What Is QEC?

1. Why quantum errors matter

Quantum information is stored in physical systems that cannot be perfectly isolated from their surroundings or controlled with unlimited precision. Superconducting circuits, trapped ions, neutral atoms and semiconductor spin qubits differ substantially in their physical implementation, but all are subject to noise, imperfect operations and measurement errors. These imperfections limit how reliably a quantum computation can proceed (Nielsen and Chuang, 2010; Preskill, 2018).

A qubit can occupy a superposition of two basis states:

The coefficients α and β are complex probability amplitudes. Quantum computation depends not only on their magnitudes but also on their relative phase. An error can therefore affect quantum information without simply changing a zero into a one.

Two elementary error operators illustrate the distinction. A bit-flip error, represented by the Pauli operator X, exchanges the computational basis states:

A phase-flip error, represented by the Pauli operator Z, changes the relative sign between the basis components:

Together with the identity I and their product Y = iXZ, these operators form a basis for all single-qubit operators. Any single-qubit error can therefore be written as

for some complex coefficients. This has a consequence that is central to quantum error correction. If a code can correct the complete set of single-qubit Pauli errors I, X, Y and Z on a given qubit, it can also correct any error operator acting on that qubit, including small continuous rotations. Under the corresponding quantum error-correction conditions, syndrome measurement distinguishes correctable error subspaces without revealing the encoded logical state. A finite set of corrections thus suffices against a continuum of possible errors. This discretisation of errors is what allows quantum error correction to work despite the continuous nature of quantum states (Nielsen and Chuang, 2010).

The Pauli description is a mathematical decomposition, not an inventory of physical noise mechanisms. In real hardware, errors arise through several processes. Energy relaxation can cause an excited qubit to decay. Dephasing can degrade the coherence between components of a superposition. Imperfect control pulses and entangling gates can introduce unwanted rotations or interactions. Readout errors can produce incorrect classical measurement outcomes, while leakage can move a physical system outside the two-dimensional space used to represent a qubit (Krantz et al., 2019). Leakage in particular falls outside the Pauli decomposition above and requires separate treatment.

Errors can also be correlated. A common disturbance, shared control electronics or unwanted coupling may affect several qubits together. Such events matter because many error-correction methods obtain their strongest guarantees under specified assumptions about the frequency, locality and correlations of physical faults. A decoder designed around independent errors may perform poorly when those assumptions fail.

The consequences accumulate as computations become more demanding. If a computation contains N operations, each failing independently with probability p, the probability that at least one operation fails is:

For small p, this is approximately Np, provided Np is also small. This elementary model illustrates why even individually reliable operations can become insufficient in long computations. It is not, however, a formula for logical failure: physical faults can sometimes cancel, remain harmless or be corrected, and real faults need not be independent.

The central difficulty is therefore not merely that quantum hardware makes errors. It is that reliable computation must be constructed from components that remain imperfect throughout operation. Quantum error correction addresses this problem by distributing information across physical qubits and extracting evidence of faults before they become uncorrectable logical failures.

2. How quantum error correction works

Quantum error correction does not protect information by making copies of an unknown quantum state. The no-cloning theorem prohibits perfect copying of an arbitrary unknown quantum state. Instead, QEC encodes quantum information into a larger Hilbert space, distributing the logical information across several physical qubits. Measurements can then reveal certain errors without determining the encoded logical state (Wootters and Zurek, 1982; Gottesman, 1997).

Encoding one logical qubit

Consider a single qubit in an arbitrary pure state:

The three-qubit repetition code encodes this state into three physical qubits:

The logical basis states are |0_L⟩ = |000⟩ and |1_L⟩ = |111⟩. The coefficients α and β remain unknown. Importantly, the encoded state is not three independent copies of the original qubit. It is a single logical state represented collectively by three physical qubits (Nielsen and Chuang, 2010).

Detecting an error without reading the state

The code uses two commuting stabiliser generators:

Here, Z_i denotes the Pauli Z operator acting on physical qubit i. Each stabiliser measures a parity relationship between two qubits. Every state in the code space has eigenvalue +1 for both stabilisers.

Suppose the second physical qubit experiences a bit-flip error, represented by X₂. The encoded state becomes:

Because X₂ anticommutes with both stabiliser generators, measuring them now produces the syndrome (−1, −1). The result identifies the second qubit as the location of the bit flip, provided the error is restricted to at most one physical-qubit bit flip.

Crucially, neither measurement reveals α or β. The stabilisers distinguish the relevant error conditions while leaving the unknown logical amplitudes intact. This is the central mechanism of stabiliser-based quantum error correction (Gottesman, 1997).

The error syndrome

Each possible single-qubit bit flip produces a distinct pair of stabiliser outcomes:

The pair of outcomes is called the error syndrome. Under the stated assumptions, the syndrome determines which single-qubit bit-flip correction to apply. For example, the syndrome (−1, −1) calls for applying X₂, restoring the original encoded state.

The syndrome does not identify an arbitrary physical error uniquely. Different errors can produce identical stabiliser outcomes, particularly when multiple faults occur. Error correction therefore depends on assumptions about which errors are possible or sufficiently likely.

What this example does not protect

The three-qubit repetition code protects against a single bit-flip error, but it does not protect against arbitrary single-qubit quantum errors. A phase-flip error, represented by Z_i, commutes with both stabilisers and therefore produces the same syndrome as no error. On the encoded state, such an error acts as a logical phase flip.

Correcting arbitrary single-qubit errors requires protection against both bit-flip and phase-flip components. More capable quantum codes, including the nine-qubit code introduced by Shor, address this requirement (Shor, 1995).

The repetition code nevertheless establishes the essential principle: quantum error correction obtains information about errors without directly measuring the quantum information it is designed to preserve. Whether that principle remains effective in a working quantum computer depends on the reliability of syndrome extraction, the available observations and the decoder’s interpretation of them.

3. Syndrome measurement

In the idealised repetition-code example, measuring two stabiliser generators produces a pair of outcomes that identifies a single bit-flip error. A working quantum error-correction system faces a further difficulty: the measurements used to detect errors are themselves imperfect. Syndrome extraction must therefore be repeated, and the decoder must distinguish evidence of faults affecting the data qubits from faults affecting the measurement process (Gottesman, 1997; Fowler et al., 2012).

Stabiliser outcomes

A stabiliser measurement tests whether the encoded system lies in the positive or negative eigenspace of a specified operator. For the repetition code introduced in the preceding section, the two stabilisers are:

Each ideal measurement returns an eigenvalue of +1 or −1. These outcomes reveal parity relationships between physical qubits, not the unknown amplitudes of the logical state. In stabiliser-based QEC, this separation permits error information to be extracted without directly measuring the protected logical information (Gottesman, 1997).

In hardware, stabilisers are generally measured indirectly. Ancillary qubits interact with the data qubits through a prescribed sequence of gates, after which the ancillas are measured. The resulting classical outcomes provide information about the stabilisers while avoiding direct measurement of the encoded logical state. However, ancilla preparation, entangling gates, readout and reset can each introduce faults (Fowler et al., 2012).

From measurement outcomes to detection events

A stabiliser outcome and a detection event are not the same thing. A stabiliser outcome is the result of an individual measurement. A detection event identifies a departure from an expected relationship between measurement outcomes.

Consider a stabiliser measured repeatedly in successive rounds. Represent its outcome in round t by a binary variable s_i,t, where 0 represents eigenvalue +1 and 1 represents eigenvalue −1. In a simplified repeated-measurement circuit, a detection event can be defined as:

Here, ⊕ denotes exclusive OR. A value of d_i,t = 1 means that the measured stabiliser outcome changed between successive rounds. A value of 0 means that it remained unchanged.

This expression is a useful introductory model, not a universal definition of a detector. In practical circuits, a detector is defined by a parity relationship among measurement results whose value is predictable in the absence of faults. Depending on the circuit, that relationship may involve measurements at different locations, different times or preparation and final-readout outcomes (Gidney, 2021).

Why repeated measurements matter

Suppose a data-qubit bit flip occurs between two measurement rounds. The error may change the outcomes of neighbouring stabilisers. If the error persists, subsequent rounds can continue reporting the changed parity, while detection events occur when the expected relationships are first violated.

