Circuits a language model wrote, checked on every input
In October 2026, Andi Gu, Alek Kemeny, Susanne Yelin and Mikhail Lukin described a framework in which large language models propose quantum circuit designs and an independent evaluator verifies and scores them ("Discovering state-of-the-art quantum circuits with large language models", arXiv 2610.22367). In seven of their eight tasks the circuits found reduce both Toffoli and qubit counts relative to the state of the art, and in the eighth the search found a new reversible architecture for modular inversion over a prime field. The arrangement matters as much as the result: the model proposes, and something else decides whether a proposal is right.
This essay does the same thing at a small scale, on small instances of two tasks of quantum arithmetic, addition and inversion modulo a prime (the second is the paper's eighth), with DKE, the Deterministic Knowledge Engine, as the thing that decides. The circuits below were written by a language model: Claude (Claude Opus 5.5), working in Claude Code, by hand, each from a derivation shown next to it. None came from a search, which is the other difference from the paper. Every one was then checked by rev_meets, a function in the quantum library for DKE, and the claim this essay makes is exactly what that check supports:
DKE certifies circuits a language model wrote: on every input, exactly, with why on the verdict, for instances small enough to check completely.
Every word of that claim is a limit as well as a promise, and section 8 says where each one stops. A check that tries some inputs and not others is a bound, not a certificate, and nothing here calls one a certificate.
Every program runs as shown once the library's source file, quantum 1.3.0, has been compiled into a store, in the order given, and every output is copied from a run.
1. What a reversible circuit is, and what correct means
A classical bit pattern goes into a reversible circuit and a classical bit pattern comes out. The gates are the ones quantum arithmetic is built from: x flips a qubit, cnot flips its second qubit when the first is 1, and ccx, the Toffoli gate, flips its third when the first two are both 1. Three more, z, cz and ccz, flip nothing and instead multiply the state by −1 when their qubits are all 1. On a quantum computer these gates act on superpositions of patterns, but because each one sends a pattern to a single pattern, possibly with a sign, a circuit made of them is completely described by what it does to each pattern. That makes it checkable with integers alone, exactly.
On an error-corrected quantum computer a Toffoli costs far more than the gates around it, so circuits are compared by how many Toffolis they use, and then by how many qubits.
The circuits here compute a function out of place. The input sits on some qubits, the output appears on others that start at 0, and every qubit used for scratch work must be returned to 0, because a scratch qubit left holding a value stays entangled with the computation and spoils whatever comes after it. rev_meets(n, steps, ins, outs, want, signs) checks exactly that, for a circuit on n qubits: for every input, the input qubits are unchanged, the output qubits hold want[x], every other qubit is 0 again, and the sign is the one specified. It answers with four things: whether the circuit meets the specification, how many cases it checked, the first case that failed (or −1), and why that case failed.
One more step appears below. mx measures a qubit and resets it to 0. If the measurement gives 1, the state is left with a sign of −1 wherever that qubit held 1, and a gate ending in _if, such as cz_if, runs only when the measurement it names gave 1, to undo that sign. Measuring a scratch qubit and repairing the sign this way can replace a second Toffoli, so it matters for the count. A circuit that measures is checked once for every combination of its measurements' outcomes, and rev_meets checks every input under each of them.
2. The inverse modulo 7
The first task: given x on three qubits, put x⁻¹ mod 7 on three others. Zero has no inverse, so the specification sends it to 0, and reads 7 as 0 too, since it is 0 mod 7.
x 0 1 2 3 4 5 6 7
x⁻¹ 0 1 4 5 2 3 6 0Written in bits, a pattern appears. Number the input bits x0, x1, x2 from the lowest and the output bits y0, y1, y2. For every x but 7, the output is the input with two of its bits exchanged: y0 = x0, y1 = x2, y2 = x1. Input 7 would give 7 that way, and the specification wants 0, so on that one input every output bit must be flipped. The input is 7 exactly when t = x0·x1·x2 is 1, so:
y0 = x0 ⊕ t, y1 = x2 ⊕ t, y2 = x1 ⊕ t.
