Many third-party cloud providers set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. However, there is little visibility to where the execution of the circuit is taking place. This situation is similar to the classical cloud. The difference in the quantum scenario is that the success of the user program is highly reliant on the backend used. Besides, the third-party provider may be untrustworthy and execute the quantum circuits on less efficient and more error-prone hardware to maximize profit. Thus, gaining visibility on the backend from various aspects will be valuable. Effective forensics can have many applications including establishing trust in quantum cloud services. We introduce the problem of forensics in the domain of quantum computing. We trace the coupling map of the hardware where the transpilation of the circuit took place from the transpiled program. We perform experiments on various coupling topologies (linear, T-shaped, H-shaped, and loop) on IBM backends. We can derive the coupling map from the transpiled circuits with complete accuracy for almost every transpiled circuit we considered. We could correctly trace 97.33% of the programs to the correct backend.
Many third-party cloud providers set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. However, there is little visibility to where the execution of the circuit is taking place. This situation is similar to the classical cloud. The difference in the quantum scenario is that the success of the user program is highly reliant on the backend used. Besides, the third-party provider may be untrustworthy and execute the quantum circuits on less efficient and more error-prone hardware to maximize profit. Thus, gaining visibility on the backend from various aspects will be valuable. Effective forensics can have many applications including establishing trust in quantum cloud services. We introduce the problem of forensics in the domain of quantum computing. We trace the coupling map of the hardware where the transpilation of the circuit took place from the transpiled program. We perform experiments on various coupling topologies (linear, T-shaped, H-shaped, and loop) on IBM backends. We can derive the coupling map from the transpiled circuits with complete accuracy for almost every transpiled circuit we considered. We could correctly trace 97.33% of the programs to the correct backend.
The qubit technologies, basis gate set, noise behavior, speed and coupling architecture are among the various factors that vary among various backends. Although third-party cloud providers offering quantum hardware as a service offer lower cost and flexibility to the users to choose from several qubit technologies, quantum hardware, and coupling maps; the actual execution of the program is not clearly visible to the customer. The success of the user program, in addition to various other metadata such as cost, performance, & number of iterations to converge, depends on the error rate of the backend used. Moreover, the third-party provider and/or tools (e.g., hardware allocator and mapper) may hold insider/outsider adversarial agents to conserve resources and maximize profit by running the quantum circuits on error-prone hardware. Thus it is important to gain visibility of the backend from various perspectives of the computing process e.g., execution, transpilation and outcomes. In this paper, we estimate the error rate of the backend from the original and transpiled circuit. Although many quantum services providers publish the error rates of their backends, we assume that such information may not be accurate and/or correspond to the actual hardware allocated to the program. For the forensics we propose two complementary approaches. First, we exploit the fact that qubit mapping and routing steps of the transpilation process select qubits and qubit pairs with low gate errors to minimize overall error accumulation. We leverage this to rank qubit links into bins and compare with publicly available data we are able to assign a bin rank within a difference of 2 with respect to the actual bin for upto83.5%of the qubit links in IBM Sherbrooke and80%in IBM Brisbane, 127 qubit IBM backends. Second, we derive the error rates of the backends from a pool of programs by solving fidelity equations using numerical nonlinear optimizer. We achieve upto92.7%(97.3%)accuracy for single qubit (2 qubit) gate error rates.
Third-party cloud providers offer quantum hardware as a service enabling flexibility to the customers to opt from varied quantum hardware, qubit technologies and topologies. However, the actual execution of the program on the desired target hardware remains opaque to the user. On one hand, the program performance, along with various other metadata such as cost, performance, & number of iterations to converge, is dependent on the quality of the backend chosen. on the other hand, the third-party provider and/or tools (e.g., hardware schedulers) may maximize profit by running the quantum circuits on poor quality backend while charging for the high quality backend. Existing approaches to mitigate this opaqueness rely on forensics of error rates and coupling topology from transpiled circuit. We note that program queue depth and execution time are well correlated with the backend and therefore, can reveal vital information about the hardware and aid in forensic analysis to address the opaqueness.
