An Experimental Study of Shor's Factoring Algorithm on IBM Q

TL;DR

This paper reports an experimental implementation of Shor's factoring algorithm on IBM's superconducting quantum chip for small numbers, using optimized circuits and a novel method to determine the period without continued fractions.

Contribution

It demonstrates a practical realization of Shor's algorithm on current quantum hardware with reduced qubit count and gate complexity, and introduces a new approach to period estimation.

Findings

Successful factorization of small numbers on IBM Q hardware

Use of semi-classical Fourier transform to minimize qubits and gates

Quantitative error estimation via statistical overlap

Abstract

We study the results of a compiled version of Shor's factoring algorithm on the ibmqx5 superconducting chip, for the particular case of $N=15$, $21$ and $35$. The semi-classical quantum Fourier transform is used to implement the algorithm with only a small number of physical qubits and the circuits are designed to reduce the number of gates to the minimum. We use the square of the statistical overlap to give a quantitative measure of the similarity between the experimentally obtained distribution of phases and the predicted theoretical distribution one for different values of the period. This allows us to assign a period to the experimental data without the use of the continued fraction algorithm. A quantitative estimate of the error in our assignment of the period is then given by the overlap coefficient.

Equations

$$\text{P}(s)=\frac{1}{Q}|e^{\frac{2\pi i{x}_0}{Q}}{|}^2\sum _{s=0}^{Q-1}|e^{\frac{2\pi isdr}{Q}}{|}^2,$$

$$\text{SSO}={\left(\sum _{j=0}^7{m}_j^{1/2}{e}_j^{1/2}\right)}^2,$$

$$\Delta \text{SSO}=\sqrt{\sum _{j=0}^7\frac{\partial }{\partial m_j}(m_j^{1/2}{e}_j^{1/2}{)}^2\Delta m_j^2}.$$

$$\text{OVL}\left[f(x_1),f(x_2)\right]=\sum _{x}min\left(f(x_1),f(x_2)\right),$$

Full text

I Introduction

Shor’s factoring algorithm shor is a well known example of a quantum algorithm outperforming the best known classical algorithm. Experimental implementation of the algorithm with physical qubits however remains a challenge because of the errors introduced by the large number of qubits and gates required to execute the algorithm. In this article we provide a proof-of-principle demonstration of a compiled version of Shor’s factoring algorithm to factor the numbers $N=15$, $21$ and $35$ using five, six and seven superconducting qubits, respectively. Similar experiments have been done on setups like NMR vandersypen , trapped ions monz , photons lu ; lanyon ; lopez , photonic chips politi and superconducting qubits lucero ; coles . However, with the exception of Refs. monz ; lopez , all these realizations involve an oversimplified version of the algorithm which is equivalent to coin flipping smolin and no quantum hardware is needed to obtain the same results.

In our implementation, classical processing is used alongside quantum computation to overcome the lack of key-functions of the device used. Furthermore, the number of physical qubits and the circuit depth are reduced to the minimum in order to minimize the effects of noise. The data is presented as estimates of the probability distribution of the values returned by the period register. While obtaining the probability distributions of the period register requires running the algorithm many times, as opposed to just once with the original continued fraction expansion, this allows the performance of quantum computers running this algorithm to be more directly evaluated. To measure the success of the experiments in different ways, the results are analyzed in both a qualitative way, with probability plots kleiner , and a quantitative way, with the square of statistical overlap (SSO) chiaverini . Probability plots are a useful tool to visualize differences between probability distributions, while the SSO provides a quantitative measure of their similarity. Using the the overlap coefficient (see below), we can also use the SSO to assign a period to the experimental data, avoiding the continued fraction algorithm which does not work for such low number of qubits. Also, the overlap coefficient (OVL) gives an estimate of the probability that the experiment succeeded. The results of the experiments are in good agreement with the theory for $N=15$ and $21$. However, the experiment succeeded for $N=35$ only about 14% of the time, where the cumulative errors coming from the high number of two-qubit gates became too large.

