Pith. sign in

REVIEW 3 major objections 3 minor 14 references

Factoring integers via Schnorr's algorithm assisted with VQE

T0 review · 3 major / 3 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that VQE can replace QAOA as the quantum subroutine in a hybrid lattice-based factoring pipeline, and demonstrates the factorization of 1961.

desk verdict A transparent replication note whose central claim—that VQE improves Babai's solution—is contradicted by its own only successful run. read the letter →

arxiv 2411.16632 v1 pith:S446EYUT submitted 2024-11-25 quant-ph cs.CR

Luis Sánchez Cano , Ginés Carrascal de las Heras , Guillermo Botella Juan , Alberto del Barrio García This is my paper · ORCID
classification quant-phcs.CR MSC 11Y0581P6868Q12
keywords VQESchnorr'salgorithmintegerfactorizationclosestvectorproblemsmoothrelationpairshybridquantum-classicallatticebasisreductionRSA
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

At stake is whether a classical factoring pipeline built on lattice geometry — Schnorr's algorithm, which turns factoring into a search for smooth relation pairs — can be assisted by a variational quantum eigensolver (VQE) instead of the QAOA optimizer used in the 2022 approach it replicates. The paper reports one successful factorization: for $N=1961$, VQE improves Babai's approximate solution to the closest vector problem enough to yield the sr-pair $(2025,1)$, which in turn produces the factors $53$ and $37$. Seven of the eight experimental configurations reported in the paper fail to find sr-pairs, a fact the authors attribute to single-run seeding, VQE returning a single candidate, and Schnorr's assumption-based nature. If the claim generalizes, quantum-assisted factorization gains a second, low-qubit route that could matter for RSA-style cryptography.

What carries the argument

The load-bearing object is the cost Hamiltonian built around Babai's lattice point. After LLL lattice-basis reduction, the approximate solution $b_{op}$ from Babai's nearest-plane algorithm is used to define $F(x_1,\dots,x_n)=\|t-b_{op}-\sum_i x_i b_i\|^2$, with binary $x_i\in\{0,1\}$; substituting $x_i=(\sigma_i^z+I)/2$ turns $F$ into the Ising Hamiltonian $\hat H$ whose ground state VQE seeks. The minimum selects a lattice vector that encodes a smooth pair $(u,v)$ through the signs of its coordinates; when $u-vN$ is also smooth, the pair is an sr-pair, and solving the resulting modulo-2 linear system yields the factors. Unlike QAOA, VQE does not need Babai's solution as an ansatz, but that solution is still needed to construct the Hamiltonian. Replacing QAOA with VQE shortens the quantum circuit, which the paper argues makes the computation less noise-sensitive on current hardware.

What would settle it

Re-run the same VQE pipeline for $N=1961$ with randomized lattice diagonal orders and several seeds, and repeat it for other small semiprimes; if factors appear only for the $[1,1,2]$ configuration taken from the QAOA paper, or no more often than a classical-only Babai baseline, the claim that VQE assists Schnorr factoring is not supported.

Watch

Extended reading notes

Core claim

The authors' central claim, stated in Section 4.1, is that they 'have factored the given number using VQE in a similar way as they did with QAOA in [14]', and that VQE can improve the approximate solution given by Babai's algorithm to obtain sr-pairs. In the demonstrated case, $N=1961$, the $3$-qubit calculation ends with the VQE ground state $[000]$, which leads to the sr-pair $(2025,1)$ — in fact the fourth sr-pair of the QAOA paper — and solving the linear system gives the factors $53$ and $37$. The paper also reports that seven of its eight attempted configurations failed to find sr-pairs; it attributes this to single-seed runs, VQE producing only one candidate, and the strength of Schnorr's assumption. The successful run fixes the lattice diagonal order to $[1,1,2]$, the same order used in the replicated QAOA work.

