We establish tight lower bounds on the adaptive and non-adaptive quantum query complexities of Promised $k$-to-one Finding on an exactly $k$-to-one input string $x\in\mathbb Z_q^n$, for every fixed $k\ge2$ and every feasible alphabet size $q\ge n/k$. The lower bounds are $Ω_k(n^{1/2-1/(2(2^k-1))})$ for unrestricted adaptive algorithms and $Ω_k(n^{1-1/k})$ for one-round non-adaptive algorithms. The former matches the adaptive quantum algorithm of Liu and Zhandry [LZ19], whereas the latter matches classical birthday sampling even when the parallel queries are arbitrarily entangled. We also establish the non-adaptive lower bound $Ω_k(\sqrt{n/k})$ for $k$-to-one Testing when $q\ge n$, resolving an open question posed by Koiran, Landes, Portier, and Yao [KLPY10].
Our proofs generate the balanced input from a uniformly random permutation and use compressed permutation oracles to describe the information learned by the algorithm. The adaptive proof bounds the growth of partial collisions through successive queries. The one-round proof instead analyzes the state after the parallel queries directly, bounding the probability that the compressed database contains a full collision. In both proofs, a short verification step accounts for correct outputs that include unrecorded positions. For the decision problem, we also compare one-round states with independent and distinct output labels.
AI Summary
The paper determines how adaptivity affects quantum query complexity for finding a full $k$-collision in an exactly $k$-to-one function on $n$ positions. It treats fixed $k\ge2$ and every feasible alphabet size $q\ge n/k$, distinguishing unrestricted adaptive access from a single parallel query layer with arbitrary entanglement and joint postprocessing.
For finding, it proves adaptive complexity $\Theta_k(n^{1/2-1/[2(2^k-1)]})$, matching the Liu–Zhandry algorithm under the exact multiplicity promise. The one-round complexity is $\Theta_k(n^{1-1/k})$, matching classical birthday sampling: entangled parallel queries provide no asymptotic query advantage in this model. For distinguishing injective from exactly $k$-to-one inputs, with $q\ge n$, it proves a one-round lower bound $\Omega(\varepsilon\sqrt{n/k})$ for success probability $1/2+\varepsilon$. This is tight for constant bias and resolves the previously posed non-adaptive collision question for $k=2$.
The proofs generate balanced inputs from a uniform permutation and encode query information in harmonic spaces of partial-injection databases. The adaptive argument controls the growth of partial collisions using a projected recording process with $O(T^2/n)$ simulation error. The one-round finding argument instead uses exact encoding, orthogonality of query branches, and a static occupancy bound. Verification queries account for outputs containing unrecorded positions. The decision proof compares relaxed hidden-block distributions and then switches independent labels to distinct labels.
The results leave the intermediate-round hierarchy unresolved. Dependence on $\varepsilon$ is not optimized; extending harmonic methods to reduce alphabet requirements for general $k$-distinctness is also left open.
Little sign of AI-generated text
Written by gpt-6.1-sol from the paper's full text. Automated: it can be wrong.
We establish tight lower bounds on the adaptive and non-adaptive quantum query complexities of Promised k-to-one Finding on an exactly k-to-one input string x∈Zqn, for every fixed k≥2 and every feasible alphabet size q≥n/k. The lower bounds are Ωk(n1/2−1/(2(2k−1))) for unrestricted adaptive algorithms and Ωk(n1−1/k) for one-round non-adaptive algorithms. The former matches the adaptive quantum algorithm of Liu and Zhandry [LZ19], whereas the latter matches classical birthday sampling even when the parallel queries are arbitrarily entangled. We also establish the non-adaptive lower bound Ωk(n/k) for k-to-one Testing when q≥n, resolving an open question posed by Koiran, Landes, Portier, and Yao [KLPY10].
Our proofs generate the balanced input from a uniformly random permutation and use compressed permutation oracles to describe the information learned by the algorithm. The adaptive proof bounds the growth of partial collisions through successive queries. The one-round proof instead analyzes the state after the parallel queries directly, bounding the probability that the compressed database contains a full collision. In both proofs, a short verification step accounts for correct outputs that include unrecorded positions. For the decision problem, we also compare one-round states with independent and distinct output labels.
The paper determines how adaptivity affects quantum query complexity for finding a full k-collision in an exactly k-to-one function on n positions. It treats fixed k≥2 and every feasible alphabet size q≥n/k, distinguishing unrestricted adaptive access from a single parallel query layer with arbitrary entanglement and joint postprocessing.
