Simplified Factoring Algorithms for Validating Small-Scale Quantum

arXiv:1310.6446v2 [quant-ph] 14 Nov 2013 cmie icis o h re-nigsbotn in exponentiation modular subroutine associated order-finding and construct algorithm the Shor’s to for employed circuits” been “compiled have techniques other Among these [6–10]. uses, devel- construction techniques circuit efficient simplify to with oped circuits, quantum of tion parameters. currently nontrivial with any for possible modular technology general not realizable a is most for operation the circuits and Creating exponentiation implement need- execute. to algorithm, to gates the time quantum of most bottleneck op- the finding the ing exponentiation order is modular which an a eration, uses involves algorithm that com- Shor’s subroutine the of However, version technology. plete and new verification of for [5], characterization algorithm factoring Shor’s as such new that function. desired verifying their of execute is methods actually it new devices Therefore, quantum create [4]. to expo- the qubits) interest of to grows of number due (which the intractable with required nentially be measurements to of appears amount or qubits one than dozen more two beyond tomography state enhancements, despite quantum other However, full and sensing [1–3]. compressed devices in advances new of test functionality and technology, the computing quantum validate and ize technology. new of functionality for techniques the need verification verify circuit great to and a fully algorithms is a scale As there to small road computer, them. quantum the implement functional on to progress enough techniques advanced experimental not capabil- experimental are studied, ities and algo- developed quantum are complicated rithms While computing. quantum ∗ lcrncades [email protected] address: Electronic hr a enmc hoeia oko construc- on work theoretical much been has There algorithms, known well use to natural is it end, this To character- to used been has tomography Traditionally, in experiment of ahead much very remains Theory ipie atrn loihsfrVldtn Small-Scal Validating for Algorithms Factoring Simplified eateto hsc,Uiest fTrno 0S.George St. 60 Toronto, of University Physics, of Department ilrdc h ubro uisadgtsnee nagvnco given a in 03.67.Ac needed numbers: gates a PACS and be qubits can v of compilation number compiled experimentalists of the execute layer reduce for additional to will circuits an able compiled that been new demonstrate some only provide have with gene We date associated The bottlenecks future. to the to Experiments in due circuits elusive large v new to compiled experimentally validating extended on and based be characterizing scheme may of verification that different means a new propose a We for need a is oorpyhsrahdispatcllmt ncharacteriz in limits practical its reached has Tomography .INTRODUCTION I. mrGamel Omar rcsigTechnologies Processing Dtd oebr1,2013) 14, November (Dated: ∗ n ailF .James V. F. Daniel and n nageeti h opldcircuits. compiled noise the of in effects exponentiation entanglement the and account modular analyzes into compiled taking V order-finding, Section of and factored. example be specific subrou- to a exponentiation number In each modular for the [19]. al- tine between in relationship ref. periods the in discuss lowable those briefly we to cir- IV similar section using methods semiprimes, synthesis some cuit modular for compiled the circuits demon- the to constructing exponentiation III of it process Section distilling the strates involves, operation. it exponentiation steps modular the and algorithm significant has com- tomography these so where generalize or regime limitations. dozen can the a one to beyond qubits, if techniques validation seen needed. and qubits be pilation of to number remains of the It layer” reduces “classical that the a compilation construct including to circuits, techniques compiled some simple valida- demonstrate of We purposes the tion. for operation exponentiation ular forthcom- be [18]. soon ing indeed may algorithm Shor’s non-compiled of a version technologies of various implementation using Experimental out [11–17]. carried compiled been size. have of from manageable circuits circuit demonstrations more a the experimental to simplify Additionally, form infor- to general known complicated solution uses its the sense about this mation in Compilation operation. ceei s oa,RAcytgah 2] h algo- The polyno- [20]. in cryptography numbers RSA today, large use cryptographic factor common in most to scheme the one undermining comput- time, allows mial quantum It of applications ing. useful and promising nscinI,w rvd re vriwo Shor’s of overview brief a provide we II, section In mod- the of versions compiled use will we paper this In hrsfcoigagrtmi eda n ftemost the of one as held is algorithm factoring Shor’s to fnwqatmdvcs n there and devices, quantum new of ation h oua xoetainoperation. exponentiation modular the t,Trno nai,Cnd 5 1A7. M5S Canada Ontario, Toronto, St., a eso hrsagrtmhsbeen has algorithm Shor’s version ral dduigcascloeain,that operations, classical using dded ouei h erftr.W also We future. near the in use to rin fSo’ atrn algorithm factoring Shor’s of ersions .CasclPoaiitcSteps Probabilistic Classical A. ehooia dacsi hsfield. this in advances technological pldcircuit. mpiled I HRSALGORITHM SHOR’S II. rin ftelte operation. latter the of ersions unu Information Quantum e 2 rithm is based on an order-finding subroutine, which in and fewer evaluations are needed, leading to an efficient turn makes heavy use of the modular exponentiation op- computation. eration [21, 22]. The modular exponentiation is the bot- However, despite this, the order finding subroutine tleneck of the algorithm, needing the resources in terms comes with its own limitations. Order finding itself is of quantum gates and computation time. broken down to two steps; modular exponentiation and The purpose of Shor’s algorithm is to factorize a num- a quantum Fourier transform. The modular exponenti- ber N. It is assumed N is odd, and that it is not a power ation is what requires the most resources. The quan- of a prime number. The case N = pk for some prime p tum Fourier transform requires few resources, particu- and integer k can be checked by calculating √k N (the kth larly when implemented semi-classically [24]. So Shor’s root of N) for all integer k log3 N, which is an efficient algorithm while efficient, is still very difficult to apply procedure [21, 22]. Since N≤is not the power of a prime, practically given today’s limitations in quantum technol- it can be written as the product of two coprime integers. ogy. To see this, we discuss the order finding subroutine Shor’s algorithm non-deterministically finds a nontriv- separately below. ial factor of N in the following manner. First, a number adivisor of a and N, denoted gcd(a,N), is found using the Eu- B. Quantum Order Finding Subroutine clidean algorithm [23]. If gcd(a,N) = 1, then gcd(a,N) 6 x is a nontrivial factor of N, and no further work is needed. To find the order of the function fa,N (x) = a In case a and N are coprime, i.e. gcd(a,N) = 1, the mod (N) defined in eq.(1), Shor’s algorithm makes heavy algorithm uses the order finding subroutine explained in use of the modular exponentiation operation given by the next subsection to find the order of a modulo N. U(a): x 0 x axmod(N) . (2) Defining the function fa,N (x) as | i| i → | i| i x Clearly the structure of the circuit that implements this fa,N (x) a mod (N), (1) ≡ operation will depend on the random number a chosen. the order of a modulo N is defined as the smallest positive The quantum state is initialized at integer x such that fa,N (x) = 1. We denote the order r. M 1 The order r is also the period of the function fa,N (x), x 0 , (3) √ X | i| i that is fa,N (x) = fa,N (x + r). For Shor’s algorithm to M x=0 succeed, either r has to be even, or a has to be a square of an integer, so that either way ar/2 is an integer. where M = 2m is the smallest power of 2 that satisfies 2 If r is found to be odd, and a is not a square, then M N . We then apply the modular exponentiation ≥ the algorithm trial has failed and a new random number operation in eq.(2) to our initial state, yielding a above must be attempted. If r is even, we compute M M ar/2 mod (N). If ar/2 1 mod (N), once again the 1 1 ≡ − U(a) x 0 = x ax(modN) . (4) algorithm has failed and a new random number a must X X √M =0 | i| i √M =0 | i| i be tried. We note that ar/2 = 1 mod (N), because if x x r/2 6 a was congruent to 1 modulo N then r would not be Applying the inverse quantum Fourier transform will the smallest power that satisfies the order condition. yield a quantum state which when measured, will with Supposing the algorithm succeeded, we have that a high probability lead us to the order r of the function 2 2 ar/ = 1 mod (N) and ar/ = 1 mod (N), yet ar =1 f (x)= ax mod (N). 