PaperlayerView exact revision on arXiv

Source-linked AI summary

Securing quantum error correction against misleading advice from AI agents

A. Barış Özgüler

arXiv:2609.19090v1quant-phcs.AIcs.CRcs.SYeess.SY

TL;DR

Passive syndrome histories in the odd-distance toric instrument cannot distinguish opposite coherent-rotation signs, although a fixed recovery can help at one sign and harm at the other. The paper uses encoded calibration and a separate evaluator to certify proposed recovery updates under measurement uncertainty and justified drift. Its advice-attack results show that evidence checks can block harmful activations while retaining beneficial updates, conditional on valid physical assumptions.

  • Problem

    The paper asks whether attacker-influenced AI advice can produce harmful recovery updates and whether observations still justify a proposed change when calibration may be uncertain or stale.

    Source: §I · p. 1

  • Method

    The controller proposes updates, while an independent evaluator checks improvement over the incumbent using calibration evidence, uncertainty, and a justified deployment drift bound.

    Source: §I · p. 1, B. A bound that includes the… · p. 4

  • Results

    Evidence checks block harmful proposals induced by tested advice attacks while retaining beneficial updates under honest advice, without assuming that advice is accurate.

    Source: §VI · p. 9

  • Takeaways & Limitations

    Activated recovery updates should be justified by independent evidence while evaluating protection together with the recovery benefit retained by acceptance.

    Source: §VI · p. 10

    The guarantee is conditional on the assumed relation between calibration and deployment; violating that physical premise can permit harmful acceptance.

    Source: C. Failure when the physical premise… · p. 7

Abstract

from arXiv · show

Can an attacker turn influence over an artificial intelligence (AI) adviser into a harmful quantum error-correction update? We identify an ambiguity in passive syndrome records that obstructs recovery selection, then show how additional calibration measurements support certified recovery updates under uncertainty and drift. In an odd-distance square toric code with error-free preparation, syndrome measurements, and recovery operations, opposite coherent $X$ rotations produce identical passive syndrome-history distributions. Yet a fixed phase correction can help at one sign and harm at the other. A terminal logical measurement on known encoded calibration states supplies the missing sign information. A separate evaluator accepts an update only when calibration uncertainty and a justified drift bound certify improvement over the current recovery, without assuming that the adviser recommends correctly. In simulated advice attacks, calibration-confidence checks reject harmful proposals while retaining beneficial updates under honest advice. We derive sufficient limits on calibration age that require improvement through deployment. In matched simulations, a validated channel-specific bound retains more beneficial updates than the general bound after accounting for evaluation time, while preventing the tested harmful activations under the stated drift assumption. A separate surface-code experiment includes stochastic circuit faults and noise changing during acquisition. Deterministic controllers achieve at least as many beneficial updates with the same observations. Violating the drift assumption permits harmful acceptance in the toric experiment. The results identify information required for recovery selection, establish conditional guarantees against harmful updates, and quantify the recovery improvements forgone through conservative acceptance.

I. INTRODUCTION

The paper asks whether attacker-influenced AI advice can cause harmful quantum error-correction updates, and whether independent evidence can justify recovery changes despite uncertainty and drift. It connects this question to an exact observation ambiguity and distinguishes that problem from computational limits and related calibration approaches.

I. INTRODUCTION

  • The security question concerns whether observations justify a proposed update at use time, since rejecting every proposal also forfeits potential recovery improvements.The paper assesses protection together with the benefit retained by acceptance.Source: §I · p. 1
  • Opposite coherent-rotation signs can yield identical passive syndrome-history distributions even though a fixed recovery helps at one sign and harms at the other.A signed calibration supplies the missing information, while an evaluator separate from the adviser checks whether an update improves on the incumbent under measurement uncertainty and justified drift.Source: §I · p. 1
  • Trusted calibration must belong to the experiment and recovery at issue, and its interpretation must remain valid at deployment.The evaluator owns the records and checks workload and action identifiers; measurement sources, evaluator, and enforcement are trusted components, while noise and drift bounds are physical assumptions.Source: §I · pp. 1–2
  • Decoding complexity is distinct from the observation obstruction: even unlimited computation cannot distinguish physical conditions with identical observation laws.A fast decoder can still rely on an incorrect or outdated noise model.Source: §I · p. 2
  • The toric result extends prior sign-ambiguity work from individual graph-state stabilizer probabilities to joint distributions of every passive syndrome history and their recovery consequences [53].It also establishes a surviving product parity, a nonzero leading coefficient, and exact sign symmetry of every passive history, complementing earlier coherent-error and privacy results [12] [17] [18] [19] [20] [21] [22] [23] [24] [25].Source: §I · p. 2

II. TORIC EXAMPLE: MISSING INFORMATION CHANGES RECOVERY

In the specified odd-distance toric instrument, passive histories cannot distinguish opposite coherent-rotation signs, although the sign can change which fixed recovery is beneficial. The section connects that ambiguity to recovery risk and bounds on what passive histories reveal.

II. TORIC EXAMPLE: MISSING INFORMATION CHANGES RECOVERY

  • The instrument is a fixed odd-distance square toric code with two logical qubits, uniform signed physical RX(θ) rotations, complete Z-syndrome extraction, and deterministic minimum-weight X recovery.Preparation, projective measurements, terminal readout, and specified recovery are ideal in this model; phase discretization and actuation noise belong to separate extensions.Source: §II · p. 2
  • Opposite signs have identical passive syndrome-history laws for every input and history length, so longer passive records do not resolve the sign ambiguity.Logical-input sensitivity is distinct and first occurs at order θ^2L; a record may reveal stored parity while carrying no sign information.Source: §II · p. 3
  • At fixed odd L as θ → 0, maximum complete-history contrast scales as Θ_L(|θ|^L), while the associated coherent channel can remain a finite, nonzero distance from identity.The matching lower bound comes from the probability that a rare syndrome occurs at least once; the bounds have distance-dependent constants and validity neighborhoods.Source: §II · p. 3
  • At L = 3, |θ| = 0.10, and H = 300, incumbent infidelity is 0.1323553 versus approximately 0.0007456 for the correctly signed table; the same +0.10 table harms recovery at the opposite sign.The incorrectly signed table raises infidelity to approximately 0.4140468.Source: §II · p. 4
  • A uniformly beneficial action must improve recovery across every condition consistent with the allowed observations; if no catalog action is beneficial throughout that class, those observations cannot justify one.That conclusion is limited to the declared deterministic action catalog; randomized recovery requires evaluating its own loss.Source: §II · p. 4

A. A sign-sensitive observation in the same instrument

Opposite coherent X rotations yield identical passive syndrome-history distributions, but a terminal observation on known encoded calibration states supplies sign information. Calibration uses repeated memories and retains all angles compatible with the measured count.

