝐵𝜙 ‖1 ≤ 𝑚

Substituting this and 𝑞 ≤ ℓ/(𝐾𝑁 ) into (45), we obtain √︃ √︃ √ √ ⃒ ⃒ 𝑁 ℓ 3ℓ ℓ + 2ℓ ℓ ℓ ℓ ⃒⟨𝜙|𝑌̂︀ |𝜙⟩⃒ ≤ + +2 = +2 + , 𝐾𝑁 𝐾𝑁 𝐾𝑁 𝐾 𝐾𝑁 𝐾𝑁 proving Lemma 11.3.

11.3

An elementary bound for the swap operator

Lemma 11.4. On (C𝑁 )⊗(𝑚+1) , let 𝐽𝑚 = TrX0 |𝐽𝑚 | ⪯

√︁

2 1/2 . Then 𝑖=1 Swap0𝑖 and |𝐽𝑚 | = (𝐽𝑚 )

∑︀𝑚

√ 𝑚(𝑁 2 + 𝑚) 𝐼 ⪯ (𝑁 𝑚 + 𝑚)𝐼.

The same bound holds with additional registers on which all swaps act trivially. Proof. The case 𝑚 = 0 is immediate. A direct operator-norm bound would give only 𝑁 𝑚𝐼, since ‖𝐽𝑚 ‖op = 𝑚. To exploit the partial trace, we introduce an auxiliary model with 𝑚 occupied positions and one movable empty slot. Swaps starting with the empty slot at position 0 move it √ to orthogonal positions, giving a norm of 𝑚. The main step is a general identity converting the partial trace of a permutation into a block of its auxiliary operator. This helps transfer back to the original operator. Permutations with an empty slot. The auxiliary space is C𝑚+1 ⊗ (C𝑁 )⊗𝑚 . Its first register records the position 𝑗 ∈ {0, . . . , 𝑚} of the empty slot; the other registers store the 𝑚 column values. We use the following indexing convention: a basis state |𝑗⟩|𝑥1 , . . . , 𝑥𝑚 ⟩ encodes the configuration obtained from [ □, 𝑥1 , . . . , 𝑥𝑚 ] 56

by swapping positions 0 and 𝑗. In particular, moving the empty slot from 0 to 𝑖 changes the label from 0 to 𝑖 without changing the stored tuple in this encoding. For a permutation 𝜋 of the 𝑚 + 1 positions, let 𝑄𝜋 permute this configuration, moving both the contents and the empty slot. These are unitary permutation matrices and satisfy 𝑄𝜋 𝑄𝜎 = 𝑄𝜋𝜎 , just as the usual register-permutation operators 𝑈𝜋 do (while the difference is, 𝑄𝜋 applies on the auxiliary space C𝑚+1 ⊗ (C𝑁 )⊗𝑚 ). In both cases, a value at position 𝑗 moves to position 𝜋(𝑗). Define the Hermitian operator 𝐽̃︀ :=

𝑚 ∑︁

𝑄(0,𝑖) ,

𝑖=1

and write (·)00 for the block with empty-slot input and output label 0. For every stored-register vector |𝑣⟩, ̃︀ 𝐽(|0⟩ ⊗ |𝑣⟩) =

𝑚 ∑︁

̃︀ 00 = 0, (𝐽)

|𝑖⟩ ⊗ |𝑣⟩,

(𝐽̃︀2 )00 = 𝑚𝐼.

(47)

𝑖=1

The different swaps give different empty-slot labels, so their contributions are orthogonal. This is the source of the square-root dependence on 𝑚. Converting the partial trace into a matrix block. For every permutation 𝜋, ̃︀ 𝜋 )00 . TrX0 𝑈𝜋 = 𝑁 (𝑄𝜋 )00 + (𝐽𝑄

(48)

To see this, consider whether 𝜋 fixes position 0. • If it does, 𝜋(0) = 0, tracing out X0 gives 𝑁 times the permutation of the remaining registers. In the auxiliary model the empty slot stays at 0, so this is exactly the first term on the right; the second term is zero. • Otherwise, let 𝑖 = 𝜋(0) ̸= 0. Tracing out X0 deletes 0 from its permutation cycle, with no factor of 𝑁 . In the auxiliary model, 𝑄𝜋 moves the empty slot to 𝑖, so (𝑄𝜋 )00 = 0. Exactly one summand of 𝐽̃︀ returns it to 0, namely 𝑄(0,𝑖) . On the remaining registers, (0, 𝑖)𝜋 performs precisely the permutation obtained by deleting 0 from its cycle. Thus the second term on the right gives the required partial trace. Because the 𝑈𝜋 and 𝑄𝜋 obey the same multiplication rules, expanding any polynomial 𝑓 into products of swaps extends (48) to ̃︀ ̃︀ (𝐽) ̃︀ . TrX0 𝑓 (𝐽𝑚 ) = 𝑁 𝑓 (𝐽) + 𝐽𝑓 00 00 (︀

)︀

(︀

)︀

̃︀ This gives the exact Choose 𝑓 to agree with absolute value on the finite spectra of both 𝐽𝑚 and 𝐽. identity ̃︀ 00 + (𝐽| ̃︀ 𝐽|) ̃︀ 00 . TrX0 |𝐽𝑚 | = 𝑁 (|𝐽|) (49)

Applying Cauchy–Schwarz. Fix a unit vector |𝑣⟩ on the stored registers and set |𝑢⟩ = |0⟩⊗|𝑣⟩. By (47), ⃦ ⃦ ⃦ ⃦ ̃︀ ̃︀ ⃦2 = 𝑚, ̃︀ |𝑢⟩ ⃦2 = 𝑚, ⃦ 𝐽|𝑢⟩ ⃦ |𝐽| ⟨𝑢|𝐽|𝑢⟩ = 0,

57

̃︀ 2 = 𝐽̃︀2 . Equation (49) and Cauchy–Schwarz give where the last equality uses |𝐽| ̃︀ 𝐽| ̃︀ |𝑢⟩ ⟨𝑣| TrX0 |𝐽𝑚 | |𝑣⟩ = ⟨𝑢|(𝑁 𝐼 + 𝐽)| ̃︀ |𝑢⟩ ⃦ ̃︀ ⃦⃦ |𝐽| ≤ ⃦ (𝑁 𝐼 + 𝐽)|𝑢⟩ √︀ √ = 𝑁 2 + 𝑚 𝑚. ⃦⃦

⃦

⃦

This holds for every unit vector |𝑣⟩, proving the operator bound. Tensoring with an identity gives the assertion about additional registers.

