Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Flow ambiguity: A path towards classically driven blind quantum computation

Atul Mantri (20053800), Tommaso F. Demarie, Nicolas C. Menicucci, Joseph Fitzsimmons (20053803)

Published Nov 23, 2024• 24 citations
OpenAlex

Abstract

Blind quantumcomputation protocols allowa user to delegate a computation to a remote quantum computer in such a way that the privacy of their computation is preserved, even from the device implementing the computation. To date, such protocols are only known for settings involving at least two quantumdevices: either a user with some quantum capabilities and a remote quantum server or two or more entangled but noncommunicating servers. In this work, we take the first step towards the construction of a blind quantum computing protocol with a completely classical client and single quantum server. Specifically, we show how a classical client can exploit the ambiguity in the flowof information inmeasurement-based quantumcomputing to construct a protocol for hiding critical aspects of a computation delegated to a remote quantum computer. This ambiguity arises due to the fact that, for a fixed graph, there existmultiple choices of the input and output vertex sets that result in deterministic measurement patterns consistent with the same fixed total ordering of vertices. This allows a classical user, computing only measurement angles, to drive a measurement-based computation performed on a remote device while hiding critical aspects of the computation.

Related papers

Impossibility of perfectly-secure one-round delegated quantum computing for classical client

Tomoyuki Morimae, Takeshi Koshiba

Blind quantum computing protocols enable a client, who can generate or measure single-qubit states, to delegate quantum computing to a remote quantum server protecting the client's privacy (i.e., input, output, and program). With current technologies, generations or measurements of single-qubit states are not too much burden for the client. In other words, secure delegated quantum computing is possible for ``almost classical" clients. However, is it possible for a ``completely classical" client? Here we consider a one-round perfectly-secure delegated quantum computing, and show that the protocol cannot satisfy both the correctness (i.e., the correct result is obtained when the server is honest) and the perfect blindness (i.e., the client's privacy is completely protected) simultaneously unless BQP is in NP. Since BQP is not believed to be in NP, the result suggests the impossibility of the one-round perfectly-secure delegated quantum computing.

arXiv:1407.1636•Quantum Information and Computation•Mar 1, 2019•15 citations

Impossibility of blind quantum sampling for classical client

Tomoyuki Morimae, Harumichi Nishimura, Yuki Takeuch +1 more

Blind quantum computing enables a client, who can only generate or measure single-qubit states, to delegate quantum computing to a remote quantum server in such a way that the input, output, and program are hidden from the server. It is an open problem whether a completely classical client can delegate quantum computing blindly (in the information theoretic sense). In this paper, we show that if a completely classical client can blindly delegate sampling of subuniversal models, such as the DQC1 model and the IQP model, then the polynomial-time hierarchy collapses to the third level. Our delegation protocol is the one where the client first sends a polynomial-length bit string to the server and then the server returns a single bit to the client. Generalizing the no-go result to more general setups is an open problem.

arXiv:1812.03703•Quantum Information and Computation•Sep 1, 2019•5 citations

Blind Quantum Computation on a Modular Superconducting Processor

Yongxin Song, Johannes Knörzer, Kieran Dalton +2 more

Current cloud-based quantum processors offer access to advanced hardware hosted on a remote server, but do not guarantee data or algorithm privacy. Blind quantum computation provides information-theoretic privacy by enabling a client to execute an algorithm without disclosing information about either the task or the final result. Here, we execute a measurement-based blind quantum computation protocol on a superconducting processor comprising two flip-chip-bonded modules, one acting as a server and the other as a client. The server generates a two-dimensional cluster state and forwards it to the client. Using this resource, the client implements a universal gate set with only adaptive single-qubit rotations and measurements. To illustrate this approach, we execute a three-qubit instance of the Deutsch-Jozsa algorithm. We analyze the server's quantum state after each rotation of a measurement-based single-qubit gate to verify that negligible information about the computation is revealed to the server, consistent with the one-way flow of information that guarantees blindness. This proof-of-principle demonstration establishes key elements of blind quantum computation in superconducting-circuit architectures, indicating that intermediate-scale implementations of blind protocols may become feasible with realistic near-term improvements in gate fidelities.

