ChatGPT Routinely Beats “AI-Resilient” Qiskit Homework—Here’s What Broke

ChatGPT Routinely Beats “AI-Resilient” Qiskit Homework—Here’s What Broke

Quantum computing courses love take-home coding assignments. They’re one of the best ways to turn abstract quantum ideas into something you can actually run and verify. But a new research study (based on the original paper) flips a key assumption on its head: even carefully “AI-resilient” Qiskit homework packages can be completed—correctly and autogradably—when a minimally engaged student hands the full materials to ChatGPT and asks for a submission.

The headline result is stark and, frankly, a little uncomfortable for anyone designing assessments: across 150 separate ChatGPT sessions, the model produced an executed, grader-passing notebook submission every single time for three different modified Qiskit homework packages. The research doesn’t claim “all Qiskit homework is doomed forever,” but it does show that many deterrence ideas fail when the workflow still allows a student to outsource the key parts and simply “run until it works.”

Why This Matters (Right Now, Not “Someday”)

This is significant because assessment has become a software-engineering problem as much as a teaching one. If your grading system mostly checks whether an output file matches expectations, you’re implicitly validating the final artifact—not the process. That gap is exactly what LLM-assisted students can exploit: they can generate code, adapt to errors, and still produce a submission that looks indistinguishable from a genuine student workflow.

A real-world scenario where this applies today: imagine a university instructor giving personalized Qiskit notebooks with seeded parameters, JSON-formatted answers, and “run the grader” instructions. The instructor might also add a reflection prompt and include extra grading checks like circuit depth metrics. That all helps—educationally and operationally—but if the assignment remains “complete as a black box” (meaning the full task specification is visible and the grader validates consistency with expected outputs), then a student can still get help from ChatGPT in a way that preserves correctness.

What makes this research a step beyond earlier AI-in-education findings is that it tests assignment-level packages in a realistic threat model. Previous work often asks whether a model can generate correct code for a single prompt. This paper asks something more practical: when ChatGPT is given the full student-visible homework materials—including seeded instance logic and expected-output checks—can it still produce a submission that the autograder accepts under a workflow that requires minimal independent engagement? In their tested conditions, the answer is “yes,” consistently.

And that’s the uncomfortable takeaway: “AI-resilient” deterrence layers aren’t automatically deterrent when the student can directly request a complete solution, run it, and iterate based on ordinary error feedback.

What the Researchers Actually Tested (And How the Threat Model Worked)

The study’s core research question is blunt:

When ChatGPT is given the complete student-visible materials for each of three AI-deterrence-modified introductory Qiskit assignments, can it produce an executed, grader-accepted submission under a minimally engaged student workflow?

The threat model: “minimally engaged” beats “smart attacking”

They assume an adversary that’s not doing anything fancy. The student can:

• provide the assignment text / notebook / student-visible files,
• request a complete solution and the submission artifacts,
• run the code in Jupyter or Colab,
• return an exact installation or runtime error,
• and copy explanations back into the submission.

Crucially, the model doesn’t get hidden instructor references, hidden expected answers, or grader feedback. This isn’t about cracking the grader. It’s about outsourcing the work and using execution feedback like a normal debugging loop.

The operational definition: resiliency = grader acceptance after execution

The paper introduces an operational measure: for each assignment package a, observed ChatGPT-resiliency is defined as the fraction of sessions where the final artifact executes and passes the corresponding grader.

They then evaluate whether ChatGPT can produce an executed, correct artifact—not whether it “understands” quantum computing.

Sample design: fixed instances, repeated across conversations

Here’s the key structure:

• Three homework packages were created.
• For each package, the researchers used one fixed student-visible instance (personalized but consistent).
• That same instance was tested across 50 separate ChatGPT sessions.
• Total sessions: 150 (50 × 3).
• Total final artifacts executed and graded: 150 of 150 passed.

Important nuance: because they reused the same instance per package, the results prove stability across sessions for those specific instances, not that every seed or every possible variant would work.

Archiving a subset for process-level evidence

They also archived nine sessions (three per package). Those are the only ones with full process-level provenance like transcripts, generated files, runtime logs, and grader outputs.

