Abstract
We have developed a framework to convert an arbitrary integer factorization problem to an executable Ising model by first writing it as an optimization function then transforming the kbit coupling (k ≥ 3) terms to quadratic terms using ancillary variables. Our resourceefficient method uses \({\mathscr{O}}({\mathrm{log}}^{2}(N))\) binary variables (qubits) for finding the factors of an integer N. We present how to factorize 15, 143, 59989, and 376289 using 4, 12, 59, and 94 logical qubits, respectively. This method was tested using the DWave 2000Q for finding an embedding and determining the prime factors for a given composite number. The method is general and could be used to factor larger integers as the number of available qubits increases, or combined with other ad hoc methods to achieve better performances for specific numbers.
Introduction
Integer factorization reduces an integer N to its factors p and q such that pq = N. While this fundamental problem in number theory is computationally hard in practice, integer factorization is not believed to belong to the class of NPhard problems. However, all known classical factoring algorithms which are deterministic and don’t have unproven hypotheses require time exponential in logN. For example, the fastest, known classical algorithm for integer factorization is the general number field sieve method^{1}, which scales exponentially in the number of operations required with respect to the integer N. Thus, the integer factorization problem has been used as a basic hardness assumption for many encryption methods including the widely deployed RSA cryptographic system. With broad applications in cryptographic data storage and communications^{2}, identifying new methods for integer factorization plays an important role in modern information security.
Quantum computing theory has the potential to reduce the number of operations required for solving the integer factorization problem. Within the circuit model of quantum computation, Shor’s algorithm is perhaps the most wellknown method for integer factorization, in which the number of operations to factorize an integer N is polynomial in the size logN^{3}. This exponential speedup over the general number field sieve is achieved by reducing factorization to the orderfinding problem. Several experimental demonstrations using quantum computing hardware have validated the correctness of Shor’s algorithm for small integer values, including early work by Vandersypen et al.^{4} to factorize N = 15 using seven spin1/2 nuclei in a molecule as qubits. Subsequent experiments by Lanyon et al.^{5}, Lu et al.^{6}, and Politi et al.^{7} implemented compiled versions of Shor’s algorithm using photonic systems for factoring 15. MartínLópez et al.^{8} factored 21 using qubit recycling, and Lucero et al.^{9} used superconducting qubits to factor 15. Geller et al.^{10} used a simplified version of Shor’s algorithm for factoring products of the Fermat primes 3, 5, 17, 257, and 65537. Recent work from Grosshans et al. has shown how factoring safe semiprimes using the quantum orderfinding algorithm can reduce the failure probability^{11}.
An equally powerful model of quantum computing is the adiabatic quantum computing (AQC) model^{12,13}, which can also solve the integer factorization problem. Peng et al. first developed integer factorization within AQC by reducing it to unconstrained optimization and solving this problem using adiabatic quantum dynamics. They further validated these ideas experimentally using a threequbit NMR quantum processor for the case of N = 21^{14}, while Xu et al. subsequently factored 143 using similar NMR technology^{15}. Schaller et al. developed a novel approach based on multiplication tables that can be cast as an optimization, which they have demonstrated for biprimes up to N = 217^{16}. Dridi et al. furthered these ideas by using Gröbner bases to reduce the number of auxiliary variables required and simplify equations, thereby enabling a demonstration of factorization up to 223357^{17}.
In this contribution, we introduce a new procedure for solving the integer factorization problem using quantum annealing^{18,19} which utilizes adiabatic quantum computation. Differ from the recent work^{20} which sketched the hardware design of reversible multiplier to achieve factorization, we provide specific mathematical derivations to be tested on the existing hardware. We begin by describing a direct method for integer factorization that reduces the problem to unconstrained optimization. We review how this optimization problem can be reduced to a quadratic form Ising Hamiltonian and be solved using quantum annealing. We then describe a modified multiplication table method that reduces the overall resource requirements on the optimization problem and permits methods to account for constraints that may appear in quantum annealing hardware, such as connectivity and number of qubits. Our modification also reduces the range of coefficients in the underlying cost function without increasing the number of qubits required. This method avoided the timeconsuming preprocessing steps^{17} to achieve comparable results, and could be combined with other adhoc function simplification methods to further reduce the number of qubits or other aspects. We finally tested both methods with results from experimental demonstrations using quantum annealing hardware.
Background
Quantum Annealing was introduced^{18} to solve optimization problems using quantum fluctuations to transit to the ground state, compared to simulated annealing which uses thermal fluctuations to get to the global minimum. Quantum fluctuations such as quantum tunneling^{21} provide ways of transitions between states. The transverse field controls the rate of the transition, as the role of temperature played in simulated annealing.
