Shor: Quantum Algorithms & Error Correction

Updated 5 July 2026

Shor is a versatile term denoting quantum algorithms, nine-qubit error-correcting codes, and syndrome extraction methods used in fault-tolerant quantum computation.
It reduces integer factoring to quantum order finding via phase estimation and the Quantum Fourier Transform, with detailed resource and noise sensitivity analyses.
Experimental and simulation studies demonstrate high-fidelity implementations in trapped-ion and semiconductor systems, highlighting practical challenges in scaling.

Shor most commonly denotes a family of constructions associated with Peter Shor: the quantum factoring algorithm introduced in 1994, the nine-qubit Shor quantum error-correcting code and related Shor-style syndrome-extraction methods, and several later mathematical and quantum-information notions that retain the name. In quantum computing, the dominant usage is Shor’s reduction of factoring to quantum order finding; in fault tolerance, “Shor” also denotes cat-state ancillas and stabilizer-measurement schemes that are explicitly distinct from the factoring algorithm (Monz et al., 2015, Huang et al., 2023).

1. Principal meanings of “Shor”

The term is not univocal. In current research usage, it spans algorithmic, coding-theoretic, and combinatorial objects. The most common ambiguity is between Shor’s algorithm and Shor-style error correction; the latter concerns syndrome extraction with ancillas and does not refer to factoring (Huang et al., 2023). Other established uses include the Ramanujan–Shor polynomials and the Shor–Laflamme distribution (Chen et al., 2018, Miller et al., 2022).

Usage	Domain	Core content
Shor’s algorithm	Quantum algorithms	Integer factoring via quantum order finding
Shor code	Quantum error correction	Nine-qubit code and its generalizations
Shor-style syndrome extraction	Fault tolerance	Per-stabilizer ancilla-based measurement
Ramanujan–Shor polynomials	Combinatorics	Rooted trees, improper edges, Cayley refinements
Shor–Laflamme distributions	Quantum information theory	Local-unitary invariants for $k$ -body correlations

This breadth matters because different subfields use “Shor” almost as a technical shorthand. A statement about “Shor correction,” “Shor states,” or “Shor polynomials” may have no connection to factoring, even though all derive from the same name.

2. Shor’s factoring algorithm

Shor’s algorithm factors a composite integer $N$ by reducing the problem to quantum order finding. For a random integer $a$ with $1 $\gcd(a,N)=1$

The quantum subroutine prepares a uniform superposition over exponents $N$ 2, computes $N$ 3 in a second register, and then applies quantum phase estimation using the Quantum Fourier Transform. In the resource-efficient Beauregard architecture, factoring an $N$ 4-bit integer uses $N$ 5 logical qubits. The modular-exponentiation core is built from a QFT-based adder $N$ 6, its inverse $N$ 7, modular addition modulo $N$ 8, and controlled modular multiplication $N$ 9; asymptotically, modular exponentiation has $a$ 0 gate complexity (Yang et al., 30 Aug 2025).

For the specific implementation analyzed in recent noise work, the exact gate-count polynomials of modular exponentiation are given as:

controlled-phase gates $a$ 1: $a$ 2
CNOT: $a$ 3
Hadamards $a$ 4: $a$ 5
single-qubit phase $a$ 6: $a$ 7
$a$ 8 gates: $a$ 9
CSWAP: $1Yang et al., 30 Aug 2025)

The classical post-processing is governed by continued fractions. A detailed treatment proves that if

then $1Barzen et al., 2022).

3. Realizations, compilations, and large-instance workflows

Experimental and software work on Shor’s algorithm spans fully scalable demonstrations, compiled small-$1Monz et al., 2015). In that implementation, the measured probabilities of the order-assigning outputs for $1 $\gcd(a,N)=1$

A separate semiconductor-nanostructure proposal implemented compiled instances for $r$ 0 using surface-acoustic-wave-assisted electron transport. It reported fidelity $r$ 1 for the $r$ 2 case and $r$ 3 for the $r$ 4 case, with the expected $r$ 5 success probability in both instances and near-maximal entanglement measures $r$ 6 and $r$ 7 (Buscemi, 2010).

At the software layer, hybrid compilation has become a distinct topic. A PennyLane/Catalyst implementation compiled Shor’s algorithm once per bit width of $r$ 8, even when $r$ 9-specific runtime optimizations were applied. Benchmarks up to $a$ 0-bit $a$ 1 found the pure compilation time to be constant and under $a$ 2 seconds on a laptop computer, while the $a$ 3-bit execution-time circuit was on the order of $a$ 4 million 1- and 2-qubit gates (Ittah et al., 16 Apr 2025). The same work reported $a$ 5 total gate-count reduction relative to an unoptimized version, averaged over $a$ 6 random choices of $a$ 7 for $a$ 8 up to $a$ 9 bits (Ittah et al., 16 Apr 2025).

