Every Headline RSA-2048 Estimate Assumes Qubits That Work. A Sydney Team Measured What Happens When They Don’t.

IBM’s calibration data for June 2026 put the median two-qubit gate error on ibm_miami, the first processor in its 120-qubit Nighthawk family, at 2.83 × 10^-3. The worst couplers on the same chip had error rates up to 1.69 × 10^-1, about sixty times higher. When a team led from the University of Sydney tried to lay a standard distance-5 rotated surface code onto the device, they found they could not place one without using a component they had already flagged as defective.

Chips like this one are what quantum computers will actually be built from, and the resource estimates behind today’s public qubit targets assume something much cleaner.

In 2025, Craig Gidney of Google Quantum AI estimated that a quantum computer with fewer than a million noisy qubits could factor RSA-2048 in under a week. Gidney states his assumptions in the abstract, and one of them is a square grid of qubits with nearest-neighbour connections and a uniform gate error rate of 0.1%. In that model every qubit and every coupler works, and they all work equally well. The 2019 estimate he published with Martin Ekerå, at 20 million qubits and eight hours, made the same assumption.

Every headline estimate of what it takes to break RSA-2048 counts the qubits that work, and no one has costed the ones that don’t. The Sydney paper, posted to arXiv in July, is a direct hardware measurement of what defective components do to a surface code and of how much of that damage can be designed around.

Removing the defective components from the circuit lowered the logical error rate by up to a factor of 2.8 and restored error suppression in an experiment that stands in for logic operations. Even so, the larger distance-5 code outperformed a smaller distance-3 code placed on a clean corner of the chip only after the team discarded runs affected by leakage, and only in one of the two bases tested. My reading is that headline qubit counts should be treated as lower bounds. They count working qubits only, and nobody has yet published how many would have to be fabricated to supply them.

The Sydney experiment on IBM’s Nighthawk processor

The paper is arXiv:2607.12118, posted on July 13, 2026. Seven of its nine authors are at the University of Sydney: Julien Drouet, Xanda Kolesnikow, Campbell McLauchlan, Georgia Nixon, Dominic Williamson, Stephen Bartlett and Robin Harper. The other two are Seok-Hyung Lee of Sungkyunkwan University and Benjamin Brown of IBM Quantum. Funding came through the Intelligence Advanced Research Projects Activity (IARPA) and its Entangled Logical Qubits program. The team ran its experiments over IBM’s standard cloud service, and Brown is the only IBM author. I’d describe it as independent work on IBM hardware with one IBM contributor.

ibm_miami is the first Nighthawk-family processor IBM released. IBM’s hardware page describes it as 120 programmable qubits on a square lattice, with each qubit connected to up to four neighbours through 218 tunable couplers.

A surface code protects one logical qubit with a patch of physical qubits laid out on a lattice like this one. Data qubits store the encoded information. Measure qubits placed between them repeatedly check the parity of their neighbours to detect errors.

The size of the patch is described by its code distance, the smallest number of physical errors that can combine into a logical error. In its standard rotated form, a distance-3 code uses 17 physical qubits and a distance-5 code uses 49. On hardware that is good enough (what the field calls operating below threshold), the larger patch should produce fewer logical errors. A distance-5 code that fails to beat a distance-3 code on the same chip is a sign that adding qubits is not yet reducing errors.

Drouet and colleagues first had to decide which components counted as defective, and their thresholds are useful to anyone reading vendor specification sheets. They flagged a coupler as underperforming if its error rate exceeded 5% or if the day’s calibration data had no entry for it. A measure qubit was treated as underperforming above an error rate of 7 × 10⁻². A data qubit counted as defective when both its relaxation time and its dephasing time fell below 80 microseconds, against device medians of 335 and 256 microseconds.

A qubit flagged this way still responds when addressed, but it gives wrong results often enough to disrupt the code around it. That kind of fault is harder to spot in a headline figure than a dead qubit. In their discussion, the authors note that theory papers usually model a defect as a qubit that cannot be addressed at all. On this device, many of the flagged components were functional but ran at several times the average error rate.