References [AK07]

Scott Aaronson and Greg Kuperberg. Quantum versus classical proofs and advice. Theory of Computing, 3(1):129–157, 2007.

[BBBV97] Charles H. Bennett, Ethan Bernstein, Gilles Brassard, and Umesh Vazirani. Strengths and weaknesses of quantum computing. SIAM Journal on Computing, 26(5):1510–1523, October 1997. [BCKM21] James Bartusek, Andrea Coladangelo, Dakshita Khurana, and Fermi Ma. One-way functions imply secure computation in a quantum world. In Tal Malkin and Chris Peikert, editors, CRYPTO 2021, Part I, volume 12825 of LNCS, pages 467–496, Virtual Event, August 2021. Springer, Cham. [BDF+ 11] Dan Boneh, Özgür Dagdelen, Marc Fischlin, Anja Lehmann, Christian Schaffner, and Mark Zhandry. Random oracles in a quantum world. In Dong Hoon Lee and Xiaoyun Wang, editors, ASIACRYPT 2011, volume 7073 of LNCS, pages 41–69. Springer, Berlin, Heidelberg, December 2011. [CDGS18] Sandro Coretti, Yevgeniy Dodis, Siyao Guo, and John P. Steinberger. Random oracles and non-uniformity. In Jesper Buus Nielsen and Vincent Rijmen, editors, EUROCRYPT 2018, Part I, volume 10820 of LNCS, pages 227–258. Springer, Cham, April / May 2018. [CGLQ20] Kai-Min Chung, Siyao Guo, Qipeng Liu, and Luowen Qian. Tight quantum time-space tradeoffs for function inversion. In 61st FOCS, pages 673–684. IEEE Computer Society Press, November 2020. [CK19]

Henry Corrigan-Gibbs and Dmitry Kogan. The function-inversion problem: Barriers and opportunities. In Dennis Hofheinz and Alon Rosen, editors, TCC 2019, Part I, volume 11891 of LNCS, pages 393–421. Springer, Cham, December 2019.

[CLQ20]

Kai-Min Chung, Tai-Ning Liao, and Luowen Qian. Lower bounds for function inversion with quantum advice. In Yael Tauman Kalai, Adam D. Smith, and Daniel Wichs, editors, ITC 2020, volume 163 of LIPIcs, pages 8:1–8:15. Schloss Dagstuhl, June 2020.

[DGK17]

Yevgeniy Dodis, Siyao Guo, and Jonathan Katz. Fixing cracks in the concrete: Random oracles with auxiliary input, revisited. In Jean-Sébastien Coron and Jesper Buus Nielsen, editors, EUROCRYPT 2017, Part II, volume 10211 of LNCS, pages 473–495. Springer, Cham, April / May 2017. 58

[DLM26]

Fangqi Dong, Alex Lombardi, and Fermi Ma. Explicit separations for one-query unitary synthesis, 2026.

[DLW24]

Fangqi Dong, Qipeng Liu, and Kewen Wu. Tight characterizations for preprocessing against cryptographic salting. In Leonid Reyzin and Douglas Stebila, editors, CRYPTO 2024, Part IV, volume 14923 of LNCS, pages 377–411. Springer, Cham, August 2024.

[DTT10]

Anindya De, Luca Trevisan, and Madhur Tulsiani. Time space tradeoffs for attacks against one-way functions and PRGs. In Tal Rabin, editor, CRYPTO 2010, volume 6223 of LNCS, pages 649–665. Springer, Berlin, Heidelberg, August 2010.

[FN91]

Amos Fiat and Moni Naor. Rigorous time/space tradeoffs for inverting functions. In 23rd ACM STOC, pages 534–541. ACM Press, May 1991.

[Gao15]

Jingliang Gao. Quantum union bounds for sequential projective measurements. Physical Review A, 92(5), November 2015.

[GLLZ21] Siyao Guo, Qian Li, Qipeng Liu, and Jiapeng Zhang. Unifying presampling via concentration bounds. In Kobbi Nissim and Brent Waters, editors, TCC 2021, Part I, volume 13042 of LNCS, pages 177–208. Springer, Cham, November 2021. [GLSV21] Alex B. Grilo, Huijia Lin, Fang Song, and Vinod Vaikuntanathan. Oblivious transfer is in MiniQCrypt. In Anne Canteaut and François-Xavier Standaert, editors, EUROCRYPT 2021, Part II, volume 12697 of LNCS, pages 531–561. Springer, Cham, October 2021. [Hel80]

Martin E. Hellman. A cryptanalytic time–memory trade-off. IEEE Transactions on Information Theory, 26(4):401–406, July 1980.

[HMY23]

Minki Hhan, Tomoyuki Morimae, and Takashi Yamakawa. From the hardness of detecting superpositions to cryptography: Quantum public key encryption and commitments. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part I, volume 14004 of LNCS, pages 639–667. Springer, Cham, April 2023.

[HXY19]

Minki Hhan, Keita Xagawa, and Takashi Yamakawa. Quantum random oracle model with auxiliary input. In Steven D. Galbraith and Shiho Moriai, editors, ASIACRYPT 2019, Part I, volume 11921 of LNCS, pages 584–614. Springer, Cham, December 2019.

[JLS18]

Zhengfeng Ji, Yi-Kai Liu, and Fang Song. Pseudorandom quantum states. In Hovav Shacham and Alexandra Boldyreva, editors, CRYPTO 2018, Part III, volume 10993 of LNCS, pages 126–152. Springer, Cham, August 2018.

[Liu23]

Qipeng Liu. Non-uniformity and quantum advice in the quantum random oracle model. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part I, volume 14004 of LNCS, pages 117–143. Springer, Cham, April 2023.

