Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2504.19651

Fooling the Decoder: An Adversarial Attack on Quantum Error Correction

Jerome Lenssen, Alexandru Paler

Published Apr 28, 2025• 0 citations
arXivHTMLPDF

Abstract

Neural network decoders are essential for fault-tolerant quantum computation, yet their internal mechanisms remain poorly understood. Leading machine learning decoders use recurrent and transformer models (e.g., AlphaQubit), and reinforcement learning (RL) is increasingly used to train such models. In this work we ask whether an RL surface code decoder, DeepQ, can be made to fail systematically. Our white-box search repeatedly draws candidate syndrome volumes from the unmodified noise model and retains the one the decoder's learned $Q$-function is most pessimistic about. At code distance 5 under phenomenological depolarising noise, it cuts the average logical qubit lifetime from roughly $10^5$ cycles to 60. We quantify what this costs: the retained error histories are individually plausible, but the selected trajectory is roughly a $10^{-18}$ tail event under undisturbed noise, so the effect is bought entirely by the ability to select among physically realisable error configurations. Controls confirm this is not an artefact of a weak target: the decoder resists noise fluctuations, tolerates an MWPM referee, and is fault tolerant at checkable distances. The result is a robustness upper bound for one decoder under one noise model, but to our knowledge the first adversarial attack of a machine learning QEC decoder.

DOI
10.48550/arxiv.2504.19651

Related papers

Evaluating Learned Decoders under Compound Noise Models in Surface Codes

Ali Syed, Tanaka Hiroshi, Khan Muhammad

The practical realization of fault-tolerant quantum computing critically hinges on the capacity of quantum error correction (QEC) schemes to robustly mitigate physical noise. Among the foremost candidates, the surface code is distinguished by its high threshold and local stabilizer checks. In recent years, neural network-based decoders, particularly those leveraging deep reinforcement learning (RL) and convolutional architectures, have demonstrated competitive performance against algorithmic staples such as Minimum Weight Perfect Matching (MWPM) and Union-Find. However, the vast majority of these learned decoders are trained and evaluated under idealized phenomenological or circuit-level depolarizing noise models. Real-world quantum processors exhibit complex, compound noise profiles encompassing crosstalk, leakage, non-Markovian temporal drift, and spatially correlated errors. In this work, we empirically evaluate the robustness of state-of-the-art neural decoders against highly structured compound noise models. We introduce a comprehensive stress-testing methodology tailored to quantify the degradation of the logical error rate when decoders are subjected to out-of-distribution noise characteristics. Our empirical results reveal that while neural decoders can overfit to their training noise profile, strategically designed training curricula and architecture regularizations enable significant resilience. We provide extensive numerical benchmarks validating that learned decoders can maintain near-optimal pseudothresholds across a broad spectrum of shifting noise conditions, highlighting their readiness for real-world superconducting qubit deployments.

•Jul 21, 2026•0 citations

Evaluating Learned Decoders under Compound Noise Models in Surface Codes

Hiroshi Tanaka, Syed Ali, Muhammad Salik Ali Khan

The practical realization of fault-tolerant quantum computing critically hinges on the capacity of quantum error correction (QEC) schemes to robustly mitigate physical noise. Among the foremost candidates, the surface code is distinguished by its high threshold and local stabilizer checks. In recent years, neural network-based decoders, particularly those leveraging deep reinforcement learning (RL) and convolutional architectures, have demonstrated competitive performance against algorithmic staples such as Minimum Weight Perfect Matching (MWPM) and Union-Find. However, the vast majority of these learned decoders are trained and evaluated under idealized phenomenological or circuit-level depolarizing noise models. Real-world quantum processors exhibit complex, compound noise profiles encompassing crosstalk, leakage, non-Markovian temporal drift, and spatially correlated errors. In this work, we empirically evaluate the robustness of state-of-the-art neural decoders against highly structured compound noise models. We introduce a comprehensive stress-testing methodology tailored to quantify the degradation of the logical error rate when decoders are subjected to out-of-distribution noise characteristics. Our empirical results reveal that while neural decoders can overfit to their training noise profile, strategically designed training curricula and architecture regularizations enable significant resilience. We provide extensive numerical benchmarks validating that learned decoders can maintain near-optimal pseudothresholds across a broad spectrum of shifting noise conditions, highlighting their readiness for real-world superconducting qubit deployments.