6 − 6 2 a,N mod (N). These statements imply that N ∤ (ar/ + 1) Since the modular exponentiation operation U(a) de- 2 2 2 and N ∤ (ar/ 1), yet N (ar 1)=(ar/ + 1)(ar/ 1). pends on the arbitrary number a, the general circuit im- − | − − We have used standard number theory notation, where plementing it must have a as a variable input, making b c means b is a factor of c, and b ∤ c means b is not a it very complicated. In other words, it is very difficult | factor of c. to create a single circuit that will execute the modular 2 2 Since N divides the product of (ar/ +1) and (ar/ 1), exponentiation in eq.(2) for arbitrary values of x and a. − but not each of them alone, then the nontrivial factors For this reason, the modular exponentiation is by far of N must be split between the two numbers. To find the most resource intensive part of Shor’s algorithm, and the factors, we simply use the Euclidean algorithm to is currently the biggest practical obstacle to implement- 2 calculate gcd(ar/ 1,N). With this, Shor’s algorithm ing the algorithm for useful values of N [10]. Though ± concludes. some experimental groups may soon realize an uncom- Note that the processes involved in Shor’s algorithm piled Shor’s algorithm [18], they will still be limited to can all be executed efficiently (in polynomial time) on small numbers for the foreseeable future. a classical computer, with the exception of order find- To handle this difficulty while still implementing most ing. It is a bottleneck for classical computing, since it aspects of Shor’s algorithm, researchers have resorted to requires a large number of evaluations of the underly- ‘compiled’ versions of the algorithm. Practically, this ing function; quantum parallelism removes this problem means that knowing N in advance, a specific value of the 3 number a is chosen that is known to yield a successful B. The Compilation Process result within the algorithm. Then the circuit U(a) for the modular exponentiation for the specific value of a is As explained above, compilation hitherto used consists constructed and used for the compiled algorithm. This of choosing a specific number a that is known to factor a will be much simpler than the generic algorithm, since we given N via Shor’s algorithm, and creating the circuit for no longer need to construct a modular exponentiation the function U(a) defined in eq.(2). We will demonstrate circuit that works for any value of a, but for a single compilation examples for the semiprimes N = 15, 21, and value. 33. These are the smallest numbers that are the product Of course, this roundabout process does not really fac- of two distinct odd primes. tor the number N, in fact it assumes previous knowledge The modular exponentiation function is periodic, and of the solution. This has led some authors to suggest that injective within a single period. Therefore, we will use “to even call such a procedure compilation is an abuse of methods of circuit synthesis similar to those used in con- language” [25], since compilers cannot know the solution struction of simple periodic functions which have the of the problem beforehand. same properties, discussed in ref. [19]. In the process, Nonetheless, the so called compilation process is of in- we show we can use a simple classical function to reduce terest as a proof of concept of aspects of the algorithm, the number of qubits and gates needed. One may call and is often the best that can be done with current tech- this a ‘layer of classical compilation’. nology. It is of interest to explore the process of compiling The circuits in this paper are constructed by inspec- circuits to create simple examples that provide milestones tion, and trial and error, making use of some general for experimentalists as technology advances. patterns and principles. Each circuit can be seen as two processes. The first is copying a linear combination of the input qubits to each output qubit via CNOT gates. This process must be used to create linearly independent combinations of the input bits in the output bits, which III. COMPILED CIRCUITS serve as the canvas on which the second process will op- erate. The linear independence ensures the condition of A. Implementations of Compiled Shor’s Algorithm injectivity within a single period is satisfied. The second process is the application of cascades of Much theoretical work has been completed on com- Toffoli gates to modify the results of the first process by piled circuits for the order-finding subroutine in Shor’s flipping some entries in the truth table. The first Toffoli algorithm. Beckman et. al. published one of the first gate of the cascade uses two suitable control bits. The theoretical works on the topic [6], discussing a possible Toffoli gate at each subsequent level of the cascade uses implementation through ion traps. The focus of that as one of its control bits the target bit of the previous work was minimizing the number of memory qubits and Toffoli gate. It is this Toffoli cascade process where most operations needed by using known properties about the of the creativity lies, since it is what actually creates number N to be factored. In particular, N = 15 was the desired periodicity. The first process alone cannot used as an example, and general methods developed for create odd periodicity. Note that the two processes may any N. be made to occur in tandem. Also note that all output qubits y are initialized to the state 0 . Similar work in developing theoretical techniqes to i If one thinks of the truth tables below,| i the first Toffoli compile the modular exponentiation subroutine was car- gate applied modifies a number of entries equal to a quar- ried out by Vedral [7], Van Meter and Itoh [8], and most 2 ter of the total length of the column (i.e. 2n ). Each recently by Markov and Saeedi [9, 10]. − consecutive Toffoli gate in the cascade flips half the num- Additionally, experimental demonstrations of compiled ber of entries of its target qubit as in the previous level circuits through photonic qubits [11, 12, 14] as well those of the cascade. For example, if n = 3 (as is the case for 3 2 with recycled photonic qubits [13], nuclear magnetic reso- S5 and S7), then the first Toffoli gate will flip 2 − = 2 nance [15, 16], and superconducting qubits [17] have been entries, the second gate in the cascade will flip 1 entry. 4 2 carried out. If n = 4, then the first Toffoli gate will flip 2 − = 4 As discussed above, compilation in the sense used in entries, the second gate in the cascade will flip 2 entries, this field does not really simplify the problem at hand. Its and the third gate will flip 1 entry. For n input qubits, a main purpose is to give milestones that closely resemble Toffoli cascade will have n 1 gates, with the final gate − useful tasks to nascent experimental devices. This will flipping only 1 entry in the truth table. help sharpen experimental techniques on the way to a full Where possible, the output of a Toffoli cascade is implementation of the algorithm. Moreover, Shor’s algo- copied over to other qubits via CNOT gates, to avoid rithm involves several steps, compilation oversimplifies need for an identical cascade. This copying may take only one of them, leaving the other steps intact. There- place in the middle of, or at the end of the cascade. Some fore, implementing a compiled version will directly help Toffoli gates may not be part of a cascade at all. us improve the technique involved in these steps. We use standard notation for CNOT and Toffoli gates, 4 with a black circle indicating the control qubit, and a in fig. 2 below. Although this circuit is a gross oversim- large circle with a plus sign inside indicates the target plification of modular exponentiation, it is still in some qubit. The small white circles we see in some circuits sense “compiled”. (such as fig. 6) are inverted control qubits, in the sense x2 x2 that the target bit is modified if the inverted control bit x1 • x1 has value 0, and is left unchanged if it has value 1. • 0 y2 The underlined entries in the truth tables denote the | i 0 y1 entries flipped by the action of a Toffoli gate, whether | i directly or indirectly (where the result of the Toffoli is FIG. 2: The fully compiled circuit for y = f˜2,15(x). Gate copied by a CNOT to another bit). Each underline is count: NT = 0, NCN = 2. an entry flip, so an even number of underlines leaves the entry unchanged. The use of the log2 function can be seen as a layer of “classical compilation”. We exploit this idea later in the paper to generalize it to other sorts of functions. 1. N=15 Moving to the case a = 4, the truth table for y = f4,15(x), for input x equal to 0 or 1 is in table II. We begin by considering the case N = 15. As in ref.

