Tim Palmer, an emeritus professor at the University of Oxford who was elected to the U.S. National Academy of Sciences in 2020, proposed in a paper published in PNAS in March 2026 that no quantum computer can use more than a limited number of qubits to full effect. In the paper’s abstract, he put that limit at about 200 to 400 qubits for current technologies and wrote that it “will never exceed 1,000.”
Palmer also wrote that his theory and standard quantum mechanics are “experimentally indistinguishable for small numbers of qubits.” He wrote that the breakdown he predicts could be tested in less than five years.
Security teams have no reason to delay post-quantum migration because of Palmer’s ceiling, an untested prediction of new physics. Even at his upper bound of 1,000, an 835-logical-qubit circuit for breaking 256-bit elliptic-curve keys, described in a July 2026 preprint, would fit under the ceiling.
What Palmer proposed
Palmer calls his framework Rational Quantum Mechanics, or RaQM. In standard quantum mechanics, the state of a group of qubits is a point in Hilbert space, the mathematical space of every state they can take. The numbers that locate that point can take any real value. Palmer proposed that this continuum is an idealization.
In RaQM, the Schrödinger equation, which describes how quantum states change, “is not modified,” Palmer wrote. Instead, the bases in which a state is defined “must satisfy certain rational-number constraints.”
His prediction concerns algorithms that, like Shor’s algorithm for factoring the large numbers behind RSA keys, require bases “with maximal N-qubit superposition/entanglement.” Superposition combines several possibilities in one state. Entanglement links qubits so that their joint state cannot be described one qubit at a time.
Palmer derived from those constraints a finite information capacity. For a state of N qubits, he counted 2ᴺ⁺¹ − 2 continuous degrees of freedom, a number that doubles with each added qubit, reaching about 2 million at 20 qubits and more than 10⁶⁰ at 200. The information available to describe the state grows only in proportion to N. Above a count he calls Nmax, he wrote, “there is insufficient information in the N qubits” to give even one bit to each of those degrees of freedom.
Palmer proposed that gravity causes the discretization. Standard quantum mechanics is then the limit of RaQM in which the gravitational constant is zero, he wrote. To put numbers on the idea, he used the Diósi–Penrose model, in which gravity limits how long a superposition of different arrangements of mass can last.
From that model, he estimated Nmax at about 200 for quantum-dot qubits, about 300 for infrared photons, and about 400 for trapped ions. He derived the ceiling of 1,000 from an extreme case. In it, a photon with a wavelength of about 10²⁵ meters, which he tied to the age of the universe, is held in superposition over one Planck length, about 10⁻³⁵ meters. He wrote that this bound “does not change the more a quantum system is shielded from its non-gravitational environment.”
In Palmer’s figures, Nmax is close to the base-2 logarithm of L, which he called “a fundamental variable of RaQM describing the degree of granularity of Hilbert Space.” Because Nmax grows only with that logarithm, even his most extreme value of L, about 10²⁹⁸, corresponds to a ceiling near 1,000, by Quantum Observer’s check of his numbers.
The physics behind the numbers
Palmer’s estimates depend on extending the Diósi–Penrose model beyond its original setting. He wrote that “the Diósi-Penrose model was developed within a Newtonian gravitational framework” and assumed that it also applies in a post-Newtonian one, an assumption his photon estimates require.
Palmer cited an underground test of gravity-related state reduction, the change of a superposition into a single outcome, and wrote that “no dissipative effects have been observed.” He answered that RaQM “is wholly consistent with a failure to detect the local effects of energy dissipation during measurement,” since his framework does not require dissipation.
Palmer kept the model’s formula for how long a superposition lasts and set aside the dissipation that researchers looked for in the underground test. He pointed to no experiment that checks the formula in the role he gave it.
The test Palmer proposed
Palmer based his argument about RSA on a qubit count from a survey that he cited. In it, Dennis Willsch and colleagues at Forschungszentrum Jülich, a German research center, described an iterative circuit, used in their simulations, that needs one more qubit than the number of bits in the integer it factors. They wrote that circuits compiled for real hardware would need about twice as many qubits as the integer has bits. For a 2,048-bit RSA key, Palmer wrote, the iterative circuit’s 2,049 qubits exceed even his largest conceivable estimate of Nmax.
He concluded in his abstract that “insofar as a classical computer will never factor a 2,048-bit RSA integer, RaQM predicts that a quantum computer will not either.”
Palmer also proposed a test built on the same algorithm. He supposed that, under standard quantum mechanics, a quantum computer could factor RSA-2048 with “some large number” of noisy qubits, “say a million.” He predicted that under RaQM, “the performance of the computer in factoring such an integer will be no better than a classical computer” as the qubit count approaches that number. He called this “a test of RaQM that could be falsified in a few years if quantum technology roadmaps are accurate.”
