Chapter 3: Application

We currently live in the ‘Noisy Intermediate Scale Quantum’ (NISQ) era . This means that our quantum computers aren’t fully error corrected; at some point in any computation, errors will build up and turn our results into noisy, random mush. One day, the industry may produce a computer that can perform calculations of arbitrary length and scale without accumulating errors. Once that’s achieved, we will all be raptured into heaven… or err… excuse me, I meant that we will be in the ‘Fault Tolerant Quantum Computation’, or FTQC, era.

Let’s now consider what that real-world, honest-to-god, fault-tolerant quantum computer will be used for. I will proceed through four categories of applications, touching on the current state of affairs and prospects for future innovation. These are all applications that are actively being worked on and are cited as reasons to build a quantum computer (except for the first category, which is more academic).

I should clarify that I am primarily interested in the long term, i.e. what algorithms we will run and what will be accomplished in the FTQC era. Many (and we will touch on this) are working on algorithms that are implementable in the near term, in the hopes of achieving useful quantum advantage on today’s devices. Scott Aaronson likes to show this Venn diagram with three rings: Verifiable; Useful; Achievable on today’s hardware. As of today, nothing sits in the middle of those three! I’m personally happy to throw out that last criterion and focus on theoretical impacts way down the road, although many companies are urgently trying to prove value to industry.

Another word of caution: while last section may go out of date (new technology developed, other approaches become dominant, etc.), this one has the chance of being wrong factually! The opinions that follow are my own, and while I think they are reasonable, others certainly disagree. You’ve been warned!*

Proving Quantumness

Our first application is incredibly boring. Imagine an evil company called Qeranos run by Qelizabeth Qolmes, who has no qualms about making a fake quantum computer. Qeranos claims their device has a hundred physical qubits and is available for public use on the cloud. They then take user requests and run them on a classical computer, with artificial noise added! If word of this were to leak, it would be a total disaster for Qeranos and the quantum computing industry as a whole. But what if Qeranos keeps its secrets safe? Is there still a way for a third party to verify that a ‘quantum computer’ is actually doing quantum computing? Thus, we reach our first application: Proving quantumness.

In these discussions, you’ll often hear people bandy about buzzwords like ‘quantum advantage’ and ‘quantum supremacy’. These are ill-defined terms that are generally used to refer to a quantum computer being able to perform tasks a classical computer could not. Practically, any PR puff-piece touting a new demonstration will claim a quantum advantage, but it takes quite a bit of time to understand if that really is the case. As we’ll see, it may be possible for optimized classical algorithms to catch up, and perhaps outperform, quantum algorithms.

What is needed here? Well, we have those three criteria I mentioned above: First, the algorithm must be able to be run on today’s NISQ devices; second, it must be verifiable – that is, we can check the answer with our classical machines and confirm the computer got it right; third, we couldn’t have done it (or spoofed a made up answer) with our classical computer.

We are aware of algorithms that a FTQC machine could do that could fulfill the latter requirements. Take Shor’s for example: We cannot factor large numbers efficiently on a classical computer, and any proposed answer can be quickly verified via simple algebra. Unfortunately, we are orders of magnitude away in qubit counts and gate fidelity to implement Shor’s.

There are a few approaches that are currently being used for this task. The first and most mature is called ‘random circuit sampling’. The idea is extremely simple: Prepare a bunch of qubits, then subject them to as many gate operations as the machine possibly can perform (this is limited by how error-prone the gates are). Then, the qubits are then in a very complicated entangled state. Given the same gates, it would not be efficient for a classical computer to generate that state. On the other hand, it should be easy for a real quantum computer to execute those gates and get the output state. This is really good at satisfying our first criterion – we can execute these circuits with existing hardware! Hooray! It is perhaps less excellent at the other criteria. Say the circuit runs perfectly on a quantum computer: how do we verify it is in the right state? We first have to measure the system, since the state is entangled and complicated. We in fact must run the circuit lots of times, to get a probability distribution of results. However, the whole point of the random circuit is that it would take an extremely long time (years and years) for a classical computer to run. As a result, we don’t have a ground truth probability distribution to compare against! What is actually done to verify the results is the calculation of a property called ‘linear cross entropy’. This metric distinguishes between results that are uniformly random and those that are random in a very specific, quantum-enabled way. There have been quite a few RCS experiments from various groups, and they’ve all shown sufficient cross entropy scores that indicate that their computers are indeed quantum!

Nevertheless, this whole approach is sort of aesthetically displeasing. It’s a given that it is totally useless (everything in this section is). More problematic is that it has an extremely indirect verification method. It relies on, as one very nice paper puts it, a ‘proxy of a proxy of a benchmark'. It’s like being blindfolded and deafened, carried to an unknown place, and verifying that you’re in Disneyland by the smell of the churros. Moreover, that cross entropy metric can still be spoofed by a dishonest actor! So there’s still a need for other approaches.

Next up on the list is boson sampling. I’m sort of cheating here – boson sampling is sort of a quantum computing paradigm (like gate-based or adiabatic), and sort of its own application. It’s complicated. The original pitch from Scott Aaronson and Alex Arkhipov was to shoot single photons through a linear optical network, then measure the distribution on the other side. Trying to simulate that distribution classically is actually inefficient, but can be done efficiently experimentally (i.e., with quantum computation!). That proposal was interesting, but difficult to implement physically, because as we’ve discussed, generating single photons is hard. So a different team proposed using ‘squeezed states’ of light to do ‘gaussian boson sampling’. This is essentially the same thing, but easier to physically implement. You’ll remember that the photonic quantum computing startup Xanadu is using these squeezed states in their approach. This style of experiment has been done, and achieved some form of quantum advantage! Some of the photonic platform companies have also used this as an intermediate milestone on their way to full-scale quantum computation. This boson sampling style of computation is not universal, but potentially could be applied to some problems regarding simulation of ‘molecular vibroic spectra of complicated molecules’. That’s a niche, but real application! Unfortunately more general simulation requires universal quantum computation, as we’ll discuss later.

