Correcting Subverted Random Oracles to Achieve Indifferentiability

A simple construction can transform a "subverted" random oracle, which disagrees with the original one at a small fraction of inputs, into an object that is indifferentiable from a random function, even if the adversary is made aware of all randomness used in the transformation.