What Is Quantum Computing? Qubits, Gates and Hardware Explained

Quantum computing processes information with qubits, physical systems that follow quantum mechanics, so a computation can use superposition, entanglement and interference instead of only 0s and 1s. It speeds up a few problem types, such as factoring (Shor's algorithm) and simulating molecules, not everything. Today's machines are small and noisy, and error correction is the central engineering problem.

Below: qubits, measurement, gates, decoherence, error correction and the six hardware families, with every milestone tied to the paper or government page it comes from. No company rankings, no arrival forecasts.

If you came here because of encryption, read this post for the physics and then go to what a cryptographically relevant quantum computer would actually need and whether quantum computing is a threat to cybersecurity today.

Key takeaways

• A qubit is a two level quantum system. Before measurement it can be in a superposition of 0 and 1; measurement returns a single classical bit, with probabilities set by the state.
• Quantum algorithms arrange interference so wrong answers cancel and right ones reinforce. They do not try every answer at once and read them all out.
• Gates are physical pulses of microwaves or light. A small set of one and two qubit gates can build any circuit.
• Qubits lose their quantum state through decoherence. Error correction spreads one logical qubit across many physical qubits, and it only helps once physical error rates are below a threshold.
• In December 2024 a Google Quantum AI paper in Nature reported a surface code memory whose logical error rate fell as the code grew, a key demonstration of below threshold operation.
• "Quantum advantage" claims are task specific, and several have been answered by better classical algorithms.
• Breaking RSA needs a large fault tolerant machine that does not exist. The most recent published estimate (Gidney, May 2025) still assumes close to a million noisy physical qubits running for about a week, at a scale no current device approaches.

Bits and qubits: what is actually different?

A classical bit is a physical thing held in one of two states, such as charge on a capacitor or a magnetised region. As NIST's explainer notes, a bit put into 0 or 1 usually stays there for a long time, and that stability is why classical computing works.

A qubit is also physical, but chosen because it behaves as a two level quantum system: two energy levels of an ion, the two lowest states of a superconducting circuit, two paths of a photon, an electron spin up or down. The two levels are written |0⟩ and |1⟩.

A classical bit is either 0 or 1. A qubit can be in a superposition: a weighted combination of |0⟩ and |1⟩, where each weight is a complex number called an amplitude. The squared size of each amplitude gives the probability of seeing that outcome when you measure. The amplitudes also carry a phase, and phase is what lets amplitudes add up or cancel. That last property, interference, is the real engine of quantum algorithms.

With more qubits, the description grows fast. NIST's explainer notes that two qubits can hold a superposition over four combinations, three over eight, and each extra qubit doubles the count. Fifty qubits need about 10 to the 15th complex amplitudes to describe in full. This is why classical computers struggle to simulate large quantum systems, and it was the observation behind Richard Feynman's 1981 talk on simulating physics with computers, which NIST credits with launching the field.

The doubling is easy to misread. It does not mean a quantum computer stores or returns 2 to the n useful answers. It means the internal state lives in a huge space that you can shape with gates but only sample from when you measure.

Superposition, in plain terms

NIST uses a ladder to explain superposition: a person stands on one rung, while an atom can behave as though it is on a low rung and a high rung at once until it is measured or disturbed. The state is not secretly one value nobody has looked at yet: the two possibilities carry amplitudes that can interfere, which a hidden coin flip cannot do.

You can see the difference with one gate. The Hadamard gate takes |0⟩ to an equal superposition. Measure right away and you get 0 or 1 at random, about half the time each. Apply a second Hadamard before measuring and you get 0 every time. A coin flipped twice is still random; a qubit sent through two Hadamards is not, because the two paths to 1 cancel. The walkthrough below runs this on a laptop.

Entanglement, briefly

Entanglement is a correlation between qubits that has no classical counterpart: the joint state cannot be written as separate states for each qubit. A two qubit Bell state, for example, gives 00 or 11 at random when measured, never 01 or 10. Entanglement lets the state of n qubits act as one object rather than n separate coins. It does not let anyone send signals faster than light; a companion post on entanglement covers why.

What does measurement do to a qubit?

Measuring a qubit returns 0 or 1, with probabilities given by the squared amplitudes, and leaves the qubit in the state that matches the result. The superposition is gone. Three consequences follow.