Computing t takes two Toffolis, the first of them into a qubit that is used for a moment and then measured away. The output qubits are 3, 4 and 5.
import quantum
inverse_mod_7 = [
("ccx", [0, 1, 3], 0.0),
("ccx", [3, 2, 4], 0.0),
("mx", [3], 0.0),
("cz_if", [3, 0, 1], 0.0),
("cnot", [4, 3], 0.0),
("cnot", [4, 5], 0.0),
("cnot", [0, 3], 0.0),
("cnot", [2, 4], 0.0),
("cnot", [1, 5], 0.0),
]
spec = [0 if x % 7 == 0 else pow(x % 7, -1, 7) for x in range(8)]
print(spec)
print(quantum.rev_meets(6, inverse_mod_7, [0, 1, 2], [3, 4, 5], spec, []))[0, 1, 4, 5, 2, 3, 6, 0]
(True, 16, -1, '')The first line is the specification, want, computed rather than typed. The second is the verdict: the circuit meets it in all 16 cases, which are the 8 inputs under each of the 2 outcomes of the one measurement. Step by step: the first Toffoli puts x0·x1 on qubit 3, the second puts t on qubit 4, the measurement clears qubit 3, and cz_if repairs the sign the measurement leaves when qubit 3 held 1, which is when x0·x1 was 1. The five cnots then copy t to the other two outputs and add the input bits each output needs.
3. A wrong circuit is refused, and says where
A check is only worth something if it refuses what is wrong. Here are two mistakes a writer could make: leaving out the sign repair, and wiring one output to the wrong input bit.
import quantum
circuit = [
("ccx", [0, 1, 3], 0.0),
("ccx", [3, 2, 4], 0.0),
("mx", [3], 0.0),
("cz_if", [3, 0, 1], 0.0),
("cnot", [4, 3], 0.0),
("cnot", [4, 5], 0.0),
("cnot", [0, 3], 0.0),
("cnot", [2, 4], 0.0),
("cnot", [1, 5], 0.0),
]
spec = [0 if x % 7 == 0 else pow(x % 7, -1, 7) for x in range(8)]
no_fixup = circuit[:3] + circuit[4:]
wrong_wire = circuit[:7] + [("cnot", [0, 4], 0.0)] + circuit[8:]
print(quantum.rev_meets(6, no_fixup, [0, 1, 2], [3, 4, 5], spec, []))
print(quantum.rev_meets(6, wrong_wire, [0, 1, 2], [3, 4, 5], spec, []))(False, 16, 11, 'sign')
(False, 16, 1, 'output')Without the repair, the circuit fails at case 11, which is input 3 under measurement outcome 1. Input 3 has x0 = x1 = 1, so the measured qubit held 1, and the outcome 1 left a sign of −1 behind. Every output bit of that case is right. Only the sign is wrong, and a check of the bits alone would have passed this circuit. The second mistake puts x0 ⊕ t on y1 instead of x2 ⊕ t, and fails at the first input where those differ, input 1, on the output.
4. Every mutant
Two hand-picked mistakes prove little. This program makes every circuit that differs from the one above in a single place: one step deleted, one qubit of one step replaced by any other qubit, or the condition taken off the _if. It runs rev_meets on each, and counts the verdicts. A mutant that names one qubit twice, or applies cz_if to a qubit no measurement has named, is not a circuit at all, and the library refuses it before checking anything, as a refusal the program catches with except refuse.
import quantum
circuit = [
("ccx", [0, 1, 3], 0.0),
("ccx", [3, 2, 4], 0.0),
("mx", [3], 0.0),
("cz_if", [3, 0, 1], 0.0),
("cnot", [4, 3], 0.0),
("cnot", [4, 5], 0.0),
("cnot", [0, 3], 0.0),
("cnot", [2, 4], 0.0),
("cnot", [1, 5], 0.0),
]
spec = [0 if x % 7 == 0 else pow(x % 7, -1, 7) for x in range(8)]
mutants = []
for i in range(len(circuit)):
mutants.append(("step " + str(i) + " deleted", circuit[:i] + circuit[i + 1:]))
for i in range(len(circuit)):
gate, qubits, angle = circuit[i]
for j in range(len(qubits)):
for q in range(6):
if q != qubits[j]:
changed = qubits[:j] + [q] + qubits[j + 1:]
mutants.append(("step " + str(i) + " on " + str(changed), circuit[:i] + [(gate, changed, angle)] + circuit[i + 1:]))
if gate.endswith("_if"):
mutants.append(("step " + str(i) + " unconditioned", circuit[:i] + [(gate[:-3], qubits[1:], angle)] + circuit[i + 1:]))
why_refused = {}
held = []
for label, mutant in mutants:
try:
verdict = quantum.rev_meets(6, mutant, [0, 1, 2], [3, 4, 5], spec, [])
if verdict[0]:
held.append(label)
else:
why_refused[verdict[3]] = why_refused.get(verdict[3], 0) + 1
except refuse as e:
why_refused["not a circuit"] = why_refused.get("not a circuit", 0) + 1
print(len(mutants), "mutants")
print(sorted(why_refused.items()))
print("held:", held)110 mutants
[('input', 15), ('not a circuit', 37), ('output', 49), ('sign', 8)]
held: ['step 5 on [3, 5]']Of 110 mutants, 109 are refused: 37 are not circuits, 15 change an input, 49 compute a wrong output and 8 get only the sign wrong. One is held. It moves step 5 from cnot on qubits 4 and 5 to cnot on qubits 3 and 5, and at that point qubit 3 holds t, exactly as qubit 4 does, so the copy is the same copy. That mutant computes the same function as the original, and holding it is the right answer: a checker that refused it would be refusing a correct circuit.
