alphaFeedback

WorksPhysics and Astronomy

Leveraging verifiable structure in quantum circuits to find more efficient compilations with agentic AI

AI contributions
Not recorded for this paper
View details

Abstract

We discuss an effective paradigm of utilizing AI agents to better compile quantum circuits when one can constrain bottleneck subroutines to have some form of classically verifiable structure. For example, when critical subroutines are composed exclusively of reversible classical logic, phasing operations, and measurement based uncomputation, one can efficiently simulate execution for classical inputs. This property facilitates efficient certification of approximate circuit synthesis via a form of fuzz testing, provided suitable assumptions on the input distribution. While this pattern was recently exploited to improve quantum cryptanalysis circuits, here we highlight the flexibility of the broader approach by discussing three important applications. (1) The computation of 1/x1/\sqrt{x} that bottlenecks real space simulations of the Coulomb operator such as those important for modeling inertial confinement fusion reactors. (2) The decoding of Reed-Solomon codes which bottlenecks the decoded quantum interferometry algorithm when used to approximately solve the optimal polynomial intersection problem. And (3) the quantum look-up tables and controlled application of Givens rotations that bottleneck the most performant quantum algorithms for simulating chemistry in second quantization. We discuss reference implementations of these algorithms and how they can be constrained and verified in the interest of seeding a Kaggle competition designed to accelerate AI-based research into the optimization of their compilation.

Introduction

Compiling a fault-tolerant quantum algorithm into a concrete circuit requires navigating a large design space of arithmetic decompositions, ancilla-management schedules, and precision trade-offs. Until recently, researchers explored this space by hand, often spending months optimizing a single subroutine and proving its correctness step by step. Automated circuit optimizers [1, 2, 3] help locally, but they preserve exact unitaries on small subcircuits rather than changing the algorithm or its approximations. AI coding agents [4] can automate this search if a fast test harness checks each candidate circuit and scores its resource cost in a closed loop. For general quantum circuits, checking whether a candidate circuit matches a target unitary is QMA-complete [5] and intractable on a classical computer above roughly 40 qubits. Fortunately, in many fault-tolerant quantum algorithms, the subroutines that dominate the cost do not use arbitrary quantum interference internally [6, 7, 8, 9, 10, 11, 12]. Instead, they use only reversible classical gates, diagonal phase gates, and measurement-based uncomputation. This structure lets a classical simulator efficiently check their approximate correctness on sampled computational basis inputs.

Ref. [13] used this method in March 2026 to estimate the cost of breaking 256-bit elliptic curve cryptography on the secp256k1 curve with Shor’s algorithm. To follow responsible disclosure, the authors withheld the explicit circuits. Instead, they released an open-source simulator and test harness with a zero-knowledge proof that their hidden circuit passed the randomized tests. Soon after Ref. [13] appeared, the ecdsa.fail challenge took their simulator and test harness and built a public competition for secp256k1 point addition circuits. The harness checked the approximate correctness of each submission in seconds and ranked it by its qubit and Toffoli counts. This fast verification let the organizers accept submissions without trusting the participants. Over 100 participants, most without a quantum computing background, used AI coding agents to further reduce the Toffoli counts by roughly half [14].

In this paper, we apply this workflow to three benchmarks beyond cryptanalysis and use them to seed a Kaggle competition. We make three main contributions:

  1. We release kickmix, an open-source C++20 and Python package in Qualtran [15] that builds and simulates circuits with over 10810^{8} gates on one CPU core.

  1. We describe a non-interactive verifier that seeds its test inputs with a salted hash of the submitted circuit. We also bound the distance between the implemented and ideal output states by the circuit’s failure rate on those inputs.

  1. We define three benchmarks and provide a reference implementation for each of them:

  • Phasing by 1/x1/\sqrt{x} for first-quantized simulations of Coulomb interactions, such as inertial confinement fusion [9].

