Quantum Copy-Protection Advances

• Quantum copy-protection is a cryptographic primitive that encodes a function into a quantum state, enabling evaluation while preventing efficient reproduction.
• It leverages principles such as the no-cloning theorem, measurement disturbance, and BB84 state preparations to achieve robust anti-piracy security.
• Recent research spans oracle-based proofs, standard-model constructions using quantum random oracles and indistinguishability obfuscation, and experimental implementations on quantum hardware.

Quantum copy-protection is a cryptographic primitive in which a vendor encodes a functionality into a quantum state so that a user can evaluate the functionality, yet cannot efficiently create additional usable programs for the same functionality. Introduced by Aaronson in the context of quantum money and software anti-piracy, it occupies a central place in uncloneable cryptography because it seeks a capability that is unattainable with classical information alone, while exploiting the no-cloning theorem and measurement disturbance as cryptographic resources (Aaronson, 2011, Sattath, 2022).

1. Origins and formal formulation

The early formalization treats a copy-protection scheme for a function family $\mathcal{F}$ as a pair of efficient procedures: a vendor circuit $V$ that maps a description $d_f$ of $f \in \mathcal{F}$ to a quantum program $\rho_f$, and a customer circuit $C$ that computes $f(x)$ from $(\rho_f,x)$. In the formulation summarized in Aaronson’s work, correctness requires that $C$ outputs $f(x)$ with probability at least $V$0, while security requires that a pirate who starts from $V$1 valid programs cannot turn them into $V$2 states whose expected total number of successful computations exceeds $V$3 on the specified distribution over $V$4 (Aaronson, 2011).

A basic obstruction appears immediately: if a function family is learnable from input-output behavior, then copy-protection is impossible. This “learnability barrier” is explicit in the early theory and explains why point functions and other evasive families became canonical targets. The same work also emphasized that, without restricting adversaries, quantum states can be simulated given unbounded computation, so the relevant security notion is computational rather than purely information-theoretic in the general setting (Aaronson, 2011).

The foundational technical evidence for feasibility came from oracle constructions. Aaronson showed that there exist quantum oracles relative to which any efficiently computable family that is not quantumly learnable can be quantumly copy-protected, and framed the central lower-bound mechanism through a “Complexity-Theoretic No-Cloning Theorem.” In the stated form, if one is given $V$5 together with an oracle $V$6 marking $V$7, then producing $V$8 registers $V$9 with total overlap $d_f$0 requires

$d_f$1

queries to $d_f$2 (Aaronson, 2011).

These oracle results established formal evidence that copy-protection is possible, but they did not by themselves yield standard-model constructions. That gap shaped much of the subsequent literature.

2. Security notions, learnability, and impossibility frontiers

The now-standard adversarial picture involves a pirate who receives a protected program, transforms it into a bipartite or multipartite state, and distributes the pieces to non-communicating freeloaders who later receive challenge inputs. Security asks whether multiple recipients can simultaneously answer correctly. This formulation captures the core anti-piracy objective more sharply than simple state-cloning language, because the relevant resource is not perfect copying of the quantum state but the ability to create multiple functionally usable descendants (Sattath, 2022).

A major refinement is the distinction between malicious-malicious, honest-honest, and honest-malicious security. In the honest-malicious game introduced for unconditional constructions, the challenger encodes a function using CP.Protect, sends the program to a pirate, and the pirate splits it between Bob and Charlie. Bob honestly runs CP.Eval, while Charlie may do anything. The scheme is $d_f$3-secure if

$d_f$4

where $d_f$5 is the trivial single-guessing success probability, and correctness with respect to a distribution $d_f$6 requires

$d_f$7

for each $d_f$8 (Broadbent et al., 2021).

This intermediate notion is significant because it is strong enough to imply secure software leasing, yet achievable without assumptions for point functions. By contrast, unconditional malicious-malicious security for wider classes remains open. This delineation corrected an early tendency to speak of “copy-protection” as though there were a single canonical security game (Broadbent et al., 2021).

The boundary of possibility is also sharper than “unlearnable implies copy-protectable.” Secure Software Leasing showed, under quantum LWE and quantum fully homomorphic encryption, that there exists a class of quantum unlearnable circuits for which neither SSL nor quantum copy-protection exists in the standard model. The paper thereby gave a negative answer to the question of whether arbitrary quantum unlearnable functions can be copy-protected under standard assumptions (Ananth et al., 2020).

The impossibility frontier was strengthened further in the random-oracle direction. “A Note on Copy-Protection from Random Oracles” proved that, assuming quantum fully homomorphic encryption with malicious circuit privacy and quantum hardness of learning with errors, there exists an unlearnable class for which copy-protection is impossible even in the classical-accessible random oracle model, and it also proved the impossibility of approximately correct copy-protection in the plain model (Ananth et al., 2022).

A common misconception is therefore that unlearnability is the only meaningful criterion. The literature instead supports a more nuanced view: learnability is a necessary barrier, but not a sufficient one outside specially structured models or function classes.