The same was done for every circuit written for this demonstration, seven of them. One run of a DKE program builds at most 60,000 values, which is a published limit, so the larger sweeps were run the same way in programs of at most fifty mutants each, ninety-five programs in all:
circuit mutants refused held
adder, 4 bits, carries uncomputed by Toffolis 893 893 0
adder, 4 bits, carries measured away 946 946 0
adder, 4 bits, carries in the sum (section 5) 723 723 0
inverse mod 7 (section 2) 110 109 1
inverse mod 7, scratch uncomputed by a Toffoli 103 102 1
inverse mod 13 (section 6) 922 921 1
inverse mod 13, scratch uncomputed by Toffolis 900 899 1
total 4597 4593 4The four held mutants each compute their circuit's own function: two are the copy above, and two are a Toffoli in the mod-13 circuit whose control can be taken from either of two qubits without changing what it adds. Across all seven, 195 mutants were refused on the sign: at the first case each fails, every bit is right and only the sign is wrong.
5. An adder whose carries live in its sum
Addition is the next task: a and b of n bits each, and their sum, of n + 1 bits, on qubits that start at 0. Schoolbook addition carries from each column into the next, and the carry out of column i is the majority of a(i), b(i) and the carry in, c(i). Majority can be written with a single product:
c(i+1) = c(i) ⊕ (a(i) ⊕ c(i))·(b(i) ⊕ c(i))
So each carry costs one Toffoli, if a(i) ⊕ c(i) and b(i) ⊕ c(i) are made in place for a moment with two cnots and then undone. The other choice in this circuit is where to keep the carries. Sum bit s(i) is a(i) ⊕ b(i) ⊕ c(i), so the carry into column i can be built directly on s(i), and a last pass of cnots adds a(i) and b(i) to it. The top carry is the top sum bit. No qubit is used for scratch, so there is nothing to uncompute and nothing to measure.
import quantum
for n in [4, 7]:
a = list(range(n))
b = list(range(n, 2 * n))
s = list(range(2 * n, 3 * n + 1))
adder = [("ccx", [a[0], b[0], s[1]], 0.0)]
for i in range(1, n):
adder += [("cnot", [s[i], a[i]], 0.0), ("cnot", [s[i], b[i]], 0.0),
("ccx", [a[i], b[i], s[i + 1]], 0.0), ("cnot", [s[i], s[i + 1]], 0.0),
("cnot", [s[i], a[i]], 0.0), ("cnot", [s[i], b[i]], 0.0)]
for i in range(n):
adder += [("cnot", [a[i], s[i]], 0.0), ("cnot", [b[i], s[i]], 0.0)]
spec = [x % 2 ** n + x // 2 ** n for x in range(2 ** (2 * n))]
toffolis = len([g for g in adder if g[0] == "ccx"])
print(n, "bits:", 3 * n + 1, "qubits,", toffolis, "Toffolis", quantum.rev_meets(3 * n + 1, adder, a + b, s, spec, []))4 bits: 13 qubits, 4 Toffolis (True, 256, -1, '')
7 bits: 22 qubits, 7 Toffolis (True, 16384, -1, '')Four bits take 13 qubits and 4 Toffolis, and the 7-bit adder, 22 qubits and 7 Toffolis, is checked on every one of its 16,384 inputs. For comparison, the two other adders in the table above were written for this demonstration too: the textbook ripple-carry adder keeps its carries on scratch qubits and undoes them with Toffolis, 12 for 4 bits on 16 qubits, and measuring the carries away instead brings that to 7. Nothing here says 4 is the fewest possible; this essay compares its circuits with each other, not with the state of the art.
