PaperlayerView exact revision on arXiv

Source-linked AI summary

QUFIG: GNN-Based Prediction of Quantum Fault Injection Vulnerabilities with Gate-Level Precision

Shihan Zhao, Qiying Li, Ben Dong, Qian Wang, Yuntao Liu

arXiv:2610.01777v1quant-phcs.CR

TL;DR

Cloud quantum computing creates security and reliability challenges, while existing work does not identify vulnerabilities with gate-level precision. QUFIG uses a circuit-DAG GNN to rank gate-fault pairs, and experiments report lower inspection costs than random and depth-based approaches.

  • Problem

    Cloud quantum computing raises security and reliability challenges, while existing efforts largely overlook gate-level risks that can threaten circuit fidelity and measurement results.

    Source: §I · p. 1

  • Method

    QUFIG uses graph learning on compiled circuit DAGs to rank gate-fault pairs by predicted impact, with fault impact measured through fidelity loss or application-level output deviation.

    Source: §I · p. 2

  • Results

    At the top-16% recovery target, QuFIG reduces inspection cost by 6.9%–19.8% versus random selection and 2.9%–18.8% versus depth-based traversal.

    Source: §I · p. 2

  • Takeaways & Limitations

    The ranking lets users select gate-fault candidates for detailed simulation, mitigation, or security auditing under a fixed evaluation budget.

    Source: §I · p. 2

Abstract

from arXiv · show

The growing scale and accessibility of quantum hardware exposed new reliability and security challenges in the quantum computing workflow, such as the run-time fault injection attacks in cloud-based quantum computing platforms. However, existing works fail to identify vulnerabilities with gate-level precision or adapt to run-time environments. In this work, we formulate gate-level fault analysis as a learning-guided prioritization problem under restricted fidelity budgets. The framework uses a circuit-DAG-based GNN backbone to predict the vulnerability score of each gate to each type of injected fault, defined as the impact of the gate-fault pair on circuit fidelity. The gate-fault pairs are then ranked by their vulnerability score. Experiments on QASMbench and HamLib MaxCut show that QUFIG recovers high-impact vulnerable gate-fault pairs with fewer inspections than random and depth-based heuristics. Our results show that QUFIG can reduce the number of gates requiring inspection by 2.9--19.8% while maintaining effective fault identification, allowing quantum circuit designers to identify vulnerabilities and apply targeted defenses more efficiently.

I. INTRODUCTION

QUFIG addresses gate-level risks in cloud quantum computing by ranking gate-fault pairs for selective inspection. It uses graph learning to prioritize high-impact candidates under a limited evaluation budget.

I. INTRODUCTION

  • Remote access to specialized cryogenic quantum hardware through cloud services introduces security and trust challenges.Cloud platforms compile and execute remote circuits through multiple managed stages, which can introduce risks if intermediate stages are compromised.Source: §I · p. 1
  • Existing quantum security work largely addresses higher-level vulnerabilities, while gate-level risks can arise when decomposition or synthesis pipelines inject or modify gates.Such changes can degrade fidelity, shift energy expectations, or cause model-level mispredictions.Source: §I · p. 1
  • Exhaustive gate-level analysis is prohibitively expensive as the number of gates, fault types, circuits, and measurement shots grows.The authors therefore frame analysis as selective prioritization of the gate-fault pairs that contribute substantially to output degradation.Source: §I · p. 1
  • QUFIG ranks gate-fault pairs by predicted impact on circuit fidelity and output quality, selecting top-ranked candidates for injection or auditing within a fixed budget.The framework uses compiled circuit DAGs and supports detailed simulation, mitigation, or security auditing.Source: §I · p. 2
  • The fault model covers stochastic decoherence, Pauli-type, and aggregate stochastic faults, with impact measured by fidelity loss or application-level output deviation.Source: §I · p. 2
  • At the top-16% recovery target, QuFIG reduces inspection cost by 6.9%–19.8% versus random selection and 2.9%–18.8% versus depth-based traversal.For the top 20% vulnerable gates on QASMbench, it reduces inspection cost by 9.9% versus random selection.Source: §I · p. 2

A. NISQ Faults and Gate-Level Fault Injection

The section describes how faults are injected at individual gates and why selective gate-level analysis is needed. Faulty outputs are compared with ideal outputs, while exhaustive evaluation becomes costly as circuits and fault types grow.