For finding, it proves adaptive complexity Θk(n1/2−1/[2(2k−1)]), matching the Liu–Zhandry algorithm under the exact multiplicity promise. The one-round complexity is Θk(n1−1/k), matching classical birthday sampling: entangled parallel queries provide no asymptotic query advantage in this model. For distinguishing injective from exactly k-to-one inputs, with q≥n, it proves a one-round lower bound Ω(εn/k) for success probability 1/2+ε. This is tight for constant bias and resolves the previously posed non-adaptive collision question for k=2.
The proofs generate balanced inputs from a uniform permutation and encode query information in harmonic spaces of partial-injection databases. The adaptive argument controls the growth of partial collisions using a projected recording process with O(T2/n) simulation error. The one-round finding argument instead uses exact encoding, orthogonality of query branches, and a static occupancy bound. Verification queries account for outputs containing unrecorded positions. The decision proof compares relaxed hidden-block distributions and then switches independent labels to distinct labels.
The results leave the intermediate-round hierarchy unresolved. Dependence on ε is not optimized; extending harmonic methods to reduce alphabet requirements for general k-distinctness is also left open.
Abstract Collision resistance is one of the most fundamental properties in cryptography. With the development of quantum computing, significant attention has been directed toward understanding the quantum query complexity of collision-finding problems in hash functions. The quantum query complexity of collision-finding in general non-uniform random functions remained an open problem until the recent work of Peng et al. (ASIACRYPT 2025), who nearly resolved it by introducing a novel parameter γ γ . Based on this parameter, they established an upper bound of O(γ1/6) O ( γ 1 / 6 ) and a matching lower bound of Ω~(γ1/6) Ω ~ ( γ 1 / 6 ) . However, the quantum query complexity of finding multi-collisions in non-uniform random functions has remained open. A s -collision to a function f is a set of distinct input x1,…,xs x 1 , ⋯ , x s such that f(x1)=f(x2)⋯=f(xs) f ( x 1 ) = f ( x 2 ) ⋯ = f ( x s ) . In this work, we address this challenge by similarly introducing a new generalized parameter γs γ s . Based on this parameter, we establish nearly tight bounds—an upper bound of O(γs) O ( γ s ) and a lower bound of Ω~(γs) Ω ~ ( γ s ) —thereby nearly resolving this open problem. Moreover, although the existing results for 2-collisions do not generalize straightforwardly to the case of s -collision ( s>2 s > 2 ), we demonstrate that the result of Peng et al. can be viewed as a special case of our more general framework. This clearly establishes our work as a direct generalization of their contribution.
How much memory is needed to retain the quantum speedup for collision finding? For a uniformly random function f:[N]→[N], the BHT algorithm finds a collision using O(N1/3) queries and a quantumly accessible classical table containing O(N1/3) input-output pairs, whereas a logarithmic-space Grover search uses O(N) queries. Determining the optimal query-space tradeoff between these extremes remains a major open problem.
We resolve this equation within the class of label-symmetric algorithms, which treat the function f's output labels as interchangeable. We prove that such algorithm that makes T queries, uses S qubits, and finds a collision in a uniformly random function f:[M]→[N] with constant probability satisfies T=Ω(N1/3)andT2S=Ω(NlogN). For the setting where M=N, these bounds are matched by a space-efficient implementation of the BHT algorithm. As a consequence of our tradeoff, any label-symmetric algorithm for the search version of Element Distinctness on f:[n]→[n2] must satisfy T=Ω(n2/3)andT2S=Ω(n2logn), matching Ambainis's quantum walk. Thus, both tradeoffs are optimal within the class of label-symmetric algorithms.
To prove these results, we develop a space-sensitive version of the compressed oracle technique. The compressed oracle records the information learned by the algorithm in an evolving superposition of databases. Using label symmetry and representation theory, we show that an algorithm using S qubits can effectively retain information about only O(S/logN) collision-free database entries. Substituting this estimate into the compressed oracle technique yields the stated tradeoffs.
Searching for collisions in random functions is a fundamental computational problem, with many applications in symmetric and asymmetric cryptanalysis. When one searches for a single collision, the known quantum algorithms match the query lower bound. This is not the case for the problem of finding multiple collisions, despite its regular appearance as a sub-component in sieving-type algorithms. At EUROCRYPT 2019, Liu and Zhandry gave a query lower bound Ω(2m/3+2k/3) for finding 2k collisions in a random function with m-bit output. At EUROCRYPT 2023, Bonnetain et al. gave a quantum algorithm matching this bound for a large range of m and k, but not all admissible values. Like many previous collision-finding algorithms, theirs is based on the MNRS quantum walk framework, but it chains the walks by reusing the state after outputting a collision. In this paper, we give a new algorithm that tackles the remaining non-optimal range, closing the problem. Our algorithm is tight (up to a polynomial factor) in queries, and also in time under a quantum RAM assumption. The idea is to extend the chained walk to a regime in which several collisions are returned at each step, and the ``walks'' themselves only perform a single diffusion layer.