[LMW24]

Alex Lombardi, Fermi Ma, and John Wright. A one-query lower bound for unitary synthesis and breaking quantum cryptography. In Bojan Mohar, Igor Shinkar, and Ryan O’Donnell, editors, 56th ACM STOC, pages 979–990. ACM Press, June 2024. 59

[MY22]

Tomoyuki Morimae and Takashi Yamakawa. Quantum commitments and signatures without one-way functions. In Yevgeniy Dodis and Thomas Shrimpton, editors, CRYPTO 2022, Part I, volume 13507 of LNCS, pages 269–295. Springer, Cham, August 2022.

[MY24]

Tomoyuki Morimae and Takashi Yamakawa. One-wayness in quantum cryptography. In 19th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2024), volume 310 of Leibniz International Proceedings in Informatics (LIPIcs), pages 4:1–4:21. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2024.

[Ros26]

Gregory Rosenthal. Query and depth upper bounds for quantum unitaries via grover search. Quantum, 10:2144, June 2026.

[Unr07]

Dominique Unruh. Random oracles and auxiliary input. In Alfred Menezes, editor, CRYPTO 2007, volume 4622 of LNCS, pages 205–223. Springer, Berlin, Heidelberg, August 2007.

[Yan22]

Jun Yan. General properties of quantum bit commitments (extended abstract). In Shweta Agrawal and Dongdai Lin, editors, ASIACRYPT 2022, Part IV, volume 13794 of LNCS, pages 628–657. Springer, Cham, December 2022.

[Yao90]

Andrew Chi-Chih Yao. Coherent functions and program checkers (extended abstract). In 22nd ACM STOC, pages 84–94. ACM Press, May 1990.

[YRC20]

Yuxiang Yang, Renato Renner, and Giulio Chiribella. Optimal universal programming of unitary gates. Physical Review Letters, 125(21):210501, 2020.

[Yue22]

Henry Yuen. Lecture 7 from COMS E6998: Frontiers of quantum complexity and cryptography, 2022.

[Zha19]

Mark Zhandry. How to record quantum queries, and applications to quantum indifferentiability. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part II, volume 11693 of LNCS, pages 239–268. Springer, Cham, August 2019.

A

A matching zero-query attack for 1OWS and 1PRS

We give a quantitative version of the folklore symmetric-subspace attack (see [LMW24]), which matches our zero-query bounds for both 1OWS (Theorem 5.2) and 1PRS (Theorem 11.2) up to logarithmic factors. The idea is to store many copies of each of a fixed set of states and compare the challenge against these states sequentially. Using more copies reduces false positives, while the quantum union bound controls the disturbance to the single challenge copy. Proposition A.1 (Symmetric-subspace attack). Suppose 𝐾 ≤ 𝑁 , and let 1 ≤ 𝐿 ≤ min{𝐾, 𝑁/32} be an integer. There are zero-query attacks using 32 · 𝐿2 · log 𝑁 qubits of advice that achieve 1OWS key-recovery probability at least 3𝐿/4𝐾 and 1PRS distinguishing advantage at least 𝐿/2𝐾, respectively. Both guarantees are averaged over the random oracle.

60

Proof. Fix distinct keys 𝑘1 , . . . , 𝑘𝐿 independently of 𝑅, and let 𝐽 = {𝑘1 , . . . , 𝑘𝐿 }. Set 𝑟 = 32𝐿, and use the advice state |Φ𝑅 ⟩ :=

𝐿 ⨂︁

|𝜓𝑅,𝑘𝑗 ⟩⊗𝑟 .

𝑗=1

𝑁 = 32𝐿2 log

This uses 𝑟𝐿 log2 2 𝑁 qubits. The keys are fixed in advance, so their descriptions need not be included in the advice. (𝑟+1)

The symmetric-subspace test. Let Πsym be the projector onto the totally symmetric subspace of (C𝑁 )⊗(𝑟+1) . For any unit vectors |𝜙⟩ , |𝜓⟩, ⃦ ⃦ 1 + 𝑟|⟨𝜙|𝜓⟩|2 ⃦ (𝑟+1) (︀ ⊗𝑟 )︀⃦2 . ⃦ = ⃦Πsym |𝜙⟩ ⊗ |𝜓⟩

𝑟+1

(50)

Indeed, the component of |𝜙⟩ parallel to |𝜓⟩ is accepted with probability one, while its orthogonal component has squared projection 1/(𝑟 + 1). On receiving the challenge, the algorithm tests it against the 𝑟 stored copies for 𝑘1 , then 𝑘2 , and so on, stopping at the first accepting outcome. Each test is the two-outcome projective mea(𝑟+1) (𝑟+1) surement {Πsym , 𝐼 − Πsym } on the challenge and the corresponding stored block. All operations are independent of 𝑅, and no online oracle queries are needed. For different keys, the expected squared overlap is 1/𝑁 . The same holds between any fixed stored state and an independent Haar-random challenge. Thus the expected acceptance probability of an individual non-matching test, evaluated on the original input state, is 𝑎 :=

1 + 𝑟/𝑁 1 1 ≤ + , 𝑟+1 𝑟+1 𝑁

1 4·𝐿·𝑎≤ . 4

The last inequality follows from 𝑟 = 32𝐿 and 𝐿 ≤ 𝑁/32. To account for the disturbance from earlier tests, we use the quantum union bound [Gao15]: for projectors 𝑄1 , . . . , 𝑄ℎ and a unit vector |𝑣⟩, 2

‖𝑄ℎ · · · 𝑄1 |𝑣⟩‖ ≥ 1 − 4

ℎ ∑︁

‖(𝐼 − 𝑄𝑖 ) |𝑣⟩‖2 .

𝑖=1

For the 1OWS game. Output the key corresponding to the first accepting test, and output an arbitrary key if all tests reject. Suppose the challenge key is 𝑘𝑗 . On the original input, the test for 𝑘𝑗 accepts with probability one, while every earlier test has expected acceptance probability 𝑎. Applying the quantum union bound to the desired sequence “reject 𝑘1 , . . . , 𝑘𝑗−1 , then accept 𝑘𝑗 ” gives 3 E𝑅 Pr[output 𝑘𝑗 | 𝑘 = 𝑘𝑗 ] ≥ 1 − 4(𝑗 − 1)𝑎 ≥ . 4 Since the challenge key lies in 𝐽 with probability 𝐿/𝐾, the overall key-recovery probability is at least 3𝐿/4𝐾.

