Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2607.05281

Routing Anonymity and Identifiability of Noisy Quantum Hardware

Ben Priestley, Mina Doosti

quant-phcs.LGSubmitted Jul 6, 2026• Announced Jul 7, 2026• 0 citations
arXivHTMLPDF

Abstract

Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.

Comments
22+30 pages, 6 figures

Related papers

Task-Driven Device Fingerprinting for Quantum Cloud Platforms via Modeling QNN Outcomes Under Noise

Tingting Li, Ziming Zhao, Jianwei Yin

Quantum Computing (QC) has recently achieved significant technological progress, attracting growing interest from both academia and industry. As most users currently access QC resources through cloud platforms, concerns around the security and accountability of quantum services have become increasingly prominent. In particular, quantum noise, typically considered a source of error, can also reveal device-specific signatures that enable Quantum Device Fingerprinting (QDF). While QDF has legitimate applications such as anomaly detection and device accountability, it also carries dual-use risks, including potential misuse for unauthorized device tracking or targeted attacks. In this paper, we propose a novel Task-Driven Quantum Device Fingerprinting (TD-QDF) identification method based on quantum task outputs; we extract the fingerprint features of quantum devices from noisy quantum computing results. Unlike previous research, our method does not require any additional information (e.g., hardware details or noise information), thereby enhancing its practical applicability and accessibility. We conducted large-scale experiments using six QNN circuits on 10 IBM quantum computers, extended four classical quantum algorithms to validate generality, and demonstrated scalability on three 127-qubit processors. Specifically, the highest accuracy can reach up to 94.32% in the 3-classification device fingerprint recognition task and up to 82.4% and 61.6% in the 7-classification and 10-classification tasks, respectively. This research contributes to advancing quantum fingerprinting technologies and holds promising implications for enhancing the security and accountability of quantum computing systems and quantum cloud services.

IEEE Transactions on Information Forensics and Security•Jan 1, 2025•6 citations

A Cross-layer Provenance-Protection Architecture for Repeated Quantum Measurements in the Cloud

Baihe Ma, Zhanning Wang, X. Rosalind Wang +8 more

Abstract Quantum cloud users access remote processors through classical measurement transcripts. The repeated shots that are operationally required for reliable quantum readout can systematically resolve microscopic, quasi-static hardware variations into stable statistical fingerprints. On IBM superconducting processors, we show that a transcript-only adversary can identify the backend with up to $89.3\%$ attack success rate at $T = 20$ repetition rounds under multi-interface aggregation. This exposes a privacy locus mismatch: many channel-centric quantum privacy formulations regulate distinguishability at the level of quantum states or channels, whereas the operational attack in Quantum-Computing-as-a-Service (QCaaS) targets repeated classical transcripts and the latent service provenance they reveal after measurement. We therefore formulate privacy for repeated quantum workloads as a cross-layer provenance-protection problem. We protect the latent service provenance behind a released transcript, namely the service provenance that jointly reflects backend realization and serving context in QCaaS settings where this provenance is not fully disclosed to the observing party. At the measurement interface, we formulate Measurement-Agnostic Quantum Differential Privacy (MA-QDP) as an operational transcript-level privacy criterion for repeated quantum workloads, uniform over physically admissible POVMs and arbitrary classical post-processing. MA-QDP specifies the privacy locus and protected secret appropriate to QCaaS transcript release, and is instantiated via atomic outcome randomization before aggregation. At the orchestration layer, we incorporate context decorrelation to suppress persistent linkage of repeated sessions to a stable service provenance. In controlled simulations, the integrated framework suppresses provenance inference under realistic shot budgets while preserving task-relevant information, yielding a favorable privacy-utility frontier compared to channel-level and classical-level perturbations. Together, our results identify repetition as an intrinsic fingerprint amplifier in QCaaS and motivate a cross-layer provenance-protection architecture for secure, repeated quantum workloads.

