our case) has two strings $(x_0, x_1)$ and the other ($P_2$) has a bit $b \in \{0, 1\}$. At the end of the protocol $P_2$ recovers $x_b$. $P_1$ should not know which of the strings $P_2$ has chosen while $P_2$ has no information about the string they did not choose $x_{1-b}$.

The following coin-tossing protocol will be needed later:

1.  $P_1$ chooses $\alpha_{1} \overset{R}{\in} \{0, 1\}^{\log(s)}$ uniformly at random, commits to it and sends the commitment to $P_2$ (this commitment has to be perfectly hiding).

2.  $P_2$ chooses $\alpha_{2} \overset{R}{\in} \{0, 1\}^{\log(s)}$ uniformly at random and sends it to $P_1$.

3.  $P_1$ opens their commitment and reveals $\alpha_1$.

4.  They both set $\alpha = \alpha_1 \oplus \alpha_2$, where $\oplus$ corresponds to the bitwise XOR ($\alpha$ is the index of the evaluation graph).

Quantum Covert Adversaries
--------------------------

We now introduce a new adversarial model for quantum protocols, based on the covert adversaries in [@AumLin07]. The quantum covert adversaries are also able to deviate arbitrarily from the protocol. The main difference with malicious is that when they cheat they are caught with high probability but not necessarily exponentially close to $1$.

This models real world situations where getting caught might have dire 