Farhi et al.^{12} remodeled the procedure as Adiabatic Quantum Computing(AQC), which finds the energetic ground state of a problem Hamiltonian by adiabatically evolving the quantum state. If the system begins at the ground state, after the adiabatic evolution, the system will remain at the ground state. By combining the initial Hamiltonian H_{B} and the problem Hamiltonian H_{P} linearly, the system could be defined as a timedependent Hamiltonian \(H(t)=(1\frac{t}{T}){H}_{B}+\frac{t}{T}{H}_{P}\), where the duration T defines the timescale for evolution and controls the rate at which the timedependent Hamiltonian changes, the initial Hamiltonian H_{B} is of the form \({H}_{B}=\,{\sum }_{i=1}^{L}\,{\sigma }_{x}^{(i)}\) over L qubits with the Pauli operator \({\sigma }_{x}^{(i)}\) defining the xbasis of the ith qubit. The problem Hamiltonian H_{P} is in the form of Ising model over L qubits as
where \({\sigma }_{z}^{(i)}\) defines the zbasis for the ith qubit and the local fields h_{i} and couplings J_{ij} define the problem instance.
Computation within the AQC model evolves the Lqubit quantum state under the timedependent Hamiltonian H(t) according to the Schrödinger equation \(i\hslash \frac{\partial }{\partial t}\psi (t)\rangle =H(t)\psi (t)\rangle \), where ψ(t)〉 is the state of the system at time t ∈ [0, T] and we will set ℏ = 1. Let ϕ_{i}(t)〉 be the ith instantaneous eigenstate, such that H(t)ϕ_{i}(t)〉 = E_{i}(t) ϕ_{i}(t)〉, and let the initial state of the system be the ground state at time t = 0, such that ψ(0)〉 = ϕ_{0}(0)〉. According to the adiabatic theorem^{22}, the system state will remain in the instantaneous ground state of the timedependent Hamiltonian provided the evolution is sufficiently slow to prevent excitations to higherlying states. Under these idealized adiabatic conditions, the system will evolve into the energetic ground state of the problem Hamiltonian as ψ(T)〉 = ϕ_{0}(T)〉. This prepared quantum state of L qubits is then measured to generate a classical string of L bits that represents the solution to the encoded factorization problem.
Several practical considerations limit the applicability of the AQC model for solving optimization problems. Foremost is the requirement that changes in the quantum state must be adiabatic, i.e, slow, relative to the internal timescales of the instantaneous Hamiltonian H(t). Theoretical analyses of this requirement provide a best lower bound on the time T as O(Δ^{−2}), where Δ is the minimum energy gap within the instantaneous eigen spectrum of H(t)^{13}. However, the minimum spectral gap is dependent on the specific instances of the initial and final Hamiltonians and the interpolation between them. A priori knowledge of spectral gap information would provide a significant insight into the underlying optimization problem, if not the solution directly, and therefore is an impractical expectation for a computational method. In addition, the purestate model for AQC fails to account for finitetemperature effects observed in actual hardware as well as unexpected environmental coupling, unpredictable control noise, unwanted crosstalk, and other imperfections.
Practically quantum annealing relaxes the AQC with guarantee that the observed final state corresponds to the energetic ground state. However, the probability to observe the energetic ground state may be reduced due to physical noise and nonadiabatic dynamics. The resulting error rate p_{e}(L) characterizes the quantum annealing dynamics, which is most accurately modeled as an open quantum system of Lqubits evolving the presence of an uncontrolled environment. The quantum annealing model is therefore more robust to the above practical considerations but it is necessarily a probabilistic computational model. Statistical sampling of a quantum annealing computation is always necessary to gather confidence in the observed result. Quantum annealing may also be interpreted as a metaheuristic for managing noisy AQC computation, whereby the aggregate likelihood of success p_{s} is determined by the number of samples S as p_{s} = 1−(p_{e})^{S}. The number of samples necessary to achieve a desired probability of success is therefore S ≥ log(1−p_{s})/log(p_{e}). For a fixed annealing duration T and probability of success p_{s}, we may expect the probability of error p to increase as the size of the system increases, i.e., as L increases. The rate at which the sample number S increases with system size plays an important role in determining the computational complexity of using the quantum annealing model. For example, an error rate that increases exponentially with system size, i.e., p_{e }∝ exp(L), yields a sampling rate that increases linearly.
A related practical consideration is the resource efficiency with which quantum annealing can be implemented. Specifically, the number of qubits necessary to realize the problem Hamiltonian H_{P} influences not only the number of samples required but also the feasibility of demonstrating the method on available hardware. The most general case of Lqubit Hamiltonian may include alltoall connectivity, whereby each qubit must interact with every other qubits. However, most of the existing hardware does not permit such connectivity directly, and methods for realizing implicit connections have been developed^{23,24}. In our implementation of integer factorization using the Ising Hamiltonian, it is necessary to compose a problem Hamiltonian in terms of pairwise interactions, and we develop an efficient transformation of the factoring problem Hamiltonian into pairwise coupling.
