Setting and result
The rotated surface code decoded by minimum-weight perfect matching is a standard model of a fault-tolerant quantum memory. Under circuit-level noise, simulations place its threshold near 0.5–1% [9 , 2 ] , and for the circuit considered here the logical failure curves cross near 5 × 10 − 3 5\times10^{-3} 5 × 1 0 − 3 (Remark 11.6 ). But rigorous thresholds are much smaller. The path argument of Dennis, Kitaev, Landahl and Preskill [1 ] gives 1.7 × 10 − 4 1.7\times10^{-4} 1.7 × 1 0 − 4 , and Fowler’s refinement [3 ] reaches 7.4 × 10 − 4 7.4\times10^{-4} 7.4 × 1 0 − 4 , each for its own circuit and noise model. For the standard syndrome-extraction circuit we prove 1.04 × 10 − 3 1.04\times10^{-3} 1.04 × 1 0 − 3 in closed form and 2 × 10 − 3 2\times10^{-3} 2 × 1 0 − 3 with a computer-verified certificate, by a local criterion for weighted non-backtracking walks and by the minimality of the correction along the failure path. All theorems are also proved in the proof assistant Lean 4, with all computations checked by its kernel (§ 10 ).
Code and circuit
Fix an odd distance d ≥ 3 d\geq3 d ≥ 3 . The data qubits sit at the points of
D = { ( x , y ) : x , y ∈ { 1 , 3 , … , 2 d − 1 } } . \mathcal{D}=\{(x,y):x,y\in\{1,3,\ldots,2d-1\}\}. D = {( x , y ) : x , y ∈ { 1 , 3 , … , 2 d − 1 }} .
2020 Mathematics Subject Classification. 81P73; 94B35, 05C38, 68V05.
Key words and phrases. Quantum error correction, surface code, fault tolerance, threshold, minimum-weight perfect matching, circuit-level noise, computer-assisted proof. A point m = ( x , y ) m=(x,y) m = ( x , y ) with x , y ∈ { 0 , 2 , … , 2 d } x,y\in\{0,2,\ldots,2d\} x , y ∈ { 0 , 2 , … , 2 d } has the diagonal neighbourhood N ( m ) = { m + ( ± 1 , ± 1 ) } ∩ D N(m)=\{m+(\pm1,\pm1)\}\cap D N ( m ) = { m + ( ± 1 , ± 1 )} ∩ D . It has X X X type if x / 2 + y / 2 x/2+y/2 x /2 + y /2 is odd and Z Z Z type otherwise. The measure qubits are the points m m m with ∣ N ( m ) ∣ ≥ 2 \lvert N(m)\rvert\ge2 ∣ N ( m )∣ ≥ 2 , excluding X-type points with x ∈ { 0 , 2 d } x\in\{0,2d\} x ∈ { 0 , 2 d } and Z-type points with y ∈ { 0 , 2 d } y\in\{0,2d\} y ∈ { 0 , 2 d } . There are d 2 − 1 d^2-1 d 2 − 1 of them. An X-type (Z-type) measure qubit m m m measures the stabilizer ∏ q ∈ N ( m ) X q \prod_{q\in N(m)}X_q ∏ q ∈ N ( m ) X q (∏ q ∈ N ( m ) Z q \prod_{q\in N(m)}Z_q ∏ q ∈ N ( m ) Z q ). Write
δ X = ( ( 1 , 1 ) , ( − 1 , 1 ) , ( 1 , − 1 ) , ( − 1 , − 1 ) ) , δ Z = ( ( 1 , 1 ) , ( 1 , − 1 ) , ( − 1 , 1 ) , ( − 1 , − 1 ) ) . \delta^X=((1,1),(-1,1),(1,-1),(-1,-1)),\qquad\delta^Z=((1,1),(1,-1),(-1,1),(-1,-1)). δ X = (( 1 , 1 ) , ( − 1 , 1 ) , ( 1 , − 1 ) , ( − 1 , − 1 )) , δ Z = (( 1 , 1 ) , ( 1 , − 1 ) , ( − 1 , 1 ) , ( − 1 , − 1 )) .
One round of syndrome extraction consists of eight steps.
(S1) Reset every measure qubit to ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ .
(S2) Apply H H H to every X-type measure qubit.
(S3–S6) In step 2 + k 2+k 2 + k , k = 1 , … , 4 k=1,\ldots,4 k = 1 , … , 4 , apply CX ( m → m + δ k X ) \operatorname{CX}(m\mathbin{\to}m+\delta^X_k) CX ( m → m + δ k X ) for each X-type m m m with m + δ k X ∈ D m+\delta^X_k\in D m + δ k X ∈ D , and CX ( m + δ k Z → m ) \operatorname{CX}(m+\delta^Z_k\mathbin{\to}m) CX ( m + δ k Z → m ) for each Z-type m m m with m + δ k Z ∈ D m+\delta^Z_k\in D m + δ k Z ∈ D .
(S7) Apply H H H to every X-type measure qubit.
(S8) Measure every measure qubit in the Z Z Z basis.
Each qubit takes part in at most one operation per step. The layout and the four CX layers coincide with those of the circuits surface_code:rotated_memory_x/z generated by Stim [4 ] . The orders δ X \delta^X δ X and δ Z \delta^Z δ Z are the standard ones that orient hook errors perpendicular to the logical operator they could shorten [5 , 2 ] .
In the memory experiment in basis Z Z Z , every data qubit is prepared in ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ in step (S1) of round 0. Rounds 0 , … , T − 1 0,\ldots,T-1 0 , … , T − 1 follow, for some T ≥ 1 T\ge1 T ≥ 1 , and then all data qubits are measured in the Z Z Z basis. Let s m , r s_{m,r} s m , r be the outcome of m m m in round r r r and f q f_q f q the final outcome of q q q . For every Z-type m m m the detectors are
D m , 0 = s m , 0 , D m , r = s m , r ⊕ s m , r − 1 ( 1 ≤ r ≤ T − 1 ) , D m , T = s m , T − 1 ⊕ ⨁ q ∈ N ( m ) f q . D_{m,0}=s_{m,0},\qquad D_{m,r}=s_{m,r}\oplus s_{m,r-1}\ (1\le r\le T-1),\qquad D_{m,T}=s_{m,T-1}\oplus\bigoplus_{q\in N(m)}f_q. D m , 0 = s m , 0 , D m , r = s m , r ⊕ s m , r − 1 ( 1 ≤ r ≤ T − 1 ) , D m , T = s m , T − 1 ⊕ q ∈ N ( m ) ⨁ f q .
We call r r r the layer of D m , r D_{m,r} D m , r . The logical outcome is ⨁ q ∈ D , y ( q ) = 1 f q \bigoplus_{q\in D,\ y(q)=1}f_q ⨁ q ∈ D , y ( q ) = 1 f q , the value of Z L Z_L Z L on the bottom row. The experiment in basis X X X is the same with ∣ + ⟩ \lvert+\rangle ∣ + ⟩ , X-basis final measurements, X-type detectors and X L X_L X L on the left column x ( q ) = 1 x(q)=1 x ( q ) = 1 . Without noise all detectors and the logical outcome equal 0 (Table 3 , V1).
Table 3. Computer verification for Theorem 1.1 . Lemma 2.3(c) needs only d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 .
Noise
A location is one of the following. Each location fails independently with probability p p p .
A reset or preparation. A failed reset to ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ (preparation of ∣ + ⟩ \lvert+\rangle ∣ + ⟩ ) is followed by X X X (by Z Z Z ).
A measurement. A failed measurement reports the flipped outcome.
An H H H gate, or a qubit that is idle during a step. Failure is followed by X X X , Y Y Y or Z Z Z , each with probability 1 / 3 1/3 1/3 .
A CX gate. Failure is followed by one of the 15 non-identity two-qubit Paulis, each with probability 1 / 15 1/15 1/15 .
A qubit is idle in a step if no reset, gate or measurement acts on it. Thus data qubits are idle in steps (S1) (except in round 0), (S2), (S7), (S8) and in each of (S3)–(S6) in which they have no CX partner. Z-type measure qubits are idle in (S2) and (S7) and in the CX steps without a partner, while X-type measure qubits are idle in the CX steps without a partner. A fault outcome is a location together with the Pauli or flip that follows its failure. Its probability is p π ( f ) p\,\pi(f) p π ( f ) with π ( f ) ∈ { 1 , 1 3 , 1 15 } \pi(f)\in\{1,\frac{1}{3},\frac{1}{15}\} π ( f ) ∈ { 1 , 3 1 , 15 1 } .
Decoding graph and decoder
We describe basis Z Z Z . Basis X X X is the same with the roles of the two types exchanged. Let V V V be the set of detectors D m , r D_{m,r} D m , r . The signature σ ( f ) ⊆ V \sigma(f)\subseteq V σ ( f ) ⊆ V of a fault outcome f f f is the set of detectors that change when f f f is the only failure, and ℓ ( f ) ∈ { 0 , 1 } \ell(f)\in\{0,1\} ℓ ( f ) ∈ { 0 , 1 } records whether the logical outcome changes. By Lemma 2.1 , ∣ σ ( f ) ∣ ≤ 2 \lvert\sigma(f)\rvert\le2 ∣ σ ( f )∣ ≤ 2 , and ℓ ( f ) \ell(f) ℓ ( f ) depends only on σ ( f ) \sigma(f) σ ( f ) . The decoding graph G G G has vertex set V ∪ { b 1 , b 2 } V \cup\{b_1,b_2\} V ∪ { b 1 , b 2 } and one edge e ( f ) e(f) e ( f ) for each nonempty signature: e ( f ) = σ ( f ) e(f)=\sigma(f) e ( f ) = σ ( f ) if ∣ σ ( f ) ∣ = 2 |\sigma(f)|=2 ∣ σ ( f ) ∣ = 2 , and e ( f ) = { u , b 1 } e(f)=\{u,b_1\} e ( f ) = { u , b 1 } or { u , b 2 } \{u,b_2\} { u , b 2 } if σ ( f ) = { u } \sigma(f)=\{u\} σ ( f ) = { u } and ℓ ( f ) = 1 \ell(f)=1 ℓ ( f ) = 1 or ℓ ( f ) = 0 \ell(f)=0 ℓ ( f ) = 0 , respectively. For an edge e e e put
c e = ∑ f : e ( f ) = e π ( f ) , q e = c e p . c_e=\sum_{f:e(f)=e}\pi(f),\qquad q_e=c_ep. c e = f : e ( f ) = e ∑ π ( f ) , q e = c e p .
The weights are w e = log ( ( 1 − r e ) / r e ) w_e=\log((1-r_e)/r_e) w e = log (( 1 − r e ) / r e ) for numbers r e r_e r e with q e ( 1 − q e ) ≤ r e ≤ q e q_e(1-q_e)\le r_e\le q_e q e ( 1 − q e ) ≤ r e ≤ q e . Two choices are common: r e = q e r_e=q_e r e = q e , and r e r_e r e equal to the probability that an odd number of outcomes with e ( f ) = e e(f)=e e ( f ) = e occur. The second lies in this range by the Bonferroni inequality. For a location ℓ \ell ℓ let c ℓ , e c_{\ell,e} c ℓ , e be the sum of π ( f ) \pi(f) π ( f ) over the outcomes f f f of ℓ \ell ℓ with e ( f ) = e e(f)=e e ( f ) = e . We call the multiset of the nonzero numbers c ℓ , e c_{\ell,e} c ℓ , e , over all locations ℓ \ell ℓ , the profile of e e e . Because the outcomes of a location exclude each other, the second choice equals ( 1 − ∏ ℓ ( 1 − 2 c ℓ , e p ) ) / 2 (1-\prod_\ell(1-2c_{\ell,e}p))/2 ( 1 − ∏ ℓ ( 1 − 2 c ℓ , e p )) /2 . Thus both choices depend only on p p p and on the profile of e e e . We call weights as above profile weights if r e = ψ ( p , profile of e ) r_e=\psi(p,\text{profile of }e) r e = ψ ( p , profile of e ) for one function ψ \psi ψ . For p ≤ 2 × 10 − 3 p\le2\times10^{-3} p ≤ 2 × 1 0 − 3 each q e q_e q e is at most 154 15 ⋅ 2 × 10 − 3 < 0.021 \frac{154}{15}\cdot2\times10^{-3}<0.021 15 154 ⋅ 2 × 1 0 − 3 < 0.021 (Lemma 2.1 ), so all weights are positive.
For a set C C C of edges let ∂ C ⊆ V \partial C\subseteq V ∂ C ⊆ V be the set of detectors of odd degree in C C C . Given the set A ⊆ V A\subseteq V A ⊆ V of detectors that equal 1, the decoder returns a set C C C of minimum weight with ∂ C = A \partial C=A ∂ C = A , and it predicts that the logical outcome was flipped if and only if ∣ C ∩ δ ( b 1 ) ∣ |C\cap\delta(b_1)| ∣ C ∩ δ ( b 1 ) ∣ is odd, where δ ( b 1 ) \delta(b_1) δ ( b 1 ) is the set of edges at b 1 b_1 b 1 . A minimum-weight perfect matching of A A A , with boundary copies and shortest-path distances, yields such a set as the symmetric difference of its paths. We prove the results below for every minimizer C C C . The decoder fails if its prediction differs from the actual flip of the logical outcome.
Result
Theorem 1.1. Let d ≥ 3 d\ge3 d ≥ 3 be odd, T ≥ 1 T\ge1 T ≥ 1 , B ∈ { X , Z } B\in\{X,Z\} B ∈ { X , Z } and 0 < p ≤ p ∗ = 1.04 × 10 − 3 0<p\le p_* = 1.04\times10^{-3} 0 < p ≤ p ∗ = 1.04 × 1 0 − 3 . Put λ = 31 p \lambda=31\sqrt{p} λ = 31 p . The memory experiment in basis B B B with T T T rounds, decoded as in § 1.3 , fails with probability
P f a i l ≤ ( T + 1 ) ( d + 1 ) 2 ⋅ 2 c max p 1 − c max p ⋅ λ d − 1 1 − λ ≤ 0.104 ( T + 1 ) ( d + 1 ) λ d 1 − λ , c max = 154 15 . P_{\mathrm{fail}}\le\frac{(T+1)(d+1)}{2}\cdot2\sqrt{\frac{c_{\max}p}{1-c_{\max}p}}\cdot\frac{\lambda^{d-1}}{1-\lambda}\le0.104(T+1)(d+1)\frac{\lambda^d}{1-\lambda},\qquad c_{\max}=\frac{154}{15}. P fail ≤ 2 ( T + 1 ) ( d + 1 ) ⋅ 2 1 − c m a x p c m a x p ⋅ 1 − λ λ d − 1 ≤ 0.104 ( T + 1 ) ( d + 1 ) 1 − λ λ d , c m a x = 15 154 . We call P f a i l / T P_{\mathrm{fail}}/T P fail / T the logical error rate per round of the memory experiment in basis B B B . Since T + 1 ≤ 2 T T+1\le2T T + 1 ≤ 2 T , it obeys P f a i l / T ≤ 0.208 ( d + 1 ) λ d / ( 1 − λ ) P_{\mathrm{fail}}/T\le0.208(d+1)\lambda^d/(1-\lambda) P fail / T ≤ 0.208 ( d + 1 ) λ d / ( 1 − λ ) uniformly in T T T . For p ≤ p ∗ p\le p_* p ≤ p ∗ we have λ ≤ 0.99972 \lambda\le0.99972 λ ≤ 0.99972 , so this decays exponentially in d d d . For example, at p = 10 − 3 p=10^{-3} p = 1 0 − 3 , where λ = 0.98031 \lambda=0.98031 λ = 0.98031 , the bound reads P f a i l / T ≤ 10.6 ( d + 1 ) λ d P_{\mathrm{fail}}/T\le10.6(d+1)\lambda^d P fail / T ≤ 10.6 ( d + 1 ) λ d , and at p = 10 − 4 p=10^{-4} p = 1 0 − 4 it reads 0.31 ( d + 1 ) ( 0.31 ) d 0.31(d+1)(0.31)^d 0.31 ( d + 1 ) ( 0.31 ) d . The bound on P f a i l / T P_{\mathrm{fail}}/T P fail / T is below 1 for all d ≥ 3 d\ge3 d ≥ 3 when p ≤ 5 × 10 − 4 p\le5\times10^{-4} p ≤ 5 × 1 0 − 4 , for d ≥ 423 d\ge423 d ≥ 423 when p = 10 − 3 p=10^{-3} p = 1 0 − 3 , but only for d ≥ 63063 d\ge63063 d ≥ 63063 when p = p ∗ p=p_* p = p ∗ .