First, one run gives one sample. To estimate a probability you run the same circuit many times, called shots, and count outcomes.

Second, you cannot read out the amplitudes directly. A 50 qubit state has about 10 to the 15th amplitudes, but a measurement gives you 50 bits. NIST's explainer quotes Stephen Jordan, a Google researcher and longtime former NIST staff member, on exactly this: computations can run in superposition, but the final measurement extracts only a small amount of information about all of them. The skill in algorithm design is arranging the circuit so the few bits you can read out carry the answer you need.

Third, any unwanted interaction with the environment acts like a partial measurement. A stray photon, a vibration or a fluctuating field can leak which path information out of the qubit and destroy the interference you were relying on. That is decoherence, covered below.

Gates and circuits: how a quantum program is built

A quantum program is usually a circuit: gates applied to a register of qubits, ending in measurements. Each gate is a reversible operation (a unitary matrix) on one or two qubits, and physically a shaped control signal: a microwave pulse on a chip, a laser pulse on an ion or atom, a beam splitter for photons.

The gates you meet first

A small set is universal: one qubit gates plus an entangling gate such as CNOT can approximate any quantum operation as closely as you need. The 2012 surface code tutorial by Fowler, Mariantoni, Martinis and Cleland completes a fault tolerant universal set with CNOT, Hadamard, S and T.

What a circuit looks like

The smallest interesting circuit applies a Hadamard to qubit 0, a CNOT onto qubit 1, then measures both. Ideal output is 00 or 11, equally often. As drawn by an open source SDK:

     ┌───┐     ┌─┐
q_0: ┤ H ├──■──┤M├───
     └───┘┌─┴─┐└╥┘┌─┐
q_1: ─────┤ X ├─╫─┤M├
          └───┘ ║ └╥┘
c: 2/═══════════╩══╩═
                0  1

Real hardware hides constraints behind that diagram. The SDK's compiler (a transpiler) rewrites gates into the device's native set and adds swap operations where qubits are not directly connected. Every added gate adds error, which is why circuit depth matters as much as qubit count.

The DiVincenzo checklist

In February 2000, David DiVincenzo of IBM published five requirements for a physical quantum computer, plus two for communication, still the clearest way to compare hardware. Paraphrased, a platform needs: scalable, well characterised qubits; a way to initialise them to a simple state; coherence times much longer than gate times; a universal set of gates; and qubit specific measurement. Every hardware family below is a different trade among those items.

Why do qubits lose their state? Decoherence and noise

Decoherence is the loss of a qubit's quantum behaviour through unwanted coupling to its surroundings: an excited qubit relaxes, or the phase between |0⟩ and |1⟩ washes out. Gates add their own errors through miscalibrated pulses and crosstalk.

Classical hardware copes with noise by copying bits and taking majority votes. Quantum information resists that: an unknown quantum state cannot be cloned, checking a qubit by measuring it destroys the superposition, and errors are continuous rotations of two kinds, bit flips and phase flips.

The size of the problem shows up in the papers. John Preskill's 2018 paper that named the "Noisy Intermediate Scale Quantum" (NISQ) era described devices of 50 to 100 qubits whose gate noise limits how large a circuit can run reliably, and warned that "the 100-qubit quantum computer will not change the world right away." That framing is still the right starting point for reading any announcement.

How does quantum error correction work?

Quantum error correction encodes one logical qubit into many physical qubits so errors can be found and fixed without measuring the encoded data. Helper qubits measure parities, called stabilizers: whether neighbouring data qubits agree, without revealing either value. The pattern of results, the syndrome, goes to a classical decoder that infers which errors most likely happened.

Physical qubits and logical qubits

• A physical qubit is one ion, one atom, one superconducting circuit. It has an error rate per gate and a coherence time.
• A logical qubit is an encoded qubit spread across many physical qubits plus the measurement and decoding machinery around it. It has a logical error rate per round of correction.

A headline qubit count almost always means physical qubits. What determines whether a machine can run long algorithms is the number of logical qubits it can hold and the logical error rate it achieves.

