Execution-transcript privacy for fault-tolerant surface-code memories

Introduction

• A distance-d memory run for Θ(d) rounds produces Θ(d^3) records, including syndromes, decoder choices, resets, timing, and leakage flags, separately from its answer.These records are shared with the control plane because real-time decoding depends on them.Source: Introduction · p. 2
• Noiseless stabilizer folklore does not establish privacy for multi-round observed transcripts or identify safe records, and the generic duality corollary does not provide the leak parameter.The paper frames the execution transcript as a privacy channel with an explicit threat model.Source: Introduction · p. 2
• Under amplitude damping, the basis-label leak order is the code’s Z-distance d_Z, not its quantum distance d_min, and no term appears below order γ d_Z.For the repetition family, the coefficient is nT; the measured-algebra-of-X case instead has identically zero leakage.Source: Introduction · pp. 2–3
• With quantum distance 1, a phase-flip code’s X-syndrome transcript is input-independent under unobserved damping, whereas a repetition code leaks at first order, nTγ + O(γ^2).The contrast shows that correctability alone does not determine transcript privacy.Source: Introduction · pp. 2–3
• Under transcript-locality hypotheses and a polymer-smallness condition, the transcript channel is exponentially close in diamond norm to one independent of arbitrary logical inputs.The paper presents this as a consequence of correctability–privacy duality.Source: Introduction · pp. 2–3
• A charged, calibrated witness leaks at a rate set by distance, and a lattice-surgery parity readout is one example of such an exposing record.The converse supplies a diagnostic for screening record sets.Source: Introduction · p. 3
• On a 156-qubit superconducting processor, the sufficient certificate for the smallness condition misses by 21.5×.The paper therefore says its theorem cannot be invoked for that processor.Source: Introduction · p. 3
• A d_Z = 1 memory’s honest transcript reaches a total-variation lower bound of 0.927; randomized encoding returns the measured statistic to its finite-sample floor at no additional two-qubit-gate cost.The acquisition is randomized and label-balanced.Source: Introduction · p. 3

Results

• Full logical-channel privacy is measured in diamond norm and governed by dmin, while basis-label privacy is total variation between the two logical Z-eigenstate transcripts and is governed at first order by dZ.Basis-label privacy protects one logical axis and is weaker than full logical-channel privacy.Source: Results · p. 4

The execution transcript is a privacy channel

• The execution transcript is the adversary-visible telemetry, including syndromes, decoder corrections, resets, timing, and leakage flags, while the logical output remains hidden.The threat model gives the adversary the full transcript and circuit, noise-model, and decoder knowledge, but excludes direct access to data qubits.Source: Results · p. 3, The execution transcript is a privacy… · pp. 4–5

Ideal syndrome transcripts are independent of the logical input

• In the ideal stabilizer model, applying the logical X changes neither measured stabilizer syndromes nor the transcript, so the two logical inputs produce identical transcript laws.The stated equality is exact in the noiseless limit; direct data-qubit readout need not have this property.Source: Ideal syndrome transcripts are… · p. 5

The mechanism: logical charge costs distance

• Under the polymer smallness condition, input-sensitive transcript contributions require a nontrivial logical cycle of support at least d, making their summed activity exponentially small in d.Homologically trivial fault pairs cancel between the input-conditioned transcript laws, and fixed classical post-processing cannot increase distinguishability.Source: The mechanism: logical charge costs… · p. 6

The order of the basis-label leak, and when it is attained

• For syndrome-only transcripts under amplitude damping, dZ is the first permitted order of basis-label leakage, but the coefficient can vanish and the true leading order can be higher.The expansion begins at order γ^dZ; this is an algebraic lower bound on the order, not a guarantee that it is attained.Source: The order of the basis-label leak, and… · p. 7
• The repetition code attains first-order leakage at dZ=1, whereas an X-only phase-flip-code syndrome transcript remains exactly input-independent under unobserved amplitude damping.The phase-flip code has dX=1, yet its syndrome transcript is perfectly private; the contrast shows that the relevant logical axis and record matter.Source: The order of the basis-label leak, and… · p. 8
• With the phase-flip code’s jump record exposed, leakage reappears at exactly order dZ, with coefficient 1; at γ=10^-2, TV is 1.0000 × 10^-6 for n=3 and 1.0000 × 10^-8 for n=4.The measured log-log slopes are 3.0000 and 4.0000, matching dZ=3 and 4.Source: The order of the basis-label leak, and… · p. 9
• The phase-flip family has d_X = 1 yet its basis-label transcript is exactly input-independent, whereas repetition-code leakage is first order in γ with coefficient nT.For the rotated surface code, d_Z = d; its 1538× proxy decrease from d = 3 to d = 5 at γ = 10^-2 is not a measured TV decrease, and asymptotic growth remains open.Source: The order of the basis-label leak, and… · p. 10