A. NISQ Faults and Gate-Level Fault Injection

  • A compiled circuit is represented as a sequence of gate unitaries, and its ideal output can also be expressed using a density matrix.Source: A. NISQ Faults and Gate-Level Fault… · p. 2
  • Gate-level fault injection applies an error after a specific gate, after which the remaining gates evolve the faulty state until final measurement.Most NISQ noise sources are non-unitary channels represented with density matrices and Kraus operators.Source: A. NISQ Faults and Gate-Level Fault… · p. 2
  • Vulnerability is quantified through fidelity or application-level deviation between ideal and faulty outputs, but exhaustive analysis is costly as candidate counts grow.The output distribution of an n-qubit circuit spans up to 2^n basis states, motivating selective prioritization.Source: A. NISQ Faults and Gate-Level Fault… · p. 2

B. GNN for Circuit Modeling

The section presents graph neural networks as a way to model quantum circuits through gate nodes and dependency edges. QUFIG extends graph-based circuit modeling to rank gate-level fault vulnerabilities.

B. GNN for Circuit Modeling

  • The GNN updates each gate embedding by aggregating information from neighboring gate nodes connected through qubit-wise dependencies.The resulting embedding incorporates local circuit context that may affect fault propagation.Source: B. GNN for Circuit Modeling · p. 2
  • Prior GNN applications include classical circuit and program tasks, as well as quantum noise-aware mapping, scheduling, and layout optimization.QUFIG applies graph learning to ranking gate-level fault vulnerabilities rather than optimizing compilation cost.Source: B. GNN for Circuit Modeling · p. 2
  • QUFIG uses circuit-DAG structure to predict how local perturbations or injected errors at individual gates affect circuit energy or fidelity.Its vulnerability heatmap highlights fragile operations in the compiled circuit DAG.Source: B. GNN for Circuit Modeling · p. 2

III. THREAT MODEL AND PROBLEM FORMULATION

QUFIG frames gate-level fault analysis as prioritizing transient gate faults in cloud quantum circuits, where exhaustive evaluation is costly. It defines candidate faults, fault classes, and impact measurements to support that prioritization.

A. Threat Model

  • The threat model considers run-time error injection against cloud quantum circuits, with an adversary seeking maximal performance degradation through minimal, less-detectable manipulations.The authors motivate identifying circuit weak points so users can apply targeted mitigation before deploying workloads.Source: A. Threat Model · p. 3

B. Gate-Fault Pair

  • A candidate fault is a gate-fault tuple specifying a target gate, fault type, and fault strength.Strength may be a stochastic-channel error probability or a coherent-perturbation rotation offset.Source: B. Gate-Fault Pair · p. 3
  • The formulation addresses transient gate-instance faults during circuit execution, not permanent device defects.Its objective is to evaluate each candidate fault's change to the final computation and prioritize high-impact pairs for detailed analysis.Source: B. Gate-Fault Pair · p. 3

C. Gate-Level NISQ Fault Classes

  • Three fault classes—stochastic decoherence, Pauli-type, and aggregate stochastic—cover amplitude damping, phase damping, bit flip, and depolarizing noise.These are the four noise channels used in the experiments.Source: C. Gate-Level NISQ Fault Classes · p. 3, Table I · p. 3
  • Amplitude damping models energy relaxation, phase damping models loss of coherence, Pauli-type faults model discrete logical perturbations, and depolarizing noise models aggregate randomization.The Pauli-type abstraction is used to study whether local perturbations propagate to final measurements.Source: C. Gate-Level NISQ Fault Classes · p. 3
  • Fault injection compares each valid gate-fault pair's faulty and ideal outputs using fidelity or an application-level metric to produce ground-truth vulnerability scores.Those scores supervise training and evaluation.Source: C. Gate-Level NISQ Fault Classes · p. 3

D. Fault Activation and Observability

Fault activation and observability distinguish whether an injected error can affect a gate's input state and whether its effect reaches the measured output. The resulting impact scores support rank-based high-impact labels rather than a fixed fidelity threshold.