Another somewhat promising avenue of research is ‘peaked circuit sampling’. The idea is pretty similar to random circuit sampling. The quantum computer is given a circuit to run that is far too deep and complex for a classical computer to run in reasonable time. The catch here is that instead of the output distribution being random/unknown, the circuit is designed to produce a specific output with higher probability (the peak!). This is desirable because there’s a verifiable ground truth in the results. If your computer produces the peak, then it’s quantum advantage! The difficulty here is designing such a circuit in a way that classical approaches can’t figure out the desired peaked output. Recent events demonstrate the challenge here: Quantum software startup BlueQubit proposed a peaked circuit scheme, touting it as the state of the art for quantum advantage. However, their collaborators/intellectual sparring partners at IBM successfully developed a new classical method for finding the output of a peaked quantum circuit. This new method cut classical runtime by an estimated 11 orders of magnitude (huge!), thus outperforming the quantum algorithm. And that’s a crosscutting theme we will see in several applications: Quantum algorithms can propose drastic speedups, but classical algorithms can fight back! This is an actively evolving field.

Finally (but not exhaustively) I’d like to discuss Google’s recent (late 2025) results on an approach varyingly referred to as ‘out of time order correlators’ (OTOC) or the ‘quantum echoes’ algorithm. Again, the core of this approach is applying a relatively large circuit that conventional computers can’t hope to simulate. The OTOC experiments apply a random circuit (call it U) on a set of qubits, then a specific operation to a single qubit, then they reverse the U operations ($U^T$). They repeat this a few times, then measure a specific qubit. The idea is that without that middle perturbation (and without noise and error), the system would just return to its initial state. However, that perturbation causes some higher order random effects as it propagates through the reversing process, leaving the system in some other state. Google claims that this has potential practical applications for molecular simulation.

I think this experiment is interesting for two reasons:

• First, Google says they can verify it! The circuit is too complicated and big to simulate with a classical computer, but they ran the same circuit on two different quantum computers, getting the same result. This indicates that the quantum computers are probably functioning properly.
• Second, it is a very representative example of the quantum hype machine. Google announced the experiment and its quantum advantage results, performed on 65 qubits. Their announcement noted their optimism using this for molecular simulation tasks, and concurrently published a different paper that used their computer to simulate molecular geometry for some simple molecules. The trouble is that second paper did not use the OTOC algorithm, and only used $\sim$10 qubits for a task that was much easier to do with classical approaches. As is often the case in the quantum world, the fine print (the actual papers) were factually correct and intellectually honest, but the non-technical summaries conflated separate results and inflated the impact of the work. It’s a valuable lesson that one should approach claims with skepticism in this field.

Factoring, Cryptography

While speculation about the potential practical uses for quantum computation began with Feynman and quantum simulation in the late 1970s, it wasn’t until Peter Shor’s algorithm for factoring in the mid 1990s that funding started to really pour into the field. Many parties, perhaps chiefly the military industrial complex, are interested in using quantum computers for various cryptographic applications. Today, as we’ve covered above, Shor’s is still perhaps the only definitive quantum algorithm that can achieve proven exponential speedups on a real-world problem. And yet, I personally think the potential impacts of quantum computing on encryption are relatively staid.

Let’s do a quick overview of modern cryptography: There are broadly two categories of encryption – symmetric and asymmetric. In a symmetric scheme, two parties have the same secret key, and use it to both encrypt and decrypt messages. This is fast and easy, but relies on both parties having the same key. Asymmetric schemes require no shared private information, but are more computationally expensive. In most modern communication schemes (such as the internet), an asymmetric scheme is used to exchange a key used in symmetric encryption of the ensuing communication. These are the protocols that keep your messages private, your financial data secure, and your passwords safe.

Quantum computing is not some magic bullet that can be used to break any encryption scheme. If there’s anything you should remember from Section I (and will become a theme in this section as well) is that quantum algorithms need some sort of ‘structure’ in order to access exponential speedups, and thus practical quantum advantage. Absent any sort of structure, a quantum computer can only achieve a Grover-type quadratic speedup. Now that we’ve reviewed quantum hardware, we understand that these computers are going to operate with clock speeds orders of magnitude lower than conventional CPUs and GPUs. That theoretical quantum quadratic advantage would likely translate to a practical thrashing by the classical computing team.

So in the realm of encryption, quantum computers are unlikely to be helpful in breaking symmetric codes. There’s no structure to exploit, just some secret key! They could attempt to brute force that key using a Grover-type search scheme, but once again, that is going to be much slower than a classical machine.

However, the most commonly used asymmetric schemes – the previously discussed RSA; elliptic curve cryptography (ECC); Diffie-Hellman – are all vulnerable to Shor’s. Each has some internal structure that Shor’s factoring algorithm can exploit, leading to exponential speedups over classical approaches.

This has rightfully freaked out security specialists for the past two and a half decades. The term of art for when a quantum computer can break real-world security schemes is ‘Q-Day.’ Visionary prophets (or opportunistic fearmongers), spurred by recent advancements in hardware and algorithms, have been telling the world that Q-Day is approaching rapidly, and that preparations must be made. And to be fair, if there is a risk (even if it’s small) of RSA and its ilk being cracked, then it is critical to mitigate that risk!

The quantum industry is obviously very aware of public interest in encryption applications, and various researchers spend time thinking about exactly what physical resources are necessary to break encryption schemes. These days, the best estimates come from the aforementioned Craig Gidney. His latest paper tackling this issue (published in 2025), assuming the characteristics of fault tolerant superconducting quantum computer (specifically its operating frequency & connectivity), finds that RSA-2048 could be broken in about a week utilizing around 1 million physical qubits. While adding more qubits could reduce that time, that seems to be a pretty reasonable bound. Recently, Iceberg Quantum, an Australian software startup, published a much-ballyhooed paper that reduced estimated qubit count by another factor of ten, to  100,000. The catch is that they assume implementation of QLDPC codes (low density parity checks, discussed briefly above). These codes have far better logical qubit per physical qubit counts, but require non-nearest neighbor connectivity. The Iceberg folks seem to have their cake & eat it too – assuming non-local connectivity (not typically a hallmark of superconducting qubit implementations), but also fast, superconducting level cycle times. Yet another reminder to take every result with a grain of salt.*

With all this smoke, the cryptography community is not standing still. Leading the way is the US National Institute of Standards and Technology (NIST) – an extremely strange organization housed in the Department of Commerce that regulates weights and measures, is a center for quantum research, and manufactures very expensive peanut butter*. NIST has been looking at post-quantum encryption schemes for well over a decade now and has selected five to-date as future standards. These schemes are all based on fundamentally different math than RSA and ECC, and should be resistant to Shor-based attacks. There’s no free lunch though – each comes with more overhead than conventional schemes, either via more data transmission or more necessary computation to (de/en)crypt. NIST has selected so many because, frankly, it’s worried! Our conventional encryption schemes are very much battle-tested, and we have significant evidence that says they are secure. These novel codes are not yet proven, so backups and alternatives have been made.

