---
title: 'Shor: Quantum Algorithms & Error Correction'
url: https://www.emergentmind.com/topics/shor
type: topic
---

# Shor: Quantum Algorithms & Error Correction

Shor most commonly denotes a family of constructions associated with Peter Shor: the quantum factoring algorithm introduced in 1994, the nine-qubit Shor quantum error-correcting code and related Shor-style syndrome-extraction methods, and several later mathematical and quantum-information notions that retain the name. In quantum computing, the dominant usage is Shor’s reduction of factoring to quantum order finding; in fault tolerance, “Shor” also denotes cat-state ancillas and stabilizer-measurement schemes that are explicitly distinct from the factoring algorithm [1507.08852] [2312.10851].

## 1. Principal meanings of “Shor”

The term is not univocal. In current research usage, it spans algorithmic, coding-theoretic, and combinatorial objects. The most common ambiguity is between **Shor’s algorithm** and **Shor-style error correction**; the latter concerns syndrome extraction with ancillas and does not refer to factoring [2312.10851]. Other established uses include the **Ramanujan–Shor polynomials** and the **Shor–Laflamme distribution** [1810.02732] [2207.07665].

| Usage | Domain | Core content |
|---|---|---|
| Shor’s algorithm | Quantum algorithms | Integer factoring via quantum order finding |
| Shor code | Quantum error correction | Nine-qubit code and its generalizations |
| Shor-style syndrome extraction | Fault tolerance | Per-stabilizer ancilla-based measurement |
| Ramanujan–Shor polynomials | Combinatorics | Rooted trees, improper edges, Cayley refinements |
| Shor–Laflamme distributions | Quantum information theory | Local-unitary invariants for \(k\)-body correlations |

This breadth matters because different subfields use “Shor” almost as a technical shorthand. A statement about “Shor correction,” “Shor states,” or “Shor polynomials” may have no connection to factoring, even though all derive from the same name.

## 2. Shor’s factoring algorithm

Shor’s algorithm factors a composite integer \(N\) by reducing the problem to quantum order finding. For a random integer \(a\) with \(1<a<N\) and \(\gcd(a,N)=1\), the order \(r\) of \(a\) modulo \(N\) is the smallest positive integer satisfying \(a^r \equiv 1 \pmod N\). When \(r\) is even and \(a^{r/2} \not\equiv -1 \pmod N\), nontrivial factors are recovered classically as \(\gcd(a^{r/2}\pm 1,N)\) [2509.00417].

The quantum subroutine prepares a uniform superposition over exponents \(x\), computes \(f(x)=a^x \bmod N\) in a second register, and then applies quantum phase estimation using the Quantum Fourier Transform. In the resource-efficient Beauregard architecture, factoring an \(n\)-bit integer uses \(2n+3\) logical qubits. The modular-exponentiation core is built from a QFT-based adder \(\mathrm{ADD}(a)\), its inverse \(\mathrm{MINUS}(a)\), modular addition modulo \(N\), and controlled modular multiplication \(\mathrm{CMULT}(a)\ \mathrm{MOD}(N)\); asymptotically, modular exponentiation has \(O(n^3)\) gate complexity [2509.00417].

For the specific implementation analyzed in recent noise work, the exact gate-count polynomials of modular exponentiation are given as:
- controlled-phase gates \(\mathrm{CP}(\theta)\): \(4n^3 + 62n^2 + 286n + 408\)
- CNOT: \(12n^2 + 88n + 156\)
- Hadamards \(H\): \(8n^2 + 60n + 112\)
- single-qubit phase \(P(\theta)\): \(2n^2 + 14n + 24\)
- \(X\) gates: \(4n + 14\)
- CSWAP: \(n + 3\) [2509.00417]

The classical post-processing is governed by continued fractions. A detailed treatment proves that if
\[
\left|\frac{y}{Q}-\frac{t}{r}\right| < \frac{1}{2r^2},
\]
then \(t/r\) is a convergent of \(y/Q\), which is the standard Legendre criterion used in Shor post-processing. With the usual choice \(n^2 < Q < 2n^2\), the probability of obtaining a measurement outcome in the required continued-fraction regime is approximately \(4/\pi^2\) [2205.01925].