They found that within these archived runs:

• 8 out of 9 needed one permitted follow-up after the first execution attempt.
• In all eight cases, the first run stopped at a missing optional visualization dependency (a qc.draw("mpl") call failing due to missing pylatexenc).
• After installing/rendering fix, the notebook proceeded and the submission passed.
• One HW2 run additionally lacked qiskit-aer, again solvable via the permitted environment adjustment.

Notably: none of the archived sessions required operator editing to change quantum logic. Fixes were about missing dependencies and rendering—not about correcting the actual quantum algorithm or grading schema.

The Three Qiskit Homework Packages (Personalized, But Still “Complete”)

The study didn’t test a single textbook-style task. It built three assignment packages with different deterrence ideas. Each package aimed to stay autogradable while forcing students to run, verify, and discuss results.

Below is the high-level shape of each package (as described in the paper).

If you’re thinking “but surely personalized seeds should make it harder,” the paper’s results suggest otherwise. The seeds changed configuration values, but didn’t move the task outside what ChatGPT could algorithmically reproduce from the visible specification.

Extra scaffolding layers they used (the deterrence stack)

Across packages, the researchers included multiple layers meant to break “copy/paste” correctness:

• deterministic personalization via seeds,
• non-palindromic bitstrings and reversed/nontrivial measurement mappings,
• varied measurement maps and custom mappings (not just textbook defaults),
• simulator execution requirements,
• machine-readable submission outputs (not just free-text),
• hidden references / canary-like elements on the instructor side,
• circuit and transpiler metrics,
• reflections tied to results,
• and an optional IBM Quantum execution pathway.

Some additional ideas existed in the broader project (like QPY semantic validation or noisy-simulation grading), but the paper’s 150-session fixed-instance experiment doesn’t claim those were mandatory or defeated.

This matters because it explains the failure mode: even a “thick” deterrence stack can still fail if the assignment remains fully specified in student-visible form and the grader mainly checks for output consistency.

The Main Result: 150/150 Passed Across Repeated ChatGPT Sessions

Let’s state the central finding plainly.

• For each of the three packages, the researchers tested the same student-visible assignment instance in 50 independent ChatGPT sessions.
• In total, 150 separate sessions were run and each final artifact was executed and graded.
• Result: 150 of 150 final artifacts executed and passed.

In their terminology, that means each tested instance had zero observed ChatGPT-resiliency under their operational definition.

So while the assignments were designed to be AI-resilient, ChatGPT consistently produced what the autograder accepted.

And the archived subset reinforces the “how,” not just the “what”:

• Within nine archived sessions, the first notebook execution almost always failed due to an optional visualization dependency (pylatexenc).
• After the allowed follow-up (installation/render fix), notebooks ran through successfully.
• No archived session required editing of operator code or correction of quantum logic.

That’s not a minor detail. It suggests the barriers weren’t quantum-specific. They were mostly environmental and dependency-level.

Why the Deterrence Layers Didn’t Stop Completion (The “Black Box Output” Problem)

The paper argues that the deterrence mechanisms didn’t meaningfully change the nature of the task for an LLM-assisted student. The reasons fall into a few categories.

1) Seeds changed parameters, not task structure

A deterministic seed prevents every student from receiving the exact same numeric values. But if the logical relationship between inputs and expected outputs stays fully visible, then an LLM can still:

• read the generator logic,
• specialize the circuit to the generated values,
• and compute the expected output shape (or at least produce a submission that will pass).

In HW1, for instance, the bit flips, measurement map, and expected count key were deterministic functions of visible student data. Once ChatGPT parsed those rules, it could produce both the circuit behavior and the corresponding expected count key.

2) Visible algorithms (like QFT and its inverse) are easy to reconstruct

In HW2, the QFT + inverse-transform workflow is essentially an identity relationship (as the paper notes, “QFT followed by inverse QFT is the identity”). If the notebook exposes:

• the QFT routine,
• the inverse routine,
• the measurement-map calculation,
• and even the reflection structure,

then ChatGPT doesn’t need to invent anything new. It just needs to assemble what’s already there, match the expected outputs, and generate the structured submission artifacts.

The study also points out that added circuit/transpiler metrics and richer submission metadata didn’t block this workflow. They increased the amount of “stuff” in the submission, but didn’t force independent reasoning beyond what was already scaffolded.