While NIST’s recommendation is to deprecate non-quantum secure standards in 2030, the technology industry is actively adopting these PQS methods today. Internet infrastructure provider Cloudflare reported that over half of its traffic utilized post-quantum encryption as of October 2025. This begs the question – what’s the point? By the time quantum computers are developed, our systems will be secure from them!

There are a few directions of discussion from here: First is the obvious point, which is that quantum algorithms could improve. Shor’s is a starting point, not an endpoint. It is entirely possible that a new scheme could be developed, potentially significantly decreasing the effort needed to attack classical or post-quantum encryption methods. We simply don’t know yet!

Second, many are worried about a family of attack known as ‘harvest now, decrypt later’ (sometimes abbreviated to HNDL). The idea, as the name suggests, is to collect and save encrypted data today, then decrypt it once a sufficiently powerful quantum computer has been developed. This is one reason why it’s prudent that technology infrastructure providers adopt PQS schemes today. Data harvested 15-20 years before Q-Day is much less valuable than data harvested a year before Q-Day. In general, I think this is a reasonable but rather overblown fear, especially considering the relatively rapid (and very in advance) rate of adoption of PQS.

Third, one might have a reasonable concern if some sensitive information – say financial transactions – were protected by asymmetric encryption and said information was easily viewed on a publicly available ledger which intermediated trustless transactions between anonymous counterparties. Good thing we do financial transactions via trusted intermediaries and a regulated payment system! Oh, wait. Some people use (invest in? hold? hodl?) bitcoin. Unfortunately, bitcoin and certain cryptocurrencies of its ilk are vulnerable to quantum attacks. The bitcoin blockchain publishes transactions with user public keys. A sufficiently large quantum computer could then use that public information to find the user’s private key, then initiate a transfer of their bitcoins to some attacker’s wallet. Users can work around this by cycling public keys after each transaction, but there’s some percentage of stranded bitcoins/unsophisticated parties who will not do this, leaving them vulnerable. Perhaps more worryingly, the blockchain itself relies on a factorization problem to mine new blocks (which adds to the ledger & mints new bitcoin). There’s a future where a quantum computer could beat all the miners to the punch and monopolize the world’s bitcoin supply/infrastructure! Bitcoin could solve this via somehow integrating a PQS algorithm, but it would require a ‘hard fork,’ where the fundamental operation of the blockchain changes. It seems like something that will be a terrible pain in the ass for lots of people, but ultimately won’t change the world too much. The more centralized Ethereum community has already begun thinking about formalizing post-quantum standards into their blockchain. In general though, I’m a crypto pessimist, so I don’t really care about the impacts here.

Quantum computing may have certain niche uses for creating encryption, though. It’s useful, both for encryption and other applications, to have a source of truly random numbers. It’s remarkably hard to generate random numbers: computers are very deterministic, physical phenomena and human behavior both have underlying patterns, and truly random phenomena are hard to access. Quantum mechanics has an excellent source of true randomness. Very simply, if you initialize a qubit in $\ket{0}$, perform a Hadamard gate, and measure, you will get 0 50% of the time and 1 50% of the time, with pure randomness! This is overly simplistic – more complex randomness creating schemes have been made – but directionally correct.

Additionally, you could imagine using quantum-native encryption schemes. This could take the form of a specific, quantum enabled algorithm, but most proposals focus on using quantum properties for secure key distribution. The problem statement is just like the asymmetric encryption schemes discussed above: We’d like a very secure way for two parties to determine a secret key to use in subsequent encrypted communications. The idea here, initially proposed by Charles Bennett and Gilles Brassard with their ‘BB84’ scheme (and shown in Fig. 2), is to have one person (Alice) entangle pairs of qubits and then send half of each entangled pair to the other party (Bob). Alice and Bob then measure each of their qubits in one of two bases, which they select randomly. They then tell each other which basis they measured in, but not the results. They throw away all the bits where they measured in a different basis. The bits that remain, because they are entangled and measured in the same basis, should be the same, forming the basis of their shared secret key! They take some selection of their approved matched bitstring and share, to make sure that there wasn’t some sort of eavesdropper (whose intermediate measurements would destroy the system’s entanglement, revealing their interception!). Ultimately, this approach and others like it have to compete with very established and resource efficient classical key distribution techniques, but may be useful in niche applications.

I reckon the story about quantum computing and encryption would be much more interesting if post-quantum encryption schemes didn’t exist (or couldn’t be made!). Then we’d have a ticking time bomb, making quantum computer development into a fascinating moral choice. I have no doubt that actors (probably the US government) are planning to utilize these data harvesting schemes, but I simply can’t see a world where Shor’s algorithm fundamentally changes data privacy. This is objectively a good thing, but leaves me wondering what good quantum computers will actually do.

Optimization, Machine Learning, Quantum AI, and other Miscellanea

This is a hodgepodge of topics that I hope to convince you should be treated as more-or-less the same in your mental model of quantum computing applications. Depending on where you’re coming from, optimization, machine learning, and AI might seem very distinct or virtually identical. My rough boundary lines between them (at least for quantum computation) are as follows: Optimization is a problem with defined constraints where we are looking for one or many solutions with superior characteristics (i.e., lie on the pareto front); machine learning is a set of methods that attempt to solve numerical problems, often optimization, via a process of training on existing data, then applying the trained model to new problems; AI could really mean anything, but let’s say it’s more specifically some sort of transformer based model like today’s LLMs. AI is a specific kind of machine learning, and we could potentially use both AI and ML to solve optimization problems.

