Claude Quantum Circuits: How a New Divsteps Proof Unlocked 17× Fewer Gates

A quantum circuit can spend much of its budget remembering how to undo its own work. The new Claude quantum circuits research attacks that overhead. Announced by Anthropic on October 16, 2026, the project used Claude Mythos 5 to redesign eight computational primitives. Seven designs reduced both Toffoli gates and qubits. The eighth introduced reversible prime-field modular inversion based on divsteps, enabling a point-addition circuit with roughly 17× fewer Toffolis than the smallest previous design, using about 12% more qubits.

The central advance is mathematical: recover earlier branch decisions from the current arithmetic state instead of storing every decision. That changes which classical algorithms become affordable inside a quantum computation.

1. What Did Claude Actually Discover About Quantum Circuits?

The research paper by Andi Gu and colleagues, submitted October 15, studies numerical evaluation, chemistry, optimization, physics simulation and number theory. These are reusable components of larger algorithms, rather than eight complete quantum applications.

1.1. Claude Quantum Circuits: Key Facts

The Anthropic quantum circuits announcement describes a 53-hour point-addition run. The model is Claude Mythos 5, not an unspecified chatbot. Its achievement depends on the search framework and evaluator as well as its reasoning.

2. The Original Problem: Why Quantum Algorithms Need So Many Gates And Qubits

A quantum circuit is a sequence of operations on qubits. A Toffoli gate flips a target bit when two control bits are set. It supports reversible arithmetic and requires costly non-Clifford resources in fault-tolerant implementations. Ancillas are temporary qubits used as workspace.

The paper counts Toffoli and CCZ gates together as $T$, and calls the maximum simultaneous logical-qubit allocation $Q$. Its scoring objective is:

A lower product rewards reductions in either resource, while exposing their trade-off. Keeping intermediate results saves recomputation but occupies qubits. Recycling workspace saves qubits but can add gates.

These are logical resources, before physical error-correction overhead. Our guide to quantum computing and artificial intelligence provides broader context for why software design matters alongside hardware.

3. The Previous Barrier: Reversibility, Branching And Uncomputation

Ordinary code can overwrite a variable and execute whichever branch matches its input. A coherent quantum subroutine must support many inputs in superposition. Its fixed circuit therefore includes controlled operations for the relevant alternatives, rather than observing an intermediate value and taking one ordinary classical path.

It must also clear temporary information. Workspace left correlated with the answer can disrupt later interference. Uncomputation removes that correlation by reversing the appropriate computation, sometimes with measurement and phase corrections.

The difficulty is knowing which earlier branch to reverse. Recording every choice works, but creates a growing history stack. Immediately reversing temporary work avoids storage, but may force expensive recomputation later.

The research reorganizes this bargain: route data through shared arithmetic, reconstruct history from surviving registers, and reserve worst-case resources only when the task actually requires them.

4. How Claude Mythos 5 Searched For More Efficient Quantum Circuits

The researchers used OpenEvolve to search over Python programs that generate circuits. Functions, loops and named registers preserved algorithmic structure. Claude could replace a decoding method or reorganize arithmetic across the circuit, rather than only simplify neighboring gates.

Each task began with a handwritten specification and a blank program. Claude proposed distinct algorithm families, developed them separately, and exchanged promising candidates across families. An independent evaluator returned correctness feedback and resource costs. Archives preserved programs and discoveries between fresh agent sessions.

This resembles the evaluator-guided search discussed in our AlphaEvolve explainer and analysis of mathematical program search. Maintaining alternatives matters because an initially expensive architecture may improve later.

Autonomy was substantial but bounded. Humans defined tasks, interfaces and scoring, and occasionally prompted broader exploration during the 53-hour run. This is an agent harness shaping research behavior, a theme also explored in BootLoops for quantitative science.

5. Modular Inversion: Why Previous Quantum Circuits Could Not Efficiently Use Divsteps

Elliptic-curve point addition needs modular division to compute a slope. For a nonzero integer $a$ and prime $p$, inversion finds $x$ satisfying:

For example, $3\times 5=15\equiv1\pmod{7}$, so five is the inverse of three modulo seven. Extended Euclidean algorithms find such inverses by expressing the greatest common divisor as a combination of the original inputs.

