arXiv subjects

Swaroop Ghosh

Publications and source records attributed to Swaroop Ghosh.

At least 37 records · Page 2Linked to original sources

arXiv2025

A Primer on Security of Quantum Computing Hardware

Quantum computing is an emerging computing paradigm that can potentially transform several application areas by solving some of the intractable problems from classical domain. Similar to classical computing systems, quantum computing stack including software and hardware rely extensively on third parties many of them could be untrusted or less-trusted or unreliable. Quantum computing stack may contain sensitive Intellectual Properties (IP) that requires protection. From hardware perspective, quantum computers suffer from crosstalk that couples two programs in a multi-tenant setting to facilitate traditionally known fault injection attacks. Furthermore, third party calibration services can report incorrect error rates of qubits or mis-calibrate the qubits to degrade the computation performance for denial-of-service attacks. Quantum computers are expensive and access queue is typically long for trusted providers. Therefore, users may be enticed to explore untrusted but cheaper and readily available quantum hardware which can enable stealth of IP and tampering of quantum programs and/or computation outcomes. Recent studies have indicated the evolution of efficient but untrusted compilation services which presents risks to the IPs present in the quantum circuits. The untrusted compiler can also inject Trojans and perform tampering. Although quantum computing can involve sensitive IP and private information and can solve problems with strategic impact, its security and privacy has received inadequate attention. This paper provides comprehensive overview of the basics of quantum computing, key vulnerabilities embedded in the quantum systems and the recent attack vectors and corresponding defenses. Future research directions are also provided to build a stronger community of quantum security investigators.

quant-ph↗

arXiv2025

Impact of Error Rate Misreporting on Resource Allocation in Multi-tenant Quantum Computing and Defense

Cloud-based quantum service providers allow multiple users to run programs on shared hardware concurrently to maximize resource utilization and minimize operational costs. This multi-tenant computing (MTC) model relies on the error parameters of the hardware for fair qubit allocation and scheduling, as error-prone qubits can degrade computational accuracy asymmetrically for users sharing the hardware. To maintain low error rates, quantum providers perform periodic hardware calibration, often relying on third-party calibration services. If an adversary within this calibration service misreports error rates, the allocator can be misled into making suboptimal decisions even when the physical hardware remains unchanged. We demonstrate such an attack model in which an adversary strategically misreports qubit error rates to reduce hardware throughput, and probability of successful trial (PST) for two previously proposed allocation frameworks, i.e. Greedy and Community-Based Dynamic Allocation Partitioning (COMDAP). Experimental results show that adversarial misreporting increases execution latency by 24% and reduces PST by 7.8%. We also propose to identify inconsistencies in reported error rates by analyzing statistical deviations in error rates across calibration cycles.

quant-ph↗

arXiv2025

Dataset Distillation for Quantum Neural Networks

Training Quantum Neural Networks (QNNs) on large amount of classical data can be both time consuming as well as expensive. Higher amount of training data would require higher number of gradient descent steps to reach convergence. This, in turn would imply that the QNN will require higher number of quantum executions, thereby driving up its overall execution cost. In this work, we propose performing the dataset distillation process for QNNs, where we use a novel quantum variant of classical LeNet model containing residual connection and trainable Hermitian observable in the Parametric Quantum Circuit (PQC) of the QNN. This approach yields highly informative yet small number of training data at similar performance as the original data. We perform distillation for MNIST and Cifar-10 datasets, and on comparison with classical models observe that both the datasets yield reasonably similar post-inferencing accuracy on quantum LeNet (91.9% MNIST, 50.3% Cifar-10) compared to classical LeNet (94% MNIST, 54% Cifar-10). We also introduce a non-trainable Hermitian for ensuring stability in the distillation process and note marginal reduction of up to 1.8% (1.3%) for MNIST (Cifar-10) dataset.

cs.LG↗

arXiv2025

Quantum Computing and Cybersecurity Education: A Novel Curriculum for Enhancing Graduate STEM Learning

Quantum computing is an emerging paradigm with the potential to transform numerous application areas by addressing problems considered intractable in the classical domain. However, its integration into cyberspace introduces significant security and privacy challenges. The exponential rise in cyber attacks, further complicated by quantum capabilities, poses serious risks to financial systems and national security. The scope of quantum threats extends beyond traditional software, operating system, and network vulnerabilities, necessitating a shift in cybersecurity education. Traditional cybersecurity education, often reliant on didactic methods, lacks hands on, student centered learning experiences necessary to prepare students for these evolving challenges. There is an urgent need for curricula that address both classical and quantum security threats through experiential learning. In this work, we present the design and evaluation of EE 597: Introduction to Hardware Security, a graduate level course integrating hands-on quantum security learning with classical security concepts through simulations and cloud-based quantum hardware. Unlike conventional courses focused on quantum threats to cryptographic systems, EE 597 explores security challenges specific to quantum computing itself. We employ a mixed-methods evaluation using pre and post surveys to assess student learning outcomes and engagement. Results indicate significant improvements in students' understanding of quantum and hardware security, with strong positive feedback on course structure and remote instruction (mean scores: 3.33 to 3.83 on a 4 point scale).