The article is organized in the following way. A brief overview of Shor’s factoring algorithm is given in Sec. II. Sec. III describes the hardware used for the experiment. In Sec. IV the implementation of the factoring experiment for $N=15$, $21$ and $35$, respectively, is described. The results obtained from running the algorithm on the ibmqx5 quantum processor are analyzed and discussed in Sec. V. Conclusions follow in Sec. VI.

II Overview of Shor’s factoring algorithm

The factoring algorithm invented by P. Shor shor relies on the relation between the problem of factoring and the problem of order finding, for which a quantum speed-up exists. In fact, finding the prime factors of a number $N$ is equivalent to finding the exponent $x$ for which the function $a^{x}\text{mod}N=1$, where $a$ is an integer smaller than $N$ picked at random. Such exponent is called the order, or period, of $a$. Let us briefly review the quantum part of the algorithm before diving into the details of the experiment. Two quantum registers are needed for the computation. One register is used to store the value of the period, called period register, and the other to store the results of the computation, called computational register. The size of both registers depends on the number $N$ to be factored. In particular, the period register should have a number of qubits $n_{p}$ in the interval $\text{log}_{2}(N^{2})\lesssim n_{p}\lesssim\text{log}_{2}(2N^{2})$ and the computational register should be large enough to be able to represent the number $N-1$, resulting from the modular exponentiation function (MEF) $a^{x}\text{mod}N$, thus requiring $n_{q}=\text{log}_{2}N$ qubits.

At the beginning of the quantum algorithm, the two registers are initialized to the state $\lvert 00...0\rangle_{p}\lvert 00...1\rangle_{q}$, where the subscripts $p$ and $q$ denote the period register and the computational register, respectively. The period register stores all the possible values of the exponent $x$, which will give an estimate of the period, by creating a uniform superposition of all possible bit-strings through Hadamard gates on all qubits $\frac{1}{\sqrt{Q}}\sum_{x=0}^{Q-1}\lvert x\rangle_{p}$, where $Q=2^{n_{p}}$. While the computational register stores the results of the MEF, $a^{x}\text{mod}N$. After the first step, the two registers are in the state $\frac{1}{\sqrt{Q-1}}\sum_{x=0}^{Q-1}\lvert x\rangle_{p}\lvert a^{x}\text{mod}N\rangle_{q}$. Then, the quantum Fourier transform (QFT) is applied to the period register so that $\lvert x\rangle_{p}\rightarrow\frac{1}{\sqrt{Q}}\sum_{s=0}^{Q-1}e^{\frac{2\pi isx}{Q}}\lvert s\rangle_{p}$. As a result of the QFT, interference between all the possible states occurs. If the period register is then measured, a value of the phase $s$ is measured with probability $\text{P}(s)=\frac{1}{Q}\sum_{s=0}^{Q-1}\lvert e^{\frac{2\pi isx}{Q}}\rvert^{2}$. Rewriting $x$ in terms of the period $r$ as $x=x_{0}+dr$, where $x_{0}$ and $d$ are integers, the probability of an outcome $s$ can be written as $\text{P}(s)=\frac{1}{Q}\lvert e^{\frac{2\pi ix_{0}}{Q}}\rvert^{2}\sum_{s=0}^{Q-1}\lvert e^{\frac{2\pi isdr}{Q}}\rvert^{2}$. Clearly, a value of $s$ such that $\frac{s}{Q}=\frac{c}{r}$, where $c$ is an integer, will be observed with high probability.

The final part of the algorithm involves classical processing of the measurement obtained in the quantum part. The value of the period $r$ can be found from the fraction $\frac{s}{Q}$ by using the continued fraction algorithm. Or as done in this paper, by running the algorithm many times to get a direct estimate of the probability distribution of the values for the period register. A comparison between the measured probability distribution and the theoretically predicted distribution for the period $r$ can be made using the SSO and the best fit gives the most likely period. If the period $r$ calculated in this way is odd or $r=0$, the algorithm fails and one restarts by picking a different base $a$. If $r$ is even, $(a^{r}-1)\text{mod}N$ can be factored into $\left(a^{\frac{r}{2}}-1\right)\left(a^{\frac{r}{2}}+1\right)\,\text{mod}N$. The final step is to check if $(a^{\frac{r}{2}}+1)\text{mod}N$ has a common divisor with $N$ by checking that gcd$\left(a^{\frac{r}{2}}+1,N\right)\neq 1$. If that’s true, then the two factors of $N$ are gcd$\left(a^{\frac{r}{2}}+1,N\right)$ and gcd$\left(a^{\frac{r}{2}}-1,N\right)$.

