PaperlayerView exact revision on arXiv

Source-linked AI summary

Stealthy SWAPs: Adversarial SWAP Injection in Multi-Tenant Quantum Computing

Suryansh Upadhyay, Swaroop Ghosh

arXiv:2310.17426v1quant-ph

TL;DR

Multi-tenant computing can improve quantum-hardware utilization, but shared superconducting hardware also presents a SWAP-injection threat. The paper proposes a representative scheduler and adversarial allocation model; it reports a maximum increase of approximately 55% and a median increase of approximately 25% in SWAP overhead.

  • Problem

    Multi-tenant computing can improve hardware utilization, but the paper identifies adversary-induced SWAP injection as a security threat in superconducting quantum computing.

    Source: §I · pp. 1–2

  • Method

    The paper presents a representative fair-share scheduler and a threat model in which an adversary strategically occupies qubits to add SWAPs to a victim program.

    Source: §III · p. 3, B. Proposed SWAP injection attack model · p. 4

  • Results

    Approximately 55% maximum and approximately 25% median increase in SWAP overhead were reported.

    Source: §VII · p. 6

  • Takeaways & Limitations

    The paper proposes a sample machine-learning model to detect anomalous user behavior as a countermeasure.

    Source: §VI · p. 6, §VII · p. 6

Abstract

from arXiv · show

Quantum computing (QC) holds tremendous promise in revolutionizing problem-solving across various domains. It has been suggested in literature that 50+ qubits are sufficient to achieve quantum advantage (i.e., to surpass supercomputers in solving certain class of optimization problems).The hardware size of existing Noisy Intermediate-Scale Quantum (NISQ) computers have been ever increasing over the years. Therefore, Multi-tenant computing (MTC) has emerged as a potential solution for efficient hardware utilization, enabling shared resource access among multiple quantum programs. However, MTC can also bring new security concerns. This paper proposes one such threat for MTC in superconducting quantum hardware i.e., adversarial SWAP gate injection in victims program during compilation for MTC. We present a representative scheduler designed for optimal resource allocation. To demonstrate the impact of this attack model, we conduct a detailed case study using a sample scheduler. Exhaustive experiments on circuits with varying depths and qubits offer valuable insights into the repercussions of these attacks. We report a max of approximately 55 percent and a median increase of approximately 25 percent in SWAP overhead. As a countermeasure, we also propose a sample machine learning model for detecting any abnormal user behavior and priority adjustment.

I. INTRODUCTION

Multi-tenant computing is proposed to improve quantum-hardware utilization, but sharing also creates a route for adversaries to exploit connectivity constraints. The paper introduces a SWAP-injection threat and a representative scheduler, then outlines experiments and countermeasures.

I. INTRODUCTION

  • Cloud quantum services face a demand-supply imbalance and long access waits, motivating multi-tenant computing to use hardware more efficiently.Source: §I · p. 1
  • Strategically occupying qubit 2 can leave the victim on less-connected qubits and increase its SWAP count versus the alternate allocation.The example compares a 1-qubit adversary and a 4-qubit victim on 5-qubit hardware.Source: Figure 1 · p. 1, §I · p. 2
  • The paper identifies adversary-induced extra SWAPs as a new fault-injection threat to reliability and security in multi-tenant quantum computing.The authors describe this as, to their knowledge, the first SWAP-based fault-injection threat study tailored to MTC.Source: §I · p. 2
  • The paper contributes a SWAP-based fault-injection model, a representative MTC scheduler, experiments across circuit depths and qubit counts, and countermeasures.Source: §I · p. 2

II. BACKGROUND

The background explains qubits and quantum gates, then describes how limited hardware connectivity necessitates SWAP-based routing. It situates the proposed superconducting-hardware attack among prior quantum-security work.

A. Qubits and Quantum gates

B. Connectivity constraint and SWAP operations

  • Disconnected qubit pairs cannot directly use a native two-qubit gate, so routing with SWAP operations brings interacting logical qubits together at added depth, gate cost, and error risk.Source: B. Connectivity constraint and SWAP… · p. 2

C. Relation to prior work

  • Prior work studies quantum IP protection, Trojan insertion, untrusted providers, crosstalk in shared hardware, and shuttle operations in trapped-ion systems; this paper targets SWAP injection in superconducting MTC.Source: C. Relation to prior work · p. 2

III. SCHEDULER

The representative scheduler combines fair-share queueing and priority-based selection to allocate qubits and identify programs that can run concurrently. Its mapping checks include connectivity and compatibility constraints.

III. SCHEDULER

  • Fair-share queueing prioritizes the least-used group share and breaks equal-share ties by giving older jobs FIFO priority.Source: §III · p. 3
  • The scheduler divides queued programs into equal high-, medium-, and low-priority groups, with lower scores receiving higher priority.Source: §III · p. 3
  • After selecting the highest-priority program, it checks other jobs for parallel execution using qubit needs, comparable execution time, connectivity, mapping, compatibility, and no-sharing constraints.Source: §III · p. 3
  • The priority metric is the ratio of two-qubit gates to total gates and helps resolve initial qubit-mapping ties.Source: §III · p. 3

IV. THREAT MODEL

The threat model assumes an adversary can inspect hardware connectivity and analyze qubit quality, then strategically occupy qubits during concurrent execution. The scheduler processes scored programs into an initial allocation, while the attack seeks to impose extra victim SWAPs.

