Researchers and vendors in quantum technology use “decoder” for at least three different jobs. An error-correction decoder works out which errors occurred in a quantum processor from the results of its repeated checks, on hardware that, in fast superconducting machines, must keep pace with checks that arrive every microsecond. A reconciliation decoder in quantum key distribution (QKD) repairs the bits on which two copies of a secret key disagree. A decoder inside an algorithm such as decoded quantum interferometry runs on the qubits themselves as part of a quantum circuit.
Of the jobs called decoding, only real-time error-correction decoding sets the clock rate and qubit cost of today’s fault-tolerant designs. A slow decoder holds up every logical operation that waits for its answer. An inaccurate one makes a machine spend more physical qubits on each logical qubit. A logical qubit is one unit of quantum information spread across many physical qubits, the individual hardware devices, so that errors can be found and corrected.
The three jobs differ in the data decoded, in the machine that does the decoding, and in the deadline it has to meet. Quantum Observer covers the companies that sell the hardware for the error-correction loop and the latency budget for each type of qubit in a companion analysis.
Error-correction decoding
A quantum computer protected by error correction measures small groups of physical qubits over and over with parity checks. Each check reports whether neighboring qubits still agree, without reading the information they store. The results of one round of checks form a syndrome. A decoder reads the stream of syndromes and infers which errors occurred, or at least whether they changed the value of the logical qubit.
Google DeepMind described the job when it introduced AlphaQubit in November 2024. “The decoder preserves quantum information by using these consistency checks to identify errors,” the company wrote. On superconducting processors, the company added, the hardware repeats those checks about a million times a second.
Algorithms
Researchers have built decoders from several families of algorithms, with different trade-offs between accuracy and speed. In the surface code, the most widely demonstrated error-correcting code, a square grid of physical qubits stores one logical qubit. Eric Dennis and three co-authors, including John Preskill, showed in a 2001 paper that the surface code can protect stored information arbitrarily well as it grows, provided the error rate stays below a critical value. A code’s distance is the smallest number of physical errors that can change the stored information without being detected.
Matching decoders pair up flagged checks along the shortest chains of errors that could explain them, a method called minimum-weight perfect matching. Oscar Higgott and Craig Gidney put the speed of their 2023 matching algorithm, Sparse Blossom, in the title of their paper, “correcting a million errors per core second.”
Nicolas Delfosse and Naomi Nickerson designed union-find decoding to run in almost-linear time in the number of physical qubits. Its running time grows only slightly faster than the number of qubits.
In quantum low-density parity-check (qLDPC) codes, one block of physical qubits stores several logical qubits. For these codes, Pavel Panteleev and Gleb Kalachev added post-processing based on ordered-statistics decoding to belief propagation, a message-passing method used to decode classical low-density parity-check (LDPC) codes. They wrote that the post-processing improved the performance of standard belief propagation on many qLDPC codes “by several orders of magnitude.”
IBM researchers later built Relay-BP on belief propagation and titled their 2025 preprint “Improved belief propagation is sufficient for real-time decoding of quantum memory.”
Tensor-network decoders estimate the most likely logical outcome by summing over many possible error patterns. IBM’s Sergey Bravyi and two co-authors described algorithms of this kind for the surface code in 2014.
Google researchers built Tesseract, a decoder that searches for the most likely set of errors behind a syndrome. Its authors wrote that Tesseract is “significantly faster than integer programming-based decoders while retaining comparable accuracy” at moderate physical error rates. Compared with matching decoders, it is slower and more accurate.
Quantinuum’s researchers used Tesseract for their color-code memory result on Helios, reported in an October 2026 preprint, and decoded after the runs had finished. They described Tesseract as generally too slow for real-time use. In the same preprint, they described two neural-network decoders as “capable of real-time decoding” and timed those decoders separately from the machine.
Neural decoders learn the noise of a particular device from data. Google DeepMind reported that AlphaQubit made 6% fewer errors than tensor-network methods and 30% fewer than correlated matching on data from Google’s Sycamore processor. The company also wrote that AlphaQubit was “still too slow to correct errors in a superconducting processor in real time.”
