PaperlayerView exact revision on arXiv

Source-linked AI summary

Qubit Sensing: A New Attack Model for Multi-programming Quantum Computing

Abdullah Ash Saki, Swaroop Ghosh

arXiv:2104.05899v1quant-ph

TL;DR

State-dependent, correlated readout errors in multi-programmed quantum computers may expose a victim’s output to another user. The paper uses reference signatures and statistical comparison to infer that output, reporting 96% accuracy on real hardware and proposing randomized flipping as a low-overhead countermeasure.

  • Problem

    State-dependent readout errors correlated across qubits can expose a victim’s potentially sensitive output to an adversary sharing the quantum computer.

    Source: §I · pp. 1–2

  • Method

    The adversary compares its qubit’s unknown output distribution with reference signatures using Jensen-Shannon Distance, while randomized output inversion is proposed as a countermeasure.

    Source: 1) Adjacent qubit · p. 2, A. BASIC IDEA · p. 4

  • Results

    The attack identifies victim output with 96% accuracy, and randomized qubit flipping incurs an average fidelity loss of approximately 0.05% on test circuits.

    Source: §IV · p. 4, B. OVERHEAD ANALYSIS · p. 4

  • Takeaways & Limitations

    Randomly inverting one or more victim output qubits can make the adversary’s signature-based inference wrong, with a reported average fidelity loss of approximately 0.05% on test circuits.

    Source: A. BASIC IDEA · p. 4, B. OVERHEAD ANALYSIS · p. 4

Abstract

from arXiv · show

Noisy quantum computers suffer from readout or measurement error. It is a classical bit-flip error due to which state "1" is read out as "0" and vice-versa. The probability of readout error shows a state dependence i.e., flipping probability of state "1" may differ from flipping probability of state "0". Moreover, the probability shows correlation across qubits. These state-dependent and correlated error probability introduces a signature of victim outputs on adversary output when two programs are run simultaneously on the same quantum computer. This can be exploited to sense victim output which may contain sensitive information. In this paper, we systematically show that such readout error-dependent signatures exist and that an adversary can use such signature to infer a user output. We experimentally demonstrate the attack (inference) on 3 public IBM quantum computers. Using Jensen-Shannon Distance (JSD) a measure for statistical inference, we show that our approach identifies victim output with an accuracy of 96% on real hardware. We also present randomized output flipping as a lightweight yet effective countermeasure to thwart such information leakage attacks. Our analysis shows the countermeasure incurs a minor penalty of 0.05% in terms of fidelity.

I. INTRODUCTION

Multi-programming runs multiple users’ workloads simultaneously on different qubits, improving quantum-computer utilization. State-dependent, cross-qubit readout errors can expose a victim’s output, motivating experimental study of the vulnerability and a proposed countermeasure.

  • Multi-programming runs multiple users’ workloads in parallel on different qubits, improving device utilization.Source: §I · p. 1
  • State-dependent readout errors correlated across qubits can let an adversary infer a victim’s state from the adversary’s own qubit.Source: §I · pp. 1–2
  • The vulnerability matters because victim outputs may contain sensitive information, such as financial portfolio results.Source: §I · p. 2
  • The paper experimentally demonstrates the vulnerability and proposes randomized output inversion as a countermeasure.Source: §I · p. 2

II. PROPOSED ATTACK METHODOLOGY

This section introduces the attack model, reference-signature collection, and statistical classification of victim outputs.

  • The section presents the attack model.Source: §II · p. 2
  • It describes collecting reference signatures.Source: §II · p. 2
  • It describes classifying victim output with a statistical method.Source: §II · p. 2

A. ATTACK MODEL

Victim and adversary circuits run simultaneously on different qubits of the same quantum computer. The adversary uses prior reference signatures and Jensen-Shannon Distance to infer the victim’s output from its own qubit’s data.

  • The victim and adversary execute circuits on different qubits of the same quantum computer.Source: A. ATTACK MODEL · p. 2
  • The adversary has prior reference signatures that distinguish victim states 0 and 1.Source: A. ATTACK MODEL · p. 2
  • During the attack, the adversary reads only its own qubit and compares its data with the references using Jensen-Shannon Distance.Source: A. ATTACK MODEL · p. 2

B. REFERENCE SIGNATURE COLLECTION

Reference signatures are collected by preparing victim qubits in states 0 and 1 while sensing from another qubit. The resulting adversary-qubit distributions differ across victim states and are used to infer the victim’s output.

