Code Surgery Gadgets: Modular Protocols

• Code surgery gadgets are modular constructions that enable fault-tolerant operations in quantum error correction and secure code reuse by attaching, manipulating, and removing ancillary structures.
• They facilitate essential logical tasks—such as joint measurements, gate applications, and code switching—using methods like lattice surgery, pushouts, and split/merge protocols while preserving code distance and locality.
• Practical applications include scalable quantum computing implementations and improved software security mechanisms through automated gadget synthesis and dynamic code activation.

A code surgery gadget is a modular construction that enables fault-tolerant, low-overhead logical operations—including joint measurements, gate application, and code switching—by attaching, manipulating, and subsequently removing ancillary structures in the context of quantum error-correcting codes or, in the classical/software regime, by surgically composing short instruction or code fragments to synthesize desired primitive operations. In quantum error correction, code surgery gadgets generalize lattice surgery, implementing computation via controlled code deformation and ancilla-assisted measurements while preserving distance and locality. In software security, code surgery gadgets refer to chains or composites of native instructions or safe-looking library routines harnessed through code reuse or property-pollution, turning otherwise benign sequences into end-to-end exploit primitives.

1. Definitions and General Architecture

In the quantum regime, a code surgery gadget is an ancilla-assisted protocol that implements a logical measurement, gate, or transformation on a quantum code, usually a CSS (Calderbank-Shor-Steane) code or LDPC stabilizer code. The gadget typically interacts with the code by:

• Merging: fault-tolerantly identifying qubits (or logical subspaces) by adding stabilizers along a shared support ("merge").
• Splitting: decoupling subcodes ("split"), often via basis-changing measurements.
• Adding "patches": attaching ancilla blocks, frequently realized as constant-degree expander graphs or low-overhead cell complexes, to gauge specific logical operators or products thereof.
• Adapters: inserting lightweight constraints or checks to tie together the ancilla structure for simultaneous, parallel, or joint measurements.

Canonical examples include planar surface code lattice surgery, color code joint-boundary measurements, and generic CSS merge/split protocols defined via categorical pushouts/pullbacks over chain complexes. In classical/software security, code surgery gadgets arise in ROP/JOP/COP, prototype pollution, or attack-surface reduction contexts, as concatenable snippets of code repurposed into programmatic "instructions" for the exploit VM, or as disabling/enabling sequences for attack chain minimization.

2. Quantum Code Surgery Gadgets: Formal Schemes and Resource Overheads

Modern quantum code surgery gadgets allow measurement of up to $t$ logically-disjoint Pauli products $\{P_1,\ldots,P_t\}$ in parallel on any CSS LDPC code, preserving code parameters and locality. A detailed architecture is as follows (Cowtan et al., 6 Mar 2025):

• Ancilla Patches: For each $P_i$, a binary branching tree of small hypergraph-product stickers, each of $O(\omega)$ size ($\omega\geq d$), splits support to disjoint leaves. Each leaf then attaches an expander-graph ancilla $G_i$ of $O(\omega\log^3\omega)$ qubits/checks for fault-tolerant measurement of the logical.
• Gauging and Decoding: Each ancilla supports $O(1)$-weight checks; syndrome extraction and $d$ rounds of stabilizer measurement ensure distance preservation. Universal adapters (low-weight checks) can connect multiple ancilla graphs for joint operator measurement.
• Resource Scaling: Total ancilla overhead is $O\big(t\omega(\log t + \log^3\omega)\big)$, with time $O(d)$ independent of $t$. In favorable families, $\omega\approx d$, yielding $O(td\log^3 d)$ scaling.
• Preservation of Code Parameters: All modifications retain the LDPC property—check and column weights remain $O(1)$, code distance is preserved at every step, and no extraneous logical qubits are formed (Cowtan et al., 6 Mar 2025).