•Mar 27, 2026•0 citations

A Graph-Based Forensic Framework for Inferring Hardware Noise of Cloud Quantum Backend

Subrata Das, Archisman Ghosh, Swaroop Ghosh

Cloud quantum platforms give users access to many backends with different qubit technologies, coupling layouts, and noise levels. The execution of a circuit, however, depends on internal allocation and routing policies that are not observable to the user. A provider may redirect jobs to more error-prone regions to conserve resources, balance load or for other opaque reasons, causing degradation in fidelity while still presenting stale or averaged calibration data. This lack of transparency creates a security gap: users cannot verify whether their circuits were executed on the hardware for which they were charged. Forensic methods that infer backend behavior from user-visible artifacts are therefore becoming essential. In this work, we introduce a Graph Neural Network (GNN)-based forensic framework that predicts per-qubit and per-qubit link error rates of an unseen backend using only topology information and aggregated features extracted from transpiled circuits. We construct a dataset from several IBM 27-qubit devices, merge static calibration features with dynamic transpilation features and train separate GNN regressors for one- and two-qubit errors. At inference time, the model operates without access to calibration data from the target backend and reconstructs a complete error map from the features available to the user. Our results on the target backend show accurate recovery of backend error rate, with an average mismatch of approximately 22% for single-qubit errors and 18% for qubit-link errors. The model also exhibits strong ranking agreement, with the ordering induced by predicted error values closely matching that of the actual calibration errors, as reflected by high Spearman correlation. The framework consistently identifies weak links and high-noise qubits and remains robust under realistic temporal noise drift.

quant-pharXiv:2512.14541•Dec 17, 2025•0 citations

Addressing Vulnerabilities and Opacities in Quantum Service Providers

Rupshali Roy

There is a steady growth in research and demand for real quan- tum hardware in the Noisy Intermediate-Scale Quantum (NISQ) era of quantum computing. This prompts many third-party cloud providers to set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. Quantum circuits submitted to these services are the fruits of the efforts invested by the designers. But these third-party cloud compilers (who offer more efficient alter- natives to established compilers) can make user circuits/programs vulnerable to various security breaches. Communication channels for transmitting quantum information also need to be developed such that there is end to end encryption. There is little to no visibil- ity on where the execution of the circuit is actually taking place. The success of the user program is highly reliant on the backend that was used for execution. Besides, the third-party provider and/or tools (e.g., hardware mapper and allocator) may be untrustworthy and execute the quantum circuits on less efficient and more error- prone hardware to conserve resources and maximize profit. These vulnerabilities in the quantum system could leak confidential data, cause loss of intellectual property rights of designers, cause loss of access control, corrupt user programs et cetera. Thus, it is imper- ative to identify these security vulnerabilities and create defense strategies to protect quantum programs, thus helping to maintain the integrity of quantum information across the software stack. My thesis aims to help address these vulnerabilities and opacities and address them.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Nov 19, 2025•1 citation

Artifact of Live Noise Fingerprints as an Empirical Semantics for Noisy Quantum Channels

