Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2605.14325

Toward Covert Quantum Computing

Evan J. D. Anderson, Kaushik Datta, Boulat A. Bash

quant-phcs.CRSubmitted May 14, 2026• Announced May 15, 2026• 0 citations
arXivHTMLPDF

Abstract

As quantum computers become available through multi-tenant cloud platforms, ensuring privacy against adversaries sharing the same quantum processing unit becomes critical. We introduce and explore \emph{covert quantum computing}, a new concept that ensures an adversary with access to all other quantum computational units (QCUs) of a quantum computer cannot detect computation on the subset that they cannot access. Analogous to covert communication, we employ information theory. However, since here the adversary controls the systems used for detection, we require a richer framework for covertness analysis that accounts for the use of quantum memories and adaptive operations. Thus, we adopt the \emph{quantum-strategy} framework used in quantum game theory and memory channel discrimination. Current quantum computers use planar graph circuit layouts and typically assume nearest-neighbor crosstalk. We derive discrete isoperimetric inequalities to show that, for an $n$-qubit circuit under this model, only $\mathcal{O}(\sqrt{n})$ border qubits provide detection information to the adversary. We then explore this scaling law on IQM's 54-qubit \emph{Emerald} processor and IBM's 156-qubit \emph{ibm\_fez} machine employing the Heron 2 architecture. We implement Ramsey experiments on qubits not used in computation, and detect nearest-neighbor crosstalk, as expected. However, we also observe long-range coupling effects beyond the border qubits, revealing a side channel that the adversary can exploit. We hypothesize that this long-range crosstalk is induced by leakage from the drive and control lines. Beyond weakening covertness, it exposes co-tenants to both adversarial and unintended crosstalk and degrades circuits that span spatially distributed qubits, motivating further work on spatial isolation and crosstalk characterization.

Related papers

Covert Quantum Communication Over Bosonic Channels and Covert Quantum Computing

Evan J. D. Anderson

This dissertation explores covertness in two quantum settings: communication and computing. Covert communication refers to transmitting over a channel such that an adversary cannot detect the presence of the transmission, whereas covert quantum computing refers to running computations on a quantum computer that are undetectable by an adversary who is also using the same device. Although these problems arise from different physical phenomena, they share the common goal of preventing an adversary from detecting their operation. We begin by presenting the preliminaries and mathematical tools from quantum information theory required for covert analysis of communication over quantum channels and covert quantum computing. We then proceed to explore covert communication over the lossy thermal-noise bosonic channel, a quantum-mechanical model of many practical channels, including optical ones. First, we characterize the covert capacity region of the degraded lossy thermal-noise bosonic broadcast channel. We extend prior work on degraded bosonic broadcast channels to incorporate photon loss to an adversarial environment. We derive the classical capacity region and the covert capacity for the two-receiver case, and extend them to $M$ receivers. We demonstrate that coherent-state encoding achieves these capacities and establish that time-division is optimal in the covert regime. These results rely on a strong minimum entropy output conjecture, a direct result of the entropy photon-number inequality (EPnI) conjecture. Building on covert communication, we develop a system construction for reliable transmission of covert qubits over an arbitrary quantum channel using single- and dual-rail encodings. We apply this construction to the lossy thermal-noise bosonic channel, thereby deriving achievable rates. We further explore the impact of access to a two-way classical communication link. While a tight upper bound remains an open problem, we provide a converse upper bound by decomposing the channel into a concatenation of a pure-loss channel and a quantum-limited amplifier and discarding the former. These bounds demonstrate a \emph{square root law} (SRL) for covert quantum communication similar to that for classical: $M(n)\propto\sqrt{n}$ qubits can be transmitted covertly and reliably over $n$ uses of the channel. We conjecture that the gap between our lower and upper bounds on the number of reliable covert qubits can be reduced by improving quantum error-correction codes and quantum channel capacity bounds. We then shift our focus to \emph{covert quantum computing}, introducing and formalizing a setting in which an adversary attempts to detect whether computation is occurring on a shared quantum processing unit (QPU) by monitoring a subset of the qubits or qumodes. For superconducting architectures with a nearest-neighbor crosstalk noise model and planar qubit topologies, a circuit remains covert by inserting idle qubits between the qubits running the computation and the remaining qubits on the QPU. Using discrete isoperimetric inequalities, we show that a circuit placement exists such that only $\mathcal{O}(\sqrt{n})$ spectator qubits bordering the circuit provide detection information to an adversary, where $n$ is the number of qubits used for computation. Thus, in this setting, the cost of maintaining covertness while also maintaining reliability of the computation is an additional $\mathcal{O}(\sqrt{n})$ idle border qubits. We experimentally explore this model on IQM's Emerald processor, using Ramsey experiments on the adversary's qubits to detect gate operations. While nearest-neighbor crosstalk was detected as expected, long-range coupling effects were also observed beyond the border qubits, identifying a side channel that an adversary can exploit for detection. Finally, we discuss the outlook, future research directions, and open problems.

