Quantum Haar Random Oracle Model

• Quantum Haar Random Oracle Model is an idealized framework providing coherent oracle access to Haar-distributed quantum states and unitaries.
• It underpins cryptographic constructions such as quantum money, succinct commitments, and quantum Merkle trees through rigorous simulation methods.
• The model leverages advanced techniques like lazy sampling, compressed oracles, and Clebsch–Gordan transforms to ensure adaptive security against quantum adversaries.

Searching arXiv for papers on the Quantum Haar Random Oracle Model and related constructions. arxiv_search(query="Quantum Haar Random Oracle Model", max_results=10, sort_by="submittedDate") The Quantum Haar Random Oracle Model (QHROM) is an idealized framework in which parties receive oracle access to quantum objects sampled from Haar-invariant distributions, most commonly a Haar-random unitary together with its inverse, and in some formulations a Haar-random state or a family of independent Haar-random unitaries indexed by input length or classical labels. It serves as a quantum analogue of random-oracle and random-permutation idealizations, but with fully coherent oracle access: queries may be made in superposition, inverse access is often explicit, and security is typically formulated against adaptive, entangled, and even unbounded adversaries subject only to a query bound (Alagic et al., 2019). Subsequent work has developed exact or negligible-error stateful simulators, compressed-oracle and path-recording techniques, representation-theoretic constructions based on Clebsch–Gordan transforms, and cryptographic applications ranging from quantum money and pseudorandomness to succinct commitments and proof systems (Grinko et al., 30 Sep 2025).

1. Formal definitions and model variants

Across the literature, the term QHROM denotes a family of closely related ideal models rather than a single canonical interface. The common feature is oracle access to Haar-distributed quantum objects under coherent querying.

Variant	Sampled object	Oracle access
Random-state/unitary sampler	A single Haar-random state $|\psi\rangle$ or unitary $U\in U(d)$	State interfaces or $U,U^\dagger$ (Alagic et al., 2019)
Invertible QHROM	A single $n$-qubit Haar-random unitary $U$	Forward and inverse superoperators $U,U^\dagger$ (Ananth et al., 2024)
Family-valued QHROM	Independent Haar-random unitaries $\{U_\ell\}_{\ell\in\mathbb N}$	Access to $U_\ell$ and $U_\ell^\dagger$ on $\ell$-qubit inputs (Ananth et al., 29 Sep 2025)
Label-indexed invertible QHRO	Independent Haar-random unitaries $U\in U(d)$0	Queries $U\in U(d)$1 and inverse (Hhan et al., 2024)
Proof-system QHROM	A single Haar-random unitary $U\in U(d)$2	Prover and verifier both access $U\in U(d)$3 (Chen et al., 2021)

In the formulation of efficient simulation, a trusted oracle machine samples either a pure state $U\in U(d)$4 uniformly from the Haar measure on the unit sphere or a unitary $U\in U(d)$5 uniformly from the Haar measure $U\in U(d)$6 on the compact group $U\in U(d)$7 (Alagic et al., 2019). In the unitary case, the basic ideal interfaces are $U\in U(d)$8, $U\in U(d)$9, and $U,U^\dagger$0 (Alagic et al., 2019).

A distinct but compatible formalization fixes a security parameter $U,U^\dagger$1 and gives every party oracle access to a family

$U,U^\dagger$2

with oracle queries permitted in superposition on an $U,U^\dagger$3-qubit register (Ananth et al., 29 Sep 2025). This formulation is tailored to cryptographic indistinguishability definitions.

In interactive-proof applications, QHROM is built directly into completeness and soundness conditions. An interactive protocol $U,U^\dagger$4 is said to be a proof system in QHROM if both prover and verifier receive input $U,U^\dagger$5 and oracle access to

$U,U^\dagger$6

with soundness quantified against any unbounded prover making at most $U,U^\dagger$7 total queries to $U,U^\dagger$8 and $U,U^\dagger$9 (Chen et al., 2021).

A related state-only idealization replaces Haar-random unitaries by an oracle that, on input $n$0, supplies a fresh $n$1-qubit Haar-random state $n$2, equivalently an isometry $n$3 (Chen et al., 2024). This is not the unitary QHROM itself, but it belongs to the same family of Haar-oracle models and is used to study separations among quantum pseudorandom notions.

2. Oracle interfaces and operational semantics

The operational content of QHROM depends on the sampled object. For Haar-random states, the ideal sampler $n$4 exposes four interfaces: $n$5, which returns a classical description $n$6 of $n$7; $n$8, which outputs an $n$9-qubit register in state $U$0; $U$1, which measures $U$2; and $U$3, which applies the controlled reflection

$U$4

These interfaces make the state oracle more structured than a simple source of copies, because they allow coherent verification and reflection relative to the same hidden Haar state (Alagic et al., 2019).