Load-bearing premise

The factorization rests on treating the fixed diagonal order $[1,1,2]$ as an acceptable experimental choice, because with the authors' own lattice-reduction code and that same order, no sr-pair is found and the factorization of $N=1961$ fails.

Editorial extensions

If this is right

  • VQE can stand in for QAOA in a Schnorr-style factoring pipeline, providing at least one concrete integer factorization as a proof of concept.
  • Because VQE circuits are shorter, the hybrid approach may be less susceptible to noise on near-term quantum hardware than the QAOA version it replaces.
  • A single VQE run returns one lattice candidate, so repeated runs or adjusted hyperparameters would be needed to make the method reliable; the successful $3$-qubit case is the existence proof.
  • For larger targets the method does not scale trivially, since increasing the qubit count from $3$ to $6$ or $10$ in the reported experiments did not produce factors.
  • If the approach can be made reliable, the practical consequence is a potential low-qubit quantum threat to RSA-style cryptography, because even one successful factorization of a target integer compromises the key.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves open whether VQE itself, rather than the fixed $[1,1,2]$ lattice diagonal order borrowed from the QAOA work, is what produces the sr-pair; a direct test would randomize the diagonal permutation across many runs.
  • A natural extension is to seed VQE with several Babai candidates or to use excited-state VQE to obtain multiple lattice vectors per run, which could raise the sr-pair yield that the single-candidate output currently limits.
  • The classical stages — lattice reduction, Babai's algorithm, and smoothness checking — dominate the pipeline, so isolating their failure rate from the quantum subroutine's would show where the bottleneck actually lies.
  • The success probability of the method is essentially unmeasured because each configuration was run once; a multi-seed benchmarking study would convert the reported yes-or-no results into a rate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes replacing the QAOA subroutine in the hybrid Schnorr factoring pipeline of Yan et al. [14] with the Variational Quantum Eigensolver (VQE). The workflow converts integer factorization into a closest-vector problem, applies LLL reduction and Babai's algorithm, and then uses VQE to minimize an Ising Hamiltonian that searches for a displacement improving the Babai solution. The authors report a successful factorization of N = 1961 into 53 and 37, and they also report failed runs for a 5-qubit case and for hyperparameter l = 2. The paper claims that the VQE-assisted algorithm can factor integers and discusses implications for RSA security.

Significance. If the central claim were valid, the paper would provide evidence that a variational quantum eigensolver can replace QAOA in Schnorr's factoring pipeline and improve Babai's CVP solution. The manuscript is commendably transparent about its failures and about the fixed diagonal order, and it makes a useful cautionary replication attempt. However, the reported experimental data contradict the central claim: the lone successful run shows no quantum improvement, and the configuration that succeeds is selected to match [14]. Thus the significance of the claimed result is not currently established.

major comments (3)
  1. [§3.2, §4.1, Table 1] The central claim that VQE improves Babai's solution is contradicted by the paper's own data. In the successful N = 1961 run, Table 1 lists [000] as the VQE optimum with value 36 and probability 1.0, i.e., x = (0, 0, 0) and b_h = bop. The value 36 equals ||t − bop||^2, and the sr-pair used, (2025, 1), is already encoded in Babai's output bop = (0, 4, 4, 242): using the original basis of Eq. (20), bop = 0·b1 + 4·b2 + 2·b3, giving u = 3^4·5^2 = 2025 and v = 1. Hence the factorization 53 × 37 is produced by classical Babai alone, and the VQE subroutine contributes nothing to this success.
  2. [Remark 4, Table 2] The successful configuration is selected post hoc. Remark 4 states that the diagonal order [1, 1, 2] was fixed to match [14] even though it is supposed to be a random permutation. Table 2 shows that using the authors' own Algorithm 1 for LLL-reduction, which they demonstrate yields a valid δ-LLL-reduced basis, the same N = 1961 case produces no sr-pair and fails to factor. Thus the single success depends on a known-good lattice ordering and on a specific LLL implementation, not on the proposed VQE method.
  3. [Table 2] Seven of the eight reported runs fail, including all l = 2 runs and both N = 48567227 attempts; the authors attribute this to running each configuration only once with a fixed seed. With a single success that is also the only configuration in which VQE is inactive, the data do not support the conclusion that VQE-assisted Schnorr factoring works, and the claimed 'potential to factorize the targeted integer in specific scenarios' remains an unsupported conjecture.
minor comments (3)
  1. [§2.2, after Eq. (8)] There is a typo: 'The subsequent method we proceeded was he LLL-reduction algorithm' should read '...was the LLL-reduction algorithm'.
  2. [§3.2] The statement that 'VQE does not need it actually' is misleading because bop is still used to construct the Hamiltonian H; the sentence should clarify that VQE does not use bop as an initial ansatz, not that bop is unnecessary.
  3. [§4.1, Table 1 caption] The table would be clearer if the caption explicitly noted that the selection [000] corresponds to x = (0, 0, 0) and therefore b_h = bop, since this is the key observation for evaluating the quantum contribution.