[11], we consider two subcases, a = 2 resulting in r = 4, x1 y3 y2 y1 and a = 4 with r = 2. Starting with the case a = 2, we 0 0 0 1 have table I showing the truth table for y = f2,15(x), for input x between 0 and 3. We use standard binary nota- 1 1 0 0 tion, and the input x is represented by 2 qubits x2, and TABLE II: The binary truth table for y = f4,15(x). x1 and the output y is represented by 4 qubits y4,y3,y2, and y1. For example, if x = 2, then x2 = 1, and x1 = 0. The circuit for y = f4,15(x) is given in fig. 3 below. x2 x1 y4 y3 y2 y1 x1 x1 • • 0 0 0001 0 y3 | i 0 1 0010 0 y2 |0i y1 1 0 0100 | i 1 1 1 0 0 0 FIG. 3: The circuit for y = f4,15(x). Gate count: NT =0, NCN = 2. TABLE I: The binary truth table for y = f2,15(x). Single qubit gates such as the NOT gate are easy to im- The function y = f2,15(x) can be implemented using plement, and we do not factor them into the gate count. the circuit in fig. 1 below. The underlined entries in the Although this circuit is simple as it is, one can fully com- truth table above are the ones that were modified by the pile it further [11] by defining f˜4,15(x) log4(f4,15(x)). action of a Toffoli gate, whether directly or indirectly This function simply maps 0 and 1 to≡ themselves, and via copying through a CNOT gate. We also reuse the can be implemented through a single CNOT gate as in definition of NT as the number of Toffoli gates in a circuit fig. 4. and NCN as the number of CNOT gates. x1 x1 • x2 x2 0 y1 x1 • • • x1 | i • • • 4 0 y FIG. 4: The fully compiled circuit for y = f˜4,15(x). Gate | i • • • 0 y3 count: NT =0, NCN = 1. | i 0 y2 | i 0 y1 The above compilation for N = 15 has been imple- | i mented in ref. [11]. We generalize these ideas and drive FIG. 1: The circuit for y = f2,15(x). Gate count: NT = 1 and them further for larger N. We will construct the gen- NCN = 7. This is slightly cheaper in terms of gates than the eral uncompiled circuits, and then compile them through analogous arrangement in ref. [11], which used 2 controlled- different intermediate functions to reach simpler circuits. swap gates (roughly as hard as a Toffoli) and 2 CNOT gates.

