An n-bit general implementation of Shor's quantum period-finding algorithm

Abstract: The goal of this paper is to outline a general-purpose scalable implementation of Shor's period finding algorithm using fundamental quantum gates, and to act as a blueprint for linear optical implementations of Shor's algorithm for both general and specific values of N. This offers a broader view of a problem often overlooked in favour of compiled versions of the algorithm.

\section{Introduction}
The superiority of quantum computers over classical computers for problems
with solutions based on quantum Fourier transform, as well as database search
and quantum simulations continue to attract attention. There are
many approaches proposed for building scalable quantum computers or achieving long-distance and high data-rate quantum
communications. Major model physical systems include nuclear magnetic
resonance, ion trap, neutral atom, cavity QED, solid state, superconducting,
and optical approaches. All of these have their own advantages, but
unfortunately, also their own drawbacks. None of them on its own is shown to
be self-sufficient to build a large-scale practical quantum computer or quantum  networks.

Quantum photonic integrated circuits, based on semiconductor technology and
compatibility with existing microelectronics infrastructure, have been recently
envisioned as the route to utilizable quantum information technologies
enabling robust and compact quantum circuit boards and processors of the next
generation computers and networking devices \cite{c36,c37,c31,c32,c39,c35,c38}.
However, thousands of stable, interconnected interferometers with low-loss and high
performance components are unavoidable for the implementation of practical
large-scale quantum algorithms, since quantum error correcting codes are not
very helpful at that large scale \cite{c37,c35}. Therefore, bulky optical
experiments with only several photons have already started to move toward
stable, miniaturized integrated quantum circuits with many logic gates like
at the heart of classical computers \cite{c36,c37,c35,c38}.

Silica-on-silicon waveguides \cite{c5,c1,c2,c3,c10,c19,c20}, silicon-on
insulator waveguides \cite{c16,c22,c18,c34}, GaN-on-sapphire waveguides
\cite{c14}, direct laser writing \cite{c2,c4,c7,c8,c9,c20,c21,c24}, and
standard lithography techniques \cite{c5,c1,c14,c10,c19,c16,c18,c22,c34} were
chosen as underlying technologies for the implementations of quantum photonic
integrated circuits. Non-classical interference of photon pairs in integrated
optical circuits using a phase controlled Mach-Zehnder interferometer
\cite{c2}, directional coupler \cite{c5, c16}, and integrated two
four-wave mixing waveguide sources in a phase controlled interferometer
\cite{c18} was shown. In 2008, Politi, et al. \cite{c5} demonstrated integrated
optical controlled-NOT gate and path-entanglement. The group later
implemented Shor's quantum algorithm on a photonic chip to factorize 15
\cite{c1}, heralded path-entangled NOON states up to four photons for
high precision quantum metrology \cite{c3}, reconfigurable photonic circuits
for the generation and manipulation of entangled states \cite{c6,c10,c34}, and
manipulation of externally generated single photons \cite{c19}. Sansoni, et al.
\cite{c7} reported the realization of a directional coupler functioning as a
beam splitter for polarization qubits. This work was then extended to
demonstrate the first integrated photonic controlled-NOT gate for polarization
qubits \cite{c8}. Corrielli, et al. showed the capability of performing
arbitrary transformations on polarization qubits in an integrated waveguide
circuit \cite{c24}. Implementations of quantum walk using integrated photonic
waveguides were proposed for potential applications in quantum simulations
\cite{c4, c9}. Single photon detectors with 20\% efficiency \cite{c11} and
photon-number-resolving detectors with 24\% efficiency \cite{c26} using
superconducting nanowires on GaAs ridge waveguides and single-mode waveguide
photon-number-resolving detector with 40\% efficiency \cite{c20} were shown at
telecom wavelengths for photonic quantum circuits. Najafi, et al. \cite{c28}
demonstrated on-chip detection of externally generated entangled photons by
integrating multiple superconducting nanowire single photon detectors. Mower
and Englund proposed a theoretical protocol for on-demand generation of
single and entangled photons on a silicon photonic integrated chip using a
time-multiplexed spontaneous parametric down conversion element \cite{c12}. In
2013, Spring, et al. showed the first single photon source on a silica
photonic chip based on spontaneous four wave mixing with a heralding
efficiency of 40\% \cite{c21}. Spatial multiplexing of heralded single photon
sources on monolithic silicon chip using spontaneous four wave mixing in
photonic crystal waveguides was proposed to increase the heralded photon rate
\cite{c22}. Matsuda, et al. \cite{c29} reported generation and demultiplexing
of photon pairs on a silicon-silica monolithic waveguide platform. Based on
type II-phase matched spontaneous parametric down-conversion processes,
experimental polarization entangled post-selection free photon source
\cite{c25} and theoretical hyperentangled photon pair generation \cite{c15}
were shown. Takesue, et al. \cite{c27} reported an on-chip single-photon
buffering for 150ps based on coupled resonator optical waveguides consisting
of high-Q photonic crystal cavities. Mouradian, et al. \cite{c33} demonstrated
quantum memories with \SI{120}{\micro\second} spin coherence times based on
nitrogen-vacancy centers in a photonic circuit. Metcalf, et al. \cite{c30}
have very recently reported the first experimental demonstration of quantum
teleportation on a reconfigurable integrated photonic chip which performs
entanglement preparation, Bell-state analysis, and quantum state tomography,
similar to the quantum photonic crystal integrated circuits that we envisioned
in 2007 \cite{c31, c32}. Li, et al. \cite{c23} have proposed an experimental
calibration method for quantum photonic integrated circuits that are becoming
increasingly complex. Tezak, et al. \cite{c13} proposed a quantum hardware
description language to facilitate the analysis, design, and simulation of
complex photonic circuits.

Despite all the promising developments above in theory and experiments,
desired level of progress in realization of quantum circuits and algorithms
has not been yet achieved. It is essential to explore large-scale integration
of high quality single and entangled photon sources on demand, long-lived
quantum memories, high-efficiency single photon detectors, reconfigurable
implementations of quantum logic gates and protocols.

Here, we construct a general implementation of Shor's
algorithm for any appropriate n-bit number using quantum logic gates, which
can then be easily translated into quantum photonic integrated circuits based
on directional couplers, interferometers, single-photon sources, detectors,
and other integrated optical devices. This general representation of Shor's
algorithm, as a model, in the physical layer can provide a simple recipe for
both experimentalists and theorists toward large-scale practical
implementations and help foresee the technological and fundamental limits of
photonic integrated circuit approach to determine and focus on the most
important experimental and theoretical requirements and aspects that are
often overlooked.

Shor's quantum factorization algorithm provides a means to easily factor
integers that are the product of two primes. Such numbers, and the difficulty
of factorizing them, provide the basis of the common RSA encryption
algorithm; a polynomial-time factorization method would greatly impact the
effectiveness of this algorithm, with significant influence on the development
of software, particularly when dealing with Internet security.

In section II, we introduce the basic design of Shor's period-finding quantum
circuit and its component modules. In section III, we begin developing basic
arithmetic operations on qubit registers; these are used in section IV to
build low-level modular operations. Section V uses this block to build the
operations necessary to perform modular arithmetic, while section VI details the
use of these block to produce the modular exponentiation module needed by
Shor's period-finding circuit. We conclude in section VII.

Unless otherwise stated, we assume that upper-case variables ($A$, $B$) are $n$-
bit numbers stored in $n+1$-bit registers (the top bit is always a 0, to have
room for addition/multiplication by 2), and lower-case variables are single
bits. A lower-case variable with a subscript indicates a specific bit of a
number, indexed from zero; for example, $a_{2}$ is the third bit of $A$.

\section{Shor's Factorization Algorithm and its Quantum Circuit Representation}
Shor's factorization algorithm contains both classical and quantum processes.
The only section of the algorithm considered to be non-classical consists of a
quantum circuit designed to find the period of a modular exponentiation
function. This circuit can be further broken down into three modules. The
complete quantum circuit is depicted below, using three black boxes:

$$\fastqc{
   \lstick{0} &            \qw &          \qw & \multigate{4}{A^{Y}\%N} &
      \rstick{0} \qw\\
   \lstick{1} &            \qw &          \qw &        \ghost{A^{Y}\%N} &
      \push{A^{Y}\% N} \qw & \meter\\
   \lstick{N} &            \qw &          \qw &        \ghost{A^{Y}\%N} &
      \rstick{N} \qw\\
   \lstick{A} &            \qw &          \qw &        \ghost{A^{Y}\%N} &
      \rstick{A^{2^{n}}\% N} \qw\\
   \lstick{0} & \gate{H_{n+1}} & \push{Y} \qw &        \ghost{A^{Y}\%N} &
      \push{Y} \qw & \gate{{QFT}^{-1}} & \qw & \meter\\
	  & (1.) & & (2.) & & (3.)
}$$

There are two numeric inputs to the circuit: $N$, the number to be factored,
and $A$, some number coprime to $N$ chosen in the classical portion of the
algorithm. All of the qubit registers are $n+1$-bits, where $n$ is the number
of bits needed to represent $N$; that is, $n=\floor{\log_{2}N}+1$.

The first module is a Hadamard transform. Each qubit in the first register is
subjected to a Hadamard gate. Since this register is initialized to zero, the
first register is then in a superposition over all states. The number of gates
required for this module scales linearly as the number of qubits increases.

The second module takes three values, $N$, $A$, and $Y$, and returns $A^{Y}\%N$
where $\%$ denotes the modulo operator. It also requires a number of ancillary
qubits beyond those listed, on the order of $n^{2}$. Note that the
$A^{2^{n}}\%N$ ancillary result comes only from known values and those from the
classical portion of the process, and the 0 register and $N$ registers do not
change, so they can be reclaimed for other uses after the algorithm is
finished.

The third module is an inverse quantum fourier transform, or inverse QFT. A
general form for this component is well-known, and the number of gates scales
quadratically with $n$.

Current efforts at realizing Shor's algorithm using photonic gates has
focused on proof-of-concept methods for specific values, such as 15
\cite{c1} or 21\cite{factor21}. While the first and third modules are well-known
and easily constructed, the modular exponentiation algorithm is more difficult
to construct for a general case. Many experimental attempts to realise Shor's
Algorithm rely on a version of this process optimised for specific constants,
as in \cite{Markov}. These ``compiled'' circuits, while useful for experimental
purposes, are restricted to a small subset of $A$ and $N$ values, and often
obfuscate the nature of the modular exponentiation component. We will focus on
creating the modular exponentiation component for a general case from elementary
gates in a way that is accessible to experimentalists.