Surface codes

The surface code arranges data qubits and measurement qubits on a two dimensional grid where each qubit only talks to its nearest neighbours, which suits chips with fixed wiring. Fowler and colleagues' 2012 tutorial explains how logical qubits form on that grid and how a full gate set is completed. The code distance, d, is roughly how many physical errors in a row it takes to corrupt the logical qubit. A distance 3 code tolerates any single error; a distance 7 code tolerates more.

The catch is the threshold. Adding qubits adds more places for errors, so a bigger code only helps if the physical error rate is low enough. Below the threshold, each step up in distance divides the logical error rate by a roughly constant factor. Above it, bigger codes make things worse. The Delft spin qubit paper cites a common target of about 1 percent error for the surface code threshold, while noting the real figure depends on many details.

What the experiments have shown

In February 2023, Google Quantum AI reported in Nature that a distance 5 surface code logical qubit "modestly outperforms" an ensemble of distance 3 logical qubits, with logical error per cycle of about 2.91 percent versus 3.03 percent. The authors describe it as error correction beginning to improve performance as qubit number grows.

In December 2023, a Harvard led team with QuEra and NIST/University of Maryland collaborators reported in Nature a programmable processor based on logical qubits in reconfigurable neutral atom arrays, operating with up to 280 physical qubits. They showed a two qubit logical gate improving as surface code distance went from 3 to 7, and ran sampling circuits with up to 48 logical qubits using error detecting codes.

In December 2024, Google Quantum AI published "Quantum error correction below the surface code threshold" in Nature, using its Willow processors. The logical error rate fell by a factor of 2.14 each time the code distance rose by 2, ending in a 101 qubit distance 7 memory with 0.143 percent error per cycle. That logical memory outlived the best physical qubit on the chip by a factor of 2.4, and a real time decoder kept up with a 1.1 microsecond cycle. The same paper reports that repetition codes were limited by rare correlated error events, about once an hour.

These are memories and small logical operations, not long algorithms, and the overhead is large: about a hundred physical qubits for one logical qubit at distance 7, before the extra machinery fault tolerant T gates need.

The hardware families, one by one

Almost any well isolated two level system can be a qubit. Six families get the most attention; the table after them compares trade offs without ranking anyone.

Superconducting circuits

A superconducting qubit is a small circuit with a Josephson junction, made from materials that lose all resistance when very cold, run inside dilution refrigerators and driven by microwave pulses. NIST's explainer says these qubits compute fast and can be made with existing chip fabrication, but their quantum states are more fragile and shorter lived than those of ion qubits.

The physics behind them received the 2025 Nobel Prize in Physics, awarded to John Clarke, Michel H. Devoret and John M. Martinis for the discovery of "macroscopic quantum mechanical tunnelling and energy quantisation in an electric circuit." In April 1999, Nakamura, Pashkin and Tsai reported in Nature electrical coherent control of a superconducting Cooper pair box qubit. The error correction results above all used superconducting qubits.

Trapped ions

A trapped ion qubit stores 0 and 1 in two energy levels of a single charged atom held by electric fields in a vacuum. Lasers or microwaves drive gates, and the ions' shared vibrational motion entangles them.

Ignacio Cirac and Peter Zoller proposed the design in Physical Review Letters on 15 May 1995. On 18 December 1995, Christopher Monroe, David Wineland and colleagues at NIST reported in the same journal a controlled NOT gate on a single trapped ion, using its internal and motional states as the two qubits. Wineland shared the 2012 Nobel Prize in Physics with Serge Haroche "for ground-breaking experimental methods that enable measuring and manipulation of individual quantum systems."

The usual trade off for their longer coherence is speed: motion mediated gates are slower, and long ion chains get harder to control, which pushes designs toward multiple trap zones.

Neutral atoms

Neutral atom machines hold uncharged atoms in arrays of focused laser beams, often called optical tweezers, and use highly excited atomic states for entangling gates. Atoms can be moved, which gives flexible connectivity. The December 2023 Nature paper described above used a "zoned architecture in reconfigurable neutral-atom arrays" with mid circuit readout. The trade offs are atom loss that must be detected and refilled, the time it takes to move atoms, and complex optics.

Photonic

Photonic approaches encode information in light: a photon's path, its polarisation, or the state of a light pulse. Photons barely interact with their surroundings, which helps coherence, but the same weak interaction makes two qubit gates hard, so these designs lean on interference, measurement and specially prepared states.

