Variational Quantum Circuits (VQCs) have emerged as a powerful quantum computing paradigm, demonstrating a scaling advantage for problems intractable for classical computation. As VQCs require substantial resources and specialized expertise for their design, they represent significant intellectual properties (IPs). However, existing quantum circuit watermarking techniques suffer from two primary drawbacks: (1) watermarks can be removed during re-compilation of the circuits, and (2) these methods significantly increase task loss due to the extensive length of the inserted watermarks across multiple compilation stages. To address these challenges, we propose BVQC, a backdoor-based watermarking technique for VQCs that preserves the original loss in typical execution settings, while deliberately increasing the loss to a predefined level during watermark extraction. Additionally, BVQC employs a grouping algorithm to minimize the watermark task's interference with the base task, ensuring optimal accuracy for the base task. BVQC retains the original compilation workflow, ensuring robustness against re-compilation. Our evaluations show that BVQC greatly reduces Probabilistic Proof of Authorship (PPA) changes by$9.89 \mathrm{e}-3$and ground truth distance (GTD) by 0.089 compared to prior watermarking technologies.
Variational Quantum Circuits (VQCs) have emerged as a powerful quantum computing paradigm, demonstrating a scaling advantage for problems intractable for classical computation. As VQCs require substantial resources and specialized expertise for their design, they represent significant intellectual properties (IPs). However, existing quantum circuit watermarking techniques suffer from two primary drawbacks: (1) watermarks can be removed during re-compilation of the circuits, and (2) these methods significantly increase task loss due to the extensive length of the inserted watermarks across multiple compilation stages. To address these challenges, we propose BVQC, a backdoor-based watermarking technique for VQCs that preserves the original loss in typical execution settings, while deliberately increasing the loss to a predefined level during watermark extraction. Additionally, BVQC employs a grouping algorithm to minimize the watermark task's interference with the base task, ensuring optimal accuracy for the base task. BVQC retains the original compilation workflow, ensuring robustness against re-compilation. Our evaluations show that BVQC greatly reduces Probabilistic Proof of Authorship (PPA) changes by9.89e−3and ground truth distance (GTD) by 0.089 compared to prior watermarking technologies.
Quantum computing represents a burgeoning computational paradigm that significantly advances the resolution of contemporary intricate problems across various domains, including cryptography, chemistry, and machine learning. Quantum circuits tailored to address specific problems have emerged as critical intellectual properties (IPs) for quantum computing companies, attributing to the escalating commercial value of quantum computing. Consequently, designing watermarking schemes for quantum circuits becomes imperative to thwart malicious entities from producing unauthorized circuit replicas and unlawfully disseminating them within the market. Unfortunately, the prevailing watermarking technique reliant on unitary matrix decomposition markedly inflates the number of 2-qubit gates and circuit depth, thereby compromising the fidelity of watermarked circuits when embedding detectable signatures into the corresponding unitary matrices. In this paper, we propose an innovative multi-stage watermarking scheme for quantum circuits, introducing additional constraints across various synthesis stages to validate the ownership of IPs. Compared to the state-of-the-art watermarking technique, our multi-stage watermarking approach demonstrates, on average, a reduction in the number of 2-qubit gates by 16% and circuit depth by 6%, alongside an increase in the fidelity of watermarked circuits by 8%, while achieving a 79.4% lower probabilistic proof of authorship.
