Pseudorandom Quantum States: Concepts & Constructions

• PRS are keyed families of efficiently generable quantum states that are computationally indistinguishable from Haar-random states even with polynomially many copies.
• They are constructed using quantum-secure functions and techniques that allow scalable, adaptive, and even noise-robust variants for advanced cryptographic protocols.
• PRS reveal key resource-theoretic phenomena and structural limitations, bridging classical pseudorandomness with quantum cryptographic applications.

Searching arXiv for papers on pseudorandom quantum states and closely related notions. Pseudorandom quantum states (PRS) are keyed families of efficiently generable pure quantum states that are computationally indistinguishable from Haar-random pure states even when a distinguisher receives polynomially many identical copies. Introduced by Ji, Liu, and Song and used throughout subsequent work, PRS occupy a central place in quantum cryptography as quantum analogues of classical pseudorandom generators, while exhibiting structural features with no direct classical counterpart. Recent work has broadened the theory in several directions: scalable constructions in which the security parameter is decoupled from output length (Brakerski et al., 2020), function-like and adaptive variants (Batra et al., 30 Jul 2025), mixed-state generalizations via pseudorandom density matrices (Bansal et al., 2024), stronger scrambling notions acting on arbitrary inputs (Lu et al., 2023), and black-box separation results clarifying the limits of shrinking, stretching, and deriving classical pseudorandom generators from PRS (Bouaziz--Ermann et al., 2024, Chen et al., 23 Jun 2026, Barhoush, 23 Oct 2025).

1. Definition and basic model

The standard PRS notion used across the literature is a keyed family of $n$-qubit pure states $\{|\phi_k\rangle\}_{k\in K}$ such that two conditions hold. First, there is an efficient quantum algorithm $G$ that, on input the key $k$, outputs $|\phi_k\rangle$. Second, for any polynomial $t$ and any quantum polynomial-time distinguisher $A$, the ensembles $\{|\phi_k\rangle^{\otimes t}\}$ and $$\{|\psi\rangle^{\otimes t}\}_{|\psi\rangle\sim \mu}$$, where $\mu$ is Haar measure on the relevant Hilbert space, are computationally indistinguishable (Lu et al., 2023, Bansal et al., 2024, Barhoush, 23 Oct 2025, Bouaziz--Ermann et al., 2024, Doosti et al., 2021).

A representative formal expression is

$\{|\phi_k\rangle\}_{k\in K}$0

with $\{|\phi_k\rangle\}_{k\in K}$1 polynomial in the security parameter $\{|\phi_k\rangle\}_{k\in K}$2 (Lu et al., 2023). Equivalent formulations appear with $\{|\phi_k\rangle\}_{k\in K}$3 rather than $\{|\phi_k\rangle\}_{k\in K}$4 as the main asymptotic variable (Bansal et al., 2024, Bouaziz--Ermann et al., 2024).

This definition is intrinsically multi-copy. The distinguisher is allowed polynomially many identical copies because a single quantum state cannot, in general, be cloned. That feature sharply distinguishes PRS from classical pseudorandom generators: the quantum notion is explicitly parameterized by copy complexity rather than by a single output string (Bouaziz--Ermann et al., 2024, Chen et al., 23 Jun 2026).

A weaker notion, single-copy pseudorandom states or $\{|\phi_k\rangle\}_{k\in K}$5-PRS, requires security only for $\{|\phi_k\rangle\}_{k\in K}$6, together with an output-length stretch condition $\{|\phi_k\rangle\}_{k\in K}$7 so that trivial encodings do not qualify (Chen et al., 23 Jun 2026). Recent work shows that any $\{|\phi_k\rangle\}_{k\in K}$8-PRS can be amplified to $\{|\phi_k\rangle\}_{k\in K}$9-copy security for any polynomial $G$0 without additional assumptions, yielding generic number-of-copies amplification (Brakerski et al., 28 Jun 2026). This suggests that polynomial-copy security is not, at the level of existence, strictly stronger than single-copy security, although black-box limits still arise for other transformations such as stretching output length (Chen et al., 23 Jun 2026).