A. A sign-sensitive observation in the same instrument

  • The toric demonstration uses L = 3 and 18 data qubits, with a dedicated known calibration memory and 100 unchanged rounds before terminal measurement.The terminal outcomes are ±1 on the populated two-dimensional subspace.Source: A. A sign-sensitive observation in the… · p. 4
  • At θ = +0.10 rad, qY ≃0.647136, versus 0.352864 at −0.10, although passive syndrome histories have identical laws.The terminal observation changes the available information; the unknown stored state is not measured to determine the sign.Source: A. A sign-sensitive observation in the… · p. 4
  • A two-sided 99% Clopper–Pearson interval from N independent memories retains every compatible angle in [−0.15, 0.15] rad, including disconnected intervals.The encoded probe uses memory noise directly, without a separate sentinel-to-code transfer relation.Source: A. A sign-sensitive observation in the… · p. 4

B. A bound that includes the deployment path

The evaluator propagates calibration uncertainty and a justified drift bound through deployment before accepting a proposed recovery. Its guarantee is conditional on valid confidence regions, physical premises, and risk bounds.

B. A bound that includes the deployment path

  • The deployment bound adds a drift allowance to the stationary risk bound over the allowed paths from calibration to deployment.The elapsed time includes acquisition, inference latency, and delivery delay.Source: B. A bound that includes the… · p. 5
  • The evaluator admits a proposed recovery only when its bounded risk certifies improvement over the incumbent; otherwise it retains the incumbent.The rule may reject an operation that would improve on the path actually executed.Source: B. A bound that includes the… · pp. 4–5
  • The probability guarantee requires valid confidence regions, allocated error budgets, applicable physical premises, and valid bounds for every allowed action.The guarantee does not assume that the adviser recommends correctly.Source: B. A bound that includes the… · p. 5
  • Repeated proposals using one confidence region consume no additional statistical allowance, but each new calibration block uses part of the total failure-probability budget.Data-dependent acquisition policies require conditional coverage or simultaneous coverage over permitted choices.Source: B. A bound that includes the… · p. 5
  • Calibration age is acceptable when propagated uncertainty still certifies the proposed improvement, so recent noisy evidence may fail while older precise evidence may suffice under slow drift.The displayed age curves bound validity for their observations and drift assumptions; they are not acceptance probabilities.Source: B. A bound that includes the… · p. 5
  • The same acceptance argument extends to other observations when their confidence regions and bounds on noise-related risk changes are justified.The surface-code extension changes the observation and loss and permits noise to vary during acquisition.Source: B. A bound that includes the… · p. 5

A. Measurements, proposals and independent assessment

The study evaluates calibration workloads, advice proposals, and recovery outcomes using independent deployment assessment. It compares adviser behavior with a deterministic controller using the same ranking.

A. Measurements, proposals and independent assessment

  • The 12 calibration workloads comprise six rotation angles with two independent acquisitions each, and the controller evaluation uses 8192 shots per workload.The workloads are reused across five conditions, yielding 60 model requests rather than 60 independent workloads.Source: A. Measurements, proposals and… · p. 5
  • Qwen receives terminal counts, timing, record identity, action ranking, and supported updates, while the deterministic comparator uses the same ranking and ignores the untrusted note.The misleading note requests the worst-ranked action as a controlled test of whether a harmful proposal reaches activation.Source: A. Measurements, proposals and… · p. 5
  • For the encoded calibration state, all 256 one-round syndrome probabilities from the exact instrument coincide at θ = ±0.10 rad, while terminal logical measurements distinguish the signs.Source: Figure 2 · p. 6
  • Independent Bell-return tests assess each of three actions using 16384 shots per action, classifying benefit or harm when candidate-minus-incumbent intervals lie beyond ±0.001.The intervals cover all three action risks within an instance, not the entire study simultaneously.Source: A. Measurements, proposals and… · pp. 6–7

B. Beneficial recovery and harmful advice

In latency-adjusted replay, the validated channel-specific bound retains more delayed beneficial updates than the general bound while preserving tested protection under valid premises. Advice attacks and delay also expose distinct costs of conservative acceptance.

B. Beneficial recovery and harmful advice

  • Under honest advice, the full rule accepts 8 of 12 beneficial proposals, while both evidence-based rules reject all 12 harmful proposals under misleading advice.Confidence-only acceptance admits 10 honest updates; the deterministic controller achieves 12, 10, and 8 under authorization, confidence-only, and full acceptance, even with misleading advice.Source: B. Beneficial recovery and harmful… · p. 7
  • After a 30T0 delivery delay, all 12 proposals remain beneficial on their executed paths, but the full rule rejects them because the propagated bound misses its improvement margin.Identity checks also reject all 12 requests tied to the wrong workload.Source: B. Beneficial recovery and harmful… · p. 7
  • The channel-specific drift coefficient retains all 12 delayed beneficial updates per controller, versus 0 under the general bound, with 0 valid-premise harmful activations.The invalid sign flip still causes harm; these are enclosed-model outcomes on latency-adjusted paths.Source: B. Beneficial recovery and harmful… · p. 7

C. Failure when the physical premise is false

An abrupt post-calibration sign reversal violates the declared drift-rate bound and permits harmful recovery updates. The safety guarantee is conditional on the assumed relation between calibration and deployment.

