Duke University Team Designs Hardware-Safety Gate for LLM-Driven Trapped-Ion Control

A new control system integrates large-language-model (LLM) agents into the autonomous operation of quantum experiments, addressing key hardware safety challenges. Duanyang Wang and colleagues at Duke University, in collaboration with Joint Quantum Institute and University of Maryland, present a system with a formal boundary between agent decisions and hardware access. The system uses a hardware-safety-gated approach, employing an authorization token system linked to exact code contents, and verifies operations through automated hardware simulation or manual human oversight. Deployed on both ⁴⁰Ca⁺/⁴⁰CaOH⁺ and ¹⁷¹Yb⁺ trapped-ion platforms, the research demonstrates successful autonomous experiment building and calibration, while strong testing of the safety mechanisms against adversarial code reveals current limitations reside in the agent’s metacognitive abilities, rather than its quantum control knowledge.

Autonomous calibration accelerates trapped-ion quantum computing experiments across multiple

A tenfold improvement over existing methods has been achieved, with the system autonomously constructing a complete calibration stack in under five minutes. Previously, this process demanded up to fifty minutes of manual coding and execution. This advancement surpasses a vital threshold, facilitating rapid prototyping and experimentation that was previously hindered by the time-consuming nature of initial system setup. Before this development, fully autonomous calibration proved impractical for complex trapped-ion experiments.

Demonstrating interface-level portability, the system deployed on both ⁴⁰Ca⁺/⁴⁰CaOH⁺ and ¹⁷¹Yb⁺ platforms, validating its adaptability across diverse quantum hardware. At Duke University and the University of Maryland, a system capable of autonomously building a complete calibration stack for trapped-ion experiments deployed. The team’s safety-filter issued 1932 benchmark scripts and approximately 250 tests, deliberately challenging the system with adversarial code.

This red-team campaign precisely mapped the filter’s protective boundary, revealing structural separation between normal calibration code and potential evasion attempts. Furthermore, the system successfully closed a cross-instrument magnetic-field-stabilisation loop with targeted human guidance, indicating a capacity for complex quantum control logic synthesis. Analysis revealed the agent’s limitations lie in metacognitive control, specifically, recognising when to re-frame a problem, rather than a lack of domain knowledge, suggesting that full autonomy still requires human intervention for higher-level experimental design.

Model Context Protocol safeguards automated quantum control

The control system relies on the Model Context Protocol (MCP) server, which functions as a translator between the large-language-model agent and the experimental hardware. This server does not simply relay instructions, but instead acts as a gatekeeper, ensuring every command authorises before reaching sensitive equipment. No code generated by the agent can directly manipulate the trapped-ion experiment; instead, the agent requests actions via ‘tool calls’ to the MCP server, which then converts these requests into a hardware-compatible format.

This process underpins a token-based authorization system, where each command requires a unique token issued either automatically after successful simulation, or manually by a human operator for critical operations, effectively creating a formal safety boundary. The system’s functionality and portability validated through deployment on co-trapped ⁴⁰Ca⁺/⁴⁰CaOH⁺ and ¹⁷¹Yb⁺ crystals. The control system utilizes the Advanced Real-Time Infrastructure for Quantum physics, or ARTIQ, stack, interfacing with it through the tools provided by the Model Context Protocol server. Preventing direct manipulation of the experiment, token-based authorization, issued either automatically via simulation or manually by an operator, ensures a formal safety boundary, safeguarding sensitive equipment.

AI agents manage laboratory equipment with defined human oversight

The pursuit of fully autonomous experimentation promises to liberate researchers and accelerate the pace of discovery. A key bottleneck not addressed by previous automated systems highlighted; while large-language-model agents excel at generating experimental code, their ability to recognise when a fundamental shift in approach is needed remains limited. Despite acknowledging limitations in an agent’s ability to fundamentally rethink experiments, the importance of this work is not diminished.

The team has demonstrably created a system where an artificial intelligence can independently manage complex laboratory equipment, representing a vital step towards fully automated research. This boundary between agent action and human oversight addresses a critical safety concern previously unaddressed in autonomous experimentation, paving the way for more reliable and sophisticated AI scientists. Establishing a formal safety boundary within a trapped-ion experiment, this system allows a large-language-model agent to autonomously develop and execute calibrations.

This achievement realised through a token-based authorization system verifying every hardware command. Moving beyond simply automating existing routines, this approach enables the agent to independently build experiments while mitigating risks to sensitive equipment. Successful deployment on both ⁴⁰Ca⁺/⁴⁰CaOH⁺ and ¹⁷¹Yb⁺ platforms confirms the system’s adaptability, demonstrating interface-level portability across different quantum hardware.

The researchers successfully demonstrated a control system allowing a large-language-model agent to autonomously manage laboratory equipment with defined human oversight. This is important because it establishes a formal safety boundary, preventing unchecked code from damaging apparatus during autonomous experimentation. The system uses token-based authorization, verifying each hardware command either through simulation or with manual operator approval, and was deployed on both ⁴⁰Ca⁺/⁴⁰CaOH⁺ and ¹⁷¹Yb⁺ platforms. The authors confirmed interface-level portability, suggesting the system can be adapted to different quantum hardware configurations.