As quantum computers scale, the rise of multi-user and cloud-based quantum platforms can lead to new security challenges. Attacks within shared execution environments become increasingly feasible due to the crosstalk noise that, in combination with quantum computer’s hardware specifications, can be exploited in form of crosstalk attack. Our work pursues crosstalk attack implementation in ion-trap quantum computers. We propose three novel quantum crosstalk attacks designed for ion trap qubits: (i) Alternate CNOT attack (ii) Superposition Alternate CNOT (SAC) attack (iii) Alternate Phase Change (APC) attack. We demonstrate the effectiveness of proposed attacks by conducting noise-based simulations on a commercial 20-qubit ion-trap quantum computer. The proposed attacks achieve an impressive reduction of up to 42.2% in output probability for Quantum Full Adders (QFA) having 6 to 9-qubit output. Finally, we investigate the possibility of mitigating crosstalk attacks by using Residue Number System (RNS) based Parallel Quantum Addition (PQA). We determine that PQA achieves higher attack resilience against crosstalk attacks in the form of 24.3% to 133.5% improvement in output probability against existing Non Parallel Quantum Addition (NPQA). Through our systematic methodology, we demonstrate how quantum properties such as superposition and phase transition can lead to crosstalk attacks and how parallel quantum computing can provide security.
As quantum computers scale, the rise of multi-user and cloud-based quantum platforms can lead to new security challenges. Attacks within shared execution environments become increasingly feasible due to the crosstalk noise that, in combination with quantum computer’s hardware specifications, can be exploited in form of crosstalk attack. Our work pursues crosstalk attack implementation in ion-trap quantum computers. We propose three novel quantum crosstalk attacks designed for ion trap qubits: (i) Alternate CNOT attack (ii) Superposition Alternate CNOT (SAC) attack (iii) Alternate Phase Change (APC) attack. We demonstrate the effectiveness of proposed attacks by conducting noise-based simulations on a commercial 20-qubit ion-trap quantum computer. The proposed attacks achieve an impressive reduction of up to 42.2% in output probability for Quantum Full Adders (QFA) having 6 to 9-qubit output. Finally, we investigate the possibility of mitigating crosstalk attacks by using Residue Number System (RNS) based Parallel Quantum Addition (PQA). We determine that PQA achieves higher attack resilience against crosstalk attacks in the form of 24.3% to 133.5% improvement in output probability against existing Non Parallel Quantum Addition (NPQA). Through our systematic methodology, we demonstrate how quantum properties such as superposition and phase transition can lead to crosstalk attacks and how parallel quantum computing can provide security.
Quantum addition is a vital building block for many quantum applications, yet exact adder architectures exhibit long carry paths and higher depth, increasing their exposure to quantum attacks. This paper presents a security driven evaluation of quantum approximate adders with carryout, having constant depth approximation and benchmarks them against two exact quantum adders. We evaluate resilience against four attack models: (1) Stuck-at∣0⟩/∣1⟩qubit attack, (2) State preparation attack, (3) Gate attack, and (4) Crosstalk attack in multi-tenant scenario. We use an emulator provided by Quantinuum that models its H1 ion trap-based 20-qubit quantum computer to conduct attacks. Our results indicate that approximate adders show higher resilience to noise, state preparation, gate, and crosstalk attacks, with AQA3 outperforming AQA4, which outperforms AQA5, due to increasing gate counts across zero, single CNOT layer, and one Toffoli gate respectively. Exact adders remain more robust against stuck-at∣0⟩/∣1⟩qubit attacks, as their carry propagation structure acts as an error absorbing mechanism, highlighting a security accuracy trade off for selecting adders in error-tolerant quantum applications.
This work presents a novel security attack based on CNOT gate induced crosstalk in superconducting qubit systems. Compared to previous work, this work introduces a double-sided crosstalk attack where attacker's circuits are located on either side of the victim circuit executing in a multi-tenant cloud-based quantum computer. The attacker, a malicious tenant or user, can interfere with, or disrupt, the state of neighboring qubits in the victim tenant or user without direct access to victim's qubits, by taking advantage of interference and crosstalk among the otherwise logically isolated qubits. New aspect of this attack is the location of the attacker's circuits on both sides of the victim. Experimental validation on cloud-based Rigetti quantum devices demonstrates that these attacks can compromise data integrity and cause the victim's circuit's outputs to change. Magnitude of the change is evaluated using total variational distance and tested on number of common benchmarks that can execute on today's quantum computers. This work underscores the need for improved isolation mechanisms and secure scheduling in multitenant quantum computing cloud environments.
