Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A crosstalk attack based on the SWAP routing path lets an attacker disrupt a victim's quantum circuit from a distance with a single CNOT gate, and passive listening can infer the victim's circuit size with 100 percent accuracy.

desk verdict A clean controlled demonstration of SWAP-path crosstalk, but the multi-tenant attack premise is unsubstantiated and the passive results are in-sample. read the letter →

arxiv 2502.10115 v1 pith:R4ZHRMGJ submitted 2025-02-14 quant-ph

Wei Jie Bryan Lee , Siyi Wang , Suman Dutta , Walid El Maouaki , Anupam Chattopadhyay This is my paper
classification quant-ph
keywords quantumcloudsecuritycrosstalkattackside-channelSWAPpathmulti-tenantcomputingGrover'salgorithmSimon'squbitallocation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that crosstalk noise on multi-tenant quantum cloud processors is determined by the SWAP path taken to route two-qubit gates between distant qubits, and that this creates a practical side channel. Its active attack places one attacker CNOT gate so that the SWAP path crosses the victim's qubits, reducing the accuracy of a victim's Grover circuit by up to 81.62 percent on a real 127-qubit cloud device. Its passive attack runs a tiny listening circuit whose measured crosstalk deviations form a signature, and matches that signature to predict Simon's circuit size with 100 percent accuracy using only four optimally chosen qubits. If the claims hold, the common defense of separating circuits by topological distance is not sufficient for shared quantum clouds.

What carries the argument

The load-bearing object is the SWAP path: the chain of qubits and SWAP gates a compiler inserts to perform a two-qubit operation between non-adjacent qubits. The paper's mechanism is that running a CNOT between two attacker qubits excites crosstalk along that entire routing path, so the attacker does not need to be physically adjacent to the victim. In the passive attack, the machinery is the crosstalk signature: for each candidate victim configuration, the attacker's listening qubits record how many measured 1s deviate from the expected all-zero output, and the victim's live signature is matched to the stored set with mean squared error. The qubit selection strategies (optimal, default, non-optimal) order listening qubits by how much they deviate, which is what lets four qubits be enough for perfect size prediction.

What would settle it

Submit two independent jobs from separate cloud accounts to the same 127-qubit device at the same time and check the execution logs: if they are never executed concurrently but queued sequentially, the attack scenario as described has no real target. A second check would be to reproduce the active one-CNOT result with attacker and victim submitted as separate jobs, instead of assembled into one composite circuit; if the effect disappears, the reported 81.62 percent outcome is an artifact of co-compilation rather than remote crosstalk.

Watch

Extended reading notes

Core claim

The central claim is that the SWAP path between two attacker-controlled qubits acts as a crosstalk conduit: when the victim's qubits lie on that path, the victim's output is corrupted with high probability, even though the attacker and victim are far apart on the device. The paper reports that a single CNOT gate on the attacker side can lower the victim's expected output accuracy to 18.38 percent (an 81.62 percent deviation) in the best case, and that the severity depends on which qubit pairs are chosen. In the passive variant, the same SWAP-path effect leaks information: an empty listening circuit produces an all-zeros output that the victim's SWAP-heavy routing perturbs, and the resulting pattern acts as a fingerprint. With optimal qubit selection the attacker needs only four listening qubits to identify which of 32 Simon circuit sizes is running, and 22 listening qubits to identify a 7-bit hidden shift with perfect accuracy.

Load-bearing premise

The key assumption is that the cloud provider runs the attacker's job and the victim's job at the same time on the same processor; the paper states this as an attack capability but gives no evidence that today's cloud scheduler actually co-schedules independent jobs.