\section{Basic Arithmetic Blocks}
\subsection{CDKM Adder $\braces{+}$}
The Cuccaro-Draper-Kutin-Moulton (CDKM) adder is a two's complement
reversible ripple-carry adder that uses no ancillary qubits (counting the
carry bit as part of the output) \cite{Cuccaro}. It acts as the basis of many
of the blocks we describe later, and itself consists of two blocks: majority
and unmajority-and-sum. Several optimisations for the design have emerged
\cite{Thomsen}, but we will be focused on the simplest implementation.

\subsubsection{Majority $\braces{MAJ}$}
The majority block computes $c_{i}\oplus a_{i}$, $a_{i}\oplus b_{i}$, and
$c_{i+1}$ from $c_{i}$, $a_{i}$, and $b_{i}$, where $c_{i}$ is the $i$th carry
value, $a_{i}$ is the $i$th bit of $A$, and $b_{i}$ is the $i$th bit of $B$.
The majority block is implemented using elemetary gates:

$$\fastqc{
   \lstick{c_{i}} &       \qw &     \targ & \ctrl{1} &
      \rstick{c_{i}\oplus a_{i}} \qw \\
   \lstick{b_{i}} &     \targ &       \qw & \ctrl{1} &
      \rstick{a_{i}\oplus b_{i}} \qw \\
   \lstick{a_{i}} & \ctrl{-1} & \ctrl{-2} &    \targ &
      \rstick{c_{i+1}} \qw
}$$

\subsubsection{Unmajority and Sum $\braces{UMS}$}
The unmajority-and-sum block computes $c_{i}$, $s_{i}$, and $a_{i}$ from
$c_{i}\oplus a_{i}$, $a_{i}\oplus b_{i}$, and $c_{i+1}$; that is, from the
outputs of the corresponding majority block.

$$\fastqc{
   \lstick{c_{i}\oplus a_{i}} & \ctrl{1} &     \targ & \ctrl{1} &
      \rstick{c_{i}} \qw \\
   \lstick{a_{i}\oplus b_{i}} & \ctrl{1} &       \qw &    \targ &
      \rstick{s_{i}} \qw \\
             \lstick{c_{i+1}} &    \targ & \ctrl{-2} &      \qw &
      \rstick{a_{i}} \qw
}$$

\cite{Cuccaro} offers an alternative version of the UMS block; for ease of
implementing the controlled adder, we have selected the simpler implementation.

\subsubsection{The Complete Adder}
A pair of these blocks is needed for each bit to be added; for example, a
CDKM adder adding three bits of input would be
$$\fastqc{
   \lstick{0} & \multigate{2}{MAJ} &                \qw &
       \qw &      \qw &                \qw &                \qw &
       \multigate{2}{UMS} &     \rstick{0} \qw\\
   \lstick{b_{0}} &        \ghost{MAJ} &                \qw &
      \qw &      \qw &                \qw &                \qw &
      \ghost{UMS} & \rstick{s_{0}} \qw\\
   \lstick{a_{0}} &        \ghost{MAJ} & \multigate{2}{MAJ} &
      \qw &      \qw &                \qw & \multigate{2}{UMS} &
      \ghost{UMS} & \rstick{a_{0}} \qw\\
   \lstick{b_{1}} &                \qw &        \ghost{MAJ} &
   \qw &      \qw &                \qw &        \ghost{UMS} &
   \qw & \rstick{s_{1}} \qw\\
   \lstick{a_{1}} &                \qw &        \ghost{MAJ} &
   \multigate{2}{MAJ} &      \qw & \multigate{2}{UMS} & \ghost{UMS} &\qw &
   \rstick{a_{1}} \qw\\
   \lstick{b_{2}} &                \qw &                \qw &
      \ghost{MAJ} &      \qw &        \ghost{UMS} &                \qw &
         \qw & \rstick{s_{2}} \qw\\
   \lstick{a_{2}} &                \qw &                \qw &
      \ghost{MAJ} & \ctrl{1} &        \ghost{UMS} &                \qw &
      \qw & \rstick{a_{2}} \qw\\
   \lstick{0} &                \qw &                \qw &
      \qw &    \targ &                \qw &                \qw &
      \qw &     \rstick{c} \qw
}$$
where $c$ denotes the carry bit of the sum. The carry bit is omitted in many
of our uses of the CDKM adder; as one of the addends is preserved, no
information is destroyed by not passing on a carry bit.

\subsection{Controlled CDKM Adder $\braces{+_{C}}$}
A cursory examination of the MAJ and UMS blocks reveals the means to make a
controlled CDKM adder: placing the blocks side-by-side gives

$$\fastqc{
   \lstick{c_{i}} &       \qw &     \targ & \ctrl{1} & \ctrl{1} &     \targ &
      \ctrl{1} & \rstick{c_{i}} \qw \\
   \lstick{b_{i}} &     \targ &       \qw & \ctrl{1} & \ctrl{1} &       \qw &
      \targ & \rstick{s_{i}} \qw \\
   \lstick{a_{i}} & \ctrl{-1} & \ctrl{-2} &    \targ &    \targ & \ctrl{-2} &
      \qw & \rstick{a_{i}} \qw
}$$

Consider the following modification:
$$\fastqc{
   \lstick{c_{i}} &       \qw &     \targ & \ctrl{1} & \ctrl{1} &     \targ &
      \ctrl{1} & \rstick{c_{i}} \qw \\
   \lstick{b_{i}} &     \targ &       \qw & \ctrl{1} & \ctrl{1} &       \qw &
      \targ & \rstick{s_{i}} \qw \\
   \lstick{a_{i}} & \ctrl{-1} & \ctrl{-2} &    \targ &    \targ &
      \ctrl{-2}\qw & \rstick{a_{i}} \qw \\
   \lstick{x} & \ctrl{-1} &       \qw &      \qw &      \qw &       \qw &
      \ctrl{-2} &     \rstick{x} \qw
}$$

If bit $x$ is high, the gates behave as usual; otherwise, the Toffoli gates
do nothing, leaving the central gates to cancel each other out. This disables
a single pair of MAJ/UMJ blocks; hooking the control bit $x$ to every other
pair will similarly disable the entire adder \cite{Markov}. Calling the
modified blocks CMJ and CUS, the controlled CDKM adder is then
$$\fastqc{
       \lstick{0} & \multigate{2}{CMJ} &                \qw &             \qw &
       \qw &                \qw &                \qw & \multigate{2}{CUS} &
       \rstick{0} \qw\\
   \lstick{b_{0}} &        \ghost{CMJ} &                \qw &             \qw &
   \qw &                \qw &                \qw &        \ghost{CUS} &
   \rstick{s_{0}} \qw\\
   \lstick{a_{0}} &        \ghost{CMJ} & \multigate{2}{CMJ} &             \qw &
   \qw &                \qw & \multigate{2}{CUS} &        \ghost{CUS} &
   \rstick{a_{0}} \qw\\
   \lstick{b_{1}} &                \qw &        \ghost{CMJ} &             \qw &
   \qw &                \qw &        \ghost{CUS} &                \qw &
   \rstick{s_{1}} \qw\\
   \lstick{a_{1}} &                \qw &     \ghost{CMJ} & \multigate{2}{CMJ} &
   \qw & \multigate{2}{CUS} &        \ghost{CUS} &                \qw &
   \rstick{a_{1}} \qw\\
   \lstick{b_{2}} &                \qw &                \qw &     \ghost{CMJ} &
   \qw &        \ghost{CUS} &                \qw &                \qw &
   \rstick{s_{2}} \qw\\
   \lstick{a_{2}} &                \qw &                \qw &     \ghost{CMJ} &
   \ctrl{1} &        \ghost{CUS} &                \qw &                \qw &
   \rstick{a_{2}} \qw\\
       \lstick{0} &                \qw &                \qw &             \qw &
       \targ &                \qw &                \qw &                \qw &
       \rstick{c} \qw\\
       \lstick{x} &          \ctrl{-6} &          \ctrl{-4} &       \ctrl{-2} &
       \qw &          \ctrl{-2} &          \ctrl{-4} &          \ctrl{-6} &
       \rstick{x} \qw
}$$

The output of this gate is
$$\fastqc{
   \lstick{B} & \multigate{1}{+_{C}} & \rstick{B+Ax} \qw\\
   \lstick{A} &        \ghost{+_{C}} &    \rstick{A} \qw\\
   \lstick{x} &            \ctrl{-1} &    \rstick{x} \qw
}$$

\subsection{Alternative Addition Blocks}
The CDKM adder presented above is the most intuitive implementation of a
quantum adder, but it is not necessarily the best when used in an actual
implementation. Each MAJ and UMS block uses three quantum gates, which means
$6n$ gates are needed for an $n$-bit adder, and each result relies on the
previous to be computed, so result takes a long time to compute.

Thomsen and Axelsen\cite{Thomsen} offer an optimisation of the ripple-carry
adder that divides a task of $ck$ bits into $c$ independent $k$-bit adders,
which are then combined to give the result in a total of $O\parens{c+k}$ time.
The Thomsen-Axelsen adder, while offering a substantial speedup over a
$ck$-bit CDKM adder, uses substantially more gates: the hardware cost of the
Thomsen-Axelsen adder is $O\parens{n\sqrt{n}}$, while the CKDM adder is linear.
The improvement in runtime is greater asymptotically than the increase in
hardware cost, so substituting the Thomsen-Axelsen adder should for large $n$
offer an overall improvement, but the higher hardware cost could prove
prohibitive for implementations where the expense of added hardware outweighs
the need for fast calculations.

Draper, Kutin, Rains, and Svore\cite{dkrs} propose a carry-lookahead adder
which runs in $O\parens{\log n}$ time, but requires $O\parens{n}$ ancillary
qubits. The additional qubit cost substantially increases the overhead qubits
required for modular exponentiation.

Zalka uses parallelised addition in \cite{zalka2008} to achieve a reduction of
depth of modular exponentiation from $n^{3}$ to $n^{2}$, while remaining in
$O\parens{n^{3}}$ gates and $O\parens{n}$ qubits. We do not consider
parallelisation of Shor's algorithm extensively in this paper, as it
complicates circuit design, but in a physical implementation the change to a
parallel adder can be advantageous.