A measurement fault can produce a different pattern. For example, an isolated incorrect stabiliser readout may disagree with both the preceding and following rounds, producing two detection events separated in time. By examining the spatial and temporal relationships among detection events, a decoder can distinguish fault hypotheses that would be ambiguous from a single measurement round (Fowler et al., 2012).

This is the basis of space-time decoding. The decoder does not simply inspect a static pattern of incorrect parities. It analyses a record extending across repeated rounds of syndrome extraction, using a model of which physical faults can produce which detection-event patterns.

What a detection event establishes

A detection event is evidence that an expected measurement relationship has been violated. It is not a direct observation of a particular physical error. Different faults can produce the same detection-event pattern, and multiple faults can combine so that some detection events cancel.

Conversely, the absence of detection events does not establish that no physical error occurred. Certain faults may leave the stabiliser record unchanged, including undetectable logical operators and errors that act trivially on the encoded information. The interpretation of an empty detector record therefore depends on the code, measurement circuit and assumed noise model (Gottesman, 1997; Fowler et al., 2012).

The resulting distinction is fundamental: a syndrome record contains evidence about physical faults, not a complete description of the faults themselves. Extracting a useful correction from that evidence requires a decoder, whose conclusions depend on both the recorded information and the model used to interpret it.

4. Decoding: inference under a noise model

Syndrome measurements produce evidence of errors, but they do not ordinarily specify a unique correction. The task of a quantum error-correction decoder is to interpret the recorded syndrome or detection events and select a recovery operation that preserves the encoded logical information. This is an inference problem: the decoder must reason from observable consequences to possible underlying faults (Gottesman, 1997; Dennis et al., 2002).

From detection events to candidate errors

In the idealised three-qubit repetition code, each single-qubit bit flip produces a distinct syndrome. Realistic quantum error correction is less straightforward. Several physical faults can generate the same detection-event pattern, and a single fault can affect multiple measurements. A decoder must therefore consider competing explanations of the observed record.

Let D denote a detector record and E a candidate physical error. Given an assumed noise model, Bayesian inference relates the probability of an error to the probability of observing the record:

The term P(E) represents the assumed probability of the candidate error. The likelihood P(D | E) describes how that error could produce the observed detector record. In an idealised deterministic syndrome model, an error either produces the observed syndrome or it does not. In a circuit-level model with imperfect measurements, the relationship is more complicated.

A decoder may select a highly probable error explanation, but identifying the exact physical error is not generally necessary. What matters is whether the selected recovery has the correct effect on the encoded logical state.

Error equivalence and logical operators

Stabiliser codes distinguish physical errors from their logical consequences. Let 𝒮 denote the stabiliser group of a code. If two Pauli errors differ by a stabiliser, they have the same action on every state in the code space:

Here, the symbol 𝒮 denotes the stabiliser group, while S denotes one of its elements. Global phases are disregarded. Such errors belong to the same stabiliser equivalence class. A recovery that differs from the actual error only by a stabiliser restores the encoded information (Gottesman, 1997).

However, two errors can produce the same syndrome without being stabiliser-equivalent. They may instead differ by a nontrivial logical operator. In that case, applying a recovery appropriate to one error when the other occurred can introduce a logical failure.

For Pauli errors, the distinction can be expressed through the residual operation following recovery. If E is the actual error and R the selected Pauli recovery, successful correction requires:

The condition is understood up to an irrelevant global phase. If the residual operation instead acts as a nontrivial logical operator, the syndrome may have been accounted for while the protected quantum information has nevertheless been altered.

Maximum-likelihood decoding

Because different physical errors can have the same logical effect, an optimal decoder for logical recovery need not select the single most probable physical error. It should instead favour the most probable logical equivalence class consistent with the observed evidence.

For Pauli noise with perfect syndrome extraction, the probability assigned to an equivalence class is obtained by summing the probabilities of its constituent errors. A class containing many individually unlikely errors can be more probable than a class containing the single most likely error (Dennis et al., 2002). The same principle carries over to imperfect measurements once faults are described by a circuit-level error model: the fault configurations consistent with the detector record are grouped according to their effect on the logical observables, and the decoder should favour the most probable group.

This distinction is sometimes described as degeneracy. It matters because quantum error-correcting codes can admit many physically distinct error patterns that act identically on the encoded state. The objective is successful logical recovery, not reconstruction of an inaccessible physical fault history.

Exact maximum-likelihood decoding is, however, computationally hard in general (Iyer and Poulin, 2015). Practical decoders therefore approximate it, trading some inferential accuracy for speed. The decoders discussed below should be understood in that light.

Minimum-weight perfect matching

One widely used decoding method is minimum-weight perfect matching (MWPM). For suitable codes and noise models, detection events can be represented as vertices in a graph, with weighted edges corresponding to possible error mechanisms or chains of faults. The decoder searches for a minimum-weight pairing of detection events, allowing appropriate boundary connections.

Edge weights are typically derived from assumed fault probabilities. Under suitable independence assumptions, more probable error mechanisms receive lower weights. MWPM can therefore provide an efficient approximation to probabilistic decoding, particularly for surface-code architectures (Dennis et al., 2002; Fowler et al., 2012). Efficient implementations make it fast enough to be a serious candidate for real-time use (Higgott and Gidney, 2023).

MWPM is not, however, a universally optimal quantum decoder. Standard matching formulations may neglect correlations among error mechanisms, simplify multi-detector fault signatures, or fail to account fully for stabiliser degeneracy. Decoders that exploit additional structure in the noise can do better. A prominent example is the neural-network decoder of Bausch et al. (2024), which is trained first on simulated data and then on a limited number of experimental samples, allowing it to adapt to an error distribution that is not specified in advance. On experimental surface-code data it outperformed the other state-of-the-art decoders against which it was compared.

The decoder’s noise model

A decoder’s conclusions depend on its model of how errors arise. That model may specify physical error probabilities, correlations between faults, measurement reliability, leakage mechanisms and the structure of the syndrome-extraction circuit.

An independent-error model is often computationally convenient, but physical noise need not be independent. Correlated faults can arise from shared control electronics, crosstalk, environmental disturbances or error propagation through multi-qubit gates. If the decoder assumes independence where substantial correlations exist, it can systematically misjudge the relative probabilities of competing logical error classes (Fowler et al., 2012).

A distinction is therefore required between missing evidence and misinterpreted evidence. A detector record may contain statistical signatures of correlated faults even when the decoder’s assumed model does not exploit them. Improving the decoder can then improve logical performance without changing the physical measurement interface.

Conversely, no improvement in inference can recover a distinction that the available observations do not encode. Where different physical conditions generate indistinguishable detector records, the decoder must rely on prior assumptions or additional information obtained through another measurement or calibration procedure.

Decoding is therefore not simply the correction of observed errors. It is the selection of a logically appropriate recovery from incomplete evidence, under assumptions that may themselves be wrong. This dependence on the noise model becomes increasingly consequential as quantum error-correcting systems grow in size and complexity.

5. Fault tolerance: correcting errors without spreading them

Quantum error correction is necessary for reliable quantum computation, but it is not sufficient. An error-correcting code may protect information against a specified set of physical errors while the circuits used to operate that code introduce additional faults. The purpose of fault-tolerant quantum computation is to prevent faults in preparation, gates, measurement and recovery from combining or propagating in ways that defeat the code's protection (Shor, 1996; Aliferis, Gottesman and Preskill, 2006).

The distinction is consequential. A code may correct every single-qubit error in an idealised model, yet a single faulty operation in its syndrome-extraction circuit may produce errors on several data qubits. If those errors form an uncorrectable pattern, the protection promised by the code does not survive its implementation.

How faults propagate through gates

Quantum gates do not merely transform intended states. They also transform errors already present on their input qubits. Consider a controlled-NOT gate, or CNOT, acting on a control qubit c and target qubit t. An error E present before the gate is equivalent to the error UEU^† after it, where U is the gate.

Under this conjugation, a Pauli X error on the control spreads from the control to the target:

A Pauli Z error on the target spreads in the opposite direction, from the target to the control:

In both cases the error is moved forward through the gate; what differs is the direction in which it spreads. X errors travel along the control-to-target direction, Z errors against it.

