Identical-Copy Secure Unclonable Primitives

• Identical-copy secure unclonable primitives are quantum constructs that prevent adversaries from generating extra usable copies from multiple identical quantum states.
• They utilize the no‐cloning theorem and advanced state synthesis techniques to underpin secure protocols such as unclonable encryption, secret sharing, and one-shot signatures.
• These primitives bridge theoretical security guarantees with practical applications in copy-protection and cryptographic systems resistant to cloning attacks.

Identical-copy secure unclonable primitives are quantum cryptographic primitives whose security is defined against adversaries that either attempt to split a single quantum object into two independently usable systems, or are given multiple identical copies of the same pure quantum state and must still be unable to create additional usable copies or duplicate the protected functionality. Recent work distinguishes this setting sharply from both ordinary single-copy security and security against independently generated copies: in the identical-copy setting the adversary receives $\ket{\psi}^{\otimes t}$, not merely $t$ independent samples from a distribution over states, and this difference can change feasibility, hardness, and the form of viable constructions (Ananth et al., 6 Oct 2025). The same distinction appears in the broader notion of multi-copy security, where the target is a $q \to q+1$ unclonability guarantee for exact duplicates of one pure state rather than merely collusion resistance for independently generated states (Çakan et al., 14 Oct 2025).

1. Copy complexity and the meaning of identical-copy security

The modern literature treats copy complexity as a first-class security parameter. A recurring taxonomy has three levels: single-copy security, where the adversary receives one copy of a quantum state; i.i.d.-copy security, where it receives $t$ independent copies, typically drawn as $\rho^{\otimes t}$; and identical-copy security, where it receives $t$ copies of the same pure state $\ket{\psi}^{\otimes t}$. The last notion is strictly stronger in the sense emphasized for copy-protection: the copies are “literally identical copies of one pure state,” not merely independent draws from the same distribution (Ananth et al., 6 Oct 2025).

This distinction is not cosmetic. In unclonable cryptography, identical copies can enable consistency tests, stronger adversarial coordination, and state-learning strategies that are absent or weaker in the single-copy model. The multi-copy literature therefore separates collusion resistance, where an adversary receives independently generated states, from multi-copy security, where it receives many exact copies of one pure state. The latter is the natural $q \to q+1$ unclonability game and does not automatically follow from the former (Çakan et al., 14 Oct 2025).

For copy-protection, one representative formalization requires that the protected output be a pure state $\ket{\psi_f}$, and that from $t$ identical copies $t$0 no QPT adversary can produce $t$1 accepted evaluations: $t$2 This formulation makes the “identical-copy” issue explicit: the adversary is not trying merely to learn information about $t$3, but to turn $t$4 exact copies of one quantum program state into $t$5 successful functional uses (Ananth et al., 6 Oct 2025).

An analogous distinction appears in nonlocal challenge models. Some works treat independent challenge distributions, in which two separated branches of an adversary receive unrelated challenges, while others require security under identical challenge distributions, which more directly captures the inability to turn one quantum object into two responders that both work on the same challenge. This stronger identical-challenge formulation is particularly important for single-decryptor encryption and related reductions to unclonable encryption (Ananth et al., 2023).

2. Primitive families and their formal anti-duplication games

A central example is unclonable encryption. In the quantum encryption of classical messages framework $t$6, the message and key are classical but the ciphertext may be quantum. The standard unclonability game gives a ciphertext to an adversary, lets it split the state between Bob and Charlie, reveals the key to both, and declares success if both output the original message. The scheme is called $t$7-unclonable secure if any QPT adversary succeeds with probability at most

$t$8

where $t$9 is the message length (Ananth et al., 2021). A stronger notion, unclonable-indistinguishability, asks the adversary to choose $q \to q+1$0, receive an encryption of $q \to q+1$1 for random $q \to q+1$2, split the ciphertext, and then have both branches guess $q \to q+1$3; security requires

$q \to q+1$4

This stronger notion implies both standard indistinguishability and unclonability and is the one that supports reductions to copy-protection (Ananth et al., 2021).

The one-bit version of this game has become a focal point. In the uncloneable-bit setting, the pirate adversary applies a CPTP map

$q \to q+1$5

to a ciphertext $q \to q+1$6, and Bob and Charlie, after later receiving the key $q \to q+1$7, output bits $q \to q+1$8. They win iff $q \to q+1$9. Strong security is the ideal bound $t$0 (Botteron et al., 2024).

