Pith. sign in

REVIEW 4 major objections 4 minor 22 references

Fault Attacks on ML-based Quantum Control and Error Correction

T0 review · 4 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A voltage-glitch adversary can corrupt the ML models that correct quantum readout errors, with early layers far more vulnerable than later ones.

desk verdict Real HERQULES fault-injection results, but the abstract's Deep Q surface-code experiment is nowhere in the body — on current evidence, the paper supports only half of its advertised scope. read the letter →

arxiv 2512.20077 v2 pith:UJWFCLGH submitted 2025-12-23 quant-ph cs.CR

Anthony Etim , Jakub Szefer This is my paper · ORCID
classification quant-phcs.CR
keywords voltageglitchingfaultinjectionquantumreadoutmachinelearningerrorcorrectionhardwaresecuritycontrollayer-dependentvulnerability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the machine-learning models now used to correct quantum readout errors are physically attackable: an adversary with momentary access to the classical controller can inject a short voltage glitch and change the corrected bitstring a quantum computer returns. Using a 5-qubit (32-class) readout-correction network, the authors show that early layers are much more fault-prone than later layers (up to 27 mispredictions out of 96 attempts versus around 4 to 5), and that a single glitch can create structured output bias—such as making the network output '00001' about 20% of the time for a given input. The abstract also claims a single glitch can drop the accuracy of a deep-Q surface-code decoder from 100% to 21.57%, although the body presents no experiment for that decoder. If these results hold, ML readout correction and decoding become security-critical parts of the quantum stack, and defenses such as redundant inference, sanity checks, and glitch detectors are needed.

What carries the argument

The mechanism that carries the argument is trigger-synchronized voltage glitching with per-layer timing windows. The target controller emits a trigger at the entry to each neural-network layer (dense_1, relu_1, dense_2, relu_2, output), and the glitch hardware injects a short voltage drop at a tunable width, intra-cycle offset, and external offset after that trigger. This lets the authors attribute faults to specific layers. An automated search over the four glitch parameters, guided by an objective that maximizes expected Hamming distance while penalizing resets/hangs, finds successful fault configurations for each layer; the per-layer timing windows are what make the layer-dependence claim

What would settle it

Run the same trigger-aligned voltage-glitch campaign on a different controller—say, a production readout FPGA or a different microcontroller—and check whether early layers still produce far more mispredictions than later layers; if the layer ordering flips or the fault parameters do not carry over, the layer-dependence claim collapses. Separately, reproduce the abstract's Deep Q decoder experiment (100% to 21.57% accuracy under one glitch), which the body currently does not present.

Watch

Extended reading notes

Core claim

The central discovery is that a voltage-glitch adversary can violate the integrity of ML-based quantum readout correction without touching the qubits or the dilution refrigerator. On the 5-qubit HERQULES readout model, the authors instrument each neural-network layer with a trigger, then scan glitch width, intra-cycle offset, external offset, and repeat count with an automated search that maximizes Hamming distance between predicted and true 5-bit strings. They find successful fault settings in every layer, but with strong layer dependence: the early dense and ReLU layers yield up to 27/96 mispredictions, while later layers yield around 4–5/96. They also show that faults are not random noise

Load-bearing premise

The results are obtained on a development board (ChipWhisperer Husky) running a C port of the readout model, and the central claim depends on that board faithfully representing the timing, memory layout, and voltage-glitch response of production quantum controllers.

