Fig. 4: Malicious attacks on \({\mathcal{P}}\) by S and R.

Real (left) vs. ideal (right) instantiations of the attacks are depicted, where boxes (red, blue, green) indicate local processing by a given party (P, S, R). a General attack by S. The attack is described by a quantum instrument \({\mathcal{I}}\) that acts on the qubits of \({| G\rangle }^{\otimes {\mathfrak{R}}}\) distributed to S, with possible dependence on some side information λ. For every \(\widetilde{{\bf{x}}}\) of P, the attack will generate for S a classical-quantum state \({\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )\) that depends on all public communication in the protocol. We show there exists a simulator \({\mathbb{S}}\) in place of party S in the ideal world that submits some input \(\widetilde{{\bf{e}}}\) to f_ideal and then uses the output \(f(\widetilde{{\bf{x}}},\widetilde{{\bf{e}}})\) to generate the same \({\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )\) achieved in the real world. b General attack by R. We again show there exists a simulator \({\mathbb{S}}\) that takes the place of R in the ideal world, receiving just the function output \(f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})\) and outputting the classical-quantum state \({\rho }_{\text{cq}}^{{\bf{R}}}(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})\) achieved in the real world, as shown to the right.