cs.CR↗

arXiv2025

The Q-Spellbook: Crafting Surface Code Layouts and Magic State Protocols for Large-Scale Quantum Computing

Quantum error correction is a cornerstone of reliable quantum computing, with surface codes emerging as a prominent method for protecting quantum information. Surface codes are efficient for Clifford gates but require magic state distillation protocols to process non-Clifford gates, such as T gates, essential for universal quantum computation. In large-scale quantum architectures capable of correcting arbitrary circuits, specialized surface codes for data qubits and distinct codes for magic state distillation are needed. These architectures can be organized into data blocks and distillation blocks. The system works by having distillation blocks produce magic states and data blocks consume them, causing stalls due to either a shortage or excess of magic states. This bottleneck presents an opportunity to optimize quantum space by balancing data and distillation blocks. While prior research offers insights into selecting distillation protocols and estimating qubit requirements, it lacks a tailored optimization approach. We present a framework for optimizing large-scale quantum architectures, focusing on data block layouts and magic state distillation protocols. We evaluate three data block layouts and four distillation protocols under three optimization strategies: minimizing tiles, minimizing steps, and achieving a balanced trade-off. Through a comparative analysis of brute force, dynamic programming, greedy, and random algorithms, we find that brute force delivers optimal results, while greedy deviates by 7% for minimizing steps and dynamic programming matches brute force in tile minimization. We observe that total steps increase with columns, while total tiles scale with qubits. Finally, we propose a heuristic to help users select algorithms suited to their objectives, enabling scalable and efficient quantum architectures.

quant-ph↗

arXiv2025

The Art of Optimizing T-Depth for Quantum Error Correction in Large-Scale Quantum Computing

Quantum Error Correction (QEC), combined with magic state distillation, ensures fault tolerance in large-scale quantum computation. To apply QEC, a circuit must first be transformed into a non-Clifford (or T) gate set. T-depth, the number of sequential T-gate layers, determines the magic state cost, impacting both spatial and temporal overhead. Minimizing T-depth is crucial for optimizing resource efficiency in fault-tolerant quantum computing. While QEC scalability has been widely studied, T-depth reduction remains an overlooked challenge. We establish that T-depth reduction is an NP-hard problem and systematically evaluate multiple approximation techniques: greedy, divide-and-conquer, Lookahead-based brute force, and graph-based. The Lookahead-based brute-force algorithm (partition size 4) performs best, optimizing 90\% of reducible cases (i.e., circuits where at least one algorithm achieved optimization) with an average T-depth reduction of around 51\%. Additionally, we introduce an expansion factor-based identity gate insertion strategy, leveraging controlled redundancy to achieve deeper reductions in circuits initially classified as non-reducible. With this approach, we successfully convert up to 25\% of non-reducible circuits into reducible ones, while achieving an additional average reduction of up to 11.8\%. Furthermore, we analyze the impact of different expansion factor values and explore how varying the partition size in the Lookahead-based brute-force algorithm influences the quality of T-depth reduction.

quant-ph↗

arXiv2025

Quantum Quandaries: Unraveling Encoding Vulnerabilities in Quantum Neural Networks

Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on third party quantum clouds for hosting models, exposing them and their training data to potential threats. As QML as a Service (QMLaaS) becomes more prevalent, reliance on third party quantum clouds poses a significant security risk. This work demonstrates that adversaries in quantum cloud environments can exploit white box access to QML models to infer the users encoding scheme by analyzing circuit transpilation artifacts. The extracted data can be reused for training clone models or sold for profit. We validate the proposed attack through simulations, achieving high accuracy in distinguishing between encoding schemes. We report that 95% of the time, the encoding can be predicted correctly. To mitigate this threat, we propose a transient obfuscation layer that masks encoding fingerprints using randomized rotations and entanglement, reducing adversarial detection to near random chance 42% , with a depth overhead of 8.5% for a 5 layer QNN design.