\subsection{CDKM Subtractor $\braces{-}$}
As it is simply a two's-complement adder, it is simple to adapt a CDKM adder
into a CDKM subtractor. The NOT gate is an inherently reversible operation;
as we know our inputs will be $n$-bit positive integers, the last bit will
always be 0, and thus there is no need for an ancillary carry bit to add 1. A
reversible, $n+1$-bit ``add one'' block for $n$-bit integers is simply a CDKM
adder that substitutes 1 for $A$:

$$\fastqc{
   \lstick{B} & \multigate{1}{+} & \rstick{B+1} \qw\\
   \lstick{1} &        \ghost{+} &   \rstick{1} \qw
}$$

This requires an entire additional $n+1$-bit register, which is inefficient;
however, we can note that the values of this register are constant across all
implementations, and as such can determine the inputs of the $MAJ$ gates. The
lowest-order bit has 1 added and a fixed initial carry of 0, giving
$$\fastqc{
       \lstick{0} &       \qw &     \targ & \ctrl{1} &    \rstick{1 \oplus 0}
         \qw \\
   \lstick{b_{0}} &     \targ &       \qw & \ctrl{1} & \rstick{b_{0}\oplus 1}\\
       \lstick{1} & \ctrl{-1} & \ctrl{-2} &    \targ &         \rstick{c_{1}}
}$$
which is equivalent to
$$\fastqc{
       \lstick{0} &   \qw & \targ &      \qw &      \rstick{1} \qw \\
   \lstick{b_{0}} & \targ &   \qw & \ctrl{1} & \rstick{\neg b_{0}} \qw\\
       \lstick{1} &   \qw &   \qw &    \targ & \rstick{b_{0}} \qw \\
}$$

The subtract one block is similar, but with the other register initialised to
-1 rather than 1. The number of gates cannot be reduced as easily as with the
+1 gate, since all it does is replace CNOT with NOT in the MAJ block.

Combining these with an $n+1$-bit CDKM adder gives an $n+1$-bit CDKM
subtractor:
$$\fastqc{
   \lstick{A} &   \qw &       \qw & \multigate{1}{+} &       \qw &   \qw &
      \rstick{A-B} \qw\\
   \lstick{B} & \targ & \gate{+1} &        \ghost{+} & \gate{-1} & \targ &
      \rstick{B} \qw
}$$

\subsubsection{Controlled CDKM Subtractor $\braces{-_{C}}$}
Creating a controlled subtractor can be accomplished by modifying the regular
subtractor: replace each of the components with a controlled equivalent.
Controlled NOT is an elementary gate, while the +1 block can be replaced by
an ordinary CDKM adder\cite{Cuccaro}:

$$\fastqc{
   \lstick{A} &       \qw &              \qw & \multigate{1}{+_{C}} &
      \rstick{A-Bx} \qw \\
   \lstick{B} &     \targ & \multigate{1}{+} &        \ghost{+_{C}} &
      \rstick{B} \qw \\
   \lstick{x} & \ctrl{-1} &        \ghost{+} &            \ctrl{-1} &
      \rstick{x} \qw
}$$

Note that while the +1 block can be manipulated due to not assuming the value
of the first bit, the -1 block must be changed into a controlled version
directly.

\subsection{CDKM Greater-Equal Comparator $\braces{\ge}$}
To determine if $a\ge N$, we introduce one more modification to the CDKM
adder, the CDKM comparator. The comparator is similar to a subtractor, but
replaces unmajority-and-sum blocks with simple unmajority ($\braces{UMJ}$)
blocks, which are the exact opposite of majority blocks:
$$\fastqc{
   \lstick{c_{i}\oplus a_{i}} & \ctrl{1} &     \targ &       \qw &
      \rstick{c_{i}} \qw \\
   \lstick{a_{i}\oplus b_{i}} & \ctrl{1} &       \qw &     \targ &
      \rstick{b_{i}} \qw \\
             \lstick{c_{i+1}} &    \targ & \ctrl{-2} & \ctrl{-1} &
         \rstick{a_{i}} \qw
}$$

Replacing a CDKM adder's UMS blocks with UMJ blocks changes the output so
that it returns the original inputs and the carry bit only; the sum is not
returned. We shall refer to this as the comparator base block, $\braces{CMB}$.
$$\fastqc{
   \lstick{A} & \multigate{2}{CMB} & \rstick{A} \qw \\
   \lstick{B} &        \ghost{CMB} & \rstick{B} \qw \\
   \lstick{0} &        \ghost{CMB} & \rstick{c} \qw
}$$

In a subtractor, this will simply return $A$ and $-B$, and the carry qubit
will be high if there was a carry from the
subtraction:
$$\fastqc{
   \lstick{A} &   \qw &       \qw & \multigate{2}{CMB} &       \qw &   \qw &
      \rstick{A} \qw \\
   \lstick{B} & \targ & \gate{+1} &        \ghost{CMB} & \gate{-1} & \targ &
      \rstick{B} \qw \\
   \lstick{0} &   \qw &       \qw &        \ghost{CMB} &       \qw &   \qw &
      \rstick{c} \qw
}$$

This carry will only be high if $B$ is strictly greater than $A$; it will be
0 if $B=A$. Thus, we want to know if $B+1$ is strictly greater than $A$; if $B
<A$, then $B+1\le A$ and the carry qubit will be low, while if $B\ge A$, $B+1>
A$ and the bit is high. Thus, by adding one last +1 block, we obtain the
greater-equal form of the CDKM comparator:

$$\fastqc{
   \lstick{A} &       \qw &   \qw &       \qw & \multigate{2}{CMB} &       \qw&
      \qw & \rstick{A} \qw \\
   \lstick{B} & \gate{+1} & \targ & \gate{+1} &        \ghost{CMB} & \gate{-1}&
      \targ & \rstick{B} \qw \\
   \lstick{0} &       \qw &   \qw &       \qw &        \ghost{CMB} &       \qw&
      \qw & \rstick{c} \qw
}$$

\subsubsection{Other Comparator Implementations}
It is possible to implement a faster, but more complex, comparator by modifying
a Thomsen-Axelsen adder in a similar way to the modification of the CDKM adder,
with the corresponding performance increases; simply replace the block
unmajority and sum with block unmajority, and extract the maximum carry with a
CNOT gate and an empty qubit.

\subsection{Doubling Block $\braces{\times 2}$}
Our implementation of multiplication necessitates the ability to multiply the
input $n$-bit numbers by two. Recall that all of the registers are $n+1$-bit;
as we know that $N$ is an $n$-bit number, $A$ cannot be more than $n$ bits.
Thus, a simple series of swaps can be used to multiply $A$ by two. For
instance, in the case where $n=5$,
$$\fastqc{
       \lstick{0} &          \qswap &          \qswap &          \qswap &
          \qswap &          \qswap & \rstick{a_{4}} \qw \\
   \lstick{a_{4}} &             \qw &             \qw &             \qw &
      \qw & \qswap \qwx[-1] & \rstick{a_{3}} \qw \\
   \lstick{a_{3}} &             \qw &             \qw &             \qw &
      \qswap \qwx[-2] &             \qw & \rstick{a_{2}} \qw \\
   \lstick{a_{2}} &             \qw &             \qw & \qswap \qwx[-3] &
      \qw &             \qw & \rstick{a_{1}} \qw \\
   \lstick{a_{1}} &             \qw & \qswap \qwx[-4] &             \qw &
      \qw &             \qw & \rstick{a_{0}} \qw \\
   \lstick{a_{0}} & \qswap \qwx[-5] &             \qw &             \qw &
      \qw &             \qw &     \rstick{0} \qw \\
}$$
It should be simple to see how this can be generalised to an $n$-bit
implementation.

\subsection{Controlled Doubling Block $\braces{{\times 2}_{C}}$}
The controlled doubling block can be constructed simply by attaching all
swaps to the control.

\section{Restricted Modulo Block $\braces{\%}$}
Consider a modulo operation $a\% N$ for the special case of $0\le a<2N$. In
this case, a single controlled subtraction is necessary in order to calculate
the result: if $a\ge N$, subtract $N$ from $a$; otherwise, return $a$ as it
is. This case proves sufficient for constructing the modular exponentiation
block \cite{Markov}.

Using the ancillary qubit from a CDKM greater-equal comparator as the control
bit in a controlled CDKM subtractor gives the desired modulo schematic:

$$\fastqc{
   \lstick{A} & \multigate{2}{\ge} & \multigate{1}{-_{C}}& \rstick{A\% B} \qw\\
   \lstick{B} &        \ghost{\ge} &        \ghost{-_{C}}&     \rstick{B} \qw\\
   \lstick{0} &        \ghost{\ge} &            \ctrl{-1}&\rstick{A\ge B} \qw\\
}$$

The modulus operation requires a single ancillary qubit, which will contain
the value of $A\ge B$.

\section{Specific Modular Calculation Blocks}
\subsection{Modular Addition $\braces{+\%}$}
This modulo operation only works for cases when $0 \le A < 2N$; however, it
will soon become apparent that only this case is necessary to perform modular
exponentiation. First, consider the modular addition of two numbers $A,B
\in\integers_{N}$. By the definition of $\integers_{N}$, $0\le A,B < N$.
Thus, $0\le A+B < 2N$; as such, the modulus part of the operation can be
performed by the simple modulo block above, giving the modular adder as

$$\fastqc{
   \lstick{A} & \multigate{1}{+} &          \qw & \multigate{3}{\%}
      &   \rstick{A+B\%N} \qw \\
   \lstick{B} &        \ghost{+} & \push{B} \qw & \\
   \lstick{N} &              \qw &          \qw &        \ghost{\%}
      &        \rstick{N} \qw \\
   \lstick{0} &              \qw &          \qw &        \ghost{\%}
      & \rstick{A+B\ge N} \qw
}$$

However, this block leaves an ancillary qubit to contain $A+B\ge N$. As
demonstrated in \cite{beauregard2002}, it is possible to clear this bit, by
using the fact that $A+B\%N<B$ if and only if $A+B\ge N$. Thus if we invert
the ancilla when $A+B\%N<B$, it is restored to zero. Recall now that our $CMB$
block will invert a qubit if the second input is greater
than the first; as below, it does so if $B>A+B\%N$, which is what is needed to
clear the ancilla.

$$\fastqc{
   \lstick{A} & \multigate{1}{+} &          \qw & \multigate{3}{\%}
      &   \push{A+B\%N} \qw & \multigate{3}{CMB} & \rstick{A+B\%N} \qw\\
   \lstick{B} &        \ghost{+} & \push{B} \qw &
      &            \push{B} &        \ghost{CMB} & \rstick{B} \qw\\
   \lstick{N} &              \qw &          \qw &        \ghost{\%}
      &        \push{N} \qw & \\
   \lstick{0} &              \qw &          \qw &        \ghost{\%}
      & \push{A+B\ge N} \qw &        \ghost{CMB} & \rstick{0} \qw
}$$

This gives us the modular addition block
$$\fastqc{
   \lstick{A} & \multigate{3}{+\%} & \rstick{A+B\%N} \qw\\
   \lstick{B} &        \ghost{+\%} &      \rstick{B} \qw\\
   \lstick{N} &        \ghost{+\%} &      \rstick{N} \qw\\
   \lstick{0} &        \ghost{+\%} &      \rstick{0} \qw\\
}$$

\subsubsection{Controlled Modular Addition $\braces{{+\%}_{C}}$}
Simply replace the addition block with a controlled addition block. When the
control is off, the addition block is disabled; as we know that $A<N$, the
modular block will not do anything with the addition block disabled.