The authors in ref. [11] define a fully compiled func- 2. N=21 tion, which we denote f˜2 15(x) log2(f2 15(x)). For , ≡ , x = 0 to 3, we have f˜2,15(x) = x. The circuit for this Suppose we wish to compile the factorization of N = function is much simpler than the one above, and is given 21, and that we have chosen a = 4 for this purpose. 5

To get a better intuitive understanding of the modu- Then we can use another Toffoli gate (forming a Toffoli lar exponentiation process, we compute the values of cascade) that has y5 as one control bit and x3 as the other x f4,21(x)=4 mod (21). The results are in table III control bit to modify the entry in the fifth row of y1, the below. target bit. To flip the entry in the third row for y3, we simply add the result of the two previous Toffoli gates, x 01234567 that is, we add y5 and the modifier entry of y1, which 4x mod (21) 1416141614 will result in a single modifier entry in the third row of y3. TABLE III: The decimal value table for f4,21(x). All of the above is shown in the circuit constructed in fig. 5 below. From the values in the table, we note that f4,21(x) is has period 3. Therefore, modulo 21, the order of 4 is 3. Similarly, for any a coprime to 21 one can find the x3 x3 x2 • • • • • x2 corresponding order r modulo 21. We do so in the table x1 • • • • x1 • • IV. 0 y5 |0i • • y4 a 2 4 5 8 10 11 13 16 17 19 20 |0i y3 | i • y2 r 63626 6 2 3 6 6 2 0 |0i y1 | i • • TABLE IV: The period r of fa,21(x) for all a coprime to 21. FIG. 5: The circuit for y = f4,21(x) with three input qubits, and five output qubits. Gate count: NT =2, NCN = 12. Note that all the periods are factors of 6, which is to be expected for N = 21 as will be explained in section IV. For now, we simply note that the largest period is 6, meaning that in general, to implement U(a) defined in We have again underlined all entries in the truth ta- eq.(2), one needs at most 3 qubits in the input register. ble (table V) that are flipped by a Toffoli gate, whether Returning to the function y = f4,21(x), we include its directly or indirectly (i.e. the result of a Toffoli being truth table for input x between 0 and 7 in table V. copied by a CNOT). An entry that is flipped twice (i.e. unchanged) is doubly underlined.

x3 x2 x1 y5 y4 y3 y2 y1 This circuit synthesis procedure is ad-hoc, and based 0 0 0 00001 on taking advantage of some patterns in the function 0 0 1 00100 truth table. It is much more efficient than some alter- natives ones. It uses only 2 Toffoli gates and 12 CNOT 0 1 0 1 0 0 0 0 gates (with a quantum cost of 24), whereas for example, 0 1 1 00001 the circuit for the identical function in ref. [9] uses 8 1 0 0 00100 Toffoli gates and 5 CNOT gates (quantum cost of 53). 1 0 1 1 0 0 0 0 Even so, we note that the circuit above has 5 output 1 1 0 00001 qubits to represent the three output values 1, 4, and 16. 1 1 1 00100 To partially compile the circuit, we map these three out-

TABLE V: The binary truth table for y = f4,21(x). comes to the integers 0, 1, and 2 instead, via the operation of a logarithm base 4.