A second major primitive is unclonable secret sharing (USS), introduced as a quantum analogue of secret sharing for a classical secret $t$1. A $t$2-USS scheme consists of QPT algorithms for share generation

$t$3

and reconstruction

$t$4

Correctness requires $t$5 when at least $t$6 valid shares are available. Unclonability is formalized by an indistinguishability-based game in which corrupted shareholders split each share into two parts destined for Bob and Charlie, both non-communicating, and the scheme is secure if they cannot both guess the challenge bit with probability noticeably better than $t$7: $t$8 The intended attack is precisely “copying a share and selling it to two buyers,” except that the shares are quantum states and the no-cloning principle may block the attack (Ananth et al., 2024).

A third family is one-shot signatures (OSS) and quantum signing tokens, where the quantum secret key is itself the unclonable resource. For OSS, even when the secret key is generated by the adversary, it should still be impossible to use one quantum signing key to produce two valid signatures. The representative oracle-model theorem gives secure OSS with $t$9-sized quantum secret keys such that for any quantum adversary making $\rho^{\otimes t}$0 oracle queries,

$\rho^{\otimes t}$1

The security notion is strong unforgeability under quantum attack: the attacker should not be able to produce even two different valid signatures for the same verification key (Shmueli et al., 6 Nov 2025).

Further variants generalize the anti-duplication pattern. Single-decryptor encryption (SDE) asks that one quantum decryption key cannot be turned into two decryptors that both work. Tokenized signatures ask that one token cannot sign both messages $\rho^{\otimes t}$2 and $\rho^{\otimes t}$3. PRF copy-protection asks that one quantum key $\rho^{\otimes t}$4 cannot be transformed into two states that both evaluate the PRF correctly on random inputs (Coladangelo et al., 2021). Across these formulations, the core game is stable: one quantum object should not yield two independently useful descendants.

3. State families, indistinguishability principles, and generic lifting frameworks

Several quantum state families recur across the area. One foundational example is the hidden coset state

$\rho^{\otimes t}$5

where $\rho^{\otimes t}$6 is a linear subspace and $\rho^{\otimes t}$7. These states have two complementary descriptions: in the computational basis they are supported on $\rho^{\otimes t}$8, while under full Hadamard transform they satisfy

$\rho^{\otimes t}$9

This complementarity underlies direct-product hardness and monogamy-of-entanglement statements used for tokenized signatures, unclonable decryption, and copy-protection (Coladangelo et al., 2021).

A second structural ingredient is simultaneous Haar indistinguishability (SHI). Here the question is whether non-communicating but entangled players can distinguish receiving identical Haar-random states from receiving independent Haar-random states. For dimension $t$0, the central theorem gives advantage at most $t$1 in the single-copy case, and more generally $t$2 when each player receives $t$3 copies. The distributions are

$t$4

versus

$t$5

This theorem directly supports plain-model unclonable encryption with quantum decryption keys and leakage-resilient secret sharing (Ananth et al., 2024).

A third theme is generic upgrading of weaker copy notions to stronger ones. One approach is a simulation theorem for “phase-randomized” pure states: if

$t$6

then an efficient simulator can reproduce $t$7 from $t$8 i.i.d. samples of a traced-out mixed-state family with trace-distance error bounded by

$t$9

This theorem yields a generic bridge from single-copy or i.i.d.-copy security to identical-copy security for pure-state primitives such as public-key quantum money and copy-protection (Ananth et al., 6 Oct 2025).

A related but distinct framework is the purification compiler from collusion-resistant security to multi-copy security. It applies when a generation algorithm has classically determined outputs, so that classical randomness $\ket{\psi}^{\otimes t}$0 determines a pure state $\ket{\psi}^{\otimes t}$1. Using PRS and PRFs, the compiler forms purified states of the form

$\ket{\psi}^{\otimes t}$2

The resulting theorem states that $\ket{\psi}^{\otimes t}$3 independently generated states can be transformed into something computationally indistinguishable from $\ket{\psi}^{\otimes t}$4, thereby converting collusion resistance into identical-copy or multi-copy security (Çakan et al., 14 Oct 2025).

At a higher level of abstraction, unclonable puncturable obfuscation (UPO) packages anti-cloning into a reusable nonlocal game. In UPO security, an adversary receives either an obfuscation of a real circuit or a punctured variant, splits into Bob and Charlie, receives challenges $\ket{\psi}^{\otimes t}$5, and tries to guess which world it is in; security requires

$\ket{\psi}^{\otimes t}$6

This modularizes identical-challenge and correlated-challenge security and becomes a common source for constructions of copy-protection, unclonable encryption, SDE, and quantum money (Ananth et al., 2023).