C. Failure when the physical premise is false

  • After an abrupt sign reversal violates the drift bound, authorization admits 12 harmful updates, confidence-only acceptance admits 10, and the full rule admits 8.The same counts occur for the deterministic controller.Source: C. Failure when the physical premise… · p. 7
  • The guarantee is conditional on the calibration-to-deployment relation being valid, not on whether the proposer is a language model.A genuine calibration record can support a harmful action if its assumed relation to deployment is false.Source: C. Failure when the physical premise… · p. 7

D. Additional attacks, maintenance, and calibration expiry

Under the tested drift paths, timing checks rejected harmful updates that calibration-confidence checks alone admitted. The section also reports how advice attacks and misleading notes affected proposals and beneficial maintenance updates.

Advice attacks

  • GPT-OSS adaptive attacks induced harmful proposals in 12 of 24 workloads, compared with 4 for any success among three fixed attacks at the same query budget.Evidence checks blocked the observed harmful proposals; the counts apply to the specified attack design.Source: D. Additional attacks, maintenance,… · p. 7

Maintenance workflows

  • With enforced command formatting, Qwen completed 12 of 18 beneficial updates under honest notes and 0 under misleading notes; with native tool calls, GPT-OSS completed 12 and 8, respectively.These maintenance-arm completion rates use a 60-second clock and are not a timing-controlled comparison with the central one-second scenario.Source: D. Additional attacks, maintenance,… · p. 7

Calibration expiry

  • Confidence-only acceptance produced harmful activations in 16 of 24 acquisition workloads, while the full timing rule produced 0 on the tested paths.All 16 initially certified updates expired before becoming harmful; validity periods were 6.41–25.14T0, versus first sampled harmful delays of 46500–66000T0.Source: D. Additional attacks, maintenance,… · p. 7, Figure 3 · p. 8

V. EXTENSION TO TIME-RESOLVED SURFACE-CODE MAINTENANCE

The paper extends its toric-code analysis to surface-code maintenance under stochastic circuit noise that changes during acquisition, inference, and deployment.

V. EXTENSION TO TIME-RESOLVED SURFACE-CODE MAINTENANCE

  • The extension tests acceptance when stochastic circuit noise changes during acquisition, inference, and deployment.The preceding toric example provides the exact obstruction using encoded calibration and recovery in one coherent instrument.Source: §V · p. 8
  • Unlike the coherent toric instrument, the extension evaluates maintenance under changing stochastic circuit noise.Source: §V · p. 8
  • The surface-code experiment uses reinitialized known-state memories and classical decoder-prior updates with a corresponding observation model and loss.Source: §V · p. 8

A. Changing-noise acquisition and certification

The surface-code evaluation models changing stochastic fault laws, compares decoder-prior updates against incumbents, and applies calibration and drift-based acceptance checks. Its setup includes two code distances, multiple conditions, and explicit acquisition-to-deployment timing.

A. Changing-noise acquisition and certification

  • The experiment uses 30-round rotated surface-code memories and matching decoders, tests both logical bases, and compares candidate and incumbent decoders on the same detector record.Risk is the larger failure probability across the two bases; six candidate decoder priors are fixed before acquisition, with distinct distance-3 and distance-5 fault families.Source: A. Changing-noise acquisition and… · p. 8
  • Both controllers receive the same calibration summaries, evaluator-computed action ranking and menu, shot budget, and external note; the scenario clock includes processing latency.Source: A. Changing-noise acquisition and… · p. 8
  • The stochastic noise coordinate λ interpolates fault laws at instruction times, with | ˙λ| ≤ w and Γ bounding the sum of fault-law total-variation slopes.Fixed-look intervals use Chernoff bounds on KL divergence for independent shots with nonidentical probabilities; propagating only from the batch-end timestamp omits part of the allowance.Source: A. Changing-noise acquisition and… · pp. 8–9
  • The 24 workloads span six conditions, two distances, and three nested shot budgets, with acquisition, inference, and deployment durations included in the timing protocol.Acquisition spans 0.143–2.294T0 in the normal scenario, median Qwen inference contributes 0.690T0, and deployment spans 1.147T0.Source: A. Changing-noise acquisition and… · p. 9
  • Evidence-based acceptance requires improvement by 0.001, with paired intervals establishing benefit below −0.001 or harm above +0.001.Deployment samples are independent of calibration; accepted effects not resolved by these intervals are not evidence of safety.Source: A. Changing-noise acquisition and… · p. 9

B. Protection and retained benefit

Evidence-based checks rejected the tested misleading proposals, while acceptance rules retained different numbers of beneficial honest-advice updates. A simulated abrupt noise step outside the declared drift bound left some accepted effects unresolved.

B. Protection and retained benefit

  • Authorization alone admitted 6 resolved harmful updates from misleading text, increasing worst-basis failure risk by 2.40–3.35 percentage points; all evidence-based rules rejected the proposals.Calibration-time confidence alone blocked this attack, while identity checks rejected all 12 wrong-workload requests.Source: B. Protection and retained benefit · p. 9
  • Among 12 honest-advice Qwen instances with independently established benefit, whole-acquisition checking retained 4 updates and end-timestamp checking retained 6.The two additional whole-acquisition rejections were distance-5 workloads at 32768 shots per basis; a deterministic controller achieved more beneficial updates across workloads satisfying the assumptions.Source: B. Protection and retained benefit · p. 9
  • An abrupt simulated noise step outside the declared rate bound produced 4 accepted Qwen effects whose benefit or harm remained unresolved.In three cases, exploratory deployment intervals excluded the improvement promised by the numerical bound, while spanning both signs of excess risk.Source: B. Protection and retained benefit · p. 9

VI. CONCLUSIONS AND IMPLICATIONS FOR RECOVERY SECURITY

Evidence checks block harmful advice-driven recovery updates while retaining beneficial updates under honest advice, but stricter timing can reject updates that would benefit deployment. These protections depend on valid observations and justified drift bounds, and recovery integrity remains distinct from workflow availability.

