Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
Quantum cloud providers can identify a user's algorithm and secret problem structure without ever seeing actual quantum data, simply by analyzing routine metadata collected for billing and system management. Existing confidentiality tools such as blind quantum computation and quantum homomorphic encryption protect the quantum payload itself, but they do not protect this classical orchestration metadata. This leaves an unexplored security risk in the logs generated when a large quantum program is split into smaller pieces to fit onto limited hardware, a process known as circuit cutting. These fragments leak sensitive information through what we term the topological transpilation penalty: the unavoidable depth and gate inflation added when a compiler reorganizes a program for a restricted hardware topology. Tests on a 156-qubit production Quantum Processing Unit (QPU) show that traditional timing side-channels fail in this setting, since hardware control-plane delays mask actual quantum execution time. The unique shape of the transpilation penalty acts instead as a persistent structural fingerprint for the hidden workload. Using 12,000 circuit fragments across eight algorithm families, our attack recovers algorithm family and Hamiltonian k-locality with near-perfect accuracy, achieving instance-disjoint AUC = 1.000 for both. This leakage persists under size-holdout evaluation on unseen circuit scales, with AUC = 0.987 and 0.986 respectively. The cutting mechanism is inferred with AUC = 0.991, and hardware topology is recovered well above chance with AUC = 0.818. These results show that circuit cutting exposes algorithmic intent, and potentially proprietary problem structure, through metadata alone, without any need to observe quantum data.
As quantum computing moves toward remote and cloud-based access, protecting quantum data during outsourced execution becomes important. Quantum one-time pad (QOTP) encryption provides information-theoretic hiding of quantum state, but evaluating gates on Pauli-encrypted data is nontrivial: Clifford operations allow classical Pauli-frame updates, whereas non-Clifford operations require key-dependent corrections.
We introduce QOTPH, a client-side key-tracked compilation framework for encrypted quantum computation. The client retains the QOTP keys and transforms each operation into a corrected gate or decomposition. The resulting circuit is executed non-adaptively by the quantum server, which neither receives the keys nor performs key updates.
We develop a unified Pauli frame compilation layer spanning Clifford operations, one- and two-qubit Pauli-generated rotations, explicit key-dependent parametrized controlled rotations, and recursively composed gates, and establish a global correctness result for circuits composed of the formally verified primitive rules. We also characterize the evaluator's view under a hidden logical circuit model, in which the QOTP frame, the uncompiled logical circuit, and the logical-to-physical instruction mapping remain client-side; the security of this model against various algorithms is also analyzed. The implementation is evaluated in Qiskit using noiseless simulation and IBM Quantum hardware, including in-circuit and local-decryption workflows.
This work bridges the gap between algebraic QOTP key tracking and practical encrypted quantum computation by providing a unified, hardware-validated compilation framework for current gate-based quantum processors.
With the rapid advancement of quantum computing, quantum compilation has become a crucial layer connecting high-level algorithms with physical hardware. In quantum cloud computing, compilation is performed on the cloud platforms, which expose user circuits to potential risks such as structural leakage and output predictability. To address these issues, we propose the encrypted-state quantum compilation scheme based on quantum circuit obfuscation (ECQCO), the first secure compilation scheme tailored for the co-location of compilers and quantum hardware for quantum cloud platforms. It applies quantum homomorphic encryption to conceal output states and instantiates a structure obfuscation mechanism based on quantum indistinguishability obfuscation, effectively protecting both functionality and topology of the circuit. Additionally, an adaptive decoupling obfuscation algorithm is designed to suppress potential idle errors while inserting pulse operations. The proposed scheme achieves information-theoretic security and guarantees computational indistinguishability under the quantum random oracle. Experimental results on benchmark datasets demonstrate that ECQCO achieves a total variation distance (TVD) of up to 0.7 and a normalized graph edit distance (GED) of 0.88, enhancing compilation-stage security. Moreover, it introduces only a slight increase in circuit depth, while keeping the average fidelity change within 1.1%, thus achieving a practical balance between security and efficiency.
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Optimization of quantum circuits using an efficient compiler is key to its success for NISQ computers. Several 3rd party compilers are evolving to offer improved performance for large quantum circuits. These 3rd parties, or just a certain release of an otherwise trustworthy compiler, may possibly be untrusted and this could lead to an adversary to Reverse Engineer (RE) the quantum circuit for extracting sensitive aspects e.g., circuit topology, program, and its properties. In this paper, we propose obfuscation of quantum circuits to hide the functionality. Quantum circuits have inherent margin between correct and incorrect outputs. Therefore, obfuscation (i.e., corruption of functionality) by inserting dummy gates is nontrivial. We insert dummy SWAP gates one at a time for maximum corruption of functionality before sending the quantum circuit to an untrusted compiler. If an untrusted party clones the design, they get incorrect functionality. The designer removes the dummy SWAP gate post-compilation to restore the correct functionality. Compared to a classical counterpart, the quantum chip does not reveal the circuit functionality. Therefore, an adversary cannot guess the SWAP gate and location/validate using an oracle model. Evaluation of realistic quantum circuit with/without SWAP insertion is impossible in classical computers. Therefore, we propose a metric-based SWAP gate insertion process. The objective of the metric is to ensure maximum corruption of functionality measured using Total Variation Distance (TVD). The proposed approach is validated using IBM default noisy simulation model. Our metric-based approach predicts the SWAP position to achieve TVD of upto 50%, and performs 7.5% better than average TVD, and performs within 12.3% of the best obtainable TVD for the benchmarks. We obtain an overhead of < 5% for the number of gates and circuit depth after SWAP addition.
Quantum circuit routing is a key step in compiling programs for noisy intermediate-scale quantum processors, particularly superconducting devices whose sparse fixed coupling makes routing a central compilation cost. Routes that appear efficient by standard overhead metrics such as SWAP count, routed two-qubit count, and depth can still lose fidelity when they pass through poorly calibrated couplers. We study a calibration-aware graph reinforcement-learning router that uses same-day calibration data from superconducting IBM Heron r2 processors to choose hardware-edge SWAPs. We train the policy with proximal policy optimization and evaluate it with exact simulated fidelity across nine Munich Quantum Toolkit (MQT) Bench circuits and three calibration snapshots. Across these evaluations, pooled mean exact fidelity is 0.727, compared with 0.440 for SWAP-based bidirectional heuristic search (SABRE)-best20 and 0.481 for target-aware SABRE. We observe that fidelity gains come with higher routed two-qubit counts and are concentrated in 5 qubit and 8 qubit circuit families; under the fixed tree action graph, all 10 qubit families favor SABRE-best20. Overall, our results show that calibration-aware learned routing can improve fidelity beyond gate-count-driven compilation, by roughly 0.25 to 0.29 in absolute mean fidelity over the SABRE-family baselines.