  • Reed-Solomon syndrome decoding for decoded quantum interferometry (DQI) on the optimal polynomial intersection problem [12, 16].

  • Quantum lookup tables and Majorana rotations for block encodings of electronic-structure Hamiltonians [11].

Because classical fuzz testing applies only to kickmix circuits, we restrict each benchmark to the kickmix subroutine that dominates the algorithm’s cost. When that subroutine interacts with non-kickmix parts such as arbitrary state preparation, as in Benchmark III, we price those parts with analytical cost formulas. This pricing ensures that the benchmark score still reflects the full algorithm.

Section II defines the kickmix gate set, describes the kickmix software package, and derives the state-distance bound from fuzz testing. Section III describes the background, reference circuit, test distribution, and score for each benchmark. Section IV discusses how circuit testing might change as AI agents improve. The appendices derive the DFTHC block-encoding circuits and the polynomial approximations in the 1/x1/\sqrt{x} baseline.

Kickmix circuits and fuzz testing via Fiat-Shamir heuristic

Optimizing quantum circuits with AI agents requires a fast, reliable way to check whether a candidate circuit works. For general quantum circuits, classical simulation takes exponential time, and deciding whether two circuits implement the same operation is coNP-complete classically and QMA-complete quantumly [5]. Ref. [13] introduced a restricted family of quantum circuits, called kickmix circuits, built exclusively from reversible classical gates, diagonal phase operations, and measurement-based uncomputation. Because every instruction in this family maps any computational basis state to a single computational basis state up to a scalar phase, a classical simulator can run a kickmix circuit on computational basis inputs in time linear in gate count.

Although full quantum algorithms rely on quantum interference across superpositions, many of the subroutines that dominate fault-tolerant resource estimates (such as integer arithmetic, quantum lookup tables, and syndrome decoders) can be written as kickmix circuits [9, 12, 13, 17]. This structure suggests checking candidate compilations by testing them on randomly sampled classical inputs. However, doing so requires care: one must check in each problem context that approximate correctness on sampled basis states guarantees high fidelity on the quantum states used by the algorithm. When this holds, combining classical trajectory simulation with the Fiat-Shamir heuristic [13, 18] turns random-input fuzz testing into a public, non-interactive verification protocol that requires no secret test set. To run this verification loop on subroutines exceeding 10810^8 gates, we release kickmix as an open-source C++20 and Python package inside Qualtran [15]. On a single CPU core, kickmix builds circuits at 2×1072 \times10^7 instructions/s and simulates them at 6.0×10106.0 \times10^{10} instructions/s, constructing an 86M-gate Decoded Quantum Interferometry circuit in less than 5 seconds and checking 102,400 syndrome-decoder shots in 150 seconds.

The kickmix gate set

When a kickmix circuit runs on an nn-qubit computational basis input ∣x⟩|x\rangle, no instruction creates a superposition over multiple computational basis states. A classical simulator therefore needs to store only one bit per qubit wire, one bit per classical register wire, and one scalar output phase. Specifically, every instruction in the kickmix gate set falls into one of four classes:

  1. Reversible classical gates (X, CX, CCX, and SWAP): Permute computational basis states by updating the stored qubit bits directly.

  2. Diagonal phase gates (Z, CZ, CCZ, Z_POW, and NEG): Leave the qubit bits unchanged and update the tracked output phase whenever all control qubits hold ∣1⟩|1\rangle.

  3. Measurement and reset gates (HMR and R): Measure a qubit in the X basis into a classical bit and reset it to ∣0⟩|0\rangle (HMR), or reset a qubit directly to ∣0⟩|0\rangle (R).

  4. Classical bit operations (BIT_STORE0, BIT_STORE1, and BIT_INVERT): Set classical register bits to 0 or 1, or invert them in place.

Every instruction above can be controlled per gate (if b) or across blocks via a condition stack (PUSH_CONDITION and POP_CONDITION), running only when all active classical conditions hold 11.

