The ECC Resource Frontier and RL-Driven Quantum Error Correction

Google Quantum AI and DeepMind use reinforcement learning (RL) to fine-tune 2,657 hardware parameters. The distance-7 surface code reaches logical errors per cycle. For elliptic-curve cryptography (ECC), the researchers reduce the estimated secp256k1 circuit width to 835 logical qubits, with Toffolis.

0. Takeaways

Google Quantum AI and DeepMind report a scalable RL control policy for QEC, trained with a detector-event surrogate that provides local feedback. On Willow, fine-tuning suppresses the logical error rate (LER) by about 20% across distance-5 surface and color codes, and the distance-7 surface code reaches per cycle. The learned mean policy tracks injected drift on hardware. Simulations extend to a distance-15 surface code with 38,670 parameters and place the real-time stochastic-steering limit at a drift period of roughly 150 epochs or longer. Using the current hardware epoch time as a rough conversion, this threshold corresponds to about 2.5-25 hours. Hardware runs still begin with multi-day calibration in which experts resolve difficult edge cases. Faster learning and shorter epochs remain practical targets.[1]

For ECC resource estimation, Luo et al. report a complete secp256k1 ECDLP implementation using 835 logical qubits and Toffolis.[2] Relative to Google ETH 2026's 1,191-qubit full-circuit estimate, the reported width is about 30% lower and the Toffoli count is 20.5 times higher. The papers do not itemize the 16-qubit window register in the same way, as discussed below.[2,9,10] Visit ECDSA.Fail to explore the live public frontier, where validated submissions are ranked by average executed Toffolis × peak live qubits.[3,4]

1. Introduction

Artificial intelligence (AI) is now a practical tool for scientific research. For example, IBM used reinforcement learning (RL)-based transpilation to map logical circuits onto connectivity-constrained quantum hardware, reducing two-qubit gate depth and count in 133-qubit benchmarks.[5] A large language model (LLM)-assisted search also found quantum low-density parity-check (qLDPC) codes and a decoder for a recent 10,000-atom Shor architecture.[6]

Quantum error correction (QEC) is required for fault-tolerant computation. Developed by Google DeepMind with Google Quantum AI, AlphaQubit supplied the high-accuracy neural decoding used in Google's below-threshold surface-code demonstration on Willow.[7,8] Below threshold means the logical error rate falls as code distance grows. Our June newsletter, Better Gates, Better Codes, Better Randomness, compares this result with QEC progress across several hardware platforms. However, scaling QEC demands control over thousands of hardware parameters: Willow's distance-7 policy controls 2,657 learned analog parameters, which are hard for experts to calibrate manually. In addition, fault-tolerant algorithms may run for days or months, which leaves little room for manual recalibration.[1]

As one of quantum computing's major applications, cryptanalysis uses Shor's algorithm to break elliptic-curve cryptography (ECC) by solving the elliptic-curve discrete logarithm problem. In March 2026, Google Quantum AI, Ethereum Foundation, and Stanford researchers reported two secp256k1 designs, attested by a zero-knowledge proof without revealing the private point-addition circuits.[9] The space-optimized design uses at most 1,200 logical qubits and 90 million Toffolis; the gate-optimized design uses at most 1,450 qubits and 70 million Toffolis.

In this newsletter, we examine how Google Quantum AI and DeepMind use RL to fine-tune 2,657 Willow parameters and track drift during QEC.[1] We then follow the secp256k1 resource frontier to Luo et al.'s 835-logical-qubit circuit and its - Toffoli workload.[2]

2. RL-driven quantum error correction

Detection events as a calibration signal

In QEC, each logical qubit is encoded across many physical qubits. Superconducting gates depend on analog pulse amplitudes, frequencies, phases, and coupler settings. These parameters drift with the device and its environment. Fault-tolerant algorithms may require days or months of continuous operation. Stopping the processor for manual recalibration would interrupt the encoded computation.

In QEC operation, syndrome extraction repeatedly measures stabilizers and records local parity changes called detection events. Each event indicates that an error affected a bounded spacetime detecting region, producing a calibration signal from the QEC circuit itself. Sivak et al. use these events to update RL policies for distance-5 and distance-7 surface codes and a distance-5 color code on Willow. Across repeated distance-5 runs, RL lowers the LER by about 20%. The distance-7 policy controls 2,657 learned hardware parameters. With the AlphaQubit2 neural decoder, the surface code reaches logical errors per cycle.[1]

Our earlier newsletter, Q-Day: A Timeline and Four Milestones, identifies a memory logical qubit with LER below as the first milestone. The reported LER moves superconducting surface codes closer to that target. Based on the current experimental trajectory, we expect superconducting surface-code systems to reach this milestone first.