quant-ph↗

arXiv2024

Forensics of Transpiled Quantum Circuits

Many third-party cloud providers set up quantum hardware as a service that includes a wide range of qubit technologies and architectures to maximize performance at minimal cost. However, there is little visibility to where the execution of the circuit is taking place. This situation is similar to the classical cloud. The difference in the quantum scenario is that the success of the user program is highly reliant on the backend used. Besides, the third-party provider may be untrustworthy and execute the quantum circuits on less efficient and more error-prone hardware to maximize profit. Thus, gaining visibility on the backend from various aspects will be valuable. Effective forensics can have many applications including establishing trust in quantum cloud services. We introduce the problem of forensics in the domain of quantum computing. We trace the coupling map of the hardware where the transpilation of the circuit took place from the transpiled program. We perform experiments on various coupling topologies (linear, T-shaped, H-shaped, and loop) on IBM backends. We can derive the coupling map from the transpiled circuits with complete accuracy for almost every transpiled circuit we considered. We could correctly trace 97.33% of the programs to the correct backend.

cs.CR↗

arXiv2024

Optimizing Quantum Embedding using Genetic Algorithm for QML Applications

Quantum Embeddings (QE) are essential for loading classical data into quantum systems for Quantum Machine Learning (QML). The performance of QML algorithms depends on the type of QE and how features are mapped to qubits. Traditionally, the optimal embedding is found through optimization, but we propose framing it as a search problem instead. In this work, we use a Genetic Algorithm (GA) to search for the best feature-to-qubit mapping. Experiments on the MNIST and Tiny ImageNet datasets show that GA outperforms random feature-to-qubit mappings, achieving 0.33-3.33 (MNIST) and 0.5-3.36 (Tiny ImageNet) higher fitness scores, with up to 15% (MNIST) and 8.8% (Tiny ImageNet) reduced runtime. The GA approach is scalable with both dataset size and qubit count. Compared to existing methods like Quantum Embedding Kernel (QEK), QAOA-based embedding, and QRAC, GA shows improvements of 1.003X, 1.03X, and 1.06X, respectively.

quant-ph↗

arXiv2024

Quantum Prometheus: Defying Overhead with Recycled Ancillas in Quantum Error Correction

Quantum error correction (QEC) is crucial for ensuring the reliability of quantum computers. However, implementing QEC often requires a significant number of qubits, leading to substantial overhead. One of the major challenges in quantum computing is reducing this overhead, especially since QEC codes depend heavily on ancilla qubits for stabilizer measurements. In this work, we propose reducing the number of ancilla qubits by reusing the same ancilla qubits for both X- and Z-type stabilizers. This is achieved by alternating between X and Z stabilizer measurements during each half-round, cutting the number of required ancilla qubits in half. This technique can be applied broadly across various QEC codes, we focus on rotated surface codes only and achieve nearly $25\%$ reduction in total qubit overhead. We also present a few use cases where the proposed idea enables the usage of higher-distance surface codes at a relatively lesser qubit count. Our analysis shows that the modified approach enables users to achieve similar or better error correction with fewer qubits, especially for higher distances ($d \geq 13$). Additionally, we identify conditions where the modified code allows for extended distances ($d + k$) while using the same or fewer resources as the original, offering a scalable and practical solution for quantum error correction. These findings emphasize the modified surface code's potential to optimize qubit usage in resource-constrained quantum systems.

quant-ph↗

arXiv2024

Trustworthy Computing using Untrusted Cloud-Based Quantum Hardware

Security and reliability are primary concerns in any computing paradigm including quantum computing. Currently users can access quantum computers through a cloud based platform where they can run their programs on a suite of quantum computers. As the quantum computing ecosystem grows in popularity and utility it is reasonable to expect that more companies including untrusted or less trusted or unreliable vendors will begin offering quantum computers as hardware as a service at varied price or performance points. Since computing time on quantum hardware is expensive and the access queue could be long the users will be motivated to use the cheaper and readily available but unreliable or less trusted hardware. The less trusted vendors can tamper with the results providing a suboptimal solution to the user. In this paper we model this adversarial tampering and simulate its impact on a number of pure quantum and hybrid quantum classical workloads. To guarantee trustworthy computing for a mixture of trusted and untrusted hardware we propose distributing the total number of shots equally among the various hardware options. On average we note approx 30X and approx 1.5X improvement across the pure quantum workloads and a maximum improvement of approx 5X for hybrid classical algorithm in the chosen quality metrics. We also propose an intelligent run adaptive split heuristic leveraging temporal variation in hardware quality to users advantage allowing them to identify tampered or untrustworthy hardware at runtime and allocate more number of shots to the reliable hardware which results in a maximum improvement of approx 190X and approx 9X across the pure quantum workloads and an improvement of up to approx 2.5X for hybrid classical algorithm.