Recent advances—parsimonious surgery (Yuan et al., 5 Mar 2026)—shrink ancilla size to $O(W\log W)$ for a weight-$W$ logical Pauli, reducing polylogarithmic overheads via "parsimonious cone" constructions over bounded-degree graphs and contractible cell complex fill-ins. Constant-time gadgets for hypergraph product codes amortize $O(1)$ time per logical operation over parallel instances, with near-constant space overheads $\tilde O(1)$ per measured logical (Chang et al., 2 Mar 2026).

Table: Key Quantum Surgery Resource Scalings

Gadget Type	Ancilla Qubits	Time Overhead	Code Compatibility
General Parallel	$O(t\omega(\log t+\log^3\omega))$	$O(d)$	All CSS LDPC codes
Parsimonious Surgery	$O(W\log W)$	$O(d)$	All qLDPC codes
Constant-Time/Space	$\tilde O(1)$	$O(1)$ (amortized)	2D HGP CSS codes

Codes: $d$ = code distance; $t$ = #parallel logicals; $\omega$ = max. logical Pauli weight.

Fault-tolerance is enforced at each deformation (branch/merge, adapter attach, unbranch), and thresholds are retained as in the underlying code (Cowtan et al., 6 Mar 2025, Vuillot et al., 2018).

3. Categorical, ZX-Calculus, and Homological Perspectives

At a formal level, code surgery gadgets are universal constructions in the category of (binary) chain complexes (Cowtan et al., 2023):

• Merges are pushouts (colimits) along subcomplexes representing logical operators, usually along a shared logical $\overline{Z}$ or $\overline{X}$. The resulting code is the quotient $$Q_\bullet=(C_\bullet\oplus D_\bullet)/\{f(a)\sim g(a)\}$$, merging $C_\bullet$ and $D_\bullet$ along $V_\bullet$.
• Splits are dual (coequalizer) pullbacks, measured out via basis changes (e.g., $X$-basis measurement).
• Fault-Tolerance is enforced via gauge-fixability: a logical $u$ is gauge-fixable if for any qubit pair in its support, there is an $X$-type gauge operator that acts trivially except interchanging those two (see Lemma A.11 of (Cowtan et al., 2023)). General distance preservation follows by sandwiching merges with small tensor codes.

The ZX calculus provides a string-diagrammatic language for code surgery gadgets. Red and green spiders correspond to rough (Z-type) and smooth (X-type) merges/splits. Complex surgery gadgets (CNOT, T gate) compose these spiders via algebraic rewrite rules corresponding to pushout and splitting operations, enabling high-level optimization (Beaudrap et al., 2017).

4. Gadget Types in Software Security: Code-Reuse and Attack Surface

In classical software security, code surgery gadgets refer to reusable instruction- or code-sequence fragments ("gadgets") that adversaries can chain to mount code-reuse attacks (ROP, JOP, etc.) (Vishnyakov et al., 2020):

• Definition: $g = (\text{addr}, \delta_{regs}, \delta_{mem})$; a gadget is a code snippet with transferable, well-defined side effects on machine state.
• VM View: The gadget set $C$ in a binary defines a virtual machine; exploit synthesis becomes codegen over this VM, constructing chains $s\in \Sigma_C^*$ that achieve a semantic goal $G$.
• Code Surgery Proper: When certain instructions are absent, "code surgery" composes multiple gadgets to synthesize them (e.g., constructing a MOV graph to route register transfers, or composing arithmetic and memory gadgets for complex primitives).
• Automated Composition: Techniques include pattern-based search, symbolic execution, abstract interpretation, and chain synthesis by SMT-solving or evolutionary algorithms. Benchmark results in (Vishnyakov et al., 2020) demonstrate hundreds of binaries per tool reliably synthesized with automated VM chaining.

Mitigations such as OCA (on-the-fly code activation) reduce the live gadget set at runtime, dynamically enabling/disabling function "decks" to preclude the existence of necessary gadget chains for exploits, including complete execve→shell ROP chains (Porter et al., 2021).

