Factoring 15 with a remote quantum computer: a complete guide for beginners

We present, for the non-specialist, an experimental implementation of Shor’s factoring algorithm. We are unaware of any other single reference that explains, in a beginner-friendly way, complete circuits that implement Shor’s algorithm. We perform the experiment with IBM quantum processors, which are remotely accessible online for free. We reproducibly factor 15 with one 7-qubit processor (ibm_perth), while four other quantum processors exhibit excessive error.


Introduction
Quantum information science is a rapidly growing field whose importance was highlighted by the 2022 Nobel Prize in physics [1].One of the 'killer apps' [2] of quantum information science is Shor's factoring algorithm, which has the potential to invalidate internet security protocols currently in widespread use [3].While the literature is full of information about Shor's algorithm, we found it challenging, even daunting, to assemble pedagogical materials appropriate for an undergraduate experiment.Typical research papers [4][5][6] are difficult for the non-specialist to comprehend, and typical textbooks [2,[7][8][9] lack complete details about implementing Shor's algorithm with standard quantum gates.We hope to provide a convenient, standalone reference to allow instructors and students to run Shor's algorithm on real quantum processors (accessed online for free) [10].This experiment can be performed on its own, as part of a quantum computing unit, or in a quantum computing course [11], and it can help satisfy the 'urgent need for bachelor's degree programs, courses, and curricular materials for quantum information science and engineering' [12].Satisfying this need, in turn, will help address the 'urgent need for experts in the field' [13].
To learn Shor's algorithm, students need to be familiar with complex numbers, summation notation, eigenvalues, and eigenvectors.Familiarity with Dirac notation is helpful but can be learned in this context; the computational basis states introduced below (|0〉, |1〉, |2〉, etc) can be viewed as abstract unit vectors similar to the more familiar Cartesian unit vectors (i , ^j , ˆand k ˆ).No other background in quantum mechanics is required, and all other necessary concepts are introduced below.
In the remainder of this section, we introduce qubits and quantum gates.In section 2, we introduce the quantum Fourier transform and inverse quantum Fourier transform.In section 3, we use the inverse quantum Fourier transform to perform quantum phase estimation, which estimates the eigenvalues of operators.In section 4, we define a problem called 'order finding' and solve it with quantum phase estimation.Finally, in section 5, we show how Shor's algorithm uses order-finding to factor a number.
The fundamental unit of quantum computing is the qubit.Whereas a classical bit is either 0 or 1, a qubit may be in a superposition, written c c 0 1. | | is the probability of measuring 1.The normalization condition, c c 1, = is just the statement that 1 is the totally probability of measuring a possible result.(A measurement that yields 0 or 1 is called a measurement in the computational basis.Measurements in other bases are theoretically possible, but all measurements in IBM Quantum are in the computational basis.) The general state of two qubits is c c c c 0 0 0 1 1 0 1 1 , 00 01 10 11 We typically know from context whether a number is in binary or base ten.)The general state of two qubits is then c j , and the normalization condition is c 1.
When two qubits are measured, the result in base ten is 0, 1, 2, or 3. When multiple qubits are measured, the result is a whole number j.State j | ⟩ is called a computational basis state.The general state of n qubits is a superposition of N 2 n = basis states, c j .
We manipulate qubits by using operators called quantum gates.Only a handful of gates are needed to implement Shor's algorithm.The quantum NOT gate, also called the X gate, transforms 0 All quantum gates are linear operators, which means that they act on superpositions in a straightforward way: The Hadamard gate, H, creates superpositions: Both equations can be combined into one where j is 0 or 1.The phase gate, P , ( ) Finally, the SWAP gate swaps two qubits.For example, SWAP 01 10 .

| ⟩ | ⟩ =
In this example, the two-bit value that would be measured changes from 1 to 2.
All of these gates can be modified so that they act only if a 'control' qubit is in the 1 | ⟩ state.For example, CNOT, the controlled NOT, applies the X operation to the 'target' qubit only if the control is 1 .
We are already prepared to analyze useful quantum circuits, which will culminate in Shor's factoring algorithm.

