On Quantum Advantage in Information Theoretic Single-Server PIR

TL;DR

This paper investigates the limits of quantum protocols for private information retrieval, showing that sub-linear communication protocols are insecure under standard models but can be secure under a restricted anchored privacy model.

Contribution

It introduces anchored privacy, a restricted security notion, and proves that sub-linear quantum PIR protocols are insecure in the standard model but secure under this new notion.

Findings

Input purification is the main adversarial strategy.

Sub-linear quantum PIR protocols are insecure in the standard model.

Anchored privacy ensures security for measurement-free protocols.

Abstract

In (single-server) Private Information Retrieval (PIR), a server holds a large database $DB$ of size $n$, and a client holds an index $i \in [n]$ and wishes to retrieve $DB[i]$ without revealing $i$ to the server. It is well known that information theoretic privacy even against an `honest but curious' server requires $\Omega(n)$ communication complexity. This is true even if quantum communication is allowed and is due to the ability of such an adversarial server to execute the protocol on a superposition of databases instead of on a specific database (`input purification attack'). Nevertheless, there have been some proposals of protocols that achieve sub-linear communication and appear to provide some notion of privacy. Most notably, a protocol due to Le Gall (ToC 2012) with communication complexity $O(\sqrt{n})$, and a protocol by Kerenidis et al. (QIC 2016) with communication complexity $O(\log(n))$, and $O(n)$ shared entanglement. We show that, in a sense, input purification is the only potent adversarial strategy, and protocols such as the two protocols above are secure in a restricted variant of the quantum honest but curious (a.k.a specious) model. More explicitly, we propose a restricted privacy notion called \emph{anchored privacy}, where the adversary is forced to execute on a classical database (i.e. the execution is anchored to a classical database). We show that for measurement-free protocols, anchored security against honest adversarial servers implies anchored privacy even against specious adversaries. Finally, we prove that even with (unlimited) pre-shared entanglement it is impossible to achieve security in the standard specious model with sub-linear communication, thus further substantiating the necessity of our relaxation. This lower bound may be of independent interest (in particular recalling that PIR is a special case of Fully Homomorphic Encryption).

Equations

$${\rho }_t({\rho }_{in}):=({\mathcal{A}}_{(t+1)/2}\otimes I_{{\mathcal{B}}_{(t-1)/2}})\dots ({\mathcal{B}}_1\otimes I_{{\mathcal{A}}_1})({\mathcal{A}}_1\otimes I_{{\mathcal{B}}_0,{\mathcal{B}}_p})({\rho }_{in}\otimes {\rho }_{joint}),$$

$${\rho }_t({\rho }_{in}):=({\mathcal{B}}_{t/2}\otimes I_{{\mathcal{A}}_{t/2}})\dots ({\mathcal{B}}_1\otimes I_{{\mathcal{A}}_1})({\mathcal{A}}_1\otimes I_{{\mathcal{B}}_0,{\mathcal{B}}_p})({\rho }_{in}\otimes {\rho }_{joint}),$$

$$\sum _{t=1}^s\log \dim ({\mathcal{X}}_t)+\sum _{t=1}^{s-1}\log \dim ({\mathcal{Y}}_t).$$

$$\Delta \left(\left({\mathcal{F}}_t\otimes I_{{\mathcal{B}}_t,\mathcal{R}}\right)\left({\tilde{\rho }}_t(\tilde{\mathcal{A}},{\rho }_{in})\right),{\rho }_t\left({\rho }_{in}\right)\right)\le \gamma .$$

$$\mathrm{Pr}\left\{\mathcal{M}\left({\text{tr}}_{{\mathcal{A}}_s}\left[\mathcal{A}⊛\mathcal{B}\right]({\rho }_{in})\right)=x_i\right\}\ge 1-\delta .$$

$$\Delta \left({\text{tr}}_{{\mathcal{B}}_0}\left({\mathcal{I}}_t\otimes {\mathbb{I}}_{{\mathcal{B}}_0,\mathcal{R}}({\rho }_{in})\right),{\text{tr}}_{{\mathcal{B}}_t}({\tilde{\rho }}_{2t}(\tilde{\mathcal{A}},{\rho }_{in}))\right)\le ϵ.$$

$$\left(1-H\left(1-\delta -2\sqrt{ϵ(2-ϵ)}\right)\right)n.$$

$$|{\psi }_t^{{\rho }_{in}}⟩⟨{\psi }_t^{{\rho }_{in}}|={\rho }_t({\rho }_{in})$$

$$|{\tilde{\psi }}_t^{{\rho }_{in}}⟩⟨{\tilde{\psi }}_t^{{\rho }_{in}}|={\tilde{\rho }}_t\left(\tilde{\mathcal{A}},{\rho }_{in}\right)$$

$$\Delta \left({\text{tr}}_{{\mathcal{S}}^{\prime }}\left(\left({\hat{\mathcal{F}}}_{2t}\otimes {\mathbb{I}}_{\mathcal{C}}\right)|{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}⟩\right),|{\psi }_{2t}^{|x_0⟩\otimes |0⟩}⟩\right)\le \gamma$$

$$\Delta \left(\left({\hat{\mathcal{F}}}_{2t}\otimes \mathbb{I}\right)|{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}⟩,|{\sigma }_{x_0,0}⟩\otimes |{\psi }_{2t}^{|x_0⟩\otimes |0⟩}⟩\right)\le \sqrt{\gamma }$$

$$\Delta \left(|{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}⟩,\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes \mathbb{I}\right)\left(|{\sigma }_{x_0,0}⟩\otimes |{\psi }_{2t}^{|x_0⟩\otimes |0⟩}⟩\right)\right)\le \sqrt{\gamma }$$

$$\Delta \left({\text{tr}}_{{\mathcal{B}}_0,{\mathcal{B}}_p}\left(\left({\mathcal{I}}_t\otimes {\mathbb{I}}_{{\mathcal{B}}_0,{\mathcal{B}}_p}\right)\circ \left(|x⟩⟨x{|}_{{\mathcal{A}}_0}\otimes |\alpha ⟩⟨\alpha {|}_{\mathcal{R},{\mathcal{B}}_0}\otimes {\rho }_{joint}\right)\right),{\text{tr}}_{{\mathcal{B}}_t}\left(|{\psi }_{2t}^{|x⟩\otimes |\alpha ⟩}⟩\right)\right)\le ϵ$$

$${\tilde{\mathcal{I}}}_t^{x_0,0}(\cdot )={\hat{\mathcal{F}}}_{2t}^{†}\circ \left(|{\sigma }_{x_0,0}⟩⟨{\sigma }_{x_0,0}|\otimes {\mathcal{I}}_t\left(\cdot \right)\right)$$

$$\Delta \left(t{r}_{{\mathcal{B}}_0,{\mathcal{B}}_p}\left(\left({\tilde{\mathcal{I}}}_t^{x_0,0}\otimes {\mathbb{I}}_{{\mathcal{B}}_0,{\mathcal{B}}_p}\right)\circ \left(|x_0⟩⟨x_0{|}_{{\mathcal{A}}_0}\otimes |0⟩⟨0{|}_{{\mathcal{B}}_0}\otimes {\rho }_{joint}\right)\right),{\text{tr}}_{{\mathcal{B}}_t}\left(|{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}⟩\right)\right)\le ϵ+\sqrt{\gamma }$$

$${\tilde{\mathcal{I}}}_t(\cdot )={\tilde{\mathcal{I}}}_t^{x_0,0}(\cdot );$$

$$|x{\alpha }_{+}⟩=\frac{1}{\sqrt{2}}|0{⟩}_{{\mathcal{R}}^{\prime }}|x_0{⟩}_{{\mathcal{A}}_0}|0{⟩}_{{\mathcal{B}}_0,\mathcal{R}}+\frac{1}{\sqrt{2}}|1{⟩}_{{\mathcal{R}}^{\prime }}|x{⟩}_{{\mathcal{A}}_0}|\alpha {⟩}_{{\mathcal{B}}_0,\mathcal{R}},$$

$$\Delta \left(|{\tilde{\psi }}_{2t}^{|x{\alpha }_{+}⟩}⟩,\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes \mathbb{I}\right)\left(|{\sigma }_{x{\alpha }_{+}}⟩\otimes |{\psi }_{2t}^{|x{\alpha }_{+}⟩}⟩\right)\right)\le \sqrt{\gamma }$$

$$|{\psi }_{2t}^{|x{\alpha }_{+}⟩}⟩=\frac{1}{\sqrt{2}}|0{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\psi }_{2t}^{|x_0⟩\otimes |0⟩}{⟩}_{\mathcal{S},\mathcal{C},\mathcal{R}}+\frac{1}{\sqrt{2}}|1{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\psi }_{2t}^{|x⟩\otimes |\alpha ⟩}{⟩}_{\mathcal{S},\mathcal{C},\mathcal{R}}$$

$$|{\tilde{\psi }}_{2t}^{|x{\alpha }_{+}⟩}⟩=\frac{1}{\sqrt{2}}|0{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}{⟩}_{\mathcal{S},\mathcal{C},\mathcal{R}}+\frac{1}{\sqrt{2}}|1{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\tilde{\psi }}_{2t}^{|x⟩\otimes |\alpha ⟩}{⟩}_{{\mathcal{S}}^{\prime },\mathcal{S},\mathcal{C},\mathcal{R}}$$

$$\Delta \left(\frac{1}{\sqrt{2}}|1{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\tilde{\psi }}_{2t}^{|x⟩\otimes |\alpha ⟩}{⟩}_{\mathcal{S},\mathcal{C}},\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes {\mathbb{I}}_{\mathcal{R},\mathcal{C}}\right)\left(\frac{1}{\sqrt{2}}|1{⟩}_{{\mathcal{R}}^{\prime }}\otimes |{\sigma }_{x,{\alpha }_{+}}{⟩}_{{\mathcal{S}}^{\prime }}\otimes |{\psi }_{2t}^{|x⟩\otimes |\alpha ⟩}{⟩}_{\mathcal{S},\mathcal{C}}\right)\right)\le \sqrt{\gamma }$$

$$\Delta \left(|{\tilde{\psi }}_{2t}^{|x⟩\otimes |\alpha ⟩}⟩,\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes \mathbb{I}\right)\left(|{\sigma }_{x{\alpha }_{+}}⟩\otimes |{\psi }_{2t}^{|x⟩\otimes |\alpha ⟩}⟩\right)\right)\le \sqrt{2\gamma }$$

