Quantum machine learning's real edge is small. A new audit tells you exactly how small.

A new audit framework for quantum machine learning shrinks the certified upper bound on real-world advantage to single-digit percentages across eight security benchmarks. More importantly, it gives researchers a falsifiability primitive the field has been missing: a test that separates "the experiment was valid" from "the quantum model actually does something the best classical alternative cannot," a distinction the literature has historically blurred (Sharp Target-Domain Certificates for Quantum-Kernel Advantage under Distribution Shift).

A quantum kernel is a similarity function computed on a quantum processor; a classical kernel is its conventional, non-quantum counterpart. Distribution shift is the standard real-world condition where the data a model was trained on differs from the data it meets in deployment. The framework asks a narrow, testable question: how much can a fixed quantum-kernel candidate beat the best member of a prespecified classical-kernel family under any data shift, with no assumptions about the loss function and only a finite batch of examples to audit?

Three features make the protocol practical. It is assumption-free about the loss: the only inputs are the candidate quantum model, the family of classical kernels being compared, and a small number of audited labels. For the common zero-one accuracy case, the partial-label updates have an exact closed form, so practitioners do not need labeled target data to compute the bound. And the protocol explicitly separates three claims that almost every quantum-ML paper folds together: that the experiment was conducted correctly, that the target task is genuinely predictable in the deployment distribution, and that the quantum model adds something a classical one could not.

When the authors run the protocol across eight security shifts against 115 classical kernels, the zero-label upper endpoints for quantum-vs-classical advantage land between 0.002 and 0.088, under nine percent in the worst case and well under one percent in most. After retrospective auditing of as few as 0 to 33 of 500 labels, including entangling-ZZ models that use two-qubit gates to entangle feature dimensions, every endpoint collapses to 0.010 or below. The prospective corroboration is harsher still. On two eligible tasks, four task-classifier medians needed only 0 to 3 audited labels to bind, with an overall median of 0 and a maximum of 76, and all 20 realized effects went negative once protocol controls were applied. A third task fails its feature gate, the screening step that decides whether the data is suitable for the protocol, before the test can run.

The headline numbers look like bad news for quantum machine learning. They are not. The framework is a measurement-infrastructure story: it lets the field spend the next round of R&D effort on the few tasks where the certificate actually goes positive, rather than on benchmarks where a classical kernel can match the quantum candidate within a percentage point. Finite-shot noise, the protocol confirms, can inflate a model's predictive distinctness, the appearance that it is doing something different from a classical model, without producing useful advantage. That finding alone should re-weight how labs read the next batch of quantum-ML preprints.

The practical win is the three-claim separation. A paper can now show that its experiment was valid, that the target task is genuinely predictable, or that quantum kernels are doing work a classical family cannot, and be audited on each leg independently. The protocol does not say quantum machine learning is doomed. It says that on these eight security shifts, against this classical baseline, with these controls, the upper bound is small. A different classical-kernel family, a different task family, or a quantum model trained on more expressive features could land elsewhere.

The next test is whether the field adopts it. The preprint makes the bound reproducible with a fixed classical-kernel family and a handful of audited labels, a low bar for a serious quantum-ML team. If the protocol sticks, the next wave of quantum-vs-classical claims will arrive with a certificate attached, and the ones that do not will read more like marketing than measurement.