Source-linked AI summary
Quantum Workload Privacy Beyond Data Confidentiality
Shaunak Suresh Pawar, Samuel Punch, Krishnendu Guha
TL;DR
Delegated quantum computing can expose proprietary scientific workload structure because hardware-aware compilation produces observable execution artefacts, not merely protected states and outputs. This work formalises Scientific-Intent Indistinguishability, proves passive security asymptotically unachievable under routing-optimal compilation, and validates near-perfect leakage on IBM Heron hardware across PDE boundary regimes and molecular geometries. The results establish execution-level confidentiality as a design requirement.
Problem
Delegated quantum computing exposes a confidentiality gap because standard quantum privacy models protect states and outputs but overlook proprietary scientific workload structure.
Method
The paper formalises Scientific-Intent Indistinguishability, analyses routing leakage under fixed-connectivity compilation, and evaluates classification, scale recovery, cross-domain transfer, and gate-padding.
Results
Near-perfect leakage detection was achieved on a 156-qubit IBM Heron r2 processor, with Macro-F1 = 1.000 ± 0.000 for the C8 versus C3 routing gap and dz = 7.701; the signature also reproduced for linear H2 versus bent H2O geometry.
Takeaways & Limitations
Protecting quantum states alone is insufficient because compilation artefacts encode hidden scientific structure; execution-level confidentiality requires topology-blind routing, artefact normalisation, and timing masking.
Takeaways & Limitations
The study is limited to fixed-connectivity superconducting hardware; reconfigurable or all-to-all architectures may be structurally immune, and broader execution-trace privacy guarantees remain open problems.
Abstract
from arXiv · showhide
Remote quantum computing exposes a confidentiality gap. Standard privacy mechanisms protect quantum states and outputs, but not the scientific structure of a workload. This work reveals that hardware-aware compilation leaves observable signatures, such as routing overhead, circuit depth, and gate composition, that correlate with hidden modelling choices like partial differential equation boundary conditions, discretisation scale, and molecular geometry. The leakage arises from the mismatch between logical topology and fixed hardware connectivity, forcing problem-dependent SWAP insertion. We formalise this threat as Scientific-Intent Indistinguishability and prove that passive security is asymptotically unachievable under routing-optimal compilation. Experiments on a 156-qubit IBM Heron processor achieve near-perfect classification of boundary regimes and molecular geometries, with leakage generalising across solver families via routing-scaling exponents. Conventional gate-padding fails as a defence, causing fidelity drops without reducing adversarial advantage. Our results show that protecting quantum data alone is insufficient; execution-level confidentiality must become a first-class design requirement.
I. Introduction
The paper identifies scientific workload structure as a confidentiality target overlooked by existing quantum privacy mechanisms. It formalises SCI-IND, develops leakage mechanisms, and validates substantial intent recovery across PDE and chemistry workloads.
- Scientific Intellectual Property includes modelling structure, physical regime, algorithmic configuration, and discretisation choices, not merely numerical outputs.
- Existing BQC and timing-side-channel research protects computation semantics or runtime information, but not scientific structure encoded in workloads.
- SCI-IND security is asymptotically unachievable under routing-optimal compilation on constrained hardware.
- Routing-overhead scaling recovers spatial discretisation N with stable exponents across solver families, k = 1.673 versus k = 1.836.
- Macro-F1 = 1.000 ± 0.000 on a 156-qubit IBM Heron r2 testbed confirms the C8 versus C3 routing gap, with dz = 7.701.
- The routing-gap signature also reproduces for hidden molecular geometry, distinguishing linear H2 from bent H2O with dz = 49.173.
- Passive gate-padding does not reduce adversarial advantage without catastrophic fidelity loss because the leakage is topological.
II. Background and Related Work
Prior work establishes links between modelling choices, circuit resources, and observable side channels, while this paper positions scientific-intent leakage within that landscape. The delegation workflow separates hidden modelling intent from outputs and execution artefacts.
- Quantum PDE research shows that modelling choices directly govern qubit count and circuit depth.
- Quantum side-channel studies fingerprint circuits through timing and resource traces but target generic circuit properties rather than scientific modelling intent.
- BQC hides circuit semantics from the server, whereas this work studies whether compilation footprints reveal hidden scientific structure.
- The workflow distinguishes confidential modelling intent, potentially disclosed numerical output, and provider-visible execution artefacts.
B. Adversary: The Conditioned Scientific Provider
A passive, domain-conditioned cloud provider can infer hidden scientific intent from compilation and scheduling artefacts. Fixed hardware connectivity forces problem-dependent routing, imprinting logical connectivity onto observable metrics.