$$\Delta \left(|{\tilde{\psi }}_{2t}^{|x_0⟩\otimes |0⟩}⟩,\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes \mathbb{I}\right)\left(|{\sigma }_{x{\alpha }_{+}}⟩\otimes |{\psi }_{2t}^{|x_0⟩\otimes |0⟩}⟩\right)\right)\le \sqrt{2\gamma }$$

$$\Delta \left(|{\sigma }_{x_0,0}⟩,|{\sigma }_{x{\alpha }_{+}}⟩\right)\le 2\sqrt{2\gamma }$$

$$\Delta \left(|{\tilde{\psi }}_{2t}^{|x⟩\otimes |\alpha ⟩}⟩,\left({\hat{\mathcal{F}}}_{2t}^{†}\otimes \mathbb{I}\right)\left(|{\sigma }_{x_0,0}⟩\otimes |{\psi }_{2t}^{|x⟩\otimes |\alpha ⟩}⟩\right)\right)\le 3\sqrt{2\gamma }$$

$$\Delta \left({\text{tr}}_{{\mathcal{B}}_0}\left(\left({\tilde{\mathcal{I}}}_t\otimes \mathbb{I}\right)\left(|x⟩⟨x|\otimes |\alpha ⟩⟨\alpha |\otimes {\rho }_{joint}\right)\right),{\text{tr}}_{{\mathcal{B}}_t}\left(|{\tilde{\psi }}_t^{|x⟩\otimes |\alpha ⟩}⟩\right)\right)\le ϵ+3\sqrt{2\gamma }.$$

$$H_{\min }(A|B{)}_{\rho }=-\underset{{\sigma }_B}{\inf }\left\{\inf \left\{\lambda \in \mathbb{R}:{\rho }_{AB}\le 2^{\lambda }{I}_A\otimes {\sigma }_B\right\}\right\}.$$

$$H_{\min }(A|B_s{)}_{\sigma }\ge H_{\min }(A|B{)}_{\rho }-\min \{m_A+m_B,2m_A\},$$

$$\text{tr}\left(\Lambda \rho \right)\ge 1-ϵ.$$

$$||\tilde{\rho }-\rho |{|}_{\text{tr}}\le \sqrt{ϵ}.$$

Full text

We show that, in a sense, input purification is the only potent adversarial strategy, and protocols such as the two protocols above are secure in a restricted variant of the quantum honest but curious (a.k.a specious) model. More explicitly, we propose a restricted privacy notion called anchored privacy, where the adversary is forced to execute on a classical database (i.e. the execution is anchored to a classical database). We show that for measurement-free protocols, anchored security against honest adversarial servers implies anchored privacy even against specious adversaries.

Finally, we prove that even with (unlimited) pre-shared entanglement it is impossible to achieve security in the standard specious model with sub-linear communication, thus further substantiating the necessity of our relaxation. This lower bound may be of independent interest (in particular recalling that PIR is a special case of Fully Homomorphic Encryption).

1 Introduction

Private Information Retrieval (PIR), introduced by Chor et al. [CGKS95], is perhaps the most basic form of joint computation with privacy guarantee. PIR is concerned with privately retrieving an entry from a database, without revealing which entry has been accessed. Formally, a PIR protocol is a communication protocol between two parties, a server holding a large database ${\mathtt{DB}}$ containing ${n}$ binary entries111Throughout this work we will focus on the setting of binary database. We do note that there is vast literature concerned with optimizations for the case of larger alphabet., and a client who wishes to retrieve the $i$th element of the database but without revealing the index $i$. Privacy can be defined using standard cryptographic notions such as indistinguishability or simulation (see [Gol04]). The simplicity of this primitive is since there is no privacy requirement for the database (i.e. we allow sending more information than necessary) and that the server is not required to produce any output in the end of the interaction, so functionality and privacy are one sided.

Clearly PIR is achievable by sending all of ${\mathtt{DB}}$ to the client. This will have communication complexity ${n}$ and will be perfectly private under any plausible definition since the client sends no information. The absolute optimal result one could hope for is a protocol with logarithmic communication, matching the most communication efficient protocol without privacy constraints, in which the client sends the index $i$ to the server and receives ${\mathtt{DB}}[i]$ in response.

Alas, [CGKS95] proved that linear (in ${n}$) communication complexity is necessary for PIR, and that this is the case even in the presence of arbitrary setup information.222Setup refers to any information that is provided to the parties prior to the execution of the protocol by a trusted entity, but crucially one that does not depend on the parties’ inputs. Shared randomness or shared entanglement are common examples. Despite its pessimistic outlook, this lower-bound served (already in [CGKS95] itself) as starting point to two extremely prolific and influential lines of research, showing that the communication complexity can be vastly improved if we place some restrictions on the server. The first considered multiple non-interacting servers (see, e.g., [Efr12, DG15] and references therein), instead of just a single server, and the second considered computationally bounded servers and relying on cryptographic assumptions (see, e.g., [CMS99, Gen09, BV11]).

While our discussion so far referred to protocols executed by classical parties over classical communication channels, the focus of this work is on the quantum setting, where there is a quantum communication channel between the client and server, and where the parties themselves are capable of performing quantum operations. Importantly, we still only require functionality for a classical database and a classical index.

One could hope that introducing quantum channels could allow an information theoretic solution to a problem that classically can only be solved using cryptographic assumptions, as has been the case for quantum key distribution [BB84], quantum money [Wie83], quantum digital signatures [GC01], quantum coin-flipping  [Moc07, CK09, ACG*+*16] and more [BS16]. Indeed, the notion of Quantum PIR (or QPIR) is quite a natural extension of its classical counterpart and has also been extensively studied in the literature. Nayak’s famous result on the impossibility of random access codes [Nay99] implies a linear lower bound for non-interactive protocols (ones that consists of only a single message from the server to the client), and implicitly, via extension of the same methods, also for multi-round protocols. Formal variants of this lower bound were proven also by Jain, Radhakrishnan and Sen [JRS09] (in terms of quantum mutual information) and by Baumeler and Broadbent [BB15]. Indeed, one could trace back all of these results to the notion of adversary purification which was used to show the impossibility of various cryptographic tasks in the information-theoretic quantum model starting as early as [Lo97, LC97, May97]. In the context of QPIR, it can be shown that executing a QPIR protocol with sub-linear communication on a superposition of databases instead of on a single database, will leave the server at the end of the execution with a state that reveals some information about the index $i$. This is made explicit in [JRS09, Section 3.1] and is also implicit in the proof of [BB15].

Most relevant to our work is the aforementioned [BB15], which provides an analysis from a cryptographic perspective and considers a well defined adversarial model known as privacy against specious adversaries, or the specious model for short. This adversarial model was introduced by Dupuis, Nielsen and Salvail [DNS10] as a quantum counterpart to the classical notion of honest but curious (a.k.a semi-honest) adversaries.333As [DNS10] point out, their model is stronger, i.e. excludes a larger class of attacks, compared to the honest but curious model, even when restricted to a completely classical setting. A specious adversary can be thought of as one that contains, as a part of its local state, a sub-state which is indistinguishable from that of the respective honest party, even when inspected jointly with the other party’s local state.444More accurately, indistinguishability is required to hold even in the presence of an environment which can be arbitrary correlated (or entangled) with the parties’ inputs. In the quantum setting this usually corresponds to the environment.

Let us provide a high level description of the specious model. We provide a general outline for two-party protocols, and not one that is specific to QPIR. Consider a protocol executed between parties $A,B$ on input registers $X,Y$ respectively. Let $A,B$ also denote the local state of the parties at a given point in time. Then the state of an honest execution of the protocol on inputs $XY$ can be described by the joint density matrix of the registers $XABY$. A specious adversarial strategy for party $A$ can be thought of as one where at any point in time, the local state of the adversary is of the form $A^{\prime}XA$ (i.e. the adversary is allowed to maintain additional information, possibly in superposition with other parts of the system), such that the reduced density matrix of $XABY$ is still indistinguishable from the one obtained in an honest execution. This provides a potential advantage to a specious adversary (compared to an honest $A$) since it is quite possible that together with $A^{\prime}$, the joint state is no longer honest. Thus the local view of the adversary, i.e. the registers $A^{\prime}XA$, might in fact reveal information about $B$’s input $Y$ that was supposed to have been kept private.

In the QPIR setting, say taking $A$ to be the server and $B$ to be the client, the register $X$ holds the database ${\mathtt{DB}}$, and $Y$ holds the index $i$. Indeed, [BB15] shows that it is sufficient that $A^{\prime}$ contains a purification of $XA$, where $X$ is a uniform distribution over all databases. We call this the purification attack. Thus, while the adversary pretends to execute the protocol on a randomly sampled database, it is in fact executed on a superposition of all possible databases at the same time (indeed this is the case since $A^{\prime}$ contains a purification of $X$). As explained above, this methodology is not new, but [BB15] analyze and show that no meaningful notion of QPIR can be achieved against this class of adversaries.

While the negative results could leave us pessimistic as to the abilities of quantum techniques to improve the state of the art on single-server PIR, there is some optimism suggested by two works. Le Gall [LG12] proposed a protocol with sub-linear communication (specifically $O(\sqrt{{n}})$). Kerenidis et al. [KLGR16] proposed two protocols – an explicit one, with $O(\log{n})$ communication, which requires linear pre-shared entanglement; and a second protocol, with poly-logarithmic communication (and does not require pre-shared entanglement). In terms of privacy, it is shown that in a perfectly honest execution of the protocol, client’s privacy is preserved. It might not be immediately clear how to translate this proof of privacy to the existing security models and reconcile it with the negative results. It is explained in [LG12] that the protocol is not actually secure if the server deviates from the protocol. However, as [BB15] observed, even a specious attacker that purifies the adversary can violate the security of the protocol, and the privacy proof strongly hinges on the honest execution using a classical database.

Challenges.

The state of affairs prior to this work, was that (non-trivial) QPIR was proven impossible even against fairly weak adversaries (namely, specious). Nevertheless, it appears that [LG12, KLGR16] achieve some non-trivial privacy guarantee using sub-linear communication. This privacy guarantee appears not to be captured by the existing security model. Lastly, we notice that all existing negative results are proven in a standalone model and did not consider protocols where the parties are allowed to share (honestly generated) setup information, such as the one by Kerenidis et al. [KLGR16]. In the quantum setting, a natural question is whether shared entanglement can help in achieving a stronger result.555We note that to the best of our understanding, even prior “entropic” results such as [JRS09] seem to fall short of capturing the potential additional power of shared entanglement. This is essentially due to the property that if $AB$ are entangled, then it is possible that the reduced state of $B$ will have (much) higher von Neumann entropy than the joint $AB$ (whose entropy might even be [math]). The goal of this work is to address these challenges.