Circularity Check

2 steps flagged · score 7.0 of 10

VQE optimum is [000], so the claimed 'VQE-assisted' factorization reduces to Babai's classical bop and to the baseline paper's already-known 4th sr-pair.

  1. renaming known result [Section 4.1, Eq. (17), Table 1, and the paragraph following Table 1]
    "Therefore, the optimal selection is [000], whose value is 36. Once we have this, the next step is to find sr-pairs. We have based our implementation of this step on the work [6], obtaining the sr-pair (2025, 1), which in fact corresponds to the 4-th sr-pair in [14]. Afterwards, we solve the system of equations given by that sr-pair, finally calculating the factors: 53 and 37. This means our code has worked properly, since 53 × 37 = 1961, i.e., we have factored the given number using VQE in a similar way as they did with QAOA in [14]."

    In Eq. (17), b_h = bop + Σ x_i b_i, and Table 1 reports the VQE optimum as [000], so b_h = bop exactly. With Eq. (22), bop = (0,4,4,242), which in the original lattice basis of Eq. (20) is 0·b1 + 4·b2 + 2·b3, giving u = 3^4·5^2 = 2025 and v = 1. Thus the sr-pair and the factors 53 and 37 are fully encoded in Babai's classical output; the VQE displacement is zero, and F(0) = 36 = ||t − bop||² is the reported minimum. The paper then identifies this same (2025,1) as the 4-th sr-pair of [14] and calls the result 'factored ... using VQE'. The claimed prediction therefore reduces by construction to the classical Babai solution and to a known result from the baseline paper, not to any quantum improvement.

  2. other [Section 4.1, Remark 4 and Table 2]
    "This experiment has been carried out considering the same diagonal order [1, 1, 2] for B as in [14]. Remember this diagonal is supposed to be a random permutation of some elements."

    The only successful run fixes the supposedly random lattice diagonal to the exact order used in the baseline paper that already produced the 4-th sr-pair. With the authors' own LLL implementation (Algorithm 1), the same N=1961 yields no sr-pair and fails to factor (Table 2). The success is therefore conditional on importing [14]'s configuration and its already-published output, so the demonstration is not an independent VQE-derived result but a reproduction of known baseline data under the baseline's chosen settings.

full rationale

The central assertion that 'we have factored the given number using VQE' is not supported by the paper's own equations and tables. The VQE optimum is [000], meaning the quantum subroutine returns the zero displacement and b_h remains exactly Babai's bop; the sr-pair (2025,1) is obtained from bop in the original basis and is explicitly identified as the 4-th sr-pair of [14]. Consequently, the factorization 53×37 is a renamed classical/baseline result rather than a VQE prediction. Remark 4 confirms that the one successful experiment reused [14]'s diagonal order, which is supposed to be random, and Table 2 shows 7 of 8 runs fail; with the authors' own LLL implementation no sr-pair is found for 1961. These internal facts exhibit a specific reduction of the claimed 'prediction' to its inputs: the VQE step contributes no displacement, and the output sr-pair is already present in the cited prior work. This warrants a high circularity score, though the paper's failure is also partly a correctness/overclaim issue about what VQE accomplished.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method introduces several hand-picked constants and relies on standard lattice and heuristic quantum assumptions. The most consequential choices are the smooth bound, the lattice parameter c, the hyperparameter l, and especially the diagonal order of the lattice basis, which is supposed to be random but was fixed to match [14]. The paper also assumes Schnorr's reduction and VQE convergence without proof.

