Table of Contents
On August 17, 2026, Quantum Zeitgeist covered a preprint from Zheng An’s group in Shenzhen, hyperlinking the phrase “depth-8 decoder” to one of its own earlier articles – a piece about GPU-accelerated decoding of quantum low-density parity-check (qLDPC) codes. The two decoders have nothing in common. An’s is a quantum circuit of eight layers of single-qubit rotations and controlled-Z gates; it runs on qubits and tries to rebuild a state which unitary dynamics have scattered into the neighboring sites. The qLDPC decoder is classical software that reads error syndromes and computes a correction. One acts on quantum information, the other on measurement results about quantum information, and they share a word and nothing else.
I am not raising this to score points. In April I published The Decoder Bottleneck. Decoder performance, I argued there, is the capability most likely to decide whether we see a cryptographically relevant quantum computer in 2030 or in 2045, so security teams should pay more attention to decoder papers than to qubit-count press releases. I still think that is right. The advice has a weakness, though. “Decoder” names four unrelated things across quantum computing, cryptography and machine learning, and anyone who follows it will find three of the four in the news every week, each subdivided into variants reported as separate breakthroughs.
Only one of the four, the classical inference layer inside a real-time error-correction loop, tells us anything about Q-Day – the date a quantum computer can break the public-key cryptography we run in production today. Even there a single result is one input among many. Papers in the other three can post record numbers indefinitely without moving the year at all.
The senses all descend, loosely, from the five parts Claude Shannon drew in 1948: information source, transmitter, channel, receiver and destination, with noise entering from below. Neither “encoder” nor “decoder” appears on that diagram; where Shannon does treat encoding and decoding, in his section 8, he calls the devices transducers. Coding theorists specialized the transmitting and receiving operations into those two roles over the following decade, and everyone who borrowed the vocabulary afterwards took the box without the mathematics beneath it.
McEliece turned unauthorized decoding into a security assumption in 1978. Brassard and Salvail borrowed the classical decoder for key reconciliation in quantum key distribution in 1993. The quantum error correction community adopted the word for classical syndrome inference in the mid-1990s, and the machine learning community revived the encoder-decoder framing around 2014. Four heirs, one word, no coordination between them whatsoever.
The Two Tests
What goes in, what comes out, and on what clock. A syndrome decoder takes parity-check bits and returns a correction, against a deadline the hardware sets. A quantum recovery circuit takes a qubit register in and hands one back, limited by circuit depth and coherence time, with no syndrome rate to answer to. A reconciliation decoder in quantum key distribution takes a partly corrupted bit string and returns an agreed key, on a block or session timescale. A transformer decoder takes embeddings and returns tokens. Four inputs, four outputs, four clocks, with nothing in any one of those boxes resembling anything in the others.
Do we want it to succeed, or to fail? In quantum error correction, in key reconciliation and in machine learning, the decoder is supposed to work, so every new paper is a claim that it worked better than the last one. In code-based cryptography the decoding problem is supposed to be intractable, so every new paper is an argument that it still is. Same vocabulary, opposite sign – and that is why we, as security practitioners, pay for the confusion instead of leaving it to the physicists.
Inside the Error-Correction Loop
A quantum computer running error correction measures parity checks continuously, producing a stream of syndrome bits that constrain which errors can have occurred without revealing the encoded state itself. The decoder is whatever classical machinery reads that stream and works out what to fix – software on a CPU, or logic burned into an FPGA. It is the sense Capability D.2 tracks in my capability framework and the one the April piece was about.
The decoder must keep pace with the rate at which syndromes arrive, which on superconducting hardware means roughly one round per microsecond, or else it accumulates a backlog until the computation halts. A logical operation that branches on a decoded outcome, separately, cannot proceed until the decoder answers, and that imposes a response-time deadline on the whole loop out through the control system and back. Throughput and response time are different quantities, though reporters routinely treat them as one. A decoding system can satisfy the first while failing the second, as we will see in a concrete example below.
Minimum-weight perfect matching, union-find, lookup tables, belief propagation with ordered-statistics post-processing, Relay, Tesseract, collision clustering, local clustering – every one of these makes a different bargain between accuracy and speed, and the April piece works through those bargains in some detail. What that piece skipped is that reporters regularly treat the sub-senses inside this one family as separate species, when they are in fact deployment modes, architectural roles and commercial packaging of the same thing.
