The reviewed record of science sign in
Pith

arxiv: 2606.11644 · v1 · pith:KOHMAS7M · submitted 2026-06-10 · quant-ph

Raw-Curve Quantum Fingerprints: A Mahalanobis Authentication Framework with Drift Early Warning and Adversarial Detection

Geyuyan Ma , Xiangdong Meng , Yangyang Fei , Zhiqiang Fan , Hanshi Zhao , Chenhui Wang , Haoran Yang , Weilong Wang
show 1 more author
Zheng Shan
This is my paper

Reviewed by Pith T0 review T1 audit T2 compute T3 formal T4 kernel 2026-06-27 09:43 UTCgrok-4.3pith:KOHMAS7Mrecord.jsonopen to challenge →

classification quant-ph
keywords quantum device authenticationMahalanobis classifierquantum fingerprintssuperconducting processorsadversarial detectiondrift monitoringquantum cloud securityraw measurement statistics
0
0 comments X

The pith

Concatenated raw quantum measurement statistics enable 100% device authentication via Mahalanobis nearest-neighbor classification.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that quantum cloud users can authenticate which physical processor executes their jobs by forming fingerprints directly from raw experimental statistics. Complementary experiments supply the data, which is stacked into high-dimensional vectors without curve fitting or selection. A Mahalanobis nearest-neighbor classifier then separates three superconducting processors with perfect accuracy across a three-week chronological test period. The same classifier produces per-device scores that support drift monitoring under noise and detection of certain adversarial feature perturbations. This supplies a unified method for fingerprinting, authentication, health tracking, and attack resistance in quantum cloud settings.

Core claim

Direct concatenation of raw measurement statistics from complementary experiments into high-dimensional vectors, followed by Mahalanobis nearest-neighbor classification, yields 100% benign authentication accuracy on three superconducting processors over a three-week chronological split while the resulting scores enable drift early warning and adversarial detection.

What carries the argument

Mahalanobis nearest-neighbor classifier applied to high-dimensional vectors formed by direct concatenation of raw experiment statistics, which carries the authentication, drift, and attack-detection functions.

Load-bearing premise

Raw statistics from complementary experiments contain stable, device-specific information that stays distinguishable across devices and over weeks without curve fitting or post-selection.

What would settle it

Apply the identical set of complementary experiments to the same three processors for an additional three-week period and measure whether the Mahalanobis classifier still reaches 100% accuracy on the new chronological test split.

Figures

Figures reproduced from arXiv: 2606.11644 by Chenhui Wang, Geyuyan Ma, Hanshi Zhao, Haoran Yang, Weilong Wang, Xiangdong Meng, Yangyang Fei, Zheng Shan, Zhiqiang Fan.

Figure 1
Figure 1. Figure 1: Overview of the proposed quantum hardware authentication framework. (a) A cloud user requests a specific quantum processor; without hardware [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Data acquisition and workflow. (a) Four interleaved quantum experiments are executed on a fixed 5-qubit chain. (b) Raw measurement statistics are [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Box plots of Mahalanobis distances to the own training centre (blue: [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Average per-feature contribution of each experiment group to the first [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 7
Figure 7. Figure 7: Distribution of authentication confidence [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗
Figure 6
Figure 6. Figure 6: Confusion matrix for the chronological test set (50 samples). The [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 8
Figure 8. Figure 8: Mean authentication confidence C¯ claimed under additive isotropic Gaussian noise (error bars: one standard deviation; shaded region: 25th–75th percentiles). TABLE VI MEAN C¯ claimed AND ACCURACY AT SELECTED σ. Device σ Mean ± std Accuracy TianYan-176 0 0.478 ± 0.094 1.000 2 0.043 ± 0.067 0.725 5 −0.261 ± 0.058 0.000 LQMS-3 0 0.773 ± 0.025 1.000 2 0.569 ± 0.034 1.000 6 0.153 ± 0.069 0.977 10 −0.021 ± 0.077… view at source ↗
Figure 9
Figure 9. Figure 9: Stacked area plot of warning states. Green: Safe; orange: Warning; [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
read the original abstract

Quantum cloud platforms are poised to deliver powerful computing capabilities, but users have no direct means to verify which physical device executes their workload. This lack of transparency enables hardware substitution attacks, where a malicious adversary could redirect a job to a substituted or inferior processor. We present a general authentication framework that addresses this problem by constructing multi-dimensional quantum fingerprints from raw measurement data. Without any curve fitting, we directly concatenate the raw statistics of complementary experiments into a high-dimensional feature vector that preserves subtle device-specific information. A Mahalanobis nearest-neighbor classifier achieves 100\% benign authentication accuracy on three superconducting processors over a three-week chronological split. The classifier naturally yields an authentication confidence $C_{\mathrm{claimed}}$ which reveals device-specific safety margins and motivates per-device alert thresholds. We assess the framework's robustness under two distinct scenarios. Under additive isotropic Gaussian noise, $C_{\mathrm{claimed}}$ decays predictably at a rate explained by inverse covariance traces, enabling an early warning mechanism. Against white-box adversarial perturbations, the same confidence threshold detects $L_2$ targeted attacks with near-perfect success and reveals device-dependent empirical thresholds for $L_\infty$ attacks, while untargeted and sparse attacks are ineffective. The proposed framework thus unifies fingerprint extraction, drift-resilient authentication, proactive health monitoring, and adversarial defense, offering a practical step toward trustworthy quantum cloud computing.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 1 minor

