As quantum computing gains popularity, it’s crucial to tackle security and privacy issues upfront. One major concern is the involvement of third-party tools and hardware. With more quantum computing services available, even from less reputable sources, users might be drawn in by lower costs and easier access. However, usage of untrusted hardware could present the risk of intellectual property (IP) theft. For instance, popular algorithms like Quantum Approximate Optimization Algorithm (QAOA) encode graph properties in parameterized quantum circuits, opening the door to potential risks. For mission critical applications like power grid optimization, the graph structure can reveal the power grid and their connectivity (an IP that should be protected). To mitigate this risk, we propose an edge pruning obfuscation method for QAOA along with a split iteration methodology. The basic idea is to, (i) create two flavors of QAOA circuit each with few distinct edges eliminated from the problem graph for obfuscation, (ii) iterate the circuits alternately during optimization process to uphold the optimization quality, and (iii) send the circuits to two different untrusted hardware provider so that the adversary has access to partial graph protecting the IP. We demonstrate that combining edge pruning obfuscation with split iteration on two different hardware secures the IP and increases the difficulty of reconstruction while limiting performance degradation to a maximum of 10% ($\approx 5$% on average) and maintaining low overhead costs (less than 0.5X for QAOA with single layer implementation).
As quantum computing gains popularity, it’s crucial to tackle security and privacy issues upfront. One major concern is the involvement of third-party tools and hardware. With more quantum computing services available, even from less reputable sources, users might be drawn in by lower costs and easier access. However, usage of untrusted hardware could present the risk of intellectual property (IP) theft. For instance, popular algorithms like Quantum Approximate Optimization Algorithm (QAOA) encode graph properties in parameterized quantum circuits, opening the door to potential risks. For mission critical applications like power grid optimization, the graph structure can reveal the power grid and their connectivity (an IP that should be protected). To mitigate this risk, we propose an edge pruning obfuscation method for QAOA along with a split iteration methodology. The basic idea is to, (i) create two flavors of QAOA circuit each with few distinct edges eliminated from the problem graph for obfuscation, (ii) iterate the circuits alternately during optimization process to uphold the optimization quality, and (iii) send the circuits to two different untrusted hardware provider so that the adversary has access to partial graph protecting the IP. We demonstrate that combining edge pruning obfuscation with split iteration on two different hardware secures the IP and increases the difficulty of reconstruction while limiting performance degradation to a maximum of 10% (≈5% on average) and maintaining low overhead costs (less than 0.5X for QAOA with single layer implementation).
Quantum computers are currently accessible through a cloud-based platform that allows users to run their programs on a suite of quantum hardware. As the quantum computing ecosystem grows in popularity and utility, it is reasonable to expect more companies, including untrustworthy/untrustworthy/unreliable vendors, to begin offering quantum computers as hardware-as-a-service at various price/performance points. Since computing time on quantum hardware is expensive and the access queue may be long, users will be enticed to use less expensive but less reliable/trustworthy hardware. Less-trusted vendors may tamper with the results and/or parameters of quantum circuits, providing the user with a sub-optimal solution or incurring a cost of higher iterations. In this paper, we model and simulate adversarial tampering of input parameters and measurement outcomes on an exemplary hybrid quantum classical algorithm namely, Quantum Approximate Optimization Algorithm (QAOA). We observe a maximum performance degradation of . To achieve comparable performance with minimal parameter tampering, the user incurs a minimum cost of 20X higher iteration. We propose distributing the computation (iterations) equally among the various hardware options to ensure trustworthy computing for a mix of trusted and untrusted hardware. In the chosen performance metrics, we observe a maximum improvement of ≈ 30%. In addition, we propose re-initialization of the parameters after a few initial iterations to fully recover the original program performance and an intelligent run adaptive split heuristic, which allows users to identify tampered/untrustworthy hardware at runtime and allocate more iterations to the reliable hardware, resulting in a maximum improvement of ≈ .
Abstract The success of quantum circuits in providing reliable outcomes for a given problem depends on the gate count and depth in near-term noisy quantum computers. A circuit (that implements a given function) with a low gate count and short depth is more likely to give a correct solution than the circuit variant with a higher gate count and depth. As such, quantum circuit compilers that decompose high-level gates to native gates of the hardware and optimize the circuit play a key role in quantum computing. However, the quality and time complexity of the optimization process can vary significantly especially for practically relevant large-scale quantum circuits. As a result, third-party (often less-trusted/untrusted/unreliable) compilers have emerged, claiming to provide better and faster optimization of complex quantum circuits than so-called trusted compilers. However, untrusted compilers, with their varying adversarial motives ranging from semi-honest to malicious can pose severe security risks such as the theft of sensitive intellectual property (IP) embedded within the quantum circuit. We propose an obfuscation technique for quantum circuits using randomized reversible gates to protect them from such attacks during compilation. The idea is to insert a small random circuit into the original circuit and send it to the untrusted compiler. Since the circuit function is corrupted, the adversary (i.e., an untrusted compiler) may get incorrect IP. However, the user may also get incorrect output post-compilation (even though highly optimized). To circumvent this issue, we concatenate the inverse of the random circuit in the compiled circuit to recover the original functionality. We demonstrate the practicality of our method by conducting exhaustive experiments on a set of benchmark circuits and measuring the quality of obfuscation by calculating the Total Variation Distance (TVD) and Degree of Functional Corruption (DFC) metrics. Our method achieves TVD of up to 1.92, indicating substantial functional corruption, and performs at least 2x better than a previously reported obfuscation method. We also attained a DFC as low as -0.75, approaching the -1 score that represents maximal functional corruption, further ensuring the robustness of our proposed method against IP theft. We also propose a novel adversarial reverse engineering (RE) approach to extract the IP and show that the proposed obfuscation is resilient against RE attacks. The proposed technique introduces minimal degradation in fidelity ( ~ 1% to ~ 3% on average).
