<p>The main thrust of Cao and Luo's argument is that in the variant of the algorithm that was implemented, the first register—that eventually contains the output—contains only 1 bit. And if you only get 1 bit of output from the algorithm, that's insufficient for factorization. (For one thing, although this isn't their argument, 1 bit clearly does not contain enough information to determine the factors.)</p>

<p>What Cao and Luo seem not to realize is that for the variation of the Fourier transform with only one bit in the first register, the same value of $c$ is output as in the standard factoring algorithm; it's just output <strong><em>one bit at a time.</em></strong>
This change doesn't affect the $O(\log^3 N)$ running time. </p>

<p>To try to be fair to Cao and Luo, they say that they don't think this algorithm works, and if it does work, then it isn't Shor's algorithm because it doesn't exactly match the algorithm described in the original factoring paper. A quote from their paper: </p>

<blockquote>
  <p>Finally, we would like to stress that if the implementation is indeed credible then it would be a new quantum factoring algorithm, not the Shor algorithm, because all requirements of the original Shor’s algorithm are not satisfied.</p>
</blockquote>

<p>And indeed, it's not the algorithm from my original factoring paper. It uses the phase estimation procedure from Kitaev's factoring algorithm, and a variant on that, discovered by Griffiths and Niu (not by Parker and Plenio, as I said in a previous edit of this answer) that lets the algorithm output the estimate of the phase one bit at a time. </p>

CC BY-SA 3.0
2017-01-09T06:37:49.820Z
Your answer does not tell us why outputting one bit at a time does not affect the (log n)^3 operation count. Can it be explained why the overhead cost suffered by outputting one bit at a time is less than O(log n)^3 ?
user1271772
CC BY-SA 3.0
2017-01-09T14:02:09.273Z
Please show me where in Cao and Luo's paper they say that outputting one bit at a time affects the operation cost. If I am reading their paper correctly, ***they do not.*** I think I have adequately refuted their criticism.
Peter Shor 
CC BY-SA 3.0
2017-01-09T14:07:48.867Z
Their criticisms are (1) if you only have one bit of output, then the continued fractions algorithm does not work. This is refuted by noticing that you actually have more than one bit of output. (2) if you only have one bit of output, then the probabilities for each output $c$ are incorrect. This again is refuted by noticing that you actually have more than one bit of output. (3) the only multiplication circuits used were ones that multiply $x\cdot t$, where $t$ is a fixed number precomputed into the multiplication circuit. I didn't refute this in my answer, but this is all you need to factor.
Peter Shor 
CC BY-SA 3.0
2017-01-09T14:23:49.950Z
I am not going to go through the circuit for one-qubit output phase estimation and explain why the relatively small change needed to accomplish this does not affect the time complexity. It's the "semi-classical" modification described on page 2 of Parker and Plenio's [paper](https://arxiv.org/abs/quant-ph/0001066), *Efficient factorization with a single pure qubit and log N mixed qubits*.
Peter Shor 
CC BY-SA 3.0
2017-01-02T17:45:47.650Z
2017-01-24T13:41:59.250Z
2017-01-24T13:41:59.250Z
Peter Shor 
<p>In the 2016 Science paper "<a href="https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068" rel="noreferrer">Realization of a scalable Shor algorithm</a>" [<a href="https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068" rel="noreferrer">1</a>], the authors factor 15 with only 5 qubits, which is fewer than the 8 qubits "required" according to Table 1 of [<a href="http://www.nature.com/nature/journal/v499/n7457/full/nature12290.html#ref12" rel="noreferrer">2</a>] and Table 5 of [<a href="https://arxiv.org/pdf/1411.6758v3.pdf" rel="noreferrer">3</a>]. The 8-qubit requirement comes from the end of [<a href="https://arxiv.org/pdf/quant-ph/0601097v1.pdf" rel="noreferrer">4</a>] which states that the number of qubits needed for factoring an $n$-bit number is $1.5n+2$ which for 15 is $1.5\cdot 4 + 2=8$.</p>

<p>The paper that uses only 5 qubits states that their algorithm "replaces a QFT acting on M qubits with a semiclassical QFT acting repeatedly on a single qubit", but the <strong>consequences</strong> of this on the <strong>complexity</strong> of the  algorithm was never mentioned in the paper. </p>

<p>Now there has been <a href="https://pdfs.semanticscholar.org/edb0/6556b7dc87fd91137909dbe35c7106b73261.pdf" rel="noreferrer">harsh criticism</a> of the paper claiming to factor 15 in a "scalable" way, as they say in Section 2 that the complexity argument for Shor's algorithm no longer holds. However, this criticism has not been corroborated anywhere, and the Science paper keeps getting celebrated as a "scalable" version of Shor's algorithm. What is the complexity of the "scalable" Shor algorithm?</p>

