Willow quantum chip demonstrates verifiable quantum advantage on hardware

https://blog.google/technology/research/quantum-echoes-willow-verifiable-quantum-advantage/

by AbhishekParmar • 9 months ago

480 255 9 months ago

Bootvis• 9 months ago

This seems like an actually useful computation to do, unlike earlier results. Is that a reasonable reading of this article?

portaouflop3• 9 months ago

No it’s still completely useless for the real world. Also not actually verifiable

hshdhdhehd• 9 months ago

Classic quantum

einsteinx2• 9 months ago

demonstrates the first-ever algorithm to achieve verifiable quantum advantage on hardware.

Am I crazy or have I heard this same announcement from Google and others like 5 times at this point?

ortusdux• 9 months ago

I'd classify this one as different as it accompanies a publication in Nature - https://www.nature.com/articles/s41586-025-09526-6

rowanG077• 9 months ago

How is an accompanying publication in nature worth anything in this context?

nicce2• 9 months ago

I think it was in Nature last time as well…

joshuaissac• 9 months ago

It's the third one I am seeing from Google specifically.

auxiliarymoose2• 9 months ago

My understanding is that this one is "verifiable" which means you get a reproducible result (i.e. consistent result comes out of a computation that would take much longer to do classically).

Non-verifiable computations include things like pulling from a hard-to-compute probability distribution (i.e. random number generator) where it is faster, but the result is inherently not the same each time.

Veedrac• 9 months ago

This is as would be expected if it were real. Advantage isn't a black and white thing, because the comparison starts against 'any task done the best we know how to do using the most resources we happen to be willing to throw at it, even if we don't have a means to check that the output was correct', and ends at 'useful output you can formally verify where you have a strong reason to believe no classical algorithm would be effective.'

corranh• 9 months ago

Main caveat is that it’s verifiable (by them) but repeatable by others (in principle).

portaouflop3• 9 months ago

So actually it’s neither verifiable or repeatable in any real-works definition of the words.

jeffhuys• 9 months ago

This is your second comment in this thread (as far as I’ve scrolled) saying this without an explanation. Could you elaborate on why?

CGMthrowaway• 9 months ago

Related papers

The idea: Quantum Computation of Molecular Structure Using Data from Challenging-To-Classically-Simulate Nuclear Magnetic Resonance Experiments https://journals.aps.org/prxquantum/abstract/10.1103/PRXQuan...

Verifying the result by another quantum computer (it hasn't been yet): Observation of constructive interference at the edge of quantum ergodicity https://www.nature.com/articles/s41586-025-09526-6

markx2• 9 months ago

In physics, a quantum (pl.: quanta) is the minimum amount of any physical entity (physical property) involved in an interaction.

Not a big leap then.

chuckadams3• 9 months ago

I see what you did there. Shame a lot of other people didn't.

reader9274• 9 months ago

And the quantum snake oil train keeps on going

zippyman55• 9 months ago

It’s actually two trains going in opposite directions. But the quantum snake oil is always in the other train.

Imnimo• 9 months ago

As with any quantum computing news, I will wait for Scott Aaronson to tell me what to think about this.

lisper• 9 months ago

Why wait? Just go read the paper:

https://www.nature.com/articles/s41586-025-09526-6

In the last sentence of the abstract you will find:

"These results ... indicate a viable path to practical quantum advantage."

And in the conclusions:

"Although the random circuits used in the dynamic learning demonstration remain a toy model for Hamiltonians that are of practical relevance, the scheme is readily applicable to real physical systems."

So the press release is a little over-hyped. But this is real progress nonetheless (assuming the results actually hold up).

[UPDATE] It should be noted that this is still a very long way away from cracking RSA. That requires quantum error correction, which this work doesn't address at all. This work is in a completely different regime of quantum computing, looking for practical applications that use a quantum computer to simulate a physical quantum system faster than a classical computer can. The hardware improvements that produced progress in this area might be applicable to QEC some day, this is not direct progress towards implementing Shor's algorithm at all. So your crypto is still safe for the time being.

ransom1538• 9 months ago

SO... BTC goes to zero?

tux3• 9 months ago

Quantum advantage papers have a history of overpromising, this one looks interesting, but it would still seem wise to wait for a second opinion.

AndrewStephens2• 9 months ago

"These results ... indicate a viable path to practical quantum advantage"

I'll add this to my list of useful phrases.

Q: Hey AndrewStephens, you promised that task would be completed two days ago. Can you finish it today?