1.1 Our Results

Anchored Privacy.

We start by formalizing a refinement of the standard notion of quantum privacy - one where the adversary is not allowed to purify its input register. We show anchored privacy against specious adversaries follows from anchored privacy against an honest party, if the protocol itself does not require parties to perform measurements (i.e. is measurement-free). Formally, using our notation from above, privacy in our model is only required to hold if the reduced density matrix of the register $X$ is a standard basis element, i.e. a fixed classical value. We call our model anchored privacy as we can view our adversary as anchored to a specific value for its input $X$.

We observe that Le Gall’s $O(\sqrt{n})$ protocol [LG12] and the two protocols mentioned above by Kerenidis et al. [KLGR16] are in fact private against honest servers. We prove that explicitly for the pre-shared entanglement protocol by Kerinidis et al. in Appendix B. Using our reduction we can deduce that these protocol are also anchored private against specious adversaries, namely that so long as the adversary does not attempt to execute the protocol on a superposition of databases (and is still specious in the manner explained above), privacy is guaranteed. In a sense, we formalize the folklore reliance on input purification to attack cryptographic schemes (and QPIR in particular), and show that in a model where input purification is impossible or prevented via some external restriction, it is possible to achieve security against specious adversaries.

We believe this model is interesting for three main reasons:

Conceptually, this model helps clarify the exact reason for the impossibility of QPIR - it is precisely because of the purification attack. Indeed, there is a formal sense in which some anchoring is necessary since we know that for any proposed protocol, allowing to execute on a superposition of inputs allows to violate security – see the preceeding discussion in Section 1. 2. 2.

We view the anchored specious model as a stepping stone towards more robust notions. One intriguing future direction (mentioned briefly in our list of open problems) is to try to develop a malicious analog that still implements the ideology of “forbidden input purification”, e.g. by forcing the adversary to “classically open” the database before or after the execution in a manner that is consistent with the client’s output. Another interesting direction is to try to enforce anchoring using a two-server setting, thus achieving logarithmic two-server QPIR (which is currently still beyond reach). 3. 3.

We believe that our new model may be plausible in certain situations where one could certify that the server cannot employ a superposition on databases. We note that this model can be externally enforced, e.g. by conducting an inspection of the server’s local computation device (with a very low probability) and making sure that it complies, and otherwise apply a heavy penalty. One could imagine such an inspection verifying that a copy of the database is stored on a macroscopic device that cannot be placed in superposition using available technology. Another example of a setting where the anchored model could be applicable is when the database contains information with some semantic meaning, so that the client can easily notice when a nonsense value has been used (this is somewhat similar to the setting considered in [GLM08]). We recall that semi-honest protocols are often used as building blocks, with additional external mechanisms that are employed to validate the assumptions of the model, and hope that our model can also be used in this way. Lastly, from a purely scientific perspective, we believe that formalizing and pinpointing a non-trivial model where non-trivial QPIR is possible will allow to better understand this primitive and the relation between quantum privacy and its classical counterpart.

Improved Lower Bound.

It would be instrumental to understand why the known QPIR lower bounds do not apply to our logarithmic protocol described above. Specifically, the protocol makes use of setup (pre-shared entanglement), and one could wonder whether this is the source of improvement, and perhaps with pre-shared entanglement it is possible to prove security even in the standard specious model. We show that this is not the case by providing a lower bound in the specious model even for the one-sided communication from the server to the client. Namely, we show that linear communication from the server to the client is necessary even if we allow arbitrary communication from the client to the server. In particular, this rules out the ability to use the setup to circumvent the lower bound, since the client (which is assumed to be honest) can generate the setup locally, and send the server’s share across the channel at the beginning of the protocol. This completes the picture in terms of the impossibility of QPIR in the specious model and further justifies our relaxation of the model in order to achieve meaningful results.

Noting that PIR can be thought of as a special case of Fully Homomorphic Encryption (FHE), our lower bound implies that even a Quantum Fully Homomorphic Encryption (QFHE) with (even approximate) information theoretic security cannot have non-trivial communication complexity, even if the QFHE protocol is allowed to make use of shared entanglement between the server and the client. We thus generalize (to allow shared prior entanglement) the impossibility results for (even imperfect) QPIR of [BB15] (as well as those of [YPF14] which explicitly referred to QFHE).

1.2 Overview of Our Techniques

Anchored-Specious Security.

Recall the notation introduced above for two party protocol $(A,B)$ on inputs $(X,Y)$, and recall that a specious adversary can be thought of as one where the local state of the adversary is of the form $A^{\prime}XA$. Now let us consider the case of measurement-free protocols and also assume that the client’s input $Y$ is a pure state (this can be justified since otherwise we can apply our argument on the joint state of $Y$ and its purifying environment instead of $Y$ itself). In such an execution, it holds that at any stage $XABY$ is a pure superposition (i.e. its density matrix is of rank $1$). Now let us consider the joint state together with the specious adversary’s additional register, i.e. $A^{\prime}XABY$. Since $(XABY)$ is pure, $A^{\prime}$ cannot be entangled with it, and therefore $A^{\prime}$ is in tensor product with the remainder of the state, namely $(XABY)$. It follows that the status of the register $A^{\prime}$ can be simulated at any point in time without any knowledge of the other components of the protocol. There is a delicate point here, since $A^{\prime}$ may indeed be in tensor product, but we must also argue that it is independent of $Y$. Intuitively, to see why such dependence on $Y$ cannot occur consider, e.g., $Y=|{y_{1}}\rangle+|{y_{2}}\rangle$. Then $YA^{\prime}$ is in the sate $|{y_{1}}\rangle\otimes\rho_{A^{\prime}}+|{y_{2}}\rangle\otimes\rho_{A^{\prime}}$ (importantly the same $\rho_{A^{\prime}}$ appears twice). However, this state is exactly the purification of executing the protocol either with $Y=|{y_{1}}\rangle$ or with $Y=|{y_{2}}\rangle$. We conclude that $\rho_{A^{\prime}}$ must be the same in both settings, and by extension it can be shown to be the same for all $Y$.

After taking care of $A^{\prime}$, we need to consider the other part of the adversary’s state, namely the register $(XA)$. This register is, by definition, identical (or indistinguishable) from the state of an honest party during the execution. Recall that we assume our protocol is anchored private against honest servers. So the local honest state $(XA)$ is guaranteed not to leak information about $B$’s input. Add to that the conclusion about $A^{\prime}$ being in tensor product and independent of $B$’s state, and we get that the entire local state of the specious adversary does not reveal any disallowed information.

As a conclusion, since we can show, e.g. in Le Gall’s protocol or in our logarithmic protocol, that an honest execution with a classical $X$ does not leak information about $Y$, this will also be the case in the anchored-specious setting.

Obviously many details are omitted from this high level overview. For example, a specious adversary is not required to make $(XABY)$ identical to an honest execution but rather only statistically close (in trace distance), which requires a more delicate analysis. Furthermore, the formal construction of a simulator for the adversary as required by the specious definition requires some care to detail. For the formal definitions and analysis see Section 3 below.

Our Lower Bound.

We first note that previous lower bound proofs in [Nay99, BB15] bounded the total communication complexity by a reduction to quantum random access codes. It is not a-priori clear how to generalize this proof method to the presence of shared entanglement. To do so, we provide a new lower bound argument that establishes a linear lower bound on the server’s communication complexity. Specifically, we show that the server needs to transmit at least roughly $n/2$ qubits to the client, no matter how many qubits is transmitted from the client to the server (assuming that the protocol has sufficiently small correctness and privacy error). As we mentioned above, such a lower bound trivially extends to hold with prior shared entanglement, since one can think of that the shared entanglement is established by the client sending messages to the server.

Our new lower bound argument is based on an interactive leakage chain rule in [LC18] and might even be considered conceptually simpler than previous methods. At a high level, we consider a server holding a uniformly random database $\mathbf{{a}}\in\{0,1\}^{n}$ and running a QPIR protocol with a client. Initially, from the client’s point of view, the database $\mathbf{{a}}$ has $n$-bits of min-entropy, and the protocol execution can be viewed as an “interactive leakage” that leaks information about $\mathbf{{a}}$ to the client. Let $m_{A}$ and $m_{B}$ denote the server and the client’s communication complexity in the protocol. The interactive leakage chain rule in [LC18] states that the min-entropy of $\mathbf{{a}}$ can only be decreased by at most $\min\{2m_{A},m_{A}+m_{B}\}$. More precisely, let $\rho_{AB}$ denote the states at the end of the protocol execution where the $A$ register stores the (classical) random database $\mathbf{{a}}$ and $B$ denotes the client’s local register. The interactive leakage chain rule states that $H_{\min}(A|B)_{\rho}\geq n-\min\{2m_{A},m_{A}+m_{B}\}$. By the operational meaning of quantum min-entropy, given the client’s state $\rho_{B}$, one cannot predict the database correctly with probability higher than $2^{-(n-\min\{2m_{A},m_{A}+m_{B}\})}$. On the other hand, suppose the protocol is secure against specious servers with sufficiently small correctness and privacy error. We can combine the by-now standard lower bound argument by Lo [Lo97] and gentle measurement[Win99, Aar04, ON07], we show that one can reconstruct the database $\mathbf{{a}}$ from the client’s state $\rho_{B}$ with a constant probability. Combining both claims allows us to establish lower bounds on both the server’s and the total communication complexity in a unified way.

1.3 Remaining Open Problems

We proposed a new model and a new protocol which, we believe, resurfaces the question of what can be achieved in the context of QPIR. We believe that a number of intriguing questions still remain for future work.

As discussed above, our model is a relaxation of the specious model, which is by itself a semi-honest model. Such models are fairly restrictive in the sense that they make structural assumptions on the adversary (i.e. that it follows the protocol, or contains a part that follows the protocol). Obviously, if we hope for non-trivial results, any model that we formalize must preclude purification of input. It is thus an intriguing question whether it is possible to formulate malicious adversarial models that are still purification-free, and what can be said about the plausibility of QPIR in such models. The current definition of anchored privacy will need to be amended, since a malicious server is allowed to just ignore its prescribed input, so a different method of anchoring needs to be devised. 2. 2.