Editorial extensions

If this is right

  • If attackers can choose any qubit pair whose SWAP path crosses the victim's qubits, topological separation alone does not protect a circuit.
  • A single CNOT is enough for disruption, so defenses that look for repeated CNOT patterns will not detect the active attack.
  • The passive attack works with a measurement-only circuit of just four qubits for size prediction, making it hard to spot by circuit-size anomaly.
  • Qubit selection matters as much as count: with the same 22 listening qubits, optimal placement gives 100 percent accuracy while non-optimal placement drops to 46.87 percent.
  • The effect was validated on a real 127-qubit cloud processor, so it is not purely a simulation result.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If concurrent execution of independent jobs turns out not to exist on current clouds, the attack still demonstrates a real hardware coupling, but its threat model would need a scheduler that does co-schedule; a natural extension is to test the same SWAP-path attack on a cloud that guarantees concurrent multi-tenant execution.
  • The passive signature method is a template side channel: with a larger training set it could in principle fingerprint other algorithmic parameters, such as the specific oracle or secret shift, not just circuit size, on any platform where concurrent execution is available.
  • The strength of the qubit-selection effect suggests that a defense based on randomizing SWAP routing, instead of maximizing distance, could break the stable signatures the passive attack relies on, though that is an inference beyond the paper's own experiments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a crosstalk-based side-channel attack on multi-tenant quantum cloud systems, attributing the effect to the SWAP path between distant qubits rather than simple proximity. In the active mode, a single attacker CNOT gate is claimed to degrade a victim's Grover circuit by up to 81.62% (Table I). In the passive mode, a small 'listening' circuit is claimed to predict the size and output of a victim's Simon's algorithm circuit with 100% accuracy (Section V.D) while being as small as 6.25% of the victim circuit. The authors argue this challenges existing topological-distance defenses. Experiments are performed on ibm_brisbane, and Experiment 2 provides a controlled comparison of victim positions intersecting versus not intersecting the attacker's SWAP path.

Significance. If the central multi-tenant concurrency premise were demonstrated and the passive evaluation were not circular, the results would be a meaningful security contribution: Experiment 2 shows a credible correlation between SWAP-path intersection and output deviation, and the idea that crosstalk signatures can leak algorithm parameters is worth investigating. The paper also gives useful empirical grounding for questioning distance-based circuit-isolation defenses. However, the significance is currently conditional on three load-bearing issues: the lack of evidence that independent tenant jobs run concurrently, the training/test overlap in the passive attack evaluation, and the absence of statistical error analysis. The paper's strengths are the controlled Experiment 2 and the explicit exploration of attacker circuit-size versus prediction accuracy, but these do not by themselves establish the claimed cross-tenant attack scenario.

major comments (4)
  1. [Section III.B and Section V.A] The attack model assumes that 'the attacker can run its circuit on a multi-tenant quantum device simultaneously with the victim's circuit,' but the Experimental Setup only states that jobs were 'queued back-to-back,' and the figures (Figs. 3, 5, 9, 12) appear to embed attacker and victim qubits into a single composite circuit. Please provide direct evidence that independent tenant jobs execute concurrently on ibm_brisbane (e.g., overlapping execution intervals, provider scheduling documentation, or a control experiment with separately submitted jobs). As written, the experiments validate SWAP-path crosstalk in a single transpiled circuit, not a cross-tenant attack, and the headline results do not transfer to the claimed threat model.
  2. [Section IV.B and Section V.D, Eq. (2)] The passive attack evaluation is circular: the Signature Dataset is built from the same 32 circuit sizes (or 128 output values) that are later 'tested,' and the MSE matrices in Figs. 9, 10, and 13 compare each Test entry against Learn entries of the identical configuration set. Under Acc1 = (n - i)/n, the true class is always present in the database, so nearest-neighbor matching can trivially rank it first; the reported 100% accuracy is a training-set result rather than an independent prediction. Please evaluate on held-out configurations, a different calibration window, or with proper cross-validation, and report performance on unseen circuit instances.
  3. [Section V.A, Tables I and II] The headline numbers (e.g., 81.62% in Table I and 81.96% in Table II) are single observed accuracy values with no error bars, no repeated runs across calibration windows, and no explicit no-attack control for each configuration beyond the 'No Attack' rows in Table II. Because crosstalk deviations are comparable in magnitude to ordinary hardware drift, please provide repeated independent runs with standard errors or confidence intervals, and describe how calibration drift was excluded as an alternative explanation.
  4. [Abstract, Section IV.A, Section V.B] The paper repeatedly claims that the active attack 'can be clearly explained through modeling' and that specific qubits 'can be identified as more susceptible,' but no model is actually defined or evaluated in Sections IV or V; the only formula provided is the MSE in Eq. (1), which is a comparison metric, not a predictive model of attack severity. Please either present the model (with its parameters, fit quality, and validation) or remove these modeling claims from the abstract and text.
minor comments (6)
  1. [Section V.A] The text says 'seed transpile = 0'; please clarify whether this refers to Qiskit's seed_transpiler parameter, and state whether the same seed was used for every circuit and whether the transpiler was aware that attacker and victim qubits were part of one composite circuit.
  2. [Eq. (3)] The text describes Confidence as a difference in normalized MSE values, but Eq. (3) shows a raw difference between MSEl and MSEs; please define the normalization and state the units or scale of the reported confidence values.
  3. [Throughout] The term 'SW AP' appears instead of 'SWAP' in many places (including the title, abstract, and section headings); please fix the formatting.
  4. [Section IV.A] The damage categories are defined with overlapping ranges: moderate is listed as both 40-60% and 40-60%, but the text also mentions 'No Attack' for deviations below 20% and minor for 20-40%; please define a single non-overlapping threshold table.
  5. [Section II] The sentence 'Although we were unable to replicate previous works on the ibm brisbane quantum device, the proposed SWAP-induced attacks would render previously proposed defense strategies... ineffective' is internally hedged; please report what was attempted in the replication and separate that from the claim about the proposed attack.
  6. [Section IV.B] The passive attack assumes the attacker knows the victim's qubit positions; this is stated, but its practical feasibility (how the attacker obtains the allocation) should be discussed, since it is a strong assumption for the claimed threat model.