A: Results indicate a viable path to success.

toasted-subs2• 9 months ago

A consistent theme of Quantum Computing is setting up the problem to have the hardwired achieve nicely to get a good news article to get more funding.

Im pretty reluctant to make any negative comments about these kinds of posts be cause it will prevent actually achieving the desired outcome.

wnevets• 9 months ago

I'm waiting for Peter Gutmann[1] to tell me what to think about this.

[1] https://eprint.iacr.org/2025/1237

getnormality• 9 months ago

I will wait for a HN commenter to tell me what Scott Aaronson thinks about this.

thedrexster• 9 months ago

this is my approach, as well, lol

guywithahat2• 9 months ago

As with most news, I'll be waiting for Scott Adams to tell me what to think about this

amiga3862• 9 months ago

The text adventure guy, or the cartoonist who went batshit?

supernetworks_• 9 months ago

https://arxiv.org/abs/2509.07255

This paper on verifiable advantage is a lot more compelling. With Scott Aaronson and Quantinuum among other great researchers

nashashmi2• 9 months ago

Before the mega monopolies took over, corps used to partner with universities to conduct this kind of research. Now we have bloated salaries, rich corporations, and expensive research while having under experienced graduates. These costs will get forwarded to the consumer. The future won’t have a lot of things that we have come to expect.

Rover222• 9 months ago

Nihilism is to trendy right now

steego• 9 months ago

Nihilism is one response to disillusionment.

Another response is to come to terms with a possibly meaningless and Sisyphean reality and to keep pushing the boulder (that you care about) up the hill anyway.

I’m glad the poster is concerned and/or disillusioned about the hype, hyperbole and deception associated with this type of research.

It suggests he still cares.

reaperducer• 9 months ago

I don't disagree, but these days I'm happy to see any advanced research at all.

Granted, too often I see the world through HN-colored glasses, but it seems like so many technological achievements are variations on getting people addicted to something in order to show them ads.

Did Bellcore or Xerox PARC do a lot of university partnerships? I was into other things in those days.

Rebelgecko• 9 months ago

Funnily enough I remember reading a comment a week or two ago decrying the death of corporate research labs like Bell Labs and Xerox PARC

ibejoeb• 9 months ago

I don't think it's accurate to attribute some kind of altruism to these research universities. Have a look at some of those pay packages or the literal hedge funds that they operate. And they're mostly exempt from taxation.

auxiliarymoose2• 9 months ago

From the article:

in partnership with The University of California, Berkeley, we ran the Quantum Echoes algorithm on our Willow chip...

And the author affiliations in the Nature paper include:

Princeton University; UC Berkeley; University of Massachusetts, Amherst; Caltech; Harvard; UC Santa Barbara; University of Connecticut; UC Santa Barbara; MIT; UC Riverside; Dartmouth College; Max Planck Institute.

This is very much in partnership with universities and they clearly state that too.

nashashmi2• 9 months ago

Thanks. I could not find any mention of it. This is good.

chermi2• 9 months ago

Did you bother looking at the author list? This is a grand statement that's easily refuted by just looking.

Maybe you're thinking specifically of LLM labs. I agree this is happening there, but I wouldn't be as dramatic. Everywhere else, university-corporation/government lab partnerships are still going very strong.

josefritzishere2• 9 months ago

Quantum is the new AI. It's just the new hype cycle of doom.

jezzamon• 9 months ago

The barrier to entry seems a little higher than AI so it's at least a little limited in scope

josefritzishere2• 9 months ago

Negative points? Is no one else tired of hype outweighing the science?

fooker• 9 months ago

Can someone explain if this is still the RCS problem or a similar one?

My impression was that every problem a quantum computer solves in practice right now is basically reducible from 'simulate a quantum computer'

seanhunter3• 9 months ago

This is not the RCS problem or indeed anything from number theory.

The announcement is about an algorithm which they are calling Quantum Echoes, where you set up the experiment, perturb one of the qbits and observe the “echoes” through the rest of the system.

They use it to replicate a classical experiment in chemistry done using nuclear magnetic resonance imaging. They say they are able to reproduce the results of that conventional experiment and gather additional data which is unavailable via conventional means.

qnleigh6• 9 months ago

This is quite different from their previous random circuit sampling (RCS) experiments that have made headlines a few times in the past. The key difference from an applied standpoint is that the output of RCS is a random bitstring which is different every time you run the algorithm. These bitstrings are not reproducible, and also not particularly interesting, except for the fact that only a quantum computer can generate them efficiently.

