Pillar C · State as of 2026-10-10

What is the only quantum advantage claim that survives today, and why is it certified randomness?

As of October 10, 2026, exactly one quantum-advantage claim in the public record is attached to a delivered application rather than a synthetic benchmark: certified randomness — 71,313 bits of entropy produced over the internet by the 56-qubit Quantinuum H2-1 and certified with 1.1 ExaFLOPS of classical supercomputing (Liu et al., Nature, March 26, 2025). The claim survives because its output is checked rather than estimated, and its fine print is printed by its own authors: security holds against «a restricted class of realistic near-term adversaries», certification costs more than generation by design (Aaronson & Hung put the practical ceiling near 60 qubits, arXiv:2303.01625), and the field’s 2026 review still lists efficiently verifiable certified randomness as a future milestone (Hangleiter, arXiv:2603.09901). Rosetta Quantum reads it as the strongest surviving claim — with every asterisk printed beside it.

→ Leer en español

State as of: 2026-10-10

Status as of: October 10, 2026. Every number in this post carries its source and date beside it. Ten earlier Rosetta Quantum posts are cross-linked below and not re-litigated here.

What exactly was delivered, and by whom?

71,313 bits of certified entropy — produced by the 56-qubit Quantinuum H2-1 trapped-ion processor, accessed over the internet, in a collaboration of JPMorganChase, Quantinuum, Argonne and Oak Ridge national laboratories and the University of Texas at Austin, published in Nature on March 26, 2025 (Liu et al.; the preprint is arXiv:2503.20498). The protocol has four moving parts, and naming them is most of the explanation. First, the client — the party who wants randomness it can prove it did not fabricate — stretches a small random seed into a stream of pseudorandom «challenge» circuits. Second, an untrusted quantum server must return samples from those circuits fast: the response window is the security mechanism, because a cheater armed with classical simulators would need more time than the protocol allows to fake passing samples against «the best currently known techniques» (JPMorganChase release, March 26, 2025). Third, the client verifies the returned samples with the cross-entropy benchmark (XEB) on classical supercomputers — the experiment measured 1.1×10¹⁸ floating-point operations per second of combined sustained performance across multiple machines for this step (abstract, arXiv:2503.20498). Fourth, a randomness extractor distills the verified samples into near-uniform certified bits. The output is the application: entropy that matters, in the release’s words, for «cryptography, fairness and privacy».

What was claimed is narrower than what parts of the press reported, and the narrowing was done by the authors themselves — the author-caveat pattern our paper-reading guide hunts for. Scott Aaronson, whose 2023 protocol with Shih-Han Hung the experiment implements, said in the collaboration’s own release: «This is a first step toward using quantum computers to generate certified random bits for actual cryptographic applications». A first step, delivered: the release claims no production deployment, and Rosetta Quantum found none in the public record at today’s reading.

Why does this claim survive when the flagship margins fell?

Because what it sells is checked, not estimated. The famous supremacy claims were statements about counterfactual classical cost — «this would take a classical machine 10,000 years» — and that genre has aged badly: the 2019 margin inverted outright when a classical re-run finished the benchmark 7× faster than the quantum machine, as we mapped in our Google-2019 post, and the photonic margins shrank by nine orders of magnitude from algorithms alone (our boson-sampling post). Certified randomness has a different shape. The classical supercomputer is not a rival to be beaten by estimate; it is the referee, paid 1.1 ExaFLOPS to check each batch after the fact. The quantum machine does not have to stay faster than every future classical algorithm; it has to produce passing samples inside a response window that the best currently known classical methods cannot meet — a dated, testable statement, the same shape as a row of the Rosetta Quantum ledger.

Two precisions keep the superlative honest. First, «only survivor» means only surviving applied claim: the random-circuit-sampling records themselves are listed as «unrefuted» in the field’s first peer-reviewed history (LaRose, Quantum 10, 2198, September 2026) — but those are synthetic benchmarks with estimated margins, exactly the genre whose erosion we track in our tensor-networks post. Certified randomness was the single applied entry in our usage map of October 6, and nothing in today’s reading changes that. Second, this claim has no time-to-solution ratio R — the unit our ledger adopted for margins in the by-how-much post — because no classical rival produces the same deliverable at any price: a classically generated «certificate of quantumness» is a contradiction in the protocol’s own terms. Where a margin cannot be computed, the ledger reports asymmetrically and says so. The units this claim is measured in are certified bits under a stated adversary model (71,313), and the price of checking them (1.1 ExaFLOPS). Both are on the scoreboard.

What does the fine print say?