These problems are often tied to specific applications, perhaps the most salient of which is ‘finance,’ broadly speaking. The financial industry (hedge funds, banks, proprietary trading firms, etc.) relies on algorithms across a wide variety of timescales to make trading decisions. The prospect of faster and/or better solutions to these problems via quantum computation could potentially translate to return on investment for financial firms. Hence, this is an prospective area of interest for the quantum industry.

Before we discuss any actual algorithms or specific applications, I need to beat a dead horse one more time: a quadratic algorithmic speedup is not going to result in a practical acceleration of anything with a quantum computer. Pitted against a classical computer trying to solve the same problem (but taking quadratically more operations), not only will a quantum computer lose, it will lose badly. Let’s make it very plain why, borrowing some analysis from this excellent Matthias Troyer paper. They compare a highly performant, hypothetical fault tolerant quantum computer (10,000 qubits, 10uS gate times, full qubit-to-qubit connectivity) with a single, commercially available GPU. This is an extremely unfair comparison: that quantum computer is extremely optimistic in its assumptions, since it’s unclear how to achieve fast operations and all-to-all gate interactions; parallelling GPUs is a common practice that typically accelerates classical problem solving; and GPU performance is increasingly rapidly over time - their comparison, an NVIDIA A100, was state of the art at time of publication, but now is something like 6 times less performant than the comparable NVIDIA GPU of 2026!

Nevertheless, we can take a few useful conclusions from the work: The first is that math operations on a quantum computer will take something like $10^{10}$ times longer on a quantum computer (the exact factor depends on the type of data being operated on). That’s mind-bogglingly slow. As a result, while a Grover/quadratic speedup may reduce the number of function calls by a factor of $n^2$, each function call may take radically longer. The authors find that a quadratic speedup is totally impractical for realized quantum advantage. They do think that a quartic ($n^4$) speedup might result in real gains though! Keep that in mind as we move through the section. Second, they identify data input/output as a huge bottleneck for practical speedups. Even with their optimistic assumptions, it’s going to be about 10,000 times slower to load data into or out of a quantum computer. This, in and of itself, can turn an exponential algorithmic speedup into a practical slowdown for problems with lots of input data. So what are we looking for in an application or algorithm? Exponential (or at the very least, high order polynomial, like $n^4$) speedups, and small input data problems. Unfortunately, for problems of optimization and machine learning, these criteria are not frequently met.

With these constraints mind, let’s examine the tools in the proverbial toolbox when it comes to these kinds of problems. First of all, we have Grover’s algorithm. Basically any optimization function can be constructed such that it is the oracle in a Grover’s implementation. As such, if you are naïvely brute force searching over the possible input space, a simple Grover’s implementation can result in a quadratic speedup. There are some details in how to actually implement this, and these schemes are usually termed ‘Grovers Adaptive Search’ (GAS). So in a generic optimization problem, we can generally access a quadratic speedup over brute force search (but remember, we may have a better way of solving this problem classically than brute force!). This is intellectually quite interesting, but, as we’ve discussed, too slow to have practical impact in the world.

Our next family of approaches are called ‘variational’ or ‘heuristic’ based algorithms. Their most common manifestations are the variational quantum eigensolver (VQE) or the quantum approximate optimization algorithm (QAOA), which are very closely related. These variational algorithms are, in a sense, a workaround to the realities of modern, NISQ-era quantum hardware. We certainly do not have systems that can run arbitrarily long series of gates, precluding the use of Grover-based schemes. The variational approaches were developed with the express intention of running them on noisy currently available hardware, which means they run relatively constrained and short gate sequences. They are also very explicitly quantum/classical hybrid algorithms.

In any variational algorithm implementation, the optimization problem has to first be encoded in a quantum way. The variable inputs that we want to optimize are mapped onto qubits, and the cost function (the thing that we are trying to optimize for) is mapped onto a Hamiltonian – the equation that represents the entire quantum state. The algorithm’s goal is to end up with quantum state that maximizes or minimizes that Hamiltonian.

The actual process of running a variational algorithm, shown in Fig. 3 is pretty simple: We start with an initial guess of what an approximately good solution might be. The quantum computer runs a short quantum circuit consisting of several parameterized gates, creating an entangled quantum state that corresponds to that solution. That state is then measured, perhaps re-running multiple times to get the information it needs to evaluate the Hamiltonian/cost function. The classical computer then evaluates the cost function of the state, then adjusts the parameters of the quantum circuit (e.g., changes the angles of the gate rotations). This proceeds iteratively until an optimal solution is found!

This approach can be applied to a variety of optimization & math problems. However, variational algorithms are no magic bullet for these applications. First of all, they are heuristic based: their performance is highly dependent on the initial guess. If the initial guess is good, the solver might find an optimal solution quite rapidly. If it’s bad, perhaps it will never find that solution! This makes it very difficult to establish whether variational methods can achieve meaningful speedups over classical approaches. They are so dependent on classical computing not just for performing mid-algorithm optimization, but also creating this all-important initial guess. This also does raise the question: if the algorithm is so dependent on a good initial guess, why not just devote more classical resources to the problem? In the extreme case, you would just use a classical computer to perform the full optimization, and the quantum process would be left vestigial. For such an approach to be maximally effective, it needs to be easy to get a good guess of the solution, but very hard to get the exact solution. That’s a very specific and difficult circumstance to find.

It does not seem like the VQE or the QAOA has found a killer app, let alone practical usage just yet. Once again, I can point to a narrative of ‘team finds quantum algorithm (QAOA in this instance) outperforms classical approach for problem (Low Autocorrelation Binary Sequences), until better classical approach is found. One interesting theoretical result found that QAOA scales better than the best currently known approaches for the k-SAT problem, a NP-hard problem dealing with Boolean logic.

So Grover’s speedups are insufficient, variational algorithms are on shaky ground, what’s left? Well, the HHL (Harrow, Hassidim, Lloyd) algorithm has a proven exponential improvement over classical methods for solving certain sets of linear equations! Wait, what? Is this the great hope coming true? Well, not quite. Solving sets of linear equations is indeed a very useful tool, broadly applicable to many optimization problems, machine learning tasks, and various real-world applications. It takes polynomial time to solve systems of equations with classical methods, but the HHL algorithm can do so in logarithmic time (exponentially faster!).

