{"id":"40e6b09d-18aa-4204-9a87-09f9b2dc83a3","arxiv_id":"2412.17101","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A single-key-qubit locking scheme encodes multiple key bits as a time-ordered sequence of control gates, hiding a quantum circuit from an untrusted compiler.","lead":"This paper proposes a way to lock quantum circuits so that an untrusted compiler cannot steal the circuit design. The method packs many key bits into a single extra qubit, and the authors report that the locked circuit hides the original function while the unlocked circuit loses under 1% fidelity on small benchmarks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Security claim rests on unverified indistinguishability of real vs dummy controlled gates; structural leakage could collapse the key space.","rationale":"The reader's weakest assumption identifies exactly the load-bearing condition: structural indistinguishability of real and dummy gates is required for the key to remain hidden, but it is only asserted, not demonstrated. My stress-test agrees with this assessment and sharpens it by noting that the classification problem is concrete and testable: the locked circuit exposes all controlled-gate positions and types, and the key is nothing more than the labeling of those gates. If the labeling can be inferred from structure, the effective key space collapses from 2^n to something smaller, and the advertised 'higher security levels' relative to prior work are not supported. The paper itself lists a structural leakage metric as future work, confirming the gap. Because this is an addressable empirical issue rather than an internal contradiction, the conditional verdict remains appropriate: the functional locking mechanism and the experimental quality metrics are plausible, but the central security claim must be treated as unverified until the structural leakage is measured. A concrete classifier-based test would settle the question without requiring new hardware or theory. No other concern is more load-bearing: the decryption-after-compilation flow is briefly described and the fidelity numbers in Table III suggest it works in simulation, but the security argument is only as strong as the indistinguishability assumption, which is exactly the untested link. Therefore the reader's conditional verdict is unchanged by this pass.","tokens_in":14958,"tokens_out":13891,"duration_ms":134827,"concrete_test":"Generate E-LoQ-locked versions of the RevLib benchmarks used in Section VI with known keys. For each controlled gate, extract structural features (gate type, control/target qubits, position in circuit, surrounding gate types, degrees of qubits, etc.). Train a supervised classifier (e.g., gradient-boosted trees) to predict real vs dummy. If held-out accuracy is materially above 50% for any benchmark, the effective key space is reduced and the 'higher security levels' claim requires revision. Additionally, report the classifier's accuracy as a function of key length n to see if leakage grows with n.","verdict_should_be":"UNCHANGED","load_bearing_attack":"E-LoQ's central security claim is that an attacker cannot tell which controlled gates in the locked circuit are real (key bit 1) and which are dummies (key bit 0). Because the key is exactly this binary labeling, any structural signal that distinguishes the two classes directly reduces the effective key space. The paper admits in Section VII that no quantitative structural leakage metric is provided. The difficulty is not obvious: dummy gates are inserted at arbitrary positions and chosen from a restricted set (CNOT or controlled-H) to match the benchmark's flavor, while real gates are conversions of original gates; features such as target-qubit degree, position in the dataflow, and consistency with known reversible-circuit patterns may separate the two classes. If a classifier can guess the label of each controlled gate with accuracy above 50%, the security claim collapses; if the labeling is perfectly hidden, the scheme is sound. This is an empirical question, and the manuscript leaves it open.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes E-LoQ, a quantum circuit locking technique that encodes an n-bit key onto a single key qubit. Encryption converts a randomly chosen subset of original gates into controlled gates (real, key bit 1) and inserts dummy controlled gates (key bit 0), with a Hadamard gate on the key qubit before each controlled gate (\"H-masking\"). After compilation, the designer removes the H gates, inserts Pauli-X gates according to the key to set the key qubit state, and simplifies the circuit. The authors evaluate functional corruption with Total Variation Distance (TVD), Hamming Variation Distance (HVD), and Degree of Functional Corruption (DFC), and they report overhead and fidelity results on RevLib benchmarks simulated with Qiskit's FakeValencia noise model. The central claims are that E-LoQ conceals the original circuit function (wrong keys corrupt outputs) and achieves higher security than one-qubit-per-key locking.","tokens_in":15144,"tokens_out":6701,"duration_ms":60819,"significance":"If the security claim were established, E-LoQ would be a useful contribution to quantum circuit IP protection: the functional-correctness argument is clean, the single-qubit key encoding is more qubit-efficient than prior work, and the overhead experiments (Table III) suggest only small fidelity penalties. The