These identities describe how errors are transformed when represented at a common point in the circuit. They do not imply that every physical fault necessarily spreads to two qubits. Propagation depends on the error type, its location and the subsequent gate sequence. Nevertheless, they demonstrate why the arrangement of gates matters to error correction (Nielsen and Chuang, 2010).

Syndrome extraction can introduce errors

As described in §3, stabilisers are commonly measured using ancillary qubits. An ancilla interacts with several data qubits, after which its measurement supplies a classical syndrome outcome. The interaction sequence must be designed carefully because an ancilla fault can propagate through subsequent gates.

Consider an ancilla that interacts sequentially with several data qubits. A fault occurring early in that sequence may propagate to multiple data qubits before the ancilla is measured. The resulting correlated error can be more damaging than an isolated physical-qubit fault.

Fault-tolerant syndrome-extraction procedures therefore constrain how errors can propagate. Depending on the code and architecture, this may involve verified ancilla states, carefully chosen gate ordering, flag qubits or other circuit designs that make dangerous fault patterns detectable or correctable (Shor, 1996; Chao and Reichardt, 2018).

Hook errors and circuit geometry

In surface-code implementations, correlated errors caused by faults during stabiliser extraction are often called hook errors. Their consequences depend not only on the number of affected qubits but also on the orientation of the resulting error chain relative to the code’s logical operators.

An unsuitable gate ordering can allow a single circuit fault to create an error pattern that contributes disproportionately to a logical failure. Appropriate scheduling and orientation of stabiliser-measurement circuits can reduce this vulnerability (Fowler et al., 2012).

This illustrates an important engineering principle: fault tolerance is a property of the implemented circuit and its error model, not merely of the abstract code. Two implementations of the same stabiliser code can have materially different logical error rates because their gate schedules, connectivity, measurement procedures and physical noise differ.

Circuit-level fault tolerance

A realistic assessment must account for faults throughout the complete error-correction cycle. These include imperfect state preparation, single- and two-qubit gates, idle periods, ancilla measurements, reset operations and classical decoding.

A circuit-level noise model assigns fault mechanisms to the operations and locations of a specified circuit. Unlike a phenomenological model that treats data and measurement errors more abstractly, it can represent correlations arising from particular gate failures and their propagation through the circuit.

Circuit-level simulations are therefore essential for evaluating proposed fault-tolerant implementations. Stabiliser-circuit simulators such as Stim can efficiently generate detector records and associated error models for large classes of Clifford circuits (Gidney, 2021). Such simulations remain conditional on the noise mechanisms included in the model.

The distinction between simulated circuit-level performance and experimentally demonstrated performance must remain explicit. A decoder may perform well under a specified stochastic Pauli-noise model while real hardware exhibits leakage, drift, coherent errors or correlated disturbances that the simulation does not adequately represent.

The fault-tolerance requirement

The objective of fault-tolerant design is to ensure that a sufficiently small number of physical faults cannot produce an uncorrectable logical error through uncontrolled propagation. The precise requirement depends on the code, circuit construction and fault model.

A code’s distance, defined in §6, fixes how many errors on the encoded data it can correct in the ideal setting. That guarantee concerns errors acting on encoded data. It does not by itself ensure that a physical syndrome-extraction circuit is fault-tolerant. The circuit must also control the consequences of faults occurring during its own execution, so that a single fault cannot spread into an error pattern heavier than the code can handle.

Formal fault-tolerance constructions impose conditions on how faults within encoded operations affect the data and how errors are contained between successive correction procedures. These conditions underpin quantum threshold theorems, which establish that arbitrarily reliable computation is possible under specified assumptions when physical error rates are sufficiently low (Aliferis, Gottesman and Preskill, 2006).

Protecting memory is not the same as performing computation

A quantum memory experiment tests whether encoded information can survive repeated correction cycles. A fault-tolerant quantum computer must do more: it must prepare logical states, perform logical gates, execute measurements and implement the required computational operations without losing the protection provided by the code.

Logical gates can introduce additional challenges. Some operations can be implemented transversally or through code deformation, while others may require resource-intensive procedures such as magic-state distillation. Consequently, a low logical memory error rate does not establish the reliability or resource cost of a complete fault-tolerant computation (Bravyi and Kitaev, 2005; Eastin and Knill, 2009).

Fault tolerance is achieved not when errors become impossible, but when the architecture prevents ordinary physical faults from becoming uncontrolled logical failures. Whether that condition can be maintained as a system grows depends on physical error rates, circuit design, decoding performance and the assumptions underlying the chosen fault-tolerance scheme.

6. Scaling and thresholds

Quantum error correction becomes useful for large-scale computation only if increasing the resources devoted to protection can reduce logical errors sufficiently to outweigh the additional opportunities for physical failure. This is the central scaling problem. Larger codes require more physical qubits, gates, measurements and classical processing, but they can also make certain logical errors progressively less likely.

Under suitable assumptions, quantum fault-tolerance theory establishes that arbitrarily reliable computation is possible when physical error rates fall below an appropriate threshold. The threshold is not a universal property of quantum hardware. Its value depends on the error model, code, fault-tolerant operations and decoding procedure (Aharonov and Ben-Or, 2008; Aliferis, Gottesman and Preskill, 2006).

Code distance and logical protection

The distance of a quantum error-correcting code is the minimum weight of a nontrivial logical operator: the smallest number of physical qubits on which an undetectable operation can act nontrivially on the encoded information. For a stabiliser code, this is the minimum weight of a Pauli operator that commutes with every stabiliser but is not itself a stabiliser, disregarding global phases (Gottesman, 1997).

A distance-d code can correct any combination of up to t arbitrary data-qubit errors, where:

This guarantee concerns ideal error correction on encoded data. It does not automatically extend to the same number of faults in a physical circuit. As discussed in §5, a circuit fault can propagate through multiple gates, and measurement errors complicate the interpretation of the syndrome.

The three-qubit repetition code from §2 illustrates an important distinction. It can correct a single bit-flip error, but a single phase-flip error acts as a nontrivial logical operator. Its quantum code distance is therefore one, not three. Distance must always be understood with respect to the error types and logical operators relevant to the code.

How logical errors can decrease

Consider an idealised family of distance-d codes exposed to sufficiently weak, independent physical errors. If the decoder successfully corrects all error patterns up to the guaranteed correction radius, logical failure requires a sufficiently damaging combination of faults.

For odd-distance surface codes under suitable stochastic noise models, a commonly used approximate scaling relation is:

Here, p_L(d) denotes the logical failure probability for a specified operation or correction cycle; p is a physical error parameter; p_th is a characteristic threshold scale; and A is a model-dependent prefactor. The expression is a phenomenological approximation, not a general theorem or an exact formula for arbitrary quantum hardware (Fowler et al., 2012).

When the physical error parameter is sufficiently below the threshold scale, the ratio in parentheses is less than one, and increasing code distance suppresses logical failure approximately exponentially. Above the threshold, the ratio exceeds one, and increasing code distance makes logical failure more likely: the additional qubits and operations add more opportunities for failure than the larger code removes.

The approximation assumes that the underlying fault mechanisms remain sufficiently well behaved as distance increases. The prefactor, effective threshold and scaling exponent can change with the noise model, circuit construction, decoder and definition of logical failure. Correlated or nonstationary errors can invalidate a simple extrapolation.

Error suppression per increase in distance

For experiments comparing successive odd code distances, it is convenient to express suppression through a dimensionless factor:

A value of Λ greater than one means that the larger code has a lower measured logical error probability under the specified experimental conditions. For example, Λ = 2 means that increasing distance from d to d + 2 halves the logical error probability.

The two descriptions are connected. Under the scaling relation above, each increase of two in distance multiplies the logical error probability by p/p_th, so:

Under the assumptions of this scaling model, a measured Λ greater than one is the experimental signature of operation below threshold, and its size indicates how far below threshold the device operates (Google Quantum AI and Collaborators, 2025).

If the suppression factor remained constant across distances, logical error rates would follow:

This relation is conditional on the suppression factor remaining unchanged. Measuring Λ at a few small code distances does not establish that it will remain constant at substantially larger distances or over longer operating times. Such extrapolation requires additional assumptions about the stability and scaling of the underlying error mechanisms.