The new experiment generates the same result every time you run it (after a small amount of averaging). It also involves running a much more structured circuit (as opposed to a random circuit), so all-in-all, the result is much more 'under control.'

As a cherry on top, the output has some connection to molecular spectroscopy. It still isn't that useful at this scale, but it is much more like the kind of thing you would hope to use a quantum computer for someday (and certainly more useful than generating random bitstrings).

elAhmo• 9 months ago

Definitely not a quantum expert, but I have a feeling that news like this have been happening for more than a decade, without anything usable.

terminalbraid• 9 months ago

It's what happens when companies are driven by profit rather than making accurate scientific statements that reputation is built by and further research funding is predicated on.

Hyperbolic claims like this are for shareholders who aren't qualified to judge for themselves because they're interested in future money and not actual understanding. This is what happens when you delegate science to corporations.

bobbyprograms• 9 months ago

Yeah but let’s be honest they aren’t going to be profiting off this. So maybe to help them feel they are contributing to a good cause

seydor• 9 months ago

It's great funding for physics research. I don't care if it's useless, it beats spending on politics and surveillance

ghurtado• 9 months ago

There's also the fact that the road to useful is littered with useless, because how else would you make progress?

massung• 9 months ago

I’m no expert either, so I hope one can corroborate or correct me…

My understanding though is that these steps are really the very beginning. Using a quantum computer with quantum algorithms to prove that it’s possible.

Once proven (which maybe article this is claiming?) the next step is actually creating a computer with enough qubits and entanglable pairs and low enough error rates that it can be used to solve larger problems at scale.

Because my current understanding with claims like these is that they are likely true, but in the tiny.

It’d be like saying “I have a new algorithm for factoring primes that is 10000x faster than the current best, but can only factor numbers up to 103.”

JohnHaugeland• 9 months ago

the big problem with quantum advantage is that quantum computing is inherently error-prone and stochastic, but then they compare to classical methods that are exact

let a classical computer use an error prone stochastic method and it still blows the doors off of qc

this is a false comparison

jasonthorsness3• 9 months ago

They get the same result when they run it a second time and it matches the classical result; this is their key achievement (in addition to the speed).

krastanov• 9 months ago

Stochasticity (randomness) is pervasively used in classical algorithms that one compares to. That is nothing new and has always been part of comparisons.

"Error prone" hardware is not "a stochastic resource". Error prone hardware does not provide any value to computation.

qnleigh6• 9 months ago

Yes the claims here allow the classical computer to use a random number generator.

ashleyn• 9 months ago

We're all asking it: any impact on AES?

jonathanstrange3• 9 months ago

The rule of thumb is that a working quantum computer that can run Grover's algorithm reduces the security of a symmetric cipher to half of its key size. That is, AES-128 should be considered to have a 64 bit key size, which is why it's not considered "quantum-safe."

Edit: An effective key space of 2^64 is not secure according to modern-day standards. It was secure at the times of DES.

adgjlsfhk12• 9 months ago

AES-128 is quantum safe (more or less). 64 bit security in the classical domain isn't safe because you can parallelize across 2^20 computers trivially. Grover gives you 2^64 AES operations on a quantum coputer (probably ~2^70 gates or so before error correction or ~2^90 after error correction) that can't be parallelized efficiently. AES-128 is secure for the next century (but you might as well switch to aes-256 because why not)

seanhunter3• 9 months ago

This is a chemistry experiment, so no.

dlandis• 9 months ago

Quantum computing-enhanced NMR could become a powerful tool in drug discovery, helping determine how potential medicines bind to their targets, or in materials science for characterizing the molecular structure of new materials like polymers, battery components or even the materials that comprise our quantum bits (qubits)

There is a section in the article about future real world application, but I feel like these articles about quantum "breakthroughs" are almost always deliberately packed with abstruse language. As a result I have no sense about whether these suggested real world applications are a few years away or 50+ years away. Does anyone?

jpadkins• 9 months ago

As a result I have no sense about whether these suggested real world applications are a few years away or 50+ years away. Does anyone?

not really. but that doesn't mean it's not worth striving for. Breakthrough to commercial application are notoriously hard to predict. The only way to find out is to keep pushing at the frontier.

kantbtrue• 9 months ago

“13,000× faster” sounds huge, but I wonder what it’s being compared to. Quantum speedups are always tricky to measure

jonathanstrange3• 9 months ago

The article states: “...13,000 times faster on Willow than the best classical algorithm on one of the world’s fastest supercomputers...”