The HMR instruction (pronounced “hammer”) applies a Hadamard gate, measures the target qubit qtq_t in the ZZ basis, and resets qtq_t to ∣0⟩\lvert0\rangle. When qtq_t holds a function f(x)f(x) of the remaining qubits, this XX-basis measurement yields a random outcome b∈{0,1}b \in\{0,1\} and introduces a phase kickback

∣x⟩∣f(x)⟩→HMR(−1)b⋅f(x)∣x⟩∣0⟩.(1)\lvert x\rangle\lvert f(x)\rangle\xrightarrow{\mathrm{HMR}} (-1)^{b\cdot f(x)}\lvert x\rangle\lvert0\rangle. \tag*{(1)}

When b=1b=1, classically controlled diagonal gates (such as Z, CZ, CCZ, or NEG) can fix the phase error (−1)f(x)(-1)^{f(x)} introduced by the XX-basis measurement. For example, uncomputing a temporary logical-AND wire ∣x1∧x2⟩\lvert x_1 \land x_2\rangle requires only one HMR instruction followed by a classically controlled CZ gate when b=1b=1, saving a Toffoli gate [17].

However, HMR only works when the resulting phase error can be corrected cheaply. If a circuit applies HMR to a junk qubit that remains entangled with the system without fixing its phase kickback, classical trajectory simulation fails loudly. The simulator samples a uniformly random bit b∈{0,1}b \in\{0,1\}, flips the tracked output phase if qt⋅b=1q_t \cdot b=1, and resets qtq_t to ∣0⟩\lvert0\rangle. Without a matching phase fixup, that random sign flip causes the check on sampled inputs to fail with probability 1/21/2 whenever qt=1q_t=1. The reset instruction R is intended only for deallocating qubits already uncomputed to ∣0⟩\lvert0\rangle. If qt=1q_t=1, the simulator applies a random sign flip, preventing circuits from silently discarding uncleaned junk qubits.

The kickmix software package in Qualtran

The kickmix library is implemented in C++20 with Python bindings inside Qualtran [15]. Inspired by the bit-packed stabilizer engine of Stim [19], kickmix is built around two design principles that let humans and AI agents iterate on 10810^8-gate circuits in seconds.

First, performance drives every layer of circuit construction, serialization, and simulation. Standard Python circuit libraries allocate a separate heap object for every gate and simulate one input at a time, which becomes prohibitively slow at 10810^8 gates. Instead, kickmix stores a circuit using a struct-of-arrays representation grouped by operand count: one byte array of opcodes (OpType) alongside separate arrays for 1-, 2-, and 3-qubit arguments, classical target and condition bits, and rotation angles. Each 1-byte opcode embeds bit flags indicating which operand arrays it consumes, letting the simulator step sequential pointers through only the active arrays without padding every gate to the worst-case size. Saving and loading a circuit in binary .km format transfers each array between memory and disk as a contiguous binary block, avoiding per-gate text formatting and parsing. During simulation, kickmix bit-packs 64 to 512 independent trajectories across CPU SIMD registers so each instruction updates an entire batch of shots in parallel. The one exception is Z_POW: because each trajectory maintains its own 128-bit fixed-precision phase accumulator rather than a single sign bit, a Z_POW instruction cannot update the whole batch with a single bitwise SIMD operation. Instead, it scans the active shot mask across all trajectories in the batch and adds the rotation angle to each active shot sequentially.

Second, expressiveness guides the Python builder API so complex end-to-end algorithms remain compact and readable. To eliminate the repetitive boilerplate that arises when writing multi-stage fault-tolerant algorithms with measurement-based uncomputation, kickmix provides four abstractions:

  1. Automatic downgrading: Operations accept qubits, classical bits, and compile-time constants interchangeably, automatically replacing classically controlled gates with lower-cost instructions, dropping no-ops on False controls, and supporting block-scoped classical conditions.