Neural Decoders Are Not a Fourth Thing
Google DeepMind’s AlphaQubit is a recurrent transformer trained to decode surface-code syndromes. Harvard’s Cascade is a convolutional network that exploits the geometric regularity of qLDPC codes. Both are syndrome decoders, the machine learning being an implementation choice inside the same box, with the input, the output and the clock identical to what union-find faces. Any “AI decoder” that consumes syndrome bits and emits a correction or a logical inference belongs to this family, and it has to beat union-find and matching on speed and accuracy like everything else in it.
A 2025 preprint from Chanho Lee and colleagues swapped the attention block for Mamba, a state-space model whose cost grows as the square of the code distance where attention costs the fourth power. On public Sycamore memory data the Mamba version matched the authors’ own transformer baseline – a considerably weaker claim than beating Google’s trained model, though we often see it reported as the latter. The authors then built a simulated noise model in which additional error scales with assumed inference cost. Under that model the crossover from distance 3 to distance 5 came out at 0.0104 for Mamba against 0.0097 for the transformer, all of it on a machine nobody ever ran.
Even with that caveat, the useful idea stands. A slow decoder is not merely a delay but a source of error in its own right.
Andrew Senior and 23 colleagues at Google DeepMind and Google Quantum AI have since reported AlphaQubit 2 decoding in real time at under a microsecond per cycle for the surface code out to distance 11. They also report the first real-time color-code decoding, to distance 9. That is sustained throughput at scale on commercial accelerators. It isn’t, however, an end-to-end sub-microsecond loop from qubits through decoder and back – and the difference between those two claims is the difference this whole piece is about.
Offline, Real-Time, and Streaming
Offline decoding runs after the experiment, on a workstation, sometimes hours later, and demonstrates that the hardware produced correctable errors. Real-time decoding runs inside the cycle budget with the result fed back into the live computation, demonstrating that the machine can compute under error correction. Streaming decoding processes an unbounded syndrome stream without waiting for the experiment to finish, which is what running Shor’s algorithm for a week actually demands. One algorithm and one set of syndrome data support all three claims, depending only on when the decoding happens.
Riverlane’s Deltaflow 2 already does this for quantum-memory experiments, and Deltaflow 3 will extend it to logical operations later in 2026, according to the company, though it had not shipped as I write this in early September.
A result decoded offline and a result decoded in real time are separate achievements, at very different distances from a working machine. Papers are usually scrupulous about saying which one they demonstrated, so the answer normally waits in the abstract for anyone who opens the PDF. It is in the write-ups that the distinction goes missing.
A predecoder is a cheap filter that resolves the easy syndromes and hands the hard ones to the main decoder, quoted by vendors with latency figures of its own. Decoder switching, proposed in late 2025, runs a fast decoder by default and escalates to an accurate one on difficult syndromes – which means one system can honestly report two different latencies.
The Decoder as a Product
“The decoder” sometimes means neither an algorithm nor a deployment mode but a box with a vendor attached, together with the interface between that box and the control electronics. Riverlane sells one, and its QECi specifies the messages and states a control system exchanges with a QEC stack. NVIDIA’s NVQLink is a broader architecture connecting accelerated computing to a quantum system controller, of which syndrome transport is one workload among several. The two overlap without being rival standards at the same layer.
To a procurement officer the decoder is a line item with a data format, inside which the algorithm can change between firmware releases without the line item changing at all.
Quantum Circuits Called Decoders
These decoders are quantum operations acting on the qubits themselves rather than on classical bits about qubits, and not one of them reads a syndrome.
The decoding circuit of a code. In any textbook treatment of the Steane or Shor codes, the encoder is the unitary that maps a logical qubit into its physical carriers and the decoder is the unitary that maps it back out again. This is the oldest quantum usage and probably the likeliest to confuse a reader arriving from the news, since the same textbook page will go on to discuss syndrome decoding two paragraphs later.
