# Adversary A: Attack on the Verification Lock

## Bottom line

The attack does not kill H15. It mostly confirms it. The proposed lock only binds after adding a rendering-policy/faithfulness rule: the renderer must not tamper with verifiers, randomness, problem selection, transcript timing, records, or the host-side meaning of "classical cost." That is exactly the kind of policy specification H15 says is necessary.

The arithmetic is mixed: several headline numbers check, but the bits-anchor threshold is inconsistent with the stated cost formula. The bigger failure is conceptual and literature-facing: `L ~= F*C_ideal` is not a known policy-independent minimum spoofing cost. The spoofing literature gives conditional hardness, practical counteralgorithms, and noisy polynomial-time simulation results, not a universal linear fidelity tax.

Recommended H15 update: raise from 0.89 to 0.92.

## Arithmetic audit

### Objection A1: the flop counts mostly check, but the bits threshold does not

Grade: SERIOUS.

Using the stated formula

`C_ideal(n,d) = d*(n/2)*0.5*32*2^n = 8*d*n*2^n`.

Re-derivations:

| quantity | recalculated | prompt claim | verdict |
|---|---:|---:|---|
| `C_ideal(53,20)` | `log10 = 19.883` | `10^19.88` | OK |
| `C_ideal(105,40)` | `log10 = 36.134` | `10^36.13` | OK |
| `2^53` complex64 state | `2^53*8 = 7.2058e16 bytes = 72.06 PB = 64 PiB` | `72 PB` | OK in decimal PB |
| Willow `F=1.5e-3` | `36.134 + log10(0.0015) = 33.311` | `L ~= 10^33.3` | OK if Claim 3 accepted |
| gap to `10^120` ops | `120 - 33.311 = 86.689` orders | `10^87` | OK as rounded |

Threshold solving `log10(8*d*n) + n*log10(2) = A`, with `d=20`:

| anchor | recalculated `n*` | prompt claim | verdict |
|---|---:|---:|---|
| ops `10^120` | `382.73` | `383` | OK |
| bits `10^90` under same cost formula | `283.50` | `299` | wrong for stated formula |
| Planck-times `10^60.9` | `187.43` | `188` | OK |

The `299` number is approximately `90/log10(2)`, i.e. solving only `2^n = 10^90` and dropping the polynomial/gate prefactor. That is not the same calculation as the ops threshold. If "bits anchor" means memory for a full state vector, the situation is worse for the prompt: complex64 state storage gives `2^n*64 bits <= 10^90`, or `n <= 294` approximately, not 299; using the stated flop expression gives about 284. Claim 6's later `284-383` quietly agrees with the recalculation, not with Claim 4's `299`.

Source: Lloyd's abstract states the universe can have performed no more than `10^120` ops on `10^90` bits. [verified-at-source: https://arxiv.org/abs/quant-ph/0110141]

### Objection A2: the noise slope arithmetic checks, but the model it slopes is not established

Grade: MINOR on arithmetic; SERIOUS on interpretation.

With `L = (1-eps)^(d*n/4) * 8*d*n*2^n`, ignoring the slow `log10(8dn)` derivative gives

`d(log10 L)/dn ~= log10(2) + (d/4)*log10(1-eps)`

or equivalently the prompt's

`log10(2) - (d/4)*|log10(1-eps)|`.

Critical depth:

`d_crit = 4*log10(2)/|log10(1-eps)|`.

Recalculated:

| `eps` | `d_crit` recalculated | prompt claim |
|---:|---:|---:|
| 0.001 | 2771.20 | 2771 |
| 0.005 | 553.13 | 553 |
| 0.01 | 275.87 | 276 |
| 0.05 | 54.05 | 54 |

For `eps=0.005,d=20`, solving the noisy equation for the `10^120` ops anchor gives `n*=397.03`, compared with `382.73` noiseless. The prompt's "383 to 398" is close enough.