61

For the 1PRS game. Use the same sequence of tests, declaring the challenge real if any test accepts, and Haar-random otherwise. Let 𝑝in be the probability of declaring real conditioned on a real challenge with key in 𝐽, and let 𝑝H be the probability of declaring real on a Haar-random challenge. These probabilities include the average over 𝑅. The preceding argument gives 𝑝in ≥ 3/4. Applying the quantum union bound to the sequence in which all tests reject gives 1 𝑝H ≤ 4𝐿𝑎 ≤ . 4 It remains to account for real challenges whose keys are not stored. Conditioned on the oracle rows indexed by 𝐽, every such challenge is independent of the advice and has average density matrix 𝐼/𝑁 , exactly as in the Haar experiment. Thus these challenges contribute the same acceptance probability as the Haar baseline. Writing 𝑝real for the acceptance probability in the real experiment, we obtain )︂ (︂ 𝐿 𝐿 𝑝real = 𝑝in + 1 − 𝑝H , 𝐾 𝐾 and hence )︀ 𝐿 (︀ 𝐿 𝑝real − 𝑝H = 𝑝in − 𝑝H ≥ . 𝐾 2𝐾 This also lower bounds the distinguishing advantage averaged over 𝑅, since the average absolute gap is at least the absolute average gap. For 𝑁 ≥ 32 and an advice budget 𝑆 ≥ 32 log2 𝑁 , take {︃

⌋︂ ⌊︃√︃

𝑁 𝐿 = min 𝐾, , 32 ⌊︂

𝑆 32 log2 𝑁

⌋︃}︃

.

Since 𝐾 ≤ 𝑁 , both attacks achieve 1 Ω min 1, 𝐾 (︃

{︃

√︃

𝑆 log 𝑁

}︃)︃

.

In particular, constant success probability or distinguishing advantage is achievable with 𝑂(𝐾 2 log 𝑁 ) advice qubits and no online queries.

B

Proof of Lemma 6.3

Now we prove Lemma 6.3. We first construct the unitary for a single key, and then apply this construction after un-compressing all the other rows. Lemma B.1 (Single-key database estimate). Let D0 be a single-key database register with basis { |𝐸⟩ : 𝐸 ⊆ [𝑁 ]}. For a normalized vector on D0 |𝛽⟩ =

∑︁

𝜈 :=

𝛽𝐸 |𝐸⟩ ,

∑︁

|𝐸| |𝛽𝐸 |2 ,

𝐸

𝐸⊆[𝑁 ]

define 𝑇𝑥 |𝐸⟩ := |𝐸 ⊕ {𝑥}⟩. There is a unitary 𝑊𝛽 acting only on D0 B such that ⃦ ⃦ (︃ )︃ ⃦ ⃦ √ √︂ 𝜈 1 ∑︁ 1 ∑︁ ⃦ ⃦ |𝑥⟩ ⊗ 𝑇𝑥 |𝛽⟩D0 |0⟩B − √ |𝑥⟩ ⊗ |𝛽⟩D0 |𝑥⟩B ⃦ ≤ (1 + 3) . ⃦𝑊𝛽 √ ⃦ ⃦ 𝑁 𝑁 𝑥 𝑁 𝑥

Here 𝜈 is the expected size the database, and 𝑊𝛽 acts as identity on the |𝑥⟩ register. 62

(51)

Proof. Define ℋD0 as the space of register D0 . Define two linear maps 𝑀+ , 𝑀− : C𝑁 → ℋD0 by 𝑀+ |𝑥⟩ :=

∑︁

𝑀− |𝑥⟩ :=

𝛽𝐸 |𝐸 ∪ {𝑥}⟩ ,

∑︁

𝛽𝐸 |𝐸 ∖ {𝑥}⟩ .

𝐸:𝑥∈𝐸

𝐸:𝑥∈𝐸 /

Thus (𝑀+ + 𝑀− ) |𝑥⟩ = 𝑇𝑥 |𝛽⟩. For any matrix 𝑀 , write ‖𝑀 ‖2HS := Tr(𝑀 † 𝑀 ) for the sum of its squared column norms. For a fixed 𝑥, distinct sets containing 𝑥 remain distinct after deleting 𝑥, and thus ‖𝑀− ‖2HS =

|𝛽𝐸 |2 =

∑︁ ∑︁ 𝑥 𝐸:𝑥∈𝐸

∑︁

|𝐸| |𝛽𝐸 |2 = 𝜈.

(52)

𝐸

Replacing by orthonormal vectors from the 𝑀+ part. Define the 𝑁 × 𝑁 Gram matrices 𝐺+ := 𝑀+† 𝑀+ and 𝐺− := 𝑀−† 𝑀− . They satisfy the following: (𝐺− )𝑥𝑥 =

∑︁

|𝛽𝐸 |2 ,

(𝐺+ )𝑥𝑥 = 1 − (𝐺− )𝑥𝑥 ,

∑︁

𝛽𝐸∪{𝑦} 𝛽𝐸∪{𝑥} = (𝐺− )𝑦𝑥 .

