⚛️ quantum physics

Pauli Encodings & Unclonable Encryption

This paper introduces Pauli Encodings as a class of quantum encryption schemes, establishing fundamental limits on their unclonable security through monogamy-of-entanglement bounds and demonstrating that while certain structured families are insecure, specific symmetric configurations achieve strong unclonable-indistinguishable security against bounded-local-dimension adversaries.

Original authors: Pierre Botteron, Sébastien Designolle, Omar Fawzi

Published 2026-07-31

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Pierre Botteron, Sébastien Designolle, Omar Fawzi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where the most valuable secrets aren't locked in a vault, but hidden inside a tiny, fragile particle of light. In our everyday life, if you copy a file, you get two identical files. But in the strange realm of quantum physics, there's a rule called the "no-cloning theorem." It says that if you have a secret quantum state, you can't make a perfect copy of it without destroying the original. This isn't just a physics quirk; it's a superpower for cryptography. It leads to the idea of "unclonable encryption": a way to lock a message so that even if a thief steals the key, they can't split the secret between two friends and have both of them read it. If they try to share the secret, the act of splitting it ruins the message for at least one of them.

The big question scientists have been asking is: Can we actually build such a lock? Specifically, can we encrypt a single bit (a 0 or a 1) into a quantum state so that once the key is revealed, two spies (let's call them Bob and Charlie) cannot both guess the message correctly with high probability? If they could, the encryption would be useless. If they can't, we have a "unclonable bit," a building block for unbreakable quantum money and secure communication. This paper dives deep into a specific type of lock made from "Pauli Encodings," which are like mathematical patterns built from the basic building blocks of quantum mechanics. The authors want to know: How strong are these locks? Can we prove they are unbreakable, or are there cracks in the armor?

The Quantum Locksmiths and Their Pauli Puzzle

In this paper, the authors introduce and study a family of quantum locks called Pauli Encodings. Imagine you have a message (a 0 or a 1) and a key. Instead of a physical key, your key is a specific pattern of quantum "switches" (called Pauli strings). The message is encoded into a quantum state that is a special kind of projector—a mathematical way of saying the state is "aligned" with your key. If you have the right key, you can read the message perfectly. If you don't, it looks like random noise.

The authors' main goal was to test how well these locks hold up against a specific attack: the "Monogamy-of-Entanglement" game. Picture this: A hacker (the pirate) intercepts the quantum message and splits it into two pieces, sending one to Bob and one to Charlie. The hacker doesn't know the key yet. Later, the key is revealed. Bob and Charlie, who can't talk to each other, try to guess the original message. If they both guess correctly, the hacker wins. The paper asks: What is the best chance Bob and Charlie have of winning?

The Good News: A Universal Lower Bound
The authors proved a fundamental limit for any Pauli Encoding. No matter how you arrange your keys, if you have $K$ different keys, Bob and Charlie can always find a strategy to win with a probability of at least $1/2 + 1/(2\sqrt{K})$ .
Think of it like this: If you have a huge number of keys ( $K$ ), the hackers' advantage shrinks, but it never disappears completely. The more keys you use, the harder it is for them, but they always have a slight edge over pure guessing (50%). This result matches a previous guess about a specific type of "anticommuting" lock, suggesting that this type of lock might be the best possible design for a fixed number of keys.

The Bad News: The "Curse of 3/4"
The paper also rules out some easy ways to prove these locks are secure. The authors identified a "curse of 3/4." They showed that if you only look at how well Bob guesses or how well Charlie guesses individually (ignoring that they are working together), you can always find a strategy where they both get it right 75% of the time. This means that simple, pairwise checks aren't enough to prove the lock is truly unclonable. You have to look at the whole three-way relationship (Alice, Bob, and Charlie) to see the real security.

The BB84 Failure
One of the most famous quantum protocols, called BB84, was tested. This protocol uses keys made of just "X" and "Z" switches. The authors proved mathematically that this specific lock is not secure. Even with many qubits, Bob and Charlie can win with a probability of about 0.85 (specifically $\cos^2(\pi/8)$ ). This is a big deal because it shows that just because a protocol is famous or looks natural, it doesn't mean it's unclonable.

The "Anticommuting" Hope
The paper then focuses on a special, inefficient lock where every key "anticommutes" with every other key (they are like magnetic poles that repel each other in a very specific way). This is the lock studied in a previous paper. The authors used advanced computer simulations (called the NPA hierarchy) to test how strong this lock is.