But this is a heuristic fidelity-discount curve, not a theorem about minimum spoofing cost. AGLLV prove a polynomial-time classical algorithm for noisy random circuit sampling, under anti-concentration, to inverse-polynomial total variation distance for constant per-gate noise; they explicitly say the result is not practical and does not address finite-size experiments. That theorem is not merely the prompt's `d_crit` race of exponentials. It changes the asymptotic object: noisy RCS with constant noise is classically simulable in polynomial time in the scalable regime. [verified-at-source: https://arxiv.org/abs/2211.03999]

## Claim 3 and the spoofing literature

### Objection B1: `L ~= F*C_ideal` is not a lower bound, and not the literature's cost law

Grade: FATAL to Claim 3 as a policy-independent quantitative lock.

The prompt treats truncated tensor-network contraction as if the minimum classical spoofing cost is a fraction `F` of exact ideal simulation cost. The cited literature does not license that.

Pan-Chen-Zhang: their Sycamore algorithm generated `10^6` uncorrelated bitstrings for `n=53,d=20` with approximate-state fidelity `F ~= 0.0037` in about 15 hours on 512 GPUs, and they estimate an efficient exascale implementation could take dozens of seconds. Their mechanism is geometry- and contraction-order-dependent sparse-state tensor contraction, not a proof that minimum cost equals `F` times state-vector evolution. They explicitly frame Google's estimate as based on a specific classical algorithm rather than a bound against all algorithms. [verified-at-source: https://arxiv.org/abs/2111.03011]

Gao et al. 2112.01657: in adversarial settings, high XEB does not imply faithful quantum dynamics. They report an efficient classical algorithm achieving 2-12% of experimental XEB values in seconds on one GPU, and state that XEB as a fidelity proxy requires conditions that cannot be assumed adversarially. This directly attacks the move from measured XEB/fidelity to minimum spoofing cost. [verified-at-source: https://arxiv.org/abs/2112.01657]

Aaronson-Gunn: they prove conditional hardness of spoofing Linear XEB under XQUATH, a strong assumption about the absence of classical probability estimators with slightly better-than-trivial mean squared error. Their theorem is not `cost = F*C_ideal`; it is a conditional reduction from spoofing heavy/XEB outputs to nontrivial amplitude probability estimation. They also emphasize that sampling-hardness results are not automatically spoofing-hardness results, because a distribution can score well on Linear XEB while being far in total variation distance. [verified-at-source: https://arxiv.org/abs/1910.12085]

Chou et al. / Barak et al. shallow-circuit spoofing: for depth `d` Haar-random 2-qubit circuits, there is a randomized classical algorithm achieving expected Linear-XEB fidelity `Omega((n/L)*15^-d)` in time `poly(n,2^L)`, with polynomial-time large fidelity for some shallow 2D circuits. Again, the relation is algorithm-, architecture-, and depth-specific, not universal linear-in-`F` exact-state cost. [verified-at-source: https://arxiv.org/abs/2005.02421]

Direction of break: `F*C_ideal` can overestimate the true spoofing cost, especially when XEB can be gamed or noisy circuits become asymptotically easy; it can also underestimate costs for a particular contraction geometry. It is neither a lower bound nor a robust central estimate. That destroys the numerical threshold as an exclusion argument.

### Objection B2: AGLLV is stronger/different than the prompt's noise kinship claim

Grade: SERIOUS.

AGLLV do not merely say "beyond some depth, fidelity decays faster than Hilbert-space size grows." They construct a polynomial-time classical sampling algorithm for noisy RCS under anti-concentration and constant per-gate noise, with inverse-polynomial total variation error. They also distinguish scalable asymptotics from finite-size experiments. The prompt's heuristic `d_crit` says a noisy device gets cheaper to spoof under one assumed `L=F*C_ideal` model. AGLLV says that with constant noise, scalable noisy RCS is not an asymptotic extended-Church-Turing violation at all. The kinship is loose at best; citing AGLLV as if it validates the crude slope is misleading.

Source: AGLLV abstract and main-result discussion. [verified-at-source: https://arxiv.org/abs/2211.03999]

## Host conversion and policy-independence

### Objection C1: "hard inside the universe" does not imply "hard for the host"

Grade: FATAL.