A more controversial direction is highly constrained large- $N$ 0 simulation. One implementation demonstrated factorization of a $N$ 1-bit integer only under the restriction $N$ 2, with $N$ 3 and the order $N$ 4 a power of two. In that setting, with $N$ 5 shots on Qiskit Aer, the reported circuit generation time for the $N$ 6-bit case was $N$ 7 s and the execution time was $N$ 8 s; for $N$ 9 bits the execution time was $a^r \equiv 1 \pmod N$ 0 s (Chen, 7 Apr 2025). This does not constitute a general-purpose RSA-scale factoring result; it is a specialized instance family.

4. Noise sensitivity and resource dynamics of Shor’s algorithm

A recent circuit-level study of Shor’s algorithm found a marked asymmetry between Pauli error types. Under a per-gate and per-idle Pauli noise model, the modular-exponentiation circuit is intrinsically far more tolerant to $a^r \equiv 1 \pmod N$ 1 noise than to $a^r \equiv 1 \pmod N$ 2 or $a^r \equiv 1 \pmod N$ 3 noise. The explanation given is structural: the arithmetic is heavily built from controlled-phase gates and QFT blocks that are diagonal in the computational basis, so many single $a^r \equiv 1 \pmod N$ 4 faults commute, cancel, or contribute only relative or global phases without changing the measured arithmetic output (Yang et al., 30 Aug 2025).

The scaling law is explicit. The total number of potential single-error positions in the modular-exponentiation circuit is

$a^r \equiv 1 \pmod N$ 5

while the number of $a^r \equiv 1 \pmod N$ 6-fault-tolerant positions is

$a^r \equiv 1 \pmod N$ 7

Thus, $a^r \equiv 1 \pmod N$ 8-tolerant positions grow with the same quartic order as the total number of possible single-error positions (Yang et al., 30 Aug 2025).

For $a^r \equiv 1 \pmod N$ 9- to $r$ 0-bit instances, the observed single-fault success rate under pure $r$ 1 noise ranged from $r$ 2 at $r$ 3 to $r$ 4 at $r$ 5. By contrast, $r$ 6- and $r$ 7-fault tolerance was much smaller and instance dependent: at $r$ 8 bits with $r$ 9, the tolerant-position counts were $N$ 00 for $N$ 01 noise and $N$ 02 for $N$ 03 noise, corresponding to single-fault success rates $N$ 04 and $N$ 05; at $N$ 06 bits with $N$ 07, the corresponding counts were $N$ 08 and $N$ 09, with success rates $N$ 10 and $N$ 11 (Yang et al., 30 Aug 2025).

The same study extrapolated to cryptographic scale under biased noise $N$ 12. For a $N$ 13-bit instance and a modular-exponentiation success target $N$ 14, the predicted minimum per-operation physical error rate was

$N$ 15

The authors explicitly noted the assumptions behind this estimate: single-error injection only, no SPAM noise, no correlated or non-Markovian multi-qubit errors, no crosstalk or leakage, and no full error correction (Yang et al., 30 Aug 2025).

Resource-dynamics work complements the noise study by analyzing how coherence and entanglement change across the algorithm. For the evolved states in Shor’s algorithm, the overall effect was found to deplete coherence and produce entanglement. In the worked example $N$ 16, $N$ 17, the geometric coherence changed from $N$ 18 after the initial superposition to $N$ 19 after the inverse QFT, while geometric entanglement rose from $N$ 20 initially to approximately $N$ 21 by the end of the quantum part (Ye et al., 8 Apr 2026). This suggests that the algorithm’s speedup is accompanied by a structured conversion of superposition resource into multipartite correlation.

5. Shor code and its generalizations

In quantum error correction, the standard Shor code is the $N$ 22 code formed by concatenating a $N$ 23-qubit bit-flip repetition code with a $N$ 24-qubit phase-flip repetition code. One experimental description gives the logical basis as

$N$ 25

with six $N$ 26-pair stabilizers and two weight- $N$ 27 $N$ 28-type stabilizers (Zhang et al., 2022).

The family extends naturally to $N$ 29. A trapped-ion experiment prepared $N$ 30-qubit GHZ states and synthetically constructed logical states of the $N$ 31 Shor code up to $N$ 32. In that system, the optimal size was $N$ 33, with synthetic logical fidelities $N$ 34 for $N$ 35 and $N$ 36 for $N$ 37. The same work directly realized the $N$ 38 code on nine qubits in a thirteen-ion chain, obtaining $N$ 39 fidelity for $N$ 40 and $N$ 41 for $N$ 42 (Nguyen et al., 2021).