𝐸:𝑥∈𝐸

(𝐺+ )𝑥𝑦 =

𝐸⊆[𝑁 ]∖{𝑥,𝑦}

Therefore, for positive semidefinite 𝐺T − and diag(𝐺− ), and trace norm ‖·‖1 , ⃦ ⃦

⃦ ⃦

⃦ ⃦

⃦ ⃦

T ‖𝐺+ − 𝐼𝑁 ‖1 = ⃦𝐺T − − 𝐼𝑁 + (diag(𝐺+ ) − diag(𝐺− ))⃦ = ⃦𝐺− − 2 diag(𝐺− )⃦

1

1

⃦ ⃦ ⃦ ⃦ ≤ ⃦𝐺T − ⃦ + 2‖diag(𝐺− )‖1 ≤ 3𝜈 1

√ Choose an isometry 𝑉 : C𝑁 → ℋD0 satisfying 𝑀+ = 𝑉 𝐺+ . That is, √︀ for an orthonormal eigenbasis { |𝑢𝑗 ⟩}𝑁 of 𝐺 with eigenvalues 𝜆 ≥ 0, set 𝑉 |𝑢 ⟩ = 𝑀 |𝑢 ⟩ / 𝜆𝑗 when 𝜆𝑗 > 0. + 𝑗 𝑗 + 𝑗 𝑗=1 These vectors are orthonormal because their inner products are given by the matrix 𝐺+ in its eigenbasis. For the zero eigenvalues, extend them to an orthonormal family of 𝑁 vectors (this is possible since dim ℋD0 = 2𝑁 ≥ 𝑁 ). Then 𝑉 † 𝑉 = 𝐼𝑁 , and since 𝜆𝑗 > 0, ‖𝑀+ − 𝑉 ‖2HS =

𝑁 √︁ ∑︁

𝑁 ∑︁

𝑗=1

𝑗=1

( 𝜆𝑗 − 1)2 ≤

|𝜆𝑗 − 1|

= ‖𝐺+ − 𝐼𝑁 ‖1 ≤ 3𝜈. Together with (52), this gives ‖𝑀+ + 𝑀− − 𝑉 ‖HS ≤ ‖𝑀− ‖HS + ‖𝑀+ − 𝑉 ‖HS ≤ (1 +

√ √ 3) 𝜈.

(53)

Constructing 𝑊𝛽 . The two families {𝑉 |𝑥⟩ |0⟩ : 𝑥 ∈ [𝑁 ]} and { |𝛽⟩ |𝑥⟩ : 𝑥 ∈ [𝑁 ]} are orthonormal in ℋD0 ⊗ ℋB , where ℋB is the space of register B. Complete them to orthonormal bases and map the first basis to the second. This defines one unitary 𝑊𝛽 satisfying, simultaneously for all 𝑥, 𝑊𝛽 (𝑉 |𝑥⟩ |0⟩) = |𝛽⟩ |𝑥⟩ .

63

Thus 𝑊𝛽 moves the orthonormal encoding of 𝑥 into B and restores |𝛽⟩ on the row. By orthogonality of the labels in X and unitarity, the square of the norm in (51) is 1 ∑︁ ‖𝑊𝛽 (𝑇𝑥 |𝛽⟩ |0⟩) − 𝑊𝛽 (𝑉 |𝑥⟩ |0⟩)‖2 𝑁 𝑥

√ 1 (1 + 3)2 𝜈 1 ∑︁ 2 2 ‖𝑇𝑥 |𝛽⟩ − 𝑉 |𝑥⟩‖ = ‖𝑀+ + 𝑀− − 𝑉 ‖HS ≤ . = 𝑁 𝑥 𝑁 𝑁

From the single-key database case in Lemma B.1, now we are ready to prove Lemma 6.3 Proof of Lemma 6.3. Fix 𝑘. As we would want [𝑊𝑘 , 𝑇𝑎,𝑦 ] = 0, we would need to go back to the uncompressed mode. Write D𝑘 for the key 𝑘 part and D−𝑘 for all other parts, and put 𝐷𝑘 := {𝑥 : (𝑘, 𝑥) ∈ 𝐷}. On the parts outside of 𝑘, use the orthonormal basis |𝑠⟩−𝑘 :=

⨂︁ |0⟩𝑎,𝑦 + 𝑠(𝑎, 𝑦) |1⟩𝑎,𝑦 √ 𝐻 |(1 − 𝑠(𝑎, 𝑦))/2⟩ . = 2 𝑎∈[𝐾]∖{𝑘} 𝑎∈[𝐾]∖{𝑘} ⨂︁

𝑦∈[𝑁 ]

𝑦∈[𝑁 ]

Here 𝑠 : ([𝐾]∖{𝑘}) × [𝑁 ] → {±1} ranges over all assignments (as for random oracle 𝑅−𝑘 ), and |0⟩𝑎,𝑦 , |1⟩𝑎,𝑦 mean absence or presence of a compressed database entry (𝑎, 𝑦). This is the uncompressed outside-𝑘 basis written in compressed coordinates, while the key 𝑘 part remains compressed. ∑︀ The two single-coordinate vectors are orthonormal, so 𝑠 |𝑠⟩ ⟨𝑠|−𝑘 = 𝐼−𝑘 . Define the unnormalized vectors on a single key (while fixing the oracle 𝑅−𝑘 on other keys): |𝛽𝑘,𝑠 ⟩𝑘 := (⟨𝑠|−𝑘 ⊗ 𝐼𝑘 ) |𝜒⟩ =

∑︁

𝛽𝑘,𝑠,𝐸 |𝐸⟩𝑘 .

𝐸⊆[𝑁 ]

Here |𝐸⟩𝑘 contains exactly the entries 𝐸 with key 𝑘, and 𝐼−𝑘 , 𝐼𝑘 are the identities on the indicated registers. For each nonzero |𝛽𝑘,𝑠 ⟩, apply Lemma B.1 to |𝛽𝑘,𝑠 ⟩ /‖ |𝛽𝑘,𝑠 ⟩‖, obtaining a unitary 𝑊𝑘,𝑠 on D𝑘 B. Squaring and using orthogonality of register |𝑥⟩, ∑︁ √ ∑︁ ‖𝑊𝑘,𝑠 (𝑇𝑥 |𝛽𝑘,𝑠 ⟩ |0⟩) − |𝛽𝑘,𝑠 ⟩ |𝑥⟩‖2 ≤ (1 + 3)2 |𝐸| |𝛽𝑘,𝑠,𝐸 |2 . (54) 𝐸

𝑥∈[𝑁 ]