For Haar-random unitaries, the minimal interface is forward and inverse access. The terminology “forward access” refers to oracle application of $U$5, while “inverse access” refers to $U$6 (Alagic et al., 2019). In proof systems and commitment schemes this inverse interface is operationally essential: the verifier uses $U$7 to reverse portions of the prover’s encoding and check consistency of hidden internal registers (Chen et al., 2021).

A more refined oracle taxonomy arises in exact simulation of Haar moments. For $U$8-query interaction, one can define four query types: forward, conjugate, transpose, and inverse. A recent representation-theoretic construction produces all four as exact oracles by arranging Clebsch–Gordan and dual-Clebsch–Gordan blocks in different four-gate patterns. In this formulation, forward queries implement $U$9, conjugate queries simulate $U,U^\dagger$0, transpose queries effect $U,U^\dagger$1, and inverse queries implement $U,U^\dagger$2 (Grinko et al., 30 Sep 2025).

This four-interface perspective clarifies that the QHROM is not merely an abstract “black box for a random unitary.” It is a model of consistent coherent access to multiple algebraically related actions of the same Haar-random object. A plausible implication is that security notions stated only for forward access may miss structure that becomes relevant when $U,U^\dagger$3, $U,U^\dagger$4, or $U,U^\dagger$5 are also queryable.

3. Stateful simulation, lazy sampling, and compressed-oracle methods

A central problem in QHROM is efficient simulation of ideal Haar objects against adversaries with black-box access. The first major simulation results establish stateful simulators that remain information-theoretically indistinguishable from the ideal Haar oracle even to unbounded adversaries (Alagic et al., 2019).

For Haar-random states, the simulator maintains entanglement in the symmetric subspace. After $U,U^\dagger$6 samples, the adversary’s reduced state is

$U,U^\dagger$7

To simulate a new $U,U^\dagger$8 call, the simulator applies an efficiently implementable symmetrization isometry $U,U^\dagger$9 that extends a maximally entangled state on $\{U_\ell\}_{\ell\in\mathbb N}$0 to one on $\{U_\ell\}_{\ell\in\mathbb N}$1. The same mechanism supports $\{U_\ell\}_{\ell\in\mathbb N}$2 and $\{U_\ell\}_{\ell\in\mathbb N}$3 by inverting the last symmetrization step, performing a simple measurement or phase, and reapplying the isometry (Alagic et al., 2019).

For Haar-random unitaries, the simulator uses exact unitary $\{U_\ell\}_{\ell\in\mathbb N}$4-designs $\{U_\ell\}_{\ell\in\mathbb N}$5 and a stateful interpolation between $\{U_\ell\}_{\ell\in\mathbb N}$6 and $\{U_\ell\}_{\ell\in\mathbb N}$7. If an adversary makes at most $\{U_\ell\}_{\ell\in\mathbb N}$8 parallel forward or inverse queries, one can sample a uniform superposition over $\{U_\ell\}_{\ell\in\mathbb N}$9 in a private register and apply controlled-$U_\ell$0 or controlled-$U_\ell$1. Adaptive extension to the $U_\ell$2-st query relies on a partial isometry $U_\ell$3 guaranteed by uniqueness of Stinespring dilation. The resulting unitary simulator is exact and uses total private space $U_\ell$4 qubits (Alagic et al., 2019).

These results establish a basic methodological point: a stateless $U_\ell$5-design is insufficient for arbitrary adaptive interaction. A single fixed $U_\ell$6-design only answers up to $U_\ell$7 queries, whereas a stateful simulator stores enough information to preserve consistency indefinitely (Alagic et al., 2019).

Later work introduced the path-recording formalism as a compressed-oracle technique specialized to Haar unitary access. For an injective relation $U_\ell$8, the path-recording isometry $U_\ell$9 acts by

$U_\ell^\dagger$0

Its right-invariance theorem states that for any $U_\ell^\dagger$1-query adversary,

$U_\ell^\dagger$2

providing an explicit approximation guarantee between Haar access and a path-recording oracle (Ananth et al., 2024). This formalism underlies later pseudorandomness proofs and can be viewed as a quantum analogue of compressed or lazy sampling for random functions.