Unfortunately, there’s a catch (or rather, several). First, the HHL algorithm only has an exponential speedup when you ignore how you load those systems of linear equations onto the quantum computer. Loading all those entries into a superposition naïvely takes too much time, and drops the algorithm out of the logarithmic regime. Workarounds are possible, but difficult: One could generate the system on the quantum computer using some other algorithm (but this doesn’t apply to any generic problem) or one could load the system in superposition from a ‘quantum memory’ or QRAM (although it's unclear if building such a thing is possible). To make matters worse, HHL does impose some restrictions on the types of systems that can be solved. And finally, the output of the algorithm is not actually the answer to the system of linear equations – it’s the quantum state of that answer, and cannot be directly measured without destroying some information! We might have to re-run HHL multiple times to get all the information needed to truly solve the system of equations, again destroying our speedup. This ultimately makes many schemes that rely on the HHL algorithm (most saliently, quantum machine learning) infeasible.

These are of course, the algorithms we have available today. It is entirely possible that a new algorithm could be created that bests these unwieldy beasts and leads to quantum dominance. However, those new potential algorithms still have to grapple with some of the structural challenges of trying to get quantum advantage on these sorts of tasks. First and foremost, it is challenging to load lots of data into or out of a quantum computer. In many cases, that is a rate limiting step, and may limit advantage.

Moreover, we’ve seen several times that successful exponential speedups require some sort of special ‘structure’ in the problem (e.g., Shor’s). Arbitrary big data problems without structure will also have a difficult time achieving more than quadratic speedups, at least based on our current knowledge of quantum computer capabilities.

This seems to significantly limit the utility of quantum computing for optimization and machine learning applications. Classical computers, and especially GPUs, have proven themselves incredibly capable at handling problems that deal with bulk operations on massive sets of data. It seems that quantum computers ‘desire’ the opposite – limited data input/output, but complex and long calculations on said inputs. Hence we arrive at the ‘killer app’ of quantum computing: simulation.

Simulation

This is the original quantum computer application, and certainly the most exciting. Feynman outlined the concept best when he said: “nature isn't classical, dammit, and if you want to make a simulation of nature, you'd better make it quantum mechanical.” It intuitively makes sense that simulating complicated molecules, chemical interactions, and properties like superconductivity should be hard to do! Moreover, it’s clear that classical computers, while having made great strides, haven’t yet cracked the code of molecular simulation. We do utilize simulators for drug design, material development, and fundamental physics research, but they are neither fast nor perfect. And the potential impacts are sky high when it comes to simulation: Superconductors! Low-carbon fertilizer production! Drug discovery! Nuclear fusion and limitless energy! Wowee!

As you can imagine, this is a wonderful story that the quantum computing industry loves to tell. But, is it true? I’d like to spell the chain of logic out here, and examine each link. Here’s the high-level argument:

1. Classical computers cannot efficiently simulate molecules (or inter-molecular interactions) to a sufficient level of accuracy.
2. Quantum computers can efficiently simulate molecules to a sufficient level of accuracy.
3. Simulating molecules will lead to incredible, world-changing impacts.

I think point 3 is particularly important. While we will cover the status of the quantum computing ‘market’ in Chapter 4, the point of the applications I’m covering here is to provide value to someone. As I’ve discussed above, I don’t find quantum computer usage for encryption to be particularly value-adding, and I don’t think they will be useful at all for optimization or machine learning. So for me, the entire ‘value’ of the quantum computing industry (around 10 public pure-play quantum companies, dozens of startups, and some fraction of the market cap of Google, IBM, and Microsoft) rests on its ability to do something useful with simulation.

Classical capabilities

So let’s start with point 1, and try to understand the classical state of the art. Chemical simulations run the gamut from routine to impossibly complex. Typically processes that involve macro-scale, classical interactions are more straight forward to model and solve (think back to modeling reaction rates in high school chemistry). However, a great deal of interest in the world of chemical simulation lies in properties that are inherently quantum.

Most important is the ‘molecular ground state energy’. We’ve previously talked about ions and atoms in the context of qubit platforms, and noted that we typically encode $\ket{0}$ as the lowest energy state of the system, AKA the ground state. The system here is a single particle (ion or atom), but it has some Hamiltonian which specifies all its valid states (and their respective energies). More complex systems – i.e. molecules – also have Hamiltonians that describe their energy levels. We focus on the ground state energy because it’s practically the most useful: Systems naturally go to their ground state energies, and understanding if a structure is stable; or if a reaction is favorable, depends on understanding the relative ground state energies of the system and its components. This propagates to virtually every practical and theoretical application of chemical simulation, classical and quantum:

• Drug discovery practically involves huge numbers of estimations of ground state energy to predict the relative efficacy and stability of drug candidates.
• Earlier, I mentioned low-carbon fertilizer production as a potential product of quantum computer-enabled simulation. Why? Well, humanity currently makes ammonia (fertilizer) using the fossil-fuel based Haber-Bosch process, which requires huge energy inputs (and associated emissions). Nature performs nitrogen fixation (turning atmospheric nitrogen into ammonia, just like Haber-Bosch) at room temperature and pressure using an enzyme called nitrogenase. We sort of know how nitrogenase makes the magic happen – it involves a helper molecule (called a cofactor) that catalyzes the reaction. But we don’t understand the actual steps by which nitrogenase and this helper, commonly called the FeMo cofactor, or FeMoco, do the fixation! If we could solve for the ground state energy of FeMoco, we could potentially help solve this mystery, and perhaps, unlock low-emissions fertilizer!
• High temperature superconductors have long been a holy grail for physicists, but understanding the phenomenon of superconductivity is notoriously difficult theoretically. The most common angle of attack is known as the Fermi-Hubbard model, which describes the highly-coupled interactions between electrons in a lattice. We’d love to be able to solve these models better, potentially unlocking how to engineer superconducting materials.

