A confident verdict is only worth what its worst error costs. For Atlas that worst error is false-safety — saying "classical is enough" when it is not. This page is the adversarial audit of that failure: how we attack it, what we measured, what we guard, and the limits we declare instead of hiding.
Atlas says CPU/cheap, but the circuit really needed a QPU or a cluster. The user trusts a wrong "don't buy" and gets a wrong answer. This is the failure that destroys trust, and the one the architecture is constrained to never make on a certified case.
Atlas over-routes (says harder than necessary). You spend more than you had to, but you do not get a wrong scientific result. Annoying, not dangerous — and on the corpus this happens 0 times.
Source: SELF_ASSESSMENT #1, corpus adopted 2026-09-05 (D42). Across the 2,517 certified circuits Atlas and the oracle agree on 2,517 rows under the shared definition C (0 strict false-safety, 0 false alarms); the 42 false alarms of the previous oracle definition were pricing differences, not routing errors. Three-number reading, robustness table and definition in Benchmark §2.
The composition exists precisely to cancel each single method's blind spot. Measured on the 800-circuit slice where single-estimator baselines exist (FS = false-safety, FA = false-alarm):
| Estimator | False-safety | False-alarm | failure mode |
|---|---|---|---|
| Atlas (min-over-methods) | 0 | 0 | matches the oracle on 800 of 800 rows (743 cpu · 49 tensor); misses: 0 (over-routes when any) |
| treewidth-only | 0 | 220 | cries wolf — greedy contraction width sends cheap circuits to HPC and escalate |
| MPS-only | 0 | 162 | over-calls tensor against the oracle’s 49 — and see the truncation note below |
| magic-only | 8 | 542 | T-count alone is nearly uninformative about route |
This is the real selling stat of multi-method routing: no single axis gets you near the oracle. Every single estimator over-routes — treewidth 220 rows, MPS 162, magic 542 — and over-routing is what you pay for in cluster hours. Atlas is 0 / 0 on this slice: never the unsafe direction, and an order of magnitude fewer over-routes than any axis alone. Single-estimator classes use counterfactual readings where the engine settled the route by theorem (Clifford: Stim) and skipped the axis.
A truncated MPS bond is a lower bound on entanglement, so an MPS-only router says "cheap" on exactly the circuits whose true bond it failed to reach. Measured: 86 of 800 rows have a truncated bond, and MPS-only calls all 86 cheap. On this corpus none of those 86 undercuts the oracle, so the false-safety column reads 0 — but that is a fact about this corpus, not a property of the estimator. The guard exists because the failure mode is real by construction; we are not going to claim it is absent because the body count is currently zero. This is why a truncated bond is never allowed to certify a cheap route in Atlas: treewidth (cotengra) is a greedy upper bound, magic via Stim is exact, and Atlas surfaces which is which rather than treating all axes as equal measurements.
Source: direct recount of treewidth_only_class / mps_only_class / magic_only_class vs oracle_route in scaled_results.csv, verified same-vintage by benchmarks/regen_baselines.py (0 cells relabelled, slice sha256 5c0aac88 unchanged — the baselines are computed by the same route_adjudicator.py the deployed engine uses). Scope: only the core-800 slice records these columns; ext-90 and moat-1627 do not, so this table is not a corpus-wide statement. The counts moved since the June reading because the oracle gained the stabilizer-rank certificate and now certifies more circuits cheap — which mechanically lowers every estimator’s false-safety and raises its false-alarm. SELF_ASSESSMENT #1; COMPETITIVE.md §4.
A deferral that keys off the predicted route is, by construction, blind to false-safety — because false-safety is Atlas not routing hard. So the guard had to be route-independent.
atlas_falsesafety.py measures evidence fragility on a cheap verdict — a trusted estimator routing harder, a small margin to the next harder threshold, reliance on an invalidated/truncated bound — gated by whether the governing estimator is exact. HIGH risk on a cheap verdict downgrades the tier to verify. The iteration was honest: the first cut over-flagged 71% of trivial CPU circuits (statevector-by-qubit-count is structurally pessimistic for n>21); gating on governing-estimator exactness fixed it.
0% over-flag on trivial CPU circuits, and the then-known false-safety still caught (HIGH → verify). That circuit, moat_ladder_n28_t8_s3, has since been resolved by the stabilizer-rank certificate rather than by the guard — so the guard currently has no live positive to point at, and we say that instead of implying a catch it is not making today. It reduces the measurable false-safety surfaced as a confident verdict; it does not conjure ground truth where none exists.
Source: SELF_ASSESSMENT #1 (atlas_falsesafety.py); AUDIT_BACKLOG (713630e: route-independent guard, 0% over-flag on trivial CPU, catches the 1 known false-safety).