4. Positive constructions across the primitive landscape

The feasibility frontier is now populated by both unconditional and assumption-based constructions. For USS, information-theoretic feasibility is known when adversarial entanglement is absent or sufficiently restricted. In the disconnected-entanglement setting, a BB84-based construction secret-shares $\ket{\psi}^{\otimes t}$7 classically into bits $\ket{\psi}^{\otimes t}$8 with parity $\ket{\psi}^{\otimes t}$9, encodes the $q \to q+1$0 as $q \to q+1$1, and reveals the basis string $q \to q+1$2 in a classical share. The security analysis proves a monogamy-style lemma for tensor strategies: for one BB84 qubit the best simultaneous cloning success is bounded by $q \to q+1$3, and for $q \to q+1$4 qubits the parity-recovery advantage drops to

$q \to q+1$5

The same paper also gives a QROM construction secure against adversaries with arbitrary pre-shared entanglement, provided they are bounded in the number of random-oracle queries (Ananth et al., 2024).

For unclonable encryption, several milestones form a clear progression. A plain-model construction with quantum decryption keys uses SHI to show that the “same state to both players” and “independent states to each player” cases are simultaneously indistinguishable, yielding the first indistinguishability-secure UE in the plain model under that key model (Ananth et al., 2024). A later candidate for the unconditional uncloneable bit uses anti-commuting Clifford-algebra observables and conjectures the optimal success bound

$q \to q+1$6

That bound is proved for $q \to q+1$7, numerically confirmed up to $q \to q+1$8, and supported by an asymptotic upper bound of $q \to q+1$9 together with a numerical upper bound of $\ket{\psi_f}$0 (Botteron et al., 2024). The conjectural stage was overtaken by a full unconditional existence result: the uncloneable bit exists with cloning probability

$\ket{\psi_f}$1

for a scheme based on Clifford 2-designs. This gives exponentially small error above the ideal random-guess baseline and establishes strong uncloneability without computational assumptions (Bhattacharyya et al., 9 Mar 2026).

Unclonable signing primitives have also progressed toward lower persistent quantum memory. For OSS and quantum signing tokens, the central technical object is a coset state, and the main advance is a parallel measure-and-correct signing algorithm together with stronger subspace-hiding and anti-concentration lemmas. The oracle-model result gives $\ket{\psi_f}$2-sized quantum secret keys, while standard-model variants achieve $\ket{\psi_f}$3, $\ket{\psi_f}$4, or $\ket{\psi_f}$5 depending on assumptions such as subexponentially secure iO, exponentially secure one-way functions, LWE variants, lossy functions, and perfect decomposable trapdoor $\ket{\psi_f}$6-to-$\ket{\psi_f}$7 functions (Shmueli et al., 6 Nov 2025). Earlier hidden-coset techniques had already given tokenized signatures in the plain model from computational direct-product hardness, with the one-bit unforgeability condition that from one token no QPT adversary can output valid signatures for both messages $\ket{\psi_f}$8 and $\ket{\psi_f}$9 (Coladangelo et al., 2021).

For copy-protection and quantum money, identical-copy security has moved from isolated constructions to generic lifting theorems. The copy-expansion framework upgrades i.i.d.-secure copy-protection into identical-copy secure copy-protection under post-quantum secure PRFs, and similarly upgrades one-copy secure money into multi-copy secure public-key quantum money under post-quantum secure iO and injective one-way functions (Ananth et al., 6 Oct 2025). The purification compiler then yields the first multi-copy secure constructions of public-key quantum money, SDE, and search-secure UE from collusion-resistant counterparts, while also introducing quantum coins, where every honest banknote is the same pure state, and upgradable quantum coins, whose verification mode can be strengthened later by publishing additional classical information (Çakan et al., 14 Oct 2025). In parallel, UPO provides modular implication theorems showing that puncturable schemes, evasive functions with preimage-sampleability, unclonable encryption, SDE, and public-key quantum money all follow from a single anti-cloning abstraction (Ananth et al., 2023).

A further line concerns revocable primitives. Multi-copy secure revocable encryption is achieved in the random permutation model, revocable programs in a classical oracle model, and revocable point functions in the random permutation model and the QROM, all using random subset states

$t$0

The technical core is a $t$1 unforgeability theorem for subset states: from $t$2 copies of $t$3 and membership-oracle access, it remains hard to produce $t$4 distinct elements of $t$5 (Ananth et al., 2024).

5. Impossibility results, cloning attacks, and the role of entanglement

The same literature also maps strict limits on identical-copy security. For USS, information-theoretic security is impossible against fully connected adversaries with unbounded entanglement and unbounded computation. The attack uses ordinary teleportation, port-based teleportation, and repeated search over possibilities to move shares together, reconstruct the secret, and propagate it back to both recipients (Ananth et al., 2024). This shows that the existence of information-theoretically secure identical-copy primitives can depend critically on the entanglement graph and on whether adversaries are query-bounded, time-bounded, or both.

