Parallel-Query Pseudorandom Unitaries

• Parallel-query pseudorandom unitaries are ensembles of efficiently implementable unitaries that mimic Haar-random behavior under batched quantum oracle queries.
• They combine random Clifford gates, pseudorandom binary phase and permutation operators to achieve strong security even against adaptive adversaries.
• These constructions bridge unitary designs, quantum query complexity, and quantum cryptography, enabling practical simulations of Haar queries in quantum protocols.

Parallel-query pseudorandom unitaries are ensembles of efficiently implementable unitaries that are intended to be indistinguishable from Haar-random unitaries to quantum distinguishers with oracle access, in regimes where access may be batched, entangled, and non-adaptive, or more generally where arbitrary polynomial-time oracle access is allowed. In the non-adaptive formulation, the distinguisher prepares an arbitrary joint input state and applies a single parallel call $U^{\otimes t}$; in the full oracle formulation, it may interleave polynomially many calls to $U$ with arbitrary quantum computation, and in the strong formulation it may also query $U^\dagger$. The subject therefore sits at the intersection of unitary designs, quantum query complexity, and quantum cryptography, with the main conceptual divide being between parallel-only security and full adaptive security (Metger et al., 2024, Ma et al., 2024).

1. Oracle models and definitions

The standard oracle model for pseudorandom unitaries fixes an $n$-qubit oracle unitary $\mathcal{O}$ acting on a query register $\mathsf{A}$, together with an ancilla or workspace register $\mathsf{B}$ of $m=\mathrm{poly}(n)$ qubits. A forward-only $t$-query adversary is parameterized by inter-query unitaries $A_1,\dots,A_t$ on $U$0, and its final state is

$U$1

In the strong setting, the adversary may alternate between forward and inverse queries. Writing $U$2, with $U$3 denoting $U$4 and $U$5 denoting $U$6, the final state is

$U$7

A family $U$8, with $U$9, is a pseudorandom unitary family if it is efficiently computable and if no polynomial-time oracle adversary can distinguish $U^\dagger$0 from Haar-random with more than negligible advantage; a strong PRU is secure even when the adversary can query both $U^\dagger$1 and $U^\dagger$2 (Ma et al., 2024).

The non-adaptive, or parallel-query, formulation specializes this oracle model to a single batch query. The distinguisher prepares an arbitrary state $U^\dagger$3, applies $U^\dagger$4 once on registers $U^\dagger$5, and then performs an arbitrary measurement. Security is equivalently phrased as computational indistinguishability of

$U^\dagger$6

In this sense, “parallel-query PRU” originally meant indistinguishability under one use of $U^\dagger$7, whereas later work uses the full oracle model and thereby strictly contains the parallel setting as a special case (Metger et al., 2024).

A recurring source of confusion is that the full oracle model already includes substantial parallelism. A single oracle call acts on the entire query register, so it automatically supports superpositions over all $U^\dagger$8 basis inputs. What the formalism counts is the number of oracle uses $U^\dagger$9, not a notion of rounds. This means that adaptivity, superposition queries, and arbitrary entanglement are unconstrained; only total oracle-gate complexity is polynomially bounded (Ma et al., 2024).

2. Non-adaptive and parallel-query constructions

The first explicit non-adaptive construction uses the composition

$n$0

where $n$1 is a random Clifford unitary, $n$2 is a pseudorandom binary phase operator

$n$3

and $n$4 is a pseudorandom permutation operator

$n$5

Assuming quantum-secure one-way functions, and hence quantum-secure PRFs and PRPs, this ensemble is secure against non-adaptive distinguishers, meaning that no efficient quantum query algorithm allowed a single application of $n$6 can distinguish it from Haar randomness (Metger et al., 2024).

A closely related line of work introduced the $n$7 ensemble,

$n$8

with $n$9 a random computational-basis permutation, $\mathcal{O}$0 a random binary phase operator, and $\mathcal{O}$1 a random Clifford unitary. The key information-theoretic statement is that the $\mathcal{O}$2 ensemble is a diamond $\mathcal{O}$3-approximate $\mathcal{O}$4-design with

$\mathcal{O}$5

Because this error is negligible for polynomial $\mathcal{O}$6, replacing the truly random classical pieces by pseudorandom function and permutation families yields non-adaptive PRUs. The same framework also gives adaptive pseudorandom isometries once the unitary model is relaxed to isometries from $\mathcal{O}$7 to $\mathcal{O}$8 qubits (Metger et al., 2024).