The Shor-code idea has also been generalized far beyond the original $N$ 43 setting. In all-photonic quantum repeaters, a generalized Shor code encodes each repeater-graph-state qubit into an $N$ 44-photon parity block

$N$ 45

For the experimentally realized $N$ 46 encoded repeater graph state, the measured two-photon fidelities were $N$ 47 with no loss, $N$ 48 with one-photon loss in one logical block, and $N$ 49 with two-photon loss, demonstrating the intended loss tolerance (Zhang et al., 2022).

Specialized noise-biased variants have also appeared. A family of high-rate amplitude-damping Shor codes with parameters $N$ 50 was introduced to approximately correct up to $N$ 51 amplitude-damping errors while maintaining immunity to collective coherent errors after concatenation with the dual-rail code (Chang et al., 2024). Another recent construction, the overlapped-repetition Shor code, improves the asymptotic rate fourfold relative to the standard Shor family and reduces the minimal-distance case from $N$ 52 to $N$ 53 (Chang, 23 Oct 2025).

6. Shor-style syndrome extraction and Shor states

“Shor-style” error correction refers to extracting each stabilizer generator’s eigenvalue using a dedicated ancilla, often a cat or GHZ state, so that a single ancilla fault does not spread into many data errors. In this sense, “Shor” is a method of fault-tolerant stabilizer measurement, not a factoring routine (Huang et al., 2023).

A trapped-ion experiment implementing the $N$ 54 Bacon–Shor subsystem code compared Shor-style and Steane-style correction of bit-flip errors on a $N$ 55-ion chain. The measured single-round logical error rates for Shor-style extraction were $N$ 56 for a single-shot decoder, $N$ 57 for an adaptive decoder I, and $N$ 58 for an improved adaptive decoder II. The corresponding disturbance to the data when ancilla information was ignored was $N$ 59. In the same platform, Steane-style extraction performed better, with logical error rates $N$ 60 using $N$ 61 and $N$ 62 using $N$ 63 (Huang et al., 2023).

The cost of Shor-style extraction has itself become a research target. For the $N$ 64 extended Hamming code, optimized “short Shor-style syndrome sequences” achieved single-shot fault-tolerant error correction with $N$ 65 measurements, compared with $N$ 66 in a basic Shor scheme, and single-shot logical $N$ 67 measurement combined with correction with $N$ 68 measurements, compared with $N$ 69 (Delfosse et al., 2020). A related adaptive protocol applicable to arbitrary stabilizer codes reduced the worst-case number of syndrome rounds from $N$ 70 in the traditional scheme to at most $N$ 71 for the strong fault-tolerant condition (Tansuwannont et al., 2022).

At the ancilla-construction level, Shor states themselves have been analyzed under biased noise. For $N$ 72 Steane-code error correction in a nonequiprobable Pauli environment, the fidelity of a $N$ 73-qubit Shor state was

$N$ 74 with no verification,
$N$ 75 with one verification,
$N$ 76 with two verifications, showing that one verification step was optimal in the simulated setting (Weinstein et al., 2011). The same study found an inherent sensitivity to bit-flip errors and recommended repeating syndrome measurements until an all-zero readout was obtained twice in a row (Weinstein et al., 2011).

A broader architectural perspective was developed in a unifying construction “between Shor and Steane,” which introduced ancilla blocks interpolating between GHZ-based and encoded-ancilla extraction. Applied to the $N$ 77 toric code, ancilla blocks of size $N$ 78 yielded decoding in $N$ 79 rounds of measurements (Huang et al., 2020). This suggests that “Shor” and “Steane” are better understood as endpoints of a syndrome-extraction design space than as disjoint methods.

7. Other mathematical uses of the name

Outside algorithmics and fault tolerance, “Shor” appears in several independent mathematical constructions. In enumerative combinatorics, Shor introduced the numbers $N$ 80 associated with improper edges of rooted trees. They satisfy the recurrence

$N$ 81

and also the relation

$N$ 82

These objects were later identified with Ramanujan’s polynomials $N$ 83, leading to the modern name Ramanujan–Shor polynomials and the Berndt–Evans–Wilson–Shor recursion (Chen et al., 2018).

In quantum information theory, the Shor–Laflamme distribution is a collection of local-unitary invariants quantifying $N$ 84-body correlations. For an $N$ 85-qubit state $N$ 86,

$N$ 87

For graph states, these quantities can be computed through a graph-coloring problem, and the mean and variance become simple functions of graph parameters. The same framework yields entanglement criteria and noise thresholds under local depolarizing channels (Miller et al., 2022).

These later usages reinforce the point that “Shor” is not a single object but a family of influential constructions across quantum computation, error correction, and combinatorics. The common thread is not topical unity but a lasting technical legacy: order finding in quantum algorithms, repetition-based structure in fault tolerance, and named recurrences or invariants in adjacent mathematical theories.