Another natural question is whether setup is necessary to achieve logarithmic QPIR in the anchored specious model. We know from Kerenidis et al.’s result that polylogarithmic communication is achievable even without setup. Is there a reason can only improve it when assuming a setup? Another surprising aspect is that the shared entanglement created during the setup is not consumed during the protocol, and can be used for other needs after the execution of the protocol (e.g., running another execution of PIR, or teleportation). A similar phenomenon occurs in quantum information: catalyst quantum states are useful for mapping one bi-partite state to another using LOCC, without consuming the catalyst state [JP99, Kli07]. The related notion of quantum embezzlement [vDH03] has a similar property, but in this case, the original shared state changes slightly. The authors are not aware of any other cryptographic protocol with this non-consumption property. 3. 3.

Most state of the art classical PIR protocols (both in the multi-server setting and in the computational cryptographic setting) only require one round of communication. That is, one message (query) from the client to the server (or servers) and one response message. All the existing sublinear QPIR protocols have multiple rounds. Understanding the round complexity of QPIR in light of the classical state of the art is also an intriguing direction. 4. 4.

A main contribution of this work is to formalize the notion of anchored security and show it can be used to provide a non-trivial cryptographic primitive. It would be interesting to study the relevance of this notion (or adequately adapted versions) in the context of a variety of other cryptographic tasks. In particular, the question of whether it is possible to construct information theoretically secure fully homomorphic encryption (FHE) given quantum channels has received attention in recent years (see, e.g., [YPF14]). In homomorphic encryption, the server has a function $f$ and the client has an input $x$, and the goal of the protocol is for the client to learn $f(x)$ without revealing any information about $x$. PIR and FHE functionalities are intimately related (think about a function $f_{{\mathtt{DB}}}(i)={\mathtt{DB}}[i]$ for FHE, and about executing PIR with database equal to the truth table of some function), and it is thus intriguing whether the anchored model is applicable in the context of FHE as well.

1.4 Paper Organization

General preliminaries are provided in Section 2. We present our new model, and the proof that for pure protocols honest security implies anchored specious security in Section 3. Our new lower bound is stated and proven in Section 4. In Appendix B, we show that the protocol by Kerenidis et al. is anchored private against specious adversaries.

2 Preliminaries

Standard preliminaries regarding Hilbert spaces and quantum states can be found in Appendix A. We provide below background and definitions concerning two-party quantum protocols, specious adversaries and quantum private information retrieval.

2.1 Two-Party Quantum Protocols

As in [BB15], we base our definitions on the works of [GW07] and [DNS10]. However, we make slight adaptations to allow for prior entanglement between the parties.

Definition 2.1** (Two-party quantum protocol).**

An s-round, two-party quantum protocol, denoted $\Pi=\{\mathscr{A,B},\rho_{joint},s\}$ consists of:

input spaces $\mathcal{A}_{0}$ and $\mathcal{B}_{0}$ for parties $\mathscr{A}$ and $\mathscr{B}$ respectively, 2. 2.

initial spaces $\mathcal{A}_{p}$ and $\mathcal{B}_{p}$ ($p$ for pre-shared state) for parties $\mathscr{A}$ and $\mathscr{B}$ respectively, 3. 3.

a joint initial state $\rho_{joint}\in\mathcal{A}_{p}\otimes\mathcal{B}_{p}$, split between the two parties, 4. 4.

memory spaces $\mathcal{A}_{1},\dots,\mathcal{A}_{s}$ for $\mathscr{A}$ and $\mathcal{B}_{1},\dots,\mathcal{B}_{s}$ for $\mathscr{B}$, and communication spaces $\mathcal{X}_{1},\dots,\mathcal{X}_{s}$, $\mathcal{Y}_{1},\dots,\mathcal{Y}_{s-1}$, 5. 5.

an $s$-tuple of quantum operations $(\mathscr{A}_{1},\dots,\mathscr{A}_{s})$ for $\mathscr{A}$, where $\mathscr{A}_{1}:L(\mathcal{A}_{0}\otimes\mathcal{A}_{p})\mapsto L(\mathcal{A}_{1}\otimes\mathcal{X}_{1})$, and $\mathscr{A}_{t}:L(\mathcal{A}_{t-1}\otimes\mathcal{Y}_{t-1})\mapsto L(\mathcal{A}_{t}\otimes\mathcal{X}_{t})$ $(2\leq t\leq s)$, 6. 6.

an $s$-tuple of quantum operations $(\mathscr{B}_{1},\dots,\mathscr{B}_{s})$ for $\mathscr{B}$, where $\mathscr{B}_{1}:L(\mathcal{B}_{0}\otimes\mathcal{B}_{p}\otimes\mathcal{X}_{1})\mapsto L(\mathcal{B}_{1}\otimes\mathcal{Y}_{1})$, $\mathscr{B}_{t}:L(\mathcal{B}_{t-1}\otimes\mathcal{X}_{t})\mapsto L(\mathcal{B}_{t}\otimes\mathcal{Y}_{t})$ $(2\leq t\leq s-1)$, and $\mathscr{B}_{s}:L(\mathcal{B}_{s-1}\otimes\mathcal{X}_{s})\mapsto L(\mathcal{B}_{s})$.

Note that in order to execute a protocol as defined above, one has to specify the input, namely a quantum state $\rho_{in}\in S(\mathcal{A}_{0}\otimes\mathcal{B}_{0})$ from which the execution starts.

Definition 2.2** (Protocol Execution).**

If $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ is an $s$-round two-party protocol, then the state after the $t$-th step $(1\leq t\leq 2s)$, and upon input state $\rho_{in}\in S(\mathcal{A}_{0}\otimes\mathcal{B}_{0}\otimes{\cal R})$, for any ${\cal R}$, is defined as

[TABLE]

for $t$ odd, and

[TABLE]

for $t$ even. We define the final state of protocol $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ upon input state $\rho_{in}\in S(\mathcal{A}_{0}\otimes\mathcal{B}_{0}\otimes{\cal R})$ as: $\left[\mathscr{A}\circledast\mathscr{B}\right](\rho_{in}):=\rho_{2s}(\rho_{in})$.

The communication complexity of a protocol is the number of qubits that are exchanged between the parties. Slightly more generally, we can consider the logarithm of the dimension of the message registers ${\cal X}_{t}$, ${\cal Y}_{t}$. The formal definition thus follows.

Definition 2.3** (Communication Complexity).**

The communication complexity of a protocol as in Definition 2.1 is

[TABLE]

We sometimes also refer to one-sided communication complexity, i.e. the total communication originating from one party to the other. The communication complexity of $\mathscr{A}$ is defined to be the communication originating from $\mathscr{A}$, or formally $\sum_{t=1}^{s}\log\dim({\cal X}_{t})$. Symmetrically the communication complexity of $\mathscr{B}$ is $\sum_{t=1}^{s-1}\log\dim({\cal Y}_{t})$.

2.2 Specious Adversary

Given a two-party quantum protocol $\Pi=\{\mathscr{A,B},\rho_{joint},s\}$, an adversary $\tilde{\mathscr{A}}$ for $\mathscr{A}$ is an $s$-tuple of quantum operations $(\mathscr{A}_{1},\dots,\mathscr{A}_{s})$, where $\tilde{\mathscr{A}}_{1}:L(\tilde{\mathcal{A}}_{0})\mapsto L(\mathcal{A}_{1}\otimes{\cal X}_{1})$ and $\tilde{\mathscr{A}}_{t}:L(\tilde{\mathcal{A}}_{t-1}\otimes\mathcal{Y}_{t-1})\mapsto L(\tilde{\mathcal{A}}_{t}\otimes{\cal X}_{t})$, $2\leq t\leq s$, with $\tilde{{\cal A}}_{1},\dots,\tilde{{\cal A}}_{s}$ being $\tilde{\mathscr{A}}$’s memory spaces. The global state after the $t$th step of a protocol run with $\tilde{\mathscr{A}}$ is $\tilde{\rho}_{t}(\tilde{\mathscr{A}},\rho_{in})$. An adversary $\tilde{\mathscr{B}}$ for $\mathscr{B}$ is similarly defined.

Definition 2.4** (Specious adversaries).**

Let $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ be an $s$-round two-party protocol. An adversary $\tilde{\mathscr{A}}$ for $\mathscr{A}$ is said to be $\gamma$-specious, if there exists a sequence of quantum operations (called recovery operators) $\mathscr{F}_{1},\dots,\mathscr{F}_{2s}$, such that for $1\leq t\leq 2s$ and for all $\rho_{in}\in S(\mathcal{A}_{0}\otimes\mathcal{B}_{0}\otimes\mathcal{R})$:

For all $t$ even, $\mathscr{F}_{t}:L(\tilde{\mathcal{A}}_{t/2})\mapsto L(\mathcal{A}_{t/2})$. 2. 2.

For all $t$ odd, $\mathscr{F}_{t}:L(\tilde{\mathcal{A}}_{(t+1)/2}\otimes\mathcal{X}_{(t+1)/2})\mapsto L(\mathcal{A}_{(t+1)/2}\otimes\mathcal{X}_{(t+1)/2})$. 3. 3.

For every input state $\rho_{in}\in S(\mathcal{A}_{0}\otimes\mathcal{B}_{0}\otimes\mathcal{R})$, for any ${\cal R}$,

[TABLE]

A $\gamma$-specious adversary $\tilde{\mathscr{B}}$ for $\mathscr{B}$ is similarly defined.

2.3 Quantum Private Information Retrieval

We define QPIR similarly to [BB15].

Definition 2.5** (Quantum Private Information Retrieval).**

An $s$-round, $n$-bit Quantum Private Information Retrieval protocol (QPIR) is a two-party protocol $\Pi_{QPIR}=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$, where $\mathscr{A}$ is the server, $\mathscr{B}$ is the client, and $\rho_{joint}$ is an initial state shared between them prior to the protocol. We call $\Pi_{QPIR}$ $(1-\delta)$-correct if, for all inputs $\rho_{in}=|{x}\rangle\langle{x}|_{{\cal A}_{0}}\otimes|{i}\rangle\langle{i}|_{{\cal B}_{0}}$, with $x=x_{1},\dots,x_{n}\in\{0,1\}^{n}$ and $i\in\{1,\dots,n\}$, there exists a measurement $\mathcal{M}$ acting on ${\cal B}_{s}$ with outcome [math] or $1$, such that:

[TABLE]

If $\delta=0$ we say that the protocol is perfectly correct.