Here 𝑇𝑥 |𝐸⟩𝑘 = |𝐸 ⊕ {𝑥}⟩𝑘 , and the displayed registers inside the norm are D𝑘 , B. When 𝛽𝑘,𝑠 = 0, choose 𝑊𝑘,𝑠 = 𝐼, and the estimate remains valid. Now set ∑︁ ∑︁ 𝑊𝑘 := |𝑠⟩ ⟨𝑠|−𝑘 ⊗ 𝑊𝑘,𝑠 , 𝑊 := 𝑊𝑘 ⊗ |𝑘⟩ ⟨𝑘|K . 𝑠

𝑘∈[𝐾]

Both are unitary because their blocks are unitary. For 𝑎 ̸= 𝑘, 𝑇𝑎,𝑦 |𝑠⟩−𝑘 = 𝑠(𝑎, 𝑦) |𝑠⟩−𝑘 , so 𝑇𝑎,𝑦 is scalar on each 𝑠-block and commutes with 𝑊𝑘 . Also, 𝑊 leaves the algorithm’s registers untouched, hence [𝑊, 𝑈 ] = 0. Since Π is diagonal in 𝑘 and each Π𝑘 acts only on the algorithm’s registers, [𝑊, Π] = 0. Finally, expand both initial states. The initial state on the database register can be written as |𝜒⟩ =

(︃ ∑︁

)︃

|𝑠⟩ ⟨𝑠|−𝑘 ⊗ 𝐼𝑘

𝑠

|𝜒⟩ =

∑︁ 𝑠

64

|𝑠⟩−𝑘 |𝛽𝑘,𝑠 ⟩𝑘 .

For each 𝐸, orthogonality gives ∑︁

|𝛽𝑘,𝑠,𝐸 |2 = ‖(𝐼−𝑘 ⊗ ⟨𝐸|𝑘 ) |𝜒⟩‖2 =

𝑠

∑︁

|𝛼𝐷 |2 .

𝐷:𝐷𝑘 =𝐸

The labels 𝑘, 𝑠, 𝑥 are orthogonal, and the fixed algorithm state |𝑧⟩ has norm one. Therefore, by ∑︀ (54) and 𝜇 = 𝐷 |𝛼𝐷 |2 |𝐷|, ‖𝑊 |𝜉real ⟩ − |𝜉ref ⟩‖2 1 ∑︁ ‖𝑊𝑘,𝑠 (𝑇𝑥 |𝛽𝑘,𝑠 ⟩ |0⟩) − |𝛽𝑘,𝑠 ⟩ |𝑥⟩‖2 = 𝐾𝑁 𝑘,𝑠,𝑥 √ (1 + 3)2 ∑︁ ≤ |𝐸| |𝛽𝑘,𝑠,𝐸 |2 𝐾𝑁 𝑘,𝑠,𝐸 √ 2 √ ∑︁ (1 + 3) ∑︁ (1 + 3)2 𝜇 2 = |𝛼𝐷 | |𝐷𝑘 | = . 𝐾𝑁 𝐾𝑁 𝐷 𝑘

Remark B.2 (Why this does not extend to the quantum advice case?). The construction uses the fact that |𝜒⟩ is on the database register alone, while the initial algorithm state |𝑧⟩ is fixed (and unentangled with |𝜒⟩). Thus for each |𝛽𝑘,𝑠 ⟩ as a state on key 𝑘 alone, 𝑊𝑘 can be chosen entirely on inaccessible registers (the database register and B). For a general initial state entangled between quantum advice and the database, say |𝜓⟩ := ∑︀ 𝐷 𝛼𝐷 |𝜙𝐷 ⟩A |𝐷⟩D , the corresponding state on a single 𝑘 can also contain the advice register A. Therefore, the same orthonormal-family construction only guarantees a unitary 𝑉 ′ on AD0 B, not on D0 B alone. This will result in a 𝑊 that also acts on register A, and thus cannot commute with the operations on the algorithm’s registers as 𝑈 and Π. Thus this proof does not extend to arbitrary quantum advice.

C

Proof of Lemma 8.3

Proof of Lemma 8.3. From (23), we know † 𝑇 † 𝑇 ) Π(𝑂𝑅 𝑈 )𝑇 |𝑟, 0𝑤 ⟩ . ) Π(𝑂𝑅 𝑈 )𝑇 |𝑅(𝑥), 0𝑤 ⟩ − E𝑟 ⟨𝑟, 0𝑤 | (𝑈 † 𝑂𝑅 𝑌𝑅 := E𝑥 ⟨𝑅(𝑥), 0𝑤 | (𝑈 † 𝑂𝑅

Throughout this section, we suppress the fixed workspace initialization |0𝑤 ⟩. Operators 𝑌𝑅 are on the advice register. The workspace is included in all evolving hybrid states, and suppressing its notation does not affect the hybrid estimates. Now we add a resampling hybrid in between, by resampling position 𝑥 on the random 𝑅 (or, swapping position 𝑥 on 𝑅 with a random image). Let 𝑅𝑥→𝑟 denote 𝑅 with its value at 𝑥 replaced by 𝑟. That is, now 𝑅𝑥→𝑟 (𝑥) = 𝑟, and for any 𝑥′ ̸= 𝑥, 𝑅𝑥→𝑟 (𝑥′ ) = 𝑅(𝑥). Define † 𝑇 † 𝑇 𝑇 Γ𝑅 := E𝑥 ⟨𝑅(𝑥)| (𝑈 † 𝑂𝑅 ) Π(𝑂𝑅 𝑈 )𝑇 |𝑅(𝑥)⟩ − E𝑥,𝑟 ⟨𝑟| (𝑈 † 𝑂𝑅 𝑥→𝑟 ) Π(𝑂𝑅𝑥→𝑟 𝑈 ) |𝑟⟩ , † 𝑇 † † 𝑇 𝑇 𝑇 𝐵𝑅 := E𝑥,𝑟 ⟨𝑟| (𝑈 † 𝑂𝑅 𝑥→𝑟 ) Π(𝑂𝑅𝑥→𝑟 𝑈 ) |𝑟⟩ − E𝑟 ⟨𝑟| (𝑈 𝑂𝑅 ) Π(𝑂𝑅 𝑈 ) |𝑟⟩ .