An adversarial pass red-teamed the triage path itself. It found a real denial-of-service: a crafted dense circuit could make the cost routine hang (compute-bound) instead of degrading gracefully.
Finding and fix: the engine's compute-bound hang on dense n≥32 is resolved by a per-circuit wall-clock timeout that degrades, not hangs — atlas_timeout.cost_atlas_guarded (fork+kill). On the hard-regime slice: 8 resolved / 2 compute-bound / 0 hangs. The adversarial battery is a permanent regression: 0 false-security across its rounds (self-designed; ~8 vectors over 2 rounds — stated exactly, not inflated).
It is over the adversarial battery's N circuits (2 rounds, ~8 vectors), self-designed — we say exactly that, not "0 false-security, period." On the threaded web tier, fork-after-threads is unsafe, so the guarded path runs in batch/CLI and the web tier keeps an n-cap. That trade-off is declared, not hidden.
Source: benchmarks/adversarial_attack.py + adversarial_findings.json (CLAIMS C3); AUDIT_BACKLOG P1-7 (cost_atlas_guarded fork+kill, f2e4eeb+); CLAIMS C4 (guard reach-2q + killable delegation in webui.py).
An audit is only credible if it can reverse a published number against us. This one did.
An earlier session, using a "device-faithful" Aer simulator, measured a per-layer ratio κ̂ ≈ 0.40 (<1), implying hardware degrades slower than inferred — "extend the depth ceiling ~14%." Our own Porter-Thomas calibration on real metal reversed it: κ̂ = 2.62 (>1). The simulator was underestimating correlated/non-Markovian noise. The correction tightens the realistic ceiling to ≈11 layers (vs an optimistic first-order 29–49) — i.e. it moved to the conservative, safe side. We never re-introduce κ̂<1.
Source: QPU_RESULTS.md §7; DEBTS (auto-correction #10); detail on the Benchmark page §5.
Each lens and extension below was verified in-session with a reproducible command. Run with PYTHONPATH=src pixi run python <module> from physics-magnitude-lab/.
| Lens / order parameter | Module | Verification |
|---|---|---|
| 1 · magic (fold) | regime_classifier | n_T* = 2.41 (SoTA) |
| 2 · entanglement (min-cut) | idea6_mincut_lens | S ≤ min-cut in all cases (bound holds) |
| 3 · treewidth | contraction_router | 2^treewidth, interaction graph |
| 4 · operator-spread (avalanche) | avalanche_meter | predicts peak 66.283 = measured |
| 5 · non-Gaussianity (flattener) | flattener | hop+T (T=800) → 2³²⁰ → 2 ms |
| 6 · central charge | idea1_critical_lens | c → 0.5 (Ising), Calabrese-Cardy |
| 7 · negativity / sign | idea14_negativity_lens | control κ_sign = 0.000 / diamond 0.641 |
Full ledger (lenses + 5-idea extensions + 8 pieces, each with module and verified number, plus the named honesty limits) in AUDIT_LEDGER.md. Reproducible images: phase_diagram.png, invasion_percolation.png, sandpile.png.
| Limit | Status |
|---|---|
| External audited benchmark | CONCEDED — the #1 credibility gap. The corpus and oracle are self-generated; the conformal guarantee is honest given the corpus, but no third party has audited the oracle or the families. |
| Hard (ESCALATE) regime | Unmeasurable by construction — 0 of 2,517 certified there (the BQP≠BPP wall). False-safety there is reduced, not proven absent. |
| Corpus diversity | 2,517 variants, not 2,517 independent structural families; exchangeability assumed, not proven. |
| Transpiler / SWAP overhead | Not in the cost metric — Atlas costs the logical circuit (known limitation, not a strength). |
| Noise model | UI slider is a toy-global envelope; the measured per-edge model lives in noise_local_validation but is not yet wired to the interactive panel. |
| False-safety in hard hardware | A genuinely hard circuit will not run with fidelity either → the judge is the classical guard (validated 0/5), not the QPU. |
| External audit — roadmap | The corpus, oracle definitions, family generators and confusion-matrix script are all public (github.com/fomv9354lve/atlas-engine, Apache 2.0) — reproduction needs nothing from us. SCOPING a formal external audit: a third party re-runs the oracle + confusion-matrix on the public corpus and signs off. Reproduce path → |
Source: SELF_ASSESSMENT (limits table); DEBTS.md (P2/P3 + "fundamental limitations — not debt"); COMPETITIVE.md §4. The rule is constant: declare the ignorance, do not hide it.
What's genuinely new despite the gap: the treewidth↔MPS divergence →