Abstract Quantum cloud users access remote processors through classical measurement transcripts. The repeated shots that are operationally required for reliable quantum readout can systematically resolve microscopic, quasi-static hardware variations into stable statistical fingerprints. On IBM superconducting processors, we show that a transcript-only adversary can identify the backend with up to $89.3\%$ attack success rate at $T = 20$ repetition rounds under multi-interface aggregation. This exposes a privacy locus mismatch: many channel-centric quantum privacy formulations regulate distinguishability at the level of quantum states or channels, whereas the operational attack in Quantum-Computing-as-a-Service (QCaaS) targets repeated classical transcripts and the latent service provenance they reveal after measurement. We therefore formulate privacy for repeated quantum workloads as a cross-layer provenance-protection problem. We protect the latent service provenance behind a released transcript, namely the service provenance that jointly reflects backend realization and serving context in QCaaS settings where this provenance is not fully disclosed to the observing party. At the measurement interface, we formulate Measurement-Agnostic Quantum Differential Privacy (MA-QDP) as an operational transcript-level privacy criterion for repeated quantum workloads, uniform over physically admissible POVMs and arbitrary classical post-processing. MA-QDP specifies the privacy locus and protected secret appropriate to QCaaS transcript release, and is instantiated via atomic outcome randomization before aggregation. At the orchestration layer, we incorporate context decorrelation to suppress persistent linkage of repeated sessions to a stable service provenance. In controlled simulations, the integrated framework suppresses provenance inference under realistic shot budgets while preserving task-relevant information, yielding a favorable privacy-utility frontier compared to channel-level and classical-level perturbations. Together, our results identify repetition as an intrinsic fingerprint amplifier in QCaaS and motivate a cross-layer provenance-protection architecture for secure, repeated quantum workloads.
Abstract Quantum cloud users access remote processors through classical measurement transcripts. The repeated shots that are operationally required for reliable quantum readout can systematically resolve microscopic, quasi-static hardware variations into stable statistical fingerprints. On IBM superconducting processors, we show that a transcript-only adversary can identify the backend with up to 89.3% attack success rate at T=20 repetition rounds under multi-interface aggregation. This exposes a privacy locus mismatch: many channel-centric quantum privacy formulations regulate distinguishability at the level of quantum states or channels, whereas the operational attack in Quantum-Computing-as-a-Service (QCaaS) targets repeated classical transcripts and the latent service provenance they reveal after measurement. We therefore formulate privacy for repeated quantum workloads as a cross-layer provenance-protection problem. We protect the latent service provenance behind a released transcript, namely the service provenance that jointly reflects backend realization and serving context in QCaaS settings where this provenance is not fully disclosed to the observing party. At the measurement interface, we formulate Measurement-Agnostic Quantum Differential Privacy (MA-QDP) as an operational transcript-level privacy criterion for repeated quantum workloads, uniform over physically admissible POVMs and arbitrary classical post-processing. MA-QDP specifies the privacy locus and protected secret appropriate to QCaaS transcript release, and is instantiated via atomic outcome randomization before aggregation. At the orchestration layer, we incorporate context decorrelation to suppress persistent linkage of repeated sessions to a stable service provenance. In controlled simulations, the integrated framework suppresses provenance inference under realistic shot budgets while preserving task-relevant information, yielding a favorable privacy-utility frontier compared to channel-level and classical-level perturbations. Together, our results identify repetition as an intrinsic fingerprint amplifier in QCaaS and motivate a cross-layer provenance-protection architecture for secure, repeated quantum workloads.
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Quantum computing has gained widespread interest due to its exponential computational capabilities. In practical scenarios, users often access real quantum computers indirectly through cloud-based platforms (e.g., IBM Quantum), which requires transmitting data to third-party servers. Quantum-specific attacks, such as crosstalk attacks, have demonstrated high success rates in inferring the output of legitimate users. These issues raise serious privacy concerns. To protect client-side privacy, quantum local differential privacy (QLDP) has been proposed, where legitimate users perturbed their true output by adding quantum noise to the circuits. However, we observe that the classical local differential privacy (LDP) properties have not been fully adapted to the quantum domain, and the information can still be inferred from the perturbed output if attackers access the noise type added by legitimate users. To fill this gap, we propose a novel QLDP-based approach to protect the true output of legitimate users. We find that QLDP can be achieved using only simple quantum noise, but not all types of quantum noise can effectively perturb the output under different quantum measurements. In addition, to prevent advanced attackers who have partial user information, we introduce a probabilistic noise addition mechanism. To allow legitimate users to accurately estimate the true output of a quantum circuit, we also propose a new quantum frequency estimation. Our approach is validated using real quantum computers and quantum simulators, achieving 94% accuracy and 90% utility to estimate the true output from the perturbed output.