## 3. Realizations, compilations, and large-instance workflows

Experimental and software work on Shor’s algorithm spans fully scalable demonstrations, compiled small-\(N\) realizations, and hybrid compilation frameworks. A trapped-ion realization of Kitaev’s iterative phase-estimation variant factored \(15\) using seven effectively employed qubits and four “cache-qubits,” together with generalized modular multipliers, and reported success probabilities in excess of \(90\%\) [1507.08852]. In that implementation, the measured probabilities of the order-assigning outputs for \(a\in\{2,7,8,11,13\}\) were \(56(2)\%\), \(51(2)\%\), \(54(2)\%\), \(47(2)\%\), and \(50(2)\%\), with squared statistical overlaps \(0.968(1)\), \(0.964(1)\), \(0.966(1)\), \(0.901(1)\), and \(0.972(1)\) [1507.08852].

A separate semiconductor-nanostructure proposal implemented compiled instances for \(N=15\) using surface-acoustic-wave-assisted electron transport. It reported fidelity \(F=0.97\) for the \(C=11\) case and \(F=0.89\) for the \(C=2\) case, with the expected \(50\%\) success probability in both instances and near-maximal entanglement measures \(\epsilon_L=0.999\) and \(0.976\) [1011.2628].

At the software layer, hybrid compilation has become a distinct topic. A PennyLane/Catalyst implementation compiled Shor’s algorithm once per bit width of \(N\), even when \(N\)-specific runtime optimizations were applied. Benchmarks up to \(32\)-bit \(N\) found the pure compilation time to be constant and under \(3\) seconds on a laptop computer, while the \(32\)-bit execution-time circuit was on the order of \(\sim 40\) million 1- and 2-qubit gates [2504.12449]. The same work reported \(10\text{–}25\%\) total gate-count reduction relative to an unoptimized version, averaged over \(10\) random choices of \(a\) for \(N\) up to \(25\) bits [2504.12449].

A more controversial direction is highly constrained large-\(N\) simulation. One implementation demonstrated factorization of a \(4096\)-bit integer only under the restriction \(N=3\cdot q\), with \(a=2\) and the order \(r\) a power of two. In that setting, with \(10{,}000\) shots on Qiskit Aer, the reported circuit generation time for the \(4096\)-bit case was \(33.467\) s and the execution time was \(2229.684\) s; for \(8192\) bits the execution time was \(11308.347\) s [2505.03743]. This does not constitute a general-purpose RSA-scale factoring result; it is a specialized instance family.

## 4. Noise sensitivity and resource dynamics of Shor’s algorithm

A recent circuit-level study of Shor’s algorithm found a marked asymmetry between Pauli error types. Under a per-gate and per-idle Pauli noise model, the modular-exponentiation circuit is intrinsically far more tolerant to \(Z\) noise than to \(X\) or \(Y\) noise. The explanation given is structural: the arithmetic is heavily built from controlled-phase gates and QFT blocks that are diagonal in the computational basis, so many single \(Z\) faults commute, cancel, or contribute only relative or global phases without changing the measured arithmetic output [2509.00417].

The scaling law is explicit. The total number of potential single-error positions in the modular-exponentiation circuit is
\[
S(n)=4n^4+50n^3+190n^2+176n+32,
\]
while the number of \(Z\)-fault-tolerant positions is
\[
T_Z(n)=\tfrac{10}{3}n^4+\tfrac{101}{3}n^3+\tfrac{356}{3}n^2+\tfrac{430}{3}n+38.
\]
Thus, \(Z\)-tolerant positions grow with the same quartic order as the total number of possible single-error positions [2509.00417].

For \(4\)- to \(9\)-bit instances, the observed single-fault success rate under pure \(Z\) noise ranged from \(0.6898\) at \(n=4\) to \(0.7196\) at \(n=9\). By contrast, \(X\)- and \(Y\)-fault tolerance was much smaller and instance dependent: at \(4\) bits with \(N=15,a=2\), the tolerant-position counts were \(1{,}022\) for \(X\) noise and \(323\) for \(Y\) noise, corresponding to single-fault success rates \(0.1278\) and \(0.0404\); at \(8\) bits with \(N=133,a=2\), the corresponding counts were \(3{,}815\) and \(1{,}024\), with success rates \(0.0686\) and \(0.0184\) [2509.00417].

