English
A quantum computer is a machine that exploits quantum mechanical phenomena — superposition, entanglement, and interference — to perform computations. The key insight is not that quantum computers are faster classical computers; they are qualitatively different in what operations they can perform efficiently. A classical bit is always 0 or 1; a qubit can be in a superposition of both simultaneously, a state that evolves according to linear algebra over the complex numbers until it is measured and collapses to a definite value. This distinction enables specific algorithms that have no efficient classical analog — for certain problems, quantum algorithms provide exponential or polynomial speedups that cannot be matched by any improvement in classical hardware.
The practical situation is more constrained than the theoretical promise. Current quantum computers are noisy, limited in qubit count, and subject to decoherence: the tendency of quantum states to lose their quantum character through interaction with the environment. Error rates per gate are high enough that the computation becomes unreliable before useful work is done without error correction, and fault-tolerant quantum error correction itself requires substantial qubit overhead — estimates suggest hundreds to thousands of physical qubits per logical qubit for the surface code. We are in the Noisy Intermediate-Scale Quantum (NISQ) era: machines with tens to hundreds of qubits, without full fault tolerance, capable of demonstrating quantum phenomena but not yet of running the algorithms (like Shor’s) that would be practically transformative.
Understanding quantum computing is relevant for practitioners across several concerns. The security implications are concrete and imminent in planning terms: Shor’s algorithm, once a fault-tolerant quantum computer exists at sufficient scale, breaks RSA and elliptic-curve cryptography. Post-quantum cryptography (§4.5) is the engineering response, currently in deployment. The algorithmic potential matters for practitioners in simulation, optimization, and machine learning who may interact with quantum computing platforms as they mature. And quantum complexity theory — BQP, QMA, and their relationships to classical complexity classes — is an active frontier of theoretical computer science (§3.3) with bearing on the foundations of computation.
Prerequisites: Linear algebra (§2.3) — quantum states are vectors in complex Hilbert spaces; quantum gates are unitary matrices. Probability and statistics (§2.5) — measurement produces probabilistic outcomes. Complexity theory (§3.3) — quantum complexity classes and their relationships to P and NP.
From Simulating Physics to Breaking Cryptography
Quantum computing was not invented by computer scientists pursuing faster computation; it was proposed by physicists frustrated by the computational expense of simulating quantum mechanics.
Richard Feynman observed in a 1981 talk at MIT — later published as “Simulating Physics with Computers” — that simulating a quantum system on a classical computer required exponential resources in the number of particles. Quantum mechanics is inherently exponential: the state space of n two-level quantum systems has dimension 2ⁿ, and classical simulation must track all 2ⁿ amplitudes. Feynman’s proposal was elegant: build a computer that itself operates quantum mechanically, so that it can simulate quantum systems without the exponential overhead. This is the origin of quantum simulation — still one of the most compelling near-term applications, with implications for drug discovery, materials science, and high-energy physics.
David Deutsch, at Oxford, formalized the quantum computer as a computational model in 1985. His paper “Quantum Theory, the Church-Turing Principle and the Universal Quantum Computer” defined the quantum Turing machine and proved a quantum analog of the Church-Turing thesis. He also designed the first quantum algorithm — the Deutsch algorithm — that solved a specific problem exponentially faster than any classical algorithm, though the problem was contrived. The Deutsch-Jozsa algorithm extended this to a more natural problem: determining whether a function is constant or balanced. These early algorithms proved the concept — quantum computation could be exponentially faster than classical computation on at least some problems — but the problems were artificial and the advantage was not yet compelling.
The field changed completely with Peter Shor’s 1994 algorithm for integer factorization. Shor showed that a quantum computer could factor an integer N in polynomial time — specifically, in time O((log N)³) — while the best known classical algorithm (the general number field sieve) requires sub-exponential time Ο(exp((log N)^(1/3) (log log N)^(2/3))). Since RSA encryption depends on the computational hardness of factoring large integers, Shor’s algorithm meant that a sufficiently powerful quantum computer would break the most widely deployed public-key cryptography in the world. This was not merely a theoretical result: it established quantum computing as a national security concern and a driver of cryptographic research. The NSA began urging agencies to plan for post-quantum cryptography; NIST started the post-quantum standardization process that concluded in 2024.
Lov Grover’s 1996 algorithm provided a different kind of quantum speedup: searching an unstructured database of N items requires O(N) operations classically but only O(√N) quantum operations. This quadratic speedup is much smaller than Shor’s exponential speedup, but it applies to a broad class of problems where any classical algorithm must essentially enumerate possibilities. Grover’s algorithm is asymptotically optimal — no quantum algorithm can do better than Ω(√N) for unstructured search — and its implications for symmetric cryptography are that key lengths should be doubled relative to quantum-resistant targets (AES-128 offers only 64-bit security against a quantum computer with Grover’s algorithm; AES-256 offers 128-bit security).
The theory of quantum error correction, developed through the late 1990s by Shor, Steane, Calderbank, and others, established that fault-tolerant quantum computation was in principle possible. The key insight — counterintuitive but true — is that quantum errors can be corrected without measuring the quantum state directly, by encoding logical qubits in entangled states of multiple physical qubits and measuring only error syndromes that reveal which errors occurred without revealing the state itself. The threshold theorem proved that if the physical error rate per gate is below a threshold (roughly 10⁻³ for current leading codes), arbitrarily long computations can be made arbitrarily reliable by adding more physical qubits for error correction. This transformed quantum computing from a physically implausible fantasy into an engineering challenge with a defined difficulty: get gate error rates below the threshold, and scale up.
The engineering progress since the 2000s has been rapid and concentrated in two main hardware approaches. Superconducting qubits, pursued primarily by IBM, Google, and Rigetti, use Josephson junctions operating at millikelvin temperatures to create two-level quantum systems with coherence times of tens to hundreds of microseconds and gate fidelities approaching 99.9%. Trapped-ion qubits, pursued by IonQ, Quantinuum, and academic groups, use individual atomic ions held in electromagnetic traps, with naturally high gate fidelities (99.9%+) but slower gate speeds. IBM’s quantum volume metric — measuring the effective capacity of a quantum computer accounting for qubit count, connectivity, and gate fidelity — has roughly doubled annually since 2017. Google’s 2019 claim of “quantum supremacy” — that its Sycamore processor performed a specific sampling task in 200 seconds that would require 10,000 years on the best classical supercomputer — sparked controversy: IBM disputed the classical runtime estimate and later classical algorithms reduced the estimated classical cost substantially. The claim illustrated both genuine progress and the difficulty of establishing meaningful benchmarks for quantum advantage.