Quantum cloud providers can identify a user's algorithm and secret problem structure without ever seeing actual quantum data, simply by analyzing routine metadata collected for billing and system management. Existing confidentiality tools such as blind quantum computation and quantum homomorphic encryption protect the quantum payload itself, but they do not protect this classical orchestration metadata. This leaves an unexplored security risk in the logs generated when a large quantum program is split into smaller pieces to fit onto limited hardware, a process known as circuit cutting. These fragments leak sensitive information through what we term the topological transpilation penalty: the unavoidable depth and gate inflation added when a compiler reorganizes a program for a restricted hardware topology. Tests on a 156-qubit production Quantum Processing Unit (QPU) show that traditional timing side-channels fail in this setting, since hardware control-plane delays mask actual quantum execution time. The unique shape of the transpilation penalty acts instead as a persistent structural fingerprint for the hidden workload. Using 12,000 circuit fragments across eight algorithm families, our attack recovers algorithm family and Hamiltonian k-locality with near-perfect accuracy, achieving instance-disjoint AUC = 1.000 for both. This leakage persists under size-holdout evaluation on unseen circuit scales, with AUC = 0.987 and 0.986 respectively. The cutting mechanism is inferred with AUC = 0.991, and hardware topology is recovered well above chance with AUC = 0.818. These results show that circuit cutting exposes algorithmic intent, and potentially proprietary problem structure, through metadata alone, without any need to observe quantum data.
Shared quantum-cloud runtimes expose service outcomes shaped by compilation, backend conditions, and scheduling. We study whether workload-dependent information remains in tenant-visible outputs after scheduler mediation, while separating such evidence from provider-side boundary traces and internal diagnostics. Experiments use a provider-inspired prototype with synthetic IBM-style backend abstractions rather than IBM’s proprietary scheduler. Across 16 independent workload seeds, leave-one-seed-out evaluation using provider-reported waiting time yields a mean accuracy of 0.6010 and a classification-based signed advantage of 0.1010 over the majority-class baseline. Monotone padding and delayed release reduce the estimated advantage to 0.0324 and 0.0418, with mean added delays of 0.185 and 0.131 in normalized simulator-time units. Controlled workload pairs and compilation- and backend-level diagnostics show configuration-dependent, nonmonotonic variation across internal observability channels, but do not attribute the external signal to a uniquely quantum mechanism. A six-run experiment on one public backend provides only weak and variable in-sample timing separability. These results demonstrate preliminary scheduler-boundary separability in the controlled prototype, but do not establish a practical public-cloud attack.
Security and reliability are primary concerns in any computing paradigm, including quantum computing. Currently, users can access quantum computers through a cloud-based platform where they can run their programs on a suite of quantum computers. As the quantum computing ecosystem grows in popularity and utility, it is reasonable to expect that more companies including untrusted/less-trusted/unreliable vendors will begin offering quantum computers as hardware-as-a-service at varied price/performance points. Since computing time on quantum hardware is expensive and the access queue could be long, the users will be motivated to use the cheaper and readily available but unreliable/less-trusted hardware. The less-trusted vendors can tamper with the results, providing a sub-optimal solution to the user. For applications such as, critical infrastructure optimization, the inferior solution may have significant socio-political implications. Since quantum computers cannot be simulated in classical computers, users have no way of verifying the computation outcome. In this paper, we address this challenge by modeling adversarial tampering and simulating it's impact on both pure quantum and hybrid quantum-classical workloads. To achieve trustworthy computing in a mixed environment of trusted and untrusted hardware, we propose an equitable distribution of total shots (i.e., repeated executions of quantum programs) across hardware options. On average, we note ≈ 30X and ≈ 1.5X improvement across the pure quantum workloads and a maximum improvement of ≈ 5X for hybrid-classical algorithm in the chosen quality metrics. We also propose an intelligent run adaptive shot distribution heuristic leveraging temporal variation in hardware quality to user's advantage, allowing them to identify tampered/untrustworthy hardware at runtime and allocate more number of shots to the reliable hardware, which results in a maximum improvement of ≈ 190X and ≈ 9X across the pure quantum workloads and an improvement of up to ≈ 2.5X for hybrid-classical algorithm.
The quantum internet is evolving from isolated point-to-point quantum key distribution links toward a globally interconnected, multi-layer protocol stack supporting entanglement distribution, quantum teleportation, and distributed quantum computing. As this architecture matures, each protocol layer-physical, link, network, transport, and application exposes negotiable security parameters: QKD protocol type, entanglement fidelity thresholds, purification rounds, error-correction schemes, and authentication methods. Yet no standardized mechanism exists to negotiate these parameters securely across layers or to prevent adversarial downgrade. The classical internet spent two decades rediscovering this lesson through attacks such as POODLE, FREAK, Logjam, KNOB, and Dragonblood; the quantum internet is now repeating the same architectural oversight. This study introduces QShield , a cross-layer security negotiation framework that binds every layer’s capability commitment into a unified transcript hash, ensuring that any single-layer downgrade invalidates the session-wide security context. We formalize a quantum security downgrade hierarchy spanning six levels from device-independent QKD to classical cryptography and identify twelve concrete downgrade attack vectors mapped from classical analogs. Evaluation across all twelve attack types shows that QShield with cross-layer transcript binding achieves 100% deterministic detection across the twelve modeled downgrade vectors evaluated under emulation, whereas independent per-layer checks detect only 40–60% of coordinated multi-layer attacks. Hybrid mode preserves near-classical session bootstrap latency (48-55 ms versus 25-30 ms baseline), while the signaling overhead remains within practical bounds (3.5-5 KB versus 0.8-1.2 KB for classical).