Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2502.10115

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Lee, Wei Jie Bryan, Siyi Wang, Dutta, Suman, Walid El Maouaki, Anupam Chattopadhyay

Published Feb 14, 2025• 0 citations
arXivHTMLPDF

Abstract

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

DOI
10.48550/arxiv.2502.10115

Related papers

POSTER: Stealthy SWAP-Based Side-Channel Attack on Multi-Tenant Quantum Cloud Systems

Wei Jie Bryan Lee, Siyi Wang, Suman Dutta +2 more

The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.

ACM Asia Conference on Computer and Communications Security (ASIA CCS)•Aug 13, 2025•3 citations

QubitVise: Double-Sided Crosstalk Attack in Superconducting Quantum Computers

Adriana Aranguren Arellano, He Xie, Jakub M. Szefer

This work presents a novel security attack based on CNOT gate induced crosstalk in superconducting qubit systems. Compared to previous work, this work introduces a double-sided crosstalk attack where attacker's circuits are located on either side of the victim circuit executing in a multi-tenant cloud-based quantum computer. The attacker, a malicious tenant or user, can interfere with, or disrupt, the state of neighboring qubits in the victim tenant or user without direct access to victim's qubits, by taking advantage of interference and crosstalk among the otherwise logically isolated qubits. New aspect of this attack is the location of the attacker's circuits on both sides of the victim. Experimental validation on cloud-based Rigetti quantum devices demonstrates that these attacks can compromise data integrity and cause the victim's circuit's outputs to change. Magnitude of the change is evaluated using total variational distance and tested on number of common benchmarks that can execute on today's quantum computers. This work underscores the need for improved isolation mechanisms and secure scheduling in multitenant quantum computing cloud environments.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Aug 30, 2025•0 citations

Stealthy SWAPs: Adversarial SWAP Injection in Multi-Tenant Quantum Computing

Suryansh Upadhyay, Swaroop Ghosh

Quantum computing (QC) holds tremendous promise in revolutionizing problem-solving across various domains. It has been suggested in literature that 50+ qubits are sufficient to achieve quantum advantage (i.e., to surpass supercomputers in solving certain class of optimization problems). The hardware size of existing Noisy Intermediate-Scale Quantum (NISQ) computers have been ever increasing over the years. Therefore, Multi-tenant computing (MTC) has emerged as a potential solution for efficient hardware utilization, enabling shared resource access among multiple quantum programs. However, MTC can also bring new security concerns. This paper proposes one such threat for MTC in superconducting quantum hardware i.e., adversarial SWAP gate injection in victim’s program during compilation for MTC. We present a representative scheduler designed for optimal resource allocation. To demonstrate the impact of this attack model, we conduct a detailed case study using a sample scheduler. Exhaustive experiments on circuits with varying depths and qubits offer valuable insights into the repercussions of these attacks. We report a max of $\approx 55$% and a median increase of $\approx 25$% in SWAP overhead. As a countermeasure, we also propose a sample machine learning model for detecting any abnormal user behavior and priority adjustment.

arXiv:2310.17426•International Conference on VLSI Design•Jan 6, 2024•10 citations

Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers

Navnil Choudhury, Chaithanya Naik Mude, Sanjay Das +3 more

As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.

arXiv:2412.10507•Network and Distributed System Security Symposium•Jan 1, 2025•11 citations

Pulse-to-Circuit Characterization of Stealthy Crosstalk Attack on Multi-Tenant Superconducting Quantum Hardware

Syed Emad Uddin Shubha, Tasnuva Farheen

Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.

arXiv:2509.11407•Oct 13, 2025•4 citations

Toward Covert Quantum Computing

Evan J. D. Anderson, Kaushik Datta, Boulat A. Bash

As quantum computers become available through multi-tenant cloud platforms, ensuring privacy against adversaries sharing the same quantum processing unit becomes critical. We introduce and explore \emph{covert quantum computing}, a new concept that ensures an adversary with access to all other quantum computational units (QCUs) of a quantum computer cannot detect computation on the subset that they cannot access. Analogous to covert communication, we employ information theory. However, since here the adversary controls the systems used for detection, we require a richer framework for covertness analysis that accounts for the use of quantum memories and adaptive operations. Thus, we adopt the \emph{quantum-strategy} framework used in quantum game theory and memory channel discrimination. Current quantum computers use planar graph circuit layouts and typically assume nearest-neighbor crosstalk. We derive discrete isoperimetric inequalities to show that, for an $n$-qubit circuit under this model, only $\mathcal{O}(\sqrt{n})$ border qubits provide detection information to the adversary. We then explore this scaling law on IQM's 54-qubit \emph{Emerald} processor and IBM's 156-qubit \emph{ibm\_fez} machine employing the Heron 2 architecture. We implement Ramsey experiments on qubits not used in computation, and detect nearest-neighbor crosstalk, as expected. However, we also observe long-range coupling effects beyond the border qubits, revealing a side channel that the adversary can exploit. We hypothesize that this long-range crosstalk is induced by leakage from the drive and control lines. Beyond weakening covertness, it exposes co-tenants to both adversarial and unintended crosstalk and degrades circuits that span spatially distributed qubits, motivating further work on spatial isolation and crosstalk characterization.