benchmark results do support the functional-corruption claims: TVD/HVD values are high for altered circuits and DFC values drop near -1. However, the security claim is not currently supported. The scheme's resistance to reverse engineering rests on the unverified assumption that real and dummy controlled gates are structurally indistinguishable, and the key-guessing metric in Eq. (4) is circular because it requires knowledge of kcorrect. The paper is a reasonable systems/design contribution but does not yet meet the security-evaluation bar expected for a claimed locking scheme.","major_comments":[{"comment":"The central security claim—that an attacker cannot recover the key from the locked circuit—depends on the assumption that dummy controlled gates are structurally indistinguishable from real controlled gates. This assumption is load-bearing because the key is exactly the binary labeling of the controlled gates. Section VII states, \"In our future work, we will develop a quantitative structural leakage metric for structural information leakage,\" which admits that no such metric is currently provided. Since dummy gates are inserted at arbitrary positions and chosen from a restricted set (CNOT or controlled-H) while real gates are conversions of existing gates, features such as target-qubit degree, position in the dataflow, and consistency with known reversible-circuit patterns may separate the two classes. The manuscript should either provide a concrete structural-leakage analysis (e.g., a distinguishing test or a classifier experiment on the locked circuits) or explicitly weaken the security claims to avoid overstatement.","section":"Section VII (Discussion and Future Work)"},{"comment":"The guessRate metric in Eq. (4) compares the output of each candidate key with the output under kcorrect, which the attacker is assumed not to know. The experiment in Figure 9 therefore demonstrates only that incorrect keys produce different outputs from the correct key; it does not demonstrate resilience to any key-recovery attack. To substantiate the statement in Section VII that E-LoQ is \"resilient to key guessing attacks,\" the paper must define an explicit attacker model (e.g., the untrusted compiler with access to the locked netlist, with or without a query oracle) and evaluate a concrete attack algorithm, such as structural analysis, SAT-style key recovery, or simulation-based distinguishing. Without such an attack model, the security analysis is circular by construction.","section":"Section VI-E, Eq. (4)"},{"comment":"The claim that \"H-masking\" prevents the compiler from simplifying away the locked structure is asserted without evidence: the paper states that H gates are placed \"to maximally obfuscate the key, decorrelate adjacent key bits, and prevent the key-controlled gates from being simplified by the compiler,\" but no compiler attack or robustness test is provided. Since the untrusted compiler is the adversary, its optimization passes (e.g., gate cancellation, commutation, unitary synthesis) are exactly the tools that could identify and remove the H gates or the controlled-gate structure. The authors should test E-LoQ under realistic compilation passes on the benchmark circuits and show that the locked structure survives, or provide a formal argument for why simplification is impossible.","section":"Section IV-A"},{"comment":"The claimed security advantage over prior work [8] is not quantified. The abstract and introduction state that E-LoQ \"achieves higher security levels,\" but the only supporting evidence is the key-space size (2^n with a single qubit). Key length alone is not a security metric if structural leakage can collapse the effective key space, and the comparison ignores that the decryption process itself reveals information about the key to anyone who observes it. The paper should either quantify the security gain under the concrete attack model requested above or reframe the contribution as a functional/overhead improvement rather than an unconditional increase in security.","section":"Section I and Section VII"}],"minor_comments":[{"comment":"Typo: \"demonstrat\" should be \"demonstrate.\"","section":"Abstract"},{"comment":"Typo: \"origianl\" should be \"original\"; also \"citcuit\" appears in the caption text and should be corrected.","section":"Figure 6 caption"},{"comment":"Typo: \"H hates\" should be \"H gates\"; \"session VI-C\" should be \"Section VI-C.\"","section":"Section VI-B"},{"comment":"The column header \"accuracy after\" is incomplete; it should specify \"accuracy after alteration.\" The fidelity-change values for mini ALU (1.02%), 4mod5 (1.06%), and 1-bit adder (1.65%) exceed 1%, while the text says changes are \"typically remaining under 1%.\" Clarify whether the abstract's \"average fidelity degradation of less than 1%\" refers to the mean across circuits rather than each individual circuit.","section":"Table III"},{"comment":"The DFC formula is ambiguous: \"Count | correct − Count | incorrect\" does not specify whether the second term is the count of the most frequent incorrect outcome or the total count of all incorrect outcomes. Use a clear mathematical expression, e.g., DFC = (count_correct − count_max_incorrect)/N.","section":"Eq. (3)"},{"comment":"The initialization of the key qubit qk is not stated. The decryption example toggles qk with X gates starting from an implicit state; specify whether qk is initialized to |0> and how the first X gate relates to that initial state.","section":"Section IV-A"}],"recommendation":"major_revision","confidential_remarks":"This paper is likely within scope for a security-oriented venue, but for a general quant-ph audience the security evaluation is below the bar. The structural-leakage gap is the main risk: the scheme's security collapses if a distinguishing test can separate real from dummy controlled gates. I saw no citation or novelty-disclosure concerns. If the authors can add a concrete structural-leakage analysis and an explicit attack model, the contribution would be substantially stronger."