Quantum Fourier transform
The Fourier transform provides information about frequency distribution.For example, the Fourier transform of the sound wave of a chord, indicates the frequencies of the notes in the chord.The quantum Fourier transform provides information about the frequency, or period, of amplitudes in a multiqubit state.For example, the two-qubit state 00 10 0 2 0 0 1 2 0 3 the periodic sequence of amplitudes is , 0. The quantum Fourier transform of an n-qubit basis state j | ⟩ is defined as where N = 2 n is again the number of basis states.We need to construct the QFT out of standard gates.Our implementation of Shor's algorithm will require a 3-qubit QFT, so we explicitly write out equation (5) for the N = 2 3 = 8 basis states: It will be convenient to write the numbers in 3-bit binary, so QFT 000 1 2 2 000 001 010 011 100 101 110 111 .7 Now we see that the right-hand side can be factored into the states of the three individual qubits: QFT 000 It is instructive for students to repeat this process for the other six basis states, to arrive at e QFT 010 1 2 2 0 1 0 e 1 0 1 , 0 e 1 0 e 1 0 e 1 , 13 QFT 101 1 2 2 0 e 1 0 e 1 0 e 1 , 15 QFT 110 1 2 2 0 1 0 e 1 0 e 1 , 16 QFT 111 1 2 2 0 e 1 0 e 1 0 e 1 .17 Next, we write j in terms of its bits j j j . 2 1 0 Students can confirm that equations ( 8) and ( 11)-( 17) are all special cases of j j j QFT 1 2 2 0 e 1 0 e 1 0 e 1 .18 We will show that the circuit in figure 1 implements equation (18).We first must decide whether j j j | ⟩ is the bottom qubit or the top qubit.Although most authors would make it the top qubit, IBM Quantum [10] makes it the bottom qubit: the bottom qubit is written first (on the left).We will use the IBM convention, which is also used in an excellent recent textbook [9].
To analyze circuits, we apply one gate at a time, reading the circuit from left to right.The initial state is j j j .| ⟩| ⟩| ⟩ The H gate on the bottom qubit transforms the state into where the dot indicates the control qubit.This gate acts only when j 1 = 1: when The controlled P After the final controlled P 2 ( ) p gate, which acts only when j 0 = 1, the state is j 0 e 1 0 e 1 .
The H gate on the top qubit yields 0 e 1 0 e 1 0 e 1 .
The final symbol represents the SWAP gate, which swaps the first and last qubits: This is the right-hand side of equation (18).The inverse quantum Fourier transform (IQFT) reverses equation (18): To design the IQFT out of standard gates, we need to know the inverses of the individual gates in the QFT circuit.The SWAP gate is obviously its own inverse.Equation (2c) implies that the H gate is its own inverse because two applications of H multiply 1 | ⟩ by e 1.
shows that the inverse of P ( ) q is P .( ) q -If the QFT is followed by the IQFT, all the individual gates must be canceled out by their inverses.So the IQFT consists of the inverses of the gates in the QFT, in the opposite order.
When students first encounter QFT and IQFT, they are liable to think, WTF? Their efforts are rewarded when they get to use the IQFT in the killer app of quantum computing.

Quantum phase estimation
Equation (3) shows that the eigenvectors of P ( ) q are 0 | ⟩ and 1 , | ⟩ with eigenvalues 1 and e , iq respectively.In fact, the eigenvalues of all quantum gates have a norm of 1 and can be written e .
iq This is because quantum gates are unitary operators (to preserve normalization), and the eigenvalues of all unitary operators have a norm of 1.Quantum phase estimation is used to experimentally determine the eigenvalues of operators.
Suppose an operator U has an eigenvector v | ⟩ with eigenvalue e .iq Suppose we want to apply a controlled-U (CU) operation to v .
| ⟩ Writing the control first, CU applies equally well to superpositions, so, for example To determine q to three bits of precision, we need three qubits in addition to v .| ⟩ The three qubits form the 'eigenvalue register,' whereas v | ⟩ is the 'eigenvector register.'Writing the eigenvalue register first, let the initial state of our circuit be v 0 0 0 .| | ⟩| ⟩| ⟩ ⟩ We apply an H gate to each qubit in the eigenvalue register, transforming the state to The circuit is shown in figure 2, for U P .
Next we apply CU twice (or equivalently, a controlled U 2 ), with the control on the second qubit from left: Finally, we apply a controlled U 4 , with the control on the leftmost qubit: In the example in figure 2, U P , 4 ( ) ( ) where j is the binary fraction j j j j j j j 0.
2 4 8 23 The subscripts are chosen for consistency with equation ( 18), as we will see presently.
Combining equations ( 22) and (23) Substituting equation (24) into equation (21), and using the fact that e 1 , 2 i integer ( ) = p ´we find that the eigenvalue register in equation ( 21) is exactly the right-hand side of equation (18).Thus, the IQFT applied subsequently to the eigenvalue register yields j j j .