Editorial extensions

If this is right

  • ML-based readout correction and decoding should be added to the threat model for quantum computing; they run on classical infrastructure that a physical attacker can reach.
  • A single glitch can corrupt the readout bitstring in a structured way, so an attacker can do more than add noise—they can bias results toward particular bitstrings.
  • Early layers are the highest-yield fault surface, so defenses such as redundant inference, cross-checks with a simpler discriminator, and activation/logit sanity checks can be targeted where they matter most.
  • Untargeted degradation is easy to achieve across all layers; targeted steering toward an attacker-chosen output is harder for random inputs and is left as future work.
  • Hardware monitors (brown-out/glitch detectors) and randomized timing (jitter) are suggested countermeasures that could raise the bar for precise synchronization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: if layer dependence holds generally, fault detection could be concentrated on the first layers of readout networks, or those layers could be executed with redundant computation.
  • A testable extension: the same glitch campaign could be run against a production readout controller or an FPGA-based decoder to see whether the fault parameters and layer ordering transfer beyond the development board.
  • If the abstract's Deep Q result is reproducible, it would extend the attack surface from readout correction to quantum error correction itself, where a corrupted syndrome could silently defeat a logical qubit; the missing body experiment is the immediate test.
  • Inference: because the attack sits on the classical side, an attacker does not need cryogenic access, making the threat realistic for cloud quantum services where users do not control the controller.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper reports a physical fault-injection study of an ML-based quantum readout error-correction model (HERQULES). The authors port HERQULES to C, run it on a ChipWhisperer Husky MCU, synchronize voltage glitches to per-layer execution windows, and use Optuna to search glitch parameters. They report layer-dependent fault success rates (Tables II–VI), show that early layers are more susceptible than later layers, and characterize the resulting output corruption using Hamming-distance and per-bit statistics, including structured bias toward specific 5-bit outputs. The abstract and title further advertise a Deep Q surface-code decoder experiment with a 100%→21.57% accuracy drop; this experiment is absent from the body and appears nowhere in Sections II–VII.

Significance. If the results transfer to production systems, this is a valuable first empirical demonstration that the classical ML component of the quantum readout stack is a fault-injection surface. The paper's concrete strengths are the hardware implementation on an open platform, the layer-synchronized trigger workflow, the automated parameter search, and the systematic reporting of per-layer success counts. The bitstring-corruption figures are also informative. However, the paper's scope is narrower than advertised: the body supports only the HERQULES readout-correction case study, not the Deep Q error-correction decoder claimed in the abstract. The external validity of the results is also limited by the use of a ChipWhisperer Husky board as a stand-in for a production quantum controller, without validation of that correspondence. With the overclaim removed or supported, the HERQULES study is a credible, if preliminary, security case study that will be of interest to the quantum-computing and hardware-security communities.