Methods
We describe two methods for implementing integer factorization within the quantum annealing model. We found these two corresponding Hamiltonians H_{P} to encode the factors of an input integer N, such that the energetic ground state corresponds to factorization of the input. The first is a direct method to compute the factors of N = pq by constructing the associated optimization problem as an Ising Hamiltonian. The second method is based on the modified multiplication tables to translate the problem into the Ising Hamiltonian. We test our methods using experimental quantum computing hardware appropriate for quantum annealing. The DWave 2000Q processor natively implements an Ising model Hamiltonian and provides programmable control over the parameters h_{i} and J_{i,j} as well as the annealing duration T.
Direct Method
Our direct method factors N = pq, where p and q are prime numbers. We set \({l}_{1}=\lfloor {\mathrm{log}}_{2}(p)\rfloor \) and \({l}_{2}=\lfloor {log}_{2}(q)\rfloor \). Because p and q are prime numbers, we use the binary representations \(p={({x}_{{l}_{1}1}{x}_{{l}_{1}2}\mathrm{...}{x}_{1}\mathrm{1)}}_{2}\) and \(q={({x}_{{l}_{1}+{l}_{2}2}{x}_{{l}_{1}+{l}_{2}3}\mathrm{...}{x}_{{l}_{1}}\mathrm{1)}}_{2}\), where l_{1} > l_{2} and x_{i} ∈ {0, 1} for i = 1 to l_{1} + l_{2}−2. We define the cost function \(f({x}_{1},\,{x}_{2},\,{x}_{3},\,{x}_{4},\,\mathrm{...,}\,{x}_{{l}_{1}+{l}_{2}2})={(Npq)}^{2}\), and explicit multiplication of the binary representations for p and q yields a sum of binary products. We reduce the resulting 3local terms to 2local terms using the following equivalence^{24}: for x, y, z ∈ {0, 1}, xy = z iff xy−2xz−2yz + 3z = 0, and xy ≠ z iff xy−2xz−2yz + 3z > 0. Therefore,
$${x}_{1}{x}_{2}{x}_{3}={x}_{4}{x}_{3}+\mathrm{2(}{x}_{1}{x}_{2}2{x}_{1}{x}_{4}2{x}_{2}{x}_{4}+3{x}_{4})\,{\rm{if}}\,{x}_{4}={x}_{1}{x}_{2}$$and
$${x}_{1}{x}_{2}{x}_{3} < {x}_{4}{x}_{3}+\mathrm{2(}{x}_{1}{x}_{2}2{x}_{1}{x}_{4}2{x}_{2}{x}_{4}+3{x}_{4})\,{\rm{if}}\,{x}_{4}\ne {x}_{1}{x}_{2}$$thus, the x_{1}x_{2}x_{3} term may be transformed to quadratic form by replacing x_{1}x_{2} with x_{4} plus a constraint in the form of a penalty term:
By introducing a new variable and adding the penalty term, we are able to transform 3local terms to 2local terms.
For integer factorization, we require \((\begin{array}{c}{l}_{1}\\ 2\end{array})+(\begin{array}{c}{l}_{2}\\ 2\end{array})=\frac{{l}_{1}({l}_{1}\mathrm{1)}}{2}+\frac{{l}_{2}({l}_{2}\mathrm{1)}}{2}\) auxiliary variables to form a quadratic cost function, and when l_{1} = l_{2} = l this number is l × (l−1). Counting the variables to denote the factors themselves, the quadratic function requires L = 2 × (l−1) + l × (l−1) = (l + 2) × (l−1) binary variables in total. Since \(l={\mathscr{O}}(\mathrm{log}(N))\), \(L={\mathscr{O}}({\mathrm{log}}^{2}(N))\). We could also let \(p={\mathrm{(1}{x}_{{l}_{1}2}\mathrm{...}{x}_{1}\mathrm{1)}}_{2},\,q={\mathrm{(1}{x}_{{l}_{1}+{l}_{2}4}\mathrm{...}{x}_{{l}_{1}1}\mathrm{1)}}_{2}\) when lengths of p and q are prefixed.
