Multi-Level Traitor Tracing (MLTT)

• Multi-Level Traitor Tracing is a quantum-secure, collusion-resistant tracing primitive that uses level-indexed secret keys to recover identity tuples from pirate programs.
• The methodology features deterministic, multi-level key generation and evaluation, ensuring consistent output and robust identification of colluders.
• MLTT acts as a compiler interface to upgrade secure key leasing schemes, impacting fields such as PRFs, digital signatures, and even machine learning watermarking.

Searching arXiv for MLTT and closely related traitor-tracing papers. Multi-Level Traitor Tracing (MLTT) is a quantum-secure, collusion-resistant tracing primitive introduced as a middle-layer abstraction for compiling traitor tracing into collusion-resistant secure key leasing (SKL). In its formal form, MLTT assigns one secret key per level, requires deterministic evaluation across levels, and provides a tracing algorithm that can recover a tuple of identities from any quantum pirate program that remains sufficiently useful after deletion-like behavior (Kitagawa et al., 6 Oct 2025). Although the name is recent, several earlier lines of work in multimedia fingerprinting, dynamic Tardos tracing, deep neural network watermarking, and federated learning already exhibited staged, hierarchical, or suspect-refinement structures that are closely aligned with MLTT in spirit, even when they were not formulated under that terminology (Gu et al., 2023).

1. Origins and conceptual scope

The explicit notion of MLTT appears in "Collusion-Resistant Quantum Secure Key Leasing Beyond Decryption" (Kitagawa et al., 6 Oct 2025). There, MLTT is presented as a generalization of quantum-secure collusion-resistant traitor tracing designed for applications in which a valid evaluator must combine several correlated secret keys, one from each of $k$ levels. The central motivation is that earlier SKL constructions for primitives such as pseudorandom functions and signatures did not handle polynomially many leased keys, and classical traitor-tracing abstractions were not the exact fit for that setting.

Two conceptual features distinguish MLTT from ordinary single-level tracing. First, the secret material is level-indexed: key generation is parameterized by both a level $i\in[k]$ and an identity $id\in[N]$. Second, tracing targets quantum pirate programs rather than only classical forged decoders. The traced object is therefore not merely a user index but a tuple $(id_1,\dots,id_k)$, one identity per level (Kitagawa et al., 6 Oct 2025).

The same paper also emphasizes a less obvious point: the traceability game samples identities randomly rather than letting the adversary choose them. This is a weaker-looking formulation than some classical traitor-tracing games, but it is stated to be exactly sufficient for the SKL compiler. This suggests that MLTT is not intended as a purely autonomous tracing notion; it is tailored to the structure required by the leasing reduction.

A common source of confusion is the relation between MLTT and two-stage tracing more broadly. Several earlier constructions are indeed hierarchical, dynamic, or list-decoding-based, but they do not instantiate the full MLTT syntax or the quantum traceability game. In that sense, MLTT is both a new formal definition and a point of convergence for older staged tracing ideas.

2. Formal model

An MLTT scheme for an application $(F,E,t)$ is a tuple

$MLTT = (Setup, KG, Eval, Trace).$

The application parameters consist of a quantum correctness predicate $F$, a quantum security predicate $E$, and a threshold $t\in[0,1)$ separating acceptable from unacceptable pirate behavior (Kitagawa et al., 6 Oct 2025).

The algorithms are defined as

$$Setup(1^\lambda, N, k) \to (\mathsf{msk}, f, aux_f),$$

$i\in[k]$0

$i\in[k]$1

and

$i\in[k]$2

Here, $i\in[k]$3 is the security parameter, $i\in[k]$4 is the identity-space size, and $i\in[k]$5 is the number of levels. The paper assumes deterministic key generation $i\in[k]$6, noting that this is without loss of generality assuming post-quantum PRFs (Kitagawa et al., 6 Oct 2025).