•Jul 21, 2026•0 citations

Reinforcement learning decoders for fault-tolerant quantum computation

Ryan Sweke, Markus S Kesselring, Evert van Nieuwenburg +1 more

Abstract Topological error correcting codes, and particularly the surface code, currently provide the most feasible road-map towards large-scale fault-tolerant quantum computation. As such, obtaining fast and flexible decoding algorithms for these codes, within the experimentally realistic and challenging context of faulty syndrome measurements, without requiring any final read-out of the physical qubits, is of critical importance. In this work, we show that the problem of decoding such codes can be naturally reformulated as a process of repeated interactions between a decoding agent and a code environment, to which the machinery of reinforcement learning can be applied to obtain decoding agents. While in principle this framework can be instantiated with environments modelling circuit level noise, we take a first step towards this goal by using deepQ learning to obtain decoding agents for a variety of simplified phenomenological noise models, which yield faulty syndrome measurements without including the propagation of errors which arise in full circuit level noise models.

arXiv:1810.07207•Machine Learning Science and Technology•Oct 29, 2020•92 citations

Power Side-Channel Attacks on Machine-Learning-based Quantum Error Correction Decoders

Anthony Etim, Jakub M. Szefer

Machine learning (ML) decoders are increasingly used in quantum error correction (QEC) to model noise, analyze imperfect syndrome measurements, and replace iterative matching algorithms with a learned inference pass, making them a critical component of the classical control stack of a fault-tolerant quantum computer. Prior security analysis of the ML decoders in the controller stack has addressed integrity and fault-injection attacks on the decoders. This work is the first to explore physical power side-channel attacks on ML decoders. In particular, it studies a convolutional Deep Q-Learning decoder for the distance-5 surface code. This work profiles the decoder to capture the power signatures generated during classification tasks and trains a classifier to identify which qubit the decoder identified as having errors based on the power signatures. The trained classifier is then applied to test data, where it recovers the correct data qubit label from the decoder’s side-channel data with up to \(83.2\%\) accuracy across 25 classes, against \(4\%\) for random guessing. A second classifier is trained to identify the type of error labeled by the decoder, Pauli X or Z, and reaches \(84.6\%\) accuracy, against \(50\%\) for random guessing. This work further performs an initial study of a timing channel, which complements the power side channels, exploring how the duration of the decoder’s first convolutional layer can leak the code size for which the decoder is compiled. All the side-channel attacks demonstrated in this work motivate treating the embedded QEC decoder as a confidentiality-critical component of the quantum control stack.

Hardware and Architectural Support for Security and Privacy•Oct 28, 2026•0 citations

Adaptive Quantum Error Correction for Surface Codes Using Deep Reinforcement Learning

Oluwasesan Adeleke, Ajmery Sultana

Quantum error correction (QEC) is indispensable for the realization of fault-tolerant quantum computers. Surface codes are a leading QEC architecture due to their high error thresholds and planar design. The core challenge lies in the decoding process: inferring latent physical errors from syndrome measurements and applying appropriate corrections. Although there are classical decoders, their performance can degrade with complex noise or be computationally demanding. This paper investigates an advanced Deep Reinforcement Learning (DRL) approach, employing a Dueling Double Deep Q-Network (DQN), to decode X-type Pauli errors on a$\mathbf{d}=\mathbf{3}$rotated surface code. The DRL agent leverages syndrome history to discern temporal error correlations and utilizes a multi-round correction strategy, enabling iterative refinement of corrective actions within an environment that simulates both physical qubit errors and syndrome measurement noise. After 30,000 training episodes with a 5 % physical error rate and 1 % measurement noise, the agent achieved a 0.00 % logical error rate in the extended test, an average episode reward of 0.38, and successfully cleared syndromes in 63 % of the test cases, demonstrating robust learning of a safe decoding policy. The persistent challenge of high training loss, despite good policy performance, is discussed, offering insights into value function approximation in complex QEC environments.

IEEE International Conference on Quantum Photonics, Artificial Intelligence & Networking (QPAIN)•Apr 16, 2026•0 citations