As mentioned earlier, the execution of this version of the algorithm requires $n_{q}=\text{log}_{2}\left(N\right)$ qubits in the computational register to perform the modular exponentiation and at least another $n_{p}=2\text{log}_{2}\left(N\right)$ qubits in the period register to perform the QFT. Thus the complete algorithm requires a total number of $3\text{log}_{2}\left(N\right)$ qubits. Even the factoring of a number as small as $N=15$ needs $12$ qubits in the input register to execute this algorithm, which is still a challenge for today’s physical realizations of quantum computers. However, Kitaev kitaev observed that for the purpose of algorithms like Shor’s, where one doesn’t need the information on the relative phase of the output states but only their measured probability amplitudes, one can replace the fully coherent quantum Fourier transform with the semi-classical quantum Fourier transform (sc-QFT). In the sc-QFT, one of the qubits of the period register is measured each time. The result of the measurement of the qubit is then used to determine the type of measurement on the next one. This enables the replacement of the $2\text{log}_{2}\left(N\right)$ qubits of the period register with a single qubit measured multiple times. For the case of factoring $N=15$, Kitaev’s approach reduces the total number of qubits required to $n=5$ and for the case of $N=21$ and $N=35$ to $n=6$ and $n=7$, respectively, which are small enough numbers for the presently available hardware to handle. This decrease in the system size, however, comes with the drawback of requiring in-sequence single-qubit readout and state re-initialization together with feed-forward of gate settings based on previous measurement results. The implementation of the sc-QFT has been described in griffiths ; chiaverini and realized in monz . At present the IBM quantum computer doesn’t perform in-sequence single qubit read out and qubit re-initialization. Below, we provide a procedure for going around this hurdle to implement the sc-QFT on the IBM Q device.

III Hardware

We use the IBM ibmqx5 chip with sixteen superconducting qubits to implement our experiments for factoring the numbers $N=15$, $21$ and $35$. The qubits are distributed on the plane, as two adjacent arrays of eight qubits each with couplings shown in Fig. 1.

The qubits’ relaxation time $T_{1}$ ranges from $25\sim 60$ $\mu$s and their dephasing time $T_{2}$ from $20\sim 100$ $\mu$s. The single-qubit gates have a high fidelity, measured at $\sim 99.8\%$ at the time of the experiment. The multi-qubit gate fidelity was measured around $95\%-98\%$ depending on the pairs of qubits considered. All gate errors are measured using simultaneous randomized benchmarking. Another source of error comes from the read-out of the states of the qubits, which amounts to roughly an error of $5\%$. Using these parameters, the effects of noise can be incorporated in the simulation, obtaining a more accurate prediction for the output of the device.

IV Experiment

Following the example given in monz , we implement the quantum part of Shor’s factoring algorithm using the circuit depicted in Fig. 2. As can be seen in the circuit diagram in Fig. 2, rotations of the control qubit depend on the outcome of each of its measurement in the previous steps. Since the ibmqx5 chip does not allow for qubit reset and conditional operation based on measurements, which are required to implement the sc-QFT suggested by Kitaev, we implement the algorithm as three separate quantum circuits as shown in Fig. 3.

