Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2604.10592

Post-Cut Metadata Inference Attacks on Quantum Circuit Cutting Pipelines

Samuel Punch, Krishnendu Guha, Utz Roedig

quant-phcs.ETSubmitted Apr 12, 2026• Announced Apr 14, 2026• 0 citations• Revised Jul 8, 2026 (v2)
v1 · Apr 12, 2026v2 · Jul 8, 2026
arXivHTMLPDF

Abstract

Quantum cloud providers can identify a user's algorithm and secret problem structure without ever seeing actual quantum data, simply by analyzing routine metadata collected for billing and system management. Existing confidentiality tools such as blind quantum computation and quantum homomorphic encryption protect the quantum payload itself, but they do not protect this classical orchestration metadata. This leaves an unexplored security risk in the logs generated when a large quantum program is split into smaller pieces to fit onto limited hardware, a process known as circuit cutting. These fragments leak sensitive information through what we term the topological transpilation penalty: the unavoidable depth and gate inflation added when a compiler reorganizes a program for a restricted hardware topology. Tests on a 156-qubit production Quantum Processing Unit (QPU) show that traditional timing side-channels fail in this setting, since hardware control-plane delays mask actual quantum execution time. The unique shape of the transpilation penalty acts instead as a persistent structural fingerprint for the hidden workload. Using 12,000 circuit fragments across eight algorithm families, our attack recovers algorithm family and Hamiltonian k-locality with near-perfect accuracy, achieving instance-disjoint AUC = 1.000 for both. This leakage persists under size-holdout evaluation on unseen circuit scales, with AUC = 0.987 and 0.986 respectively. The cutting mechanism is inferred with AUC = 0.991, and hardware topology is recovered well above chance with AUC = 0.818. These results show that circuit cutting exposes algorithmic intent, and potentially proprietary problem structure, through metadata alone, without any need to observe quantum data.

Comments
17 Pages

Related papers

Quantum Workload Privacy Beyond Data Confidentiality

Shaunak Suresh Pawar, Samuel Punch, Krishnendu Guha

Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.

arXiv:2609.02323•Sep 2, 2026•0 citations

Leveraging Quantum Circuit Cutting for Obfuscation and Intellectual Property Protection

George Typaldos, Wei Tang, Jakub M. Szefer

Circuit cutting is a novel technique in the field of quantum computing that offers a promising approach for breaking up large quantum circuits into smaller ones that can be executed on smaller quantum computers. Circuit cutting offers a scalable and hybrid computing approach, by combining classical and quantum computers to run large quantum circuits. At the same time, quantum circuits represent the fundamental building blocks of quantum algorithms, and obfuscation techniques are crucial for protecting the sensitive information and intellectual property encoded in these circuits. This paper constitutes the first security analysis of circuit cutting techniques as a means to protect quantum circuits, and not just for cutting bigger quantum circuits to fit on smaller devices. As cloud providers are in control of quantum computers and give access to users, utilizing cloud-based quantum computers for executing quantum circuits involves considerable security risks. This work demonstrates that quantum circuits can be effectively obfuscated by using quantum circuit cutting techniques. If users are worried about an adversary who attempts to reverse-engineer the original quantum algorithm, circuit cutting can be used as a security measure. To further provide configurable obfuscation level, i.e. number of possible circuits that the cloud provider would have to guess, this work proposes a novel dummy-subcircuits technique. This technique introduces dummy subcircuits with additional qubit cut points to create more confusion for the cloud provider and further help to obfuscate the user's original circuits with limited cost.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Sep 15, 2024•3 citations

Exploiting Timing Side-Channels in Quantum Circuits Simulation Via ML-Based Methods

