Deep divefrom Episode 5AI & computing9 October 202617 min

One Qubit, Six Digits — and a Perfect Square

A deep dive into one paper: what was known before, what the researchers did, what the numbers say and what they don't.

The paper: Factoring six-digit integers with superconducting quantum circuits (arXiv)

Chapters

Transcript

The script the two AI voices read from. The times are worked out from the script, not heard, so a line can start a few seconds early or late.

Read the whole episode

Cold open

Host 1You heard the trailer — this is the whole story. Welcome to the Hastrup Review of Science — where artificial intelligence reads real science, so you don't have to pretend you understood the paper. One paper today: a single superconducting qubit, a stack of microwave drives, and a six-digit number split into its two factors.

Host 2The paper is called Factoring six-digit integers with superconducting quantum circuits, by Xi Zhang, Xinsheng Tan and Yang Yu at Nanjing University and the Hefei National Laboratory. It was posted to the arXiv in September, so it has not been through peer review yet.

Host 1And the claim, in one sentence?

Host 2They turn factoring into the question of whether a two-by-two matrix has a zero eigenvalue, build that matrix out of microwave drives on one qubit, and read the answer off a spectrum. With it they found the factors of fifteen and of one hundred thirteen thousand five hundred sixty-nine, without any two-qubit gates or entanglement.

Host 1We will get to how much that last number tells us. First, why does anyone care about factoring at all?

Why factoring matters

Host 2Because modern public-key cryptography leans on it. The RSA system, published by Rivest, Shamir and Adleman in nineteen seventy-eight, is secure only as long as multiplying two large primes is easy and undoing that multiplication is hard.

Host 1How hard is hard?

Host 2For the numbers used in practice, around six hundred digits, the best known classical method, the general number field sieve, would need far longer than anyone could wait. That is established background, not something this paper addresses. The largest RSA challenge number factored classically so far had two hundred fifty digits and took a large computing effort in twenty twenty.

Host 1And then quantum computing enters.

Host 2In nineteen ninety-four Peter Shor showed that a quantum computer could factor in polynomial time, exponentially faster than the best known classical general-purpose algorithms. That single result is a large part of why governments and companies fund quantum hardware. It is also why the cryptography community is already migrating to post-quantum schemes.

What came before

Host 1So what had actually been done on real hardware before this paper?

Host 2The paper lists it. Shor's algorithm factored fifteen on a nuclear magnetic resonance system in two thousand one, and twenty-one on a photonic system in twenty twelve. The authors point out that many of those early runs relied on prior knowledge of the factors, or on simplifications tailored to the specific number.

Host 1Meaning the answer was partly built into the circuit.

Host 2Partly, yes. As background, a twenty thirteen critique showed that if you are allowed to use the answer to design the circuit, you can factor almost anything with a coin flip, so these demonstrations were mainly tests of hardware, not of factoring. Full Shor's algorithm for a cryptographically relevant number needs error-corrected machines, and recent estimates still put that at hundreds of thousands to a million physical qubits.

Host 1And there was a second line of work, the adiabatic one.

Host 2Right. Instead of running Shor's algorithm, you write factoring as an optimisation problem whose lowest-energy state encodes the factors, and let a quantum system settle into it. The paper notes those experiments went from one hundred forty-three in twenty twelve to fifty-six thousand one hundred fifty-three in a twenty fourteen preprint, which used only four qubits because that number has a special structure.

Host 1So small numbers, special cases, and a lot of asterisks.

Host 2That is fair. The authors write that factoring an arbitrary number on quantum hardware has not been demonstrated, and they frame their work as a different route that avoids the multi-qubit control current processors struggle with.

The open question

Host 1Then the open question this paper is asking is what, exactly?

Host 2Can you get something that factors, without the hardest ingredients of a quantum computer: many qubits, high-fidelity two-qubit gates and entanglement? Their answer is to use a single, very well-controlled quantum system as a measuring instrument.

The idea: a matrix with a zero

Host 1Walk me through the math first. Where does a matrix come in?

Host 2Take the number N you want to factor and two candidate factors, p and q. Build a two-by-two symmetric matrix with p and q on the diagonal and the square root of N in both off-diagonal corners.

Host 1And why that matrix?

Host 2Its determinant is p times q minus N. A matrix has a zero eigenvalue exactly when its determinant is zero, so this matrix has a zero eigenvalue if and only if p times q equals N.

Host 1So factoring becomes: find the p and q where an eigenvalue hits zero.

Host 2Yes. And the authors say plainly that on a classical computer this is pointless, because solving for the eigenvalues of each candidate takes longer than just dividing N by p. The bet is that a physical system can show you its eigenvalues directly, as energies you measure.

Host 1And a qubit is such a system.