In the first circuit, the system is initialized in the state $\lvert 0\rangle_{p}\lvert 0...01\rangle_{q}$ and the first bit, $b_{0}$, encoding the value of the period is measured at the end. In the second circuit, the initial state $\lvert 0\rangle_{p}\lvert\psi_{b_{0}}\rangle_{q}$ is prepared. Different states $\lvert\psi_{b_{0}}$ are prepared depending on the value of $b_{0}$ measured in the previous circuit. Rotation gates on the period register are also inserted conditional on the value of $b_{0}$ before measuring the second bit encoding the value of the period, $b_{1}$. In the third circuit, depending on the values of $b_{0}$ and $b_{1}$, the qubit registers are initialized to $\lvert 0\rangle_{p}\lvert\psi_{b_{0}b_{1}}\rangle_{q}$ and rotation gates are inserted before the measurement of $b_{2}$. The possible quantum states of the computational register can be computed classically for the full algorithm, conditional on the measurement results of the period register. This is just the result of successive modular exponentiation. At the beginning of each circuit, except the first one, there are two possible states of the computational register that have to be prepared depending on the value of the period register measured in the previous stage. If the measurement of the period register gives [math], then the computational register is prepared to the state $\lvert\psi_{0}\rangle_{q}=\lvert\psi\rangle_{q}+ZU_{a^{x}}\lvert\psi\rangle_{q}$. If the period register gives $1$, the computational register is initialized to $\lvert\psi_{1}\rangle_{q}=\lvert\psi\rangle_{q}-ZU_{a^{x}}\lvert\psi\rangle_{q}$. This means that for an implementation with $m$ stages, a superposition of $2^{m}$ product states have to be prepared. However, the state at the $m$-th stage is, at worst, the result of $m-1$ modular exponentiations. Thus, breaking the circuit in this way, only adds an extra number of gates which is polynomial in the number of stages $m$: $1+2+3+...+m=\frac{m(m+1)}{2}$, due to the gates needed for the state initialization at each stage. This retains the scalability of the implementation given in Ref. monz .

In the following experiments, we limit ourselves to the choice of one, or two, bases $a$ to avoid redundancy. We specifically choose a non-trivial base (in the sense of smolin ) for which a working quantum processor is needed to find the results. One could adopt the same approach to treat any such non-trivial bases. To understand what happens in the case of a trivial base, consider factoring $N=15$. The possible periods $r$ for any of the bases $a$ are all powers of two. This means that any even value of the phase $s$ measured from the period register will give a fraction $\frac{s}{Q}$ proportional to $\frac{1}{r}$ which always allows one to find the period. In facts, by analyzing the state of the quantum registers along the circuit, it is possible to see that no quantum interference happens between the states in the computational register. Therefore, in this case the correct results can be obtained regardless of the quality of the entangling gates of the device, as long as one can entangle the period register with the computational register. To show that the quantum processor ibmqx5 is giving us the correct answer by exploiting quantum interference it is sufficient to run the experiment for one of the possible bases. This is in turn is related to the quality of the entangling gates and the noise of the device. Thus, the ability to factor higher and higher $N$ using a non-trivial base (one which has a period that is not a power of 2) gives a benchmark of the performance of the device.

In the experiment for the $N=15$ case, five input qubits are required. One qubit initialized to $\lvert 0\rangle_{p}$ for the period register, acting as a control qubit, and all other qubits initialized to the state $\lvert\psi\rangle=\lvert 0001\rangle_{q}$ belonging to the computational register. Alongside the quantum registers, we also need a three-bit classical register to store the results of the measurement of the control qubit, which encodes the value of the period.

The case $N=15$ is the simplest possible case and it does not provide an example where quantum interference between the states of the computational register brings an advantage to the computation. For this reason, we attempt to factor the second smallest number which is a product of two primes, $N=21$. In this case, there are bases $a$ for which the period is not a power of two, thus constructive quantum interference between states in the computational register is needed to increase the likelihood of finding the correct result. An example of such case was first demonstrated in Ref. lopez .

We implement an algorithm for factoring $N=21$ with base $a=2$ using three bits of precision for the estimation of the phase which encodes the period. In this case the quantum register is composed of five qubits in the computational register and one qubit in the period register. We adopt the same methodology used previously, breaking each stage of the modular exponentiation and manually feeding the output of each section as input to the next. This means that the circuit will have three stages of modular exponentiation, where a single bit of the phase which encodes the period is estimated at each stage (details in Appendix A). Therefore, the circuit looks like the one in Fig. 3. The modular exponentiation circuit are specifically designed to calculate $a^{x}\,\text{mod}\,21$, where we choose the base $a=2$. This base has periods $r=6$, thus $1/r$ cannot easily be represented in binary. Therefore, the accuracy of the estimation of the period depends on the number of bits used for the phase estimation.