This is the old fatal conversion step. The argument assumes that the host is a classical computer subject to the same algorithmic resources, representation costs, and online causal constraints as an embedded simulator. But a host running a universe need not compute by the embedded world's abstractions. It may have:

- different primitive operations;
- cached or precomputed transcripts;
- access to the pseudo-random seeds before observers do;
- planted instances with known witnesses;
- nonuniform advice/hardwired lookup for finite historical records;
- lossy rendering until queried;
- the ability to alter memories, logs, test choices, or apparent randomness;
- the ability to simulate only the verifier-facing transcript rather than the alleged physical process.

Claim 2 defines `L` as the minimum classical cost of emitting outputs that pass every verification test actually applied. That is a property of a fully specified interaction model. It is not policy-independent. The phrase "actually applied" makes the problem finite-transcript spoofing unless the policy also commits the renderer to answer counterfactual verifier challenges faithfully. Without that, the host can render the accepted transcript, not the computation.

The classical-host assumption is not enough. A classical host with nonuniform advice for one finite universe-history can emit a record far below the cost of recomputing the certified computation, unless the renderer is constrained to generate the record by a faithful online simulation of embedded physics. That constraint is exactly what H15 says must be specified.

### Objection C2: "minimum spoofing cost" smuggles the policy in the word "minimum"

Grade: FATAL.

Minimum over what class of spoofers? If it means all classical generators of observer records, then the minimum can be a compressed transcript generator or a planted-witness generator. If it means classical generators that preserve the verifier, preserve measurement choices, preserve memory, preserve causal timing, and preserve the semantics of quantum circuit selection, then the policy band has already been narrowed by stipulation.

So Claim 2's "policy-independent" label is not earned. The lock binds only after one specifies a host-observer interface and a faithfulness rule for verifier-visible facts.

## Is the certificate mechanism real?

### Objection D1: a certificate verifies a relation inside a rendered transcript; it does not force the transcript's origin

Grade: FATAL.

Claim 1 equivocates between:

1. observers verified that a string `y` satisfies predicate `V(x,y)=1`; and
2. the host had to perform the expensive process allegedly certified by `y`.

The first can be true while the second is false. Certificates are cheap precisely because they decouple checking from finding. If the host has any route to the witness/output other than reproducing the embedded expensive process, the observer's verifier does not detect that. Examples:

- Shor-style factoring certificate: multiplication verifies factors cheaply, but a host could plant the semiprime with known factors.
- Random-circuit/XEB records: a host could select, bias, or rewrite the circuit instances, samples, or logs unless those are independently fixed and untampered.
- Interactive proofs: soundness binds a prover under assumptions about verifier randomness and message timing. A renderer that controls the verifier's random tape, memory, or transcript is outside the proof model.
- Post hoc records: once "the observers' record" is fixed, emitting that record is cheaper than producing a world in which it arose faithfully.

The checker being rendered does not help. It makes the checker another object subject to rendering policy. "Do not tamper with verifier" is not a consequence of certification; it is an extra rule.

### Objection D2: the argument needs counterfactual soundness, not just actual verification

Grade: SERIOUS.

A robust lock would require that the host be committed not only to the verifier calls observers actually made, but to the distribution of verifier challenges they could have made. Standard verification soundness is counterfactual: cheating prover succeeds with small probability over verifier randomness. A rendered history that contains one accepting run does not force the host to support that whole counterfactual distribution. This is another route by which H15 reappears.

## Claim 6 threshold and "excluded" language

### Objection E1: `2^n` is not a proven lower bound on classical simulation

Grade: SERIOUS.

There is no theorem that generic fault-tolerant quantum computations require `Omega(2^n)` classical operations to spoof. The relevant separation is complexity-theoretic and conditional. BQP vs BPP is not resolved; RCS hardness is based on assumptions and reductions with caveats; Linear XEB spoofing hardness in Aaronson-Gunn is conditional on XQUATH. [verified-at-source for Aaronson-Gunn conditionality: https://arxiv.org/abs/1910.12085]

Thus Claim 6's "a classical host is excluded" is too strong. At most: under a specified faithful-rendering policy, a specified classical-host cost model, and accepted quantum-hardness assumptions, about 300-400 logical qubits would exceed the chosen Lloyd-style resource anchor. That is not exclusion of a classical host in the generic simulation hypothesis.

