⚛️ quantum physics

Quantum Pessiland

This paper establishes the existence of "Quantum Pessiland," a theoretical world where average-case hardness of $UP \cap coUP$ coexists with the non-existence of almost all quantum cryptographic primitives and sampling-based quantum advantages, thereby demonstrating that non-relativizing techniques are necessary to construct certain quantum primitives from specific complexity assumptions.

Original authors: Boyang Chen, Tomoyuki Morimae, Takashi Yamakawa

Published 2026-09-01

📖 4 min read🧠 Deep dive

CC BY 4.0

Original authors: Boyang Chen, Tomoyuki Morimae, Takashi Yamakawa

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the landscape of modern computing, there is a fundamental tension between the difficulty of solving problems and the possibility of keeping secrets. For decades, scientists have mapped out different "worlds" of computational reality to understand what is possible. One such world, known as Pessiland, is a place where solving complex problems is generally very hard, yet the tools needed to build secure digital locks simply do not exist. In this bleak scenario, even though nature presents difficult puzzles, there is no way to create a one-way function—a mathematical process that is easy to perform but impossible to reverse without a secret key. Because almost all classical encryption relies on these one-way functions, Pessiland is a world where secure communication is impossible, despite the existence of hard problems.

However, the rise of quantum computing has introduced a new layer of complexity. Quantum mechanics allows for strange behaviors, like superposition, where a system can exist in multiple states at once. Researchers have long wondered if this strange physics could rescue cryptography from the bleakness of Pessiland. Could quantum computers create secure systems even when the classical foundations are missing? This question led scientists to ask if there is a quantum version of this miserable world—a place where problems remain hard, but even the most advanced quantum cryptographic tools fail to exist.

A team of researchers has now answered this question with a definitive "yes." They have mathematically constructed a theoretical world they call Quantum Pessiland. In this world, they proved that there are problems that are difficult to solve on average, even for a quantum computer equipped with extra hints known as quantum advice. Yet, in this same world, the fundamental building blocks of quantum security simply cannot be built. Specifically, they showed that in this environment, it is impossible to create certain pairs of quantum states that look different to the eye but are indistinguishable to any efficient computer, a requirement for many quantum encryption schemes. They also demonstrated that a specific type of quantum puzzle, which acts as a digital lock, cannot be created securely against classical attackers.

To reach this conclusion, the researchers did not build a physical machine or run an experiment in a lab. Instead, they constructed a mathematical model using a "oracle," which is essentially a black box that answers specific questions instantly. They designed this black box to contain a collection of random, shuffled lists. In their model, they showed that while a quantum computer could be given a massive amount of pre-computed information to help it solve problems, it would still fail to break the security of these theoretical puzzles. The core of their discovery lies in a new mathematical tool they developed, which they call a "patching lemma." This tool allows them to show that even if an attacker knows a little bit about the secret shuffling inside the black box, they cannot learn enough to break the system, because the remaining unknown parts are so vast and random that any attempt to guess them is futile.

The implications of this finding are profound for the future of quantum security. The researchers proved that in their constructed world, not only do secure quantum locks fail, but the very ability of quantum computers to outperform classical ones in generating random patterns also disappears. In this Quantum Pessiland, quantum computers offer no advantage over classical ones when it comes to sampling random data. This suggests that the existence of secure quantum cryptography is not guaranteed simply by the hardness of mathematical problems. It implies that if we want to build a future with unbreakable quantum encryption, we cannot rely solely on the assumption that some problems are hard to solve; we may need to find a different, more specific foundation for security that does not vanish in this bleak theoretical landscape.

The study also addresses a long-standing open question in the field regarding the relationship between the difficulty of solving problems and the ability to create quantum advantages. By showing that a world can exist where problems are hard but no quantum advantage is possible, the researchers demonstrated that proving the existence of secure quantum systems requires techniques that go beyond standard mathematical models. Their work serves as a cautionary tale: just because a problem is hard does not automatically mean we can build a secure system to protect it. The path to a secure quantum future is more intricate than simply hoping that the math is difficult enough to stop hackers.