In a December 2025 preprint that has not been peer reviewed, Google DeepMind’s Andrew Senior and 23 co-authors reported a neural decoder fast enough for what they called real-time decoding of the surface code, at under 1 microsecond per cycle on commercial accelerators, up to distance 11. They also reported what they called the first real-time decoding of the color code, at distances up to 9. The team timed the decoder on a Google TPU, a chip designed for machine learning, with simulated data and an imposed clock rate, outside any running control loop. The authors wrote that they were “not measuring the latency involved in the measurement and communication hardware for a real quantum computer.”
Accuracy and qubit count
Practical decoders approximate the best possible answer. Pavithran Iyer and David Poulin showed that optimal decoding of stabilizer codes, the family that includes the surface code, is “computationally much harder than optimal decoding of classical linear codes,” a task that is itself NP-complete. For an NP-complete problem, no efficient algorithm is known, and none exists unless P = NP, a question computer scientists have not settled.
Decoder accuracy affects how many physical qubits a machine needs. In its March 2026 roadmap, Riverlane, a British error-correction company, wrote that, in testing, its Local Clustering Decoder halved the code distance required for MegaQuOp computations from 33 to 17. MegaQuOp is Riverlane’s term for a run of a million reliable operations.
The company put the saving at 75% of the qubit requirement. In a footnote, Riverlane limited the result to superconducting qubits in which leakage, a qubit’s escape from the two states that store information, is the main source of errors.
Throughput and response time
An error-correction decoder works against two deadlines at once. Throughput is the rate at which it processes syndromes. It must at least match the rate at which the hardware produces them.
In a paper posted as a preprint in October 2024 and published in Nature Communications in June 2026, a team of Riverlane and Rigetti researchers wrote that real-time decoding must be scalable and low-latency to avoid a backlog that would slow logical operations exponentially. The team ran its decoder on a field-programmable gate array (FPGA), a chip whose logic can be reconfigured after manufacture, inside the control system of a Rigetti superconducting processor. In an experiment on eight physical qubits, the researchers measured a mean decoding time per round below 1 microsecond.
Response time, or latency, is the delay between the last relevant measurement and the decoder’s answer. In its 2024 Nature paper, Google’s team reported that its real-time decoder kept pace with the 1.1-microsecond cycle of a Willow-generation processor with 72 physical qubits for up to a million cycles at distance 5, with an average latency of 63 microseconds.
Latency limits a machine wherever the next logical step depends on a decoded result. Researchers who estimate the resources for fault-tolerant machines therefore assume a reaction time for the control system, the delay between measuring a logical qubit and acting on the decoded outcome. Craig Gidney of Google Quantum AI assumed “a control system reaction time of 10 microseconds” in a 2025 preprint estimating the resources for factoring a 2048-bit RSA key.
In a separate illustration, Riverlane, citing published estimates, wrote in an April 2026 post that factoring a 2048-bit RSA key could take 8 hours with a 10-microsecond decoding response time. In the same example, the company wrote, “a 100µs response time would slow it down by more than sixfold.” IBM lists real-time decoding among the requirements for Starling, the fault-tolerant computer it plans to deliver in 2029.
Offline, real-time, and streaming decoding
Researchers decode either after an experiment or during it. A team that decodes offline, as Quantinuum’s did for its color-code experiment, uses ordinary computers after the run and learns whether the hardware produced errors that a decoder could correct.
Real-time decoding keeps pace with the machine’s checks and returns each result in time for the operations that depend on it. The corrections can be tracked in software and need not be applied after every round. Computations that last hours or days require streaming decoders, which work through an unbounded flow of syndromes in overlapping windows. Luka Skoric and co-authors described parallel window decoding for that purpose in 2022.
The same algorithm and the same data can support offline, real-time, or streaming claims, depending on when a team decodes. In its guide to logical-qubit announcements, Quantum Observer treats the difference between offline and real-time decoding as one of five tests for a new logical-qubit result.
The hardware that runs decoders
In error correction, “decoder” also means the hardware that runs the algorithm, which builders choose to match the machine’s clock. FPGAs and application-specific integrated circuits (ASICs), chips built for a single task, run with the fixed and predictable timing that fast-cycling machines need.