We call $\Pi_{QPIR}$ $\epsilon$-private against a (possibly adversarial) server $\tilde{\mathscr{A}}$, if there exists a sequence of quantum operations (simulators) $\mathscr{I}_{1},\dots,\mathscr{I}_{s-1}$, where $\mathscr{I}_{t}:L({\cal A}_{0}\otimes{\cal A}_{p})\mapsto L(\tilde{{\cal A}}_{t}\otimes{\cal Y}_{t})$, such that for all $1\leq t\leq s-1$ and for all $\rho_{in}\in S({\cal A}_{0}\otimes{\cal B}_{0}\otimes{\cal R})$,

[TABLE]

If $\epsilon=0$ we say that the protocol is perfectly private.

We say that a QPIR protocol is $\epsilon$-private against a class of servers if it is $\epsilon$-private against any server from this class.

We note that in the above definition privacy is required to hold also for adversarial input states for the client and server, which also includes inputs in superposition, and even for the case where the client and server (and possibly a third party) are entangled. Nayak [Nay99, ANTSV02] showed that a perfectly private QPIR protocol, even only against [math]-specious servers, must have communication complexity at least $(1-H(1-\delta))n$, where $H(p)$ is the binary entropy function. Baumeler and Broadbent [BB15] extended this lower bound to the case of $\epsilon>0$ and presented a communication lower bound of

[TABLE]

3 Anchored Privacy Against Specious Adversaries

We now present our new restricted notion of privacy, that we call anchored privacy. A protocol is anchored private if it satisfies the standard definition of privacy with respect to classical inputs on the adversary’s side. There is no privacy requirement for superposition input states on the adversary’s side (and therefore this notion of privacy is weaker, and hence, easier to achieve). A formal definition follows.

Definition 3.1** (Anchored Privacy).**

A QPIR protocol is anchored $\epsilon$-private if Eq. (2) holds for all $\rho_{in}\in{\cal A}_{0}\otimes{\cal B}_{0}\otimes{\cal R}$ (for any ${\cal R}$), for which $\rho_{in}|_{{\cal A}_{0}}=|{x}\rangle\langle{x}|$ for some $x\in\{0,1\}^{n}$.

We note that prior intuitive notions of security such as that implied by the analysis of Le Gall [LG12] in fact correspond to anchored privacy against honest servers. Our main theorem below shows that this type of privacy extends to the specious setting as well.

Theorem 3.2**.**

Let $\Pi$ be a measurement-free QPIR protocol which is anchored $\epsilon$-private against honest servers, then $\Pi$ is anchored $({\epsilon}+3\sqrt{2\gamma})$-private against $\gamma$-specious servers.

Critically, the theorem only holds for measurement-free QPIR protocols. To see this, consider the following protocol, which will be anchored-private against honest servers but not anchored-private against specious ones. Let $\Pi$ be a QPIR protocol which is anchored-private against honest servers (e.g., Le-Gall’s protocol [LG12]). Now consider the following protocol $\Pi^{\prime}$ which first generates a superposition over all possible databases, then measures this superposition to obtain a classical value for the database. It then runs $\Pi$ on this measured database (with the client using its real input index). Finally, both parties toss out the output of this first execution, and run $\Pi$ again, now using the actual input database.

Let us first see that $\Pi^{\prime}$ is anchored-private against honest servers. This follows since $\Pi$ is secure against honest adversaries when executed over input states in which the server’s input is classical, and hence so is $\Pi^{\prime}$ which just consists of two sequential executions of $\Pi$ over classical databases. However, a purification of an honest server allows to execute a purification attack on the first execution of $\Pi$ in a way that allows to recover the client’s input, even though the database used as input for $\Pi^{\prime}$ is completely classical.

Warm-up.

We first give a proof under some simplifying assumptions: (i) $\gamma=\epsilon=0$. (ii) the input is pure (iii) the purification space is trivial: ${\cal R}=\mathbb{C}$ and (iv) the specious server’s quantum operations $\tilde{\mathscr{A}}_{t}$ are unitary. The main point that makes the analysis easier in this case is assumption (i).

Fix a step of the protocol $t$.

We claim that for every unitary $\gamma$-specious adversary, which is perfect (i.e. $\gamma=0$) the entire state, (written in some fixed but maybe non standard basis), is of the form $|{\eta}\rangle_{{\cal S}^{\prime}}\otimes|{\psi_{t}}\rangle_{{\cal S},{\cal C}}$ where $|{\psi_{t}}\rangle$ is the state that an honest server and client would have when running on the same input. Here, and later, we use the notation ${\cal S}$ for all of the honest server registers at step $t$, ${\cal C}$ for all of the client’s registers at step $t$ and ${\cal S}^{\prime}$ for the specious server’s ancillary register at step $t$. Crucially, $|{\eta}\rangle$ is independent of the (server and client) input.

We now prove the above claim. By the specious property, we know that there exists a quantum operation $\mathscr{F}_{t}$ which maps the global state at the $t$th stage to the state $|{\psi_{t}}\rangle$. We know that the state in step $t$ in the honest run is necessarily pure since $\Pi$ is measurement free. W.l.o.g. we can assume that the operation $\mathscr{F}_{t}$ is a unitary $U_{t}$, followed by tracing out everything other then the ${\cal S}$ and ${\cal C}$ registers.

Let’s assume towards contradiction that the state in the basis $U_{t}^{\dagger}$ is of the form $|{\eta(input)}\rangle\otimes|{\psi_{t}}\rangle$, where $|{\eta(input)}\rangle$ depends on the input (where here we mean both the client and the server’s input). There must be two different input states such that running them would give $|{\eta(1)}\rangle\otimes|{\psi_{t}(1)}\rangle$ and $|{\eta(2)}\rangle\otimes|{\psi_{t}(2)}\rangle$ for which $|{\eta(1)}\rangle\neq|{\eta(2)}\rangle$. Since the honest runs are entirely unitary (by the measurement-free property) and have different inputs, necessarily, $|{\psi_{t}(1)}\rangle\neq|{\psi_{t}(2)}\rangle$. By running the specious adversary on a superposition of these two inputs, we get that after applying $\mathscr{F}_{t}$, the state becomes a mixture of the two states, $|{\psi_{t}(1)}\rangle$ and $|{\psi_{t}(2)}\rangle$. This contradicts the perfect specious property (see Eq. (1)) – which requires the state to be the pure (since all the operations of the client and honest servers are unitary, and their input in this case is pure). 2. 2.

By the perfect anchored-privacy against the honest server, the state $\rho_{t}=\textnormal{tr}_{C}(|{{\psi_{t}}}\rangle\langle{{\psi_{t}}}|_{S,C})$ is independent of the client’s input, and therefore, could only depend on $x$ – the server’s input. To emphasize that independence on the client’s input (and possible dependence on the server’s input), we denote the state $\rho_{t}$ by $\rho_{t}(x)$.

Our goal is to show the anchored-privacy property for the specious server. Indeed, the two points above show that the specious server’s state (in the fixed basis we choose to work in) is $|{{\eta}}\rangle\langle{{\eta}}|\otimes\rho_{t}(x)$, which is independent of the client’s input. Therefore the simulator can generate that state exactly by using the server’s classical input $x$, as required (see Eq. (2)).

Outline of the general proof.

For each round $t$ we construct a simulator for the server in the following way: we first construct a simulator $\tilde{{\mathscr{I}}}_{t}^{x_{0},0}$ for input $|{x_{0}}\rangle\otimes|{0}\rangle$ where $|{x_{0}}\rangle$ is an input for the server and $|{0}\rangle$ is an input for the client. We construct this simulator using the simulator for the honest server along with the ’specious operator’, and an ancillary state $|{\sigma_{x_{0},0}}\rangle$. We then show that $|{\sigma_{x_{0},0}}\rangle$ is also an appropriate ancillary state for any input $|{x}\rangle\otimes|{\eta}\rangle$. Using this, we show that $\tilde{{\mathscr{I}}}_{t}^{x,0}$ is indeed a simulator for any input $|{x}\rangle\otimes|{\eta}\rangle$, with slightly worse parameters.

We are now ready to give the proof in full generality:

Theorem 3.2 (Proof).

Let $\Pi$ be a purified QPIR protocol which is anchored $\epsilon$-private against honest servers, and let $\tilde{{\mathscr{A}}}$ be a $\gamma$-specious server for $\Pi$. W.l.o.g we can assume that $\tilde{{\mathscr{A}}}$ is purified, namely, a unitary666This is because we can include the purification register at any point, as the server could have included himself rather than throwing it away. From now on, we will fix $t$. We can denote

[TABLE]

where $|{\psi_{t}^{\rho_{in}}}\rangle\in{\cal S}\otimes{\cal C}\otimes{\cal R}$ for some ${\cal R}$, and we use ${\cal S}$ to represent the server’s registers ${\cal S}={\cal A}_{t}\otimes{\cal Y}_{t}\otimes{\cal A}_{p}$ (for $t$ odd. otherwise ${\cal S}={\cal A}_{t}\otimes{\cal A}_{p}$), and ${\cal C}$ to represent the client’s registers ${\cal C}={\cal B}_{t}\otimes{\cal X}_{t}\otimes{\cal B}_{p}$ (for $t$ even. otherwise ${\cal C}={\cal B}_{t}\otimes{\cal B}_{p}$). Furthermore, w.l.o.g we assume the various recovery operators for $\tilde{{\mathscr{A}}}$ are purified. That is, there exist unitary operators $\hat{{\mathscr{F}}}_{t}$ such that ${\mathscr{F}}_{t}(\cdot)=\textnormal{tr}_{{\cal S}^{\prime}}\left(\hat{{\mathscr{F}}}_{t}(\cdot)\right)$ for some purification space ${\cal S}^{\prime}$ which is at the hands of the server (from now on, for the sake of this proof, where we say ”recovery operators” we regard these unitary $\hat{{\mathscr{F}}}_{t}$ operators). Therefore we can denote

[TABLE]

where w.l.o.g $|{\tilde{\psi}_{t}^{\rho_{in}}}\rangle\in S^{\prime}\otimes S\otimes C\otimes R$. We note that all of the unitary operators - ${\mathscr{A}}_{t},{\mathscr{B}}_{t}$ which are used in the original protocol (by either the server or the client), $\tilde{{\mathscr{A}}}_{t}$ which are used by the specious server $\tilde{{\mathscr{A}}}$, and the recovery $\hat{{\mathscr{F}}}_{t}$ operators are independent of both the client’s and the server’s inputs