But I digress. We’re talking about the capabilities of classical simulation. Clearly, we can already do some ground state energy estimation, since there are thousands of computational chemists in the world today, armed with nothing but classical computers, working on problems such as drug discovery, chemical synthesis, and molecular characterization. Unfortunately, these simulations may not always be straightforward. Calculating a molecule’s ground state energy ostensibly requires taking into account the relative positions & energies of all of its component electrons. Those electrons are fundamentally quantum beasts, and thus have (potentially) quantum mechanically mediated interactions with their peers. To properly and completely simulate every one of those interactions is a very difficult game, and scales exponentially with the number of electrons or orbitals in a system. Computational chemists today have a variety of tricks to help simplify this process: the most simple of which is to ignore quantum effects altogether, looking only at ‘molecular mechanics’. This tends to be fast, but obviously less accurate than including quantum mechanical effects (how much less accurate is highly dependent on the system in question).

If quantum mechanical effects are to be included in a simulation, an array of computational tactics can be used, each with varying degrees of complexity. Again, the tradeoff is between speed and accuracy. The most base of these is called the Hartree Fock (HF) method. An HF simulation makes a simplifying assumption, wherein each electron only interacts with the average field of the other electrons (rather than having individualized interactions with each other particle). This assumption radically accelerates computation, at the cost of accuracy. The relative accuracy penalty however, really depends on the kind of molecule! Chemists make distinctions between molecules with different kinds of inter-atomic correlations, some of which can be quite well-simulated by classical methods. More complex molecules, however, may require much more advanced approaches. Various other methods essentially build on top of Hartree Fock and the closely related Density Functional Theory (DFT), culminating in the intimidating ‘CCSD(T)’ method*. CCSD(T) is often called the gold standard of computational chemistry, but it’s no free lunch. It’s application comes at a steep computational cost: Implementing the approach scales with $O(N^7)$*. For large molecules, that does in fact become impractical! But, these wily chemists have more tricks up their sleeves. They can segment larger molecules into sections, and perform more robust, time-consuming simulations on sectors where more local quantum interactions occur. After all, (this is a point that computational chemists like to make) quantum effects such as entanglement are delicate! To first order, two people are not entangled, and neither are two molecules. Generally, in large systems we wouldn’t expect two electrons from opposite parts of the system to have quantum-mediated interactions. Thus you could imagine some sort of approach (and indeed, this is what chemists do today) that combines fast classical simulation with more precise, selective, quantum-aware aspects.

Moreover, there’s a lot of industry interest in approaches which are even faster than these HF/DFT style strategies. We have enormous amounts of compute deployed in data centers for various machine learning and artificial intelligence applications. A natural question is to ask whether some of these ML approaches (and the copious infrastructure that is deployed to support them) can be used for chemical simulation. And indeed, there are a host of startups that are investigating neural network potentials as an enabling tool, given their favorable linear scaling and reasonable levels of accuracy. This is still a relatively nascent approach, so we might expect to see significant gains on this front in the near future.

But what of this headline point that current day simulators are hamstrung and limited? Well, the truth is that it’s complicated. Even with all our tricks and computational power, there are simulations we cannot do – there are any number of enzymatic reactions we’ve never been able to simulate. Moreover, some problems, such as simulating superconductivity, involve long-range electron interactions that are not well-suited for HF/DFT-style approaches.

And crucially, we’d like to be able to do many of these simulations fast. In drug design especially, chemists often need to perform huge quantities of iterative simulations; it’s often an acceptable tradeoff to have lower accuracy but much faster simulations to increase throughput.

Even in other, more complicated simulation domains, the computational chemists are not sitting still. For a long time, this problem of simulating FeMoco has been a sort of north star for the field, especially for the quantum side. Any number of papers have been written describing how many qubits would be needed to solve the problem, considered to be intractable with classical methods. And yet, in 2026, a group from Caltech led by Professor Garnet Chan, published results for their classical estimation of FeMoco’s ground state energy (with chemical accuracy!). We’ll return to the implications of this startling result shortly, but I think it’s worth underscoring this point yet again: Classical approaches are always getting better!

Quantum computer enabled simulation

Claim 2 is that quantum computers will be able to efficiently do accurate chemical simulations. At least right now, the best known approach for quantum-enabled simulations is known as ‘quantum phase estimation,’ or QPE. Some of the variational algorithms discussed above could also be used, but at the expense of probability of success, total runtime, and/or accuracy. As a result, we will focus our interest on QPE, and assume its utilization in a world with fault tolerant quantum computers.

The operational principle of QPE (which is in fact used as a subroutine in Shor’s algorithm) in chemistry applications is as follows: Prepare a guess (often called an ansatz) of the ground state of a system. That is then encoded into qubit form. Run the QPE with the ansatz as an input, and it will project the ansatz state onto the real ground state, with a probability of success proportional to the overlap between the ansatz and the ground state. After that, measurement of the output qubits gives you the ground state energy! There are some complications I’m glossing over here (how do we encode molecular states into qubits?!), but this is schematically correct.

An additional wrinkle is ‘time evolution’ – i.e. how does the Hamiltonian evolve over time. This might be relevant to thinking about reactions actually occur, like a drug binding to its target. In many cases, where molecules are not strongly entangled, it may be straightforward to evolve the ground state over time with classical methods. However, some cases (photo-chemistry is an oft-cited example) nuclear dynamics become very important, and classical approximations break down. In these cases, a quantum computer would be able to evolve the system natively by applying gates, in a process called Trotterization. Unfortunately, things are a bit trickier than standard QPE on the read-out front, since it’s not possible to extract the full quantum state in one-shot. You’d have to run the circuit over many shots to extract the full picture of the quantum state after evolution.

One potential problem with this whole QPE story is easy to see: We need a good guess of the ground state to be able to produce the ground state! If we start with a totally random ansatz, then the QPE will only succeed after exponential time, leaving us practically far behind the classical approach. The typical approach is to use a HF approximation as the ansatz, and proceed from there. A classical proponent would say, A) that HF (or a DFT approximation with similar computational effort) is probably good enough for a lot of applications; B) even getting to that HF ansatz is computationally difficult for lots of highly coupled systems like these Fermi-Hubbard models; C) for these very difficult problems (such as FeMoco) the HF approximation is quite poor, leading to much longer hypothetical quantum run-times! A more subtle problem is that it might be difficult or time consuming to actually load that ansatz into the quantum computer, again eating away at any quantum advantage.