A. Adversary capabilities

  • The adversary is assumed to know the public connectivity graph and have enough computing resources to analyze qubit quality using error rates and connectivity.Source: A. Adversary capabilities · p. 3

B. Proposed SWAP injection attack model

  • The scheduler takes fair-share-scored programs and outputs initial qubit allocations, grouping programs by score and calculating a two-qubit-gate-to-total-gate priority metric.Source: B. Proposed SWAP injection attack model · p. 4
  • The adversary strategically occupies selected qubits to maximize additional SWAPs on a victim program running concurrently on hardware with a predefined connectivity graph.The paper's sample scheduler case study compares the resulting victim SWAP count with an alternate allocation baseline.Source: B. Proposed SWAP injection attack model · p. 4
  • The qubit quality metric Q indicates targeting likelihood: lower Q values make a qubit more likely to be targeted.Source: Figure 3 · p. 4

C. Attack scenario : Kitchen sink approach

The kitchen-sink attack uses varied adversarial jobs to exploit scheduler vulnerabilities without requiring exact knowledge of a victim program.

C. Attack scenario : Kitchen sink approach

D. Adversarial qubit selection

Adversarial qubit selection weighs connectivity and error characteristics to choose qubits that are more useful to occupy.

D. Adversarial qubit selection

1) Qubit Quality Metric:

The qubit quality metric combines connectivity and error factors to rank qubits for potential use in a SWAP-based attack.

1) Qubit Quality Metric:

V. RESULTS AND ANALYSIS

The evaluation uses random circuits and noisy fake-provider simulators, measuring added SWAPs and their CNOT-gate overhead.

V. RESULTS AND ANALYSIS

  • Benchmarks use random quantum circuits varying in qubit count, gate count, depth, and connectivity pattern.Source: §V · p. 5
  • Execution uses Qiskit fake-provider noisy simulators based on IBM system snapshots containing coupling maps, basis gates, and qubit parameters.Source: §V · p. 5
  • Performance is measured by SWAP overhead, defined as the percentage increase in CNOT gates, and the absolute number of additional SWAPs.A SWAP is reduced during compilation to a combination of CNOT gates, usually three.Source: §V · p. 5

2) Attack feasibility: The impact of resource allocation in MTC:

The experiments compare SWAP overhead across qubit allocations, circuit complexities, and program sizes. Less-connected allocations show higher overhead than densely connected baselines, with the reported increase varying by circuit and qubit case.

1) Experimental setup:

  • ≈55% maximum and ≈25% median increases in SWAP overhead were observed between allocation configurations 1 and 5 (baseline) across 100 six-qubit programs.The next-best-connected allocation still showed a maximum increase of ≈15% and a median increase of ≈8%.Source: 1) Experimental setup · p. 5

3) Impact of program complexities:

  • As circuit size rose from 50 to 300 gates, mean SWAP overhead fell from ≈29% to ≈15%, while the mean number of additional SWAPs rose from ≈10% to ≈35%.The authors report the attack as comparably effective, if not more so, on smaller programs.Source: 3) Impact of program complexities · p. 5

4) Effect of program size (i.e., number of qubits):

  • ≈28% mean and ≈70% maximum increases in SWAP overhead occurred when comparing least- with most-connected allocations across 4–10-qubit cases.The comparisons used 100 batches per qubit case on Fake Singapore, with similar depth and gate count.Source: 4) Effect of program size (i.e.,… · pp. 5–6, Figure 6 · p. 6

VI. DEFENSE STRATEGY

The defense strategy proposes detecting anomalous queue behavior with a One-Class SVM and responding through alerts, independent execution, or priority adjustment.

VI. DEFENSE STRATEGY

  • The proposed defense uses One-Class SVM anomaly detection on queue behavior and responds with alerts, independent execution, or dynamic priority adjustment.Flagged users may run programs independently, or the scheduler may adjust priorities to allocate resources more fairly.Source: §VI · p. 6

2) Job concurrency:

  • Priority-distribution features treat concentration at either end of the predefined priority range as anomalous.The proposed feature set also includes normal and anomalous labels for user behavior in the program queue.Source: §VI · p. 6, 4) User Account Activity · p. 6

1) Job request frequency:

  • Frequency features flag users exceeding daily request thresholds or submitting many concurrent jobs.The passage describes both consistently exceeding a request threshold and attempting to run a large number of jobs concurrently as anomalous patterns.Source: 1) Job request frequency · p. 6, 2) Job concurrency · p. 6

4) User Account Activity:

The paper concludes that adversarial SWAP injection can raise overhead and proposes queue-anomaly detection as a countermeasure. Its defense examples include account activity, execution duration relative to priority, and resource contention.

4) User Account Activity:

5) Execution Duration vs. Priority:

6) Resource Contention:

  • Frequent competition for the same resources is anomalous; a One-Class SVM flags new data points with decision scores well below a set threshold.The model is trained exclusively on data representing normal behavior.Source: 6) Resource Contention · p. 6

VII. CONCLUSION

  • The paper reports up to ≈55% and a median ≈25% increase in SWAP overhead, alongside a sample machine-learning model for detecting anomalous user behavior.The conclusion also presents a representative scheduler and a novel SWAP-injection attack model for multi-tenant computing.Source: §VII · p. 6
Loading 2310.17426v1…