major comments (4)
  1. [Abstract and §I-D] The abstract supplied with the submission claims that the paper studies 'two representative architectures' and reports that 'a single trigger-aligned voltage glitch in either the first convolutional layer or the final fully connected output layer [of a Deep Q decoder] reduces decoding accuracy from 100% to as low as 21.57%.' The body contains no mention of a Deep Q decoder, a convolutional layer, a surface code, or the value 21.57%, and no corresponding figure or table. The full-text abstract is narrower, but the advertised abstract and title still commit the paper to this result. This is a load-bearing internal inconsistency: the paper's headline quantitative claim is unsupported by the experimental body. Either the experiment must be added in full (architecture, training, fault-injection setup, and results) or the claim must be removed and the title/abstract narrowed to the readout-cor
  2. [§III-A, §IV-A] The experimental setup uses a C port of HERQULES running on a ChipWhisperer Husky MCU. All timing windows (Algorithm 1), fault parameters, and success rates in Tables II–VI are properties of this particular development board. The threat model in §II-B, however, targets a real quantum computer controller. The manuscript gives no evidence that the Husky's instruction timing, memory layout, compiler behavior, and voltage-regulator response are representative of production superconducting-qubit readout controllers, nor does it discuss how fault parameters or success rates would transfer. Without such evidence or an explicit limitation, the quantitative claims are board-specific rather than controller-general. The authors should either benchmark a production-like controller or clearly scope the conclusions to the tested prototype.
  3. [§IV-A, Tables II–VI] The central layer-dependence claim rests on 'No. of Faults out of 96' in Tables II–VI, with early layers reaching 27/96 and later layers falling to 4–5/96. These numbers come from a single set of experiments with no confidence intervals, no repeated sessions, and no report of session-to-session variability. Because the configurations in each table are the top-5 selected after Optuna optimization over a single set of 96 fault attempts, the ranking is also vulnerable to optimizer overfitting. The claim that susceptibility is 'strongly layer-dependent' needs statistical support: repeated independent runs, confidence intervals, or a significance test for the per-layer differences.
  4. [§III-B and Tables II–VI] The search objective is described as 'maximizes the expected Hamming distance between the predicted 5-bit output and the ground truth, subject to a penalty for resets or hangs,' but no equation, penalty value, or Optuna budget is given. Moreover, Tables II–VI rank configurations by 'No. of Faults' (number of mispredictions), which is not the same as expected Hamming distance: a configuration that almost always flips one bit would rank high by fault count but low by Hamming distance. For the 'best fault-inducing configuration' and 'untargeted degradation' claims, the paper should state the exact objective, the sampling budget, and the metric used for ranking.
minor comments (4)
  1. [Algorithm 1] The cycle ranges are internally inconsistent: Layer 1 ends at cycle 140047, while Layer 2 is listed as executing in cycles [14048, 15602], which lies before the end of Layer 1. One of the ranges is likely a typo (e.g., 140048). Please correct and verify all cycle windows.
  2. [§IV-B, Figures 7–12] The structured-corruption analysis is shown for a single input, 10010, whose noisy bit is noted as a 'known issue' in the underlying HERQULES data set. The observation that output 00001 appears ~20% of the time under a Layer-2 fault may be partly an artifact of this noisy bit. Please clarify how representative this input is, and ideally report results for multiple inputs with error bars.
  3. [Figures 2–6] The 3D scatter plots are hard to interpret: there is no color or size scale indicating the number or success density of glitch points, and the axis ranges are clipped to narrow external-offset windows. Adding a color map or a density projection would improve readability.
  4. [General] Minor typographical issues include 'We first preset results' in §IV-A and 'This is consistent with the intuition' in §IV-A; consider a final proofreading pass. Also, the full-text abstract and the advertised abstract should be made consistent before resubmission.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the HERQULES fault-injection results are measured empirically and are not derived from their inputs.

full rationale

The paper's central claims are direct physical measurements: a voltage glitch is injected into a C port of HERQULES on a ChipWhisperer Husky, and the resulting outputs are logged over 96 trials per configuration. Fault parameters are found by Optuna search, but the reported success rates and bitstring distributions are then measured on fresh trials, so no fitted parameter is renamed as a prediction. Layer-dependent susceptibility is an observed empirical pattern, not a consequence of defining a metric in terms of the result. No equation in the paper reduces a derived quantity to an input by construction. The self-citations to prior work from the same group ([4], [5]) are used only for threat-model framing and related-work context, and are not the load-bearing evidence for the experimental attack results, so they do not constitute circularity. The abstract advertises a Deep Q surface-code decoder result (100% to 21.57%) that is absent from the body; while this is a serious missing-support and internal-consistency problem, it is not a circularity of the kind assessed here. Overall, the HERQULES experimental derivation is self-contained and non-circular, so the score is 0.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

This is an experimental paper, not a derivation. The central result rests on the HERQULES model/dataset from prior work, the MCU-as-controller proxy, and the Optuna-defined success objective; the listed glitch parameters are tuned per layer rather than predicted. No new entities are introduced.

