As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88% to 99.9% identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads
As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88% to 99.9% identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads
As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88 % to 99.9 % identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads.
Our aim in this paper is to present experimental evidence of a side-channel attack on superconducting cloud-based quantum computers, demonstrating that a quantum circuit can be analyzed indirectly using data gathered before and after its execution on a quantum computer. We hope that this can motivate further research into hardware and system stability of quantum computers as well as into more-nuanced systems-level attacks. Although much work has been done on establishing error correcting codes to address issues of decoherence, and schemes can be utilized to leverage quantum effects for the sake of intrusion detection over quantum communication channels, there is a lack of literature in the field regarding side-channel attacks on transpiled quantum circuits, particularly those which leverage quantum effects to gather information about quantum circuits running in the cloud. We explored issues of decoherence by examining quantum circuit behavior both before and after a specified circuit was executed in order to ascertain decalibration rates and potential sources of decoherence: our data clearly shows that information on an interim circuit can be acquired in this manner. Using convenient data classification techniques and various circuit diagrams consisting of one quantum gate and several measurements, we were able to distinguish between these various circuits when executed at position n in the interim phase by training our classifier on data from probing circuits executed at queue positions n-1 and n+1. This shows that there is sufficient information residing in the data before and after a circuit is executed on a cloud-based superconducting quantum computer to allow an attacker to ascertain information about an otherwise unknown third-party circuit and shows potential to form the basis of a side-channel attack in cases where queue positions can be examined to target a third party’s transpiled circuit during experimentation. This side channel attack merits further examination and extrapolation to identify more-complex circuits, and deeper statistical consideration to determine potential sources of information leakage and mitigation strategies.
With the rapidly growing interest in quantum computing also grows the importance of securing these quantum computers from various physical attacks. Constantly increasing qubit counts and improvements to the fidelity of the quantum computers hold great promise for the ability of these computers to run novel algorithms with highly sensitive intellectual property. However, in today's cloud-based quantum computer setting, users lack physical control over the computers. Physical attacks, such as those perpetrated by malicious insiders in data centers, could be used to extract sensitive information about the circuits being executed on these computers. Indeed, this work shows for the first time that power-based side-channel attacks could be deployed against quantum computers. Such attacks can be used to recover information about the control pulses sent to these computers. By analyzing these control pulses, attackers can reverse-engineer the equivalent gate-level description of the circuits, and possibly even the secret algorithms being run. This work introduces five new types of attacks, and evaluates them using control pulse information available from cloud-based quantum computers. This work demonstrates how and what circuits could be recovered, and then in turn how to defend from the newly demonstrated side-channel attacks on quantum~computers.
The rapidly growing interest in quantum computing also increases the importance of securing these computers from various physical attacks. Constantly increasing qubit counts and improvements to the fidelity of the quantum computers hold great promise for the ability of these computers to run novel algorithms with highly sensitive intellectual property. However, in today's cloud-based quantum computer setting, users lack physical control over the computers. Physical attacks, such as those perpetrated by malicious insiders in data centers, could be used to extract sensitive information about the circuits being executed on these computers. This work shows the first exploration and study of power-based side-channel attacks in quantum computers. The explored attacks could be used to recover information about the control pulses sent to these computers. By analyzing these control pulses, attackers can reverse-engineer the equivalent gate-level description of the circuits, and the algorithms being run, or data hard-coded into the circuits. This work introduces five new types of attacks, and evaluates them using control pulse information available from cloud-based quantum computers. This work demonstrates how and what circuits could be recovered, and then in turn how to defend from the newly demonstrated side-channel attacks on quantum computing systems.
Abstract With the growing deployment of quantum computing, side-channel attacks have emerged as one of the most serious security threats for cloud quantum service providers. This study investigates whether it is possible to infer the execution order and start times of quantum gates—and ultimately reconstruct the victim circuit—solely from measurements of the power consumption of quantum controllers. While most previous research has focused on reconstructing quantum circuits composed of standard basis gates, the possibility of reconstructing users’ custom quantum circuits from the power leakage of quantum controllers has received little attention. Our approach is evaluated under two observation models: per-channel power and total power. In the per-channel setting, the power trace of each channel is analyzed separately and compared with simulated pulse templates for different gates, in order to identify the most likely gate type and its start time. In this setting, template-based power comparison accurately determines both the gate and its onset time, and simple decision rules reduce misclassification between similar gates. In the total-power setting, an optimization model is employed to recover the logical ordering of the circuit with good accuracy, without requiring access to individual channel traces. The results show that even with a single measurement, circuit reconstruction is feasible provided that the pulse shapes and the device topology are known.
Quantum cloud providers can identify a user's algorithm and secret problem structure without ever seeing actual quantum data, simply by analyzing routine metadata collected for billing and system management. Existing confidentiality tools such as blind quantum computation and quantum homomorphic encryption protect the quantum payload itself, but they do not protect this classical orchestration metadata. This leaves an unexplored security risk in the logs generated when a large quantum program is split into smaller pieces to fit onto limited hardware, a process known as circuit cutting. These fragments leak sensitive information through what we term the topological transpilation penalty: the unavoidable depth and gate inflation added when a compiler reorganizes a program for a restricted hardware topology. Tests on a 156-qubit production Quantum Processing Unit (QPU) show that traditional timing side-channels fail in this setting, since hardware control-plane delays mask actual quantum execution time. The unique shape of the transpilation penalty acts instead as a persistent structural fingerprint for the hidden workload. Using 12,000 circuit fragments across eight algorithm families, our attack recovers algorithm family and Hamiltonian k-locality with near-perfect accuracy, achieving instance-disjoint AUC = 1.000 for both. This leakage persists under size-holdout evaluation on unseen circuit scales, with AUC = 0.987 and 0.986 respectively. The cutting mechanism is inferred with AUC = 0.991, and hardware topology is recovered well above chance with AUC = 0.818. These results show that circuit cutting exposes algorithmic intent, and potentially proprietary problem structure, through metadata alone, without any need to observe quantum data.