# We beat Google's zero-knowledge proof of quantum cryptanalysis

DevFeed: [We beat Google's zero-knowledge proof of quantum cryptanalysis](<https://devfeed.tech/articles/we-beat-google-s-zero-knowledge-proof-of-quantum-cryptanalysis-7646.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/04/17/we-beat-googles-zero-knowledge-proof-of-quantum-cryptanalysis/>)

Author: "Keegan Ryan"

Published: 2026-04-17T11:00:00Z

Content type: article

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [Zero-knowledge proof](<https://devfeed.tech/topics/zkp.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Google](<https://devfeed.tech/topics/google.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>), [Rust](<https://devfeed.tech/topics/rust.md>), [Code](<https://devfeed.tech/topics/code.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [google](<https://devfeed.tech/tags/google.md>), [memory](<https://devfeed.tech/tags/memory.md>), [memory-safety](<https://devfeed.tech/tags/memory-safety.md>), [quantum](<https://devfeed.tech/tags/quantum.md>), [rust](<https://devfeed.tech/tags/rust.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-knowledge](<https://devfeed.tech/tags/zero-knowledge.md>)

## AI overview

Trail of Bits presents a zero-knowledge proof that improves on Google's reported resource bounds for quantum circuits. The article attributes the result to memory-safety and logic vulnerabilities in Google's Rust prover code, explains the zkVM-based proof setup, and describes the released proof-forging code.

## Source excerpt

Two weeks ago, Google's Quantum AI group published a zero-knowledge proof of a quantum circuit so optimized, they concluded that first-generation quantum computers will break elliptic curve cryptography keys in as little as 9 minutes. Today, Trail of Bits is publishing our own zero-knowledge proof that significantly improves Google's on all metrics. Our result is not due to some quantum breakthrough, but rather the exploitation of multiple subtle memory safety and logic vulnerabilities in Google's Rust prover code. Google has patched their proof, and their scientific claims are unaffected, but this story reflects the unique attack surface that systems introduce when they use zero-knowledge proofs. Google's proof uses a zero-knowledge virtual machine (zkVM) to calculate the cost of a quantum circuit on three key metrics. The total number of operations and Toffoli gate count represent the running time of the circuit, and the number of qubits represents the memory requirements. Google, along with their coauthors from UC Berkeley, the Ethereum Foundation, and Stanford, published proofs for two circuits; one minimizes the number of gates, and the other minimizes qubits. Our proof improves on both. Resource Type Google's Low-Gate Google's Low-Qubit Our Proof Total Operations 17,000,000 17,000,000 8,300,000 Number of Qubits 1,425 1,175 1,164 Toffoli Count 2,100,000 2,700,000 0 Table 1: Resource upper bounds reported in different proofs for circuits computing the correct output across 9,024 randomly sampled inputs Our proof fully verifies when using Google's unpatched verification code. It has the same verification key as their original proofs and is cryptographically indistinguishable from a zero-knowledge proof resulting from actual algorithmic improvements to the quantum circuit. We are releasing the code we developed to forge the proof, and a summary of our proof follows. Circuit SHA-256 hash: 0x7efe1f62bb14a978322ab9ed41d670fc0fe0f211331032615c910df5a540e999 Groth16 pr