We illustrate this direct method of factorization for the case of N = 15. Because \({{\rm{l}}{\rm{o}}{\rm{g}}}_{2}(p)\,\le \,2\, < \,{{\rm{l}}{\rm{o}}{\rm{g}}}_{2}(q)\, < \,4\), we define p = (x_{1}1)_{2} and q = (x_{2}x_{3}1)_{2}. The objective function f(x_{1}, x_{2}, x_{3}) = (N−pq)^{2} may then be reduced to the 3local form:
$$f(x)=128{x}_{1}{x}_{2}{x}_{3}56{x}_{1}{x}_{2}48{x}_{1}{x}_{3}+16{x}_{2}{x}_{3}52{x}_{1}52{x}_{2}96{x}_{3}+196.$$We reduce the 3local terms to 2local terms using the method described above to obtain
$$\begin{array}{rcl}f^{\prime} (x) & = & 200{x}_{1}{x}_{2}48{x}_{1}{x}_{3}512{x}_{1}{x}_{4}+16{x}_{2}{x}_{3}512{x}_{2}{x}_{4}+128{x}_{3}{x}_{4}\\ & & 52{x}_{1}52{x}_{2}96{x}_{3}+768{x}_{4}+\mathrm{196,}\end{array}$$where
$$\mathop{{\rm{\min }}}\limits_{{x}_{1}{x}_{2}={x}_{4}}f({x}_{1},\,{x}_{2},\,{x}_{3},\,{x}_{4})=\,{\rm{\min }}\,f^{\prime} ({x}_{1},\,{x}_{2},\,{x}_{3},\,{x}_{4})$$This result is a quadratic unconstrained binary optimization (QUBO) problem over L = 4 variables that may be transformed into an equivalent Ising Hamiltonian as defined in Eq. 1 by identifying the binary variable x_{i} with the ith spin state s_{i} = 2x_{i} − 1. For N = 15, the local fields h^{T} and couplings J of the Ising problem Hamiltonian are then determined to be
and
It is notable that the L × L coupling matrix J is generally dense on the upper triangle, indicating that L(L−1)/2 couplings are necessary. Similarly Ising parameters may be generated for other integers N by the appropriate quadritization into a QUBO problem and then reduced to Ising form.
Modified Multiplication Table Method
The second method is based on modified multiplication table. It reduces the range of Ising parameter values used as coefficients for the local fields and couplings. At the meantime, it considers to use a smaller number of carry variables without complicated preprocessing.
The modified multiplication table method uses local minimizations over the products of individual binary substring bits representing the integers p and q. It divides the multiplication table into several blocks, and considers each block individually. We could also choose the size of each block to get the desired range of parameters and the number of variables, or make a balance between them. A detailed analysis of the range of coefficients is shown in the last section of the supplemental material. Note that the modified multiplication table method does not eliminate the need for quadratization of 4body and 3body product terms and auxiliary variables are required. However, this approach does reduce the number of these higherorder terms compared to the direct method, which makes it possible to embed larger problem sizes on currently available quantum hardware.
We describe this method by an illustrative example of N = 143, for which p = 13 and q = 11. Past approaches for integer factorization constructed a system of equations from each column or part of each column in the multiplication table^{17,25,26}, which accounts for a carry bit or several carry bits for each part. In our approach, we divide the multiplication table into blocks so that it is only needed to use carries between blocks. This greatly reduced the number of carries, thus the total number of variables reduced too.
As shown in Table 1 for N = 143, we introduce two sets of carry bits. We denote them using c_{i} ∈ {0, 1}, and the twobit numbers (c_{2}c_{1})_{2} = c_{2} × 2 + c_{1} and (c_{4}c_{3})_{2} = c_{4} × 2 + c_{3} represent the carry bits for each of the divided columns in the table. Note that the columns are composed along twobit domains, so that addition within each block is over twobit numbers. But the sums are over fourbit numbers. The resulting block system of equations derived from Table 1 is
Because this modified multiplication table method calculates carries only for each block, it avoids requiring carry bits for each column in the multiplication table. This reduces the overall complexity of the computation by reducing the number of carry bits as well as the number of couplings between bits. In the limit of a single column per block, the conventional multiplication table is recovered, while in the limit of a single equation the direct method is recovered. Instead of making the sum of each column equal to every each bit of the number to be factored as in a conventional multiplication table, we make each block of the multiplication table equal to the corresponding block of the number to be factored. As shown in the appendix material, the equations for these blocks may be reduced to the nonnegative cost function
