Week 1 | bits, probabilistic bits, and the 2026 landscape | reading: Watrous §1.1, Wong Ch. 1
By the end of this lecture you should be able to write probabilistic states of a bit as vectors and random operations as stochastic matrices; treat reading a bit as sampling and attach an error bar to what you see; state the one change that turns a probabilistic bit into a qubit; and say where quantum computing stands in 2026 and why cryptographers care.
Quantum computing is one of the rare technologies whose most famous application is destructive. In 1994 Peter Shor showed that a large enough quantum computer could factor integers and compute discrete logarithms efficiently. Those are exactly the two problems that RSA, Diffie–Hellman and elliptic-curve cryptography depend on. For thirty years this was a theorem about machines that did not exist. Three recent developments have turned it into a planning problem.
The vertical axis spans four orders of magnitude. None of these machines exists yet: today's largest devices have hundreds to a few thousand physical qubits. What matters is the trend, and the fact that most of the drop came from better algorithms and better error correction, not from waiting for hardware.
Every resource estimate rests on assumptions: the error rate of a single gate (usually 0.1%), the time for one round of error correction (usually a microsecond), which qubits can interact, and how long you are willing to wait. Fewer qubits usually means a longer runtime. So when a number makes the news, ask four questions. What error rate? What connectivity? What runtime? Peer-reviewed, or a preprint? We will read these papers properly in Lecture 17.
Why hurry, if the machine does not exist? Because an adversary can record encrypted traffic today and decrypt it once one does. This is called harvest now, decrypt later. Court records, medical files and financial archives must stay secret for decades, so for them the clock is already running. This course teaches both sides of that story: the algorithms that break today's cryptography, and the error correction that decides when.
A hospital's records must stay confidential for 25 years, and no cryptographically relevant quantum computer exists yet. An adversary who copies the encrypted records off the network today puts them at risk .
1981. Richard Feynman argues that simulating nature efficiently needs a computer that is itself quantum. 1985. David Deutsch defines a universal quantum computer. 1994–96. Shor's factoring algorithm, then Lov Grover's search algorithm, show what such a machine could do. 2016. IBM puts a five-qubit processor on the cloud, and anyone can run a circuit. 2024. NIST standardizes the cryptography meant to survive it all. The theory came first, by decades, and engineering has been catching up ever since.
| component | weight | what it looks like |
|---|---|---|
| weekly homework | 20% | by-hand mathematics plus short Python checks; lowest score dropped |
| labs 1–6 | 25% | every other week; Qiskit and Stim; real IBM quantum hardware |
| final project | 15% | proposal, notebook, four-page report, eight-minute talk |
| midterm | 15% | week 8, lectures 1–14 |
| final exam | 25% | cumulative, weighted toward lectures 15–24 |
The only prerequisites are linear algebra and some Python. We assume no physics: everything we need about quantum mechanics fits into a few rules about vectors and matrices. Today we build the first of those rules out of something you already know, which is probability.
A bit is in state 0 or state 1. It will pay off, almost immediately, to write these states as column vectors:
$$0\;\longleftrightarrow\; e_0=\begin{pmatrix}1\\[2pt] 0\end{pmatrix},\qquad 1\;\longleftrightarrow\; e_1=\begin{pmatrix}0\\[2pt] 1\end{pmatrix}.$$A deterministic operation on a bit is then a matrix that sends basis vectors to basis vectors. The NOT operation swaps them:
$$\mathrm{NOT}=\begin{pmatrix}0 & 1\\[2pt] 1 & 0\end{pmatrix},\qquad \mathrm{NOT}\,e_0=e_1,\qquad \mathrm{NOT}\,e_1=e_0.$$There are exactly four deterministic one-bit operations: the identity, NOT, "set to 0" and "set to 1". All four are matrices whose columns are basis vectors. Writing a bit this way looks like overkill. What it buys us is that the next step, adding randomness, needs no new ideas at all.
Suppose you do not know the value of a bit, but you do know the odds: it is 0 with probability \(p_0\) and 1 with probability \(p_1\). Stack the odds into a vector.
A probabilistic state of a bit is a vector
$$p=\begin{pmatrix}p_0\\[2pt] p_1\end{pmatrix}=p_0\,e_0+p_1\,e_1,\qquad p_0,\;p_1\ge 0,\qquad p_0+p_1=1.$$The last condition says the 1-norm \(\lVert p\rVert_1=|p_0|+|p_1|\) equals 1.
If a random process takes state \(j\) to state \(i\) with probability \(M_{ij}\), then by the law of total probability the new odds are \(p'_i=\sum_j M_{ij}\,p_j\). That is exactly the rule for multiplying a matrix by a vector: \(p'=Mp\).