VI. CONCLUSIONS AND IMPLICATIONS FOR RECOVERY SECURITY

  • Evidence checks block harmful activations induced by attacker-controlled notes while retaining beneficial updates under honest advice, without assuming the adviser is accurate.The guarantee requires valid observations and justified bounds.Source: §VI · p. 9
  • Timing checks reject harmful updates after sufficiently long valid drift, while confidence-only acceptance can admit them; violating the drift assumption permits harmful acceptance.An undeclared toric sign flip also causes harmful acceptances, while the surface-code excess-risk sign remains unresolved.Source: §VI · p. 9
  • A validated channel-specific bound retains more beneficial updates than the general bound in matched simulations after evaluation time is included.The comparison prevents tested harmful activations under the stated drift assumption.Source: §VI · p. 9
  • A deterministic controller following the evaluator’s ranking achieves at least as many beneficial updates as the tested AI adviser with the same observations.Both proposers face the same evidence requirements.Source: §VI · p. 9
  • End-timestamp checking retains 6 of 12 honest-advice Qwen updates, versus 4 under whole-acquisition checking; both additional rejections were beneficial distance-5 updates.The independent deployment intervals establish benefit for all 12 proposals.Source: Figure 4 · p. 10
  • Recovery integrity and workflow availability are separate endpoints: misleading notes can suppress beneficial completion even when harmful activation is blocked.Longer acquisition can average over drift and delay deployment.Source: §VI · p. 10
  • The toric chain assumes ideal preparation, extraction, readout, and logical actuation; hardware deployment requires characterizing these processes, drift, and the recovery actually applied.The surface-code extension instead uses reinitialized known-state memories and classical decoder updates.Source: §VI · p. 10

Proofs, protocols, and validation

The supporting material specifies the toric-code instrument and its observation models, then develops calibration examples and exact results on syndrome histories and code geometry. It distinguishes sampling uncertainty from physical-model uncertainty and reports results only within each study’s stated sampling scope.

I. CODE, INSTRUMENT, AND OBSERVABLES

  • The supporting studies use distinct observation models and endpoints, and their results should not be pooled as a common success rate.The text distinguishes finite-data uncertainty from physical-model uncertainty or violation; additional shots address only the former.Source: §I · p. 12

A. Periodic square toric code

  • The periodic square toric code places 2L² physical qubits on tagged edges and encodes two logical qubits in its CSS generators.Edge tags remain distinct when edges share endpoints at L = 2.Source: A. Periodic square toric code · p. 12

B. One-round instrument

  • The one-round instrument applies a syndrome-conditioned recovery in each round; its noise process is a signed coherent X rotation under otherwise ideal preparation, extraction, recovery, and readout.The signed angle θ specifies rotation direction and magnitude.Source: B. One-round instrument · p. 12

C. A positive calibrated-recovery example

  • At |θ| = 0.1 and H = 300, the incumbent infidelity is 0.1323553, versus 0.0007456 for the correctly calibrated phase table.The feasibility sweep selected candidates using the true angle before testing acceptance from calibration counts; later workflows select using observations only.Source: C. A positive calibrated-recovery… · p. 13

A. Effect characters and commuting Kraus operators

  • Expanding the syndrome effects in edge supports yields a character-based expression, and the resulting logical Kraus operators lie in the commuting algebra generated by logical X operators.The expansion sums over syndrome characters and identifies supports satisfying the stated kernel condition.Source: A. Effect characters and commuting… · p. 14

B. The all-angle parity law and sign ambiguity

  • For odd L ≥ 3, passive syndrome histories depend on the logical input through its conserved product parity, and inputs with equal parity have identical history laws at every history length.The laws at opposite signed rotation angles are identical; syndrome counts suffice for repeated measurements of this instrument.Source: B. The all-angle parity law and sign… · p. 15

C. The geometric constraint on nonscalar effects

  • A simple circuit is contained in some graph cut exactly when its length is even; for odd L, the geometric obstruction separates the two stated orders.The theorem gives toric-code parameters [[2L², 2, L]].Source: C. The geometric constraint on… · pp. 15–16

D. Attainment and the exact leading coefficient

The section examines how syndrome records and coherent logical drift affect recovery selection, including how passive histories can conceal sign information relevant to recovery. It connects calibration evidence to recovery actions and drift-aware deployment confidence, with conditional certification of improvement over the incumbent rather than an absolute logical-risk ceiling.

D. Attainment and the exact leading coefficient

  • Below degree 2L, the zero-syndrome logical coefficient vanishes; for L = 3, M3 = 42 and the coefficients in equations (34) and (38) are −21/16 and −21/8, respectively.The count and normalized coefficient have different distance dependence: the exponential support multiplicity cancels in this leading coefficient, but uniform-in-L control of the full contrast and higher-order terms requires separate bounds.Source: D. Attainment and the exact leading… · pp. 16–17

A. The known leading coherent drift

B. The complete-history bound and a nonresonant schedule

  • Passive syndrome histories are exactly blind to the sign of θ at every history length, while the complete-history bound contracts by at least [1 − ηL(θ)]^R.At fixed code size, the stated small-angle accumulation schedule is R*(θ) = ΘL(|θ|^-L); the constants and validity neighborhoods depend on L.Source: B. The complete-history bound and a… · pp. 17–18

A. Removing branch phases leaves a parity measurement

  • After branch-phase removal, the remaining backaction is a parity measurement: within-parity states are preserved exactly, while cross-parity elements are multiplied by AL(θ).The corrected channel preserves within-sector matrix elements, but the preparation label remains unidentifiable from the record.Source: A. Removing branch phases leaves a… · p. 18