Summary. The paper proposes an authentication framework for quantum cloud processors that builds multi-dimensional fingerprints by directly concatenating raw measurement statistics from complementary experiments into high-dimensional feature vectors, without curve fitting or post-selection. A Mahalanobis nearest-neighbor classifier is reported to achieve 100% benign authentication accuracy on three superconducting processors over a three-week chronological split; the resulting per-device confidence metric is used for drift early warning under additive noise (via inverse-covariance traces) and for detecting white-box adversarial perturbations.

Significance. If the reported separation is not an artifact of covariance estimation, the work supplies a fitting-free, interpretable method for hardware verification in quantum-as-a-service settings that simultaneously addresses authentication, health monitoring, and adversarial robustness; the raw-data approach and explicit confidence thresholds are concrete strengths that could be directly tested on other platforms.

major comments (1)
  1. [Abstract / classifier section] Abstract and classifier description: the 100% accuracy claim rests on Mahalanobis distances that presuppose an invertible covariance matrix, yet the manuscript supplies no information on feature dimension after raw concatenation, number of independent runs used to estimate per-device or global covariance, or any regularization (pseudo-inverse, shrinkage, or projection) to avoid singularity when d exceeds n. This precondition is load-bearing for the central empirical result and must be demonstrated before the separation can be attributed to device-specific structure rather than metric degeneracy.
minor comments (1)
  1. [Abstract] The abstract invokes 'inverse covariance traces' to explain noise-decay rates but does not provide the explicit formula or derivation relating trace(Σ^{-1}) to the observed decay of C_claimed.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the careful and constructive review. The single major comment concerns the lack of explicit information needed to confirm covariance invertibility in the Mahalanobis classifier. We address this below and will revise the manuscript to supply the required details.

read point-by-point responses

  1. Referee: [Abstract / classifier section] Abstract and classifier description: the 100% accuracy claim rests on Mahalanobis distances that presuppose an invertible covariance matrix, yet the manuscript supplies no information on feature dimension after raw concatenation, number of independent runs used to estimate per-device or global covariance, or any regularization (pseudo-inverse, shrinkage, or projection) to avoid singularity when d exceeds n. This precondition is load-bearing for the central empirical result and must be demonstrated before the separation can be attributed to device-specific structure rather than metric degeneracy.

    Authors: We agree that these details are necessary to substantiate the central result. The current manuscript does not report the post-concatenation feature dimension, the exact number of independent runs used for covariance estimation, or the regularization method. In the revised version we will add this information to the classifier section, including the feature dimension arising from direct concatenation of raw histograms, the number of runs collected over the three-week period for estimating the (global) covariance, and the regularization technique (if any) applied to guarantee invertibility. We will also report a simple diagnostic (e.g., condition number or smallest eigenvalue) confirming that the metric is non-degenerate. This addition will allow readers to verify that the reported separation reflects device-specific structure rather than an artifact of the distance metric. revision: yes

Circularity Check

0 steps flagged

No circularity: experimental classification result stands on raw data split

full rationale

The paper's central claim is an empirical 100% benign authentication accuracy obtained by concatenating raw measurement statistics into feature vectors and applying a Mahalanobis nearest-neighbor classifier on a chronological train/test split across three devices. No equations, derivations, or self-citations are shown that reduce this accuracy to a fitted parameter by construction, rename a known result, or import uniqueness via author-overlapping citations. The noise-decay explanation via inverse-covariance traces is a post-hoc interpretation of the same metric already used for classification, not a load-bearing prediction that forces the reported accuracy. The framework is therefore self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract supplies no explicit free parameters, axioms, or invented entities; all claims rest on the unstated premise that raw statistics are device-discriminative.

pith-pipeline@v0.9.1-grok · 5806 in / 1035 out tokens · 16139 ms · 2026-06-27T09:43:24.127705+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 1 canonical work pages

  1. [1]

    https://quantum.ibm.com

    IBM Quantum. https://quantum.ibm.com. Accessed: 2024-10-15

    2024

  2. [2]