I agree it's not very precise without knowing which of the world's fastest supercomputers they're talking about, but there was no need to leave out this tidbit.

jasonthorsness3• 9 months ago

The paper talks only about the Frontier supercomputer which is #2 on Top500. But I think it was an analysis rather than them actually running it.

nicce2• 9 months ago

I don’t understand how these papers get accepted

jasonthorsness3• 9 months ago

"surpassing even the fastest classical supercomputers (13,000x faster)"

"Quantum verifiability means the result can be repeated on our quantum computer — or any other of the same caliber — to get the same answer, confirming the result."

"The results on our quantum computer matched those of traditional NMR, and revealed information not usually available from NMR, which is a crucial validation of our approach."

It certainly seems like this time, there finally is a real advantage?

seanhunter3• 9 months ago

I’ve only skimmed the paper but it seems like the “information not usually available” from NMR is the Jacobian and Hessian of the Hamiltonian of the system.

So basically you’re able to go directly from running the quantum experiment to being able to simulate the dynamics of the underlying system, because the Jacobian and Hessian are the first and second partial derivatives of the system with respect to all of its parameters in matrix form.

i-con2• 9 months ago

Notice how they say "quantum advantage" not "supremacy" and "a (big) step toward real-world applications". So actually just another step as always. And I'm left to doubt if the classic algorithm used for comparison was properly optimised.

ccppurcell• 9 months ago

I skimmed the paper so might have missed something, but iiuc there is no algorithm used for comparison. They did not run some well defined algorithm on some benchmark instances, they estimated the cost of simulating the circuits "through tensor network contraction" - I quote here not to scare but because this is where my expertise runs out.

streptomycin• 9 months ago

FWIW "quantum advantage" and "quantum supremacy" are synonyms, some people just prefer the former because the latter reminds them of "white supremacy" https://en.wikipedia.org/wiki/Quantum_supremacy#Criticism_of...

i-con2• 9 months ago

Good point, I had no idea. I actually thought they just restrained themselves this time :D

kmeisthax• 9 months ago

I'll believe quantum computing exists when someone releases the factors of an RSA or DSA keypair with economic value, or at least a keypair not generated by the same people factoring it. Something like the code signing keys for Apple's boot ROM, or the root key of a well-trusted CA. It doesn't even have to be their current keys, it can be something older / shorter, as long as it's outside the time horizon of classical factoring.

aantix• 9 months ago

Is Bitcoin in jeopardy?

marginalx• 9 months ago

Finally some good news to the crypto madness!

guerrilla• 9 months ago

We can only hope.

TeeMassive• 9 months ago

The last time I heard a similar news from Google, it turned out they were solving a quantum phenomenon using a quantum phenomenon. It seems to be the same pattern here. Not to say it's not progress, but kind of feels like overhyped.

refulgentis4• 9 months ago

Idk. I get this is the median take across many comments, I don’t mean to be disagreeable with a crowd. But I don’t know why using quantum phenomena is a sign something’s off. It’s a quantum computer! But I know something is off with this take if it didn’t strike you that way.

fwip3• 9 months ago

To me, it matters because it's a sign that it might not be particularly transferable as a method of computation.

A wind tunnel is a great tool for solving aerodynamics and fluid flow problems, more efficiently than a typical computer. But we don't call it a wind-computer, because it's not a useful tool outside of that narrow domain.

The promise of quantum computing is that it can solve useful problems outside the quantum realm - like breaking traditional encryption.

tiahura• 9 months ago

Can it factor 21?

nyeah• 9 months ago

Unfairly high bar. They're not magicians.

qnleigh6• 9 months ago

Just gonna leave this here: Why haven't quantum computers factored 21 yet? https://algassert.com/post/2500

FabHK• 9 months ago

So, "verifiable" here means "we ran it twice and got the same result"?

Quantum verifiability means the result can be repeated on our quantum computer — or any other of the same caliber — to get the same answer, confirming the result.

refulgentis4• 9 months ago

Sounds like N, not 2

EvgeniyZh3• 9 months ago

It is not very clear from the text and from what I can say there is no "verifiability" concept in the papers they link.

I think what they are trying to do is to contrast these to previous quantum advantage experiments in the following sense.