free parameters (1)
  • Best glitch parameter vectors per layer (width, offset, external offset, repeat) = L1 (2400,2400,10026,2); L2 (2700,2600,14208,5); L3 (2600,2800,36170,5); L4 (2500,2400,39175,5); L5 (2500,2400,117065,5)
    Found by Optuna to maximize Hamming distance; success counts in Tables II-VI are contingent on these tuned settings and are not predicted from any model.
assumptions (4)
  • domain assumption The MCU C port of HERQULES faithfully represents a real quantum controller's ML readout pipeline.
    Section III-A ports the algorithm from [2] to ChipWhisperer Husky; no validation against real controller timing, memory layout, or voltage behavior is provided.
  • domain assumption The IQ dataset and pretrained HERQULES model from [2] are representative of quantum readout error correction.
    Sections II-A and III-A use data from [2] without live qubit capture or checks for distribution shift.
  • ad hoc to paper Optimizing expected Hamming distance with a penalty for resets is an appropriate attack-success objective.
    Section III-B defines this objective; it is a reasonable heuristic but not derived from any external standard or from the HERQULES deployment context.
  • standard math The dense/ReLU/softmax forward pass in Algorithm 1 is implemented correctly and executes within the measured cycle windows.
    Algorithm 1 assumes the C implementation matches the neural-network math; no formal verification or numerical-check evidence is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fault Attacks on ML-based Quantum Control and Error Correction." pith.science (2026). https://pith.science/paper/UJWFCLGH

@misc{pith2026251220077,
  author       = {Pith},
  title        = {Pith review of: Fault Attacks on ML-based Quantum Control and Error Correction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UJWFCLGH}},
  note         = {Machine review of arXiv:2512.20077}
}
read the original abstract

Machine-learning (ML) models are increasingly used in quantum computing systems to discriminate multi-qubit readouts, mitigate correlated readout errors, and decode quantum error-correcting codes, making them an integral component of today's quantum computer control and readout stacks. This paper is the first to analyze the susceptibility of such ML models to physical fault injection, which can cause quantum computers to return incorrect results or perform wrong error correction operation. This work studies two representative architectures: (i) a fully connected neural network for 5-qubit (32-class) readout error correction (HERQULES), and (ii) a convolutional neural network used as a Deep Q-learning (Deep Q) decoder for the distance-5 Surface Code. Using the ChipWhisperer Husky for voltage glitching together with automated search over the fault parameter space, this work localizes successful fault settings to specific layers of each target ML model. On the HERQULES model, fault susceptibility is strongly layer-dependent: early layers exhibit higher misprediction rates than later layers. On the Deep Q decoder, a single trigger-aligned voltage glitch in either the first convolutional layer or the final fully connected output layer reduces decoding accuracy from 100% to as low as 21.57%. We further characterize the resulting failures at the bitstring level using Hamming-distance and per-bit flip statistics, showing that single-shot glitches can induce structured corruption rather than purely random noise. These results motivate treating ML-based quantum readout and error-correction decoding as security-critical components, and highlight the need for lightweight fault-detection and redundancy mechanisms in quantum computing pipelines.

Figures

Figures reproduced from arXiv: 2512.20077 by the authors.

