Impossibility of Succinct Quantum Proofs for Collision-Freeness

Abstract

We show that any quantum algorithm to decide whether a function f:[n]->[n] is a permutation or far from a permutation must make Omega(n^{1/3}/w) queries to f, even if the algorithm is given a w-qubit quantum witness in support of f being a permutation. This implies that there exists an oracle A such that SZK^A is not contained in QMA^A, answering an eight-year-old open question of the author. Indeed, we show that relative to some oracle, SZK is not in the counting class A0PP defined by Vyalyi. The proof is a fairly simple extension of the quantum lower bound for the collision problem.