Ben Dong, Hui Feng, Qian Wang

As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88% to 99.9% identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads

arXiv:2509.12535•Sep 16, 2025•0 citations

Quantum Circuit Cutting: A Security Methodology

George Typaldos, Theodoros Trochatos, Jakub M. Szefer

Quantum computing research has experienced tremendous advancements in recent years, and real-world applications that utilize quantum hardware are continuously emerging. Large companies are investing in quantum computing for a wide range of applications, such as finance, drug discovery, secure communications, etc. As quantum computer deployment is expected to increase and be further commercialized in the upcoming years, it is vital to develop secure systems and protocols able to protect confidential data from untrusted parties. Quantum circuit cutting is a technique originally developed to compensate for the NISQ state of quantum technology, as it breaks a large quantum circuit into several smaller subcircuits that can fit into available QPUs. However, the same method can also be applied to provide security guarantees and protect the user's data from malicious third parties that own the quantum hardware. In this paper, we present a methodology for employing circuit cutting to efficiently use available QPUs and hide the submitted algorithm from potentially malicious cloud providers. We assume variable provider intelligence and introduce two obfuscation techniques, namely, virtual subcircuits and virtual cuts, to provide a modular obfuscation level.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Aug 30, 2025•0 citations

Undermining Quantum Circuit Obfuscation: Insights from Structural Analysis

Donald Lushi, Samah Mohamed Saeed

The developments in quantum computing hardware and software are focused on boosting the scalability and robustness of quantum systems. With near-term quantum computers poised to accelerate specific computational tasks, ensuring their security has become a pressing priority. Recent efforts have proposed practical solutions to ensure data confidentiality in quantum computers accessed through the cloud, particularly in the presence of untrusted quantum cloud providers by leveraging trusted hardware that enables quantum circuit obfuscation. However, these solutions overlook the detailed structural information of the quantum algorithms, which may limit the effectiveness of the obfuscation methods. In this paper, we investigate the structural constraints of quantum algorithms executed across different quantum architectures. Based on this analysis, we develop a Machine Learning (ML)-based classifier that reveals the underlying quantum algorithm of the obfuscated physical quantum circuit. We also propose a pre-processing phase to minimize the obfuscation's impact on the classifier accuracy. We evaluate our proposed ML-based classification model on different obfuscated physical quantum circuits, which are transpiled to support IBM quantum hardware. Our analysis shows the vulnerability of existing obfuscation methods to reverse engineering attacks, which can potentially expose sensitive information about quantum circuits.

IEEE International Symposium on Hardware Oriented Security and Trust (HOST)•May 5, 2025•2 citations

Program Queue Analysis for Forensics of Quantum Backends

Rupshali Roy, Swaroop Ghosh

Third-party cloud providers offer quantum hardware as a service enabling flexibility to the customers to opt from varied quantum hardware, qubit technologies and topologies. However, the actual execution of the program on the desired target hardware remains opaque to the user. On one hand, the program performance, along with various other metadata such as cost, performance, & number of iterations to converge, is dependent on the quality of the backend chosen. on the other hand, the third-party provider and/or tools (e.g., hardware schedulers) may maximize profit by running the quantum circuits on poor quality backend while charging for the high quality backend. Existing approaches to mitigate this opaqueness rely on forensics of error rates and coupling topology from transpiled circuit. We note that program queue depth and execution time are well correlated with the backend and therefore, can reveal vital information about the hardware and aid in forensic analysis to address the opaqueness.

