Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2310.17426 · International Conference on VLSI Design

Stealthy SWAPs: Adversarial SWAP Injection in Multi-Tenant Quantum Computing

Suryansh Upadhyay, Swaroop Ghosh

Published Jan 6, 2024• 10 citations
arXivHTMLPDF

Abstract

Quantum computing (QC) holds tremendous promise in revolutionizing problem-solving across various domains. It has been suggested in literature that 50+ qubits are sufficient to achieve quantum advantage (i.e., to surpass supercomputers in solving certain class of optimization problems). The hardware size of existing Noisy Intermediate-Scale Quantum (NISQ) computers have been ever increasing over the years. Therefore, Multi-tenant computing (MTC) has emerged as a potential solution for efficient hardware utilization, enabling shared resource access among multiple quantum programs. However, MTC can also bring new security concerns. This paper proposes one such threat for MTC in superconducting quantum hardware i.e., adversarial SWAP gate injection in victim’s program during compilation for MTC. We present a representative scheduler designed for optimal resource allocation. To demonstrate the impact of this attack model, we conduct a detailed case study using a sample scheduler. Exhaustive experiments on circuits with varying depths and qubits offer valuable insights into the repercussions of these attacks. We report a max of $\approx 55$% and a median increase of $\approx 25$% in SWAP overhead. As a countermeasure, we also propose a sample machine learning model for detecting any abnormal user behavior and priority adjustment.

DOI
10.1109/vlsid60093.2024.00085

Related papers

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Lee, Wei Jie Bryan, Siyi Wang, Dutta, Suman +2 more

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

arXiv:2502.10115•Feb 14, 2025•0 citations

SHARE: Secure Hardware Allocation and Resource Efficiency in Quantum Systems

Suryansh Upadhyay, Swaroop Ghosh

Quantum computing (QC) is poised to revolutionize problem-solving across various fields, with research suggesting that systems with over 50 qubits may achieve quantum advantage-surpassing supercomputers in certain optimization tasks. As the hardware size of Noisy Intermediate-Scale Quantum (NISQ) computers continues to grow, Multi-tenant computing (MTC) has emerged as a viable approach to enhance hardware utilization by allowing shared resource access across multiple quantum programs. However, MTC can also bring challenges and security concerns. This paper focuses on optimizing quantum hardware utilization in shared environments by implementing multi-programming strategies that not only enhance hardware utilization but also effectively manage associated risks like crosstalk and fault injection. We propose a novel partitioning and allocation method called Community-Based Dynamic Allocation Partitioning (COMDAP) and Secure COMDAP to refine and secure multi-programming capabilities in quantum systems. COMDAP ensures equitable and efficient resource distribution, addresses the issues of suboptimal partitioning, and significantly improves hardware utilization. We report a 23% average improvement in hardware utilization rate compared to existing greedy heuristics, with rates averaging 92%. COMDAP introduces an average increase of approximately 0.05X in$\Delta \mathbf{CX}$, alongside a 3.5% average reduction in PST across benchmarks.

arXiv:2405.00863•IEEE International Conference on Quantum Computing and Engineering (QCE)•Sep 15, 2024•10 citations

Impact of Error Rate Misreporting on Resource Allocation in Multi-tenant Quantum Computing and Defense

Subrata Das, Swaroop Ghosh

Cloud-based quantum service providers allow multiple users to run programs on shared hardware concurrently to maximize resource utilization and minimize operational costs. This multi-tenant computing (MTC) model relies on the error parameters of the hardware for fair qubit allocation and scheduling, as error-prone qubits can degrade computational accuracy asymmetrically for users sharing the hardware. To maintain low error rates, quantum providers perform periodic hardware calibration, often relying on third-party calibration services. If an adversary within this calibration service misreports error rates, the allocator can be misled into making suboptimal decisions even when the physical hardware remains unchanged. We demonstrate such an attack model in which an adversary strategically misreports qubit error rates to reduce hardware throughput, and probability of successful trial (PST) for two previously proposed allocation frameworks, i.e. Greedy and Community-Based Dynamic Allocation Partitioning (COMDAP). Experimental results show that adversarial misreporting increases execution latency by 24% and reduces PST by 7.8%. We also propose to identify inconsistencies in reported error rates by analyzing statistical deviations in error rates across calibration cycles.

arXiv:2504.04285•ACM Great Lakes Symposium on VLSI (GLSVLSI)•Jun 27, 2025•1 citation

Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers

Navnil Choudhury, Chaithanya Naik Mude, Sanjay Das +3 more

As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.

arXiv:2412.10507•Network and Distributed System Security Symposium•Jan 1, 2025•11 citations

Pulse-to-Circuit Characterization of Stealthy Crosstalk Attack on Multi-Tenant Superconducting Quantum Hardware

Syed Emad Uddin Shubha, Tasnuva Farheen

Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.

arXiv:2509.11407•Oct 13, 2025•4 citations

POSTER: Stealthy SWAP-Based Side-Channel Attack on Multi-Tenant Quantum Cloud Systems

Wei Jie Bryan Lee, Siyi Wang, Suman Dutta +2 more

The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.

ACM Asia Conference on Computer and Communications Security (ASIA CCS)•Aug 13, 2025•3 citations
Quantum computing (QC) holds tremendous promise in revolutionizing problem-solving across various domains. It has been suggested in literature that 50+ qubits are sufficient to achieve quantum advantage (i.e., to surpass supercomputers in solving certain class of optimization problems). The hardware size of existing Noisy Intermediate-Scale Quantum (NISQ) computers have been ever increasing over the years. Therefore, Multi-tenant computing (MTC) has emerged as a potential solution for efficient hardware utilization, enabling shared resource access among multiple quantum programs. However, MTC can also bring new security concerns. This paper proposes one such threat for MTC in superconducting quantum hardware i.e., adversarial SWAP gate injection in victim’s program during compilation for MTC. We present a representative scheduler designed for optimal resource allocation. To demonstrate the impact of this attack model, we conduct a detailed case study using a sample scheduler. Exhaustive experiments on circuits with varying depths and qubits offer valuable insights into the repercussions of these attacks. We report a max of ≈55\approx 55≈55% and a median increase of ≈25\approx 25≈25% in SWAP overhead. As a countermeasure, we also propose a sample machine learning model for detecting any abnormal user behavior and priority adjustment.
The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by 81.62%81.62\%81.62% through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as 6.25%6.25\%6.25% of the victim's, achieves 100%100\%100% accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.
Quantum computing (QC) is poised to revolutionize problem-solving across various fields, with research suggesting that systems with over 50 qubits may achieve quantum advantage-surpassing supercomputers in certain optimization tasks. As the hardware size of Noisy Intermediate-Scale Quantum (NISQ) computers continues to grow, Multi-tenant computing (MTC) has emerged as a viable approach to enhance hardware utilization by allowing shared resource access across multiple quantum programs. However, MTC can also bring challenges and security concerns. This paper focuses on optimizing quantum hardware utilization in shared environments by implementing multi-programming strategies that not only enhance hardware utilization but also effectively manage associated risks like crosstalk and fault injection. We propose a novel partitioning and allocation method called Community-Based Dynamic Allocation Partitioning (COMDAP) and Secure COMDAP to refine and secure multi-programming capabilities in quantum systems. COMDAP ensures equitable and efficient resource distribution, addresses the issues of suboptimal partitioning, and significantly improves hardware utilization. We report a 23% average improvement in hardware utilization rate compared to existing greedy heuristics, with rates averaging 92%. COMDAP introduces an average increase of approximately 0.05X inΔCX\Delta \mathbf{CX}ΔCX, alongside a 3.5% average reduction in PST across benchmarks.
Cloud-based quantum service providers allow multiple users to run programs on shared hardware concurrently to maximize resource utilization and minimize operational costs. This multi-tenant computing (MTC) model relies on the error parameters of the hardware for fair qubit allocation and scheduling, as error-prone qubits can degrade computational accuracy asymmetrically for users sharing the hardware. To maintain low error rates, quantum providers perform periodic hardware calibration, often relying on third-party calibration services. If an adversary within this calibration service misreports error rates, the allocator can be misled into making suboptimal decisions even when the physical hardware remains unchanged. We demonstrate such an attack model in which an adversary strategically misreports qubit error rates to reduce hardware throughput, and probability of successful trial (PST) for two previously proposed allocation frameworks, i.e. Greedy and Community-Based Dynamic Allocation Partitioning (COMDAP). Experimental results show that adversarial misreporting increases execution latency by 24% and reduces PST by 7.8%. We also propose to identify inconsistencies in reported error rates by analyzing statistical deviations in error rates across calibration cycles.
As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.
Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.
The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.