Policy updates and the surrogate objective

The control method addresses two linked problems. The first is the training signal. Below threshold, LER becomes exponentially rare as code distance grows, and each estimate reduces device performance to one global scalar. During a general algorithm, the logical state is unknown, so LER is not directly observable. The authors therefore optimize the mean detector-event rate,

The detector proxy is available in principle every QEC cycle, and each event retains spatial information. The resulting objective provides frequent feedback as a surrogate for LER.

For small random parameter perturbations, finite-difference measurements follow

The measured gradients support as a local proxy for the LER objective.[1]

The second problem is scalability. Local syndrome extraction confines each detector to a bounded spacetime region. A factor graph connects that detector only to nearby hardware parameters, so the reward identifies where an update should act. For the distance-5 surface code, one detector connects to 302 parameters on average, while one parameter connects to 18 detectors. This bounded connectivity decomposes the full policy into overlapping local optimization problems and provides the scalability discussed below. Broad crosstalk would connect more parameters to each detector and enlarge each local problem.

The policy is a factorized Gaussian over the analog parameters, with learned mean and diagonal variance . Each epoch samples parameter sets, runs QEC circuits, scores local detector events, and updates the distribution. A typical surface-code epoch evaluates 40 candidates. Each candidate runs a 25-cycle memory circuit for shots, equivalent to QEC cycles.

Hardware fine-tuning

Each hardware run begins after conventional calibration and expert tuning, with RL applied as the final optimization layer. Five independent surface-code runs and five color-code runs improve the mean LER by about 20% after roughly 200 epochs.[1] Repeated convergence across restarts supports the fine-tuning result.

The distance-7 policy trains on a fixed Z-basis, 25-cycle memory circuit. It improves every tested X- and Z-basis circuit across 10 to 150 cycles, smaller distances, and different subgrids. Across published Google QEC memory experiments, the best distance-7 surface-code LER falls from [8] to .[1] Each result uses the most accurate decoder available for that experiment. The repeated distance-5 runs therefore provide the cleaner estimate of the RL contribution. The comparison below places these values alongside earlier surface- and color-code memory experiments.[1,8,11-13]

Drift tracking and recovery

The robustness experiments cover two conditions: tracking injected drift around a calibrated point and recovering from deliberately randomized parameters. The drift test changes CZ coupling, XY pulse amplitude, and XY frequency with step-like, sinusoidal, and stroboscopic waveforms. Detector responses remain localized as predicted by the factor graph, while the learned mean policy follows the changing parameters.

Periodic logical evaluations show 24% lower mean LER than a fixed policy, with variation reduced by a factor of 2.4. An offline decoder-steering analysis, performed after the hardware run on saved QEC data, reports 31% lower LER and 3.5-fold lower variation. Unlike hardware-parameter steering, it relies on LER estimates.[1]

For the bad-start test, the authors perturb every learned parameter until a 25-cycle distance-5 memory circuit reaches 50% logical error probability. The policy returns to the expert-calibrated level in about 1,000 epochs. This test begins with a functioning processor, a defined parameter set, and a known factor graph, so it measures recovery within that prepared system.

Simulated scaling

Hardware results extend through distance 7, while circuit simulations cover odd surface-code distances from 3 to 15.[1] In the principal scaling sweep, each simulated one- and two-qubit gate has 30 learnable parameters; additional simulations vary this local parameter count. The distance-15 policy contains 38,670 parameters and starts above the modeled surface-code threshold.

The error-suppression factor summarizes how rapidly the LER falls as code distance increases. The simulations measure progress through

where is the LER at the local optimum , set by the irreducible control-independent error floor. The ratio reports the fraction of locally attainable suppression already reached and equals 1 at the optimum. Therefore, is the remaining fractional distance to the local optimum and forms the horizontal axis of the scaling plot.

The vertical axis, , is the normalized per-epoch speed of error suppression. It measures how quickly training closes the remaining gap. Near the local optimum, the simulations follow

so the gap decays as . The fitted is independent of system size in these simulations. It changes with local properties, including the number of gates per detecting region and learnable parameters per gate. This supports scalable convergence under the simulated locality model; large-distance hardware throughput and crosstalk remain experimental questions.