quant-pharXiv:2605.14656•May 15, 2026•0 citations

On the Security of Two Blind Quantum Computations

Shih-Min Hung, Tzonelih Hwang

Blind quantum computation (BQC) protocol allows a client having partial quantum ability to delegate his quantum computation to a remote quantum server without leaking any information about the input, the output and the intended computation to the server. Several BQC protocols have been proposed, e.g., Li et al. in [1] proposed a triple-server BQC protocol and Xu et al. in [2] proposed a single-server BQC protocol. Though both papers claimed that their protocols can satisfy the requirement of privacy, this paper points out a security loophole in their protocols. With that the server can reveal the private information of the client.

arXiv:1508.07478•Aug 29, 2015•2 citations

Flow Ambiguity: A Path Towards Classically Driven Blind Quantum Computation

Atul Mantri, Tommaso F. Demarie, Nicolas C. Menicucci +1 more

Current protocols for securely delegating computation to remote quantum computers require some form of quantum communication, thus limiting secure access to future cloud-based quantum computing resources. A new analysis shows that it is possible to hide critical aspects of a computation delegated to a quantum computer using only classical communication.

arXiv:1608.04633•Physical Review X•Jul 11, 2017•25 citations

Toward the application of blind quantum computing: a case study

Sabina Gaia Tomasicchio, Claudio Cicconetti, Marco Conti +1 more

As quantum computing technology matures, an asymmetric computational landscape is emerging where powerful quantum data centers serve users with limited quantum capabilities. The Quantum Internet will enable users to access remote quantum resources, but this delegation raises privacy and trust concerns when the server cannot be assumed to be fully trusted. In this work, we study an implementation-oriented case study in which a Blind Quantum Computing (BQC) protocol is integrated with the encoding stage of a quanvolutional feature extractor for image classification. The goal is to evaluate how an existing BQC-compatible remote state preparation mechanism behaves when used inside a hybrid Quantum Machine Learning workflow. The client encodes classical pixel values as private rotation angles, while fresh random masks hide these angles from an honest-but-curious server at the protocol level. The quantum preprocessing is simulated with finite-shot computational-basis measurements in SquidASM/NetSquid, rather than ideal expectation values, and is evaluated on a small MNIST subset selected for computational feasibility. We analyze the resulting trade-offs among finite-shot sampling, communication and entanglement overhead, depolarizing link and device noise, seed sensitivity, and random-circuit complexity. The study provides practical evidence on the resource and performance constraints that arise when embedding BQC primitives into quantum machine-learning applications, and identifies limitations that must be addressed before deployment-oriented privacy-preserving QML can be considered practical.