•Jan 1, 2025•0 citations

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Lee, Wei Jie Bryan, Siyi Wang, Dutta, Suman +2 more

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

arXiv:2502.10115•Feb 14, 2025•0 citations

Covert Quantum Communication Over Optical Channels

Evan J. D. Anderson, Christopher K. Eyre, Isabel M. Dailey +2 more

We explore covert communication of qubits over the lossy thermal-noise bosonic channel, which is a quantum-mechanical model of many practical channels, including optical. Covert communication ensures that an adversary is unable to detect the presence of transmissions, which are concealed in channel noise. We show a \emph{square root law} (SRL) for quantum covert communication similar to that for classical: $\propto\sqrt{n}$ qubits can be transmitted covertly and reliably over $n$ uses of an optical channel. Our achievability proof uses photonic dual-rail qubit encoding, which has been proposed for long-range repeater-based quantum communication and entanglement distribution. Our converse employs prior covert signal power limit results and adapts well-known methods to upper bound quantum capacity of optical channels. Finally, we believe that the gap between our lower and upper bounds for the number of reliable covert qubits can be mitigated by improving the quantum error correction codes and quantum channel capacity bounds.

arXiv:2401.06764•Jan 12, 2024•1 citation

Square Root Law for Covert Quantum Communication over Optical Channels

Evan J. D. Anderson, Christopher K. Eyre, Isabel M. Dailey +2 more

We explore covert communication of qubits over the lossy thermal-noise bosonic channel, which is a quantum-mechanical model of many practical channels, including optical. Covert communication ensures that an adversary is unable to detect the presence of transmissions, which are concealed in channel noise. We show a square root law (SRL) for quantum covert communication similar to that for classical:$\propto\sqrt{n}$qubits can be transmitted covertly and reliably over$n$uses of an optical channel. Our achievability proof uses photonic dual-rail qubit encoding, which has been proposed for long-range repeater-based quantum communication and entanglement distribution. Our converse employs prior covert signal power limit results and adapts well-known methods to upper bound quantum capacity of optical channels. Finally, we believe that the gap between our lower and upper bounds for the number of reliable covert qubits can be mitigated by improving the quantum error correction codes and quantum channel capacity bounds.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Sep 15, 2024•6 citations

POSTER: Stealthy SWAP-Based Side-Channel Attack on Multi-Tenant Quantum Cloud Systems

Wei Jie Bryan Lee, Siyi Wang, Suman Dutta +2 more

The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.

ACM Asia Conference on Computer and Communications Security (ASIA CCS)•Aug 13, 2025•3 citations

Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers

Navnil Choudhury, Chaithanya Naik Mude, Sanjay Das +3 more

As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.