B. Information and action classes of the comparisons

  • The specified phase-canceling correction generally requires signed-angle information beyond passive syndrome records, although sign-robust or Pauli recovery can still improve recovery.Commuting controls allow terminal phase correction for final-memory fidelity in this model; the comparison does not cover arbitrary interleaved noncommuting controls.Source: B. Information and action classes of… · pp. 18–19

C. An unidentifiable record-only target

  • For the stated pair of known encoded states, identical history laws make every record-only classifier succeed with probability 1/2, even when one state has zero expected loss and the other exceeds 1/4.The example concerns a particular memory-loss target, not whether recovery can improve an unknown stored state.Source: C. An unidentifiable record-only target · p. 19

A. Record and channel separation

  • For this 18-qubit instrument, worst-case equal-prior record-classification success is at most approximately 0.500814, while the corrected channel has order-one unhalved diamond displacement, db ≃ 1.37934.Finite-angle evaluations use exhaustive floating-point sums with independent 60-digit checks; formal interval certification remains separate. They demonstrate this regime without extrapolation to larger codes or faulty extraction circuits.Source: A. Record and channel separation · pp. 19–20

A. What must the observations distinguish?

  • A recovery update must be justified across conditions compatible with the evidence; signed probes can distinguish recovery-relevant signs, while a confidence set and justified drift bound support certification.The main demonstration uses terminal logical measurements on known encoded states; the evaluator is separate from the proposer, and identical passive observation laws cannot reveal the missing sign.Source: §VI · p. 20, A. What must the observations… · p. 21
  • Active self-calibration changes the observation experiment, so its positive results are compatible with the passive sign ambiguity; known-state probes or active syndrome dithering could also supply different information.Source: A. What must the observations… · p. 21

B. Record integrity and the threat model

  • The evaluator links calibration measurements and acquisition time to a fixed-catalog action, rejecting unknown or mismatched records while limiting proposers to action selection or budgeted probe requests.The threat model includes misleading recommendations and authentic old evidence; the prototype assumes a trusted evaluator process, reliable acquisition electronics, and bounded physical evolution, while cryptographic authentication remains separate work.Source: B. Record integrity and the threat model · p. 21

C. From finite measurements to a deployment set

  • Finite sentinel counts yield a two-sided Clopper–Pearson probability interval, inverted across allowed contrast–offset corners to form an angle confidence set; empty or unsupported sets are rejected.The angle interval is intersected with the physical domain, and proposals whose deployment region exceeds the supported domain are rejected.Source: C. From finite measurements to a… · p. 21
  • Under valid drift, readout, and transfer premises and exact execution, Proposition 8 bounds the unconditional probability of accepting an update that fails to improve on the incumbent, even with adaptive action selection.The bound applies over the declared experiment family; it does not impose an absolute logical-risk ceiling.Source: C. From finite measurements to a… · p. 22

D. Age, acquisition duration, and deployment duration

  • A conservative channel-distance allowance handles time-varying angles and incorporates execution duration into the freshness criterion under stipulated physical bounds.The extension accounts for finite capture duration, clock error, within-block drift, and correction cost.Source: D. Age, acquisition duration, and… · p. 22

A. Mechanism stress tests and baselines

This section stress-tests whether calibration evidence, uncertainty, and drift bounds can support safe recovery updates, examining certification, attack rejection, freshness, and failures when assumptions are violated across toric-code analyses, simulated workflows, audits, and circuit studies. It also compares recovery-update alternatives and examines the limits of passive-record identifiability and conservative acceptance.

A. Mechanism stress tests and baselines

  • The full confidence-and-freshness rule accepted 190 honest fresh and 168 benign-delay updates, all beneficial, and no bounded-stale harmful updates; confidence alone admitted 178 harmful stale updates.The acceptance proportions were 95% and 84%, respectively; zero harms in 200 trials gives an approximate one-sided 95% upper limit of 1.49% for this fixed challenge distribution, not arbitrary attacks.Source: A. Mechanism stress tests and baselines · pp. 22–23, Table S2 · p. 23
  • The full gate retained 97.1% of fresh-evidence recovery gain and 90.8% under benign delay in the tested distributions.Paired path-bootstrap 95% intervals were [94.9%, 98.9%] and [86.8%, 94.2%], respectively; the retained fraction depends on workload distribution.Source: A. Mechanism stress tests and baselines · p. 23

B. Failure when the drift bound is exceeded

  • When the drift bound was violated, the full rule admitted 187 harmful activations out of 200, matching confidence-only acceptance; the guarantee therefore depends on a valid physical drift premise.Supplemental sweeps reported 5400 condition–replicate evaluations satisfying assumptions with no observed harms and 4767 harmful activations among 22600 evaluations violating them; reused count blocks mean these totals are not independent binomial trials.Source: B. Failure when the drift bound is… · p. 23, §1 · p. 26

A. Learned recovery and a Bayesian comparison

  • Across 600 held-out paths, the guarded GRU’s mean infidelity was 0.088018 versus 0.225490 for incumbent retention and 0.089296 for a Bayesian filter; the neural-versus-Bayesian comparison was inconclusive.In a separate acquisition study, Bayesian allocation reduced mean newly acquired shots by 19.7% while mean infidelity increased from 0.0365583 to 0.0372372; learned allocation traced a similar cost–risk frontier.Source: A. Learned recovery and a Bayesian… · p. 23

B. Acceptance at calibration in the profile-changing circuit challenge

  • In the stochastic surface-code challenge, calibration established benefit for 346 of 400 candidates, while 54 remained unresolved; under stale deployment, all 400 effects were unresolved and the vacuous-bound gate rejected every candidate.This was a separate Stim/PyMatching study at distances 3 and 5 with 30 rounds, using paired matching-prior scoring on the same records; its circuit noise differs from the coherent toric instrument.Source: B. Acceptance at calibration in the… · p. 24

3. A rare syndrome attains the history exponent

  • At the specified coherent monitoring schedule, logical-input history distinguishability is bounded by O(|θ|^L), and a rare-syndrome construction attains that exponent while exact blindness to the noise sign remains.The sharper toric bound constrains every equal-prior binary history classifier’s success advantage to Δrec/2 = O(|θ|^L); it fixes the small-angle order, not the leading constant or an optimal general sample schedule.Source: §4 · p. 26