Host 2A two-level quantum system has a Hamiltonian that is exactly a two-by-two matrix. Its energy levels are the eigenvalues, and spectroscopy measures them, so if you can set the matrix entries, the qubit evaluates the zero-eigenvalue condition for you.

Building the matrix with microwaves

Host 1How do you set those entries physically?

Host 2The general form is an offset term, called B zero, plus a transverse field, B one and B two, plus a longitudinal field, B three. Comparing that with the factoring matrix, p maps to B zero plus B three over two, q maps to B zero minus B three over two, and the square root of N maps to B one over two.

Host 1So N sits in the transverse field, and the candidate pair sits in the offset and the longitudinal term.

Host 2Exactly. In normal qubit work you ignore B zero, because a constant energy offset does nothing to the dynamics. Here it matters, because it shifts where zero energy is, and p and q both depend on it.

Host 1And all of this is done with microwaves, not magnets?

Host 2Yes, in the rotating frame of a driven qubit. The in-phase and quadrature parts of a microwave drive set B one and B two, and the detuning between the drive frequency and the qubit's transition sets B three. Amplitude, phase and frequency are things you can dial very precisely with standard electronics.

The device

Host 1Describe the hardware.

Host 2A single transmon, which is a superconducting circuit with one Josephson junction and two pads, each two hundred fifty by five hundred micrometres. It sits inside an aluminium box cavity resonating at nine point zero two six gigahertz, cooled to thirty millikelvin in a dilution refrigerator.

Host 1One qubit.

Host 2One transmon, but they use four of its energy levels, not two. The transitions between neighbouring levels sit at seven point one six seven one, six point eight three one, and six point three four gigahertz.

Host 1And how good is the qubit?

Host 2Modest by current standards. Energy relaxation times are about fifteen, twelve and ten microseconds for the three transitions, and the dephasing times about six point three, five point five and four microseconds.

Host 1Why four levels if you only need a two-level system?

Host 2They split the levels into two pairs. The upper pair, levels two and three, becomes the effective spin-one-half whose matrix encodes the problem, and it is driven by what they call the construct drive. The lower pair, levels zero and one, is driven by a second, offset drive, and one of its dressed states serves as the zero-energy reference.

Host 1So the lower pair is a movable ruler, and the upper pair is the thing being measured against it.

Host 2That is a good way to say it. Moving the reference level is how they realise the B zero offset, which a single two-level system on its own could not give them.

The measurement

Host 1And the actual measurement sequence?

Host 2The construct and offset drives each run for ninety microseconds, and a probe pulse of fifty microseconds tests for absorption. Then a strong tone on the cavity reads out the state, because the cavity's transmission depends on which state the transmon is in.

Host 1What signal means you found a factor?

Host 2They watch only one spot: the excited-state population at the zero-energy reference. If the probe is absorbed there, a resonance peak, then one eigenvalue is zero, so p times q should equal N.

Host 1Give me the recipe end to end.

Host 2Set the transverse drive to encode the square root of N. Set the offset and detuning to encode a candidate p and q, measure at zero energy, and if there is a peak, record the pair and check classically whether p times q equals N. If not, move on to the next pair.

Host 1Which pairs do they try?

Host 2p runs from two up to the square root of N, and q from the square root of N up to half of N. To keep the drives in range for large N, they divide everything by the square root of N and use a reference scale of five megahertz.

Results

Host 1Results. Start with fifteen.

Host 2For fifteen they scanned p from two to four and q from four to seven, twelve candidate pairs. There was a clear population peak at three and five, which is correct, and the authors stress the factors were not written into the pulse sequence ahead of time.

Host 1And the headline number.

Host 2One hundred thirteen thousand five hundred sixty-nine. Here the zero-energy signal showed multiple peaks, not one, and checking those candidates classically picked out the answer: three hundred thirty-seven times three hundred thirty-seven.

Host 1Multiple peaks. How many?

Host 2The text does not give a count, and it does not report how many measurements were taken or how long the scan took. What it argues is that the spectroscopy narrows classical checking down to a subset of pairs.

Host 1They also compare the size of that number to earlier work.

Host 2They say it is more than three orders of magnitude larger than anything factored in Shor's algorithm demonstrations, which checks out: it is about five thousand four hundred times twenty-one. Against the adiabatic record they cite, fifty-six thousand one hundred fifty-three, it is about twice as large.

Host 1Before we go further, a word from our sponsor.

A word from our sponsor

Host 2Do you have a forest growing out of your nose? Then you are in luck.

Host 2The Hastrup Review of Science is brought to you by nose-hair trimmers. A small rotating blade behind a protective guard clears the area quickly, without pulling.

Host 1I trim every morning. It is the only part of my routine where I go in deep and come out feeling better about myself.

