Quantum circuit cutting enables near-term quantum devices to execute workloads exceeding their qubit capacity by decomposing circuits into independently runnable fragments. While this extends computational reach, it creates a previously unexplored confidentiality surface: the fragment-level execution transcript observable by a semi-honest cloud provider. We formalise this surface and demonstrate that post-cut transcripts constitute a practical metadata side channel. Operating solely on provider-visible compiled circuit metadata (fragment width, depth, and two-qubit gate count), we evaluate a structured inference attack across six classification objectives spanning algorithm identity, cut mechanism, and coarse Hamiltonian structure. Our corpus comprises 1,200 circuit fragments across eight algorithm families transpiled against three hardware topologies, validated on a 156-qubit production quantum computer confirming that QPU execution time remains invariant across a 25x variation in compiled depth. Under strict instance-disjoint generalisation, our attack recovers algorithm family with 0.960 accuracy (AUC 0.999), cut mechanism with 0.847 accuracy (AUC 0.924), and Hamiltonian k-locality with 0.960 accuracy (AUC 0.998). Connectivity and geometry inference achieve AUC of 0.986 and 0.942 with strong stability under size-holdout. Topology inference remains above chance (AUC 0.666). A matched-footprint control and ablation study confirm leakage is structure-dominated and not explained by scale artefacts. These results demonstrate that circuit cutting is not confidentiality-neutral and that metadata leakage should be treated as a first-class security concern in quantum cloud systems.
Quantum circuit cutting enables near-term quantum devices to execute workloads exceeding their qubit capacity by decomposing circuits into independently runnable fragments. While this extends computational reach, it creates a previously unexplored confidentiality surface: the fragment-level execution transcript observable by a semi-honest cloud provider. We formalise this surface and demonstrate that post-cut transcripts constitute a practical metadata side channel. Operating solely on provider-visible compiled circuit metadata (fragment width, depth, and two-qubit gate count), we evaluate a structured inference attack across six classification objectives spanning algorithm identity, cut mechanism, and coarse Hamiltonian structure. Our corpus comprises 1,200 circuit fragments across eight algorithm families transpiled against three hardware topologies, validated on a 156-qubit production quantum computer confirming that QPU execution time remains invariant across a 25x variation in compiled depth. Under strict instance-disjoint generalisation, our attack recovers algorithm family with 0.960 accuracy (AUC 0.999), cut mechanism with 0.847 accuracy (AUC 0.924), and Hamiltonian k-locality with 0.960 accuracy (AUC 0.998). Connectivity and geometry inference achieve AUC of 0.986 and 0.942 with strong stability under size-holdout. Topology inference remains above chance (AUC 0.666). A matched-footprint control and ablation study confirm leakage is structure-dominated and not explained by scale artefacts. These results demonstrate that circuit cutting is not confidentiality-neutral and that metadata leakage should be treated as a first-class security concern in quantum cloud systems.
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
Circuit cutting is a novel technique in the field of quantum computing that offers a promising approach for breaking up large quantum circuits into smaller ones that can be executed on smaller quantum computers. Circuit cutting offers a scalable and hybrid computing approach, by combining classical and quantum computers to run large quantum circuits. At the same time, quantum circuits represent the fundamental building blocks of quantum algorithms, and obfuscation techniques are crucial for protecting the sensitive information and intellectual property encoded in these circuits. This paper constitutes the first security analysis of circuit cutting techniques as a means to protect quantum circuits, and not just for cutting bigger quantum circuits to fit on smaller devices. As cloud providers are in control of quantum computers and give access to users, utilizing cloud-based quantum computers for executing quantum circuits involves considerable security risks. This work demonstrates that quantum circuits can be effectively obfuscated by using quantum circuit cutting techniques. If users are worried about an adversary who attempts to reverse-engineer the original quantum algorithm, circuit cutting can be used as a security measure. To further provide configurable obfuscation level, i.e. number of possible circuits that the cloud provider would have to guess, this work proposes a novel dummy-subcircuits technique. This technique introduces dummy subcircuits with additional qubit cut points to create more confusion for the cloud provider and further help to obfuscate the user's original circuits with limited cost.