They ran simulations up to a high level of complexity (level 3).
They found that as the number of keys gets huge, the hackers' winning probability seems to drop to a limit of approximately 0.5556.
This is much lower than the 0.85 of the BB84 lock and very close to the theoretical best of 0.5.
However, the authors are careful to note that this is a numerical result from simulations, not a final mathematical proof. They suspect the true limit is even lower (closer to 0.5), but they haven't proven it yet.

Efficient Locks and Bounded Adversaries
Finally, the authors looked at "efficient" locks—ones that don't require a massive number of quantum bits to work. They proved that if the hackers are limited in how much computing power (or "dimension") they have, these efficient locks are very secure. For example, if the hackers' computers can't get too big, the probability of them winning drops to almost zero as the message gets longer. They also showed that while some efficient locks are "indistinguishable" (hard to tell apart), they might not be fully "unclonable" yet, though the evidence points toward them being very strong candidates.

The Takeaway

This paper is a mix of "here is a solid rule," "here is a trap to avoid," and "here is a very promising lead."

The Rule: For any Pauli lock, hackers have a guaranteed minimum success rate of $1/2 + 1/(2\sqrt{K})$ .
The Trap: Don't rely on simple checks; the "curse of 3/4" shows they aren't enough. Also, the famous BB84 lock is definitely not unclonable.
The Lead: The "anticommuting" lock looks incredibly strong, with simulations suggesting hackers can only win about 55.56% of the time in the long run. While not yet a mathematically proven "solved" problem, the numerical evidence is very encouraging, and the authors believe these locks could be the key to future unclonable cryptography.

In short, we now know exactly how weak some locks are, we know a universal floor for how strong they can be, and we have strong computer evidence that a specific, tricky design might be the holy grail of unclonable security.

Technical Summary: Pauli Encodings & Unclonable Encryption

1. Problem Statement

The paper addresses the Unclonable Bit Question, initiated by Gottesman [Got03] and Broadbent and Lord [BL20]. The central problem is determining whether a classical bit $x \in \{0, 1\}$ can be encrypted under a classical key $k$ into a quantum state $\rho_{x|k}$ such that the scheme satisfies:

Correctness: The message can be recovered with probability 1 given the key and ciphertext.
Efficiency: Algorithms run in polynomial time.
Unclonable Security: An adversary, upon receiving the ciphertext, splits it into two non-communicating systems (held by Bob and Charlie). After the key is revealed, Bob and Charlie cannot both recover the message $x$ with probability significantly greater than $1/2$ .

This security notion is formalized as unclonable-indistinguishable security, which implies the existence of an Unclonable Bit. The paper investigates this by analyzing the optimal winning probability of the associated Cloning Game, which is upper-bounded by the winning probability of the Monogamy-of-Entanglement (MoE) game [Tom+13].

2. Methodology

The authors introduce and analyze a broad class of schemes called Pauli Encodings.

2.1 The Scheme Definition

For a set of Pauli strings $\mathcal{K}(n) \subseteq \{I_2, X, Y, Z\}^{\otimes n} \setminus \{I_{2^n}\}$ , the encryption of a bit $x$ under key $P \in \mathcal{K}(n)$ is defined as the normalized projector:
$\rho_{x|P}^{(n)} := \frac{I_{2^n} + (-1)^x P}{2^n}$
The corresponding POVM for decryption is $A_{x|P} = \frac{I_{2^n} + (-1)^x P}{2}$ .

2.2 Analytical Tools

To evaluate security, the paper reduces the cloning problem to the MoE game. The optimal winning probability $P^*(\text{win MoE})$ is analyzed using:

Symmetry Reductions: Exploiting the symmetry of the Pauli group and the specific structure of the encoding sets.
NPA Hierarchy: Utilizing the Navascués-Pironio-Acín (NPA) moment hierarchy to compute upper bounds on the winning probability. The authors perform exact symmetry reductions to solve the hierarchy up to level three for specific families.
Frobenius Norm Arguments: Used to derive bounds against adversaries with bounded local dimensions.
Pairwise Relaxations: Analyzing "pairwise MoE games" to identify limitations of certain proof techniques.

