Quantum Computing for Cybersecurity Professionals

Part 6: Correlations Without a Mechanism

(Updated: July 2026)

This is Part 6 of Quantum Computing for Cybersecurity Professionals, an 11-part series that builds quantum computing from the ground up for security and IT professionals who know classical crypto but have no physics background. No lies-to-children, no hype, every claim checkable with arithmetic. Read the full series online or download the free ebook.

In May 1935, Albert Einstein, Boris Podolsky, and Nathan Rosen published four pages in Physical Review arguing that quantum mechanics, whatever its successes, had to be incomplete. Their exhibit was a pair of particles prepared so that measuring one appeared to settle the other, instantly, at any distance. Surely, they argued, the answers were fixed all along, and the theory was simply blind to the ledger. Einstein later compressed the objection into the phrase that has sold a million bad headlines: spooky action at a distance.

The argument ran for eighty-seven years. It became arithmetic in 1964, laboratory data in the 1980s, was settled loophole-free in a Delft basement in 2015, and collected the Nobel Prize in 2022. The disputed phenomenon is entanglement, and you are already holding the disputed object: Part 5‘s failed copier manufactured it, two qubits described by $$(1/\sqrt{2},\ 0,\ 0,\ 1/\sqrt{2})$$, agreeing forever, disagreeing never. This part defines what that state is, grants Einstein’s instinct its strongest modern form, breaks it with arithmetic you can check at your desk, and closes the file on the last myth standing: that entanglement lets qubits communicate.

The state the copier left behind

Start with what the four numbers say. The state puts amplitude $$1/\sqrt{2}$$ on the string 00, the same on 11, and exactly zero on 01 and 10. Measure both qubits, anywhere, any time, and the Born rule pays out 00 half the time, 11 the other half, and a disagreement never. Separate the qubits by a corridor, a continent, or 1.3 kilometers of Dutch campus, and the agreement holds. So far, striking but not yet strange; correlated randomness is an old story.

The strangeness is in what the state refuses to be. Two independent qubits, one holding the pair $$(a_0, a_1)$$ and the other $$(b_0, b_1)$$, have a joint description you can always build by multiplication: the amplitude of each string is the product of its parts. Run that requirement against our state and it fails in four lines; the arithmetic box below has them. No assignment of individual pairs multiplies out to $$(1/\sqrt{2}, 0, 0, 1/\sqrt{2})$$. That is the definition, and it deserves stating in full: a joint state is entangled when it cannot be factored into separate descriptions of its parts. The pair has an amplitude description. Neither member has one of its own.

Sit with that sentence, because nothing in classical engineering prepares you for it. Every distributed system you have ever operated is exactly the sum of its node states plus correlations you could log. Here, the complete description of the whole exists, is four numbers long, and contains no page for either half. Ask what qubit A alone is doing and the honest answer is a shrug wearing mathematics. Physics does hand you a local description, but it is a statistical one, a fair coin in every direction you can measure, carrying none of the correlation. The amplitude pair, the thing this series has used to describe a qubit since Part 3, simply does not exist for either half.

THE ARITHMETIC: The factorization test.

Suppose the state did factor: qubit A carries $$(a_0, a_1)$$, qubit B carries $$(b_0, b_1)$$, and joint amplitudes are products. Matching our state requires four equations: $$a_0 b_0 = 1/\sqrt{2}$$, $$a_0 b_1 = 0$$, $$a_1 b_0 = 0$$, $$a_1 b_1 = 1/\sqrt{2}$$.

Take the second equation. A product is zero only if a factor is zero, so $$a_0 = 0$$ or $$b_1 = 0$$. If $$a_0 = 0$$, the first equation reads $$0 = 1/\sqrt{2}$$. If $$b_1 = 0$$, the fourth reads $$0 = 1/\sqrt{2}$$. Both branches contradict. No factorization exists, for this state or for anything within reach of it. Four lines, one shrug, and a new kind of object.

The gloves objection

Your instinct has an answer ready, and it deserves the floor, because it is Einstein’s answer. Take a pair of gloves, seal the left in one box and the right in another, ship one to Geneva and one to Singapore. Open either box and you know, instantly, at any distance, what the other contains. No spookiness, no signal, no physics beyond a shared past: the answers were fixed at the source, and “instantly” describes your bookkeeping, never the gloves. John Bell himself liked to make the point with a colleague’s famously mismatched socks: see one pink sock, deduce the other, alert no journalists.