̂︀ + 𝐵. ̂︀ Therefore, we Now 𝑌𝑅 = Γ𝑅 + 𝐵𝑅 . By linearity, in the compressed oracle framework, 𝑌̂︀ = Γ ̂︀ ̂︀ only need to bound ⟨𝜓| Γ |𝜓⟩ and ⟨𝜓| 𝐵 |𝜓⟩ respectively.

65

̂︀ part. In the real mode, for each 𝑥, define the 𝑥 part of the operator for Γ𝑅 as For the Γ † 𝑇 † 𝑇 𝑇 Γ𝑅 (𝑥) := ⟨𝑅(𝑥)| (𝑈 † 𝑂𝑅 ) Π(𝑂𝑅 𝑈 )𝑇 |𝑅(𝑥)⟩ − E𝑟 ⟨𝑟| (𝑈 † 𝑂𝑅 𝑥→𝑟 ) Π(𝑂𝑅𝑥→𝑟 𝑈 ) |𝑟⟩ ,

and thus Γ𝑅 = 𝑁1 𝑥 Γ𝑅 (𝑥), and Γ𝑅 (𝑥) taking expectation over 𝑅(𝑥) will be equal to 0. In the compressed oracle database mode, Let 𝑄𝑥 be the projector onto databases where 𝑥 is contained, (𝐼 − 𝑄𝑥 ) as the part where 𝑥 is absent, and they act as the identity of the algorithm’s ̂︀ 𝑥 as Γ𝑅 (𝑥) in the compressed oracle framework, and register. We can correspondingly define Γ ∑︀

⃦ ⃦ ⃦ ̂︀ ⃦ ⃦Γ𝑥 ⃦ ≤ 2,

̂︀ 𝑥 (𝐼 − 𝑄𝑥 ) = 0. (𝐼 − 𝑄𝑥 )Γ

This is from the fact that, in the uncompressed representation, (𝐼 − 𝑄𝑥 ) projects the oracle value register at 𝑥 onto its uniform superposition, and thus it averages Γ𝑅 (𝑥) over that coordinate 𝑅(𝑥). Now for every 𝑥 ∈ [𝑁 ], ⃒ ⃒ ⃒ ⃒ ⃒ ̂︀ 𝑥 |𝜓⟩⃒⃒ = ⃒⃒⟨𝜓| 𝑄𝑥 Γ ̂︀ 𝑥 |𝜓⟩ + ⟨𝜓| (𝐼 − 𝑄𝑥 )Γ ̂︀ 𝑥 𝑄𝑥 |𝜓⟩⃒⃒ ≤ 2 · 2 ‖𝑄𝑥 |𝜓⟩‖ . ⃒⟨𝜓| Γ

Since 𝑥 𝑄𝑥 will count the database size, on |𝜓⟩ supported on databases of size ≤ ℓ, ℓ. By Cauchy-Schwarz, ∑︀

⃒ ⃒ ⃒ ∑︁ ⃒⃒ ∑︁ ⃒ ̂︀ |𝜓⟩⃒⃒ ≤ 1 ̂︀ 𝑥 |𝜓⟩⃒⃒ ≤ 4 ‖𝑄𝑥 |𝜓⟩‖ ≤ 4 ⃒⟨𝜓| Γ ⃒⟨𝜓| Γ

𝑁

𝑁

𝑥

√︃

𝑥

2 𝑥 ‖𝑄𝑥 |𝜓⟩‖ ≤

∑︀

ℓ . 𝑁

̂︀ part. Fix 𝑟. Define cO𝑥 from the compressed oracle cO except that, at query input For the 𝐵 𝑥, it applies the response corresponding to 𝑟 without changing the database. Let |𝑣𝑖 ⟩ and |𝑣𝑖𝑥 ⟩ be the states just before the (𝑖 + 1)-th query using cO and cO𝑥 , respectively, starting from the same state |𝑟⟩ |𝜓⟩. Now our goal is to upper bound |E𝑥 ⟨𝑣𝑇𝑥 | Π |𝑣𝑇𝑥 ⟩ − ⟨𝑣𝑇 | Π |𝑣𝑇 ⟩|, which can be bounded

|E𝑥 ⟨𝑣𝑇𝑥 | Π |𝑣𝑇𝑥 ⟩ − ⟨𝑣𝑇 | Π |𝑣𝑇 ⟩| ≤ |2 Re ⟨𝑣𝑇 | ΠE𝑥 ( |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩) + E𝑥 (⟨𝑣𝑇𝑥 | − ⟨𝑣𝑇 |)Π( |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩)| ≤ 2 ‖E𝑥 ( |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩)‖ + E𝑥 ‖ |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩‖2 . Consider induction on queries, the difference can be viewed as ⃦ 𝑥 ⃦ ⃦ |𝑣 ⟩ − |𝑣𝑖+1 ⟩⃦ = ‖cO𝑥 ( |𝑣 𝑥 ⟩ − |𝑣𝑖 ⟩) + (cO𝑥 − cO) |𝑣𝑖 ⟩‖ . 𝑖+1 𝑖

As cO𝑥 − cO only acts on query address 𝑥 and has norm at most 2, the triangle inequality gives √︁

𝑥 E𝑥 ‖ |𝑣𝑖+1 ⟩ − |𝑣𝑖+1 ⟩ ‖2 ≤

2 𝑥 ‖(cO𝑥 − cO) |𝑣𝑖 ⟩‖ ≤ 4, and

∑︀

2 E𝑥 ‖ |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩ ‖2 + √ 𝑁

√︁

Since the initial states |𝑣𝑖0 ⟩ = |𝑣𝑖 ⟩, this gives E𝑥 ‖ |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩ ‖2 ≤

4𝑖2 . 𝑁

For the average state difference, we can rewrite the difference as ⃦ 𝑥 ⃦ ⃦ |𝑣 ⟩ − |𝑣𝑖+1 ⟩⃦ = ‖cO( |𝑣 𝑥 ⟩ − |𝑣𝑖 ⟩) + (cO𝑥 − cO)( |𝑣 𝑥 ⟩ − |𝑣𝑖 ⟩) + (cO𝑥 − cO) |𝑣𝑖 ⟩‖ , 𝑖+1 𝑖 𝑖