The previous experiments involve sampling from some distribution, which is believed to be classically hard. However, it is a non-trivial question whether you succeed or fail in this task. Having perfect sampler from the same distribution won't allow you to easily verify the samples.

On the other hand these experiments involve measuring some observable, i.e., the output is just a number and you could compare it to the value obtained in a different way (one a different or same computer or even some analog experimental system).

Note that these observables are expectation values of the samples, but in the previous experiments since the circuits are random, all the expectation values are very close to zero and it is impossible to actually resolve them from the experiment.

Disclaimer: this is my speculation about what they mean because they didn't explain it anywhere from what I can see.

nine_k2• 9 months ago

It means that they transcended the "works on my machine" stage, and can reliably run a quantum algorithm on more than one different quantum computer.

cluckindan• 9 months ago

They haven’t, though?

jerkstate• 9 months ago

A key result here is the first demonstration of quantum supremacy; from TFA

This is the first time in history that any quantum computer has successfully run a verifiable algorithm that surpasses the ability of supercomputers.

whatever1• 9 months ago

I think I have read that before?

pred_• 9 months ago

Normally, where I come from anyway, verifiability would refer to the ability to prove to a classical skeptic that the quantum device did what it's supposed to, cf. e.g. Mahadev (https://arxiv.org/abs/1804.01082), Aaronson (https://arxiv.org/abs/2209.06930), in a strong, theoretical, sense. And that's indeed relevant in the context of proving advantage, as the earlier RCS experiments lacked that ability, so “demonstrating verifiable quantum advantage” would be quite the step forward. That doesn't appear to be what they did at all though. Indeed, the paper appears to barely touch on verifiability at all. And – unlike the press release – it doesn't claim to achieve advantage either; only to indicate “a viable path towards” it.

leoc• 9 months ago

So the Scott Aaronson Full Employment Conjecture remains unrefuted?

bossyTeacher2• 9 months ago

Afaik we are a decade or two away from quantum supremacy. All the AI monks, forget that if AI is the future, quantum supremacy is the present. And whoever controls the present, decides the future.

Rememeber, it is not about quantum general computing, it's about implementing the quantum computation of Shor's algorithm

cwmma• 9 months ago

but much like AI hype quantum hype is also way over played, yeah modern asymmetric encryption will be less secure, but even after you have quantum computers that can do Shor's algorithm it might be a while before there are quantum computers affordable enough for it to be an actual threat (i.e. it's not cheaper to just buy a zero day for the target's phone or something).

But since we already have post quantum algorithms, the end state of cheap quantum computers is just a new equilibrium where people use the new algorithms and they can't be directly cracked and it's basically the same except maybe you can decrypt historical stuff but who knows if it's worth it.

bossyTeacher2• 9 months ago

I was mostly talking about state actors buying quantum computers that are just built to run that particular algorithm and using it to snoop on poorer countries who cannot afford such tech. Plus all countries will have plenty of systems that have not been quantum proofed. The moment when it becomes affordable to a state actor until most state actors have access to such tech is likely to be a long time especially since no one will admit to possess such tech. And unlike nuclear weapons, it is much harder to prove whether or not someone has one

Lapsa• 9 months ago

but can it run Doom?

wiz21c• 9 months ago

Linux would be a start :-)

junon• 9 months ago

I wouldn't hold my breath for Linux on a quantum computer.

westurner2• 9 months ago

FWIU a 6-stage RISC processor is sufficient to run Linux.

Things like CUDA-Q may be faster on classical computers than on quantum computers for forever; though what CUDA-Q solves for is also an optimization problem?

tbabej• 9 months ago

The chip would need to be scaled couple of orders of magnitude, but in principle, it is possible :) see https://arxiv.org/abs/2412.12162

DrNosferatu• 9 months ago

I would like to hear from the classical computation people if they validate these results and claims:

As many times in the past quantum supremacy was claimed, and then, other groups have shown they can do better with optimized classical methods.

csnweb• 9 months ago

That might take a few days or weeks, it seems like they put in some decent effort into it this time. From skimming the supplement I wouldn’t be suprised if the speedup is only 100x though. That’s still significant, but clearly less than they claim. For example I am not entirely convinced that 20% flops efficiency is really the upper limit or that the slicing overhead of 5x is really needed here.

fHr• 9 months ago

Lol

sambapa• 9 months ago

I think that quantum will be the next bubble

krupan• 9 months ago

This type of announcement is definitely pumping air into it

tombert• 9 months ago

I bought a hundred shares of D-Wave about six months ago, betting on this fact.