What a threshold theorem establishes

Quantum threshold theorems establish the possibility of reliable computation under specified physical and architectural assumptions. Their conclusions concern families of fault-tolerant constructions, not arbitrary devices that happen to use quantum error correction.

The assumptions typically constrain the strength and structure of noise, the availability and quality of physical operations, and the manner in which faults can propagate. Different theorems accommodate different noise models and computational architectures (Aharonov and Ben-Or, 2008; Aliferis, Gottesman and Preskill, 2006).

Consequently, there is no single physical error-rate threshold that applies to every code and every implementation. A quoted threshold is meaningful only alongside its assumptions: the error model, gate set, measurement procedure, decoding algorithm and definition of the relevant failure rate.

A system can also exhibit logical error suppression across several measured code distances without establishing that every component of a scalable fault-tolerant architecture operates below its required threshold. Memory performance is one important demonstration, but complete computation imposes additional requirements.

Why scaling can fail

The most consequential limitation of a simple scaling model is that larger systems need not experience statistically equivalent noise. Increasing the number of qubits and operations can introduce new interactions, shared disturbances, control constraints and opportunities for correlated failure.

A correlated fault affecting many qubits can violate the assumptions behind an independent-error scaling model. Likewise, rare events may contribute little to short experiments while becoming important during prolonged operation. A decoder trained or configured for one error distribution may perform differently when that distribution changes.

To illustrate the distinction, consider a hypothetical logical error model containing both a distance-suppressed contribution and a residual contribution:

Here λ > 1 is a model parameter governing the distance-suppressed term, and B represents a hypothetical distance-independent residual failure contribution. The parameter λ is deliberately distinguished from the measured ratio Λ(d): when B is not zero, the two differ, and the measured ratio falls towards one as distance grows. This is an illustrative model, not a general law of quantum error correction or an estimate of any particular device.

If B is small compared with the first term at measured distances, the measured Λ(d) will be close to λ, and the data may appear consistent with sustained exponential suppression. At larger distances, however, the residual contribution would dominate and the measured suppression would diminish.

The example does not establish that a physical error floor exists. It demonstrates why finite-range measurements cannot, by themselves, exclude every alternative scaling model that agrees with the available observations.

Scaling is an engineering claim

Demonstrating useful scaling requires more than fitting a favourable curve. The relevant evidence includes circuit-level performance, logical failure statistics, sensitivity to decoder assumptions, correlations in detector records, calibration stability and the resources required to operate larger codes.

Logical error rates must also be compared using consistent operational definitions. A failure probability per correction cycle is not directly interchangeable with a failure probability per logical gate, per unit time or per complete algorithm. The conversion depends on the operations performed and the duration and structure of the computation.

Increasing code distance can suppress logical errors, but the observed suppression factor is not a guarantee of future scaling. It is evidence obtained under a particular physical implementation, decoder and operating regime. The next section examines what experimental demonstrations establish, and which conclusions still depend on extrapolation.

7. Experimental evidence: what quantum hardware demonstrates

Quantum error correction has moved beyond theoretical constructions and numerical simulations. Experimental processors now demonstrate that increasing the size of an error-correcting code can reduce the measured logical error rate. One important example is Google’s Willow superconducting processor, reported by Google Quantum AI and collaborators in Nature (Google Quantum AI and Collaborators, 2025).

The significance of this result is specific. Willow demonstrated below-threshold surface-code memory performance over the code distances investigated. It did not demonstrate an arbitrarily scalable quantum computer, nor did it establish that every relevant error mechanism will continue to be suppressed at larger distances.

Logical error suppression with increasing distance

The Willow experiments investigated surface-code quantum memories at distances 3, 5 and 7 on a 105-qubit processor. The reported logical error rate decreased as code distance increased. The paper reports that increasing the code distance by two suppressed the logical error rate by a fitted factor of:

This means that, over the measured range, increasing code distance by two reduced the logical error probability per correction cycle by a factor of approximately 2.14. The result was obtained using an offline neural-network decoder fine-tuned on processor data. A separate ensemble of matching-based decoders produced a suppression factor of Λ = 2.04 ± 0.02 on the same experiment, a reminder that the measured suppression factor depends on the decoder as well as the hardware.

By the approximate scaling relation in §6, the headline result is consistent with operation roughly a factor of two below an effective threshold scale under the experiment’s conditions. The reported uncertainty describes the fitted experimental result; it does not quantify uncertainty about whether the same scaling will continue at larger distances (Google Quantum AI and Collaborators, 2025).

The distance-7 memory used 101 physical qubits, with a reported logical error probability of 0.143% ± 0.003% per correction cycle:

The distinction between a probability per correction cycle and a probability per complete computation is important. A low per-cycle error rate does not by itself establish that a long computation can be completed reliably. The cumulative probability of failure depends on the number and nature of logical operations, their duration, and the correlations among failures.

Comparison with physical-qubit performance

The Willow study also compared the lifetime of an encoded quantum memory with that of its best-performing constituent physical qubit. The distance-7 logical memory was reported to last approximately:

times longer than the best physical qubit under the study’s comparison conditions (Google Quantum AI and Collaborators, 2025).

This comparison matters because encoding introduces additional physical operations, each of which can fail. Demonstrating that the encoded memory outperforms an individual physical qubit therefore provides evidence that the error-correction machinery can deliver a net benefit.

Nevertheless, a logical-memory lifetime advantage is not equivalent to demonstrating a universal set of fault-tolerant logical gates. The latter requires additional operations and resources, with their own error mechanisms and performance requirements.

Decoding in real time

The headline suppression figures were obtained through offline decoding. A working quantum computer cannot rely exclusively on retrospective analysis: it must process syndrome information while computation proceeds.

The same study therefore also operated a distance-5 memory, on a separate 72-qubit processor of the same architecture, with a real-time decoder based on a specialised version of the sparse blossom algorithm. This streaming matching decoder maintained below-threshold performance, achieving Λ = 2.0 ± 0.1, against Λ = 2.18 ± 0.09 when the same data were later decoded offline by the neural-network decoder. The real-time decoder used a prior that did not depend on device data, and had to keep pace with a correction-cycle time of 1.1 µs over runs of up to one million cycles (Google Quantum AI and Collaborators, 2025).

The average decoder latency was 63 ± 17 µs. The paper defines latency as the time between the decoding software receiving the final cycle of syndrome data and the decoder returning its correction. The figure therefore excludes the time taken to classify measurement signals and transport them to the decoder, and, as the paper notes, it does not yet include feedback into the logical circuit. The reaction time of a complete system would be longer.

The result matters for two reasons. It shows that below-threshold operation is not merely an artefact of offline analysis. It also makes the timing problem discussed in §9 concrete: even on this partial measure, the decoder’s latency was tens of correction cycles, so decoded information arrived well after the measurements that produced it.

For a quantum memory, this delay can be accommodated while correction rounds continue. For computations that require a decoded result before selecting a subsequent operation, it becomes an architectural constraint. The distinction is between decoder throughput, which determines whether incoming syndrome data can be processed continuously, and decoder latency, which determines when a particular result becomes available.

Rare correlated errors

The Willow results also illustrate why favourable average error suppression is not the whole reliability problem. In separate repetition-code experiments on the 72-qubit processor, extending to distance 29, the researchers found that logical performance at high distance was limited by rare correlated error bursts. These occurred approximately once an hour, corresponding to roughly three billion correction cycles, affected neighbourhoods of about thirty qubits and decayed over a few hundred microseconds. The paper reports that they set an apparent logical error floor of about 10⁻¹⁰ per cycle in those experiments, and that their origin is not yet understood (Google Quantum AI and Collaborators, 2025).

These observations should not be confused with the distance-7 surface-code logical error rate. The experiments used different codes, a different processor and addressed different aspects of error correction. The rare-event result is relevant because it reveals a failure mechanism that a simple independent-error model does not capture.

A disturbance affecting many physical qubits can create correlated errors that do not behave like independently distributed faults. Depending on the code, circuit and decoder, such events may become disproportionately important as logical error rates from ordinary faults decrease.