Now be precise about what the gloves model claims for our qubits. At the source, the pair flips one coin and writes the result into both qubits: both carry 0, or both carry 1. Every measurement then reads a pre-written answer. Run this model against everything in the previous section and it passes in full. Perfect agreement: reproduced. Fifty-fifty marginals: reproduced. Distance-proof correlation: trivially reproduced, the way your two backup tapes agree without a network between them. The factorization failure does not rescue us either, since the gloves model was never a pair of amplitude pairs to begin with; it is Part 2’s picture, definite values plus shared history, and Part 4 killed that picture for one qubit’s interference, never for two qubits’ correlations.

Honesty first, as always in this series: for every experiment described so far, the gloves win. If entanglement only ever produced agreement on one fixed question, Einstein would be right, the state would be a fancy ledger, and this article would end here. So far, the gloves win.

Bell’s arithmetic at 120 degrees

What John Bell saw in 1964, in a paper physics took years to notice, is that the gloves model signs a contract it cannot keep once the qubits can be asked more than one question. The upgrade costs nothing we do not own. Part 3 measured every qubit against one fixed question; a rotated question is available inside the same real-number arithmetic, and measuring at angle $$\theta$$ means comparing the state against the tilted pair $$(\cos\theta, \sin\theta)$$. One imported fact, derivable in four lines from the linearity you already use: measure the two halves of our state at angles $$\alpha$$ and $$\beta$$, and they agree with probability $$\cos^2(\alpha – \beta)$$. Same angle, agreement always, matching everything above. The correlation cares only about the difference between the questions.

Bell’s move, in the three-question form David Mermin later popularized, is to allow each side three questions and force the recipe to commit. The arithmetic box runs it in full, and the totals are these. The qubits, asked two different questions, agree one time in four. Any conceivable pre-written recipe, asked two different questions, agrees at least one time in three. A third against a quarter. The gap is small, unforgiving, and measured.

Laboratories spent three decades closing the escape hatches, from the Paris experiments of the early 1980s to the loophole-free test at Delft in 2015, which violated the bound with entangled electron spins 1.3 kilometers apart, far enough that no light-speed signal could coordinate the answers. The 2022 Nobel Prize went to Aspect, Clauser, and Zeilinger for that experimental program. Einstein’s instinct, given every courtesy and fifty years of engineering, loses to the pigeonhole principle. The recipe model is dead.

THE ARITHMETIC: One-third versus one-quarter.

Three questions, at angles 0°, 120°, and 240°. Geneva and Singapore each pick one at random for every entangled pair and log the answers.

The quantum tally for different questions: the angle difference is 120° or 240°, and $$\cos^2(120°) = (-1/2)^2 = 1/4$$, same for 240°. Agreement rate: one in four.

The recipe’s best effort. To reproduce the observed perfect agreement whenever the questions match, both qubits must leave the source carrying identical pre-written answers to all three questions: a shared triple, like (0, 1, 1). Now the pigeonhole: a triple has three entries and only two possible values, so some two entries are equal, meaning at least one of the three question-pairs agrees in advance. Check the cases yourself. The triples 000 and 111 agree on all three pairs. Every mixed triple, like (0, 1, 1), agrees on exactly one pair of the three. There is no third kind of triple. So when two different questions are chosen at random, pre-written answers agree with probability at least $$1/3$$.

Floor for any recipe: one in three. Measured rate: one in four. You cannot write a recipe that loses to its own pigeonhole, and nature does. (The $$\cos^2$$ correlation is the one fact imported here on credit; it follows from Part 3’s rules in four lines, and every published Bell test is, in effect, the universe grading that homework.)

WHERE THIS BREAKS: The gloves, retired with honors.

The gloves analogy is the correct teaching tool for what entanglement is not, which is why this article leaned on it, and it must be retired the moment the 120-degree data arrives. Gloves are Part 2’s world: definite properties, fixed at the source, revealed on inspection. Bell’s arithmetic shows the qubits’ correlations exceed what any such ledger can produce, so the one thing the analogy exists to suggest, answers written in advance, is the one thing the experiment excludes. Real tests carry real fine print: detector efficiency, timing, and locality loopholes occupied experimentalists for decades, which is exactly why the 2015 loophole-free results, and the Nobel that followed, closed an argument rather than a seminar.

MYTH AUTOPSY: “Entangled qubits communicate.”

The correlation is real, instantaneous-looking, and distance-proof, so the myth writes itself: measure here, affect there, message sent. It fails on arithmetic you can now do in one line. Whatever angle Geneva chooses, and whether Geneva measures at all, Singapore’s local statistics never move: add the joint outcomes that leave Singapore reading 0 and you get $$\cos^2(\alpha-\beta)/2 + \sin^2(\alpha-\beta)/2 = 1/2$$, for every $$\alpha$$ on the dial. Singapore sees a fair coin before, during, and after anything Geneva does. No experiment on one side detects the other side’s choice, which means no channel, no bandwidth, no bit.