Abstract Quantum computing has the potential to provide solutions to problems that are intractable on classical computers, but the accuracy of the current generation of quantum computers suffer from the impact of noise or errors such as leakage, crosstalk, dephasing, and amplitude damping among others. As the access to quantum computers is almost exclusively in a shared environment through cloud‐based services, it is possible that an adversary can exploit crosstalk noise to disrupt quantum computations on nearby qubits, even carefully designing quantum circuits to purposely lead to wrong answers. In this study, the extent and characteristics of crosstalk noise are studied through tomography conducted on IBM Quantum computers, leading to an enhanced crosstalk simulation model. These results indicate that crosstalk noise is a significant source of errors on IBM quantum hardware, making crosstalk based attack a viable threat to quantum computing in a shared environment. Based on the crosstalk simulator benchmarked against IBM hardware, the impact of crosstalk attacks and develop strategies are assessed for mitigating crosstalk effects. Through a systematic set of simulations, the effectiveness of three crosstalk attack mitigation strategies is assessed, namely circuit separation, qubit allocation optimization via reinforcement learning, and the use of spectator qubits, and show that they all overcome crosstalk attack risk with varying degrees of success and help to secure quantum computing in a shared platform.
Quantum computing, while allowing for processing information exponentially faster than classical computing, is far from becoming a personal commodity. Indeed, because of cost and needs for ultra-cold temperature, shielded environment, and complex wiring for control, access to quantum computers is likely to be provided remotely, through quantum servers. Sharing quantum hardware between multiple users enables the efficient use of quantum resources, but makes some security threats possible. For instance, previous studies demonstrated that crosstalk between attacker and victim's qubits can be exploited to mount security attacks. In this work, we address the problem of securing user circuits submitted to quantum servers. We propose the Qubit Allocation for Inter-Circuit Crosstalk Countermeasure (QAICCC), which aims to maximize qubit usage, reduce inter-circuit crosstalk as well as intra-circuit noise. QAICCC performs (1) a crosstalk analysis of the targeted quantum processor to determine qubits involved in crosstalk with the largest intensity; (2) the allocation of qubits in the safest possible way; and (3) the application of existing techniques to further reduce crosstalk between circuits and noise in user circuits. The main contribution is the allocation algorithm, which aims to maximize qubit usage (including making unused qubits available for future usage) while minimizing the largest inter-circuit crosstalk error rate. Thus, QAICCC will support quantum computing adoption by securing the usage of quantum servers by a large number of actors.
We demonstrate an end-to-end, multi-stage attack against a quantum neural network (QNN) model that is executed on a trapped-ion quantum computer. Our chain combines side-channel reconnaissance, crosstalk characterization, adversarial example generation, and a physical crosstalk attack that realizes the adversarial perturbation on the device. We cover the full attack chain on ion traps and report the corresponding superconducting-hardware experiments in the appendix. We discuss implications for QaaS providers and hardware mitigations.
Trapped-ion (TI) quantum bits are a front-runner technology for quantum computing. TI systems with multiple interconnected traps can overcome the hardware connectivity issue inherent in superconducting qubits and can solve practical problems at scale. With a sufficient number of qubits on the horizon, the multi-programming model for Quantum Computers (QC) has been proposed where multiple users share the same QC for their computing. Multi-programming is enticing for quantum cloud providers as it can maximize device utilization, throughput, and profit for clouds. Users can also benefit from the short wait queue. However, shared access to quantum computers can create new security issues. This paper presents one such vulnerability in shared TI systems that requireshuttleoperations for communication among traps. Repeated shuttle operations increase quantum bit energy and degrade the reliability of computations (fidelity). We show adversarial program design approaches requiring numerous shuttles. We propose a random and systematic methodology for adversary program generation. Our analysis shows shuttle-exploiting attacks can substantially degrade the fidelities of victim programs by$\approx 2 \times to\approx 63 \times $. Finally, we present several countermeasures such as adopting a hybrid initial mapping policy, padding victim programs with dummy qubits, and capping maximum shuttles.