Residual cross-talk in superconducting qubit devices creates a security vulnerability for emerging quantum cloud services. We demonstrate a Clifford-only Quantum Rowhammer attack—using just $X$ and CNOT gates—that injects faults on IBM's 127-qubit Eagle processors without requiring pulse-level access. Experiments show that targeted hammering induces localized errors confined to the attack cycle and primarily manifests as phase noise, as confirmed by near-50% flip rates under Hadamard-basis probing. A full-lattice sweep maps QR's spatial and temporal behavior, revealing reproducible corruption limited to qubits within two coupling hops and rapid recovery in subsequent benign cycles. Finally, we leverage these properties to outline a prime-and-probe covert channel, demonstrating that the clear separability between hammered and benign rounds enables highly reliable signaling without error correction. These findings underscore the need for hardware-level isolation and scheduler-aware defenses as multi-tenant quantum computing becomes standard.Residual cross-talk in superconducting qubit devices creates a security vulnerability for emerging quantum cloud services. We demonstrate a Clifford-only Quantum Rowhammer attack—using just$X$and CNOT gates—that injects faults on IBM's 127-qubit Eagle processors without requiring pulse-level access. Experiments show that targeted hammering induces localized errors confined to the attack cycle and primarily manifests as phase noise, as confirmed by near-50% flip rates under Hadamard-basis probing. A full-lattice sweep maps QR's spatial and temporal behavior, revealing reproducible corruption limited to qubits within two coupling hops and rapid recovery in subsequent benign cycles. Finally, we leverage these properties to outline a prime-and-probe covert channel, demonstrating that the clear separability between hammered and benign rounds enables highly reliable signaling without error correction. These findings underscore the need for hardware-level isolation and scheduler-aware defenses as multi-tenant quantum computing becomes standard.

IEEE International Conference on Quantum Computing and Engineering (QCE)Aug 30, 20250 citations

Pulse-Level Simulation of Crosstalk Attacks on Superconducting Quantum Hardware

Syed Emad Uddin Shubha, Tasnuva Farheen

Hardware crosstalk in multi-tenant superconducting quantum computers poses a severe security threat, allowing adversaries to induce targeted errors across tenant boundaries by injecting carefully engineered pulses. We present a simulation-based study of active crosstalk attacks at the pulse level, analyzing how adversarial control of pulse timing, shape, amplitude, and coupling can disrupt a victim's computation. Our framework models the time-dependent dynamics of a three-qubit system in the rotating frame, capturing both always-on couplings and injected drive pulses. We examine two attack strategies: attacker-first (pulse before victim operation) and victim-first (pulse after), and systematically identify the pulse and coupling configurations that cause the largest logical errors. Protocol-level experiments on quantum coin flip and XOR classification circuits show that some protocols are highly vulnerable to these attacks, while others remain robust. Based on these findings, we discuss practical methods for detection and mitigation to improve security in quantum cloud platforms.Hardware crosstalk in multi-tenant superconducting quantum computers poses a severe security threat, allowing adversaries to induce targeted errors across tenant boundaries by injecting carefully engineered pulses. We present a simulation-based study of active crosstalk attacks at the pulse level, analyzing how adversarial control of pulse timing, shape, amplitude, and coupling can disrupt a victim's computation. Our framework models the time-dependent dynamics of a three-qubit system in the rotating frame, capturing both always-on couplings and injected drive pulses. We examine two attack strategies: attacker-first (pulse before victim operation) and victim-first (pulse after), and systematically identify the pulse and coupling configurations that cause the largest logical errors. Protocol-level experiments on quantum coin flip and XOR classification circuits show that some protocols are highly vulnerable to these attacks, while others remain robust. Based on these findings, we discuss practical methods for detection and mitigation to improve security in quantum cloud platforms.

arXiv:2507.16181IEEE International Conference on Quantum Computing and Engineering (QCE)Aug 30, 20251 citation

Hacking quantum computers with row hammer attack

Fernando Almaguer Angeles, Pedro R. Dieguez, Akshata Shenoy H. +1 more

We demonstrate a hardware vulnerability in quantum computing systems by exploiting cross-talk effects on an available commercial quantum computer (IBM). Specifically, based on the cross-talk produced by certain quantum gates, we implement a row hammer attack that ultimately allows us to flip a qubit. Both single-qubit and two-qubit operations are performed and analyzed. Our findings reveal that two-qubit operations applied near the target qubit significantly influence it through cross-talk, effectively compromising its state.We demonstrate a hardware vulnerability in quantum computing systems by exploiting cross-talk effects on an available commercial quantum computer (IBM). Specifically, based on the cross-talk produced by certain quantum gates, we implement a row hammer attack that ultimately allows us to flip a qubit. Both single-qubit and two-qubit operations are performed and analyzed. Our findings reveal that two-qubit operations applied near the target qubit significantly influence it through cross-talk, effectively compromising its state.