5. Applications, Specializations, and Performance

Quantum code surgery gadgets are foundational in:

• Surface and Color Code Lattice Surgery: Merges/splits via boundary measurements enable universal gate sets without braiding (Horsman et al., 2011, Landahl et al., 2014). Joint-boundary gadgets allow CNOTs, joint-X(Y)/Z measurements, GHZ-state distribution, and magic state injection. Color-code surgery provides higher locality and efficient transversal Clifford gates.
• Flexible Ancilla Gadgets: Recent gadget channels allow the data and ancilla to be arbitrary stabilizer (even non-additive) codes, with logic executed via transversal operations and ancilla measurement. This schema enforces universal gate sets even for non-CSS codes (Kubischta et al., 2024).
• Experimental Implementations: Modular teleportation gadgets realize code-based teleportation in laboratory ion-trap architectures, with explicit transpilation to shuttling and gate primitives, and resource/performance analysis under realistic noise (Benito et al., 23 Dec 2025).

Classical code surgery gadgets (software) are central to:

• Attack Surface Reduction: Debloating techniques and dynamic code-activation dramatically reduce reachable gadgets, validated by breaking all known ROP chains in tested binaries with low overhead (Porter et al., 2021).
• Quality-Oriented Metrics: Effective security assessment must analyze expressivity, gadget quality, special-purpose gadget presence, and locality, since simple count reduction does not correlate with attack resistance (Brown et al., 2019).

6. Security, Limitations, and Optimizations

For quantum code surgery gadgets:

• LDPC and Distance Preservation: All discussed schemes (parallel, parsimonious, categorical) guarantee that added ancilla patches and intermediate code deformations maintain low-density parity-check, preserve or increase code distance, and never introduce spurious logical operators (Cowtan et al., 6 Mar 2025, Cowtan et al., 2023).
• Ancilla Weight Minimization: In certain codes, representative weights may scale unfavorably with code size, necessitating careful basis vector selection or code design to suppress overhead (Cowtan et al., 6 Mar 2025, Yuan et al., 5 Mar 2026).
• Adaptability: In practice, network and decoder limitations, finite-size effects, and initialization constraints may introduce further overheads or collapse the expected polylog factors (Cowtan et al., 6 Mar 2025).

For classical/software gadgets:

• Debloating Paradoxes: Raw gadget count reduction can inadvertently introduce new exploitable gadgets or higher expressivity, so security metrics must incorporate expressivity, gadget quality, and special-purpose gadget availability; iterative workflows are recommended (Brown et al., 2019).
• Prototype Pollution Gadgets: Act as code surgery gadgets in the sense that attacker-controlled prototype properties are routed through benign code snippets ("gadgets") into high-impact sinks, e.g., eval or spawn, enabling RCEs in popular NPM packages as validated by Dasty (Shcherbakov et al., 2023).

7. Representative Examples and Benchmarks

Quantum Example: In a CSS LDPC code, to measure $t=3$ logically disjoint operators $P_1=Z_1, P_2=X_2Y_3, P_3=Z_4X_5$, one builds a two-level branching tree splitting the support into three disjoint leaves; attaches three expander gadgets, and (optionally) adapters; measures all ancilla checks for $d$ rounds, decodes, and unbranches, returning to the original code—achieving $O(d)$ time and $O(td\log^3 d)$ space overhead (Cowtan et al., 6 Mar 2025).

Software Example: Under OCA, average gadget reduction is 73.2% (SPEC), 87.2% (coreutils), and 80.3% (nginx), with no surviving end-to-end ROP chains in tested workloads and only 2–4% runtime slowdown (Porter et al., 2021). Quality and expressivity metrics are vital, as debloating can increase the attacker's options unless guided by iterative, analysis-driven workflows (Brown et al., 2019).

---

Code surgery gadgets thus unify a rich taxonomy of ancilla-based and programmatic protocol modules for realizing, characterizing, and securing critical operations in both quantum error correction and code-reuse security frameworks. Their continued refinement draws deeply on category theory, graph-theoretic constructions, symbolic reasoning, and automated synthesis, with active application to scalable quantum architectures and practical attack-surface-hardening in complex software systems.