Theorem 1.2. In the setting of Theorem 1.1 :
(a) if 0 < p ≤ 1.6 × 10 − 3 0<p\le1.6\times10^{-3} 0 < p ≤ 1.6 × 1 0 − 3 and λ = 0.997 ( p / ( 1.6 × 10 − 3 ) ) 21 / 50 \lambda=0.997\left(p/(1.6\times10^{-3})\right)^{21/50} λ = 0.997 ( p / ( 1.6 × 1 0 − 3 ) ) 21/50 , then
P f a i l ≤ 0.032 ( T + 1 ) ( d + 1 ) λ d 1 − λ . P_{\mathrm{fail}}\le0.032(T+1)(d+1)\frac{\lambda^d}{1-\lambda}. P fail ≤ 0.032 ( T + 1 ) ( d + 1 ) 1 − λ λ d . (b) if the weights are profile weights , 0 < p ≤ p ∗ ∗ = 2 × 10 − 3 0<p\le p_{**}=2\times10^{-3} 0 < p ≤ p ∗∗ = 2 × 1 0 − 3 and λ = 0.999 ( p / p ∗ ∗ ) 9 / 25 \lambda=0.999\left(p/p_{**}\right)^{9/25} λ = 0.999 ( p / p ∗∗ ) 9/25 , then
P f a i l ≤ 0.061 ( T + 1 ) ( d + 1 ) λ d 1 − λ . P_{\mathrm{fail}}\le0.061(T+1)(d+1)\frac{\lambda^d}{1-\lambda}. P fail ≤ 0.061 ( T + 1 ) ( d + 1 ) 1 − λ λ d . Part (b) implies P f a i l / T ≤ 0.122 ( d + 1 ) λ d / ( 1 − λ ) P_{\mathrm{fail}}/T\le0.122(d+1)\lambda^d/(1-\lambda) P fail / T ≤ 0.122 ( d + 1 ) λ d / ( 1 − λ ) , and λ < 0.999 \lambda<0.999 λ < 0.999 for p ≤ p ∗ ∗ p\le p_{**} p ≤ p ∗∗ . At p = 10 − 3 p=10^{-3} p = 1 0 − 3 we have λ < 0.7784 \lambda<0.7784 λ < 0.7784 , and the bound on P f a i l / T P_{\mathrm{fail}}/T P fail / T is at most 0.551 ( d + 1 ) ( 0.7784 ) d 0.551(d+1)(0.7784)^d 0.551 ( d + 1 ) ( 0.7784 ) d , which is below 1 for all d ≥ 5 d\ge5 d ≥ 5 and below 10 − 6 10^{-6} 1 0 − 6 for d ≥ 71 d\ge71 d ≥ 71 . Part (a), at p = 10 − 3 p=10^{-3} p = 1 0 − 3 , gives λ < 0.8185 \lambda<0.8185 λ < 0.8185 and
P f a i l / T ≤ 0.353 ( d + 1 ) ( 0.8185 ) d P_{\mathrm{fail}}/T \le0.353\,(d+1)\,(0.8185)^d P fail / T ≤ 0.353 ( d + 1 ) ( 0.8185 ) d . But for p < 1.92 × 10 − 4 p < 1.92 \times10^{-4} p < 1.92 × 1 0 − 4 the rate 31 p 31\sqrt{p} 31 p of Theorem 1.1 is smaller than that of part (b).
The circuit of § 1.1 has eight steps per round. A common leaner schedule measures and resets the measure qubits in a single step and prepares and measures the X-type ones in the X X X basis directly (§ 7 ). It has fewer idle steps, and the same two arguments yield larger thresholds.
Theorem 1.3. For the lean schedule of Section 7, with the noise model, memory experiments and decoder of Sections 1.2 and 1.3, let d ≥ 3 d \ge3 d ≥ 3 be odd, T ≥ 1 T \ge1 T ≥ 1 and B ∈ { X , Z } B \in\{X,Z\} B ∈ { X , Z } .
(a) If 0 < p ≤ 1.53 × 10 − 3 0 < p \le1.53 \times10^{-3} 0 < p ≤ 1.53 × 1 0 − 3 and λ = 25.55 p \lambda= 25.55\sqrt{p} λ = 25.55 p , then
P f a i l ≤ 0.0985 ( T + 1 ) ( d + 1 ) λ d 1 − λ . P_{\mathrm{fail}} \le0.0985\,(T+1)(d+1)\frac{\lambda^d}{1-\lambda}. P fail ≤ 0.0985 ( T + 1 ) ( d + 1 ) 1 − λ λ d . (b) If 0 < p ≤ 2.4 × 10 − 3 0 < p \le2.4 \times10^{-3} 0 < p ≤ 2.4 × 1 0 − 3 and λ = 0.997 ( p / ( 2.4 × 10 − 3 ) ) 21 / 50 \lambda= 0.997\left(p/(2.4 \times10^{-3})\right)^{21/50} λ = 0.997 ( p / ( 2.4 × 1 0 − 3 ) ) 21/50 , then
P f a i l ≤ 0.028 ( T + 1 ) ( d + 1 ) λ d 1 − λ . P_{\mathrm{fail}} \le0.028\,(T+1)(d+1)\frac{\lambda^d}{1-\lambda}. P fail ≤ 0.028 ( T + 1 ) ( d + 1 ) 1 − λ λ d . (c) If the weights are profile weights, 0 < p ≤ 3 × 10 − 3 0 < p \le3 \times10^{-3} 0 < p ≤ 3 × 1 0 − 3 and λ = 0.997 ( p / ( 3 × 10 − 3 ) ) 9 / 25 \lambda= 0.997\left(p/(3 \times10^{-3})\right)^{9/25} λ = 0.997 ( p / ( 3 × 1 0 − 3 ) ) 9/25 , then
P f a i l ≤ 0.052 ( T + 1 ) ( d + 1 ) λ d 1 − λ . P_{\mathrm{fail}} \le0.052\,(T+1)(d+1)\frac{\lambda^d}{1-\lambda}. P fail ≤ 0.052 ( T + 1 ) ( d + 1 ) 1 − λ λ d .
At p = 10 − 3 p = 10^{-3} p = 1 0 − 3 , part (c) gives λ < 0.6714 \lambda< 0.6714 λ < 0.6714 , and the bound on P f a i l / T P_{\mathrm{fail}}/T P fail / T is below 0.39 for all d ≥ 3 d \ge3 d ≥ 3 and below 10 − 6 10^{-6} 1 0 − 6 for d ≥ 43 d \ge43 d ≥ 43 .
§ 8 extends both arguments to error rates that depend on the type of operation (Theorem 8.1 ) and applies them to error models built from the published component error rates of six devices. Three models are certified: those of the Quantinuum Helios and H2 data sheets, and one with the error rates of IBM’s Heron r3 processor ibm_boston on a square grid. However, the models of Google’s and USTC’s processors are not certified. For them, floating-point estimates indicate that no positive potential satisfies the inequalities of Lemma 6.5 with λ < 1 \lambda< 1 λ < 1 .
Relation to earlier work
Dennis, Kitaev, Landahl and Preskill reduced matching failure to self-avoiding walks and proved a threshold of 1.14% for independent qubit and measurement errors, and of 1.7 × 10 − 4 1.7 \times10^{-4} 1.7 × 1 0 − 4 per qubit and time step for the toric code with a CNOT syndrome-extraction circuit and worst-case Pauli faults, assuming that classical decoding takes one time step [1 ] . Fowler proved 7.4 × 10 − 4 7.4 \times10^{-4} 7.4 × 1 0 − 4 for the planar code with nearest-neighbour circuits and unit weights [3 ] , using the bound 14 p / 5 14p/5 14 p /5 on line probabilities of the circuits of [9 ] . General threshold theorems for local stochastic noise cover concatenated codes [6 ] and low-density parity-check codes [7 , 8 ] , and finite thresholds have recently been proved for the union-find and greedy decoders of the surface code under circuit-level local stochastic noise [10 ] . We keep the path reduction of [1 ] but replace the path count by the local criterion of § 4 , applied to the exact edge probabilities of the circuit. For Theorem 1.2 we also use the minimality of the correction along the path, beyond the half-weight inequality of [1 ] , and for part (b) a canonical choice among the minimum-weight corrections. For the circuit considered here, Fowler’s argument gives 4.3 × 10 − 4 4.3 \times10^{-4} 4.3 × 1 0 − 4 (Remark 11.1 ), so Theorems 1.1 and 1.2 improve the rigorous value for this circuit by factors of about 2.4 and 4.6.
Outline
Section 2 describes the decoding graph: each fault outcome produces one edge, the bulk has twelve edges per node, and the graph has 29 node types in each sector. In Section 3 we reduce failure to weighted paths from b 1 b_1 b 1 to b 2 b_2 b 2 , following [1 ] . We prove the local criterion in Section 4 and combine the pieces into Theorem 1.1 in Section 5. Section 6 proves Theorem 1.2 , Section 7 treats the lean schedule, and Section 8 treats non-uniform error rates. Computer-verified statements carry the mark † and are collected in Table 3 –Table 6 . Section 10 describes the formal proofs in Lean 4.
Table 6. Computer verification for Theorem 8.1 and the error models of Table 2.
The decoding graph
We write G d , T G_{d,T} G d , T for the decoding graph of the experiment with distance d d d and T T T rounds, in basis Z or X. The height of a detector D m , r D_{m,r} D m , r is the second coordinate y y y of m m m in basis Z and the first coordinate x x x in basis X.
Lemma 2.1 (†). For B ∈ { X , Z } B \in\{X,Z\} B ∈ { X , Z } , odd d ≤ 13 d \le13 d ≤ 13 and T ≤ 7 T \le7 T ≤ 7 the following hold.
(a) Every fault outcome flips at most two detectors.
(b) Outcomes with the same signature have the same value of ℓ \ell ℓ , and ℓ ( f ) = 1 \ell(f) = 1 ℓ ( f ) = 1 only if ∣ σ ( f ) ∣ = 1 |\sigma(f)| = 1 ∣ σ ( f ) ∣ = 1 .
(c) The edges at b 1 b_1 b 1 join it to detectors of height 2, and the edges at b 2 b_2 b 2 join it to detectors of height 2 d − 2 2d - 2 2 d − 2 . No detector is adjacent to both.
(d) The heights of the two ends of an edge in V differ by at most 2.
(e) b 1 b_1 b 1 has exactly ( T + 1 ) ( d + 1 ) / 2 (T + 1)(d + 1)/2 ( T + 1 ) ( d + 1 ) /2 neighbours, and c e ≤ 154 / 15 c_e \le154/15 c e ≤ 154/15 for every edge e e e .
Part (a) says that the circuit-level noise decomposes into a graph in each sector. Here each Y Y Y component splits into its X X X part, seen by Z-type detectors, and its Z Z Z part, seen by X-type detectors. Lemma 2.3 below will show that Lemma 2.1 holds for all odd d ≥ 3 d \ge3 d ≥ 3 and all T ≥ 1 T \ge1 T ≥ 1 .
The bulk
Let m m m be a Z-type measure qubit far from the boundary and $1 \le r \le T - 1f a r f r o m 0 a n d far from 0 and f a r f r o m 0 an d T. Then the data qubit m + δ k Z m + \delta_k^Z m + δ k Z meets m m m in step 2 + k 2 + k 2 + k . There are two kinds of data qubits. A data qubit q q q of kind A has Z-type neighbours q ∓ ( 1 , 1 ) q \mp(1,1) q ∓ ( 1 , 1 ) , which it meets in steps (S3) and (S6), and X-type neighbours q + ( 1 , − 1 ) q + (1,-1) q + ( 1 , − 1 ) , q + ( − 1 , 1 ) q + (-1,1) q + ( − 1 , 1 ) , which it meets in (S4) and (S5). A data qubit of kind B has Z-type neighbours q + ( − 1 , 1 ) q + (-1,1) q + ( − 1 , 1 ) , q + ( 1 , − 1 ) q + (1,-1) q + ( 1 , − 1 ) , met in (S4) and (S5), and X-type neighbours q ∓ ( 1 , 1 ) q \mp(1,1) q ∓ ( 1 , 1 ) , met in (S3) and (S6).
Lemma 2.2. In basis Z, a bulk detector v = D m , r v = D_{m,r} v = D m , r has exactly twelve edges. Their other ends, written as offsets ( Δ x , Δ y , Δ r ) (\Delta x, \Delta y, \Delta r) ( Δ x , Δ y , Δ r ) , and their coefficients are
Table 2.2.
In basis X the coefficients are the same, with offsets ± ( 2 , − 2 , 0 ) \pm(2,-2,0) ± ( 2 , − 2 , 0 ) , ± ( 0 , 0 , 1 ) \pm(0,0,1) ± ( 0 , 0 , 1 ) , ± ( 2 , 2 , 0 ) \pm(2,2,0) ± ( 2 , 2 , 0 ) , ± ( 2 , 2 , − 1 ) \pm(2,2,-1) ± ( 2 , 2 , − 1 ) , ± ( 2 , − 2 , 1 ) \pm(2,-2,1) ± ( 2 , − 2 , 1 ) and ± ( 0 , 4 , − 1 ) \pm(0,4,-1) ± ( 0 , 4 , − 1 ) .
Proof. We treat basis Z, where only X components matter, and list the outcomes that produce each edge in Table 1, in units of p / 15 p/15 p /15 . Three propagation rules determine the list. First, a CX copies an X on its control to its target. Second, an X on the target of a CX is not copied. Third, an X on an X-type measure qubit before its first CX acts trivially, because that qubit is in ∣ + ⟩ |+\rangle ∣ + ⟩ at that point. By the first rule, an X on such a qubit between its k k k -th and ( k + 1 ) (k + 1) ( k + 1 ) -st CX is copied onto its remaining data qubits. For k = 1 k = 1 k = 1 this equals an X on its first data qubit, for k = 2 k = 2 k = 2 it is the hook pair, and for k = 3 k = 3 k = 3 it is an X on its last data qubit.
An X on a data qubit q q q changes the next outcome of each Z-type neighbour that has not yet met q q q in the current round, and the outcome in the next round of each neighbour that has. Hence an X on a kind-A qubit between (S6) of round r − 1 r - 1 r − 1 and (S3) of round r r r flips its two neighbours in layer r r r , and it produces the edge with offset ( 2 , 2 , 0 ) (2,2,0) ( 2 , 2 , 0 ) . An X between (S3) and (S6) of round r r r flips q + ( 1 , 1 ) q + (1,1) q + ( 1 , 1 ) in layer r r r and q − ( 1 , 1 ) q - (1,1) q − ( 1 , 1 ) in layer r + 1 r + 1 r + 1 , and it gives the offset ( − 2 , − 2 , 1 ) (-2,-2,1) ( − 2 , − 2 , 1 ) . Similarly, for kind B the windows are (S5) of round r − 1 r - 1 r − 1 to (S4) of round r r r , with offset ( 2 , − 2 , 0 ) (2,-2,0) ( 2 , − 2 , 0 ) , and (S4) to (S5), with offset ( − 2 , 2 , 1 ) (-2,2,1) ( − 2 , 2 , 1 ) . The hook pair of an X-type measure qubit m ′ m' m ′ is { m ′ + ( 1 , − 1 ) , m ′ + ( − 1 , − 1 ) } \{m' + (1,-1),m' + (-1,-1)\} { m ′ + ( 1 , − 1 ) , m ′ + ( − 1 , − 1 )} . It flips m ′ + ( 2 , 0 ) m' + (2,0) m ′ + ( 2 , 0 ) in layer r r r and m ′ + ( − 2 , 0 ) m' + (-2,0) m ′ + ( − 2 , 0 ) in layer r + 1 r + 1 r + 1 , while the flips of m ′ + ( 0 , − 2 ) m' + (0,-2) m ′ + ( 0 , − 2 ) cancel, which leads to the offset ( − 4 , 0 , 1 ) (-4,0,1) ( − 4 , 0 , 1 ) . Finally, an X X X on the Z Z Z -type qubit m m m after its reset changes s m , r s_{m,r} s m , r only, which gives the offset ( 0 , 0 , 1 ) (0,0,1) ( 0 , 0 , 1 ) . Applying these rules to all locations in the neighbourhood, we obtain the entries of Table 1. For a CX we record which of the 15 outcomes contribute, as pairs (control part, target part).
The same derivation with Z Z Z components yields the offsets and coefficients stated for basis X X X .
Table 1. Outcomes producing the twelve edges at a bulk detector (basis Z Z Z , Lemma 2.2). The kind-A and kind-B qubits are the data qubits shared by the two ends of the edge.
Locality and node types
The type of a detector v ∈ V v \in V v ∈ V is the multiset of pairs (offset of the other end, c e c_e c e ) over the edges e e e at v v v , where an edge to b 1 b_1 b 1 or b 2 b_2 b 2 is recorded with the label b 1 b_1 b 1 or b 2 b_2 b 2 in place of the offset.
Lemma 2.3. Let v = D m , r v = D_{m,r} v = D m , r .
(a) If v ∈ σ ( f ) v \in\sigma(f) v ∈ σ ( f ) , then f f f acts on a qubit at ℓ ∞ \ell^\infty ℓ ∞ -distance at most 2 from m m m , in round r − 1 r-1 r − 1 or r r r (in round T − 1 T-1 T − 1 or in the final measurement if r = T r = T r = T ).
(b) The type of v v v is determined by the positions of the qubits at ℓ ∞ \ell^\infty ℓ ∞ -distance at most 6 from m m m and the X X X or Z Z Z types of the measure qubits among them, by min ( r , 2 ) \min(r,2) min ( r , 2 ) and by min ( T − r , 2 ) \min(T-r,2) min ( T − r , 2 ) .
(c) For all odd d ≥ 3 d \ge3 d ≥ 3 and all T ≥ 1 T \ge1 T ≥ 1 , every detector of G d , T G_{d,T} G d , T has the type of a detector of G d ′ , T ′ G_{d',T'} G d ′ , T ′ for some d ′ ∈ { 3 , 5 , 7 , 9 } d' \in\{3,5,7,9\} d ′ ∈ { 3 , 5 , 7 , 9 } and T ′ ∈ { 1 , … , 5 } T' \in\{1,\ldots,5\} T ′ ∈ { 1 , … , 5 } . The same reduction applies to the statements of Lemma 2.1 .