The current NISQ era is characterized by real quantum hardware that is genuinely useful for some purposes and genuinely not useful for others. Quantum simulation of chemistry has shown promising results: IBM, Google, and academic groups have computed ground-state energies of small molecules with accuracy competitive with classical methods, though not yet at the scale of classically intractable chemistry. Variational quantum algorithms — where a quantum circuit with trainable parameters is optimized classically — have been proposed for optimization and machine learning, but results on real hardware have been disappointing: noise limits the achievable depth of circuits, and the advantage over classical heuristics has not materialized for practically sized problems. The most honest assessment: quantum computers have definitively demonstrated the ability to perform specific quantum computations that classical computers would have genuine difficulty matching, but no application has yet shown unambiguous practical advantage for a useful problem.
The post-quantum cryptography transition is the near-term impact that is already shaping engineering decisions. NIST finalized the first post-quantum standards in 2024: ML-KEM, derived from CRYSTALS-Kyber, for key encapsulation, and ML-DSA, derived from CRYSTALS-Dilithium, for signatures, both based on lattice problems. Organizations with long-lived sensitive data — those encrypting information that must remain secret for more than a decade — face the “harvest now, decrypt later” threat: adversaries may be collecting encrypted traffic today to decrypt when a capable quantum computer exists. Planning for post-quantum migration is a present engineering task regardless of when fault-tolerant quantum computers arrive.
Qubits, Gates, and Algorithms
The Quantum State and Its Manipulation
| A qubit is a quantum two-level system whose state is a unit vector in a two-dimensional complex Hilbert space. The computational basis states | 0⟩ and | 1⟩ are the analogs of classical bit values 0 and 1; a general qubit state is α | 0⟩ + β | 1⟩ where α, β ∈ ℂ and | α | ² + | β | ² = 1. The amplitudes α and β have no classical analog: they can be complex numbers, and their magnitudes squared give the probabilities of measuring 0 or 1. Until measured, the qubit genuinely has no definite value; it is in superposition. |
An n-qubit system has a state space of dimension 2ⁿ, describable as a unit vector in ℂ^{2ⁿ}. For n = 50 qubits, this is a vector with 2^50 ≈ 10^15 complex amplitudes — impossible to store explicitly on a classical computer. This exponential state space is the resource that quantum algorithms exploit.
| Quantum gates are unitary transformations on the state space. Single-qubit gates include the Hadamard gate H (which maps | 0⟩ to ( | 0⟩ + | 1⟩)/√2, creating superposition), the Pauli gates X (bit flip), Y, Z, and the phase gate T. The CNOT (controlled-NOT) gate is the canonical two-qubit gate: it flips the second qubit if and only if the first is | 1⟩. The Hadamard gate applied to each of n qubits in the | 0⟩ state produces a uniform superposition over all 2ⁿ computational basis states — a starting point for many algorithms. |
| Entanglement, the distinctively quantum correlation between qubits, is created by two-qubit gates. The Bell state ( | 00⟩ + | 11⟩)/√2 — produced by applying H to one qubit and then CNOT — has no factored representation as a product of individual qubit states: the two qubits are entangled, and measuring one instantly determines the state of the other regardless of the distance between them (though this cannot be used to transmit information superluminally). Entanglement is an essential resource for quantum algorithms: without entanglement, quantum circuits are classically simulable in polynomial time. |
Interference is the third quantum phenomenon that algorithms exploit. Because amplitudes are complex numbers that add algebraically, quantum computation can amplify the amplitudes of correct answers and cancel the amplitudes of incorrect answers through carefully designed interference. Shor’s algorithm, Grover’s algorithm, and quantum phase estimation all work by constructing circuits where the desired answer has large amplitude through constructive interference, and wrong answers cancel through destructive interference. The circuit design task is, in effect, choreographing interference to extract useful information.
Key Quantum Algorithms
Shor’s algorithm for integer factorization uses quantum phase estimation to compute the order of an element modulo N — the smallest r such that aʳ ≡ 1 (mod N) for randomly chosen a. The quantum Fourier transform, which computes the discrete Fourier transform in O(n²) gate operations rather than the classical O(n·2ⁿ), is the key subroutine. Once the order r is known, classical number theory efficiently computes factors of N from r. The circuit requires O((log N)³) gates, and the number of qubits scales as O(log N). For N = 2048-bit RSA, this is roughly 4000 logical qubits and a few billion gates — beyond any current hardware, but within reach of a fault-tolerant quantum computer of the scale that appears achievable.
Grover’s algorithm for unstructured search achieves its √N speedup through the Grover iteration: a reflection about the target state composed with a reflection about the equal superposition state. Repeated O(√N) times, this amplifies the target amplitude to near certainty. The algorithm is conceptually simple but broadly applicable: any problem where solution verification is efficient can be searched with a quadratic speedup.
Quantum simulation — the original motivation for quantum computing — uses a quantum computer to evolve the Schrödinger equation of a quantum system that would be exponentially expensive to simulate classically. The Variational Quantum Eigensolver (VQE) estimates ground-state energies of molecular Hamiltonians using a hybrid classical-quantum loop: prepare a parameterized quantum state, measure its energy expectation value on the quantum computer, update parameters classically. This NISQ-era approach can run on current hardware but has limited depth; whether it achieves practical advantage over classical methods for chemistry at relevant molecular scales remains undemonstrated.
Quantum machine learning algorithms — quantum principal component analysis (qPCA), quantum support vector machines (qSVM), HHL for linear systems — were proposed with claims of exponential speedup over classical algorithms. Subsequent analysis by Ewin Tang and others showed that dequantization — classical algorithms using quantum-inspired sampling techniques — could match or approach many of these speedups. The quantum ML advantage, if it exists, is more limited than initially claimed and requires specific structural properties of the input data.
Physical Implementations and Their Challenges
Superconducting qubits achieve quantum behavior by cooling Josephson junctions to millikelvin temperatures, far below the 1.2K superconducting transition temperature of aluminum. At these temperatures, the circuit behaves as a quantum two-level system. Gate operations are applied with microwave pulses of specific frequency and duration. The main limitations are coherence time (how long the qubit maintains quantum behavior, currently tens to hundreds of microseconds) and gate error rate (currently 0.1–1% per two-qubit gate). The dilution refrigerators required for cooling are large, expensive, and complicated; scaling to thousands of qubits while maintaining cryogenic temperature and microwave control infrastructure is a significant engineering challenge.