Figure 1
Figure 1. Overview and setup for evaluation of physical fault injection against ML model that performs quantum computer error correction. The host PC orchestrates inference queries and logging. ChipWhis￾perer Husky injects a voltage glitches on the target’s supply rail, aligned to a trigger emitted by the target at the start of a chosen neural network layer. Each trial returns a predicted 5-bit class and a status (correct, mi… view at source ↗
Figure 6
Figure 6. Points where successful voltage glitches were found in Layer 5: Output layer TABLE II: Best fault-inducing configuration per layer in the 5- layer network targeting Layer 1: Dense 1 layer. The No. of Faults column corresponds to the number of successful faults observed out of 96 repetitions. Configuration Width Offset External Offset Repeats No. of Faults 1 2400 2400 10026 2 13 2 2400 2400 10021 2 13 3 2400 2400 100… view at source ↗
Figure 3
Figure 3. Points where successful voltage glitches were found in Layer 2: ReLU 1 layer 36000 36100 36200 External Offset 0 1000 2000 3000 4000 Offset 0 1000 2000 3000 4000 Width [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Points where successful voltage glitches were found in Layer 3: Dense 2 layer 39000 39100 39200 External Offset 0 1000 2000 3000 4000 Offset 0 1000 2000 3000 4000 Width [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Points where successful voltage glitches were found in Layer 4: ReLU 2 layer 117000 117100 117200 External Offset 0 1000 2000 3000 4000 Offset 0 1000 2000 3000 4000 Width [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]
Figure 12
Figure 12. Figure 12: Distribution of classification of outputs for input 10010 when faulting Layer 5: Output layer. from the data set. The randomly selected input corresponds to IQ data for readout that should be the binary 10010, this corresponds to integer value 18. Due to known issue w…
Figure 7
Figure 7. Figure 7: Distribution of classification of outputs for input 10010 under no fault attack. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Predicted Labels 0 25 50 75 100 Distribution (%) 4.27 0.08 0.85 0.02 0.04 0.02 0.25 0.02 14.15 0.72 66…
Figure 8
Figure 8. Figure 8: Distribution of classification of outputs for input 10010 when faulting Layer 1: Dense 1 layer. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Predicted Labels 0 25 50 75 100 Distribution (%) 0.11 13.80 0.77 0.10 0.03 0.02 0.02 0.…
Figure 9
Figure 9. Figure 9: Distribution of classification of outputs for input 10010 when faulting Layer 2: ReLU 1 layer. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Predicted Labels 0 25 50 75 100 Distribution (%) 0.26 0.89 0.03 0.01 0.01 0.38 0.03 0.25…
Figure 10
Figure 10. Figure 10: Distribution of classification of outputs for input 10010 when faulting Layer 3: Dense 2 layer. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Predicted Labels 0 25 50 75 100 Distribution (%) 0.21 0.88 0.01 0.03 0.03 0.27 0.01 0.…
Figure 11
Figure 11. Figure 11: Distribution of classification of outputs for input 10010 when faulting Layer 4: ReLU 2 layer. In the figures we show the results of applying top faulting configuration from each layer onto a randomly selected input 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 2 linked inside Pith

  1. [1]

    Deep neural network discrimination of multiplexed superconducting qubit states,

    B. Lienhardet al., “Deep neural network discrimination of multiplexed superconducting qubit states,”Physical Review Applied, 2022

    2022

  2. [2]

    Scaling qubit readout with hardware efficient machine learning archi- tectures,

    S. Maurya, C. N. Mude, B. Lienhard, W. D. Oliver, and S. Tannu, “Scaling qubit readout with hardware efficient machine learning archi- tectures,” inProceedings of the 50th Annual International Symposium on Computer Architecture (ISCA), 2023

    2023

  3. [3]

    Dynamic pulse switching for protection of quantum computation on untrusted clouds,

    T. Trochatoset al., “Dynamic pulse switching for protection of quantum computation on untrusted clouds,” inIEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2024

    2024

  4. [4]

    Quantum computer fault injection attacks,

    C. Xu, F. Erata, and J. Szefer, “Quantum computer fault injection attacks,” in2024 IEEE International Conference on Quantum Computing and Engineering (QCE), pp. 331–337, Sept. 2024

    2024

  5. [5]

    Classification of quantum computer fault injection attacks

    C. Xu, F. Erata, and J. Szefer, “Classification of quantum computer fault injection attacks.” arXiv:2309.05478, 2023

    arXiv 2023

  6. [6]

    A primer on security of quantum computing hardware

    S. Ghoshet al., “A primer on security of quantum computing hardware.” arXiv:2305.02505, 2023

    arXiv 2023

  7. [7]

    Unfolding quantum computer readout noise,

    B. Nachman, M. Urbanek, W. A. de Jong, and C. W. Bauer, “Unfolding quantum computer readout noise,”npj Quantum Information, vol. 6, no. 1, p. 84, 2020

    2020

  8. [8]

