Prove? Why does the attacker need to "prove" it? For example, the attacker can check whether there is an oracle by looking at the code and seeing whether such an attack is possible. Or, the attacker can guess that such an attack might be possible and then try the attack. If the attack succeeds, the attacker knows the system is vulnerable. There might be other ways too.
Or, to put it another way: an easy way to prove that such an attack is possible is to actually implement the attack and demonstrate that it works. Boom, done. Problem solved.
Proving that an attack is possible is usually a lot easier than finding the attack in the first place. Both of those are, in turn, a lot easier than proving that oracle-based attacks are impossible.
There's something funny about your question that I'm not following. I'm not getting why an attacker would care about a mathematical proof of the existence of such an attack. The proof of the pudding is in the eating. If an attack successfully breaks the system, seems like that's all that matters; who cares whether we have a mathematical proof?
I can see why a system defender would want a proof of the non-existence of such an attack, but that's a different question. Is that what you were asking for?