Classical divsteps replaces large divisions with conditional swaps, additions, subtractions and halvings. A small signed counter schedules swaps without repeated magnitude comparisons. But a reversible integer implementation needs to recover those decisions.

Earlier reversible divsteps existed for binary fields and polynomial rings, where shrinking polynomial registers can accommodate history. Integer divsteps offers no equivalent fixed space release. The new claim concerns prime-field integer inversion, not the invention of divsteps itself.

The benchmark uses 256-bit elliptic-curve arithmetic with $p=2^{256}-2^{32}-977$. Its point-addition counts include reversible cleanup, but exclude application-specific storage or lookup for the classically supplied addend. Those boundaries matter when comparing the primitive with a complete cryptographic algorithm.

6. The New Divsteps Proof: Recovering Branch History Without Storing It

Write the state as $(z,f,g,f_v,g_v)$, initialized to $(0,p,w,0,1)$. Here $w$ is the nonzero input to invert, $z$ schedules swaps, and $f_v,g_v$ track scaled input coefficients. Each active step uses one of three updates:

If $g$ is odd and $z\ge0$, set $(f,g)$ to $(g,\frac{g-f}{2})$, replace $(f_v,g_v)$ with $(2g_v,g_v-f_v)$, and negate $z$. If $g$ is odd and $z<0$, retain $f$, set $g$ to $\frac{g+f}{2}$, update the coefficients to $(2f_v,g_v+f_v)$, and increment $z$. If $g$ is even, halve $g$, double $f_v$, retain $g_v$, and increment $z$. All right-hand sides use the old state.

These rules preserve a determinant identity:

After $t$ active steps, the scaling relations are $f_vw\equiv2^tf\pmod{p}$ and $g_vw\equiv2^tg\pmod{p}$. At termination, $f=\pm1$ and $g=0$, allowing recovery of the inverse after removing the power-of-two scale.

Parity exposes swaps: $f_v$ stays even and $g_v$ stays odd. A swap produces $f_v^{\prime}=2g_v$, with exactly one trailing zero. A nonswap doubles an already even coefficient, producing a multiple of four. Further counter and termination checks recover more decisions cheaply.

The hard case is a nonterminating, negative-counter nonswap. Let $b$ record whether the incoming $g$ was odd. Write the updated coefficient as $f_v^{\prime}=2^jq$, where $q$ is odd and $j$ counts trailing zeros. The coefficient update is:

Because $q$ is odd, it has an inverse modulo $2^j$. Multiplying by that inverse gives the paper’s Equation (8):

The crucial window invariant says the parenthesized residue is less than $2^{j-1}$. Earlier history therefore cannot contaminate the next bit. Equation (9) extracts the decision:

Bits are numbered from zero. For intuition, take $j=3$, $q=3$, and an incoming normalized residue of three. An odd branch adds four, producing seven. The highest bit changes from zero to one. This illustrates the decoding arithmetic, not a complete divsteps walk.

The reported Lean formalization establishes branch recovery under the recurrence’s invariants. As with our Fermat formalization coverage, the exact statement being checked matters. It does not certify global circuit optimality.

7. How The New Design Achieved 17× Fewer Gates

Decoding every branch is possible in principle but increasingly expensive at larger depths. A configurable cutoff selects shallow decisions for decoding and deeper decisions for storage. This creates a Pareto frontier: designs offering different balances of gates and qubits.

7.1. Point-Addition Resources In Context

The rounded counts yield about 17× fewer gates and 12% more qubits against the smallest prior design. Against Schrottenloher, the new circuit saves qubits but uses more gates. The baseline determines the headline.

The selected design stores at most 60 ambiguous decisions and schedules 533 steps, checking termination from step 499. The worst-case bound is 590 steps. Sampled stack overflow occurs about 2.4 times per million inversions, while stopping outside the supported window occurs around once per 100,000.

These are bounded-failure assumptions, not universal success guarantees. The full point adder recorded four failures in 100,000 tests. Physical runtime additionally depends on depth, routing, error correction and magic-state supply.