3. Evasive function classes and the first provable schemes

The first broadly cited provable copy-protection construction in a standard cryptographic model targeted compute-and-compare programs in the quantum random oracle model. A compute-and-compare program $d_f$9 outputs $f \in \mathcal{F}$0 iff $f \in \mathcal{F}$1, and thus generalizes point functions. The point-function component of the scheme prepares a BB84-type state

$f \in \mathcal{F}$2

where $f \in \mathcal{F}$3 is random and $f \in \mathcal{F}$4 is derived from a quantum random oracle; it also publishes $f \in \mathcal{F}$5. On input $f \in \mathcal{F}$6, the evaluator computes $f \in \mathcal{F}$7, measures in the basis prescribed by $f \in \mathcal{F}$8, obtains $f \in \mathcal{F}$9, and outputs $\rho_f$0 iff $\rho_f$1. The same paper then copy-protects $\rho_f$2 by publishing $\rho_f$3 classically and quantum-protecting the point function on $\rho_f$4 (Coladangelo et al., 2020).

Its proof gives a non-trivial bound against fully malicious adversaries in the QROM, making it “the first copy-protection scheme to enjoy any level of provable security in a standard cryptographic model.” The analysis relies on BB84 monogamy-of-entanglement bounds, including the joint cheating term

$\rho_f$5

together with quantum random-oracle reductions. The same construction also satisfies a secure software leasing notion with negligible adversarial advantage in the QROM (Coladangelo et al., 2020).

A different line, developed in “Secure Software Leasing Without Assumptions,” achieved unconditional honest-malicious copy-protection for point functions and unconditional SSL for compute-and-compare via reduction. Its central construction, “AuthCP,” derives copy-protection from total quantum authentication. For a point $\rho_f$6, it protects by encoding a fixed state under key $\rho_f$7,

$\rho_f$8

and evaluates at input $\rho_f$9 by running $C$0 and outputting $C$1 on accept and $C$2 on reject. If the underlying QAS is $C$3-total, then AuthCP is $C$4-correct with respect to $C$5 and $C$6-honest-malicious secure (Broadbent et al., 2021).

The significance of this line is conceptual as well as technical. It shows that total quantum authentication codes can serve as a foundational primitive for copy-protection, and that honest-malicious copy-protection is not merely a weakened stopgap but a notion strong enough to imply secure software leasing. At the same time, correctness is distributional rather than worst-case, and the function classes remain evasive rather than universal (Broadbent et al., 2021).

4. Obfuscation-based frameworks and broader program classes

A major generalization came from quantum state indistinguishability obfuscation. “How to Use Quantum Indistinguishability Obfuscation” introduced qsiO for quantum descriptions of classical programs and showed that applying qsiO to a program yields “best-possible” copy protection: if $C$7 and $C$8 implement the same function, then

$C$9

Under this indistinguishability condition, any successful piracy attack against $f(x)$0 would transfer to any other copy-protection scheme for the same class. The same work also showed, assuming injective one-way functions, that qsiO gives concrete copy protection for a large family of puncturable programs, and introduced coupled unclonable encryption as a key tool (Coladangelo et al., 2023).

The plain-model frontier then moved from evasive functions toward cryptographic functionalities. “Unclonable Cryptography with Unbounded Collusions and Impossibility of Hyperefficient Shadow Tomography” constructed the first unbounded collusion-resistant copy-protection schemes in the plain model for public-key encryption, public-key functional encryption, signatures, and pseudorandom functions, under post-quantum subexponentially secure iO and LWE. It also showed that any unlearnable functionality can be copy-protected against unbounded collusions relative to a classical oracle, and used the resulting schemes to rule out hyperefficient shadow tomography under the same assumptions (Çakan et al., 2023).

The construction strategy in that work amplifies earlier coset-state approaches through identity-based encryption and puncturable pseudorandomness, so that each issued protected key is tied to a fresh identity while preserving the monogamy-of-entanglement core. This is not a universal plain-model theorem for arbitrary programs, but it decisively broadened the set of functionalities known to admit $f(x)$1 anti-piracy security in non-oracular settings (Çakan et al., 2023).

Recent work has pushed the protected class further through puncturing notions tailored to challenge distributions. “How to Copy-Protect Malleable-Puncturable Cryptographic Functionalities Under Arbitrary Challenge Distributions” defined malleable-puncturable schemes, in which one may answer inputs unrelated to the challenge while remaining unhelpful on challenge-related inputs, and showed that all such schemes can be copy-protected under subexponentially secure iO and one-way functions, even for arbitrary high min-entropy challenge distributions (Çakan et al., 25 Jul 2025).

Taken together, these developments indicate a shift in the field’s center of gravity: from point functions and oracle evidence toward structured, assumption-based families of cryptographic programs in the plain model. A plausible implication is that the long-term organizing principle for the area will be not “which individual functions can be protected,” but “which cryptographic security games admit puncturing, malleability control, or indistinguishability obfuscation compatible with monogamy constraints.”