quant-ph↗

arXiv2024

STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud

The high expenses imposed by current quantum cloud providers, coupled with the escalating need for quantum resources, may incentivize the emergence of cheaper cloud-based quantum services from potentially untrusted providers. Deploying or hosting quantum models, such as Quantum Neural Networks (QNNs), on these untrusted platforms introduces a myriad of security concerns, with the most critical one being model theft. This vulnerability stems from the cloud provider's full access to these circuits during training and/or inference. In this work, we introduce STIQ, a novel ensemble-based strategy designed to safeguard QNNs against such cloud-based adversaries. Our method innovatively trains two distinct QNNs concurrently, hosting them on same or different platforms, in a manner that each network yields obfuscated outputs rendering the individual QNNs ineffective for adversaries operating within cloud environments. However, when these outputs are combined locally (using an aggregate function), they reveal the correct result. Through extensive experiments across various QNNs and datasets, our technique has proven to effectively masks the accuracy and losses of the individually hosted models by upto $76\%$, albeit at the expense of $\leq 2\times$ increase in the total computational overhead. This trade-off, however, is a small price to pay for the enhanced security and integrity of QNNs in a cloud-based environment prone to untrusted adversaries. We also demonstrated STIQ's practical application by evaluating it on multiple real quantum hardwares, showing that STIQ achieves up to $\approx 70\%$ obfuscation, with combined performance similar to an unobfuscated model.

quant-ph↗

arXiv2024

Magic Mirror on the Wall, How to Benchmark Quantum Error Correction Codes, Overall ?

Quantum Error Correction Codes (QECCs) are pivotal in advancing quantum computing by protecting quantum states against the adverse effects of noise and errors. With a variety of QECCs developed, including new developments and modifications of existing ones, selecting an appropriate QECC tailored to specific conditions is crucial. Despite significant improvements in the field of QECCs, a unified methodology for evaluating them on a consistent basis has remained elusive. Addressing this gap, this paper presents the first benchmarking framework for QECCs, introducing a set of universal parameters. By evaluating eight prominent QECCs, we propose a comprehensive suite of eight parameters for their analysis. Our methodology establishes a universal benchmarking approach and highlights the complexity of quantum error correction, indicating that the choice of a QECC depends on the unique requirements and limitations of each scenario. Furthermore, we develop a systematic strategy for selecting QECCs that adapts to the specific requirements of a given scenario, facilitating a tailored approach to quantum error correction. Additionally, we introduce a novel QECC recommendation tool that assesses the characteristics of a given scenario provided by the user, subsequently recommending a spectrum of QECCs from most to least suitable, along with the maximum achievable distance for each code. This tool is designed to be adaptable, allowing for the inclusion of new QECCs and the modification of their parameters with minimal effort, ensuring its relevance in the evolving landscape of quantum computing.

quant-ph↗

arXiv2024

Watermarking of Quantum Circuits

Quantum circuits constitute Intellectual Property (IP) of the quantum developers and users, which needs to be protected from theft by adversarial agents, e.g., the quantum cloud provider or a rogue adversary present in the cloud. This necessitates the exploration of low-overhead techniques applicable to near-term quantum devices, to trace the quantum circuits/algorithms\textquotesingle{} IP and their output. We present two such lightweight watermarking techniques to prove ownership in the event of an adversary cloning the circuit design. For the first technique, a rotation gate is placed on ancilla qubits combined with other gate(s) at the output of the circuit. For the second method, a set of random gates are inserted in the middle of the circuit followed by its inverse, separated from the circuit by a barrier. These models are combined and applied on benchmark circuits, and the circuit depth, 2-qubit gate count, probability of successful trials (PST), and probabilistic proof of authorship (PPA) are compared against the state-of-the-art. The PST is reduced by a minuscule 0.53\% against the non-watermarked benchmarks and is up to 22.69\% higher compared to existing techniques. The circuit depth has been reduced by up to 27.7\% as against the state-of-the-art. The PPA is astronomically smaller than existing watermarks.