3. Key Contributions and Results

3.1 Universal Lower Bounds

The paper establishes a universal lower bound on the optimal winning probability for any Pauli Encoding with $K$ keys:
$P^*(\text{win MoE}) \geq \frac{1}{2} + \frac{1}{2\sqrt{K}}$
This bound is achieved by an attack targeting a single key and guessing otherwise. The authors refine this for specific structured families:

All Pauli Strings ( $\{I, X, Y, Z\}^{\otimes n}$ ): Lower bound $\approx \frac{1}{2} + \frac{1}{2}(\frac{1+\sqrt{3}}{4})^n$ .
Real Pauli Strings ( $\{I, X, Z\}^{\otimes n}$ ): Lower bound $\approx \frac{1}{2} + \frac{1}{2}(\frac{1+\sqrt{2}}{3})^n$ .
HZH Multiset: Lower bound $\approx \frac{1}{2} + \frac{1}{2}(\frac{1}{2} + \frac{1}{2\sqrt{2}})^n$ .

3.2 No-Go Results and Limitations

The authors identify fundamental limitations in natural approaches to proving unclonable security:

The "Curse of 3/4": They prove that for any correct binary encryption scheme, the optimal winning probability of the pairwise MoE game (averaging marginal guessing probabilities) is at least $3/4$ . This implies that arguments relying solely on pairwise guessing marginals cannot establish strong unclonable-indistinguishable security.
Insecurity of BB84 Encoding: The paper proves that the BB84 encoding (using keys $\{X, Z\}^{\otimes n}$ ) is not weakly unclonable-indistinguishable secure. The optimal winning probability is exactly $\cos^2(\pi/8) = \frac{1}{2} + \frac{1}{2\sqrt{2}} \approx 0.8536$ , which does not vanish as $n \to \infty$ .

3.3 Security Results

Bounded-Dimension Adversaries: For adversaries with local Hilbert space dimensions bounded by $d$ , the winning probability is upper-bounded by $\frac{1}{2} + \frac{d\sqrt{2^n}}{2\sqrt{|K(n)|}}$ . This implies strong security for schemes like $K_{\text{all}}^{(n)}$ against adversaries with dimensions independent of $n$ .
Strong Indistinguishable Security: The paper proves that several efficient families ( $K_{\text{all}}^{(n)}$ , $K_{\text{real}}^{(n)}$ , and specific HZH families) satisfy strong indistinguishable security (a weaker notion than unclonable security). Notably, the BB84 encoding also satisfies strong indistinguishable security despite failing unclonable security, demonstrating a separation between these two notions.
Anticommuting Protocol Analysis: For the inefficient protocol using pairwise anticommuting Pauli strings (studied in [Bot+26]), the authors perform a full symmetry reduction of the NPA hierarchy up to level three. They obtain an asymptotic upper bound of $\omega_3^{(\infty)} \approx 0.5556$ . This improves upon the previous level-one bound of $5/8 = 0.625$ and provides numerical evidence supporting the conjecture that the optimal value is $\frac{1}{2} + \frac{1}{2\sqrt{K}}$ .
Optimality of Anticommuting at Level One: The authors prove that among all Pauli commutation patterns with a fixed number of keys, the anticommuting pattern minimizes the level-one NPA upper bound. Consequently, no level-one analysis can yield an asymptotic upper bound below $5/8$ .

3.4 Efficient Protocols

The paper analyzes several efficient Pauli Encodings (where key generation is polynomial in $n$ ). Numerical evidence from level-one NPA computations suggests that families such as $K_{\text{all}}^{(n)}$ and specific HZH variants are promising candidates for unclonable bits, as their winning probabilities decrease with $n$ .

4. Significance and Claims

The paper claims to generalize the specific anticommuting protocol of [Bot+26] to a broad class of Pauli Encodings, providing a unified framework for analyzing their security.

Theoretical Limits: It establishes the "curse of 3/4" as a fundamental obstruction to proving unclonable security via pairwise marginals, clarifying why certain previous approaches in the literature may have been insufficient.
Refined Bounds: It provides sharper lower and upper bounds for various Pauli families, demonstrating that the anticommuting protocol is likely optimal among Pauli encodings for a fixed number of keys, at least within the constraints of level-one NPA analysis.
Separation of Notions: By showing that BB84 is indistinguishable secure but not unclonable secure, the paper highlights the strictness of the unclonable security definition.
Future Directions: The authors note that while they provide strong evidence for the security of efficient Pauli families, the proof of strong unclonable security for these efficient schemes remains an open problem, which they conjecture holds. They explicitly reference concurrent independent works [AS26; Rag26] that have since established strong security for some of these efficient families.

The work serves as a rigorous analysis of the landscape of Pauli-based unclonable encryption, delineating what is provably insecure, what is conditionally secure, and what remains conjectural.