Defect exclusion results on a 120-qubit chip

The team tested defect exclusion, a technique that removes flagged components from the circuit altogether. Theorists have studied the idea for roughly a decade. When a component is removed, the parity checks that depended on it are merged into a larger check, called a super-stabilizer, that avoids the damaged site. The team measured each super-stabilizer through smaller checks. Those checks don’t commute with each other, so they had to be measured in separate rounds. For couplers and measure qubits, the team adapted ancilla-repurposing circuits from Catherine Leroux and colleagues at AWS. For data qubits, it used merged-stabilizer constructions from earlier theory work by Auger et al. and by Strikis et al.

Memory experiment results

A memory experiment stores a logical qubit and measures how quickly errors accumulate in it. The team compared four strategies in the Pauli-Z basis, all decoded with BeliefMatching, a standard decoder that combines belief propagation with matching:

• Unmodified circuit, decoder unaware of the defects: 4.49% logical error per round
• Unmodified circuit, decoder given the full calibration data: 4.22%
• Circuit modified to exclude the defective couplers: 2.71%
• Circuit also excluding the defective data qubit: 1.62%

From the first line to the last, that is a 2.8× improvement. The comparison I find most useful is between the second and third lines. Giving the decoder full knowledge of the defects improved the error rate by 0.27 percentage points, and redesigning the circuit to avoid them improved it by 1.51. On this chip, knowing where the defects were helped far less than routing the code around them.

In a control run, excluding the defective data qubit alone, without the surrounding couplers, produced no significant improvement. In a second control, the team excluded a healthy coupler as a placebo, and performance got marginally worse, as it should if the method works as claimed.

The gains were uneven across the two bases. In the Pauli-X basis, the same strategies brought the logical error per round down to 2.03% and then 1.89%, a much smaller improvement. The defective couplers in this layout took part only in Z-type stabilizer measurements, and removing the defective data qubit cost the code an entire row, reducing its distance against X-type errors to four. The 2.8× headline figure therefore describes the better of the two bases.

Stability experiment results

A stability experiment is a harder test. A memory experiment only establishes that a logical qubit keeps its information, while a stability experiment checks whether repeated rounds of syndrome extraction converge on a known answer. That kind of repeated readout is what lattice surgery depends on. Lattice surgery is the measurement-based technique a surface-code machine uses for logic operations, merging and splitting code patches and reading the result out of parity checks repeated over many rounds.

The paper reports a suppression factor per round. Values below one mean that extra rounds of checks lower the failure rate. A value of one or more means the checks are adding errors as fast as they correct them.

With defect exclusion, the team measured a suppression factor of 0.94, or 6.3% suppression of the failure rate per round. Without it, the factor was at or above one, so on this device, adding rounds of error correction did nothing until the defective components were removed from the circuit.

In my view, this is the more important of the two results for anyone assessing hardware. Below-threshold behaviour in a memory experiment is the milestone most announcements report. Below-threshold behaviour in a stability experiment is closer to what a machine needs in order to compute, and on this chip it went from absent to present by changing which components the circuit used.

Leakage, post-selection and other limits of the result

Some summaries of the paper say that defect exclusion allowed a distance-5 surface code to beat a distance-3 code. That is only true under one specific condition.

In the main memory experiment, the defect-excluded distance-5 code reached logical error rates below 2% in both bases. The authors describe that as approaching, but not beating, the best distance-3 code. That distance-3 patch used no defective components, and a code that small can be placed on a clean corner of a damaged chip. Even with the defects removed, the larger code still performed worse than the smaller one.

The distance-5 code came out ahead only after leakage post-selection. Transmon qubits sometimes leak out of the two energy levels that store information and into higher ones, and ibm_miami has no mid-circuit reset to bring them back. The team estimated leakage from the raw measurement signal and discarded shots above a 3% leakage-likelihood cutoff. On the remaining data, in the Pauli-Z basis only, the distance-5 code reached 0.98% against 1.26% for the distance-3 code. In the X basis it didn’t beat the distance-3 code.

Post-selection is a useful way to measure what leakage costs, but the authors are explicit that it does not scale. A machine with a million qubits would have to discard an impractical share of its runs. A team trying to scale this approach would need hardware that can reset a leaked qubit mid-circuit, and ibm_miami can’t do that.