6. The inverse modulo 13
Thirteen needs four bits, and its table has no pattern as kind as the one modulo 7. Writing each output bit as an exclusive-or of products of input bits, the form a circuit of Toffolis computes directly, gives every product of two inputs, every product of three, and x0·x1·x2·x3. A Toffoli multiplies two things, so the work is to factor those sums into few products. With two scratch values, u = x0·x1 and v = x2·x3, and P = u·(1 ⊕ x3 ⊕ v), the four output bits come to:
y0 = x0 ⊕ x1 ⊕ x3 ⊕ u(1 ⊕ x3) ⊕ v(1 ⊕ x0) ⊕ x0(x2 ⊕ x3) y1 = x1 ⊕ x2 ⊕ (x0 ⊕ x1)(x2 ⊕ x3) ⊕ P ⊕ v(1 ⊕ x1) y2 = x3 ⊕ (x0 ⊕ x1)(x1 ⊕ x3) ⊕ x2(x1 ⊕ u) y3 = x2 ⊕ P ⊕ v(x0 ⊕ x1)
Each product is one Toffoli, with the exclusive-ors inside it made in place for a moment and undone. P appears twice, so it is computed once, onto y3 while that qubit is still 0, and copied to y1 with a cnot. The two scratch values are measured away at the end, each with its sign repaired. The inputs are qubits 0 to 3, the outputs 4 to 7.
import quantum
inverse_mod_13 = [
# u = x0 x1 on qubit 8, v = x2 x3 on qubit 9
("ccx", [0, 1, 8], 0.0), ("ccx", [2, 3, 9], 0.0),
# P = u(1 ⊕ x3 ⊕ v) into y3, then copied into y1
("cnot", [3, 9], 0.0), ("x", [9], 0.0), ("ccx", [8, 9, 7], 0.0),
("x", [9], 0.0), ("cnot", [3, 9], 0.0), ("cnot", [7, 5], 0.0),
# y3 ⊕= x2 ⊕ v(x0 ⊕ x1)
("cnot", [2, 7], 0.0), ("cnot", [1, 0], 0.0), ("ccx", [9, 0, 7], 0.0),
("cnot", [1, 0], 0.0),
# y0 = x0 ⊕ x1 ⊕ x3 ⊕ u(1 ⊕ x3) ⊕ v(1 ⊕ x0) ⊕ x0(x2 ⊕ x3)
("cnot", [0, 4], 0.0), ("cnot", [1, 4], 0.0), ("cnot", [3, 4], 0.0),
("x", [3], 0.0), ("ccx", [8, 3, 4], 0.0), ("x", [3], 0.0),
("x", [0], 0.0), ("ccx", [9, 0, 4], 0.0), ("x", [0], 0.0),
("cnot", [3, 2], 0.0), ("ccx", [0, 2, 4], 0.0), ("cnot", [3, 2], 0.0),
# y1 ⊕= x1 ⊕ x2 ⊕ (x0 ⊕ x1)(x2 ⊕ x3) ⊕ v(1 ⊕ x1)
("cnot", [1, 5], 0.0), ("cnot", [2, 5], 0.0), ("cnot", [1, 0], 0.0),
("cnot", [3, 2], 0.0), ("ccx", [0, 2, 5], 0.0), ("cnot", [1, 0], 0.0),
("cnot", [3, 2], 0.0), ("x", [1], 0.0), ("ccx", [9, 1, 5], 0.0),
("x", [1], 0.0),
# y2 = x3 ⊕ (x0 ⊕ x1)(x1 ⊕ x3) ⊕ x2(x1 ⊕ u)
("cnot", [3, 6], 0.0), ("cnot", [1, 0], 0.0), ("cnot", [1, 3], 0.0),
("ccx", [0, 3, 6], 0.0), ("cnot", [1, 0], 0.0), ("cnot", [1, 3], 0.0),
("cnot", [1, 8], 0.0), ("ccx", [2, 8, 6], 0.0), ("cnot", [1, 8], 0.0),
# u and v measured away, each sign undone
("mx", [8], 0.0), ("cz_if", [8, 0, 1], 0.0), ("mx", [9], 0.0),
("cz_if", [9, 2, 3], 0.0),
]
spec = [0 if x % 13 == 0 else pow(x % 13, -1, 13) for x in range(16)]
print(spec)
toffolis = len([g for g in inverse_mod_13 if g[0] == "ccx"])
print(toffolis, "Toffolis", quantum.rev_meets(10, inverse_mod_13, [0, 1, 2, 3], [4, 5, 6, 7], spec, []))[0, 1, 7, 9, 10, 8, 11, 2, 5, 3, 4, 6, 12, 0, 1, 7]
11 Toffolis (True, 64, -1, '')Eleven Toffolis, and the circuit meets the specification in all 64 cases: 16 inputs under the 4 outcomes of its two measurements. It met it the first time it was checked, as every circuit in this essay did. That is worth saying plainly and not worth leaning on: the next circuit a model writes may not, and the point of the check is that nobody has to take the model's word for which kind it wrote.
