On October 16, Anthropic announced that it had used its AI model Claude Mythos 5 to design eight basic circuits needed for quantum computation, reducing computational resources compared with conventional approaches. On seven of the eight tasks, the new circuits cut both the operation count and the qubit count relative to the comparison circuits. For the remaining task, elliptic-curve point addition, Claude found a design that slightly increases the qubit count but cuts the operation count to about one-seventeenth. The research was led by Andi Gu, who participates in Anthropic's STEM Fellows Program, with collaborators including researchers from Harvard University and QuEra Computing. The paper summarizing the results is a preprint submitted to arXiv on October 15; it does not confirm any speedup on an actual quantum computer. The key to the result was a technique that reduces the circuit's burden by recovering intermediate history when needed, rather than storing all of it.
In quantum circuits, the key question is how to erase intermediate information
In a quantum circuit, even erasing the working information used midway through a computation requires operations. To compute while preserving superposition, the working qubits must be returned to their original state after use, so that no unwanted entanglement remains with the output. Unlike in an ordinary program, intermediate values cannot simply be overwritten or discarded.
The technique used for this is "uncomputation," which traces the computation backward to cancel the working information. Holding intermediate values for longer reduces recomputation, but requires more qubits. Conversely, if information is erased early and qubits are reused, more operations are needed later to recompute values that turn out to be required. In other words, depending on which information is stored and which is recomputed, the resources needed for a circuit that produces the same result can vary widely.
Conditional branching also faces constraints that ordinary programs do not. When the input is in superposition, the approach of "checking a condition and running only the matching process" cannot be used as is. The processing for different inputs must be built in advance into a single fixed sequence of gates. As a result, an algorithm that is efficient on a conventional computer can require substantial resources for branching and for erasing working information once it is converted into a quantum circuit. The paper's description of its method also presents a mechanism for evaluating candidate circuits with these constraints in mind.
The research team gave Claude the specification of a computation and had it generate quantum circuits in Python. The generated circuits were verified for correctness by an external evaluation program, which also measured the operation count and the number of qubits needed at the same time. The main metric was the product of these two values. Claude received the evaluation results, revised its designs, and improved several algorithms in parallel.
The search for elliptic-curve point addition reportedly lasted 53 hours. It was not entirely free of human intervention, however: the researchers gave the initial instructions and at times prompted Claude to broaden its search. Setting this human involvement aside, the autonomy Anthropic describes means that Claude repeatedly implemented, verified, and improved candidate circuits on its own.
Recovering branch history from post-computation values instead of storing it
Elliptic-curve point addition is an operation that takes two points on a curve and finds a new point corresponding to their sum. It is the core step of algorithms that solve the elliptic-curve discrete logarithm problem on a quantum computer, and accounts for most of the required computational resources. This study targeted secp256k1, an elliptic curve defined over a 256-bit prime modulus.
The most computationally demanding part of point addition is computing the "modular inverse." For an integer a, this means finding x such that the remainder of a×x divided by p is 1. It is needed to compute the slope of the line connecting two points on the elliptic curve.
The algorithm Claude focused on, "divsteps," repeatedly applies operations such as swapping, addition and subtraction, and halving to two numbers. It can be computed efficiently on conventional computers, but in a quantum implementation the branch history, meaning which operation was chosen at each step, becomes a problem. To make the computation reversible, this history must be available for later reference. Trying to store the entire branch history would require a large number of qubits for that purpose alone.
Claude therefore reasoned that if the previous operation could be inferred from the post-computation numbers and coefficients, the full branch history would not need to be stored. According to Anthropic, it first tried recovery using simple rules, which succeeded in small-scale tests but did not work properly for the 256-bit problem. It then analyzed the divsteps iteration mathematically and derived formulas for recovering branches from the information left in the coefficients. The paper's section on reversible modular inversion explains these mathematical relationships and how they are incorporated into the quantum circuit.
Recovering the history, however, itself requires operations. The final design therefore does not store history that can be recovered with few operations, and stores only history that would require many operations to recover. By tuning the criterion for switching between storing and recovering, the team obtained a range of options, from designs that use more qubits to reduce operations to designs that use more operations to save qubits.
What is the "one-seventeenth" reduction measured against?
The divsteps circuit requires about 4 million Toffoli operations and 935 logical qubits per elliptic-curve point addition. Toffoli gates are costly to execute in error-corrected quantum computation, so their count is a key indicator of computational load. Logical qubits, meanwhile, are computational qubits protected by error correction, and differ from the number of physical qubits installed in a quantum computer.
The result of "cutting the operation count to about one-seventeenth" comes from a comparison with a circuit the research team reimplemented based on the qubit-saving approach of Luo et al. The point-addition evaluation records that the team published on GitHub also list the unrounded figures. The comparison with the main existing approaches is as follows.
| Comparison on the same point-addition task | Toffoli operations | Peak logical qubits |
|---|---|---|
| Luo et al. approach, reimplemented by the research team | 69,529,757 | 838 |
| Divsteps circuit designed by Claude | 4,006,673 | 935 |
| Schrottenloher's existing approach | About 1,900,000 | 1,446 |
These figures are based on the October 2026 paper and the research team's public records. All of them target the same affine-coordinate point addition and include the uncomputation that erases working information. They do not, however, include the storage and lookup process for supplying the point to be added from the classical computer side. The evaluation of the divsteps circuit also applies the input distribution and tolerated failure rate described below.