Correctness is defined relative to the predicate $i\in[k]$7. Beyond ordinary correctness, MLTT imposes a deterministic-evaluation condition: for overwhelming probability over $i\in[k]$8 and over $i\in[k]$9, there exists a value $id\in[N]$0 such that for all identity choices $id\in[N]$1,

$id\in[N]$2

This condition is operationally important because the SKL compiler later uses coherent superpositions of keys, and the output must remain stable across different identity combinations (Kitagawa et al., 6 Oct 2025).

The traceability game $id\in[N]$3 captures collusion resistance. The challenger samples

$id\in[N]$4

provides $id\in[N]$5 to the adversary, and then—for each level $id\in[N]$6 and each user index $id\in[N]$7—samples

$id\in[N]$8

If the adversary outputs a quantum program $id\in[N]$9 that is $(id_1,\dots,id_k)$0-good, the challenger runs

$(id_1,\dots,id_k)$1

Writing $(id_1,\dots,id_k)$2, security requires that the adversary cannot force

$(id_1,\dots,id_k)$3

except with negligible probability (Kitagawa et al., 6 Oct 2025).

The $(id_1,\dots,id_k)$4-good test is itself part of the definition. Informally, the pirate program must still satisfy the security predicate $(id_1,\dots,id_k)$5 with success probability at least $(id_1,\dots,id_k)$6. The paper frames this test using Zhandry-style projective implementation and approximate projective implementation so that usefulness can be estimated without excessively destroying the quantum state (Kitagawa et al., 6 Oct 2025).

3. Security guarantee and the SKL compiler

The principal role of MLTT is as a compiler interface. The paper proves that if there exists an MLTT scheme for $(id_1,\dots,id_k)$7 satisfying traceability, then the compiler yields an SKL scheme for $(id_1,\dots,id_k)$8 with bounded standard-KLA security (Kitagawa et al., 6 Oct 2025). In that reduction, each leased key is assembled from level-wise quantum states

$(id_1,\dots,id_k)$9

where $(F,E,t)$0, $(F,E,t)$1, and

$(F,E,t)$2

The full leased key is $(F,E,t)$3, while the verification key stores the classical data needed for deletion-certificate verification (Kitagawa et al., 6 Oct 2025).

Evaluation applies $(F,E,t)$4 coherently inside the superposition, and deletion measures each $(F,E,t)$5 register in the Hadamard basis. Verification checks the corresponding consistency relation; in the paper’s simplified notation,

$(F,E,t)$6

This structure ties the soundness of deletion certificates to the ability to trace any residual pirate program that remains effective (Kitagawa et al., 6 Oct 2025).

The reduction relies on two ingredients. The first is MLTT traceability itself: if the adversary outputs an $(F,E,t)$7-good pirate program whose traced identities are outside the sampled identity sets, then MLTT is broken. The second is a new theorem on many two-superposition states, built from states of the form

$(F,E,t)$8

For $(F,E,t)$9, the paper states that there exists $MLTT = (Setup, KG, Eval, Trace).$0 such that any unbounded QPT adversary succeeds with probability at most

$MLTT = (Setup, KG, Eval, Trace).$1

This parallelized information-theoretic hardness statement is the quantum core enabling collusion resistance in the compiler proof (Kitagawa et al., 6 Oct 2025).

The construction has direct downstream consequences. The same work gives the first bounded collusion-resistant SKL scheme for PRFs, assuming LWE; a compiler that upgrades any single-key secure SKL scheme for digital signatures into one with unbounded collusion-resistance, assuming OWFs; and a compiler that upgrades collusion-resistant SKL schemes with classical certificates to ones having verification-query resilience, also assuming OWFs (Kitagawa et al., 6 Oct 2025). These results situate MLTT not as an endpoint but as a reusable primitive for post-quantum leasing constructions.

4. Hierarchical decoding before the MLTT name

Before MLTT was formalized, staged tracing already appeared in coding-theoretic traitor tracing. "Secure Codes with List Decoding" introduces secure codes with list decoding (SCLDs) for collusion-resistant multimedia fingerprinting, unifying frameproof codes, separable codes, and hypercodes with list decoding (Gu et al., 2023). The defining SCLD conditions combine complete traceability with bounded candidate-list size:

$MLTT = (Setup, KG, Eval, Trace).$2

for distinct coalitions up to size $MLTT = (Setup, KG, Eval, Trace).$3, and

$MLTT = (Setup, KG, Eval, Trace).$4

for any descendant vector $MLTT = (Setup, KG, Eval, Trace).$5.