free parameters (5)
  • smooth_bound = 15 for N=1961, 50 for N=48567227
    Hand-picked; determines the prime basis and, together with l, the lattice dimension.
  • lattice_parameter_c = 1.5 for N=1961, 4 for N=48567227
    Adjustable parameter in the lattice construction; no optimization or justification is given.
  • hyperparameter_l = 1 or 2
    Controls the number of qubits in Eq. (4); no principled choice, both values are tested.
  • diagonal_order_of_B = [1,1,2] (same as [14])
    The diagonal is specified to be a random permutation, but the successful run fixes it to the order used in [14] (Remark 4). This is the key choice that makes the experiment succeed.
  • seed = not reported
    Authors mention using a seed for the experiments but do not provide it, so results cannot be exactly reproduced.
assumptions (5)
  • domain assumption Schnorr's construction maps factoring to a CVP on a prime lattice
    The paper relies on this equivalence, citing [10,11]; Remark 1 concedes the algorithm is based on an assumption.
  • domain assumption A nearest lattice vector yields smooth relation pairs with sufficient probability
    The whole pipeline depends on obtaining sr-pairs from Babai or the quantum step; Remark 1 flags uncertainty and Table 2 shows most runs yield no sr-pair.
  • standard math LLL-reduction with delta in (1/4,1) runs in polynomial time
    Standard result; used in Section 2.2.
  • standard math Babai's nearest plane algorithm gives the stated 2^(n/2) approximation
    Standard bound cited to [1]; used to justify the CVP approximation.
  • domain assumption VQE converges to the ground state of the constructed Ising Hamiltonian
    VQE is a heuristic; the paper provides no convergence analysis and no hardware noise model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Factoring integers via Schnorr's algorithm assisted with VQE." pith.science (2026). https://pith.science/paper/S446EYUT

@misc{pith2026241116632,
  author       = {Pith},
  title        = {Pith review of: Factoring integers via Schnorr's algorithm assisted with VQE},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S446EYUT}},
  note         = {Machine review of arXiv:2411.16632}
}
read the original abstract

Current asymmetric cryptography is based on the principle that while classical computers can efficiently multiply large integers, the inverse operation, factorization, is significantly more complex. For sufficiently large integers, this factorization process can take in classical computers hundreds or even thousands of years to complete. However, there exist some quantum algorithms that might be able to factor integers theoretically -- the theory works properly, but the hardware requirements are far away from what we can build nowadays -- and, for instance, Yan, B. et al. ([14]) claim to have constructed a hybrid algorithm which could be able even to challenge RSA-2048 in the near future. This work analyses this article and replicates the experiments they carried out, but with a different quantum method (VQE), being able to factor the number 1961.

Figures

Figures reproduced from arXiv: 2411.16632 by the authors.

Figure 1
Figure 1. Flowchart of the proposed algorithm. The difference with respect to Schnorr’s algorithm is the addition of VQE. Besides this, with respect to [14], QAOA has been replaced by VQE. QAOA may converge faster, but when implemented on current circuits, it faces challenges. With VQE, on the other hand, we have shorter circuits which are therefore less susceptible to noise in this specific case (a discussion on this can be … view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 9 canonical work pages

  1. [14]

    et al.: Factoring integers with sublinear resources on a superconducting quantum processor, arXiv:2212.12372v1 (2022)

