Quantum Computing (QC) has recently achieved significant technological progress, attracting growing interest from both academia and industry. As most users currently access QC resources through cloud platforms, concerns around the security and accountability of quantum services have become increasingly prominent. In particular, quantum noise, typically considered a source of error, can also reveal device-specific signatures that enable Quantum Device Fingerprinting (QDF). While QDF has legitimate applications such as anomaly detection and device accountability, it also carries dual-use risks, including potential misuse for unauthorized device tracking or targeted attacks. In this paper, we propose a novel Task-Driven Quantum Device Fingerprinting (TD-QDF) identification method based on quantum task outputs; we extract the fingerprint features of quantum devices from noisy quantum computing results. Unlike previous research, our method does not require any additional information (e.g., hardware details or noise information), thereby enhancing its practical applicability and accessibility. We conducted large-scale experiments using six QNN circuits on 10 IBM quantum computers, extended four classical quantum algorithms to validate generality, and demonstrated scalability on three 127-qubit processors. Specifically, the highest accuracy can reach up to 94.32% in the 3-classification device fingerprint recognition task and up to 82.4% and 61.6% in the 7-classification and 10-classification tasks, respectively. This research contributes to advancing quantum fingerprinting technologies and holds promising implications for enhancing the security and accountability of quantum computing systems and quantum cloud services.
Quantum Computing (QC) has recently achieved significant technological progress, attracting growing interest from both academia and industry. As most users currently access QC resources through cloud platforms, concerns around the security and accountability of quantum services have become increasingly prominent. In particular, quantum noise, typically considered a source of error, can also reveal device-specific signatures that enable Quantum Device Fingerprinting (QDF). While QDF has legitimate applications such as anomaly detection and device accountability, it also carries dual-use risks, including potential misuse for unauthorized device tracking or targeted attacks. In this paper, we propose a novel Task-Driven Quantum Device Fingerprinting (TD-QDF) identification method based on quantum task outputs; we extract the fingerprint features of quantum devices from noisy quantum computing results. Unlike previous research, our method does not require any additional information (e.g., hardware details or noise information), thereby enhancing its practical applicability and accessibility. We conducted large-scale experiments using six QNN circuits on 10 IBM quantum computers, extended four classical quantum algorithms to validate generality, and demonstrated scalability on three 127-qubit processors. Specifically, the highest accuracy can reach up to 94.32% in the 3-classification device fingerprint recognition task and up to 82.4% and 61.6% in the 7-classification and 10-classification tasks, respectively. This research contributes to advancing quantum fingerprinting technologies and holds promising implications for enhancing the security and accountability of quantum computing systems and quantum cloud services.
Quantum computing (QC) has recently achieved significant technological advancements, attracting widespread attention. Current users mainly access QC resources through cloud services. However, cloud-based quantum services provide convenience while also introducing security risks. For example, attackers could steal private information or inject malicious programs into quantum devices, while quantum device fingerprinting may be the first step for these malicious intents. In this paper, we propose a novel Task-Driven Quantum Device Fingerprinting (TD-QDF) identification method based on quantum neural network (QNN) task outcomes. Unlike previous research, our method does not require any hardware details, resulting in high availability in practice. Extensive experiments involving 3 QNN circuits on 10 real IBM quantum computers show that our method can effectively identify quantum devices. This research contributes to advancing quantum fingerprinting technologies and holds promising implications for enhancing the security and accountability of quantum computing systems.
Quantum computing users increasingly access quantum hardware through cloud platforms and are charged based on usage. Because these resources are scarce and expensive, users often request specific devices to ensure performance, while providers may reassign jobs to other devices to maximize throughput, potentially compromising user expectations. Thus, we present QuanGuard, an efficient fingerprinting framework for verifying whether the allocated quantum resources match user selections. QuanGuard constructs dynamic fingerprints from the noisy execution results of a probing circuit, exploiting device-specific error evolution patterns to identify hardware uniquely. We further develop an error evolution algorithm that generates user-side fingerprints for lightweight matching against assigned resources. The method requires only a single probing circuit per detection, making it highly practical for current quantum cloud platforms. Experiments on seven IBM quantum computers show that QuanGuard achieves accurate and reliable device verification with minimal overhead.
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Noisy Intermediate-Scale Quantum (NISQ) devices, while accessible via cloud platforms, face challenges due to limited availability and suboptimal quality. These challenges raise the risk of cloud providers offering fraudulent services. This emphasizes the need for users to detect such fraud to protect their investments and ensure computational integrity. This study introduces a novel dynamic fingerprinting method for detecting fraudulent service provision on quantum cloud platforms, specifically targeting machine substitution and profile fabrication attacks. The dynamic fingerprint is constructed using a single probing circuit to capture the unique error characteristics of quantum devices, making this approach practical because of its trivial computational costs. When the user examines the service, the execution results of the probing circuit act as the device-side fingerprint of the quantum device providing the service. The user then generates the user-side fingerprint by estimating the expected execution result, assuming the correct device is in use. We propose an algorithm for users to construct the user-side fingerprint with linear complexity. By comparing the device-side and user-side fingerprints, users can effectively detect fraudulent services. Our experiments on the IBM Quantum platform, involving seven devices with varying capabilities, confirm the method's effectiveness.
Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on third-party quantum clouds for hosting models, exposing them and their training data to potential threats. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third-party quantum clouds poses a significant security risk. This work demonstrates that adversaries in quantum cloud environments can exploit white-box access to QML models to infer the user's encoding scheme by analyzing circuit transpilation artifacts. The extracted data can be reused for training clone models or sold for profit. We validate the proposed attack through simulations, achieving high accuracy in distinguishing between encoding schemes. We report that ≈95% of the time, the encoding can be predicted correctly. To mitigate this threat, we propose a transient obfuscation layer that masks encoding fingerprints using randomized rotations and entanglement, reducing adversarial detection to near-random chance ≈42%, with a depth overhead of ≈8.5% for a 5-layer QNN design.
Quantum cloud platforms are poised to deliver powerful computing capabilities, but users have no direct means to verify which physical device executes their workload. This lack of transparency enables hardware substitution attacks, where a malicious adversary could redirect a job to a substituted or inferior processor. We present a general authentication framework that addresses this problem by constructing multi-dimensional quantum fingerprints from raw measurement data. Without any curve fitting, we directly concatenate the raw statistics of complementary experiments into a high-dimensional feature vector that preserves subtle device-specific information. A Mahalanobis nearest-neighbor classifier achieves 100\% benign authentication accuracy on three superconducting processors over a three-week chronological split. The classifier naturally yields an authentication confidence Cclaimed which reveals device-specific safety margins and motivates per-device alert thresholds. We assess the framework's robustness under two distinct scenarios. Under additive isotropic Gaussian noise, Cclaimed decays predictably at a rate explained by inverse covariance traces, enabling an early warning mechanism. Against white-box adversarial perturbations, the same confidence threshold detects L2 targeted attacks with near-perfect success and reveals device-dependent empirical thresholds for L∞ attacks, while untargeted and sparse attacks are ineffective. The proposed framework thus unifies fingerprint extraction, drift-resilient authentication, proactive health monitoring, and adversarial defense, offering a practical step toward trustworthy quantum cloud computing.