The same method is applied to factor $N=35$ with base $a=4$. In this case we need six qubit in the computational register and one qubit in the period register. As in the case of $N=21$, the period of $4^{x}\,\text{mod}\,35$ is $r=6$, therefore $1/r$ cannot be easily represented in binary. As a result of running the quantum algorithm we obtain a probability distribution for the estimated phase $s$ which is peaked around the multiples of $1/r$. We use a three-bit register for the estimation of the phase which encodes the period. Again, the circuit for running the algorithm is realized as shown in Fig. 2, each stage, estimating one bit of the phase, is implemented separately and then joined through a classical algorithm. The individual circuits which compute the MEF at the different stages can be found in Appendix A.

V Results and Data Analysis

Figs. 4a, 5a, 6a and 7a show the results obtained running the quantum part of the factoring algorithm on the ibmqx5 superconducting device. Depicted are the experimental relative probabilities found (in blue) side by side with the expectation values which can be computed theoretically (in green) for each value of the estimated phase $s$ for the bases $a$ used. The algorithm was run 1000 times for each base.

The success of the experiment is evaluated in two different ways. We use probability plots to give a qualitative estimation of the correctness of the results, while the square of the statistical overlap (SSO) is used as a quantitative measure. Probability plots kleiner are a useful tool to visually compare two distributions. In a probability plot, one distribution is plotted against the other. If the two distributions are identical, the plot will show a straight line ($y=x$). The amount of deviation from the straight $y=x$ line is an indication of the difference between the two probability distributions plotted. For the case at hand, this means plotting on the $(x,y)$ plane a point for each value of the phase, where the value of the $x$ coordinate is given by the theoretical value of the probability distribution for that phase and the value of the $y$ coordinate is given by the corresponding experimental value found. The data are then fitted with a straight line for comparison with the ideal $y=x$ case. Error-bars on the fit are given as a range of y-values compatible with the error on the fit coming from both slope and offset of the fitted line at a fixed x-value. Thus, all straight lines contained within these error-bars are compatible with the experimental data within the estimated error for the fit. The probability plots between the experimental distribution and the expected theoretical one for each case are shown in Figs. 4b, 5b, 6b and 7b. In the case of $N=15$, the data in Figs. 4b and 5b are on a straight line very close to the $y=x$ line (tagged as ”Ideal” on the plots). For the $N=21$ case, the data lie on a straight line parallel to the $y=x$ ideal line as can be seen from Fig. 6b. This means that there is an offset in the relative frequency of each phase in our experimental distribution. However, the overall shape coincides with the theoretical one, indicating that the difference in relative frequencies between phases is preserved. Finally, for $N=35$, the data in Fig. 7b lie on a straight line which is very far from the $y=x$ line, indicating an important deviation of the experimental results from the theoretically expected ones. In facts, looking at the histogram in Fig. 7a shows that the experimental results were affected by noise, which tends to make all phases equally probable. In summary, for $N=15$ and $N=21$ the fit is close to the ideal line (within the error bars) but for $N=35$ it is not. Therefore, we believe that the probability plots provide a good qualitative measure of the similarity between probability distributions, as they correctly describe the similarity which is apparent by the comparison of the histograms of the distributions.

Next we give a quantitative measure of the correctness of the results. In particular, we want to answer the question: given the experimental data obtained, what is the likelihood that this data comes from a given probability distribution? The answer to this question will reveal two aspects of our experiment. First, it will allow us to assign a period to the results without the need for the continued fraction algorithm. Second, it will give us a measure of the error we make in the assignment. Our method of assigning the period to the experimental data relies on the following observation: the probability of obtaining a certain phase $s$ is

[TABLE]

independently of the base $a$ chosen. As a function of the estimated phase $s$, the probability distribution $\text{P}(s)$ is completely characterized by the values of the parameters $r$ and $Q$, the period and the number of bits $\text{log}_{2}Q$ used to encode the value of the period, respectively. Therefore, independently of the base chosen, there correspond a fixed probability distribution to each value of $r$ and $Q$. To determine the period to assign to the experimental data, we compare the probability distribution $\text{P}_{\text{exp}}(s)$ obtained experimentally, with all the possible probability distributions $\text{P}^{r}_{\text{th}}(s)$ given by values of $r$ from $2$ to $Q-1$, for fixed number of bits $\text{log}_{2}Q$ encoding the period. The period of the theoretical distribution which is most similar to the experimental data is then assigned to the experiment.