Variational Quantum Algorithms (VQAs) are a leading paradigm for near-term quantum computing, combining parameterized quantum circuits with classical optimization across quantum chemistry, combinatorial optimization, and quantum machine learning. Since real-world VQA deployments routinely require circuits that exceed available hardware capacity, quantum circuit cutting has become an indispensable execution strategy, and pre-trained parameters are increasingly distributed through public repositories, introducing supply-chain security risks that have received little attention. Prior quantum backdoor attacks either introduce detectable circuit modifications or depend on device-specific noise, and none consider circuit cutting as an attack surface. We present CutBackdoor, the first parameter-supply-chain backdoor that uses cut circuit execution from CutQC as the deployment-time trigger against VQAs. Under noisy finite-shot circuit-cut execution, poisoned parameters preserve full-circuit validation performance while substantially increasing cut-path reconstruction error, without any circuit modification. The trigger activates when a resource-limited victim responds to a qubit-capacity mismatch by invoking the cutting workflow, requiring no attacker presence at deployment. We provide a theoretical analysis and empirically validate it across varying shot budgets. Evaluation across multiple VQA benchmarks on IBM quantum backends demonstrates cut-path energy amplification of 1.3× to 2.9× \revA{over clean baselines on the VQE and VQD benchmarks while maintaining small stealthiness error on the full-circuit path. The cut-path gap persists across the evaluated backends and cut placements under matched compilation; Zero-Noise Extrapolation provides only partial mitigation, and the diagonal-cost QAOA benchmark
delineates the attack's structural boundary
Quantum circuits constitute Intellectual Property (IP) of the quantum developers and users, which needs to be protected from theft by adversarial agents e.g., the quantum cloud provider or a rogue adversary present in the cloud. This necessitates the exploration of low-overhead techniques applicable to near-term quantum devices, to trace the quantum circuits/algorithms' IP and their output. We present two such lightweight watermarking techniques to prove ownership in the event of an adversary cloning the circuit design. For the first technique a rotation gate is placed on ancilla qubits combined with other gate (s) at the output of the circuit. For the second method, a set of random gates are inserted in the middle of the circuit followed by its inverse, separated from the circuit by a barrier. These models are combined and applied on benchmark circuits and the circuit depth, 2-qubit gate count, probability of successful trials (PST) and probabilistic proof of authorship (PPA) are compared against the state-of-the-art. The PST is reduced by a miniscule 0.53% against the non-watermarked benchmarks and is up to 22.69% higher compared to existing techniques. The circuit depth has been reduced by up to 27.7% as against the state-of-the-art. The PPA is astronomically smaller than existing watermarks.
Variational quantum algorithms (VQAs) are a central paradigm for noisy intermediate-scale (NISQ) quantum computing, yet their reliance on predesigned and pretrained variational quantum circuits (VQCs) introduces critical security vulnerabilities, particularly backdoor attacks. These attacks embed hidden malicious behaviors that remain dormant under normal conditions but are activated by specific triggers, leading to adversarial outcomes such as incorrect predictions or manipulated objective values. This paper presents a survey of backdoor attacks in VQCs, covering data-poisoning, compiler-level, and quantum-native mechanisms. We formalize key terminology and threat models, and review existing attack strategies along with their empirical characteristics. We also analyze current detection and defense approaches, highlighting their limitations, especially against quantum-specific threats. By synthesizing recent advances, this survey outlines the evolving security landscape of VQCs and identifies key challenges and future directions for developing robust, quantum-aware defenses in hybrid quantum-classical systems.
We introduce a barrier-free watermarking framework for quantum circuits that embeds authorship as a controlled measurement bias on dedicated ancilla qubits while preserving the functional behavior of the original computation when the ancillas are ignored. Each watermark block prepares an ancilla and couples it once to a selected work qubit using an interaction that preserves the ancilla's measurement statistics, and blocks are placed before measurement to avoid compiler reordering across readout. Because the watermark is defined by a statistical property rather than a specific gate pattern, it is designed to remain verifiable after standard transpilation and hardware mapping. We provide a Qiskit implementation and an evaluation protocol that measures watermark detectability, functional impact on the circuit output distribution, and performance overhead. Experiments on RevLib benchmarks, simulator backends, and IBM quantum hardware show that the watermark can be detected reliably while introducing only modest degradation under typical NISQ noise levels, with the tradeoff becoming more pronounced as circuit depth increases.
Quantum cloud platforms have become the most widely adopted and mainstream approach for accessing quantum computing resources, due to the scarcity and operational complexity of quantum hardware. In this service-oriented paradigm, quantum circuits, which constitute high-value intellectual property, are exposed to risks of unauthorized access, reuse, and misuse. Digital watermarking has been explored as a promising mechanism for protecting quantum circuits by embedding ownership information for tracing and verification. However, driven by recent advances in generative artificial intelligence, the paradigm of quantum circuit design is shifting from individually and manually constructed circuits to automated synthesis based on quantum circuit generative models (QCGMs). In such generative settings, protecting only individual output circuits is insufficient, and existing post hoc, circuit-centric watermarking methods are not designed to integrate with the generative process, often failing to simultaneously ensure stealthiness, functional correctness, and robustness at scale. These limitations highlight the need for a new watermarking paradigm that is natively integrated with quantum circuit generative models. In this work, we present the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity. We introduce a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction. Empirical results confirm that our method achieves high-fidelity circuit generation and robust watermark detection across a range of perturbations, paving the way for scalable, secure copyright protection in AI-powered quantum design.