Imagine you run a public shooting range. You want anyone to come practice marksmanship, but you don't want them to assassinate anyone. So you let them fire any gun they want — but you choose the targets (randomly), you don't reveal what they hit until after they've left, and you only tell them one bit: hit or miss. They can still learn to shoot. They just can't aim at anything specific. That's the core mechanism of this paper. The committed claim: a quantum computer accessible through a specific restricted interface — random computational-basis inputs chosen by the server and revealed post-execution, plus exactly one output bit — retains the scientific utility of quantum computation while conjecturally blocking all known factoring algorithms. The model is called ½BQP₁, and it strictly subsumes the well-studied one-clean-qubit model DQC1, meaning everything DQC1 can do (infinite-temperature correlations, out-of-time-order correlators, partition functions), this model can also do. The authors even propose a candidate problem that separates ½BQP₁ from DQC1: testing classical predictions of quantum spin dynamics. The security argument comes in two layers. Layer one: the authors show that if you take the quantum core of every known factoring construction — Shor, Ekerå–Håstad, Kitaev, Regev — and force it through a one-bit readout, the quantum stage becomes classically simulable. This isn't just for textbook Shor; they generalize across a broad family of redesigned preparation-and-postprocessing pipelines built around a single arithmetic-oracle call. Layer two addresses the obvious workaround: what if you coherently implement the classical post-processing (rational reconstruction) inside the quantum circuit itself, so the single output bit directly leaks a factor? Here the defense is that random inputs force the attacker to implement rational reconstruction in logarithmic depth, and no one has managed to parallelize rational reconstruction to that degree in decades of circuit complexity research. The architectural family here is computational complexity theory, not hardware engineering. This is a paper about computation models and oracle separations, not about building a physical device. The key structural choice is the interface restriction: random inputs plus one-bit output. The paper leans heavily on classical circuit lower bounds — specifically, the conjecture that rational reconstruction cannot be computed by polynomial-size logarithmic-depth (NC¹-like) circuits. This is the load-bearing wall. If someone parallelizes rational reconstruction tomorrow, the security argument's second layer collapses. Integrity-wise, this is a theory paper with conjectured security, not proven security. The authors are admirably transparent about this: the title says 'protecting,' but the fine print says 'conjectured.' The first layer (classical simulability of known factoring algorithms under one-bit readout) is a proven result within the paper. The second layer rests on a circuit lower bound conjecture that is widely believed but unproven — the same epistemic status as P ≠ NP. There's no experimental validation because there's nothing to experiment on yet; this is a protocol design paper. The strength is that the authors don't claim more than they have. The milestone question maps to deployment: when does a fault-tolerant quantum computer actually become publicly accessible, and will this or a similar interface be the gating mechanism? IBM's roadmap targets 100K+ qubits by 2033; Google's Willow chip hit 105 qubits with below-threshold error correction in 2024. The real threshold isn't qubit count but fault tolerance at scale — roughly 1,000-10,000 logical qubits with error rates below 10⁻⁶. Once that exists, the question this paper answers becomes urgent rather than theoretical. The obvious experiment the authors didn't run: a formal proof (or computational evidence) that rational reconstruction truly resists log-depth parallelization. They cite decades of failure to parallelize it as evidence, but they didn't attempt a conditional proof reducing it to a more standard complexity assumption. The honest read: this is a genuinely hard open problem in circuit complexity, and solving it would be a separate major paper. They're not hiding a failure — they're pointing at a mountain and saying 'we believe this mountain is real.' Fair enough, but the mountain is unclimbed.
