⚛️ quantum physics

When Error Mitigation Makes Things Worse: Budget-Aware Evaluation, Extrapolation Failure, and the Calibration Trust Boundary

This paper demonstrates that error mitigation techniques, particularly unconstrained zero-noise extrapolation and neural correctors, can significantly amplify errors and fail to detect tail risks under miscalibration or budget constraints, thereby revealing critical vulnerabilities in near-term quantum learning pipelines regarding calibration integrity and evaluation methodologies.

Original authors: Guilin Zhang (Workday AI Research), Kai Zhao (Workday AI Research), Xiquan Cui (Workday AI Research), Henry Heng (Workday AI Research), Xu Chu (Workday AI Research), Aletta Johanna Blanken (Workday AI

Published 2026-10-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Guilin Zhang (Workday AI Research), Kai Zhao (Workday AI Research), Xiquan Cui (Workday AI Research), Henry Heng (Workday AI Research), Xu Chu (Workday AI Research), Aletta Johanna Blanken (Workday AI Research)

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the quiet, ultra-cold laboratories where the next generation of computers is being built, scientists are wrestling with a fundamental problem: noise. These machines, known as quantum computers, are designed to solve complex problems by manipulating the strange states of subatomic particles. However, the hardware is incredibly fragile. Even the slightest vibration or temperature shift causes the particles to behave unpredictably, corrupting the data before it can be used. To fix this, researchers have developed a set of techniques called error mitigation. The goal is simple: take the messy, noisy output from the machine and mathematically clean it up to reveal the true answer underneath. It is the difference between listening to a radio station through a storm of static and hearing the music clearly. For the field to move forward, scientists must trust that these cleaning methods actually work and do not make the signal worse.

A recent study from Workday AI Research challenges this trust, revealing that the most popular cleaning method can sometimes amplify the very errors it is meant to remove. The researchers focused on a technique called zero-noise extrapolation, which works by intentionally making the computer noisier in controlled steps and then guessing what the result would have been if the noise were zero. It is a bit like trying to guess the weight of a person by weighing them while they hold increasingly heavy backpacks and then working backward. The study found that when the computer's internal settings are slightly off—a condition known as miscalibration—this guessing game fails spectacularly. In simulations, the method produced worse results than doing nothing at all in between 38 and 63 percent of the cases. Even more troubling, when it did fail, the errors were not just slightly off; they were extreme, producing numbers that were hundreds of times larger than the actual mistake.

The researchers tested these findings on a small, real quantum computer provided by IBM, and the simulation held true. On this actual hardware, the error-mitigation method made the results worse in 80 to 88 percent of the trials. The average error became three to four times larger than the raw, uncorrected data. This suggests that the method is fragile. It relies on the assumption that the machine's noise behaves in a smooth, predictable way. When the machine has a hidden, steady bias—like a scale that is consistently off by a few grams—the method's mathematical guess goes wildly astray. The study also noted that if scientists only looked at the "middle" result, or the median, they would miss these failures entirely. The average error would look terrible, but the middle value would appear normal, hiding the fact that the system was producing dangerous outliers.

To address these issues, the team explored a different approach using a type of artificial intelligence, specifically a neural network, to learn how to correct the errors. They trained this computer program on thousands of simulated examples, teaching it to recognize patterns in the noise and subtract them out. Crucially, they compared this new method against the old one using the same strict limit on how many times the quantum computer could be asked to run a calculation. This "budget" is a critical constraint because running these machines is expensive and time-consuming. The study found that once the cost of training the AI was paid for, the neural network performed very well at low budgets, outperforming the traditional method. However, the AI had its own limitations. It could not transfer its knowledge perfectly to the real hardware without further adjustment, and it relied heavily on information provided by the machine's manufacturer about its current state.

This reliance on manufacturer data opened a new door for potential security risks. The researchers treated the calibration data provided by the cloud service as a "trust boundary," meaning the user has to take the provider's word for it without being able to verify it themselves. They demonstrated that if an attacker could subtly alter this calibration data—perhaps by changing a number that describes how the machine's controls are set—the AI's correction would go wrong. In one test, a small, calculated change to this metadata increased the error by more than eight times. The AI, trusting the false information, made the data worse instead of better. This highlights a vulnerability in the current system: the safety of the calculation depends on the integrity of the data stream coming from the provider, which is currently not protected against tampering.

The study concludes that the field needs a more honest way to evaluate these error-correction tools. Scientists must look at the full picture, including the cost of running the method, the risk of extreme errors, and the security of the data inputs. The traditional method of simply guessing the answer based on noise scaling is not a silver bullet; it can fail silently and catastrophically. While learning-based methods show promise, they are not yet a solved problem, especially when moving from simulation to real machines. The path forward requires rigorous testing that accounts for the fact that these machines are imperfect, their settings can drift, and the data describing them can be manipulated. Until these factors are fully understood and secured, the numbers coming out of these powerful new computers must be treated with a healthy dose of skepticism.

Technical Summary: When Error Mitigation Makes Things Worse

Problem Statement

Error mitigation is a critical component of near-term quantum machine learning (QML) pipelines, designed to convert noisy hardware outputs into usable expectation-value estimates without the overhead of full error correction. However, current evaluation practices often obscure critical reliability and security vulnerabilities. Specifically, methods are frequently compared at fixed, generous shot budgets per circuit execution, ignoring the fact that different techniques (e.g., Zero-Noise Extrapolation vs. learning-based methods) require vastly different numbers of circuit executions per estimate. Furthermore, the integrity of provider-reported calibration data—a necessary input for many mitigation strategies—is often treated as a trusted fact rather than a potential attack surface.

