Untelegraphable-Indistinguishability Security

• Untelegraphable-indistinguishability is a quantum security notion ensuring that observable outputs (ciphertexts, traces, or programs) do not reveal which plaintext, source, or implementation produced them.
• It extends traditional semantic security by leveraging quantum principles like no-cloning and entanglement monogamy, preventing non-local adversaries from extracting useful distinguishing information.
• Recent constructions in the QROM and plain model utilize coset states and Haar-random unitaries to achieve practical unclonable encryption and measurement-restricted security guarantees.

Untelegraphable-indistinguishability security denotes a family of quantum security requirements under which an observable artifact—typically a ciphertext, but also a program, execution trace, or obfuscated implementation—does not “telegraph” which plaintext, source program, or functionality-preserving implementation produced it. The terminology is not uniform across the literature: some papers formulate the underlying goal as quantum indistinguishability or semantic security, some as unclonable indistinguishability against non-local adversaries, and some as untelegraphable encryption where the adversary is restricted to classical outputs produced by measurement. Taken together, these works present a spectrum of decision-based security notions centered on negligible distinguishing advantage under quantum attack models (Xiang et al., 2015, Ananth et al., 2022, Broadbent et al., 1 Oct 2025).

1. Conceptual core and terminology

In the program-obfuscation literature, untelegraphability is described as the property that an obfuscator outputs programs or runtimes that “do not telegraph” which original they come from, that is, they are indistinguishable to an adversary (Breuer et al., 2018). In quantum cryptography, the nearest direct analogue is unclonable indistinguishability: no non-local adversary can produce two states that both allow distinguishing between encryptions of two equal-length messages (Ananth et al., 2022). A more recent abstraction is Untelegraphable Encryption (UTE), defined as a quantum encryption primitive that is a special case of Uncloneable Encryption (UE), where the adversary’s capabilities are restricted to producing purely classical information rather than arbitrary quantum states (Broadbent et al., 1 Oct 2025).

This vocabulary reflects a shift from ordinary one-receiver indistinguishability to settings in which information might be split, measured, forwarded, or exposed through auxiliary observables. In that sense, untelegraphable-indistinguishability security is not merely about hiding the message from a single distinguisher; it is about preventing the extraction of transferable distinguishing information. The literature also emphasizes that this is fundamentally quantum: unclonable indistinguishability has no direct classical counterpart, because its statement depends on no-cloning and quantum monogamy phenomena (Ananth et al., 2022).

2. Foundational indistinguishability and semantic-security formalisms

A rigorous foundation for the subject is given by Chong Xiang and Li Yang, who systematically define indistinguishability and semantic security for quantum public-key and private-key encryption schemes, and for computational security, physical security, and information-theoretic security (Xiang et al., 2015). For a quantum private-key encryption scheme, information-theoretic indistinguishability is defined by the condition

$$\forall\, \text{quantum circuit family } \{C_n\}, \forall\, p(\cdot),\, \forall\, \text{large } n,\, \forall\, x,y \in \{0,1\}, \quad \Big|\Pr[C_n(E_{G(1^n)}(x))=1] - \Pr[C_n(E_{G(1^n)}(y))=1]\Big| < \frac{1}{p(n)} .$$

They further show that this is equivalent to a trace-distance criterion on the ciphertext ensembles: $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$ which is presented as a necessary and sufficient condition for information-theoretic indistinguishability. The same work proves that indistinguishability and semantic security are equivalent for quantum encryption schemes.

A complementary line of work studies stronger quantum indistinguishability notions for symmetric-key encryption. “Quantum indistinguishability under quantum chosen plaintext attack” (qIND-qCPA) allows the challenge phase to involve quantum superpositions of messages, provided the adversary supplies classical descriptions of the quantum states rather than arbitrary externally entangled inputs (Gagliardoni et al., 2015). That paper also introduces qSEM-qCPA and proves the equivalence qIND-qCPA $\equiv$ qSEM-qCPA. The resulting hierarchy is significant for untelegraphable security because it isolates the strongest achievable challenge model for classical encryption schemes while avoiding the unachievability of fully general entangled challenge states.

3. Security games for unclonable and untelegraphable indistinguishability

The unclonable IND-CPA game formalizes a strong two-recipient decision problem. A non-local adversary first chooses $m_0,m_1$, receives an encryption of $m_b$, splits the ciphertext into registers for two receivers, and then both receivers—after learning the key—attempt to output the challenge bit $b$. The adversary wins only if both outputs are correct, and security requires

$$\mathsf{Adv}_{\mathcal{G},A,B,C}(\lambda) := \Pr[\text{Win}] \leq \frac{1}{2} + \mathrm{negl}(\lambda) .$$

This notion strengthens earlier search-based unclonability, which only prevented both parties from recovering the entire plaintext (Ananth et al., 2022).

