Quantum Interactive Oracle Proofs (qIOPs)

• Quantum Interactive Oracle Proofs (qIOPs) are interactive quantum proof systems that generalize both QIPs and qPCPs, balancing limited verifier queries with multi-round interactions.
• They utilize constructions such as EPR-sharing and strong qIOP protocols with constant verifier quantum space, ensuring high soundness through methods like the many-qubits test.
• qIOPs underpin advancements in post-quantum succinct arguments, offering new avenues to bridge quantum complexity theory with practical, secure quantum verification.

Quantum Interactive Oracle Proofs (qIOPs) generalize both quantum interactive proofs (QIPs) and quantum probabilistically checkable proofs (qPCPs), and serve as a quantum analogue of classical interactive oracle proofs (IOPs). In the qIOP framework, the communication between an unbounded quantum prover and a quantum verifier is interactive, but the verifier’s quantum resources are significantly restricted—specifically, the verifier is permitted only limited queries to the prover’s messages and constrained quantum computation. The model sits between QIP (where the verifier reads all the prover’s quantum message qubits) and qPCP (where only a constant number of qubits are queried in a single round), and is motivated by foundational questions in quantum complexity, verification, and cryptographic succinct arguments for quantum languages (Sun et al., 19 Jan 2026).

1. Foundations and Definitions

Classical IOP systems extend probabilistically checkable proofs (PCPs) by permitting a bounded number of interaction rounds, with the verifier making a small number of adaptive queries to oracle-encoded prover messages. The quantum versions pose unique challenges due to entanglement, measurement disturbance, and the representation of quantum states as oracles. In the qIOP model, the interaction consists of $m$ rounds; in each, the prover sends a quantum message, and the verifier applies a query channel. Formally, the $i$th verifier round is a channel: $$\mathcal{V}_{x,i} : (\mathcal{W}_{i-1} \otimes \mathcal{W}'_{i-1}) \otimes R \rightarrow (\mathcal{M}_i \otimes J_i) \otimes (\mathcal{W}'_i \otimes R)$$ with

• $\mathcal{W}_{i-1}$: prover’s new message
• $\mathcal{W}'_{i-1}$: retained portion of previous messages
• $R$: verifier’s private register
• $\mathcal{M}_i \otimes J_i$: quantum/classical message back to prover

Variants include: (1) the general qIOP (verifier generates fresh quantum messages), (2) restricted qIOP (messages classical), and (3) strong qIOP (SQIOP), wherein the verifier never stores any part of the message (always returns the full message to the prover) (Sun et al., 19 Jan 2026). The qIOP is parameterized by proof length $\ell(n)$, query complexity $q(n)$ (total number of qubits queried), and time $t(n)$. Completeness and soundness are defined as usual: constants $c > s$ such that an honest prover on $x\in L_{yes}$ is accepted with probability $\geq c$, while no prover can cause acceptance on $x\in L_{no}$ with probability $> s$.

2. qIOPs in Relation to qPCP and QIP

Limiting a qIOP protocol to a single round and disallowing verifier messages recovers the standard (non-adaptive) qPCP model, in which the verifier accesses a poly-size quantum witness but reads only $O(1)$ qubits in total (Sun et al., 19 Jan 2026). In contrast, the QIP model allows a polynomial-time quantum verifier to interact in multiple rounds, but the verifier receives all message qubits (so $q(n) = \mathrm{poly}(n)$). The qIOP setting, allowing only $O(1)$ quantum queries in each round but multiple rounds of interaction, thus strictly interpolates between QIP($\mathrm{poly}$) and qPCP. Notably, whether QMA admits a qIOP system is a relaxation of the quantum PCP conjecture.

3. Main Constructions for QMA

Two unconditional constructions for QMA were established in (Sun et al., 19 Jan 2026).

3.1 EPR-Sharing qIOP

The first construction is a "general" qIOP for QMA with polynomial communication, but $O(1)$ quantum queries. The verifier and prover begin by sharing $Nn$ EPR pairs, which the honest prover uses to teleport $N$ copies of a witness state (a ground state for a 5-local Clifford Hamiltonian $H$) to the verifier. Using an error-correcting code and a constant-query PCPP of proximity, the prover commits to the one-time pad bits generated in the teleportation. The verifier samples local terms $\ell_1,\dots,\ell_N$ to measure, applies corresponding Pauli observables to its share of the EPRs, composes a Boolean circuit $C$ of the measurement results, and verifies correctness (via an interactive oracle commitment with $O(1)$ quantum queries). Parameters include $3$-round communication, total quantum queries $O(1)$, and polynomial quantum/classical communication. Completeness is near-perfect for yes-instances; soundness is enforced by the proximity proof and XOR checks (Sun et al., 19 Jan 2026).