The identifying algorithm is explicitly two-step. Step 1 filters the code to a candidate set $MLTT = (Setup, KG, Eval, Trace).$6 by checking $MLTT = (Setup, KG, Eval, Trace).$7, which guarantees all traitors lie in $MLTT = (Setup, KG, Eval, Trace).$8 and $MLTT = (Setup, KG, Eval, Trace).$9. Step 2 enumerates subsets of $F$0 of size at most $F$1 and outputs the unique subset whose descendant vector equals $F$2. The total time complexity is

$F$3

with the corollary that $F$4 yields $F$5 time with complete traceability (Gu et al., 2023). This is strongly MLTT-like in the sense that coarse filtering precedes exact attribution.

The same paper also proposes a two-stage dynamic traitor tracing framework based on a $F$6-HLD in Stage 1 and a $F$7-SCLD in Stage 2. The first stage reduces the suspect set to size at most $F$8; the second stage applies SCLD decoding on that reduced set with $F$9. The total capacity is stated as

$E$0

with time complexity

$E$1

subject to

$E$2

The paper describes this as a dynamic two-stage tracing framework rather than MLTT, but its structure is a direct precursor to suspect-set shrinking followed by exact tracing (Gu et al., 2023).

A different hierarchical lineage appears in "Dynamic Traitor Tracing for Arbitrary Alphabets: Divide and Conquer" (Laarhoven et al., 2012). There, a $E$3-ary dynamic scheme is built from smaller-alphabet schemes by dividing users into $E$4 groups, assigning each group a disjoint alphabet block, and updating only the subgroup whose symbols appear in the pirate output. This produces a hierarchy of probabilistic dynamic traitor tracing schemes and yields a linear tradeoff between alphabet size and codelength. Applied to the binary dynamic Tardos base scheme, the resulting codelength is

$E$5

The large scheme is thus assembled from local schemes responsible for subpopulations and disjoint symbol blocks, a structure that is hierarchical in both alphabet and tracing resolution (Laarhoven et al., 2012).

These works show that hierarchical tracing long predates the formal term MLTT. What MLTT adds is a specific multi-level syntax, a quantum traceability game, and a deterministic evaluation requirement tailored to cryptographic compilation.

5. MLTT-like tracing in machine learning watermarking

In machine-learning security, the closest analogues of MLTT are staged watermarking schemes that escalate from weaker to stronger evidence. "Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes" presents a combined black-and-white-box watermarking pipeline for DNN classifiers that first accuses through black-box trigger queries and then, after access to the leaked model is granted, confirms and refines attribution through white-box fingerprinting (Rodriguez-Lois et al., 2023). The black-box stage uses a $E$6-ary Tardos code over trigger labels, with user codewords

$E$7

bias vectors drawn from a symmetric Dirichlet distribution, per-trigger scores

$E$8

and

$E$9

Rather than waiting for all triggers, the scheme accumulates evidence sequentially through an SPRT:

$t\in[0,1)$0

The white-box stage embeds orthogonal-code fingerprints in the weights through

$t\in[0,1)$1

with projection scores

$t\in[0,1)$2

The resulting workflow is explicitly described as “catch-one then refine”: the black-box stage identifies at least one colluder, while the white-box stage identifies additional traitors once model access is available (Rodriguez-Lois et al., 2023).

This DNN setting also reveals an important limitation of directly importing classical tracing theory. The Marking Assumption may fail because model averaging, fine-tuning, and pruning can alter trigger outputs in ways not captured by classical descendant models. The paper treats this as a primary open issue, even though its experiments on MNIST show that the combined method can still identify traitors and that the Tardos-based black-box stage requires far fewer total queries than an independent-trigger baseline (Rodriguez-Lois et al., 2023).