In an October 2025 preprint, IBM researchers described a prototype FPGA decoder for memory experiments on the gross code, in which 144 physical data qubits store 12 logical qubits. The decoder completed one belief-propagation iteration in 24 nanoseconds. Its authors wrote that this was fast enough for an average decoding time per cycle under 1 microsecond, assuming circuit error probabilities below 3 in 1,000. IBM teams have also used AI coding agents to search for faster FPGA designs of a gross-code decoder, with the gains so far estimated in a design tool and not yet measured on a running chip.
GPUs and CPUs are general-purpose chips that teams can reprogram without designing new logic. For its Willow experiments, Google’s team ran its real-time decoder as software on a workstation, using a specialized version of Sparse Blossom. Google DeepMind’s researchers timed their newer neural decoder on a TPU.
Buyers often meet the hardware and the algorithm together, as one product. The companion analysis lists the companies that sell them and the decoding deadline for each type of qubit.
Reconciliation in quantum key distribution
In QKD, two parties build a shared secret key from quantum states of light sent over fiber or through free space. After detection, each party holds a long string of bits called the sifted key. Noise and any eavesdropping cause the two strings to disagree at some positions.
The parties find and correct those disagreements over an ordinary authenticated channel in a step called reconciliation. Gilles Brassard and Louis Salvail introduced the Cascade protocol for it at EUROCRYPT ’93. In Cascade, the two parties compare the parities of blocks of bits over several rounds of messages. Later systems use LDPC codes, in which one party sends a syndrome and the other decodes it.
Here the decoder works on a classical bit string, produced by photons that no longer exist. Haokun Mao and colleagues reported LDPC reconciliation at up to 60 megabits per second on an ordinary CPU in a 2019 preprint, with stable performance for sifted-key error rates from 1% to 8%.
An eavesdropper learns something about the key from every parity bit that the parties disclose. The parties remove that information later by shortening the key, a step called privacy amplification. Mao’s team reported a reconciliation efficiency approaching 1.1, against a theoretical floor of 1.0 for the amount of information disclosed.
A reconciliation decoder has a throughput deadline, the need to keep up with the rate at which raw key accumulates. No key is used until it has been reconciled and shortened, so the decoder can run seconds behind the photon detections without affecting the key.
Decoders inside quantum algorithms
Stephen Jordan of Google Quantum AI and eight co-authors introduced decoded quantum interferometry (DQI) in a paper published in Nature. DQI uses the quantum Fourier transform “to reduce optimization problems to decoding problems,” the authors wrote. Inside DQI, the decoder is a classical decoding algorithm compiled into reversible quantum gates and run on the machine’s logical qubits.
For their main example, approximating optimal polynomial fits over finite fields, the authors wrote that DQI “achieves a superpolynomial speed-up over known classical algorithms.” In an October 2025 preprint, Tanuj Khattar and seven co-authors, including Gidney, designed circuits for that problem, whose decoding step works on Reed–Solomon codes. They identified the extended Euclidean algorithm inside the decoder as the bottleneck.
Khattar’s team estimated that classically intractable instances could be solved with about 5.72 million Toffoli gates, which they wrote is substantially fewer than breaking RSA-2048 requires. A Toffoli gate is a three-qubit operation that researchers often use to count the cost of fault-tolerant programs. DQI’s decoder therefore has a budget measured in gates on a fault-tolerant machine, with no deadline set by a hardware clock. The machine running it would still need an error-correction decoder of the first kind to keep its logical qubits intact.
The DQI authors also analyzed sparse problems that reduce to decoding classical LDPC codes. One of them is max-XORSAT, in which the task is to satisfy as many of a set of parity equations as possible. The authors constructed a max-XORSAT instance on which, by their analysis, DQI finds an approximate optimum substantially faster than general-purpose classical heuristics such as simulated annealing. They also wrote that “a tailored classical solver can outperform DQI on this instance.”
Decoding as a hardness assumption
Designers of code-based cryptography need the opposite outcome. In Classic McEliece and in Hamming Quasi-Cyclic (HQC), an attacker who holds the public key faces a decoding problem designed to resist every known decoder. Elwyn Berlekamp, Robert McEliece, and Henk van Tilborg proved in 1978 that decoding a general linear code is NP-complete.