2. Constructions and scalable pseudorandomness

A standard construction paradigm first proves a statistical statement relative to a truly random classical function and then replaces that function by a quantum-secure pseudorandom function. Earlier constructions randomized phases only, but scalable PRS required a different mechanism: randomizing amplitudes as well as phases (Brakerski et al., 2020).

The paper “Scalable Pseudorandom Quantum States” shows that any quantum-secure one-way function implies scalable PRS (Brakerski et al., 2020). Its central oracle-level construction produces asymptotically random states by sampling approximate complex Gaussian amplitudes, using the fact that a normalized complex Gaussian vector is Haar-distributed. The resulting trace-distance bound between $G$1 copies of the oracle construction and $G$2 copies of a Haar-random state is

$G$3

which is negligible in $G$4 for polynomial $G$5 (Brakerski et al., 2020). Replacing the random function with a quantum-secure PRF yields scalable computational PRS under post-quantum one-way functions (Brakerski et al., 2020).

A later construction gives a new isometric method for scalable PRS and, from it, the first scalable and quantum-accessible adaptive pseudorandom function-like quantum state generators (PRFS) under quantum-secure one-way functions (Batra et al., 30 Jul 2025). The construction is notable for introducing no entanglement or correlations with the environment, which is especially useful for adaptive function-like variants.

Subset-state constructions show that relative phases are not necessary for state pseudorandomness. Two independent 2023 papers prove that random subset states—equal superpositions over randomly chosen subsets of computational basis states—are information-theoretically indistinguishable from Haar-random states in an intermediate regime of subset sizes (Jeronimo et al., 2023, Giurgica-Tiron et al., 2023). In one formulation, if $G$6, $G$7, and the subset size $G$8 satisfies

$G$9

then

$k$0

so the ensembles are statistically close for polynomially many copies (Jeronimo et al., 2023). With a quantum-secure pseudorandom permutation, this yields an efficiently generable PRS family (Jeronimo et al., 2023). This resolves a conjecture of Ji, Liu, and Song and shows that state pseudorandomness does not require random phases (Jeronimo et al., 2023, Giurgica-Tiron et al., 2023).

3. Variants: scramblers, function-like generators, and mixed-state generalizations

A major strengthening of the original generator notion is the pseudorandom state scrambler (PRSS). Whereas a standard pseudorandom state generator maps a fixed initial state, usually $k$1, to a pseudorandom output, a PRSS is a keyed family of isometries $k$2 such that for every fixed input pure state $k$3, the outputs $k$4 are pseudorandom against polynomially many copies (Lu et al., 2023). This remedies a limitation of earlier PRSG constructions, which can fail badly on inputs other than the designated initial state (Lu et al., 2023).

The information-theoretic core of PRSS is built from a parallel version of Kac’s walk. On a space of dimension $k$5, the parallel walk mixes in total variation in $k$6 steps rather than the $k$7 behavior of the standard walk, making polynomial-size implementations possible (Lu et al., 2023). The resulting random scrambler also has a dispersing property: for every input, the set of outputs over keys forms a negligible-$k$8-net of the sphere (Lu et al., 2023). This is substantially stronger than what standard PRS generators guarantee.

The mixed-state extension is pseudorandom density matrices (PRDMs). A PRDM family $k$9 is efficiently generable and computationally indistinguishable from the $|\phi_k\rangle$0 generalized Hilbert–Schmidt ensemble

$|\phi_k\rangle$1

obtained by tracing out $|\phi_k\rangle$2 qubits from Haar-random $|\phi_k\rangle$3-qubit pure states (Bansal et al., 2024). When $|\phi_k\rangle$4, PRDMs reduce exactly to standard PRS (Bansal et al., 2024). For $|\phi_k\rangle$5, the GHSE is statistically indistinguishable from the maximally mixed state on polynomially many copies, since

$|\phi_k\rangle$6

and hence PRDMs in this regime are computationally indistinguishable from maximally mixed as well (Bansal et al., 2024).