The floor reported for these repetition codes is a measured property of a specific device and experiment. It does not establish a universal or unavoidable floor for the architecture. The same experiments broke past an earlier, higher floor of about 10⁻⁶ seen on previous Google processors, which the paper attributes to the mitigation of high-energy impact events by a change in qubit fabrication (Google Quantum AI and Collaborators, 2025). What the new floor does establish is that the experimentally observed noise includes mechanisms that require separate characterisation and cannot be assumed away when extrapolating scaling.

What simulations add

The Willow study supplemented experimental measurements with numerical simulations extending beyond the largest experimentally demonstrated surface-code distance. Such simulations are useful for investigating whether measured device parameters are consistent with continued logical error suppression (Google Quantum AI and Collaborators, 2025).

However, a simulation tests the consequences of its specified model. It cannot independently establish that all relevant physical error mechanisms have been included, or that their statistical properties will remain unchanged as the processor grows.

The distinction is especially important for correlated noise, leakage, drift and rare disturbances. If a mechanism is absent from the model, a favourable simulated scaling curve provides no direct evidence that the mechanism will remain harmless in hardware.

What the experiment establishes

Willow provides experimental evidence for four significant achievements.

1. Logical error suppression: Increasing surface-code distance from 3 to 5 to 7 reduced the measured logical error rate under the reported operating conditions.
2. A net memory advantage: The distance-7 encoded memory outperformed the best physical qubit in the study’s lifetime comparison.
3. Real-time operation: A distance-5 memory maintained below-threshold performance while being decoded in real time.
4. Evidence of non-ideal noise structure: Separate repetition-code experiments revealed rare correlated disturbances relevant to long-duration operation and future scaling.

These results support the feasibility of increasingly reliable logical quantum memories. They do not, on their own, demonstrate large-scale fault-tolerant computation, establish sustained suppression at arbitrarily large code distances, or certify the completeness of the assumed noise model.

Beyond a single experiment

Willow is not the only report of below-threshold behaviour, and the distinctions drawn in this section apply equally to other experimental platforms.

Below-threshold surface-code memory has also been reported on a superconducting processor using an all-microwave leakage-suppression architecture. He et al. demonstrated a distance-7 surface-code memory with a suppression factor of Λ = 1.40(6). Their leakage-suppression procedures reversed the above-threshold scaling observed without adequate leakage mitigation (He et al., 2025).

Below-threshold behaviour has also been demonstrated on a neutral-atom processor. Bluvstein et al. compared distance-3 and distance-5 surface codes and reported that the larger code achieved 2.14(13) times lower logical error per round in a four-round characterisation circuit. The central value coincides with Willow’s suppression factor, but the two figures come from different experiments and are not related. The result used atom-loss information in machine-learning decoding (Bluvstein et al., 2026).

The platforms differ in their dominant error mechanisms and architectural constraints. Atom loss is particularly important in neutral-atom systems, where detecting a missing atom can provide useful information for decoding. The neutral-atom experiment also investigated logical operations beyond quantum memory.

Each result provides evidence about its own device, decoder and operating regime. The measured suppression factors should not be treated as directly comparable measures of hardware quality, because the experiments differ in their circuits, noise mechanisms, decoding procedures and operational definitions. None removes the extrapolation questions raised above.

Evidence and extrapolation

A finite experiment can establish logical performance over the code distances, operating times and conditions actually tested. Claims about substantially larger systems necessarily introduce assumptions about how hardware behaviour, error correlations, calibration and decoder performance will change.

The relevant engineering question is therefore not whether Willow demonstrated useful quantum error correction. It did. The question is which assumptions must remain valid for the observed suppression to persist as the architecture scales.

Experimental logical error suppression is evidence of progress towards fault tolerance, not a certification of future fault-tolerant performance. The distinction becomes especially important when the measurements used to demonstrate performance cannot reveal every failure mechanism relevant to the protected computation.

8. What quantum error correction cannot reveal

Quantum error correction depends on extracting information about errors without destroying the quantum information being protected. This creates an important distinction between information that a system must conceal, information that its current procedures fail to capture, and information that its decoder fails to use.

These limitations are not interchangeable. Some are necessary for quantum information to remain protected. Others arise from the design of the measurement procedures or from assumptions embedded in the decoder.

Kahl (2026a) calls a system blind to a distinction, relative to a question, when nothing it uses distinguishes the alternatives that matter for that question. The blindness is representational because the records concerned are used as information about the condition they monitor. The paper distinguishes three kinds by where the distinction is lost: function-relative blindness (revealed by no procedure that preserves the system’s function), observation-relative blindness (not revealed by current procedures, but recoverable by a further procedure that preserves the function) and model-relative blindness (recorded, but unused by the model reading the record). The kinds are not ranked; they differ in what would recover the distinction, and in whether it should be recovered at all (Kahl, 2026a).

Function-relative blindness: information that must remain protected

The first limitation is intrinsic to the purpose of quantum error correction. A QEC system must preserve an arbitrary unknown logical state. Its routine syndrome measurements must therefore avoid extracting information that would distinguish the logical states within the protected code space.

For a stabiliser code, every encoded state has the same prescribed stabiliser eigenvalues. Consequently, measuring those stabilisers does not distinguish different logical states within the code space (Gottesman, 1997).

This property is essential. It is an instance of a general principle of quantum theory: information about which of several non-orthogonal states a system occupies cannot be gained without disturbing it (Fuchs and Peres, 1996; Busch, 2009).

Kahl (2026a, Proposition 5.1) states the principle for whole inquiries rather than single measurements. Suppose a procedure, however adaptive, must apply a prescribed unitary operation to every possible encoded input while also producing a classical record, and suppose its apparatus starts in a state independent of the encoded state, with no other access to records correlated with it. Then every outcome must act on the code space as that same unitary, multiplied by a constant factor that does not depend on the input. The probability of each complete history is therefore the same for every encoded state. Such a procedure can produce information relevant to error correction, but its record cannot reveal which arbitrary logical state was supplied.

Realistic codes preserve encoded information only approximately, and Kahl (2026a, Proposition 5.2) gives the corresponding bound, derived from the information–disturbance trade-off of Kretschmann, Schlingemann and Werner (2008). Two standard measures are needed. The diamond norm measures how far apart two quantum operations are: the largest difference between their outputs over all inputs, including inputs entangled with an untouched reference system. With the normalisation used here it runs from 0, for identical operations, to 2. The total-variation distance between two probability laws over records is the largest difference in probability they assign to any event; it bounds how well any test, however computed, can tell from a record which law produced it.

The bound is then as follows. If what an inquiry does could be undone to within ε in diamond norm, its complete classical record distinguishes any two encoded states by at most 2√ε in total variation, however the record is processed. Read the other way, a record that distinguishes encoded states by t requires a recoverability defect of at least t²/4 (Kahl, 2026a; Kretschmann, Schlingemann and Werner, 2008).

Two features of the bound matter. First, it is governed by recoverability, not performance. An inquiry that leaves the memory rotated by a fixed but unintended amount has failed to perform its function, yet its record is as blind as if it had not, because the rotation could in principle be undone. What is incompatible with preserving arbitrary unknown encoded information is irreversible extraction. Second, the converse fails. A blind record does not certify that the encoded state survived. In a three-qubit repetition code under coherent rotations, every syndrome history has the same probability for every encoded state, yet the stored information is nonetheless damaged. The blindness that protects the encoded state also hides damage to it, so evidence of damage must come from outside the record (Kahl, 2026a).

Both results concern procedures required to preserve the specified operation for arbitrary encoded inputs. They do not prohibit destructive final measurement, verification of specially prepared known states, or tests that impose additional assumptions on the permitted inputs. Kahl (2026a) claims no new theorem: both propositions are short derivations from established results. The contribution of the classification is the distinction between a lack of information required by the protected function and other limitations that may be legitimate targets for engineering improvement.

Function-relative blindness is not a measurement deficiency to be repaired. It is a condition of preserving the protected quantum information.

Observation-relative blindness: information absent from the record

A different limitation arises when the current procedures leave two physically distinct error conditions indistinguishable, even though choosing the best recovery would require distinguishing them, and some further procedure that preserves the function would separate them.