3.2 Strong qIOP (SQIOP) with Constant Verifier Quantum Space

The second construction achieves a strong qIOP. Here, the verifier's quantum workspace is $O(1)$ qubits throughout the protocol, at the cost of exponential communication from the prover (exponential-length Hadamard encodings). The protocol employs a "many-qubits test" (see section 4), enforcing that the prover’s measurements in $X$/$Z$ bases on the entire $N$-copy witness behave as close as possible to ideal Pauli observables. Protocol execution includes several test types (EnergyTest, QubitsTest, EnergyConsistencyTest), with the verifier adaptively choosing among them. Each verifier channel queries $O(1)$ qubits from the prover's (large) message, and the private quantum register is never larger than constant size. Communication is $\mathrm{exp(poly}(n))$ due to Hadamard encodings (Sun et al., 19 Jan 2026).

4. The Single-Prover Many-Qubits Test

A central technical contribution is the single-prover many-qubits test, which certifies approximate Pauli anti-commutation for two families of observables: $$\{f_X(a)\}_{a\in\mathbb{F}_2^n},\quad \{f_Z(b)\}_{b\in\mathbb{F}_2^n}$$ acting on the prover's Hilbert space. For appropriate marginal distributions $\mu_1, \mu_2$ on $(b,a)$, if

$$\mathbb{E}_{(b,a)\sim\mu_k}\|f_Z(b)f_X(a) - (-1)^{a\cdot b}f_X(a)f_Z(b)\|^2_\sigma \leq \delta \qquad (k=1,2)$$

then, by a Gowers–Hatami–type stability argument, there exists an isometry and a true Pauli representation $g(\cdot)$ acting on an extended space such that the measured observables approximate $g_X(a)$, $g_Z(b)$ in expectation. The construction relies on rounds in which the prover produces purifications of measurement outcomes, and consistency/anti-commutation is enforced through four types of test (Z-consistency, X-consistency, flipped X-consistency, anti-commuting). This robust test is critical for soundness in the SQIOP protocol (Sun et al., 19 Jan 2026).

5. Security and Post-Quantum Succinct Arguments

qIOPs enable post-quantum secure, succinct interactive arguments. The "interactive BCS" (IBCS) transformation compiles a $k$-round public-coin IOP (or qIOP) plus a succinct vector commitment (VC) into a $(2k+1)$-message succinct interactive argument. For soundness against quantum adversaries, the VC must be collapsing: opening the commitment and measuring in superposition or the computational basis yields indistinguishable results for any QPT adversary. Security analysis employs a hybrid argument and quantum rewinding lemma, ensuring that extraction via rewinding does not unduly reduce acceptance probability (Chiesa et al., 2024). The IBCS argument inherits soundness error

$$\varepsilon_{\rm ARG}(n) \leq \varepsilon_{\rm IOP}(n) + k(\beta + \delta) + O(k/\sqrt{T})$$

where $(\beta,\delta)$ are the binding and collapsing errors, and $T$ is the number of rewinds per round. This suggests that succinct quantum arguments for QMA leveraging qIOPs are viable under standard assumptions, closing previous gaps in post-quantum soundness of IOP-based succinct non-interactive arguments (Chiesa et al., 2024).

6. Open Problems and Future Directions

Several fundamental open questions remain regarding qIOPs (Sun et al., 19 Jan 2026):

• Existence of strong qIOPs for QMA with only polynomial quantum communication
• Whether there exists a protocol for QMA with entirely classical communication, but quantum prover and verifier
• Construction of black-box transformations compiling strong qIOPs to polynomial-size qPCPs
• Applicability of a Fiat–Shamir transform to qIOPs, yielding non-interactive, succinct quantum arguments for QMA under standard cryptographic assumptions

A plausible implication is that qIOPs may provide the theoretical and protocol groundwork to bridge the gap between the quantum PCP conjecture and cryptographically useful, succinct argument systems for quantum complexity classes. As these developments mature, further investigation into recursive post-quantum IOPs and non-interactive arguments in the quantum random oracle model is expected (Chiesa et al., 2024).