Technical Summary: Quantum Pessiland

1. Problem Statement and Motivation

The paper addresses the existence of a "Quantum Pessiland," a theoretical world analogous to the classical "Pessiland" defined by Impagliazzo [Imp95]. In classical Pessiland, problems in NP are hard on average, yet One-Way Functions (OWFs) do not exist. Since almost all classical cryptographic primitives imply OWFs [IL89], Pessiland represents a world where essentially no classical cryptography is possible despite the existence of average-case hard problems.

In the quantum realm, the landscape is different. Recent works [Kre21, MY22, AQY22] have demonstrated that quantum cryptography (e.g., private-key quantum money, secret-key encryption, digital signatures) can exist even in the absence of OWFs, relying instead on weaker primitives such as Pseudorandom State Generators (PRSGs), One-Way State Generators (OWSGs), One-Way Puzzles (OWPuzzs), and EFI pairs (Extremely Far but Indistinguishable pairs).

The central question posed is: Does there exist a world where NP (or a relevant subclass) is hard on average, yet even these weaker quantum cryptographic primitives do not exist? If such a world exists, it would imply that quantum cryptography is not merely a relaxation of classical cryptography but requires fundamentally different hardness assumptions, or perhaps that quantum cryptography is impossible in certain average-case hard settings.

2. Methodology and Technical Overview

The authors construct a relativized world (an oracle separation) to demonstrate the existence of Quantum Pessiland. Their approach adapts and extends the classical construction of Pessiland by Wee [Wee06], which utilized a random permutation oracle and a PSPACE oracle.

2.1 The Oracle Construction

The authors define oracles relative to which their results hold:

Classical Oracle ( $O$ ): Composed of a verification oracle $V^\pi$ $V^{π}$ for a family of uniformly random permutations $\pi = (\pi_1, \pi_2, \dots)$ $π = (π_{1}, π_{2}, \dots)$ and a fixed PSPACE-complete oracle ( $QBF$ $QB F$ ).
- $V^\pi(\ell, u, v) = 1$ if $|u|=|v|=\ell$ and $\pi_\ell(u)=v$ , else $0$.
Quantum Oracle ( $U$ ): For the EFI pair result, they introduce a Helstrom oracle (a unitary oracle) that performs optimal measurements to distinguish between quantum states generated by circuits, alongside the classical oracle $V$ .

2.2 The Core Challenge: Auxiliary Inputs

A significant technical hurdle is ruling out auxiliary-input primitives. In the classical setting, Wee [Wee06] ruled out auxiliary-input OWFs by showing that any polynomial-size circuit could be approximated by an oracle-free circuit if the oracle values on a small set of "heavy" queries were hardwired. However, this technique fails in the quantum setting for two reasons:

Superposition Queries: Quantum algorithms query oracles in superposition, making the classical notion of "heavy queries" (based on the fraction of classical inputs) ill-defined.
Uniformity vs. Non-uniformity: Auxiliary-input quantum primitives are defined against uniform adversaries who receive an infinite set of hard auxiliary inputs. A non-uniform "hardwiring" strategy (advice) is insufficient; the adversary must be broken by a uniform algorithm that learns the necessary information.

2.3 The Patching Lemma (Key Technical Innovation)

To overcome these obstacles, the authors introduce the Patching Lemma (Theorem 5.2). This lemma provides a uniform Quantum Polynomial-Time (QPT) extractor $E$ that, given an auxiliary input $x$ , learns a "patch" $\Gamma$ (a finite set of triples $(\ell, u, v)$ where $V^\pi(\ell, u, v)=1$ ).

Mechanism: The extractor runs the adversary algorithm $A$ up to a random query, measures the query register, and classically checks the oracle $V^\pi$ . If the query is a "positive" (i.e., $V^\pi=1$ ), it is added to the patch.
Exponential Moment Bound: The critical insight is that while a straightforward union bound over all $2^n$ auxiliary inputs would fail, the number of "discoveries" (adding elements to the patch) follows a distribution where the probability of making many discoveries is exponentially small. By bounding the exponential moment of the number of discoveries, the authors show that the expected number of discoveries is linear in the input length ( $O(n)$ ), even for the worst-case input. This allows the patch to be of polynomial size while maintaining indistinguishability for all inputs simultaneously with probability one over the choice of the random permutation $\pi$ .

