Noisy Shor's Algorithm Analysis

• Noisy Shor's algorithm is a quantum order-finding procedure that incorporates imperfections like decoherence, noisy gates, and state distortions into its design.
• The approach leverages a coupled quantum-classical pipeline where classical decoding—via continued fractions and verified denominator mass—recovers the true order despite distorted quantum outputs.
• Research highlights how various noise models, from random phase errors to circuit-level Pauli noise, determine algorithm performance and inspire NISQ-era techniques such as modular phase estimation and qubit recycling.

Searching arXiv for recent and foundational papers on noisy Shor's algorithm and noisy order finding. arxiv_search(query="Shor algorithm noise noisy order finding factoring", max_results=10, sort_by="submittedDate")

Noisy Shor’s algorithm denotes the study and implementation of Shor’s factoring procedure when the quantum order-finding subroutine is executed with nonideal state preparation, imperfect gates, decoherence, restricted qubit budgets, or distorted measurement distributions. In the ideal setting, order finding for coprime integers $(a,N)$ seeks the multiplicative order $r=\operatorname{ord}_N(a)$, where $a^r \equiv 1 \pmod N$, and the precision-register distribution is comb-like with peaks near $y \approx Q\,s/r$ for $Q=2^t$. In noisy realizations, those peaks can broaden, shift, merge, flatten, or disappear, so the central question is often not whether the histogram “looks periodic,” but whether the standard continued-fraction and modular-verification pipeline still returns the true order (Yang et al., 15 May 2026). The contemporary literature spans asymptotic failure theorems for noisy QFTs, circuit-level noise sensitivity studies, compiled and resource-reduced demonstrations, and classical post-processing enhancements designed to extract more information from fragile quantum executions (Cai, 2023).

1. Order finding as the locus of noise sensitivity

Shor’s algorithm reduces factoring to order finding. For a chosen $a$ with $\gcd(a,N)=1$, the quantum subroutine estimates the period of $f(x)=a^x \bmod N$, where $r$ is the smallest positive integer satisfying $a^r \equiv 1 \pmod N$. Standard post-processing then uses continued fractions and, when the usual parity condition is met, evaluates

$r=\operatorname{ord}_N(a)$0

to recover nontrivial factors (Liao et al., 11 Dec 2025).

In the phase-estimation formulation studied explicitly for noisy order finding, the precision register has $r=\operatorname{ord}_N(a)$1 qubits, $r=\operatorname{ord}_N(a)$2, and the measured outcome is $r=\operatorname{ord}_N(a)$3 with distribution $r=\operatorname{ord}_N(a)$4. The ideal distribution is comb-like, with peaks near $r=\operatorname{ord}_N(a)$5, but hardware noise can distort the distribution so that correct order recovery depends on downstream classical decoding rather than on visual regularity alone (Yang et al., 15 May 2026).

The standard classical decoder examined in recent work has four stages: continued-fraction decoding of $r=\operatorname{ord}_N(a)$6 to a candidate denominator $r=\operatorname{ord}_N(a)$7; modular verification of candidates satisfying $r=\operatorname{ord}_N(a)$8; aggregation of the probability mass

$r=\operatorname{ord}_N(a)$9

and selection of the inferred order

$a^r \equiv 1 \pmod N$0

A noisy run is defined as recoverable if and only if $a^r \equiv 1 \pmod N$1 (Yang et al., 15 May 2026).

This formulation shifts attention from idealized Fourier peaks to the organization of verified denominator mass. A plausible implication is that noisy Shor’s algorithm is best understood as a coupled quantum-classical pipeline: the quantum circuit need not produce a pristine periodogram if the classical decoder still concentrates verified mass on the true order.