- The adversary observes physical qubit mapping, routed depth, gate-mixture statistics, and transpilation latency without modifying circuits or injecting noise.
- Provider domain conditioning supplies solver-family knowledge and baseline execution footprints for detecting deviations in compiled artefacts.
- Periodic-boundary PDE interactions can conflict with fixed hardware cycles, forcing SWAP insertion that increases depth and gate counts.
- The vulnerability extends beyond PDEs to delegated programs whose hidden parameters modify logical connectivity, while gate-padding fails against topological leakage.
- A workload combines public profile x with hidden scientific intent s, while compilation maps it with hardware H and randomness ρ to a physical circuit and schedule.
- The provider’s transcript contains routed depth, two-qubit overhead, swap fraction, CX fraction, depth overhead ratio, and transpilation latency.
- The delegation pipeline exposes hidden modelling intent through compiler-generated routing overhead, gate composition, and depth.
B. Relation to Existing Notions
SCI-IND defines a distinct security question from BQC: whether observable operational signatures reveal hidden scientific intent. Its game compares workloads with identical public profiles but different hidden intents.
- BQC circuit privacy and SCI-IND are orthogonal: either notion can hold while the other fails.
- The security game gives an adversary two workloads sharing public profile x but differing in hidden intents s0 and s1, then returns one execution transcript.
- SCI-IND security requires that every probabilistic polynomial-time adversary cannot distinguish the two hidden intents from the transcript.
D. Analytical Limits
Under routing-optimal compilation, differing hidden connectivity can create statistically distinguishable routing overhead, making passive scientific-intent privacy asymptotically infeasible. Although the analytical result targets non-isomorphic graphs, empirical scaling reveals leakage for near-isomorphic parameter variations as well.
- Analytical result: A routing-optimal compiler creates an efficient distinguisher whenever hidden workloads induce connectivity graphs with different routing costs.The distinguisher operates by thresholding observed routing overhead.
- Analytical result: The distinguisher’s advantage depends on the routing-overhead gap relative to compilation noise.Here, ∆routing denotes the expected overhead difference and σρ the standard deviation induced by compilation randomness.
- Asymptotic limit: Passive SCI-IND security requires σρ/∆routing →∞ whenever ∆routing/σρ ≥ c > 0.The required noise level destroys computational utility.
- Scope: Proposition 1 does not analytically cover near-isomorphic graphs produced by continuous parameter changes such as N = 14 versus N = 16.Phase 2 addresses this boundary empirically through routing-scaling measurements.
V. Physics-to-Artefact Coupling
Hidden scientific choices become observable because hardware-aware compilation maps workload connectivity onto fixed hardware connectivity. This mismatch produces problem-dependent routing, depth, and gate-volume signatures that can be measured in a controlled testbed.
- Topological coupling: Boundary topology changes logical connectivity, causing different routing costs when the hardware cannot natively embed the workload graph.Periodic wrap-around connectivity requires more SWAPs than local Dirichlet connectivity on constrained hardware.
- Complexity coupling: Grid resolution controls circuit depth and gate volume, creating resolution-dependent signatures after routing.The passage states depth ∝N · nsteps and gate volume ∝N^α.
- Evaluation design: The leakage surface is evaluated across boundary topology, discretisation scale, calibration drift, and accuracy requirements.The testbed uses matched workload pairs and assesses mutual information, paired Cohen’s dz, and grouped held-out classification.
A. Phases 1–4: Boundary, Scale, Stability, Accuracy
Across four evaluation phases, compilation artefacts reveal boundary regimes, discretisation scale, hardware stability, and accuracy targets, with leakage transferring across solver families and workloads. The strongest signals arise when logical and hardware topologies are physically mismatched.
- Phase 1: Boundary topology: Macro-F1 = 0.925 ± 0.021 for boundary-topology classification on ladder_2x4, with swap_equiv yielding 0.624 bits MI.All eight compilation features exceeded the null 95% band with pHolm < 0.016.
- Phase 2: Discretisation scale: 96.3% adjacent accuracy transfers discretisation-scale inference from Family A to held-out Family B.The routing exponents are k = 1.673 for Family A and k = 1.836 for Family B.
- Phase 2: Discretisation scale: MI = 0.011 bits on gridish topology, where the local stencil maps natively, showing that physical mismatch rather than logical volume generates the signal.This is the reported collapse in leakage for the natively mapped topology.