arXiv:2412.10507•Network and Distributed System Security Symposium•Jan 1, 2025•11 citations
As quantum computers become available through multi-tenant cloud platforms, ensuring privacy against adversaries sharing the same quantum processing unit becomes critical. We introduce and explore \emph{covert quantum computing}, a new concept that ensures an adversary with access to all other quantum computational units (QCUs) of a quantum computer cannot detect computation on the subset that they cannot access. Analogous to covert communication, we employ information theory. However, since here the adversary controls the systems used for detection, we require a richer framework for covertness analysis that accounts for the use of quantum memories and adaptive operations. Thus, we adopt the \emph{quantum-strategy} framework used in quantum game theory and memory channel discrimination. Current quantum computers use planar graph circuit layouts and typically assume nearest-neighbor crosstalk. We derive discrete isoperimetric inequalities to show that, for an nnn-qubit circuit under this model, only O(n)\mathcal{O}(\sqrt{n})O(n​) border qubits provide detection information to the adversary. We then explore this scaling law on IQM's 54-qubit \emph{Emerald} processor and IBM's 156-qubit \emph{ibm_fez} machine employing the Heron 2 architecture. We implement Ramsey experiments on qubits not used in computation, and detect nearest-neighbor crosstalk, as expected. However, we also observe long-range coupling effects beyond the border qubits, revealing a side channel that the adversary can exploit. We hypothesize that this long-range crosstalk is induced by leakage from the drive and control lines. Beyond weakening covertness, it exposes co-tenants to both adversarial and unintended crosstalk and degrades circuits that span spatially distributed qubits, motivating further work on spatial isolation and crosstalk characterization.
This dissertation explores covertness in two quantum settings: communication and computing. Covert communication refers to transmitting over a channel such that an adversary cannot detect the presence of the transmission, whereas covert quantum computing refers to running computations on a quantum computer that are undetectable by an adversary who is also using the same device. Although these problems arise from different physical phenomena, they share the common goal of preventing an adversary from detecting their operation. We begin by presenting the preliminaries and mathematical tools from quantum information theory required for covert analysis of communication over quantum channels and covert quantum computing. We then proceed to explore covert communication over the lossy thermal-noise bosonic channel, a quantum-mechanical model of many practical channels, including optical ones. First, we characterize the covert capacity region of the degraded lossy thermal-noise bosonic broadcast channel. We extend prior work on degraded bosonic broadcast channels to incorporate photon loss to an adversarial environment. We derive the classical capacity region and the covert capacity for the two-receiver case, and extend them to MMM receivers. We demonstrate that coherent-state encoding achieves these capacities and establish that time-division is optimal in the covert regime. These results rely on a strong minimum entropy output conjecture, a direct result of the entropy photon-number inequality (EPnI) conjecture. Building on covert communication, we develop a system construction for reliable transmission of covert qubits over an arbitrary quantum channel using single- and dual-rail encodings. We apply this construction to the lossy thermal-noise bosonic channel, thereby deriving achievable rates. We further explore the impact of access to a two-way classical communication link. While a tight upper bound remains an open problem, we provide a converse upper bound by decomposing the channel into a concatenation of a pure-loss channel and a quantum-limited amplifier and discarding the former. These bounds demonstrate a \emph{square root law} (SRL) for covert quantum communication similar to that for classical: M(n)∝nM(n)\propto\sqrt{n}M(n)∝n​ qubits can be transmitted covertly and reliably over nnn uses of the channel. We conjecture that the gap between our lower and upper bounds on the number of reliable covert qubits can be reduced by improving quantum error-correction codes and quantum channel capacity bounds. We then shift our focus to \emph{covert quantum computing}, introducing and formalizing a setting in which an adversary attempts to detect whether computation is occurring on a shared quantum processing unit (QPU) by monitoring a subset of the qubits or qumodes. For superconducting architectures with a nearest-neighbor crosstalk noise model and planar qubit topologies, a circuit remains covert by inserting idle qubits between the qubits running the computation and the remaining qubits on the QPU. Using discrete isoperimetric inequalities, we show that a circuit placement exists such that only O(n)\mathcal{O}(\sqrt{n})O(n​) spectator qubits bordering the circuit provide detection information to an adversary, where nnn is the number of qubits used for computation. Thus, in this setting, the cost of maintaining covertness while also maintaining reliability of the computation is an additional O(n)\mathcal{O}(\sqrt{n})O(n​) idle border qubits. We experimentally explore this model on IQM's Emerald processor, using Ramsey experiments on the adversary's qubits to detect gate operations. While nearest-neighbor crosstalk was detected as expected, long-range coupling effects were also observed beyond the border qubits, identifying a side channel that an adversary can exploit for detection. Finally, we discuss the outlook, future research directions, and open problems.