C. CLASSIFYING VICTIM OUTPUT

The adversary compares an unknown output distribution with reference distributions for victim states 0 and 1 using Jensen-Shannon Distance (JSD). Across 200 test circuits on three devices, victim states were correctly classified 192 times.

C. CLASSIFYING VICTIM OUTPUT

  • JSD0 and JSD1 compare the unknown distribution with references for victim states 0 and 1, and the smaller distance determines the classification.If JSD1 < JSD0, the unknown data is classified as victim state 1, and vice versa.Source: 1) Adjacent qubit · p. 2
  • 96% accuracy was achieved in classifying victim outputs across 200 randomized-benchmarking test circuits on three devices.The circuits had varied depths from 1–10.Source: Figure 3 · p. 3, 1) Adjacent qubit · p. 3
  • The evaluation used randomized-benchmarking circuits of varied depth, with state preparation for victim states 0 or 1.The adversarial sensing circuit consisted of a single X gate.Source: 1) Adjacent qubit · p. 3

2) Non-adjacent sensing

The victim and adversary need not use adjacent qubits: distinct readout signatures were observed for physically distant pairs.

2) Non-adjacent sensing

  • Distinct victim-state signatures were observed across physically non-adjacent qubit pairs, including Q0 and Q4 in ibmq_rome.The experiments collected data from many non-adjacent pairs.Source: 2) Non-adjacent sensing · p. 3

D. SENSING MULTIPLE VICTIM QUBITS USING A SINGLE ADVERSARY QUBIT

One adversary qubit can distinguish outputs from two victim qubits, but overlapping signatures limit sensing to at most two victim qubits.

D. SENSING MULTIPLE VICTIM QUBITS USING A SINGLE ADVERSARY QUBIT

  • Victim and adversary qubits can also show separate signatures when physically non-adjacent.The example includes Q0 and Q4 in ibmq_rome.Source: Figure 4 · p. 3
  • A single adversary qubit can sense at most two victim qubits; signatures for three victim qubits overlap.The signatures for three victim qubits become closer, making sensing with one qubit infeasible.Source: Figure 5 · p. 3, D. SENSING MULTIPLE VICTIM QUBITS… · p. 3
  • The four possible states of two victim qubits (00, 01, 10, and 11) have distinct signatures on one adversary qubit.The experiments validate sensing multiple-victim outputs with a single qubit.Source: Figure 5 · p. 3, D. SENSING MULTIPLE VICTIM QUBITS… · p. 3

III. COUNTERMEASURE

The section presents a countermeasure to thwart qubit sensing and discusses its overhead.

III. COUNTERMEASURE

  • The section discusses a countermeasure intended to thwart qubit sensing and its associated overhead.Source: §III · p. 4

A. BASIC IDEA

Randomly inverting one or more victim output qubits can disrupt the adversary’s signature-based inference, leaving it to guess without knowing which qubits were inverted.

A. BASIC IDEA

  • Randomly adding NOT gates to victim output qubits makes the adversary’s sensed state differ from the victim’s actual output.The victim can post-process the added inversion to recover its intended output, while the adversary treats the sensed state as correct.Source: A. BASIC IDEA · p. 4
  • Without knowing which victim qubits were inverted, the adversary cannot make an educated decision from the signature and must guess randomly.Source: A. BASIC IDEA · p. 4
  • Random guessing yields 50% accuracy for one victim qubit and 25% for two victim qubits.Source: A. BASIC IDEA · p. 4

B. OVERHEAD ANALYSIS

The conclusion reports 96% attack accuracy and presents randomized qubit flipping as a low-overhead countermeasure; overhead experiments report about 0.05% average fidelity loss.

B. OVERHEAD ANALYSIS

  • About 0.05% average fidelity loss is measured with an added X-gate across experiments on three IBM devices.The added X-gate also makes adversary inferencing wrong.Source: B. OVERHEAD ANALYSIS · p. 4
  • An added X-gate introduces gate error and increases runtime, both of which hurt program fidelity.The passage notes single-qubit gates have lower error rates and faster runtimes.Source: B. OVERHEAD ANALYSIS · p. 4

IV. CONCLUSION

  • 96% accuracy is reported for the attack, alongside randomized qubit flipping as a low-overhead circuit-level countermeasure.Source: §IV · p. 4
Loading 2104.05899v1…