This paper investigates two primary gaps:

Reliability: Does a corrected answer genuinely improve upon the raw estimate within a fixed online shot budget, and how severely do methods fail when their underlying assumptions (such as smooth noise scaling) break?
Security: What information does the mitigation layer trust, and how can an adversary manipulate unverified metadata (calibration data) to degrade performance?

Methodology

Experimental Design

The study evaluates four mitigation pipelines under a unified equal-online-budget protocol. All methods share the same total shot budget $B$ per evaluation, with costs distributed according to their specific execution requirements:

Unmitigated: 1 execution.
Neural Error Mitigation (NEM): 1 execution (offline training cost reported separately).
Zero-Noise Extrapolation (ZNE): 3 to 4 executions (depending on factory).
Clifford Data Regression (CDR): 32 executions (per target circuit).

The evaluation spans three noise regimes:

Stochastic Device Noise: Depolarizing errors, thermal relaxation, and asymmetric readout.
Stochastic-Correlated Noise: Adds gate-error fluctuations and correlated ZZ crosstalk (proxy for co-tenant interference).
Coherent Miscalibration: Models control-offset errors where physical pulses receive a fixed offset $\delta$ .

The Neural Corrector (NEM)

The authors propose a budget-conditioned neural corrector that predicts a residual correction to the noisy estimate.

Architecture: A residual Multi-Layer Perceptron (MLP) with two encoders (circuit features and noise/calibration features) and an output network.
Inputs: Noisy measurement, circuit features (qubit count, layers, parameters), noise features (gate errors, readout asymmetry), and shot-noise scale ( $1/\sqrt{S}$ ).
Training: Trained offline on simulated data (4,400 pairs per regime) using Huber loss. The model is conditioned on shot count to generalize across budgets without retraining.
Safety Mechanism: An ensemble of three seeds is used; if they disagree beyond a calibrated threshold, the system falls back to the raw estimate.

Threat Model

The paper treats provider-reported calibration as a trust boundary. Since users cannot cryptographically bind calibration metadata to the specific execution state, the study simulates:

Calibration Spoofing (A1): Falsified calibration data fed into the model.
Coherent Bias Injection (A2): An adversary manipulating control offsets $\delta$ to maximize post-mitigation error.
Metadata Stress Test: A white-box projected-gradient descent (PGD) attack on the calibration features within the training range.

Key Results

1. Budget-Aware Evaluation and ZNE Failure

Under coherent miscalibration, ZNE frequently amplifies error rather than reducing it.

Performance: In simulation, ZNE produces worse results than the raw estimate on 38–63% of instances. In a small real-hardware study (IBM Heron), ZNE was worse on 80–88% of instances, with mean errors 3.0–4.1× the raw error.
Tail Risk: While the median error of ZNE often remains close to the raw baseline (masking failure in standard monitoring), the mean error diverges significantly due to extreme tail errors. One instance reached an error 371 times the largest raw error, demonstrating that unconstrained extrapolation can produce catastrophic outliers.
Hardware Validation: The failure pattern observed in simulation (worsening on the majority of instances with heavy tails) was reproduced on real hardware, though the study size was limited.

2. Neural Corrector (NEM) Performance

Accuracy-Cost Frontier: After amortizing offline training costs, NEM occupies the low-budget end of the accuracy-cost frontier. Under coherent miscalibration, NEM reduced mean error by 72–81% across various budgets, outperforming ZNE significantly.
Comparison with CDR: CDR remains more accurate when its high online budget (32× executions) is affordable. However, at qubit counts of n=16 and n=20, NEM matches CDR's accuracy specifically under miscalibration at 1/32 of the quantum cost, making it superior for low-budget or high-reuse scenarios in this specific regime.
Robustness: The ensemble disagreement fallback mechanism reduced the "worse-than-raw" rate from 7% to 5% in representative cases.

3. Security and Metadata Attacks

Vulnerability: The neural corrector relies heavily on calibration features. Removing these features triples the Mean Absolute Error (MAE).
Attack Success: A white-box PGD attack on the calibration features (within the training range) increased the corrector's mean error by 8.1× (from 0.008 to 0.067) and worsened every correction instance.
Detection Limits: The ensemble disagreement monitor detected only 50% of the worsened cases under attack, highlighting that current safeguards are empirical, not robust guarantees.

Claims and Significance

The paper makes the following modest claims regarding its contributions:

Re-evaluation of Reliability: The study demonstrates that standard error mitigation, particularly ZNE, can amplify error under realistic calibration mismatches. Crucially, median-only monitoring is insufficient to detect these failures because the distribution of errors becomes heavy-tailed while the median remains stable.
Budget-Aware Comparison: The authors establish that comparing methods requires an equal-online-budget framework. Under this accounting, learning-based methods (like NEM) become viable and superior at low budgets, whereas classical methods like CDR only win when their high execution overhead is affordable.
Calibration Integrity as a Security Boundary: The paper formalizes provider calibration as an unverified input. It demonstrates that this metadata constitutes a concrete attack surface where small, in-range perturbations can drastically degrade mitigation performance, even evading simple disagreement monitors.
Hardware Transfer Limitations: The study explicitly notes that a model trained in simulation does not transfer to real hardware without on-device adaptation. The hardware results presented are primarily for validating the failure patterns of ZNE, not for claiming the immediate deployability of the neural corrector on current devices.

Conclusion: The paper argues that near-term quantum learning pipelines must evolve to report cost, tail risk, and calibration integrity simultaneously. It warns that without these considerations, error mitigation may inadvertently introduce catastrophic tail risks or security vulnerabilities, turning a solution into a source of amplified error.