$$\begin{array}{rcl}f(p,\,q,\,c) & = & {\mathrm{(2}{p}_{2}+2{p}_{1}{q}_{1}+2{q}_{2}8{c}_{2}4{c}_{1}+{p}_{1}+{q}_{1}\mathrm{3)}}^{2}\\ & & +\mathrm{(2}{q}_{1}+2{p}_{2}{q}_{2}+2{p}_{1}+2{c}_{2}8{c}_{4}4{c}_{3}+{p}_{2}{q}_{1}+{p}_{1}{q}_{2}\\ & & +{c}_{1}+{\mathrm{1)}}^{2}+{({q}_{2}+{p}_{2}+{c}_{3}+2{c}_{4}\mathrm{2)}}^{2}.\end{array}$$This form may be expanded and further simplified using the property \({x}_{i}^{2}={x}_{i}\,{\rm{for}}\,{x}_{i}=\mathrm{0,}\,1\), while the remaining cubic and higherorder terms like c_{1}p_{1}q_{1} and p_{1}p_{2}q_{1}q_{2} can be reduced to quadratic form by introducing auxiliary variables. In particular, we note that the quadratization of the negative term is similar to the position term, e.g.,
$$\{\begin{array}{lll}{x}_{1}{x}_{2}{x}_{3}={x}_{4}{x}_{3}+\mathrm{2(}{x}_{1}{x}_{2}2{x}_{1}{x}_{4}2{x}_{2}{x}_{4}+3{x}_{4}) & {\rm{if}} & {x}_{4}={x}_{1}{x}_{2}\\ {x}_{1}{x}_{2}{x}_{3} < {x}_{4}{x}_{3}+\mathrm{2(}{x}_{1}{x}_{2}2{x}_{1}{x}_{4}2{x}_{2}{x}_{4}+3{x}_{4}) & {\rm{if}} & {x}_{4}\ne {x}_{1}{x}_{2}\end{array}$$as detailed in the appendix material, the conversion to QUBO form leads to the parameters for the Ising Hamiltonian. For N = 143, this yields the local fields
and the upper triangular coupling matrix
Our approach requires a decision to partition the columns of the multiplication table into blocks, and this choice must balance the number of unknown variables (carries) against the range of coefficients in the problem Hamiltonian. We illustrate this choice for the factorization of biprimes 59989 and 376289 in Tables 2 and 3. Our approach is to set the bitlength of the carry variable for each block based on the largest possible number of that block(the right neighboring columns). For example, the maximum carry for the rightmost block in the multiplication table of N = 59989 is 3 which requires two bits to represent. Thus, the bitlength of the carry variable for this block is 2, i.e., (c_{2}c_{1})_{2}. Similarly, for N = 376289, the bitlength of the carry variables for the rightmost block is 3, while the bitlength of the carry variable for the third block is 4. Because this bitlength is larger than the size of the fourth block, which has a bitlength of 3, the most significant bit of the carry is included in the neighboring block, i.e., the fifth block in this example.
We estimate the number of variables needed to construct the Ising Hamiltonian that encodes the factorization problem for N = 59989 and 376289. This requires quadratization of the resulting systems of factoring equations followed by reduction to the Ising form, exactly as discussed explicitly above. For the case of N = 59989, we have l_{1} = l_{2} = 6, and therefore 12 variables are required to represent the factors themselves plus 11 variables to denote the carries, while 36 auxiliary variables are required for quadratization of the factoring equations. The total number variables is 59. For N = 376289, we have l_{1} = l_{2} = 8 with 14 carries and 64 auxiliary variables. As noted above, sometimes vary bits in the multiplication table will overlap, as is the case for column 2^{14} of 376289 shown in Table 3. In such circumstances, we just simply add these carries in the table and then use the same method as before to find the corresponding Ising Hamiltonian. Thus, this problem Hamiltonian requires 94 qubits.
Generally, for factoring a biprime number, we use approximately log(N) binary variables to encode the integer factors and about log(N) binary variables to denote the carries where N is the number to be factored. An additional log^{2}(N)/4 auxiliary binary variables are required for quadratization. Therefore, a total of approximately log^{2}(N)/4 binary variables are required to represent the problem Hamiltonian and, consequently, a similar number of qubits must be available within hardware. As a point of reference, applying this method to the current factoring record for RSA768 would require approximately 147456 qubits.
Experiments
We tested both the direct and modified multiplication table methods using quantum annealing hardware from DWave Systems. The DWave System hardware consists of a programmable platform of integrated superconducting flux qubits designed to operate within the quantum annealing model. In particular, the hardware system accepts as input a problem Hamiltonian H_{P} presented in Ising form and the parameters h and J. The hardware also enables interpolation from the starting Hamiltonian H_{B} and the final Hamiltonian at a rate controlled by the annealing duration T. Measurements of the resulting quantum state are performed in σ_{z} basis for each qubits.