We make some observations about table V, first that y4 That is, we define a function fˆ4 21(x) log4(f4 21(x)), , ≡ , and y2 are always zero, and need not have any gates. We which needs only two out put qubits. Its truth table is observe that y3 can almost be written as y3 = x3 x2 x1, shown in table VI below. Using our same circuit synthesis ⊕ ⊕ with the exception being the underlined 0 in the third procedure, the circuit for fˆ4,21(x) is shown in fig. 6. row, which would have been 1 if the formula was exact. Similarly y1 can almost be written as y1 = x3 x2 ⊕ ⊕ x1 1, with the exception being the underlined 0 in the x3 x3 ⊕ • • sixth row, which would have been a 1 if the formula was x2 x2 • • • • exact. x1 x1 • • We also note that y5 has only two nonzero entries, 0 y2 | i • which can potentially be constructed from a single Toffoli 0 y1 gate. Observe that y5 takes the value 1 when x3 = x1 = | i 6 x2, or equivalently when x3 x2 = x2 x1 = 1. Therefore, FIG. 6: The circuit for the partially compiled fˆ4,21(x), with ⊕ ⊕ we can construct y5 as the output of a Toffoli gate with three input qubits and two output qubits. Gate count: NT =2, the two control bit values x3 x2 and x2 x1. NCN = 6. ⊕ ⊕ 6

x3 x2 x1 y2 y1 a 2 4 5 7 8 10 13 14 16 17 19 20 23 25 26 28 29 31 32 0 0 0 0 0 r 10 5 10 10 10 2 10 10 5 10 10 10 2 5 10 10 10 5 2 0 0 1 0 1 TABLE VIII: The period r of fa,33(x) for all a coprime to 33. 0 1 0 1 0 0 1 1 0 0 We choose a = 4 once again, since it is easy to work 1 0 0 0 1 with, and its odd period of 5 is admissible in Shor’s al- 1 0 1 1 0 gorithm since 4 is a square. We can construct the circuit x 1 1 0 0 0 for calculating f4,33(x)=4 mod (33), which takes on 1 1 1 0 1 values 1, 4, 16, 31, 25 as x varies from 0 to 4, and then re- peats for x 5. To represent the input values 0 to 4 we TABLE VI: The truth table for the partially compiled need three qubits≥ in the input register, and to represent ˜ f4,21(x), with three input qubits and two output qubits. the output values up to 31 we will need five qubits in the output register. The function log4 can be used through an intermediate However, we choose instead to construct the compiled classical operation, and simplifies the circuit to 2 Toffoli circuit, for f˜4,33(x)= g(f4,33(x)) where g(y) = (y 1)/3. gates and 6 CNOT gates (quantum cost of 18), and uses This maps the output values to 0, 1, 5, 10, 8. This− map fewer qubits. Again, the logarithm can be considered a works well since g(y) is a simple differentiable function classical layer of compilation that reduces the number of that maps the output values of f4,33(x) to smaller inte- qubits needed to more manageable levels. ger values. Here, g(y) performs the classical compilation Since the circuit in fig. 6 has period 3, it can be further step, and takes the place of the logarithms used in pre- ˜4 21 compiled to the fully compiled function f , (x), whose vious examples. Constructing the circuit for g(f4,33(x)) truth table is in table VII and circuit in fig. 7. This we have fig. 8 below. fully compiled circuit has only two input qubits. It can be thought of as the “underlying circuit”. Note that in a x3 x3 • • fully compiled circuit, the values of the function output x2 x2 • • • • generated by all the possible inputs create one full period x1 x1 • • • • • of the function, but not two or more. This is similar to 0 y4 the idea of the simplest periodic function. In fact, the | i • 0 y3 function f˜4 21(x) is identical to S3, the simple monoperi- , |0i y2 odic function of period 3, introduced in ref. [19]. Many |0i y1 fully compiled circuits for higher N will also fall into the | i simple periodic function category. FIG. 8: The circuit table for y = f˜4,33(x). Gate count: NT =3, NCN = 7. x2 x2 x1 • • x1 • 0 y2 | i • 0 y1 x3 x2 x1 y4 y3 y2 y1 | i • 0 0 0 0000 FIG. 7: The fully compiled circuit for y = f˜4,21(x) with an 0 0 1 0 0 0 1 additional layer of classical compilation. Gate count: NT =1, NCN = 3. Identical to S3 circuit in ref. [19]. 0 1 0 0101 0 1 1 1100 1 0 0 1000 x2 x1 y2 y1 1 0 1 0000 0 0 0 0 1 1 0 0 0 0 1 0 1 0 1 1 1 1 0101 1 0 1 0 TABLE IX: The binary truth table for y = f˜4,33(x). 1 1 0 0

TABLE VII: The fully compiled truth table for y = f˜4,21(x) with two input and two output qubits. C. Classical Compilation

What we have called the classical compilation step 3. N=33 works by defining f˜a,N (x) = g(fa,N (x)) where g(y) is some differentiable function that maps the output values Suppose N = 33, the table VIII shows all the possible of fa,N (x) (for all x in the function’s domain) to smaller a coprime to 33, and the order of each modulo 33 (i.e. integer values. The smaller output values after applying the period of fa,33(x)). the function g allow us to use fewer qubits to represent 7 the output register, and thus saving us some resources. p q N λ(N) allowed r We have seen examples where g(y) is a logarithm, or a 3 5 15 4 2, 4 linear function. In general, other simple functions can 3 7 21 6 2, 3, 6 be used, though for some combinations of a and N this 3 11 33 10 2, 5, 10 compilation is not possible except through very artifi- 5 7 35 12 2, 3, 4, 6, 12 cially defined complicated functions g. Circuit compilation is only interesting when it involves 3 13 39 12 2, 3, 4, 6, 12 simple intermediate steps that offer a substantial simpli- 3 17 51 16 2, 4, 8, 16 fication of a complex circuit. If the function we use to 5 11 55 20 2, 4, 5, 10, 20 compile is itself overly complicated, then we have not 3 19 57 18 2, 3, 6, 9, 18 gained much. This puts a limitation of the usefulness 5 13 65 12 2, 3, 4, 6, 12 compilation process as a whole. 3 23 69 22 2, 11, 22 7 11 77 30 2, 3, 5, 6, 10, 15, 30 5 17 85 16 2, 4, 8, 16 IV. GENERAL N AND ALLOWABLE PERIODS 3 29 87 28 2, 4, 7, 14, 28