Trapped-ion qubits use electromagnetic traps to confine individual ions. Gate operations are applied with laser pulses that couple internal electronic states. The advantage is naturally high fidelity (gate errors of 0.01% or less in some demonstrations) and long coherence times. The disadvantage is slow gate speed (microseconds rather than nanoseconds) and difficulty scaling to large numbers of ions while maintaining the necessary optical access and connectivity.
Photonic quantum computers use photons as qubits, with linear optical elements implementing gates. The advantage is room-temperature operation and natural suitability for quantum communication. The disadvantage is the inherent probabilistic character of photon-photon interactions: most two-qubit gates succeed only probabilistically, requiring complex adaptive protocols. Measurement-based and fusion-based approaches are being developed by PsiQuantum and others.
Error correction overhead is the critical unknown. The surface code, the leading practical quantum error correction code, requires approximately 1000 physical qubits per logical qubit for reasonable logical error rates, assuming physical error rates of around 0.1%. Running Shor’s algorithm on 2048-bit RSA at fault-tolerant scale would require millions of physical qubits and likely decades of quantum operation. Current roadmaps from IBM and Google project hundreds to thousands of physical qubits by the late 2020s; the bridge to millions of fault-tolerant qubits is the central challenge.
What Studying This Changes
Quantum computing changes how practitioners understand the landscape of computation and its near-future security implications.
The first change is the ability to make calibrated assessments of quantum claims. The field has produced both genuine breakthroughs (Shor’s algorithm, quantum error correction, demonstrations of quantum advantage on specific tasks) and overstated claims (exponential speedups for machine learning, imminent practical advantage). The practitioner who has studied the fundamentals can distinguish them: understanding which algorithms have proven speedups for which problems, what the NISQ era can and cannot do, and what fault-tolerant quantum computers would actually require makes quantum hype more readable.
The second change is awareness of the cryptographic urgency. Shor’s algorithm is not hypothetical — it is a proven algorithm that would break RSA and elliptic-curve cryptography on a fault-tolerant quantum computer. The post-quantum migration is not a future concern; it is a present engineering task for any organization managing long-lived sensitive data. Understanding why the threat is real — the algorithm, the current hardware trajectory, the “harvest now, decrypt later” attack — motivates action that abstract statements about “quantum risk” do not.
The third change is access to quantum complexity theory. BQP (bounded-error quantum polynomial time) is the class of problems solvable efficiently on a quantum computer; it contains factoring but is believed not to contain NP-complete problems. The relationship BQP ⊆ PSPACE suggests quantum computers cannot solve exponentially hard problems in general, only specific ones. QMA (quantum Merlin-Arthur, the quantum analog of NP) contains the local Hamiltonian problem and other physically significant problems. These complexity classes situate quantum computing in the broader complexity landscape of §3.3.
The fourth change is preparation for quantum simulation opportunities. Quantum chemistry and materials simulation are the most compelling near-term applications, and they matter for drug discovery, battery design, and catalyst development. Practitioners in computational chemistry, materials science, and adjacent fields who understand how quantum simulation works and what quantum hardware can currently do are better positioned to use quantum resources as they become available and to evaluate the literature’s often overconfident claims.
Resources
Books and Texts
Nielsen and Chuang’s Quantum Computation and Quantum Information (Cambridge, 2000) is the canonical text. It develops quantum mechanics, linear algebra, quantum circuits, the major algorithms (Deutsch-Jozsa, Simon’s, Shor’s, Grover’s), quantum error correction, and quantum information theory with unusual mathematical care. Despite being over two decades old, it remains the essential reference — the field’s fundamental algorithms have not changed, and the mathematical framework is permanent. It is demanding and thorough; most practitioners use it as a reference rather than reading it cover to cover.
Mermin’s Quantum Computer Science: An Introduction (Cambridge, 2007) is more accessible than Nielsen-Chuang, written specifically for computer scientists who want to understand quantum computing without a physics background. Its development of quantum mechanics from the linear-algebraic foundations that CS students already have makes it the right starting point for most CS practitioners.
Bernhardt’s Quantum Computing: An Applied Approach (2nd ed., Springer, 2021) provides an up-to-date practical introduction that covers both the theory and the current hardware landscape, including programming quantum computers with Qiskit. It is the most practically oriented of the major texts.
Preskill’s lecture notes on quantum computation (free at <www.theory.caltech.edu/~preskill/ph229>) are the most comprehensive freely available treatment at graduate depth, covering quantum error correction and fault tolerance in more detail than any published book.
Aaronson’s Quantum Computing Since Democritus (Cambridge, 2013) is heterodox but essential: a broad intellectual treatment connecting quantum computing to computational complexity, philosophy of science, and the foundations of physics. It is the book that most effectively conveys why quantum computing matters in the broader intellectual landscape of computer science and science.
| Book | Role | Type |
|---|---|---|
| Nielsen & Chuang, Quantum Computation and Quantum Information | Canonical comprehensive reference | Reference |
| Mermin, Quantum Computer Science: An Introduction | CS-oriented accessible entry | Entry |
| Bernhardt, Quantum Computing: An Applied Approach (2nd ed.) | Practical contemporary introduction | Entry |
| Preskill, lecture notes (free) | Graduate-depth treatment; error correction | Depth |
| Aaronson, Quantum Computing Since Democritus | Conceptual and complexity context | Depth |
Courses and Lectures
MIT 8.370/18.435 (Quantum Computing, free on MIT OCW and edX) is the standard academic course, using Nielsen-Chuang and covering the foundations through the major algorithms and quantum error correction.
Preskill’s Quantum Computation course (Caltech Ph 219, lecture notes and videos free) provides the most rigorous freely available treatment of quantum error correction and fault tolerance.
IBM Quantum Learning (free at learning.quantum.ibm.com) provides structured practical education on quantum computing with Qiskit, ranging from introductory to advanced. The combination of educational content and free access to real quantum hardware makes it the most practical entry point for hands-on quantum computing.