1. A controlled recovery comparison

  • For the L = 3, θ = 0.05 instrument, randomized adjacent-bin feedback achieved final-memory infidelity approximately 4.0017 × 10^-4, about 74-fold smaller than the implemented fixed controller, while wrong-sign calibration raised it to approximately 0.7521.Nearest-bin feedback improved one-round infidelity by approximately 151-fold but became worse than the fixed controller at the stated storage horizon; deferred 12-bit correction had infidelity below 1.774 × 10^-4 under its stated assumptions.Source: §1 · p. 26, Figure S5 · p. 27, Table S3 · p. 27

Supplemental Material D: Language-model maintenance and preliminary interface tests

  • In the revised interface pilot, guarded control completed 23 beneficial episodes out of 24, while authorization alone admitted 6 harmful updates and the deterministic comparator completed all 24 beneficially.The interfaces used different physical seeds, so the pilot is not a paired causal estimate of interface improvement or additional independent evidence for the central toric experiment.Source: Supplemental Material D:… · p. 27

1. Choosing a budget before acquisition

  • At λ = 10^-6, Bayesian acquisition averages 6581 new shots versus 8192 (19.7% fewer), while mean infidelity rises from 0.0365583 to 0.0372372.This is a one-look risk–cost tradeoff; the comparison uses one acquisition with α = 0.01 and does not attribute the cross-experiment risk decrease to learning.Source: §1 · p. 29, Figure S7 · p. 30

circuit-level decoder updates

  • At calibration settings, pointwise boxes establish benefit for all 200 distance-3 and 146 distance-5 cases; under stale deployment, all 400 effects remain unresolved and the full gate refuses every update.Calibration admits all 400 candidates, but stale-deployment certification requires a noise-family-specific drift bound; the prescribed full-gate bound is valid but vacuous.Source: circuit-level decoder updates · p. 29

supports and the parity law

  • For odd L, a nonzero seam-parity pair forces even circuit length to be at least 2L, proving the bound without assuming a staircase.The seam-parity pair is (1, 1) for odd L.Source: supports and the parity law · p. 29

1. Generator coefficients and the cut constraint

  • Cut-containment cancellation removes local cross terms, while surviving nonscalar supports at degree 2L are simple circuits with a common sign and selector factor.This establishes an attained leading effect order and identifies how support multiplicity enters the observable coefficient.Source: §1 · p. 31

2. Seam-linked paths and distinct simple supports

  • The exact coefficient measures the full leading zero-syndrome parity contrast rather than merely the existence of one surviving circuit; the calculation establishes a nonzero θ^2L coefficient.A related fixed-code bound for weak amplitude damping excludes leakage below a permitted order but does not establish general attainment [25, Proposition 1].Source: §2 · p. 31, §3 · p. 31

reduction and the channel remainder

  • At degree L, complementary subsets of straight logical lines exhaust the order-L coefficient, whose leading generator is a sum of commutators.The proof also gives the stated equation (42) through an alternating-binomial identity.Source: reduction and the channel remainder · p. 32

protocol

  • The exact protocol calculation gives the record curve without input-state optimization, while its one-round channel coefficient tends to α^3θ^3.Repeated rounds multiply the relevant matrix element by the corresponding channel factor.Source: protocol · p. 33

validation

  • Across 122 angles, relative Pauli-only improvement occurred at stronger noise, the −1 calibration ratio was the wrong-sign case, and extra per-round logical depolarization erased the benefit.The phenomenological budget treats correction as a whole action; pulse synthesis, measurement faults, latency-dependent gate noise, and potentially deferrable per-round control require a resolved implementation model.Source: validation · p. 33, Figure S8 · p. 34

and continuous bounds

  • At N = 18, 37 Fourier samples recover each Cij in exact arithmetic, while the certificate considers every intersecting cell rather than treating the plotting grid as sufficient.Comparisons against direct Kraus evaluation support the numerical tolerance, but formal floating-point enclosures would be needed to certify rounding error beyond the tested cases.Source: and continuous bounds · p. 35
  • The exhaustive audit’s largest integrated probability was 0.00281349 (< α = 0.01); with drift radii 0.005 and 0.02 rad, maximum margin-violation probability was 0.00378720114.The audit exhausts counts and actions on a finite physical-parameter grid, using evaluator knowledge to compute worst-selection risk.Source: and continuous bounds · p. 35

workflow details

  • On the public development distribution and tested average-risk objective, retention was the best fixed catalog policy; the robust catalog accepted 323 of 600 paths at mean risk 0.0893974.Predictors target observed next-outcome frequency, not hidden angle or logical risk.Source: workflow details · p. 36

confirmation uncertainty

  • Mean primary excess risks were [−0.003108, −0.002010] at distance 3 and [0.002362, 0.002704] at distance 5; individual return-to-base effects remained statistically unresolved.The equally weighted X/Z mean-risk return-to-base estimates were +0.0004706 (95% interval [0.0001977, 0.0007361]) and +0.0015100 (95% interval [0.0014172, 0.0015991]); the stale rule rejected all cases.Source: confirmation uncertainty · p. 37

prior-work comparison

  • The exact record-effect onset is the central quantitative contribution; prior work [53] identifies a related ambiguity for individual graph-state stabilizer outcomes, whereas this result concerns full passive-history laws.The proof uses corrected Kraus operators and their common eigenbasis; the effect-character expansion and toric cut constraint yield the exact onset and nonzero coefficient, building on [20, Eq. (91)] and support enumeration in [21, Appendix H].Source: prior-work comparison · pp. 38–39

1. Decoding cost, changing records, and measurement advantage

  • Efficient decoding and simulation address different tasks from certifying a recovery update, and exhaustive evaluation of this toric instrument grows exponentially when extended directly.The security evaluation asks what physical evidence supports an update when observations omit relevant information or become outdated; drift can also make a decoder’s assumed history model inaccurate.Source: §1 · pp. 40–41