Cloud quantum platforms give users access to many backends with different qubit technologies, coupling layouts, and noise levels. The execution of a circuit, however, depends on internal allocation and routing policies that are not observable to the user. A provider may redirect jobs to more error-prone regions to conserve resources, balance load or for other opaque reasons, causing degradation in fidelity while still presenting stale or averaged calibration data. This lack of transparency creates a security gap: users cannot verify whether their circuits were executed on the hardware for which they were charged. Forensic methods that infer backend behavior from user-visible artifacts are therefore becoming essential. In this work, we introduce a Graph Neural Network (GNN)-based forensic framework that predicts per-qubit and per-qubit link error rates of an unseen backend using only topology information and aggregated features extracted from transpiled circuits. We construct a dataset from several IBM 27-qubit devices, merge static calibration features with dynamic transpilation features and train separate GNN regressors for one- and two-qubit errors. At inference time, the model operates without access to calibration data from the target backend and reconstructs a complete error map from the features available to the user. Our results on the target backend show accurate recovery of backend error rate, with an average mismatch of approximately 22% for single-qubit errors and 18% for qubit-link errors. The model also exhibits strong ranking agreement, with the ordering induced by predicted error values closely matching that of the actual calibration errors, as reflected by high Spearman correlation. The framework consistently identifies weak links and high-noise qubits and remains robust under realistic temporal noise drift.
There is a steady growth in research and demand for real quan- tum hardware in the Noisy Intermediate-Scale Quantum (NISQ) era of quantum computing. This prompts many third-party cloud providers to set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. Quantum circuits submitted to these services are the fruits of the efforts invested by the designers. But these third-party cloud compilers (who offer more efficient alter- natives to established compilers) can make user circuits/programs vulnerable to various security breaches. Communication channels for transmitting quantum information also need to be developed such that there is end to end encryption. There is little to no visibil- ity on where the execution of the circuit is actually taking place. The success of the user program is highly reliant on the backend that was used for execution. Besides, the third-party provider and/or tools (e.g., hardware mapper and allocator) may be untrustworthy and execute the quantum circuits on less efficient and more error- prone hardware to conserve resources and maximize profit. These vulnerabilities in the quantum system could leak confidential data, cause loss of intellectual property rights of designers, cause loss of access control, corrupt user programs et cetera. Thus, it is imper- ative to identify these security vulnerabilities and create defense strategies to protect quantum programs, thus helping to maintain the integrity of quantum information across the software stack. My thesis aims to help address these vulnerabilities and opacities and address them.
We present the first architecture for a trusted execution environment for quantum computers. In the architecture, to protect the user's circuits, they are obfuscated with decoy control pulses added during circuit transpilation by the user. The decoy pulses are removed, i.e. attenuated, by the trusted hardware inside the superconducting quantum computer's fridge before they reach the qubits. This preliminary work demonstrates that protection from possibly malicious cloud providers is feasible with minimal hardware cost.
Our aim in this paper is to present experimental evidence of a side-channel attack on superconducting cloud-based quantum computers, demonstrating that a quantum circuit can be analyzed indirectly using data gathered before and after its execution on a quantum computer. We hope that this can motivate further research into hardware and system stability of quantum computers as well as into more-nuanced systems-level attacks. Although much work has been done on establishing error correcting codes to address issues of decoherence, and schemes can be utilized to leverage quantum effects for the sake of intrusion detection over quantum communication channels, there is a lack of literature in the field regarding side-channel attacks on transpiled quantum circuits, particularly those which leverage quantum effects to gather information about quantum circuits running in the cloud. We explored issues of decoherence by examining quantum circuit behavior both before and after a specified circuit was executed in order to ascertain decalibration rates and potential sources of decoherence: our data clearly shows that information on an interim circuit can be acquired in this manner. Using convenient data classification techniques and various circuit diagrams consisting of one quantum gate and several measurements, we were able to distinguish between these various circuits when executed at position n in the interim phase by training our classifier on data from probing circuits executed at queue positions n-1 and n+1. This shows that there is sufficient information residing in the data before and after a circuit is executed on a cloud-based superconducting quantum computer to allow an attacker to ascertain information about an otherwise unknown third-party circuit and shows potential to form the basis of a side-channel attack in cases where queue positions can be examined to target a third party’s transpiled circuit during experimentation. This side channel attack merits further examination and extrapolation to identify more-complex circuits, and deeper statistical consideration to determine potential sources of information leakage and mitigation strategies.