Calculated from the published figures, Claude's divsteps circuit needs about 17.4 times fewer Toffoli operations than the Luo et al. approach, while its logical qubit count rises by about 11.6%. The resource cost, evaluated as the product of operation count and qubit count, is about 15.6 times lower. Specifically, the operation ratio is 69,529,757 ÷ 4,006,673, the qubit increase is 935 ÷ 838 − 1, and the two are combined to compare the products. These are values calculated by the author from published records, not results measured by independently rerunning the circuits.
The assessment changes with the comparison target, however. Compared with Schrottenloher's existing approach, Claude's divsteps circuit needs about 35% fewer logical qubits but about 2.1 times as many Toffoli operations. Which circuit is better depends on whether reducing operations is the priority or the number of available logical qubits is limited. The result is best understood as widening the range of circuits that can be chosen according to such constraints.
A reduction in Toffoli operations also does not translate directly into the same reduction in runtime. Actual runtime also depends on the processing required for error correction and on how many resource states used in operations can be supplied in parallel. The paper also distinguishes cases where circuit depth, rather than total operation count, determines runtime.
The Lean proof and the failure rate the circuit tolerates
The Lean proof materials published by the research team cover points such as the divsteps iteration terminating within 590 steps for the target inputs, and the branch history being recoverable from the updated state. Lean is a system that formalizes mathematical statements and checks whether their proofs are correct. However, the published materials state explicitly that they do not formally prove the correctness of the entire quantum circuit or the operation-count estimates.
Furthermore, the resource-saving circuit is not designed to run all 590 iterations at most. The number of iterations is limited to 533, and the area for storing branch history is also capped. For rare inputs, such as those where iteration runs long, the circuit is allowed to fail, and in exchange the operation and qubit counts are reduced. In other words, the guarantee that branch history can be recovered mathematically is a separate matter from whether the resource-limited actual circuit succeeds on every input.
The point-addition evaluation assumes inputs in which two points on the elliptic curve are chosen nearly uniformly and independently, excluding exceptional cases where the coordinate formulas used do not apply. For this input distribution, the specification tolerates a failure rate of at most 2×10⁻⁴ per point addition. According to the paper's appendix, 4 of 100,000 tests on the full circuit failed. These failures arise from the circuit's resource limits and do not represent the failure rate caused by noise in an actual quantum computer.
The evaluation program checks more than the numerical results of the computation. It also checks whether the inputs that should be preserved remain unchanged, whether the working qubits have been returned to 0, and whether the phases that affect later quantum interference are correct. For circuits of the kind targeted here, tracking the bit strings and phases for individual inputs and measurement outcomes allows correctness to be verified efficiently even on a conventional computer.
Because the input space is large, however, actual verification tests sampled inputs. A failure rate obtained from samples is not a guarantee for all inputs, and errors affecting the entire superposition need to be evaluated separately. Distinguishing among formal mathematical proof, sample-based circuit testing, and confirmation on an actual quantum computer is important to assessing these results correctly.
Storing and recovering information selectively also worked in a decoder
The other major improvement in this research came in Reed–Solomon decoding, used inside the quantum optimization algorithm Decoded Quantum Interferometry (DQI). It makes more efficient the mathematical decoding process handled in earlier DQI research, and differs from improving the performance of decoders that correct noise in the quantum computer itself.
Claude first replaced the extended Euclidean algorithm, whose processing varies depending on the input, with the Berlekamp–Massey algorithm, which performs the same form of processing in every iteration. It then adopted a scheme that recovers many of the temporary values generated during the computation from the current state and stores only the exceptional information that cannot be recovered. This achieved both greater efficiency in the algorithm itself and a reduction in the resources needed to store working information.
Reserving storage for the case where exceptions occur most often would require 665 logical qubits. For the target input distribution, however, exceptions occur infrequently, so Claude chose a design that reserves only 19 logical qubits, corresponding to a single case. According to the paper's appendix, in verification using 400 million samples, the combined probability of two failure causes, including insufficient history storage, was 1.4×10⁻⁴. Here too, the required computational resources are reduced by tolerating inputs that fail with low probability.
The reduction from 665 to 19, however, refers to the area for storing exceptional history, and does not mean the decoder's overall qubit count fell by that much. According to the paper's comparison table, the peak number of logical qubits needed for the full circuit fell from 1,938 to 1,837, and Toffoli operations fell from about 5.1 million to about 440,000. The roughly 12-fold improvement Anthropic emphasizes refers to this reduction in operation count.
What elliptic-curve point addition and Reed–Solomon decoding have in common is that, after reviewing the algorithm, Claude examined how much intermediate information could be recovered and allocated resources according to the tolerated failure rate. In both cases, the large efficiency gains came not from minor tweaks to existing circuits but from redesigning the computation methods and circuit structures themselves.
The results show the possibility that AI can find mathematical techniques different from conventional ones in designing quantum algorithms and turn them into reduced computational resources. Connecting this to practical quantum computation, however, will require verifying which designs actually reduce processing time and resource consumption, including the constraints of error correction and physical devices. Going forward, what will matter is not only comparisons of operation and logical qubit counts but also how much efficiency improvement is achieved on real hardware.