Coherence Rather Than Error Rate Governs Privacy in Multi-Tenant Quantum Computing

Introduction

• Crosstalk across adjacent tenant sectors can degrade gate fidelity while unintentionally carrying information about a tenant.The paper frames this as a privacy hazard in cloud quantum computing, where users rent separate device sectors.Source: Introduction · p. 1

Setting.

• The adversary is a co-tenant limited to its own qubits; conditional spread Γ measures how much the victim’s secret changes the adversary’s observations.Information leakage is defined through distinguishability of the adversary’s conditional states, without assuming secret probabilities.Source: Setting · pp. 2–3

Leakage is controlled by conditional spread.

• When MΓ ≪ 1, leakage is approximately (M − 1)Γ / ln 2 per run, but repeated runs can accumulate significant information.The approximation applies in the stated small-MΓ regime.Source: Leakage is controlled by conditional… · p. 3

Repetition can amplify small per-shot leakage.

• Without quantum memory, an adversary’s shot budget is governed by ξ_loc = −ln(1 − Γ^2)/2 ≃ Γ^2/2 for Γ ≪ 1; repeated copies can weaken per-run guarantees.The paper identifies this memoryless adversary as realistic given current quantum-memory and decoherence limits; pairwise-distinct conditional states allow leakage to approach log2 M with repetition.Source: Repetition can amplify small per-shot… · pp. 3–4

Average infidelity does not determine leakage.

• At identical average gate infidelity, stochastic Z-flip noise yields Γ = 0 and no leakage, while coherent boundary errors permit finite shot budgets scaling as r^-1.Average gate infidelity does not distinguish the coherent-versus-stochastic split that conditional spread detects.Source: Average infidelity does not determine… · p. 4

Defence against leakage

• Under a secret uniform Pauli frame on the victim’s whole register, Γ = 0 and L(A →B) = 0 when the secret affects the victim’s state rather than the Hamiltonian.The draw must remain secret during the observation window; the frame is a quantum one-time pad on the victim’s register.Source: Defence against leakage · p. 4

Experimental measurement of the attack.

• The attack experiment prepares the victim’s boundary qubit in |0⟩ or |1⟩, while the co-tenant probes from |+⟩ and measures in X and Y after an idle window τ.A static ZZ interaction separates the conditional probe states by phase gap ∆θ = 4ζτ.Source: Experimental measurement of the attack · p. 5
• Pauli-frame overhead non-trivially lowers victim survival probability in practice, despite the theoretical absence of a fidelity cost; accumulated gate errors are a proposed explanation.The observed residual leakage under the full frame may reflect finite-shot noise or the transmon third level, which two-level Pauli operators do not symmetrise.Source: Experimental measurement of the attack · pp. 5–7, Figure 3 · p. 5
• Across 21 IBM Kingston boundaries, median Γ was 0.35 and the adversary’s 99%-confidence shot budget had median 75.The idle window was the smaller of the probe’s reported T2 and one third of the victim’s reported T1.Source: Experimental measurement of the attack · p. 6, Figure 4 · p. 6
• 134 of 176 boundaries with reported two-qubit gate error between 1 × 10−3 and 3 × 10−3 show Γ from 0.007 to 0.68; reported device quantities do not determine leakage.The survey compares Γ with two-qubit gate error, probe T2, victim T1, probe readout error, and probe single-qubit gate error.Source: Experimental measurement of the attack · p. 6, Figure 5 · p. 7
• In the experiment, the full-register frame substantially suppresses leakage, whereas boundary-only randomisation achieves nothing when the victim’s circuit can move the secret toward the boundary.The comparison models a secret initially on interior q150 that is moved to boundary q149 before crosstalk with probe q148.Source: Experimental measurement of the attack · pp. 6–7
• A reduced survey on seven IQM Garnet boundaries measured smaller conditional spreads than IBM Kingston, consistent with Garnet’s shorter median T2 of 10.3µs and correspondingly shorter idle windows.The idle window was chosen per boundary from each qubit’s measured coherence time.Source: Experimental measurement of the attack · p. 7

Discussion

• Whole-register victim-side Pauli randomisation acts as a quantum one-time pad and closes the leakage channel; boundary-only randomisation provides no protection.Source: Discussion · p. 7
• The published error-rate figure of merit alone cannot support a privacy guarantee for shared quantum processors.Source: Discussion · p. 7
• The experiments surveyed two superconducting processors; other device types and composition across many co-scheduled tenants remain open questions.Source: Discussion · p. 7