A part of me thinks quantum computing is mostly bullshit, but I would be very happy to be wrong. I should probably learn Q# or something just to be sure.

NaomiLehman• 9 months ago

100%. I'm buying all the domain names and have already profited heavily over 9 months.

m3kw9• 9 months ago

All thats need to verify is, is it faster than classical chips? Why do they need some other methods?

andy_ppp2• 9 months ago

I would be quite worried about advances in quantum computers if I had any Bitcoin after watching this DEFCON talk: https://www.youtube.com/watch?v=OkVYJx1iLNs

IAmGraydon2• 9 months ago

Every time I mention quantum computing as a threat to crypto (which I have been for years), I get downvoted to oblivion. I guess we have a lot of HODLers here. A bet on crypto is a bet against quantum computing.

mikestorrent• 9 months ago

I haven't seen anyone post any progress on factoring large numbers with quantum computers in a while. Annealers won't do it efficiently, but probably still hold the record anyway, for a relatively small number you could do classical hardware. Gate model machines with enough qubits to do it are still ages off. Bitcoin should find a way to transition to a post-quantum algorithm, but that's about it. As long as they do it before anyone has a big enough QPU, they're fine, and nobody is even close, it seems.

tsimionescu2• 9 months ago

I haven't once even thought of investing in crypto, and think that the technology is mostly useless and proof of work schemes should be banned on environmental grounds.

Even so, I don't agree that quantum is a threat to crypto. There are already well known quantum-resistant encryption schemes being deployed live in browsers, today. Crypto can just start adopting one of these schemes today, and we're still probably decades away from a QC that can factor the kinds of primes that crypto security uses. The transition will be slightly more complex for proof of work schemes, since those typically have dedicated hardware - but other types of crypto coins can switch in months, most likely, if they decide to, at least by offering new wallet types or something.

bottlepalm• 9 months ago

Unless advances in QC could rewrite the blockchain then there's not much to worry about. If the crypto algorithms are compromised, you coins are pretty much frozen on the chain until a new algorithms are implemented. Are you're arguing QC makes signatures/verification/mining impossible?

vayup2• 9 months ago

Quantum is a known threat. There is enough time to fix it. Folks are working on the fixes.

Cryptocurrencies would be the last thing I worry about w.r.t Quantum crypto attacks. Everything would be broken. Think banks, brokerage accounts, email, text messages - everything.

acdha4• 9 months ago

I think that’s backwards: most of the stuff you mentioned is using TLS and can switch to post-quantum algorithms with a config change, and do so incrementally with no user-visible impact - e.g. right now I’m already using PQC for many sites and about half of the traffic Cloudflare sees is using PQC:

https://radar.cloudflare.com/adoption-and-usage

In contrast, cryptocurrencies have to upgrade the entire network all at once or it’s effectively a painful fork. That effort appears to just be getting talked about now, without even starting to discuss timing:

https://github.com/bitcoin/bips/pull/1895

snailmailman• 9 months ago

The world has already migrated through so many past now-insecure cryptography setups. If quantum computers start breaking things, people will transition to more secure systems.

In HTTPS for example, the server and client must agree on how to communicate, and we’ve already had to deprecate older, now-insecure cryptography standards. More options get added, and old ones will have to be deprecated. This isn’t a new thing, just maybe some cryptographic schemes will get rotated out earlier than expected.

germandiago• 9 months ago

Like everything else that is a new invention, it can be a threat.

Anyways I am against stopping evolution on those grounds. What we need to do is learn and fix as you say. Not regulation and forbid. :)

irjustin• 9 months ago

Everything would be broken. Think banks, brokerage accounts, email, text messages - everything.

Wonder if this would become the next "nuclear proliferation".

Since it's so hard to manufacture it gets controlled at state level and then becomes a technology that the general public are never allowed to have.

qnleigh6• 9 months ago

The quantum algorithm that would break certain kinds of public key cryptography schemes (not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers) will take days to weeks to break a single key [0]. This is another reason why we will have plenty of warning before quantum computing causes any major disruptions to daily life.

What I would start worrying about is the security of things like messages sent via end-to-end encrypted services like WhatsApp and Signal. Intercepted messages can be saved now and decrypted any time in the future, so it's better to switch to more robust cryptography sooner rather than later. Signal has taken steps in this direction recently: https://arstechnica.com/security/2025/10/why-signals-post-qu....

