We pre-register criteria before we run. If nothing breaks, we say so. Most firms assume the threat and sell the fix.
What this means
Pre-registration means we write down what a positive result looks like before we run a single circuit. If the data does not meet those criteria, we report a null. No rounding. No post-hoc reframing. No "the threat is still real even though our test found nothing." Our own 10-run baseline on ibm_fez returned zero breaks, and we published it.
The risk without it
An industry built on assumed urgency has no incentive to publish null results. When every assessment confirms the threat and recommends the same migration stack, you cannot tell the difference between a real signal and a vendor incentive. You migrate everything, or migrate the wrong things first, and the budget is gone before the actual exposure is addressed.
How we do it
We use a three-discriminator null-test framework. Criteria are pre-registered before any hardware run. Discriminator 1: measurement entropy relative to classical baseline. Discriminator 2: output distribution compared to PRNG. Discriminator 3: circuit depth vs. decoherence signature. All three must clear threshold for a positive result. If they do not, the result is null, and the null is the finding.
Evidence
- -Three-discriminator null-test framework, criteria fixed before hardware run
- -10/10 ibm_fez runs returned null, published as the honest baseline
- -Pre-registration discipline applied to every client assessment
- -Null result = a finding, not a failure