2. Noise models and asymptotic robustness limits

One major line of work studies random relative noise in the controlled rotation gates of the QFT. In the factoring setting, controlled-$a^r \equiv 1 \pmod N$2 gates with

$a^r \equiv 1 \pmod N$3

are perturbed to

$a^r \equiv 1 \pmod N$4

Under this model, if

$a^r \equiv 1 \pmod N$5

then Shor’s algorithm fails to factor $a^r \equiv 1 \pmod N$6-bit integers $a^r \equiv 1 \pmod N$7 for a set of primes $a^r \equiv 1 \pmod N$8 of positive density, and an appendix establishes the same type of failure with probability $a^r \equiv 1 \pmod N$9 over random prime pairs $y \approx Q\,s/r$0. The useful outputs become exponentially unlikely because many independent random phase perturbations destroy the coherent geometric sums that produce the Fourier peaks (Cai, 2023).

An analogous theorem has been proved for Shor’s discrete-log algorithm and related QFT-based variants. Under the same noisy-QFT model, if

$y \approx Q\,s/r$1

then the algorithm succeeds only with exponentially small probability for a positive-density set of primes $y \approx Q\,s/r$2, and fails with probability $y \approx Q\,s/r$3 for uniformly random $y \approx Q\,s/r$4-bit primes $y \approx Q\,s/r$5. The paper’s conclusion is that scalable Shor-style discrete logarithm requires arbitrarily precise controlled rotations; fixed-quality approximate rotations are not asymptotically sufficient (Cai et al., 2024).

A different perspective injects circuit-level Pauli noise directly into a Beauregard implementation of Shor’s circuit after each gate layer. The channels are

$y \approx Q\,s/r$6

Under this model, Shor’s circuit demonstrates superior fault tolerance under $y \approx Q\,s/r$7 noise compared to $y \approx Q\,s/r$8 and $y \approx Q\,s/r$9 noise. For bit lengths from 4 to 9, the number of $Q=2^t$0-noise fault-tolerant positions grows with the same quartic polynomial order as the number of possible error positions, whereas $Q=2^t$1- and $Q=2^t$2-noise tolerance depends strongly on the composite number $Q=2^t$3 and the parameter $Q=2^t$4. The same work reports an extrapolated upper bound on the tolerable physical error rate for 2048-bit factoring under biased noise of $Q=2^t$5 (Yang et al., 30 Aug 2025).

A coherence-theoretic treatment models noisy Shor via a depolarizing channel

$Q=2^t$6

and proves the lower bound

$Q=2^t$7

for a specific noisy construction. In this framework, algorithmic success is controlled by the residual coherence of the final state and the decoherence induced by the combined evolution (Ye et al., 16 Aug 2025).

3. Recoverability of distorted order-finding distributions

A hardware-centered study of noisy order finding analyzes 680 measured distributions from IBM quantum systems and asks when standard classical decoding still recovers the true order. The dataset contains 310 recoverable runs (45.6%) and 370 non-recoverable runs (54.4%), with instances $Q=2^t$8, bases $Q=2^t$9, precision-register sizes $a$0 and $a$1, approximate-QFT degree 0,1,2 depending on the circuit, and 4,000 shots per run (Yang et al., 15 May 2026).

The analysis uses four distribution-level features. Two are global histogram descriptors: $a$2 where $a$3 measures residual comb-like spacing and $a$4 measures flatness. Two are post-processing-aware quantities built from verified denominator masses: $a$5 Here $a$6 and $a$7 are the largest and second-largest verified masses, respectively (Yang et al., 15 May 2026).

Single-feature AUROC values are 0.981 for $a$8, 0.946 for $a$9, 0.946 for $\gcd(a,N)=1$0, and 0.937 for $\gcd(a,N)=1$1. A random forest trained on all four features with 5-fold stratified cross-validation achieves held-out AUROC $\gcd(a,N)=1$2. Permutation importance shows that $\gcd(a,N)=1$3 is by far the most important feature, and an interpretable decision tree uses $\gcd(a,N)=1$4 as the root split, with $\gcd(a,N)=1$5 corresponding mostly to a non-recoverable branch and $\gcd(a,N)=1$6 to a pure recoverable leaf (Yang et al., 15 May 2026).

These results formalize a point often obscured in discussions of noisy Shor experiments: some highly distorted distributions remain recoverable when one verified denominator dominates the post-processing mass, while some visibly structured distributions fail because classical post-processing favors an incorrect verified denominator. The decisive object is therefore not merely the raw histogram, but the verified-denominator competition induced by continued fractions and modular checks.