For each round $t$, we will start by constructing a simulator for $\tilde{{\mathscr{A}}}$ acting on $\rho_{in}=|{x_{0}}\rangle\langle{x_{0}}|_{{\cal A}_{0}}\otimes|{0}\rangle\langle{0}|_{{\cal B}_{0}}$, where $x_{0}\in\{0,1\}^{n}$ (in this specific input, ${\cal R}$ is trivial and is thus omitted). By $\gamma$-speciousness of $\tilde{{\mathscr{A}}}$, along with our purification assumptions, there exists a unitary recovery operator $\hat{{\mathscr{F}}}_{2t}:L(\tilde{{\cal A}}_{t})\mapsto L({\cal S}^{\prime}\otimes{\cal A}_{t})$ such that

[TABLE]

By Lemma A.1, this means that there exists a state $|{\sigma_{x_{0},0}}\rangle\in{\cal S}^{\prime}$ such that:

[TABLE]

We can now operate on Eq. (7) with $\hat{{\mathscr{F}}}_{2t}^{\dagger}\otimes{\mathbb{I}}$ to get:

[TABLE]

The above connects the states derived from the execution with the specious server to that with the honest server. By anchored $\epsilon$-privacy of $\Pi$ against honest servers, there exists a simulator ${\mathscr{I}}_{t}:L(\mathcal{A}_{0}\otimes\mathcal{A}_{p})\mapsto L({\cal A}_{t}\otimes{\cal X}_{t})$ such that for all $x\in\{0,1\}^{n}$ and $|{\alpha}\rangle\in{\cal B}_{0}\otimes{\cal R}$, for any ${\cal R}$,

[TABLE]

(In fact, the above holds for any mixture over such $\alpha$’s, by convexity). We can now define the simulator for $\rho_{in}$ corresponding to input state $|{x_{0}}\rangle\otimes|{0}\rangle$ to be the following unitary embedding from ${\cal A}_{0}\otimes{\cal A}_{p}$ to ${\cal S}^{\prime}\otimes{\cal A}_{0}\otimes{\cal A}_{p}$:

[TABLE]

To show that it indeed satisfies the requirements from a simulator, we combine Eqs. (8),(10), and (9) for $x=x_{0},\ |{\alpha}\rangle=|{0}\rangle$, to get that

[TABLE]

We now define the simulator for any input to be this exact simulator:

[TABLE]

In the remainder of the proof we show that $\tilde{{\mathscr{I}}}_{t}(\cdot)$ satisfies an inequality similar to Eq. (11) with respect to all classical server inputs $x\in\{0,1\}^{n}$ (not necessarily $x_{0}$) and any input state $|{\alpha}\rangle\in{\cal B}_{0}\otimes{\cal R}$ for any ${\cal R}$, as well as for a mixture of such $\alpha$’s; this would imply anchored privacy for the specious server. To this end we show that also for this input, a similar inequality to Eq. (11) holds (with a slightly worse bound). Define

[TABLE]

where we have added an additional (control) qubit in the space ${\cal R}^{\prime}$. The specious adversary condition applies to this input state as well, and thus using the same derivation as for Eq. (8)) we get:

[TABLE]

Using the fact that neither the server nor the client act on the ${\cal R}^{\prime}$ register, we get:

[TABLE]

Similarly, since the same is true for the adversarial run, we get:

[TABLE]

We plug Eqs. (14) and (15) into Eq. (13), and project the register ${\cal R}^{\prime}$ in the resulting state onto $|{1}\rangle_{{\cal R}^{\prime}}$ to get:

[TABLE]

Now we apply the fact that $\hat{{\mathscr{F}}}_{2t}^{\dagger}$ doesn’t act on the client’s input; the fact that a unitary operator doesn’t change the distance between states; and the fact that tracing out doesn’t increase that distance [AKN98], and Eq. $\eqref{y+ simulator part2}$ becomes:

[TABLE]

Similarly, by projecting onto $|{0}\rangle_{{\cal R}^{\prime}}$ instead of $|{1}\rangle_{{\cal R}^{\prime}}$ in the derivation of 16, we get

[TABLE]

We now want to apply the triangle inequality to  (18), using Eqs. (8). Applying yet again the same sequence of simple argument, namely the fact that unitary transformations preserve the trace distance and tracing out can only decrease it, we get

[TABLE]

And we can use Eq. (19) together with Eq. (17) to get:

[TABLE]

And finally combine Eq. (20), (9) and (12) (in a similar way to how we derived Eq. (11)) to get:

[TABLE]

This finishes our proof. ∎

4 Linear Lower Bound in the Specious Model, Even with Prior Entanglement

In this section we show that in the standard specious model, even allowing arbitrarily long prior entanglement, it is still impossible to achieve QPIR with sublinear communication. We do so by presenting a new lower bound argument based on an interactive leakage chain rule in [LC18], which allows us to establish linear lower bounds on both the server’s communication complexity and the total communication complexity in a unified way. Then we observe that the lower bound on the server’s communication complexity extends trivially to the case with arbitrary prior entanglement. In the following, we state some useful preliminaries in Section 4.1 and present our lower bound in Section 4.2.

4.1 Quantum Information Theory Background

We first recall the notion of quantum min-entropy. Consider a bipartite quantum state $\rho_{AB}$. The quantum min-entropy of $A$ conditioned on $B$ is defined as

[TABLE]

When $\rho_{AB}$ is a cq-state (i.e., the $A$ register is a classical state), the quantum min-entropy has a nice operational meaning in terms of guessing probability [KRS09]. Specifically, if $H_{\min}(A|B)_{\rho}=k$, then the optimal probability of predicting the value of $A$ given $\rho_{B}$ is exactly $2^{-k}$.

In the following, we state the interactive leakage chain rule in [LC18]. Let $\rho=\rho_{AB}$ be a cq-state, that is, the system $A$ is classical while $B$ is quantum. The interactive leakage chain rule bounds how much the min-entropy $H_{\min}(A|B)_{\rho}$ can be decreased by an “interactive leakage” produced by applying a two-party protocol $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ to $\rho$, where $A$ is treated as a classical input to $\mathscr{A}$ and $B$ is given to $\mathscr{B}$ as part of its initial state in $\rho_{joint}$.

Definition 4.1**.**

Let $\rho=\rho_{AB}$ be a cq-state. Let $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ be a two-party protocol where $\rho_{joint}$ contains $\rho_{B}$ in the $\mathscr{B}_{p}$ system, and $\rho_{in}$ be an input state where the classical state $\rho_{A}$ is copied to ${\cal A}_{0}$ as the input for $\mathscr{A}$. (That is, ${\cal A}_{0}$ has an initial state $|{0}\rangle_{A_{0}}$ and we do controlled NOT gates from $\rho_{A}$ to $|{0}\rangle_{A_{0}}$.) Consider the protocol execution $\left[\mathscr{A}\circledast\mathscr{B}\right](\rho_{in})$ and let $\sigma_{AB_{s}}$ be the final state where $A$ denotes the original classical state and $B_{s}$ denotes the final state of $\mathscr{B}$. We say $\sigma_{B_{s}}$ is an interactive leakage of $A$ produced by $\Pi$.

Theorem 4.2**.**

Let $\rho=\rho_{AB}$ be a cq-state. Let $\sigma_{AB_{s}}$ be the final state of a two-party protocol $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ with certain input state $\rho_{in}$. Let $m_{A}$ and $m_{B}$ be the communication complexity of $\mathscr{A}$ and $\mathscr{B}$, respectively. We have

[TABLE]

We will also use the following lemma about gentle measurement, which is first proved by Winter [Win99] and improved by Ogawa and Nagaoka [ON07], and is also referred to as the almost-as-good-as-new Lemma by Aaronson [Aar04]. It says that the post-measurement state of an almost-sure measurement will remain close to its original. The following version is taken from Wilde’s book [Wil13].

Lemma 4.3**.**

Suppose $0\leq\Lambda\leq I$ is a measurement operator such that for a mixed state $\rho$,

[TABLE]

Then the post-measurement state $\tilde{\rho}$ is $\sqrt{\epsilon}$-close to the original state $\rho$:

[TABLE]

We will also need the following lemma, which can be proved by a standard argument using Uhlmann theorem and the Fuchs and van de Graaf inequality [FvdG99] (for a proof, see, e.g., [BB15]).

Lemma 4.4**.**

Suppose $\rho_{A}$, $\sigma_{A}\in{\cal A}$ are two quantum states with purifications $|{\phi}\rangle_{AB}$, $|{\psi}\rangle_{AB}\in{\cal A}\otimes{\cal B}$, respectively, and $||\rho_{A}-\sigma_{A}||_{\textnormal{tr}}\leq\epsilon$. Then there exists a unitary $U_{B}\in L({\cal B})$ such that

[TABLE]

4.2 Our Lower Bound

Theorem 4.5**.**

Let $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint}=|{0}\rangle\langle{0}|,s\}$ be a QPIR protocol for the server’s database of size $n$. Suppose $\Pi$ is $(1-\delta)$-correct and $\epsilon$-private against $\gamma$-specious servers with $\delta\leq n^{-4}/100,\epsilon\leq n^{-8}/100$. Then the server’s communication complexity is at least $(n-1)/2$ and the total communication complexity is at least $n-1$.

In the above theorem, we consider protocols with no prior setup, i.e., $\rho_{joint}=|{0}\rangle\langle{0}|$. We observe that the lower bound for the server’s communication complexity extends for general $\rho_{joint}$, since one can think of $\rho_{joint}$ as prepared by the client, who sends the server’s initial state to the server at the beginning of the protocol. This simple reduction does not increase the server’s communication complexity and extends the lower bound on the server’s communication complexity for arbitrary $\rho_{joint}$.

Corollary 4.6**.**

Let $\Pi=\{\mathscr{A},\mathscr{B},\rho_{joint},s\}$ be a QPIR protocol for the server’s database of size $n$ with arbitrary $\rho_{joint}$. Suppose $\Pi$ is $(1-\delta)$-correct and $\epsilon$-private against $\gamma$-specious servers with $\delta\leq n^{-4}/100,\epsilon\leq n^{-8}/100$. Then the server’s communication complexity is at least $(n-1)/2$.

We now prove Theorem 4.5.

Proof.