  1. NumPy-style broadcasting: Most primitive gates, measurements, and classical bit operations accept both single wires and register arrays (km.array), broadcasting scalars against registers or operating elementwise across registers, so a single builder call replaces an explicit loop over individual qubits.

  1. Dynamic workspace allocation: The builder provides methods to allocate and free temporary quantum and classical registers within a configurable qubit budget. Subroutines can use these methods to request and release scratch space locally, and freed qubits are handed back out to later allocations.

  1. Library of common subroutines: The builder provides a library of commonly used fault-tolerant subroutines, including temporary-AND gates, QROM table lookups, adders, comparators, finite-field arithmetic, and context-managed unary iteration, with paired compute and measurement-based uncompute variants.

kickmix also includes inspection utilities that generate circuit diagrams and interactive SVG flame charts showing where Toffoli gates and qubits are spent across nested subroutines.

Fuzz testing via the Fiat-Shamir heuristic

To verify a candidate kickmix circuit, we simulate it on computational basis inputs using km.Simulator and compare the resulting bitstrings and phases against a classical reference. When the input domain is small, we can test every basis state exhaustively to certify exact correctness on all inputs. When the input domain is too large to enumerate, fuzz testing on a random sample of inputs instead certifies approximate correctness by bounding the probability ε\varepsilon that the circuit fails on a random input. Because verification reduces to bounding this failure rate ε\varepsilon, the same procedure naturally accommodates approximations in circuit compilations that are correct on almost all inputs, such as dropping low-weight carry bits, truncating intermediate registers, or bounding iteration counts to save Toffolis [7, 13].

A bound on the per-input failure rate ε\varepsilon also bounds the error of the circuit on coherent superpositions of inputs. Fix the outcome string r∈{0,1}mr \in\{0,1\}^{m} of the mm HMR and R instructions in a kickmix circuit. The circuit then maps each computational basis state to one computational basis state times a phase, and we call this linear map VrV_r. Each HMR or R instruction with outcome bb acts as (∣0⟩⟨0∣+(−1)b∣0⟩⟨1∣)/2(|0\rangle\langle0|+(-1)^b|0\rangle\langle1|)/\sqrt{2}, so the Kraus operators of the circuit are 2−m/2Vr2^{-m/2}V_r. On a basis input, every record rr therefore has probability 2−m2^{-m}, which matches the uniform sampling of the simulator. If we defer every measurement by copying its outcome into a fresh record qubit, the circuit acts on an input ∣ψ⟩=∑xαx∣x⟩|\psi\rangle=\sum_x\alpha_x|x\rangle as the isometry

W∣ψ⟩=2−m/2∑rVr∣ψ⟩⊗∣r⟩.(2)W|\psi\rangle=2^{-m/2}\sum_r V_r|\psi\rangle\otimes|r\rangle. \tag*{(2)}

The ideal circuit applies the target unitary UU and leaves the record in the state ∣+⟩⊗m|+\rangle^{\otimes m}. Let Br={x:Vr∣x⟩≠U∣x⟩}B_r=\{x:V_r|x\rangle\ne U|x\rangle\} be the failing inputs for record rr, and let εr=∑x∈Br∣αx∣2\varepsilon_r=\sum_{x\in B_r}|\alpha_x|^2. Then ε=Er[εr]\varepsilon=\mathbb{E}_r[\varepsilon_r] is the probability that a test shot fails when x∼∣αx∣2x\sim|\alpha_x|^2 and rr is uniform. For example, suppose that an input fails only because an R or uncorrected HMR gate acts on a qubit in ∣1⟩|1\rangle. This input fails when b=1b=1 and is exact when b=0b=0. It adds half its weight to ε\varepsilon, and it adds no error to the branches with b=0b=0.