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What’s actually new here: E-LoQ gets multiple key bits onto a single key qubit by sequencing the key over time and using Hadamard masks before compilation, then X gates and simplification after. Prior work used one qubit per key bit, so this is a real step forward in qubit overhead. The functional part of the scheme is straightforward and consistent: the encryption/decryption flow is coherent, and the TVD/HVD/DFC experiments show that wrong keys corrupt the output while the correct key restores it with under 1% fidelity loss. I have no quarrel with the mechanics or the quality of the corruption measurements.\n\nThe soft spots are exactly where the reader's report puts them, and the stress-test concern lands. The security claim in the abstract—\"higher security levels\" and \"effectively conceals the function\"—is not backed by any attack model, structural leakage analysis, or comparison with [8] that would justify \"higher.\" The guessRate metric in Eq. 4 is circular because it compares against kcorrect, which the attacker does not know. More importantly, the scheme's security rests on the indistinguishability of real versus dummy controlled gates. The paper itself admits in Section VII that a quantitative structural leakage metric is future work, so the core assumption is untested. That matters: if a classifier can tell which controlled gates are dummies even slightly better than chance, the effective key space collapses. The authors' strategy of choosing CNOTs for arithmetic benchmarks and controlled-H for Grover is sensible, but it is not an argument that the labeling is hidden.\n\nThat said, these are addressable flaws, not internal contradictions. A serious revision should include a structural attack or at least a feature-based leakage estimate, plus a non-circular security metric. The authors seem aware of the limitation, which counts in their favor.\n\nWho is this for? Researchers in hardware security and quantum IP protection who want a qubit-efficient locking primitive. It does not change the trajectory of quantum computing, but it is a plausible incremental contribution to a niche subfield. I would not cite it in my own work until the security claim is repaired, but it deserves referee time: the encoding idea is worth examining, and the gaps are precisely the kind referees can help close.\n\nRecommendation: send to peer review, with a clear request for structural leakage analysis and a corrected security metric.","headline":"A genuinely new encoding trick for quantum circuit locking, but the paper's headline security claim is not supported by the evidence it provides.","tokens_in":15629,"tokens_out":886,"would_cite":false,"duration_ms":9609,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"E-LoQ locks quantum circuits by encoding an entire n-bit key onto a single ancilla qubit, so wrong keys corrupt outputs while the correct key restores the original circuit with under 1% average fidelity loss.","keywords":["quantum circuit locking","logic locking","quantum IP protection","H-masking","key qubit","quantum obfuscation","untrusted compiler","fidelity degradation"],"falsifier":"A concrete test: take a locked circuit, remove each controlled gate one at a time, and check which resulting circuits are consistent with a plausible original design; if an automated tool can label the dummy gates correctly with accuracy clearly above 50% across many random keys, the claimed security collapses.","tokens_in":14768,"feed_emoji":"🔐","tokens_out":9966,"duration_ms":79543,"temperature":0.7,"pith_summary":"The paper proposes E-LoQ, a method for keeping quantum circuit designs secret when compilation is outsourced to an untrusted third party. The core idea is to lock the circuit with a key that lives on a single additional qubit, instead of one qubit per key bit as in earlier work. The key qubit controls a mix of real and dummy gates, so a wrong key scrambles the output distribution while the correct key lets the user remove the locking and recover the original circuit. Benchmarks show strong functional concealment and an average fidelity loss under 1% after unlocking.","feed_headline":"One key qubit locks quantum circuits against IP theft","feed_subtitle":"Wrong keys scramble outputs; the right key restores the original circuit with under 1% fidelity loss.","key_machinery":"The central mechanism is H-masking: every key-controlled gate is preceded by a Hadamard gate on the single key qubit, so the circuit as sent to the compiler reveals no key value. Decryption replaces those H gates with Pauli-X gates at positions determined by the key transitions, producing the |0> or |1> control state that activates the real gates and leaves the dummy gates idle. This turns an n-bit key into a time-ordered sequence of