In an appendix, the team reports that performing a mid-circuit measurement on certain qubits added noise to many other qubits on the chip, strongly enough that they restricted measure qubits to positions that avoided the effect. IBM classifies ibm_miami as an exploratory quantum processing unit (QPU), and its release notes acknowledge that mid-circuit measurement quality is limited. The crosstalk is therefore most likely a property of this machine, and a device with cleaner mid-circuit measurement should achieve lower error rates than the ones reported here.

A second Australian group reported compatible results eleven days earlier. Younghun Kim, Spiro Gicev, Martin Sevior and Muhammad Usman, of the University of Melbourne and CSIRO’s Data61, ran a reset-free version of LUCI, a defect-avoidance framework developed at Google, on IBM hardware (arXiv:2607.01887). They found it remained competitive with the standard rotated surface code while nearly halving the syndrome density in time. Both groups, using different frameworks and protocols, concluded that on real chips the circuit has to be designed around the defects.

Yield economics and chip binning

Cécile Perrault, Executive Director of the European Quantum Industry Consortium (QuIC), made the commercial argument that sent me back to this paper, and she made it well. A manufacturer pays to fabricate every chip, including the ones it scraps, so the cost of each machine depends on what fraction of production is good enough to ship. What counts as good enough isn’t decided by the fab. It is decided by the error-correcting code and the decoder the chip will run, and a code that tolerates more defects turns rejected chips into shippable product.

Her examples come from conventional semiconductors, where manufacturers faced the same problem decades ago. Intel sells processors with a disabled core as cheaper parts, and DRAM makers build spare rows into memory chips and use fuses to switch them in for defective ones. Those industries scaled with yields well below 100% by designing products that no longer needed perfect chips. As Cécile puts it, binning is the business model, not a manufacturing failure.

The yield figures that usually accompany this argument come from a simulation published nearly a decade ago. They say a large machine can be built with 95% of its qubits working but not with 80%, however many chips the manufacturer discards. Shota Nagayama and colleagues posted the work in 2016 as arXiv:1607.00627, and it was published the following year in New Journal of Physics.

The same paper includes an intermediate result that is rarely quoted: 90% yield also works, provided the manufacturer discards the badly fabricated chips. Nagayama’s team had in effect described chip binning for quantum hardware long before any company needed it, and the yield thresholds quoted in commercial arguments today still come from that simulation.

Which recent manufacturing deals this result applies to

Three recent hardware deals have been described as bets on yield, including in Cécile’s post:

• IonQ closed its $1.8 billion acquisition of SkyWater, a US semiconductor foundry, on July 31, after announcing it in January. The Federal Trade Commission split one to one on whether to impose conditions, and the deal closed without them.
• IQM, the Finnish maker of superconducting quantum computers, confirmed in its first-half results on August 4 that it has invested over €40 million in doubling the cleanroom capacity of its fab in Espoo, with the aim of producing up to 30 full-stack systems a year.
• Quantinuum and Quanta Computer, the Taiwanese electronics manufacturer, signed a co-development agreement on August 13 to industrialize the hardware infrastructure for future Quantinuum machines.

Each deal is a bet on manufacturing, and in the broad sense Cécile describes, each depends on yield. Only IQM’s depends on the kind of yield this paper measures.

IonQ and Quantinuum both build trapped-ion machines, in which the qubits are individual atoms held in electromagnetic fields. The atoms are identical by physics, so the qubits themselves have no fabrication tolerance. The chip in a trapped-ion system is the trap, built from electrodes, integrated optics and packaging. A defect in the trap degrades or disables a zone, and that is a different failure from a transmon that came out of the fab with a relaxation time below 10 microseconds, against a device median of 335.

Defect exclusion in a stabilizer lattice is not what IonQ bought with SkyWater, or what Quantinuum is getting from Quanta. For them, yield means working traps, optics and packaging. IQM builds superconducting processors on the same physical basis as Nighthawk, so the paper’s findings apply to IQM directly.

The word “yield” means one thing on a transmon lattice and something different in an ion trap, and vendor comparisons often treat the two as one.

The yield term missing from CRQC resource estimates

What Gidney and Pinnacle assume

Three estimates set most of the public qubit targets for breaking RSA-2048. In 2025, Gidney brought the 20-million-qubit figure he and Ekerå published in 2019 down by more than a factor of twenty. Iceberg Quantum’s Pinnacle Architecture claims fewer than 100,000 physical qubits using generalized bicycle codes. All three price a code running on a lattice of nominally identical working qubits, and none of them includes a yield term. The papers estimate algorithmic and error-correction overheads and state their assumptions openly. Readers who treat their qubit counts as hardware targets are reading more into them than the papers claim.