While the latest 2000Q system contains up to 2048 qubits arranged in a connectivity pattern expressed as a 16by16 Chimera graph, this sparse connectivity pattern requires additional resources to ensure the required interactions between the logical variables defining the problem Hamiltonian. This is accomplished by embedding the problem Hamiltonian into the hardware graph while maintaining the logical form of the cost function^{27,28,29}. From the coupling matrix J, we define a graph G that represents the variables as vertices and nonzero coupling as edges. A minor embedding of G(V, E) into a hardware graph G′(V′, E′) is defined by a mapping \(\varphi :G\mapsto G^{\prime} \) such that each vertex v ∈ G is mapped to a connected subtree T_{v} of G′ and if (u, v) ∈ E then there exist i_{u}, i_{v} ∈ G′ such that i_{u} ∈ T_{u}, i_{v} ∈ T_{v} and (i_{u}, i_{v}) ∈ E′. If such a mapping ϕ exists between G and G′, we say G is a minor of G′ and we use G ≤ _{m}G′ to denote such relationship.
The logical parameters for local fields and couplers should also be considered. In the parameter setting problem^{30}, we assign each node and each edge in the minor embedding graph such that: (1) for each node in the tree T_{i} expanded by the same vertex i, its value \({h^{\prime} }_{{i}_{k}}\) satisfies \(\sum \,{h^{\prime} }_{{i}_{k}}={h}_{i}\), (2) for each edge in the tree T_{i} expanded by the same vertex i, the value \({J}_{{i}_{k},{i}_{k^{\prime} }}\) needs to be large enough to make sure all physical qubits that correspond to the same logical qubit to be of the same value and (3) for each edge in the minor embedding graph which is in the original graph, we could use the same J_{ij} value.
Our programmed implementation of these methods were written in C/C++ using the XACC programming framework^{31}. XACC enables integration of the DWave solver application programming interface (SAPI) using a directivebased programming model. Preprocessing of the input N generated the Ising parameters for a logical Hamiltonian that was then embedded into the hardware graph structure. For minor embedding, we use the sapi_findembedding method included in the DWave 2000Q control software, SAPI version 3.0. This embedding methods is based on a randomized algorithm from Cai, Macready and Roy^{32}, while access to these methods were managed using the XACC dwsapiembedding plugin^{31}. The corresponding biases and couplings for the embedded problem were generated using the logical Ising parameters. The output of the embedding was a program implementation of the physical Ising model that was submitted for execution on the DWave processor. Additional parameters for the execution included the number of samples S and the annealing duration T. The default annealing schedule for the 2000Q was used for all executions. The output from each of the S executions was a measured binary string designating ±1 values for each spin variable. The number of samples was S = 10,000. Each returned string was then classified according to the corresponding energy for the physical Ising model and subsequently decoded into the factors p and q. A histogram of all solutions returned for a specific annealing time was recorded.
Figure 1(a,b) shows the frequency of each decoded solutions to the factorization problem for N = 15 and 21 using the direct method. These observed solutions are decoded using the inverse of the embedding with majority vote used to resolve any ambiguity in results. The plot presents the decoded results in order of lowest energy to highest energy (left to right). For these two examples, the lowest energy solution corresponds to the correct factors. In addition, several other computed solutions decoded into the correct factors as the associated errors were resolved by the decoding method. For example, several solutions are labeled as (3,7) because the observed bit strings corresponded to highenergy states before decoding. Only the first (leftmost) corresponds to the lowest energy state. The others were higher energy solutions, thus can’t be counted as the correct solution.
Using the modified multiplication table method for factoring 143, we embed the problem Hamiltonian to DWave machine using the following method. Suppose n qubits are needed in the Hamiltonian, we divide n into \(\lceil \frac{n}{4}\rceil \) groups. For each group, we use 4 copies of the nodes with each \({h^{\prime} }_{{i}_{k}}=\frac{1}{4}{h}_{i}\). We assign each edge in the tree T_{i} the negative number with largest absolute value to make it a penalty term. This method guarantees the nodes correspond to the same original qubit have the same value. We assign each edge corresponding to the original edge in the problem graph the same J_{ij} value. The embedded graph to DWave machine is in Fig. 2.
The results graph are shown in Fig. 3. The final state of the part of the system which represents the problem solution will be 1 −1 −1 1〉 or −1 1 1−1〉 with relatively high probability, which corresponds to solutions p = (1p_{2}p_{1}1) = (1101)_{2} = 13, q = (1q_{2}q_{1}1) = (1011)_{2} = 11 or p = 11, q = 13.
For factoring larger numbers like 376289 using DWave, we embed the Hamiltonians into the Chimera hardware using the predefined function find_embedding and embed_problem available in the vendor’s software developer packages, because the problem graph can’t be embedded directly like the case 143 shown above which has 12 qubits, due to the size limitation of the current Chimera hardware. For now, the largest number experimented for finding an embedding in DWave 2000Q is 249919 which equals to 509 × 491. It uses 74 qubits in the final Ising Hamiltonian, and embeds to 1803 physical qubits in Chimera graph.
