On Best-Possible One-Time Programs

As a diligent researcher, I have meticulously reviewed both provided texts concerning On Best-Possible One-Time Programs. The material presents a sophisticated line of inquiry into the security limits of one-time programs (OTPs), moving from general impossibility results to identifying achievable, stronger security guarantees under specific constraints.

Here is a detailed and comprehensive summary synthesizing the key findings, theorems, and concepts from both sources:

This body of work investigates the theoretical limits of one-time programs (OTPs) designed to evaluate a program on a single input while revealing no other information. The central theme revolves around determining the best-possible security achievable by such transformations, particularly when considering quantum functionalities and various models of classical computation.

The initial and most striking result establishes a fundamental barrier to achieving the strongest possible one-time security guarantees:

• Impossibility for Generic Best-Possible Compilers: The authors prove that a generic best-possible one-time compiler cannot exist, even when considering classical randomized functionalities. This impossibility is contingent upon the existence of certain lossy encryption schemes, specifically those derived from either the Learning with Errors (LWE) problem or weakly pseudorandom group actions.

• Under Classical Assumptions: The impossibility is formally stated as: Best-possible one-time compilers do not exist unless lossy encryptions do not exist. This result holds relative to all oracles.

Given the general impossibility result, the paper pivots to identifying a more practical and achievable class of OTPs: testable one-time program compilers. These are defined as compilers that output quantum states augmented with reflection oracles for themselves.

• SEQ Security as a Ceiling: The authors introduce the concept of Single-Effective-Query (SEQ) simulation security. A crucial finding is that SEQ security serves as a powerful ceiling on one-time security in the plain model. Specifically, they demonstrate that:

• Any one-time compiler achieving SEQ security is necessarily best-possible among testable one-time compilers (Theorem 3).

• This suggests that SEQ security is the most robust form of one-time security achievable within this restricted subclass.

The research then moves from theoretical limits to constructive results by focusing on a specific, powerful obfuscation technique: stateful quantum indistinguishability obfuscation (stateful quantum iO).

• Implication Chain: The paper establishes a strong implication chain: Stateful quantum iO implies best-possible testable OTPs. This is the key constructive step that moves beyond the negative impossibility results.

• Achievability in Classical Models: Remarkably, the authors demonstrate that stateful quantum iO is achievable even in the classical oracle model, which contrasts with previous studies where such obfuscation was only explored for deterministic classical functionalities.

• Constructive Proof: The existence of ideal stateful quantum obfuscation is proven to be possible within the classical oracle model (Theorem 11).

The paper systematically relates these security notions to specific quantum settings:

• Generalizing SEQ: The authors show that SEQ security can be generalized to cover all quantum functionalities in the classical oracle model (Corollary 2).

• Quantum Channel Security: A significant positive result is the demonstration that one-time programs with SEQ security exist for all quantum channels in the classical oracle model. This provides a concrete, achievable benchmark for one-time security against arbitrary quantum processes.

To establish the impossibility results, the paper utilizes specific cryptographic tools:

• Lossy Encryption Scheme: A detailed construction of a statistically lossy Public Key Encryption (PKE) scheme is presented, built from lossy trapdoor functions and pairwise-independent permutations. This scheme serves as the tool used to prove that certain best-possible compilers cannot exist under LWE hardness assumptions (Theorem 13).

• Simulation Security Notions: The paper defines SEQ security (Definition 15) and relates it to other concepts, such as quantum state indistinguishability obfuscation (QSIO). A key negative result shows that the impossibility of a best-possible compiler rules out schemes satisfying a natural definition of QSIO for sampling programs (Corollary 3).

• Estimation Techniques: Supporting theorems related to empirical estimation (e.g.

As a fastidious researcher, I have analyzed this paper, On Best-Possible One-Time Programs, and identified several key theoretical breakthroughs that translate directly into significant improvements for AI systems.

Here are the specific improvements I can suggest for AI systems:

)AI System Improvement 1: Development of Best-Possible Testable Security Primitives

The paper establishes a rigorous security hierarchy culminating in the concept of a best-possible testable one-time program compiler (Definition 16). This is superior to previous notions because it identifies the strongest achievable security guarantee within a restricted, yet practically relevant, class of programs (testable one-time programs).

The improved AI system would be capable of:

1. Scanning its own underlying model (e.g., neural network architecture or learned weights) to identify all possible one-time implementations that could exist for a given functionality.

2. Selecting the obfuscation method that achieves the best-possible security among those programs, rather than settling for weaker, simulation-based ones (like CSEQ).