<ul>
<li>[<a href="https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068" rel="noreferrer">1</a>] Monz <em>et al.</em> (2016) <strong>Science</strong>. Vol. 351, Issue 6277, pp. 1068-1070</li>
<li>[<a href="http://www.nature.com/nature/journal/v499/n7457/full/nature12290.html#ref12" rel="noreferrer">2</a>] Smolin <em>et al.</em> (2013) <strong>Nature</strong>. 499, 163–165</li>
<li>[<a href="https://arxiv.org/pdf/1411.6758v3.pdf" rel="noreferrer">3</a>] Dattani &amp; Bryans (2014) <strong>arXiv:1411.6758</strong></li>
<li>[<a href="https://arxiv.org/pdf/quant-ph/0601097v1.pdf" rel="noreferrer">4</a>] Zalka (2008) <strong>arXiv:quant-ph/0601097</strong></li>
<li>[<a href="https://pdfs.semanticscholar.org/edb0/6556b7dc87fd91137909dbe35c7106b73261.pdf" rel="noreferrer">5</a>] Cao &amp; Luo <strong>"Comment on: Realization of a scalable Shor algorithm"</strong></li>
</ul>

CC BY-SA 3.0
2016-12-08T13:23:06.737Z
Depends on what you mean by "scalable". Some of the criticisms of Cao and Liu seem quite nit-picky. For example, one of their criticisms is that Kitaev did not claim that you could use only one qubit in the paper cited for this result. They don't seem to investigate whether this claim itself is actually true or false. Kitaev's algorithm can in fact be modified to use only one qubit, as the Science paper claims, even though this claim does not seem to be in Kitaev's paper on his algorithm.
Peter Shor 
CC BY-SA 3.0
2016-12-08T13:55:33.103Z
@PeterShor, what an honor to hear from you! Ok so the authors (correctly) extended the results of Kitaev's paper to make it possible with one qubit, and Cao & Liu complain that they call it "Kitaev's algorithm" rather than "modified Kitaev algorithm or something like that". However, they also say that the complexity argument no longer holds when the QFT is turned into the "semi-classical QFT". I a still a student when it comes to this type of analysis so I would appreciate input. Is the complexity still O(log n)^3 ? Is it still "scalable" in terms of being polynomial, or at least < GNFS ?
user1271772
CC BY-SA 3.0
2016-12-08T14:14:51.650Z
I'll let somebody else answer this, as people might claim I'm biased. But let me point out that the authors of the *Science* paper didn't extend Kitaev's algorithm ... it's a well-known extension. They merely didn't cite the correct reference.
Peter Shor 
CC BY-SA 3.0
2016-12-08T14:34:17.020Z
@D.W. About reference [2]. Thank you for your comment! I am not sure how to fix this. However, I believe it is straightforward to look for the Zalka paper in the reference [2] bibliography, and then see that when Zalka's paper was cited in reference [2], the authors were saying that it was Zalka's paper that lead them to the conclusion that factoring 15 requires at least 8 qubits. This however doesn't even seem necessary, because it is clear from Table 1 of reference [2] that they claimed factoring 15 requires 8 qubits, and then I took the time to summarize exactly how Zalka's paper leads to 8
user1271772
CC BY-SA 3.0
2016-12-08T14:36:10.323Z
@D.W. If you have any ideas how to improve my reference [2] issue, I would welcome your advice (or edit). Neither Zalka's paper nor reference [2] explicitly explains why factoring 15 requires 8 qubits, but Zalka's paper gives the formula that I've repeated in my question, and then I have taken the time to substitute in the numbers and arrive at 8 qubits. :)
user1271772
CC BY-SA 3.0
2016-12-15T15:29:32.370Z
These formulas that arrive at 8 qubits take some specific implementation of Shor's algorithm and calculate how many qubits that implementation takes. They do not claim that this is the best possible implementation.
Peter Shor 
CC BY-SA 3.0
2016-12-15T20:34:18.823Z
@PeterShor: Absolutely, however the 8-qubit scheme of Zalka's paper (reference [4] in the question) seems to preserve the O(log(n)^3) scaling of the overall algorithm, whereas the Cao & Liu paper argues that by replacing the M qubit QFT with a 1 qubit "semiclassical QFT", the O(log(n)^3) scaling argument is lost. The question is whether or not there is merit to that claim (that the scaling deteriorates by replacing the M-qubit QFT this way) ?
user1271772
CC BY-SA 4.0
2019-02-24T05:46:42.507Z
@user1271772 This was flagged for moderation attention on the basis of you being one of the authors mentioned in your own post. Not that that's bad, some self-advertisement is an unavoidable part of science, but maybe best to be clear about it?
Bjørn Kjos-Hanssen
CC BY-SA 4.0
2021-05-03T23:01:01.563Z
What happened was that a moderator broke the moderator agreement contract that they signed when they took the role. I was user1271772 until well into 2020, so that flag in Feb 2019 is evidence of a violation of contract (don't worry, I know who it was). Anyway: I'm not praising my own work or anything like that, in this question.
user1271772
<cc.complexity-theory><ds.algorithms><quantum-computing><factoring><security>
Is the 2016 implementation of Shor's algorithm really scalable?
user1271772
# Is the 2016 implementation of Shor's algorithm really scalable?