Conclusions
We have presented two general methods for factoring integers using quantum annealing for optimizing a cost function that is reduced to an Ising Hamiltonian. Both methods requires \({\mathscr{O}}({\mathrm{log}}^{2}(N))\) qubits in total, where N is the number to be factored. The novelty of our demonstration of quantum annealing for prime factorization is based on the reduction in quantum resources required to execute factoring and the experimental verification of the algorithmic accuracy using currently available hardware. As a proofofconcept, we have demonstrated these methods by factoring integers using the DWave 2000Q quantum annealing hardware, but these methods may be used on any other quantum annealing system with a similar number of qubits, qubit degree of connectivity, and hardware parameter precision. Assuming that quantum annealing hardware systems will continue to grow both in the number of qubits and bits of precision capabilities, our methods offer a promising path toward factor much larger numbers in the future. It is also good to combine our method with other ad hoc methods to achieve significantly better performances for specific numbers.
Finally, we note that while our demonstrations of factoring have made use of currently available quantum annealers, there is an outstanding question regarding the asymptotic complexity for this approach. It is well known that algorithmic complexity within the AQC model depends on the minimum spectral gap between the ground and firstexcited states of the underlying timedependent Hamiltonian. Attempts to classify the complexity of the spectral gap with respect to system size have not yet succeed and, indeed, Cubitt, PerezGarcia, and Wolf have proven that the problem of claiming a Hamiltonian has a gap is undecidable in general^{33}. Nonetheless, there is hope that our resourceefficient algorithms may find use in preprocessing potential factors for noisy factorization algorithms, e.g., as suggested by Patterson et al. within the context of RSA^{34}.
Data Availability
The data that support the plots within this paper and other findings of this study are available from the corresponding author upon reasonable request.
Additional information
Publisher’s note: Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
References
 1.
Lenstra, A. K., Lenstra, H. W. Jr., Manasse, M. S. & Pollard, J. M. The number field sieve. In Proceedings of the twentysecond annual ACM symposium on Theory of computing, 564–572 (ACM, 1990).
 2.
Wagstaff, S. S. The Joy of Factoring, vol. 68 (American Mathematical Soc., 2013).
 3.
Shor, P. W. Polynomialtime algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM review 41, 303–332 (1999).
 4.
Vandersypen, L. M. et al. Experimental realization of shor’s quantum factoring algorithm using nuclear magnetic resonance. Nature 414, 883–887 (2001).
 5.
Lanyon, B. et al. Experimental demonstration of a compiled version of shor’s algorithm with quantum entanglement. Phys. Rev. Lett. 99, 250505 (2007).
 6.
Lu, C.Y., Browne, D. E., Yang, T. & Pan, J.W. Demonstration of a compiled version of shor’s quantum factoring algorithm using photonic qubits. Phys. Rev. Lett. 99, 250504 (2007).
 7.
Politi, A., Matthews, J. C. & O’brien, J. L. Shor’s quantum factoring algorithm on a photonic chip. Science 325, 1221–1221 (2009).
 8.
MartíınLópez, E. et al. Experimental realization of shor’s quantum factoring algorithm using qubit recycling. Nat. Photonics 6, 773–776 (2012).
 9.
Lucero, E. et al. Computing prime factors with a josephson phase qubit quantum processor. Nat. Phys. 8, 719–723 (2012).
 10.
Geller, M. R. & Zhou, Z. Factoring 51 and 85 with 8 qubits. Sci. reports 3 (2013).
 11.
Grosshans, F., Lawson, T., Morain, F. & Smith, B. Factoring safe semiprimes with a single quantum query. arXiv preprint arXiv:1511.04385 (2015).
 12.
Farhi, E. et al. A quantum adiabatic evolution algorithm applied to random instances of an NPcomplete problem. Science 292, 472–475 (2001).
 13.
Albash, T. & Lidar, D. A. Adiabatic quantum computation. Rev. Mod. Phys. 90, 015002, https://doi.org/10.1103/RevModPhys.90.015002 (2018).
 14.
Peng, X. et al. Quantum adiabatic algorithm for factorization and its experimental implementation. Phys. Rev. Lett. 101, 220405 (2008).
 15.
Xu, N. et al. Quantum factorization of 143 on a dipolarcoupling nuclear magnetic resonance system. Phys. review letters 108, 130501 (2012).
 16.
Schaller, G. & Schützhold, R. The role of symmetries in adiabatic quantum algorithms. arXiv preprint arXiv : 0708.1882 (2007).
 17.
Dridi, R. & Alghassi, H. Prime factorization using quantum annealing and computational algebraic geometry. Sci. Reports 7 (2017).
 18.
Kadowaki, T. & Nishimori, H. Quantum annealing in the transverse ising model. Phys. Rev. E 58, 5355 (1998).
 19.
Das, A. & Chakrabarti, B. K. Colloquium: Quantum annealing and analog quantum computation. Rev. Mod. Phys. 80, 1061 (2008).