Failure probabilities also belong to a specified input distribution. A downstream application cannot assume the same rate for arbitrarily chosen or adversarial inputs. Reusing the circuit requires checking that its input promise and permitted error fit the surrounding algorithm, including how often the subroutine is called.

8. The 12× Reed–Solomon Breakthrough: Replacing Euclidean Decoding With Berlekamp–Massey

Decoded quantum interferometry, or DQI, uses coherent error-correcting decoding to favor good optimization solutions. Its optimal polynomial intersection application seeks a low-degree polynomial satisfying many finite-field constraints. A Reed–Solomon decoder reconstructs error locations from compact checks called syndromes.

The previous optimized DQI construction used a synchronized extended-Euclidean solve. Input-dependent divisions and swaps were expensive to fit into one fixed circuit. Claude switched to Berlekamp–Massey, which processes a fixed syndrome sequence to construct a locator polynomial whose roots identify error positions.

The tested instance uses 70 syndromes for at most 35 errors. Berlekamp–Massey reduced arithmetic, but straightforward reversibility would retain overwritten polynomials. Claude exploited a freedom: multiplying the locator by a nonzero scalar preserves its roots. Rescaled updates and conditional routing made both branches share arithmetic and eliminated most polynomial history.

Updated constant coefficients also recover overwritten discrepancies. Rare exceptions still need storage. Across 403 million classical sample decodings, requiring a second exceptional entry occurred about once in 10,000 under the DQI input distribution. Allocating one 19-qubit entry replaced a 35-entry, 665-qubit worst-case reserve.

The complete decoder falls from approximately 5.1 million Toffolis and 1,938 qubits to 440,000 and 1,837. The paper reports about 12× improvement in combined cost. This is a smaller coherent decoder, not a demonstrated 12× application speedup.

9. The Other Six Quantum Circuit Improvements Across The Paper

The remaining results show how different structural insights produce efficient quantum circuits. Counts below follow Table I, rounded as published. Combined gains compare Toffoli count multiplied by peak logical qubits.

9.1. Six Designs, Their Resource Savings And Their Mechanisms

Hermitian decoding has no directly comparable published reversible baseline. Its dramatic savings against a naïve construction therefore belong in a separate comparison category.

10. How Were Claude’s Quantum Circuit Discoveries Verified?

The evaluator uses the kickmix model: reversible classical gates, diagonal sign gates and restricted measurement-based uncomputation. On a computational-basis trajectory it tracks bits, a phase sign and measurement outcomes, avoiding a full exponentially large state vector.

Each test checks the required output, preserved input registers, phase correctness and clean ancillas. Correct output bits alone are insufficient: a wrong phase can spoil interference. If every allowed trajectory passes, linearity extends correctness to superpositions. Large-domain sampling gives statistical evidence under the stated distribution, rather than exhaustive proof.

The released circuits, evaluator and Lean proofs make the evidence inspectable. The repository identifies formal developments for divsteps branch recovery and its step bound, plus a DQI decoder-error bound. Those mathematical results and sampled circuit tests establish different things.

Our discussion of Lean verification explains why definitions, assumptions and formalization scope remain essential. Developers assessing reuse should inspect task contracts, reproduce resource counts and test the input distribution their larger algorithm actually supplies.

11. What Do These Discoveries Mean For Practical Quantum Computing?

The useful result is a smaller logical workload for specific primitives. Chemistry selection, numerical evaluation and DQI decoding become less expensive within their specified interfaces. General-purpose quantum circuit optimization remains harder, especially when classical validation is intractable or a better encoding lies outside the interface.

Elliptic-curve arithmetic also matters to quantum discrete-logarithm attacks. This work demonstrates no present-day cryptographic break and supplies no justified attack date. Our AI cryptography analysis covers the importance of stating exactly what an attack result establishes. Hardware evidence, such as the experiments discussed in our Willow quantum-chip explainer, answers a different engineering question.

The Claude quantum circuits study offers a concrete research lesson: redesign the algorithm, representation and cleanup together, then verify each claimed saving. Follow Binary Verse AI for source-led explanations connecting new proofs and algorithms to what developers and researchers can actually use.