We assume that each VrV_r maps distinct inputs in the support of ∣ψ⟩|\psi\rangle to distinct outputs. This condition holds when each HMR and R gate acts on a qubit that is a function of the other qubits, as in measurement-based uncomputation. Each VrV_r then preserves norms on the support of ∣ψ⟩|\psi\rangle and agrees with UU outside BrB_r. The triangle inequality gives ∥(Vr−U)∑x∈Brαx∣x⟩∥≤2εr\|(V_r-U)\sum_{x\in B_r}\alpha_x|x\rangle\|\le2\sqrt{\varepsilon_r} for every rr. The record states are orthonormal, so the errors of the branches add in quadrature:

∥W∣ψ⟩−U∣ψ⟩⊗∣+⟩⊗m∥2=Er[∥(Vr−U)∑x∈Brαx∣x⟩∥2]≤4ε.(3)\|W|\psi\rangle-U|\psi\rangle\otimes|+\rangle^{\otimes m}\|^2=\mathbb{E}_r\left[\left\|(V_r-U)\sum_{x\in B_r}\alpha_x|x\rangle\right\|^2\right]\le4\varepsilon. \tag*{(3)}

Two unit vectors at Euclidean distance dd have an overlap of at least 1−d2/21-d^2/2. Hence the purified output has fidelity at least (1−2ε)2(1-2\varepsilon)^2 with U∣ψ⟩⊗∣+⟩⊗mU|\psi\rangle\otimes|+\rangle^{\otimes m}. Discarding the record cannot decrease this fidelity. The physical output state is therefore within trace distance 1−(1−2ε)2≤2ε\sqrt{1-(1-2\varepsilon)^2}\le2\sqrt{\varepsilon} of U∣ψ⟩U|\psi\rangle. This trace distance also bounds the total-variation distance for any later measurement. This guarantee requires the verifier to sample test inputs from ∣αx∣2|\alpha_x|^2, so each benchmark in Section III specifies this distribution.1

To prevent a submission from hard-coding outputs on a fixed test set, our verifier generates challenge inputs via the Fiat-Shamir heuristic [13, 18]. Given a serialized circuit file CC, the verifier hashes the raw bytes of CC with SHA-256 and uses that 256-bit digest to seed a deterministic pseudorandom generator. Changing even a single byte of CC yields a completely new SHA-256 digest and a fresh set of NN challenge inputs. In a competition setting, we also combine the circuit’s SHA-256 digest with a private salt to derive the generator seed so that participants cannot perform seed grinding by repeatedly adding no-op instructions to search for a seed that generates easier test inputs. This construction makes verification non-interactive, deterministic, and reproducible once the salt is published, without maintaining large secret test sets.

On each shot i∈{1,…,N}i\in\{1,\ldots,N\}, the verifier initializes the input registers to a sampled computational basis state, runs the circuit, and checks three conditions:

  1. Input and output registers hold their expected classical bitstrings.

  1. Every scratch qubit returns cleanly to ∣0⟩|0\rangle.

  1. The accumulated output phase matches the target phase within the benchmark tolerance.

If a shot violates any of these conditions, the verifier records a failure. Suppose a circuit fails on kk out of NN independent shots, giving an empirical failure rate ε^=k/N\hat{\varepsilon}=k/N. If the circuit’s true failure rate ε\varepsilon actually exceeded some threshold ε+>ε^\varepsilon^{+}>\hat{\varepsilon}, the probability of observing kk or fewer failures across NN shots by chance would be at most

Pr⁡(at most k failures in N shots∣ε≥ε+)≤∑j=0k(Nj)(ε+)j(1−ε+)N−j.(4)\Pr(\text{at most } k \text{ failures in } N \text{ shots} \mid\varepsilon\geq\varepsilon^{+}) \leq\sum_{j=0}^{k} \binom{N}{j}(\varepsilon^{+})^{j}(1-\varepsilon^{+})^{N-j}. \tag*{(4)}