Proof. (a) We use the propagation rules from the proof of Lemma 2.2. In basis Z Z Z only X X X components matter, and basis X X X is the same with Z Z Z components and the roles of the two types of measure qubits exchanged. An X X X on a data qubit q q q is copied by the gate CX ( q → m ′ ) \operatorname{CX}(q \to m') CX ( q → m ′ ) onto each Z Z Z -type measure qubit m ′ m' m ′ with q ∈ N ( m ′ ) q \in N(m') q ∈ N ( m ′ ) , where it flips the outcome of m ′ m' m ′ and is removed by the next reset of m ′ m' m ′ . It is copied nowhere else, because q q q is the target of its CX gates with X X X -type measure qubits. An X X X on a Z Z Z -type measure qubit flips its outcome and is removed by the next reset, whereas an X X X on an X X X -type measure qubit m ′ m' m ′ is copied onto the data qubits of N ( m ′ ) N(m') N ( m ′ ) that m ′ m' m ′ meets later in the same round. The latter does not change the outcome of m ′ m' m ′ , and it is removed by the next reset. Hence the propagated X X X part of a single-qubit outcome lies, on data qubits, within distance 1 of the faulty qubit, and the detectors it flips lie within distance 2 of it. A two-qubit outcome is the product of its two factors, and detector values are linear in the Pauli frame. In time, a measure qubit is reset at the start of each round, and a data error that is present from round ρ \rho ρ on changes s m ′ , ρ ′ s_{m',\rho'} s m ′ , ρ ′ for all ρ ′ ≥ ρ \rho' \ge\rho ρ ′ ≥ ρ or for all ρ ′ ≥ ρ + 1 \rho' \ge\rho+ 1 ρ ′ ≥ ρ + 1 , so it flips layers ρ \rho ρ and ρ + 1 \rho+ 1 ρ + 1 only. The final layer compares the last round with the data measurement, which sees the same error.
(b) By (a), the outcomes with v v v in their signature act within distance 2 of m m m , so their CX partners lie within distance 3. By the rules in (a), the signature and the logical effect of such an outcome in round ρ \rho ρ are determined by the steps at which CX gates act, in rounds ρ \rho ρ and ρ + 1 \rho+ 1 ρ + 1 , on its qubits, on the data qubits within distance 1 of them and on the measure qubits adjacent to those. Hence all of these qubits lie within distance 5 of m m m . Which gates act on a qubit, and in which step, depends only on which of its diagonal neighbours exist, and these lie within distance 6 of m m m . Whether round r − 1 r - 1 r − 1 is round 0, and whether layer r r r or r + 1 r + 1 r + 1 is the final one, is recorded by min ( r , 2 ) \min(r, 2) min ( r , 2 ) and min ( T − r , 2 ) \min(T - r, 2) min ( T − r , 2 ) .
(c) The bulk pattern of qubit positions and measure-qubit types is invariant under the lattice generated by ( 4 , 0 ) (4, 0) ( 4 , 0 ) , ( 0 , 4 ) (0, 4) ( 0 , 4 ) and ( 2 , 2 ) (2, 2) ( 2 , 2 ) , and the measure qubits of each of the two types form a single coset of it. Along the side y = 0 y = 0 y = 0 the X-type measure qubits sit at x ≡ 2 ( m o d 4 ) x \equiv2 \pmod{4} x ≡ 2 ( mod 4 ) , along y = 2 d y = 2d y = 2 d at x ≡ 0 x \equiv0 x ≡ 0 , along x = 0 x = 0 x = 0 the Z-type ones sit at y ≡ 0 y \equiv0 y ≡ 0 and along x = 2 d x = 2d x = 2 d at y ≡ 2 ( m o d 4 ) y \equiv2 \pmod{4} y ≡ 2 ( mod 4 ) . For odd d d d this pattern, measured from the nearest corner, does not depend on d d d . Hence, for a detector in a given basis, the configuration within distance 6 of m m m is determined by the distances from m m m to the four sides, truncated at 7. If d ≥ 9 d \ge9 d ≥ 9 , each quadruple of truncated distances that occurs in G d , T G_{d,T} G d , T also occurs in G 9 , T G_{9,T} G 9 , T . Indeed, the range [ 7 , 11 ] [7, 11] [ 7 , 11 ] of coordinates at distance at least 7 from both opposite sides of G 9 G_9 G 9 contains the even coordinates 8 and 10, one of each residue modulo 4, so the parity condition that makes m m m X-type or Z-type can be met there. Likewise, for T ≥ 5 T \ge5 T ≥ 5 the layer data ( min ( r , 2 ) , min ( T − r , 2 ) ) (\min(r,2),\min(T-r,2)) ( min ( r , 2 ) , min ( T − r , 2 )) of all layers occur for T ′ = 5 T' = 5 T ′ = 5 . Part (b) then implies the claim for the types of detectors. The statements of Lemma 2.1 concern single outcomes, edges and the neighbours of b 1 b_1 b 1 , and they reduce in the same way. For the logical effect, after round ρ + 1 \rho+ 1 ρ + 1 the propagated frame of an outcome in round ρ \rho ρ no longer changes on the data qubits, so ℓ ( f ) \ell(f) ℓ ( f ) is the parity of its X X X part on the bottom row at that time, which is again determined locally. An outcome with empty signature is handled in the same way, with the configuration around the outcome in place of the configuration around a detector. Finally, the number of neighbours of b 1 b_1 b 1 is a sum over detectors. By the types, a detector is adjacent to b 1 b_1 b 1 exactly when it has height 2, and each layer has ( d + 1 ) / 2 (d + 1)/2 ( d + 1 ) /2 detectors of height 2.
Corollary 2.4 (†). In each basis the detectors of all graphs G d , T G_{d,T} G d , T , d ≥ 3 d \ge3 d ≥ 3 odd and T ≥ 1 T \ge1 T ≥ 1 , have exactly 29 types. They are listed in Appendix A.
From matching failure to weighted paths
Fix an experiment and let F \mathcal{F} F be the set of fault outcomes that occur. At most one outcome occurs per location. Let E E E be the set of edges e e e such that the number of f ∈ F f \in\mathcal{F} f ∈ F with e ( f ) = e e(f) = e e ( f ) = e is odd. Since detector values are linear in the Pauli frame, the set of detectors equal to 1 is ∂ E \partial E ∂ E . The logical outcome is linear in the Pauli frame as well, and by Lemma 2.1 (b) an outcome flips it if and only if its edge ends at b 1 b_1 b 1 . Therefore the logical outcome flips if and only if ∣ E ∩ δ ( b 1 ) ∣ |E \cap\delta(b_1)| ∣ E ∩ δ ( b 1 ) ∣ is odd.
Lemma 3.1. If the decoder fails with the minimizer C C C , then E △ C E \triangle C E △ C contains a simple path from b 1 b_1 b 1 to b 2 b_2 b 2 .
Proof. Let R = E △ C R=E\triangle C R = E △ C . Since ∂ C = ∂ E \partial C=\partial E ∂ C = ∂ E , each detector has even degree in R R R . Failure means that ∣ C ∩ δ ( b 1 ) ∣ |C\cap\delta(b_1)| ∣ C ∩ δ ( b 1 ) ∣ and ∣ E ∩ δ ( b 1 ) ∣ |E\cap\delta(b_1)| ∣ E ∩ δ ( b 1 ) ∣ have different parity, so b 1 b_1 b 1 has odd degree in R R R . As the degrees in R R R sum to 2 ∣ R ∣ 2|R| 2∣ R ∣ , the vertex b 2 b_2 b 2 has odd degree as well. In each connected component of ( V ∪ { b 1 , b 2 } , R ) (V\cup\{b_1,b_2\},R) ( V ∪ { b 1 , b 2 } , R ) the number of odd-degree vertices is even. Hence b 1 b_1 b 1 and b 2 b_2 b 2 lie in the same component, and that component contains a simple path between them. □
Lemma 3.2. Every simple path from b 1 b_1 b 1 to b 2 b_2 b 2 in G d , T G_{d,T} G d , T has at least d d d edges.
Proof. By Lemma 2.1(c,d), the path enters V V V at height 2 2 2 , leaves it from height 2 d − 2 2d-2 2 d − 2 , and each of its edges inside V V V changes the height by at most 2 2 2 . Thus it has at least ( 2 d − 4 ) / 2 = d − 2 (2d-4)/2=d-2 ( 2 d − 4 ) /2 = d − 2 edges inside V V V , and two edges at the boundary vertices. □
Lemma 3.3. Let γ ⊆ E △ C \gamma\subseteq E\triangle C γ ⊆ E △ C be a simple path from b 1 b_1 b 1 to b 2 b_2 b 2 . Then w ( γ ∩ E ) ≥ w ( γ ) / 2 w(\gamma\cap E)\ge w(\gamma)/2 w ( γ ∩ E ) ≥ w ( γ ) /2 .
Proof. We follow the argument of [1 Sec. 4] . Because the detector boundary of γ \gamma γ is empty, C △ γ C\triangle\gamma C △ γ is also a valid output, and w ( C ) ≤ w ( C △ γ ) = w ( C ) − w ( C ∩ γ ) + w ( γ ∖ C ) w(C)\le w(C\triangle\gamma)=w(C)-w(C\cap\gamma)+w(\gamma\setminus C) w ( C ) ≤ w ( C △ γ ) = w ( C ) − w ( C ∩ γ ) + w ( γ ∖ C ) . Since γ ⊆ E △ C \gamma\subseteq E\triangle C γ ⊆ E △ C , we have γ ∖ C = γ ∩ E \gamma\setminus C=\gamma\cap E γ ∖ C = γ ∩ E and w ( C ∩ γ ) = w ( γ ) − w ( γ ∩ E ) w(C\cap\gamma)=w(\gamma)-w(\gamma\cap E) w ( C ∩ γ ) = w ( γ ) − w ( γ ∩ E ) . □
Lemma 3.4. For every set S S S of edges, Pr ( S ⊆ E ) ≤ ∏ e ∈ S q e \Pr(S\subseteq E)\le\prod_{e\in S}q_e Pr ( S ⊆ E ) ≤ ∏ e ∈ S q e .
Proof. If S ⊆ E S\subseteq E S ⊆ E , then for each e ∈ S e\in S e ∈ S some f e ∈ F f_e\in\mathcal{F} f e ∈ F has e ( f e ) = e e(f_e)=e e ( f e ) = e . The f e f_e f e are distinct, because each outcome has one edge. Two distinct outcomes at the same location never occur together, while outcomes at distinct locations are independent. Hence
Pr ( S ⊆ E ) ≤ ∑ ( f e ) e ∈ S Pr ( f e ∈ F ∀ e ) ≤ ∑ ( f e ) e ∈ S ∏ e ∈ S p π ( f e ) = ∏ e ∈ S q e . \Pr(S\subseteq E)\le\sum_{(f_e)_{e\in S}}\Pr(f_e\in\mathcal{F}\ \forall e)\le\sum_{(f_e)_{e\in S}}\prod_{e\in S}p\,\pi(f_e)=\prod_{e\in S}q_e. Pr ( S ⊆ E ) ≤ ( f e ) e ∈ S ∑ Pr ( f e ∈ F ∀ e ) ≤ ( f e ) e ∈ S ∑ e ∈ S ∏ p π ( f e ) = e ∈ S ∏ q e .
Lemma 3.5. Put a e = 2 q e / ( 1 − q e ) a_e=2\sqrt{q_e}/(1-q_e) a e = 2 q e / ( 1 − q e ) . For every path γ \gamma γ ,
∑ S ⊆ γ , w ( S ) ≥ w ( γ ) / 2 ∏ e ∈ S q e ≤ ∏ e ∈ γ a e . \sum_{\substack{S\subseteq\gamma,\\w(S)\ge w(\gamma)/2}}\prod_{e\in S}q_e\le\prod_{e\in\gamma}a_e. S ⊆ γ , w ( S ) ≥ w ( γ ) /2 ∑ e ∈ S ∏ q e ≤ e ∈ γ ∏ a e . Proof. Each term on the left satisfies w ( S ) − w ( γ ∖ S ) ≥ 0 w(S)-w(\gamma\setminus S)\ge0 w ( S ) − w ( γ ∖ S ) ≥ 0 , so it is at most ∏ e ∈ S q e e ( w ( S ) − w ( γ ∖ S ) ) / 2 \prod_{e\in S}q_e e^{(w(S)-w(\gamma\setminus S))/2} ∏ e ∈ S q e e ( w ( S ) − w ( γ ∖ S )) /2 . Summing this over all S ⊆ γ S\subseteq\gamma S ⊆ γ , we obtain
∏ e ∈ γ ( q e e w e / 2 + e − w e / 2 ) . \prod_{e\in\gamma}\left(q_ee^{w_e/2}+e^{-w_e/2}\right). e ∈ γ ∏ ( q e e w e /2 + e − w e /2 ) . With e w e = ( 1 − r e ) / r e e^{w_e}=(1-r_e)/r_e e w e = ( 1 − r e ) / r e and q e ( 1 − q e ) ≤ r e ≤ q e q_e(1-q_e)\le r_e\le q_e q e ( 1 − q e ) ≤ r e ≤ q e we get
q e 1 − r e r e ≤ q e q e ( 1 − q e ) = q e 1 − q e , r e 1 − r e ≤ q e 1 − q e , q_e\sqrt{\frac{1-r_e}{r_e}}\le\frac{q_e}{\sqrt{q_e(1-q_e)}}=\sqrt{\frac{q_e}{1-q_e}},\qquad
\sqrt{\frac{r_e}{1-r_e}}\le\sqrt{\frac{q_e}{1-q_e}}, q e r e 1 − r e ≤ q e ( 1 − q e ) q e = 1 − q e q e , 1 − r e r e ≤ 1 − q e q e , so each factor is at most a e a_e a e . □
Proposition 3.6. Let Γ \Gamma Γ be the set of simple paths from b 1 b_1 b 1 to b 2 b_2 b 2 in G d , T G_{d,T} G d , T . Then P f a i l ≤ ∑ γ ∈ Γ ∏ e ∈ γ a e P_{\mathrm{fail}}\le\sum_{\gamma\in\Gamma}\prod_{e\in\gamma}a_e P fail ≤ ∑ γ ∈ Γ ∏ e ∈ γ a e .
Proof. By Lemmas 3.1 and 3.3, failure implies that some γ ∈ Γ \gamma\in\Gamma γ ∈ Γ and S = γ ∩ E S=\gamma\cap E S = γ ∩ E satisfy S ⊆ E S\subseteq E S ⊆ E and w ( S ) ≥ w ( γ ) / 2 w(S)\ge w(\gamma)/2 w ( S ) ≥ w ( γ ) /2 . We apply the union bound over γ \gamma γ and S S S , then Lemmas 3.4 and 3.5. □
A local criterion for non-backtracking walks
Lemma 4.1. Let G G G be a finite graph with vertex set V ∪ { b 1 , b 2 } V\cup\{b_1,b_2\} V ∪ { b 1 , b 2 } , without an edge between b 1 b_1 b 1 and b 2 b_2 b 2 , and let a e > 0 a_e>0 a e > 0 for each edge e e e . Let λ > 0 \lambda>0 λ > 0 and suppose that
Σ ( v ) : = ∑ e ∋ v a e λ + a e ≤ 1 for every v ∈ V . \Sigma(v):=\sum_{e\ni v}\frac{a_e}{\lambda+a_e}\le1\qquad\text{for every }v\in V. Σ ( v ) := e ∋ v ∑ λ + a e a e ≤ 1 for every v ∈ V . where the sum includes edges to b 1 b_1 b 1 and b 2 b_2 b 2 . Put κ = λ + max e ∋ b 2 a e \kappa=\lambda+\max_{e\ni b_2}a_e κ = λ + max e ∋ b 2 a e and Σ ( b 1 ) = ∑ e ∋ b 1 a e / ( λ + a e ) \Sigma(b_1)=\sum_{e\ni b_1}a_e/(\lambda+a_e) Σ ( b 1 ) = ∑ e ∋ b 1 a e / ( λ + a e ) . Then for every L ≥ 2 L\ge2 L ≥ 2 the simple paths from b 1 b_1 b 1 to b 2 b_2 b 2 with L L L edges satisfy
∑ γ ∏ e ∈ γ a e ≤ κ Σ ( b 1 ) λ L − 1 . \sum_{\gamma}\prod_{e\in\gamma}a_e\le\kappa\Sigma(b_1)\lambda^{L-1}. γ ∑ e ∈ γ ∏ a e ≤ κ Σ ( b 1 ) λ L − 1 .
