Keyless secrecy against bounded adversaries

A keyless coding/cryptographic primitive that asks for two guarantees at once—receiver correctness and adversary ignorance unless abortion occurs—is introduced, demonstrating that such security can be achieved without relying on secret keys or computational hardness assumptions. This result is significant because it establishes the first efficient quantum scheme providing both detection and everlasting secrecy against a bounded adversary, a feat previously thought impossible in this setting.

The Core Primitive and Guarantees

The primitive is defined as a (p, q)-tamper detection scheme where the receiver is never fooled into accepting an incorrect message (Detection) and the adversary learns nothing about the message unless the receiver aborts (Everlasting Secrecy). The scheme operates without a shared secret key or computational hardness assumptions. The only restriction placed on the adversary is that their map in Phase 1 must be computed by a circuit of size at most p, while Phase 2 remains unrestricted.

The security is formalized through an experiment involving two phases:

1. Alice encodes a message using an encoder and sends it to Bob.

2. Eve intercepts the codeword and creates a two-part output (bc, e) = f1(pp, c), where f1 is the adversary's map in Phase 1, which is size-bounded by p.

3. Bob decodes bc to get mb; he aborts if mb = ⊥ (Detection).

4. Eve post-processes e to get her candidate guess for m, given by me = f2(pp, e), where f2 is unbounded in Phase 2.

Construction and Efficiency

The construction relies on encoding the k-bit message into n qubits with an expansion factor γ = n/k. The scheme uses a unitary operator U drawn from an approximate unitary t-design for t = poly(n, p). The encoding is defined as:

(EncU (m) = ψm⟩A ⊗ 0⟩B, where ψm⟩ = Um⟩A ⊗ 0⟩B).

The efficiency of the scheme is established by showing that the required size q for the encoder and decoder is polynomial in n and p. The moment order chosen for the unitary design, denoted as l, is set to poly(n, p). This choice ensures that both detection and secrecy are achieved simultaneously against all adversaries of size p.

Detection Guarantee

Detection is guaranteed by bounding the off-diagonal overlap variables Xst for distinct messages s and t. The scheme is ε-relaxed-tamper-detecting against a family FAdv if, for every message m and every channel Φ in FAdv, Pr[m / b ∈ M] ≤ ε. This condition is satisfied when the total contribution of the off-diagonal terms exceeds a threshold related to the required error probability. The analysis shows that for Haar-random U, this probability is bounded by 2−n over the choice of U, provided n is sufficiently large relative to p and FAdv.

Everlasting Secrecy Guarantee

Everlasting secrecy ensures that Eve learns nothing about m unless Bob aborts. This is achieved by bounding the diagonal overlap variables Xss for a fixed message s. The analysis shows that for a fixed phase-1 circuit V in Vp, the accepting-branch vector ws remains close to the message-independent reference vector vr whenever the corresponding quadratic statistic YL(ψs) is small. By applying Markov's inequality at order 2l and using concentration bounds, it is shown that this state remains within a distance η = 2lp2/d of the reference vector with high probability, ensuring everlasting secrecy against arbitrary unbounded post-processing (Phase 2).

Universal Relaxed Tamper Detection

The paper proves the universal relaxed tamper detection problem: for any family FAdv of channels with cardinality FAdv ≤ 2 dα for some constant α < 1, there exists an integer n0 such that for all n ≥ n0, a Haar-random unitary yields a code that is ε-relaxed-tamper-detecting against FAdv with ε = 2−k. This result confirms the conjecture that a cardinality bound alone suffices for universal relaxed detection across arbitrary channel families.

Full Tamper Detection

Full tamper detection requires bounding the diagonal overlap Xss, which depends on structural properties of the channels, specifically their Kraus rank and entanglement fidelity. Theorem 26 establishes that full tamper detection can be obtained against an adversarial family FAdv satisfying cardinality constraints (FAdv ≤ 2 dα) and entanglement fidelity constraints (Fe(Φ) ≤ d−δ). The required expansion factor γ is determined by the parameters α, δ, and δ', showing that for constant parameters, the expansion factor is O(1).

This is a highly sophisticated quantum cryptographic primitive that addresses the fundamental tension between message integrity (detection) and information-theoretic security (secrecy) in a keyless setting, constrained only by a bounded adversary's online computation.

As an AI researcher, I can identify several high-impact improvements to AI systems by leveraging the theoretical guarantees provided by this paper. The core insight is that one can achieve both properties simultaneously without relying on classical secrets or computational hardness assumptions (like factoring).

Here are specific improvements and capabilities for AI systems derived from this research:

)1. Enhanced Robustness Against Quantum Tampering

The paper proves the existence of an efficient, keyless code secure against global quantum tampering, even when the adversary's action is restricted to a polynomial-sized circuit.

• To improve AI systems that rely on quantum computation (e.g., in machine learning models operating on quantum hardware or cryptographic primitives), this primitive allows for everlasting secrecy against any adversary whose tampering mechanism is bounded by a polynomial circuit size, regardless of the complexity of the channel they use in phase 2.

• Specifically, an AI system can utilize this encoding/decoding scheme to transmit critical model weights or inference data. If an external entity attempts to tamper with the transmitted data using a quantum operation restricted by circuit size (e.g., a limited number of non-unitary operations), the receiver is guaranteed to either abort or receive the correct message, and even if they don't abort, they learn nothing about the original message unless the adversary was unbounded in phase 2.

)2. Keyless Secure Data Transmission and Model Distribution

The scheme operates without a shared secret key, making it ideal for decentralized or untrusted environments where key distribution is infeasible or compromised.

• AI models (especially large language models or neural networks) can be distributed across multiple nodes in a network where the communication channel is public and insecure. This primitive ensures that model parameters transmitted between nodes are tamper-evident and secret from any adversary constrained by polynomial computation, fulfilling both detection (integrity) and secrecy (privacy).

)3. Provable Security Guarantees Against Bounded Quantum Attacks

The security is established based on the adversary's online computation being bounded by a polynomial circuit size, which is a much weaker assumption than assuming the hardness of an underlying mathematical problem.

• AI systems can be designed with provable security guarantees against specific classes of quantum attacks (the class of circuits in F1(p)). This allows for designing AI systems that are resilient against adversaries who possess limited computational resources but are capable of performing complex, bounded quantum manipulations.

)4. Universal Tamper Detection Against Arbitrary Channel Families

The research extends the results to show that for certain parameter constraints (cardinality and entanglement fidelity bounds), full tamper detection can be achieved against arbitrary CPTP channel families, removing the need for restrictive assumptions like Kraus rank bounds.

• This capability allows AI systems to operate in environments where the adversary might employ a diverse set of quantum operations (a family of channels). The system can reliably detect any operation from this family that attempts to corrupt the message, provided that each individual operation is sufficiently weak (low entanglement fidelity) or the total number of distinct operations is bounded.

)5. Efficient Implementation for Real-World Systems

The paper demonstrates that these strong security guarantees are achievable with circuits whose size grows polynomially with the required security parameter and message length, making them computationally feasible.

• AI systems can be implemented on hardware where circuit depth and size matter (e.g., near-term quantum computers or specific classical hardware implementations). The construction yields efficient quantum circuits for encoding and decoding, ensuring that the security overhead is manageable in terms of computational resources (size q = poly(n, p)).

In summary, this primitive enables the creation of AI infrastructure—such as secure distributed model training or untrusted data exchange protocols—that provides both absolute integrity (detection) and information-theoretic privacy (secrecy) against adversaries limited by polynomial quantum computation, without requiring any classical secret keys or computational hardness assumptions.