Shared quantum-cloud runtimes expose service outcomes shaped by compilation, backend conditions, and scheduling. We study whether workload-dependent information remains in tenant-visible outputs after scheduler mediation, while separating such evidence from provider-side boundary traces and internal diagnostics. Experiments use a provider-inspired prototype with synthetic IBM-style backend abstractions rather than IBM’s proprietary scheduler. Across 16 independent workload seeds, leave-one-seed-out evaluation using provider-reported waiting time yields a mean accuracy of 0.6010 and a classification-based signed advantage of 0.1010 over the majority-class baseline. Monotone padding and delayed release reduce the estimated advantage to 0.0324 and 0.0418, with mean added delays of 0.185 and 0.131 in normalized simulator-time units. Controlled workload pairs and compilation- and backend-level diagnostics show configuration-dependent, nonmonotonic variation across internal observability channels, but do not attribute the external signal to a uniquely quantum mechanism. A six-run experiment on one public backend provides only weak and variable in-sample timing separability. These results demonstrate preliminary scheduler-boundary separability in the controlled prototype, but do not establish a practical public-cloud attack.
Shared quantum-cloud runtimes expose service outcomes shaped by compilation, backend conditions, and scheduling. We study whether workload-dependent information remains in tenant-visible outputs after scheduler mediation, while separating such evidence from provider-side boundary traces and internal diagnostics. Experiments use a provider-inspired prototype with synthetic IBM-style backend abstractions rather than IBM’s proprietary scheduler. Across 16 independent workload seeds, leave-one-seed-out evaluation using provider-reported waiting time yields a mean accuracy of 0.6010 and a classification-based signed advantage of 0.1010 over the majority-class baseline. Monotone padding and delayed release reduce the estimated advantage to 0.0324 and 0.0418, with mean added delays of 0.185 and 0.131 in normalized simulator-time units. Controlled workload pairs and compilation- and backend-level diagnostics show configuration-dependent, nonmonotonic variation across internal observability channels, but do not attribute the external signal to a uniquely quantum mechanism. A six-run experiment on one public backend provides only weak and variable in-sample timing separability. These results demonstrate preliminary scheduler-boundary separability in the controlled prototype, but do not establish a practical public-cloud attack.
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
Abstract Quantum cloud users access remote processors through classical measurement transcripts. The repeated shots that are operationally required for reliable quantum readout can systematically resolve microscopic, quasi-static hardware variations into stable statistical fingerprints. On IBM superconducting processors, we show that a transcript-only adversary can identify the backend with up to 89.3% attack success rate at T=20 repetition rounds under multi-interface aggregation. This exposes a privacy locus mismatch: many channel-centric quantum privacy formulations regulate distinguishability at the level of quantum states or channels, whereas the operational attack in Quantum-Computing-as-a-Service (QCaaS) targets repeated classical transcripts and the latent service provenance they reveal after measurement. We therefore formulate privacy for repeated quantum workloads as a cross-layer provenance-protection problem. We protect the latent service provenance behind a released transcript, namely the service provenance that jointly reflects backend realization and serving context in QCaaS settings where this provenance is not fully disclosed to the observing party. At the measurement interface, we formulate Measurement-Agnostic Quantum Differential Privacy (MA-QDP) as an operational transcript-level privacy criterion for repeated quantum workloads, uniform over physically admissible POVMs and arbitrary classical post-processing. MA-QDP specifies the privacy locus and protected secret appropriate to QCaaS transcript release, and is instantiated via atomic outcome randomization before aggregation. At the orchestration layer, we incorporate context decorrelation to suppress persistent linkage of repeated sessions to a stable service provenance. In controlled simulations, the integrated framework suppresses provenance inference under realistic shot budgets while preserving task-relevant information, yielding a favorable privacy-utility frontier compared to channel-level and classical-level perturbations. Together, our results identify repetition as an intrinsic fingerprint amplifier in QCaaS and motivate a cross-layer provenance-protection architecture for secure, repeated quantum workloads.