4. Representation-theoretic formulation and Clebsch–Gordan simulation

A representation-theoretic formulation generalizes Haar-oracle simulation from $U_\ell^\dagger$3 to arbitrary compact groups. Let $U_\ell^\dagger$4 be a compact group and $U_\ell^\dagger$5 a unitary representation on a $U_\ell^\dagger$6-dimensional Hilbert space $U_\ell^\dagger$7. The $U_\ell^\dagger$8-fold tensor power admits the Schur–Weyl (Peter–Weyl) decomposition

$U_\ell^\dagger$9

Here $\ell$0 is the finite set of irreducible representation labels appearing in $\ell$1, $\ell$2 is the carrier space of irrep $\ell$3, and $\ell$4 is the multiplicity space (Grinko et al., 30 Sep 2025).

By Schur’s lemma, the commutant of $\ell$5 is spanned by matrix units

$\ell$6

where $\ell$7 range over an orthonormal basis $\ell$8 of $\ell$9. The multiplicity basis may be labeled by Gelfand–Tsetlin or branching patterns

$U\in U(d)$00

which encode the path of irreducible components encountered when adjoining one copy of $U\in U(d)$01 at a time (Grinko et al., 30 Sep 2025).

The oracle construction introduces an auxiliary memory that purifies the Haar randomness. The memory starts in the trivial irrep state $U\in U(d)$02, and each query extends a superposition over irrep labels and multiplicity patterns by interleaving a Clebsch–Gordan transform and a dual-Clebsch–Gordan transform. A single compressed Clebsch–Gordan step uses preprocessing $U\in U(d)$03, a compressed unitary $U\in U(d)$04 of gate-depth $U\in U(d)$05 and ancilla $U\in U(d)$06, and an uncomputation stage (Grinko et al., 30 Sep 2025).

For the $U\in U(d)$07-th forward query, the oracle is

$U\in U(d)$08

If the query arrives in state $U\in U(d)$09, then

$U\in U(d)$10

Tracing out memory yields

$U\in U(d)$11

so $U\in U(d)$12 successive queries reproduce the exact Haar integral (Grinko et al., 30 Sep 2025).

The same architecture produces conjugate, transpose, and inverse oracles by permuting the positions of Clebsch–Gordan and dual-Clebsch–Gordan blocks. Inverse access is realized by exchanging dual blocks so that

$U\in U(d)$13

For the unitary group, the resulting simulator is efficient in both space and time: total gate complexity and depth

$U\in U(d)$14

ancilla usage

$U\in U(d)$15

and worst-case diamond-norm error at most $U\in U(d)$16, with the mathematical construction itself exact and error arising only from $U\in U(d)$17-approximate compilation of the Clebsch–Gordan unitaries (Grinko et al., 30 Sep 2025).

This construction is presented as a representation-theoretic generalization of Zhandry’s compressed function-oracle technique. Relative to earlier unitary-oracle simulators, it is fully constructive, supports arbitrary precision $U\in U(d)$18, and unifies forward, conjugate, transpose, and inverse queries in a single framework (Grinko et al., 30 Sep 2025).

5. Cryptographic applications and proof-system uses

QHROM has been used as an idealized foundation for several quantum cryptographic constructions. One early application is information-theoretic quantum money. By replacing the ideal Haar-state oracle with the polynomial-time simulator for Haar-random states, minting becomes a call to $U\in U(d)$19 and verification becomes a call to $U\in U(d)$20. Because the simulator is negligibly close to the ideal oracle even for unbounded adversaries, the resulting Haar-money scheme is described as perfectly information-theoretically unforgeable and untraceable (Alagic et al., 2019).

A different application is the quantum Merkle tree. In that construction, prover and verifier share access to a Haar-random unitary $U\in U(d)$21 on $U\in U(d)$22 qubits and its inverse. To commit to an $U\in U(d)$23-qubit state $U\in U(d)$24, the prover organizes $U\in U(d)$25 with $U\in U(d)$26, allocates registers at the nodes of a perfect binary tree, stores the $U\in U(d)$27-qubit blocks of $U\in U(d)$28 at the leaves, and for each internal node applies $U\in U(d)$29 to the triple consisting of the two children and the parent initialized to $U\in U(d)$30. The prover sends only the root register to the verifier. To decommit to a leaf set $U\in U(d)$31, the prover reveals the corresponding light cone, and the verifier reapplies $U\in U(d)$32 in reverse order while checking that each recovered parent register is $U\in U(d)$33. The communication to open $U\in U(d)$34 leaves is $U\in U(d)$35 many $U\in U(d)$36-qubit registers, hence $U\in U(d)$37 when $U\in U(d)$38 (Chen et al., 2021).

