Proxy re-encryption (PRE), as a promising cryptographic primitive for secure data sharing in cloud, has been widely studied for decades. PRE allows the proxies to use the re-encryption keys to convert ciphertexts computed under the delegator’s public key into ones that can be decrypted using the delegatees’ secret keys, without knowing anything about the underlying plaintext. This delegable property of decryption rights gives rise to an important issue: if some proxies reveal their re-encryption keys, or collude with some delegatees to create a pirate decoder, then anyone who gains access to the pirate decoder can decrypt all ciphertexts computed under the delegator’s public key without the delegator’s permission. Several works have provided potential solutions to this issue by designing tracing mechanisms on PRE, where proxies that reveal their re-encryption keys can be identifified by the delegator. However, these solutions perform poorly in terms of the sizes of the public, the secret and the re-encryption keys, and support neither multi-hop nor public traceability. This paper advances the research of tracing mechanisms on PRE and proposes the fifirst public trace-and-revoke PRE system, where the malicious delegatees involved in the generation of a pirate decoder can be identifified by anyone who gains access to the pirate decoder, and their decryption capabilities can subsequently be revoked by the content distributor. Our construction is multi-hop, supports user revocation and public (black-box) traceability, and achieves signifificant effificiency advantages over previous constructions. Our construction is a generic transformation from inner-product functional PRE (IPFPRE) that we introduce to trace-and-revoke PRE. In addition, we instantiate our generic construction of trace-and-revoke PRE from the Learning with Errors (LWE) assumption, which was widely believed to be quantum-resistant. This is achieved by proposing the fifirst LWE-based IPFPRE scheme, which may be of independent interest.