Following monz , we use the square of the statistical overlap (SSO) introduced in chiaverini as a measure of similarity between probability distributions. The SSO is defined as

[TABLE]

where $m_{j}$ and $e_{j}$ are the measured and expected output-state probabilities of state $\lvert j\rangle$, respectively.

One can calculate the error on the SSO from the Poissonian counting error of the data, assuming Gaussian propagation of errors

[TABLE]

For each base used in the experiments, we calculate the SSO of $\text{P}_{\text{exp}}(s)$ with all possible $\text{P}^{r}_{\text{th}}(s)$. To better visualize which $\text{P}^{r}_{\text{th}}(s)$ most resembles the data, we plot unit area normalized Gaussian distributions with the SSO as the mean and $\Delta\text{SSO}$ as the standard deviation. The Gaussian whose value of the mean is closest to 1 comes from the $\text{P}^{r}_{\text{th}}(s)$ most similar to $\text{P}_{\text{exp}}(s)$. Therefore, we assign period $r$ to our data. While the spread of each Gaussian gives an indication of the error in the calculation of the SSO. To quantitatively determine the error in the assignment of the period, we calculate the area of overlap between the Gaussian distribution with the highest SSO and the second closest one. This is done through the overlap coefficient inman between the normal distributions. The OVL is defined as

[TABLE]

where $f(x_{1})$ is the normal distribution with the highest SSO and $f(x_{2})$ is the normal distribution with second highest SSO. The OVL tells us what is the probability that the assignment is done incorrectly i.e. the highest SSO for our experimental data comes from a different theoretical probability distribution than the assigned one. Thus, we quantify the error on our assignment as $\epsilon_{ij}\equiv\text{OVL}\left[f(x_{i}),f(x_{j})\right]$ where $i$ denotes the period of the distribution with the highest SSO and $j$ the period of the distribution with the second highest SSO.

The results of the comparison for all experiments are presented in Figs. 4c, 5c, 6c, and 7c. Figs. 4c and 5c show the SSO of the experimental distributions and their deviations obtained for $N=15$, $a=2$ and $a=11$, respectively. For $a=2$, the highest SSO is $0.97$ for the theoretical distribution corresponding to the period $r=4$. Thus, we assign the period $r=4$ to the experimental distribution obtained. The error we make in assigning the period $r=4$ instead of period $r=7$, which is the closest match, is $\epsilon_{47}=3.8\times 10^{-134}$. For $a=11$, the highest SSO is $0.92$ which correspond to $r=2$. The error in the assignment of $r=2$ with respect to $r=4$, which has the second highest SSO, is $\epsilon_{24}=4.1\times 10^{-31}$. The results obtained for $N=21$ with $a=2$ are shown in Fig. 6c. Here, it is more difficult to determine the period with certainty. The highest SSO is $0.78$, which corresponds to the theoretical distribution with $r=6$. The error in assigning $r=6$ to the experimental data is $\epsilon_{67}=1.2\times 10^{-3}$. Therefore, there is a $\sim 0.1\%$ chance that we assigned the period incorrectly and the true period was $r=7$ instead. For the case of $N=35$ and $a=4$, the results presented in Fig. 7c show that the highest SSO between the experimental data and the theoretical distribution corresponding to all possible periods is $0.99$ for $r=7$, although this is not the expected period. There is another close match with an SSO of $0.98$ for $r=6$, which is the correct one. The error in assigning period $r=7$ to the experimental data instead of $r=6$ is $\epsilon_{76}=0.14$. Thus, in this case it is quite difficult to discern the correct period.