Proof. For an oriented edge ε = ( u → v ) \varepsilon=(u\to v) ε = ( u → v ) put h ( ε ) = 1 / ( λ + a ε ) h(\varepsilon)=1/(\lambda+a_\varepsilon) h ( ε ) = 1/ ( λ + a ε ) . For m ≥ 1 m\ge1 m ≥ 1 and an oriented edge ( x 0 → x 1 ) (x_0\to x_1) ( x 0 → x 1 ) with x 0 ∈ V ∪ { b 1 } x_0\in V\cup\{b_1\} x 0 ∈ V ∪ { b 1 } and x 1 ∈ V x_1\in V x 1 ∈ V , let W m ( x 0 → x 1 ) W_m(x_0\to x_1) W m ( x 0 → x 1 ) be the sum of ∏ i = 1 m a x i x i + 1 \prod_{i=1}^{m}a_{x_i x_{i+1}} ∏ i = 1 m a x i x i + 1 over all walks x 1 , x 2 , … , x m + 1 x_1,x_2,\ldots,x_{m+1} x 1 , x 2 , … , x m + 1 with x m + 1 = b 2 x_{m+1}=b_2 x m + 1 = b 2 , x 2 , … , x m ∈ V x_2,\ldots,x_m\in V x 2 , … , x m ∈ V , consecutive vertices adjacent and x i + 1 ≠ x i − 1 x_{i+1}\ne x_{i-1} x i + 1 = x i − 1 for 1 ≤ i ≤ m 1\le i\le m 1 ≤ i ≤ m . We show by induction on m m m that
W m ( x 0 → x 1 ) ≤ κ λ m h ( x 0 → x 1 ) . (1) W_m(x_0\to x_1)\le\kappa\lambda^m h(x_0\to x_1). \tag*{(1)} W m ( x 0 → x 1 ) ≤ κ λ m h ( x 0 → x 1 ) . (1)
Because the edge { x 0 , x 1 } \{x_0,x_1\} { x 0 , x 1 } contributes a x 0 x 1 / ( λ + a x 0 x 1 ) a_{x_0x_1}/(\lambda+a_{x_0x_1}) a x 0 x 1 / ( λ + a x 0 x 1 ) to Σ ( x 1 ) \Sigma(x_1) Σ ( x 1 ) , the hypothesis implies
∑ e ∋ x 1 , e ≠ { x 0 , x 1 } a e λ + a e ≤ 1 − a x 0 x 1 λ + a x 0 x 1 = λ h ( x 0 → x 1 ) . (2) \sum_{\substack{e\ni x_1,\,e\ne\{x_0,x_1\}}}\frac{a_e}{\lambda+a_e}\le1-\frac{a_{x_0x_1}}{\lambda+a_{x_0x_1}}=\lambda h(x_0\to x_1). \tag*{(2)} e ∋ x 1 , e = { x 0 , x 1 } ∑ λ + a e a e ≤ 1 − λ + a x 0 x 1 a x 0 x 1 = λh ( x 0 → x 1 ) . (2)
For m = 1 m=1 m = 1 , W 1 ( x 0 → x 1 ) = a x 1 b 2 W_1(x_0\to x_1)=a_{x_1b_2} W 1 ( x 0 → x 1 ) = a x 1 b 2 if x 1 x_1 x 1 is adjacent to b 2 b_2 b 2 and 0 0 0 otherwise. Since a x 1 b 2 = ( λ + a x 1 b 2 ) ⋅ a x 1 b 2 / ( λ + a x 1 b 2 ) ≤ κ a x 1 b 2 / ( λ + a x 1 b 2 ) a_{x_1b_2}=(\lambda+a_{x_1b_2})\cdot a_{x_1b_2}/(\lambda+a_{x_1b_2})\le\kappa a_{x_1b_2}/(\lambda+a_{x_1b_2}) a x 1 b 2 = ( λ + a x 1 b 2 ) ⋅ a x 1 b 2 / ( λ + a x 1 b 2 ) ≤ κ a x 1 b 2 / ( λ + a x 1 b 2 ) , (4.1) follows from (4.2). For m ≥ 2 m\ge2 m ≥ 2 ,
W m ( x 0 → x 1 ) = ∑ x 2 ∈ V ∖ { x 0 } x 2 ∼ x 1 a x 1 x 2 W m − 1 ( x 1 → x 2 ) ≤ κ λ m − 1 ∑ x 2 a x 1 x 2 λ + a x 1 x 2 ≤ κ λ m h ( x 0 → x 1 ) , W_m(x_0\to x_1)=\sum_{\substack{x_2\in V\setminus\{x_0\}\\x_2\sim x_1}}a_{x_1x_2}W_{m-1}(x_1\to x_2)\le\kappa\lambda^{m-1}\sum_{x_2}\frac{a_{x_1x_2}}{\lambda+a_{x_1x_2}}\le\kappa\lambda^m h(x_0\to x_1), W m ( x 0 → x 1 ) = x 2 ∈ V ∖ { x 0 } x 2 ∼ x 1 ∑ a x 1 x 2 W m − 1 ( x 1 → x 2 ) ≤ κ λ m − 1 x 2 ∑ λ + a x 1 x 2 a x 1 x 2 ≤ κ λ m h ( x 0 → x 1 ) ,
by induction and (4.2). A simple path b 1 , x 1 , … , x L − 1 , b 2 b_1,x_1,\ldots,x_{L-1},b_2 b 1 , x 1 , … , x L − 1 , b 2 is a walk of this kind, so the sum in the lemma is at most ∑ x 1 ∼ b 1 a b 1 x 1 W L − 1 ( b 1 → x 1 ) ≤ κ λ L − 1 Σ ( b 1 ) \sum_{x_1\sim b_1}a_{b_1x_1}W_{L-1}(b_1\to x_1)\le\kappa\lambda^{L-1}\Sigma(b_1) ∑ x 1 ∼ b 1 a b 1 x 1 W L − 1 ( b 1 → x 1 ) ≤ κ λ L − 1 Σ ( b 1 ) .
On the k k k -regular tree with all a e = a a_e=a a e = a the criterion reads k a / ( λ + a ) ≤ 1 ka/(\lambda+a)\le1 k a / ( λ + a ) ≤ 1 , that is λ ≥ ( k − 1 ) a \lambda\ge(k-1)a λ ≥ ( k − 1 ) a . Since this is the exact growth rate of non-backtracking walks there, the criterion is sharp on trees. On a lattice with unequal edges it gives the growth rate of weighted non-backtracking walks exactly: if all nodes have the same multiset { a e } \{a_e\} { a e } and Σ ≡ 1 \Sigma\equiv1 Σ ≡ 1 , then h h h is a positive eigenvector of the weighted non-backtracking operator with eigenvalue λ \lambda λ .
Proof of Theorem 1.1
The criterion holds at every detector
Let λ = 31 p \lambda=31\sqrt{p} λ = 31 p and write a e = p α e ( p ) a_e=\sqrt{p}\,\alpha_e(p) a e = p α e ( p ) with α e ( p ) = 2 c e / ( 1 − c e p ) \alpha_e(p)=2\sqrt{c_e}/(1-c_ep) α e ( p ) = 2 c e / ( 1 − c e p ) . Then
Σ ( v ) = ∑ e ∋ v α e ( p ) 31 + α e ( p ) , \Sigma(v)=\sum_{e\ni v}\frac{\alpha_e(p)}{31+\alpha_e(p)}, Σ ( v ) = e ∋ v ∑ 31 + α e ( p ) α e ( p ) ,
which increases with p p p . Thus it suffices to check Σ ( v ) ≤ 1 \Sigma(v)\le1 Σ ( v ) ≤ 1 at p = p ∗ p=p_* p = p ∗ . There 31 p ∗ = 0.999719 … ≥ 0.9997 31\sqrt{p_*}=0.999719\ldots\ge0.9997 31 p ∗ = 0.999719 … ≥ 0.9997 , and Σ ( v ) \Sigma(v) Σ ( v ) decreases in λ \lambda λ , so it suffices to check
∑ e ∋ v a e 0.9997 + a e ≤ 1 at p = p ∗ . (3) \sum_{e\ni v}\frac{a_e}{0.9997+a_e}\le1\qquad\text{at }p=p_*. \tag*{(3)} e ∋ v ∑ 0.9997 + a e a e ≤ 1 at p = p ∗ . (3)
By Corollary 2.4 we need to check only 29 types per basis. For the bulk type of Lemma 2.2 the computation is short:
Table 1 (PDF p. 9).
and the weighted sum is 0.999409. The other 28 types satisfy (5.1) with left side at most 0.9629† . We list the values for all types in Appendix § 14 . The check is done in exact rational arithmetic, with rational upper bounds for the square roots (Table 3 , V6).
Assembly
We first check that the graph G d , T G_{d,T} G d , T satisfies the hypotheses of Lemma 4.1 . Each edge comes from a nonempty signature, which contains a detector, so there is no edge between b 1 b_1 b 1 and b 2 b_2 b 2 . Since there is one edge per signature, there are no parallel edges, and the number of edges at b 1 b_1 b 1 equals the number of its neighbours. Combining Proposition 3.6 , Lemma 3.2 and Lemma 4.1 , we obtain
P f a i l ≤ ∑ L ≥ d κ Σ ( b 1 ) λ L − 1 = κ Σ ( b 1 ) λ d − 1 1 − λ . P_{\mathrm{fail}} \le\sum_{L \ge d} \kappa\,\Sigma(b_1)\,\lambda^{L-1} = \kappa\,\Sigma(b_1)\frac{\lambda^{d-1}}{1-\lambda}. P fail ≤ L ≥ d ∑ κ Σ ( b 1 ) λ L − 1 = κ Σ ( b 1 ) 1 − λ λ d − 1 .
Let a max = 2 c max p / ( 1 − c max p ) a_{\max}=2\sqrt{c_{\max}p}/(1-c_{\max}p) a m a x = 2 c m a x p / ( 1 − c m a x p ) . By Lemma 2.1 (e), κ ≤ λ + a max \kappa\le\lambda+a_{\max} κ ≤ λ + a m a x and each term of Σ ( b 1 ) \Sigma(b_1) Σ ( b 1 ) is at most a max / ( λ + a max ) a_{\max}/(\lambda+a_{\max}) a m a x / ( λ + a m a x ) , so κ Σ ( b 1 ) ≤ ( T + 1 ) ( d + 1 ) 2 a max \kappa\,\Sigma(b_1)\le\frac{(T+1)(d+1)}{2}a_{\max} κ Σ ( b 1 ) ≤ 2 ( T + 1 ) ( d + 1 ) a m a x . This is the first bound of the theorem. For p ≤ p ∗ p\le p_* p ≤ p ∗ we have 1 − c max p ≥ 0.98932 1-c_{\max}p\ge0.98932 1 − c m a x p ≥ 0.98932 and a max ≤ 6.4429 p a_{\max}\le6.4429\sqrt{p} a m a x ≤ 6.4429 p , so
P f a i l ≤ ( T + 1 ) ( d + 1 ) 2 ⋅ 6.4429 p ⋅ λ d − 1 1 − λ = 6.4429 62 ( T + 1 ) ( d + 1 ) λ d 1 − λ ≤ 0.104 ( T + 1 ) ( d + 1 ) λ d 1 − λ . \begin{aligned}
P_{\mathrm{fail}}\le\frac{(T+1)(d+1)}{2}\cdot6.4429\sqrt{p}\cdot\frac{\lambda^{d-1}}{1-\lambda} \\
&= \frac{6.4429}{62}(T+1)(d+1)\frac{\lambda^d}{1-\lambda}\le0.104(T+1)(d+1)\frac{\lambda^d}{1-\lambda}.
\end{aligned} P fail ≤ 2 ( T + 1 ) ( d + 1 ) ⋅ 6.4429 p ⋅ 1 − λ λ d − 1 = 62 6.4429 ( T + 1 ) ( d + 1 ) 1 − λ λ d ≤ 0.104 ( T + 1 ) ( d + 1 ) 1 − λ λ d .
Proof of Theorem 1.2
In the proof of Theorem 1.1 we sum over all ways of labelling the edges of a path as errors or corrections, although most of these labellings cannot occur. Indeed, the correction edges on a stretch of the failure path belong to a minimum-weight correction. Their weight is therefore at most that of the error edges on the stretch plus any detour between its ends, and at most that of any set of edges with the same boundary. We turn these two inequalities into local exclusion rules (Definition 6.2 ) and count only the labelled paths that obey them. For profile weights a third rule uses the freedom in the choice of the minimizer: among the minimizers for which the decoder fails we take one that minimizes a fixed linear functional, and such a minimizer cannot turn a corner around which an equally heavy route of smaller value exists. These rules are the main new ingredient of the proof. For part (a) we fix p ∗ ∗ = 1 / 625 p_{**}=1/625 p ∗∗ = 1/625 and the tilt s = 21 / 50 s=21/50 s = 21/50 , and for part (b) p ∗ ∗ = 1 / 500 p_{**}=1/500 p ∗∗ = 1/500 and s = 9 / 25 s=9/25 s = 9/25 .
Windows
For a path or walk P P P we write c ( P ) = ∏ e ∈ P c e c(P)=\prod_{e\in P}c_e c ( P ) = ∏ e ∈ P c e , with multiplicity, and G / B G/B G / B for the graph obtained from G G G by identifying b 1 b_1 b 1 and b 2 b_2 b 2 to a single vertex B B B . Let C C C be a minimizer and γ ⊆ E △ C \gamma\subseteq E\mathbin{\triangle}C γ ⊆ E △ C the path of Lemma 3.1 . A window is a sub-path σ \sigma σ of γ \gamma γ . We write σ C = σ ∩ C \sigma_C=\sigma\cap C σ C = σ ∩ C and σ E = σ ∩ E \sigma_E=\sigma\cap E σ E = σ ∩ E , so that σ \sigma σ is the disjoint union of σ C \sigma_C σ C and σ E \sigma_E σ E .
Lemma 6.1. (a) For every window σ \sigma σ and every set P ′ P' P ′ of edges of G / B G/B G / B with the same detector boundary as σ \sigma σ , w ( σ C ) − w ( σ E ) ≤ w ( P ′ ) w(\sigma_C)-w(\sigma_E)\le w(P') w ( σ C ) − w ( σ E ) ≤ w ( P ′ ) .
(b) For every X ⊆ C X\subseteq C X ⊆ C and every set P ′ P' P ′ of edges of G / B G/B G / B with the same detector boundary as X X X , w ( X ) ≤ w ( P ′ ) w(X)\le w(P') w ( X ) ≤ w ( P ′ ) .
Proof. (a) The set C ′ = C △ σ △ P ′ C'=C\mathbin{\triangle}\sigma\mathbin{\triangle}P' C ′ = C △ σ △ P ′ satisfies ∂ C ′ = ∂ C \partial C'=\partial C ∂ C ′ = ∂ C . Since C △ σ = ( C ∖ σ C ) ∪ σ E C\mathbin{\triangle}\sigma=(C\setminus\sigma_C)\cup\sigma_E C △ σ = ( C ∖ σ C ) ∪ σ E , we have w ( C ′ ) ≤ w ( C ) − w ( σ C ) + w ( σ E ) + w ( P ′ ) w(C')\le w(C)-w(\sigma_C)+w(\sigma_E)+w(P') w ( C ′ ) ≤ w ( C ) − w ( σ C ) + w ( σ E ) + w ( P ′ ) , and w ( C ) ≤ w ( C ′ ) w(C)\le w(C') w ( C ) ≤ w ( C ′ ) .
(b) Similarly, the set C ′ = C △ X △ P ′ C'=C\mathbin{\triangle}X\mathbin{\triangle}P' C ′ = C △ X △ P ′ satisfies ∂ C ′ = ∂ C \partial C'=\partial C ∂ C ′ = ∂ C and w ( C ′ ) ≤ w ( C ) − w ( X ) + w ( P ′ ) w(C')\le w(C)-w(X)+w(P') w ( C ′ ) ≤ w ( C ) − w ( X ) + w ( P ′ ) , and w ( C ) ≤ w ( C ′ ) w(C)\le w(C') w ( C ) ≤ w ( C ′ ) .
For a detector D m , r D_{m,r} D m , r with m = ( x , y ) m=(x,y) m = ( x , y ) put ϕ ( D m , r ) = x + 9 y + 81 r \phi(D_{m,r})=x+9y+81r ϕ ( D m , r ) = x + 9 y + 81 r , and for a set C C C of edges let Φ ( C ) \Phi(C) Φ ( C ) be the sum of ϕ ( u ) + ϕ ( v ) \phi(u)+\phi(v) ϕ ( u ) + ϕ ( v ) over the edges { u , v } \{u,v\} { u , v } of C C C with u , v ∈ V u,v\in V u , v ∈ V .
A labelled window is a path σ = ( v 0 , … , v m ) \sigma=(v_0,\ldots,v_m) σ = ( v 0 , … , v m ) in G G G with 2 ≤ m ≤ 4 2\le m\le4 2 ≤ m ≤ 4 and a label E or C on each edge. We write n C n_C n C and n E n_E n E for the numbers of its C- and E-edges, σ C \sigma_C σ C and σ E \sigma_E σ E for the sets of these edges, and T ( σ ) T(\sigma) T ( σ ) for the set of detectors of odd degree in σ C \sigma_C σ C . The head of σ \sigma σ is v m − 1 v_{m-1} v m − 1 . The ball of a detector v v v is the set of detectors joined to v v v by a chain of at most four edges between detectors. Since the detectors of σ \sigma σ lie within three such edges of its head, they belong to the ball of the head. An admissible walk for σ \sigma σ is a walk in G / B G/B G / B , with b 1 b_1 b 1 and b 2 b_2 b 2 read as B B B , that visits B B B at most once and whose detectors all lie in the ball of the head.
Definition 6.2. A labelled window σ \sigma σ is excluded if it satisfies one of the following conditions.