states on one qubit, which is the object that carries the argument, and it is what lets the method claim higher security per qubit than prior one-qubit-per-bit locking.","core_discovery":"The paper's central claim is that an n-bit structural key can be folded into one key qubit without weakening the lock. During encryption, a Hadamard gate is placed on the key qubit before every key-controlled gate, hiding the key from the compiler; the locked circuit contains both real controlled gates (active when the control is |1>) and dummy controlled gates (identity when the control is |0>). During decryption, the Hadamard gates are replaced by Pauli-X gates according to the key bit sequence, toggling the qubit to the correct control state, after which the controlled gates are simplified away. The authors report that this achieves high divergence between locked and original output distributions (total variation and Hamming variation distances close to 1, degree of functional corruption near -1) and that the post-unlocking circuit loses less than 1% fidelity on average compared with the original.","pith_inferences":["Editorial inference: the security guarantee is only as strong as the structural indistinguishability of real and dummy gates; the paper leaves a quantitative structural leakage metric for future work, so the effective key space may be much smaller than the nominal 2^n if such a distinguisher exists.","Editorial inference: the gate-count increase in the locked circuit equals the number of dummy gates, which equals the number of 0 bits in the key; an adversary with a good estimate of the original circuit size could infer the key's Hamming weight and possibly target the search.","Editorial inference: the fidelity result comes from noise-inclusive simulation on a hardware-like backend; real-device runs could show larger degradation, and the under-1% figure should be read as a simulation-based estimate."],"forward_implications":["Key length no longer costs qubits: a single ancilla qubit can carry an arbitrarily long key, removing the main practical obstacle to locking circuits on current hardware.","Wrong keys give an attacker no information: output distributions under wrong keys are nearly flat or anti-correlated with the original, so key guessing succeeds only at chance level.","The locking overhead is temporary: after compilation and correct decryption, the key qubit and dummy gates are simplified away, leaving a circuit essentially identical in depth and gate count to the original.","The method is not limited to one gate family: the authors demonstrate locking with CNOT-based real and dummy gates on arithmetic benchmarks and with controlled-H gates on circuits such as Grover's algorithm."],"supporting_citations":[{"why":"This is the prior quantum logic locking method that uses one qubit per key bit, and E-LoQ's single-qubit key is directly compared against it.","marker":"[8]"},{"why":"This earlier obfuscation method supplies the DFC metric that E-LoQ adopts, and E-LoQ addresses its structural leakage weakness.","marker":"[25]"},{"why":"This split-compilation scheme is a competing obfuscation approach that E-LoQ contrasts with, since split compilation is vulnerable to compiler collusion.","marker":"[27]"},{"why":"This is the compilation and simulation environment used to evaluate the locked and unlocked circuits in the experiments.","marker":"[7]"},{"why":"This is the benchmark suite that provides the reversible circuits (adders, ALUs, comparators) used in all experiments.","marker":"[32]"}],"fun_headline_variants":["One key qubit replaces many to secure quantum circuits","Single-qubit key locks quantum designs, fidelity loss <1%","Folding key bits into one qubit thwarts quantum IP theft","E-LoQ: compact quantum circuit locking, <1% fidelity loss"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme's security rests on the assumption that an attacker reading the locked circuit cannot tell which controlled gates are real (key bit 1) and which are dummy (key bit 0), so the key cannot be recovered from the circuit's structure.","fun_headline_variants_meta":{"raw":{"variants":["One key qubit replaces many to secure quantum circuits","Single-qubit key locks quantum designs, fidelity loss <1%","Folding key bits into one qubit thwarts quantum IP theft","E-LoQ: compact quantum circuit locking, <1% fidelity loss"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000673,"raw_usage":{"total_tokens":3068,"prompt_tokens":956,"completion_tokens":2112,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":572,"completion_tokens_details":{"reasoning_tokens":2038}},"tokens_in":572,"tokens_out":2112,"duration_ms":15787,"temperature":1.0,"reasoning_tokens":2038,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:47:35.206075+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test: take a locked circuit, remove each controlled gate one at a time, and check which resulting circuits are consistent with a plausible original design; if an automated tool can label the dummy gates correctly with accuracy clearly above 50% across many random keys, the claimed security collapses.","supporting_citations":[{"cited_title":"Split compilation for security of quantum circuits,","cited_arxiv_id":null,"evidence_quote":"This split-compilation scheme is a competing obfuscation approach that E-LoQ contrasts with, since split compilation is vulnerable to compiler collusion."}],"review_version":1}