Setting the right-hand side of Eq. (4) equal to a target false-pass probability δ=2−128\delta=2^{-128} defines the one-sided Clopper–Pearson upper confidence bound ε+\varepsilon^{+} on the true failure rate ε\varepsilon at confidence level 1−2−1281-2^{-128}. In particular, when a circuit passes all NN shots (k=0k=0), only the j=0j=0 term survives, giving (1−ε+)N=δ(1-\varepsilon^{+})^{N}=\delta and ε+≈ln⁡(1/δ)/N≈88.7/N\varepsilon^{+}\approx\ln(1/\delta)/N\approx88.7/N. For example, if a circuit passes N=10,240N=10{,}240 shots with zero failures, the chance that it fails on more than ε+=1%\varepsilon^{+}=1\% of inputs is at most 0.9910240<2−1280.99^{10240}<2^{-128}, and passing N=102,400N=102{,}400 shots certifies ε+<0.1%\varepsilon^{+}<0.1\% at the same 1−2−1281-2^{-128} confidence level. Depending on the benchmark, the verifier either requires k=0k=0 across all NN shots or allows k≥0k\geq0 failures and uses the certified upper bound ε+\varepsilon^{+} to compute the repetition overhead in the benchmark score.2

Kaggle competition

We are launching a public competition on Kaggle, an online platform for machine learning and algorithmic challenges, featuring three benchmarks from fusion simulation, decoded quantum interferometry, and quantum chemistry. Each benchmark isolates the kickmix subroutine that dominates the fault-tolerant cost of the full algorithm at a fixed problem size. In our own runs with AI coding agents, we have found significant improvements over the previously published baselines, and we expect further improvements remain to be discovered. For each benchmark, we commit to our best internal run via its SHA-256 hash2 and will release our full solutions at the end of the competition. With a $150,000 prize pool, we welcome anyone interested in AI-driven optimization, regardless of quantum computing background, to try new ideas and push these benchmarks further. Below, we motivate each problem, describe the baseline circuit from prior work, and specify the verification contract and score.

Benchmark I: Inverse square roots for Coulomb simulations with relevance to fusion reactor design

Problem introduction and importance

Quantum simulation of matter is one of the primary applications for quantum computers. This simulation capability is even more important where experimental verification is challenging. One such example we recently explored was the calculation of stopping power relevant to warm-dense-matter simulation [9]. The calculation of a stopping power is critical to the understanding and design of inertial confinement fusion devices. The stopping power calculation itself is representative of a broader class of dynamical simulations containing core quantum circuit primitives. Thus our focus here is on one of the highest cost algorithmic building blocks. The primitive we focus on in this section is the primary bottleneck for the Trotterized time-evolution for a system represented in a first-quantized representation [9] and involves the coherent calculation of the inverse distance between two particles.

Our goal will be to implement the dynamics of η\eta-electrons represented on a grid interacting under the Hamiltonian