The second failure is about control. Even granting the correlation, nobody chooses their outcome; Geneva gets a Born-random answer and so does Singapore, and you cannot encode a message in a value you do not select. The agreement is only visible when the two logs meet, and the logs travel by classical means, at light speed or slower. Quantum teleportation, despite the branding, pays the same toll: moving one qubit’s state consumes one entangled pair and requires sending two ordinary classical bits, so nothing outruns light there either. Relativity files no complaint.

Say instead: entangled qubits are correlated in ways no pre-shared classical recipe can reproduce; nothing travels between them.

What entanglement is actually for

Strip the mysticism and entanglement is a resource with a job description. Inside a quantum computer it is the fuel: two-qubit gates create it, and a computation that never entangles anything can be simulated cheaply on the laptop you already own, which means the exponential workspace of Part 5 only opens for algorithms that entangle at scale. The register states inside Shor’s algorithm are entangled beyond any classical bookkeeping, and that is a requirement, never a side effect.

Entanglement also enforces the strangest access-control property in your future stack: monogamy. If two qubits are maximally entangled with each other, physics forbids either from being entangled with anything else; there is no BCC on a Bell pair. That exclusivity is why entanglement-based key distribution can promise eavesdropper detection with a straight face, and why a measured Bell violation can certify that randomness is fresh and unshared even when the hardware vendor is untrusted. Verification by physics rather than by attestation: your audit instincts should be circling that sentence.

And the same resource, pointed the wrong way, is the machine’s failure mode. A qubit that entangles with a stray photon, a phonon, a fluctuating field, has formed a Bell-flavored bond with something nobody controls, and its interference dies exactly as Part 4’s which-path test predicted. Under its proper name, decoherence, this is Part 10‘s central villain. Fuel one way, failure the other.

ATTACKER’S-EYE VIEW: No exploit in the correlation.

Clear the fantasy first, because it is sold in real rooms: there is no covert FTL channel here, no undetectable comms layer, no “quantum radio.” No-signaling is an arithmetic identity, so any pitch involving instantaneous communication through entanglement, and such pitches exist at the confluence of defense budgets and physics envy, fails at the marginal-probability line above. File under Part 1’s rule: ask at what, exactly.

The real security content runs the other way. Monogamy makes entanglement the one resource whose exclusivity is enforced by physics: an eavesdropper who entangles with a distributed pair necessarily degrades the pair’s Bell score, so the security test and the physics test are the same number. That is the engine of entanglement-based QKD, of which the E91-family protocols are the commercial descendants, and of device-independent randomness, where a Bell violation certifies fresh entropy even from a box you refuse to trust. I consider Bell-certified randomness the most under-appreciated security primitive of the coming decade, precisely because it moves a root-of-trust question from the vendor’s documentation into the universe’s arithmetic.

And for the defender of quantum systems, the villain has a face now: decoherence is uninvited entanglement, the environment forming Bell-flavored bonds with your register at gigahertz rates. Every shield, filter, and millikelvin in Part 10 exists to stop the universe from doing to your computer what Bell did to Einstein.

What to remember

Entanglement is a joint state that cannot be factored into individual descriptions; the pair has four amplitudes, and neither member has two of its own. The gloves model, shared answers fixed at the source, reproduces the easy correlations perfectly and deserves the respect of a precise statement, because Bell turned precisely that statement into arithmetic. Asked three questions at 120-degree spacing, any pre-written recipe agrees at least one time in three by pigeonhole, the qubits agree one time in four by the Born rule, and loophole-free experiments side with the qubits. Nothing communicates: local statistics never move, outcomes cannot be chosen, and the correlation exists only in logs that travel classically. In the machine, entanglement is fuel, monogamy is access control, and the same bond formed with the environment is the failure mode called decoherence.

Next, in Part 7, “The Shape of a Quantum Algorithm”: everything is finally on the table: amplitudes, interference, a vast state, a narrow door, and entanglement to bind them. Part 7 assembles the pieces into the only recipe that works, prepare, imprint, interfere, measure, and shows why the machine that does everything at once is useless until a problem’s structure determines which outcomes cancel.

Marin Ivezic

I am the Founder of Applied Quantum (AppliedQuantum.com), a research-driven consulting firm empowering organizations to seize quantum opportunities and proactively defend against quantum threats. A former quantum entrepreneur, I’ve previously served as a Fortune Global 500 CISO, CTO, Big 4 partner, and leader at Accenture and IBM. Throughout my career, I’ve specialized in managing emerging tech risks, building and leading innovation labs focused on quantum security, AI security, and cyber-kinetic risks for global corporations, governments, and defense agencies. I regularly share insights on quantum technologies and emerging-tech cybersecurity at PostQuantum.com.