(Asked by: username_0 on 2016-11-19)

In the 2016 Science paper "[Realization of a scalable Shor algorithm](https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068)" [[1](https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068)], the authors factor 15 with only 5 qubits, which is fewer than the 8 qubits "required" according to Table 1 of [[2](http://www.nature.com/nature/journal/v499/n7457/full/nature12290.html#ref12)] and Table 5 of [[3](https://arxiv.org/pdf/1411.6758v3.pdf)]. The 8-qubit requirement comes from the end of [[4](https://arxiv.org/pdf/quant-ph/0601097v1.pdf)] which states that the number of qubits needed for factoring an $n$-bit number is $1.5n+2$ which for 15 is $1.5\cdot 4 + 2=8$.

The paper that uses only 5 qubits states that their algorithm "replaces a QFT acting on M qubits with a semiclassical QFT acting repeatedly on a single qubit", but the **consequences** of this on the **complexity** of the algorithm was never mentioned in the paper.

Now there has been [harsh criticism](https://pdfs.semanticscholar.org/edb0/6556b7dc87fd91137909dbe35c7106b73261.pdf) of the paper claiming to factor 15 in a "scalable" way, as they say in Section 2 that the complexity argument for Shor's algorithm no longer holds. However, this criticism has not been corroborated anywhere, and the Science paper keeps getting celebrated as a "scalable" version of Shor's algorithm. What is the complexity of the "scalable" Shor algorithm?

* [[1](https://d2ufo47lrtsv5s.cloudfront.net/content/351/6277/1068)] Monz *et al.* (2016) **Science**. Vol. 351, Issue 6277, pp. 1068-1070
* [[2](http://www.nature.com/nature/journal/v499/n7457/full/nature12290.html#ref12)] Smolin *et al.* (2013) **Nature**. 499, 163–165
* [[3](https://arxiv.org/pdf/1411.6758v3.pdf)] Dattani & Bryans (2014) **arXiv:1411.6758**
* [[4](https://arxiv.org/pdf/quant-ph/0601097v1.pdf)] Zalka (2008) **arXiv:quant-ph/0601097**
* [[5](https://pdfs.semanticscholar.org/edb0/6556b7dc87fd91137909dbe35c7106b73261.pdf)] Cao & Luo **"Comment on: Realization of a scalable Shor algorithm"**