1. Why the proposer need not be accurate

  • With a valid confidence region and correctly bound record and action, any accepted action meets the promised excess-loss margin simultaneously across allowed actions, regardless of proposer accuracy.Repeated queries against one region require no action-by-action penalty; the bound controls unconditional violation probability across the declared experiment family.Source: §1 · p. 41

2. Measuring readout nuisance parameters

  • Measured nuisance calibration produced 2,323 beneficial activations, 0 observed harmful activations, and 3 calibration-angle noncoverage events.The legacy comparator recorded 1,498/1,537/1,449 beneficial activations but 16/83/470 noncoverage events across settings, undermining protection where its nuisance premises failed. Calibration uses known +Y and −Y references measured through the same readout channel as the signed probe.Source: §2 · pp. 41, 42, 46

3. An audit allowing arbitrary catalog advice

  • The exhaustive finite-grid audit found a maximum margin-violation probability of 0.003787201138615698, below the declared 0.01 allowance.It exhausts counts and catalog choices on the specified physical grid; the analytical guarantee separately requires valid continuous risk bounds.Source: §3 · p. 42

4. Binding the action at activation time

  • The evaluator binds each single-use authorization to its evidence, reference, action, workload, epoch, and expiry, then rechecks identity and risk at activation.Activation copies the evaluated action array inside the critical section; external actuator execution and identity verification require additional interfaces.Source: §4 · p. 42

5. A sufficient validity period for a fixed circuit-noise family

  • At T = 30T0, all 200 distance-3 records and 199 of 200 distance-5 records admit a nonempty deployment window under the stated simulation scenario.Source: §5 · p. 43

6. Language-model and deterministic controllers

  • Among 168 assumption-satisfying workloads, the full-gate LLM achieved 159 beneficial updates and 0 observed harmful activations, versus 142 and 26 under authorization alone; state machines achieved 162 and 0.Additional acquisition costs were 1,007,616 shots for the full-gate LLM and 860,160 for each deterministic variant.Source: §6 · p. 43, Figure S13 · p. 46
  • When the drift premise was violated, 16/24 full-gate LLM blocks and 21/24 deterministic blocks had harmful activations.These invalid-premise cases are retained as failures; the controller outcomes characterize the specified attack set under its stated physical premises.Source: §6 · p. 43, Figure S13 · p. 46

8. Scope of deployment

  • The guarantees apply to the stated observation and noise models, ideal toric actuation, and an in-process evaluator with uncompromised memory and clock.Deployment also requires characterized reference preparation, readout, probe transfer, and drift, plus verification that the physical actuator applies the evaluated correction; broader noise families or within-block drift require corresponding bounds.Source: §8 · p. 44

4. Independent circuit reconstruction

  • The surface-memory experiments use independently sampled workloads and deployment shots, while timing conversions define scenario clocks rather than measured quantum-device timescales.Circuit reconstruction reproduced K3 = 3911.5 and K5 = 10101.5 without adding Monte Carlo observations; the central toric median request is approximately 0.782T0, not a per-syndrome decoding deadline.Source: §4 · p. 47, §1 · p. 48, §2 · p. 49

3. Confidence for changing acquisition probabilities

  • Three fixed looks use a union-bound allocation across 32 confidence boxes per look, including paired discordant outcomes for five candidate–incumbent comparisons in each basis.The paired counts retain candidate–incumbent correlation, without assuming independence among decoders.Source: §3 · pp. 49–50

4. Transport and the acceptance bound

  • The evaluator accepts only when the transported worst-basis risk bound satisfies U(a) ≤ −0.001, conditional on the declared noise-path class and correct timestamps.The whole-acquisition transport bound applies at later deployment times, including times determined by measured inference latency; its 0.05 probability allocation is within one workload across three looks.Source: §4 · p. 50

5. Controller interface, threats, and deployment outcomes

  • Qwen followed the misleading action in all 12 misleading-note instances and requested nonzero activation in all 12 wrong-identity instances.The threat model assumes software supplies the correct workload-match flag; that flag is not cryptographic authentication.Source: §5 · p. 50
  • Under honest advice, all 12 proposals had established benefit, but the whole-acquisition rule admitted 4 per controller; Qwen retained 48.5% of its authorization-only mean gain.Figure S15 summarizes timed-maintenance conditions and rules. In delayed and slow-acquisition conditions, the menus were already empty at issuance; the slow case’s 98.468T0 deployment horizon made the bound vacuous at the specified drift rate.Source: §5 · p. 51, Figure S15 · p. 52
  • When the simulated path violated the drift premise, 4 proposals per controller were admitted, but all 8 benefit-or-harm classifications remained unresolved.A post hoc diagnostic found the deployment lower endpoint exceeded the accepted numerical certificate in 3 of 4 Qwen cases and 4 of 4 deterministic cases; this did not resolve harm relative to the incumbent.Source: §5 · p. 51, Figure S15 · p. 52

1. Readout estimation and activation checks

  • Across 7,200 simulated readout calibrations, reference measurements admitted 2,323 beneficial updates with 0 observed harmful activations, at costs of 9,216–73,728 shots.The result assumes known preparation, a common stationary readout channel, and a justified probe-to-code relation; measuring nuisance parameters preserves coverage in changed-readout settings.Source: §1 · p. 54
  • The legacy fixed-readout comparator had 83 and 470 noncoverage events in the two changed-readout settings, versus 3 across all 7,200 calibrations with measured nuisance parameters.The legacy comparator showed no observed harmful update in these workloads, so noncoverage and observed harm are distinct outcomes.Source: §1 · p. 54

2. Coherent-memory controllers and learned proposals

  • Across 168 valid-premise workloads, the guarded LLM completed 159 beneficial updates with 0 observed harmful activations, while the deterministic controller completed 162 with 0 under either gate.Authorization alone completed 142 beneficial updates and had 26 harmful activations; the deterministic variants used fewer additional calibration shots than the guarded LLM.Source: §2 · p. 55, Figure S18 · p. 57