Anonymous for Peer Review

Abstract Quantum computations execute on noisy hardware whose effective noise is opaque and varies across platforms and over time. Complete descriptions of the underlying noise channel are often too detailed for reasoning, comparison, or analysis. We therefore study the semantic problem of constructing tractable abstractions of noisy quantum channels: given a finite set of observations, how can we summarise channel behaviour while preserving properties of interest? We characterise the effective noise of a quantum channel as an abstract domain of noise fingerprints. A noise fingerprint is an observational abstraction of a quantum channel over a finite experiment interface. We formalise the relation between concrete channels and fingerprints through an approximate Galois connection and derive four abstraction properties: soundness, conciseness, efficiency, and adaptiveness. We provide an executable instantiation of the abstraction function using the classical-shadow estimator, together with a partial concretisation function that reconstructs channels from fingerprints via semidefinite programming. We evaluate this abstraction against the formal properties: the soundness bound is shown to be tight, compression over the concrete domain is exponential with near-lossless retention, sample complexity is (poly)logarithmic, and incremental updates track channel drift at the optimal rate. Additional experiments show that fingerprints preserve physically meaningful noise signatures and distinguish cross-platform behaviours. Together, this work brings abstract interpretation to the empirical semantics of noisy quantum channels, providing a lightweight, formally grounded abstraction for characterising, comparing, and monitoring noisy quantum executions. Context Characterising noisy quantum channels remains challenging: full process tomography scales exponentially with system size, while commonly used noise metrics provide limited semantic guarantees. This artifact accompanies a paper that introduces live noise fingerprints as a reusable semantic abstraction for noisy quantum channels. A noise fingerprint is defined as the matrix of deviations between observed and ideal Pauli expectation values over a fixed experimental interface. We show that these fingerprints form an abstract domain for completely positive trace-preserving (CPTP) maps through an approximate Galois connection to the concrete channel space. The framework is evaluated against four formal requirements: Soundness — a Lipschitz bound relating abstract distance to diamond-norm distance. Conciseness — substantial compression relative to the underlying channel representation. Estimation efficiency — practical estimation from finite measurements. Adaptiveness — support for incremental updates under channel drift. The concrete instantiation uses the Huang–Kueng–Preskill classical-shadow estimator with median-of-means aggregation. Every theoretical claim is machine-verified. The artifact includes exact SDP-based diamond norms for small systems, two independently validated large-system ground truths (completely bounded norm multiplicativity for single-site channel pairs and the exact Pauli-channel ℓ₁ formula), and a product-factorised classical-shadow sampler proven distribution-identical to the full sampler. All four research questions are evaluated for n = 1–8 qubits across 12 experimental configurations, combining three channel families with hardware-informed profiles derived from IBM Boston and Quantinuum H2 calibrations under both Qiskit and Cirq simulation variants. All stochastic measurements are reported as mean ± standard deviation, and every figure includes error bars. New in this version. The artifact now includes a self-contained worked example, worked_example.ipynb, which runs the abstraction end to end on small quantum programs: from OpenQASM source, through the gates and the noise a backend inserts around them, to the observation interface a program's test defines, the resulting fingerprints, and the decision they support. It is written for readers approaching the work from programming languages and software engineering rather than quantum information, and it is the shortest path into the artifact: it requires only NumPy, runs in seconds, and needs no SDP solver, quantum SDK, or hardware. The artifact also characterises the operational limits of the approach, including detectability thresholds at realistic hardware noise rates, readout-error-induced bias floors, explicit interface-blindness constructions and their informationally complete remedies, and drift regimes where warm-started updates remain beneficial. Artifact Evaluation file This artifact accompanies the paper "Live Noise Fingerprints as an Empirical Semantics for Noisy Quantum Channels" and provides the complete implementation, experiments, and evaluation pipeline used to validate the proposed noise-fingerprint abstraction. The