In June 2022, Xanadu researchers with NIST collaborators reported in Nature a quantum computational advantage claim using Borealis, a programmable photonic processor. They ran Gaussian boson sampling on 216 squeezed modes. That is a sampling task, not a general algorithm, and the paper itself notes that earlier photonic demonstrations were vulnerable to "spoofing" by classical heuristics.

Semiconductor spins

Spin qubits store information in the spin of single electrons or holes held in quantum dots, tiny traps defined by gate electrodes in silicon or germanium. They resemble transistors, which is why the Delft authors see a path to scaling through semiconductor technology.

In January 2022, a QuTech team at Delft University of Technology reported in Nature a two qubit silicon processor with single and two qubit gate fidelities all above 99.5 percent, measured by gate set tomography. The paper's title, "Quantum logic with spin qubits crossing the surface code threshold," refers to the roughly 1 percent error target. It is a two qubit result; the open question is reproducing that quality across large arrays.

Topological qubits, and why the claims are disputed

Topological qubits are a proposal to store information non locally in exotic quasiparticles such as Majorana zero modes, so local noise cannot easily disturb it, which would cut error correction overhead. The first hurdle is showing the quasiparticles exist in a device and behave as theory predicts.

In February 2025, Microsoft Azure Quantum researchers published "Interferometric single shot parity measurement in InAs-Al hybrid devices" in Nature. They report a single shot measurement of fermion parity in a nanowire device, using an architecture designed to be compatible with future tests of fusion rules. The abstract itself discusses its measurements "in terms of both topologically trivial and non-trivial origins." The peer reviewed paper does not claim to have proven a topological qubit, and announcements in this family deserve that caution until independent groups reproduce the key signatures.

The families side by side

There is no row for "best": each family is a different answer to DiVincenzo's checklist.

A separate approach, quantum annealing, uses a physical system that settles into low energy states to tackle certain optimisation and physics problems. NIST notes it is a different technology from the gate based machines this post describes.

What can quantum computers do, and what can they not do?

Quantum computers are not faster classical computers. They have large known speedups for a few problems, smaller ones for others, and none known for most everyday workloads.

Shor's algorithm: factoring and discrete logarithms

Peter Shor presented his algorithms in 1994; the extended version was posted to arXiv on 30 August 1995. The abstract states the result directly: efficient, polynomial time algorithms on a hypothetical quantum computer for factoring integers and finding discrete logarithms, two problems believed hard for classical computers and used as the basis of public key cryptosystems. That covers RSA and elliptic curve cryptography. NIST's explainer says the paper turned quantum computing into a national security issue.

Shor's speedup is superpolynomial, but it needs a large fault tolerant machine. The most cited resource estimates come from Craig Gidney and Martin Ekerå. In May 2019 they estimated factoring 2048 bit RSA in about eight hours with 20 million noisy qubits. In May 2025, Gidney revised that to under a week with fewer than a million noisy qubits. Both rest on stated assumptions: a square grid with nearest neighbour connections, a uniform 0.1 percent gate error rate, a 1 microsecond surface code cycle and a 10 microsecond control reaction time. Set those beside the 101 qubit Willow memory and the gap is plain. For the security side, see when a quantum computer could break encryption.

Grover's algorithm: unstructured search

Lov Grover's paper (arXiv, 29 May 1996) shows how to find a marked item among N unsorted items in on the order of the square root of N steps, where a classical search needs about N/2 on average. The abstract notes the algorithm is "within a small constant factor of the fastest possible quantum mechanical algorithm." So the speedup is quadratic and that is the ceiling for unstructured search. For symmetric keys the effect is far smaller than Shor's on public keys; see does quantum computing break AES-256.

Simulating quantum systems

Simulating molecules, materials and nuclear matter is the application that started the field. NIST describes the hope that large machines could simulate the quantum rules governing molecules and materials, which classical computers can only approximate with great effort. The DOE Office of Science explainer lists chemical catalysts and the quarks and gluons inside atomic nuclei as targets, and adds that the machines available today "are small, noisy prototypes."

Sampling and "quantum advantage" claims

Most advantage demonstrations so far are sampling tasks chosen because they are hard to simulate classically, not because the output is useful. Their history shows how such claims age.