Palmer added that a quantum computer built on current qubit technology “will already have ceased having an advantage over a classical computer in factoring a 1,024-bit RSA integer.” He also predicted that a well-shielded computer’s output would show a growing, discretized form of shot noise, random scatter in its results, as the qubit count approaches Nmax.
Palmer framed the limit in terms of qubits free of error. In his abstract, he wrote that the advantage of algorithms such as Shor’s “will have saturated at 1,000 perfect qubits.” “Error-correction algorithms can correct for such factors, utilising additional qubits,” he wrote of qubit imperfections and noise. “Hence, RaQM does not predict that the performance of noisy qubits will saturate at 1,000 qubits.”
Oxford’s physics department described his prediction the same way. In its release on the paper, the department wrote that Palmer predicts Shor’s algorithm “will start to fail in this way when a few hundred (error-corrected) qubits are entangled.” On that account, the qubits that count toward his limit are logical qubits, the error-corrected units an algorithm uses, each built from many physical qubits. A machine could hold far more than 1,000 noisy physical qubits and still lose its advantage on Shor’s algorithm.
What experiments have shown
Laboratories have built arrays of more than 1,000 physical qubits. In the experiments described below, no team held those qubits in the kind of state that Palmer’s prediction concerns.
Caltech physicists trapped more than 6,100 atoms in about 12,000 sites and kept them coherent for 12.6 seconds, they reported in Nature in 2025. Researchers at Tsinghua University reported in a June 2026 preprint that they had loaded an average of 11,022 atoms into an array of 18,225 sites, without rearranging them or running qubit operations. A Harvard-led team kept more than 3,000 atoms in a continuously reloaded array for over two hours, in work published in Nature in 2025.
Palmer’s limit concerns states spread across Hilbert space. Atoms stored side by side without entanglement, however many, are no test of it.
In error-correction experiments, researchers entangle hundreds of physical qubits in states confined to small parts of Hilbert space. Dolev Bluvstein and colleagues at Harvard reported in Nature in November 2025 that they had run a surface code below threshold, the physical error rate under which a larger code produces fewer logical errors, in a four-round test on a platform of up to 448 atoms. Quantinuum researchers reported in a February 2026 preprint an entangled state of 94 logical qubits on Helios, a trapped-ion computer with 98 physical qubits, using a code that detects errors without correcting them, as Quantum Observer described in its guide to logical-qubit claims.
That state, known as a GHZ state, is a superposition of just two of the 2⁹⁴ possible readings of 94 qubits, all zeros and all ones. In a code that stores one logical qubit, the physical qubits occupy a space of just two dimensions. Palmer used this reasoning himself for superconductors, whose huge numbers of electrons evolve, he wrote, “in a very small subset of the available Hilbert Space.”
By that criterion, neither experiment tests his ceiling. Both test something he said RaQM allows, the use of codes to protect growing numbers of noisy qubits.
IBM and University of Chicago researchers came closer to Palmer’s criterion with a circuit built to spread its output across many states. In a preprint revised on September 2, they reported sampling a 64-qubit circuit encoded on 76 physical qubits. In the first version, in July, the team used 97 physical qubits, as Quantum Observer reported.
On August 13, Hidetaka Manabe, Hanfeng Gu, and Feng Pan computed the amplitudes for all 2,051 output samples from the July experiment in 37.3 minutes on 256 graphics processors. The three later became co-authors of the revised preprint, in which the team wrote that the computation “does not constitute a classical simulation of the sampling task itself.” In both versions of the experiment, the team used far fewer qubits than Palmer’s lowest estimate of Nmax for any technology, about 200.
Shor’s algorithm itself has been run only on small numbers. In their survey, Willsch and colleagues wrote that digital quantum computers have so far factored only “very small integers,” none larger than 35. They simulated a quantum computer of 40 qubits on 2,048 graphics processors and factored a 39-bit number that way.
A Sandia-led team estimated in September that current processors fall about five orders of magnitude short of the circuit sizes that factoring RSA-2048 requires, as Quantum Observer reported. No experiment described here has tested the range in which Palmer’s theory and standard quantum mechanics disagree.
If the ceiling held
Palmer took his figure of 2,049 error-free qubits from the iterative circuit that Willsch and colleagues simulated. Published attack designs use fewer logical qubits. For RSA-2048, Craig Gidney of Google Quantum AI estimated in a 2025 preprint that his circuit needs 1,399 logical qubits. Clémence Chevignard, Pierre-Alain Fouque, and André Schrottenloher put theirs at 1,730 logical qubits per run, in a paper presented at CRYPTO 2025, so both counts exceed 1,000.
For 256-bit elliptic-curve keys, the counts are lower. Ryan Babbush of Google Quantum AI and co-authors including Dan Boneh of Stanford University put the attack at fewer than 1,200 logical qubits in a March 2026 preprint. Chevignard, Fouque, and Schrottenloher estimated 1,193 logical qubits per run for the P-256 curve, with 22 runs needed, in a paper for EUROCRYPT 2026.