Host 2Most are battery powered and washable, many come with an attachment for ears and eyebrows, and they are widely available and very reasonably priced right now.

Host 1Quiet, precise and pleasantly ticklish. A very dependable product.

Host 2Nose-hair trimmers. Our referral link is in the show notes.

What limits it

Host 1Back to the paper. Why were there multiple peaks instead of one clean answer?

Host 2The authors name two limits. First, control precision: the spacing between neighbouring candidates in the drive is the reference scale divided by the square root of N, about fifteen kilohertz here, but the microwave amplitude fluctuates by about one percent of the scale, roughly fifty kilohertz.

Host 1So the noise is bigger than the step.

Host 2More than three times bigger. The second limit is the linewidth of the resonance, set by coherence: with a coherence time around five microseconds, the half-width is about thirty kilohertz, again wider than the fifteen-kilohertz step. Both effects let many pairs with p times q merely close to N light up as well.

Host 1Can that be fixed?

Host 2They simulated it. Raising the reference scale from five to fifty megahertz and the coherence time from five to one hundred microseconds concentrates the response on far fewer candidates, which they estimate is roughly a hundredfold gain in efficiency, and they cite those coherence levels as reachable with better fabrication.

Why it matters

Host 1Step back. What is the principle here?

Host 2That a well-controlled quantum system can act as an analog instrument for evaluating a mathematical condition, here a zero eigenvalue, by encoding the problem in the drive parameters and reading the answer from a spectrum. The appeal is that it needs only single-qubit control and readout, which current hardware does well.

Host 1Who does that change anything for?

Host 2For now, mostly for people working on Hamiltonian engineering and analog quantum protocols. It shows that the offset term everyone usually drops can be made into a tunable, useful control knob, using a second pair of levels as a movable reference.

Host 1And what does it not mean?

Host 2It does not mean RSA is in danger, and the authors say so themselves: the scaling of the protocol and any practical advantage over classical factoring remain to be established. They add that much more scalability, control fidelity and coherence would be needed before the cryptographic implications could even be assessed.

Caveats

Host 1Let us do the caveats properly.

Host 2First, this is a preprint from a single group with no peer review yet. Second, the six-digit number is a perfect square, three hundred thirty-seven squared.

Host 1Why does that matter?

Host 2Because the protocol starts by computing the square root of N to set the drive, and for a perfect square that square root is already the answer. To be fair to the authors, the factor pair is right there in their figure, nothing is hidden, but it is the one input where a pocket calculator finishes in one step.

Host 1Third?

Host 2The search itself. By our own arithmetic from the scan range they give, p up to three hundred thirty-seven and q up to fifty-six thousand seven hundred eighty-five makes roughly nineteen million candidate pairs, while plain trial division needs at most about three hundred thirty-six divisions, each trivial for a laptop.

Host 1So the search space is bigger than the brute-force classical one.

Host 2As written, yes, and each candidate costs a pulse sequence of well over a hundred microseconds plus readout. The paper does not claim otherwise, and it does not say whether every pair in that range was physically measured.

Host 1Fourth?

Host 2Precision scales against you. The step between candidates is the drive scale divided by the square root of N, so every extra two digits in N demands roughly ten times finer control and narrower lines. That is our reading of their formula, not a claim in the paper, but it suggests the resource that grows is analog precision, which is a known weakness of analog computing.

Host 1And the absence of entanglement, which they present as an advantage.

Host 2It is an engineering advantage, and an honest one. But as background, entanglement is widely thought to be necessary for exponential quantum speedups, so a protocol without it would not be expected to beat classical methods by that margin. Here the qubit works as a precise spectrometer for a two-by-two matrix, not as a quantum computer in the Shor sense.

What to watch

Host 1What should we watch for next?

Host 2Three things. A run on numbers that are not perfect squares, ideally products of two different primes chosen by someone else. And a full accounting of the number of measurements and wall-clock time, compared honestly with trial division.

Host 1And the third?

Host 2The parallel idea they mention: several qubits scanning different regions of candidate space at once. That would cut acquisition time by a constant factor, so the real question is whether the number of candidates and the required precision can be made to grow slowly with N. Until someone shows that, this is a careful single-qubit control experiment with a factoring problem attached.

Host 1Bottom line?

Host 2An elegant encoding, a small and honest experiment, and an important figure that, read closely, is a perfect square. The authors themselves say the advantage is unproven, and we agree.

Sign-off

Host 1That is the deep dive: Factoring six-digit integers with superconducting quantum circuits, by Zhang, Tan and Yu at Nanjing University, a preprint on the arXiv. The link is in the show notes.

Host 2Every Friday this same feed carries the roundup episode: five new papers as trailers, and you pick which become deep dives. This has been the Hastrup Review of Science.