Circularity Check

2 steps flagged · score 6.0 of 10

Passive-attack '100% prediction' results are nearest-neighbor lookups against a signature database built from the very same circuit configurations being classified; the active attack is not circular but is evaluated under an undemonstrated concurrency assumption.

  1. fitted input called prediction [Section IV.B (Learning stage) and Section V.D (Experiment 3)]
    "In the learning phase, the attacker iteratively acquires and records unique crosstalk signatures corresponding to all 32 possible circuit sizes, compiling them into a Signature Dataset. ... the obtained crosstalk signature is compared against all entries in the Signature Dataset. The closest match, based on the lowest MSE, is considered the best prediction."

    The 32 'possible circuit sizes' in the Signature Dataset are exactly the 32 victim circuits later tested in Experiment 3 (sizes 2, 4, ..., 64 qubits). Each test signature is matched by minimum MSE against a database that contains a signature recorded from that same circuit configuration. The reported 100% accuracy is therefore a resubstitution/training-set accuracy, not an independent prediction on unseen configurations. No held-out split or unseen circuit size is used, so the 'prediction' reduces to retrieving the training label of the closest matching stored signature.

  2. fitted input called prediction [Section IV.B (Learning stage) and Section V.E (Experiment 4)]
    "Similarly, when predicting the exact bit patterns of a hidden shift of size 7 bits, there are 27 = 128possible values, resulting in 128 unique noise signatures. All collected noise signatures are recorded and stored as the Signature Dataset for further analysis. ... After selecting the attack circuit, the attacker proceeds with the passive SWAP attack to predict the output value. With the Optimal Strategy, only 22 qubits are necessary to achieve 100% prediction accuracy, as illustrated in Fig. 12."

    The Signature Dataset contains one signature for each of the 128 possible hidden shifts, and Experiment 4 then predicts among exactly these 128 values. The MSE comparison ranks the victim's signature against a database that already contains a signature for that same hidden-shift value. Additionally, the 'Optimal' qubit-selection strategy ranks qubits by their deviations in these same collected signatures, so both feature selection and accuracy evaluation are performed on the training set. The 100% prediction accuracy is thus a training-set lookup result rather than evidence of generalization to unseen victim circuits.

full rationale

The active SWAP attack (Experiments 1 and 2) is not circular: Acc0 is directly measured after placing a CNOT on chosen qubits, the severity labels are thresholds applied to that measured accuracy, and the SWAP-path intersection table is an empirical correlation between transpilation path and observed deviation. The paper does not fit a parameter and then rename it a prediction in the active mode. There is also no load-bearing self-citation: the references to the authors' own prior work are ordinary contextual citations and not used to justify the attack mechanism. The circularity is confined to the passive attack evaluation. The Signature Dataset is constructed by measuring crosstalk signatures for each possible victim configuration, and the same configurations are subsequently 'predicted' by nearest-neighbor MSE lookup. With no held-out data, the 100% accuracy figures in Experiments 3 and 4 are training-set accuracies; they demonstrate that signatures are reproducible within a calibration window, but not that the method predicts an unseen victim's circuit size or output. The multi-tenant concurrency assumption in Section III.B is asserted rather than demonstrated—the experimental setup only says jobs were 'queued back-to-back'—but this is a threat-model validity concern, not a circularity of derivation, so it does not by itself raise the circularity score. Overall the central passive-attack claim reduces to a lookup against its own training data, giving a partial circularity score of 6.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

