Quantum Computing for Cybersecurity Professionals

Part 3: Quantum Amplitudes: The One New Rule

(Updated: July 2026)

This is Part 3 of Quantum Computing for Cybersecurity Professionals, an 11-part series that builds quantum computing from the ground up for security and IT professionals who know classical crypto but have no physics background. No lies-to-children, no hype, every claim checkable with arithmetic. Read the full series online or download the free ebook.

In the summer of 1926, with his paper already at the printer, Max Born added a footnote. The paper proposed that the strange new quantum theory predicts probabilities, and that the probability of finding a particle somewhere is given by the size of a quantity called the amplitude. The footnote corrected one word: by the square of the amplitude. Physics has run on that correction ever since. It earned Born the Nobel Prize in 1954, twenty-eight years later, and it will run every quantum computer that ever threatens your cryptography.

It is also the only new rule this article needs. Part 2 described a bit you haven’t seen as a pair of non-negative probabilities summing to one, and put four beliefs about that picture on the record. This article introduces quantum amplitudes by changing that pair in exactly one way, and the change fits in a sentence: the numbers may now be negative. By the end you will know what a qubit’s state actually is, what measurement does and what it costs, why “0 and 1 at the same time” was never right, and where the new physics hides: in a sign that no single measurement can see. One honest warning: nothing in this part disproves your classical instincts. That demolition is scheduled, and it is the next part’s entire job.

From probabilities to quantum amplitudes

Take the pair from Part 2 and relax one constraint. A qubit’s state is a pair of amplitudes, $$(a_0, a_1)$$: real numbers, positive or negative, whose squares sum to one. To predict a measurement, apply Born’s footnote. The outcome is 0 with probability $$a_0^2$$ and 1 with probability $$a_1^2$$. That is the entire rule, in modern dress.

Notice how much of Part 2 carries over untouched. Two numbers describe the qubit. The squares behave exactly like your old probabilities, non-negative and summing to one, because something has to happen. And the state itself is perfectly definite. There is nothing vague about $$(0.6, -0.8)$$; it is as definite as a row in a config file. What the state leaves undetermined is the future: which outcome the next measurement will produce.

A qubit, then, is any physical system with two reliably distinguishable configurations whose behavior demands this bookkeeping: the direction of a current in a superconducting loop, the energy level of a trapped ion, the polarization of a photon. My earlier introduction to qubits for cybersecurity professionals surveys the hardware menagerie, and the engineering is the subject of Part 10. For this series, the qubit is the amplitude pair.

One difference from Part 2 deserves its own paragraph. Probability pairs lived in observers’ heads; the admin and the outsider held different pairs about the same bit, and both were right. The amplitude pair is fixed by the preparation instead. Everyone who knows how the qubit was set writes down the same pair, signs included, which makes it feel less like opinion and more like a dial setting. Whether something definite hides underneath the dial is a fair question, and Part 2’s Belief 1 says your instincts vote yes. Hold that thought. It has an appointment.

THE ARITHMETIC: Born’s rule, by hand.

The state $$(3/5, 4/5)$$ is legal, since $$(3/5)^2 + (4/5)^2 = 9/25 + 16/25 = 1$$. Measure it: you get 0 with probability $$9/25 = 36%$$ and 1 with probability $$16/25 = 64%$$.

The state $$(1/\sqrt{2}, 1/\sqrt{2})$$, where $$1/\sqrt{2} \approx 0.707$$, gives $$1/2$$ and $$1/2$$: a perfect fair coin.

Now the ones that matter. $$(1/\sqrt{2}, -1/\sqrt{2})$$ squares to the same $$1/2$$ and $$1/2$$, because squaring erases the sign. So does $$(-3/5, 4/5)$$ reproduce the statistics of $$(3/5, 4/5)$$. Different states, identical measurement outcomes. Whatever the minus sign is doing, a single measurement cannot see it.

FOR THE RECORD: Real amplitudes are a deliberate simplification.

In full quantum mechanics, amplitudes are complex numbers and the Born rule squares their magnitude. This series uses real amplitudes throughout, because anyone can check a sign by hand and nothing we cover requires more. A complex phase is the grown-up version of a minus sign; every argument you will read here works unchanged in the general theory. Where the difference could ever matter, I will say so.

Measurement, and the price of looking

Here is what measurement does, stated as rules you can hold me to. Measuring a qubit in state $$(a_0, a_1)$$ returns a single classical bit, 0 or 1, with the Born probabilities. Immediately afterward, the qubit’s state is the definite pair matching the outcome: $$(1, 0)$$ if you got 0, $$(0, 1)$$ if you got 1. Measure again and you get the same answer, consistently, forever. The original amplitudes are spent. No further measurement of that qubit recovers them.

Compare that with Part 2’s Belief 4, which said reading updates your numbers and never the bit. The first half still holds; the second half fails outright. Measuring an amplitude pair changes the pair, and the change is violent: whatever information lived in the balance and signs of $$(a_0, a_1)$$ is reduced to one classical bit, with the rest destroyed in the act of asking. How brutally this caps what a register of qubits can tell you is Part 5‘s subject. For now, the accounting for a single qubit is stark enough. One bit out. Everything else gone. Looking, here, is spending.

MYTH AUTOPSY: “Measurement requires a conscious observer.”

None of the definitions above mentioned a mind, and none needs to. A measurement is any interaction that leaves a record of the outcome in something else: a detector’s counter, a log line, a stray photon that bounced off the system and carried the news away, a single air molecule that scattered differently because the outcome was 0 rather than 1. The Geiger counter clicking in an empty lab is measuring. The SIEM writes the log line whether or not an analyst ever reads it. Part 2 taught you the operative word, and it was record, never mind.