The same paper also introduces memoryless PRS, a restricted-adversary notion in which the distinguisher receives copies one at a time, may perform adaptive POVMs, but has no persistent quantum memory between copies (Bansal et al., 2024). Standard PRS imply memoryless PRS, but the converse fails: there exist single-copy PRS-like constructions that are not memoryless PRS because coherence tests can distinguish them without quantum memory (Bansal et al., 2024). This restricted model supports stronger noise robustness statements than the unrestricted pure-state notion.

4. Resource-theoretic structure and hidden resources

PRS have strong connections to quantum resource theory because Haar-random states typically exhibit near-maximal entanglement, coherence, and magic. A recurring question is whether pseudorandom families must share those resource profiles, or whether low-resource ensembles can computationally masquerade as high-resource ones.

Subset-state constructions demonstrate pseudoentanglement directly. Since a subset state $|\phi_k\rangle$7 has Schmidt rank at most $|\phi_k\rangle$8 across any bipartition, its entanglement entropy across any cut is at most $|\phi_k\rangle$9. Choosing $t$0 with $t$1 superlogarithmic but sublinear yields PRS families with entanglement entropy at most $t$2 across every cut, yet still pseudorandom against polynomial-time distinguishers (Jeronimo et al., 2023). The same constructions also yield low-entanglement ensembles that are statistically close to Haar for polynomially many copies in the appropriate parameter regime (Giurgica-Tiron et al., 2023, Jeronimo et al., 2023).

The paper “Pseudorandom unitaries are neither real nor sparse nor noise-robust” develops a broader “pseudoresource” framework (Haug et al., 2023). For PRS, it establishes lower bounds on coherence and purity while showing that imaginarity behaves differently. PRS must have relative entropy of coherence $t$3, and sparse states with only $t$4 support in the computational basis cannot be pseudorandom (Haug et al., 2023). By contrast, imaginarity of pure states is hard to test efficiently, and therefore PRS can assume any value of imaginarity; there exist both real PRS and highly imaginary PRS (Haug et al., 2023).

This leads to pseudoimaginarity: a low-imaginarity ensemble, even an exactly real one, can masquerade as an ensemble with nearly maximal imaginarity (Haug et al., 2023). The paper classifies purity, coherence, entanglement, magic, and imaginarity into distinct pseudoresource regimes, with purity admitting only an exponentially small gap while imaginarity admits an essentially maximal one (Haug et al., 2023).

PRDMs sharpen these observations for mixed states. The generalized Hilbert–Schmidt ensemble has near-maximal magic, coherence, and entanglement with overwhelming probability. Specifically, for $t$5,

$t$6

and logarithmic negativity across a bipartition is also $t$7 in the relevant regime (Bansal et al., 2024). Yet for $t$8, the ensemble is statistically close to maximally mixed, which has zero entanglement, zero coherence, and zero magic. This produces a pseudoresource gap of $t$9 versus $A$0 for magic and coherence when PRDMs are instantiated via binary-phase PRS and partial trace (Bansal et al., 2024). A plausible implication is that mixed-state pseudorandomness creates stronger hidden-resource phenomena than the pure-state theory alone.

5. Noise, robustness, and adversary restrictions

Noise robustness is a point of sharp divergence between pure-state PRS and mixed-state generalizations. Standard PRS are extremely fragile under depolarizing or other unital noise, because purity changes are efficiently detectable. The paper “Pseudorandom unitaries are neither real nor sparse nor noise-robust” proves that PRS and PRU can exist only if the probability that an error occurs is negligible, ruling out their generation on noisy intermediate-scale and early fault-tolerant quantum computers (Haug et al., 2023). The key test is the SWAP test, whose acceptance probability on two copies is

$A$1

so any non-negligible purity loss becomes efficiently visible (Haug et al., 2023).