by axis

• Under the stated hypotheses, each logical axis is suppressed according to its coset distance; full logical-channel privacy scales as e^-Θ(d_min), while basis-label privacy depends on d_Z.For the rotated surface code, d_min = d, giving exponential suppression in d. A code with d_Z much larger than d_min can hide its computational-basis label better than it hides arbitrary logical inputs.Source: by axis · p. 12

A charged calibrated record leaks

• A charged calibrated record that recovers a logical operator with error p_W leaks at least 1 − 2p_W in total variation, approaching full disclosure as readout errors shrink.Lattice-surgery parity readout is an example; the converse requires a witness that is both homologically nontrivial and calibrated to a known logical operator.Source: A charged calibrated record leaks · p. 13

Simulation consistency checks

• In simulations, adding a charged calibrated witness raised adversary AUC to 0.99 and the permutation p-value to 0.003, while honest-record classifier AUC was 0.499 to 0.498.The honest-arm chance result is a consistency check: the logical-X states have identical detector laws by construction, so it is not a device privacy measurement.Source: Simulation consistency checks · pp. 14–15, Table 1 · p. 15
• The full-record adversary stays at chance for honest U across d = 3, 5, 7 and near one with witness W; coherent and leakage tests remain at chance at d = 3.Pauli-noise and classifier variations also return chance across d = 3, 5, 7; the coherent and leakage null is limited to d = 3 by the exact statevector simulator.Source: Figure 3 · p. 16, Simulation consistency checks · pp. 17–18
• The merged-parity error falls from 6.5 × 10−3 at d = 3 to 2.2 × 10−4 at d = 11, so its converse total-variation bound rises toward one.The exponential fit has decay rate 0.43 per unit distance; the modeled measurement uses a distance-d-protected merge seam and minimum-weight perfect matching.Source: Simulation consistency checks · p. 16, Figure 4 · p. 17
• The fired-detector cluster-tail rate stays below one but does not certify Kotecký–Preiss smallness: the measured indicator is about 190× above threshold, and hardware calibration is 21.5× above it in ε0.The proxy fits observed fired-detector components, not latent fault-support regions or resummed operator-norm activity; the required threshold at detector degree 12 is about 4.1 × 10−3.Source: Simulation consistency checks · pp. 16–17, Figure 4 · p. 17
• The honest memory stays empirically blind even above the code threshold by symmetry, while the locality rate rises with error rate; the two thresholds are not claimed to coincide.A separate two-patch check gives joint logical parity decaying as e−0.44d from 1.3 × 10−2 at d = 3 to 3.9 × 10−4 at d = 11; this quantity is about 2pL, not a bound on merged-seam error.Source: Simulation consistency checks · p. 18

A diagnostic test of when the theorem applies

• The screen first checks whether the measured-check algebra contains a nontrivial logical operator: the honest gadget passes at d = 3, 5, 7, while lattice surgery exposes Z̄1 Z̄2.The algebra check is polynomial-time and exact for the idealized measured algebra, but does not cover coherent faults, analog records, leakage, timing, or feedback.Source: A diagnostic test of when the theorem… · p. 18
• The second screen part passively fits locality from fired-detector component sizes; full certification also needs a device model showing exposed analog and classical records factor through allowed local events or input-independent kernels.The measured locality rate remains an indicator rather than certification, and the controlled local-Pauli alternative is a separate experiment, not the passive measurement shown.Source: A diagnostic test of when the theorem… · pp. 18–19