The same study extrapolated to cryptographic scale under biased noise \(p_X=p_Y=p_Z/1000\). For a \(2048\)-bit instance and a modular-exponentiation success target \(c=0.5\), the predicted minimum per-operation physical error rate was
\[
p_{\min}\approx 1.417\times 10^{-17}.
\]
The authors explicitly noted the assumptions behind this estimate: single-error injection only, no SPAM noise, no correlated or non-Markovian multi-qubit errors, no crosstalk or leakage, and no full error correction [2509.00417].

Resource-dynamics work complements the noise study by analyzing how coherence and entanglement change across the algorithm. For the evolved states in Shor’s algorithm, the overall effect was found to deplete coherence and produce entanglement. In the worked example \(N=15\), \(a=7\), the geometric coherence changed from \(0.9995\) after the initial superposition to \(0.9375\) after the inverse QFT, while geometric entanglement rose from \(0\) initially to approximately \(0.9876\) by the end of the quantum part [2604.06639]. This suggests that the algorithm’s speedup is accompanied by a structured conversion of superposition resource into multipartite correlation.

## 5. Shor code and its generalizations

In quantum error correction, the standard Shor code is the \([[9,1,3]]\) code formed by concatenating a \(3\)-qubit bit-flip repetition code with a \(3\)-qubit phase-flip repetition code. One experimental description gives the logical basis as
\[
|0_L\rangle=\frac{(|000\rangle+|111\rangle)^{\otimes 3}}{2\sqrt 2},\qquad
|1_L\rangle=\frac{(|000\rangle-|111\rangle)^{\otimes 3}}{2\sqrt 2},
\]
with six \(Z\)-pair stabilizers and two weight-\(6\) \(X\)-type stabilizers [2203.07979].

The family extends naturally to \([[m^2,1,m]]\). A trapped-ion experiment prepared \(m\)-qubit GHZ states and synthetically constructed logical states of the \([[m^2,1,m]]\) Shor code up to \(m=7\). In that system, the optimal size was \(m=5\), with synthetic logical fidelities \(0.9976(3)\) for \(|+\rangle_L\) and \(0.9967(4)\) for \(|-\rangle_L\). The same work directly realized the \([[9,1,3]]\) code on nine qubits in a thirteen-ion chain, obtaining \(98.8(1)\%\) fidelity for \(|+\rangle_L\) and \(98.5(1)\%\) for \(|-\rangle_L\) [2104.01205].

The Shor-code idea has also been generalized far beyond the original \([[9,1,3]]\) setting. In all-photonic quantum repeaters, a generalized Shor code encodes each repeater-graph-state qubit into an \(m\)-photon parity block
\[
|0_L\rangle=\frac{|0\rangle^{\otimes m}+|1\rangle^{\otimes m}}{\sqrt2},\qquad
|1_L\rangle=\frac{|0\rangle^{\otimes m}-|1\rangle^{\otimes m}}{\sqrt2}.
\]
For the experimentally realized \(n=3,m=3\) encoded repeater graph state, the measured two-photon fidelities were \(0.64\pm 0.05\) with no loss, \(0.67\pm 0.05\) with one-photon loss in one logical block, and \(0.71\pm 0.05\) with two-photon loss, demonstrating the intended loss tolerance [2203.07979].

Specialized noise-biased variants have also appeared. A family of high-rate amplitude-damping Shor codes with parameters \([[(w+1)(w+K),K]]\) was introduced to approximately correct up to \(w\) amplitude-damping errors while maintaining immunity to collective coherent errors after concatenation with the dual-rail code [2412.16450]. Another recent construction, the overlapped-repetition Shor code, improves the asymptotic rate fourfold relative to the standard Shor family and reduces the minimal-distance case from \([[9,1,3]]\) to \([[7,1,3]]\) [2510.21030].

## 6. Shor-style syndrome extraction and Shor states

“Shor-style” error correction refers to extracting each stabilizer generator’s eigenvalue using a dedicated ancilla, often a cat or GHZ state, so that a single ancilla fault does not spread into many data errors. In this sense, “Shor” is a method of fault-tolerant stabilizer measurement, not a factoring routine [2312.10851].