 20.
Maezawa, M., Imafuku, K., Hidaka, M., Koike, H. & Kawabata, S. Design of quantum annealing machine for prime factoring. In Superconductive Electronics Conference (ISEC), 2017 16th International, 1–3 (IEEE, 2017).
 21.
Ray, P., Chakrabarti, B. K. & Chakrabarti, A. Sherringtonkirkpatrick model in a transverse field: Absence of replica symmetry breaking due to quantum fluctuations. Phys. Rev. B 39, 11828 (1989).
 22.
Messiah, A. Quantum Mechanics : Volume 2 (NorthHolland Publishing Company, 1962).
 23.
Biamonte, J. D. Nonperturbative kbody to twobody commuting conversion hamiltonians and embedding problem instances into ising spins. Phys. Rev. A 77, 052331 (2008).
 24.
Boros, E. & Hammer, P. L. Pseudoboolean optimization. Discret. applied mathematics 123, 155–225 (2002).
 25.
Dattani, N. S. & Bryans, N. Quantum factorization of 56153 with only 4 qubits. arXiv preprint arXiv:1411.6758 (2014).
 26.
Pal, S., Moitra, S., Anjusha, V., Kumar, A. & Mahesh, T. Hybrid scheme for factorization: Factoring 551 using a 3qubit nmr quantum adiabatic processor. arXiv preprint arXiv:1611.00998 (2016).
 27.
Choi, V. Minorembedding in adiabatic quantum computation: I. the parameter setting problem. Quantum Inf. Process. 7, 193–209 (2008).
 28.
Klymko, C., Sullivan, B. D. & Humble, T. S. Adiabatic quantum programming: minor embedding with hard faults. Quantum Inf. Process. 13, 709–729, https://doi.org/10.1007/s1112801306839 (2014).
 29.
Humble, T. S. et al. An integrated programming and development environment for adiabatic quantum optimization. Comput. Sci. Discov. 7, 015006 (2014).
 30.
Choi, V. Minorembedding in adiabatic quantum computation: Ii. minoruniversal graph design. Quantum Inf. Process. 10, 343–353 (2011).
 31.
McCaskey, A. J. et al. Extremescale programming model for quantum acceleration within high performance computing. arXiv preprint arXiv:1710.01794 (2017).
 32.
Cai, J., Macready, W. G. & Roy, A. A practical heuristic for finding graph minors. arXiv preprint arXiv:1406.2741 (2014).
 33.
Cubitt, T. S., PerezGarcia, D. & Wolf, M. M. Undecidability of the spectral gap. Nature 528, 207 (2015).
 34.
Paterson, K. G., Polychroniadou, A. & Sibborn, D. L. A codingtheoretic approach to recovering noisy rsa keys. In Wang, X. & Sako, K. (eds) Advances in Cryptology – ASIACRYPT 2012, 386–403 (Springer Berlin Heidelberg, Berlin, Heidelberg, 2012).
Acknowledgements
Access to the DWave 2000Q was provided by the Quantum Computing Institute at Oak Ridge National Laboratory and Google Quantum Artificial Intelligence Lab, USRAPurdue. This manuscript has been authored by UTBattelle, LLC under Contract No. DEAC0500OR22725 with the U.S. Department of Energy. The Department of Energy will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (http://energy.gov/downloads/doepublicaccessplan).
Author information
Affiliations
Department of Computer Science, Purdue University, West Lafayette, IN, 47906, USA
 Shuxian Jiang
 & Sabre Kais
Quantum Computing Institute, Oak Ridge National Laboratory, Oak Ridge, TN, 37831, USA
 Keith A. Britt
 , Alexander J. McCaskey
 & Travis S. Humble
Department of Chemistry, Physics and Birck Nanotechnology Center, Purdue University, West Lafayette, IN, 47906, USA
 Sabre Kais
Authors
Search for Shuxian Jiang in:
Search for Keith A. Britt in:
Search for Alexander J. McCaskey in:
Search for Travis S. Humble in:
Search for Sabre Kais in:
Contributions
S.K. and T.S.H. designed the research, S.J. performed the calculations, S.J., A.M. and K.A.B. run simulations on the DWave machine. All authors analyzed the data and wrote the paper.
Competing Interests
The authors declare no competing interests.
Corresponding authors
Correspondence to Travis S. Humble or Sabre Kais.
Electronic supplementary material
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Further reading

Quest towards “factoring larger integers with commercial DWave quantum annealing machines”
Science China Physics, Mechanics & Astronomy (2019)
Comments
By submitting a comment you agree to abide by our Terms and Community Guidelines. If you find something abusive or that does not comply with our terms or guidelines please flag it as inappropriate.