Given that the period is what determines the difficulty TABLE X: For each semiprime N = pq with p and q distinct of factorization [25], and even the size of the compiled odd primes, the table lists the value of the Carmichael func- circuit, it is of interest to find which periods of f (x)= tion λ(N) lcm(p 1, q 1), and the allowable periods r, a,N ≡ − − ax mod (N) are allowed for a given N. That is, we wish given by all the factors of λ(N). to find the set of all orders of any a modulo a given N. Suppose N = pq is fixed, where p and q are distinct primes. From elementary number theory we know there of the output state and compare it to theoretical expec- are ϕ(N) = (p 1)(q 1) positive integers less than tations to benchmark the device, and judge if it works N that are coprime− to−N [26]. The function ϕ(N) is correctly. In addition, by comparing the measured prob- called Euler’s totient function [27]. The group formed ability distribution to the theoretically expected one, we by coprime integers modulo N is of size (p 1)(q 1), can roughly quantify the noise (assuming a Werner state and so any subgroup must have a size, also known− as− the model), and entanglement of the state. We demonstrate group’s order, that divides (p 1)(q 1). In other words, this by way of an illustrative example. − − Suppose we have a “toy” quantum circuit with three for any number a chosen, the period of fa,N (x) must be a factor of (p 1)(q 1). qubits in the input register and three in the output regis- In fact, an− even stronger− condition has been estab- ter. If we represent the binary numbers in each register as decimal numbers, the value in each register is an integer lished. The period r of fa,N (x) can be shown to divide the Carmichael function of N [28], given by from 0 to 7. Suppose further that the circuit is periodic. That is, if we treat the circuit as a function with this λ(N) lcm(p 1, q 1), (5) input range, it has a period p, for some p between 1 and ≡ − − 8 inclusive. where lcm is the least common multiple. Denoting the action of the circuit by the function Fp, For example, if N = 21, then p = 3 and q = 7, there- and initializing each of the three qubits in the input regis- fore λ(21) = lcm(2, 6)=6. Table X gives pairs of distinct ter to the state + , then the action of the circuit creates | i odd primes p, q, and the corresponding N, λ(N), and al- the output state ψp given by lowed values of the period r (which are all the factors of | i 7 λ(N)) for N < 90. 1 Table X is useful for experimentalists who want to ψp Fp j i 0 o | i≡ h √8 X | i | i i construct a compiled factoring circuit that has a given j=0 7 period/order. For example, if we wish to construct a 1 compiled circuit for factoring some number N where the = j j modp , (6) √8 X | ii| io period r is 11, then we know the smallest such N is 69. j=0 where i subscript denotes the input register and o sub- V. ILLUSTRATIVE EXAMPLE OF COMPILED script denotes the output registers. For example, if p = 3, PERIOD FINDING we have 1 ψ3 = 0 + 3 + 6 0 + 1 + 4 + 7 1 Suppose we are able to construct the compiled circuits | i √8h| i | i | i
i| io | i | i | i
i| io described in the previous section using some quantum + 2 + 5 2 . (7) device. We can run the circuit with the initial state | i | i
i| ioi + in all input registers (generating an equal superposi- |tion),i and 0 in all the output registers. After running As a side note, the state ψ3 is the one produced by the | i | i the circuit we can measure the probability distribution partially compiled circuit for fˆ4,21 in fig. 6 and table VI, 8 with the subtle difference the here we have defined three p 0 1 2 3 4 5 6 7 | i | i | i | i | i | i | i | i qubits in the output register, and the fˆ4,21 only has two. 1 1 0 0 0 0 0 0 0 In Shor’s algorithm, the final step is applying the quan- 2 0.5 0 0 0 0.5 0 0 0 tum Fourier transform (QFT) to the input register. We 3 0.344 0.015 0.063 0.235 0.031 0.235 0.063 0.015 follow suit and do the same in our toy model. The QFT 4 0.25 0 0.25 0 0.25 0 0.25 0 is defined as 5 0.219 0.059 0.125 0.19 0.031 0.191 0.125 0.059 N 1 1 − 6 0.188 0.125 0.063 0.125 0.188 0.125 0.063 0.125 QFT : j ωkj k , (8) X N 7 0.156 0.147 0.125 0.103 0.093 0.103 0.125 0.147 | i → √N =0 | i k 8 0.125 0.125 0.125 0.125 0.125 0.125 0.125 0.125 where ωN is the Nth root of unity, defined as ωN 2 3 ≡ TABLE XI: The probabilities p(k) of finding k after a mea- e πi/N . Continuing with our example, we have N =2 = P | i 4 surement on the input register of φp . The column index is 8. Dropping the subscript, we have ω ω8 = eπi/ = | i 1 ≡ k and the row index is p. √2 (1 + i). Applying the the QFT to the input register in eq.(6), we have comparison will help assess the accuracy and effectiveness 7 7 of the quantum information processing device on which 1 φ QFT ψ = ωkj k j modp . (9) it was implemented. | pi≡ i| pi 8 X X | ii| io j=0 k=0 To make the model more realistic, one can introduce a depolarizing channel model of noise [29], via the trans- For example, if p = 3, we have form 1 I φ3 3 0 + 0.293(1 i) 1 i 2 + 1.707(1+i) 3 + 4 ρ ρ′ = (1 ǫ) + ǫρ , (13) | i≡ √8 h | i − | i− | i | i | i p → p − 8 p + 1.707(1 i) 5 + i 6 + 0.293(1+i) 7 0 − | i | i | ii| io for some parameter ǫ. The value ǫ = 1 results in an un- + 3 0 + 0.414 1 + 1 2 2.414 3 4 2.414 5 changed (noiseless) state, and ǫ = 0 a maximally mixed  | i | i | i− | i − | i− | i + 6 + 0.414 7 1 + 2 0 (0.707 0.293i) 1 (totally noisy) state. Under this transformation due to | i | ii| io  | i− − | i the depolarizing channel, the probability distribution in (1 i) 2 + (0.707 1.707i) 3 + (0.707+1.707i) 5 − − | i − | i | i row p of table XI will be “diluted” by the maximally (1+i) 6 (0.707+0.293i) 7 2 . (10) mixed distribution (which corresponds to the p = 8 row). i oi − | i− | i | i That is Then we can define the reduced density matrix ρp as the 1 ( k ) ′ ( k )= (1 ǫ)+ ǫ ( k ). (14) result when the output register is traced out, that is Pp | i →Pp | i 8 − Pp | i

