Quantum circuits constitute Intellectual Property (IP) of the quantum developers and users, which needs to be protected from theft by adversarial agents e.g., the quantum cloud provider or a rogue adversary present in the cloud. This necessitates the exploration of low-overhead techniques applicable to near-term quantum devices, to trace the quantum circuits/algorithms' IP and their output. We present two such lightweight watermarking techniques to prove ownership in the event of an adversary cloning the circuit design. For the first technique a rotation gate is placed on ancilla qubits combined with other gate (s) at the output of the circuit. For the second method, a set of random gates are inserted in the middle of the circuit followed by its inverse, separated from the circuit by a barrier. These models are combined and applied on benchmark circuits and the circuit depth, 2-qubit gate count, probability of successful trials (PST) and probabilistic proof of authorship (PPA) are compared against the state-of-the-art. The PST is reduced by a miniscule 0.53% against the non-watermarked benchmarks and is up to 22.69% higher compared to existing techniques. The circuit depth has been reduced by up to 27.7% as against the state-of-the-art. The PPA is astronomically smaller than existing watermarks.
Quantum circuits constitute Intellectual Property (IP) of the quantum developers and users, which needs to be protected from theft by adversarial agents e.g., the quantum cloud provider or a rogue adversary present in the cloud. This necessitates the exploration of low-overhead techniques applicable to near-term quantum devices, to trace the quantum circuits/algorithms' IP and their output. We present two such lightweight watermarking techniques to prove ownership in the event of an adversary cloning the circuit design. For the first technique a rotation gate is placed on ancilla qubits combined with other gate (s) at the output of the circuit. For the second method, a set of random gates are inserted in the middle of the circuit followed by its inverse, separated from the circuit by a barrier. These models are combined and applied on benchmark circuits and the circuit depth, 2-qubit gate count, probability of successful trials (PST) and probabilistic proof of authorship (PPA) are compared against the state-of-the-art. The PST is reduced by a miniscule 0.53% against the non-watermarked benchmarks and is up to 22.69% higher compared to existing techniques. The circuit depth has been reduced by up to 27.7% as against the state-of-the-art. The PPA is astronomically smaller than existing watermarks.
Quantum computing represents a burgeoning computational paradigm that significantly advances the resolution of contemporary intricate problems across various domains, including cryptography, chemistry, and machine learning. Quantum circuits tailored to address specific problems have emerged as critical intellectual properties (IPs) for quantum computing companies, attributing to the escalating commercial value of quantum computing. Consequently, designing watermarking schemes for quantum circuits becomes imperative to thwart malicious entities from producing unauthorized circuit replicas and unlawfully disseminating them within the market. Unfortunately, the prevailing watermarking technique reliant on unitary matrix decomposition markedly inflates the number of 2-qubit gates and circuit depth, thereby compromising the fidelity of watermarked circuits when embedding detectable signatures into the corresponding unitary matrices. In this paper, we propose an innovative multi-stage watermarking scheme for quantum circuits, introducing additional constraints across various synthesis stages to validate the ownership of IPs. Compared to the state-of-the-art watermarking technique, our multi-stage watermarking approach demonstrates, on average, a reduction in the number of 2-qubit gates by 16% and circuit depth by 6%, alongside an increase in the fidelity of watermarked circuits by 8%, while achieving a 79.4% lower probabilistic proof of authorship.
We introduce a barrier-free watermarking framework for quantum circuits that embeds authorship as a controlled measurement bias on dedicated ancilla qubits while preserving the functional behavior of the original computation when the ancillas are ignored. Each watermark block prepares an ancilla and couples it once to a selected work qubit using an interaction that preserves the ancilla's measurement statistics, and blocks are placed before measurement to avoid compiler reordering across readout. Because the watermark is defined by a statistical property rather than a specific gate pattern, it is designed to remain verifiable after standard transpilation and hardware mapping. We provide a Qiskit implementation and an evaluation protocol that measures watermark detectability, functional impact on the circuit output distribution, and performance overhead. Experiments on RevLib benchmarks, simulator backends, and IBM quantum hardware show that the watermark can be detected reliably while introducing only modest degradation under typical NISQ noise levels, with the tradeoff becoming more pronounced as circuit depth increases.
Quantum cloud platforms have become the most widely adopted and mainstream approach for accessing quantum computing resources, due to the scarcity and operational complexity of quantum hardware. In this service-oriented paradigm, quantum circuits, which constitute high-value intellectual property, are exposed to risks of unauthorized access, reuse, and misuse. Digital watermarking has been explored as a promising mechanism for protecting quantum circuits by embedding ownership information for tracing and verification. However, driven by recent advances in generative artificial intelligence, the paradigm of quantum circuit design is shifting from individually and manually constructed circuits to automated synthesis based on quantum circuit generative models (QCGMs). In such generative settings, protecting only individual output circuits is insufficient, and existing post hoc, circuit-centric watermarking methods are not designed to integrate with the generative process, often failing to simultaneously ensure stealthiness, functional correctness, and robustness at scale. These limitations highlight the need for a new watermarking paradigm that is natively integrated with quantum circuit generative models. In this work, we present the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity. We introduce a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction. Empirical results confirm that our method achieves high-fidelity circuit generation and robust watermark detection across a range of perturbations, paving the way for scalable, secure copyright protection in AI-powered quantum design.