cs.CR↗

arXiv2024

AI-driven Reverse Engineering of QML Models

Quantum machine learning (QML) is a rapidly emerging area of research, driven by the capabilities of Noisy Intermediate-Scale Quantum (NISQ) devices. With the progress in the research of QML models, there is a rise in third-party quantum cloud services to cater to the increasing demand for resources. New security concerns surface, specifically regarding the protection of intellectual property (IP) from untrustworthy service providers. One of the most pressing risks is the potential for reverse engineering (RE) by malicious actors who may steal proprietary quantum IPs such as trained parameters and QML architecture, modify them to remove additional watermarks or signatures and re-transpile them for other quantum hardware. Prior work presents a brute force approach to RE the QML parameters which takes exponential time overhead. In this paper, we introduce an autoencoder-based approach to extract the parameters from transpiled QML models deployed on untrusted third-party vendors. We experiment on multi-qubit classifiers and note that they can be reverse-engineered under restricted conditions with a mean error of order 10^-1. The amount of time taken to prepare the dataset and train the model to reverse engineer the QML circuit being of the order 10^3 seconds (which is 10^2x better than the previously reported value for 4-layered 4-qubit classifiers) makes the threat of RE highly potent, underscoring the need for continued development of effective defenses.

quant-ph↗

arXiv2024

Security Concerns in Quantum Machine Learning as a Service

Quantum machine learning (QML) is a category of algorithms that employ variational quantum circuits (VQCs) to tackle machine learning tasks. Recent discoveries have shown that QML models can effectively generalize from limited training data samples. This capability has sparked increased interest in deploying these models to address practical, real-world challenges, resulting in the emergence of Quantum Machine Learning as a Service (QMLaaS). QMLaaS represents a hybrid model that utilizes both classical and quantum computing resources. Classical computers play a crucial role in this setup, handling initial pre-processing and subsequent post-processing of data to compensate for the current limitations of quantum hardware. Since this is a new area, very little work exists to paint the whole picture of QMLaaS in the context of known security threats in the domain of classical and quantum machine learning. This SoK paper is aimed to bridge this gap by outlining the complete QMLaaS workflow, which encompasses both the training and inference phases and highlighting significant security concerns involving untrusted classical or quantum providers. QML models contain several sensitive assets, such as the model architecture, training/testing data, encoding techniques, and trained parameters. Unauthorized access to these components could compromise the model's integrity and lead to intellectual property (IP) theft. We pinpoint the critical security issues that must be considered to pave the way for a secure QMLaaS deployment.

quant-ph↗

arXiv2024

Quantum Data Breach: Reusing Training Dataset by Untrusted Quantum Clouds

Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on a third-party quantum cloud for hosting the model, exposing the models and training data. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third party quantum clouds can pose a significant threat. This paper shows that adversaries in quantum clouds can use white-box access of the QML model during training to extract the state preparation circuit (containing training data) along with the labels. The extracted training data can be reused for training a clone model or sold for profit. We propose a suite of techniques to prune and fix the incorrect labels. Results show that $\approx$90\% labels can be extracted correctly. The same model trained on the adversarially extracted data achieves approximately $\approx$90\% accuracy, closely matching the accuracy achieved when trained on the original data. To mitigate this threat, we propose masking labels/classes and modifying the cost function for label obfuscation, reducing adversarial label prediction accuracy by $\approx$70\%.

quant-ph↗

arXiv2024

The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models

Quantum Machine Learning (QML) amalgamates quantum computing paradigms with machine learning models, providing significant prospects for solving complex problems. However, with the expansion of numerous third-party vendors in the Noisy Intermediate-Scale Quantum (NISQ) era of quantum computing, the security of QML models is of prime importance, particularly against reverse engineering, which could expose trained parameters and algorithms of the models. We assume the untrusted quantum cloud provider is an adversary having white-box access to the transpiled user-designed trained QML model during inference. Reverse engineering (RE) to extract the pre-transpiled QML circuit will enable re-transpilation and usage of the model for various hardware with completely different native gate sets and even different qubit technology. Such flexibility may not be obtained from the transpiled circuit which is tied to a particular hardware and qubit technology. The information about the number of parameters, and optimized values can allow further training of the QML model to alter the QML model, tamper with the watermark, and/or embed their own watermark or refine the model for other purposes. In this first effort to investigate the RE of QML circuits, we perform RE and compare the training accuracy of original and reverse-engineered Quantum Neural Networks (QNNs) of various sizes. We note that multi-qubit classifiers can be reverse-engineered under specific conditions with a mean error of order 1e-2 in a reasonable time. We also propose adding dummy fixed parametric gates in the QML models to increase the RE overhead for defense. For instance, adding 2 dummy qubits and 2 layers increases the overhead by ~1.76 times for a classifier with 2 qubits and 3 layers with a performance overhead of less than 9%. We note that RE is a very powerful attack model which warrants further efforts on defenses.

quant-ph↗