D. Fault Activation and Observability

  • A fault is activated when the gate's input state occupies the subspace affected by its channel, and observable when its effect reaches the final measurement distribution or application objective.Amplitude damping depends on population in |1⟩, while phase damping is relevant when the qubit carries phase coherence.Source: D. Fault Activation and Observability · p. 3
  • Impact is measured through distribution-level fidelity loss and, for application-driven circuits such as MaxCut, normalized output deviation.The fidelity term captures output-distribution deviation; the objective term captures application-level degradation.Source: D. Fault Activation and Observability · p. 3

E. Fault Impact Score and High-Impact Labels

  • The fault impact score combines the two observability measures, with λ weighting application-level deviation; benchmarks without an application objective set λ = 0 and use fidelity loss.This benchmark condition makes fidelity loss the impact metric when no application-specific objective is available.Source: E. Fault Impact Score and High-Impact… · p. 3
  • High-impact faults are the top-q% of valid gate-fault pairs ranked by impact score, with inapplicable pairs labeled −1.This rank-based labeling avoids an arbitrary global fidelity threshold and gives each circuit a stable set of positive examples despite differing absolute fidelity values.Source: E. Fault Impact Score and High-Impact… · pp. 3–4

F. Budget-Constrained Fault-Site Prioritization

Budget-constrained prioritization selects a limited set of candidate faults to cover as many high-impact faults as possible. QUFIG approximates the exhaustive ranking from a circuit DAG whose gate nodes carry structural features.

F. Budget-Constrained Fault-Site Prioritization

  • Given budget B, the goal is to select at most B valid candidate faults that cover as many high-impact faults as possible.Computing every candidate's impact requires exhaustive fault simulation, so a graph-based predictor approximates the ranking for targeted follow-up analysis.Source: F. Budget-Constrained Fault-Site… · p. 4

IV. LEARNING-GUIDED FAULT-SITE PRIORITIZATION

  • The learning-guided framework has five stages: circuit-DAG construction, gate-feature embedding, GNN-based impact prediction, fault-aware training, and budget-constrained top-k selection.The objective is to rank faults likely to cause large output degradation rather than simulate every candidate pair.Source: §IV · p. 4

A. Circuit DAG Construction

  • The circuit DAG represents gate instances as nodes and qubit-wise execution dependencies as directed edges.Gate features describe each gate's functional role and position in the compiled circuit; Table II summarizes the features used.Source: A. Circuit DAG Construction · p. 4, Table II · p. 4

B. Gate Embedding and GNN Backbones

QUFIG embeds gate-level circuit context and applies standard GNN backbones to predict fault-specific vulnerability scores. It ranks valid gate-fault pairs for budgeted follow-up, using a hybrid loss intended to improve confidence calibration.

B. Gate Embedding and GNN Backbones

  • A learnable embedding maps gate features to hidden representations, which a message-passing GNN updates using neighboring gates' dependency information.The framework is backbone-agnostic and evaluates standard GCN, GAT, GIN, and GraphSAGE models rather than introducing a new message-passing operator.Source: B. Gate Embedding and GNN Backbones · p. 4

C. Per-Fault Impact Prediction

  • Fault-specific prediction heads output a score for each valid gate-fault pair, estimating its probability of causing large output degradation.A mask excludes fault types that are inapplicable to a given gate.Source: C. Per-Fault Impact Prediction · p. 4

D. Budget-Constrained Top-k Selection

  • Predicted scores rank valid pairs, and the top-B candidates are selected for detailed simulation, mitigation, or security auditing.The selected set targets pairs predicted to have the largest impact, reducing the number requiring exhaustive simulation while preserving high-impact faults.Source: D. Budget-Constrained Top-k Selection · pp. 4–5, Figure 2 · p. 5
  • A hybrid binary cross-entropy and mean absolute error loss combines classification supervision with penalties on probability deviations to encourage better-calibrated confidence.MAE penalizes probabilities far from the binary target, while BCE supplies the primary classification signal.Source: D. Budget-Constrained Top-k Selection · p. 5

A. Experiment Setup

The experiments use QASMbench and HamLib MaxCut circuits to train and evaluate gate-level vulnerability prediction. Ground-truth labels come from simulated fault injection, and learned rankings are compared with random and depth-based selection under circuit-grouped evaluation.