A related but distinct line is "BlackCATT: Black-box Collusion Aware Traitor Tracing in Federated Learning" (Rodríguez-Lois et al., 12 Feb 2026). BlackCATT is not presented as a full hierarchical MLTT scheme. Its accusation remains per-client, using black-box Tardos-style scores

$t\in[0,1)$3

with accusation threshold $t\in[0,1)$4. Its main contribution is instead a collusion-aware embedding loss combined with iterative trigger optimization:

$t\in[0,1)$5

where

$t\in[0,1)$6

and the trigger set is optimized by PGD. The paper explicitly measures Marking Assumption Violation (MAV),

$t\in[0,1)$7

and shows that trigger optimization can reduce MAV and accelerate tracing. Yet it also states that the method does not implement an explicit multi-stage group-to-individual refinement process; the “multi-level” aspect is only implicit (Rodríguez-Lois et al., 12 Feb 2026).

Taken together, these machine-learning works support a narrower usage of the term: MLTT-like tracing in this context refers to evidence accumulation in stages, typically from black-box accusation to stronger internal confirmation. That is conceptually aligned with MLTT, but it is not the same as the formal quantum primitive.

6. Tradeoffs, assumptions, and open problems

Across the literature, MLTT and MLTT-like schemes are shaped by tradeoffs among traceability strength, decoding complexity, bandwidth, and model realism. In SCLDs, the list size $t\in[0,1)$8 controls the tradeoff between code rate and decoding cost; in the dynamic two-stage framework, $t\in[0,1)$9 and $$Setup(1^\lambda, N, k) \to (\mathsf{msk}, f, aux_f),$$0 control rate-complexity behavior; in divide-and-conquer dynamic tracing, alphabet size $$Setup(1^\lambda, N, k) \to (\mathsf{msk}, f, aux_f),$$1 trades linearly against codelength; and in DNN watermarking, black-box evidence is cheaper and less intrusive but weaker than white-box inspection (Gu et al., 2023).

The formal MLTT definition itself imposes assumptions that are highly specific. Deterministic evaluation across identities is crucial for coherent leased-key evaluation, and the security game uses randomly sampled identities rather than adversarially chosen ones. Bounded and unbounded collusion are separated by parameter choices such as $$Setup(1^\lambda, N, k) \to (\mathsf{msk}, f, aux_f),$$2 for bounded security and $$Setup(1^\lambda, N, k) \to (\mathsf{msk}, f, aux_f),$$3 in settings that support unbounded identity spaces (Kitagawa et al., 6 Oct 2025). A plausible implication is that MLTT is best understood as an application-shaped tracing notion rather than a universal replacement for classical traitor tracing.

In machine-learning settings, the main unresolved issue is the gap between classical collusion models and actual model behavior. The DNN watermarking work identifies violation of the Marking Assumption, dependence on trigger design and class distribution, lack of a full theoretical analysis of score distributions under MA violations, and limited evaluation on small CNNs on MNIST as explicit limitations (Rodriguez-Lois et al., 2023). In federated learning, BlackCATT assumes an honest trusted aggregator, i.i.d. data across clients, classification tasks only, and black-box verification only; it also notes that trigger optimization can weaken the assumptions behind Tardos-code analysis and that more explicit support for true multi-level tracing remains future work (Rodríguez-Lois et al., 12 Feb 2026).

A second misconception concerns the scope of the term. Not every two-stage decoder, dynamic tracing scheme, or black-box/white-box pipeline is formally MLTT. The coding-theoretic and machine-learning systems surveyed here are better described as antecedents, analogues, or partial realizations of multi-level tracing. By contrast, the formal MLTT definition requires multi-level key generation, deterministic cross-identity evaluation, and tracing against quantum pirate programs (Kitagawa et al., 6 Oct 2025).

The emerging picture is therefore bifurcated. In cryptography, MLTT is a precise primitive enabling collusion-resistant SKL. In adjacent areas, the same phrase naturally denotes staged tracing architectures that narrow a suspect set and then refine attribution. The literature collectively suggests that hierarchical evidence accumulation is the unifying design principle, but the technical meaning of MLTT remains domain-dependent unless the full formal syntax is specified.