\subsection{Modular Doubling $\braces{\times2\%}$}
The other important operation to perform is a specific, simpler case of
modular addition: the modular multiplication of $0\le A < N$ by 2. Similarly
to the above, we know that $0\le 2A < 2N$, and the modulus can be taken by
the simple modulo block. Thus, we can achieve the naive modular doubling
operation by means of the doubling block constructed earlier and the naive
implementation of the modular adder above:

$$\fastqc{
   \lstick{A} & \gate{\times2} & \multigate{2}{\%} &  \push{2A\% N} \qw\\
   \lstick{N} &            \qw &        \ghost{\%} &       \push{N} \qw\\
   \lstick{0} &            \qw &        \ghost{\%} & \push{2A\ge N} \qw
}$$

Unlike the above case, we cannot eliminate the ancillary bit through algebra.
Specifying $2A\%N$ and $N$ is not sufficient to find $A$ even if we know $A<N$;
as one counterexample, $N=4$ and $2A\%N=2$ yields $A\in\left\{1,3\right\}$,
but no specific value. Thus, it is necessary in the most general case, where
the inputs are not known classically, to have an ancillary bit containing
$2A\ge N$. In the case that $A$ and $N$ are known classically, it is a simple
matter to clear this bit; it will be shown later that we will be able to do so.

\subsubsection{Controlled Modular Doubling $\braces{{\times 2\%}_{C}}$}
Simply replace the $\braces{\times2}$ block with its controlled counterpart;
as $A<N$ the modulo gate will not do anything once the multiplier is disabled.

\subsection{Modular Multiplication $\braces{\times\%}$}
Using the $+\%$ and $\times 2\%$ blocks, we can construct a block that takes
$A,B,N$, and returns $A+B\%N,2B\%N,N$, as well as two ancillary bits which
will contain $0$ and $2B\ge N$:
$$\fastqc{
   \lstick{A} &  \multigate{3}{+\%} & \qw & \qw & \rstick{A+B\%N} \qw\\
   \lstick{B} &         \ghost{+\%} &                 \qw &
      \multigate{3}{\times2\%} &   \rstick{2B\%N} \qw \\
   \lstick{N} &         \ghost{+\%} &                 \qw &
      \ghost{\times2\%} &       \rstick{N} \qw \\
   \lstick{0} &         \ghost{+\%} &      \push{\,\,0} \qw & &\\
   \lstick{0} &                 \qw &                 \qw &
      \ghost{\times2\%} & \rstick{2B\ge N} \qw
}$$

Making the adder in the $A+B\%N$ block controlled allows this block to
perform a controlled addition of two numbers alongside the doubling:
$$\fastqc{
   \lstick{A} &  \multigate{3}{+\%} & \qw & \qw & \rstick{A+xB\%N} \qw \\
   \lstick{B} &         \ghost{+\%} &                  \qw &
      \multigate{3}{\times2\%} &   \rstick{2B\%N} \qw \\
   \lstick{N} &         \ghost{+\%} &                \qw &
      \ghost{\times2\%} &       \rstick{N} \qw \\
   \lstick{0} &         \ghost{+\%} &   \push{\,\,0} \qw \\
   \lstick{0} &                 \qw &                \qw &
      \ghost{\times2\%} & \rstick{2B\ge N} \qw \\
   \lstick{x} &           \ctrl{-2} &                \qw &
      \qw &       \rstick{x} \qw
}$$

Consider lining up $n$ of these blocks up, indexed 0 to $n-1$, such that the
$k$th block would have the inputs and outputs
$$\fastqc{
       \lstick{S_{k}} & \multigate{3}{+\%} & \qw & \qw
         & \rstick{S_{k+1}=S_{k}+2^{k}xA\%N}
         \qw \\
   \lstick{2^{k}A\%N} &        \ghost{+\%} &
      \qw & \multigate{3}{\times2\%} &   \rstick{2^{k+1}A\%N} \qw \\
           \lstick{N} &        \ghost{+\%} &
            \qw &        \ghost{\times2\%} &             \rstick{N} \qw \\
           \lstick{0} &        \ghost{+\%} &           \push{\,\,0} \qw \\
           \lstick{0} &                \qw &
            \qw &        \ghost{\times2\%} &
               \rstick{2\parens{2^{k}A\%N}\ge N} \qw \\
       \lstick{x_{k}} &          \ctrl{-2} &
         \qw &                      \qw &         \rstick{x_{k}} \qw
}$$
where $S_{0}=0$ and $x_{k}$ denotes the $k$th bit of an $n$-bit number $X$.
While the adders can share an ancillary bit, the doublers each require their
own bit in the general case. If $2^{k}A\forall 0\le k\le n$ and $N$ are not
known classically, this thus requires $n+1$ qubits; if these values are known,
the doublers can share their ancillary bit as well, making only 2 qubits
required.

Without the modulus operation, the resulting sum from all of these blocks is
$$\sum_{k=0}^{n-1} 2^{k}Ax_{k} = A\sum_{k=0}^{n-1} 2^{k}x_{k} = AX.$$ As
addition and multiplication are well-defined modulo $N$, this is in the same
congruence class modulo $N$ as the product with the modulus operations; thus,
the chain of blocks defines the basic modular multiplication block
$$\fastqc{
   \lstick{0} & \multigate{4}{{\times\%}_{B}} & \rstick{AX\% N} \qw \\
   \lstick{A} &        \ghost{{\times\%}_{B}} & \rstick{2^{n+1}A\% N} \qw\\
   \lstick{X} &        \ghost{{\times\%}_{B}} & \rstick{X} \qw \\
   \lstick{N} &        \ghost{{\times\%}_{B}} & \rstick{N} \qw \\
   \lstick{\mbox{$n^{*}$+1 ancilla}} &   \ghost{{\times\%}_{B}} &
                   \rstick{\mbox{$n^{*}$+1 ancilla}} \qw
}$$
where the mark $n^{*}$ is used to indicate the difference in ancilla required
if $2^{k}A$ and $N$ are or are not classically known. In the case where no
values are known classically, the multipliation requires five full registers;
in the case where all $2^{k}A$ and $N$ are known classically, it requires only
2 ancillary bits and four registers, but two of the registers are used to store
classical values. Thus, to multiply some quantum register $X$ by a known
classical value $A$ modulo a classical value $N$ requires $2n+4$ qubit
registers, all of which contain results after the operation finishes.

Note that with the basic block, an empty register is required at the outset,
but no empty register is provided at the close; this could pose an issue when
laying blocks in succession. However, when $N$ is odd and $A$ is coprime to
$N$ (both of can be assumed for Shor's algorithm), a solution to this issue
presents itself. When $A$ and $N$ are both classically known, it is a simple
matter to determine $A^{-1}$ modulo $N$ classically prior to the algorithm;
when $A$ is not classically known, \cite{proos2004} details an
$O\parens{n^{2}}$ implementation of the quantum extended Euclidean algorithm
for coprime $A$ and $N$, which can likewise determine $A^{-1}$.

We know that $N$ is odd (if $N$ were even it would have a trivial factor of
2, making Shor's algorithm unnecessary), and thus $2^{n+1}$ has an inverse
modulo $N$; as both $N$ and $2^{n+1}$ are classically knowable, we can
preconstruct a circuit to multiply by $\parens{2^{n+1}}^{-1}$ mod $N$;
no information is lost, as multiplying by $2^{n+1}$ reverses it.

We now construct the circuit
$$\fastqc{
   \lstick{0} & \multigate{3}{{\times\%}_{B}}
      & \qw
      & \qw
      & \push{AX\% N} \qw
      & \qswap \qwx[2]
      & \multigate{3}{{\times\%}_{B}}
      & \rstick{0} \qw\\
   \lstick{A} &        \ghost{{\times\%}_{B}}
      & \gate{\times \parens{2^{n+1}}^{-1}\% N}
      & \multigate{2}{{}^{-1}\%}
      & \push{A^{-1}\% N} \qw
      & \qw
      & \ghost{{\times\%}_{B}}
      & \rstick{2^{n+1}A^{-1}\% N} \qw\\
   \lstick{X} &        \ghost{{\times\%}_{B}}
      & \rstick{X} \qw
      &
      & \lstick{X}
      & \qswap
      & \ghost{{\times\%}_{B}}
      & \rstick{AX\% N} \qw\\
   \lstick{N} &        \ghost{{\times\%}_{B}}
      & \qw
      & \ghost{{}^{-1}\%}
      & \push{N} \qw
      & \qw
      & \ghost{{\times\%}_{B}}
      & \rstick{N} \qw
}$$
After the last multiplication, the top register holds $X\oplus A^{-1}AX\% N$,
which clearly cancels to 0 in all cases. It is a simple matter of again
multiplying by $\parens{2^{n+1}}^{-1}$ then reversing the modular inverse gate
(which has the added benefit of clearing its ancilla) to yield the modular
multiplication block
$$\fastqc{
   \lstick{0} & \multigate{3}{\times\%} & \rstick{0} \qw\\
   \lstick{A} &        \ghost{\times\%} & \rstick{A} \qw\\
   \lstick{X} &        \ghost{\times\%} & \rstick{AX\%N} \qw\\
   \lstick{N} &        \ghost{\times\%} & \rstick{N} \qw\\
}$$
This block contains two basic modular multiplications which each use $n^{*}+1$
ancillary bits, though the $+1$ can be recycled, leaving $2n^{*}$ uncleared
ancilla. There are two modular multiplication blocks and two modular inverse
blocks, all with performance $O\parens{n^{2}}$, so this block also is
$O\parens{n^{2}}$

\subsubsection{Controlled Modular Multiplication $\braces{{\times\%}_{C}}$}
There are multiple ways to construct a controlled multiplication block. The
most obvious means is to simply replace all of the adders with a controlled
version. Alternately, adding an additional register and two sets of $n+1$
Fredkin gates gives
$$\fastqc{
   \lstick{1} & \qswap \qwx[2] & \qw & \qswap \qwx[2] & \rstick{1} \qw\\
   \lstick{0} &    \qw & \multigate{4}{\times\%} & \qw & \rstick{0} \qw\\
   \lstick{A} & \qswap & \ghost{\times\%} & \qswap
      & \rstick{A}\qw\\
   \lstick{X}    & \qw & \ghost{\times\%} & \qw & \rstick{A^{c}X\% N} \qw \\
   \lstick{N}    & \qw & \ghost{\times\%} & \qw & \rstick{N} \qw \\
   \lstick{\mbox{$2n^{*}$ ancilla}}
      & \qw & \ghost{\times\%} & \qw & \rstick{\mbox{$2n^{*}$ ancilla}} \qw\\
   \lstick{c} & \ctrl{-4} & \qw & \ctrl{-4} & \rstick{c} \qw
}$$
This construction reduces the number of controls needed, which reduces the
complexity of the overall circuit. It even does not impact the number of
ancillary bits; simply make the clearing of the bit after each doubling be
controlled by the control bit as well, and clear based on classically-known
values if the control states that the multiplication is being performed.