Scott Aaronson’s quantum complexity course (materials at scottaaronson.com) covers quantum complexity theory at depth, including BQP, QMA, and the landscape of quantum versus classical computational problems.
| Course | Platform | Type |
|---|---|---|
| MIT 8.370/18.435 Quantum Computing (free) | MIT OCW / edX | Entry |
| Preskill Ph 219 Quantum Computation (free) | theory.caltech.edu | Depth |
| IBM Quantum Learning (free) | learning.quantum.ibm.com | Practice |
| Aaronson quantum complexity course (free) | scottaaronson.com | Depth |
Practice, Tools, and Current Sources
Qiskit (IBM, free, qiskit.org) is the most widely used quantum programming framework. It provides a Python API for building and running quantum circuits, a simulator for development, and access to IBM’s real quantum hardware through the IBM Quantum platform. Working through Qiskit’s textbook (quantum.ibm.com/textbook, free) — implementing Grover’s algorithm, quantum teleportation, and a small instance of Shor’s algorithm — provides the most direct engagement with quantum algorithms on real hardware.
Cirq (Google, free, github.com/quantumlib/Cirq) is Google’s quantum programming framework, with access to Google’s quantum hardware through the Cloud. It provides fine-grained control over circuit construction that Qiskit abstracts.
PennyLane (Xanadu, free, pennylane.ai) is the leading framework for variational quantum algorithms and quantum machine learning, with differentiable quantum computing capabilities that allow optimization of quantum circuit parameters using gradient methods.
Quirk (free, algassert.com/quirk) is a browser-based quantum circuit simulator with visual representation of quantum states. Working through a few quantum algorithms in Quirk — seeing the superposition and interference graphically — builds intuition that mathematical description alone does not.
The quantum error correction zoo (errorcorrectionzoo.org, free) is a comprehensive catalog of quantum error-correcting codes with their properties and relationships. It is the reference for understanding the space of error correction approaches beyond the surface code.
| Resource | Platform | Type |
|---|---|---|
| Qiskit + IBM Quantum (free) | qiskit.org | Practice |
| IBM Quantum Learning / legacy Qiskit Textbook archive (free) | learning.quantum.ibm.com / GitHub archive | Practice |
| PennyLane (free) | pennylane.ai | Practice |
| Microsoft Quantum Katas (free) | quantum.microsoft.com / GitHub | Practice |
| PennyLane Codebook (free) | pennylane.ai/codebook | Practice |
| Quantum Country (free) | quantum.country | Auxiliary |
| Quirk circuit simulator (free) | algassert.com/quirk | Practice |
| Cirq (free) | github.com/quantumlib/Cirq | Practice |
| QuTiP (free) | qutip.org | Practice |
| Error Correction Zoo (free) | errorcorrectionzoo.org | Reference |
Traps
| Trap | Why it misleads | Better response |
|---|---|---|
| Confusing quantum superposition with parallel computation | The common description of quantum computing as “computing all possibilities simultaneously” implies that a quantum computer simply runs 2ⁿ classical computations at once and reads off the right answer. This is wrong: measurement collapses the superposition to a single outcome, and without interference-based amplification of the correct answer, measuring gives a random answer. Quantum algorithms must carefully engineer interference so the right answer has large amplitude. | Study Grover’s algorithm at the algorithmic level to understand how interference works: each Grover iteration reflects about the target state and the uniform superposition, amplifying the target. Without this interference structure, there is no speedup. The phrase “superposition enables computing all answers at once” is the misunderstanding to correct. |