arXiv:2503.21650Mar 27, 20250 citations

Pulse-to-Circuit Characterization of Stealthy Crosstalk Attack on Multi-Tenant Superconducting Quantum Hardware

Syed Emad Uddin Shubha, Tasnuva Farheen

Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.Hardware crosstalk in multi-tenant superconducting quantum computers constitutes a significant security threat, enabling adversaries to inject targeted errors across tenant boundaries. We present the first end-to-end framework for mapping physical pulse-level attacks to interpretable logical error channels, integrating density-matrix simulation, quantum process tomography (QPT), and a novel isometry-based circuit extraction method. Our pipeline reconstructs the complete induced error channel and fits an effective logical circuit model, revealing a fundamentally asymmetric attack mechanism: one adversarial qubit acts as a driver to set the induced logical rotation, while a second, the catalyst, refines the attack’s coherence. Demonstrated on a linear three-qubit system, our approach shows that such attacks can significantly disrupt diverse quantum protocols, sometimes reducing accuracy to random guessing, while remaining effective and stealthy even under realistic hardware parameter variations. We further propose a protocol-level detection strategy based on observable attack signatures, showing that stealthy attacks can be exposed through targeted monitoring and providing a foundation for future defense-in-depth in quantum cloud platforms.

arXiv:2509.11407Oct 13, 20254 citations

QubitVise: Double-Sided Crosstalk Attack in Superconducting Quantum Computers

Adriana Aranguren Arellano, He Xie, Jakub M. Szefer

This work presents a novel security attack based on CNOT gate induced crosstalk in superconducting qubit systems. Compared to previous work, this work introduces a double-sided crosstalk attack where attacker's circuits are located on either side of the victim circuit executing in a multi-tenant cloud-based quantum computer. The attacker, a malicious tenant or user, can interfere with, or disrupt, the state of neighboring qubits in the victim tenant or user without direct access to victim's qubits, by taking advantage of interference and crosstalk among the otherwise logically isolated qubits. New aspect of this attack is the location of the attacker's circuits on both sides of the victim. Experimental validation on cloud-based Rigetti quantum devices demonstrates that these attacks can compromise data integrity and cause the victim's circuit's outputs to change. Magnitude of the change is evaluated using total variational distance and tested on number of common benchmarks that can execute on today's quantum computers. This work underscores the need for improved isolation mechanisms and secure scheduling in multitenant quantum computing cloud environments.This work presents a novel security attack based on CNOT gate induced crosstalk in superconducting qubit systems. Compared to previous work, this work introduces a double-sided crosstalk attack where attacker's circuits are located on either side of the victim circuit executing in a multi-tenant cloud-based quantum computer. The attacker, a malicious tenant or user, can interfere with, or disrupt, the state of neighboring qubits in the victim tenant or user without direct access to victim's qubits, by taking advantage of interference and crosstalk among the otherwise logically isolated qubits. New aspect of this attack is the location of the attacker's circuits on both sides of the victim. Experimental validation on cloud-based Rigetti quantum devices demonstrates that these attacks can compromise data integrity and cause the victim's circuit's outputs to change. Magnitude of the change is evaluated using total variational distance and tested on number of common benchmarks that can execute on today's quantum computers. This work underscores the need for improved isolation mechanisms and secure scheduling in multitenant quantum computing cloud environments.

IEEE International Conference on Quantum Computing and Engineering (QCE)Aug 30, 20250 citations

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Lee, Wei Jie Bryan, Siyi Wang, Dutta, Suman +2 more

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

arXiv:2502.10115Feb 14, 20250 citations

Residual cross-talk in superconducting qubit devices creates a security vulnerability for emerging quantum cloud services. We demonstrate a Clifford-only Quantum Rowhammer attack—using just

X

and CNOT gates—that injects faults on IBM's 127-qubit Eagle processors without requiring pulse-level access. Experiments show that targeted hammering induces localized errors confined to the attack cycle and primarily manifests as phase noise, as confirmed by near-50% flip rates under Hadamard-basis probing. A full-lattice sweep maps QR's spatial and temporal behavior, revealing reproducible corruption limited to qubits within two coupling hops and rapid recovery in subsequent benign cycles. Finally, we leverage these properties to outline a prime-and-probe covert channel, demonstrating that the clear separability between hammered and benign rounds enables highly reliable signaling without error correction. These findings underscore the need for hardware-level isolation and scheduler-aware defenses as multi-tenant quantum computing becomes standard.

81.62\%

through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as

6.25\%

of the victim's, achieves

100\%

accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.