Hardware measurement

• A zero selection-free statistic is failure to detect leakage, not evidence of its absence; the stated confidence bound also assumes within-class i.i.d. Bernoulli shots.The randomized-encoding null cells likewise do not certify equality of the underlying transcript laws.Source: Hardware measurement · p. 19, tion · p. 23, Table 2 · p. 23
• Across four null cells, empirical total variations of 0.002–0.011 were bounded above by 0.051, while a like-for-like leak cell had a 95% lower bound of 0.267.These opposing bounds separate the measured leak from acquisition artifact without a noise-model inference.Source: Hardware measurement · pp. 19–20
• At n = 21, the sufficient certificate was not satisfied on the device, missing by 21.5×; the repetition-code experiment tests leakage rather than the theorem’s condition.The hardware was a 156-qubit IBM Heron r2 processor.Source: Hardware measurement · pp. 19–20

tion

• Randomized acquisition reduced the n = 7 lower bound from 0.880 to 0.660 and flattened per-cell asymmetry to 0.055–0.059 across a sevenfold range of n.The n = 21 bound changed from 0.949 to 0.927; the reduction at n = 7 identified acquisition-order contamination in that grouped-sweep outlier.Source: Figure 5 · p. 21, tion · pp. 22–23
• At n = 21, the randomized-acquisition repetition-code transcript had TV ≥0.927 at one-sided 95% confidence, consistent with first-order leakage that code length does not suppress.The memory has d_Z = 1; this measures the predicted leakage mechanism, not Theorem 1 for a rotated surface code.Source: Figure 5 · p. 21, tion · p. 24
• Randomized encoding returned the empirical lower bound to the finite-sample floor at six of seven lengths, a 62-fold reduction at n = 21, with no two-qubit-gate cost.Its privacy argument is a construction requiring a secret random bit that is not exposed in the transcript.Source: tion · p. 24
• Across a sevenfold range of code length, the dZ = 1 repetition family’s per-cell asymmetry had median 0.071 and was 0.070 on an independent replicate.The measurement resolved asymmetry with 20,000 shots and does not establish that theorem hypotheses fail: under the stated convention, H1* remains intact and charged fault paths account for the observed asymmetry.Source: tion · pp. 25–26

The leak order is the code’s Z-distance

• The repetition-code TV lower bound was 0.358, while the distance-3 surface-code bound was 0.032—11.2 times smaller, but not a measured ratio of true TV.The surface bound’s 95% interval [0.016, 0.051] straddles its 0.023 null floor, whereas the repetition bound clears its 0.016 floor; these lower bounds do not establish suppression.Source: The leak order is the code’s Z-distance · p. 27, Figure 7 · p. 28

The order in γ, measured at fixed code

• The fixed-code n = 5 exposure sweep measured a log-log slope of 0.85 ± 0.03, matching the 0.86 predicted by the parameter-free transcript law.The n = 3 arm gave 1.07 ± 0.07 against 0.93; its smallest reachable γ = 0.015 is outside the asymptotic regime where the integer dZ = 1 exponent applies.Source: The order in γ, measured at fixed code · pp. 29–30

The converse, and the cost of privacy

• At n = 3, randomized encoding equalized decoded logical error rates to 1.50 × 10−2 and 1.58 × 10−2, within 6%, with no added two-qubit gates.The physical randomization uses opposite-codeword preparation, costing +5 one-qubit gates and +1 depth; it is not merely a software Pauli-frame relabeling.Source: tion · p. 25, The converse, and the cost of privacy · p. 30

The theorem’s own convergence condition, on this device

• The processor’s measured ϵ0 = 8.9×10−2 exceeds the 4.1 × 10−3 requirement by 21.5×, so the sufficient convergence certificate misses on this hardware.The equivalent polymer activity is ea = 22.4, above the required ea < 1; this means convergence is not established, not that a leak is proved.Source: The theorem’s own convergence… · p. 31

Relation to correctability–privacy duality, and scope

• Approximate correctability–privacy duality [23] [24] [25] turns ϵ_d-correctability into at most 2√ϵ_d transcript privacy, yielding e^−Θ(d) privacy for a below-threshold surface-code memory.This generic corollary is strictly weaker than the paper’s axis-resolved result.Source: Relation to correctability–privacy… · pp. 31–32