In shared quantum-cloud systems, variational programs encode costly classical optimization in rotation angles that can leak through adjacent hardware. We present the first physical recovery of a useful variational parameter region from a complete workload. The attack observes a disjoint idle two-qubit register during a 24-qubit quantum approximate optimization algorithm (QAOA) execution, without victim outputs or model queries. A fixed Marrakesh decoder distinguishes the regions under identical circuits, reaching 85/96 accuracy on held-out jobs and ROC AUC 0.997. Tests over separate time periods, matched controls, and a placement retest confirm the response at one of 17 layouts; conditional subsampling gives 0.756 expected accuracy from 2,000 observations. A public workload census finds source separation in 92 of 2,100 QAOA workloads, including five of 420 held-out workloads. For continuous secrets, a Jacobian factorization separates victim sensitivity, physical transfer, and scheduling, then converts channel gain into parameter and utility bounds. Under conditionally independent affine leakage, observable terms form a binary linear code. Its shortest element determines the first leakage order, while its dimension determines how many random bits perfect secrecy requires. Fresh masks defer leakage to the shortest cycle, while mask reuse creates a second-order temporal channel; the same code yields maximum safe slot concurrency.
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Many third-party cloud providers set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. However, there is little visibility to where the execution of the circuit is taking place. This situation is similar to the classical cloud. The difference in the quantum scenario is that the success of the user program is highly reliant on the backend used. Besides, the third-party provider may be untrustworthy and execute the quantum circuits on less efficient and more error-prone hardware to maximize profit. Thus, gaining visibility on the backend from various aspects will be valuable. Effective forensics can have many applications including establishing trust in quantum cloud services. We introduce the problem of forensics in the domain of quantum computing. We trace the coupling map of the hardware where the transpilation of the circuit took place from the transpiled program. We perform experiments on various coupling topologies (linear, T-shaped, H-shaped, and loop) on IBM backends. We can derive the coupling map from the transpiled circuits with complete accuracy for almost every transpiled circuit we considered. We could correctly trace 97.33% of the programs to the correct backend.
Quantum Computing is advancing from isolated prototypes toward heterogeneous, cloud-accessed quantum processors that are noisy, capacity-limited, and operationally diverse. In this landscape, the prevalent device-centric execution model (i.e., compiling a circuit for a single backend and running all shots monolithically) constrains scale, reliability, and cost-effectiveness. This thesis argues for and instantiates a system-centric paradigm of distributed execution, which treats execution as an engineered process that orchestrates spatial and temporal distribution across multiple devices and time scales, guided by explicit Quality-of-Service (QoS) objectives. Spatial distribution aggregates multiple, heterogeneous Quantum Processing Units and supporting classical services into a shared resource pool, placing circuits, subcircuits, and workloads where their algorithmic needs best align with hardware characteristics and availability. Temporal distribution adapts execution over time, modulating sampling depth, pacing, and scheduling in response to drift, queue dynamics, and evidence of statistical convergence. Together, these dimensions are governed by policy-driven orchestrations that reconciles fidelity, latency, and cost, and that elevates user intent above device idiosyncrasies. This thesis delivers five main contributions: (1) a shot-wise execution methodology that distributes measurement shots across heterogeneous QPUs under policy control, reducing output variance and matching or surpassing single-device averages; (2) Quantum Broker, a QoS-aware orchestration framework with the Quantum QoS Specification Language (QQSpec) that consistently finds feasible, high-quality allocations and outperforms single-backend and uniform-shot baselines under competing fidelity/latency/cost goals; (3) Cut&Shoot, an integrated circuit-cutting + shot-wise pipeline that executes large circuits across multiple devices with significantly lower error than monolithic, cutting-only, or shot-wise-only baselines, at negligible time overhead relative to standard cutting; (4) a hybrid orchestration architecture, QCRAFT Scheduler–Shotwise, which combines high-level circuit scheduling with shot-wise distribution to achieve up to 95% cost reduction and 92% fewer job submissions while improving robustness to hardware variability; and (5) IncrementalExecution, an adaptive, evidence-seeking shot manager that approximates optimal allocations with minimal overhead and high fidelity across unseen circuits and backends. Evaluations on simulated and real cloud backends demonstrate practicality across heterogeneous providers. Situated within Quantum Software Engineering, this thesis promotes abstractions and runtime mechanisms that make distribution a first-class program property rather than a backend option. The resulting perspective embraces hardware diversity as an optimization opportunity, improves portability across providers, and lays a path from today’s Noisy Intermediate-Scale Quantum (NISQ) platforms to future networked and fault-tolerant regimes. The overarching vision is that, by engineering execution as a principled, evidence-seeking process, heterogeneous quantum resources become the substrate for scalable, reliable, and efficient Quantum Computing.