As quantum computing advances, quantum circuit simulators serve as critical tools to bridge the current gap caused by limited quantum hardware availability. These simulators are typically deployed on cloud platforms, where users submit proprietary circuit designs for simulation. In this work, we demonstrate a novel timing side-channel attack targeting cloud-based quantum simulators. A co-located malicious process can observe fine-grained execution timing patterns to extract sensitive information about concurrently running quantum circuits. We systematically analyze simulator behavior using the QASMBench benchmark suite, profiling timing and memory characteristics across various circuit executions. Our experimental results show that timing profiles exhibit circuit-dependent patterns that can be effectively classified using pattern recognition techniques, enabling the adversary to infer circuit identities and compromise user confidentiality. We were able to achieve 88% to 99.9% identification rate of quantum circuits based on different datasets. This work highlights previously unexplored security risks in quantum simulation environments and calls for stronger isolation mechanisms to protect user workloads
Quantum computing research has experienced tremendous advancements in recent years, and real-world applications that utilize quantum hardware are continuously emerging. Large companies are investing in quantum computing for a wide range of applications, such as finance, drug discovery, secure communications, etc. As quantum computer deployment is expected to increase and be further commercialized in the upcoming years, it is vital to develop secure systems and protocols able to protect confidential data from untrusted parties. Quantum circuit cutting is a technique originally developed to compensate for the NISQ state of quantum technology, as it breaks a large quantum circuit into several smaller subcircuits that can fit into available QPUs. However, the same method can also be applied to provide security guarantees and protect the user's data from malicious third parties that own the quantum hardware. In this paper, we present a methodology for employing circuit cutting to efficiently use available QPUs and hide the submitted algorithm from potentially malicious cloud providers. We assume variable provider intelligence and introduce two obfuscation techniques, namely, virtual subcircuits and virtual cuts, to provide a modular obfuscation level.
The developments in quantum computing hardware and software are focused on boosting the scalability and robustness of quantum systems. With near-term quantum computers poised to accelerate specific computational tasks, ensuring their security has become a pressing priority. Recent efforts have proposed practical solutions to ensure data confidentiality in quantum computers accessed through the cloud, particularly in the presence of untrusted quantum cloud providers by leveraging trusted hardware that enables quantum circuit obfuscation. However, these solutions overlook the detailed structural information of the quantum algorithms, which may limit the effectiveness of the obfuscation methods. In this paper, we investigate the structural constraints of quantum algorithms executed across different quantum architectures. Based on this analysis, we develop a Machine Learning (ML)-based classifier that reveals the underlying quantum algorithm of the obfuscated physical quantum circuit. We also propose a pre-processing phase to minimize the obfuscation's impact on the classifier accuracy. We evaluate our proposed ML-based classification model on different obfuscated physical quantum circuits, which are transpiled to support IBM quantum hardware. Our analysis shows the vulnerability of existing obfuscation methods to reverse engineering attacks, which can potentially expose sensitive information about quantum circuits.
Third-party cloud providers offer quantum hardware as a service enabling flexibility to the customers to opt from varied quantum hardware, qubit technologies and topologies. However, the actual execution of the program on the desired target hardware remains opaque to the user. On one hand, the program performance, along with various other metadata such as cost, performance, & number of iterations to converge, is dependent on the quality of the backend chosen. on the other hand, the third-party provider and/or tools (e.g., hardware schedulers) may maximize profit by running the quantum circuits on poor quality backend while charging for the high quality backend. Existing approaches to mitigate this opaqueness rely on forensics of error rates and coupling topology from transpiled circuit. We note that program queue depth and execution time are well correlated with the backend and therefore, can reveal vital information about the hardware and aid in forensic analysis to address the opaqueness.