Central claim rests on two asserted domain conditions: concurrent co-execution of independent tenant jobs, and deterministic SWAP routing with transpile seed 0. Both are stated as assumptions in Section III.B and V.A without supporting evidence. The passive attack additionally assumes the victim's qubit allocation is known or can be inferred. No new physical entities are postulated; the work reuses standard crosstalk noise.

assumptions (3)
  • domain assumption Multi-tenant IBM Quantum simultaneously schedules independent user circuits on the same physical device.
    Section III.B states the attacker can run its circuit simultaneously with the victim's circuit, but no evidence or reference shows that IBM Quantum co-schedules separate user jobs. The experiments appear to run a single composite circuit.
  • domain assumption SWAP paths are deterministic and consistent across the device when the transpilation seed is fixed to 0.
    Section V.A sets seed transpile = 0 to ensure consistency, but actual routing could vary with calibration and circuit layout; no verification of path stability is provided.
  • ad hoc to paper Measured deviations in victim output are caused by SWAP-path crosstalk rather than by unrelated hardware drift.
    Experiment 2's correlation supports this, but the paper provides no physical model or control isolating the crosstalk mechanism from other noise sources.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System." pith.science (2026). https://pith.science/paper/R4ZHRMGJ

@misc{pith2026250210115,
  author       = {Pith},
  title        = {Pith review of: SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R4ZHRMGJ}},
  note         = {Machine review of arXiv:2502.10115}
}
abstract

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

Figures

Figures reproduced from arXiv: 2502.10115 by the authors.

Figure 1
Figure 1. Active SWAP Attack Flow. Apart from these general assumptions, for the passive SWAP attack, it is further assumed that the attacker has knowledge of the victim’s qubit positions. IV. METHODOLOGY The proposed SWAP-based side-channel attack can be ex￾ecuted stealthily from a distance (active attack) or used to extract sensitive information from an unsuspecting victim’s circuit (passive attack). In this section, a deta… view at source ↗
Figure 2
Figure 2. Passive SWAP Attack Flow. from 1 to 32 bits, the victim’s circuit requires up to 64 qubits, allocated at even positions (0, 2, 4, . . . , 126), while the attacker’s qubits occupy the odd positions (1, 3, 5, . . . , 125). Consider another instance, where the attacker predicts the exact output of a fixed length, say 7 bit, the victim’s 14 qubits are placed at strategically spaced positions (e.g., 0, 9, 19, . . . , 126… view at source ↗
Figure 3
Figure 3. Attack Configuration in Experiment 1. Here, victim [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Attack Configuration in Experiment 2. Specifically, [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 7
Figure 7. Figure 7: Simon’s Algorithm with a Hidden Shift s = 111. the attacker to monitor. For the attack circuit, the maximum size is 127 − 64 = 63 qubits. The attack process follows the same workflow described in Section IV. During initialization, the attacker sets up a 63-qubit listen…
Figure 6
Figure 6. Figure 6: The Output Accuracy, Acc0 for Different Positions of Victim Circuit with a Fixed Attacker Position. D. Experiment 3: Passive SWAP Attack for Circuit Size For the passive SWAP attacks in Experiments 3 and 4, the scalability of the victim’s circuit is crucial. Therefore,…
Figure 8
Figure 8. Figure 8: Tradeoff Between Listening Size, Acc1, and Confi￾dence in Experiment 3. Once the attacker’s listening circuit size has been deter￾mined, the attacker can proceed with executing the attack on the actual quantum device along with the victim’s circuit. After the victim’s …
Figure 9
Figure 9. Figure 9: Attack Configuration and Results in Experiment 3. [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]
Figure 10
Figure 10. Figure 10: MSE Matrix for Listening Circuit with 11 Qubits [PITH_FULL_IMAGE:figures/full_fig_p007_10.png]
Figure 12
Figure 12. Figure 12: Attack Configuration in Experiment 4. Here, red [PITH_FULL_IMAGE:figures/full_fig_p008_12.png]
Figure 11
Figure 11. Figure 11: Tradeoff Between Listening Size, Acc1, and Confi￾dence in Experiment 4. After selecting the attack circuit, the attacker proceeds with the passive SWAP attack to predict the output value. With the Optimal Strategy, only 22 qubits are necessary to achieve 100% predicti…
Figure 13
Figure 13. Figure 13: MSE Matrix for Listening Circuit with 22 Qubits. REFERENCES [1] S. Bravyi, A. W. Cross, J. M. Gambetta, D. Maslov, P. Rall, and T. J. Yoder, “High-threshold and low-overhead fault-tolerant quantum memory,” Nature, vol. 627, no. 8005, pp. 778–782, 2024. [2] F. Arute, K…

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. An End-to-End Multi-Stage Kill-Chain Attack on Quantum Neural Networks: Demonstration on Trapped-Ion Hardware

    quant-ph 2026-07 conditional novelty 6.0 of 10

    A full kill-chain reconstructs QNN structure from simulated power traces then injects timed crosstalk to approximate adversarial inputs on AQT trapped-ion hardware.