(M) There is an admissible walk P ′ P' P ′ from v 0 v_0 v 0 to v m v_m v m with h ′ h' h ′ edges, empty if v 0 , v m ∈ { b 1 , b 2 } v_0,v_m\in\{b_1,b_2\} v 0 , v m ∈ { b 1 , b 2 } , such that k = n C − n E − h ′ ≥ 0 k=n_C-n_E-h'\ge0 k = n C − n E − h ′ ≥ 0 and
( 1 p ∗ ∗ ) k c ( σ E ) c ( P ′ ) c ( σ C ) > ∏ e ∈ σ C 1 1 − c e p ∗ ∗ ⋅ ( 1 1 − c max p ∗ ∗ ) h ′ . (4) \left(\frac{1}{p_{\ast\ast}}\right)^k \frac{c(\sigma_E)c(P')}{c(\sigma_C)}
>
\prod_{e\in\sigma_C}\frac{1}{1-c_e p_{\ast\ast}}\cdot
\left(\frac{1}{1-c_{\max}p_{\ast\ast}}\right)^{h'}. \tag*{(4)} ( p ∗∗ 1 ) k c ( σ C ) c ( σ E ) c ( P ′ ) > e ∈ σ C ∏ 1 − c e p ∗∗ 1 ⋅ ( 1 − c m a x p ∗∗ 1 ) h ′ . (4) (J) There are admissible walks, each from a vertex of T ( σ ) T(\sigma) T ( σ ) to another vertex of T ( σ ) T(\sigma) T ( σ ) or to B B B , such that each vertex of T ( σ ) T(\sigma) T ( σ ) is an end of exactly one of them, their union P ′ P' P ′ has h ′ h' h ′ edges counted with multiplicity, k = n C − h ′ ≥ 0 k=n_C-h'\ge0 k = n C − h ′ ≥ 0 and
( 1 p ∗ ∗ ) k c ( P ′ ) c ( σ C ) > ∏ e ∈ σ C 1 1 − c e p ∗ ∗ ⋅ ( 1 1 − c max p ∗ ∗ ) h ′ . (5) \left(\frac{1}{p_{\ast\ast}}\right)^k \frac{c(P')}{c(\sigma_C)}
>
\prod_{e\in\sigma_C}\frac{1}{1-c_e p_{\ast\ast}}\cdot
\left(\frac{1}{1-c_{\max}p_{\ast\ast}}\right)^{h'}. \tag*{(5)} ( p ∗∗ 1 ) k c ( σ C ) c ( P ′ ) > e ∈ σ C ∏ 1 − c e p ∗∗ 1 ⋅ ( 1 − c m a x p ∗∗ 1 ) h ′ . (5) If T ( σ ) T(\sigma) T ( σ ) is empty, P ′ P' P ′ is empty.
(S) (Only for Theorems 1.2(b) and 1.3(c).) The window has m = 2 m=2 m = 2 , its vertices u = v 0 u=v_0 u = v 0 , b = v 1 b=v_1 b = v 1 and w = v 2 w=v_2 w = v 2 are detectors, both of its edges carry the label C, and some detector x ∉ { u , b , w } x\notin\{u,b,w\} x ∈ / { u , b , w } is adjacent to u u u and to w w w , with ϕ ( x ) < ϕ ( b ) \phi(x)<\phi(b) ϕ ( x ) < ϕ ( b ) , such that the profiles of u x ux ux and x w xw x w are those of u b ub u b and b w bw b w , in some order.
Rule (M) compares the window with an alternative route between its ends. Rule (J) compares its correction edges with a re-pairing of their endpoints. Rule (S) compares the corner u , b , w u,b,w u , b , w with the opposite corner u , x , w u,x,w u , x , w of a square. Restricting the walks to the ball of the head keeps (M) and (J) local, and the detector x x x of (S) lies within two edges of the head b b b (Lemma 6.6). Because dropping walks only drops exclusions, any restriction of this kind would do.
Lemma 6.3. (a) Let p ≤ p ∗ ∗ p\le p_{\ast\ast} p ≤ p ∗∗ , let the weights be as in Section 1.3, and let C C C be a minimizer. Label the edges of γ ∩ E \gamma\cap E γ ∩ E by E and those of γ ∩ C \gamma\cap C γ ∩ C by C. Then no window of γ \gamma γ , with these labels, is excluded by (M) or (J).
(b) Let p ≤ p ∗ ∗ p\le p_{\ast\ast} p ≤ p ∗∗ , let the weights be profile weights and suppose that the decoder fails. Let C ∗ C^* C ∗ be a minimizer for which the decoder fails, with the smallest value of Φ \Phi Φ among these minimizers, and label the path γ ⊆ E △ C ∗ \gamma\subseteq E\triangle C^* γ ⊆ E △ C ∗ as in (a). Then no window of γ \gamma γ is excluded by (S).
Proof. (a) Suppose that a window σ \sigma σ of γ \gamma γ is excluded, and let P ′ P' P ′ be the walk or the union of walks of Definition 6.2. Let P ′ ′ P'' P ′′ be the set of edges that P ′ P' P ′ uses an odd number of times, so that w ( P ′ ′ ) ≤ w ( P ′ ) w(P'')\le w(P') w ( P ′′ ) ≤ w ( P ′ ) . Put ϵ e = − ln ( 1 − q e ) \epsilon_e=-\ln(1-q_e) ϵ e = − ln ( 1 − q e ) . Since q e ( 1 − q e ) ≤ r e ≤ q e q_e(1-q_e)\le r_e\le q_e q e ( 1 − q e ) ≤ r e ≤ q e , each weight satisfies ∣ w e + ln q e ∣ ≤ ϵ e \lvert w_e+\ln q_e\rvert\le\epsilon_e ∣ w e + ln q e ∣ ≤ ϵ e , and each ϵ e \epsilon_e ϵ e with e ∈ P ′ e\in P' e ∈ P ′ is at most − ln ( 1 − c max p ) -\ln(1-c_{\max}p) − ln ( 1 − c m a x p ) .
Under (M), P ′ ′ P'' P ′′ has the same detector boundary as σ \sigma σ , because b 1 b_1 b 1 , b 2 b_2 b 2 and B B B are not detectors, and we have
w ( σ C ) − w ( σ E ) − w ( P ′ ) ≥ k ln 1 p + ln c ( σ E ) c ( P ′ ) c ( σ C ) − ∑ e ∈ σ ϵ e − ∑ e ∈ P ′ ϵ e . w(\sigma_C)-w(\sigma_E)-w(P')
\ge
k\ln\frac{1}{p}
+\ln\frac{c(\sigma_E)c(P')}{c(\sigma_C)}
-\sum_{e\in\sigma}\epsilon_e
-\sum_{e\in P'}\epsilon_e. w ( σ C ) − w ( σ E ) − w ( P ′ ) ≥ k ln p 1 + ln c ( σ C ) c ( σ E ) c ( P ′ ) − e ∈ σ ∑ ϵ e − e ∈ P ′ ∑ ϵ e .
At p = p ∗ ∗ p=p_{\ast\ast} p = p ∗∗ the right side is positive by (6.1). As p p p decreases, the first term does not decrease, because k ≥ 0 k\ge0 k ≥ 0 , and each ϵ e \epsilon_e ϵ e decreases, so the right side stays positive. Hence w ( σ C ) − w ( σ E ) > w ( P ′ ′ ) w(\sigma_C)-w(\sigma_E)>w(P'') w ( σ C ) − w ( σ E ) > w ( P ′′ ) , which contradicts Lemma 6.1(a).
Under (J), each vertex of T ( σ ) T(\sigma) T ( σ ) is an end of exactly one walk, so P ′ ′ P'' P ′′ has the detector boundary T ( σ ) T(\sigma) T ( σ ) of σ C \sigma_C σ C . The same estimate without the terms of σ E \sigma_E σ E , and with (6.2) in place of (6.1), shows that w ( σ C ) > w ( P ′ ′ ) w(\sigma_C)>w(P'') w ( σ C ) > w ( P ′′ ) , which contradicts Lemma 6.1(b) for X = σ C X=\sigma_C X = σ C . (b) Suppose that the window ( u , b , w ) (u,b,w) ( u , b , w ) of γ \gamma γ is excluded by (S), with the detector x x x , and let Q Q Q be the cycle with the edges u b ub u b , b w bw b w , w x wx w x and x u xu xu . The edges u b ub u b and b w bw b w belong to C ∗ C^* C ∗ . The set C ′ = C ∗ △ Q C'=C^*\mathbin{\triangle} Q C ′ = C ∗ △ Q satisfies ∂ C ′ = ∂ C ∗ \partial C'=\partial C^* ∂ C ′ = ∂ C ∗ , and since Q Q Q has no edge at b 1 b_1 b 1 , the decoder predicts the same logical flip with C ′ C' C ′ as with C ∗ C^* C ∗ . Since profile weights agree on edges with the same profile, w ( u x ) + w ( x w ) = w ( u b ) + w ( b w ) w(ux)+w(xw)=w(ub)+w(bw) w ( ux ) + w ( x w ) = w ( u b ) + w ( b w ) . If neither u x ux ux nor x w xw x w belongs to C ∗ C^* C ∗ , then w ( C ′ ) = w ( C ∗ ) w(C')=w(C^*) w ( C ′ ) = w ( C ∗ ) , so C ′ C' C ′ is a minimizer for which the decoder fails, and Φ ( C ′ ) − Φ ( C ∗ ) = 2 ( ϕ ( x ) − ϕ ( b ) ) < 0 \Phi(C')-\Phi(C^*)=2(\phi(x)-\phi(b))<0 Φ ( C ′ ) − Φ ( C ∗ ) = 2 ( ϕ ( x ) − ϕ ( b )) < 0 , which contradicts the choice of C ∗ C^* C ∗ . If exactly one of them, say x w xw x w , belongs to C ∗ C^* C ∗ , then w ( C ′ ) = w ( C ∗ ) − w ( u b ) − w ( b w ) − w ( x w ) + w ( u x ) = w ( C ∗ ) − 2 w ( x w ) w(C')=w(C^*)-w(ub)-w(bw)-w(xw)+w(ux)=w(C^*)-2w(xw) w ( C ′ ) = w ( C ∗ ) − w ( u b ) − w ( b w ) − w ( x w ) + w ( ux ) = w ( C ∗ ) − 2 w ( x w ) , and if both do, then w ( C ′ ) = w ( C ∗ ) − w ( Q ) w(C')=w(C^*)-w(Q) w ( C ′ ) = w ( C ∗ ) − w ( Q ) . In both cases w ( C ′ ) < w ( C ∗ ) w(C')<w(C^*) w ( C ′ ) < w ( C ∗ ) , which contradicts the minimality of C ∗ C^* C ∗ .
For example, for a window made of C-edges only, k ≥ 0 k\geq0 k ≥ 0 says that the alternative has at most as many edges as the window. For mixed windows, rule (M) uses the E-edges as well: the correction edges of a window weigh at most as much as its error edges together with any alternative. Rule (J) uses only the correction edges, but it can re-pair the ends of two separate runs of them.
Labelled paths
A labelled path is a simple path b 1 = v 0 , v 1 , … , v L = b 2 b_1=v_0,v_1,\ldots,v_L=b_2 b 1 = v 0 , v 1 , … , v L = b 2 in G G G with a label E or C on each edge, none of whose sub-paths with 2, 3 or 4 edges is, with its labels, an excluded window. Its weight is
ω ( γ ) = ∏ E - e d g e s q e 1 − s ( 1 − q e ) − s ∏ C - e d g e s ( q e 1 − q e ) s , \omega(\gamma)=\prod_{\mathrm{E\text{-}edges}}q_e^{1-s}(1-q_e)^{-s}\prod_{\mathrm{C\text{-}edges}}\left(\frac{q_e}{1-q_e}\right)^s, ω ( γ ) = E - edges ∏ q e 1 − s ( 1 − q e ) − s C - edges ∏ ( 1 − q e q e ) s ,
and we write ω ( e , l ) \omega(e,l) ω ( e , l ) for the factor of an edge e e e with label l l l .
Proposition 6.4. For every p ≤ p ∗ ∗ p\leq p_{**} p ≤ p ∗∗ , P f a i l P_{\mathrm{fail}} P fail is at most the total weight of all labelled paths, provided that for part (b) the weights are profile weights.
Proof. Suppose the decoder fails. For part (a) let C C C be the minimizer that it returns, and for part (b) let C = C ∗ C=C^* C = C ∗ be the minimizer of Lemma 6.3 (b). In both cases the decoder fails with C C C . Let γ ⊆ E △ C \gamma\subseteq E\mathbin{\triangle}C γ ⊆ E △ C be the path of Lemma 3.1 , and label the edges of γ ∩ E \gamma\cap E γ ∩ E by E and those of γ ∩ C \gamma\cap C γ ∩ C by C. By Lemma 6.3 no sub-path of γ \gamma γ with at most four edges is, with these labels, an excluded window, so γ \gamma γ with these labels is a labelled path. Its set S S S of E-edges satisfies S ⊆ E S\subseteq E S ⊆ E and, by Lemma 3.3 , w ( S ) ≥ w ( γ ∖ S ) w(S)\geq w(\gamma\setminus S) w ( S ) ≥ w ( γ ∖ S ) . By the union bound and Lemma 3.4 , P f a i l P_{\mathrm{fail}} P fail is at most the sum of ∏ e ∈ γ q e \prod_{e\in\gamma}q_e ∏ e ∈ γ q e over labelled paths. As in the proof of Lemma 3.5 , we have ∏ e ∈ γ q e ≤ ∏ e ∈ S q e e s w e ∏ e ∈ γ ∖ S e − s w e \prod_{e\in\gamma}q_e\leq\prod_{e\in S}q_e e^{s w_e}\prod_{e\in\gamma\setminus S}e^{-s w_e} ∏ e ∈ γ q e ≤ ∏ e ∈ S q e e s w e ∏ e ∈ γ ∖ S e − s w e . Because q e ( 1 − q e ) ≤ r e ≤ q e q_e(1-q_e)\leq r_e\leq q_e q e ( 1 − q e ) ≤ r e ≤ q e , we have q e e s w e ≤ q e 1 − s ( 1 − q e ) − s q_e e^{s w_e}\leq q_e^{1-s}(1-q_e)^{-s} q e e s w e ≤ q e 1 − s ( 1 − q e ) − s and e − s w e ≤ ( q e / ( 1 − q e ) ) s e^{-s w_e}\leq(q_e/(1-q_e))^s e − s w e ≤ ( q e / ( 1 − q e ) ) s .
A criterion with memory
A state is a path v 0 , v 1 , v 2 , v 3 v_0,v_1,v_2,v_3 v 0 , v 1 , v 2 , v 3 of distinct vertices with v 1 , v 2 , v 3 ∈ V v_1,v_2,v_3\in V v 1 , v 2 , v 3 ∈ V and v 0 ∈ V ∪ { b 1 } v_0\in V\cup\{b_1\} v 0 ∈ V ∪ { b 1 } , together with labels l 1 l 2 l 3 l_1l_2l_3 l 1 l 2 l 3 of its three edges. Its successors are the states ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) (v_1,v_2,v_3,v_4;l_2l_3l_4) ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) with v 4 ∈ V ∖ { v 0 , v 1 , v 2 } v_4\in V\setminus\{v_0,v_1,v_2\} v 4 ∈ V ∖ { v 0 , v 1 , v 2 } , and its terminal moves are the edges { v 3 , b 2 } \{v_3,b_2\} { v 3 , b 2 } with a label l 4 l_4 l 4 . In both cases we require that none of the windows ( v 2 , v 3 , v 4 ) (v_2,v_3,v_4) ( v 2 , v 3 , v 4 ) , ( v 1 , … , v 4 ) (v_1,\ldots,v_4) ( v 1 , … , v 4 ) and ( v 0 , … , v 4 ) (v_0,\ldots,v_4) ( v 0 , … , v 4 ) , with the labels l 3 l 4 l_3l_4 l 3 l 4 , l 2 l 3 l 4 l_2l_3l_4 l 2 l 3 l 4 and l 1 ⋯ l 4 l_1\cdots l_4 l 1 ⋯ l 4 , is excluded, where v 4 = b 2 v_4=b_2 v 4 = b 2 for terminal moves. These three windows have the head v 3 v_3 v 3 .
Lemma 6.5. Let λ > 0 \lambda>0 λ > 0 , and let H H H assign a positive number to every state. Suppose that every state σ = ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) \sigma=(v_0,v_1,v_2,v_3;l_1l_2l_3) σ = ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) satisfies
∑ s u c c e s s o r s ω ( v 3 v 4 , l 4 ) H ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) + ∑ t e r m i n a l m o v e s ω ( v 3 b 2 , l 4 ) ≤ λ H ( σ ) . (6) \sum_{\mathrm{successors}}\omega(v_3v_4,l_4)H(v_1,v_2,v_3,v_4;l_2l_3l_4)+\sum_{\mathrm{terminal\ moves}}\omega(v_3b_2,l_4)\leq\lambda H(\sigma). \tag*{(6)} successors ∑ ω ( v 3 v 4 , l 4 ) H ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) + terminal moves ∑ ω ( v 3 b 2 , l 4 ) ≤ λ H ( σ ) . (6)
Then for every L ≥ 4 L\geq4 L ≥ 4 the labelled paths with L L L edges have total weight at most
λ L − 3 ∑ ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) H ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) , \lambda^{L-3}\sum\omega(b_1v_1,l_1)\omega(v_1v_2,l_2)\omega(v_2v_3,l_3)H(b_1,v_1,v_2,v_3;l_1l_2l_3), λ L − 3 ∑ ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) H ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) ,
where the sum runs over the states with v 0 = b 1 v_0=b_1 v 0 = b 1 .