Circuit datasets

  • The evaluation combines QASMbench small- and medium-scale circuits with 2,120 valid compiled HamLib MaxCut circuits from 2,304 candidates.HamLib circuits vary cost-layer type, mixer-layer type, and QAOA depth.Source: A. Experiment Setup · pp. 5–6

Ground-truth generation

  • Ground truth comes from injecting noise into valid gate–error pairs in compiled circuit DAGs and measuring fidelity degradation to assign multi-label vulnerability labels.Considered channels include amplitude damping, phase damping, bit flip, and depolarizing noise.Source: A. Experiment Setup · p. 6

Model setting

  • GraphSAGE predicts vulnerability scores for each gate across error types and is compared with random and depth-ordered gate-selection heuristics.The model uses four GNN layers and a hidden dimension of 128.Source: A. Experiment Setup · p. 6

Evaluation protocol

  • Evaluation uses an 80/10/10 train-validation-test split and 10-fold cross-validation, with group-aware exclusions to reduce structural leakage.Related circuit structures are excluded from training when assigned to the test set.Source: A. Experiment Setup · p. 6

B. Quantum Circuit Error Fidelity Analysis

Fault sensitivity is concentrated in a small subset of gates, and vulnerable-gate positions vary across circuit families rather than following one depth pattern. Among tested GNN backbones, SAGE performs most consistently across QASMbench and MaxCut.

B. Quantum Circuit Error Fidelity Analysis

  • Only a small subset of gates causes substantial output degradation, while most remain relatively stable even under strong perturbations.The distribution is non-uniform across both gates and datasets.Source: B. Quantum Circuit Error Fidelity… · p. 6
  • Vulnerable gates vary across early, middle, and later circuit regions, so depth alone does not directly determine vulnerability.Fig. 4 bins each circuit’s most vulnerable gate by normalized position; the distribution is dataset-dependent.Source: B. Quantum Circuit Error Fidelity… · pp. 6–7, Figure 4 · p. 7

C. GNN Backbone Analysis

  • SAGE provides the most consistent backbone performance across QASMbench and MaxCut, with the best MAE and AUPRC on MaxCut.On QASMbench it has the lowest MAE and highest AUPRC; Table V compares backbone calibration and ranking quality.Source: C. GNN Backbone Analysis · p. 7, Table V · p. 7

D. Vulnerablity Point Detection

QuFIG reduces inspection cost when recovering highly vulnerable gates on both MaxCut and QASMbench. Its rankings identify gates associated with fidelity loss and application-level degradation, supporting budget-constrained prioritization for simulation, mitigation, and auditing.

E. Target-detection Cost Evaluation

  • For top-16% vulnerable-gate recovery, QuFIG inspects 56.3% of MaxCut gates versus 70.1% random and 69.3% depth-late, and 70.6% of QASMbench gates versus 75.8% random and 72.7% depth-late.Source: E. Target-detection Cost Evaluation · pp. 7–8
  • On QASMbench, QuFIG requires 81.9% inspection for the top 20% vulnerable gates, versus 90.9% for random selection.The reported improvement is smaller than on MaxCut, where circuit structures are more diverse.Source: E. Target-detection Cost Evaluation · p. 8

VI. CONCLUSION

  • QuFIG ranks gates by predicted vulnerability so users can focus detailed inspection, mitigation, and security auditing on gates that dominate circuit-level degradation.The conclusion describes this as budget-constrained gate vulnerability prioritization.Source: §VI · p. 8
Loading 2610.01777v1…