2.4 Hardness Proofs

Average-Case Hardness: They leverage recent tight bounds on quantum permutation inversion with quantum advice [ABC+26] combined with the Goldreich-Levin theorem [KT24, AC02] to show that inverting the permutation (or solving the associated search problem) remains hard even for QPT algorithms with quantum advice.
Non-Existence of Primitives: Using the Patching Lemma, they show that any candidate auxiliary-input OWPuzz or EFI pair can be "patched" to an oracle-free version (or a version using only the PSPACE/Helstrom oracle). Since the PSPACE/Helstrom oracles allow efficient inversion or distinguishing, the original primitives are broken.

3. Key Results

The paper establishes two main theorems regarding the existence of Quantum Pessiland:

Theorem 1.1 (Classical Oracle)

There exists a classical oracle $O$ relative to which:

Hardness: There is a language $L_O \in UP^O \cap coUP^O$ that is strongly hard on average against QPT algorithms with polynomial-size oracle-dependent quantum advice. (Consequently, $NP \cap coNP$ is also hard).
Search Hardness: There is a total unique search relation $R_O \in TFUP^O$ that is average-case hard against the same class of algorithms.
No Quantum Advantage: $SampBQP^O = SampBPP^O$ . Thus, there is no sampling-based quantum advantage.
No Cryptography: Classically-secure auxiliary-input One-Way Puzzles (OWPuzzs) do not exist.

Theorem 1.2 (Quantum Oracle)

There exists a quantum unitary oracle $U$ and a classical oracle $V$ relative to which:

Hardness: $L_V \in UP^V \cap coUP^V$ and a relation $R_V \in TFUP^V$ are hard on average against QPT algorithms with quantum advice.
No Cryptography: Auxiliary-input EFI pairs do not exist.

Corollaries

Corollary 1.3: Relative to the classical oracle, $PP$ is strongly hard on average against QPT with quantum advice, yet OWPuzzs do not exist. This implies $P^{\#P} \not\subseteq_{i.o.} BQP/qpoly$ .
Corollary 1.4: Relative to the classical oracle, Inefficient-Verifier Proofs of Quantumness (IV-PoQ) do not exist, despite the average-case hardness of $UP \cap coUP$ .

4. Significance and Implications

The paper claims the following significance:

Existence of Quantum Pessiland: It proves that there is a world where average-case hardness exists (specifically for $UP \cap coNP$ ) but no quantum cryptography (neither classical-secure nor quantum-secure variants of OWPuzzs and EFI pairs) is possible. This contrasts with the classical case where the non-existence of OWFs implies the non-existence of all classical cryptography, but here the non-existence of quantum primitives is shown even when $UP \cap coUP$ is hard.
Limits of Quantum Advantage: The result $SampBQP = SampBPP$ in this world indicates that average-case hardness of $UP \cap coUP$ alone is insufficient to guarantee sampling-based quantum advantage.
Separation of Techniques: The paper addresses an open problem regarding the construction of OWPuzzs from $P^{\#P} \not\subseteq_{i.o.} BQP/qpoly$ . Since OWPuzzs do not exist in their oracle world despite this separation holding, the authors conclude that non-relativizing proof techniques are necessary to construct OWPuzzs solely from this complexity-theoretic assumption. This gives a partial negative answer to the open problem posed by Khurana and Tomer [KT25].
Technical Advancement: The Patching Lemma is presented as a uniform, quantum analogue of Wee's approximation lemma, specifically designed to handle uniform adversaries with auxiliary inputs in the presence of superposition queries.

The authors maintain a modest stance, noting that their results are relative to oracles and do not resolve the question of whether such a world exists in the unrelativized (real) world. They emphasize that their work clarifies the separation between average-case hardness and the existence of quantum cryptographic primitives in the relativized setting.