ρp Tro φp φp . (11) The transformation in eq.(14) follows from eq.(13) to- ≡ | ih |
gether with the realization that the probability dis- From using eq.(10) and eq.(11) we can calculate ρ3 to be tribution ( k ) consists of the diagonal elements of Pp | i ρp. The transformed probabilities sum to unity, since 344 11+5i 16+16i 11 27i 0 11 27i 16 16i 11 5i 7 7  − − − − − −  11 5i 15 27+11i 31 31i 2 5i 22i 8 20i 9 9i k=0 p( k ) = 1 implies k=0 p′ ( k ) = 1.  − − − − − − −   16 16i 27 11i 63 102 42i 16 16i 5+11i 31i 8 20i  P P | i P P | i  − − − − − − − −  The presence of entanglement between the input and 3  11+27i 31+31i 102+42i 235 64+27i 53+53i 5+11i 22i  10− − − −   0 2+5i 16+16i 64 27i 31 64+27i 16 16i 2 5i    output registers is also of interest. We note that the state  − − − − − − −   11 27i 22i 5 11i 53 53i 64 27i 235 102 42i 31 31i − − − − − − − − − −  ψp defined in eq.(6) above is completely separable for  16+16i 8+20i 31i 5 11i 16+16i 102+42i 63 27+11i   − − −  | i  11+5i 9+9i 8+20i 22i 2+5i 31+31i 27 11i 15  p = 1 and maximally entangled for p = 8, with interme- − − − − (12) diate entanglement for 1

p 1 2 3 4 5 6 7 8 VI. CONCLUSION S 1 0.5 0.238 0.25 0.16 0.141 0.129 0.125 Shor’s algorithm is based on probabilistic classical TABLE XII: The rough separability index S for various values of period p. The values of S are calculated from the proba- steps as well as a quantum order finding subroutine. The bility distributions in table XI by summing the squares of the latter has a modular exponentiation step, which in its entries for each row. general form is very difficult to implement with currently realizable quantum technology. Therefore, experimental- ists over the last decade or so have resorted to compiled We note that S is almost monotonically decreasing versions of Shor’s algorithm, that simplify the modular when taken as a function of p, with just one exception at exponentiation step using known information about the p = 3. And since entanglement monotonically increases solution. with p, we can take 1 S as a rough measure of entan- − In this paper, we have extended the method of compil- glement created by our circuit. This can act as a proxy ing the modular exponentiation operation, and demon- for the ability of the constructed circuit to handle entan- strated a more efficient method of circuit synthesis than glement, assuming a simple depolarizing channel noise previously used. We have provided the compiled circuits model. for several semiprimes, and illustrated how the process Using eq.(14) and eq.(15), we find the value of S is can be generalized. A simple layer of “classical compila- affected by the introduction of a depolarization channel tion” has been discussed as potentially simplifying com- model of noise by plicated circuits further.

2 1 An emphasis has been placed on periodicity in the S S′ = ǫ S + (1 ǫ)(1 + 15ǫ). (16) → 64 − modular exponentiation circuits, and a link to the sim- ple periodic functions in ref. [19] has been pointed out. Supposing we know the theoretical (noiseless) value of S Finally, we have presented a simplified procedure to vali- based on our knowledge of the period p, and we measure date the function of such a circuit, including its handling (noisy) S′ after executing the circuit, we can use eq.(16) of noise and entanglement. to find the value of ǫ, and estimate the noisiness of our system. To sum up, in this section we introduced a simple method to test and validate a nascent quantum tech- VII. ACKNOWLEDGEMENT nology using some periodic circuit and the QFT. This procedure applied will give us some basic insight into the We would like to thank the Natural Sciences and Engi- operation of our test circuit, how well it functions, as well neering Research Council of Canada (NSERC) for fund- as its handling of noise and entanglement. ing this research.