Consider a noise process involving coherent rotations. Unlike a stochastic Pauli error, a coherent rotation retains phase relationships that may affect the performance of a recovery operation. Coherent errors are known to behave differently from their Pauli approximations. For the surface code, Bravyi et al. (2018) found that the standard Pauli approximation could underestimate the logical error rate below threshold, even though it gave a good estimate of the threshold itself (Bravyi et al., 2018).

Depending on the code and measurement procedure, distinct coherent error parameters can nevertheless produce identical syndrome statistics. Özgüler (2026), in a recent preprint, establishes such a result for an idealised toric-code instrument: an odd-distance square toric code, uniform coherent X rotations, and error-free preparation, syndrome extraction and recovery. For this instrument, the complete passive syndrome history has the same probability distribution for rotation angles +θ and −θ, for every encoded input, every angle and every number of rounds (Özgüler, 2026).

A passive syndrome history contains the syndrome outcomes obtained during error correction, without additional measurements of the encoded logical information. The sign of the rotation is absent from this record, so no decoder, estimator or learned model, however large, can recover it from the record alone.

The sign matters for what the system should do. Özgüler shows that a correction tuned to one sign helps when the rotation runs that way and harms when it runs the other. Kahl (2026a) uses this result as a paradigm case of observation-relative blindness, and exhibits the same structure in a three-qubit repetition code small enough to check by hand (Kahl, 2026a).

In the numerical illustration reported by Kahl (2026a), the instrument is an L = 3 periodic toric code, of distance 3, encoding two logical qubits. The physical noise consists of uniform coherent X rotations with magnitude |θ| = 0.05 radians. The comparison concerns one correction round.

The calculation compares repairs that know the sign with repairs that must serve both signs. In both cases the repair may depend on the observed syndrome: syndromes whose effects on the memory agree are grouped, and each group receives its own repair. The figures reported are values of the recovery defect: the diamond-norm distance between the two-qubit logical channel the memory undergoes after repair and the identity channel. Where one repair must serve both signs, the defect is that of the worse sign.

Under the model’s assumptions, no sign-blind repair achieves a defect below 3.7 × 10⁻⁴, whereas an explicit sign-aware repair achieves a defect no greater than 9.9 × 10⁻⁷. The ratio therefore exceeds 370, even at the conservative ends of the reported bounds. Both figures were computed by semidefinite programming as numerical primal–dual bounds in floating point, not certified with interval arithmetic (Kahl, 2026a).

This is a comparison of optimised repair channels under different information constraints. It is not a direct comparison of experimentally measured logical error rates. The calculation assumes idealised operations and a specified coherent noise model.

Whether the ratio persists at larger toric-code distances, or over more rounds, has not been investigated in that numerical comparison. Bravyi et al. (2018) found that, for their surface-code noise models, the effective logical noise approached stochastic Pauli behaviour at larger code sizes. That result cautions against extrapolating the numerical advantage to other distances or architectures without further analysis (Bravyi et al., 2018).

The underlying limitation is independent of decoder sophistication. If two physical hypotheses induce identical probability distributions over every available syndrome history, no algorithm receiving only that history can infer which hypothesis is correct.

Additional evidence must come from procedures that leave the working memory untouched. Özgüler’s remedy is calibration: separately prepared memories in known logical states are exposed to the same noise and then measured logically at the end, which reveals the sign. Because the calibration states are known, measuring them reveals nothing about any unknown state held in the working memory (Özgüler, 2026). Kahl (2026a) adds a second route: a separate sentinel qubit, exposed to the same rotation and measured in a basis sensitive to its sign. Both remedies assume that the sign is the same on the calibration memories or sentinel as on the working memory, and that it has not changed since. When noise drifts, that assumption must itself be tested, and calibration evidence trusted only for a limited time (Özgüler, 2026; Kahl, 2026a).

Observation-relative blindness cannot be overcome by improving inference over an unchanged record. It requires additional evidence or a justified external assumption.

Model-relative blindness: information recorded but unused

The third limitation is different. The available detector record may contain evidence of a relevant physical distinction, while the decoder’s model fails to represent or exploit that evidence.

For example, a decoder may assume that physical faults occur independently, even when the detector record contains statistical signatures of correlated errors. Those correlations can affect the relative probabilities of competing logical error classes, as discussed in §4. A decoder that ignores such structure may select inferior recoveries despite receiving information that could support better inference.

The remedy is already established practice. Decoders whose error models are learned or refined from experimental detector data can exploit structure that a hand-specified model omits. A prominent example is the neural-network decoder of Bausch et al. (2024), trained first on simulated data and then fine-tuned on experimental samples, so that it adapts to the experimental error distribution without that distribution having to be specified in advance (Bausch et al., 2024).

Kahl (2026a) illustrates both halves of the case with simulations. In a surface-code memory whose decoder omits a correlated error, the omission costs logical performance, and a test statistic fixed in advance detects it in the same detector record the decoder receives. In a continuously monitored bit-flip code whose controller assumes the wrong detector efficiency, a standard check on the controller’s own records exposes the error, and re-estimating the efficiency from those records restores the performance of a correctly specified controller. Nothing about the encoded state is needed or revealed, so the remedy preserves the function by construction (Kahl, 2026a).

The contribution of the classification is not the observation that better models improve decoding. It is the claim that this remedy belongs to one kind of limitation only. Model-relative blindness is remediable through improved inference because the relevant evidence is already present in the record. Observation-relative blindness cannot be repaired in the same way, however sophisticated the decoder becomes.

This does not mean that every model mismatch can be identified from operational records. Detectability depends on whether the competing models produce distinguishable record distributions and whether sufficient data can be collected.

Model-relative blindness is a limitation of the decoder's representation of available evidence, not necessarily a limitation of the measurement interface.

Three limitations, three engineering responses

The distinction can be summarised by asking whether the missing information is compatible with the protected function, whether it is present in the available record, and whether the decoder uses it correctly.

The distinction matters because a proposed remedy can fail when it addresses the wrong limitation. More sophisticated decoding cannot recover information absent from the measurement record. Additional measurements cannot legitimately reveal an arbitrary protected logical state while preserving the exact operation required for every possible input.

Conversely, redesigning measurement hardware may be unnecessary when the existing detector record already contains the evidence needed for better inference.

The engineering objective is not to make every physical distinction observable. It is to preserve the distinctions that must remain protected, expose those needed for diagnosis, and use the available evidence correctly.

9. Engineering implications: designing for reliable operation

Quantum error correction is often introduced as a mathematical method for protecting quantum information. Its practical success, however, depends on the coordinated behaviour of physical qubits, control electronics, measurement circuits, classical processors and software. A code that performs well under an idealised noise model may perform poorly when implemented with imperfect gates, correlated disturbances or inadequate real-time decoding (Fowler et al., 2012; Krantz et al., 2019).

The engineering challenge is therefore broader than reducing the error rate of individual qubits. It is to construct a system in which physical faults remain sufficiently local, diagnostic information reaches the decoder, recovery decisions are timely, and the assumptions supporting logical error suppression remain justified.

Hardware: controlling the sources and propagation of faults

Physical qubit performance is a necessary foundation for quantum error correction. Relevant characteristics include coherence times, gate fidelity, measurement fidelity, leakage, connectivity and the stability of device parameters. These characteristics interact: improving one component does not necessarily improve the logical error rate if another component becomes the dominant source of failure.

Hardware architecture also determines how faults propagate. Shared control lines, microwave crosstalk, unwanted interactions and common environmental disturbances can produce correlations between nominally separate qubits. As discussed in §5, multi-qubit gates can spread existing errors, while the ordering of syndrome-extraction operations can influence whether a fault develops into a dangerous logical error (Fowler et al., 2012).

Hardware optimisation should therefore be evaluated against logical performance, not only against isolated component benchmarks. A reduction in the average two-qubit gate error rate may be valuable, but its effect on logical reliability depends on which faults are reduced, whether their correlations change, and how the decoder responds.

Readout: designing the measurement interface

Syndrome extraction is an information interface between the quantum processor and its classical control system. It converts selected properties of the evolving quantum state into measurement outcomes from which detection events can be constructed.

The interface must satisfy two requirements that can pull in different directions. It must reveal enough information to support error diagnosis, while avoiding disclosure of the arbitrary logical state that the computation is intended to preserve. The latter restriction is fundamental to stabiliser-based quantum error correction (Gottesman, 1997).