NIST selected HQC in March 2025 as a backup to ML-KEM, formerly CRYSTALS-Kyber. Germany’s Federal Office for Information Security (BSI) advised against Classic McEliece in new systems on October 1, 2026, after three research groups estimated key-recovery costs below its claimed security levels.
DQI’s speedup depends on decoding problems that can be solved efficiently. The security of HQC and Classic McEliece depends on decoding problems that cannot. A cryptanalyst who publishes a faster decoder for either scheme has weakened it.
Machine-learning decoders
Machine-learning researchers use the word in one more sense. The decoder half of a transformer, the architecture Google researchers introduced in 2017, generates an output sequence one token at a time. AlphaQubit is built from transformer components. It reads syndromes and predicts logical errors, so it handles the same data as matching or union-find decoders.
Google DeepMind still called AlphaQubit too slow for real-time use on a superconducting processor. A neural network does the full error-correction job only when it takes syndromes from a running machine and returns a correction or a logical outcome within the hardware’s deadlines.
The meanings compared
| Job | What is decoded | By what | Deadline | Source |
|---|---|---|---|---|
| Error-correction decoding | Syndromes from repeated parity checks | Matching, union-find, belief-propagation, tensor-network, and neural decoders on FPGAs, ASICs, GPUs, or CPUs | Keep pace with the check cycle, 1.1 microseconds on Willow. Answer within the control system’s reaction time, 10 microseconds in Gidney’s RSA estimate | Google, 2024, Gidney, 2025 |
| QKD reconciliation | Mismatched bits in two copies of a sifted key | Cascade or LDPC decoders on conventional processors | Throughput that keeps up with raw key. A delay of seconds is acceptable, on this analysis’s reading | Mao et al., 2019, for throughput |
| Decoding inside a quantum algorithm | A syndrome held in a quantum register | A classical decoder compiled into reversible gates on logical qubits | Gate count, about 5.72 million Toffoli gates for intractable instances | Khattar et al., 2025 |
| Decoding as a hardness assumption | An attacker’s syndrome for a disguised code | Generic decoding attacks and attacks on the code’s algebra | Must stay infeasible at every parameter set | Berlekamp et al., 1978 |
The case that decoding is one problem
The strongest objection to sorting the word this way is that the mathematics is shared. Belief propagation decodes classical LDPC codes in QKD reconciliation and quantum LDPC codes in IBM’s Relay-BP. The DQI authors wrote that the sparse optimization problems they studied “reduce to decoding low-density parity-check codes, for which powerful decoders are known.”
Code-based cryptography and error correction also share a formal task, finding the low-weight error that produced a given syndrome. On that view, a decoding result in any one field counts as progress in all of them.
Researchers do carry methods between the fields. Error-correction researchers borrowed belief propagation from classical channel coding, and IBM’s team adapted it for qLDPC codes with Relay-BP.
Each field still has a different deadline for its decoders. In his RSA estimate, Gidney assumed a 10-microsecond reaction time on a machine with a 1-microsecond cycle. A QKD link can wait seconds for reconciliation. Researchers measure the cost of DQI’s decoder in Toffoli gates and the cost of an attack on code-based cryptography in the bit operations it would take.
Researchers who set a speed record in one of those settings have shown little about whether their decoder could meet the deadline of another.
What would change this reading
Three developments would weaken the claim that error-correction decoding is the only decoding job that limits fault-tolerant machines.
- A fault-tolerant design in which logical operations rarely wait on decoded results, so that the code cycle sets the logical clock and the reaction time drops out. Gidney’s 10-microsecond assumption and Riverlane’s 10-microsecond goal are the current reference points.
- A run of DQI or a related algorithm on error-corrected hardware. The decoder compiled into the circuit would then become a cost driver of its own, counted against the same logical error budget as every other part of the program.
- Real-time decoders as accurate as tensor-network methods. If accuracy stopped costing speed, a given code could reach a target logical error rate with fewer qubits on the same hardware.
Until one of these appears in a published result, the test for any announcement is whether its decoder takes syndromes from a running machine and answers against that machine’s clock. Decoders that pass it are relevant to the schedule for machines such as IBM’s Starling, planned for 2029. The others are offline error-correction results or belong to key distribution, algorithm design, or cryptanalysis.