H=T+U+V(5)H = T + U + V \tag*{(5)}

References

  1. [1]A. Kissinger and J. van de Wetering, Reducing the number of non-Clifford gates in quantum circuits, Phys. Rev. A 102, 022406 (2020).DOI
  2. [2]M. Xu, Z. Li, O. Padon, S. Lin, J. Pointing, A. Hirth, H. Ma, J. Palsberg, A. Aiken, U. A. Acar, and Z. Jia, Quartz: superoptimization of quantum circuits, in Proceedings of the 43rd ACM SIGPLAN International Conference on Programming Language Design and Implementation (ACM, 2022) pp. 625–640.DOI
  3. [3]F. J. R. Ruiz, T. Laakkonen, J. Bausch, M. Balog, M. Barekatain, F. J. H. Heras, A. Novikov, N. Fitzpatrick, B. Romera-Paredes, J. van de Wetering, A. Fawzi, K. Meichanetzidis, and P. Kohli, Quantum circuit optimization with AlphaTensor, Nature Machine Intelligence 7, 374 (2025).arxiv.org/abs/2402.14396
  4. [4]A. Novikov, N. Vũ, M. Eisenberger, E. Dupont, P.-S. Huang, A. Z. Wagner, S. Shirobokov, B. Kozlovskii, F. J. R. Ruiz, A. Mehrabian, M. P. Kumar, A. See, S. Chaudhuri, G. Holland, A. Davies, S. Nowozin, P. Kohli, and M. Balog, AlphaEvolve: A coding agent for scientific and algorithmic discovery (2025), arXiv:2506.13131 [cs.AI].arXiv
  5. [5]D. Janzing, P. Wocjan, and T. Beth, “non-identity-check” is QMA-complete, International Journal of Quantum Information 03, 463 (2005).DOI
  6. [6]R. Babbush, C. Gidney, D. Berry, N. Wiebe, J. McClean, A. Paler, A. Fowler, and H. Neven, Encoding Electronic Spectra in Quantum Circuits with Linear T Complexity, Physical Review X 8, 041015 (2018).DOI
  7. [7]C. Gidney and M. Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, Quantum 5, 433 (2021).DOI
  8. [8]J. Lee, D. W. Berry, C. Gidney, W. J. Huggins, J. R. McClean, N. Wiebe, and R. Babbush, Even More Efficient Quantum Computations of Chemistry Through Tensor Hypercontraction, PRX Quantum 2, 030305 (2021).DOI
  9. [9]N. C. Rubin, D. W. Berry, A. Kononov, F. D. Malone, T. Khattar, A. White, J. Lee, H. Neven, R. Babbush, and A. D. Baczewski, Quantum computation of stopping power for inertial fusion target design, Proceedings of the National Academy of Sciences 121, e2317772121 (2024).DOI
  10. [10]C. Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits (2025).arxiv.org/abs/2505.15917
  11. [11]G. H. Low, R. King, D. W. Berry, Q. Han, A. E. DePrince, III, A. F. White, R. Babbush, R. D. Somma, and N. C. Rubin, Fast quantum simulation of electronic structure by spectrum amplification, Phys. Rev. X 15, 041016 (2025).DOI
  12. [12]T. Khattar, N. Shutty, C. Gidney, A. Zalcman, N. Yosri, D. Maslov, R. Babbush, and S. P. Jordan, Verifiable quantum advantage via optimized DQI circuits (2025), arXiv:2510.10967 [quant-ph].arXiv
  13. [13]Babbush, R., Zalcman, A., Gidney, C., Moodbrown, T., Khattar, T., Neven, H., Bergamaschi, T., Drake, J., & Boneh, D. (2026). Securing elliptic curve cryptocurrencies against quantum vulnerabilities: Resource estimates and mitigations.
  14. [14]Long, J., Pender, T., Huang, Z., Santos, M. B., Singh, S. K., Naskrečki, B., BitWonka, Dallaire-Demers, P.-L., Giannicola, F., P. M. L. Pasquarelli, O., Freuler, J. C.-H., Lee, J. V., Gnuchy, G., Kannappan, G. K., Boyer, X., Butler, K., Balasubramani, A., Newman, J., Dereje, B., … Drake, J. (2026). Efficient record-and-replay arithmetic for quantum elliptic-curve point addition.
  15. [15]M. P. Harrigan, T. Khattar, C. Yuan, A. Peduri, N. Yosri, F. D. Malone, R. Babbush, and N. C. Rubin, Expressing and analyzing quantum algorithms with Qualtran (2024), arXiv:2409.04643 [quant-ph].arXiv