package includes a pure Python/NumPy implementation of noisy quantum channels, classical-shadow fingerprint estimation, semidefinite-programming-based concretisation, machine-checked tests, a worked-example notebook, and scripts to reproduce every figure and quantitative claim reported in the paper. Evaluators can start from the notebook for a program-level walkthrough of the abstraction, verify correctness using an automated verification target, and regenerate all experimental results, including scalability, convergence, variance, detectability, and warm-start analyses. Precomputed datasets and figures are included to enable immediate inspection, while the full experimental pipeline can be rerun from scratch without requiring GPUs, quantum hardware, or network access after dependency installation. The artifact is released under the MIT License and is designed for reuse by allowing new quantum programs, hardware noise profiles, qubit counts, and abstraction properties to be incorporated with minimal modification. Package Contents worked_example.ipynb — a self-contained, executed walkthrough of the abstraction on small programs. It covers: an OpenQASM front end and the ideal denotation of a program; the realisation of that program on a backend, with the backend's noise inserted after every gate and rendered in the printed circuit; the observation interface, derived from what a program's test asserts rather than chosen freely; fingerprints and the equivalence decision, over five benchmark programs and five backend configurations, with a diagnostic per program naming the observation that carries the difference; interface blindness and its repair by refinement; prefix sweeping to localise which gate two realisations first disagree on; a control panel for running the whole chain on the reader's own .qasm file; measurement-reuse accounting, and numerical checks of three properties from the paper. Outputs are stored in the notebook, so it can be read without execution. src/ Pure NumPy implementation of: Quantum states and channels Noise fingerprints Literal classical-shadow estimators (full and product-factorised) Optional readout-error models Exact diamond-norm computation via Watrous SDPs Validated large-system diamond-norm ground truths General SDP-based concretisation procedures Configurable noise models Registry of all 12 experimental configurations (profiles.py) experiments/ Experiment drivers for all research questions: rq1_sweep.py — Soundness rq2_sweep.py — Conciseness rq3_sweep.py — Estimation Efficiency rq4_sweep.py — Adaptiveness Additional components include audited single-size reproductions, a stress-test suite (realistic_limits.py), a seed-sweep audit framework, and a figure-generation pipeline with shared publication styling. results/ — JSON outputs containing every measured data point for each research question. figures/ — Results figures, one file per figure. tests/ — Forty-one machine-checked tests, including validation of exact diamond-norm ground truths, verification of the product-factorised sampler, and consistency checks required before experimental execution. Additional files — README.md (overview, results summary, and reproduction guide), Dockerfile (containerised environment), requirements.txt (pinned dependencies). Installation The artifact requires Python 3.10 or later. Install dependencies: pip install -r requirements.txt Required packages: NumPy, SciPy, CVXPY, scikit-learn, matplotlib. Opening the worked-example notebook additionally requires jupyter; the notebook itself imports only NumPy and can also be read as-is, since its outputs are stored. No quantum SDK is required; all simulations use a pure NumPy density-matrix implementation. A containerised environment is also provided: docker build . Getting started: the worked example jupyter notebook notebooks/worked_example.ipynb Approximate runtime: under one minute; NumPy only. This is the recommended entry point. It takes a program in OpenQASM, shows what a backend does to it, derives the observation interface from the program's test, computes the fingerprints, and decides whether the two backends are interchangeable for that test — the abstraction of the paper, on objects small enough to check by hand. Expected results Two backends implementing the same physical noise by different means are judged interchangeable on all five programs, with deviations at machine precision (≈ 10⁻¹⁶). A leftover coherent phase rotation, of the kind an optimisation pass can introduce, is flagged on four of the five programs and correctly cleared on the fifth, whose test reads only populations and therefore cannot be affected by it. Judged on a population-only interface, the same phase rotation is invisible; refining the interface to the observables the program's test actually reads restores it. The prefix sweep localises a fault confined to the two-qubit gate at exactly that gate, and reports the earliest divergence when the