There is no clear advantage of one control implementation over another; the
naive implementation requires more complex gates, and introduces a large
number of controls, while the Fredkin implementation requires an additional
full register of $n+1$ qubits. In the modular exponentiation case, we will
omit the register needed for the Fredkin implementation.

\subsubsection{Alternate Modular Multiplication Blocks}
Markov and Saeedi\cite{Markov} construct several multiplication blocks for
specific values of $A$ and/or $N$, which offer significant advantages to the
circuit above in exchange for loss of generality. They also propose a distinct
implementation of the modular multiplication block which uses a
division-with-remainder method, as opposed to the repeated-addition method
proposed above. This requires $\floor{\log_{2} A}+n+1$ ancillary bits, more
than the circuit proposed above, but offers significant advantages for some
values of $A$ and $N$, particularly when $A^{2}<N$.

\section{Modular Exponentiation for Shor's Algorithm}
In our implementation of Shor's algorithm, we wish to take a non-classically
determined value $A$ and raise it to a superposition of exponents modulo $N$,
where $N$ is an input parameter (and thus classically known). We will do so by
repeated multiplication by $A^{2^{k}}\%N$ for $0\le k\le n$, using $n+1$
modular multiplication blocks.

The $k$th multiplication block is of the form
$$\fastqc{
   \lstick{0}
      & \multigate{3}{{\times\%}_{C}}
      & \rstick{0} \qw\\
   \lstick{A^{2^{k}}}
      & \ghost{{\times\%}_{C}}
      & \rstick{A^{2^{k}}} \qw\\
   \lstick{P_{k}}
      & \ghost{{\times\%}_{C}}
      & \rstick{P_{k+1} = P_{k}A^{2^{k}y_{k}}\% N} \qw\\
   \lstick{N}
      & \ghost{{\times\%}_{C}}
      & \rstick{N} \qw\\
   \lstick{y_{k}}
      & \ctrl{-1}
      & \rstick{y_{k}} \qw
}$$
where $P_{0}=1$. It is then necessary to square $A^{2^{k}}$ modulo $N$ between
multiplication blocks, as we are working with $A$ not classically known.

For this we will use a naive implementation requires an additional
$n+1$-qubit register into which $A^{2^{k}}\%N$ is copied using CNOT gates,
followed by an additional modular multiplication, which thus requiresa totoal
of $3n+2$ qubits, one of which is recyclable prior to the end of the
calculation. More effective quantum circuits for modular square are not
considered in this paper, and none were readily found in literature;
implementations of Shor's algorithm for general $N$ focus on classically known
$A$, as $A$ can be easily determined classically in the typical case. Thus,
our consideration of this is largely to demonstrate the advantages of a
partially-classical circuit over a purely quantum one.

Modular exponentiation of classically unknown $A$ thus requires five input
registers and $3n^{2}+n+1$ ancillary qubits, for a total of $3n^{2}+6n+6$
qubits. In the case where $A$ is classically known, the modular multiplication
blocks do not have any unclearable ancillary bits, requiring a total of 1
ancillary bit each, and it is not necessary to perform a quantum modular
square at all ($A^{2^{k}}\%N$ can be found classically for all $k$), reducing
the number of qubits needed to $5n+6$ (one ancillary bit and five registers).

\section{Conclusion}
We construct an $n$-bit implementation of modular exponentiation $A^{x}\%N$
which only requires that $N$ be classically known, and the corresponding
implementation where $A$ and $N$ are both classically known. This circuit uses
$O\parens{n^{3}}$ gates, or equivalently $O\parens{\parens{\log N}^{3}}$
gates; this concurs with theoretical expectations of the period-finding routine.
When $A$ is classically known, the number of ancillary qubits drops off and
reduces to be comparable to other general-$N$ implementations of Shor's
algorithm. This requires a general case of $3n^{2}+6n+6$ qubits, which can be
reduced to $5n+6$ in the event of a classically-known value of $A$ (assuming
that modifications can be made to the circuit based on that classical value),
clearly illustrating the advantages of classical control over $A$. This
$O\parens{\parens{\log N}^2}$ gate count is the best we have found for
classically unknown $A$, while $O\parens{n}$ is the minimum necessary to
perform Shor's Algorithm on general $N$. The circuit also operates in
$O\parens{n^{3}}$ depth, as it is not parallellised.

There are numerous variations on the circuit, which offer various advantages
and disadvantages. Table \ref{tab:comparison} lists a comparison of our
construction with other implementations of modular exponentiation; in most
cases, it offers situational advantages over other implementations: it has more
effective asymptotic behaviour in one area and worse in another. While
\cite{beckman1996} and \cite{vedral1996} offer similar asymptotic behaviour to
our own circuit, the former is designed for ion-trap hardware and the latter
requires more non-asymptotic qubits.

\begin{table}
   \begin{tabular}{|c|c|c|c|}
   \hline
      Implementation
         & Depth
         & Gates
         & Qubits\\ \hline
      \cite{beauregard2002}
         & $O\parens{n^{3}}$
         & $O\parens{n^{3}\log n}$
         & $O\parens{n}$\\ \hline
      \cite{pavlidis2013}
         & $O\parens{n^{2}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\ \hline
      \cite{pham2013}
         & $O\parens{\log^{2} n}$
         & $O\parens{n^{4}}$
         & $O\parens{n^{4}}$\\ \hline
      \cite{meter2005}
         & $O\parens{n^{2}\log n}$
         & $O\parens{n^{3}}$
         & $O\parens{n^{2}}$\\ \hline
      \cite{kutin2006}
         & $O\parens{n^{2}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\ \hline
      \cite{zalka2008}
         & $O\parens{n^{2}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\
      (two algorithms)
         & $O\parens{n}$
         & $O\parens{n^{2}}$
         & $O\parens{n^{1.2}}$\\ \hline
      \cite{fowler2004}
         & $O\parens{n^{3}}$
         & $O\parens{n^{4}}$
         & $O\parens{n}$\\ \hline
      \cite{beckman1996}
         & $O\parens{n^{3}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\ \hline
      \cite{vedral1996}
         & $O\parens{n^{3}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\ \hline
      Current Work
         & $O\parens{n^{3}}$
         & $O\parens{n^{3}}$
         & $O\parens{n}$\\ \hline
   \end{tabular}
   \caption{Asymptotic comparison of select Shor's Algorithm implementations}
   \label{tab:comparison}
\end{table}

The number of gates required is linear for a single adder and the derived
blocks, quadratic for multiplication, and cubic for exponentiation, which is
in keeping with the general circuits discussed in passing by \cite{Markov} in
comparison to their linear specific-case circuits.

There are two clear avenues for further work: first, developing a means to
square a number modulo $N$ (a non-reversible operation by itself) on fewer
than $n+1$ ancillary qubits and in less than $O\parens{n^{2}}$ time should be
possible, but no implementation was discovered as this paper was being
written; all reviewed implementations of Shor's algorithm using repeated
modular multiplication focused on classically-known values of $A$. This is
largely a matter of curiosity, to determine how a quantum $A$ might work, as
$A$ can be determined classically rather simply.

Further, we do not consider the impact of error correction on our circuit,
instead focusing on simply constructing the framework. An actual implementation
would likely require error correction, and thus it would be necessary to
determine any consequences that an appropriate scheme might have on the design
and performance of the circuit.

While compiled circuits can use much smaller numbers of qubits, and are thus
often more useful for experimental tests, they lose out on generality. A
general formulation gives a broader view of the problem which the compiled
circuits may overlook, and is necessary for any practical realisation of the
algorithm in the future. Our proposed general implementation of Shor's
algorithm provides a blueprint for large-scale quantum photonic integrated
circuit realizations.


Long Short-Term Network Based Unobtrusive Perceived Workload Monitoring with Consumer Grade Smartwatches in the Wild

Abstract: Continuous high perceived workload has a negative impact on the individual's well-being. Prior works focused on detecting the workload with medical-grade wearable systems in the restricted settings, and the effect of applying deep learning techniques for perceived workload detection in the wild settings is not investigated. We present an unobtrusive, comfortable, pervasive and affordable Long Short-Term Memory Network based continuous workload monitoring system based on a smartwatch application that monitors the perceived workload of individuals in the wild. We make use of modern consumer-grade smartwatches. We have recorded physiological data from daily life with perceived workload questionnaires from subjects in their real-life environments over a month. The model was trained and evaluated with the daily-life physiological data coming from different days which makes it robust to daily changes in the heart rate variability, that we use with accelerometer features to asses low and high workload. Our system has the capability of removing motion-related artifacts and detecting perceived workload by using traditional and deep classifiers. We discussed the problems related to in the wild applications with the consumer-grade smartwatches. We showed that Long Short-Term Memory Network outperforms traditional classifiers on discrimination of low and high workload with smartwatches in the wild.