To establish communication complexity lower bound for $\Pi$, we consider a purified version $\bar{\Pi}=\{\bar{\mathscr{A}},\bar{\mathscr{B}},\rho_{joint},s\}$ of $\Pi$, where both parties’ operations are purified. Specifically, $\bar{\mathscr{A}}$ is modified from $\mathscr{A}$, where the sequence of quantum operations $\bar{\mathscr{A}}_{1},\dots,\bar{\mathscr{A}}_{s}$ are unitaries

[TABLE]

$\bar{{\cal A}}_{0}$ is of sufficiently large dimension and initialized to $|{0}\rangle$; $\bar{{\cal A}}_{t}$ are called purifying spaces and

[TABLE]

for all $\rho\in{\cal A}_{0}\otimes{\cal B}_{0}$. The purified $\bar{\mathscr{B}}$ for $\mathscr{B}$ is similarly defined.

By inspection, it is easy to verify that $\bar{\Pi}$ preserves the properties of $\Pi$, i.e., $\bar{\Pi}$ is also $(1-\delta)$-correct, $\epsilon$-private against $\gamma$-specious servers, and has the same communication complexity as $\Pi$. Thus, communication complexity lower bound for $\bar{\Pi}$ implies that for $\Pi$. Also, note that $\bar{\mathscr{A}}$ is a [math]-specious adversary for $\Pi$.

Now, let us consider an experiment that first samples a uniformly random database $\mathbf{{a}}\in\{0,1\}^{n}$, and use $\mathbf{{a}}$ as the server’s database to run the protocol $\bar{\Pi}$ with an arbitrary fixed input of the client. Note that execution of the protocol can be viewed as producing an interactive leakage of $\mathbf{{a}}$. Let $\rho_{AB}$ denote the final state where system $A$ denotes the input $\mathbf{{a}}$ and system $B$ has the client’s final local state. By Theorem 4.2, we have

[TABLE]

where $m_{A},m_{B}$ denote the server and the client’s communication complexities, respectively. The operational meaning of min-entropy says that given the client’s state $\rho_{B}$, one cannot guess the random database $\mathbf{{a}}$ correctly with probability higher than $2^{-(H(A)_{\rho}-\min\{2m_{A},m_{A}+m_{B}\})}$. To derive a lower bound on the communication complexity, we show a strategy to predict the database $\mathbf{{a}}$ with probability at least $1-n^{2}\sqrt{\delta+2\sqrt{\epsilon(1-\epsilon)}}>1/2$, which gives the desired lower bound.

Let $\sigma_{B}^{i}=\textnormal{tr}_{A}[\bar{\mathscr{A}}\circledast\bar{\mathscr{B}}](|{\mathbf{{a}}}\rangle\langle{\mathbf{{a}}}|_{A_{0}}\otimes|{i}\rangle\langle{i}|_{B_{0}})$ and $\sigma_{A}^{i}=\textnormal{tr}_{B}[\bar{\mathscr{A}}\circledast\bar{\mathscr{B}}](|{\mathbf{{a}}}\rangle\langle{\mathbf{{a}}}|_{A_{0}}\otimes|{i}\rangle\langle{i}|_{B_{0}})$.

By the definition of privacy, there exists a quantum operation $\mathscr{F}$ such that

[TABLE]

Since $\textnormal{tr}_{B_{0}}\mathscr{F}_{0}\otimes I_{\bar{B}_{0}}\left(\rho_{in}^{1}\right)=\textnormal{tr}_{B_{0}}\mathscr{F}_{0}\otimes I_{\bar{B}_{0}}\left(\rho_{in}^{i}\right)$ for all $i$,

[TABLE]

We have, by triangle inequality,

[TABLE]

for all $i$.

By Lemma 4.4, we have

[TABLE]

where $|{\phi}\rangle_{\bar{A}\bar{B}}$ and $|{\psi^{i}}\rangle_{\bar{A}\bar{B}}$ are purifications of $\sigma_{A}^{1}$ and $\sigma_{A}^{i}$, respectively.

By the definition of correctness error, there exists measurement ${\cal M}_{i}$ such that

[TABLE]

Let

[TABLE]

for $i=2,\dots,n$. Thus we have by Eq. (25)

[TABLE]

By Lemma 4.3, the client can recover $\tilde{\sigma}^{(i)}_{B}$ such that

[TABLE]

Now we construct a protocol for the client to learn all the bits $\mathbf{{a}}=a_{1},\dots,a_{n}$. First the client chooses input $|{1}\rangle\langle{1}|$. Then he plays the protocol $\bar{\Pi}$ with Alice and obtains $\sigma_{B}^{1}$. Measuring $\sigma_{B}^{1}$ by ${\cal M}_{1}$, the client gets $a_{1}$ with probability at least $1-\delta$. By Lemma 4.3, the client can recover $\tilde{\sigma}_{B}^{1}$ such that

[TABLE]

Then the client measures ${\cal M}_{2}^{\prime}$ on $\tilde{\sigma}_{B}^{1}$ and then recovers $\tilde{\sigma}_{B}^{2}$. Continue this process and $\tilde{\sigma}_{B}^{k}$ will be the state recovered from applying ${\cal M}_{k}^{\prime}$ to $\tilde{\sigma}_{B}^{k-1}$. We claim that

[TABLE]

Suppose this is true for $i=2,\cdots,k$. If we measure ${\cal M}_{k+1}^{\prime}$ on $\tilde{\sigma}_{B}^{k+1}$ and on $\sigma_{B}^{1}$, respectively, and recover $\tilde{\sigma}_{B}^{k+1}$ and $\tilde{\sigma}_{B}^{(k+1)}$, respectively, we have

[TABLE]

where the first inequality is because quantum operations do not increase trace distance. Now use the triangle inequality with Eqs. (27) and (29), and the claim follows by induction.

By Eqs. (26) and (28), the probability of recovering $a_{i}$ by measuring ${\cal M}_{i}^{\prime}$ on $\tilde{\sigma}_{B}^{i-1}$ is at least $1-i\sqrt{\delta+\epsilon^{\prime}}$. Therefore, the client learns $\mathbf{{a}}$ with probability at least

[TABLE]

which is what we need to complete the proof. ∎

Acknowledgments

We thank the anonymous referees for presenting us with the work of Kerenidis et al. [KLGR16], and other valuable comments. ZB is supported by the Israel Science Foundation (Grant 468/14), Binational Science Foundation (Grants 2016726, 2014276), and by the European Union Horizon 2020 Research and Innovation Program via ERC Project REACT (Grant 756482) and via Project PROMETHEUS (Grant 780701). OS is supported by ERC Grant 280157, by the Israel Science Foundation (Grant 682/18), and by the Cyber Security Research Center at Ben-Gurion University. CYL is financially supported from the Young Scholar Fellowship Program by Ministry of Science and Technology (MOST) in Taiwan, under Grant MOST107-2636-E-009-005. KMC is partially supported by 2016 Academia Sinica Career Development Award under Grant No. 23-17 and the Ministry of Science and Technology, Taiwan under Grant No. MOST 103-2221- E-001-022-MY3. DA and AG were supported by ERC Grant 280157 for part of the work on this project, and are supported by the Israel Science Foundation (Grant 1721/17).

Appendix A Hilbert Spaces and Quantum States

The Hilbert space of a quantum system $A$ is denoted by the corresponding calligraphic letter ${\cal A}$ and its dimension is denoted by $\dim({\cal A})$. Let $L({\cal A})$ be the space of linear operators on ${\cal A}$. A quantum state of system $A$ is described by a density operator $\rho_{A}\in L({\cal A})$ that is positive semidefinite and with unit trace $(\textnormal{tr}(\rho_{A})=1)$. Let $S({\cal A})=\{\rho_{A}\in L({\cal A}):\rho_{A}\geq 0,\textnormal{tr}(\rho_{A})=1\}$ be the set of density operators on ${\cal A}$. When $\rho_{A}\in S({\cal A})$ is of rank one, it is called a pure quantum state and we can write $\rho=|{\psi}\rangle\langle{\psi}|_{A}$ for some unit vector $|{\psi}\rangle_{A}\in{\cal A}$, where $\langle{\psi}|=|{\psi}\rangle^{{\dagger}}$ is the conjugate transpose of $|{\psi}\rangle$. If $\rho_{A}$ is not pure, it is called a mixed state and can be expressed as a convex combination of pure quantum states.

The Hilbert space of a joint quantum system $AB$ is the tensor product of the corresponding Hilbert spaces ${\cal A}\otimes{\cal B}$. For $\rho_{AB}\in S({\cal A}\otimes{\cal B})$, its reduced density operator in system $A$ is $\rho_{A}=\textnormal{tr}_{B}(\rho_{AB})$, where

[TABLE]

for an orthonormal basis $\{|{i}\rangle_{B}\}$ for ${\cal B}$. We sometimes use the equivalent notation,

[TABLE]

Suppose $\rho_{A}\in S({\cal A})$ of finite dimension $\dim({\cal A})$. Then there exists ${\cal B}$ of dimension $\dim({\cal B})\geq\dim({\cal A})$ and $|{\psi}\rangle_{AB}\in{\cal A}\otimes{\cal B}$ such that

[TABLE]

The state $|{\psi}\rangle_{AB}$ is called a purification of $\rho_{A}$.

The trace distance between two quantum states $\rho$ and $\sigma$ is

[TABLE]

where $||X||_{\mathrm{tr}}=\frac{1}{2}\textnormal{tr}{\sqrt{X^{{\dagger}}X}}$ is the trace norm of $X$. Hence the trace distance between two pure states $|{\alpha}\rangle,|{\beta}\rangle$ is

[TABLE]

Lemma A.1**.**

Consider a quantum state $\rho_{XY}$ over two registers $X,Y$, and denote $\rho_{X}=\textnormal{tr}_{Y}(\rho_{XY})$. Then if there exists $\epsilon,|{\varphi}\rangle$ s.t. $\Delta(\rho_{X},|{{\varphi}}\rangle\langle{{\varphi}}|)\leq\epsilon$, then there exists $\tilde{\rho}_{Y}$ s.t. $\Delta(\rho_{XY},|{{\varphi}}\rangle\langle{{\varphi}}|\otimes\tilde{\rho}_{Y})\leq\sqrt{\epsilon}$. Furthermore, if $\rho_{XY}$ is pure then so is $\tilde{\rho}_{Y}$.

Proof.