Scientific Reports•Aug 19, 2026•0 citations
Blind quantumcomputation protocols allowa user to delegate a computation to a remote quantum computer in such a way that the privacy of their computation is preserved, even from the device implementing the computation. To date, such protocols are only known for settings involving at least two quantumdevices: either a user with some quantum capabilities and a remote quantum server or two or more entangled but noncommunicating servers. In this work, we take the first step towards the construction of a blind quantum computing protocol with a completely classical client and single quantum server. Specifically, we show how a classical client can exploit the ambiguity in the flowof information inmeasurement-based quantumcomputing to construct a protocol for hiding critical aspects of a computation delegated to a remote quantum computer. This ambiguity arises due to the fact that, for a fixed graph, there existmultiple choices of the input and output vertex sets that result in deterministic measurement patterns consistent with the same fixed total ordering of vertices. This allows a classical user, computing only measurement angles, to drive a measurement-based computation performed on a remote device while hiding critical aspects of the computation.
Blind quantum computing protocols enable a client, who can generate or measure single-qubit states, to delegate quantum computing to a remote quantum server protecting the client's privacy (i.e., input, output, and program). With current technologies, generations or measurements of single-qubit states are not too much burden for the client. In other words, secure delegated quantum computing is possible for ``almost classical" clients. However, is it possible for a ``completely classical" client? Here we consider a one-round perfectly-secure delegated quantum computing, and show that the protocol cannot satisfy both the correctness (i.e., the correct result is obtained when the server is honest) and the perfect blindness (i.e., the client's privacy is completely protected) simultaneously unless BQP is in NP. Since BQP is not believed to be in NP, the result suggests the impossibility of the one-round perfectly-secure delegated quantum computing.
Blind quantum computing enables a client, who can only generate or measure single-qubit states, to delegate quantum computing to a remote quantum server in such a way that the input, output, and program are hidden from the server. It is an open problem whether a completely classical client can delegate quantum computing blindly (in the information theoretic sense). In this paper, we show that if a completely classical client can blindly delegate sampling of subuniversal models, such as the DQC1 model and the IQP model, then the polynomial-time hierarchy collapses to the third level. Our delegation protocol is the one where the client first sends a polynomial-length bit string to the server and then the server returns a single bit to the client. Generalizing the no-go result to more general setups is an open problem.
Current cloud-based quantum processors offer access to advanced hardware hosted on a remote server, but do not guarantee data or algorithm privacy. Blind quantum computation provides information-theoretic privacy by enabling a client to execute an algorithm without disclosing information about either the task or the final result. Here, we execute a measurement-based blind quantum computation protocol on a superconducting processor comprising two flip-chip-bonded modules, one acting as a server and the other as a client. The server generates a two-dimensional cluster state and forwards it to the client. Using this resource, the client implements a universal gate set with only adaptive single-qubit rotations and measurements. To illustrate this approach, we execute a three-qubit instance of the Deutsch-Jozsa algorithm. We analyze the server's quantum state after each rotation of a measurement-based single-qubit gate to verify that negligible information about the computation is revealed to the server, consistent with the one-way flow of information that guarantees blindness. This proof-of-principle demonstration establishes key elements of blind quantum computation in superconducting-circuit architectures, indicating that intermediate-scale implementations of blind protocols may become feasible with realistic near-term improvements in gate fidelities.
Blind quantum computation (BQC) protocol allows a client having partial quantum ability to delegate his quantum computation to a remote quantum server without leaking any information about the input, the output and the intended computation to the server. Several BQC protocols have been proposed, e.g., Li et al. in [1] proposed a triple-server BQC protocol and Xu et al. in [2] proposed a single-server BQC protocol. Though both papers claimed that their protocols can satisfy the requirement of privacy, this paper points out a security loophole in their protocols. With that the server can reveal the private information of the client.
As quantum computing technology matures, an asymmetric computational landscape is emerging where powerful quantum data centers serve users with limited quantum capabilities. The Quantum Internet will enable users to access remote quantum resources, but this delegation raises privacy and trust concerns when the server cannot be assumed to be fully trusted. In this work, we study an implementation-oriented case study in which a Blind Quantum Computing (BQC) protocol is integrated with the encoding stage of a quanvolutional feature extractor for image classification. The goal is to evaluate how an existing BQC-compatible remote state preparation mechanism behaves when used inside a hybrid Quantum Machine Learning workflow. The client encodes classical pixel values as private rotation angles, while fresh random masks hide these angles from an honest-but-curious server at the protocol level. The quantum preprocessing is simulated with finite-shot computational-basis measurements in SquidASM/NetSquid, rather than ideal expectation values, and is evaluated on a small MNIST subset selected for computational feasibility. We analyze the resulting trade-offs among finite-shot sampling, communication and entanglement overhead, depolarizing link and device noise, seed sensitivity, and random-circuit complexity. The study provides practical evidence on the resource and performance constraints that arise when embedding BQC primitives into quantum machine-learning applications, and identifies limitations that must be addressed before deployment-oriented privacy-preserving QML can be considered practical.