66

(55)

and therefore, by the triangle inequality, ⃦ ⃦ ⃦E𝑥 ( |𝑣 𝑥 ⟩ − |𝑣𝑖+1 ⟩)⃦ = ‖E𝑥 cO( |𝑣 𝑥 ⟩ − |𝑣𝑖 ⟩) + E𝑥 (cO𝑥 − cO)( |𝑣 𝑥 ⟩ − |𝑣𝑖 ⟩) + E𝑥 (cO𝑥 − cO) |𝑣𝑖 ⟩‖ 𝑖 𝑖 𝑖+1

≤ ‖E𝑥 ( |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩)‖ + ‖E𝑥 (cO𝑥 − cO)( |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩)‖ + ‖E𝑥 (cO𝑥 − cO) |𝑣𝑖 ⟩‖ 4 · E𝑥 ‖ |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩‖2 + ‖E𝑥 (cO𝑥 − cO)‖ 𝑁 4𝑖 2 𝑥 ≤ ‖E𝑥 ( |𝑣𝑖 ⟩ − |𝑣𝑖 ⟩)‖ + + , 𝑁 𝑁 ≤ ‖E𝑥 ( |𝑣𝑖𝑥 ⟩ − |𝑣𝑖 ⟩)‖ +

√︂

where the last line is from (55), and as {cO𝑥 − cO}𝑥 are orthogonal for different 𝑥. This gives ‖E𝑥 ( |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩)‖ ≤

2𝑇 2 . 𝑁

(56)

̂︀ part by From (55) and (56), we can upper bound the 𝐵

|E𝑥 ⟨𝑣𝑇𝑥 | Π |𝑣𝑇𝑥 ⟩ − ⟨𝑣𝑇 | Π |𝑣𝑇 ⟩| ≤ 2 ‖E𝑥 ( |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩)‖ + E𝑥 ‖ |𝑣𝑇𝑥 ⟩ − |𝑣𝑇 ⟩‖2 ≤

8𝑇 2 . 𝑁

̂︀ part, this proves the lemma. Together with the bound for the Γ

C.1

A weaker but simpler bound (︁√︀

)︁

In this subsection, we also show a weaker bound of 𝑂 (𝑇 2 + ℓ)/𝑁 for Lemma 8.3, which can be derived directly from [CGLQ20]. For normalized state |𝜓⟩ (with both the algorithm’s register and the database register), by our definition of 𝑌̂︀ in the compressed oracle database mode: ⃒ ⃒ ⃒ ⃒ ⃒⟨𝜓| 𝑌̂︀ |𝜓⟩⃒ ⃒ ⃒ (︃ )︃ ⃒ ⃒ ∑︁ 1 ⃒ ⃒ † † 𝑇 𝑇 † † 𝑇 𝑇 = ⃒⟨𝜓| · E𝑥 ⟨𝑦1 | 𝐻(𝑈 cO ) Π(cO 𝑈 ) 𝐻 |𝑦2 ⟩ ⊗ 𝑇𝑥,(𝑦1 ⊕𝑦2 ) − E𝑟 ⟨𝑟| (𝑈 cO ) Π(cO 𝑈 ) |𝑟⟩ ⊗ 𝐼𝐷 |𝜓⟩⃒ ⃒ ⃒ 𝑀 𝑦1 ,𝑦2 ⃒ ⃦ ⃒ ⃦2 )︃ (︃ ⃒ ⃦ ⃦ ⃦ ⃦2 ⃒⃒ ∑︁ 1 ⃒ ⃦ ⃦ ⃦ 𝑇 𝑇 ⃒ √ · 𝐻 |𝑦⟩ ⊗ 𝑇𝑥,𝑦 |𝜓⟩⃦ − E𝑟 ⃦Π(cO 𝑈 ) |𝑟⟩ |𝜓⟩⃦ = ⃒E𝑥 ⃦Π(cO 𝑈 ) ⃦ ⃒⃒ . ⃦ 𝑀 ⃒ ⃦ ⃒ 𝑦

This is exactly the distinguishing advantage of the following distinguishing game: 1. The algorithm starts with a normalized state |𝜓⟩ with support on databases of size ≤ ℓ. 2. The algorithm will receive a challenge input, from either 𝑅(𝑥) for a random 𝑥 ← [𝑁 ] or a completely random 𝑟 ← [𝑀 ]. 3. Then the algorithm is allowed to make 𝑇 queries to the oracle 𝑅 (or 𝑂𝑅 ), and it needs to tell whether the challenge is from 𝑅 or a completely random string from range. Therefore, now we only need to prove the maximum distinguishing advantage of this game, and this will give a proof for Lemma 8.3. This has been studied in [CGLQ20, Lemma 5.9]. 67

From the above interpretation, now our goal is to upper bound the distinguishing advantage of the game starting with |𝜓⟩ supported on databases of size ≤ ℓ. ⃒ ⃒ ⃒ ⃒ ⃒ Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑅(𝑥)) = 1] − Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑦) = 1]⃒ ⃒ ⃒𝑅,𝑥 𝑅,𝑦 ⃒ ⃒⃒ ⃒ √︂ √︂ ⃒√︂ ⃒ ⃒√︂ ⃒ ⃒ ⃒ ⃒ ⃒ ≤ ⃒ Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑅(𝑥)) = 1] − Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑦) = 1]⃒ ⃒ Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑅(𝑥)) = 1] + Pr [𝐴𝑂𝑅 ( |𝜓⟩ , 𝑦) = 1]⃒ ⃒ 𝑅,𝑥 ⃒ ⃒ ⃒ 𝑅,𝑦 𝑅,𝑥 𝑅,𝑦 √︃ √

≤

𝑇+ ℓ √ √ ·2 2≤4· 𝑁

𝑇2 + ℓ . 𝑁

([CGLQ20, Lemma 5.9])

68

Related documents

• Time-space lower bounds for breaking quantum cryptography#1157449
• The security of practical quantum key distribution#6600
• Centralised multi link measurement compression with side information#1011934
• Simultaneously Query-Optimal Quantum Linear-System Algorithm#1118759
• Keyless secrecy against bounded adversaries#1000211