Machine Learning Optimal Quantum Error Correction Thresholds

Dominik Seip, Luis Colmenarez, Markus Schmitt +1 more

As quantum computers remain susceptible to noise, QEC is essential for preserving logical information during computations. However, the performance of QEC codes breaks down beyond certain noise thresholds, revealing fundamental limits on their ability to protect quantum information. These limits can be characterized using information-theoretic measures such as the coherent information, which quantifies the maximum rate at which logical information can be reliably transmitted through a noisy quantum channel. In this work, we establish a direct connection between the CI and the binary cross-entropy loss used when training neural network decoders. Specifically, we show that the CI constitutes a sharp lower bound on the achievable loss for decoders that track logical operators across noisy channels. To this end, we develop a transformer-based neural network model based on maximum likelihood decoding. We train this network to estimate the CI and evaluate its performance on the surface code under three noise models: code capacity, phenomenological, and circuit-level noise. Our results demonstrate that the network accurately predicts CI and yields threshold estimates that closely match known theoretical limits. When used as a decoder, the network significantly outperforms the minimum weight perfect matching decoder in terms of logical error rate. We also introduce a novel soft post-selection scheme that independently treats uncertainty in both logical operators and relies on confidence-based filtering of the network's output. We prove that such post-selection strategies, based on the MLD cosets, are optimal, and demonstrate their scalability in terms of both logical error rate and abort probability. These findings establish transformer-based architectures as powerful tools for QEC and provide the first numerical evidence supporting the optimality and scalability of MLD-based post-selection.