    Yan, B., Tan, Z., Wei, S. et al.: Factoring integers with sublinear resources on a superconducting quantum processor, arXiv:2212.12372v1 (2022)

    arXiv 2022

  2. [1]

    Babai, L.: On Lovász’ lattice reduction and the nearest lattice point problem, Com- binatorica 6(1) (1986)

    work page 1986

  3. [2]

    Bhattacherjee, S., Hernández-Castro, J., Moyler, J.: A greedy global framework for LLL, Cryptology ePrint Archive (2023)

    work page 2023

  4. [3]

    et al.: Backtesting Quantum Computing Algorithms for Portfolio Optimization, IEEE Transactions on Quantum Engineering, vol

    Carrascal, G., Hernamperez, P. et al.: Backtesting Quantum Computing Algorithms for Portfolio Optimization, IEEE Transactions on Quantum Engineering, vol. 5, pp. 1-20, Art no. 3100220, doi: 10.1109/TQE.2023.3337328 (2024)

    arXiv 2024

  5. [4]

    Chen, Y.: Quantum Algorithms for Lattice Problems, Cryptology ePrint Archive, Paper 2024/555, https://eprint.iacr.org/2024/555 (2024)

    work page 2024

  6. [5]

    N., Solano, E.: Digitized-counterdiabatic quantum factorization, arXiv preprint arXiv:2301.11005 (2023)

    Hegade, N. N., Solano, E.: Digitized-counterdiabatic quantum factorization, arXiv preprint arXiv:2301.11005 (2023)

    arXiv 2023

  7. [6]

    Factoring integers with sublinear resources on a superconducting quantum processor

    Khattar, T., Yosri, N.: A comment on "Factoring integers with sublinear resources on a superconducting quantum processor", arXiv:2307.09651v2 (2023)

    arXiv 2023

  8. [7]

    Lenstra, A.K., Lenstra, H.W., Lovász, L.: Factoring polynomials with rational co- efficients, Math. Ann. 261, 515-534 (1982)

    work page 1982

Show all 14 references
  1. [8]

    Q., Stehlé, D.: An LLL algorithm with quadratic complexity, SIAM Journal on Computing, 39(3), 874-903 (2009)

    Nguyen, P. Q., Stehlé, D.: An LLL algorithm with quadratic complexity, SIAM Journal on Computing, 39(3), 874-903 (2009)

    2009

  2. [9]

    P.: Average time fast SVP and CVP algorithms factoring integers in polynomial time (2009)

    Schnorr, C. P.: Average time fast SVP and CVP algorithms factoring integers in polynomial time (2009)

    2009

  3. [10]

    In: Davies, D.W

    Schnorr, C.P.: Factoring Integers and Computing Discrete Logarithms via Dio- phantine Approximation. In: Davies, D.W. (eds) Advances in Cryptology - EURO- CRYPT ’91. Lecture Notes in Computer Science, vol 547. Springer, Berlin, Heidel- berg. https://doi.org/10.1007/3-540-46416...

    1991 doi

  4. [11]

    Schnorr, C.P.: Factoring Integers by CVP and SVP Algorithms (2019)

    2019

  5. [12]

    P., Euchner, M.: Lattice basis reduction: Improved practical algorithms and solving subset sum problems, Mathematical programming, vol

    Schnorr, C. P., Euchner, M.: Lattice basis reduction: Improved practical algorithms and solving subset sum problems, Mathematical programming, vol. 66, pp. 181-199 (1994)

    1994

  6. [13]

    W.: Algorithms for quantum computation: discrete logarithms and fac- toring, Proceedings 35th Annual Symposium on Foundations of Computer Science, Santa Fe, NM, USA, pp

    Shor, P. W.: Algorithms for quantum computation: discrete logarithms and fac- toring, Proceedings 35th Annual Symposium on Foundations of Computer Science, Santa Fe, NM, USA, pp. 124-134, doi: 10.1109/SFCS.1994.365700 (1994)

    1994

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.