\section{Introduction}
 \begin{figure}
\centering
\includegraphics[width= 0.54\columnwidth]{ECG_PPG.jpg}
\caption{The difference between the IBI data obtained from an ECG sensor and a PPG sensor. ECG data has a structure which composes of P, Q, R, S, T data points \cite{Poungponsri2013AnAF} whereas we can only obtain peaks from PPG data for capturing heartbeats. }
\label{diff_IBI_PPG}
\end{figure}
Ongoing high levels of perceived workload can have a negative impact on the well-being and health \cite{stressworkload}. Recent research has revealed concerning rates of anxiety and depression among university students \cite{Bayram2008}. Every individual can perceive a task with different levels of workload. For example, for a Computer Science student, writing a program to compute Fibonacci numbers may be easy, but it would be hard for a student from the philosophy department.  Traditionally, perceived workload can be assessed with self-reports. However, collecting these reports can be a challenging task.  In recent years, researchers experimented with wearable sensor technologies for identifying high workload. However, many of the investigated technologies were high-end sensor systems like full-lead  electrocardiography (ECG) \cite{RAHHAL2016340}  and  electroencephalography  (EEG) \cite{Fan2018}, which do not provide high-comfort.  Consumer-grade out-of-the-box smartwatches and smartbands can be used to monitor the perceived workload in daily life because they are unobtrusive, comfortable to wear and cost-efficient. Modern smartwatches are promising candidates for daily life perceived workload detection since they are equipped with built-in sensors including heart rate monitor, accelerometer and gyroscope. The photoplethysmography (PPG) based heart rate monitoring (HRM) units  of popular smartwatches such as Samsung Gear Series and Apple Watch provide less data than high-end sensor systems (sampling frequency 1000+ Hz vs less than 100 Hz) and more vulnerable to the artifacts which make the decision process of the proposed system harder (see Figure \ref{diff_IBI_PPG} for IBI data comparison of ECG and PPG sensors).  Generally, the number of valid RR intervals from full-lead ECG signals is about 99\%, whereas the same value for the smartwatches  can drop to 50\% \cite{Can2019} which makes the system developed in the laboratory to fail in the wild settings.

Perceived workload detection in the wild settings is harder than laboratory settings, due to the dependence on the self-reports, selection of unobtrusive devices and less information about the task that the user is engaging. More sophisticated approaches for daily life settings are required.

\indent Recently, more and more engineering problems have been solved with Recurrent Neural Networks (RNN)  since they are powerful tools with high performance. For automatic workload detection systems using physiological data, researchers needed a neural network that could take advantage of the sequential structure of the data. Long Short-Term Memory Network (LSTM) is a particular type of RNN. It was defined by
Hochreiter and Schmidhuber in 1997 \cite{hochreiter1997long} to alleviate the long-term dependency problem of RNN \cite{Alhagry2017}. Because of the vanishing/exploding gradient problem as a result of backpropagation through time in a standard RNN, a long sequential data could be hard to learn \cite{Alhagry2017}. In LSTM, instead of an RNN cell, a gated LSTM cell is used to cope with this problem. This makes LSTM suitable for sequential data classification. Chauchan et al. \cite{Chauhan2018} showed that LSTM can be implemented on a smartwatch and a smartphone, and works faster than the shallow SVM.

\indent In this study, we improved the state of the art by combining two important features as shown in Table \ref{table:relatedwork}. First, our system tested and trained in the wild with self-reported questionnaires without any restriction of a certain task, and with the consumer-grade smartwatches which makes it scalable. Most of the previous works are tested on a certain type of task like the N-Back task less than a week. Detecting workload in the wild settings without restricting the task type is more challenging. Ground truth collection is solely based on questionnaires in the wild whereas the workload level is known at any moment in the restricted environments. When the unrestricted movements and resulting artifacts, low data quality of unobtrusive devices, subjectivity of the perceived workload obtained from questionnaires are taken into account, the performance of perceived workload detection systems in the wild is lower than the systems tested in the laboratory environments.

Second,  to the best of our knowledge, our work is the first attempt that applies LSTM for daily life perceived workload detection with consumer-grade smartwatches. We compared the prediction performance of LSTM with a shallow network and the traditional machine learning algorithms on the perceived workload data coming from daily life.

The rest of the paper is organized as follows: In Section \ref{chaptertwo}, we present the related work for automatic workload detection systems in daily life. In Section \ref{methodology}, we present the proposed smartwatch based workload detection platform. In Section 5, we explained the data collection procedure. In Section \ref{sec:results}, we provide the results of the proposed system. In Section \ref{discussion}, we evaluate the findings of the study and future work of the current research.

\section{Related Works}
\label{chaptertwo}

In the early workload studies with wearables, data from the different physiological modalities were collected in laboratory environments and over 90\% accuracy was achieved for detecting two levels of workload \cite{Fan2018}. However, researchers noticed that affect levels experienced in the laboratory environments are different when compared to the real-life situation affect levels \cite{PicardLab2016}.
Cinaz et al. \cite{Cinaz:2013:MMW:2434601.2434680} developed an ECG chest belt based perceived workload detection system, they trained their model in the laboratory and applied in an office environment. They used Linear Discriminant Analysis (LDA), K-Nearest Neighbour (kNN) and SVM as the classifier. Their model recognized successfully five out of seven participant's perceived workload during one day. Fan et al. \cite{Fan2018} developed an EEG based perceived workload detection system and evaluated it in a Virtual Driving environment. They used kNN for the machine learning unit. Schaule et al. \cite{Schaule2018} developed a perceived workload detection scheme using a smartwatch (Microsoft Band 2) which is equipped with Galvanic Skin Response (GSR), HRV and Skin Temperature (ST) sensors with Naive Bayes, kNN and Random Forest classifiers. They evaluated their approach on the N-Back task with 10 participants for one day.  N-Back task is a protocol used in cognitive science studies to measure the working memory \cite{nback}.  They plan to add an "in-the-wild" application as future work. Munoz et al. \cite{Munoz2016} conducted an SDNN based (which is a feature of the HRV shown in the Table \ref{table:hrv_fatures}) statistical analysis by using LG Watch R, on 9 participants during three consecutive days. They applied the N-Back Task to alleviate the perceived workload.

These studies are conducted in semi-restricted environments  \cite{Munoz2016}, \cite{Cinaz:2013:MMW:2434601.2434680} and \cite{Schaule2018}. Although participants are in ambulatory settings and their movements are not restricted, they follow a pre-arranged schedule or program which makes labeling and assigning the ground truth easier. Also, they collected objective ground-truths along with the questionnaire, which makes their system more accurate but hard for further data collection due to the requirement of a dedicated laboratory settings. Workload detection in unrestricted real-life (daily life) is the most challenging problem since we rely only on personal self-reports as the ground truth. The classification accuracies are lower than those in the laboratory environments and there is a room for improvement in the performance of the daily life perceived workload detection research (see Table \ref{table:relatedwork}) \cite{Schaule2018}. Researchers strive hard to come up with ways to improve the performance of daily life workload detection studies.  As seen from the literature, a system that is designed for daily life settings is required. For the sake of the scalability, the only option to train this system would be based on self-reported questionnaires.

\begin{table}[]
  \caption{Comparison of our work with the previous works on workload detection.}
  \centering
  \label{table:relatedwork}
\resizebox{\columnwidth}{!}{
\begin{tabular}{p{3.5cm}P{1.6cm}P{2cm}P{1.5cm}P{1.7cm}P{1cm}P{1.3cm}P{1.6cm}P{1.3cm}}
\hline
Article         & Device           & Features                                                                           & Method                                                               & Environment     & Classes & Accuracy            &  Participants & Duration \\ \hline
Munoz et al. (2016) \cite{Munoz2016}     & LG Watch  R      & SDNN                                                                               & ANOVA                                                                & N-Back Task     & N/A               & N/A                 & 9           & 3 days   \\  \\ \hline
Fan et al. (2018) \cite{Fan2018}      & EEG              & Statistical, FD,  HOC & kNN                                                                 & Virtual Driving & 2                 & 82 \% recall         & 20          & 6 days   \\ \\ \hline
Cinaz et al. (2013) \cite{Cinaz:2013:MMW:2434601.2434680}    & ECG Chest Belt   & HRV                                                                                & LDA, kNN, SVM            & Office-Work     & 3                 & 71\%                & 7           & 1 day    \\\\ \hline
Schaule et al.  (2018) \cite{Schaule2018}  & Microsoft Band 2 & GSR, HRV, ST                                    & Random Forest, Naive Bayes SVM                & N-Back Task         & 2                 & 66\%*  & 10          & 1 day    \\\\ \hline
Our Work (2019) & Samsung Gear S2  & ACC, HRV                                                                            & LSTM, MLP, SVM Naive Bayes, kNN, Random Forest & In the wild     & 2                 & 70\%                & 17          & 1 month   \\
\hline
\multicolumn{4}{l}{\textsuperscript{*}\footnotesize{Average accuracy is not reported.}}

\end{tabular}

}
\end{table}

 \begin{figure}
\centering
\includegraphics[width= \columnwidth]{HR_ACC.png}
\caption{Data gap and artifact problems caused by motions. When the physical activity (see Accelerometer data in the first subfigure) is increased above some threshold, data gaps have emerged. Furthermore, minor hand movements cause artifacts in data. In the last subfigure, we extracted percentage changes in the IBI data. We marked the artifacts which are more / less from the local average above 20 percent. }
\label{datagap}
\end{figure}

\section{Proposed System Description}
\label{methodology}
In this study, we propose a smartwatch based perceived workload level detection system that works completely in the wild. This system monitors the user's self-reported perceived workload levels in their daily activities without creating any interruption or restriction. The only requirement to use this system is wearing a smartwatch. Daily-life environments create more challenges than controlled laboratory setups \cite{survey}. Artifacts caused by unrestricted movements and loosely worn smartwatches are among these problems. Extremely loose settings lead to artifacts due to lack of skin contact and the PPG sensor is highly affected by the motion artifacts (see Figure \ref{datagap}) \cite{motionppg}. Therefore, we applied artifact detection and removal techniques. After the artifacts are removed, we interpolated the missing data points. Next, the features in Table II are extracted from the sensory signals and fed to the machine learning algorithm for prediction. In order to use this system, pre-trained machine learning models are required.  LSTM classifiers were trained on the feature vectors with generated class labels. We further compared LSTM with a shallow neural network and traditional machine learning algorithms.  The overall diagram of the proposed system is presented in Figure \ref{figurefors2}.