The quantum proponents say, look, there are lots of molecules where classical approaches today simply aren’t tractable, but with a reasonably good ansatz we can use QPE (or even variational approaches) to get highly accurate ground states. This in fact is a really crucial element of the argument for quantum computers in chemical simulation: QPE makes a guarantee about how accurate its result is. However, the probability of getting to that result (corresponding directly to its runtime) is directly proportional to the quality of the ansatz. So we still run into the problem of ansatz quality! Nevertheless, these papers predicting theoretical run-times often make guarantees about chemical ‘accuracy’ (e.g., to X milli-hartrees). Our classical methods don’t have such a guarantee built in*.

I do think the quantum vision is cogent here, assuming the hardware is capable enough. The more-accurate CCSD(T) and its ilk have very unfavorable scaling ($N^7$, remember!) and we’ve already reviewed that making cubic or quartic polynomial speedups could result in practical quantum advantage. This seems to spell out an opportunity for real quantum speedups! Of course, both camps believe in the important role of classical simulation here. A successful quantum-enabled system would have tight integration of classical HPC resources with its quantum processor.

Time estimates of these quantum algorithms obviously vary depending on approach and molecule complexity. This paper estimates that with qubit counts in the low thousands, the ground state energy for molecules like FeMoCo could be simulated in around ten hours. This one says about 5 million qubits can solve cytochrome P450’s (a liver enzyme) ground state in about a hundred hours. This seems to indicate that quantum computational approaches are probably more useful for situations where one desires high accuracy rather than high throughput.

But there are alternative visions for quantum-enabled simulation besides this QPE-based approach: First and foremost, there are many people working on analog simulators, typically utilizing ultracold atoms or molecules. We’ve discussed analog approaches briefly before, but it’s worth emphasizing how they are different then the digital quantum world that most ‘quantum computers’ live in. In the QPE approach above, a critical step is encoding the problem of interest into some sort of binary notation: one common approach is to represent each orbital as a qubit, such that if an orbital is occupied, that qubit would be in the $\ket{1}$ state. Then, the actual algorithm runs as a series of 1- and 2- qubit gates on those qubits (and some set of ancillas). The analog approach says hold on, why do that encoding at all? We’re talking about continuous systems! Their approach leans on some physics I can’t hope to understand, wherein when atoms/molecules get super cold, they begin to behave like smaller quantum particles. In their systems, they cool down particles, position them in a specific way that represents a problem of interest, then apply fields and make some measurements. This allows them to attempt to simulate these Hamiltonians and find ground states of interest, among other things. One particular hot topic for the analog simulators is the Fermi-Hubbard model we discussed earlier. This is a semi-idealized model of electrons moving through a lattice. The model is A) quite hard to simulate with conventional approaches, especially as its size increases; B) related to interesting physical phenomena such as superconductivity. You could also attempt to solve Fermi-Hubbard with ‘standard’, digital QPE. However, given the relative maturity and capability of gate-based computation (particularly limited circuit depth), analog approaches are currently in the lead here.

And then there are digital, gate-based approaches that aren’t based on standard QPE. The aforementioned Garnet Chan has an interesting paper proposing a high-order polynomial speedup for certain coupled cluster simulations using a novel quantum encoding technique. This is sort of orthogonal to typical QPE proposals since it is targeting speeding up simulations in a regime where classical methods have typically excelled.

And of course, I have to end with the ever present caveat – new algorithms might be developed! Who knows what might be possible when better hardware capabilities are available to researchers.

Quantum simulation & impact

Finally, let’s say we do get these ground state energies. Do they change the world? This is a tricky question, and I’ll tell you immediately that I won’t be able to give a satisfying answer. Certainly, some people think yes. My personal belief is that accurate ground state simulation of complex systems (whether that be classical or quantum based) is potentially very valuable, but not world-changing.

Today, there are legions of computational chemists who routinely do ground state estimation in service of drug discovery. This is one step in a complex workflow, wherein candidate drugs are proposed then winnowed down until something is manufacturable, effective, safe, and commercially viable. For hit identification, throughput is a priority; huge quantities of candidates need to be screened. This seems to be a very good fit for more heuristic, tensor based approaches which excel in speed to solution rather than accuracy. On the other hand, different parts of the development process (i.e. structure based drug discovery) rely on more in-depth analysis of a smaller subset of candidates. If a highly accurate and sufficiently fast quantum approach was available, it could be useful. Continuing along this line of thinking: low-throughput, hyper-accurate simulations could be helpful for fundamental understanding of protein interactions (thus feeding into better selection of targets for future efforts).

There’s this concept of ‘Amdahl’s law’, which says that the speedup associated with optimizing a portion of a process is proportional to the time that portion is actually used. Put otherwise, bottlenecks move! I’m sure just about every drug manufacturer in the world would take a better simulation tool, but it certainly wouldn’t solve all their problems. There are many other bottlenecks in the drug discovery process, from target selection (what do we even need to simulate in the first place) to trials (do our drugs even work). So I think this all sort of eats into the story of quantum computing being revolutionary for this market, but leave the possibility of it being an important tool open.

On other fronts, things get murkier. There’s a chance that simulation reveals something fundamental and clear about superconductivity or nitrogenase operation that immediately leads to groundbreaking new materials or processes. I can’t rule that out! But it seems more likely that the information will be much more granular and hard to utilize. I’m going to quote Professor Garnet Chan directly here, from his blog post about his team’s classical FeMoco simulation work:

The […] proposition, that elucidating the reaction mechanism of nitrogenase will lead to a transformative societal impact, is […] nuanced. The claim originates in the observation that the competing industrial process for fertilizer production via nitrogen reduction, namely, the Haber-Bosch process, takes place at high temperatures and pressures and consumes a significant percentage of the world’s energy. Bacteria, on the other hand, can do this process at room temperature.

While it is true that the nitrogenase enzyme functions at ambient temperature and pressure, it is simply false that it consumes much less energy. This is because the large amount of energy required for nitrogen fixation mainly originates from thermodynamics, i.e. one needs energy to break the strong nitrogen triple bond. In fact, taking into account the physiological conditions and the ATP cost, bacteria arguably expend more energy to reduce ammonia than a modern efficient industrial implementation of the Haber-Bosch process. Thus the real hope behind trying to understand the nitrogenase mechanism in the context of societal impact is that we may one day engineer a variant of it with more desirable properties, e.g. with higher turnover, or with a lower carbon footprint, or which is more selective for nitrogen reduction. Whether this is actually possible remains to be seen, and certainly requires much more than knowing the ground-state of FeMo-co, or even the full reaction mechanism.