  2. Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security

    quant-ph 2025-07 conditional novelty 6.0 of 10

    The paper adapts kill chain methodology from classical IT security to quantum machine learning, organizing published QML attacks into a five-stage lifecycle with attacker roles, capabilities, and defenses.

Reference graph

Works this paper leans on

28 extracted references · 24 canonical work pages · cited by 2 Pith papers

  1. [1]

    High-threshold and low-overhead fault-tolerant quantum memory,

    S. Bravyi, A. W. Cross, J. M. Gambetta, D. Maslov, P. Rall, and T. J. Yoder, “High-threshold and low-overhead fault-tolerant quantum memory,” Nature, vol. 627, no. 8005, pp. 778–782, 2024

    work page 2024

  2. [2]

    Quantum supremacy using a programmable superconducting processor,

    F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin, R. Barends, R. Biswas, S. Boixo, F. G. S. L. Brandao, D. A. Buell, B. Burkett, Y . Chen, Z. Chen, B. Chiaro, R. Collins, W. Courtney, A. Dunsworth, E. Farhi, B. Foxen, A. Fowler, C. Gidney, M. Giustina, R. Graff, K. Guerin, S. Habegger, M. P. Harrigan, M. J. Hartmann, A. Ho, M. Hoffmann, T. Huang, T. ...

    work page 2019

  3. [3]

    Quantum error correction below the surface code threshold,

    R. Acharya, L. Aghababaie-Beni, I. Aleiner, T. I. Andersen, M. Ans- mann, F. Arute, K. Arya, A. Asfaw, N. Astrakhantsev, J. Atalaya, et al., “Quantum error correction below the surface code threshold,” arXiv preprint arXiv:2408.13687, 2024

    arXiv 2024

  4. [4]

    Distributed quantum computing across an optical network link,

    D. Main, P. Drmota, D. P. Nadlinger, E. M. Ainley, A. Agrawal, B. C. Nichol, R. Srinivas, G. Araneda, and D. M. Lucas, “Distributed quantum computing across an optical network link,” Nature, vol. 638, no. 8050, pp. 383–388, 2025

    work page 2025

  5. [5]

    A comprehensive study of quantum arithmetic circuits,

    S. Wang, X. Li, W. J. B. Lee, S. Deb, E. Lim, and A. Chattopadhyay, “A comprehensive study of quantum arithmetic circuits,” Philosophical Transactions A, vol. 383, no. 2288, p. 20230392, 2025

    work page 2025

  6. [6]

    How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,

    C. Gidney and M. Eker ˚a, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum, vol. 5, p. 433, Apr. 2021

  7. [7]

    Quantum analysis of AES

    K. Jang, A. Baksi, H. Kim, G. Song, H. Seo, and A. Chattopad- hyay, “Quantum analysis of AES.” Cryptology ePrint Archive, Paper 2022/683, 2022

    work page 2022

  8. [8]

    Efficient quantum circuits for machine learning activation functions including constant t-depth relu,

    W. Zi, S. Wang, H. Kim, X. Sun, A. Chattopadhyay, and P. Rebentrost, “Efficient quantum circuits for machine learning activation functions including constant t-depth relu,” Phys. Rev. Res., vol. 6, p. 043048, Oct 2024

    work page 2024

Show all 28 references
  1. [9]

    IBM quantum platform

    “IBM quantum platform.” https://quantum.ibm.com/

  2. [10]

    The ibm quantum computer and the ibm quantum experience,

    A. C. Santos, “The ibm quantum computer and the ibm quantum experience,” Revista Brasileira de Ensino de F´ısica, vol. 39, Sept. 2016

    2016

  3. [11]

    Amazon braket

    “Amazon braket.” https://aws.amazon.com/braket/

  4. [12]

    Cloud based qc with amazon braket,

    C. Gonzalez, “Cloud based qc with amazon braket,” Digitale Welt, vol. 5, pp. 14–17, 2021

    2021

  5. [13]

    Ibm quantum platform

    “Ibm quantum platform.” https://quantum.microsoft.com/

  6. [14]