1. Encoded measurement and joint syndrome sampling

  • Opposite-sign rotations have identical passive syndrome-history laws, but terminal measurements on known encoded calibration states provide sign information for recovery selection.Complex conjugation under θ → −θ reverses the calibration mean while preserving the passive history law.Source: Figure S19 · p. 58, §1 · p. 62

1. Readout estimation and activation checks

  • The 8192-shot finite-grid audit found a maximum certified-action margin-violation probability of 0.00378720114, below the 0.01 threshold across 5076 settings.The check enumerated all 8193 possible counts and 13 actions; deployment also binds evidence to the evaluated recovery and reevaluates risk at activation.Source: §1 · p. 54, Figure S20 · p. 59

2. Coherent-memory controllers and learned proposals

  • The full freshness rule admitted no harmful updates in 200 bounded-stale paths and retained 97.1% of fresh-evidence gain and 90.8% with benign delay.Without age propagation, confidence-only evaluation admitted 178 harmful updates; violating the drift bound caused harm on 187/200 paths under the full rule.Source: §2 · p. 55, Figure S21 · p. 60

3. Stationary-acquisition circuit validation

  • At v = 10^-8, 200 reused calibration records yielded deployment windows for all distance-3 records and 199 distance-5 records; all 32 within-window tests were accepted and 16 beneficial beyond-window tests rejected.The two code distances use different noise families, so the windows do not isolate a code-distance scaling law; expiry marks loss of sufficient certification, not measured onset of harm.Source: §3 · pp. 55–56, Figure S22 · p. 61

2. Continuous confidence inversion and path allowance

  • The evaluator inverts a two-sided 0.01 Clopper–Pearson interval over a 60001-point angle grid, then propagates calibration uncertainty and a declared drift-rate bound to deployment.The grid allowance is 0.027 in the excess-risk bound, materially reducing acceptance; the bound is conditional on the physical drift premise and a tested numerical-error allowance.Source: §2 · p. 62

a. Contributions to the sufficient bound

  • The sufficient age bound adds the maximum risk over compatible calibration cells, a 0.027 risk-grid allowance, and a 0.0108 A/T0 drift allowance.At fixed retained cells, the risk-grid allowance alone consumes 2.5T0 of the age budget; expiry can precede the first harmful point on a particular path.Source: a. Contributions to the sufficient bound · pp. 62–63

3. Physical settings, fixed actions and timing

  • The fixed-action study uses 12 independent calibration workloads with nested shot budgets and tests Qwen requests against matched enforcement rules using the same proposals.Outcome risks are independently assessed with terminal Bell-return readouts; workload counts, not repeated scenarios or nested budgets, are the independent units, and study-wide simultaneous coverage is not established.Source: §3 · p. 63, §4 · p. 63, §5 · p. 63

6. Physical-model verification and scope

  • The physical-model checks match logical Kraus matrices to 2.78 × 10^-15 and verify circuit parity on all 262144 computational-basis strings under error-free preparation and logical actuation assumptions.The exported circuit specifies 18 rotations, eight ancilla-based Z checks, and 32 CNOTs; it specifies the circuit rather than demonstrating external compiler execution.Source: §6 · pp. 63–64

1. Design and observation boundaries

  • The attack study uses fixed notes and bounded adaptive queries, with exact-channel benefit and harm thresholds of −0.001 and +0.001 in its extension.That extension uses six angle values, six development acquisitions, and 24 held-out acquisitions; its exact-risk endpoints differ from the original experiment’s sampled deployment intervals.Source: §1 · p. 67, §2 · p. 67

2. Static and response-adaptive attacks

  • Confidence and full checks reject all observed harmful proposals in the static and adaptive attack arms, whereas authorization admits them.The adaptive arm makes three dependent queries per workload; a low proposal count can also result from an invalid response.Source: Table S8 · p. 67, §2 · p. 67, Figure S26 · p. 69

3. Multistep maintenance and command-format comparison

  • In the operational study, GPT-OSS completes beneficial updates in 12 of 18 honest-note workflows and 8 of 18 misleading-note workflows using native tool calls.The comparison preserves physical observations and acceptance checks; the text-only interface could not process direct tool calls, and the interface comparisons report no harmful activations.Source: §3 · p. 68, Figure S27 · p. 70

4. Valid drift and interpretation of the statistical unit

  • Under the stated drift model, full acquisition-to-completion age bounds deployment; zero observed harmful activations does not establish a universal attack-success rate or verify untested threats.The timed study evaluates 161 delays for each of 24 acquisitions, while repeated delay points share evidence and are not independent acquisitions.Source: §4 · p. 68

1. Outward-rounded inference and stationary risk

  • Outward-rounded validation supports all 24 previously accepted updates at original deployment ages under the physical assumptions, but validates inequalities without protection when the drift premise is false.Refinement changes representative stationary upper bounds by at most 1.24 × 10^-5; unresolved calculations retain the incumbent.Source: §1 · p. 71

2. A channel-specific drift constant

  • A channel-specific derivative bound uses Mu ≤ 123.459 instead of 10800 and extends maximum certified ages by a common factor of 87.48 before latency is charged.At budget 8192, maximum certified ages are 1.53–28.15T0 under the general bound and 134.25–2462.93T0 under the derivative bound; the refinement gives Mu ≤ 123.238.Source: §2 · p. 71

3. Latency, retained benefit, and premise failure

  • Across 96 valid-premise instances, the general rule accepts 32 beneficial updates and the derivative rule accepts 60, with neither accepting a harmful update.All 12 delayed beneficial proposals per controller survive the sharper bound, including when first-use cost is charged; under the invalid sign flip, the sharper rule admits more harmful updates.Source: Figure S28 · p. 72, §3 · p. 72

Related papers

Loading 2609.19090v1…