Where the corollary does not reach

• Theorem 1 assigns each logical axis its own coset distance, so amplitude-damping basis-label privacy is governed by d_Z rather than d_min.The distinction allows one axis to be hidden far better than another, a separation a d_min-only guarantee cannot express.Source: Where the corollary does not reach · p. 32, Contributions of the axis-resolved… · p. 36
• 0.927 is the transcript’s TV lower bound for identifying the repetition-code input at n = 21, while the phase-flip code’s syndrome transcript carries exactly zero information under unexposed damping jumps.Both families have d_min = 1; the phase-flip code’s syndrome blindness holds for every damping strength and number of rounds, but does not extend to records that include jump patterns.Source: Where the corollary does not reach · pp. 32–33

this one

• Private-algebra privacy does not protect the classical basis label: complete Z-dephasing can satisfy the algebraic condition while mapping the two logical Z-eigenstates to outputs with TV = 1.For the commutative algebra span{I_L, Z̄}, the algebraic notion makes no promise about its classical centre, unlike the state-distinguishability notion used here.Source: this one · pp. 34–35

Contributions of the axis-resolved framework

• The axis-resolved framework identifies which records expose the input and at what rate, with amplitude-damping leakage set by d_Z and other dominant channels selecting their own axis.Its contributions include an explicit detector-graph and Kotecký–Preiss rate and a sufficient transcript criterion that requires no correctability hypothesis for any axis.Source: this one · pp. 35–36, Contributions of the axis-resolved… · p. 36

Which secret the theorem covers

• Syndrome-based attacks that reconstruct computation activity concern a different secret from the logical input protected by Theorem 1.The distinction determines an operator’s safe publication scope; the supplied passage frames the theorem’s practical reading around a fixed schedule.Source: Which secret the theorem covers · p. 36
• A code with large d_min protects an arbitrary logical input, whereas under amplitude damping, large d_Z protects the computational-basis label.Source: Which secret the theorem covers · p. 36
• The fixed-schedule theorem protects the logical input from a transcript observer, but does not establish telemetry safety because the transcript may still reveal the algorithm.The schedule itself, and everything inferable from it, is not protected.Source: Table 4 · p. 37, Which secret the theorem covers · p. 37

Discussion

• A calibrated logical record can leak, including an intentional lattice-surgery parity readout; circuit blindness instead comes from the cryptographic protocol.The relocation principle places the boundary through ordinary fault-tolerant primitives, not only exotic ones.Source: Discussion · pp. 37, 39
• TV is at least 0.927 for the dZ = 1 memory at repetition length n = 21, while the sufficient Kotecký–Preiss certificate misses by 21.5× on the measured processor.The failed certificate does not demonstrate that physical activity violates the condition.Source: Discussion · p. 37
• The dZ = 3 circuit’s empirical TV lower bound is 11.2 times smaller than the dZ = 1 circuit’s, making code choice the basis-label privacy control.The repetition code stores its logical basis in the noise-preferred basis; the surface code does not.Source: Discussion · pp. 37–38
• Randomized encoding returns the empirical bound to the statistical floor on good qubit lines at no two-qubit-gate cost, but residual leakage remains on degraded lines.It uses a transversal single-qubit layer; the mitigation’s price appears in the logical error rate.Source: Discussion · p. 38
• The privacy guarantee is conditional on a fixed, input-independent schedule: large dmin protects arbitrary logical states, while large dZ protects computational-basis labels against amplitude damping.Circuit identity, patch activity, adaptive schedules, the final output, and direct physical probing are separate observables.Source: Discussion · p. 38
• A fixed-code exposure sweep reproduces the parameter-free curve at 0.94 of its height, with exponent 0.85 ± 0.03 against the predicted 0.86.The measured device’s damping exposure is dominated by idle windows, and matched simulation attributes the observed asymmetry to damping there.Source: Discussion · pp. 38–39

Methods

• The observer sees syndrome history, decoder actions, reset records, timing metadata, and jump or herald records, but not the final physical register, recovered logical qubit, or reported output.The user or trusted agent holds the final physical register and performs recovery.Source: The transcript instrument and the… · p. 40
• The transcript channel maps an input state to classical transcript probabilities through instrument effects, followed by fixed classical post-processing.Decoder actions and timing or reset metadata are deterministic or input-independent functions, so data processing prevents them from increasing distinguishability.Source: The transcript instrument and the… · p. 41
• Fault-support regions track connected detector cells touched by a bra–ket fault pair before syndrome cancellation; observed detector components are a distinct empirical diagnostic.A fault chain may occupy Θ(k) cells but fire only at its endpoints, while a nontrivial logical loop may occupy Θ(d) cells and fire nothing.Source: The transcript instrument and the… · pp. 41–42
• Neutrality is homological: a region is charged when its carried operator is nontrivial logically, even if it has zero net syndrome.A logical loop can have trivial boundary but nontrivial homology.Source: The transcript instrument and the… · p. 42
• PWTS bounds the resummed activity of fault histories producing each connected fault-support region, uniformly in d and T.Its activity decays geometrically with region size, including for charged regions.Source: The transcript instrument and the… · p. 42