Three asterisks, all printed by the authors themselves. One: the adversary is bounded by assumption. The abstract certifies the 71,313 bits «under this restricted adversary and additional assumptions» — the security analysis covers «a restricted class of realistic near-term adversaries», not an unbounded one (arXiv:2503.20498). A cheater with more classical compute than the analysis grants sits outside the certificate. Two: verification costs more than generation, by design. Aaronson and Hung wrote in the protocol paper that verification is exponentially expensive and that the practical regime sits near 60 qubits — large enough that spoofing attacks are costly, small enough that checking stays possible (arXiv:2303.01625, March 2, 2023). That is why the certifier outweighed the prover in 2025 — 1.1 ExaFLOPS of supercomputing refereeing one 56-qubit machine — and why the protocol as demonstrated does not scale by adding qubits: more qubits make the referee’s job impossible, fewer make the cheater’s job cheap. Three: the metric itself is under live classical attack. The hardness of spoofing linear XEB rests on a conjecture, XQUATH, that «has been disproven for sublinear depth circuits», and a related score used in Hamiltonian-simulation supremacy claims «can be classically simulated efficiently in certain regimes» (Tanggara, Gu & Bharti, arXiv:2405.00789, v2 February 3, 2026). Dominik Hangleiter’s assessment, in the blog series accompanying his 2026 perspective, is blunter: «verification uses XEB which can be classically spoofed, and only actually measured in the simulatable regime» (Quantum Frontiers, February 28, 2026). None of this refutes the March 2025 certificate — it was issued against the methods of its day and says so — but it is why the milestone list below still ends in the future tense.

What has happened since the Nature paper?

Three dated developments. First, November 5, 2025: the same industrial team posted a follow-up preprint — certified randomness amplification on Quantinuum’s 98-qubit Helios, streaming gates to the processor in real time, holding the state coherent for ≈0.9 seconds and revealing measurement bases only milliseconds before measurement, so that a classical spoofing window of ≈30 ms constrains any adversary to a ≈4,500 km radius; measured fidelity was 0.586 on 64-qubit circuits with 276 two-qubit gates (arXiv:2511.03686, November 5, 2025). Its stated advance is removing the need for «physically co-located, loophole-free Bell tests» — the constraint that kept the strongest form of certified randomness pinned inside one laboratory. At our reading it is a preprint by the interested parties, not yet peer-reviewed, and the ledger reads it at exactly that level. Second, March 10, 2026, revised September 8, 2026: the field received a formal perspective titled «Has quantum advantage been achieved?» — Hangleiter answers yes, with the loopholes «scalability and verifiability» explicitly open, and lists among the milestones for the coming 100-logical-qubit era to «eventually demonstrate classically verifiable advantage with applications to certified randomness» (arXiv:2603.09901). Read that carefully: in the field’s own referee document, the efficiently verifiable version of this post’s subject is a milestone ahead, not a result behind. Third, February 3, 2026: the XEB-spoofing paper above reached its v2. The direction of all three is the same — the 2025 result stands as dated, and the race between certification and spoofing will be scored in public.

What does certified randomness NOT demonstrate?

Nothing beyond itself. It says nothing about chemistry or drug discovery, nothing about optimization or logistics, nothing about machine learning — the feasibility verdicts for those classes are unchanged in our molecular-simulation post, our routing post and our QML post, and none of them inherits a point from this protocol. It is not device-independence: the older Bell-test lineage — NIST extracted «1024 random bits uniform to within 10⁻¹²», certified by «the impossibility of superluminal signals» (Bierhorst et al., Nature 2018; arXiv:1803.06219) — rests on physics rather than computational hardness, a strictly stronger guarantee bought at the price of a co-located loophole-free Bell test (the Bell record itself is mapped in our entanglement post). The 2025 protocol trades that physical guarantee for remote operation plus a hardness assumption. It is not a commercial market: the counter of advantage-backed commercial workloads in our usage map read 0 on October 6, 2026, and one demonstrated protocol with published caveats does not move it. And it does not retire existing randomness products: hardware random-number generators are sold today without any advantage claim — what the 2025 result adds is not better randomness but a certificate that an untrusted remote device could not have faked its output classically, under the stated assumptions.

Approach	Guarantee rests on	Demonstrated	Fine print	Source
Bell test (device-independent)	impossibility of superluminal signaling	1,024 bits uniform to within 10⁻¹² (2018)	requires a co-located, loophole-free Bell test	arXiv:1803.06219 / Nature 2018
Random circuit sampling (Aaronson–Hung)	classical hardness of sampling + response window	71,313 bits on 56 qubits (Nature, 2025-03-26)	restricted adversary; 1.1 ExaFLOPS to verify; ≈60-qubit practical ceiling	arXiv:2503.20498 · arXiv:2303.01625
Amplification over a network	fast sampling + measurement bases revealed late	98-qubit Helios demo (preprint, 2025-11-05)	preprint, not yet peer-reviewed; ≈30 ms spoofing window; ≈4,500 km adversary bound	arXiv:2511.03686

What we don’t know

We don’t know whether the restricted-adversary bound survives better classical sampling: the certificate is dated by construction, and the spoofing literature above is active — a future method that produces passing samples inside the window would not rewrite history, but it would end new certificates of this design. We don’t know whether anyone runs RCS-based certified randomness in production: the public record shows a demonstration and a release, not a deployment, and JPMorganChase has published none at our reading. We don’t know whether the Helios amplification result survives peer review — it is a preprint by the interested parties, and this post will be superseded on that row when a reviewed version appears. We don’t know the complete adversary model of the Nature paper: the full text sits behind a paywall for this run, so our quotes come from the authors’ own abstract, the arXiv record and the collaboration’s release — a sourcing limitation we declare rather than hide. And we don’t know whether an efficient verifier exists: finding one would make certification cheap — and the same discovery would likely reshape the hardness story it rests on, which is why the field’s milestone list keeps it in the future tense.