Recovery maps. Given a fixed encoding and a noisy channel, which quantum operation best recovers the encoded information under a chosen fidelity objective? The code-specific Petz recovery map – usually called the transpose channel in this setting – is the standard analytic construction. For a fixed code and objective the optimal recovery can also be written as a semidefinite program. The approximate-error-correction literature calls all of these decoders. They have no hardware and frequently no implementation at all, the question they answer being what recovery is possible in principle.
Variational recovery circuits. An’s group parameterizes a shallow quantum circuit, optimizes its angles against a recovery objective, and asks how much of the in-principle recoverable information a bounded-depth circuit can actually reach. After the dynamics, the authors reset the target register and applied a depth-8 circuit to the radius-3 halo around it, recovering the input with a held-out median average fidelity of 0.758.
That beats the 2/3 ceiling Serge Massar and Sandu Popescu proved in 1995 for anyone who measures a single unknown qubit and prepares a replacement, and it is the result Quantum Zeitgeist headlined – real and modest. It is a diagnostic for where quantum information remains locally accessible. It is not error correction, as the authors say plainly in their own discussion section.
Quantum autoencoders. The same encoder-decoder framing borrowed back from machine learning, implemented as quantum circuits and used for compression instead of correction.
Decoders in Cryptography
The Problem That Must Not Be Solved
In March 2025, NIST selected Hamming Quasi-Cyclic (HQC) as its fifth post-quantum algorithm and a second key-encapsulation mechanism for standardization, chosen specifically for resting on different mathematics from ML-KEM. No FIPS number exists yet. NIST said in March 2025 that a draft would follow in about a year and the final standard in 2027, but as of its August 5, 2026 update, the standardization page still lists HQC as selected and nothing more. “Selected” is the word to use, and “standardized” the word to avoid.
HQC’s security depends on quasi-cyclic syndrome decoding: given a parity-check matrix and a syndrome, find the low-weight error vector that produced it. In algebraic outline that is the very problem a surface-code decoder solves continuously, and the resemblance is genuine without the tasks being the same. A surface-code decoder exploits known local geometry, repeated noisy measurements and a hardware-specific error model. An HQC attacker faces a deliberately constructed quasi-cyclic instance with none of that structure to work with. Riverlane needs its instances solved in under a microsecond. HQC needs the attacker’s instances never solved at all.
Robert McEliece built that asymmetry into a single cryptosystem. His 1978 proposal hid a binary Goppa code so that the legitimate receiver could exploit the secret structure with an efficient decoder, Patterson’s, from 1975. The attacker received a scrambled public code and a decoding problem with nothing in it to exploit.
That same year, Berlekamp, McEliece and van Tilborg proved general linear-code decoding NP-complete, noting in their own abstract that the result strongly suggests but does not rigorously imply the absence of a polynomial-time algorithm. A worst-case theorem proves nothing about any particular code distribution, of course. But the design has survived forty-eight years anyway, which is why PQC standardization kept code-based schemes in the portfolio as insurance against a break in lattice mathematics.
Cryptanalysts use the word as well. Information set decoding, the generic attack family aimed at HQC, BIKE and Classic McEliece, runs from Prange in 1962 through Stern to the BJMM variants and their successors. A cryptanalysis paper reporting a decoding record is reporting that the problem got slightly easier, which is bad news. A quantum error correction paper reporting a decoding record is reporting that the problem got slightly easier, which is good news. Identical sentence, opposite implication, and the only way to tell them apart is to know which literature we happen to be reading.
The Decoder Inside HQC
Decapsulation runs a concatenated Reed-Muller and Reed-Solomon decoder to strip the error vector and recover the shared secret, so HQC contains a decoder of its own and the two senses collide inside one algorithm. That decoder has a decryption failure rate – a design parameter NIST weighed during selection – and its implementation must run in constant time.
HQC’s first-round version used a BCH decoder with a running time that correlated with the weight of the error it happened to be correcting. Guillaume Wafo-Tapa and colleagues turned that leak into a practical chosen-ciphertext timing attack in 2019. The third-round redesign replaced BCH with the Reed-Muller and Reed-Solomon combination, and side-channel researchers duly followed it there. Constant-time decoding isn’t an optimization anyone gets to defer.