Even polynomially bounded entanglement can be sufficient against restricted reconstruction circuits. If a USS reconstruction circuit is implementable using Clifford gates and only $t$6 many $t$7-gates, then adversaries with polynomial time and polynomial pre-shared entanglement can attack it by teleporting shares together and homomorphically evaluating the reconstruction on Pauli-encrypted data. Each $t$8-gate requires guessing a hidden phase-correction bit, yielding success probability about $t$9; for $t$00, that inverse-polynomial success probability already violates security (Ananth et al., 2024).

Unclonable encryption exhibits analogous limitations. A generalization of the Broadbent–Lord information-theoretic construction to real-orthogonal monogamy games shows that the original $t$01 success upper bound is not tight. A simple cloning strategy based on the optimal phase-covariant cloner succeeds with probability at least

$t$02

where $t$03. For the specific conjugate-encryption scheme, an even simpler attack succeeds with probability

$t$04

These attacks show that the strongest form of indistinguishability-secure unclonable encryption is subtle and that some early information-theoretic constructions were significantly weaker than ideal (Ananth et al., 2021).

The multi-copy setting introduces a second kind of limitation: learnability from many identical copies. States long used in unclonable cryptography—specifically BB84 states $t$05, subspace or coset states, and SIS-based states—become vulnerable to tomography or state-learning when sufficiently many identical copies are available. The consequence drawn for revocable cryptography is that these familiar state families cannot directly underpin multi-copy secure revocable encryption or programs (Ananth et al., 2024).

These impossibility and attack results correct a common misconception that “unclonability” is a monolithic resource. The literature instead identifies several independent axes: whether copies are identical or merely i.i.d.; whether challenge distributions are identical or independent; whether attackers share disconnected, polynomial, or unbounded entanglement; whether correctness or reconstruction circuits have low non-Clifford complexity; and whether security is information-theoretic, oracle-based, or computational. Different points in this design space admit sharply different answers.

6. Classical and physical contrasts

The phrase “unclonable primitive” also appears in the literature on physical unclonable functions (PUFs), where the governing assumptions differ markedly from the quantum cryptographic setting. Optical PUFs are intended to be practically unclonable because of random and uncontrollable manufacturing variations, but manufacturer duplication can invalidate that premise. A notable nanofabrication study produced 99 nominal duplicates, discarded 36 visually damaged ones, and analyzed the remaining 63 copies of a non-trivial optical scattering structure. These exhibited “essentially the same scattering behavior,” with residual differences “close to or below noise levels,” so that from the PUF perspective the duplicates had to be treated as equivalent (Marakis et al., 2022).

The reported metrics illustrate the operational notion of equivalence. For the most similar pair among the 63 copies, the Pearson correlation between speckle patterns reached 87%, while the histogram of pairwise correlations peaked around 77%. After Gabor transformation and binarization, the like distribution of fractional Hamming distance had mean around 0.3, the unlike distribution mean around 0.48, and the distributions intersected at about 0.4, with no overlap for the tested samples (Marakis et al., 2022). In that setting, “unclonability” fails against the manufacturer even if it remains plausible against outsiders.

This physical contrast clarifies what is distinctive about quantum identical-copy security. In the PUF setting, effective duplication may both break old security assumptions and enable new applications such as group identification, anti-counterfeiting labels, and hardware encryption/decryption devices without embedded secret keys (Marakis et al., 2022). In the quantum setting, by contrast, the most significant recent development is that the uncloneable bit is now known to exist unconditionally, with security approaching the ideal $t$06 baseline exponentially fast (Bhattacharyya et al., 9 Mar 2026). A plausible implication is that the quantum notion has become more sharply delimited than the classical physical one: quantum identical-copy security is now supported by explicit no-cloning games, entropic monogamy bounds, and concrete constructive separations between feasible and infeasible regimes, whereas physical “unclonability” remains tightly coupled to fabrication models and operational noise thresholds.

Taken together, these developments place identical-copy secure unclonable primitives at the intersection of copy complexity, monogamy of entanglement, and quantum state synthesis. The field now contains formal definitions for exact-copy adversaries, generic compilers from weaker to stronger copy notions, unconditional and assumption-based constructions for multiple primitive families, and a substantial body of impossibility and attack results showing where unclonability fails. The resulting picture is not that unclonability is universally available, but that it is a technically precise and increasingly well-mapped quantum cryptographic resource.