\subsection{Smartwatch Framework}

\begin{table}[]
\caption{Heart rate variability and Acceleration features and their definitions.}
\begin{tabular} {@{}p{0.3\textwidth}p{0.62\textwidth}@{}}
\hline \textbf{Feature} & \textbf{Description} \\ \hline
 \multicolumn{2}{c}{\textbf{Heart Rate Variability Features}}\\ \hline
Mean RR & Mean value of the RR intervals \\
SDNN & standard deviation of the inter-beat interval \\
RMSSD & Root mean square of the successive difference of the RR intervals \\
pNN50 & Percentage of the number of successive RR intervals varying more than 50ms from the previous interval \\
HRV triangular index & Total number of RR intervals divided by the height of the histogram of all RR intervals measured on a scale with bins of 1/128 s \\
TINN & Triangular interpolation of RR interval histogram \\
LF & Power in low-frequency band (0.04-0.15 Hz) \\
HF & Power in high-frequency band (0.15-0.4 Hz) \\
LF/HF & Ratio of LF-to-HF \\
VLF & Power in very low-frequency band (0.00-0.04 Hz) \\
SDSD  & Related standard deviation of successive RR interval differences
\\
\hline
 \multicolumn{2}{c}{\textbf{Acceleration Features}}\\ \hline
Mean X & Mean acceleration over x axis \\
Mean Y & Mean acceleration over y axis \\
Mean Z  & Mean acceleration over z axis\\
Mean ACC MAG &  Mean acceleration over acceleration magnitude axis \\
STD X  & Standard Deviation of acceleration over x axis\\
STD Y  & Standard Deviation of acceleration over y axis\\
STD Z  & Standard Deviation of  acceleration over z axis\\
Energy & FFT energy over mean acceleration magnitude \\

\hline

\\ \hline
\end{tabular}%
\label{table:hrv_fatures}
\end{table}

 Samsung Gear S2 is equipped with the ambient light sensor, PPG sensor for heart rate monitoring, 3D inertial measurement unit with 3D accelerometer and gyroscope and pedometer. Samsung Gear Series run on the Tizen platform. We developed a data collection application for the Tizen Platform Wearable 2.3.2. The acceleration data collection application was developed in our previous works \cite{Ekiz2017}, \cite{hibit} and \cite{Can2019}. The sampling rate of the 3D accelerometer is 20 Hz. In order to compute RR intervals, the smartwatch samples PPG with 100 Hz and calculates each successive beat.   The retrieved RR intervals from the smartwatch application during low and high perceived workload can be seen in Figure \ref{fig:highwslow}. The decrease in HRV can be seen in the case of high workload, from the data gathered by the smartwatches.  We used Samsung Gear S2's haptic feedback functionality to inform participants that the session is finished and they should fill the questionnaire using their smartphones.
 Body and head movements can be used to detect the emotions and arousal level \cite{Ekman1965}. Montepare et al. \cite{Montepare1999} demonstrated video recordings of actors expressing emotions with body movements to the 82 younger and older adults. The face of actors are blurred, thus understanding the facial expression from the video recording is not possible. All videos were silent. Participants correctly identified the emotions expressed by actors in video recordings. From the accelerometer, body movements can be automatically recognised. HRV can be affected by movements also, therefore usage of acceleration along with HRV is required.

 \begin{figure*}
\centering
\includegraphics[width=\textwidth]{latest_diagram.pdf}
\caption{The system diagram of the perceived workload monitoring system.}
\label{figurefors2}
\end{figure*}

\begin{figure}
    \centering
    \includegraphics[width=0.5\columnwidth]{highws.pdf}
    \caption{RR intervals in high and low perceived workload. The variability decreases in high perceived workload.}
    \label{fig:highwslow}
\end{figure}

\subsection{Preprocessing of Physiological Signals}
\label{preprocessing}

All of the preprocessing codes are implemented in MATLAB \cite{matlab}. We developed the preprocessing and feature extraction modules in our previous work \cite{Can2019}. RR intervals are filtered for artifacts by calculating the difference of successive RR intervals. Acceleration and RR signals are divided into 2 minutes long sliding windows with 50\% overlap \cite{Cinaz:2013:MMW:2434601.2434680} , \cite{gjoreski2017monitoring}. We calculated local averages that took 10 points. The RR intervals that are more than 20\% different than the previous point are considered as artifacts \cite{Cinaz:2013:MMW:2434601.2434680}. RR interval artifact data points are removed. The remaining RR intervals are sampled with cubic spline interpolation for further analysis. After the interpolation, the windows containing more than 10\% interpolated RR interval artifacts are excluded from the model. 20 windows are extracted for each session.
\subsection{Feature Extraction}
For each window, 11 HRV \cite{Alberdi201649} (please see HRV guidelines for further references \cite{hrvguideline}) and 8 acceleration features \cite{TangGSRActivity2014} shown in Table \ref{table:hrv_fatures} are calculated. We extracted features from both time and frequency domains which are determined as the most discriminative ones \cite{survey} by using our MATLAB functions along with Vollmer toolbox \cite{MarcusVollmer}.

We calculated the energy of the acceleration by applying FFT. The mean acceleration over each of the axes is calculated as a feature. A total of 19 features are extracted from the RR intervals coming from the heart rate monitoring unit and acceleration signals. The features and their descriptions are shown in Table \ref{table:hrv_fatures}.

\subsection{Feature Selection and Dimensionality Reduction}

Feature selection is very important for the sake of the machine learning classifiers' performance. In this section, we present the feature selection and dimensionality reduction techniques that we used in our study.

\subsubsection{Correlation Based Feature selection}
We use Correlation Based Feature (CFB) selection. We eliminate highly correlated features. We applied the CFB implementation of the Weka toolkit \cite{weka}. CFB selected 5 features from 16 features. The selected features are RMSSD, SD/SD, mean acceleration over \textit{x} axis, mean acceleration over \textit{z} axis and FFT energy over the acceleration magnitude.

\subsubsection{Principal Component Analysis}
Principal Component Analysis (PCA) is a dimensionality reduction technique that transforms variables into uncorrelated principal components. It is widely used in data analysis, previous studies reported that when it is used with machine learning algorithms, their classification performance is enhanced. We selected the covered variance as 80\% in order to avoid over-fitting. PCA is used along with the Support Vector Machine.
\subsection{Classification}

In order to discriminate high and low perceived workload level sessions, we use traditional machine learning classifiers in the Weka Toolkit \cite{weka} and LSTM in Keras \cite{chollet2015keras} which is a high level machine learning library which is written in Python and runs on Tensorflow. The model is trained and evaluated on an NVIDIA DGX-1 cluster \cite{dgx}. We created a general model which is trained with all of the participants by not feeding their personal information, i.e., model do not know who is who. Some works created a personal model \cite{Schaule2018} for each participant. Since deep learning requires more data than traditional classifiers, we feed the data coming from participants into a classifier, this approach is known as a general model in the literature. We applied 10-fold stratified cross-validation where all folds class distribution is equal. The fined tuned parameters for the classifiers are as follows:
\begin{itemize}
    \item Random Forest  with 100 Tress
    \item SVM with Radial Basis Function (RBF) kernel (SVM-RBF)
    \item kNN where N=3.
    \item Naive Bayes
    \item Multilayer Perceptron (MLP) with 1 hidden layer and 5 hidden units.
    \item LSTM 200 neurons and 0.2 dropout
\end{itemize}
\begin{figure*}
    \centering
    \includegraphics[width=0.6\columnwidth]{MLP.jpg}
    \caption{Multilayer Perceptron with one hidden layer and four hidden units. }
    \label{fig:mlp}
\end{figure*}

\begin{figure}
\centering

\includegraphics[ height=2.0in]{LSTM_Cell.png}
\caption{The block diagram of an LSTM cell. $\sigma$ is a sigmoid activation function which maps numbers to a range between 0 and 1. Tanh is a hyperbolic tangent activation
function which maps numbers to a range between -1 and 1. $C_t$ is the memory of block t, $H_t$ is the output of block t, input data is the x, past output (block t-1) is $H_{t−1}$, past memory is $C_{t-1}$ and bias vectors are represented as $b_0, b_1, b_2, b_3$ symbols.}
\label{fig:lstm}
\end{figure}

\begin{figure}
\centering

\includegraphics[ width = 0.8\columnwidth]{LSTM.jpg}
\caption{The block diagram of the LSTM network that we used in our proposed system. Input is the feature vectors computed from sliding windows.}
\label{fig:lstmour}
\end{figure}

MLP is a feedforward artificial neural network \cite{Alpaydin:2010:IML:1734076}. It has a minimum of three layers which  are the input layer, hidden layer(s) and the output layer. The hidden layer (s) uses the activation functions to capture nonlinear  data relations. Therefore, MLPs can discriminate between classes that are nonlinearly separated \cite{Alpaydin:2010:IML:1734076}. We selected them as a representative of a shallow neural network to compare with the used sequential deep learning method. Unipolar Sigmoid Function was used as an activation function in hidden volumes of MLP. We used a shallow MLP with an only one hidden layer to compare a shallow neural network with the deep sequential one.  The MLP used in our system is shown in Figure  \ref{fig:mlp}.
\\
\indent A basic structure of an LSTM cell is demonstrated in Figure \ref{fig:lstm}. The decision of whether the information should be remembered or not is controlled by gates. The previous
data is saved via LSTM cells.  There are three types of gates LSTM uses to decide whether to add or remove the information
in the cell state($C_t$). Forget gate decides to throw away information by using a sigmoid layer. The input gate is the second gate which selects the values to be  updated. It uses a sigmoid layer when making a decision and tanh layer for creating an updated value vector (see Figure \ref{fig:lstm}). The cell state is updated with the reevaluated output of the input gate. The decision of which parts of the cell state is selected as the final output is calculated on the updated cell state and by using a sigmoid layer as seen in Figure \ref{fig:lstm}. The LSTM network that we used in our proposed system is shown in Figure \ref{fig:lstmour}.

