Fooling the Decoder: An Adversarial Attack on Quantum Error Correction

Abstract:Neural network decoders are essential for fault-tolerant quantum computation, yet their internal mechanisms remain poorly understood. Leading machine learning decoders use recurrent and transformer models (e.g., AlphaQubit), and reinforcement learning (RL) is increasingly used to train such models. In this work we ask whether an RL surface code decoder, DeepQ, can be made to fail systematically. Our white-box search repeatedly draws candidate syndrome volumes from the unmodified noise model and retains the one the decoder's learned $Q$-function is most pessimistic about. At code distance 5 under phenomenological depolarising noise, it cuts the average logical qubit lifetime from roughly $10^5$ cycles to 60. We quantify what this costs: the retained error histories are individually plausible, but the selected trajectory is roughly a $10^{-18}$ tail event under undisturbed noise, so the effect is bought entirely by the ability to select among physically realisable error configurations. Controls confirm this is not an artefact of a weak target: the decoder resists noise fluctuations, tolerates an MWPM referee, and is fault tolerant at checkable distances. The result is a robustness upper bound for one decoder under one noise model, but to our knowledge the first adversarial attack of a machine learning QEC decoder.

arXiv:2504.19651 [quant-ph]

(or arXiv:2504.19651v2 [quant-ph] for this version)

https://doi.org/10.48550/arXiv.2504.19651 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.