Methods

• Gate and measurement twirling are disabled because gate twirling is the Pauli-frame defence under test; dynamical decoupling is disabled because it echoes away the static ZZ interaction.Leaving twirling on would erase the attack and could be mistaken for a null result.Source: Methods · p. 7
• The Pauli frame suppresses leakage, while the heuristic boundary-only frame sits on the undefended baseline.Figure 6 tracks conditional phase gap and spread against idle-window length, plus adversary shot budget at 99% confidence.Source: Figure 6 · p. 8
• The IQM Garnet survey measures conditional spread on seven boundaries using 1,000 shots per circuit and four circuits.Source: Figure 7 · p. 8

Use of large language models

• Claude Sonnet 5 assisted with prose revision and writing the hardware-experiment Python and Qiskit code; the author reviewed and independently verified outputs and takes responsibility for the article.Source: Use of large language models · p. 8

• Processed data underlying every figure is available at.Source: Data availability · p. 8
• Backend calibration data for IBM Kingston and IQM Garnet is available through their respective cloud-provider platforms.Source: Data availability · p. 8

Competing interests

• The author declares no competing financial interests.Source: Competing interests · p. 8

Ethical and dual-use considerations

• The paper says its net publication effect is protective because the defence and call for transparent provider data help users assess exposure, while withholding the characterization would leave hardware behaviour unchanged.Source: Ethical and dual-use considerations · p. 8

Maximal quantum leakage and its normalisation

• Maximal quantum leakage measures the increase in guessing success from access to the quantum encoding and is linked to state distinguishability under a uniform prior.It equals Sibson mutual information of order infinity between the secret and the adversary's measurement outcome.Source: Maximal quantum leakage and its… · p. 11
• Leakage is bounded above by log2 M; for a binary secret, it equals the Helstrom-bound distinguishability.Source: Maximal quantum leakage and its… · p. 11

Proof of Result 1

• Each term Tr(Πx∆x) is bounded above by ∥∆x∥1 /2 because measurement operators satisfy 0 ≤ Πx ≤ I and Tr ∆x = 0.Source: Proof of Result 1 · p. 11
• For M = 2, Eq. (S7) is exact: the sum equals the trace distance between the conditional states by the Helstrom bound.Source: Proof of Result 1 · p. 12
• The leakage L(A → B) cannot exceed log2 M.Source: Proof of Result 1 · p. 12

Proof of Result 2

• The Pauli-frame correction is chosen to keep the victim’s intended logical operation correct for each Pauli draw.Source: Proof of Result 2 · p. 12
• The correction choice does not affect the argument that Pauli averaging removes the secret dependence.Source: Proof of Result 2 · p. 12
• Averaging over the unknown Pauli frame makes the adversary’s conditional state independent of secret x, so the states are no longer distinguishable and leakage is zero.Source: Proof of Result 2 · p. 12

Equatorial inputs are optimal under T1/T2 decoherence

• The analysis uses the standard superconducting-qubit T1/T2 Lindblad model and neglects victim relaxation during the idle window, which can only lower the computed leakage.Source: Equatorial inputs are optimal under… · p. 12
• The probe’s optimal input has equal computational-basis amplitudes, |α| = |β| = 1/√2, maximizing |⟨0|φ⟩⟨φ|1⟩|.Source: Equatorial inputs are optimal under… · p. 13
• For the two conditional unitary channels, the channel distance is 2|sin(2ζτ)|, yielding the same optimum as the unassisted probe.Source: Equatorial inputs are optimal under… · p. 13
• The optimal probe is prepared in |+⟩, and entanglement with an ancilla gives the adversary no advantage.Source: Equatorial inputs are optimal under… · pp. 12–13

Experimental estimation phase gap and contrast

• Four circuits combine victim preparation in |0⟩ or |1⟩ with probe readout in X or Y to estimate measurement statistics.Source: Experimental estimation phase gap and… · p. 13
• Each Pauli expectation is estimated as 2 P̂x(0) − 1, where P̂x(0) is the fraction of shots returning outcome 0 for victim state x.Source: Experimental estimation phase gap and… · pp. 13–14
• The phase gap and contrast are estimated from the four expectations ⟨X⟩0, ⟨Y⟩0, ⟨X⟩1, and ⟨Y⟩1.Source: Experimental estimation phase gap and… · p. 14
• Both victim states are measured because |1⟩ preparation requires an X gate and relaxation drives |1⟩ toward |0⟩, producing asymmetric state-preparation errors and decay.Source: Experimental estimation phase gap and… · p. 14