    Bias in error-corrected quantum sensing,

    I. Rojkov, D. Layden, P. Cappellaro, J. Home, and F. Reiter, “Bias in error-corrected quantum sensing,”Physical Review Letters, vol. 128, no. 14, p. 140503, 2022

    2022

Show all 22 references
  1. [9]

    Mitigation of readout noise in near-term quantum devices by classical post-processing based on detector tomography,

    F. B. Maciejewski, Z. Zimbor ’as,et al., “Mitigation of readout noise in near-term quantum devices by classical post-processing based on detector tomography,”Quantum, vol. 4, p. 257, 2020

    2020

  2. [10]

    Scalable mitigation of measurement errors in near-term quantum devices,

    P. D. Nation, H. Kang, N. Sundaresan, and J. M. Gambetta, “Scalable mitigation of measurement errors in near-term quantum devices,” 2021

    2021

  3. [11]

    Quantum readout error mitigation via deep learning,

    J. Kimet al., “Quantum readout error mitigation via deep learning,” 2021

    2021

  4. [12]

    Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures,

    A. Barenghi, L. Breveglieri, I. Koren, D. Naccache, and F. Regazzoni, “Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures,”Proceedings of the IEEE, vol. 100, no. 11, pp. 3056– 3076, 2012

    2012

  5. [13]

    A survey on fault injection methods of digital integrated circuits,

    M. Eslamiet al., “A survey on fault injection methods of digital integrated circuits,”Integr. VLSI J., 2020

    2020

  6. [14]

    A systematic review of fault injection attacks on iot devices,

    A. Gangolliet al., “A systematic review of fault injection attacks on iot devices,”Electronics, 2022. 6

    2022

  7. [15]

    Practical fault attack on deep neural networks,

    J. Breier, Z. Houar,et al., “Practical fault attack on deep neural networks,” 2018

    2018

  8. [16]

    Rapid high-fidelity multiplexed readout of superconducting qubits,

    J. Heinsoo, C. K. Andersen, A. Remm, S. Krinner, T. Walter, Y . Salath ´e, S. Gasparinetti, J.-C. Besse, A. Poto ˇcnik, A. Wallraff,et al., “Rapid high-fidelity multiplexed readout of superconducting qubits,”Physical Review Applied, vol. 10, no. 3, p. 034040, 2018

    2018

  9. [17]

    Chipwhisperer: An open-source platform for hardware embedded security research,

    C. O’Flynn and Z. D. Chen, “Chipwhisperer: An open-source platform for hardware embedded security research,” inConstructive Side-Channel Analysis and Secure Design (COSADE), vol. 8622 ofLNCS, pp. 243– 260, Springer, 2014

    2014

  10. [18]

    Optuna: A next-generation hyperparameter optimization framework,

    T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, “Optuna: A next-generation hyperparameter optimization framework,” 2019

    2019

  11. [19]

    Experimental evaluation of two software countermea- sures against fault attacks,

    N. Moroet al., “Experimental evaluation of two software countermea- sures against fault attacks,” 2014

    2014

  12. [20]

    On the importance of checking cryptographic protocols for faults,

    D. Boneh, R. A. DeMillo, and R. J. Lipton, “On the importance of checking cryptographic protocols for faults,” inEUROCRYPT, 1997

    1997

  13. [21]

    Recovering qsvt polynomials from side-channel information on quantum computers,

    K. Tessma, H. Kukina, and J. Szefer, “Recovering qsvt polynomials from side-channel information on quantum computers,” inInternational Conference on Computer Design, ICCD, November 2025

    2025

  14. [22]

    Design of quantum computer antivirus,

    S. Deshpande, C. Xu, T. Trochatos, H. Wang, F. Erata, S. Han, Y . Ding, and J. Szefer, “Design of quantum computer antivirus,” inProceedings of the International Symposium on Hardware Oriented Security and Trust, HOST, May 2023. 7

    2023

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.