If you are at all interested in this question, I highly recommend reading the full blog post.

Where does this leave us for the question of quantum utility for simulation? I am loathe to give you an opinion to adopt whole cloth. To me, it seems possible that a fully developed, fault tolerant quantum computer could outperform classical computers at certain simulation problems, particularly when it comes to accuracy. The relative probability of that outcome though, depends on how fast such a computer could be developed. Classical simulation approaches seem to be advancing quite rapidly, especially with interest from the ML/AI world overflowing into other application spaces. I think it is just as possible that in the next decade, we end up with extremely practical classical approaches for even large systems of interest, eating away at potential applications for a quantum computer. In the domain of Fermi-Hubbard, I think there’s a lot of reasons to be optimistic about the scaling and utilization of analog quantum simulators to solve these problems on time-scales much sooner than FTQC.

This is the application space for quantum computing I feel most optimistic about, but that’s more a reflection of my bearishness for spaces like encryption and machine learning rather than my excitement for quantum computer-enabled chemical simulation. Perhaps one way to frame my hesitancy is this: If all the money flowing to quantum computing went to computational chemists, where would the field be today?

On Value

I reject categorically the notion that all research and development has to be done with a specific consideration for applications and end-user value.

Application-unoriented research and experimentation has yielded many world changing innovations (electromagnetism, the internet, X-rays, etc.). Similarly, research intended for one use case has often gone to result in significant impacts for other industries: today's semiconductor manufacturing processes rely on extreme ultraviolet (EUV) lithography machines which use laser technology originally developed for defense, fusion, and medical device appications.

And yet, I think at some point you do have to do a cost-benefit analysis of the impacts of funding a direction of research, especially when it is becoming more mature. Quantum computing is at a strange place, where it has decades of theoretical & algorithmic research; ever-increasing hardware capabilities; a still uncertain and long timeline to fault tolerant operation; and a cloud of financialized hype growing around it. We’ll discuss this last point further in the next chapter, but I want to take a moment to review our survey of applications and try to draw some conclusions.

Going down the line:

• It’s interesting to perform quantum-enabled calculations for their own sake, but they have no real world impact.
• Breaking encryption schemes certainly is a real, quantumly-advantaged application. But the world is rapidly moving toward post-quantum encryption schemes that will make quantum computers inefficient at decryption. Perhaps there will be some impact for hackers and bad actors trying to harvest old data for value, or exploit vulnerabilities in cryptocurrency protocols. But it’s not very… exciting.
• Machine learning and optimization are unnatural fits for quantum computers, which have problems with data throughput and no general way to access exponential or high-order polynomial speedups for these kinds of problems. There might be advantage on the table for extremely specific, quantum-native problems, but it’s certainly not generic. Meanwhile, classical GPU-accelerated methods are getting so good here, and show no rate of slowing their rate of progress. It seems doubtful that this will provide long term value!
• Quantum computing for simulations is a real application, but not a panacea to every difficult chemistry/physics problem. In general, classical methods are sufficient for the vast majority of problems that computational chemists deal with today. Quantum approaches may be able to get higher accuracy solutions than conventional computers, but not at high speed. This will probably be an unfavorable tradeoff for applications that demand high throughput, such as drug design or materials discovery. It may be transformational for problems that are (currently) intractable for classical approaches, such as studying superconductivity. However, even for these: A) analog quantum simulators show a lot of near-term promise, perhaps eating away into the impact of quantum computers; B) classical approaches are always getting better; C) solving the specifically scoped mathematical problems in question does not translate directly into some sort of world-changing discovery. The most likely future here is that (if successfully developed) quantum computers get integrated into high performance computing nodes at some universities and national labs, and are a tool in the proverbial toolbox for computational chemistry.

Not-quite-parting Thoughts

And so, we’ve learned all we’re going to learn on the technical side. We’ve covered theoretical computer science, semiconductor physics, and computational chemistry, among other topics. I’m reasonably convinced that if you’ve read and internalized the above, you’ll be able to be ‘quantum literate’. Will you be able to understand the proof on some quantum algorithm paper? No, probably not. But can you parse through headlines and understand things at a reasonable level? Hopefully!

Let’s try using our noggins and working through a case example: At the time of writing, the top-voted paper on Scirate (a sort of community voting platform for quantum computing papers) is “Fault-Tolerant Quantum Computing with Trapped Ions: The Walking Cat Architecture ”. OK! The title is pretty straightforward: this is a proposal for a quantum computer architecture that uses trapped ions that the authors think could enable fault-tolerant operation. We can read the abstract and go deeper:

We propose a fault-tolerant quantum computer architecture for trapped-ion devices, which we call the walking cat architecture. Our blueprint includes a compiler, a detailed description of all the quantum error-correction protocols, a micro-architecture, a sufficiently fast decoder, and thorough simulations. The backbone of the architecture is a cat factory, producing cat states distributed throughout the machine, which are consumed to perform logical operations. The walking cat architecture is based entirely on a modern quantum error-correction approach called low-density parity-check (LDPC) codes. […] Our dense architecture provides a design with 110 logical qubits executing about one million T gates per day using only 2,514 physical qubits. We estimate that the quantum Hamiltonian simulation of a Heisenberg model on 100 sites can be executed within one month with 10,000 physical qubits, including all shots required to achieve chemical accuracy, suggesting that such a device could enter the regime of classically intractable physics simulations. […]

This makes things a bit clearer: they’re going to use LDPC codes, which we’ve covered (and certainly it makes sense for a ion-based computer to use a LDPC approach, which would utilize non-local interactions). They figure out some decoding schemes for error correction, do resource estimates for a fault tolerant system, and do some modeling of system throughput for a real-world problem. A headline takeaway might be the density of their logical qubit encoding: a ratio of approximately 23 physical qubits per logical qubit is a very impressive figure, and one that might merit some additional scrutiny or skepticism. Doing a close reading might be out of our comfort zone, but we now have the tools to parse what's going on!

Not every paper or press release will be so simple. But I hope that this work has given you the tools and mental models to think about quantum computing in a structured and critical way.