The two transcript-locality hypotheses

• H1* requires the honest-backbone effect to be scalar within each syndrome sector, so error-free records do not distinguish logical states.The sectorwise condition is stronger than requiring scalar behavior only after averaging over syndromes.Source: The two transcript-locality hypotheses · pp. 42–43
• H1* holds for complete stabilizer gadgets, fresh or reset ancillas, classical-kernel records, decoder post-processing, and no intermediate physical logical recovery.A measured-check-group test can check that measured checks do not multiply to a nontrivial logical, but it does not establish the full hypothesis for coherent faults, analog records, leakage, timing, and feedback.Source: The two transcript-locality hypotheses · p. 43
• PWTS requires pre-logical activity of every connected fault-support region to decay geometrically, including regions that may be charged.The polymer expansion needs pre-logical activity because correctable regions have zero logical quotient under H1* and Knill–Laflamme.Source: The two transcript-locality hypotheses · pp. 43–44
• The PWTS derivation applies to the standard reset-ancilla syndrome-record model under stated microscopic locality and rate assumptions; outside that model it must be separately certified.The model’s bound uses local depolarizing, measurement, reset, coherent, crosstalk, and leakage branch weights.Source: The two transcript-locality hypotheses · p. 44

Privacy notion

• The transcript channel is within κd = e^-Θ(d) in diamond norm of an input-independent channel, bounding total variation for every pair of logical inputs.The bound includes inputs beyond the logical basis pair and supports hypothesis-testing privacy and differential-privacy corollaries.Source: Privacy notion · p. 44
• Pure ε-DP and Rényi-DP are unavailable because faithful transcripts can occur under one input but not the other, forcing an infinite likelihood ratio.The paper records a smooth (εd, δd)-DP corollary with both parameters e^-Θ(d), not a relative-likelihood claim.Source: Privacy notion · pp. 44–45

Device-model derivation of the locality hypothesis

• For the reset-ancilla model, bounded-footprint noise atoms yield a resummed rod activity from local noise rates, with persistent errors registering at detector endpoints.The activity combines stochastic, coherent, crosstalk, and leakage contributions.Source: Device-model derivation of the… · p. 45
• Repeated or persistent records of logical factors, including direct data-qubit readout or per-qubit energy telemetry, drive one-wire activity toward one and break the locality bound.The model excludes persistent quantum-nondemolition records that reconstruct a logical operator across Θ(d) rounds.Source: Device-model derivation of the… · pp. 45–46

• The all-orders cluster expansion controls high-order combinations of individually invisible records without relying on cancellation between fault paths.Under PWTS and the Kotecký–Preiss condition ea < 1, charged clusters of size at least m/ℓ* have total weight bounded by κ_m = C poly(d, T) θ^(m/ℓ*), with θ < 1.Source: Proof architecture of the no-leakage… · pp. 46, 51
• The argument requires a sector-scalar honest backbone and uniformly bounded region activity, with convergence supplied by the Kotecký–Preiss condition.Neutral homologically trivial contributions vanish by Knill–Laflamme; the backbone's off-code dressing carries no logical signal.Source: Proof architecture of the no-leakage… · pp. 46–47
• Each nonzero logical-P component costs its own coset distance d_P, including for coherent, non-Pauli operators, rather than the ordinary minimum distance.A charged connected fault-support region must have size at least d_P/ℓ*; the proof applies this separately to X, Y, and Z components.Source: Proof architecture of the no-leakage… · pp. 47, 50
• The distance cost is assigned to connected fault-support regions, not fired detectors, so even syndrome-silent logical configurations still pay the charged-support bound.Detector parities can cancel along a fault chain, making the fired set much smaller than the support; the expansion instead sums over outcomes on touched cells.Source: Proof architecture of the no-leakage… · p. 48
• Transcript laws obey TV(Pρ, Pσ) ≤ 3κd_min for all logical inputs, while the |0_L⟩ and |1_L⟩ transcript laws differ by at most κd_Z.The all-input bound covers superpositions and mixtures; the Z-eigenstate bound isolates the Z-axis cost.Source: Proof architecture of the no-leakage… · p. 49