Current limitations

The current RL framework has two practical limitations: expert intervention and slow response to hardware drift. Each independent hardware run still begins with several days of conventional calibration and expert tuning. Human operators resolve edge cases that remain difficult to automate. RL then fine-tunes the prepared processor within a defined parameter set and factor graph. All hardware results quantify the learned mean policy during dedicated evaluation epochs. The stochastic-policy regime relevant to future uninterrupted, single-shot logical algorithms has so far been evaluated only in simulation.[1]

The measured response to a step in XY-pulse amplitude is about 130 epochs. At the current 1-10 minutes per epoch, this response takes roughly 2-22 hours. The QEC circuits themselves require about four seconds per epoch at a cycle, so compilation and experimental overhead dominate the wall clock.

Discrete Fourier analysis across hardware runs finds about 4 dB suppression of low-frequency LER fluctuation power. The spectrum is consistent with the policy suppressing slow drift, although the paper treats the linear-filter picture as an empirical interpretation. The learning rate still sets a clear bandwidth limit. In simulation, real-time steering requires a drift period of about 150 epochs or longer, consistent with the measured 130-epoch response. Using the current hardware epoch time as a rough conversion, this threshold corresponds to about 2.5-25 hours. Tracking faster drift will require fewer training epochs and lower wall-clock overhead per epoch.[1]

3. The ECC resource frontier

ECC, ECDLP, and the quantum threat

Elliptic-curve cryptography (ECC) combines short keys with efficient arithmetic. A 256-bit elliptic curve provides about 128-bit classical security, comparable to RSA-3072. This efficiency supports widespread use in TLS, SSH, digital signatures, and cryptocurrencies such as Bitcoin.[2]

ECC security rests on the elliptic-curve discrete logarithm problem (ECDLP). Given a base point and a public point , ECDLP asks for the hidden scalar
. Classical generic attacks require group operations, where is the field size. Shor's algorithm solves ECDLP in polynomial time on a fault-tolerant quantum computer. Common 256-bit curves therefore present one of the earliest plausible quantum targets among deployed public-key systems, making accurate resource estimates important.[2,10] Our earlier newsletter, Q-Day: A Timeline and Four Milestones, compares this attack envelope with the QEC and non-Clifford milestones needed to execute it.

Schrottenloher's open point-addition circuits

Google Quantum AI, Ethereum Foundation, and Stanford reported two optimized secp256k1 circuits in March 2026. They committed to the private circuits and used a zero-knowledge proof to attest resource and correctness bounds across 9,024 pseudorandom inputs.[9]

Schrottenloher published an explicit circuit architecture and implementation in June 2026.[10] The space-optimized point-addition circuit uses 1,192 qubits and Toffolis. The gate-optimized circuit uses 1,446 qubits and Toffolis. The complete Shor algorithm adds a 16-qubit window register, giving 1,208 or 1,462 logical qubits and or
Toffolis. The open implementation permits direct inspection of the circuit architecture, resource accounting, approximation model, and randomized correctness tests.

Luo's 835-qubit operating point

Luo et al. reduce the space used by reversible modular inversion through register sharing, mid-circuit measurement with classical feed-forward, and a semiclassical quantum Fourier transform (QFT).[2] The resulting asymptotic space cost is .

For secp256k1, Luo et al. report 835 logical qubits and Toffolis for the complete ECDLP construction.[2] Google's full-circuit conversion adds a 16-qubit window register to its 1,175-qubit point-addition core, giving 1,191 qubits and Toffolis.[9] On these reported totals, Luo's width is about 30% lower and its Toffoli count is 20.5 times higher.

ECDSA.Fail's live public frontier

ECDSA.Fail turns secp256k1 point-addition design into an open optimization contest. Anyone can submit a circuit. Score-improving accepted entries are promoted to the leaderboard, while other officially evaluated submissions can still define low-qubit Pareto points in the site's frontier view.[3,4] A circuit ranks well when it keeps both qubit use and Toffoli work low. The leaderboard combines them into one score:

For each submission, the harness derives 9,024 test inputs from the submitted operation stream. It checks the output point, freed ancillas, residual phase, and a forward-then-reverse identity before assigning a score. The following values are a snapshot retrieved on 27 July 2026.[3,4]

The best public product is 52.9% below the Google ETH low-qubit reference and 50.1% below its low-Toffoli reference. The 824-qubit submission is a separate Pareto point with much higher Toffoli cost; it was officially evaluated but not promoted because its product score did not improve the global best. This benchmark covers one reversible point-addition kernel; a complete attack also needs the full ECDLP circuit, error correction, state factories, routing, and physical scheduling. Visit ECDSA.Fail for the current frontier and individual evaluated submissions.