quant-pharXiv:2606.22194•Jun 23, 2026•0 citations
Neural network decoders are essential for fault-tolerant quantum computation, yet their internal mechanisms remain poorly understood. Leading machine learning decoders use recurrent and transformer models (e.g., AlphaQubit), and reinforcement learning (RL) is increasingly used to train such models. In this work we ask whether an RL surface code decoder, DeepQ, can be made to fail systematically. Our white-box search repeatedly draws candidate syndrome volumes from the unmodified noise model and retains the one the decoder's learned QQQ-function is most pessimistic about. At code distance 5 under phenomenological depolarising noise, it cuts the average logical qubit lifetime from roughly 10510^5105 cycles to 60. We quantify what this costs: the retained error histories are individually plausible, but the selected trajectory is roughly a 10−1810^{-18}10−18 tail event under undisturbed noise, so the effect is bought entirely by the ability to select among physically realisable error configurations. Controls confirm this is not an artefact of a weak target: the decoder resists noise fluctuations, tolerates an MWPM referee, and is fault tolerant at checkable distances. The result is a robustness upper bound for one decoder under one noise model, but to our knowledge the first adversarial attack of a machine learning QEC decoder.
The practical realization of fault-tolerant quantum computing critically hinges on the capacity of quantum error correction (QEC) schemes to robustly mitigate physical noise. Among the foremost candidates, the surface code is distinguished by its high threshold and local stabilizer checks. In recent years, neural network-based decoders, particularly those leveraging deep reinforcement learning (RL) and convolutional architectures, have demonstrated competitive performance against algorithmic staples such as Minimum Weight Perfect Matching (MWPM) and Union-Find. However, the vast majority of these learned decoders are trained and evaluated under idealized phenomenological or circuit-level depolarizing noise models. Real-world quantum processors exhibit complex, compound noise profiles encompassing crosstalk, leakage, non-Markovian temporal drift, and spatially correlated errors. In this work, we empirically evaluate the robustness of state-of-the-art neural decoders against highly structured compound noise models. We introduce a comprehensive stress-testing methodology tailored to quantify the degradation of the logical error rate when decoders are subjected to out-of-distribution noise characteristics. Our empirical results reveal that while neural decoders can overfit to their training noise profile, strategically designed training curricula and architecture regularizations enable significant resilience. We provide extensive numerical benchmarks validating that learned decoders can maintain near-optimal pseudothresholds across a broad spectrum of shifting noise conditions, highlighting their readiness for real-world superconducting qubit deployments.
The practical realization of fault-tolerant quantum computing critically hinges on the capacity of quantum error correction (QEC) schemes to robustly mitigate physical noise. Among the foremost candidates, the surface code is distinguished by its high threshold and local stabilizer checks. In recent years, neural network-based decoders, particularly those leveraging deep reinforcement learning (RL) and convolutional architectures, have demonstrated competitive performance against algorithmic staples such as Minimum Weight Perfect Matching (MWPM) and Union-Find. However, the vast majority of these learned decoders are trained and evaluated under idealized phenomenological or circuit-level depolarizing noise models. Real-world quantum processors exhibit complex, compound noise profiles encompassing crosstalk, leakage, non-Markovian temporal drift, and spatially correlated errors. In this work, we empirically evaluate the robustness of state-of-the-art neural decoders against highly structured compound noise models. We introduce a comprehensive stress-testing methodology tailored to quantify the degradation of the logical error rate when decoders are subjected to out-of-distribution noise characteristics. Our empirical results reveal that while neural decoders can overfit to their training noise profile, strategically designed training curricula and architecture regularizations enable significant resilience. We provide extensive numerical benchmarks validating that learned decoders can maintain near-optimal pseudothresholds across a broad spectrum of shifting noise conditions, highlighting their readiness for real-world superconducting qubit deployments.
Abstract Topological error correcting codes, and particularly the surface code, currently provide the most feasible road-map towards large-scale fault-tolerant quantum computation. As such, obtaining fast and flexible decoding algorithms for these codes, within the experimentally realistic and challenging context of faulty syndrome measurements, without requiring any final read-out of the physical qubits, is of critical importance. In this work, we show that the problem of decoding such codes can be naturally reformulated as a process of repeated interactions between a decoding agent and a code environment, to which the machinery of reinforcement learning can be applied to obtain decoding agents. While in principle this framework can be instantiated with environments modelling circuit level noise, we take a first step towards this goal by using deepQ learning to obtain decoding agents for a variety of simplified phenomenological noise models, which yield faulty syndrome measurements without including the propagation of errors which arise in full circuit level noise models.
Machine learning (ML) decoders are increasingly used in quantum error correction (QEC) to model noise, analyze imperfect syndrome measurements, and replace iterative matching algorithms with a learned inference pass, making them a critical component of the classical control stack of a fault-tolerant quantum computer. Prior security analysis of the ML decoders in the controller stack has addressed integrity and fault-injection attacks on the decoders. This work is the first to explore physical power side-channel attacks on ML decoders. In particular, it studies a convolutional Deep Q-Learning decoder for the distance-5 surface code. This work profiles the decoder to capture the power signatures generated during classification tasks and trains a classifier to identify which qubit the decoder identified as having errors based on the power signatures. The trained classifier is then applied to test data, where it recovers the correct data qubit label from the decoder’s side-channel data with up to 83.2%83.2\%83.2% accuracy across 25 classes, against 4%4\%4% for random guessing. A second classifier is trained to identify the type of error labeled by the decoder, Pauli X or Z, and reaches 84.6%84.6\%84.6% accuracy, against 50%50\%50% for random guessing. This work further performs an initial study of a timing channel, which complements the power side channels, exploring how the duration of the decoder’s first convolutional layer can leak the code size for which the decoder is compiled. All the side-channel attacks demonstrated in this work motivate treating the embedded QEC decoder as a confidentiality-critical component of the quantum control stack.
Quantum error correction (QEC) is indispensable for the realization of fault-tolerant quantum computers. Surface codes are a leading QEC architecture due to their high error thresholds and planar design. The core challenge lies in the decoding process: inferring latent physical errors from syndrome measurements and applying appropriate corrections. Although there are classical decoders, their performance can degrade with complex noise or be computationally demanding. This paper investigates an advanced Deep Reinforcement Learning (DRL) approach, employing a Dueling Double Deep Q-Network (DQN), to decode X-type Pauli errors on ad=3\mathbf{d}=\mathbf{3}d=3rotated surface code. The DRL agent leverages syndrome history to discern temporal error correlations and utilizes a multi-round correction strategy, enabling iterative refinement of corrective actions within an environment that simulates both physical qubit errors and syndrome measurement noise. After 30,000 training episodes with a 5 % physical error rate and 1 % measurement noise, the agent achieved a 0.00 % logical error rate in the extended test, an average episode reward of 0.38, and successfully cleared syndromes in 63 % of the test cases, demonstrating robust learning of a safe decoding policy. The persistent challenge of high training loss, despite good policy performance, is discussed, offering insights into value function approximation in complex QEC environments.
As quantum computers remain susceptible to noise, QEC is essential for preserving logical information during computations. However, the performance of QEC codes breaks down beyond certain noise thresholds, revealing fundamental limits on their ability to protect quantum information. These limits can be characterized using information-theoretic measures such as the coherent information, which quantifies the maximum rate at which logical information can be reliably transmitted through a noisy quantum channel. In this work, we establish a direct connection between the CI and the binary cross-entropy loss used when training neural network decoders. Specifically, we show that the CI constitutes a sharp lower bound on the achievable loss for decoders that track logical operators across noisy channels. To this end, we develop a transformer-based neural network model based on maximum likelihood decoding. We train this network to estimate the CI and evaluate its performance on the surface code under three noise models: code capacity, phenomenological, and circuit-level noise. Our results demonstrate that the network accurately predicts CI and yields threshold estimates that closely match known theoretical limits. When used as a decoder, the network significantly outperforms the minimum weight perfect matching decoder in terms of logical error rate. We also introduce a novel soft post-selection scheme that independently treats uncertainty in both logical operators and relies on confidence-based filtering of the network's output. We prove that such post-selection strategies, based on the MLD cosets, are optimal, and demonstrate their scalability in terms of both logical error rate and abort probability. These findings establish transformer-based architectures as powerful tools for QEC and provide the first numerical evidence supporting the optimality and scalability of MLD-based post-selection.