Can an attacker turn influence over an artificial intelligence (AI) adviser into a harmful quantum error-correction update? We identify an ambiguity in passive syndrome records that obstructs recovery selection, then show how additional calibration measurements support certified recovery updates under uncertainty and drift. In an odd-distance square toric code with error-free preparation, syndrome measurements, and recovery operations, opposite coherent $X$ rotations produce identical passive syndrome-history distributions. Yet a fixed phase correction can help at one sign and harm at the other. A terminal logical measurement on known encoded calibration states supplies the missing sign information. A separate evaluator accepts an update only when calibration uncertainty and a justified drift bound certify improvement over the current recovery, without assuming that the adviser recommends correctly. In simulated advice attacks, calibration-confidence checks reject harmful proposals while retaining beneficial updates under honest advice. We derive sufficient limits on calibration age that require improvement through deployment. In matched simulations, a validated channel-specific bound retains more beneficial updates than the general bound after accounting for evaluation time, while preventing the tested harmful activations under the stated drift assumption. A separate surface-code experiment includes stochastic circuit faults and noise changing during acquisition. Deterministic controllers achieve at least as many beneficial updates with the same observations. Violating the drift assumption permits harmful acceptance in the toric experiment. The results identify information required for recovery selection, establish conditional guarantees against harmful updates, and quantify the recovery improvements forgone through conservative acceptance.
Comments
74 pages, 32 figures (10-page main text, 62 pages of Supplemental Material, and 2 pages of references)
Can an attacker turn influence over an artificial intelligence (AI) adviser into a harmful quantum error-correction update? We identify an ambiguity in passive syndrome records that obstructs recovery selection, then show how additional calibration measurements support certified recovery updates under uncertainty and drift. In an odd-distance square toric code with error-free preparation, syndrome measurements, and recovery operations, opposite coherent X rotations produce identical passive syndrome-history distributions. Yet a fixed phase correction can help at one sign and harm at the other. A terminal logical measurement on known encoded calibration states supplies the missing sign information. A separate evaluator accepts an update only when calibration uncertainty and a justified drift bound certify improvement over the current recovery, without assuming that the adviser recommends correctly. In simulated advice attacks, calibration-confidence checks reject harmful proposals while retaining beneficial updates under honest advice. We derive sufficient limits on calibration age that require improvement through deployment. In matched simulations, a validated channel-specific bound retains more beneficial updates than the general bound after accounting for evaluation time, while preventing the tested harmful activations under the stated drift assumption. A separate surface-code experiment includes stochastic circuit faults and noise changing during acquisition. Deterministic controllers achieve at least as many beneficial updates with the same observations. Violating the drift assumption permits harmful acceptance in the toric experiment. The results identify information required for recovery selection, establish conditional guarantees against harmful updates, and quantify the recovery improvements forgone through conservative acceptance.
What must a quantum error-correction decoder know about temporally correlated noise, and what does it cost to learn? We study this question for fixed stabilizer memory experiments with known system-environment interactions. We formulate calibration in terms of the fidelity differences that select a Pauli recovery and relate missing information to the resulting fidelity loss. Our main example uses weak coherent X rotations in a class of CSS codes including Shor, Steane, and odd-distance rotated surface codes. All physical qubits share a sign either fixed throughout a run or independently redrawn each interval. The two models have identical syndrome statistics and the same spatiotemporal Pauli process (SPP), obtained by Pauli-twirling every noise interval. Yet at suitable storage times, they require different logical corrections. In the weak-noise limit, each model is almost perfectly correctable when known. Without model information, even the best final recovery has a worst-case fidelity loss approaching 1/2 relative to the noise-aware optimum, despite access to the full syndrome record. For this pair of models, at fixed code and fixed positive target loss below 1/2, we prove matching calibration bounds. With logical preparation and final readout, complete QEC cycles require a number of noise intervals scaling as the inverse rotation angle raised to the code's X distance. Allowing two uninterrupted intervals before one extraction reduces the optimal cost to inverse-square scaling. Physical Pauli twirling of every noise interval changes both recovery performance and its information requirements. Discarding the record of applied random Pauli operations makes the SPP sufficient for optimal recovery. Keeping this record can improve the attainable fidelity, but reaching that optimum may require additional noise information.
Quantum error-correcting decoders provide both corrections and confidence estimates for the logical-error risk of individual measurement records. Such confidence can guide postselection, but it depends on the accuracy of the decoder noise model. When the physical device drifts away from that model, confidence measures such as the logical gap can become miscalibrated. We show that this mismatch can itself provide useful information. On IBM quantum hardware, syndrome statistics drift across consecutive acquisition windows, and the resulting detector histories differ substantially from those predicted by the stationary detector error model used for decoding. We observe a similar hardware-model mismatch in independent Google surface-code memory data. We exploit this effect by assigning additional rejection weight to detector histories that are unlikely under the assumed model. For minimum-weight perfect matching (MWPM), the minimum weight W provides an inexpensive proxy for syndrome surprisal. On held-out IBM repetition-code memories, likelihood-aware postselection reduces the retained logical-error probability (LEP) by 10.6% at d=7 and 28.8% at d=9, both at 15% rejection. On Google ten-round d=5 XZZX surface-code memory data, it reduces retained LEP by 75.4% at 90% rejection. Applied to Google's magic-state cultivation experiment with the Tesseract decoder, it reduces tomography infidelity by 34.7% with 30% additional grafting-stage rejection, or increases accepted yield by 30.4% at a target fidelity of 97.0%. Burst-noise simulations show that the advantage persists as code distance and syndrome-extraction volume increase. The method reuses quantities already produced during logical-gap decoding and requires only an additional fitting step.