Proof. For a state σ \sigma σ and m ≥ 1 m\ge1 m ≥ 1 let W m ( σ ) W_m(\sigma) W m ( σ ) be the total weight of the sequences of m m m edges that continue σ \sigma σ by successors and end with a terminal move, the weight being the product of the factors of the new edges. Then W 1 ( σ ) W_1(\sigma) W 1 ( σ ) is the terminal sum in (6.3), so W 1 ( σ ) ≤ λ H ( σ ) W_1(\sigma)\le\lambda H(\sigma) W 1 ( σ ) ≤ λ H ( σ ) , and for m ≥ 2 m\ge2 m ≥ 2 , by induction,
W m ( σ ) = ∑ successors ω ( v 3 v 4 , l 4 ) W m − 1 ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) ≤ λ m H ( σ ) . W_m(\sigma)=\sum_{\text{successors}}\omega(v_3v_4,l_4)W_{m-1}(v_1,v_2,v_3,v_4;l_2l_3l_4)\le\lambda^m H(\sigma). W m ( σ ) = successors ∑ ω ( v 3 v 4 , l 4 ) W m − 1 ( v 1 , v 2 , v 3 , v 4 ; l 2 l 3 l 4 ) ≤ λ m H ( σ ) .
A labelled path b 1 , v 1 , … , v L b_1,v_1,\ldots,v_L b 1 , v 1 , … , v L begins with the state ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) (b_1,v_1,v_2,v_3;l_1l_2l_3) ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) , and each quadruple of consecutive vertices is a successor of the previous one. Indeed v i + 1 ∉ { v i − 2 , v i − 1 , v i } v_{i+1}\notin\{v_{i-2},v_{i-1},v_i\} v i + 1 ∈ / { v i − 2 , v i − 1 , v i } because the path is simple, and the windows ending at v i + 1 v_{i+1} v i + 1 are not excluded because the path is labelled. Hence the labelled paths with L L L edges have total weight at most ∑ ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) W L − 3 ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) \sum\omega(b_1v_1,l_1)\omega(v_1v_2,l_2)\omega(v_2v_3,l_3)W_{L-3}(b_1,v_1,v_2,v_3;l_1l_2l_3) ∑ ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) W L − 3 ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) .
Classes and locality
The certificate assigns the same potential to states with the same class and the same labels. Here the class of ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) (v_0,v_1,v_2,v_3;l_1l_2l_3) ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) records the types of v 0 v_0 v 0 (or the label b 1 b_1 b 1 ), v 1 v_1 v 1 , v 2 v_2 v 2 and v 3 v_3 v 3 and the offsets v 1 − v 0 v_1-v_0 v 1 − v 0 , v 2 − v 1 v_2-v_1 v 2 − v 1 and v 3 − v 2 v_3-v_2 v 3 − v 2 . We call the inequality (6.3), written in terms of classes, labels and edge coefficients, the row of the state. The growth rate of a set of rows is the infimum of the λ \lambda λ for which some positive potential satisfies all of them. The typed ball of a detector v v v is the set of pairs (offset u − v u-v u − v , type of u u u ) over the detectors u u u in the ball of v v v .
Lemma 6.6. The rows of the states ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) (v_0,v_1,v_2,v_3;l_1l_2l_3) ( v 0 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) with a given last vertex v 3 v_3 v 3 are determined by the typed ball of v 3 v_3 v 3 . The sum of ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) H ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) \omega(b_1v_1,l_1)\omega(v_1v_2,l_2)\omega(v_2v_3,l_3)H(b_1,v_1,v_2,v_3;l_1l_2l_3) ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 v 3 , l 3 ) H ( b 1 , v 1 , v 2 , v 3 ; l 1 l 2 l 3 ) over the states with a given neighbour v 1 v_1 v 1 of b 1 b_1 b 1 is determined by the typed ball of v 1 v_1 v 1 . Every typed ball of every graph G d , T G_{d,T} G d , T occurs in some G d ′ , T ′ G_{d',T'} G d ′ , T ′ with d ′ ≤ 25 d'\le25 d ′ ≤ 25 and T ′ ≤ 13 T'\le13 T ′ ≤ 13 .
Proof. The vertices of a state ending at v 3 v_3 v 3 and of its successors lie within three edges of v 3 v_3 v 3 , and their classes and the coefficients of the edges involved are read from types and offsets. Since the windows tested in these rows have the head v 3 v_3 v 3 , the exclusion tests use only walks whose detectors lie in the ball of v 3 v_3 v 3 , the edges among these detectors and their boundary edges, all of which the types record. Rule (S) uses a detector within two edges of the head and the profiles of four edges between detectors of the ball. The profiles of the edges at a detector v v v are determined by the same local data as its type in Lemma 2.3(b), because the outcomes with v v v in their signature and their locations are, and they are in fact determined by the type of v † v^\dagger v † . So the types record these profiles as well. The start sums involve v 2 ∼ v 1 v_2\sim v_1 v 2 ∼ v 1 , v 3 ∼ v 2 v_3\sim v_2 v 3 ∼ v 2 and no exclusions.
A chain of at most four edges between detectors changes each coordinate by at most 16 and the layer by at most 4. By Lemma 2.3(b), the typed ball of v 3 v_3 v 3 is therefore determined by the positions of the cubits within ℓ ∞ \ell^\infty ℓ ∞ -distance 22 of v 3 v_3 v 3 and the X X X or Z Z Z types of the measure qubits among them, by min ( r , 6 ) \min(r,6) min ( r , 6 ) and by min ( T − r , 6 ) \min(T-r,6) min ( T − r , 6 ) , where r r r is the layer of v 3 v_3 v 3 . The last statement follows as in Lemma 2.3(c), with 6 replaced by 22 and 2 by 6. Indeed, the even coordinates of G 25 G_{25} G 25 at distance at least 23 from both opposite sides are 24 and 26, one of each residue modulo 4, and the layer data of every layer occur for T ′ = 13 T'=13 T ′ = 13 .
Proof of Theorem 1.2
Put λ 0 = 997 / 1000 \lambda_0=997/1000 λ 0 = 997/1000 for part (a) and λ 0 = 999 / 1000 \lambda_0=999/1000 λ 0 = 999/1000 for part (b). The instances with d ≤ 25 d\le25 d ≤ 25 and T ≤ 13 T\le13 T ≤ 13 have 2,546,882 distinct rows for part (a) and 2,545,552 for part (b)1 , and by Lemma 6.6 these are all the rows of all graphs G d , T G_{d,T} G d , T . Each of the two certificates assigns a positive integer h h h to each of the 953,120 pairs of a class and a label sequence l 1 l 2 l 3 l_1l_2l_3 l 1 l 2 l 3 that occur, and we put H = h / 10 15 H=h/10^{15} H = h /1 0 15 . All rows hold in exact integer arithmetic at p = p ∗ ∗ p=p_{**} p = p ∗∗ with λ = λ 0 \lambda=\lambda_0 λ = λ 0 , when each factor ω ( e , l ) \omega(e,l) ω ( e , l ) is replaced by a rational upper bound computed with integer roots of order 50 for part (a) and 25 for part (b)1 (Table 4 ). Let p ≤ p ∗ ∗ p\le p_{**} p ≤ p ∗∗ and ρ = ( p / p ∗ ∗ ) s \rho=(p/p_{**})^s ρ = ( p / p ∗∗ ) s . Then each factor satisfies ω ( e , l ) ( p ) ≤ ρ ω ( e , l ) ( p ∗ ∗ ) \omega(e,l)(p) \le\rho\omega(e,l)(p_{**}) ω ( e , l ) ( p ) ≤ ρ ω ( e , l ) ( p ∗∗ ) , because ( p / p ∗ ∗ ) 1 − s ≤ ρ (p/p_{**})^{1-s} \le\rho ( p / p ∗∗ ) 1 − s ≤ ρ and ( 1 − q e ) − 1 (1-q_e)^{-1} ( 1 − q e ) − 1 decreases as p p p decreases. Windows excluded by (M) or (J) stay excluded by Lemma 6.3 (a), and rule (S) does not depend on p p p . Hence all rows hold at p p p with λ p = λ 0 ρ \lambda_p=\lambda_0\rho λ p = λ 0 ρ . Let K K K be an upper bound, computed with the same rational bounds of the factors, for the start sums of Lemma 6.6 at p ∗ ∗ p_{**} p ∗∗ over all neighbours v 1 v_1 v 1 of b 1 † b_1^\dagger b 1 † . Let K 3 K_3 K 3 be an upper bound of the same kind for the sums of ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 b 2 , l 3 ) \omega(b_1v_1,l_1)\omega(v_1v_2,l_2)\omega(v_2b_2,l_3) ω ( b 1 v 1 , l 1 ) ω ( v 1 v 2 , l 2 ) ω ( v 2 b 2 , l 3 ) over the paths b 1 , v 1 , v 2 , b 2 b_1,v_1,v_2,b_2 b 1 , v 1 , v 2 , b 2 with a given v 1 v_1 v 1 and all labels{sup}†; such paths exist only for d = 3 d=3 d = 3 . For part (a) K = 0.031062 … K=0.031062\ldots K = 0.031062 … and K 3 = 0.032106 … K_3=0.032106\ldots K 3 = 0.032106 … , and for part (b) K = 0.056229 … K=0.056229\ldots K = 0.056229 … and K 3 = 0.064013 … K_3=0.064013\ldots K 3 = 0.064013 … . From Proposition 6.4, Lemma 6.5 and Lemma 3.2 we obtain
Table 4. Computer verification for Theorem 1.2 . Rows S1–S5 concern part (a). Lemma 6.6 needs d ≤ 25 d \le25 d ≤ 25 and T ≤ 13 T \le13 T ≤ 13 .
P f a i l ≤ ∣ N ( b 1 ) ∣ ( ρ 3 K 3 [ d = 3 ] + ∑ L ≥ max ( d , 4 ) λ p L − 3 ρ 3 K ) ≤ ρ 3 ∣ N ( b 1 ) ∣ ( K + K 3 ) λ p d − 3 1 − λ p . P_{\mathrm{fail}} \leq\lvert N(b_1)\rvert\left(\rho^3K_3[d=3]+\sum_{L\geq\max(d,4)}\lambda_p^{L-3}\rho^3K\right)\leq\rho^3\lvert N(b_1)\rvert(K+K_3)\frac{\lambda_p^{d-3}}{1-\lambda_p}. P fail ≤ ∣ N ( b 1 )∣ ρ 3 K 3 [ d = 3 ] + L ≥ m a x ( d , 4 ) ∑ λ p L − 3 ρ 3 K ≤ ρ 3 ∣ N ( b 1 )∣ ( K + K 3 ) 1 − λ p λ p d − 3 .
Recall that ∣ N ( b 1 ) ∣ = ( T + 1 ) ( d + 1 ) / 2 \lvert N(b_1)\rvert=(T+1)(d+1)/2 ∣ N ( b 1 )∣ = ( T + 1 ) ( d + 1 ) /2 by Lemma 2.1 (e). With ρ = λ p / λ 0 \rho=\lambda_p/\lambda_0 ρ = λ p / λ 0 the right side equals ( K + K 3 ) ( T + 1 ) ( d + 1 ) λ p d / ( 2 λ 0 3 ( 1 − λ p ) ) (K+K_3)(T+1)(d+1)\lambda_p^d/(2\lambda_0^3(1-\lambda_p)) ( K + K 3 ) ( T + 1 ) ( d + 1 ) λ p d / ( 2 λ 0 3 ( 1 − λ p )) , and ( K + K 3 ) / ( 2 λ 0 3 ) (K+K_3)/(2\lambda_0^3) ( K + K 3 ) / ( 2 λ 0 3 ) is at most 0.032 0.032 0.032 for part (a) and 0.061 0.061 0.061 for part (b). □
The lean schedule
In the lean schedule all measure qubits and data qubits are prepared in a first step, the Z-type measure qubits in ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ and the X-type ones in ∣ + ⟩ \lvert+\rangle ∣ + ⟩ . Each round then consists of the steps (S3)–(S6) of § 1.1 and one more step. In it each Z-type measure qubit is measured in the Z basis and reset to ∣ 0 ⟩ \lvert0\rangle ∣ 0 ⟩ , each X-type measure qubit is measured in the X basis and reset to ∣ + ⟩ \lvert+\rangle ∣ + ⟩ , and the data qubits are idle. The noise model of § 1.2 applies to these locations, the measurement and the reset in this step failing independently, each with probability p p p . The detectors, the logical outcomes and the decoder are as before.
§ 2 carries over with the following changes{sup}†. Each fault outcome again flips at most two detectors, and Lemma 2.1 holds with c max = 94 / 15 c_{\max}=94/15 c m a x = 94/15 . In the bulk of basis Z, the coefficients 15 c e 15c_e 15 c e of the edges with offsets ± ( 0 , 0 , 1 ) \pm(0,0,1) ± ( 0 , 0 , 1 ) , ± ( 2 , − 2 , 0 ) \pm(2,-2,0) ± ( 2 , − 2 , 0 ) , ± ( 2 , 2 , 0 ) \pm(2,2,0) ± ( 2 , 2 , 0 ) , ± ( 2 , 2 , − 1 ) \pm(2,2,-1) ± ( 2 , 2 , − 1 ) , ± ( 2 , − 2 , − 1 ) \pm(2,-2,-1) ± ( 2 , − 2 , − 1 ) and ± ( 4 , 0 , − 1 ) \pm(4,0,-1) ± ( 4 , 0 , − 1 ) are 46, 42, 18, 16, 8 and 8, against 66, 72, 48, 16, 8 and 8 in Lemma 2.2. The difference comes from the three idle steps per round of the data qubits and the two of the Z-type measure qubits that the lean schedule does not have. There are again 29 node types per basis. We count the reset in the measure-and-reset step, and the first step, as the start of the next round. With this convention a measure qubit is again reset at the start of each round, and the proofs of Lemmas 2.3 and 6.6 , which use only the layout, the CX orders and this structure of the rounds, apply verbatim. All edges again change each coordinate by at most 4 and the layer by at most 1.
Proof of Theorem 1.3. (a) As in § 5 , with λ = 25.55 p \lambda=25.55\sqrt{p} λ = 25.55 p . At p = 1.53 × 10 − 3 p=1.53\times10^{-3} p = 1.53 × 1 0 − 3 we have 25.55 p ≥ 0.9993 25.55\sqrt{p}\geq0.9993 25.55 p ≥ 0.9993 , and the criterion (5.1), with 0.9997 0.9997 0.9997 replaced by 0.9993 0.9993 0.9993 , holds for all types, with largest left side 0.99794 0.99794 0.99794 at the bulk type and 0.95318 0.95318 0.95318 for the others{sup}†. With c max = 94 / 15 c_{\max}=94/15 c m a x = 94/15 , the assembly of § 5 then leads to the prefactor c max / ( 1 − c max p ) / 25.55 ≤ 0.0985 \sqrt{c_{\max}/(1-c_{\max}p)}/25.55\leq0.0985 c m a x / ( 1 − c m a x p ) /25.55 ≤ 0.0985 .
(b) As in § 6 , with p ∗ ∗ = 3 / 1250 p_{**}=3/1250 p ∗∗ = 3/1250 , s = 21 / 50 s=21/50 s = 21/50 and c max = 94 / 15 c_{\max}=94/15 c m a x = 94/15 in Definition 6.2. The instances with d ≤ 25 d\leq25 d ≤ 25 and T ≤ 13 T\leq13 T ≤ 13 have 2,548,765 distinct rows, all of which already occur for d ≤ 15 d\leq15 d ≤ 15 and T ≤ 7 T\leq7 T ≤ 7 . A certificate with positive integers on the 953,120 pairs of a class and a label sequence satisfies all rows in exact arithmetic with λ = 997 / 1000 \lambda=997/1000 λ = 997/1000 , and the start constants are K = 0.026464 … K=0.026464\ldots K = 0.026464 … and K 3 = 0.028384 … K_3=0.028384\ldots K 3 = 0.028384 … , with ( K + K 3 ) / ( 2 ⋅ 0.997 3 ) ≤ 0.028 s u p † (K+K_3)/(2\cdot0.997^3)\leq0.028{sup}\dagger ( K + K 3 ) / ( 2 ⋅ 0.99 7 3 ) ≤ 0.028 s u p † .
(c) As in part (b) of Theorem 1.2 , with p ∗ ∗ = 3 / 1000 p_{**}=3/1000 p ∗∗ = 3/1000 , s = 9 / 25 s=9/25 s = 9/25 , λ 0 = 997 / 1000 \lambda_0=997/1000 λ 0 = 997/1000 and c max = 94 / 15 c_{\max}=94/15 c m a x = 94/15 . The instances with d ≤ 25 d\leq25 d ≤ 25 and T ≤ 13 T\leq13 T ≤ 13 have 2,547,432 distinct rows. Again, a certificate on the same 953,120 pairs satisfies all rows in exact arithmetic with λ = 997 / 1000 \lambda=997/1000 λ = 997/1000 , and the start constants are K = 0.045261 … K=0.045261\ldots K = 0.045261 … and K 3 = 0.057416 … K_3=0.057416\ldots K 3 = 0.057416 … , with ( K + K 3 ) / ( 2 ⋅ 0.997 3 ) ≤ 0.052 s u p † (K+K_3)/(2\cdot0.997^3)\leq0.052{sup}\dagger ( K + K 3 ) / ( 2 ⋅ 0.99 7 3 ) ≤ 0.052 s u p † . □
Non-uniform error rates
In a real device the gates, measurements and idle steps fail at different rates. To model this, we sort the locations of the circuit of Section 1.1 into seven categories: resets and preparations; measurements; H H H gates; CX gates; qubits idle in steps (S2)–(S7); data qubits idle in step (S1); data qubits idle in step (S8). A rate vector θ \theta θ assigns a failure probability θ k \theta_k θ k to the locations of category k k k , with the failure outcomes of Section 1.2. The probability of an edge becomes
q e ( θ ) = ∑ k c e , k θ k , q_e(\theta)=\sum_k c_{e,k}\theta_k, q e ( θ ) = k ∑ c e , k θ k ,
where c e , k c_{e,k} c e , k is the sum of π ( f ) \pi(f) π ( f ) over the outcomes f f f with e ( f ) = e e(f)=e e ( f ) = e at locations of category k k k , so that ∑ k c e , k = c e \sum_k c_{e,k}=c_e ∑ k c e , k = c e . The graph, the signatures and the logical effects do not depend on θ \theta θ , and Sections 2 and 3 hold with q e ( θ ) q_e(\theta) q e ( θ ) in place of c e p c_ep c e p . The types, which now record the coefficients c e , k c_{e,k} c e , k , are again 29 per basis, and Lemma 2.3 holds with the same proof1 .