    Quantum computing in the NISQ era and beyond,

    J. Preskill, “Quantum computing in the NISQ era and beyond,”Quan- tum, vol. 2, p. 79, 2018

    2018

  3. [3]

    Quantum supremacy using a programmable superconducting processor,

    F. Arute, K. Arya, R. Babbush, et al., “Quantum supremacy using a programmable superconducting processor,”Nature, vol. 574, no. 7779, pp. 505–510, 2019

    2019

  4. [4]

    Demonstration of quantum supremacy,

    Google AI Quantum, “Demonstration of quantum supremacy,” Google AI Blog, 2019. https://ai.googleblog.com/2019/10/ quantum-supremacy-using-programmable.html

    2019

  5. [5]

    Amazon Braket: Fully managed quantum computing service,

    Amazon Web Services, “Amazon Braket: Fully managed quantum computing service,” 2020. https://aws.amazon.com/braket/

    2020

  6. [6]

    Azure Quantum: The open cloud ecosystem for quantum solutions,

    Microsoft Quantum, “Azure Quantum: The open cloud ecosystem for quantum solutions,” 2021. https://azure.microsoft.com/en-us/solutions/ quantum-computing/

    2021

  7. [7]

    Ac- cessed: 2024

    Tianyan Quantum Cloud Platform, https://tianyan.ustc.edu.cn/. Ac- cessed: 2024

    2024

  8. [8]

    A variational eigenvalue solver on a photonic quantum processor,

    A. Peruzzo, J. McClean, P. Shadbolt, et al., “A variational eigenvalue solver on a photonic quantum processor,”Nature Communications, vol. 5, p. 4213, 2014. 12

    2014

  9. [9]

    The theory of variational hybrid quantum-classical algorithms,

    J. R. McClean, J. Romero, R. Babbush, and A. Aspuru-Guzik, “The theory of variational hybrid quantum-classical algorithms,”New Journal of Physics, vol. 18, no. 2, p. 023023, 2016

    2016

  10. [10]

    Quantum simulation,

    I. M. Georgescu, S. Ashhab, and F. Nori, “Quantum simulation,”Reviews of Modern Physics, vol. 86, no. 1, p. 153, 2014

    2014

  11. [11]

    Quantum machine learning,

    J. Biamonte, P. Wittek, N. Pancotti, et al., “Quantum machine learning,” Nature, vol. 549, no. 7671, pp. 195–202, 2017

    2017

  12. [12]

    An introduction to quantum machine learning,

    M. Schuld, I. Sinayskiy, and F. Petruccione, “An introduction to quantum machine learning,”Contemporary Physics, vol. 56, no. 2, pp. 172–185, 2015

    2015

  13. [13]

    Noisy intermediate- scale quantum algorithms,

    K. Bharti, A. Cervera-Lierta, T. Kyaw, et al., “Noisy intermediate- scale quantum algorithms,”Reviews of Modern Physics, vol. 94, no. 1, p. 015004, 2022

    2022

  14. [14]

    Overview and comparison of gate level quantum software platforms,

    R. LaRose, “Overview and comparison of gate level quantum software platforms,”Quantum, vol. 4, p. 297, 2020

    2020

  15. [15]

    Quantum computing with realistically noisy devices,

    E. Knill, “Quantum computing with realistically noisy devices,”Nature, vol. 434, no. 7029, pp. 39–44, 2005

    2005

  16. [16]

    A quantum engineer’s guide to superconducting qubits,

    P. Krantz, M. Kjaergaard, F. Yan, T. P. Orlando, S. Gustavsson, and W. D. Oliver, “A quantum engineer’s guide to superconducting qubits,” Applied Physics Reviews, vol. 6, no. 2, p. 021318, 2019

    2019

  17. [17]

    Fluctuations of energy- relaxation times in superconducting qubits,

    P. V . Klimov, J. Kelly, Z. Chen, M. Neeley, A. Megrant, B. Burkett, R. Barends, K. Arya, B. Chiaro, Y . Chen, et al., “Fluctuations of energy- relaxation times in superconducting qubits,”Physical Review Letters, vol. 121, no. 9, p. 090502, 2018

    2018

  18. [18]

    Quantum PUF for security and trust in quantum computing,

    K. Phalak, A. Ash-Saki, M. Alam, R. O. Topaloglu, and S. Ghosh, “Quantum PUF for security and trust in quantum computing,”IEEE Journal on Emerging and Selected Topics in Circuits and Systems, vol. 11, no. 2, pp. 333–345, 2021

    2021

  19. [19]

    QPUF 2.0: Exploring quantum physical unclonable functions for security-by-design of energy cyber-physical systems,

    V . K. V . V . Bathalapalli, S. P. Mohanty, C. Pan, and E. Kougianos, “QPUF 2.0: Exploring quantum physical unclonable functions for security-by-design of energy cyber-physical systems,” arXiv preprint arXiv:2304.08511, 2023

    work page arXiv 2023

  20. [20]