|
⟩ So a measurement of the eigenvalue register yields j, which is used to calculate q and finally eigenvalue e .as a binary fraction.So the expected measurement is j j j 001. 2 1 0 = If the initial state of the top qubit is a superposition of eigenvectors, the measurement yields one of the eigenvalues.
In the preceding example, U acts on a single qubit, so v | ⟩ is a single qubit.In our application of Shor's algorithm, U will act on 4 qubits, so the eigenvector v | ⟩ will consist of four qubits.The eigenvalue register will still be three qubits.Figure 3 shows the circuit we use to implement Shor's algorithm, where U will be specified below.

Order finding
Shor's algorithm depends on modular arithmetic, the surprisingly rich mathematics of remainders.First, we define XmodN as the remainder when X is divided by N. For example, 16mod15=1.We then define the order of XmodN as the smallest positive r such that X r modN=1.For example, the order of 4mod15 is 2 because 4 2 mod15=1.
The heart of Shor's algorithm is quantum phase estimation, with U defined as a modular multiplication, with eigenvalues e , s r 2 i / p where s = 0, 1, K, r−1.When U operates on equation (26), the numerical value in the ket is simply multiplied by a: We separate from the sum the final term, where k = r−1: In ⟩ because a r modN=1=a 0 .Making these substitutions, and also substituting k = k′−1 in the sum, equation (28) becomes The separated term can rejoin the sum as k′ = 0. Then we see that the right-hand side is indeed the eigenvector, equation (26), multiplied by the eigenvalue e .

s r 2 i / p
To use phase estimation to find eigenvalues of U, the initial state of the eigenvector register must be an eigenvector, or superposition of eigenvectors, of U. Luckily, the easily constructed state is a superposition of eigenvectors of U. To prove this, we examine a normalized superposition of the r eigenvectors given by equation ( 26 The algorithm to experimentally determine the order of amodN is thus as follows.We use quantum phase estimation, with U given by equation (25), and the initial state of the eigenvector register given by equation (33).Each of the eigenvectors is equally weighted in this superposition, so each of the eigenvalues e s r 2 i / p is equally likely to be measured.More precisely, we write the eigenvalue as e e e , s r j and the measurement outcome is j s r, / = for any s from 0 to r−1.In our application of Shor's algorithm, s/r will be a terminating fraction.If r = 2 and we use three bits for the eigenvalue register, then s is either 0 or 1, so j = s/r is either 0/2 = 0.000 or 1/2 = 0.100 (a binary fraction defined in equation ( 23)); the measured result will be either 000 or 100.If r = 4, then j = s/r is either 0/4 = 0.000, 1/4 = 0.010, 2/4 = 0.100, or 3/4 = 0.110, and the measured result will be either 000, 010, 100, or 110.