•Jul 5, 2026•0 citations

Quantum Workload Privacy Beyond Data Confidentiality

Shaunak Suresh Pawar, Samuel Punch, Krishnendu Guha

Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.

arXiv:2609.02323•Sep 2, 2026•0 citations
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Quantum Computing (QC) has recently achieved significant technological progress, attracting growing interest from both academia and industry. As most users currently access QC resources through cloud platforms, concerns around the security and accountability of quantum services have become increasingly prominent. In particular, quantum noise, typically considered a source of error, can also reveal device-specific signatures that enable Quantum Device Fingerprinting (QDF). While QDF has legitimate applications such as anomaly detection and device accountability, it also carries dual-use risks, including potential misuse for unauthorized device tracking or targeted attacks. In this paper, we propose a novel Task-Driven Quantum Device Fingerprinting (TD-QDF) identification method based on quantum task outputs; we extract the fingerprint features of quantum devices from noisy quantum computing results. Unlike previous research, our method does not require any additional information (e.g., hardware details or noise information), thereby enhancing its practical applicability and accessibility. We conducted large-scale experiments using six QNN circuits on 10 IBM quantum computers, extended four classical quantum algorithms to validate generality, and demonstrated scalability on three 127-qubit processors. Specifically, the highest accuracy can reach up to 94.32% in the 3-classification device fingerprint recognition task and up to 82.4% and 61.6% in the 7-classification and 10-classification tasks, respectively. This research contributes to advancing quantum fingerprinting technologies and holds promising implications for enhancing the security and accountability of quantum computing systems and quantum cloud services.
Abstract Quantum cloud users access remote processors through classical measurement transcripts. The repeated shots that are operationally required for reliable quantum readout can systematically resolve microscopic, quasi-static hardware variations into stable statistical fingerprints. On IBM superconducting processors, we show that a transcript-only adversary can identify the backend with up to 89.3%89.3\%89.3% attack success rate at T=20T = 20T=20 repetition rounds under multi-interface aggregation. This exposes a privacy locus mismatch: many channel-centric quantum privacy formulations regulate distinguishability at the level of quantum states or channels, whereas the operational attack in Quantum-Computing-as-a-Service (QCaaS) targets repeated classical transcripts and the latent service provenance they reveal after measurement. We therefore formulate privacy for repeated quantum workloads as a cross-layer provenance-protection problem. We protect the latent service provenance behind a released transcript, namely the service provenance that jointly reflects backend realization and serving context in QCaaS settings where this provenance is not fully disclosed to the observing party. At the measurement interface, we formulate Measurement-Agnostic Quantum Differential Privacy (MA-QDP) as an operational transcript-level privacy criterion for repeated quantum workloads, uniform over physically admissible POVMs and arbitrary classical post-processing. MA-QDP specifies the privacy locus and protected secret appropriate to QCaaS transcript release, and is instantiated via atomic outcome randomization before aggregation. At the orchestration layer, we incorporate context decorrelation to suppress persistent linkage of repeated sessions to a stable service provenance. In controlled simulations, the integrated framework suppresses provenance inference under realistic shot budgets while preserving task-relevant information, yielding a favorable privacy-utility frontier compared to channel-level and classical-level perturbations. Together, our results identify repetition as an intrinsic fingerprint amplifier in QCaaS and motivate a cross-layer provenance-protection architecture for secure, repeated quantum workloads.
Cloud quantum platforms give users access to many backends with different qubit technologies, coupling layouts, and noise levels. The execution of a circuit, however, depends on internal allocation and routing policies that are not observable to the user. A provider may redirect jobs to more error-prone regions to conserve resources, balance load or for other opaque reasons, causing degradation in fidelity while still presenting stale or averaged calibration data. This lack of transparency creates a security gap: users cannot verify whether their circuits were executed on the hardware for which they were charged. Forensic methods that infer backend behavior from user-visible artifacts are therefore becoming essential. In this work, we introduce a Graph Neural Network (GNN)-based forensic framework that predicts per-qubit and per-qubit link error rates of an unseen backend using only topology information and aggregated features extracted from transpiled circuits. We construct a dataset from several IBM 27-qubit devices, merge static calibration features with dynamic transpilation features and train separate GNN regressors for one- and two-qubit errors. At inference time, the model operates without access to calibration data from the target backend and reconstructs a complete error map from the features available to the user. Our results on the target backend show accurate recovery of backend error rate, with an average mismatch of approximately 22% for single-qubit errors and 18% for qubit-link errors. The model also exhibits strong ranking agreement, with the ordering induced by predicted error values closely matching that of the actual calibration errors, as reflected by high Spearman correlation. The framework consistently identifies weak links and high-noise qubits and remains robust under realistic temporal noise drift.