We prove near-optimal lower bounds for preprocessing attacks on quantum cryptography in the random oracle model. Specifically, we show that a T-query adversary with S qubits of non-uniform advice can recover a random key k from the n-qubit binary phase state ∣ψk⟩∝∑xR(k,x)∣x⟩ with probability at most O(NT2+ST) for N=2n. In contrast, the best known bound for post-quantum one-way functions is O(NT2+ST), with a trivial attack at S=N. This demonstrates a new advantage of quantum cryptography over classical cryptography: n qubits of communication suffice for security against preprocessing attacks with space up to N2 rather than N. Our methodology is simple: express the optimal preprocessing attack as the operator norm of a random matrix, and bound this value in expectation over the random oracle via the trace-moment method. These trace moments have a natural interpretation using compressed oracles [Zhandry, Crypto 2019], which we then analyze. This can be viewed as a simplification and generalization of the approach of Liu [Eurocrypt 2023] for proving the security of post-quantum cryptography against preprocessing attacks. We also prove the following results: (1) We tighten Liu's analysis of post-quantum PRGs in QROM, achieving a distinguishing advantage bound of O(NT2+NST). (2) For unitary synthesis, we extend the one-query lower bound of Lombardi-Ma-Wright [STOC 2024] to hold against adversaries that can make one arbitrary function query along with polynomially many (adaptive) queries to the random oracle, either before or after the function query. This also interprets the original LMW24 result in terms of compressed oracles. (3) Finally, we prove a tight O(NS) bound for the pseudorandomness of random binary phase states against space S distinguishers.
Subgraph detection asks whether an n-vertex graph, accessed through queries to its adjacency matrix, contains a copy of a fixed graph H. We prove the first unconditional superlinear lower bounds on the bounded-error quantum query complexity of this problem, answering a longstanding open question. A copy of H is a certificate of constant size, so the adversary method with nonnegative weights cannot prove superlinear lower bounds.
For every fixed r≥4, detecting the clique Kr requires nλr−o(1) queries, where λ4=19/18, the exponents λr increase strictly with r, and λr≥2−42/r+O(1/r). More generally, we prove superlinear lower bounds for detecting every fixed connected graph H with chromatic number c≥4. These bounds approach quadratic as c grows: for sufficiently large c, detection requires n2−O(loglogc/c)−o(1) queries. Chromatic number alone does not characterize the quantum query complexity of subgraph detection: we show that detecting the complete bipartite graph Kr,r requires nβr−o(1) queries, where β10=181/180 and βr≥2−O(1/r).
Our main technical result is a lower bound for finding an all-ones certificate from a known family when the input bits are sampled independently. Its proof combines Zhandry's compressed oracle [CRYPTO 2019] with conditioning on a randomly planted certificate, adapting an argument of Belovs [FOCS 2026]. Our hard instances are built from graphs containing many copies of the desired subgraph with limited overlap. For cliques, we use a construction of Gowers and Janzer [CPC 2021]; for complete bipartite graphs, we use a random construction.
A collision for a function f is two distinct inputs x1=x2 such that f outputs the same value on both inputs: f(x1)=f(x2). The quantum query complexity of finding collisions has been shown~\cite{BHT1997,AS2004, Ambainis05, Kutin05} in some settings to be Θ(N1/3); however, these results do not apply to random functions. The issues are two-fold. First, the Ω(N1/3) lower bound only applies when the domain is no larger than the co-domain, which precludes many of the cryptographically interesting applications. Second, most of the results in the literature only apply to r-to-1 functions, which are quite different from random functions. Understanding the collision problem for random functions is of great importance to cryptography, and we seek to fill the gaps of knowledge for this problem. To that end, we prove that, as expected, a quantum query complexity of Θ(N1/3) holds for all interesting domain and co-domain sizes. Our proofs are simple, and combine existing techniques with several novel tricks to obtain the desired results. Using our techniques, we also give an optimal Ω(M1/3) lower bound for the set equality problem. This lower bound can be used to improve the relationship between classical randomized query complexity and quantum query complexity for so-called permutation-symmetric functions.