The mixed-state theory changes this conclusion. A PRDM ensemble is called noise-robust to a channel $A$2 if $A$3 remains a PRDM (Bansal et al., 2024). For non-negligible purity, such as $A$4, PRDMs are not robust to unital noise because purity changes remain detectable. But for $A$5, PRDMs are robust to any efficiently implementable unital channel (Bansal et al., 2024). The reason is structural: in this regime PRDMs are already computationally indistinguishable from the maximally mixed state, and unital channels fix the maximally mixed state.

The same paper shows that this regime resists a strong attack due to Kretschmer that combines classical shadows with a $A$6 oracle. For large-$A$7 PRDMs, the purity $A$8 is negligible, so estimating it requires a superpolynomial number of copies (Bansal et al., 2024). This separates mixed-state pseudorandomness from standard PRS even against nonphysical distinguishers.

Memoryless PRS provide a restricted pure-state route to noise robustness. In the no-quantum-memory model, distinguishing noisy PRS from Haar-random states under unital noise requires a superpolynomial number of copies (Bansal et al., 2024). This suggests that realistic limitations on adversarial quantum memory partially restore noise tolerance for pure-state pseudorandomness, though only in a restricted security model.

An experimental paper on “Generation of Pseudo-Random Quantum States on Actual Quantum Processors” uses a different, non-cryptographic notion of pseudorandomness, defined through agreement with Haar entanglement statistics rather than computational indistinguishability (Cenedese et al., 2023). It reports that generating highly entangled Haar-like states on current hardware is strongly limited by connectivity and SPAM errors, with IonQ Harmony outperforming IBM ibm_lagos despite lower two-qubit gate fidelity because of all-to-all connectivity and better SPAM (Cenedese et al., 2023). This empirical notion is distinct from cryptographic PRS, but it reinforces the broader point that actual hardware noise and architecture matter sharply for random-state generation.

6. Cryptographic applications and structural limitations

PRS support a growing collection of cryptographic primitives. They underlie quantum money, commitments, and related tasks in the Ji–Liu–Song framework, and scalable PRS broaden the usable parameter regime (Brakerski et al., 2020). PRS are also linked to hardware assumptions: efficient PRS are sufficient to construct the challenge set for universally unforgeable quantum physical unclonable functions, improving earlier constructions that required Haar-random states (Doosti et al., 2021). The same work shows that practical unknownness or strong uniqueness assumptions on qPUFs imply pseudorandom unitaries, which in turn imply PRS via $A$9 (Doosti et al., 2021).

PRSS yield further applications. Because they scramble arbitrary inputs rather than only a fixed initial state, they subsume standard PRSGs, scalable PRSGs, and PRF-like state generators (Lu et al., 2023). They also give streamlined constructions of quantum encryption and succinct quantum state commitments in regimes where prior PRSG-based constructions required postselection or multiple copies (Lu et al., 2023).

PRDMs support additional primitives not available from pure-state pseudorandomness alone. They yield EFI pairs, a fundamental cryptographic primitive, in a form robust to mixed-unitary noise, including local depolarizing noise with substantial strength (Bansal et al., 2024). They also provide noise-robust quantum money in the sense that the Ji–Liu–Song private-key scheme remains secure when honest banknotes undergo a noise channel $\{|\phi_k\rangle^{\otimes t}\}$0 satisfying

$\{|\phi_k\rangle^{\otimes t}\}$1

with $\{|\phi_k\rangle^{\otimes t}\}$2 (Bansal et al., 2024).