There is a steady growth in research and demand for real quan- tum hardware in the Noisy Intermediate-Scale Quantum (NISQ) era of quantum computing. This prompts many third-party cloud providers to set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. Quantum circuits submitted to these services are the fruits of the efforts invested by the designers. But these third-party cloud compilers (who offer more efficient alter- natives to established compilers) can make user circuits/programs vulnerable to various security breaches. Communication channels for transmitting quantum information also need to be developed such that there is end to end encryption. There is little to no visibil- ity on where the execution of the circuit is actually taking place. The success of the user program is highly reliant on the backend that was used for execution. Besides, the third-party provider and/or tools (e.g., hardware mapper and allocator) may be untrustworthy and execute the quantum circuits on less efficient and more error- prone hardware to conserve resources and maximize profit. These vulnerabilities in the quantum system could leak confidential data, cause loss of intellectual property rights of designers, cause loss of access control, corrupt user programs et cetera. Thus, it is imper- ative to identify these security vulnerabilities and create defense strategies to protect quantum programs, thus helping to maintain the integrity of quantum information across the software stack. My thesis aims to help address these vulnerabilities and opacities and address them.
Abstract Quantum computations execute on noisy hardware whose effective noise is opaque and varies across platforms and over time. Complete descriptions of the underlying noise channel are often too detailed for reasoning, comparison, or analysis. We therefore study the semantic problem of constructing tractable abstractions of noisy quantum channels: given a finite set of observations, how can we summarise channel behaviour while preserving properties of interest? We characterise the effective noise of a quantum channel as an abstract domain of noise fingerprints. A noise fingerprint is an observational abstraction of a quantum channel over a finite experiment interface. We formalise the relation between concrete channels and fingerprints through an approximate Galois connection and derive four abstraction properties: soundness, conciseness, efficiency, and adaptiveness. We provide an executable instantiation of the abstraction function using the classical-shadow estimator, together with a partial concretisation function that reconstructs channels from fingerprints via semidefinite programming. We evaluate this abstraction against the formal properties: the soundness bound is shown to be tight, compression over the concrete domain is exponential with near-lossless retention, sample complexity is (poly)logarithmic, and incremental updates track channel drift at the optimal rate. Additional experiments show that fingerprints preserve physically meaningful noise signatures and distinguish cross-platform behaviours. Together, this work brings abstract interpretation to the empirical semantics of noisy quantum channels, providing a lightweight, formally grounded abstraction for characterising, comparing, and monitoring noisy quantum executions. Context Characterising noisy quantum channels remains challenging: full process tomography scales exponentially with system size, while commonly used noise metrics provide limited semantic guarantees. This artifact accompanies a paper that introduces live noise fingerprints as a reusable semantic abstraction for noisy quantum channels. A noise fingerprint is defined as the matrix of deviations between observed and ideal Pauli expectation values over a fixed experimental interface. We show that these fingerprints form an abstract domain for completely positive trace-preserving (CPTP) maps through an approximate Galois connection to the concrete channel space. The framework is evaluated against four formal requirements: Soundness — a Lipschitz bound relating abstract distance to diamond-norm distance. Conciseness — substantial compression relative to the underlying channel representation. Estimation efficiency — practical estimation from finite measurements. Adaptiveness — support for incremental updates under channel drift. The concrete instantiation uses the Huang–Kueng–Preskill classical-shadow estimator with median-of-means aggregation. Every theoretical claim is machine-verified. The artifact includes exact SDP-based diamond norms for small systems, two independently validated large-system ground truths (completely bounded norm multiplicativity for single-site channel pairs and the exact Pauli-channel ℓ₁ formula), and a product-factorised classical-shadow sampler proven distribution-identical to the full sampler. All four research questions are evaluated for n = 1–8 qubits across 12 experimental configurations, combining three channel families with hardware-informed profiles derived from IBM Boston and Quantinuum H2 calibrations under both Qiskit and Cirq simulation variants. All stochastic measurements are reported as mean ± standard deviation, and every figure includes error bars. New in this version. The artifact now includes a self-contained worked example, worked_example.ipynb, which runs the abstraction end to end on small quantum programs: from OpenQASM source, through the gates and the noise a backend inserts around them, to the observation interface a program's test defines, the resulting fingerprints, and the decision they support. It is written for