The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by 81.62%81.62\%81.62% through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as 6.25%6.25\%6.25% of the victim's, achieves 100%100\%100% accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.
We explore covert communication of qubits over the lossy thermal-noise bosonic channel, which is a quantum-mechanical model of many practical channels, including optical. Covert communication ensures that an adversary is unable to detect the presence of transmissions, which are concealed in channel noise. We show a \emph{square root law} (SRL) for quantum covert communication similar to that for classical: ∝n\propto\sqrt{n}∝n​ qubits can be transmitted covertly and reliably over nnn uses of an optical channel. Our achievability proof uses photonic dual-rail qubit encoding, which has been proposed for long-range repeater-based quantum communication and entanglement distribution. Our converse employs prior covert signal power limit results and adapts well-known methods to upper bound quantum capacity of optical channels. Finally, we believe that the gap between our lower and upper bounds for the number of reliable covert qubits can be mitigated by improving the quantum error correction codes and quantum channel capacity bounds.
We explore covert communication of qubits over the lossy thermal-noise bosonic channel, which is a quantum-mechanical model of many practical channels, including optical. Covert communication ensures that an adversary is unable to detect the presence of transmissions, which are concealed in channel noise. We show a square root law (SRL) for quantum covert communication similar to that for classical:∝n\propto\sqrt{n}∝n​qubits can be transmitted covertly and reliably overnnnuses of an optical channel. Our achievability proof uses photonic dual-rail qubit encoding, which has been proposed for long-range repeater-based quantum communication and entanglement distribution. Our converse employs prior covert signal power limit results and adapts well-known methods to upper bound quantum capacity of optical channels. Finally, we believe that the gap between our lower and upper bounds for the number of reliable covert qubits can be mitigated by improving the quantum error correction codes and quantum channel capacity bounds.
The rapid advancement of quantum computing has led to an increased use of cloud-based quantum devices, raising concerns over the privacy and security of computations on multi-tenant quantum systems. Previous studies have explored crosstalk in these environments, but several questions remain regarding its causes, countermeasures, and applicability. In this work, we revisit the crosstalk effect, tracing it to the SWAP path between qubits, demonstrating its effectiveness even over long distances. Specifically, we introduce a SWAP-based side-channel attack in both active and passive modes, validated on real IBM quantum devices. In the active attack, a single CNOT gate disrupts Grover’s Algorithm from afar with an 81.62% reduction in output accuracy. The passive attack, using a circuit just 6.25% of the victim’s size, achieves 100% accuracy in predicting circuit attributes in Simon’s Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, demonstrating that attackers can still extract sensitive information or manipulate results remotely.
As quantum computing rapidly advances, its nearterm applications are becoming increasingly evident.However, the high cost and under-utilization of quantum resources are prompting a shift from single-user to multi-user access models.In a multi-tenant environment, where multiple users share one quantum computer, protecting user confidentiality becomes crucial.The varied uses of quantum computers increase the risk that sensitive data encoded by one user could be compromised by others, rendering the protection of data integrity and confidentiality essential.In the evolving quantum computing landscape, it is imperative to study these security challenges within the scope of realistic threat model assumptions, wherein an adversarial user can mount practical attacks without relying on any heightened privileges afforded by physical access to a quantum computer or rogue cloud services.In this paper, we demonstrate the potential of crosstalk as an attack vector for the first time on a Noisy Intermediate Scale Quantum (NISQ) machine, that an adversarial user can exploit within a multi-tenant quantum computing model.The proposed side-channel attack is conducted with minimal and realistic adversarial privileges, with the overarching aim of uncovering the quantum algorithm being executed by a victim.Crosstalk signatures are used to estimate the presence of CNOT gates in the victim circuit, and subsequently, this information is encoded and classified by a graph-based learning model to identify the victim quantum algorithm.When evaluated on up to 336 benchmark circuits, our attack framework is found to be able to unveil the victim's quantum algorithm with up to 85.7% accuracy.