In a July preprint, revised in September, Han Luo, Tongyang Li, and six co-authors reported a complete attack on a 256-bit prime-field curve with 835 logical qubits. They paid for the smaller count with far more Toffoli gates, the costly three-qubit operations in such circuits, than Google’s design uses.
If Palmer’s estimates of 200 to 400 for current technologies are right, every one of these designs exceeds the limit. Under his upper bound of 1,000, the design with 835 logical qubits fits. A security team that relied on the ceiling to protect elliptic-curve keys would need Palmer’s theory to be right and Nmax to stay below about 835 for every future technology. In these comparisons, Nmax is taken as a count of the logical qubits an algorithm uses, the reading Palmer and his department gave. Whether a circuit under the numerical ceiling could run under Palmer’s theory has not been established.
The case for taking the ceiling seriously
Palmer set the limit at 1,000 perfect qubits, so error correction cannot carry an algorithm past it. He defined the states at issue as those in which “superposition/entanglement is maximally distributed across the full 2ᴺ⁺¹ − 2 dimensions of Hilbert Space.” No experiment described here prepared such states near his estimates of Nmax. He also wrote that RaQM is consistent with the underground test’s null result, since his framework does not require the dissipation that researchers looked for.
Palmer made a falsifiable prediction with a date attached and published it in PNAS, thanking “the PNAS reviewers” in his acknowledgments. No experiment described here contradicts RaQM. In each one, the team either used fewer qubits than Palmer’s lowest estimate or prepared states too narrow, by his own criterion, to test it.
Physicists have not settled how gravity and quantum theory fit together. Despite almost a century of study, “it is still unclear how general relativity (GR) and quantum theory (QT) should be unified into a consistent theory,” Richard Howl, Roger Penrose, and Ivette Fuentes wrote in 2019. They proposed testing gravity’s effect on quantum states with a Bose–Einstein condensate, a cloud of atoms cooled until they share one quantum state. Palmer thanked Howl and Penrose for comments on his paper.
Those are good reasons for physicists to run Palmer’s test. They are weak grounds for a security plan that assumes its outcome before anyone has run it.
What security teams should conclude
Security teams should not cite the paper as evidence that RSA-2048 or elliptic-curve keys are safe. Palmer called the breakdown a prediction to be tested. To run the test he proposed, a laboratory would need a machine big enough to break the keys.
On October 27, seven months after Palmer’s paper appeared, NIST published its final transition plan. In it, the agency set 2030 as the year after which RSA and elliptic-curve algorithms are deprecated at every approved key size, and 2035 as the year after which they are disallowed, as Quantum Observer reported. NIST published the replacement standards in August 2024, including ML-KEM, formerly CRYSTALS-Kyber, for key establishment and ML-DSA, formerly CRYSTALS-Dilithium, for signatures.
In September, G7 cybersecurity agencies called on governments and organizations to begin their post-quantum transition as soon as possible. An adversary who records encrypted traffic today can decrypt it whenever a capable machine exists.
If Palmer is right and his ceiling is low enough to rule out every attack circuit, organizations that migrate will have spent money on a threat that never arrives. If he is wrong, or right with a ceiling near his upper bound, organizations that waited will have left recorded traffic and long-term signatures exposed.
What would settle it
To run Palmer’s test, a laboratory needs a machine that performs circuits using the full Hilbert space, as Shor’s algorithm does, on hundreds of logical qubits with low error. IBM has said that its Starling machine will run 100 million operations on 200 logical qubits by 2029, at the bottom of Palmer’s range for current technologies. IBM has also said that Blue Jay, dated “2033+” on its roadmap, will run on 2,000 logical qubits, twice Palmer’s upper bound, as Quantum Observer noted in its ranking of fault-tolerant applications.
A machine of that kind that fell short of standard predictions in a way error correction could not repair, with the discretized noise Palmer described, would give RaQM its first evidence. A fault-tolerant machine that ran such circuits on more than 1,000 logical qubits with results matching standard quantum mechanics would refute it. So would a run of Shor’s algorithm at a size the model rules out, such as the factoring of RSA-2048.
Other physicists have tied similar questions to specific machine sizes. In an April 2026 preprint on probing the Planck scale with quantum computers, Boaz Katz and Shlomi Kotler related logical-qubit counts to how far a computation challenges classical physics. They wrote that “500 logical qubits are sufficient to reject theories confined to a laboratory,” a count above Palmer’s estimates for current technologies.
As of November 12, 2026, Palmer had not revised the preprint of his paper on arXiv since February 15. Until one of those results appears, security teams can treat his ceiling as a hypothesis to watch and keep to NIST’s 2030 and 2035 dates.
An earlier version of this analysis appeared on PostQuantum.com, the author’s own publication, on March 21, 2026. It is republished here with permission and was revised and updated for Quantum Observer in November 2026.