    Quantum leak: Tim- ing side-channel attacks on cloud-based quantum services,

    C. Lu, E. Telang, A. Aysu, and K. Basu, “Quantum leak: Tim- ing side-channel attacks on cloud-based quantum services,” ArXiv, vol. abs/2401.01521, 2024

    2024 arXiv

  7. [15]

    Exploration of power side-channel vulnerabilities in quantum computer controllers,

    C. Xu, F. Erata, and J. Szefer, “Exploration of power side-channel vulnerabilities in quantum computer controllers,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 579–593, 2023

    2023

  8. [16]

    Reconstructing quantum circuits through side- channel information on cloud-based superconducting quantum comput- ers,

    B. Bell and A. Tr ¨ugler, “Reconstructing quantum circuits through side- channel information on cloud-based superconducting quantum comput- ers,” in 2022 IEEE International Conference on Quantum Computing and Engineering (QCE) , pp. 259–264, IEEE, 2022

    2022

  9. [17]

    Poster: Malaq-a malware against quantum computer,

    S. Wang, A. Jin, S. Deb, T. Dutta, M. Mukherjee, and A. Chattopadhyay, “Poster: Malaq-a malware against quantum computer,” in Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, pp. 1946–1948, 2024

    1946

  10. [18]

    Software mitigation of crosstalk on noisy intermediate-scale quantum computers,

    P. Murali, D. C. McKay, M. Martonosi, and A. Javadi-Abhari, “Software mitigation of crosstalk on noisy intermediate-scale quantum computers,” in Proceedings of the Twenty-Fifth International Conference on Archi- tectural Support for Programming Languages and Operating Systems ...

    2020

  11. [19]

    Detecting crosstalk errors in quantum information processors,

    M. Sarovar, T. Proctor, K. Rudinger, K. Young, E. Nielsen, and R. Blume-Kohout, “Detecting crosstalk errors in quantum information processors,” Quantum, vol. 4, p. 321, 2020

    2020

  12. [20]

    Impact of noise on the resilience and the security of quantum computing,

    A. A. Saki, M. Alam, and S. Ghosh, “Impact of noise on the resilience and the security of quantum computing,” in 2021 22nd International Symposium on Quality Electronic Design (ISQED) , pp. 186–191, IEEE, 2021

    2021

  13. [21]

    Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,

    P. Zhao, K. Linghu, Z. Li, P. Xu, R. Wang, G. Xue, Y . Jin, and H. Yu, “Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,” PRX Quantum, vol. 3, p. 020301, Apr 2022

    2022

  14. [22]

    Simulating and mitigating crosstalk,

    A. Winick, J. J. Wallman, and J. Emerson, “Simulating and mitigating crosstalk,” Phys. Rev. Lett., vol. 126, p. 230502, Jun 2021

    2021

  15. [23]

    Quantum crosstalk robust quantum control,

    Z. Zhou, R. Sitler, Y . Oda, K. Schultz, and G. Quiroz, “Quantum crosstalk robust quantum control,” Phys. Rev. Lett., vol. 131, p. 210802, Nov 2023

    2023

  16. [24]

    Crosstalk attacks and defence in a shared quantum computing environ- ment,

    B. Harper, B. Tonekaboni, B. Goldozian, M. Sevior, and M. Usman, “Crosstalk attacks and defence in a shared quantum computing environ- ment,” arXiv preprint arXiv:2402.02753 , 2024

    2024 arXiv

  17. [25]

    A fast quantum mechanical algorithm for database search,

    L. K. Grover, “A fast quantum mechanical algorithm for database search,” in Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, STOC ’96, (New York, NY , USA), p. 212–219, Association for Computing Machinery, 1996

    1996

  18. [26]

    Analysis of crosstalk in nisq devices and security implications in multi-programming regime,

    A. A. Saki, M. Alam, and S. Ghosh, “Analysis of crosstalk in nisq devices and security implications in multi-programming regime,” in Proceedings of the ACM/IEEE International Symposium on Low Power Electronics and Design , pp. 25–30, 2020

    2020

  19. [27]

    Design of quantum computer antivirus,

    S. Deshpande, C. Xu, T. Trochatos, H. Wang, F. Erata, S. Han, Y . Ding, and J. Szefer, “Design of quantum computer antivirus,” in 2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pp. 260–270, IEEE, 2023

    2023

  20. [28]

    On the power of quantum computation,

    D. R. Simon, “On the power of quantum computation,” SIAM Journal on Computing, vol. 26, no. 5, pp. 1474–1483, 1997

    1997

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.