4. Conclusion

On hardware, Google Quantum AI and DeepMind use detector events to fine-tune 2,657 parameters and track slow drift. The policy lowers mean LER by about 20% in repeated distance-5 runs and reaches per cycle at distance 7.[1] Simulations extend the locality-based convergence study to distance 15 and evaluate the stochastic-policy regime needed for future uninterrupted steering. Further progress depends on shortening two timescales. A better policy could reduce the current 130-epoch learning response, while faster hardware execution and lower experimental overhead could shorten the 1-10 minutes required per epoch. Together, these changes would raise the maximum drift frequency that steering can suppress. Stronger drift rejection could lower LER and support higher-distance surface codes with lower logical error rates.

The ECC estimates now map a clear trade-off between logical-qubit count and Toffoli cost. Schrottenloher keeps the Toffoli count near with about 1,200-1,460 qubits, whereas Luo reaches 835 qubits at Toffolis.[2,10] ECDSA.Fail shows the same trade-off across officially evaluated point-addition circuits.[3,4] Current constructions therefore appear to be approaching a Pareto frontier. A large simultaneous reduction in qubits and Toffolis looks difficult within the present arithmetic framework. No formal lower bound has been proved, and a different algorithm or cost model could still shift this frontier.

5. References

1. Sivak, V. et al. "Reinforcement learning control of quantum error correction." Nature (2026). https://doi.org/10.1038/s41586-026-10759-2
2. Luo, H. et al. "Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition." arXiv:2607.13816 (2026). https://arxiv.org/abs/2607.13816
3. ECDSA.Fail. "Can you break ECDSA?" https://www.ecdsa.fail/. Live records: [https://api.ecdsa.fail/api/benchmarks/1ffb695a-309b-46b6-a728-2f97d8c7be74 and https://api.ecdsa.fail/api/benchmarks/1ffb695a-309b-46b6-a728-2f97d8c7be74/submissions](https://api.ecdsa.fail/api/benchmarks/1ffb695a-309b-46b6-a728-2f97d8c7be74 and https://api.ecdsa.fail/api/benchmarks/1ffb695a-309b-46b6-a728-2f97d8c7be74/submissions)
4. ECDSA.Fail. "The secp256k1 Point-Addition Challenge." https://github.com/ecdsafail/ecdsafail-challenge
5. Kremer, D. et al. "Practical and efficient quantum circuit synthesis and transpiling with Reinforcement Learning." arXiv:2405.13196 (2025). https://arxiv.org/abs/2405.13196
6. Cain, M. et al. "Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits." arXiv:2603.28627 (2026). https://arxiv.org/abs/2603.28627
7. Bausch, J. et al. "Learning high-accuracy error decoding for quantum processors." Nature 635, 834-840 (2024). https://doi.org/10.1038/s41586-024-08148-8
8. Google Quantum AI and Collaborators. "Quantum error correction below the surface code threshold." Nature 638, 920-926 (2025). https://doi.org/10.1038/s41586-024-08449-y
9. Babbush, R. et al. "Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations." Google Quantum AI (2026). https://quantumai.google/static/site-assets/downloads/cryptocurrency-whitepaper.pdf
10. Schrottenloher, A. "Optimized Point Addition Circuits for Elliptic Curve Discrete Logarithms." arXiv:2606.02235 (2026). https://arxiv.org/abs/2606.02235
11. Google Quantum AI. "Suppressing quantum errors by scaling a surface code logical qubit." Nature 614, 676-681 (2023). https://doi.org/10.1038/s41586-022-05434-1
12. Eickbusch, A. et al. "Demonstration of dynamic surface codes." Nature Physics 21, 1994-2001 (2025). https://doi.org/10.1038/s41567-025-03070-w
13. Lacroix, N. et al. "Scaling and logic in the colour code on a superconducting quantum processor." Nature 645, 614-619 (2025). https://doi.org/10.1038/s41586-025-09061-4