  16. [16]S. P. Jordan, N. Shutty, M. Wootters, A. Zalcman, A. Schmidhuber, R. King, S. V. Isakov, T. Khattar, and R. Babbush, Optimization by decoded quantum interferometry, Nature 646, 831 (2025), arXiv:2408.08292 [quant-ph].DOI
  17. [17]C. Gidney, Halving the cost of quantum addition, Quantum 2, 74 (2018).DOI
  18. [18]Fiat, A., & Shamir, A. (1987). How to prove yourself: Practical solutions to identification and signature problems. In Advances in Cryptology — CRYPTO ’86 (pp. 186–194).
  19. [19]C. Gidney, Stim: a fast stabilizer circuit simulator, Quantum 5, 497 (2021).DOI
  20. [20]N. C. Jones, J. D. Whitfield, P. L. McMahon, M.-H. Yung, R. Van Meter, A. Aspuru-Guzik, and Y. Yamamoto, Faster quantum chemistry simulation on fault-tolerant quantum computers, New Journal of Physics 14, 115023 (2012).DOI
  21. [21]T. Häner, M. Roetteler, and K. M. Svore, Optimizing Quantum Circuits for Arithmetic, arXiv:1805.12445 (2018).arXiv
  22. [22]Software, . id . (2005). Quake III Arena source code: q_math.c.
  23. [23]Y. Su, D. Berry, N. Wiebe, N. Rubin, and R. Babbush, Fault-tolerant quantum simulations of chemistry in first quantization, PRX Quantum 2, 040332 (2021).DOI
  24. [24]Kliuchnikov, V., Lauter, K., Minko, R., Paetznick, A., & Petit, C. (2023). Shorter quantum circuits via single-qubit gate approximation. In Quantum (Vol. 7, p. 1208). arXiv:2303.10064
  25. [25]V. Guruswami and M. Sudan, List decoding algorithms for certain concatenated codes, in Proceedings of the Thirty-Second Annual ACM Symposium on Theory of Computing, STOC ’00 (Association for Computing Machinery, New York, NY, USA, 2000) pp. 181–190.DOI
  26. [26]M. Naor and B. Pinkas, Oblivious transfer and polynomial evaluation, in Proceedings of the Thirty-First Annual ACM Symposium on Theory of Computing (ACM, 1999) pp. 245–254.DOI
  27. [27]D. Bleichenbacher and P. Q. Nguyen, Noisy polynomial interpolation and noisy Chinese remaindering, in Advances in Cryptology — EUROCRYPT 2000, Lecture Notes in Computer Science, Vol. 1807 (Springer, 2000) pp. 53–69.DOI
  28. [28]J. Proos and C. Zalka, Shor’s discrete logarithm quantum algorithm for elliptic curves (2004), arXiv:quant-ph/0301141 [quant-ph].DOI
  29. [29]Zhou, H., Duckering, C., Zhao, C., Bluvstein, D., Cain, M., Kubica, A., Wang, S.-T., & Lukin, M. D. (n.d.). Resource analysis of.
  30. [30]Cain, M., Xu, Q., King, R., Picard, L. R. B., Levine, H., Endres, M., Preskill, J., Huang, H.-Y., & Bluvstein, D. (2026). Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits.
  31. [31]L. de Moura, S. Kong, J. Avigad, F. van Doorn, and J. von Raumer, The Lean theorem prover (system description), in Automated Deduction - CADE-25 (Springer International Publishing, 2015) pp. 378–388.DOI
  32. [32]A. Gu, A. H. Kemeny, S. F. Yelin, and M. D. Lukin, Discovering state-of-the-art quantum circuits with large language models (2026), arXiv:2610.22367 [quant-ph].arXiv
  33. [33]Babbush, R. (2026). Accelerating the field of quantum algorithms with AI.

Paper details

vlnc:W_c92w3zey
v1 · latestHistory (1)

published · Fresh — added to the Hub within the last 30 days

added ·

Usage

views · 5

downloads · 0

A view counts once per browser per day, a download each time the PDF is requested.

CC BY 4.0

Original source

  • Physics and Astronomy

Not recorded for this paper · View statement →

Looking for related papers…
Contents