So within one NIST-selected algorithm we have a decoder that must succeed reliably and secretly, together with a decoding problem that must remain unsolvable. Anyone building a cryptographic inventory that records algorithm properties will meet both on the same line item.
Reconciliation
Quantum key distribution ends in classical post-processing, one stage of which corrects the disagreements between Alice’s and Bob’s raw bit strings. Gilles Brassard and Louis Salvail’s Cascade protocol, from EUROCRYPT ’93, remains in wide use and under active benchmarking thirty-three years later, alongside low-density parity-check (LDPC) and polar-code alternatives that trade interactivity for computation.
Cascade is a quantum key distribution reconciliation protocol from 1993. Cascade is also the Harvard neural decoder for qLDPC codes from 2026. Both are called decoders and both are named Cascade, although they have no relationship of any kind – my favorite collision in the whole taxonomy.
Decoders in Machine Learning
The decoder half of an encoder-decoder architecture, the decoder-only transformer, the decoder of an autoencoder: left alone, this usage stays in its own literature and bothers nobody. It stops staying there the moment someone points a model at error correction. A 2023 preprint by Hanyan Cao and colleagues is titled qecGPT: decoding Quantum Error-correcting Codes with Generative Pre-trained Transformers. “Decoding” there is the error-correction sense; the second hides inside GPT, a decoder-only architecture. The title contains both meanings and spells out only one of them.
Near Misses
The readout discriminator maps the analog signal from a measurement to a zero or a one. Practitioners usually call it a discriminator or a state classifier, occasionally a decoder; the soft-information decoders in the first family consume the likelihoods derived from it instead of its hard decision. Estimators in quantum sensing map measurement records to a physical parameter, and papers sometimes call that mapping a decoder as well.
qLDPC codes took both their name and half their algorithms from classical channel coding. Belief propagation decodes classical LDPC in a phone modem and quantum LDPC in a fault-tolerant computer, an inheritance nobody arrived at by accident – though the two remain different jobs with different failure modes.
Five Questions for Any Decoder Number
Which kind of decoder is it? Syndrome data in, a logical inference out, against a hardware clock is the only answer that touches Q-Day.
What noise model? Code-capacity, phenomenological and circuit-level noise produce numbers that differ by orders of magnitude for the same decoder, of which circuit-level is the deployment-relevant one. A logical error rate quoted without its noise model is comparable to nothing.
Latency defined how? The Ankaa-2 paper from Riverlane and Rigetti reports mean decoding of 0.44 to 0.79 microseconds per round in its stability experiment. It also reports a full decoding response time of 9.6 microseconds in a separate fast-feedback experiment over nine rounds, of which 6.5 microseconds is decoding and 3.1 is communication and control. Both numbers are honest, and they answer different questions, because per-round throughput, full response time and amortized-over-a-batch share one word and measure three different things.
What code, at what distance? Real-time decoding at distance 3 and real-time decoding at distance 25 are separated by most of the engineering that remains. QpiAI reported roughly 1.5 microseconds end to end on a 64-qubit processor in March 2026 – at distance 5, in a company announcement that no paper has followed. Without the distance and the source type we cannot say what the number means.
Mean, or the whole distribution? Mean latency is the number vendors publish, and it isn’t sufficient on its own. What decides whether the machine keeps computing is sustained throughput against the syndrome rate, how fat the tail is, and whether the architecture buffers the outliers. The Ankaa-2 data shows a minority of runs crossing the one-microsecond line, and those runs decode worse. Ask for the distribution.
Four of those five apply only to the first family. That is why the first one comes first.
What the Filter Is For
An’s recovery hierarchy is a legitimate contribution to the study of many-body dynamics, the syndrome decoding problem is the security basis of a NIST-selected key-encapsulation mechanism, and learned architectures now supply some of the most accurate syndrome decoders in existence. Every one of these decoders matters to somebody, and several of them matter to me. Nothing above argues otherwise.
If we are estimating when quantum computers break RSA, though, only the first family counts as evidence; the other three are noise wearing the same label. The Quantum Zeitgeist anchor tag was a small slip in a news write-up. The same slip in a risk assessment credits a timeline with progress from three fields that have no bearing on it, and the first of the five questions is the one that catches it.