A trapped-ion experiment implementing the \([[9,1,3]]\) Bacon–Shor subsystem code compared Shor-style and Steane-style correction of bit-flip errors on a \(23\)-ion chain. The measured single-round logical error rates for Shor-style extraction were \(9.72\pm 1.16\%\) for a single-shot decoder, \(10.04\pm 1.45\%\) for an adaptive decoder I, and \(7.84\pm 1.57\%\) for an improved adaptive decoder II. The corresponding disturbance to the data when ancilla information was ignored was \(4.71\pm 1.59\%\). In the same platform, Steane-style extraction performed better, with logical error rates \(4.93^{+0.51}_{-0.48}\%\) using \(|+_L\rangle\) and \(4.75^{+0.51}_{-0.47}\%\) using \(|0_L\rangle\) [2312.10851].

The cost of Shor-style extraction has itself become a research target. For the \([[16,6,4]]\) extended Hamming code, optimized “short Shor-style syndrome sequences” achieved single-shot fault-tolerant error correction with \(10\) measurements, compared with \(40\) in a basic Shor scheme, and single-shot logical \(Z\) measurement combined with correction with \(11\) measurements, compared with \(63\) [2008.05051]. A related adaptive protocol applicable to arbitrary stabilizer codes reduced the worst-case number of syndrome rounds from \((t+1)^2\) in the traditional scheme to at most \(\lfloor (t+3)^2/4 \rfloor -1\) for the strong fault-tolerant condition [2208.05601].

At the ancilla-construction level, Shor states themselves have been analyzed under biased noise. For \([[7,1,3]]\) Steane-code error correction in a nonequiprobable Pauli environment, the fidelity of a \(4\)-qubit Shor state was
- \(1-10p_x-11p_y-7p_z\) with no verification,
- \(1-5p_x-6p_y-10p_z\) with one verification,
- \(1-5p_x-6p_y-13p_z\) with two verifications,
showing that one verification step was optimal in the simulated setting [1111.3930]. The same study found an inherent sensitivity to bit-flip errors and recommended repeating syndrome measurements until an all-zero readout was obtained twice in a row [1111.3930].

A broader architectural perspective was developed in a unifying construction “between Shor and Steane,” which introduced ancilla blocks interpolating between GHZ-based and encoded-ancilla extraction. Applied to the \(L\times L\) toric code, ancilla blocks of size \(m\times m\) yielded decoding in \(O(L/m)\) rounds of measurements [2012.15403]. This suggests that “Shor” and “Steane” are better understood as endpoints of a syndrome-extraction design space than as disjoint methods.

## 7. Other mathematical uses of the name

Outside algorithmics and fault tolerance, “Shor” appears in several independent mathematical constructions. In enumerative combinatorics, Shor introduced the numbers \(Q(i,j,k)\) associated with improper edges of rooted trees. They satisfy the recurrence
\[
Q(i,j,k)=(k+i-1)Q(i-1,j,k)+(i+j-2)Q(i-1,j-1,k),
\]
and also the relation
\[
Q(i,j,k)=(k-j+1)Q(i-1,j,k+1)+(i+j-2)Q(i-1,j-1,k+1).
\]
These objects were later identified with Ramanujan’s polynomials \(\psi_k(r,x)\), leading to the modern name **Ramanujan–Shor polynomials** and the **Berndt–Evans–Wilson–Shor recursion** [1810.02732].

In quantum information theory, the **Shor–Laflamme distribution** is a collection of local-unitary invariants quantifying \(k\)-body correlations. For an \(n\)-qubit state \(\rho\),
\[
A_k[\rho]=\sum_{\mathrm{swt}(\mathbf r,\mathbf s)=k}\left|\mathrm{Tr}\!\left(\rho\,X^{\mathbf r}Z^{\mathbf s}\right)\right|^2.
\]
For graph states, these quantities can be computed through a graph-coloring problem, and the mean and variance become simple functions of graph parameters. The same framework yields entanglement criteria and noise thresholds under local depolarizing channels [2207.07665].

These later usages reinforce the point that “Shor” is not a single object but a family of influential constructions across quantum computation, error correction, and combinatorics. The common thread is not topical unity but a lasting technical legacy: order finding in quantum algorithms, repetition-based structure in fault tolerance, and named recurrences or invariants in adjacent mathematical theories.

Source: https://www.emergentmind.com/topics/shor