A second construction lifts random permutations on $\mathcal{O}$9 to random unitaries on $\mathsf{A}$0, $\mathsf{A}$1, by forming products of exponentials of sparse Hermitian matrices built from phased permutations. The resulting ensemble is shown to approximate Haar moments up to $\mathsf{A}$2, and substituting $\mathsf{A}$3-wise independent permutations gives efficient $\mathsf{A}$4-designs, while substituting quantum-secure PRPs gives a parallel-secure PRU. In that framework, the operational distinguishability of an ensemble $\mathsf{A}$5 under $\mathsf{A}$6 parallel queries is captured by the diamond norm between the twirling channels

$\mathsf{A}$7

and the Haar twirl $\mathsf{A}$8 (Chen et al., 2024).

These works established a precise parallel-query notion but also exposed its limitation. The non-adaptive model captures a single global batch $\mathsf{A}$9, whereas adaptive distinguishers may interleave arbitrary channels between oracle calls. The early papers therefore left open whether the same simple $\mathsf{B}$0-type constructions remain secure against fully adaptive distinguishers, and that gap became the main structural question for PRUs (Metger et al., 2024, Metger et al., 2024).

3. Full existence theorems for standard and strong PRUs

The general existence question was resolved by proving that pseudorandom unitaries exist assuming any quantum-secure one-way function exists. Two variants were established. For standard PRUs, secure against forward-only oracle adversaries, the construction is

$\mathsf{B}$1

where $\mathsf{B}$2 is a random permutation of $\mathsf{B}$3, $\mathsf{B}$4 is a random Boolean function on $\mathsf{B}$5, $\mathsf{B}$6, $\mathsf{B}$7, and $\mathsf{B}$8 is drawn from an exact unitary 2-design such as the random Clifford group. For every $\mathsf{B}$9-query adversary,

$m=\mathrm{poly}(n)$0

Replacing the truly random permutation, function, and 2-design pieces by pseudorandom counterparts under quantum-secure one-way functions yields a computational PRU (Ma et al., 2024).

For strong PRUs, secure against adversaries that can query both $m=\mathrm{poly}(n)$1 and $m=\mathrm{poly}(n)$2, the construction becomes

$m=\mathrm{poly}(n)$3

where $m=\mathrm{poly}(n)$4 is now ternary, $m=\mathrm{poly}(n)$5 with $m=\mathrm{poly}(n)$6, and both $m=\mathrm{poly}(n)$7 and $m=\mathrm{poly}(n)$8 come from a unitary 2-design. The statistical bound for every $m=\mathrm{poly}(n)$9-query forward-and-inverse adversary is

$t$0

This gives strong computational PRUs under the same quantum-secure one-way-function assumption (Ma et al., 2024).

These theorems are stronger than the earlier parallel-only results in two ways. First, the security definition is not restricted to a single batch call $t$1, but quantifies over arbitrary polynomial-time oracle circuits. Second, the strong notion explicitly allows inverse access. A non-adaptive parallel distinguisher is therefore just one special case of the general theorem. This suggests that the conceptual distinction is not “parallel versus non-parallel” in isolation, but rather “single-batch non-adaptive access versus unrestricted oracle access” (Ma et al., 2024).

4. Path-recording simulation of Haar queries

The conceptual core of the adaptive theory is the path-recording oracle. In the forward-only case, for an $t$2-qubit Haar-random unitary $t$3, one defines an efficiently implementable linear map $t$4 acting on the query register together with a relation register $t$5 that stores pairs $t$6. In simplified form,

$t$7

It maps an input $t$8 to a uniform superposition over currently unused outputs $t$9, while recording the pair in $A_1,\dots,A_t$0. For every $A_1,\dots,A_t$1-query algorithm,

$A_1,\dots,A_t$2

Thus any algorithm making up to $A_1,\dots,A_t$3 queries to a Haar-random unitary can be simulated by an explicit efficient quantum circuit up to trace distance $A_1,\dots,A_t$4 (Ma et al., 2024).

When inverse queries are allowed, the bookkeeping is richer. The strong-security analysis introduces forward and inverse relation registers, partial path-recording isometries, and a symmetrized fully defined oracle $A_1,\dots,A_t$5 that reproduces the purified dynamics of the ternary permutation-function construction. The corresponding simulation theorem states that for any $A_1,\dots,A_t$6-query forward-and-inverse algorithm,

$A_1,\dots,A_t$7

The paper’s abstract summarizes the upshot more broadly: any algorithm that makes queries to a Haar-random unitary can be efficiently simulated on a quantum computer, up to inverse-exponential trace distance (Ma et al., 2024).