UTE-IND modifies the same intuition by constraining the attack surface to measurement. In the UTE game, the adversary chooses two messages, receives an encryption of one of them, applies a quantum-to-classical channel $\Phi$, and then, given the classical outcome and the secret key, tries to recover the challenge bit. The formal value is written as

$\mfk{c}^2_{1\rightarrow 1}(\ttt{Q}|\scr{M}) = \sup_{\ttt{A}} \int_K \frac{1}{2}\sum_{b=0}^1 \mathrm{Tr}\!\left[ P^k_{m_b}\cdot \Phi(\sigma^k_{m_b}) \right] d\pi(k),$

and UTE-IND holds when this quantity is at most $1/2+\varepsilon$ for negligible $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$0 (Broadbent et al., 1 Oct 2025).

The three notions most directly relevant to untelegraphable-indistinguishability can be summarized as follows.

Notion	Adversary model	Success condition
Quantum IND / SEM	Quantum distinguisher on ciphertexts	Guess which plaintext or extract no more than simulator
Unclonable IND-CPA	Non-local adversary splitting ciphertext	Both receivers correctly output the challenge bit
UTE-IND	Measurement channel plus keyed decoder	Classical transcript and key reveal the challenge bit

This organization makes clear that untelegraphable security is best viewed as a structured strengthening of indistinguishability rather than a wholly separate principle.

4. Feasibility results and concrete constructions

A central feasibility result is that encryption schemes satisfying unclonable indistinguishability exist unconditionally in the quantum random oracle model (QROM) (Ananth et al., 2022). The construction uses coset states and a quantum random oracle: key generation chooses a random subspace $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$1 of dimension $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$2, encryption of a bit $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$3 samples canonical representatives $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$4 and $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$5, prepares a coset state $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$6, and outputs $D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$7. The proof relies on monogamy-of-entanglement properties of coset states, a reduction to a reprogramming game in the QROM, projective measurements, and Jordan’s lemma.

A later development establishes the first construction of unclonable encryption satisfying indistinguishability security in the plain model, with quantum decryption keys, by reducing the problem to simultaneous state indistinguishability (Ananth et al., 2024). The core technical statement is simultaneous Haar indistinguishability: non-communicating but entangled players cannot distinguish between receiving identical Haar-random states and receiving independently sampled Haar-random states, with advantage bounded by

$D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$8

This result is then used to build unclonable encryption in the plain model, and the same framework yields implications for single-decryptor encryption and leakage-resilient secret sharing.

For UTE itself, a Haar-measure encryption scheme gives unconditional bounds and multi-ciphertext extensions (Broadbent et al., 1 Oct 2025). The basic encryption map is

$D(\rho_x,\rho_y) < \frac{1}{p(n)} ,$9

where $\equiv$0 is Haar-random. For bit encryption, the paper states the bound

$\equiv$1

It also gives multi-copy and collusion-resistant bounds, including

$\equiv$2

and extends the approach to the unbounded-round case under pseudorandom unitaries, yielding everlasting security.

5. Program traces, obfuscation, and circuit-level indistinguishability

Untelegraphability also appears in program transformation and obfuscation. In encrypted computing, an “obfuscating” compiler introduces secret random delta offsets into registers and memory values, so that the physical values observed during execution are unrelated to the program’s logical values unless the offset scheme is known (Breuer et al., 2018). A central lemma states that object codes from the same source are identical apart from embedded constants, and the runtime traces are identical except for cipherspace values read and written; moreover, for any particular 32-bit plaintext value $\equiv$3, the probability across compilations that $\equiv$4 appears at any register or memory location at any given point in the trace is uniformly $\equiv$5, to the maximal extent permitted by program structure. With encryption, the associated theorem states that there is no method, deterministic or stochastic, that can read a bit of plaintext data from a program trace or rewrite the program to generate a target bit to order, with any probability above random chance. Without encryption, the same-source case remains untelegraphable up to structural leakage, but functionally equivalent yet differently structured programs need not be indistinguishable.

Quantum indistinguishable obfuscation has also been formulated via circuit equivalence. One proposal introduces quantum subpath sum equivalence, in which two circuits are connected by a polynomial-size sequence of incremental transformations on subpaths, each preserving functionality (Zhang et al., 2024). The security reduction turns equivalence checking into polynomial identity testing on phase polynomials, with failure probability bounded by

$\equiv$6

and proves that for every QPT distinguisher $\equiv$7,

$\equiv$8

for quantum implementations of the same classical function in the quantum random oracle model. The paper explicitly notes, however, that fuller untelegraphable settings with adaptive chosen-input behavior or auxiliary leakage may require further modifications.