Abstract The success of quantum circuits in providing reliable outcomes for a given problem depends on the gate count and depth in near-term noisy quantum computers. A circuit (that implements a given function) with a low gate count and short depth is more likely to give a correct solution than the circuit variant with a higher gate count and depth. As such, quantum circuit compilers that decompose high-level gates to native gates of the hardware and optimize the circuit play a key role in quantum computing. However, the quality and time complexity of the optimization process can vary significantly especially for practically relevant large-scale quantum circuits. As a result, third-party (often less-trusted/untrusted/unreliable) compilers have emerged, claiming to provide better and faster optimization of complex quantum circuits than so-called trusted compilers. However, untrusted compilers, with their varying adversarial motives ranging from semi-honest to malicious can pose severe security risks such as the theft of sensitive intellectual property (IP) embedded within the quantum circuit. We propose an obfuscation technique for quantum circuits using randomized reversible gates to protect them from such attacks during compilation. The idea is to insert a small random circuit into the original circuit and send it to the untrusted compiler. Since the circuit function is corrupted, the adversary (i.e., an untrusted compiler) may get incorrect IP. However, the user may also get incorrect output post-compilation (even though highly optimized). To circumvent this issue, we concatenate the inverse of the random circuit in the compiled circuit to recover the original functionality. We demonstrate the practicality of our method by conducting exhaustive experiments on a set of benchmark circuits and measuring the quality of obfuscation by calculating the Total Variation Distance (TVD) and Degree of Functional Corruption (DFC) metrics. Our method achieves TVD of up to 1.92, indicating substantial functional corruption, and performs at least 2x better than a previously reported obfuscation method. We also attained a DFC as low as -0.75, approaching the -1 score that represents maximal functional corruption, further ensuring the robustness of our proposed method against IP theft. We also propose a novel adversarial reverse engineering (RE) approach to extract the IP and show that the proposed obfuscation is resilient against RE attacks. The proposed technique introduces minimal degradation in fidelity ( ~ 1% to ~ 3% on average).
Circuit cutting is a novel technique in the field of quantum computing that offers a promising approach for breaking up large quantum circuits into smaller ones that can be executed on smaller quantum computers. Circuit cutting offers a scalable and hybrid computing approach, by combining classical and quantum computers to run large quantum circuits. At the same time, quantum circuits represent the fundamental building blocks of quantum algorithms, and obfuscation techniques are crucial for protecting the sensitive information and intellectual property encoded in these circuits. This paper constitutes the first security analysis of circuit cutting techniques as a means to protect quantum circuits, and not just for cutting bigger quantum circuits to fit on smaller devices. As cloud providers are in control of quantum computers and give access to users, utilizing cloud-based quantum computers for executing quantum circuits involves considerable security risks. This work demonstrates that quantum circuits can be effectively obfuscated by using quantum circuit cutting techniques. If users are worried about an adversary who attempts to reverse-engineer the original quantum algorithm, circuit cutting can be used as a security measure. To further provide configurable obfuscation level, i.e. number of possible circuits that the cloud provider would have to guess, this work proposes a novel dummy-subcircuits technique. This technique introduces dummy subcircuits with additional qubit cut points to create more confusion for the cloud provider and further help to obfuscate the user's original circuits with limited cost.
Variational Quantum Circuits (VQCs) have emerged as a powerful quantum computing paradigm, demonstrating a scaling advantage for problems intractable for classical computation. As VQCs require substantial resources and specialized expertise for their design, they represent significant intellectual properties (IPs). However, existing quantum circuit watermarking techniques suffer from two primary drawbacks: (1) watermarks can be removed during re-compilation of the circuits, and (2) these methods significantly increase task loss due to the extensive length of the inserted watermarks across multiple compilation stages. To address these challenges, we propose BVQC, a backdoor-based watermarking technique for VQCs that preserves the original loss in typical execution settings, while deliberately increasing the loss to a predefined level during watermark extraction. Additionally, BVQC employs a grouping algorithm to minimize the watermark task's interference with the base task, ensuring optimal accuracy for the base task. BVQC retains the original compilation workflow, ensuring robustness against re-compilation. Our evaluations show that BVQC greatly reduces Probabilistic Proof of Authorship (PPA) changes by9.89e−3and ground truth distance (GTD) by 0.089 compared to prior watermarking technologies.