Proof architecture

• The decay base is θ = a = e^(νKrodη̄), with binding Kotecký–Preiss condition ea < 1 and constants independent of d and T.Here ν is bounded by e^Δ and is the connective constant of the bounded-degree detector graph; Krod and η̄ are persistent-wire constants. A charged region has size at least d/ell*, where ell* is of order check weight times temporal extent for the rotated code.Source: Proof architecture of the no-leakage… · pp. 51–52
• At T = Θ(d), the anchor-cell choice contributes a Θ(d^3) prefactor, absorbed by the exponential θ^(d/ell*).The spacetime volume enters only through the polynomial prefactor poly(d, T).Source: Proof architecture of the no-leakage… · p. 52
• The transcript-factorization bound η(R) ≤ (Krodη̄)^|R| is an explicit modeling hypothesis, not a derived fact.It lets PWTS bound each region’s activity by a product over that region; the device-model derivation states it as a hypothesis.Source: Proof architecture of the no-leakage… · p. 52

Relation to fault-tolerance threshold theorems

• The proof assumes PWTS, a transcript analogue of the local-stochastic or local-Hamiltonian noise condition used in threshold proofs [6] [44].It expands the observed instrument into detector-region polymers.Source: Relation to fault-tolerance threshold… · p. 52
• The argument adapts threshold-proof cluster expansion to transcript polymers, showing input-sensitive charged clusters are exponentially suppressed below a constant threshold.The homological lower bound on charged-cluster size is the geometric fact underlying surface-code distance [17] [18].Source: Relation to fault-tolerance threshold… · p. 52
• Threshold theorems bound uncorrectable-fault probability, whereas this theorem bounds the probability that a transcript reveals the logical input.Both bounds are governed by code distance.Source: Relation to fault-tolerance threshold… · p. 52
• The result applies to reset-ancilla transcripts on local, leakage-managed hardware, with factorization and no exposed data-calibrated record as extra transcript assumptions.PWTS excludes similar long-range or persistent pathologies.Source: Relation to fault-tolerance threshold… · p. 52

Time scale, composition, and stopping

• For T = e^o(d), the bound remains non-trivial, so privacy survives execution logs subexponential in code distance.For T = poly(d), it remains e^-Θ(d).Source: Time scale, composition, and stopping · pp. 52–53
• For T = e^Θ(d) with a sufficiently large constant, the prefactor overwhelms the exponential decay and the theorem becomes vacuous.The result makes no claim in that regime.Source: Time scale, composition, and stopping · pp. 52–53
• For N memory blocks each protected at κ_d = e^-Θ(d), the composition bound gives total variation at most Nκ_d, preserving privacy for N = e^o(d).This union bound is loose; tightness is not claimed.Source: Time scale, composition, and stopping · p. 53
• A transcript-based stopping rule gains nothing because post-processing cannot increase distinguishability.The data-processing inequality applies because the stopping rule is a function of the transcript.Source: Time scale, composition, and stopping · p. 53
• The schedule is fixed and input-independent; adaptive or maliciously chosen schedules are outside the work's scope.An adversary influencing device behavior is excluded by hypothesis.Source: Time scale, composition, and stopping · p. 53

The converse

• A charged, calibrated witness is the relevant converse: a transcript function estimates a logical-operator eigenvalue with error p_W, yielding a binary-testing bound.A witness is charged when its reported Paulis multiply to a nontrivial logical operator, and calibrated reports track their Paulis with known bounded error.Source: The converse · p. 53
• For decoded lattice-surgery parity, p_W = p_LS ≤ Ce^-αd below threshold, giving TV ≥ 1 − e^-Θ(d).The witness is the decoded merged-boundary parity from the redundant spacetime syndrome.Source: The converse · p. 53
• With Θ(d) raw local reports at fixed per-report error δ, the union bound scales as Θ(dδ) and becomes vacuous once dδ ≳ 1/2.The bound is useful only for short witnesses or δ = o(1/d).Source: The converse · p. 54
• Measured merged-parity error is pLS = 0.100 at d = 3 versus 0.217 at d = 7; in linear geometry, a single stabilizer seam has no spatial protection, and error rises with distance.The exponential converse concerns a decoded witness on a two-dimensional seam.Source: The converse · p. 54
• A bare PWTS violation need not leak input: it may measure the wrong Pauli or be one-time-padded, so the estimator—not its component reports—is the primary statement.The witness converse is a binary-testing result for charged calibrated witnesses.Source: The converse · pp. 53–54