The success of quantum circuits in providing reliable outcomes for a given problem depends on the gate count and depth in near-term noisy quantum computers. Quantum circuit compilers that decompose high-level gates to native gates of the hardware and optimize the circuit play a key role in quantum computing. However, the quality and time complexity of the optimization process can vary significantly especially for practically relevant large-scale quantum circuits. As a result, third-party (often less-trusted/untrusted) compilers have emerged, claiming to provide better and faster optimization of complex quantum circuits than so-called trusted compilers. However, untrusted compilers can pose severe security risks, such as the theft of sensitive intellectual property (IP) embedded within the quantum circuit. We propose an obfuscation technique for quantum circuits using randomized reversible gates to protect them from such attacks during compilation. The idea is to insert a small random circuit into the original circuit and send it to the untrusted compiler. Since the circuit function is corrupted, the adversary may get incorrect IP. However, the user may also get incorrect output post-compilation. To circumvent this issue, we concatenate the inverse of the random circuit in the compiled circuit to recover the original functionality. We demonstrate the practicality of our method by conducting exhaustive experiments on a set of benchmark circuits and measuring the quality of obfuscation by calculating the Total Variation Distance (TVD) metric. Our method achieves TVD of up to 1.92 and performs at least 2X better than a previously reported obfuscation method. We also propose a novel adversarial reverse engineering (RE) approach and show that the proposed obfuscation is resilient against RE attacks. The proposed technique introduces minimal degradation in fidelity (~1% to ~3% on average).
Quantum computing leverages quantum mechanics to achieve computational advantages over classical hardware, but the use of third-party quantum compilers in the Noisy Intermediate-Scale Quantum (NISQ) era introduces risks of intellectual property (IP) exposure. We address this by proposing a novel obfuscation technique that protects proprietary quantum circuits by inserting additional quantum gates prior to compilation. These gates corrupt the measurement outcomes, which are later corrected through a lightweight classical post-processing step based on the inserted gate structure. Unlike prior methods that rely on complex quantum reversals, barriers, or physical-to-virtual qubit mapping, our approach achieves obfuscation using compiler-agnostic classical correction. We evaluate the technique across five benchmark quantum algorithms—Shor’s, QAOA, Bernstein-Vazirani, Grover’s, and HHL—using IBM’s Qiskit framework. The results demonstrate high Total Variation Distance (above 0.5) and consistently negative Degree of Functional Corruption (DFC), confirming both statistical and functional obfuscation. This shows that our method is a practical and effective solution for the security of quantum circuit designs in untrusted compilation flows.
Quantum compilers play a crucial role in quantum computing by converting these algorithmic quantum circuits into forms compatible with specific quantum computer hardware. However, untrusted quantum compilers present considerable risks, including the potential theft of quantum circuit intellectual property (IP) and compromise of the functionality (e.g. Trojan insertion). Quantum circuit obfuscation techniques protect quantum IP by transforming a quantum circuit into a key-dependent version before compilation and restoring the compiled circuit's functionality with the correct key. This prevents the untrusted compiler from knowing the circuit's original functionality. Existing quantum circuit obfuscation techniques focus on inserting key qubits to control key gates. One added key gate can represent at most one Boolean key bit. In this paper, we propose OPAQUE, a phase-based quantum circuit obfuscation approach where we use the angle of rotation gates as the secret keys. The rotation angle is a continuous value, which makes it possible to represent multiple key bits. Moreover, phase gates are usually implemented as virtual gates in quantum hardware, diminishing their cost and impact on accuracy.
An efficient quantum circuit (program) compiler aims to minimize the gate-count - through efficient instruction translation, routing, gate, and cancellation - to improve run-time and noise. Therefore, a high-efficiency compiler is paramount to enable the game-changing promises of quantum computers. To date, the quantum computing hardware providers are offering a software stack supporting their hardware. However, several third-party software toolchains, including compilers, are emerging. They support hardware from different vendors and potentially offer better efficiency. As the quantum computing ecosystem becomes more popular and practical, it is only prudent to assume that more companies will start offering software-as-a-service for quantum computers, including high-performance compilers. With the emergence of third-party compilers, the security and privacy issues of quantum intellectual properties (IPs) will follow. A quantum circuit can include sensitive information such as critical financial analysis and proprietary algorithms. Therefore, submitting quantum circuits to untrusted compilers creates opportunities for adversaries to steal IPs. In this paper, we present a split compilation methodology to secure IPs from untrusted compilers while taking advantage of their optimizations. In this methodology, a quantum circuit is split into multiple parts that are sent to a single compiler at different times or to multiple compilers. In this way, the adversary has access to partial information. With analysis of over 152 circuits on three IBM hardware architectures, we demonstrate the split compilation methodology can completely secure IPs (when multiple compilers are used) or can introduce factorial time reconstruction complexity while incurring a modest overhead (~ 3% to ~ 6% on average).