IEEE Dallas Circuits and Systems Conference (DCAS)•Apr 10, 2026•0 citations
Quantum cloud providers can identify a user's algorithm and secret problem structure without ever seeing actual quantum data, simply by analyzing routine metadata collected for billing and system management. Existing confidentiality tools such as blind quantum computation and quantum homomorphic encryption protect the quantum payload itself, but they do not protect this classical orchestration metadata. This leaves an unexplored security risk in the logs generated when a large quantum program is split into smaller pieces to fit onto limited hardware, a process known as circuit cutting. These fragments leak sensitive information through what we term the topological transpilation penalty: the unavoidable depth and gate inflation added when a compiler reorganizes a program for a restricted hardware topology. Tests on a 156-qubit production Quantum Processing Unit (QPU) show that traditional timing side-channels fail in this setting, since hardware control-plane delays mask actual quantum execution time. The unique shape of the transpilation penalty acts instead as a persistent structural fingerprint for the hidden workload. Using 12,000 circuit fragments across eight algorithm families, our attack recovers algorithm family and Hamiltonian k-locality with near-perfect accuracy, achieving instance-disjoint AUC = 1.000 for both. This leakage persists under size-holdout evaluation on unseen circuit scales, with AUC = 0.987 and 0.986 respectively. The cutting mechanism is inferred with AUC = 0.991, and hardware topology is recovered well above chance with AUC = 0.818. These results show that circuit cutting exposes algorithmic intent, and potentially proprietary problem structure, through metadata alone, without any need to observe quantum data.
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
Circuit cutting is a novel technique in the field of quantum computing that offers a promising approach for breaking up large quantum circuits into smaller ones that can be executed on smaller quantum computers. Circuit cutting offers a scalable and hybrid computing approach, by combining classical and quantum computers to run large quantum circuits. At the same time, quantum circuits represent the fundamental building blocks of quantum algorithms, and obfuscation techniques are crucial for protecting the sensitive information and intellectual property encoded in these circuits. This paper constitutes the first security analysis of circuit cutting techniques as a means to protect quantum circuits, and not just for cutting bigger quantum circuits to fit on smaller devices. As cloud providers are in control of quantum computers and give access to users, utilizing cloud-based quantum computers for executing quantum circuits involves considerable security risks. This work demonstrates that quantum circuits can be effectively obfuscated by using quantum circuit cutting techniques. If users are worried about an adversary who attempts to reverse-engineer the original quantum algorithm, circuit cutting can be used as a security measure. To further provide configurable obfuscation level, i.e. number of possible circuits that the cloud provider would have to guess, this work proposes a novel dummy-subcircuits technique. This technique introduces dummy subcircuits with additional qubit cut points to create more confusion for the cloud provider and further help to obfuscate the user's original circuits with limited cost.
As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88% to 99.9% identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads
Quantum computing research has experienced tremendous advancements in recent years, and real-world applications that utilize quantum hardware are continuously emerging. Large companies are investing in quantum computing for a wide range of applications, such as finance, drug discovery, secure communications, etc. As quantum computer deployment is expected to increase and be further commercialized in the upcoming years, it is vital to develop secure systems and protocols able to protect confidential data from untrusted parties. Quantum circuit cutting is a technique originally developed to compensate for the NISQ state of quantum technology, as it breaks a large quantum circuit into several smaller subcircuits that can fit into available QPUs. However, the same method can also be applied to provide security guarantees and protect the user's data from malicious third parties that own the quantum hardware. In this paper, we present a methodology for employing circuit cutting to efficiently use available QPUs and hide the submitted algorithm from potentially malicious cloud providers. We assume variable provider intelligence and introduce two obfuscation techniques, namely, virtual subcircuits and virtual cuts, to provide a modular obfuscation level.
The developments in quantum computing hardware and software are focused on boosting the scalability and robustness of quantum systems. With near-term quantum computers poised to accelerate specific computational tasks, ensuring their security has become a pressing priority. Recent efforts have proposed practical solutions to ensure data confidentiality in quantum computers accessed through the cloud, particularly in the presence of untrusted quantum cloud providers by leveraging trusted hardware that enables quantum circuit obfuscation. However, these solutions overlook the detailed structural information of the quantum algorithms, which may limit the effectiveness of the obfuscation methods. In this paper, we investigate the structural constraints of quantum algorithms executed across different quantum architectures. Based on this analysis, we develop a Machine Learning (ML)-based classifier that reveals the underlying quantum algorithm of the obfuscated physical quantum circuit. We also propose a pre-processing phase to minimize the obfuscation's impact on the classifier accuracy. We evaluate our proposed ML-based classification model on different obfuscated physical quantum circuits, which are transpiled to support IBM quantum hardware. Our analysis shows the vulnerability of existing obfuscation methods to reverse engineering attacks, which can potentially expose sensitive information about quantum circuits.
Third-party cloud providers offer quantum hardware as a service enabling flexibility to the customers to opt from varied quantum hardware, qubit technologies and topologies. However, the actual execution of the program on the desired target hardware remains opaque to the user. On one hand, the program performance, along with various other metadata such as cost, performance, & number of iterations to converge, is dependent on the quality of the backend chosen. on the other hand, the third-party provider and/or tools (e.g., hardware schedulers) may maximize profit by running the quantum circuits on poor quality backend while charging for the high quality backend. Existing approaches to mitigate this opaqueness rely on forensics of error rates and coupling topology from transpiled circuit. We note that program queue depth and execution time are well correlated with the backend and therefore, can reveal vital information about the hardware and aid in forensic analysis to address the opaqueness.