4. Post-processing enhancements and NISQ-oriented reformulations

One strategy for noisy Shor execution is to leave the quantum period-finding stage unchanged and strengthen only the classical interpretation of the measured order. A generalized period decomposition method replaces the standard use of only the half-order test by testing arbitrary divisors of the measured period. If $\gcd(a,N)=1$7, the method evaluates candidates such as

$\gcd(a,N)=1$8

and for perfect-square bases $\gcd(a,N)=1$9 it also considers

$f(x)=a^x \bmod N$0

The paper emphasizes that this is a classical post-processing enhancement rather than a modification of the quantum circuit (Liao et al., 11 Dec 2025).

Classical simulations for this method cover over one million test cases on RSA-like semiprimes from 2 to 8 digits. The reported success rates are 99.9992% for 7-digit numbers and 99.9998% for 8-digit numbers, with only five failures in one million trials for the 7- and 8-digit cases combined. Bounded divisor search remains effective: checking only small prime divisors of $f(x)=a^x \bmod N$1 gives over 99.5% success with primes below 1000, and using primes up to four digits matches the full-decomposition performance at about 99.9998%. The stated motivation is explicitly NISQ-relevant: repeated quantum runs are expensive because of short coherence times, gate errors, and limited circuit depth, so extracting more value from each measured period can reduce complete retries (Liao et al., 11 Dec 2025).

A second line of work restructures the phase-estimation layer itself. A modular, windowed formulation of Shor’s algorithm divides the counting register into blocks $f(x)=a^x \bmod N$2 with overlaps $f(x)=a^x \bmod N$3, applies QPE to each block independently, and classically stitches the partial phase windows together. The approach reduces the counting register from about $f(x)=a^x \bmod N$4 qubits to a small fixed block size $f(x)=a^x \bmod N$5, which in the examples is three or four qubits per block, while leaving the work-register requirement unchanged. Numerical demonstrations include $f(x)=a^x \bmod N$6 and $f(x)=a^x \bmod N$7, and the overlap mechanism provides redundancy for carry-aware reconstruction (Shukla et al., 5 Sep 2025).

A distributed reformulation pushes the same idea across multiple processors. In the distributed order-finding algorithm, the maximum number of qubits required by a single node is reduced by

$f(x)=a^x \bmod N$8

when factoring an $f(x)=a^x \bmod N$9-bit integer on $r$0 nodes, and the communication complexity is $r$1. The phase-estimation stage itself requires no quantum communication; quantum communication enters only when the work register must be teleported between nodes so that each local estimate refers to the same eigenphase (Xiao et al., 2023).

Taken together, these methods do not remove the core arithmetic burden of Shor’s algorithm. They do, however, change the failure surface: one line reduces the number of fragile quantum reruns by richer classical exploitation of a measured order, while the other line shortens or distributes the phase-estimation circuits that must survive noise in the first place.

5. Compiled demonstrations and platform-specific executions

Small-scale experiments have repeatedly shown that Shor’s algorithm can be made to fit noisy hardware by compilation, qubit recycling, or problem-specific encodings. A foundational critique demonstrates that for any product $r$2 of two distinct odd primes, one can choose a base $r$3 such that

$r$4

so the order is $r$5. In that compiled setting, modular exponentiation reduces to a controlled-NOT, the Fourier transform reduces to a Hadamard, and the entire algorithm requires only two coherent qubits and constant time. The paper’s central warning is that the correct measure of difficulty is not the size of the number factored, but the length of the period found (Smolin et al., 2013).

A photonic implementation of qubit recycling factors $r$6 in a compiled setting where the $r$7-qubit control register is replaced by a single qubit recycled $r$8 times, reducing the total qubit count to one third of that required in the standard protocol. Using a qutrit encoding of the work register, the experiment reports output probabilities for $r$9 with fidelity $a^r \equiv 1 \pmod N$0 relative to the ideal distribution, first-bit fidelity $a^r \equiv 1 \pmod N$1, and average fringe fidelity $a^r \equiv 1 \pmod N$2. The output is explicitly described as distinguishable from noise (Martin-Lopez et al., 2011).