In October 2019, Google's Sycamore paper in Nature reported sampling a 53 qubit random circuit a million times in about 200 seconds and estimated the equivalent classical task at about 10,000 years. Two days earlier, IBM researchers posted an analysis on arXiv arguing that with secondary storage, the Summit supercomputer could simulate such circuits "in a matter of days."

In June 2023, IBM researchers reported in Nature measurements on a 127 qubit processor at a scale they described as beyond brute force classical computation, calling it evidence for the "utility of quantum computing in a pre-fault-tolerant era." Within two weeks, a preprint by Tindall and colleagues reported a classical tensor network simulation of the same kicked Ising system that was "significantly more accurate and precise than the results obtained from the quantum processor."

In October 2025, Google Quantum AI reported in Nature measurements of second order out of time order correlators on a superconducting processor, which the authors say carry high classical simulation complexity and "indicate a viable path to practical quantum advantage." Read the phrasing carefully: a path, for a specific class of measurements.

The experiments still matter, but "advantage" is always a claim about one task against the best classical method known at the time.

What they will not do

• General speedups. There is no known quantum speedup for ordinary programs such as web servers, databases or compilers. NIST expects quantum and classical machines to work together, not one to replace the other.
• Read out everything at once. Measurement limits what you get back, so "try all answers in parallel" is not a working mental model.
• Run long algorithms on today's devices. Without error correction at scale, circuit depth is capped by noise.

Classical versus quantum, by problem type

A dated timeline from primary sources

Dates are publication or announcement dates from each source, listed under Sources.

Step by step: run your first quantum circuit on a laptop

An open source SDK and a local simulator are enough to see every idea above. This uses Qiskit, an Apache 2.0 licensed Python SDK, and its Aer simulator, tested with qiskit 2.2.3 and qiskit-aer 0.17.2; PyPI's newer qiskit releases need Python 3.10 or later. Nothing here touches real hardware or sends data anywhere.

1. Create an isolated environment

python3 -m venv qenv
source qenv/bin/activate
python -m pip install --upgrade pip
python -m pip install qiskit qiskit-aer
python -m pip show qiskit qiskit-aer | grep -E "^(Name|Version|Requires)"

The last command shows what each package pulls in. On our test install, qiskit required numpy, scipy, rustworkx, stevedore, dill and typing-extensions, and the full environment held about fifteen packages. Keep that in mind for the supply chain section below.

2. One qubit, two Hadamards

Save as one_qubit.py:

from qiskit import QuantumCircuit, transpile
from qiskit_aer import AerSimulator

sim = AerSimulator()

# One Hadamard, then measure: expect roughly half 0 and half 1
qc = QuantumCircuit(1, 1)
qc.h(0)
qc.measure(0, 0)
print(sim.run(transpile(qc, sim), shots=1000, seed_simulator=7).result().get_counts())

# Two Hadamards, then measure: the paths to 1 cancel, expect all 0
qc2 = QuantumCircuit(1, 1)
qc2.h(0)
qc2.h(0)
qc2.measure(0, 0)
print(sim.run(transpile(qc2, sim), shots=1000, seed_simulator=7).result().get_counts())

Run it with python one_qubit.py. Our run printed {'1': 486, '0': 514} and then {'0': 1000}. The first line is superposition plus measurement. The second is interference: something a random coin cannot do.

3. Entangle two qubits

Save as bell.py:

from qiskit import QuantumCircuit, transpile
from qiskit_aer import AerSimulator

qc = QuantumCircuit(2, 2)
qc.h(0)
qc.cx(0, 1)
qc.measure([0, 1], [0, 1])
print(qc.draw(output="text"))

sim = AerSimulator()
result = sim.run(transpile(qc, sim), shots=1000, seed_simulator=7).result()
print(result.get_counts())

Our run printed the circuit diagram shown earlier and {'11': 511, '00': 489}. You never see 01 or 10: the two results are perfectly correlated, and each one alone is random.