[0] https://arxiv.org/pdf/2505.15917

twothreeone2• 9 months ago

Usually, the crypto should have Forward Secrecy already even without being PQ-safe (e.g., via https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm) so in practice the attacker would need to break many successive session keys - which rotates every time a new message is sent.

dweekly• 9 months ago

Meta has been rolling out PQC: https://engineering.fb.com/2024/05/22/security/post-quantum-...

And Apple: https://security.apple.com/blog/imessage-pq3/

Cloudflare started rolling it out three years ago! https://developers.cloudflare.com/ssl/post-quantum-cryptogra...

johncolanduoni3• 9 months ago

not even the core part of Bitcoin blockchains, which are not vulnerable to quantum computers

Um, what? Shor’s algorithm can take the public key of a wallet (present on any outgoing transaction in the ledger) and produce its private key. So now you can hijack any wallet that has transferred any Bitcoin. Notably only one successful run of the algorithm is needed per wallet, so you could just pick a big one if it takes weeks.

It probably wouldn’t help you mine in practice, sure. Technically it would give you better asymptotic mining performance (via Grover’s algorithm) but almost certainly worse in practice for the foreseeable future.

hoppp2• 9 months ago

Amazing talk. Thanks for sharing

xtracto• 9 months ago

I would be more worried about everything else before Crypto... I would be worried about SSH, about blowfish (and all the dumped password databases) and TLS, and oh so many things.

josefx• 9 months ago

I feel bad about the quantum guru, elder of the quantum village. He starts of his talk by complaining that people assumed "we would have 10 to 20 years" when news about quantum computing hit. The quantum computing hype was 10 years ago. Microsofts attempt to sell people the Quantum computing cloud with Q# is already 8 years old by now. The people who said we had at least 10 years were right. Guy is in denial either about his age or how much of his life he spend trying to sell people on second hand hot air.

mjunyeopkim• 9 months ago

the quantum chip iirc only runs a subset of algorithms due to limited gates implementable on the quantum chip; is the quantum chip a universal computer?

in_a_hole• 9 months ago

This is more the case for D-Wave's machines which are specialised for quantum annealing, allowing for greater numbers of qubits. Google and most other major hardware players make chips which can implement a universal quantum gate set allowing for arbitrary quantum operations to be performed (in principle). The issue with these chips is that quantum error correction is not fully implemented yet so computations are effectively time-limited due to the build up of noise from imperfect implementation and finite-temperature effects. A big part of current punts at quantum advantage is figuring out how to squeeze every last drop out of these currently faulty devices.

twothreeone2• 9 months ago

Now factor 21.

laserbeam• 9 months ago

It’s really hard to parse both the announcement (too much hyperbola) and the article (too technical), however as I understand it, this is what quantum computing should be good at. Not at making classical algorithms faster, but at simulating quantum physics experiments. This is a good direction and I find it more plausible than “we factored numbers faster”.

This SHOULD be the main application of the tech. It’s hard to tell if it is because authors can’t do science communication, they can apparently only do sales.

kwizikle• 9 months ago

The signal's overlap reveals how a disturbance spreads across the Willow chip

On its face this suggests that the result is not deterministic except perhaps on the same Willow chip at the same temperature.

gsf_emergency_42• 9 months ago

Why use the subtext? In the peer review (pp30-31), the authors

acknowledge [that] Hamiltonian learning of an actual physical system has not been performed [and] have therefore further de-emphasized the quantum advantage claim in the revised manuscript

https://static-content.springer.com/esm/art%3A10.1038%2Fs415...

qnleigh6• 9 months ago

This excerpt misses the wider point of the paper. The paragraph immediately following the one you quote still does make claims of quantum advantage:

"Our second order OTOC circuits introduce a minimal structure while remaining sufficiently generic that circumvents this challenge by exploiting the exponential advantage provided by including time inversion in the measurement protocol, see arXiv:2407.07754."

The advantage claimed by the paper isn't about Hamiltonian learning (i.e extracting model parameters from observational data), but instead about computing the expectation value of a particular observable. They acknowledge that the advantage isn't provable (even the advantage of Shor's algorithm isn't provable), but they argue that there likely is an advantage.

johncolanduoni3• 9 months ago

Shor’s algorithm’s advantage isn’t proven, but a proof that integer factorization doesn’t admit a classical algorithm faster than O((log N)^3) could be found. The same applies for Google’s artificial problem.