A square matrix \(M\) is stochastic if all its entries are nonnegative and every column sums to 1. Column \(j\) is the probability distribution of the output when the input is \(j\). Stochastic matrices are exactly the matrices that turn probabilistic states into probabilistic states.
Tick every stochastic matrix (Definition 1.2).
A memory cell holds a bit, but at every clock tick it flips with probability 0.1. The bit starts at 0. What are the odds after one, two and three ticks?
Column \(j\) of \(M\) describes what happens to state \(j\): stay with probability 0.9, flip with probability 0.1. So
$$M=\begin{pmatrix}0.9 & 0.1\\[2pt] 0.1 & 0.9\end{pmatrix},\qquad p^{(0)}=\begin{pmatrix}1\\[2pt] 0\end{pmatrix}.$$One tick:
$$p^{(1)}=Mp^{(0)}=\begin{pmatrix}0.9\\[2pt] 0.1\end{pmatrix}.$$Two ticks:
$$p^{(2)}=Mp^{(1)}=\begin{pmatrix}0.9(0.9)+0.1(0.1)\\[2pt] 0.1(0.9)+0.9(0.1)\end{pmatrix}=\begin{pmatrix}0.82\\[2pt] 0.18\end{pmatrix}.$$Three ticks:
$$p^{(3)}=Mp^{(2)}=\begin{pmatrix}0.756\\[2pt] 0.244\end{pmatrix}.$$The chance of reading 0 decays 1, 0.9, 0.82, 0.756, … toward \(\tfrac12\). After enough ticks the cell is a fair coin, and all memory of the starting value is gone.
A bit that flips with probability \(q\) at each tick and starts at 0 reads 0 after \(k\) ticks with probability
$$P^{(k)}(0)=\frac12+\frac12\,(1-2q)^k .$$The matrix is
$$M=\begin{pmatrix}1-q & q\\[2pt] q & 1-q\end{pmatrix}.$$Check directly that
$$M\begin{pmatrix}1\\[2pt] 1\end{pmatrix}=\begin{pmatrix}1\\[2pt] 1\end{pmatrix},\qquad M\begin{pmatrix}1\\[2pt] -1\end{pmatrix}=(1-2q)\begin{pmatrix}1\\[2pt] -1\end{pmatrix},$$so these are eigenvectors with eigenvalues \(1\) and \(1-2q\). Write the starting state in this basis and apply \(M\) \(k\) times:
$$e_0=\frac12\begin{pmatrix}1\\[2pt] 1\end{pmatrix}+\frac12\begin{pmatrix}1\\[2pt] -1\end{pmatrix} \quad\Longrightarrow\quad M^k e_0=\frac12\begin{pmatrix}1\\[2pt] 1\end{pmatrix}+\frac{(1-2q)^k}{2}\begin{pmatrix}1\\[2pt] -1\end{pmatrix}.$$The top entry is \(\tfrac12+\tfrac12(1-2q)^k\). With \(q=0.1\) this is \(\tfrac12+\tfrac12(0.8)^k\), which gives 0.9, 0.82 and 0.756 as before.
A cell flips with probability \(q=0.25\) at each tick and starts at 0. What is the chance of reading 0 after three ticks?
Stochastic matrices keep the 1-norm of a probabilistic state, but not its ordinary length. After one tick, \(\lVert p^{(1)}\rVert_1=0.9+0.1=1\), while \(\lVert p^{(1)}\rVert_2=\sqrt{0.81+0.01}=\sqrt{0.82}\approx0.906\). The whole of quantum computing grows out of swapping the roles of these two norms. Hold on to that sentence until Section 6.
The fair coin \(F=\tfrac12\begin{pmatrix}1&1\\ 1&1\end{pmatrix}\) sends \(e_0\) to \((\tfrac12,\tfrac12)\). Its 1-norm and its 2-norm .
You cannot look at a probabilistic state. When you read the bit you see one value, 0 or 1, and never the vector \(p\). To learn \(p_0\) you prepare the same state many times, read it each time, and estimate. In the language of probability and statistics, each reading is a Bernoulli\((p_0)\) trial, and after \(n\) readings the sample proportion \(\hat p\) gives the approximate 95% confidence interval
$$\hat p\;\pm\;1.96\sqrt{\frac{\hat p\,(1-\hat p)}{n}} .$$After \(n=400\) readings the sample proportion is \(\hat p=0.5\). What is the half-width of the 95% interval?
A device should produce 0 with probability 0.9. (a) With \(n=100\) readings and \(\hat p=0.9\), what is the 95% interval? (b) What goes wrong with \(n=10\)? (c) How many readings guarantee a half-width of at most 0.01, whatever \(p_0\) is?