Stating the prediction per qubit

• Assuming one decay rate for every data qubit is not a small correction for leaks of order γd_Z once d_Z > 1.The exact transcript laws described here were evaluated at a single γ.Source: Stating the prediction per qubit · p. 54
• A median-γ law understated the prediction at short exposures and overstated it at long exposures, creating an apparent crossing unrelated to the device.At small exposure, the fastest-decaying d_Z qubits dominate; at large exposure, they have already decayed.Source: Stating the prediction per qubit · p. 54
• Re-evaluating the exact law with per-qubit rates brought the shortest-exposure ratio to 0.97 and removed both lower-bound violations.The earlier median-rate comparison was a factor 1.52 above the law at the shortest exposure, with lower bounds exceeding it at two of five exposures.Source: Stating the prediction per qubit · pp. 54–55
• Per-qubit T1, T2, and readout error were snapshotted before submission and after job completion because calibrations move.The worst-drifting qubit changed by more than a factor of two, so disagreements were reported as a γ range.Source: Stating the prediction per qubit · p. 55

Noise models and simulators

• Numerics use rotated-surface-code circuit-level depolarizing noise with gate, measurement, reset, and per-round data errors [55].Where needed, decoding uses minimum-weight perfect matching [57] [59], and leakage follows standard leakage-reduction analyses [45] [60] [61].Source: Noise models and simulators · p. 55
• The adversarial classifier uses the full detector-event vector to distinguish circuits with and without a detector-silent logical-X injection, reporting held-out AUC with bootstrap intervals.Its AUC is a finite-sample monotone proxy for distinguishing advantage; only the optimal likelihood-ratio score is biconditional with TV = 0.Source: Noise models and simulators · p. 55
• The d = 3 statevector simulator applies genuine coherent rotations and persistent leaked-carrier errors that randomize each round until leakage-reduction reset.The coherent rotations are non-Clifford and cannot be captured by a stabilizer sampler.Source: Noise models and simulators · p. 56
• The converse simulator uses minimum-weight perfect matching on the distance-d-protected merge seam and treats merged-parity error as the leak rate.This uses a named decoder rather than an idealized bound.Source: Noise models and simulators · p. 56
• The PWTS calibration fits fired-detector cluster-size tails, but this diagnostic cannot certify polymer activity or the Kotecký–Preiss condition.At simulated rates, that smallness condition is not met; the direct distinguishing-advantage test is used for accessible-rate privacy evidence, while the closed bound holds in the deeper sub-threshold regime.Source: Noise models and simulators · p. 56

Data availability

• The public archive has a fixed v1.0.1 release, with the citation resolving to an archived snapshot rather than a moving branch.Simulation results are stored as one JSON file per figure panel with outcomes, seeds, and tool versions.Source: Data availability · p. 56
• The original grouped-sweep analysis plan, circuit families, and result manifests were fixed before quantum-processor time was used.The randomized re-acquisition and fixed-code exposure sweeps were follow-ups, with plans frozen before their jobs were submitted.Source: Data availability · p. 56
• Hardware data include raw per-shot registers and session metadata covering job identifiers, qubit lines, transpiled depths, inter-shot delay, and calibration snapshots.The records are from ibm_cleveland.Source: Data availability · p. 57

Code availability

• The archive includes code for Stim circuit construction, matching decoding, adversarial-classifier and exact statevector-trajectory simulations, cluster-tail calibration, and figure generation.The implementation is available alongside the result data.Source: Code availability · p. 57
• Dedicated scripts exactly enumerate logical coset distances and transcript laws, including damping-order measurements with and without the environment jump record.Other scripts check logical-Z-algebra correctability and recompute the hardware bound with exact one-sided confidence bounds.Source: Code availability · p. 57
• The audit script re-derives the Kotecký–Preiss conditions, thresholds, tail sums, slopes, bounds, and certificate numbers, with 170/170 checks passing.The paper identifies which argument links those checks cover and which remain ordinary mathematics for readers to verify.Source: Code availability · p. 57