[1] W. J. Munro, D. F. V. James, A. G. White, and P. G. [9] I. Markov and M. Saeedi. Constant–optimized quantum Kwiat. Maximizing the entanglement of two mixed circuits for modular multiplication and exponentiation. qubits. Phys. Rev. A, 64:030302, Aug 2001. Quantum Info. Comput., 12(5–6):361–394, 2012. [2] R. Blume-Kohout. Optimal, reliable estimation of quan- [10] I. Markov and M. Saeedi. Faster quantum number factor- tum states. New J. Phys., 12:043034, 2010. ing via circuit synthesis. Phys. Rev. A, 87:012310, 2013. [3] M. Kaznady and D. F. V. James. Numerical strategies for [11] B. P. Lanyon, T. J. Weinhold, N. K. Langford, M. Barbi- quantum tomography: Alternatives to full optimization. eri, D. F. V. James, A. Gilchrist, and A. G. White. Ex- Phys. Rev. A, 79:022109, 2009. perimental demonstration of a compiled version of Shor’s [4] S. T. Flammia, D. Gross, Y. K. Liu, and J. Eisert. Quan- algorithm with quantum entanglement. Phys. Rev. Lett., tum tomography via compressed sensing: error bounds, 99:250505, 2007. sample complexity and efficient estimators. New J. Phys., [12] C. Y. Lu, D. E. Browne, T. Yang, and J. W. Pan. Demon- 14:095022, 2012. stration of a compiled version of Shor’s quantum factor- [5] P. Shor. Polynomial–time algorithms for prime factor- ing algorithm using photonic qubits. Phys. Rev. Lett., ization and discrete logarithms on a quantum computer. 99:250504, 2007. SIAM Journal of Computing, 26(5):1484–1509, 1997. [13] E. Martin-L´opez, A. Laing, T. Lawson, R. Alvarez, X. Q. [6] D. Beckman, A. N. Chari, S. Devabhaktuni, and Zhou, and J. L. O’Brien. Experimental realization of J. Preskill. Efficient networks for quantum factoring. Shor’s quantum factoring algorithm using qubit recy- Phys. Rev. A., 54(2):1034–1063, 1996. cling. Nature Photonics, 6:773–776, 2012. [7] V. Vedral, A. Barenco, and A. Ekert. Quantum net- [14] A. Politi, J. C. F. Matthews, and J. L. O’Brien. Shors works for elementary arithmetic operations. Phys. Rev. quantum factoring algorithm on a photonic chip. Science, A, 54(1):147–153, 1996. 325(5945):1221, 2009. [8] R. VanMeter and K. M. Itoh. Fast quantum modular [15] L. Vandersypen, M. Steffen, G. Breyta, C. Yannoni, exponentiation. Phys. Rev. A., 71:052320, 2005. M. Sherwood, and I. Chuang. Experimental realization of 10

Shor’s quantum factoring algorithm using nuclear mag- [21] M. Nielsen and I. Chuang. Quantum computation and netic resonance. Nature, 414(6866):883–887, 2001. quantum information. Cambridge, 2000. [16] N. Xu, J. Zhu, D. Lu, X. Zhou, X. Peng, and J. Du. [22] P. Kaye, R. Laflamme, and M. Mosca. An introduction Quantum factorization of 143 on a dipolar–coupling nu- to quantum computing. Oxford University Press, 2006. clear magnetic resonance system. Phys. Rev. Lett., [23] Euclid of Alexandria. The Elements, Book 7. c. 300 BC. 108:130501, 2012. [24] R. B. Griffiths and C. S. Niu. Semiclassical Fourier [17] E. Lucero, R. Barends, Y. Chen, J. Kelly, M. Mariantoni, transform for quantum computation. Phys. Rev. Lett., A. Megrant, P. O’Malley, D. Sank, A. Vainsencher, 76:3228–3231, 1996. J. Wenner, T. White, Y. Yin, A. N. Cleland, and J. M. [25] J. A. Smolin, G. Smith, and A. Vargo. Oversimplifying Martinis. Computing prime factors with a Josephson quantum factoring. Nature, 499(7457):163–165, 2013. phase qubit quantum processor. Nature Physics, 8:719– [26] D. Mermin. Quantum Computer Science: An Introduc- 723, 2012. tion. Cambridge University Press, 2007. [18] 2013. Private communication with Prof. Rainer Blatt. [27] G. H. Hardy and E. M. Wright. An introduction to the [19] O. Gamel and D. F. V. James. Synthesizing quantum theory of numbers. Oxford University Press, 1979. circuits for simple periodic functions. Quant. Inf. Comp., [28] P. Erd˝os, C. Pomerance, and E. Schmutz. Carmichael’s 2013. arXiv:1305.3642. lambda function. Acta Arith., 58:363–385, 1991. [20] R. Rivest, A. Shamir, and L. Adleman. A method for ob- [29] C. King. The capacity of the quantum depolarizing chan- taining digital signatures and public–key cryptosystems. nel. IEEE Trans. on Info. Theory, 49(1):221–229, 2003. Communications of the ACM, 21(2):120–126, 1978.