| Overstating near-term quantum advantage | Variational quantum algorithms were proposed with enthusiasm for chemistry, optimization, and machine learning, but results on actual NISQ hardware have consistently shown that noise limits circuit depth too severely for useful computation on problems of practical scale. The “quantum advantage” claims for NISQ applications have largely not been experimentally validated for problems that classical computers cannot solve. | Assess quantum advantage claims by asking: has the speedup been demonstrated on real hardware for a problem of practical scale? What is the comparison against the best classical algorithm (not a naive one)? Has dequantization been ruled out? For most near-term quantum ML claims, the answer to these questions suggests modest or zero advantage. |
| Dismissing the cryptographic urgency because fault-tolerant quantum computers don’t exist yet | “We don’t have fault-tolerant quantum computers yet, so the cryptographic threat is not real” is the most consequential error. The harvest-now-decrypt-later attack is real today: adversaries collecting encrypted data now can store it until a capable quantum computer exists. For data that must remain secure for more than a decade, post-quantum migration is already necessary, regardless of quantum hardware timelines. | Assess which data under your management must remain secure for ten or more years. For that data, evaluate your current cryptographic posture against NIST’s post-quantum standards (ML-KEM and ML-DSA, derived from CRYSTALS-Kyber and CRYSTALS-Dilithium) and plan migration. The technical community’s timeline estimates for fault-tolerant quantum computers range from 10 to 30 years; that range is not long enough to defer planning. |
| Treating quantum computing as a software problem | The most significant limitations of current quantum hardware are physical: decoherence times, gate error rates, qubit connectivity, the engineering of cryogenic systems at scale. Software improvements — better circuit compilation, error mitigation, variational ansatz design — help at the margin but cannot overcome hardware limitations. The path to fault-tolerant quantum computing runs primarily through hardware progress. | Understand the hardware landscape alongside the algorithms. The difference between superconducting and trapped-ion approaches, the meaning of T1 and T2 coherence times, the significance of gate fidelity and qubit connectivity — these physical properties determine what algorithms can run and how large a system can be before noise dominates. Hardware literacy is part of quantum computing literacy. |
| Skipping quantum error correction as too advanced | Quantum error correction is not an advanced topic to learn after everything else; it is the central engineering challenge that determines whether the theoretically promised quantum speedups are achievable at practical scale. Without fault tolerance, quantum computers cannot run Shor’s algorithm at useful scale, cannot run more than shallow circuits, and are limited to NISQ applications. Understanding why error correction is hard, and what the surface code provides, is essential context for any assessment of quantum computing timelines and applications. | Study quantum error correction alongside the algorithms, not after. The three-qubit bit-flip code, the Shor code, and the surface code require only the linear algebra from §2.3 and probability from §2.5. Understanding the threshold theorem — that below a critical physical error rate, arbitrarily long computations are possible — and understanding what current hardware’s error rates imply for when fault-tolerant computation is achievable, is the quantitative foundation for informed assessment. |
中文
量子计算机是一种利用量子力学现象——叠加、纠缠和干涉——来执行计算的机器。关键洞见并不是量子计算机是更快的经典计算机；而是它们在能够高效执行的操作上具有质的不同。经典 bit 永远是 0 或 1；qubit 则可以同时处于二者的叠加态中，这个状态会按照复数线性代数演化，直到被测量并坍缩为一个确定值。正是这种区别，使一些没有高效经典对应物的算法成为可能——对于某些问题，量子算法提供了指数级或多项式级加速，而这些加速无法通过改进经典硬件来匹配。