Theorem 8.1. Let θ \theta θ be a rate vector with max e q e ( θ ) < 1 / 2 \max_e q_e(\theta)<1/2 max e q e ( θ ) < 1/2 , and consider the memory experiment with rates t θ t\theta tθ for some 0 < t ≤ 1 0<t\leq1 0 < t ≤ 1 .
(a) Suppose that ∑ e ∋ v a e / ( λ + a e ) ≤ 1 \sum_{e\ni v}a_e/(\lambda+a_e)\leq1 ∑ e ∋ v a e / ( λ + a e ) ≤ 1 at every detector v v v , where a e = 2 q e ( θ ) / ( 1 − q e ( θ ) ) a_e=2\sqrt{q_e(\theta)}/(1-q_e(\theta)) a e = 2 q e ( θ ) / ( 1 − q e ( θ )) and λ < 1 \lambda<1 λ < 1 . Then
P f a i l ≤ ( T + 1 ) ( d + 1 ) 2 ⋅ a max λ ⋅ ( λ t ) d 1 − λ t . P_{\mathrm{fail}}\leq\frac{(T+1)(d+1)}{2}\cdot\frac{a_{\max}}{\lambda}\cdot\frac{(\lambda\sqrt{t})^d}{1-\lambda\sqrt{t}}. P fail ≤ 2 ( T + 1 ) ( d + 1 ) ⋅ λ a m a x ⋅ 1 − λ t ( λ t ) d . where a max a_{\max} a m a x is the largest a e a_e a e over the edges at b 1 b_1 b 1 and b 2 b_2 b 2 .
(b) Let q ( P ) = ∏ e ∈ P q e ( θ ) q(P)=\prod_{e\in P}q_e(\theta) q ( P ) = ∏ e ∈ P q e ( θ ) , with multiplicity, and q max = max e q e ( θ ) q_{\max}=\max_e q_e(\theta) q m a x = max e q e ( θ ) . In Definition 6.2, replace (6.1) by
q ( σ E ) q ( P ′ ) q ( σ C ) > ∏ e ∈ σ 1 1 − q e ( θ ) ⋅ ( 1 1 − q max ) h ′ (7) \frac{q(\sigma_E)q(P')}{q(\sigma_C)}
>
\prod_{e\in\sigma}
\frac{1}{1-q_e(\theta)}
\cdot
\left(\frac{1}{1-q_{\max}}\right)^{h'} \tag*{(7)} q ( σ C ) q ( σ E ) q ( P ′ ) > e ∈ σ ∏ 1 − q e ( θ ) 1 ⋅ ( 1 − q m a x 1 ) h ′ (7) and (6.2) by
q ( P ′ ) q ( σ C ) > ∏ e ∈ σ C 1 1 − q e ( θ ) ⋅ ( 1 1 − q max ) h ′ (8) \frac{q(P')}{q(\sigma_C)}
>
\prod_{e\in\sigma_C}
\frac{1}{1-q_e(\theta)}
\cdot
\left(\frac{1}{1-q_{\max}}\right)^{h'} \tag*{(8)} q ( σ C ) q ( P ′ ) > e ∈ σ C ∏ 1 − q e ( θ ) 1 ⋅ ( 1 − q m a x 1 ) h ′ (8) keeping the conditions k ≥ 0 k\geq0 k ≥ 0 , and define labelled paths, states and rows as in Section 6 with the windows excluded by these two rules, with the factors ω ( e , l ) \omega(e,l) ω ( e , l ) evaluated at q e ( θ ) q_e(\theta) q e ( θ ) and with a tilt 0 < s ≤ 1 / 2 0<s\leq1/2 0 < s ≤ 1/2 . Suppose that a positive potential satisfies all rows with some λ < 1 \lambda<1 λ < 1 , and let K K K and K 3 K_3 K 3 be the largest start sums, as in Section 6. Then
P f a i l ≤ ( T + 1 ) ( d + 1 ) 2 ⋅ K + K 3 λ 3 ⋅ ( λ t s ) d 1 − λ t s . P_{\mathrm{fail}}\leq\frac{(T+1)(d+1)}{2}\cdot\frac{K+K_3}{\lambda^3}\cdot\frac{(\lambda t s)^d}{1-\lambda t s}. P fail ≤ 2 ( T + 1 ) ( d + 1 ) ⋅ λ 3 K + K 3 ⋅ 1 − λ t s ( λ t s ) d . (c) For a location ℓ \ell ℓ of category k k k let c ℓ , e ( θ ) c_{\ell,e}(\theta) c ℓ , e ( θ ) be the sum of θ k π ( f ) \theta_k\pi(f) θ k π ( f ) over the outcomes f f f of ℓ \ell ℓ with e ( f ) = e e(f)=e e ( f ) = e , and call the multiset of the nonzero numbers c ℓ , e ( θ ) c_{\ell,e}(\theta) c ℓ , e ( θ ) the profile of e e e at θ \theta θ . Suppose that r e r_e r e is a function of t t t and of this profile, and add rule (S) of Definition 6.2, with these profiles, to the two rules of part (b). If a positive potential satisfies all rows with some λ < 1 \lambda<1 λ < 1 , then the bound of part (b) holds with the start sums of these rows.
Proof. (a) For the rates t θ t\theta tθ each a e a_e a e is at most t a e \sqrt{t}a_e t a e , because 1 − t q e ( θ ) ≥ 1 − q e ( θ ) 1-tq_e(\theta)\geq1-q_e(\theta) 1 − t q e ( θ ) ≥ 1 − q e ( θ ) . Since x / ( λ t + x ) x/(\lambda\sqrt{t}+x) x / ( λ t + x ) increases in x x x , the criterion holds with λ t \lambda\sqrt{t} λ t in place of λ \lambda λ . The bound then follows from the assembly of Section 5, with t a max \sqrt{t}a_{\max} t a m a x in place of a max a_{\max} a m a x .
(b) Lemma 6.3(a) holds for the rates t θ t\theta tθ , with (8.1) and (8.2) in place of (6.1) and (6.2). In its proof the first two terms of the lower bound become k ln ( 1 / t ) + ln ( q ( σ E ) q ( P ′ ) / q ( σ C ) ) k\ln(1/t)+\ln(q(\sigma_E)q(P')/q(\sigma_C)) k ln ( 1/ t ) + ln ( q ( σ E ) q ( P ′ ) / q ( σ C )) under (M) and k ln ( 1 / t ) + ln ( q ( P ′ ) / q ( σ C ) ) k\ln(1/t)+\ln(q(P')/q(\sigma_C)) k ln ( 1/ t ) + ln ( q ( P ′ ) / q ( σ C )) under (J), and k ≥ 0 k\geq0 k ≥ 0 . Similarly, Lemma 6.6 holds with the same proof. Each factor satisfies ω ( e , l ) ( t θ ) ≤ t s ω ( e , l ) ( θ ) \omega(e,l)(t\theta) \le t^{s}\omega(e,l)(\theta) ω ( e , l ) ( tθ ) ≤ t s ω ( e , l ) ( θ ) , because t 1 − s ≤ t s t^{1-s} \le t^{s} t 1 − s ≤ t s for s ≤ 1 / 2 s \le1/2 s ≤ 1/2 . Hence all rows hold for the rates t θ t\theta tθ with λ t s \lambda t^{s} λ t s in place of λ \lambda λ , and every start sum is at most t 3 s t^{3s} t 3 s times its value at θ \theta θ . With ρ = t s \rho= t^{s} ρ = t s , the assembly of Section 6 yields the bound.
(c) The profiles at t θ t\theta tθ are t t t times those at θ \theta θ , so rule (S) does not depend on t t t , and Lemma 6.3(b) holds with the same proof: profile weights agree on edges with the same profile. The proof of part (b) then applies with the rows of part (c), and Proposition 6.4 uses the minimizer C ∗ C^* C ∗ of Lemma 6.3(b). □
Table 2 lists error models built from published component error rates of six devices, mapped onto the seven categories. Errors reported as average infidelities r r r , including the memory errors of the Quantinuum data sheets, are converted to Pauli error probabilities 3 r / 2 3r/2 3 r /2 (one qubit) and 5 r / 4 5r/4 5 r /4 (two qubits). Errors reported as Pauli errors, and the cross-entropy-benchmarking errors of Zuchongzhi 3.2, are used as they are. Readout and SPAM errors are used as measurement flip probabilities, and the SPAM errors of Helios and H2 also as reset failure probabilities. Rates that a source does not report are assumptions, listed with the sources in the accompanying files. The models are idealizations: they assume independent stochastic Pauli noise on the circuit of Section 1.1, whereas the devices use other native gates and schedules and also suffer leakage and correlated or coherent errors. Thus Theorem 8.1 applies to the stated models, not to the devices. Part (b), with s = 43 / 100 s = 43/100 s = 43/100 , certifies three models:
Quantinuum Helios:
P f a i l ≤ 0.033 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.75 t 43 / 100 P_{\mathrm{fail}} \le0.033\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.75t^{43/100} P fail ≤ 0.033 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.75 t 43/100
Quantinuum H2:
P f a i l ≤ 0.022 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.715 t 43 / 100 P_{\mathrm{fail}} \le0.022\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.715t^{43/100} P fail ≤ 0.022 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.715 t 43/100
IBM Heron r3, square grid:
P f a i l ≤ 0.023 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.97 t 43 / 100 P_{\mathrm{fail}} \le0.023\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.97t^{43/100} P fail ≤ 0.023 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.97 t 43/100
for their rates scaled by any t ≤ 1 t \le1 t ≤ 1 . For profile weights, part (c) with s = 19 / 50 s = 19/50 s = 19/50 improves these to
Quantinuum Helios:
P f a i l ≤ 0.058 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.675 t 19 / 50 P_{\mathrm{fail}} \le0.058\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.675t^{19/50} P fail ≤ 0.058 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.675 t 19/50
Quantinuum H2:
P f a i l ≤ 0.039 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.643 t 19 / 50 P_{\mathrm{fail}} \le0.039\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.643t^{19/50} P fail ≤ 0.039 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.643 t 19/50
IBM Heron r3, square grid:
P f a i l ≤ 0.039 ( T + 1 ) ( d + 1 ) λ d 1 − λ , λ = 0.873 t 19 / 50 P_{\mathrm{fail}} \le0.039\,(T+1)(d+1)\frac{\lambda^{d}}{1-\lambda},\qquad\lambda= 0.873t^{19/50} P fail ≤ 0.039 ( T + 1 ) ( d + 1 ) 1 − λ λ d , λ = 0.873 t 19/50
Part (a) also certifies Helios and H2, but it fails at λ = 1 \lambda= 1 λ = 1 for the other four models{sup}†. For the models of Google’s and USTC’s processors, floating-point estimates of the growth rate of the rows are 1.39, 1.45 and 1.52 for part (b) and 1.25, 1.30 and 1.36 for part (c).
Computer verification
Table 3 lists the computations behind the statements marked{sup}†. We compute the fault table by forward propagation of Pauli frames, independently of Stim’s detector-error-model code, and keep each Pauli outcome of each location with its exact probability. Over the full range there are 1,924,076 outcomes. The circuit file also declares the detectors of the other type, but the decoding graph of each sector ignores them. All comparisons in V6 use exact rational arithmetic. One run of the accompanying script performs all checks in the table and passes only if all of them hold.
Table 4 lists the checks behind Theorem 1.2. Two further scripts, one for each part, regenerate the rows of all instances with d ≤ 25 d \le25 d ≤ 25 and T ≤ 13 T \le13 T ≤ 13 and check them against the two certificates, each of which lists 953,120 integers h h h . By Lemma 6.6 the rows at a detector depend only on its typed ball, so each script computes the rows at one detector for each distinct typed ball in the range, which we call the heads; balls are compared as full tuples. The rows are generated by a C++ program with exact integer arithmetic. A Python implementation of the same rules produces the same rows at all detectors of five test instances with d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 , and of two instances with the rates of § 8 . Classes are named by 64-bit hashes of the types and offsets they record. A collision would merge two classes, but this can only make the system of rows harder to satisfy. Three further steps are not used in the proof: the iteration on the system of rows that found the potentials, and two tests of the exclusions. For the first test, let w e + = ln q e − ln ( 1 − q e ) w_e^{+} = \ln q_e - \ln(1-q_e) w e + = ln q e − ln ( 1 − q e ) and w e − = − ln q e + ln ( 1 − q e ) w_e^{-} = -\ln q_e + \ln(1-q_e) w e − = − ln q e + ln ( 1 − q e ) be the upper and lower bounds of the weights at p ∗ ∗ p_{**} p ∗∗ . For each excluded window, Dijkstra’s algorithm on G / B G/B G / B with the weights w + w^{+} w + finds an edge set with the same detector boundary as σ \sigma σ that is lighter than w − ( σ C ) − w + ( σ E ) w^{-}(\sigma_C) - w^{+}(\sigma_E) w − ( σ C ) − w + ( σ E ) , or an edge set with the same detector boundary as σ C \sigma_C σ C that is lighter than w − ( σ C ) w^{-}(\sigma_C) w − ( σ C ) . The test covers all 23.7 million excluded windows of the instances with d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 , with no failure, both at p ∗ ∗ = 1 / 625 p_{**} = 1/625 p ∗∗ = 1/625 and at p ∗ ∗ = 1 / 500 p_{**} = 1/500 p ∗∗ = 1/500 . The second test recomputes every exclusion by rule (S) from the decoding graph, with the profiles read from the fault table, and checks that the two pairs of edges have the same profiles. For d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 it confirms all 18,720 such windows for each schedule and finds no window that the rule misses.
The checks behind Theorem 1.3 (Table 5 ) are those of Table 3 and Table 4 , run on the lean schedule with its own certificates. The Dijkstra test of the exclusions finds no failure among the 23.6 million excluded windows of the 40 instances with d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 at p ∗ ∗ = 3 / 1250 p_{**} = 3/1250 p ∗∗ = 3/1250 , nor among the 23.5 million at p ∗ ∗ = 3 / 1000 p_{**} = 3/1000 p ∗∗ = 3/1000 .
Table 5. Computer verification for Theorem 1.3.
For § 8 , a further script runs the checks H1–H4 of Table 6 on the error models of Table 2 . For H4 it runs the script of rows S1–S5 with the edge probabilities q e ( θ ) q_e(\theta) q e ( θ ) , written as integers over a common denominator, in place of the coefficients, and check H5 runs the script of row S6 in the same way. As a test, with uniform rates this code gives the rows of the code of Table 4 for ( d , T ) = ( 5 , 3 ) (d,T) = (5,3) ( d , T ) = ( 5 , 3 ) , ( 7 , 4 ) (7,4) ( 7 , 4 ) and ( 9 , 5 ) (9,5) ( 9 , 5 ) , after renaming the classes and rescaling the numerators of the edges.
Table 2. Error models (Pauli error probabilities per location) and the rates λ \lambda λ of parts (a), (b) and (c) of Theorem 8.1 at t = 1 t = 1 t = 1 . Daggered values are certified exactly, those of (b) with s = 43 / 100 s = 43/100 s = 43/100 and those of (c) with s = 19 / 50 s = 19/50 s = 19/50 . Values in parentheses are not certificates: in column (a) they are floating-point roots of the criterion, and in columns (b) and (c) floating-point growth rates of the rows, computed from the instances with d ≤ 15 d \le15 d ≤ 15 and T ≤ 7 T \le7 T ≤ 7 , the smallest over s ∈ { 0.40 , 0.43 , 0.45 } s \in\{0.40, 0.43, 0.45\} s ∈ { 0.40 , 0.43 , 0.45 } for (b) and over a grid of s s s between 0.30 and 0.44 for (c). Helios and H2: typical values of the data sheets. Heron r3: medians of ibm boston on 2026-10-18, placed on a square grid, which the device does not have. Google 72q: the error budget of the 72-qubit processor in [11 Table S4] , with the CZ crosstalk and leakage rows added to the CX rate, and the leakage-heating row added to the data-idle error during measurement and reset, which is split over steps (S1) and (S8). Willow: mean simultaneous randomized-benchmarking errors of the spec sheet. Zuchongzhi 3.2: cross-entropy-benchmarking errors of the 97-qubit region, used as reported. Assumptions: the rates in the column “idle” for the IBM, Google and USTC models (for the Google models estimated from coherence times); the reset rates and the (S1) and (S8) idle rates of the IBM and USTC models; for Willow, the reset and data-idle rates of the 72-qubit budget; and for both Google models, the split of the data-idle error over (S1) and (S8).