Readout-chain design involves more than achieving a high measurement fidelity. It includes measurement duration, reset reliability, discrimination thresholds, analogue signal processing, timing alignment, data transport and the conversion of raw measurements into detector records. Each stage can introduce errors, discard potentially useful information or create dependencies between observations.

The observability analysis of §8 suggests an additional design question, which Kahl (2026a) states as a principle: before fabrication, decide which distinctions the interface must transmit for diagnosis, and which it must withhold to preserve the protected operation (Kahl, 2026a).

This question should be considered during architecture development. Once the measurement hardware, control topology and data paths are fixed, recovering a missing diagnostic distinction may require substantial redesign rather than a software update.

Calibration: obtaining evidence outside protected operation

Calibration provides information about physical behaviour that routine syndrome measurements may not reveal. Depending on the hardware platform, calibration procedures can estimate gate parameters, readout response, coherent control errors, leakage and temporal drift (Krantz et al., 2019).

The distinction between calibration and protected computation is important. A diagnostic experiment may deliberately prepare known states, apply test operations or perform measurements that would be inappropriate during the preservation of an arbitrary unknown logical state.

Such experiments can reveal physical distinctions unavailable to the operational syndrome interface. The coherent-noise example in §8 illustrates the principle: if the syndrome history is insensitive to the sign of a relevant rotation, calibration on known states can supply that sign (Özgüler, 2026).

Calibration nevertheless introduces its own assumptions. Measurements made on prepared test states must be representative of the conditions encountered during computation. Parameters can drift between calibration and operation, while some faults may depend on workload, operating history or the simultaneous activity of neighbouring components.

A calibration programme should therefore address not only parameter estimation but also the validity period of those estimates, their uncertainty and their sensitivity to operating conditions.

Decoding: using the evidence that the system already records

A decoder is an operational component of the error-correction system, not merely an offline analysis tool. Its performance depends on the accuracy of its noise model, the information supplied by the measurement interface and the time available to make recovery decisions.

Decoder development therefore has two distinct objectives. The first is computational: process detector records with sufficiently low latency and resource consumption. The second is inferential: select recoveries that minimise logical failure under the actual physical error distribution.

These objectives are related but not identical. A faster decoder can be less accurate if it relies on an excessively simplified noise model. Conversely, a more accurate offline decoder may be unsuitable for real-time operation if its computational requirements exceed the available processing budget.

Efficient matching-based decoding demonstrates the importance of algorithmic implementation (Higgott and Gidney, 2023). However, decoder throughput alone does not establish logical performance under hardware noise.

Decoder validation should compare predicted and observed detector statistics, investigate correlations and test sensitivity to plausible model errors. Where the record contains information that the decoder ignores, improving inference may provide a performance benefit without additional quantum hardware, as the learned decoders discussed in §4 show.

Where the record does not distinguish relevant physical hypotheses, decoder optimisation has a different limit. The missing information must be supplied through calibration, additional observation or an explicitly justified assumption.

System integration: timing, interfaces and resource constraints

Fault-tolerant operation requires coordination between quantum hardware and classical processing. Syndrome measurements occur repeatedly, while detector records must be transported, interpreted and incorporated into subsequent control decisions.

The classical processing architecture must keep pace with the rate at which measurement data are generated. The scale of the problem is illustrated by the Willow real-time experiment described in §7: correction cycles of 1.1 µs, against an average decoder latency of 63 µs, measured from the decoding software receiving the final cycle of data and excluding signal transport and feedback (Google Quantum AI and Collaborators, 2025).

The decoder kept up with the data stream, but its answers arrived tens of cycles after the measurements that produced them. This distinction between throughput and latency is important: a decoder may process successive measurement records at the required rate without producing each individual result within a single correction cycle.

Depending on the error-correction scheme, recovery operations may be implemented physically or tracked through a classical Pauli frame, allowing some corrections to be deferred (Knill, 2005).

Pauli-frame tracking reduces the need to apply every correction immediately, but it does not eliminate timing constraints. Logical measurements, adaptive operations and non-Clifford procedures may require decoded information before later operations can proceed.

Where a subsequent operation depends on a decoding result that is not yet available, the computation may have to wait. Latency of the order demonstrated in the Willow experiment can then translate into additional idle time, during which the qubits continue to accumulate errors. Whether such a delay occurs depends on the circuit, scheduling strategy and available opportunities for feed-forward.

Consequently, classical decoding latency, memory bandwidth, communication paths and control-system scheduling can become architectural constraints. A quantum processor cannot be evaluated independently of the systems required to operate its error correction.

Assurance: distinguishing evidence from assumptions

An engineering organisation must decide not only whether a QEC system performs well in a particular experiment, but also what evidence justifies confidence in its continued operation. This requires separating demonstrated properties from extrapolations and assumptions.

A logical error rate measured over a specified operating period supports a claim about performance under those conditions. It does not automatically establish the same rate for longer periods, different workloads, larger code distances or changed hardware configurations.

Similarly, agreement between a noise model and observed detector statistics does not establish that the model captures every physically relevant mechanism. Different models can produce similar or identical observable predictions.

The three forms of blindness introduced in §8 provide a way to organise these limitations:

• Function-relative: Identify properties that cannot be established through state-preserving observation of an arbitrary unknown logical state.
• Observation-relative: Identify competing physical hypotheses that the available detector records cannot distinguish, and determine whether independent calibration or diagnostic procedures can resolve them.
• Model-relative: Test whether recorded evidence contradicts the decoder’s assumed noise model or supports more effective inference.

This classification does not replace quantitative reliability analysis. It determines which questions can be investigated using existing operational records and which require other sources of evidence (Kahl, 2026a).

Independent tests, known-state experiments, hardware characterisation and comparisons between models can strengthen an assurance argument. They do not remove every assumption. Their value depends on whether the tests are representative, whether their failure mechanisms are sufficiently independent and whether their conclusions apply to the protected computation.

Design for observability, not merely for measurement volume

More measurements do not necessarily produce better error correction. Additional observations may be redundant, introduce new faults or disclose information that the protected operation must keep inaccessible.

The relevant question is whether a proposed measurement distinguishes physical conditions that matter to a consequential engineering decision. Where the distinction is already present in the record, the appropriate response may be better inference. Where it is absent, a separate diagnostic interface may be required. Where revealing it would defeat the protected quantum operation, the restriction must be preserved.

Reliable quantum error correction requires an architecture that controls faults, transmits the right diagnostic information, interprets that information correctly and states clearly what its evidence cannot establish. These are system-level requirements. They cannot be satisfied by improving physical qubits, decoders or measurement fidelity in isolation.

10. Research context and conclusions

Quantum error correction rests on several decades of research into quantum information, error-correcting codes and fault-tolerant computation. Its mathematical foundations include the stabiliser formalism (Gottesman, 1997), while the development of topological codes established important connections between local measurements, decoding and the protection of logical information (Dennis et al., 2002).

The engineering literature examines how these principles can be implemented using imperfect physical devices. Surface-code architectures provide a prominent example (Fowler et al., 2012), while fault-tolerance theory establishes the conditions under which reliable computation is possible despite physical errors (Aliferis, Gottesman and Preskill, 2006).

Experimental demonstrations, including Google’s below-threshold surface-code results, provide evidence of logical error suppression under specified operating conditions (Google Quantum AI and Collaborators, 2025). As discussed in §7, subsequent results from other superconducting and neutral-atom platforms extend the experimental evidence, although their operating conditions, noise mechanisms and decoding procedures differ (He et al., 2025; Bluvstein et al., 2026).

Observability and the limits of diagnosis

Kahl’s research examines a related but distinct question: what can an error-correcting system establish from the evidence available during its own operation, and when is its failure to acquire evidence a defect rather than a condition of its working?

Blind by Design: Quantum Error Correction, Functional Incompatibility and the Value of Evidence (Kahl, 2026a) distinguishes three kinds of blindness by where a distinction is lost. Function-relative blindness holds when no procedure that preserves the protected operation can reveal the distinction. Observation-relative blindness holds when the current procedures do not reveal it, but a further procedure that preserves the operation would. Model-relative blindness holds when the record contains the evidence but the decoder’s model does not use it.