- Phase 3: Hardware stability: F1 = 0.98 remains constant across simulated drift on gridish, while line-topology F1 declines from 0.97 to 0.64 and scale accuracy remains ≥82%.The result compares stability across two hardware topologies under d ∈[0.0, 1.0].
- Phase 4: Accuracy targets: Routed depth is ≈800 for ε = 10−4 and ≈100 for ε = 10−2, with dz = 1.296; cross-family evaluation yields Macro-F1 > 0.90.The depth signal persists across constrained and relaxed hardware.
- Molecular geometry: Macro-F1 = 1.000±0.000 distinguishes linear H2 from bent H2O using routed-depth and gate features.The bent geometry produces routed depth 43.33 versus 20.00 for linear and +4.00 extra CX gates.
VII. Real-Hardware Validation on IBM Heavy-Hex
The IBM Heavy-Hex testbed uses a 156-qubit Heron device and matched transpilation workloads to examine leakage under constrained connectivity. Its configuration targets routing signatures produced by boundary-dependent logical topology.
- Target device: The target device is ibm_fez, a 156-qubit IBM Heron r2 processor with Heavy-Hex connectivity and girth g(H) = 12.Its native basis is {rz, sx, x, cz}.
- Workload topology: Periodic C8 and Dirichlet C3 workload graphs on eight logical qubits cannot embed natively on Heavy-Hex girth 12.Both therefore require SWAP insertion, while C8 has the strictly longer minimum routing path.
- Protocol: Stage 1 transpiles 120 matched pairs with five seeds at optimisation level 3, producing 1200 circuits.Stage 2 uses 20 held-out pairs.
- Experimental configuration: The figure identifies the leakage basis on IBM Heavy-Hex through its hardware girth parameter.The supplied caption names g(H) = 12 as the relevant configuration descriptor.
- Protocol: Stage 2 executes the held-out workloads as 40 independent QPU jobs with 256 shots each using SamplerV2.This is the real-hardware execution stage described in the protocol.
B. Information-Theoretic Leakage
Stage 1 shows that topological features strongly fingerprint periodic versus Dirichlet workloads, while padding strategies fail to improve privacy and reduce fidelity. Real-QPU artefacts preserve this distinguishability because leakage spans correlated channels and includes structural routing patterns.
- Information-theoretic leakage: All nine Stage 1 features exceed the null 95% threshold at p < 0.0001, with seven reaching the binary MI ceiling of 0.695 bits.Ratio-based features reach effect sizes up to dz = 39.33.
- Information-theoretic leakage: Macro-F1 = 1.000 ± 0.000 on Stage 1, while real-QPU artefacts retain a routing gap of ∆routing = 32.85 extra_twoq gates.The real-QPU twoq_overhead effect size is dz = 7.701.
- Defence strategies: D1 adds 32.85 dummy CZ pairs, D2 equalises routed depth, and D3 combines both normalisation strategies.These strategies target two-qubit overhead, depth, or both on ibm_fez hardware parameters.
- Defence evaluation: Macro-F1 = 1.000 persists after single-channel normalisation, while fidelity degrades by up to 13.7%.The leakage remains in correlated channels, including structural SWAP patterns and ratio features.
- Defence evaluation: All strategies remain at Macro-F1 = 1.000 as fidelity falls below 0.50, so gate-count padding does not remove the topological signal.The structural routing difference persists because C8 requires multi-hop resolution while C3 is resolved locally.
IX. Conclusion
The paper introduces SCI-IND, proves passive security asymptotically unachievable under routing-optimal compilation on constrained hardware, and validates leakage on a 156-qubit IBM Heron r2 QPU. It concludes that execution-level confidentiality requires dedicated protections, while the study remains bounded to fixed-connectivity superconducting hardware.
- Contributions: The paper introduces SCI-IND and proves passive SCI-IND security asymptotically unachievable under routing-optimal compilation on constrained hardware.The conclusion frames this as a new confidentiality challenge for delegated quantum computing.
- Validation: dz = 7.701 and Macro-F1 = 1.000 validate the leakage on a 156-qubit IBM Heron r2 QPU.These results are reported for real quantum-processing-unit execution.
- Implications: Execution-level confidentiality is presented as a first-class design requirement, with topology-blind routing APIs, artefact normalisation, and schedule-level timing masking as minimum baselines.These are proposed as baseline protections against compilation-level leakage.
- Limitations: The study is limited to fixed-connectivity superconducting hardware; reconfigurable or all-to-all architectures may be structurally immune.Formal execution-trace privacy guarantees and low-overhead defences remain open problems.