4. Add noise and watch errors appear

Save as noisy_bell.py:

from qiskit import QuantumCircuit, transpile
from qiskit_aer import AerSimulator
from qiskit_aer.noise import NoiseModel, depolarizing_error

noise = NoiseModel()
noise.add_all_qubit_quantum_error(depolarizing_error(0.05, 2), ["cx"])

qc = QuantumCircuit(2, 2)
qc.h(0)
qc.cx(0, 1)
qc.measure([0, 1], [0, 1])

sim = AerSimulator(noise_model=noise)
print(sim.run(transpile(qc, sim), shots=1000, seed_simulator=7).result().get_counts())

With a 5 percent depolarizing error on the CNOT, our run printed {'01': 6, '10': 15, '11': 471, '00': 508}. The 01 and 10 outcomes are errors. One noisy gate already corrupts about 2 percent of shots; a circuit with thousands of gates would be mostly noise. That is the problem error correction exists to solve, and a good way to make the threshold idea concrete: try 0.01 and 0.1 and compare.

5. Pin what you installed

# Record the exact versions you tested with
python -m pip freeze > requirements.lock

# Rebuild the same environment later, or on another machine
python3 -m venv qenv-clean
source qenv-clean/bin/activate
python -m pip install -r requirements.lock

Pinned versions keep a notebook reproducible and show which package changed when something breaks. Commit the lock file next to the notebooks so the environment is reviewed like code.

Where quantum computing meets software supply chain security

Quantum software is ordinary open source software. SDKs, simulators, decoders and the cloud clients that submit jobs are Python, C++ and Rust packages on the same numerical libraries as data science stacks; the walkthrough above pulled in about fifteen packages for a two line circuit, on a laptop that probably holds credentials for other systems. The questions are familiar: which versions are installed where, are they pinned, and do known vulnerabilities affect them. The separate question of what a future large quantum computer means for your cryptography, which is a migration and inventory problem, is covered in quantum computing and cryptography in the software supply chain.

Safeguard does not build, simulate, benchmark or secure quantum hardware, and it offers nothing quantum specific. Its fit here is indirect and limited to the software around the experiments: Safeguard scans repositories, container images and SBOM files, including a project that holds quantum notebooks and their requirements files, matches components against vulnerability databases, and shows which projects carry a given component and version. safeguard scan --dir . in a research repository, or safeguard scan --image <name> on the image your notebooks run in, tells you what is installed and what needs attention.

Common mistakes

• Reading a physical qubit count as computing power. What matters is logical qubits and logical error rate. More noisy qubits can do less than fewer clean ones.
• Explaining superposition as "trying every answer at once." NIST's explainer calls this a popular misconception. Measurement returns a small amount of information; algorithms work through interference.
• Treating "quantum advantage" as general. Each claim covers one task. Check which task, against which classical method, and whether a rebuttal has appeared.
• Confusing error mitigation with error correction. Mitigation post processes noisy results; correction protects logical qubits during computation. Only correction scales to long algorithms.
• Ignoring the software stack. Quantum SDKs are open source packages with dependency trees. Pin them, track them and scan them like any other code.
• Using a single resource estimate as a forecast. Estimates such as Gidney's depend on explicit hardware assumptions. They tell you what a machine would need, not when it will exist.

FAQ

What is quantum computing in simple terms?

Computing with qubits, physical systems governed by quantum mechanics. A qubit can be in a superposition of 0 and 1, qubits can be entangled, and algorithms use interference so that measurement is likely to return the right answer.

What is the difference between a bit and a qubit?

A bit is always 0 or 1. A qubit can be in a weighted combination of both, with amplitudes that can interfere. Measuring a qubit still returns only 0 or 1.

Are quantum computers faster than normal computers?

Only for certain problems: factoring and discrete logarithms (Shor), unstructured search with a quadratic gain (Grover), and simulating quantum systems. Everyday software has no known speedup.

What is a logical qubit?

A qubit encoded across many physical qubits using an error correcting code, such as the surface code, so that errors can be detected and corrected during computation. Its logical error rate, not the physical count, decides how long a computation can run.

What types of quantum computers are there?

Gate based machines built from superconducting circuits, trapped ions, neutral atoms, photons or semiconductor spins, plus proposed topological qubits. Quantum annealers are a separate approach aimed at certain optimisation and physics problems.

Has quantum advantage been achieved?