It is sufficient w.l.o.g to prove for a pure $\rho_{XY}$, since it is always possible to purify $\rho_{XY}$ by adding an additional register $Z$, and consider the pure state $\rho_{XYZ}$. The transitivity of the partial trace operation implies that if the theorem is true for $X,(YZ)$, then it is also true for $X,Y$. Also assume w.l.o.g that $|{\varphi}\rangle=|{0}\rangle$ (this is just a matter of choosing a basis elements).

Thus we will provide a proof in the case where the joint state of $X,Y$ can be written as a superposition $|{\alpha}\rangle=\sum_{x,y}w_{x,y}|{x}\rangle|{y}\rangle$. Define $P_{0}=\Pr[X=0]=\sum_{y}\left|{w_{0,y}}\right|^{2}$, and note that it must be the case that $P_{0}\geq 1-\epsilon$. To see this, note that $P_{0}$ is the probability of measuring $X=0$ in the experiment where we first trace out $Y$ and then measuring $X$. Since $\Delta(\rho_{X},|{{0}}\rangle\langle{{0}}|)\leq\epsilon$, the probability of measuring $X=0$ after tracing out $Y$ is $\epsilon$ close to the probability of measuring $X=0$ in $|{{0}}\rangle\langle{{0}}|$, which is $1$ (see, e.g., [AKN98]). The claim $P_{0}\geq 1-\epsilon$ follows.

Now define $|{\beta}\rangle=\tfrac{1}{\sqrt{P_{0}}}\sum_{y}w_{0,y}|{y}\rangle$, and let $\tilde{\rho}_{Y}=|{{\beta}}\rangle\langle{{\beta}}|$. Then

[TABLE]

We have

[TABLE]

which implies that indeed $\Delta(\rho_{XY},|{{0}}\rangle\langle{{0}}|\otimes\tilde{\rho}_{Y})=\sqrt{1-P_{0}}\leq\sqrt{\epsilon}$. ∎

Appendix B Security Analysis of Kereneidis et al.’s Protocol

For completeness, we restate777We make one minor adaptation – see Remark 1. the QPIR protocol with pre-shared entanglement by Kerenidis et al. [KLGR16, Section 6]. Given a database ${{\mathtt{DB}}}\in\{0,1\}^{n}$ for some ${n}=2^{\ell}$ as input to the server, and index $i\in[{n}]$ as input to the client (If the client’s input is a superposition, the algorithm is run in superposition), we denote the protocol $\Pi_{n}$ as follows.

The protocol $\Pi_{n}$ is recursive and calls $\Pi_{{n}/2}$ as a subroutine. For the execution of $\Pi_{n}$, the parties are required to pre-share a pair of entangled state registers $\tfrac{1}{2^{{n}/4}}\sum_{\mathbf{{r}}\in\{0,1\}^{{n}/2}}|{\mathbf{{r}}}\rangle_{R}|{\mathbf{{r}}}\rangle_{R^{\prime}}$, where $R$ is held by the server and $R^{\prime}$ is held by the client. They also share an entangled state needed for the recursive application of the protocol $\Pi_{{n}/2}$ (and the recursive calls it entails). Unfolding the recursion, this means that for all ${n}^{\prime}=2^{{\ell}^{\prime}}$ with ${\ell}^{\prime}\in[{\ell}-1]$, there is an entangled register of length ${n}^{\prime}$ shared between the client and the server.

The protocol execution is described in shorthand Figure 1. In what follows we provide a detailed description and analyze the steps of the protocol to establish correctness and assert properties that will allow us to analyze privacy.

If ${n}=1$ then the database contains a single value. In this case there is no need for shared entanglement, and the server sends a register $F$ containing $|{{{\mathtt{DB}}}}\rangle$ (the final response) to the client, and the protocol terminates. This is trivially secure and efficient. Otherwise proceed to the next steps. 2. 2.

The server denotes ${{\mathtt{DB}}}_{0},{{\mathtt{DB}}}_{1}\in\{0,1\}^{{n}/2}$ s.t. ${{\mathtt{DB}}}=[{{\mathtt{DB}}}_{0}\|{{\mathtt{DB}}}_{1}]$, i.e. the low-order and high-order bits of the database respectively. The server starts with two single-bit registers $Q_{0},Q_{1}$ initialized to [math]. The server CNOTs $Q_{b}$ with the inner product of $R$ and ${{\mathtt{DB}}}_{b}$ so that it contains $|{\mathbf{{r}}\cdot{{\mathtt{DB}}}_{b}}\rangle_{Q_{b}}$, and sends $Q_{0},Q_{1}$ to the client.

At this point, the joint state between the client and (an honest) server is

[TABLE]

In particular the reduced density matrix of the server’s state is independent of the index ${i}$. 3. 3.

Let $b^{*}=\lfloor\tfrac{i-1}{{n}}\rceil$ denote the most significant bit of $i$. The client evaluates a $Z$ gate on $Q_{b^{*}}$. It sends $Q_{0},Q_{1}$ back to the server.

At this point, the joint state between the client and (an honest) server is

[TABLE]

Importantly, the reduced density matrix of the server, which contains the registers $R,Q_{0},Q_{1}$, is the diagonal matrix that corresponds to the classical distribution of sampling a random $\mathbf{{r}}$ in register $R$, and placing $\mathbf{{r}}\cdot{{\mathtt{DB}}}_{0},\mathbf{{r}}\cdot{{\mathtt{DB}}}_{1}$ in $Q_{0},Q_{1}$. This density matrix is independent of $b^{*}$ and therefore of $i$. 4. 4.

The server again CNOTs $Q_{b}$ with the inner product of $R$ and ${{\mathtt{DB}}}_{b}$.

At this point, the joint state between the client and (an honest) server is

[TABLE]

From this point on we disregard $Q_{0},Q_{1}$ since they remain zero throughout. Since this step only involves a local unitary by the server, we are guaranteed that its reduced density matrix is still independent of ${i}$. 5. 5.

The server performs QFT on $R$ and the client performs QFT on $R^{\prime}$. The resulting state is

[TABLE]

Since we only performed local operations on the server and client side (without communication), the server’s density matrix remains perfectly independent of $b^{*}$ and thus of ${i}$. 6. 6.

Note that at this point, the joint state of the client and server is a “shifted” entangled state where the shift corresponds to the half-database ${{\mathtt{DB}}}_{b^{*}}$ that contains the element that the client wishes to retrieve. More explicitly, ${{\mathtt{DB}}}[i]={{\mathtt{DB}}}_{b^{*}}[i^{*}]$ for $i^{*}=i\pmod{{n}/2}$ contains the $({\ell}-1)$ least significant bits of $i$. Therefore, for all $\mathbf{{y}},\mathbf{{w}}$ in the support of the joint state, it holds that ${{\mathtt{DB}}}[i]=\mathbf{{w}}[i^{*}]\oplus\mathbf{{y}}[i^{*}]$.

The client will now ignore (temporarily) the register $R^{\prime}$ and execute $\Pi_{{n}/2}$ recursively on index ${i}^{*}$. The (honest) server will carry out the protocol with the value $\mathbf{{y}}$ from the register $R$ serving as the server’s database. Note that since the register $R^{\prime}$ is not touched, for the purposes of executing the protocol the value $\mathbf{{w}}$ in $R^{\prime}$ is equivalent to have been measured, and the value $\mathbf{{y}}$ in $R$ is equivalent to the deterministic register $\mathbf{{w}}\oplus{{\mathtt{DB}}}_{b^{*}}$.

We are recursively guaranteed that in the end of the execution of $\Pi_{{n}/2}$, the client receives a register $F$ containing the value $\mathbf{{y}}[i^{*}]=\mathbf{{w}}[i^{*}]\oplus{{\mathtt{DB}}}_{b^{*}}[i^{*}]=\mathbf{{w}}[i^{*}]\oplus{{\mathtt{DB}}}[i]$. Since the client still maintains the original register $R^{\prime}$ containing $\mathbf{{w}}$, it can CNOT the value $\mathbf{{w}}[i^{*}]$ from $F$ and obtain $|{{{\mathtt{DB}}}[i]}\rangle_{A}$. Namely, in the end of the execution, the register $F$ indeed contains the desired value ${{\mathtt{DB}}}[i]$. 7. 7.

Lastly, if the client and server desire to “clean up” and restore the shared entanglement so that it can be reused in consequent executions, the client can copy the contents of the register $F$ to a fresh register (which is possible since this register contains a classical value). Since the client and server are pure (i.e. do not measure) throughout the protocol, they can rewind the execution of the protocol to restore their initial joint entanglement.

If the final cleanup step is not executed then the total number of rounds of $\Pi_{{n}}$ is $2{\ell}+1$, and the total communication complexity is $4l+1$ (recall that ${\ell}=\log({n})$). If the cleanup step is executed, the round complexity and communication complexity are doubled due to rewinding the execution.

Remark 1**.**

Note that in the original protocol by Kerenidis et al. step 7 does not appear, and it is not mentioned that the shared entanglement can be cleaned and reused.

We conclude that for classical inputs for both the client and the server, the honest server’s density matrix is independent of $i$. If the client first measures its input state, privacy holds. But since the very first operation is a CNOT operation (to determine the value of $i$) and since CNOT and measurements in the standard basis commute, we conclude that the server’s reduced density matrix is independent of the client’s input, even for inputs which are in superposition.

Lemma B.1**.**

The protocol $\Pi_{n}$ is a PIR protocol with perfect correctness and perfect anchored privacy against honest servers. It furthermore has communication complexity $O(\log{n})$, and uses $O({n})$ bits of (reusable) shared entanglement.

Proof.

The analysis in the body of the protocol establishes that the local view of the adversary is independent of $i$, when $i$ is treated as a fixed parameter. For the sake of our privacy notion, we are required to establish that the server’s local state is independent of $i$ even when $i$ is an arbitrary quantum state. This follows since the client refers to the index $i$ as constant, and therefore a superposition over $i$ will translate to a superposition over classical executions of the protocol, each with a fixed $i$. Since the server’s local view is identical for any fixed $i$, it will also be in the same state for a superposition, and also for an arbitrary mixed state of $i$ and some potential environment.

The communication complexity and the amount of reusable shared entanglement needed in this protocol follow directly from the protocol. ∎

We can therefore apply Theorem 3.2 and conclude that $\Pi$ is secure against anchored-specious adversaries.

Corollary B.2**.**

There exists a PIR protocol $\Pi$ with logarithmic communication complexity assuming linear shared entanglement, which is perfectly correct and anchored $O(\sqrt{\gamma})$-private against $\gamma$-specious adversaries.