readers approaching the work from programming languages and software engineering rather than quantum information, and it is the shortest path into the artifact: it requires only NumPy, runs in seconds, and needs no SDP solver, quantum SDK, or hardware. The artifact also characterises the operational limits of the approach, including detectability thresholds at realistic hardware noise rates, readout-error-induced bias floors, explicit interface-blindness constructions and their informationally complete remedies, and drift regimes where warm-started updates remain beneficial. Artifact Evaluation file This artifact accompanies the paper "Live Noise Fingerprints as an Empirical Semantics for Noisy Quantum Channels" and provides the complete implementation, experiments, and evaluation pipeline used to validate the proposed noise-fingerprint abstraction. The package includes a pure Python/NumPy implementation of noisy quantum channels, classical-shadow fingerprint estimation, semidefinite-programming-based concretisation, machine-checked tests, a worked-example notebook, and scripts to reproduce every figure and quantitative claim reported in the paper. Evaluators can start from the notebook for a program-level walkthrough of the abstraction, verify correctness using an automated verification target, and regenerate all experimental results, including scalability, convergence, variance, detectability, and warm-start analyses. Precomputed datasets and figures are included to enable immediate inspection, while the full experimental pipeline can be rerun from scratch without requiring GPUs, quantum hardware, or network access after dependency installation. The artifact is released under the MIT License and is designed for reuse by allowing new quantum programs, hardware noise profiles, qubit counts, and abstraction properties to be incorporated with minimal modification. Package Contents worked_example.ipynb — a self-contained, executed walkthrough of the abstraction on small programs. It covers: an OpenQASM front end and the ideal denotation of a program; the realisation of that program on a backend, with the backend's noise inserted after every gate and rendered in the printed circuit; the observation interface, derived from what a program's test asserts rather than chosen freely; fingerprints and the equivalence decision, over five benchmark programs and five backend configurations, with a diagnostic per program naming the observation that carries the difference; interface blindness and its repair by refinement; prefix sweeping to localise which gate two realisations first disagree on; a control panel for running the whole chain on the reader's own .qasm file; measurement-reuse accounting, and numerical checks of three properties from the paper. Outputs are stored in the notebook, so it can be read without execution. src/ Pure NumPy implementation of: Quantum states and channels Noise fingerprints Literal classical-shadow estimators (full and product-factorised) Optional readout-error models Exact diamond-norm computation via Watrous SDPs Validated large-system diamond-norm ground truths General SDP-based concretisation procedures Configurable noise models Registry of all 12 experimental configurations (profiles.py) experiments/ Experiment drivers for all research questions: rq1_sweep.py — Soundness rq2_sweep.py — Conciseness rq3_sweep.py — Estimation Efficiency rq4_sweep.py — Adaptiveness Additional components include audited single-size reproductions, a stress-test suite (realistic_limits.py), a seed-sweep audit framework, and a figure-generation pipeline with shared publication styling. results/ — JSON outputs containing every measured data point for each research question. figures/ — Results figures, one file per figure. tests/ — Forty-one machine-checked tests, including validation of exact diamond-norm ground truths, verification of the product-factorised sampler, and consistency checks required before experimental execution. Additional files — README.md (overview, results summary, and reproduction guide), Dockerfile (containerised environment), requirements.txt (pinned dependencies). Installation The artifact requires Python 3.10 or later. Install dependencies: pip install -r requirements.txt Required packages: NumPy, SciPy, CVXPY, scikit-learn, matplotlib. Opening the worked-example notebook additionally requires jupyter; the notebook itself imports only NumPy and can also be read as-is, since its outputs are stored. No quantum SDK is required; all simulations use a pure NumPy density-matrix implementation. A containerised environment is also provided: docker build . Getting started: the worked example jupyter notebook notebooks/worked_example.ipynb Approximate runtime: under one minute; NumPy only. This is the recommended entry point. It takes a program in OpenQASM, shows what a backend does to it, derives the observation interface from the program's test, computes the fingerprints, and decides whether the two backends are interchangeable for that test — the abstraction of the paper, on objects small enough to check by hand. Expected results Two backends implementing the same physical noise by different means are judged interchangeable on all five programs, with deviations at machine precision (≈ 10⁻¹⁶). A leftover coherent phase rotation, of the kind an optimisation pass can introduce, is flagged on four of the five programs and correctly cleared on the fifth, whose test reads only populations and therefore cannot be affected by it. Judged on a population-only interface, the same phase rotation is invisible; refining the interface to the observables the program's test actually reads restores it. The prefix sweep localises a fault confined to the two-qubit gate at exactly that gate, and reports the earliest divergence when the
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.