A separate complexity-theoretic line identifies a barrier for gate-teleportation-based computational qiO (Nevin, 22 Nov 2025). Exact Non-Identity Check (ENIC) is shown to be NP-hard for Clifford+$\equiv$9 circuits of logarithmic $m_0,m_1$0-depth, and the paper concludes that, unless $m_0,m_1$1, there is no efficient function-determined conjugate encoding for this class and hence no efficient gate-teleportation-based computational indistinguishability obfuscation. This places a concrete limit on one route to circuit-level untelegraphable indistinguishability.

6. Quantification and formal reasoning

Several adjacent literatures quantify indistinguishability in ways that illuminate untelegraphable security. In asymptotically Gaussian compressed encryption (AG-OTS), the adversary chooses two equal-length plaintexts and attempts to distinguish which one produced the ciphertext $m_0,m_1$2; the success probability is bounded by

$m_0,m_1$3

where $m_0,m_1$4 is the total variation distance between the induced ciphertext distributions (Yu, 2017). The key conclusion is that if all plaintexts have equal energy, then $m_0,m_1$5 and indistinguishability is perfect, whereas even small energy deviations make distinguishing feasible. This provides a quantitative example of how side information outside message identity—in this case energy—can reintroduce “telegraphed” information.

A different statistical perspective appears in coarse-grained boson sampling (Nikolopoulos, 2022). The paper defines a boson-sampling distinguishability problem between the most-probable-bin distribution $m_0,m_1$6 and the uniform distribution $m_0,m_1$7, with statistical distance

$m_0,m_1$8

and proves the bound

$m_0,m_1$9

Because this distance is exponentially small in $m_b$0 under the stated scaling, the resulting keys are statistically indistinguishable from uniform even for computationally unbounded adversaries without the secret seed. The paper presents this as a toy model for message encryption, authentication, and entity authentication.

Formal reasoning about indistinguishability has also been studied through proof theory. In the Bana-Comon framework, computational indistinguishability is the sole predicate, written $m_b$1, and a ground formula $m_b$2 is interpreted as standard PPT indistinguishability of the corresponding term ensembles (Koutsos, 2018). For a sound but incomplete first-order axiom set based on $m_b$3-$m_b$4, the paper proves decidability of whether $m_b$5 is unsatisfiable for bounded-session protocols. The omission of unrestricted transitivity is essential for decidability, and the resulting procedure is triple-exponential. This work is not about UTE or UE directly, but it shows that parts of indistinguishability reasoning can be mechanized.

7. Limitations, lower bounds, and open directions

Strong indistinguishability notions are accompanied by sharp impossibility results. For symmetric-key encryption under superposition challenge models, no quasi-length-preserving secret-key encryption scheme can be qIND or gqIND secure (Gagliardoni et al., 2015). The paper identifies stream ciphers and basic block ciphers as examples: if encryption is essentially a permutation on message space, a Hadamard-basis attack perfectly distinguishes challenge states. Message expansion is therefore not an implementation detail but a structural requirement for these stronger notions.

For unclonable indistinguishability, deterministic one-time schemes are ruled out even more strongly (Ananth et al., 2022). The paper states that no unconditionally secure, deterministic one-time encryption scheme can satisfy unclonable indistinguishability, even for 1-bit messages, regardless of computational efficiency. The attack based on a random Haar unitary succeeds with constant probability, at least $m_b$6 as block length grows. Randomness, oracle access, or additional structure is thus essential.

UTE introduces quantitative optimality statements. For any quantum encryption of classical messages with ciphertext dimension $m_b$7,

$m_b$8

and the Haar-measure construction is presented as essentially optimal among such schemes (Broadbent et al., 1 Oct 2025). The same paper proves an asymptotic equivalence between UTE and UE in the many-receiver regime: $m_b$9 This suggests that measurement-only telegraphing attacks capture the asymptotic limit of more general cloning attacks, and it is explicitly proposed as a path toward the open problem of indistinguishability security for UE in the plain model.

The current state of the subject is therefore bifurcated. On one side, there are positive constructions: QROM-based unclonable indistinguishability, plain-model schemes with quantum decryption keys, and optimal UTE with multi-ciphertext and collusion-resistant variants (Ananth et al., 2022, Ananth et al., 2024, Broadbent et al., 1 Oct 2025). On the other, there are structural barriers: impossibility for deterministic or quasi-length-preserving schemes, sensitivity to side information such as message energy, and hardness barriers for some quantum obfuscation paradigms (Gagliardoni et al., 2015, Yu, 2017, Nevin, 22 Nov 2025). In aggregate, the literature supports a precise interpretation of untelegraphable-indistinguishability security as a quantum strengthening of indistinguishability in which preventing the extraction, duplication, or classical forwarding of distinguishing information is the central objective.