とすお

Putting @Alice__Bob results in context, and a little rant/primer about quantum resource estimation. Disclaimer: I have huge respect for @Alice__Bob and their top notch scientists, I don't mean to suggest they're doing anything misleading. But headlines of the form "new architecture reduces the number of qubits necessary to break RSA" come up with some frequency, and I think most people, even experts, don't have enough context to put them in perspective. In quantum resource estimation, we count the number of qubits and gate layers necessary to implement a given quantum algorithm. The point is to estimate how large and how fast quantum computers need to be to solve useful problems. The standard approach is to baseline the estimates on noise levels from small-scale lab demos, i.e. if in your lab you have a ten-qubit QC with 2Q gate error rate epsilon, duration t, and certain connectivity, you compile the algorithm assuming that same noise level, speed, and connectivity pattern - more qubits. That's why @GoogleQuantumAI's papers assume 1e-3 error rate and 1 us cycle time and nearest-neighbour connectivity, and why the recent @IonQ_Inc paper assumes 1e-4 error rate and 200 us 2Q gate time and long-range transport. So in the standard approach, what you have to believe is, in essence, that QCs can be scaled in qubit count without compromising performance. This is of course a BIG if, and there are all kinds of reasons why this is hard (yield, I/O, power...), but it's difficult to do resource estimation without this assumption. However, not every architecture has a good lab demo to baseline on. Sometimes we want to think about some very futuristic qubit (e.g. cat qubit, majorana) or component (e.g. long-range coupler) that doesn't yet exist in the lab - or it does, but is so early on that the numbers are embarrassing to even mention. In those cases, the authors still have to assume something for its performance, but there isn't any reasonable experimental evidence to ground this assumption on. What you usually get from that is a result of the form "assuming as usual that we can scale qubit count without compromising performance, and further assuming that we have access to this particular MAGIC FUTURISTIC COMPONENT THAT DOESN'T EXIST, we find that we need XXX qubits to break RSA-2048". Nothing wrong with this so far! In a nutshell, results like this one tell us inform us about the trade-off between complexity at the physical level, and the overheads of QEC - so the headline should read "study finds that if a MAGIC FUTURISTIC COMPONENT THAT DOESN'T EXIST can be built, quantum computers can be X times smaller and Y times faster". In practice, however, nobody likes to shout about the MAGIC FUTURISTIC COMPONENT THAT DOESN'T EXIST. Thus, the headline gets abbreviated to "study finds method to make quantum computers X times smaller and Y times faster". And while technically correct, this headline creates an impression of a major conceptual breakthrough in QC architecture, whereas most of the heavy lifting is done by the change in *ambition* about the raw hardware performance. [I say most rather than all because these compiling for MAGIC FUTURISTIC COMPONENT THAT DOESN'T EXIST is often nontrivial and requires new techniques and thinking, so it might be unfair to ascribe all speedup to the hardware noise baseline. In practice, it is sometimes a challenge to disentangle the impacts of new ideas vs shifting assumptions about hardware performance] Let's take a very dumb example to make sure the point is clear. @CraigGidney says Google needs ~ 1 million qubits to break RSA-2048. Let's say I have an idea for a new qubit that has 1e-16 physical error rates. In this case, I might not need QEC at all, and I can break RSA with ~ 2000 qubits. I am welcome to make a headline "Maciej believes his qubit design can make QCs 500x smaller" - but saying "Maciej discovered a new method to break RSA with 500x lower qubits" would be misleading, right? This brings us to today's annoucement from Alice and Bob - breaking RSA-2048 with 23k qubits. While A&B uses regular superconducting chips, they run a very unusual architecture where the qubit is encoded in "cat states" with many many photons. Those qubits are peculiar because they're very easy to dephase, but very hard to bit-flip (sort of like classical bits!). This stems from the fact that most physical processes subtract/add photons one at a time, but their bit flip requires many many such events to happen in quick succession. To model this, the paper assumes that 2Q gates have Z-type (dephasing) error rate of ~5e-4 (would be world class for superconducting qubits, but not crazy), but that the X-type (bit flip) error rate is literally zero. While it might sound reasonable on paper, to my eye, this is a classic MAGIC FUTURISTIC COMPONENT THAT DOESN'T EXIST. Why do I say that? Well, first of all, there are no published results on 2Q gates on those qubits. Second, the cat qubits have - by design - very high dephasing rates, so the ability to match or exceed the performance of "standard" qubits is something aggressive. Third, while there is little doubt that cat qubit operations will have a noise bias (more Z than X errors), the ratio will be finite. The world is littered with proposals where "in theory, process ABC should be suppressed 10^10 times, but in practice, it's only suppressed 10^2 times" - and the burden of proof is on A&B to provide evidence that this baseline is reasonable. In the past, A&B did great experimental work on idling qubit noise bias, and put out good theory papers on biased gates - but lab data on gate bias remains to be released. I hope it's coming soon! In a nutshell: standard theory of fault-tolerant computation does a lot of heavy lifting to ensure that QEC corrects all, and not just some, low-weight errors. The cat qubit architecture avoids a lot of this overhead by assuming that errors are all of Z type. So the real headline is: "study finds that QCs could shrink 50x if they manage to eliminate bit-flip errors" - but that's a big if! Let me finish with a more positive spin on the results. First, A&B significantly improved their own estimate from a couple of years back, which is great. Second, the assumption of no bit flips is the bosonic equivalent of the standard QEC assumption that errors are exponentially suppressed with Pauli weight. If QEC papers assumed that for years before experimental demos, maybe A&B is justified in doing so as well? Third, "scaling qubit count without compromising performance" is much more believable when you're building a 20k qubit QC than a 1M qubit QC. Once again - this is context, not criticism. Building QCs is hard, and I am very happy to see so many folks approaching it from so many novel angles. I wish for A&B to succeed in their effort - the biased qubit angle is very interesting and could have huge payoffs down the line.