实践状况比理论承诺更受限制。当前量子计算机有噪声，qubit 数量有限，并且受到退相干影响：量子态会因为与环境相互作用而失去量子特性。每个 gate 的错误率足够高，如果没有纠错，计算会在完成有用工作之前变得不可靠；而容错量子纠错本身又需要巨大的 qubit 开销——估计表明，对于 surface code，一个 logical qubit 可能需要数百到数千个 physical qubits。我们正处于 Noisy Intermediate-Scale Quantum（NISQ）时代：机器拥有数十到数百个 qubits，没有完整容错能力，可以展示量子现象，但还不能运行 Shor 算法这类会带来实际变革的算法。
理解量子计算，对多个方向的实践者都有关。安全影响在规划意义上已经具体且迫近：一旦足够规模的容错量子计算机出现，Shor 算法就会破解 RSA 和椭圆曲线密码学。后量子密码学（§4.5）是工程回应，目前正在部署中。算法潜力对仿真、优化和机器学习方向的实践者也重要，因为随着量子计算平台成熟，他们可能会与这些平台交互。量子复杂性理论——BQP、QMA 及其与经典复杂性类之间的关系——则是理论计算机科学（§3.3）的活跃前沿，并且关涉计算基础。
前置知识：线性代数（§2.3）——量子态是复 Hilbert 空间中的向量；量子 gates 是酉矩阵。概率与统计（§2.5）——测量会产生概率性结果。复杂性理论（§3.3）——量子复杂性类及其与 P 和 NP 的关系。
从模拟物理到破解密码学
量子计算并不是由追求更快计算的计算机科学家发明的；它是由一群对模拟量子力学所需计算成本感到挫败的物理学家提出的。
Richard Feynman 在 1981 年 MIT 的一场演讲中观察到——这场演讲后来以 “Simulating Physics with Computers” 之名发表——在经典计算机上模拟一个量子系统，需要的资源会随着粒子数量呈指数增长。量子力学本质上是指数性的：n 个二能级量子系统的状态空间维度是 2ⁿ，而经典模拟必须追踪全部 2ⁿ 个振幅。Feynman 的提议很优雅：建造一台本身按照量子力学运行的计算机，使它能够在没有指数开销的情况下模拟量子系统。这就是量子仿真的起源——它至今仍是最有说服力的近中期应用之一，并且对药物发现、材料科学和高能物理都有影响。
Oxford 的 David Deutsch 于 1985 年把量子计算机形式化为一种计算模型。他的论文 “Quantum Theory, the Church-Turing Principle and the Universal Quantum Computer” 定义了量子 Turing 机，并证明了 Church-Turing thesis 的量子类比。他还设计了第一个量子算法——Deutsch 算法——它可以比任何经典算法以指数级速度更快地解决一个特定问题，尽管这个问题是人为构造的。Deutsch-Jozsa 算法把这一思想扩展到一个更自然的问题：判断一个函数是常数函数还是平衡函数。这些早期算法证明了概念——量子计算在至少某些问题上可以比经典计算指数级更快——但问题本身仍然偏人工化，其优势还不够有说服力。
Peter Shor 于 1994 年提出整数分解算法后，这个领域彻底改变。Shor 表明，量子计算机可以在多项式时间内分解整数 N——具体来说，是 O((log N)³) 时间——而已知最佳经典算法（general number field sieve）需要亚指数时间 Ο(exp((log N)^(1/3) (log log N)^(2/3)))。由于 RSA 加密依赖于大整数分解的计算困难性，Shor 算法意味着，一台足够强大的量子计算机会破解世界上部署最广泛的公钥密码学。这不仅是理论结果：它使量子计算成为国家安全关切，并推动了密码学研究。NSA 开始敦促各机构规划后量子密码学；NIST 启动了后量子标准化流程，并于 2024 年完成。
Lov Grover 于 1996 年的算法提供了另一种量子加速：在 N 个项目的非结构化数据库中搜索，经典计算需要 O(N) 次操作，而量子计算只需要 O(√N) 次操作。这种二次加速远小于 Shor 的指数加速，但它适用于一大类经典算法基本只能枚举可能性的题目。Grover 算法在渐近意义上是最优的——对于非结构化搜索，没有任何量子算法能优于 Ω(√N)。它对对称密码学的影响是：相对于抗量子目标，密钥长度应当加倍（面对使用 Grover 算法的量子计算机，AES-128 只提供 64 bit 安全性；AES-256 则提供 128 bit 安全性）。
量子纠错理论由 Shor、Steane、Calderbank 等人在 1990 年代后期发展出来，它确立了容错量子计算原则上是可能的。关键洞见反直觉但真实：量子错误可以在不直接测量量子态的情况下被纠正，方法是把 logical qubits 编码到多个 physical qubits 的纠缠态中，并只测量 error syndromes，从而揭示发生了哪些错误，而不揭示状态本身。阈值定理证明，如果每个 gate 的物理错误率低于某个阈值（对于当前主流代码，大约是 10⁻³），那么通过增加用于纠错的 physical qubits，任意长的计算都可以被做得任意可靠。这把量子计算从一个物理上不可信的幻想，转化成了一个具有明确难度的工程挑战：把 gate 错误率降到阈值以下，然后扩展规模。
自 2000 年代以来的工程进展迅速，并集中在两类主要硬件路线。超导 qubits 主要由 IBM、Google 和 Rigetti 推进，它们使用在毫开尔文温度下工作的 Josephson junctions 来构造二能级量子系统，其 coherence times 达到数十到数百微秒，gate fidelities 接近 99.9%。囚禁离子 qubits 由 IonQ、Quantinuum 和学术团队推进，它们使用电磁陷阱中的单个原子离子，天然具有很高 gate fidelities（99.9%+），但 gate 速度较慢。IBM 的 quantum volume 指标——综合 qubit 数量、连接性和 gate fidelity 来衡量量子计算机有效容量——自 2017 年以来大约每年翻倍。Google 2019 年关于 “quantum supremacy” 的主张——其 Sycamore 处理器在 200 秒内完成一个特定采样任务，而最好的经典超级计算机需要 10,000 年——引发了争议：IBM 质疑其经典运行时间估计，后来的经典算法也大幅降低了估计的经典成本。这一主张同时展示了真实进展，也展示了为量子优势建立有意义 benchmark 的困难。
当前 NISQ 时代的特征是：真实量子硬件对某些用途确实有用，对另一些用途也确实还没有用。化学中的量子仿真已经展示出有前景的结果：IBM、Google 和学术团队已经计算出小分子的基态能量，准确性可与经典方法竞争，尽管还没有达到经典不可处理的化学规模。变分量子算法——其中带可训练参数的量子电路由经典优化器优化——已经被提议用于优化和机器学习，但在真实硬件上的结果令人失望：噪声限制了电路可达到的深度，而相对于经典启发式方法的优势还没有在实际规模问题上出现。最诚实的评估是：量子计算机已经明确展示出能够执行某些经典计算机确实难以匹配的量子计算，但还没有任何应用在有用问题上展现出无歧义的实际优势。
后量子密码学迁移，是已经在塑造工程决策的近中期影响。NIST 于 2024 年最终确定了第一批后量子标准：ML-KEM，源自 CRYSTALS-Kyber，用于密钥封装；ML-DSA，源自 CRYSTALS-Dilithium，用于签名；二者都基于格问题。拥有长期敏感数据的组织——那些加密的信息必须在十年以上保持机密——面临 “harvest now, decrypt later” 威胁：攻击者可能今天就收集加密流量，等到有能力的量子计算机出现时再解密。不管容错量子计算机何时到来，规划后量子迁移都是当前的工程任务。
Qubits、Gates 与算法
量子态及其操作
| 一个 qubit 是一个量子二能级系统，其状态是二维复 Hilbert 空间中的单位向量。计算基态 | 0⟩ 和 | 1⟩ 类似于经典 bit 值 0 和 1；一般 qubit 状态是 α | 0⟩ + β | 1⟩，其中 α, β ∈ ℂ 且 | α | ² + | β | ² = 1。振幅 α 和 β 没有经典对应物：它们可以是复数，其模平方给出测量为 0 或 1 的概率。在被测量之前，qubit 确实没有确定值；它处于叠加态。 |
一个 n-qubit 系统的状态空间维度是 2ⁿ，可以被描述为 ℂ^{2ⁿ} 中的单位向量。对于 n = 50 个 qubits，这是一个拥有 2^50 ≈ 10^15 个复振幅的向量——不可能在经典计算机上显式存储。这个指数级状态空间，就是量子算法利用的资源。
| 量子 gates 是作用于状态空间的酉变换。单 qubit gates 包括 Hadamard gate H（把 | 0⟩ 映射到 ( | 0⟩ + | 1⟩)/√2，从而创造叠加）、Pauli gates X（bit flip）、Y、Z，以及 phase gate T。CNOT（controlled-NOT）gate 是典型的双 qubit gate：当且仅当第一个 qubit 是 | 1⟩ 时，翻转第二个 qubit。对处于 | 0⟩ 状态的 n 个 qubits 分别应用 Hadamard gate，会产生所有 2ⁿ 个计算基态的均匀叠加——这是许多算法的起点。 |