The importance for parallel-query security is that these simulation bounds depend only on $A_1,\dots,A_t$8 and $A_1,\dots,A_t$9, not on the temporal organization of queries. The proofs reason about the full joint adversary state after $U$00 oracle uses, together with projectors onto “distinct” subspaces and variable-length relation registers encoding full coherent histories. This removes any need for a sequential Markovian interpretation of the oracle interaction (Ma et al., 2024).

5. How parallel access fits into the modern theory

In the single-oracle setting, the standard quantum oracle model already subsumes parallel-query strategies. A single call $U$01 acts on the full $U$02-dimensional query register and therefore supports superpositions over all classical inputs. A non-adaptive batch adversary that applies $U$03 once is just a special case of a more general oracle algorithm, and the full PRU and strong-PRU definitions strictly contain such models (Ma et al., 2024).

Earlier non-adaptive papers made this distinction explicit. In the non-adaptive model, the relevant object is one global twirl channel on $U$04 copies, and the proof strategy reduces everything to the comparison of

$U$05

That analysis is sufficient for batch security but does not automatically address arbitrary adaptive compositions

$U$06

which explains why adaptive security remained open in the unitary case even after non-adaptive PRUs had been constructed (Metger et al., 2024).

A second misconception concerns “many independent parallel oracle instances.” The single-oracle theory does not explicitly formalize a multi-instance model in which the adversary receives independent oracles $U$07 and can query them all in parallel. The full adaptive PRU proofs are stated for repeated uses of one oracle instance. The paper notes that if one wants $U$08 independent parallel queries to an $U$09-qubit unitary, that corresponds to a different oracle model, and it is not explicitly treated. A plausible implication is that many applications can still be reduced to a larger single-instance Hilbert space, but this extension is not part of the formal theorem (Ma et al., 2024).

The gluing perspective reinforces the same point. Low-depth constructions built from overlapping local Haar blocks are analyzed through the adversary’s joint state and overall query count rather than any syntactic notion of rounds, which is why the resulting indistinguishability statements are naturally compatible with wide, low-depth, highly parallel oracle use (Ma et al., 2024, Metger et al., 2024).

6. Stronger oracle models, idealized variants, and later extensions

The inverseless Haar random oracle model provides an idealized benchmark for parallel-query pseudorandomness. In that model, all parties share access to a common Haar-random unitary $U$10, but not to $U$11. It was shown that unbounded-query secure PRUs exist with a construction that makes two calls to the Haar oracle, while any construction making only a single call to the Haar oracle cannot achieve unbounded-query security. The single-call regime nevertheless admits bounded-query secure PRUs, with a threshold around $U$12 queries in the parallel or non-adaptive setting (Ananth et al., 2024).

A distinct idealized model, the invertible quantum Haar random oracle model, gives all parties access to a common Haar-random unitary and its inverse. In that setting, classically-accessible adaptive secure pseudorandom function-like state generators were constructed, but simple keyed-unitary templates such as

$U$13

were shown not to be quantum-accessible PRFSGs and in particular not to be PRUs. The attack uses a Simon-type quantum procedure and exploits coherent access to both the public Haar unitary and the keyed construction. This demonstrates that not every apparently natural “mask a Haar unitary by simple conjugation” template survives quantum parallel access (Hhan et al., 2024).

The strongest post-2024 extension enlarges the oracle model beyond $U$14 and $U$15 to include $U$16 and $U$17. This work introduces strong unitary designs and strong PRUs that remain robust under all such queries, including parallel and adaptive access patterns, and proves constructions of depth $U$18 for strong designs and $U$19 for ancilla-free strong PRUs. Its motivation is that butterfly-effect experiments, Hayden–Preskill decoding, and related scrambling diagnostics use precisely these richer oracle interfaces, which conventional designs and strong PRUs do not cover (Schuster et al., 30 Sep 2025).

Taken together, these results give a layered picture of parallel-query pseudorandomness. Non-adaptive PRUs address one batch $U$20; standard and strong PRUs address arbitrary polynomial-time oracle use of $U$21 and possibly $U$22; and later strong-design notions extend further to $U$23 and $U$24. This suggests that “parallel-query pseudorandom unitary” is best understood not as one single definition, but as a family of oracle indistinguishability notions ordered by the richness of the allowed query interface and the extent of adaptivity they permit.