5. Multi-copy security and adjacent unclonable primitives

The original literature mostly focused on the $f(x)$2 setting, but later work emphasized that security can change qualitatively when the adversary receives many copies. “Revocable Encryption, Programs, and More: The Case of Multi-Copy Security” showed, in oracle models, the first feasibility results for revocable encryption and revocable programs that remain meaningful when the adversary is given multiple identical copies. Its technical core identifies random subset states

$f(x)$3

as “unlearnable but usable” states and proves a $f(x)$4 unforgeability statement for them (Ananth et al., 2024).

The multi-copy agenda was then strengthened by generic compilers. “Multi-Copy Security in Unclonable Cryptography” introduced a compiler that upgrades collusion-resistant unclonable primitives to multi-copy security assuming one-way functions, and obtained the first multi-copy secure constructions of public-key quantum money (“quantum coins”), single-decryptor encryption, unclonable encryption, and related primitives. The same paper also introduced upgradable quantum coins, which permit almost-public verification under weaker assumptions and later public verification when additional classical information is released (Çakan et al., 14 Oct 2025).

A complementary generic amplification appears in “Less is More: On Copy Complexity in Quantum Cryptography.” There, i.i.d.-copy secure unclonable primitives are transformed into identical-copy secure ones by embedding the base states into phase-scrambled superpositions with quantum one-time pads and pseudorandomness. Under indistinguishability obfuscation and other standard assumptions, the paper concludes that there exist identical-copy secure unclonable primitives such as public-key quantum money and quantum copy-protection (Ananth et al., 6 Oct 2025).

Quantum copy-protection also functions as a source primitive for other unclonable tasks. “Uncloneable Decryptors from Quantum Copy-Protection” shows that CPA secure uncloneable bit decryptors can be instantiated from a copy-protection scheme for any balanced binary function, introduces flip detection security to support messages of unrestricted length, and upgrades CPA to CCA2 using strong EUF-CMA secure digital signatures (Sattath et al., 2022).

These adjacent primitives matter because they clarify what copy-protection is and is not. Copy-protection is stronger than SSL, structurally related to uncloneable encryption and decryptors, and increasingly studied under the same copy-complexity lens. The literature therefore treats it not as an isolated curiosity, but as one node in a larger theory of unclonable cryptographic resources.

6. Realization pathways, experiments, and open problems

Although most of the modern theory is highly abstract, several works address implementation pathways. “Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more” shows that protocols where Alice merely sends random BB84 states can be converted into protocols with a fully classical Alice, assuming Bob cannot efficiently solve LWE. Its key ingredient is a classically instructed parallel remote-state-preparation protocol that leaves Bob holding $f(x)$5 uniformly random BB84 states, up to a basis change on his space, while Alice knows which states were prepared and all communication remains classical (Gheorghiu et al., 2022).

A concrete proof-of-concept appears in “Password authentication schemes on a quantum computer,” which implements quantum copy-protection for password verification on IBM devices. The construction encodes the password as a point function using trap-based authentication and the Steane $f(x)$6 code. The reported tests include an ideal simulator, a simulator with IBM device noise models, and runs on real hardware; in the summary provided, the ideal simulator accepts the correct password with 100% success, the noisy simulator yields the expected result about 10% of the time, and real hardware shows low but nonzero acceptance rates, with sub-1% rates for complete detection of bit and phase errors (Wang et al., 2022).

Earlier proposals explored more direct state-based media. “A Quantum Copy-Protection Scheme with Authentication” encodes classical information in non-orthogonal quantum states using secret rotation operators and authenticates via a quantum hash checked by a SWAP test. The paper’s formulas make the intended mechanism explicit, including the encoding

$f(x)$7

and SWAP-test acceptance probability

$f(x)$8

These proposals are historically important, although they predate the later cryptographic security frameworks that dominate current theory (Gyongyosi et al., 2012).

Experimental work on Wiesner-style money has likewise provided physical evidence for the no-cloning barrier that motivates copy-protection. “Experimental quantum forgery of quantum optical money” studies the fidelity limits of $f(x)$9-to-$(\rho_f,x)$0 cloning of arbitrary qubit sequences and explicitly notes that the resulting security analysis can be applied as a security measure in quantum digital right management (Bartkiewicz et al., 2016).

The outstanding problems are now sharply articulated. Plain-model copy-protection for arbitrary unlearnable functions is blocked by impossibility results (Ananth et al., 2020, Ananth et al., 2022). Unconditional malicious-malicious security, worst-case correctness for the assumption-free authentication-based constructions, and copy-protection for richer function classes remain open (Broadbent et al., 2021). On the implementation side, the survey literature still stresses the dependence on long-term quantum memory, low-noise evaluation, and practical verification interfaces (Sattath, 2022). The field has therefore progressed from feasibility evidence to a differentiated theory of what can be protected, under which assumptions, against which copy complexity, but it has not eliminated the divide between strong theoretical constructions and deployable quantum software systems.