(a) The half-width is \(1.96\sqrt{0.9\cdot 0.1/100}=0.0588\), so the interval is about \((0.841,\;0.959)\).
(b) With \(n=10\) the half-width is \(0.186\), which gives \((0.714,\;1.086)\): an interval for a probability that runs past 1. The normal approximation is poor when \(n\) is small or \(p\) is near 0 or 1. The Wilson interval stays inside \([0,1]\); here it is \((0.596,\;0.982)\).
(c) Since \(p(1-p)\le\tfrac14\), we need \(1.96\sqrt{0.25/n}\le 0.01\), that is, \(n\ge 1.96^2(0.25)/0.01^2=9604\).
To cut the half-width of a 95% interval in half, you need about readings.
A quantum computer never hands you its state. It hands you samples. Every experimental number in this course, from Lab 1 on, is an estimate with an error bar, and in Lab 1 you will do Example 1.2 first on a simulator and then on real IBM hardware.
Two bits have four possible values, 00, 01, 10, 11, so a probabilistic state of two bits is a vector in \(\mathbb R^4\) with nonnegative entries adding up to 1:
$$p=\begin{pmatrix}p_{00}\\[2pt] p_{01}\\[2pt] p_{10}\\[2pt] p_{11}\end{pmatrix}.$$If the bits are independent, with odds \(a=(a_0,a_1)\) for the left bit and \(b=(b_0,b_1)\) for the right, then \(p_{ij}=a_i\,b_j\). This way of combining two vectors has a name.
Entry \(ij\) is \(a_i b_j\), and the first factor labels the left bit.
The left bit has odds \(a=(0.7,\,0.3)\) and the right bit, independently, \(b=(0.2,\,0.8)\). Find the entries \(p_{01}\) and \(p_{10}\) of \(a\otimes b\).
(a) The left bit is the noisy cell after one tick, \(a=(0.9,\,0.1)\); the right bit is an independent biased coin, \(b=(0.6,\,0.4)\). Find the joint odds. (b) Two sealed envelopes hold the same random bit, so \(p=(\tfrac12,\,0,\,0,\,\tfrac12)\). Is this a tensor product of two one-bit states?
(a) Multiply entry by entry:
$$\begin{pmatrix}0.9\\[2pt] 0.1\end{pmatrix}\otimes\begin{pmatrix}0.6\\[2pt] 0.4\end{pmatrix}=\begin{pmatrix}0.54\\[2pt] 0.36\\[2pt] 0.06\\[2pt] 0.04\end{pmatrix}.$$(b) If \(p=a\otimes b\), then \(p_{00}\,p_{11}=a_0b_0a_1b_1=p_{01}\,p_{10}\). Here \(p_{00}p_{11}=\tfrac14\) but \(p_{01}p_{10}=0\), so no: the bits are correlated. In general a two-bit distribution is a product exactly when the table
$$\begin{pmatrix}p_{00} & p_{01}\\[2pt] p_{10} & p_{11}\end{pmatrix}$$has determinant zero.
Keep part (b) in mind. In Lecture 5 the same determinant test will detect entanglement, the quantum cousin of correlation, and in Lab 2 you will measure that it is strictly stronger than anything two envelopes can do.
\(n\) bits need a vector of \(2^n\) probabilities. A classical computer never stores it: it simulates randomness by following one random path at a time. For quantum states that shortcut fails, because of interference (next section), and this is both why quantum computers are hard to simulate and why they might be powerful.
Here is the whole course in one sentence: replace nonnegative probabilities that add up to 1 with complex amplitudes whose squared sizes add up to 1.
A qubit state is a vector
$$\psi=\begin{pmatrix}\alpha\\[2pt] \beta\end{pmatrix}\in\mathbb C^2\quad\text{with}\quad |\alpha|^2+|\beta|^2=1 ,$$that is, with 2-norm equal to 1. Reading it gives 0 with probability \(|\alpha|^2\) and 1 with probability \(|\beta|^2\). We will soon write it \(|\psi\rangle=\alpha|0\rangle+\beta|1\rangle\).
A qubit is in the state \(\psi=\Big(\tfrac{1+i}{\sqrt3},\ \tfrac{i}{\sqrt3}\Big)\). With what probability does reading it give 0?
Operations must now preserve the 2-norm instead of the 1-norm. The matrices that do this are called unitary (Lecture 2), and they replace stochastic matrices. The most important one is the Hadamard gate
$$H=\frac{1}{\sqrt2}\begin{pmatrix}1 & 1\\[2pt] 1 & -1\end{pmatrix}.$$Compare \(\psi_1=(0.6,\;0.8)\) and \(\psi_2=(0.6,\;-0.8)\). Do they read the same? Are they the same?