The individual phenomena are known; the paper’s contribution is to separate them according to where information is unavailable or fails to be used, and to show that each calls for a different remedy. Its central claim is that epistemic adequacy is partly relative to function: a system that fails to acquire evidence its interface could physically supply is not, for that reason alone, inadequate, when acquiring that evidence would defeat what the system is required to do.

The distinction has practical consequences. Some limitations require preserving the existing measurement restriction. Others require independent calibration or changes to the diagnostic interface. Still others can potentially be addressed through better noise models and decoding. These are different engineering problems, even when they produce superficially similar failures.

Related work on evidence and certification

A broader treatment of the relationship between representation, observation and certification appears in What Conceptual Change Cannot Recover (Kahl, 2026b). That work examines conditions under which distinct underlying hypotheses cannot be distinguished through an available observation interface, even when inference procedures are revised.

The connection to quantum error correction is methodological. A decoder cannot recover a distinction that its measurement interface does not transmit. Conversely, when the relevant distinction is already present in the record, improvements in inference may be effective.

The physical requirements of preserving quantum information introduce additional constraints that must be analysed within quantum theory rather than inferred from a general theory of observation.

The central engineering question

Reliable quantum computation requires more than an error-correcting code with favourable mathematical properties. It requires physical hardware, measurement procedures, decoding algorithms and fault-tolerant operations whose combined behaviour supports sustained logical error suppression.

It also requires a disciplined account of evidence. Measured logical error rates establish performance under the conditions tested. Simulations establish consequences of specified models. Threshold theorems establish what is possible under their assumptions. None of these forms of evidence should be substituted for another.

The objective is not to observe everything. It is to preserve what must remain protected, measure what matters for diagnosis, and distinguish demonstrated reliability from the assumptions on which future scaling depends.

Suggested citation

Kahl, P. (2026). ‘Quantum Error Correction: Protection, Evidence and the Limits of Observation’. Lex et Ratio. Available at: https://www.lexetratio.com/quantum-error-correction/ (accessed [date]).

References

1. Aharonov, D. and Ben-Or, M. (2008). ‘Fault-tolerant quantum computation with constant error rate’. SIAM Journal on Computing, 38(4), 1207–1282. DOI: 10.1137/S0097539799359385 .
2. Aliferis, P., Gottesman, D. and Preskill, J. (2006). ‘Quantum accuracy threshold for concatenated distance-3 codes’. Quantum Information and Computation, 6(2), 97–165. arXiv:quant-ph/0504218 .
3. Bausch, J., Senior, A. W., Heras, F. J. H. et al. (2024). ‘Learning high-accuracy error decoding for quantum processors’. Nature, 635, 834–840. DOI: 10.1038/s41586-024-08148-8 .
4. Bluvstein, D., Geim, A. A., Li, S. H. et al. (2026). ‘A fault-tolerant neutral-atom architecture for universal quantum computation’. Nature, 649, 39–46. DOI: 10.1038/s41586-025-09848-5 .
5. Bravyi, S., Englbrecht, M., König, R. and Peard, N. (2018). ‘Correcting coherent errors with surface codes’. npj Quantum Information, 4, article 55. DOI: 10.1038/s41534-018-0106-y .
6. Bravyi, S. and Kitaev, A. (2005). ‘Universal quantum computation with ideal Clifford gates and noisy ancillas’. Physical Review A, 71, 022316. DOI: 10.1103/PhysRevA.71.022316 .
7. Busch, P. (2009). ‘“No information without disturbance”: quantum limitations of measurement’. In Myrvold, W. C. and Christian, J. (eds), Quantum Reality, Relativistic Causality, and Closing the Epistemic Circle. Dordrecht: Springer, pp. 229–256. DOI: 10.1007/978-1-4020-9107-0_13 .
8. Chao, R. and Reichardt, B. W. (2018). ‘Quantum error correction with only two extra qubits’. Physical Review Letters, 121, 050502. DOI: 10.1103/PhysRevLett.121.050502 .
9. Dennis, E., Kitaev, A., Landahl, A. and Preskill, J. (2002). ‘Topological quantum memory’. Journal of Mathematical Physics, 43, 4452–4505. DOI: 10.1063/1.1499754 .
10. Eastin, B. and Knill, E. (2009). ‘Restrictions on transversal encoded quantum gate sets’. Physical Review Letters, 102, 110502. DOI: 10.1103/PhysRevLett.102.110502 .
11. Fowler, A. G. et al. (2012). ‘Surface codes: Towards practical large-scale quantum computation’. Physical Review A, 86, 032324. DOI: 10.1103/PhysRevA.86.032324 .
12. Fuchs, C. A. and Peres, A. (1996). ‘Quantum-state disturbance versus information gain: Uncertainty relations for quantum information’. Physical Review A, 53(4), 2038–2045. DOI: 10.1103/PhysRevA.53.2038 .
13. Gidney, C. (2021). ‘Stim: a fast stabilizer circuit simulator’. Quantum, 5, 497. DOI: 10.22331/q-2021-07-06-497 .
14. Google Quantum AI and Collaborators (2025). ‘Quantum error correction below the surface code threshold’. Nature, 638, 920–926. DOI: 10.1038/s41586-024-08449-y .
15. Gottesman, D. (1997). Stabilizer Codes and Quantum Error Correction. PhD thesis, California Institute of Technology. arXiv:quant-ph/9705052 .
16. He, T., Lin, W., Wang, R., Li, Y. et al. (2025). ‘Experimental Quantum Error Correction below the Surface Code Threshold via All-Microwave Leakage Suppression’. Physical Review Letters, 135, 260601. DOI: 10.1103/rqkg-dw31 .
17. Higgott, O. and Gidney, C. (2023). ‘Sparse blossom: correcting a million errors per core second with minimum-weight matching’. Preprint. arXiv:2303.15933 .
18. Iyer, P. and Poulin, D. (2015). ‘Hardness of decoding quantum stabilizer codes’. IEEE Transactions on Information Theory, 61(9), 5209–5223. DOI: 10.1109/TIT.2015.2451663 .
19. Kahl, P. (2026a). ‘Blind by Design: Quantum Error Correction, Functional Incompatibility and the Value of Evidence’. Version 1.0. Lex et Ratio. DOI: 10.5281/zenodo.23278643 .
20. Kahl, P. (2026b). ‘What Conceptual Change Cannot Recover: Interface Closure, Epistemic Recoupling and Representational Sealing’. Version 2.1. Lex et Ratio. DOI: 10.5281/zenodo.23390484 .
21. Knill, E. (2005). ‘Quantum computing with realistically noisy devices’. Nature, 434, 39–44. DOI: 10.1038/nature03350 .
22. Krantz, P. et al. (2019). ‘A quantum engineer’s guide to superconducting qubits’. Applied Physics Reviews, 6, 021318. DOI: 10.1063/1.5089550 .
23. Kretschmann, D., Schlingemann, D. and Werner, R. F. (2008). ‘The information-disturbance tradeoff and the continuity of Stinespring’s representation’. IEEE Transactions on Information Theory, 54(4), 1708–1717. DOI: 10.1109/TIT.2008.917696 .
24. Nielsen, M. A. and Chuang, I. L. (2010). Quantum Computation and Quantum Information. 10th anniversary edition. Cambridge University Press.
25. Özgüler, A. B. (2026). ‘Securing quantum error correction against misleading advice from AI agents’. Preprint. arXiv:2609.19090 .
26. Preskill, J. (2018). ‘Quantum Computing in the NISQ era and beyond’. Quantum, 2, 79. DOI: 10.22331/q-2018-08-06-79 .
27. Shor, P. W. (1995). ‘Scheme for reducing decoherence in quantum computer memory’. Physical Review A, 52, R2493–R2496. DOI: 10.1103/PhysRevA.52.R2493 .
28. Shor, P. W. (1996). ‘Fault-tolerant quantum computation’. In Proceedings of the 37th Annual Symposium on Foundations of Computer Science, pp. 56–65. IEEE. DOI: 10.1109/SFCS.1996.548464 .
29. Wootters, W. K. and Zurek, W. H. (1982). ‘A single quantum cannot be cloned’. Nature, 299, 802–803. DOI: 10.1038/299802a0 .