Quantum error correction protects logical information only when every physical operation remains below the fault-tolerance threshold, a condition that must be maintained continuously rather than only at the initial calibration. In practice, however, analog control parameters inevitably drift because of environmental fluctuations. As future fault-tolerant quantum computations are expected to run for days or even months, interrupting computation for repeated recalibration becomes fundamentally impractical. A promising alternative is to integrate calibration directly into computation by repurposing syndrome measurements as a calibration signal (Sivak et al, Nature 2026), but whether such self-calibration can be achieved with provable efficiency remains an open question. Here we establish a theoretical framework for such self-calibrating quantum fault tolerance. We prove that, for a broad class of control-induced errors, the detection rate defines a locally strongly convex surrogate objective for analog calibration with high probability. This geometric property enables a simple and efficient online optimization algorithm using only syndrome measurements collected during normal error correction. We prove convergence to an ε detection rate within O(1/ε2) epochs for time-independent drifts and also establish guarantees for time-dependent drifts. We further show that the convergence rate is independent of the code distance for quantum low-density parity-check (LDPC) codes. Pulse-level simulations of neutral-atom arrays and large-scale circuit-level Clifford simulations confirm these theoretical predictions. Our results establish self-calibrating fault tolerance as a provably efficient paradigm in which the same syndrome measurements simultaneously protect logical information and stabilize the underlying hardware.
This preliminary research preprint presents a reproducible numerical study of history-conditioned quantum error correction under temporally correlated noise. We consider a three-qubit phase-error code subject to a synthetic Pauli noise model with a persistent hidden noise regime. A noisy classical monitor and the accumulated syndrome/measurement history are used to estimate that regime through standard Bayesian hidden-Markov filtering, and recovery operations are selected by a causal maximum-a-posteriori rule. The central question is whether accessible temporal information can extend the finite interval over which encoded quantum information remains reliable. In 100,000 matched synthetic trajectories, survival through 20 correction rounds increases from 0.74406 for a snapshot MAP decoder to 0.91455 for the history-conditioned decoder. Under a 90% no-logical-fault survival criterion, the empirical computational-memory window increases from 6 to 25 rounds, with a simultaneous 95% lower confidence band supporting 23 rounds for the history-conditioned policy. Control experiments show that the advantage disappears when temporal predictability is removed: when the hidden regime becomes independent from round to round, the history-conditioned and snapshot policies coincide. Additional monitor and model ablations demonstrate that the benefit depends on correction-relevant temporal correlations, informative side information, and adequate calibration. The work also formulates finite-horizon survival criteria and sufficient error-budget bounds without assuming independent logical faults, while explicitly separating classical filter stability from preservation of quantum information. This study does not claim a new Bayesian filtering method, superiority over existing temporal quantum-error-correction decoders, a scalable fault-tolerance threshold, or demonstrated room-temperature quantum-computing hardware. Rather, it provides a concrete operational specialization of the broader TrinityLabo history-first framework and a small, reproducible benchmark showing how temporal inference can condition quantum recovery under specified noise assumptions. Ambient-temperature operation remains a future experimental application requiring calibrated device-level noise models, fault-prone syndrome extraction, hardware latency analysis, and comparison against established temporal decoders.
The performance of a given quantum error correction (QEC) code depends upon the noise model that is assumed. Independent Pauli noise, applied after each quantum operation, is a simplistic noise model that is easy to simulate and understand in the context of stabilizer codes. Although such a noise model is artificial, it is equivalent to independent, random, unbiased qubit rotations. What about spatially or temporally correlated qubit rotations? Such a noise model is applicable to global operations (e.g., NMR or ESR), common control sources (e.g., lasers), or slow drift (e.g., charge or magnetic noise) in various qubit technologies. In the worst case, such errors can combine constructively and result in a post-correction failure rate that increases with the number of error correction cycles. However, we show that this worst case does not generally arise unless taking active corrective actions while performing QEC. That is, by employing virtual Pauli frame updates ("passive" error correction) rather than physical corrections ("active" error correction), coherent errors do not compound appreciably. Starting in a random Pauli frame is also advantageous. In fact, through perturbation theory arguments and supporting numerical simulations, we show that the logical qubit performance beyond distance 3 for correlated single-qubit Hamiltonian noise models (i.e., global errant qubit rotations), when employing these "lazy" strategies, essentially matches the performance of Pauli noise model with the same process fidelity (fidelity after one application). In a more general circuit model of noise, correlations may add constructively within syndrome extraction rounds but Pauli frame randomization from passive error correction mitigates this effect across multiple rounds.
Quantum error correction (QEC) protects quantum computations by repeatedly measuring stabilizer syndromes and using a classical decoder to infer corrections. Modern surface-code decoders are increasingly calibration-aware: they use recent device behavior to set priors such as matching-graph edge probabilities, and these priors directly shape the selected correction. We identify the prior-update path as an overlooked integrity-critical attack surface: a poisoned prior can change decoding decisions even when the syndrome stream, logical labels, and decoder implementation are unchanged. This makes prior poisoning different from ordinary syndrome anomalies and difficult for raw syndrome-anomaly tests to detect. We introduce PriorGuard, a lightweight semantic guard that checks proposed prior changes on high-influence detector-graph entries against private syndrome-derived evidence, accepts updates only when their log-odds movement is evidence-supported, and otherwise falls back to the last evidence-supported prior. We evaluate on Stim-generated rotated surface-code memory circuits decoded with PyMatching. Prior influence is highly concentrated, with the top 10 percent of entries carrying over 60 percent of positive logical-error influence; poisoning only 6.4 percent of decoder-prior entries can raise logical error rate (LER) by 3.35x. PriorGuard recovers most attack-induced loss with a low false-positive rate and modest update-boundary overhead of about 1.7--1.8 ms and less than 0.31 MB auxiliary memory per update.