Formal verification in Lean 4
We prove the theorems of this paper in the proof assistant Lean 4 (version 4.35.0-rc3), using the Mathlib library (commit c55e6e78). A proof assistant checks every step of a proof against a small set of logical rules; the part of Lean that performs this check is its kernel . The formal development defines the circuit, the noise, the memory experiment and the decoder of § 1 , and derives the bounds of the theorems from these definitions. It contains about 25,100 lines written by hand, together with generated data files (node types, certificates) and generated check files. Each theorem is proved in two versions: in the kernel version every computation is checked by the kernel, and in the native version the large computations are evaluated outside the kernel, which takes far less time. In this section we state what is proved, what has to be trusted, and how to reproduce the verification.
What is modelled
The circuit and the experiment. The layout of the rotated surface code, the eight steps of a round, the noise locations with their outcomes and the probabilities p π ( f ) p\mathop{\pi}(f) p π ( f ) are those of § 1.1 and § 1.2 . We define the effect of the faults by Pauli-frame propagation: a CX gate copies an X component from its control to its target and a Z component from its target to its control, an H gate exchanges the two components, and a reset clears both. For any set of faults, at most one outcome per location, this determines the recorded measurement outcomes, the detectors D m , r D_{m,r} D m , r of § 1.1 and the flip of the logical outcome. The formal development proves that these are the parities of the single-fault values, so they agree with the signatures σ ( f ) \sigma(f) σ ( f ) and the logical effects ℓ ( f ) \ell(f) ℓ ( f ) of § 1.3 .
The decoder and the failure probability. Here the decoding graph and the weights are those of § 1.3 , for any numbers r e r_e r e with q e ( 1 − q e ) ≤ r e ≤ q e q_e(1-q_e) \le r_e \le q_e q e ( 1 − q e ) ≤ r e ≤ q e ; this range contains both common choices. The failure probability P f a i l P_{\mathrm{fail}} P fail is the probability, under the product distribution of the faults, that some set C C C of minimum weight with ∂ C \partial C ∂ C equal to the observed detectors predicts the logical flip wrongly. Hence a bound on this probability holds for every rule that selects a minimizer.
Profile weights. The profile of an edge and profile weights are those of § 1.3 : for a location ℓ \ell ℓ , c ℓ , e c_{\ell,e} c ℓ , e is the sum of π ( f ) \pi(f) π ( f ) over the outcomes f f f of ℓ \ell ℓ with e ( f ) = e e(f)=e e ( f ) = e , the profile of e e e is the multiset of the nonzero numbers c ℓ , e c_{\ell,e} c ℓ , e over all locations ℓ \ell ℓ , and the weights are profile weights if r e r_e r e is a function of p p p and the profile of e e e . Note that both choices of § 1.3 are profile weights. The theorems that use rule (S) are stated for profile weights.
The lean schedule. We model the lean schedule of § 7 by its own Pauli-frame semantics: a preparation step, then per round four CX steps and a fused measure-and-reset step, in which the X-type measure qubits are measured in the X basis. Its noise locations are those of § 7 , including the reset failures after the last measurement. The development proves that every lean location changes the measurement outcomes and the final data values exactly as the corresponding location of the eight-step circuit restricted to the lean locations, and that the reset failures after the last measurement change nothing. Hence the lean experiment has the failure probability of the restricted eight-step circuit, and the formal theorems are about the lean schedule itself.
Non-uniform rates. A rate vector θ \theta θ assigns to each of the seven categories of § 8 the failure probability θ k \theta_k θ k , and the outcomes of a failed location are uniform. The formal theorems are stated for the three certified models, whose rates are those of the accompanying files, scaled by any 0 < t ≤ 1 0 < t \le1 0 < t ≤ 1 .
What is proved
Table 7 lists the formal theorems. Each holds for all odd d ≥ 3 d \ge3 d ≥ 3 , all T ≥ 1 T \ge1 T ≥ 1 and both bases, with the constants of the corresponding theorem of this paper. Their statements are the inequalities of Theorems 1.1 , 1.2 , 1.3 and 8.1 , written for the failure probability defined above.
Table 7. The formal theorems, and for each of their two versions the number of axioms it depends on besides the three standard ones. “Kernel”: every computation is checked by Lean’s kernel. “Native”: the large computation is evaluated outside the kernel, by compiled code or by Lean’s interpreter; each such evaluation enters the proof as one axiom (see the text). The standard axioms are propositional extensionality, the axiom of choice and quotient soundness.
What has to be trusted
A Lean proof can rely on axioms, which the kernel accepts without proof. Lean reports, for every theorem, the axioms it depends on. Every theorem of Table 7 depends on three standard axioms of Lean’s foundations (propositional extensionality, the axiom of choice and the soundness of quotients). The kernel versions depend on nothing else.
The native versions also depend on axioms of a second kind, one for each large computation. For such a computation Lean evaluates the Boolean test outside the kernel, with compiled code or with its interpreter, and records the outcome “true” as an axiom naming the test. Trusting these axioms means trusting, in addition to the kernel, Lean’s compiler, interpreter and runtime, the C compiler that builds the precompiled modules, and the assumption that the loaded libraries were built from the checked sources. The kernel itself already relies on the GMP library for arithmetic on large natural numbers. The computations are: the checks of Theorem 1.1 at representative detectors, which by Lemma 2.3(c) lie in instances with d ≤ 9 d \le9 d ≤ 9 and T ≤ 5 T \le5 T ≤ 5 (60 tests: the signatures of all fault outcomes near these detectors, and their node types); the type table of the circuit, with the edge profiles for rule (S); the coverage of all typed balls by the heads, and the number of heads; the rows and the start sums at the 13,658 heads (40 tests); the rational upper bounds of the factors; the bound on the numerators; and the criterion for the node types, used by parts (a) and by the native version of Theorem 1.1 .
In the kernel versions the kernel checks the same facts, in reformulated forms whose soundness is proved, split into generated files that are checked one per process: the rows and start sums at the 13,658 heads for each of the ten certificates (3,330 files), the coverage of the typed balls for the five models (107 files), the type tables (550 files), and the factor bounds and the search trees that hold the typed balls and the potentials. As in the native versions, the exclusion witnesses come from an untrusted search and are checked exactly. A further file compares the statement of each kernel theorem of Theorems 1.2 to 8.1 with the statement of its native version, and the two are identical; the two versions of Theorem 1.1 are stated by the same source text.
The certificates are read from the files of the supplement; the formal data files record the SHA-256 hash of each certificate file. Programs outside Lean generate the node types, the tables, the heads and the other auxiliary data from which the checks start. Because every item they produce is checked inside Lean, an error in them can only make a check fail. The search for exclusion witnesses is likewise untrusted: the rows accept a window as excluded only after the witness found by the search passes an exact check whose soundness is proved.
Two cross-checks support the model without being part of the proof. The node types computed in Lean coincide, as strings including all coefficients, with the node types of the accompanying programs for all five models (the eight-step circuit, the lean schedule built by those programs from its own circuit description through Stim, and the three non-uniform models). All five models have the same 13,658 typed balls on the range of Lemma 6.6 .
Cost
Table 8 lists the measured cost of the checks. Each check runs as a separate Lean process.
Table 8. Cost of the formal checks: number of files, sum over the files of the time per process, and the largest memory of one process. The remaining files, which combine the checks and state the theorems of the native versions and of Theorem 1.1, take about one minute in total and up to 4.0 GiB, and the comparison of the statements takes 5 s and 16.2 GiB.
Reproduction
The formal development is part of the supplement, with a README that lists the commands. First, the definitions and proofs build with Lean’s build tool. Then the scripts below compile the check files, each in its own Lean process and, except for Theorem 1.1, with the precompiled computational modules (QECComp) loaded. Finally the files that combine the checks and state the theorems are compiled, and each prints the axioms of its theorems:
lake build QEC QECComp
scripts/run_checks.sh # Theorem 1.1, kernel
scripts/run_final.sh # Theorem 1.1, native
scripts/run_checks8.sh # Theorem 1.2(a)
for X in L He Hl H2; do # Theorems 1.3(b), 8.1(b)
scripts/run_checksW.sh $X
done
scripts/run_finalW.sh # parts (a), theorem files
for X in S8 SL SHe SHl SH2; do # 1.2(b), 1.3(c), 8.1(c)
scripts/run_checksS.sh $X
done
scripts/run_finalS.sh # profile tables, theorem files
After these commands, one script builds the kernel versions of Theorems 1.2 to 8.1 in stages, one file per process; the README lists the stages and the numbers of parallel jobs. A final file, gen/kernel/StmtV3.lean, compares their statements with those of the native versions and prints their axioms.
Table 9 maps the parts of this paper to the files of the development.
Table 9. Where the parts of the paper are formalized.
Remarks
the heavier boundary edges are taken into account. Two changes account for the improvement to 1.04 × 10 − 3 1.04 \times10^{-3} 1.04 × 1 0 − 3 . First, log-likelihood weights let each edge contribute 2 q e 2\sqrt{q_e} 2 q e instead of 2 q max 2\sqrt{q_{\max}} 2 q m a x . Second, the criterion of Lemma 4.1 replaces the factor 11 by an exact count of the twelve unequal edges at each node. At the bulk node with λ = 1 \lambda= 1 λ = 1 the left side of the criterion is below 1 at p = 1.0419 × 10 − 3 p = 1.0419 \times10^{-3} p = 1.0419 × 1 0 − 3 but above 1 at p = 1.0420 × 10 − 3 p = 1.0420 \times10^{-3} p = 1.0420 × 1 0 − 3 , so the method cannot reach beyond 1.042 × 10 − 3 1.042 \times10^{-3} 1.042 × 1 0 − 3 . As p → 0 p \to0 p → 0 the bulk root of Σ = 1 \Sigma= 1 Σ = 1 is λ = Λ p \lambda= \Lambda\sqrt{p} λ = Λ p with Λ = 30.929 \Lambda= 30.929 Λ = 30.929 , the solution of ∑ e 2 c e / ( Λ + 2 c e ) = 1 \sum_e 2\sqrt{c_e}/(\Lambda+ 2\sqrt{c_e}) = 1 ∑ e 2 c e / ( Λ + 2 c e ) = 1 over the bulk coefficients. With unit weights the same method gives 8.7 × 10 − 4 8.7 \times10^{-4} 8.7 × 1 0 − 4 in the bulk.
Remark 11.2 (Limits of the certificate). Consider the rows of § 6 computed from the instances with d ≤ 15 d \le15 d ≤ 15 and T ≤ 7 T \le7 T ≤ 7 , with the exclusions at each p p p . Their growth rate is 0.99407 at p = 1.6 × 10 − 3 p = 1.6 \times10^{-3} p = 1.6 × 1 0 − 3 for the rules of part (a) with s = 0.42 s = 0.42 s = 0.42 , and 0.99744 to 0.99751 at p = 2 × 10 − 3 p = 2 \times10^{-3} p = 2 × 1 0 − 3 for the rules of part (b) with s = 0.36 s = 0.36 s = 0.36 . But for every tilt s s s it is above 1 at p = 1.62 × 10 − 3 p = 1.62 \times10^{-3} p = 1.62 × 1 0 − 3 for the rules of part (a) and at p = 2.05 × 10 − 3 p = 2.05 \times10^{-3} p = 2.05 × 1 0 − 3 for those of part (b); for the lean schedule the same holds at 2.47 × 10 − 3 2.47 \times10^{-3} 2.47 × 1 0 − 3 and at 3.05 × 10 − 3 3.05 \times10^{-3} 3.05 × 1 0 − 3 . These statements rest on lower and upper Collatz–Wielandt bounds computed in floating point on a grid of tilts, together with the log-convexity of the growth rate in s s s [18 ] . Since the full range of d d d and T T T only adds rows, certificates of these kinds, with any tilt, cannot reach these values. Longer windows raise these values only slowly: on the bulk lattice, without boundaries, the rules of part (a) reach growth rate 1 at 1.6185 × 10 − 3 1.6185 \times10^{-3} 1.6185 × 1 0 − 3 with windows of four edges and at 1.6936 × 10 − 3 1.6936 \times10^{-3} 1.6936 × 1 0 − 3 with windows of five edges. Rule (S) extends to runs of three or four correction edges: such a run can be excluded if an edge-disjoint route between its ends uses only edges between detectors, has the same multiset of profiles and has a smaller value of Φ \Phi Φ . This excludes more windows but leaves the growth rates at the values of p p p above unchanged to five digits.
Remark 11.3 (Limits of arguments by increasing events). Call a set of outcomes failing if, when exactly these outcomes occur, some minimizer makes the decoder fail. An event is increasing if it is preserved when outcomes are added. All bounds in this paper bound P f a i l P_{\mathrm{fail}} P fail by the probability of an increasing event that contains the failing sets, and so does any bound obtained by counting paths, clusters or witnesses with a union bound. Rule (S) does not change this, because it too depends only on the labels and the graph. Every such event contains the event U U U that some subset of the occurring outcomes is failing, and U U U is itself increasing. Lemma 6.1(b) describes U U U : every subset X X X of a minimizer has minimum weight among the sets with boundary ∂ X \partial X ∂ X . Hence if the decoder fails and γ \gamma γ is the path of Lemma 3.1 , then γ \ C \gamma\mathbin{\backslash} C γ \ C is a minimizer for the error γ \ E \gamma\mathbin{\backslash} E γ \ E , which is produced by a subset of the occurring outcomes, and with this minimizer the decoder fails on that error alone. So U U U occurs if and only if some simple path γ \gamma γ from b 1 b_1 b 1 to b 2 b_2 b 2 contains a set E ′ E' E ′ of edges, each produced by an occurring outcome, such that γ \ E ′ \gamma\mathbin{\backslash} E' γ \ E ′ has minimum weight among the sets with boundary ∂ E ′ \partial E' ∂ E ′ .
We estimated Pr ( U ) \Pr(U) Pr ( U ) by Monte Carlo sampling for the memory experiment with T = d T = d T = d , deciding U U U in each sample by integer programming. Samples that the program did not resolve within its round or time limit count as not in U U U , so the estimates are lower bounds; the share of such samples is below 1% for d ≤ 9 d \le9 d ≤ 9 at p ≤ 4.25 × 10 − 3 p \le4.25 \times10^{-3} p ≤ 4.25 × 1 0 − 3 and about 3% at d = 11 d = 11 d = 11 and p = 4 × 10 − 3 p = 4 \times10^{-3} p = 4 × 1 0 − 3 . These estimates are not rigorous. For the circuit of § 1.1 and d = 5 , 7 , 9 , 11 d = 5,7,9,11 d = 5 , 7 , 9 , 11 , with 800 to 2,550 samples per point, Pr ( U ) \Pr(U) Pr ( U ) decreases with d d d at p = 3.5 × 10 − 3 p = 3.5 \times10^{-3} p = 3.5 × 1 0 − 3 but increases with d d d at p = 5 × 10 − 3 p = 5 \times10^{-3} p = 5 × 1 0 − 3 . At p = 4 × 10 − 3 p = 4 \times10^{-3} p = 4 × 1 0 − 3 the four estimates agree within their statistical errors, at about 0.044, and at p = 4.25 × 10 − 3 p = 4.25 \times10^{-3} p = 4.25 × 1 0 − 3 they rise slightly from d = 7 d = 7 d = 7 to d = 11 d = 11 d = 11 , by less than their statistical errors. For the lean schedule the estimates are roughly constant in d d d at 6 × 10 − 3 6 \times10^{-3} 6 × 1 0 − 3 and increase from d = 5 d = 5 d = 5 to d = 7 d = 7 d = 7 at 7 × 10 − 3 7 \times10^{-3} 7 × 1 0 − 3 . The threshold of U U U for the 8-step circuit therefore lies between 3.5 × 10 − 3 3.5 \times10^{-3} 3.5 × 1 0 − 3 and 5 × 10 − 3 5 \times10^{-3} 5 × 1 0 − 3 , probably near 4 × 10 − 3 4 \times10^{-3} 4 × 1 0 − 3 , and no argument of this kind can prove a threshold above it. Where Pr ( U ) \Pr(U) Pr ( U ) no longer decays but matching still succeeds, failing sets are present but are undone by the other outcomes, and a proof there would need an argument that is not monotone in the faults.
d = 3 , 5 , 7 d = 3, 5, 7 d = 3 , 5 , 7 , between 2.5 and 3 times what Google’s decoders reach at d = 7 d = 7 d = 7 [11 ] , and the model reproduces them at t ≈ 1.1 t \approx1.1 t ≈ 1.1 . For this decoder and in this model, the device thus operates at or above the threshold of U U U , where no argument by increasing events applies, while matching still suppresses errors.
Code and data
The programs, the certificates, the formal proofs and the outputs of all checks in Table 3 –Table 6 are archived at https://doi.org/10.5281/zenodo.23498518.
Generative AI tools were used to find and prove the results, to write the programs and the formal proofs, and to draft the text.
Node types
Each line gives one type: an example detector ( x , y , r ) (x, y, r) ( x , y , r ) in G 9 , 5 G_{9,5} G 9 , 5 , the number of detectors of this type in G 9 , 5 G_{9,5} G 9 , 5 , the degree, the coefficients 15 c e 15c_{\mathrm{e}} 15 c e of its edges (a superscript ♭ \flat ♭ marks the edge to b 1 b_1 b 1 and ♯ \sharp ♯ the edge to b 2 b_2 b 2 ), and the left side of (3) , that is Σ \Sigma Σ at p = p ∗ p = p_* p = p ∗ and λ = 0.9997 \lambda= 0.9997 λ = 0.9997 , rounded up to four decimals. The first row is the bulk type.
Table 10. Node types in basis Z Z Z .
Table 11. Node types in basis X X X .
References
ORCID: https://orcid.org/0000-0003-4668-3639