Peer reviewed papers report it for specific sampling tasks, such as the 2019 Sycamore and 2022 Borealis papers. Better classical simulations have answered some claims, so each applies to one task at one time.

Can a quantum computer break encryption today?

No. Breaking RSA 2048 needs a large fault tolerant machine. The most recent published estimate still assumes close to a million noisy physical qubits running for about a week, at error rates and speeds no device sustains at that scale. Migration planning still matters because encrypted data can be recorded now and attacked later.

Did Microsoft build a topological qubit?

Its February 2025 Nature paper reports a parity measurement and discusses both topological and non topological interpretations. It does not establish a topological qubit.

Fix it without waiting for upstream

Safeguard has nothing to do with qubits, but quantum research runs on the same open source supply chain as everything else: SDKs, simulators and decoders arrive as Python, C++ and Rust packages with deep dependency trees on shared laptops, notebooks and CI runners. Keeping those dependencies patched and pinned is ordinary supply chain hygiene, and the tools below apply to it the same way they apply to any other code you build.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

To try it on your own machine, download Safeguard from https://safeguard.sh/download and see the CLI documentation at https://docs.safeguard.sh/docs/cli .

See how Safeguard would help

The first demo sets up Safeguard's local runner on your own machine, approves it with its device code, and runs a scan from the terminal. On a research laptop or notebook server, the same flow scans the repository that holds your circuits and requirements file and lists the SDK and numerical packages it found.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same approve each step flow applies when a dependency in a Python research environment needs an upgrade and you want tests run before anything changes.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That lets you ask which projects carry a given package version, for example a particular numerical library, while controlling what the assistant can touch.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST: Quantum Computing Explained
• US Department of Energy: DOE Explains, Quantum Computing
• National Quantum Initiative: About
• Shor, Polynomial Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer, arXiv quant-ph/9508027
• Grover, A fast quantum mechanical algorithm for database search, arXiv quant-ph/9605043
• Cirac and Zoller, Quantum Computations with Cold Trapped Ions, Physical Review Letters 74, 4091 (1995)
• Monroe et al., Demonstration of a Fundamental Quantum Logic Gate, Physical Review Letters 75, 4714 (1995)
• Nakamura, Pashkin and Tsai, Coherent control of macroscopic quantum states in a single Cooper pair box, Nature 398, 786 (1999)
• DiVincenzo, The Physical Implementation of Quantum Computation, arXiv quant-ph/0002077
• Fowler, Mariantoni, Martinis and Cleland, Surface codes: Towards practical large scale quantum computation, arXiv 1208.0928
• Preskill, Quantum Computing in the NISQ era and beyond, arXiv 1801.00862
• Arute et al., Quantum supremacy using a programmable superconducting processor, Nature 574, 505 (2019)
• Pednault et al., Leveraging Secondary Storage to Simulate Deep 54 qubit Sycamore Circuits, arXiv 1910.09534
• Xue et al., Quantum logic with spin qubits crossing the surface code threshold, Nature 601, 343 (2022)
• Madsen et al., Quantum computational advantage with a programmable photonic processor, Nature 606, 75 (2022)
• Google Quantum AI, Suppressing quantum errors by scaling a surface code logical qubit, Nature 614, 676 (2023)
• Kim et al., Evidence for the utility of quantum computing before fault tolerance, Nature 618, 500 (2023)
• Tindall et al., Efficient tensor network simulation of IBM's Eagle kicked Ising experiment, arXiv 2306.14887
• Bluvstein et al., Logical quantum processor based on reconfigurable atom arrays, Nature 626, 58 (2024, online December 2023)
• Google Quantum AI and collaborators, Quantum error correction below the surface code threshold, Nature 638, 920 (2025, online December 2024)
• Aghaee et al. (Microsoft Azure Quantum), Interferometric single shot parity measurement in InAs-Al hybrid devices, Nature 638, 651 (2025)
• Google Quantum AI and collaborators, Observation of constructive interference at the edge of quantum ergodicity, Nature 646, 825 (2025)
• Gidney and Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, arXiv 1905.09749
• Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv 2505.15917
• Nobel Prize in Physics 2012 summary, nobelprize.org
• Nobel Prize in Physics 2025 summary, nobelprize.org
• PyPI: qiskit

Last reviewed: 23 October 2026.