quant-pharXiv:2605.14325•May 15, 2026•0 citations
The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by 81.62%81.62\%81.62% through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as 6.25%6.25\%6.25% of the victim's, achieves 100%100\%100% accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.
The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.
This work presents a novel security attack based on CNOT gate induced crosstalk in superconducting qubit systems. Compared to previous work, this work introduces a double-sided crosstalk attack where attacker's circuits are located on either side of the victim circuit executing in a multi-tenant cloud-based quantum computer. The attacker, a malicious tenant or user, can interfere with, or disrupt, the state of neighboring qubits in the victim tenant or user without direct access to victim's qubits, by taking advantage of interference and crosstalk among the otherwise logically isolated qubits. New aspect of this attack is the location of the attacker's circuits on both sides of the victim. Experimental validation on cloud-based Rigetti quantum devices demonstrates that these attacks can compromise data integrity and cause the victim's circuit's outputs to change. Magnitude of the change is evaluated using total variational distance and tested on number of common benchmarks that can execute on today's quantum computers. This work underscores the need for improved isolation mechanisms and secure scheduling in multitenant quantum computing cloud environments.
Quantum computing (QC) holds tremendous promise in revolutionizing problem-solving across various domains. It has been suggested in literature that 50+ qubits are sufficient to achieve quantum advantage (i.e., to surpass supercomputers in solving certain class of optimization problems). The hardware size of existing Noisy Intermediate-Scale Quantum (NISQ) computers have been ever increasing over the years. Therefore, Multi-tenant computing (MTC) has emerged as a potential solution for efficient hardware utilization, enabling shared resource access among multiple quantum programs. However, MTC can also bring new security concerns. This paper proposes one such threat for MTC in superconducting quantum hardware i.e., adversarial SWAP gate injection in victim’s program during compilation for MTC. We present a representative scheduler designed for optimal resource allocation. To demonstrate the impact of this attack model, we conduct a detailed case study using a sample scheduler. Exhaustive experiments on circuits with varying depths and qubits offer valuable insights into the repercussions of these attacks. We report a max of ≈55\approx 55≈55% and a median increase of ≈25\approx 25≈25% in SWAP overhead. As a countermeasure, we also propose a sample machine learning model for detecting any abnormal user behavior and priority adjustment.
As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.
Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.
As quantum computers become available through multi-tenant cloud platforms, ensuring privacy against adversaries sharing the same quantum processing unit becomes critical. We introduce and explore \emph{covert quantum computing}, a new concept that ensures an adversary with access to all other quantum computational units (QCUs) of a quantum computer cannot detect computation on the subset that they cannot access. Analogous to covert communication, we employ information theory. However, since here the adversary controls the systems used for detection, we require a richer framework for covertness analysis that accounts for the use of quantum memories and adaptive operations. Thus, we adopt the \emph{quantum-strategy} framework used in quantum game theory and memory channel discrimination. Current quantum computers use planar graph circuit layouts and typically assume nearest-neighbor crosstalk. We derive discrete isoperimetric inequalities to show that, for an nnn-qubit circuit under this model, only O(n)\mathcal{O}(\sqrt{n})O(n​) border qubits provide detection information to the adversary. We then explore this scaling law on IQM's 54-qubit \emph{Emerald} processor and IBM's 156-qubit \emph{ibm\_fez} machine employing the Heron 2 architecture. We implement Ramsey experiments on qubits not used in computation, and detect nearest-neighbor crosstalk, as expected. However, we also observe long-range coupling effects beyond the border qubits, revealing a side channel that the adversary can exploit. We hypothesize that this long-range crosstalk is induced by leakage from the drive and control lines. Beyond weakening covertness, it exposes co-tenants to both adversarial and unintended crosstalk and degrades circuits that span spatially distributed qubits, motivating further work on spatial isolation and crosstalk characterization.