)AI System Improvement 2: Robust Quantum/Classical Channel Security via SEQ Simulation Security

The paper introduces the generalized Single Effective Query (SEQ) security notion. The paper proves that this notion is achievable for all quantum functionalities in the classical oracle model (Corollary 2), even beyond classical randomized functionalities, using stateful quantum iO.

The improved AI system would be capable of:

1. Integrating a SEQ-secure layer directly into its core inference engine or data handling pipeline.

2. This would allow the AI to perform complex reasoning or decision-making based on a single, highly constrained query to the underlying program (analogous to the SEQ oracle). This constraint ensures that no information is leaked beyond what is necessary for the specific task, even if the internal state evolves during computation (thanks to stateful iO).

)AI System Improvement 3: State-Aware Program Obfuscation for Sequential/Adaptive Tasks

The paper introduces Stateful Quantum Indistinguishability Obfuscation (stateful quantum iO), which is necessary when programs change their behavior after the first query. This addresses the limitation of static obfuscation by allowing for program evolution over time.

The improved AI system would be capable of:

1. Executing long, multi-step reasoning tasks where intermediate results or memory (state) are critical to the final output, and where these internal states change as queries are processed.

2. Using stateful iO to obfuscate this process, ensuring that an adversary cannot distinguish between two functionally equivalent programs that differ only in how they evolve their internal state over a sequence of queries. This is crucial for tasks involving adaptive learning or sequential decision-making (e.g., multi-turn dialogue systems or complex reinforcement learning policies).

)AI System Improvement 4: Post-Quantum Cryptographic Foundation for AI Integrity

The paper constructs statistically/perfectly lossy Public Key Encryption (lossy PKE) schemes based on the hardness of Learning With Errors (LWE) and group actions. This provides a foundation for secure communication and integrity checks.

The improved AI system would be capable of:

1. Implementing cryptographic primitives derived from these LWE-based constructions directly into its training or inference infrastructure.

2. This allows the AI to securely share sensitive model parameters (weights) or verify the integrity of data inputs using a scheme whose security relies on assumptions that are resistant to quantum attacks (post-quantum hardness).

)AI System Improvement 5: Zero-Knowledge Verification for Quantum Functionality Evaluation

The work demonstrates how SEQ security can be used to simulate a simulator, implying that the output can be verified against an ideal query interface. Furthermore, the introduction of testable programs allows for explicit reflection oracles to verify program correctness.

The improved AI system would be capable of:

1. Generating verifiable proofs or signatures for its computations in a way that is robust against cheating, even when the computation is performed by an untrusted environment (the oracle).

2. This capability stems from the ability to use reflection oracles to check if the program state is still functional, ensuring that any claimed output corresponds to a valid execution path.

)AI System Improvement 6: Enhanced Quantum Channel Modeling and Simulation

The paper provides a framework for modeling arbitrary quantum channels using Stinespring dilations and defining simulators that are perfectly indistinguishable from the ideal oracle access (Lemma 10).

The improved AI system would be capable of:

1. Modeling complex, non-unitary physical interactions or data transformations as quantum channels.

2. Simulating the behavior of these complex channels with perfect fidelity, even when the underlying hardware implementation is unknown or untrusted, by leveraging the indistinguishability between ideal oracle access and a testable program simulator (Sim′(P)).

One-time programs (OTPs) aim to let a user evaluate a program on a single input while revealing nothing else. Classical OTPs require hardware. Quantum measurement suggests a physical basis for one-time use, yet deterministic functionalities remain impossible due to gentle-measurement attacks (Broadbent, Gutoski and Stebila, 2013). Recent constructions cover randomized functionalities with high-entropy outputs (Gunn, Movassagh 2025; Gupte et al., 2025), but the strongest achievable security remains unclear. Inspired by classical obfuscation, we ask for a "best-possible" one-time compiler that, for any functionality, leaks the least information compared with any other one-time implementation. We prove that such a generic compiler cannot exist even for classical randomized functionalities assuming. We then identify a natural subclass: testable OTP compilers, which output quantum states augmented with reflection programs for themselves. We formulate a simplified, generalized Single-Effective-Query (SEQ) simulation security notion for quantum channels, using self-adjoint implementations whose behavior under arbitrary quantum interactions depends only on the channel. SEQ security implies best-possible testable one-time security. We construct SEQ-secure OTPs for all quantum functionalities in the classical oracle model, giving the first positive results for arbitrary quantum channels beyond classical randomized functionalities. SEQ security could thus serve as a testable one-time analogue of virtual black-box (VBB) security. Finally, we propose stateful quantum indistinguishability obfuscation (stateful quantum iO): quantum state obfuscation for stateful quantum programs. It implies best-possible testable OTPs and is achievable in the classical oracle model, offering an approach towards best-possible testable OTPs in the plain model.