At the same time, several black-box limitations have become clear. PRS cannot be shrunk from polynomial output length to logarithmic output length in a black-box way: relative to Kretschmer’s oracle, long PRS exist but short PRS do not (Bouaziz--Ermann et al., 2024). Conversely, recent work on stretching shows the first black-box separation between short-stretch and longer-stretch $\{|\phi_k\rangle^{\otimes t}\}$3-PRS: relative to a quantum oracle, $\{|\phi_k\rangle^{\otimes t}\}$4-PRS with output length $\{|\phi_k\rangle^{\otimes t}\}$5 exist, but $\{|\phi_k\rangle^{\otimes t}\}$6-PRS with output length $\{|\phi_k\rangle^{\otimes t}\}$7 do not (Chen et al., 23 Jun 2026). Another 2025 result establishes a black-box separation between quantum-evaluable pseudorandom generators and both logarithmic and linear PRS, ruling out black-box derivations of PRGs from PRS in a unitary-oracle model with inverse access (Barhoush, 23 Oct 2025). Taken together, these results indicate that output length, copy security, and relation to classical pseudorandomness are all structurally nontrivial for PRS.

7. Conceptual distinctions and current picture

Several distinctions have emerged as central. First, PRS, PRSS, and PRU are genuinely different notions. PRU imply PRSS, and PRSS imply standard PRSG behavior on fixed input, but the converses fail. In particular, real-valued PRSS exist, while PRU require imaginarity and cannot be real (Lu et al., 2023, Haug et al., 2023).

Second, state pseudorandomness and unitary pseudorandomness impose different resource requirements. The paper on resource constraints proves that PRU require near-maximal imaginarity, while PRS do not have that restriction (Haug et al., 2023). This establishes a qualitative gap: complex-valued formalism is operationally necessary for pseudorandom unitaries but not for pseudorandom states.

Third, mixed-state pseudorandomness appears to be the appropriate notion for robustness under strong noise. Standard PRS are too brittle under unital noise, whereas PRDMs with $\{|\phi_k\rangle^{\otimes t}\}$8 remain pseudorandom under arbitrary efficiently implementable unital channels and can even be computationally indistinguishable from the maximally mixed state while hiding extensive entanglement, magic, and coherence (Bansal et al., 2024).

Fourth, resource-theoretic hardness results show that arbitrary mixed-state resource testing is severely limited. For $\{|\phi_k\rangle^{\otimes t}\}$9, any tester distinguishing $$\{|\psi\rangle^{\otimes t}\}_{|\psi\rangle\sim \mu}$$0 from $$\{|\psi\rangle^{\otimes t}\}_{|\psi\rangle\sim \mu}$$1 requires superpolynomially many copies in the negligible-purity regime (Bansal et al., 2024). Black-box resource distillation under the same conditions also requires superpolynomially many copies (Bansal et al., 2024). This suggests that pseudorandom mixed states are not merely cryptographic objects; they expose fundamental bounds on what quantum resources can be efficiently certified or distilled from unknown inputs.

A plausible synthesis is that PRS now sit within a broader hierarchy of quantum pseudorandom objects: fixed-input state generators, arbitrary-input scramblers, function-like state generators, mixed-state ensembles, and pseudorandom unitaries. The recent literature has clarified that these notions differ in adversary model, noise tolerance, resource requirements, and black-box power, rather than forming a single monotone ladder.

As of the current state of the literature, PRS are best understood not as a single primitive but as a family of closely related notions whose behavior depends critically on output length, copy security, adversary memory, whether the object is state-like or channel-like, and whether one allows mixed states. That perspective unifies the central developments: scalable constructions (Brakerski et al., 2020), arbitrary-input scrambling (Lu et al., 2023), mixed-state generalization (Bansal et al., 2024), subset-state and pseudoresource phenomena (Jeronimo et al., 2023, Giurgica-Tiron et al., 2023), and the recent separation results delimiting what PRS can and cannot generically do (Bouaziz--Ermann et al., 2024, Chen et al., 23 Jun 2026, Barhoush, 23 Oct 2025).