Shor's factoring algorithm
Conventional computers cannot efficiently factor extremely large numbers.Conventional encryption protocols are secure only if factoring large numbers remains intractable.An ideal quantum computer could implement Shor's algorithm to rapidly factor large numbers and invalidate conventional encryption.Present quantum computers are far from ideal, but we can still use Shor's algorithm on the test case of factoring 15.
Shor's algorithm factors N = pq, where p and q are prime numbers.First, we choose an integer a such that 1 < a < N. We test whether a and N have a common factor.(This can be done efficiently on a classical computer.)If a and N have a common factor, then we have already factored N. Otherwise, we use the phase estimation circuit to determine the order r of amodN.If r is odd, or if a r/2 modN=N−1, then we pick a different a and try again.
If r is even and a r/2 modN ≠ N−1, we may proceed.We use the definition of the order r of amodN=amod(pq): -+ must be a multiple of pq.We will now show that neither a 1 can be a multiple of pq, so one of them must be a multiple of p, and the other must be a multiple of q.If a 1 were a multiple of pq=N, then a N 1 mod 0 = and the order of amodN would be r/2, not r.On the other hand, if a 1 were a multiple of pq=N, then a N 1 mod 0.
is a multiple of pq, one is a multiple of p, and the other is a multiple of q.
So, once our order-finding algorithm determines the order r of amodN, we know that a 1 r 2 ( ) /and a 1 r 2 ( ) / + each contain a different factor of N. For example, if we find that the order of 11mod15 is 2, then we compute 11 2/2 −1 = 10 and 11 2/2 + 1 = 12.We search for the common factor of 10 and 15, and the common factor of 12 and 15. (Classical computers have efficient algorithms for this, even for large numbers.)This completes the factoring of 15.
We wish to implement Shor's algorithm to factor 15 for all a < 15 that have no common factors with 15 (and for which a r/2 mod15 is not 14): 2, 4, 7, 8, 11, and 13.For each of these, we need to construct the operator U defined by equation (25 It is possible to construct such a U that operates correctly on all basis states: [5].However, the initial state of the eigenvector register is 1 , | ⟩ so that the initial application of U acts on the state 1 , | ⟩ so it is sufficient to design a U that converts state 1 | ⟩ to a mod 15 . This can be accomplished by NOT gates on the two qubits on the right (which are the top two qubits, q[0] and q[1] in figure 4).Since the U gate in quantum phase estimation is controlled, we place two CNOT gates in figure 4. The controlled U gate in figure 3  The astute reader protests that we have just determined the order of 2mod15 to be 4, while designing a circuit to compute the order of 2mod15.The astute reader is absolutely correct.Ideally, we would use a generic U operation, which acts correctly on all possible inputs, so that we would not have to do simplifying calculations in advance.However, these sorts of simplifying calculations are common in the literature [4][5][6].Without these simplifying calculations, the circuit requires far more gates, and we find that the error is excessive; every gate contributes to a cumulative error in the final results.
In some cases, U 2 as well as U 4 has no effect and is omitted.For example, when a = 4, the initial controlled U operation leaves the eigenvector register in a superposition of 1 | ⟩ and 4 .
| ⟩ If U 2 were to act on these states, the results would be U 1 1 4 mod 15 1

| ⟩ | ⟩ | ⟩ = ´=
The a = 4 case still requires U, which converts two of the four qubits change states.To change the appropriate qubits, we place CNOT gates on the rightmost qubit (q[0]) and the third qubit from the right (q [2]) in figure 5. Similar considerations for a = 7, 8, 11, and 13 lead to the CNOT gates in figures 6-9.
It is a good exercise for students to explain or construct the circuits in figures 4-9.We will do one more example, a = 7 in figure 6, because the calculations get slightly more complicated at larger a.The first U gate must convert 1 0001 the two middle qubits (q[1] and q [2]) must change, so we target them with CNOT gates.Then, The first case is achieved by a SWAP on q[0] and q [2], and the second case is achieved by a SWAP on q[1] and q [3].
We constructed the circuits in figures 4-9 using IBM's Quantum Composer [10], a simple graphical interface.(A Python-based interface allows more advanced programming [14], but is more challenging for beginners.)We implemented Shor's algorithm on five 7-qubit processors: ibm_perth, ibm_lagos, ibm_nairobi, ibm_oslo, and ibm_jakarta.On each processor, we ran each circuit 1024 times.(1024 is the default number of 'shots.') We first discuss results for ibm_perth, which are shown in figure 10.For a = 4 and 11, measurement is highly likely to yield either 000 or 100, which means that s/r as a binary fraction is either 0.000 or 0.100 = 1/2.We thus have experimentally determined that r = 2.We then find the common factor of 15 and a r/2 −1, and the common factor of 15 and a r/2 + 1.For example, for a = 4, 4 2/2 −1 = 3 and 4 2/2 + 1 = 5, the factors of 15.
Above, we obtained the values of r by visual inspection of figure 10.For an objective confirmation of r, we calculated the coefficient of determination [15] (R 2 ) for both r for all a.As expected, for a = 4 and 11, R 2 was larger for r = 2 than r = 4. Also as expected, for a = 2, 7, 8, and 13, R 2 was larger for r = 4 than r = 2.
Our successful results on ibm_perth were reproducible: we ran the experiment with ibm_perth three times, on different days, and each time we obtained results similar to those in figure 10.Shor's algorithm was not successful on the other four quantum processors: R 2 was     larger for r = 4 than for r = 2 for all values of a on ibm_lagos, ibm_nairobi, and ibm_oslo.The error on ibm_jakarta was different: in contrast with expectations, for a = 2, R 2 was larger for r = 2 than for r = 4; and for a = 4, R 2 was larger for r = 4 than for r = 2.Only ibm_perth had low enough error to correctly (and reproducibly) determine the order r for all a.
Figure 11 shows results for the same circuits run on a simulator.Simulated results are not identical to theoretical probabilities due to statistical fluctuations.However, the outcomes with probabilities of 0 never occur: the odd numbers (001, 011, 101, and 111) never occur in these simulations, and 010 and 110 never occur for simulations with a = 4 and a = 11.Comparing figures 10 and 11, we see the effect of experimental error in the quantum processors: Results that are ideally impossible do occur in real devices, in the current state of technological development.
Students will need various levels of guidance, depending on the course.Shor's algorithm was assigned as a final project at the end of our quantum computing course.Students had an entire 75 min class period to design and run their circuits on IBM Quantum.The instructor was available to answer questions.Students had already learned the theory and been given the generic circuit (figure 3) and the specific circuit for a = 2 (figure 4).They were given the option of designing U and U 2 for the five other values of a, or using larger circuits (figure 1(E) in [5], and doubling these for U 2 ) that would yield correct results when simulated but not run on real devices.Students who submitted lab reports before the deadline had the opportunity to revise and resubmit.Eventually, 31 out of 53 students designed and analyzed the six circuits perfectly.Students were very enthusiastic about this final project, which we believe led to uncommonly good course evaluations.Five students used the word 'best' or 'favorite' to describe the course or instructor.