7. A verdict that names what it read
A verdict printed once is gone when the screen scrolls. The quantum library keeps one as a Result: a record of a result computed outside the store's own rules, naming the circuit it is about and the digest of the circuit as its producer read it. The digest is computed outside the store, here a SHA-256 of the circuit's steps, and the store never computes one: it only compares them. Record the circuit's digest and the verdict, and the library's rules decide whether the verdict still holds:
import quantum
update(quantum.Circuit.inverse_mod_13.digest, "sha256:95e4a863bb143c3eac9217155854bad523429b757351d5ff503e14a54c94d6a1", "me")
update(quantum.Result.inverse_mod_13_meets.circuit, "inverse_mod_13", "me")
update(quantum.Result.inverse_mod_13_meets.digest, "sha256:95e4a863bb143c3eac9217155854bad523429b757351d5ff503e14a54c94d6a1", "me")
update(quantum.Result.inverse_mod_13_meets.producer, "quantum 1.3.0 rev_meets", "me")
update(quantum.Result.inverse_mod_13_meets.outcome, "meets x -> x^-1 mod 13 on all 64 cases", "me")
held = current(quantum.Result.inverse_mod_13_meets.holds)
print(held.value)meets x -> x^-1 mod 13 on all 64 caseswhy asks what that conclusion rests on:
import quantum
proof = why(quantum.Result.inverse_mod_13_meets.holds)
for claim in proof:
print(claim.path, "=", claim.value)quantum.Result.inverse_mod_13_meets.holds = meets x -> x^-1 mod 13 on all 64 cases
quantum.Result.inverse_mod_13_meets.circuit_current = True
quantum.Result.inverse_mod_13_meets.circuit = inverse_mod_13
quantum.Circuit.inverse_mod_13.digest = sha256:95e4a863bb143c3eac9217155854bad523429b757351d5ff503e14a54c94d6a1
quantum.Result.inverse_mod_13_meets.digest = sha256:95e4a863bb143c3eac9217155854bad523429b757351d5ff503e14a54c94d6a1
quantum.Result.inverse_mod_13_meets.source_current = True
quantum.Result.inverse_mod_13_meets.outcome = meets x -> x^-1 mod 13 on all 64 cases
quantum.Result.inverse_mod_13_meets.device_current = TrueThe verdict holds because the circuit it names has, in the store, the digest the check read, and because it names no source circuit and no device whose digests could have moved. If someone edits the circuit, its digest changes, and the verdict stops holding, with the reason:
import quantum
update(quantum.Circuit.inverse_mod_13.digest, "sha256:a-circuit-someone-edited", "me")
print(quantum.results_not_holding())
update(quantum.Circuit.inverse_mod_13.digest, "sha256:95e4a863bb143c3eac9217155854bad523429b757351d5ff503e14a54c94d6a1", "me")
print(quantum.results_not_holding())['inverse_mod_13_meets circuit_changed']
[]Put the checked circuit back, and the verdict holds again. A certificate is about particular bytes, and this one knows which.
8. What this does not show
Only instances small enough to check completely. rev_meets holds the whole specification in one run, one expected value for each input, and a run builds at most 60,000 values. The 7-bit adder, 16,384 inputs, is certified in one run. The 8-bit adder, 65,536, is not: its specification does not fit. Past that size a check can only try some inputs, and that is a bound, not a certificate.
Only functions computed out of place. The check takes outputs on qubits apart from the inputs. An adder that writes a + b over b is a different kind of specification, and the library's other exact check, rev_same, which compares two circuits, refuses a circuit that measures.
No comparison with the best known circuits. The counts above are this essay's circuits' own. Nothing here claims one is the smallest that exists, and nothing here checked the circuits of the paper this essay began with.
The certificate is the check. A verdict is as good as rev_meets, which is published source in the library this essay links to, and can be read line by line.
The model wrote; it did not judge. Every circuit here came from a language model, and every verdict came from DKE. That division is the whole of the claim.