The consciousness framing entered through decades of loose popularization, and it adds exactly nothing: no prediction changes, no equation acquires a new term. It is also why this series says measurement and never “observation,” a word that smuggles a watcher into physics that has no seat for one. In Part 10 the record-making runs wild under its proper name, decoherence: the environment measures your qubits constantly, uninvited, which is most of why building this machine is so hard.

Say instead: a measurement is any interaction that leaves a record anywhere. Minds are optional and always were.

What superposition actually says

With the rules on the table, the vocabulary word can finally be defined without mysticism. A superposition is any state with both amplitudes nonzero. $$(3/5, 4/5)$$ is a superposition. So is the fair-coin state $$(1/\sqrt{2}, 1/\sqrt{2})$$. That is the entire definition. It describes one definite mathematical object, two numbers, no fog.

MYTH AUTOPSY: “A qubit is 0 and 1 at the same time.”

The most popular sentence in quantum journalism fails three separate ways. First, it predicts something that has never been seen. If the qubit were both values at once, some measurement somewhere should have caught both; in a century of experiments, every measurement of every qubit has returned exactly one bit. Second, the slogan is blind to the sign. $$(1/\sqrt{2}, 1/\sqrt{2})$$ and $$(1/\sqrt{2}, -1/\sqrt{2})$$ would both be “0 and 1 at once,” yet they are different states that a well-chosen operation treats oppositely; a description with no room for the minus sign has missed the engine of the entire subject. Third, it confuses the description with the value. The state is one definite thing. The value, before measurement, is what does not yet exist; there are two amplitudes, and there are zero values.

Say instead: a qubit holds a weighted combination of 0 and 1, and the weights can cancel.

The other popular framing has earned a stay of execution. “It is really 0 or 1, we just don’t know which” is Part 2’s Belief 1 wearing quantum clothes, and nothing above refutes it. A single qubit, prepared and measured, is indistinguishable from a biased coin; you could model everything above with hidden definite values and secret probabilities, and today’s evidence could not convict you. Your skepticism is earned. Keep it loaded. The next part exists because there is an experiment your model must survive, and it will not.

Two states, one coin

Look again at the pair of states from the arithmetic box: $$(1/\sqrt{2}, 1/\sqrt{2})$$ and $$(1/\sqrt{2}, -1/\sqrt{2})$$. The Born rule squares both into the same fair coin. Prepare either one, measure a million copies, and the two tallies are statistically identical. The sign exists in the description and vanishes in the statistics.

So is the minus sign physics, or is it notation? The theory’s answer is blunt: the two states are as distinguishable, in principle, as 0 and 1, because there exist operations that treat them in opposite ways. To see the difference you must let amplitudes meet other amplitudes, signs intact, before any measurement squares them away. Signed numbers only reveal themselves when they are added, because adding is the one thing squares can’t undo: $$+1/\sqrt{2}$$ and $$-1/\sqrt{2}$$ make zero, and zero is a probability you can notice. The sign needs a collision.

Building the collider takes one operation and four lines of arithmetic, and it produces the device Part 2’s beliefs cannot describe: a coin that randomizes once and un-randomizes twice, with no record anywhere. Signs are invisible until they collide.

ATTACKER’S-EYE VIEW: The end of the silent tap.

Part 2 closed on why passive attacks are silent: classical information reads without disturbance and copies without a trace. The Born rule ends that. Measurement changes the state, so interception acquires a fingerprint; run an intercept-and-resend attack against a BB84-style quantum key exchange and you corrupt roughly 25% of the bits you touch, which the endpoints detect by comparing samples. The entire commercial premise of QKD, from Part 1’s disambiguation sidebar, is selling that fingerprint.

The one-shot rule cuts against the attacker too. A stolen qubit is nothing like a stolen file: one measurement, one bit, and the rest of the state burns. No imaging, no replay, no second pass. And the sign channel should interest anyone who thinks about covert storage: information parked in the signs of amplitudes is invisible to an adversary who only measures, and extracting it requires the interference machinery of the next part, aimed correctly.

The defender’s version of the same fact is sobering. Everything that leaves a record measures, and the universe leaves records promiscuously; a stray photon is an eavesdropper with no agenda. Keeping amplitudes alive means keeping everything’s hands off the qubit, and the bill for that isolation, in Part 10, explains most of the distance between today’s machines and the one that breaks RSA.

What to remember

A qubit’s state is a pair of amplitudes: numbers that behave like probabilities except they can be negative, with squares summing to one. The Born rule turns state into prediction: measurement returns 0 or 1 with probability equal to the squared amplitude, after which the pair is replaced by the definite pair for the outcome, and the original amplitudes are spent. Measurement means any interaction that leaves a record anywhere; minds are optional and always were. Superposition is one definite state whose weights can cancel, never “0 and 1 at the same time,” while the “really definite, just hidden” reading remains standing, for now, on borrowed time. And two states can share identical statistics while differing by a single sign, which only a collision between amplitudes can reveal.

Next, in Part 4, “The Impossible Coin”: we build the collider. One operation, applied twice, will return certainty from a perfect fair coin with no record in existence, and Part 2’s receipt comes due. Bring the four beliefs. Exactly one leaves the room unchanged.

Marin Ivezic

I am the Founder of Applied Quantum (AppliedQuantum.com), a research-driven consulting firm empowering organizations to seize quantum opportunities and proactively defend against quantum threats. A former quantum entrepreneur, I’ve previously served as a Fortune Global 500 CISO, CTO, Big 4 partner, and leader at Accenture and IBM. Throughout my career, I’ve specialized in managing emerging tech risks, building and leading innovation labs focused on quantum security, AI security, and cyber-kinetic risks for global corporations, governments, and defense agencies. I regularly share insights on quantum technologies and emerging-tech cybersecurity at PostQuantum.com.