| 纠缠是 qubits 之间具有鲜明量子特征的关联，由双 qubit gates 创造。Bell 态 ( | 00⟩ + | 11⟩)/√2——通过先对一个 qubit 应用 H，再应用 CNOT 产生——无法分解为单个 qubit 状态的乘积：两个 qubits 处于纠缠态，测量其中一个会立刻决定另一个的状态，而不论二者相距多远（尽管这不能用于超光速传递信息）。纠缠是量子算法的必要资源：没有纠缠，量子电路可以在多项式时间内被经典模拟。 |
干涉是算法利用的第三种量子现象。由于振幅是复数，并会按代数方式相加，量子计算可以通过精心设计的干涉，放大正确答案的振幅，并抵消错误答案的振幅。Shor 算法、Grover 算法和 quantum phase estimation 都通过构造这样的电路工作：目标答案通过相长干涉获得大振幅，错误答案通过相消干涉被抵消。电路设计任务，实质上就是编排干涉，以提取有用信息。
关键量子算法
Shor 的整数分解算法使用 quantum phase estimation 来计算模 N 下某个元素的阶——也就是对随机选择的 a，找到满足 aʳ ≡ 1 (mod N) 的最小 r。量子 Fourier 变换是关键子程序，它可以用 O(n²) gate operations 计算离散 Fourier 变换，而经典版本需要 O(n·2ⁿ)。一旦阶 r 已知，经典数论可以从 r 中高效计算 N 的因子。该电路需要 O((log N)³) gates，qubit 数量按 O(log N) 缩放。对于 2048-bit RSA，这大约需要 4000 个 logical qubits 和几十亿个 gates——超出现有硬件能力，但在看起来可实现规模的容错量子计算机范围内。
Grover 的非结构化搜索算法，通过 Grover iteration 获得 √N 加速：这个迭代由一次关于目标状态的反射和一次关于均匀叠加状态的反射组成。重复 O(√N) 次后，它会把目标振幅放大到接近确定。该算法概念上简单，但应用范围广：任何可以高效验证解的问题，都可以通过这种方式获得二次搜索加速。
量子仿真——量子计算的原始动机——使用量子计算机演化一个量子系统的 Schrödinger 方程，而这在经典计算机上会呈指数级昂贵。Variational Quantum Eigensolver（VQE）使用混合经典—量子循环来估计分子 Hamiltonian 的基态能量：在量子计算机上制备一个参数化量子态，测量其能量期望值，再用经典方法更新参数。这种 NISQ 时代方法可以在当前硬件上运行，但电路深度有限；它是否能在相关分子尺度的化学问题上相对于经典方法获得实际优势，目前仍未被证明。
量子机器学习算法——quantum principal component analysis（qPCA）、quantum support vector machines（qSVM）、用于线性系统的 HHL——曾被提出，并声称相对于经典算法拥有指数加速。Ewin Tang 等人的后续分析表明，dequantization——使用受量子启发的采样技术的经典算法——可以匹配或接近其中许多加速。如果量子 ML 优势存在，它也比最初声称的更有限，并且需要输入数据具有特定结构性质。
物理实现及其挑战
超导 qubits 通过把 Josephson junctions 冷却到毫开尔文温度来获得量子行为，这个温度远低于铝的 1.2K 超导转变温度。在这些温度下，电路表现为一个量子二能级系统。Gate operations 通过特定频率和持续时间的微波脉冲施加。主要限制是 coherence time（qubit 能维持量子行为多久，目前为数十到数百微秒）和 gate error rate（目前双 qubit gate 大约为 0.1–1%）。冷却所需的 dilution refrigerators 大型、昂贵且复杂；在维持低温和微波控制基础设施的同时扩展到数千 qubits，是一个重要工程挑战。
囚禁离子 qubits 使用电磁陷阱约束单个离子。Gate operations 通过耦合内部电子态的激光脉冲施加。优势是天然高 fidelity（一些展示中 gate errors 为 0.01% 或更低）和长 coherence times。劣势是 gate 速度慢（微秒级，而不是纳秒级），并且在维持必要光学访问和连接性的同时扩展到大量离子很困难。
光子量子计算机使用光子作为 qubits，并用线性光学元件实现 gates。优势是室温运行，并天然适合量子通信。劣势是 photon-photon 相互作用本身具有概率性：多数双 qubit gates 只能以概率方式成功，因此需要复杂的自适应协议。PsiQuantum 等公司正在发展 measurement-based 和 fusion-based 方法。
纠错开销是关键未知数。Surface code 是当前领先的实用量子纠错码；在物理错误率约为 0.1% 的假设下，为了达到合理 logical error rates，它大约需要每个 logical qubit 对应 1000 个 physical qubits。在容错规模上运行针对 2048-bit RSA 的 Shor 算法，需要数百万个 physical qubits，并且可能需要持续数十年的量子操作。IBM 和 Google 当前路线图预计到 2020 年代末达到数百到数千个 physical qubits；从这里跨越到数百万个容错 qubits，是中心挑战。
学习这一部分会改变什么
量子计算会改变实践者对计算图景及其近未来安全影响的理解。
第一个变化，是能够对量子主张作出校准过的判断。这个领域既产生了真实突破（Shor 算法、量子纠错、在特定任务上展示量子优势），也存在被夸大的主张（机器学习中的指数加速、即将到来的实际优势）。学习过基础的实践者可以区分二者：理解哪些算法在哪些问题上有已证明加速，NISQ 时代能做什么、不能做什么，以及容错量子计算机真正需要什么，都会让量子 hype 变得可读。
第二个变化，是意识到密码学紧迫性。Shor 算法并非假想——它是一个已证明的算法，一旦有容错量子计算机，就会破解 RSA 和椭圆曲线密码学。后量子迁移不是未来关切；对于任何管理长期敏感数据的组织，它都是当前工程任务。理解威胁为什么真实——算法本身、当前硬件轨迹，以及 “harvest now, decrypt later” 攻击——会比抽象地说“量子风险”更能促成行动。
第三个变化，是进入量子复杂性理论的能力。BQP（bounded-error quantum polynomial time）是量子计算机可以高效求解的问题类；它包含整数分解，但被认为不包含 NP-complete 问题。关系 BQP ⊆ PSPACE 表明，量子计算机并不能一般性地解决指数级困难问题，只能解决特定问题。QMA（quantum Merlin-Arthur，NP 的量子类比）包含 local Hamiltonian 问题和其他物理上重要的问题。这些复杂性类把量子计算放置到 §3.3 的更广泛复杂性图景中。
第四个变化，是为量子仿真机会做准备。量子化学和材料仿真是最有说服力的近中期应用，并且对药物发现、电池设计和催化剂开发都有意义。计算化学、材料科学及相邻领域的实践者，如果理解量子仿真如何工作，以及当前量子硬件能做什么，就能在量子资源逐渐可用时更好地使用它们，也能评估文献中那些常常过度自信的主张。
资源
书籍与文本
Nielsen 和 Chuang 的 Quantum Computation and Quantum Information（Cambridge，2000）是经典文本。它以罕见的数学细致性发展量子力学、线性代数、量子电路、主要算法（Deutsch-Jozsa、Simon、Shor、Grover）、量子纠错和量子信息理论。尽管已经出版二十多年，它仍然是必要参考——这个领域的基本算法没有改变，数学框架也具有永久性。它要求很高且非常全面；多数实践者会把它作为参考书，而不是从头读到尾。
Mermin 的 Quantum Computer Science: An Introduction（Cambridge，2007）比 Nielsen-Chuang 更易读，专门面向没有物理背景、但想理解量子计算的计算机科学家。它从 CS 学生已经掌握的线性代数基础发展量子力学，因此是多数 CS 实践者的合适起点。
Bernhardt 的 Quantum Computing: An Applied Approach（第 2 版，Springer，2021）提供了较新的实践性入门，同时覆盖理论和当前硬件图景，包括用 Qiskit 编程量子计算机。它是主要教材中最偏实践的一本。
Preskill 的 量子计算讲义（可在 <www.theory.caltech.edu/~preskill/ph229> 免费获取）是目前可免费获得的、研究生深度最完整的材料，对量子纠错和容错的处理比任何已出版书籍都更详细。