XiphiasX3• 9 months ago

And Bitcoin is still 108k… why exactly?

pfortuny• 9 months ago

"demonstrates": that words is a tell-all.

XiphiasX3• 9 months ago

Genuine question - why is Bitcoin not collapsing upon this news? Surely big money that control Bitcoin have high enough IQ to extrapolate inti the future and come to decision on the inevitable implications.

janpmz• 9 months ago

The critics claim the noise collapses quantum states so quickly that it's not possible to make full use of the quantum effects. The burden of proof is on the chip makers. I think they have not convinced the critics yet.

XiphiasX3• 9 months ago

Smart money knows quantum will crack Bitcoin. Why is Bitcoin not crashing?

khaki54• 9 months ago

Because to steal bitcoin by reverse engineering a private key from a public one you need to be able to factor a very large number. Currently the highest number they have factored using only quantum computing is 21.

ghtbircshotbe• 9 months ago

They've said this so many times that I'm not even sure what they could say at this point to make me believe them.

zero_k• 9 months ago

Wait, is this another algorithm where they didn't bother even cursorily looking at the classical algorithm for even a minute, then compare it with their stuff? Last time they pulled this, it was my field, and I could only laugh. Just stop this nonsense and start doing some real work. Yeah, I know their "work" seems to be "how to extract money using buzzwords" but it's getting tiring, and I don't consider that "work".

cashsterling3• 9 months ago

Until a company can demonstrate a quantum volume of even just 2^16... their computer is just about worthless for any sort of half-real quantum computing.

I pay zero attention to any technical information and marketing speak coming from a quantum computing company until they demonstrate decent quantum volume.

Most companies computers can't even hit 2^16 so they are figuring out means of distracting the market from the poor fidelity of their systems.

godzillabrennus• 9 months ago

Until a company can demonstrate that a motor vehicle can be operated by a layperson, it's just about worthless for any sort of half-real transportation task.

I pay zero attention to any technical information and marketing speak coming from a motor vehicle company until they demonstrate decent improvements in operating their machines.

Most companies' motor vehicles have to be hand cranked and kick-started by a youthful person with good vitality who doesn't fear being run over by their motor vehicle.

-- Some guy in 1925 who worked in the horse and buggy industry...

cashsterling3• 9 months ago

The better analogy here, in my opinion, is until someone builds a car that actually drives forward...

A lot of these quantum computing papers are just loud engine rev'ing.

But you are right... "zero attention" is hyperbole... I shouldn't have said "I pay zero attention"... I should have said, "I am underwhelmed and don't give a lot of credence to systems until they demonstrate ability to perform high fidelity calculations of reasonable complexity and depth."

I do think superconducting qubits approaches will continue to improve in fidelity and ability... there are just too many brilliant people working on these challenges to count them out.

mrguyorama• 9 months ago

The Model T was produced in 1908. Normal people being able to use (though not afford) cars was normal before that.

It took only 30 years to go from Otto and Benz going "Look at this neat contraption" to "Mass produced, semi-affordable personal cars".

gamblor956• 9 months ago

The Ford Model T had been on the market for over almost 2 decades by then. Over 15 million were sold, mostly to laypeople.

In contrast, no quantum computer today actually quantum computes. They just approximate quantum computing in specific scenarios and have yet to match, let alone exceed, the performance of regular computers.

EvgeniyZh3• 9 months ago

Quantum volume is a good metric but that's kind of one-dimensional take. Almost any interesting circuit doesn't requires all-to-all connectivity and superconducting QC are bad at all-to-all connected circuit so we can have interesting NISQ experiments without particularly large QV

cashsterling3• 9 months ago

It is not a one dimensional take... it is a stress test of qubit gate fidelity [across all qubits involved in the circuit], state prep and measurement , lifetime (coherence), memory errors, etc.

Now I agree that there are other great stress tests of quantum computer systems... but most of the industry agreed that quantum volume was a great metric several years ago. As many companies systems have been unable to hit decent QV, companies have pivoted away from QV to other metrics... many of them are half baloney.

northlondoner• 9 months ago

Verification is about ergodicity that reflects very promising approach to error-correction. The concept of ergodicity is quite elegant and used in different physics domains. See recent paper regarding this, might be helpful to community to understand ergodicity.

Ergodicity detection algorithms: Scaling of ergodicity in random symbolic dynamics https://arxiv.org/abs/2508.08319

Willow quantum chip demonstrates verifiable quantum advantage on hardware

Related Stories