A superconducting implementation on IBM processors demonstrates compiled order finding for $a^r \equiv 1 \pmod N$3 using only 5 qubits, with 3 control qubits and a 2-qubit compressed work register for the orbit $a^r \equiv 1 \pmod N$4. The paper replaces standard Toffoli gates by relative-phase Toffoli gates of Margolus type; after transpilation, the circuit uses 25 CX gates and has depth 35. Reported Kolmogorov/trace distances from the ideal output distribution are 0.1694 on ibmq_toronto and 0.1784 on ibmq_casablanca, versus 0.4347 for a random uniform distribution, and the authors verify entanglement between control and work registers even though a stronger genuine multipartite entanglement witness is not violated (Skosana et al., 2021).

Earlier semiconductor work proposed a compiled realization of $a^r \equiv 1 \pmod N$5 factoring in GaAs quantum-wire networks driven by surface acoustic waves. Numerical solution of the time-dependent multi-particle Schrödinger equation gives fidelities $a^r \equiv 1 \pmod N$6 for $a^r \equiv 1 \pmod N$7 and $a^r \equiv 1 \pmod N$8 for $a^r \equiv 1 \pmod N$9, with the protocol described as almost unsensitive to small destabilizing effects during quantum computation (Buscemi, 2010).

The most recent cloud-oriented assessment argues that there remains a substantial gap between the capabilities of current quantum hardware and the requirements for factoring cryptographically relevant integers. Theoretical resource estimates suggest that 2048-bit RSA keys could be broken using Shor’s algorithm with fewer than a million noisy qubits, but current cloud-based experiments find that circuit constructions still need to be highly specific for each modulus, and that machine fidelities are unstable, with high and fluctuating error rates (Bagourd et al., 17 Dec 2025).

6. Recurring misconceptions and the present state of the subject

One persistent misconception is that a successful compiled demonstration on a small device establishes practical progress toward large-integer factoring. The compilation critique shows why this inference is unreliable: a circuit can nominally “factor” very large semiprimes with two coherent qubits if the order has been engineered to be $r=\operatorname{ord}_N(a)$00. This suggests that scalable difficulty in Shor’s algorithm resides in recovering long, unknown periods rather than in printing a large modulus in the problem statement (Smolin et al., 2013).

A second misconception is that noisy Shor failure is captured by a single generic statement such as “noise washes out the peaks.” The literature is more specific. Random relative errors on small QFT rotations can make useful outputs exponentially unlikely at asymptotic scale (Cai, 2023), circuit-level Pauli noise exhibits a pronounced asymmetry between $r=\operatorname{ord}_N(a)$01 noise and $r=\operatorname{ord}_N(a)$02 noise (Yang et al., 30 Aug 2025), and recoverability on present-day IBM hardware is governed most strongly by dominant verified mass fraction rather than by histogram appearance alone (Yang et al., 15 May 2026).

A third misconception is that robustness necessarily requires altering the quantum circuit. Several recent approaches instead preserve the order-finding core and strengthen the classical layer. Generalized period decomposition broadens the set of useful measured orders without compromising polynomial-time complexity, and its reported advantage is precisely that it minimizes unnecessary repetitions on NISQ devices (Liao et al., 11 Dec 2025). A plausible implication is that, in the near term, the most effective “noise mitigation” for Shor may often be hybrid: shallower or distributed quantum phase estimation combined with more discriminating classical denominator selection.

The present state of noisy Shor research is therefore bifurcated. On one side, asymptotic theory gives strong evidence that uncontrolled noise in the QFT can destroy scalability. On the other, practical studies show that limited, structured, or recoverable noise does not imply immediate failure on small instances, especially when compilation, qubit recycling, overlap-based reconstruction, or richer classical post-processing are available. The resulting picture is neither that Shor’s algorithm is robust on current hardware nor that every noisy implementation is meaningless. It is that the viability of noisy Shor execution depends on which part of the pipeline is noisy, how the noise scales, how problem-specific the compilation is, and whether the classical decoder can still concentrate verified probability mass on the true order.