Aaronson 的 Quantum Computing Since Democritus（Cambridge，2013）风格异端但必要：它从广阔思想层面把量子计算与计算复杂性、科学哲学和物理学基础连接起来。这本书最有效地传达了为什么量子计算在计算机科学和科学的更广泛思想图景中重要。
| 书籍 | 作用 | 类型 |
|---|---|---|
| Nielsen & Chuang, Quantum Computation and Quantum Information | 经典综合参考 | 参考 |
| Mermin, Quantum Computer Science: An Introduction | 面向 CS 的易读入口 | 入门 |
| Bernhardt, Quantum Computing: An Applied Approach（第 2 版） | 当代实践性入门 | 入门 |
| Preskill, lecture notes（免费） | 研究生深度处理；纠错 | 深入 |
| Aaronson, Quantum Computing Since Democritus | 概念与复杂性语境 | 深入 |
课程与讲座
MIT 8.370/18.435（Quantum Computing，MIT OCW 和 edX 免费）是标准学术课程，使用 Nielsen-Chuang，覆盖从基础到主要算法和量子纠错的内容。
Preskill 的 Quantum Computation course（Caltech Ph 219，讲义和视频免费）提供了目前可免费获得的、对量子纠错和容错最严格的处理。
IBM Quantum Learning（learning.quantum.ibm.com 免费）提供结构化实践教育，使用 Qiskit 学习量子计算，范围从入门到高级。教育内容与真实量子硬件免费访问的结合，使它成为动手学习量子计算最实际的入口。
Scott Aaronson 的 quantum complexity course（材料见 scottaaronson.com）深入覆盖量子复杂性理论，包括 BQP、QMA，以及量子计算问题与经典计算问题之间的图景。
| 课程 | 平台 | 类型 |
|---|---|---|
| MIT 8.370/18.435 Quantum Computing（免费） | MIT OCW / edX | 入门 |
| Preskill Ph 219 Quantum Computation（免费） | theory.caltech.edu | 深入 |
| IBM Quantum Learning（免费） | learning.quantum.ibm.com | 实践 |
| Aaronson quantum complexity course（免费） | scottaaronson.com | 深入 |
实践、工具与当前资料
Qiskit（IBM，免费，qiskit.org）是使用最广泛的量子编程框架。它提供 Python API，用于构建和运行量子电路；提供开发用模拟器；并通过 IBM Quantum 平台访问 IBM 的真实量子硬件。完成 Qiskit 教材（quantum.ibm.com/textbook，免费）——实现 Grover 算法、量子隐形传态和小实例 Shor 算法——可以最直接地接触真实硬件上的量子算法。
Cirq（Google，免费，github.com/quantumlib/Cirq）是 Google 的量子编程框架，可以通过 Cloud 访问 Google 的量子硬件。相比 Qiskit，它提供更细粒度的电路构造控制。
PennyLane（Xanadu，免费，pennylane.ai）是变分量子算法和量子机器学习的主导框架，提供可微量子计算能力，使人可以用梯度方法优化量子电路参数。
Quirk（免费，algassert.com/quirk）是一个浏览器中的量子电路模拟器，提供量子态的可视化表示。用 Quirk 完成几个量子算法——图形化地看见叠加和干涉——能建立单靠数学描述无法提供的直觉。
Quantum Error Correction Zoo（errorcorrectionzoo.org，免费）是量子纠错码及其性质和关系的综合目录。它是理解 surface code 之外纠错方法空间的参考。
| 资源 | 平台 | 类型 |
|---|---|---|
| Qiskit + IBM Quantum（免费） | qiskit.org | 实践 |
| IBM Quantum Learning / legacy Qiskit Textbook archive（免费） | learning.quantum.ibm.com / GitHub archive | 实践 |
| PennyLane（免费） | pennylane.ai | 实践 |
| Microsoft Quantum Katas（免费） | quantum.microsoft.com / GitHub | 实践 |
| PennyLane Codebook（免费） | pennylane.ai/codebook | 实践 |
| Quantum Country（免费） | quantum.country | 辅助 |
| Quirk circuit simulator（免费） | algassert.com/quirk | 实践 |
| Cirq（免费） | github.com/quantumlib/Cirq | 实践 |
| QuTiP（免费） | qutip.org | 实践 |
| Error Correction Zoo（免费） | errorcorrectionzoo.org | 参考 |
陷阱
| 陷阱 | 为什么会误导 | 更好的回应 |
|---|---|---|
| 把量子叠加混同于并行计算 | 常见说法把量子计算描述为“同时计算所有可能性”，这暗示量子计算机只是同时运行 2ⁿ 个经典计算，然后读取正确答案。这是错的：测量会把叠加坍缩为单一结果，如果没有基于干涉的正确答案振幅放大，测量只会给出随机答案。量子算法必须精心设计干涉，使正确答案具有大振幅。 | 从算法层面学习 Grover 算法，以理解干涉如何工作：每次 Grover iteration 都会关于目标状态和均匀叠加进行反射，从而放大目标。“叠加让量子计算机一次算出所有答案”正是需要纠正的误解。 |
| 夸大近中期量子优势 | 变分量子算法曾被热烈提议用于化学、优化和机器学习，但真实 NISQ 硬件上的结果一再显示，噪声把电路深度限制得过于严重，无法在实际规模问题上产生有用计算。关于 NISQ 应用的“量子优势”主张，大多还没有在经典计算机无法解决的实际问题上得到实验验证。 | 评估量子优势主张时要问：这种加速是否已在真实硬件上、针对实际规模问题展示？比较对象是否是最佳经典算法，而不是朴素算法？dequantization 是否已被排除？对于多数近中期量子 ML 主张，这些问题的答案都指向有限或没有优势。 |
| 因为容错量子计算机还不存在，就否定密码学紧迫性 | “我们还没有容错量子计算机，所以密码学威胁不真实”是最有后果的错误。harvest-now-decrypt-later 攻击今天已经真实存在：攻击者现在收集加密数据，并把它们保存到有能力的量子计算机出现时再解密。对于必须保持十年以上安全的数据，无论量子硬件时间线如何，后量子迁移都已经必要。 | 评估你管理的数据中，哪些必须保持十年或更久的安全性。对于这些数据，对照 NIST 后量子标准（ML-KEM 和 ML-DSA，源自 CRYSTALS-Kyber 和 CRYSTALS-Dilithium）评估当前密码学状态，并规划迁移。技术共同体对容错量子计算机的时间估计大约从 10 到 30 年不等；这个范围并不长到可以推迟规划。 |
| 把量子计算当成软件问题 | 当前量子硬件最重要的限制是物理性的：退相干时间、gate 错误率、qubit 连接性，以及大规模低温系统的工程。软件改进——更好的电路编译、错误缓解、变分 ansatz 设计——只能在边际上提供帮助，无法克服硬件限制。通向容错量子计算的道路，主要依赖硬件进展。 | 在学习算法的同时理解硬件图景。超导路线和囚禁离子路线的差异，T1 和 T2 coherence times 的含义，gate fidelity 和 qubit connectivity 的重要性——这些物理属性决定哪些算法能运行，以及系统多大时噪声会占主导。硬件素养是量子计算素养的一部分。 |
| 因为量子纠错太高级而跳过它 | 量子纠错不是学完其他内容之后才学的高级主题；它是决定理论承诺中的量子加速能否在实际规模上实现的中心工程挑战。没有容错，量子计算机无法在有用规模上运行 Shor 算法，无法运行超过浅层电路的计算，只能局限于 NISQ 应用。理解为什么纠错困难，以及 surface code 提供了什么，是评估量子计算时间线和应用的必要语境。 | 把量子纠错和算法一起学习，而不是放到最后。三 qubit bit-flip code、Shor code 和 surface code 只需要 §2.3 中的线性代数和 §2.5 中的概率。理解阈值定理——低于某个关键物理错误率后，任意长计算原则上可能——并理解当前硬件错误率对容错计算何时可实现意味着什么，是做出有信息评估的定量基础。 |