VI Conclusions

Although the results are obtained with a compiled and simplified version of Shor’s factoring algorithm, our purpose is to show a way to proceed with the implementation of generic algorithms on the approximate quantum computers available now. In practice, the non-negligible noise and the lack of key functions of the device force us to rethink how to design algorithms that can work on these machines. As it is evident from this work, one needs to supplement the deficiencies of the hardware with a more detailed theoretical analysis and classical processing. By doing so, one can reduce the length of the circuit needed to implement the algorithm, mitigating the effects of noise, and overcoming the lack of particular functions assumed for a general-purpose quantum computer. We emphasize that the simplification by inspection done here was possible only due to the small size of the circuit. Larger circuits would require a more sophisticated optimization. We used different methods to evaluate the success of the experiment. The first one is the probability plot, which gives a qualitative measure of the similarity between the distribution of the experimental data and the expected theoretical distributions. The second one is the SSO, which gives a quantitative measure of the similarity between probability distributions. By using the SSO, we introduced a new way to assign a certain period to the probability distribution obtained from the experimental data. In this way, we avoid using the continued fraction algorithm, which fails when the number of bits used to encode the value of the period is particularly low, as in our situation. To correctly quantify the error which can be made in this assignment, the OVL between different candidates for the period is calculated. Overall, the experimental results obtained from running the algorithm on the ibmqx5 device are in agreement with the theoretical expectation values. Excellent agreement is found for $N=15$, while deviations from the theoretical results become more noticeable for $N=21$. Eventually, the algorithm fails to factor $N=35$. This is due to the cumulative errors coming from the increasing number of two-qubits gates necessary to implement the more complex MEF needed for this case.

Acknowledgements.

We acknowledge use of the IBM Q for this work. The views expressed are those of the authors and do not reflect the official policy or position of IBM or the IBM Q team. The authors are grateful to N. T. Bronn and R. Ya. Kezerashvili for the valuable and stimulating discussions.

Appendix A circuits for the MEF

Here we present the procedure used to implement the MEF in the experiments for factoring $N=15,21$ and $35$. These were specifically designed to reduce the number of gates to the minimum and mitigate the effects of noise. To make the approach scalable, one would need an automatic way to generate the modular exponentiation circuits as proposed in Ref. monz .

The circuits used for the MEF in the experiment for factoring $N=15$ are shown in Fig. 8. The MEF in the first circuit of Fig. 3 shown in Fig. 8a is the identity operation for any base $a$, making it a deterministic step. The output of the first circuit, is then fed into the second one. As shown in Ref. monz , the MEF here reduces to a very simple circuit depending on the base $a$ selected for factoring. If the base $a$ is any one of the elements of the set $\left\{4,11,14\right\}$, the modular exponentiation function is again the identity shown in Fig. 8a and this step turns again into a deterministic step. If the base is one of the elements of the set $\left\{2,7,8,13\right\}$, the MEF has the same simple circuit for any of these $a$, which can be seen from Fig. 8b. The MEF for the two bases $a=2$ and $11$ for the third circuit are given in Figs. 8c and 8d, respectively.

The circuits of the MEF used in the experiment of factoring $N=21$ are presented in Fig. 9. The experiment was conducted only with the base $a=2$, therefore all circuits have been designed only for this base. The MEF for the first circuit is shown in Fig. 9a. For the second circuit, the MEF in Fig. 9b was used. In the third circuit, depending on the values of the bits of the period register measured in the previous stages, different states are prepared as input. For this reason, different modular exponentiation circuits are designed according to the results of the measurements of the period register. The various possibilities are shown in Figs. 9c, 9d, 9e and 9f corresponding to the four possible outcomes $00$, $01$, $10$ and $11$, respectively.

The MEFs implemented in the experiment of factoring $N=35$ are depicted in Fig. 10. The circuits are designed for the algorithm with base $a=4$. The MEF for first, second and third circuits are shown in Figs. 10a, 10b, and 10c, respectively. In this case, one circuits which works for any input was designed for the MEF at each stage.