**Tags:** cc.complexity-theory, ds.algorithms, quantum-computing, factoring, security
> **Comments:**
> **username_1**: Depends on what you mean by "scalable". Some of the criticisms of Cao and Liu seem quite nit-picky. For example, one of their criticisms is that Kitaev did not claim that you could use only one qubit in the paper cited for this result. They don't seem to investigate whether this claim itself is actually true or false. Kitaev's algorithm can in fact be modified to use only one qubit, as the Science paper claims, even though this claim does not seem to be in Kitaev's paper on his algorithm.  
> **username_0**: @PeterShor, what an honor to hear from you! Ok so the authors (correctly) extended the results of Kitaev's paper to make it possible with one qubit, and Cao & Liu complain that they call it "Kitaev's algorithm" rather than "modified Kitaev algorithm or something like that". However, they also say that the complexity argument no longer holds when the QFT is turned into the "semi-classical QFT". I a still a student when it comes to this type of analysis so I would appreciate input. Is the complexity still O(log n)^3 ? Is it still "scalable" in terms of being polynomial, or at least < GNFS ?  
> **username_1**: I'll let somebody else answer this, as people might claim I'm biased. But let me point out that the authors of the *Science* paper didn't extend Kitaev's algorithm ... it's a well-known extension. They merely didn't cite the correct reference.  
> **username_0**: @D.W. About reference [2]. Thank you for your comment! I am not sure how to fix this. However, I believe it is straightforward to look for the Zalka paper in the reference [2] bibliography, and then see that when Zalka's paper was cited in reference [2], the authors were saying that it was Zalka's paper that lead them to the conclusion that factoring 15 requires at least 8 qubits. This however doesn't even seem necessary, because it is clear from Table 1 of reference [2] that they claimed factoring 15 requires 8 qubits, and then I took the time to summarize exactly how Zalka's paper leads to 8  
> **username_0**: @D.W. If you have any ideas how to improve my reference [2] issue, I would welcome your advice (or edit). Neither Zalka's paper nor reference [2] explicitly explains why factoring 15 requires 8 qubits, but Zalka's paper gives the formula that I've repeated in my question, and then I have taken the time to substitute in the numbers and arrive at 8 qubits. :)  
> **username_1**: These formulas that arrive at 8 qubits take some specific implementation of Shor's algorithm and calculate how many qubits that implementation takes. They do not claim that this is the best possible implementation.  
> **username_0**: @PeterShor: Absolutely, however the 8-qubit scheme of Zalka's paper (reference [4] in the question) seems to preserve the O(log(n)^3) scaling of the overall algorithm, whereas the Cao & Liu paper argues that by replacing the M qubit QFT with a 1 qubit "semiclassical QFT", the O(log(n)^3) scaling argument is lost. The question is whether or not there is merit to that claim (that the scaling deteriorates by replacing the M-qubit QFT this way) ?  
> **username_2**: @user1271772 This was flagged for moderation attention on the basis of you being one of the authors mentioned in your own post. Not that that's bad, some self-advertisement is an unavoidable part of science, but maybe best to be clear about it?  
> **username_0**: What happened was that a moderator broke the moderator agreement contract that they signed when they took the role. I was user1271772 until well into 2020, so that flag in Feb 2019 is evidence of a violation of contract (don't worry, I know who it was). Anyway: I'm not praising my own work or anything like that, in this question.  

---

## 1 answers

### Answer by username_1 on 2017-01-02. Score: 13

The main thrust of Cao and Luo's argument is that in the variant of the algorithm that was implemented, the first register—that eventually contains the output—contains only 1 bit. And if you only get 1 bit of output from the algorithm, that's insufficient for factorization. (For one thing, although this isn't their argument, 1 bit clearly does not contain enough information to determine the factors.)

What Cao and Luo seem not to realize is that for the variation of the Fourier transform with only one bit in the first register, the same value of $c$ is output as in the standard factoring algorithm; it's just output ***one bit at a time.***
This change doesn't affect the $O(\log^3 N)$ running time.

To try to be fair to Cao and Luo, they say that they don't think this algorithm works, and if it does work, then it isn't Shor's algorithm because it doesn't exactly match the algorithm described in the original factoring paper. A quote from their paper:

> Finally, we would like to stress that if the implementation is indeed credible then it would be a new quantum factoring algorithm, not the Shor algorithm, because all requirements of the original Shor’s algorithm are not satisfied.

And indeed, it's not the algorithm from my original factoring paper. It uses the phase estimation procedure from Kitaev's factoring algorithm, and a variant on that, discovered by Griffiths and Niu (not by Parker and Plenio, as I said in a previous edit of this answer) that lets the algorithm output the estimate of the phase one bit at a time.

> **Comments:**
> **username_0**: Your answer does not tell us why outputting one bit at a time does not affect the (log n)^3 operation count. Can it be explained why the overhead cost suffered by outputting one bit at a time is less than O(log n)^3 ?  
> **username_1**: Please show me where in Cao and Luo's paper they say that outputting one bit at a time affects the operation cost. If I am reading their paper correctly, ***they do not.*** I think I have adequately refuted their criticism.  
> **username_1**: Their criticisms are (1) if you only have one bit of output, then the continued fractions algorithm does not work. This is refuted by noticing that you actually have more than one bit of output. (2) if you only have one bit of output, then the probabilities for each output $c$ are incorrect. This again is refuted by noticing that you actually have more than one bit of output. (3) the only multiplication circuits used were ones that multiply $x\cdot t$, where $t$ is a fixed number precomputed into the multiplication circuit. I didn't refute this in my answer, but this is all you need to factor.  
> **username_1**: I am not going to go through the circuit for one-qubit output phase estimation and explain why the relatively small change needed to accomplish this does not affect the time complexity. It's the "semi-classical" modification described on page 2 of Parker and Plenio's [paper](https://arxiv.org/abs/quant-ph/0001066), *Efficient factorization with a single pure qubit and log N mixed qubits*.  

---