Neutral-atom estimates put the requirement in the low tens of thousands of qubits, and they face a different version of the problem. As with ions, the atoms are identical, and the losses come from loading the arrays and from atoms escaping during a computation. Whether those estimates account for atom loss is a separate question, and I haven’t assessed it here.

For superconducting hardware, the gap between fabricated and usable qubits is not a small correction. Papers on defect-adaptive codes commonly model current transmon technology at about 2% defective qubits. That figure circulates as a simulation parameter, and I haven’t found a published measured yield for a production fleet.

A defective component corrupts every parity check it takes part in. That does far more harm than removing one qubit from the count would. On a square lattice, each data qubit takes part in up to four checks. The decoder then receives noise where it expects signal. A larger code contains more checks and therefore more exposure, so scaling up makes the problem worse until someone redesigns the code around the defects.

A more accurate reading of “under a million physical qubits” is therefore under a million working physical qubits, arranged in a way that still lets a defect-tolerant code be built from them, on a machine with enough yield to keep the code distance at the value the designer intended. Nobody has published how many fabricated qubits that would take. Until someone does, every headline qubit count is a lower bound on the hardware required.

Why qLDPC codes are more exposed to defects

The obvious way around this would be to switch from surface codes to quantum low-density parity-check (qLDPC) codes, which encode far more logical qubits in a given number of physical ones and cut headline requirements by an order of magnitude. On yield, however, qLDPC codes are likely to fare worse, for a structural reason. Surface-code checks are local. That locality makes it possible to reroute around a damaged patch, and it is part of the reason surface codes tolerate defects. In a qLDPC code with nonlocal checks, a single defective qubit or coupler takes part in checks spread across the chip, and there is no equivalent local repair.

I have written before that qLDPC codes are generally less tolerant of qubit loss than surface codes. This paper provides hardware evidence for the surface-code side of that comparison. The qLDPC side is still theoretical, and the architectures claiming the lowest qubit counts are the ones most exposed to defects.

What this means for manufacturability (Capability E.1)

My CRQC Quantum Capability Framework breaks the path to a cryptographically relevant quantum computer into nine core capabilities covering the physics and the algorithms, plus one cross-cutting capability that applies to all of them. That capability is E.1, Engineering Scale and Manufacturability. E.1 has been the least mature dimension since I first published the framework, and module yield has been at the top of its list of open questions from the start.

E.1 assessments so far have relied on roadmaps, fab announcements and the semiconductor analogy. The field had simulations but few measurements. Drouet and colleagues provide a measurement, on 120 qubits, on one machine, on specific days in May and June 2026. It is a small sample from a single device, but it comes from hardware.

I would put three questions to any vendor with a superconducting roadmap:

1. What are your defect thresholds, and what fraction of components on a shipped device falls outside them?
2. Does your quoted logical error rate come from a code placed on a clean region of the chip, or from one spanning the whole device?
3. Does the machine support mid-circuit reset? Without it, leakage mitigation depends on discarding runs, and that works in a paper but not at scale.

None of the three appears on the specification sheets I have seen.

Progress on E.1 is unlikely to come from fabs alone. On this chip, below-threshold operation depended on the code and the circuit as much as on fabrication, so manufacturers will need to co-design codes, decoders and fabrication processes. That work is slower and less visible than a new wafer size or a cleanroom opening, and I would not expect many press releases about it.

What would change my assessment

This paper doesn’t alter my estimate of when a CRQC is likely to arrive, and it gives no one a reason to reschedule a PQC migration. It does affect how I read the qubit counts that appear in arguments about CRQC timelines.

Two results would move my assessment of E.1. The first would be a resource estimate that publishes a yield assumption alongside its gate error rate, so that its physical qubit count becomes something a fab can be held to. The second would be a defect-excluded code beating a smaller clean code on the same device without post-selection. This paper came close to that demonstration but didn’t deliver it.

Until then, we know roughly how many working qubits a CRQC would need, but not how many would have to be built to get them.