3) Custom oracle masks in Deutsch–Jozsa remain a standard translation

In HW3, the oracle is seeded via a custom mask. But the key classification behavior (constant vs balanced) is determined by whether the mask is zero or nonzero under the described relationship. Since the assignment exposed the mask-to-oracle translation approach, ChatGPT could implement the standard controlled-NOT oracle pattern and proceed.

Again, personalization didn’t remove the underlying algorithmic mapping—it just changed the specific mask instance.

4) Hidden references didn’t matter when expected outputs were derivable from public logic

Hidden deterministic references were included to prevent trivial “read instructor answer file” cheating. But the graders checked for:

• seeded configuration consistency,
• expected bitstrings and ideal counts,
• dominant outcome checks,
• and reflection presence/structure.

In other words, the grader validated consistency with expected outputs, not independent authorship or conceptual understanding. That’s a subtle but critical distinction: a submission can be correct without demonstrating that a human student performed the substantive reasoning.

5) Machine-readable JSON + structured reflections are a gift to LLMs

JSON submission schemas and structured reflection prompts don’t automatically make things harder. If the expected schema is shown or exemplified, LLMs can output matching structured data reliably.

The study’s results suggest that once ChatGPT already had the relevant computed values (or the necessary output behavior), generating JSON and a plausible reflection became routine.

6) The observed failures were mostly ordinary dependency issues

The most common “deterrence failure” wasn’t a quantum correctness barrier. It was something like missing pylatexenc for drawing plots, or missing qiskit-aer in one environment.

A minimally engaged student can recover from this by installing a dependency. So the workflow still ends with a correct, executed, autograded artifact.

This is consistent with the broader research insight that execution feedback improves model performance substantially—something the paper links to via results like [9] and [10] (execution feedback helps when models can run and iterate).

What This Means for Quantum Educators (Assessment That Actually Measures Understanding)

The authors are careful not to say “stop using autograding” or “stop doing take-home coding.” Instead, they argue the finding is narrower:

An executed, grader-passing take-home artifact—even a personalized one—is not enough evidence of independent understanding.

So what should you do?

Separate “AI-supported production” from “verified understanding”

The paper’s implication is that assessments should target explainability and adaptability, not just correctness of outputs.

They suggest practical options like:

• a short oral defense tied directly to the student’s own circuit and counts,
• supervised modifications (change qubit mapping, oracle, or input state and explain expected impact),
• prediction of a new outcome before executing,
• a transfer task that changes the algorithmic structure rather than only the seed,
• semantic validation of submitted circuits when implementation itself is a learning goal,
• brief in-class checks connecting code ↔ math ↔ observed noise.

The key idea: make students demonstrate reasoning that can’t be substituted by “run once, pass grader.”

Don’t over-interpret “more artifacts” as “more validity”

Notebook files, JSON, transpiler stats, QPY exports, job IDs, noisy counts, and reflections can all be real artifacts. But the study warns that these don’t necessarily prove authorship or understanding.

A circuit might be semantically correct because the LLM produced it, while the student can still fail to explain or adapt it. So assignments should be explicit about what each artifact is evidence for.

Key Takeaways

• Three AI-deterrence-modified Qiskit homework packages were tested at the introductory level with one fixed student-visible instance per package.
• Across 150 separate ChatGPT sessions (50 per package), 150/150 final submissions executed and passed the autograder.
• In the nine archived sessions, 8/9 first attempts failed due to optional visualization/environment dependencies (e.g., missing pylatexenc), and all passed after a single permitted follow-up. No session required correction of quantum logic or operator editing.
• The deterrence layers (seeds, measurement mapping changes, JSON schemas, circuit metrics, reflections, hidden references) didn’t stop completion because they mostly changed parameters and scaffolding, not the underlying fact that the task was derivable from visible specifications.
• The study’s conclusion is not “all Qiskit homework is impossible to secure.” It’s that artifact correctness alone is insufficient to assess independent understanding.
• For future assessment design, correctness should be complemented with explain/modify/predict/transfer checks—evidence that the student can reason beyond the specific seeded instance.

If you want, tell me what your current Qiskit assignment structure looks like (e.g., how personalized seeds work, what the grader validates, whether the student-visible notebook exposes algorithmic routines). I can suggest concrete redesign patterns that target the exact failure mode this paper observed—without needing to ban AI outright.