    Quantum physical unclonable functions: Possibilities and impossibilities,

    M. Arapinis, M. Delavar, M. Doosti, and E. Kashefi, “Quantum physical unclonable functions: Possibilities and impossibilities,”Quantum, vol. 5, p. 475, 2021

    2021

  21. [21]

    A well-conditioned estimator for large- dimensional covariance matrices,

    O. Ledoit and M. Wolf, “A well-conditioned estimator for large- dimensional covariance matrices,”Journal of Multivariate Analysis, vol. 88, no. 2, pp. 365–411, 2004

    2004

  22. [22]

    On the generalised distance in statistics,

    P. C. Mahalanobis, “On the generalised distance in statistics,”Proceed- ings of the National Institute of Sciences of India, vol. 2, no. 1, pp. 49– 55, 1936

    1936

  23. [23]

    Decoherence benchmarking of superconducting qubits,

    J. J. Burnett, A. Bengtsson, M. Scigliuzzo, D. Niepce, M. Kudra, P. Dels- ing, and J. Bylander, “Decoherence benchmarking of superconducting qubits,”npj Quantum Information, vol. 5, p. 54, 2019

    2019

  24. [24]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in3rd International Conference on Learning Representations (ICLR 2015), San Diego, CA, 2015

    2015

  25. [25]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in6th Interna- tional Conference on Learning Representations (ICLR 2018), Vancouver, Canada, 2018

    2018

  26. [26]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in IEEE European Symposium on Security and Privacy (EuroS&P 2016), pp. 372–387, IEEE, Saarbrücken, Germany, 2016

    2016

  27. [27]

    One pixel attack for fooling deep neural networks,

    J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,”IEEE Transactions on Evolutionary Computation, vol. 23, no. 5, pp. 828–841, 2019. APPENDIXA COVARIANCEESTIMATION For each devicec, letZ c ∈R nc×d be the matrix of PCA- projected training samples (nc samples,d= 119components). The sample covariance matrix isS c = 1 nc...

    2019

  28. [28]

    Definition and whitening interpretation:For a pointz(in the PCA subspace) and a class with centroidµ c and covariance Σc, the squared Mahalanobis distance is(z−µ c)⊤Σ−1 c (z− µc). FactorisingΣ −1 c =L ⊤Lyields∥L(z−µ c)∥2 2, i.e., Euclidean distance after a linear whitening transformation that makes the class-conditional distribution isotropic (unit varian...

  29. [29]

    With- out normalisation, high-variance dimensions would dom- inate the distance and mask subtle shape variations

    Why it is necessary for our fingerprint data:Our 1468- dimensional raw fingerprint (Section II-C) has three character- istics that make Euclidean or Manhattan distances unsuitable: •Heterogeneous scales:probabilities, gate counts, and time delays have vastly different natural variances. With- out normalisation, high-variance dimensions would dom- inate th...

  30. [30]

    Relation to PCA and why down-weighting high within- class variance helps:PCA is applied globally to the training set (all devices combined) and retains directions of large totalvariance (95% cumulative). A direction may have large total variance either because it captures genuine differences between devices (useful for classification) or because it con- t...

  31. [31]

    safety margin

    Specific roles in the framework: •Authentication:The MNN classifier assigns a test sam- ple to the device with smallest Mahalanobis distance. The class-conditional whitening yields clean geometric separation (inter-/intra-class ratios>3), giving 100% accuracy under natural drift. •Confidence scoreC claimed:Defined as 1−D claimed/Dsecond, the ratio of Maha...

  32. [32]

    •TianYan-176(b= 52.11,d= 26.68, typicala≈49.7, c≈419.0): ∆ = 52.11×419.0−49.7×26.68≫0

    Application to the three devices:Using the per-device traces and typical noise-free distances (Section IV-B), we obtain the following picture. •TianYan-176(b= 52.11,d= 26.68, typicala≈49.7, c≈419.0): ∆ = 52.11×419.0−49.7×26.68≫0. For all test samples∆is strongly positive; therefore every individual sample exhibits a monotonic decrease ofC claimed, produci...

  33. [33]

    Compute the Mahalanobis distance from every training sample of devicecto its own centroidµ c

  34. [34]

    Take the 95th percentile of these distances as the accep- tance thresholdθ c

  35. [35]

    This model has no knowledge of other device classes; it makes an independent accept/reject decision for each claimed identity without a joint classification rule

    During testing, a sample claiming identitycis accepted if its Mahalanobis distance toµ c is≤θ c, and rejected otherwise. This model has no knowledge of other device classes; it makes an independent accept/reject decision for each claimed identity without a joint classification rule. Consequently, it does not produce a single overall multi-class accuracy. ...