### Objection E2: fault tolerance changes `F`, but not policy-independence

Grade: SERIOUS.

Under fault tolerance, `F -> 1` may remove the NISQ fidelity discount. It does not remove planted instances, verifier tampering, nonuniform advice, transcript rendering, host-side shortcuts, or the absence of unconditional classical lower bounds. Claim 6 inherits all failures of Claims 1-3.

## Prior art missed

### Objection F1: the quantum-computation counting idea is old; the policy-independence-by-verification version was not found in this search

Grade: MINOR for novelty, SERIOUS for framing.

I found no exact prior-art hit for the full move "verification certificates remove simulation rendering-policy freedom" in quick web searches over combinations of simulation hypothesis, quantum computation, verification, Deutsch, host, and certificates. That absence is not proof of novelty; it is only a failed quick search.

What is definitely prior art:

- Deutsch-style "where was the computation performed?" counting is inherited from the prompt and not source-checked here. [inherited-unchecked]
- Quantum supremacy/RCS literature already separates experimental benchmark score, fidelity, faithful simulation, and spoofing hardness. Aaronson-Gunn explicitly warn that sampling hardness is not automatically Linear-XEB spoofing hardness. [verified-at-source: https://arxiv.org/abs/1910.12085]
- Gao et al. explicitly frame XEB's adversarial limitations and show high XEB need not imply faithful quantum dynamics. [verified-at-source: https://arxiv.org/abs/2112.01657]
- AGLLV explicitly undercut scalable noisy RCS as an ECT violation under constant noise. [verified-at-source: https://arxiv.org/abs/2211.03999]

So even if the exact simulation-policy argument is open/novel, its components are surrounded by prior art that makes the proposed lock much weaker than stated.

## Overall graded objections

FATAL: Claim 1's certificate mechanism does not remove policy freedom; it assumes verifier faithfulness.

FATAL: Claim 2's `L` is not policy-independent; it is defined only after specifying the spoofing class and host-observer interface.

FATAL: Claim 3's `L ~= F*C_ideal` is not a literature-backed lower bound or universal cost law.

FATAL: The inside-universe hardness to host-cost conversion is unlicensed.

SERIOUS: Claim 4 has a real arithmetic inconsistency: bits threshold `299` does not follow from the stated formula; `~284` does.

SERIOUS: Claim 5's arithmetic checks, but AGLLV says something stronger/different than the prompt's heuristic kinship.

SERIOUS: Claim 6's "excluded" language exceeds known complexity lower bounds and relies on unproven separations.

MINOR: Several numerical anchors do check: `10^19.88`, `10^36.13`, `72 PB`, `10^33.3`, `10^87`, and the listed `d_crit` values.

MINOR: No exact prior-art hit for policy-independence-via-verification in this quick search, but absence is weak evidence.

## Should H15 move?

Move H15 up, from 0.89 to 0.92.

Reasoning: the kill condition asked for a proof that all observer-adequate rendering policies fall in a narrow enough band for a robust verdict. This attack did not provide that proof. It found a potentially useful mechanism only after adding a no-tampering/no-shortcut verifier faithfulness condition. That condition is a rendering-policy constraint, so H15 reasserts itself at the exact point of attempted escape.

The reason not to raise much higher is that the attack is not empty. For a specified policy class -- classical host, online faithful rendering, untampered verifiers, unpredictable verifier randomness, no planted instances/advice beyond what the simulated physics permits -- verified fault-tolerant quantum computation could become a threshold-bearing test. But that is a test of that specified simulation proposal, not of the generic simulation hypothesis.

So reading B beats reading A. The mechanism is live only after policy specification; as an assault on H15, it is a seventh confirming line.