The security claim for the quantum Merkle tree is query-bounded soundness: an unbounded cheating prover making at most $U\in U(d)$39 oracle queries should not significantly exceed the target soundness, and the paper conjectures a bound of the form

$U\in U(d)$40

over the Haar choice of $U\in U(d)$41 (Chen et al., 2021). This suggests that the commitment’s binding property is intended to derive from the unpredictability of the unqueried action of a Haar-random unitary.

Haar-oracle models also support constructions of quantum pseudorandom objects weaker than full pseudorandom unitaries. In the invertible label-indexed QHRO model, an Even–Mansour–style function-like state generator is defined by

$U\in U(d)$42

For any unbounded adversary making up to $U\in U(d)$43 classical adaptive queries to the construction and up to $U\in U(d)$44 adaptive quantum queries to $U\in U(d)$45 and $U\in U(d)$46, the distinguishing advantage between the real and ideal experiments is bounded by

$U\in U(d)$47

yielding the first unconditional adaptive-secure PRFSG in that model (Hhan et al., 2024).

State-only Haar-oracle models have also been used to separate quantum pseudorandomness notions. Relative to an oracle that outputs a single Haar-random state, there exists a statistical single-copy pseudorandom state construction, and in a stronger isometry-oracle setting there is a separation showing that 1PRS can exist while PRS do not (Chen et al., 2024). This indicates that access to Haar-random quantum objects can support nontrivial cryptographic primitives even when stronger notions remain impossible.

6. Pseudorandom unitaries, limitations, and open directions

A major development in QHROM is the construction of pseudorandom unitaries directly from a shared Haar oracle. In the inverseless Haar Random Oracle Model, unbounded-query secure PRUs exist with two calls to the Haar oracle, via

$U\in U(d)$48

The same work proves that any one-call construction of the form $U\in U(d)$49 is insecure for unbounded-query security: it can be broken by $U\in U(d)$50 non-adaptive queries. It also gives a bounded-query one-call PRU,

$U\in U(d)$51

secure for $U\in U(d)$52 queries, together with one-call multi-copy PRSG and PRFS constructions (Ananth et al., 2024).

In the full QHROM with inverse access, strong PRUs have now been constructed. Fixing target length $U\in U(d)$53, the key space is $U\in U(d)$54, with $U\in U(d)$55, and

$U\in U(d)$56

on the $U\in U(d)$57-qubit register. The corresponding security theorem states that this family is a strong PRU in QHROM: for every QPT adversary making polynomially many forward and inverse oracle calls, the distinguishing advantage between the real experiment and one using two independent Haar-random unitaries is negligible (Ananth et al., 29 Sep 2025).

The proof strategy combines hybrid arguments with path-recording isometries. One step replaces Haar-random unitaries with Ma–Huang path-recording isometries $U\in U(d)$58, incurring global trace-distance error $U\in U(d)$59; later steps compare $U\in U(d)$60 with simplified operators $U\in U(d)$61, with operator-norm deviation $U\in U(d)$62, and show that cumulative distinguishing advantage remains $U\in U(d)$63 before reversing the simplifications by Haar invariance (Ananth et al., 29 Sep 2025). This places path recording at the center of modern QHROM pseudorandomness proofs.

Several limitations and open problems recur across the literature. One is the minimum number of sequential Haar calls needed for strong PRUs in QHROM; the current conjecture is that two calls are tight even with inverse access (Ananth et al., 29 Sep 2025). Another is whether comparable constructions can be instantiated in the plain model, for example from LWE or one-way functions (Ananth et al., 29 Sep 2025). On the simulation side, open questions include extending efficient Clebsch–Gordan transforms to other groups such as permutations and reducing the $U\in U(d)$64-dependence in time or space toward lower bounds (Grinko et al., 30 Sep 2025). In function-like state generation, open questions include whether the same key can be reused for both masks and whether depth-1 QHRO constructions admit stronger quantum-accessible security notions (Hhan et al., 2024).

A recurrent misconception is that fixed $U\in U(d)$65-designs alone realize the full QHROM. The simulation results show otherwise: a stateless $U\in U(d)$66-design suffices only up to $U\in U(d)$67 queries, whereas exact or negligibly accurate emulation of ongoing adaptive interaction requires stateful internal memory, whether via symmetric-subspace lazy sampling, Stinespring interpolation, path recording, or representation-theoretic compressed oracles (Alagic et al., 2019). The modern view of QHROM is therefore not just “Haar randomness as an oracle,” but a collection of techniques for maintaining coherent consistency of that randomness under extended quantum interaction.