Quantum Error Correction: Where the Field Really Stands

Quantum error correction stopped being a theory problem some time around late 2024 and became an engineering problem with a published cost curve. What has not changed is the overhead: the machines that would threaten RSA still need somewhere between a hundred and a thousand physical qubits for every usable logical one. This is what the peer-reviewed record actually says, which claims are contested, and what a company should do about cryptography in the meantime.

Physical qubits, logical qubits, and the ratio that decides everything

A physical qubit is a piece of hardware: a superconducting circuit, a trapped ion, a neutral atom in an optical tweezer. It decoheres in microseconds to seconds and its gates fail at rates between roughly 0.1% and 1%. A logical qubit is an abstraction built from many physical qubits plus continuous measurement and classical decoding, engineered so that its error rate is lower than any of its parts.

Vendor qubit counts are therefore close to meaningless on their own. The number that matters is the encoding rate and the resulting logical error rate per cycle. In the rotated surface code, protecting against distance d requires on the order of 2d² physical qubits, so pushing the logical error rate down by orders of magnitude costs quadratically more hardware. That quadratic is the reason a cryptographically relevant machine is measured in hundreds of thousands or millions of physical qubits rather than thousands.

The threshold theorem, and what “below threshold” proved

The threshold theorem, established in the mid-1990s, says that if the physical error rate per operation sits below some code-dependent threshold, then increasing the code distance suppresses logical errors exponentially, and arbitrarily long computations become possible with only polylogarithmic overhead. Above the threshold, adding qubits makes things worse, because each new component contributes more errors than the code can correct.

For two decades the field sat above threshold. Google Quantum AI’s paper “Quantum error correction below the surface code threshold”, published in Nature on 9 December 2024, is the result that changed that. On the 105-qubit Willow processor, a distance-7 surface code using 101 qubits (49 data, 48 measure, 4 for leakage removal) reached a logical error rate of 0.143% ± 0.003% per cycle, with an error suppression factor Λ of 2.14 ± 0.02 for each increase of two in code distance.

The distance-7 logical qubit had a lifetime of 291 ± 6 microseconds, “exceeding the lifetime of its best physical qubit by a factor of 2.4 ± 0.3.”

Λ ≈ 2 is a real result and a sobering one. Halving the logical error rate per two units of distance means reaching the error rates a Shor’s-algorithm run needs, on the order of 10⁻¹⁰ per logical operation, requires very large distances and correspondingly large qubit budgets. The same paper also reported that distance-29 repetition codes exposed correlated error bursts roughly once an hour, the kind of rare fault that no distance scaling fixes.

The milestone results, with dates

Quantinuum’s Helios announcement is worth reading carefully, because it illustrates how much definitional work these numbers do. The 94 logical qubits are error-detected in a GHZ state; the 50 break-even figure and the 48 “fully error-corrected” qubits at a 2:1 encoding rate use the Iceberg code, which detects errors cheaply but does not give the deep suppression a surface code at high distance does. All three claims are defensible and all three mean different things.

Surface codes versus qLDPC: the overhead argument

IBM has bet against the surface code. Its published roadmap uses quantum low-density parity check codes, specifically bivariate bicycle codes, with the [[144,12,12]] “gross code” encoding 12 logical qubits into 144 data qubits and claimed to need roughly 10× fewer physical qubits than a surface code of comparable protection. The cost is connectivity: qLDPC codes need long-range couplers rather than a nearest-neighbour grid, which is what IBM’s Loon chip was built to demonstrate.

The roadmap then runs Kookaburra in 2026 as the first module storing information in qLDPC memory, Cockatoo in 2027 for inter-module entanglement, and Starling in 2028–2029 targeting 100 million gates on 200 logical qubits. Treat those as engineering commitments, not results. As of 2026 the surface code remains the only scheme with a published below-threshold memory demonstration at multiple distances on real hardware.