For the LSTM networks, we evaluated different number of neurons such as 50, 100, 150, 200 and 250. We also evaluated the effect of the amount of recurrent dropout by applying 0.0, 0.2, 0.4 and 0.6. The fully  connected layer is selected as 25. We also evaluated the LSTM and MLP with different numbers of epochs and we selected 500 as the maximum number of epochs. We will present the best results in terms of the number of epochs.
\section{Experiment Design}
\label{sec:results}
This section evaluates the performance of the proposed daily life perceived workload detection method with traditional classifiers and the LSTM on daily life data obtained from participants.
\begin{figure}
    \centering
    \includegraphics[width=0.2\columnwidth]{our_application.jpeg}
    \caption{The data collection application developed for the Samsung Gear S2 Smartwatch in Tizen Web Framework.}
    \label{fig:datacollection}
\end{figure}
\subsection{Experiment Design}
Prior to the data acquisition, the user receives an informed consent form. Once the user accepts the terms in the informed consent form, he/she can use the application. The data collected using accelerometer and PPG sensors and stored in the memory of the smartwatch.  Answers of 7854 questions from the NASA Task Load Index (NASA-TLX) questionnaire and 374 hours of physiological signals are collected from 17 participants.  The ages were between 23 and 32. The gender distribution is 13 men and 4 women. Since 5 of the participants did not fill the questionnaires regularly, we could not use their data for supervised learning algorithms. Our early users gave us complaints that they were forgetting to fill the questionnaire, to solve this issue, we added the haptic feedback feature in the next versions of our application and the collaboration of the users for filling the questionnaire after the physiological data collection increased. In Figure \ref{fig:datacollection}, a Samsung Gear S2 smartwatch running our application is shown.  The data is collected over a month from each participant. The resulting amount of questions became 5544 and the duration  of the total recording time became 264 hours. Participants were asked to wear a Samsung Gear S2 smartwatch during their everyday life without any restriction. The procedure of the data collection session in non-restricted everyday life is described in Figure \ref{datamethod}. Participants recorded their physiological signals in their daily life with the application that we developed for Samsung Gear S2. We wanted to make the dataset as rich as possible. Evaluating the physiological data of a participant only on the same day may create a bias. In order to discard this bias, participants are allowed to start our application once a day for an hour, i.e., one trial per day per participant is collected. The length of a trial is 60 minutes. At the end of the session, the participant has received a strong vibration signal from the smartwatch and received a NASA-TLX questionnaire containing 21 questions with 6 scales. The perceived workload score is determined with the NASA-TLX questionnaire (see Table \ref{figure:tlx}). Each participant completed 25 sessions. Generally, participants completed the experiment in a month. The trials with the answers of questionnaires where the time-span between the daily life session and the completion of NASA-TLX are more than 30 minutes and sessions where the data quality is less than 50\% quality are not used for supervised learning.   Hence, we could use 3444 questions and 164 hours of sensory data for the rest of the system. The histogram of the remaining NASA-TLX scores (N=164) is shown in Figure \ref{fig:disttlx}.
\begin{figure*}
\centering
\includegraphics[width=\columnwidth]{intothewild_v2.pdf}
\caption{The experiment procedure in non-restricted everyday life environment.}
\label{datamethod}
\end{figure*}

\begin{figure*}

    \centering

    \includegraphics[width=0.35\textwidth]{"distribution_of_nasa-tlx_score".pdf}
            \caption{Histogram of NASA-TLX scores.}

    \label{fig:disttlx}
\end{figure*}

\begin{table}[]
\centering
\caption{NASA-TLX factors, rating scales and questions.}
\begin{tabular}{@{}p{4cm}cp{6cm}@{}}
\toprule
\textbf{Factors} & \textbf{ Rating Scale} & \textbf{Questions}   \\ \midrule
Mental Demand               & Low - High   & How much mental and perceptual activity did you spend for this task?       \\
Physical Demand             & Low - High   & How much physical activity did you spend for this task?                         \\
Temporal Demand             & Low - High   & How much time pressure did you feel in order to complete this task?                    \\
Performance                 & Good - Poor  & How successful do you think you were in accomplishing the goals of the task          \\
Effort                      & Low - High   & How hard did you have to work to accomplish your level of performance?                 \\
Frustration                 & Low - High   & How insecure, discouraged, irritated, stressed, and annoyed were you during this task? \\ \bottomrule
\end{tabular}
\label{figure:tlx}
\end{table}
\subsubsection{Collection of Self-Reports}

NASA-TLX \cite{nasatlx} is used to measure the perceived workload of individuals, developed by Hart and Staveland. First, the subject has to rate 6 items on a scale from 0 to 100 that best indicate his experience in the task. The rating consists of the following items: mental demand, physical demand, temporal demand, own performance, effort, and frustration. Next, pairwise comparison of each scale is demonstrated to the subject who is asked to indicate which of the items represents the most important contributor to the stress. Based on these ratings, the total perceived workload was computed as a weighted average. This makes NASA-TLX suitable for measuring the perceived workload in different types of tasks. NASA-TLX can be implemented on a mobile phone \cite{tlxiphone}, paper \cite{nasatlx} or a computer \cite{tlxcomputer1},  \cite{tlxcomputer2}. The six rating scales, questions and endpoints of the mobile implementation of the NASA-TLX are shown in Table \ref{figure:tlx}. In this study, we used the official application of the NASA-TLX \cite{tlxiphone} for Smartphones. NASA-TLX can also be implemented on the smartwatch framework, however the screen sizes of the current smartwatches make it difficult to fill the questionnaire for participants. We recorded self-report questionnaires at the end of each hour and label each session according to their score. The evaluation of self-reports are still an open question.  Some of the models require laboratory calibration session for each individual \cite{cinaz}, \cite{Gjoreski:2016:CSD:2968219.2968306}. The calibration approach makes the enrollment procedure harder and badly affects the scalability of the solution. We used the approach proposed by Sano et al. \cite{sano}. This approach does not require such an enrollment procedure. The sessions are sorted according to NASA-TLX scores.   We divided the dataset into two parts, first $50\%$ as high workload (N=82) and last $50\%$ as low workload (N=82) as shown in Figure \ref{fig:disttlx}. Thanks to this approach, we were able to analyze a balanced dataset in terms of class distribution.
\subsubsection{Ethics}

The procedure of the methodology used in this study is approved by the Institutional Review Board for Research with Human Subjects of Bogazici University with the approval number 2018/16. Prior to the data acquisition, each participant received a consent form which explains the experimental procedure and its benefits and implications to both the society and the subject. The procedure was also explained vocally to the subject. All of the data are stored anonymously.

\section{Results}

The effect of the selection of the LSTM parameters is shown in Table \ref{lstm:tune}. We applied the recurrent dropout, which is available in the Keras implementation, to our LSTM network. The recurrent dropout is a special type of a dropout developed for LSTMs \cite{Semeniuta}, to prevent overfitting for long-term connections.  We evaluated the number of neurons from 50 to 250  and the amount of recurrent dropout from 0.0 to 0.6. The results show that the selection of parameters has a significant impact on the classification accuracy. We compared the results of the LSTM with the MLP and traditional machine learning algorithms in Table \ref{accuracy}. The LSTM network outperformed the traditional machine learning classifiers.

\begin{table}[!htb]
\caption{The effect of different number of neurons and dropout parameters of LSTM networks on classification performance.}
\label{lstm:tune}
\centering
\begin{tabular}{@{}lllll@{}}
\toprule
\textbf{LSTM Blocks/Dropout} & 0.00 & 0.20     & 0.40     & 0.60     \\ \midrule
50 LSTM Blocks     & 67.50\%         & 67.50\% & 65.62\% & 64.37\% \\
100 LSTM Blocks     & 66.87\%         & 66.87\% & 65.62\% & 65.62\% \\
150 LSTM Blocks     & 65.62\%         & 67.50\% & 65.62\% & 63.12\% \\
200 LSTM Blocks     & 65.62\%         & \textbf{70.00\%} & 65.00\% & 64.37\% \\
250 LSTM Blocks     & 66.25\%         & 68.12\% & 66.87\% & 63.75\% \\ \bottomrule
\end{tabular}
\end{table}

\begin{table}[!htb]
\caption{Performance of different classification algorithms. }
\centering
\begin{tabular}{@{}ll@{}}
\toprule
\textbf{Algorithm} & \textbf{Accuracy} \\ \midrule
Random Forest      & 57.92\%           \\
PCA + Support Vector Machine (RBF)     & 65.24\%          \\
K-Nearest neighbor (N=3)         & 57.92\%        \\
Naive Bayes        & 62.80\%         \\
Multi Layer Perceptron       & 60.98\%          \\
Long Short-Term Memory Network               & \textbf{70.00\%}         \\ \bottomrule
\end{tabular}
\label{accuracy}
\end{table}

Monitoring the perceived workload in the wild is not easy, the best performing model is the PCA+SVM (RBF) with 65.24\% accuracy.   The LSTM improved the performance significantly by achieving 70.00 \% accuracy, therefore the application of the RNN is very promising for the unobtrusive and seamless monitoring of the workload in the wild.
\section{Conclusions}
\label{discussion}
We proposed a perceived workload level monitoring system to be used in the wild settings.  Workload is one of the sources that might lead to negative impact on an individual’s well-being and psychology and that is why it should be monitored closely.  The system trained with self-reports which makes it easily applicable as a smartwatch and smartphone application for the users who want to feed the dataset. We applied the state-of-the-art preprocessing, feature extraction, feature selection, machine learning, and deep learning techniques.  Our system runs on a commercial smartwatch that has rich functionalities. The choice of the device is important because most of the studies use wearables like full-lead ECG or EEG, which are not suitable for the daily life usage due to low comfort, obtrusiveness, and high price. Smartwatches are already part of our daily lives and users do not see them as a burden or obtrusive. This eases the way to adapt our system to daily lives.  However, with these devices, preprocessing and classification techniques of the proposed system gain importance due to the artifacts occur due to motion, a system lacking proper building blocks can easily fail in daily life settings.

\indent Systems that work on unobtrusive consumer-grade smartwatches in the wild would face several additional issues. We tried to find solutions to these problems. The devices might not be properly placed on the subjects, we used the quality measurement of RR intervals and gave visual feedback to the users. Collecting questionnaire data can be hard in daily life settings, a user may forget to fill it due to their busy schedule. We applied haptic feedback thanks to the vibration feature of the smartwatches. This property helped our participants to not forget the filling of the questionnaires. Due to the subjectivity of the questionnaire a model might not fit easily like in the laboratory settings. We tried to solve this issue by conducting a longer period of data collection like a month.

\indent  The supervised methods are evaluated on 164 hours of daily life data and 3444 answers of self-report questions. As seen from the results, LSTM increased the performance of our system approximately 5\% when compared to the best performing classifier.  We demonstrated the importance of the parameter tuning and the application of recurrent dropout for LSTM. Choosing the right parameters in LSTM improves the accuracy of our daily perceived workload detection system.  The results showed that LSTM by its nature fits better with the workload detection problem by using sequential physiological data.  We achieved lower accuracy (70\% vs 90\%) compared to the works carried out in the laboratory. Hence, there is still significant room for improvement for the systems working in the wild settings.  The effect of the smartwatch placement, and tightness of the watch strap should also be evaluated to inform the users for the best usage settings. Even with the haptic feedback of the smartwatch, missing entries can be present. For example, a subject can be in a important meeting where he/she can not reply the questions of the questionnaire. Missing entries of questionnaires with the physiological data can be corrected and used with unsupervised approaches. We believe that the contribution of this study would be useful
especially for students and workers. In particular, it can be potentially beneficial for people who usually experience high workload for a long period of time. By monitoring the workload levels with our unobtrusive daily life applicable system, the productivity of employees could be improved. For instance, if a company detects that a factory worker, pilot, truck driver or soldier experiences enduring high workload levels, they could be given a rest and come back to work as fresh. In this way, possible accidents, negligence could be avoided and the productivity of workers could be improved.

\bibliographystyle{unsrtnat}

Human-Computer Interaction (cs.HC); Machine Learning (cs.LG)