Conclusions
Many students have heard vague rumors that quantum computing has the potential to revolutionize multiple industries, including network security.Implementation of Shor's algorithm, to obtain real experimental data, is a wonderful way to harness student interest and introduce the foundations of quantum information science.As a student wrote in a quantum computing lab report, 'seeing circuits actually in action on a real quantum system is an incredible sight and feeling.It served both to show just how far we have come in the field and just how far we still have to go' [16].
We have presented the simplest possible test case for Shor's algorithm, factoring 15.It is possible to factor larger numbers, even with 7-qubit processors, but the process is more complicated [6].Factoring 15 is a foundational skill for further studies [6,7,17,18] of Shor's algorithm.
the probability of measuring 0, and c 1 2

p
gate effectively multiples the 1 | ⟩ component of the bottom qubit by e j i 4 0 / p because it acts only when j 0 = 1.So the state after the controlled P 4 ( )

p
Next, we apply CU to v , | ⟩ where the control is the third qubit from left.Using equation (20c), the state becomes iq

Figure 2
Figure 2 shows quantum phase estimation applied to U P , 4 ( ) =

Figure 2 .p
Figure 2. Quantum phase estimation to determine the eigenvalue associated with the 1 | ⟩ eigenvector of U P .4 ( ) = p The ⨁ symbol on the top qubit represents a NOT, or X, gate.The IQFT begins with the SWAP gate (the line with´'s at both ends.)The three symbols on the far right represent measurements, and 'c3' simply indicates that three classical bits are the result.q[0], etc, are arbitrary labels.

Figure 3 .
Figure 3.Quantum phase estimation configured for Shor's algorithm using seven qubits.
k = 0.For nonzero k, the sum in parentheses is the geometric series sum over k has only a single nonzero term, when k = 0, so equation (31) simplifies to Subtracting N from the term in parentheses cannot change the remainder when dividing by N, But this would mean a r/2 modN=N−1, and we explicitly excluded this case.Since neither a 1 r 2

Figure 10 .
Figure 10.Experimental results from ibm_perth for the six Shor's algorithm circuits in figures 4-9.Each of the eight clusters of columns shows the frequency of the specified outcome (000 through 111) for each circuit (a = 2, 4, 7, 8, 11, and 13).The circuits expected to yield r = 2 are indicated by black columns.
the bottom qubit is multiplied by e .Thus the state after the first controlled P 2 ( ) After the controlled U, we need a controlled U 2 .Since the initial U is controlled, it may or may not act on the initial state 1 .The controlled U 4 operation must act correctly on each of these.In all four cases, we find that U 4 has no effect.For example, U 1 Since U 4 has no effect, we omit the controlled U 4 operation.