Why “quantum advantage” claims keep getting disputed

Two reasons, and both are structural. First, the classical baseline is a moving target set by adversarial effort: several early advantage claims were retired within months by better tensor-network simulations on GPUs. Second, sampling-style demonstrations produce output that is expensive to verify, so the claim rests on the same complexity assumptions that make it interesting.

Both major labs have tried to answer the verification problem. Google’s Quantum Echoes result of 22 October 2025 used out-of-time-order correlators on Willow, reporting a run of about two hours against an estimated 3.2 years per data point on the Frontier supercomputer, roughly 13,000× faster, and argued that expectation values are reproducible across machines in a way that random-circuit bitstrings are not. Google also conceded that the accompanying nuclear magnetic resonance application “is not yet beyond classical”.

IBM and Algorithmiq announced on 30 July 2026 a heterogeneous quantum matter simulation on a Heron processor where, they said, no classical method reliably covered the full problem regime. The result depends on controlled noise injection and error mitigation with quantified uncertainty rather than on classical verification, and IBM explicitly keeps it open to challenge on a public advantage tracker. That framing is more honest than earlier claims, and it is also an admission that “advantage” is now a running scoreboard rather than a single event.

How far is a machine that breaks RSA

The best public estimate has moved a long way, and in the wrong direction for anyone hoping for decades of slack. Craig Gidney’s May 2025 paper estimates that a 2048-bit RSA integer could be factored in under a week by a quantum computer with fewer than a million noisy qubits, assuming a 0.1% uniform gate error rate, a square nearest-neighbour grid and a one-microsecond surface code cycle. His own 2019 estimate was 20 million qubits. The improvement came from approximate residue arithmetic, yoked surface codes and magic state cultivation, not from better hardware.

So the arithmetic is: roughly a million physical qubits with today’s error rates, versus the roughly one hundred that the best below-threshold demonstration used. That is four orders of magnitude, and nobody credible has a dated schedule for closing it. Anyone quoting a specific “Q-Day” year is guessing.

What to do about cryptography before the machine exists

The migration deadline is set by policy and by the harvest-now-decrypt-later problem, not by hardware progress. Encrypted traffic captured in 2026 can be stored and broken later, so anything with a confidentiality life beyond a decade is already exposed.

1. Inventory first. You cannot migrate what you cannot find. Catalogue every place RSA, ECDH, ECDSA or DH appears, including hardware roots of trust, code-signing chains, VPN concentrators and third-party SDKs.
2. Adopt the finalised standards, not the candidates. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) were issued in August 2024. HQC was selected in March 2025 as a backup key-encapsulation mechanism with different mathematical foundations; NIST advanced nine additional signature candidates to a third round in May 2026.
3. Plan against the NIST dates. The initial public draft of NIST IR 8547 deprecates RSA and elliptic-curve algorithms at 112-bit security after 2030 and disallows quantum-vulnerable public-key algorithms after 2035. As of the time of writing that document is still at draft stage, but federal buyers are already procuring against it.
4. Use hybrid key exchange in transit. Combining ML-KEM with X25519 costs a little bandwidth and protects against both a future quantum attack and an implementation flaw in a young algorithm.
5. Prioritise signatures last, key exchange first. A signature forged in 2035 is a 2035 problem; a session key captured today is already a problem.

The useful mental model as of 2026: error correction works, the overhead is measured and large, the advantage scoreboard is contested by design, and the cryptographic deadline is driven by regulation rather than by qubit counts.

Sources

• Nature — Quantum error correction below the surface code threshold (Google Quantum AI)
• Google Research — A verifiable quantum advantage (Quantum Echoes)
• IBM Quantum — IBM lays out clear path to fault-tolerant quantum computing
• IBM Newsroom — IBM and Algorithmiq demonstrate quantum advantage
• Quantinuum — Introducing Helios
• arXiv — Craig Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits
• NIST CSRC — Post-Quantum Cryptography project news
• NIST IR 8547 (initial public draft) — Transition to Post-Quantum Cryptography Standards