Both have \(0.6^2+0.8^2=0.36+0.64=1\), and reading either gives 0 with probability 0.36 and 1 with probability 0.64. Read directly, they cannot be told apart. But they are different vectors, and one Hadamard separates them completely:
$$H\psi_1=\frac{1}{\sqrt2}\begin{pmatrix}1.4\\[2pt] -0.2\end{pmatrix}\approx\begin{pmatrix}0.990\\[2pt] -0.141\end{pmatrix},$$ $$H\psi_2=\frac{1}{\sqrt2}\begin{pmatrix}-0.2\\[2pt] 1.4\end{pmatrix}\approx\begin{pmatrix}-0.141\\[2pt] 0.990\end{pmatrix}.$$Now \(\psi_1\) reads 0 with probability 0.98 and \(\psi_2\) reads 0 with probability 0.02. The sign was invisible, but it decided the outcome.
Apply a "fair coin" twice to a bit that starts at 0. Classically the fair coin is the stochastic matrix
$$F=\frac12\begin{pmatrix}1 & 1\\[2pt] 1 & 1\end{pmatrix},\qquad F^2e_0=\begin{pmatrix}\tfrac12\\[4pt] \tfrac12\end{pmatrix}:$$randomizing twice is still random. The quantum version is \(H\). One application gives \(He_0=(\tfrac{1}{\sqrt2},\tfrac{1}{\sqrt2})\), which reads 0 or 1 with probability \(\tfrac12\) each, exactly like the coin. The second application gives
$$H^2e_0=\frac12\begin{pmatrix}1+1\\[2pt] 1-1\end{pmatrix}=\begin{pmatrix}1\\[2pt] 0\end{pmatrix}.$$The output is 0 with certainty. The figure shows why. Each path from input to output carries the product of the amplitudes along it. The two paths into 1 carry \(+\tfrac12\) and \(-\tfrac12\) and cancel, while the two paths into 0 reinforce. Probabilities, being nonnegative, can only pile up. Amplitudes can also cancel. Every algorithm in this course, from Deutsch–Jozsa to Grover to Shor, works by arranging for the wrong answers to cancel.
The state \(\big(\tfrac1{\sqrt2},\,-\tfrac1{\sqrt2}\big)\) reads 0 or 1 with probability \(\tfrac12\) each, just like a fair coin. Apply \(H\) once and then read it. What do you see?
"A qubit is 0 and 1 at the same time, so a quantum computer tries every answer in parallel." This is misleading. A qubit in the state \(He_0\) gives one random answer when read, just like a coin. The power comes from interference: steering amplitudes so that when you finally do read, the answer you want is the likely one. No cancellation, no speedup.
Any two-level quantum system will do, and the mathematics is identical for all of them. Superconducting circuits (IBM, Google) are tiny electrical loops cooled to near absolute zero: fast gates, nearest-neighbour wiring; your labs run on these. Trapped ions (Quantinuum, IonQ) are single charged atoms held by electric fields and steered by lasers: very accurate, slower. Neutral atoms (QuEra, Atom Computing, Pasqal) sit in arrays of laser "tweezers" that can be rearranged mid-computation. Photons (PsiQuantum, Xanadu) travel at room temperature and suit networking. This course treats them all through one abstraction: vectors, unitaries and measurements.
import numpy as np
M = np.array([[0.9, 0.1],
[0.1, 0.9]]) # each column sums to 1
p = np.array([1.0, 0.0]) # start: definitely 0
for k in range(1, 4):
p = M @ p
print(k, p.round(4))
rng = np.random.default_rng(seed=1)
n = 1000
reads_zero = rng.random(n) < 0.9 # n reads of a bit with P(0) = 0.9
p_hat = reads_zero.mean()
half = 1.96 * np.sqrt(p_hat * (1 - p_hat) / n)
print(f"p_hat = {p_hat:.3f}, 95% CI = ({p_hat - half:.3f}, {p_hat + half:.3f})")
1 [0.9 0.1] 2 [0.82 0.18] 3 [0.756 0.244] p_hat = 0.892, 95% CI = (0.873, 0.911)
from qiskit import QuantumCircuit from qiskit.quantum_info import Statevector qc = QuantumCircuit(1) qc.h(0) print(Statevector(qc).data.round(4)) # amplitudes after one H qc.h(0) print(Statevector(qc).probabilities().round(4)) # probabilities after two
[0.7071+0.j 0.7071+0.j] [1. 0.]
Replace the second qc.h(0) by qc.measure_all() and sample the circuit. Can you tell the one-H state from a fair coin by reading it? (No, and that is Example 1.4 again.)
Next time: complex numbers, inner products and Dirac notation, the language that makes "amplitude" precise. HW1 is due at the start of Week 2.
all numbers and figures in these notes are computed in python (verify_L01.py) and follow the page theme