{"id":"f53ca4ec-93d8-4f37-82fc-bc69c02dfa2a","arxiv_id":"2505.13848","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The proposed quantum circuit obfuscation method appends reversible gates and corrects outputs classically, but the compiler sees the appended gates and can reverse them, so the security claim fails.","lead":"The paper adds extra quantum gates to a circuit before sending it to a compiler, scrambling the measurement results, and then fixes the results classically with a secret key. A smart generalist should read it because it is a compact case study in why output scrambling alone does not protect a circuit from the very compiler that receives it.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'key' is not secret from the untrusted compiler: the appended encryptor gates are fully visible in the transmitted circuit, so the compiler can strip or invert them and recover the original algorithm and outputs.","rationale":"The reader's weakest assumption is the same load-bearing concern I identify: that the key remains secret while the circuit containing the encryptor gates is sent to an untrusted compiler. I agree with that assessment. The construction is a transparent, deterministic permutation of measurement outcomes; the only secret is which gates were added and where, and that information is present verbatim in the circuit. The paper's related-work discussion notes a similar vulnerability for the Das-Ghosh approach when both the obfuscated circuit and its inverse are given to the same compiler, but it does not recognize that its own scheme has exactly this property because the gate descriptions are in the circuit itself. The metrics are not attack metrics: TVD and DFC only quantify distortion of the raw output, which is expected and irrelevant if the adversary can classically undo the distortion. The classical correction mechanism itself is coherent and appears reproducible from the provided description and code link, but it does not support the security claim. Since the central claim fails and the reader already rejected on this basis, no verdict adjustment is needed.","tokens_in":10523,"tokens_out":4080,"duration_ms":44223,"concrete_test":"Run the provided implementation to generate the obfuscated circuits for the five benchmarks. Simulate an adversarial compiler that (i) parses each Qiskit circuit, identifies the trailing encryptor gates from the circuit object, and applies their classical inverse permutations to the measured bitstrings, or equivalently (ii) deletes the trailing encryptor gates and executes the remaining circuit. Compare the recovered histogram with the original circuit's histogram using the paper's own TVD and DFC metrics. If median TVD is approximately 0 and median DFC is approximately 1, the obfuscation provides no confidentiality against the compiler, confirming the central flaw.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section V.A.2 says the user appends the selected gates 'to the end of the original quantum circuit' before compilation, and Section V.A.4 calls the key 'only available to the user.' But the circuit delivered to the untrusted compiler contains the exact gate identities, qubit targets, and ordering that the key encodes. The classical correction rule (Fig. 2) is public and deterministic, so anyone who can read the circuit can reconstruct the key and invert the corruption on the measurement bitstrings. For phase gates the correction is identity; for X, CNOT, SWAP, Toffoli, and similar gates, the inverse is the same classical permutation. Moreover, because the encryptor gates are appended as a suffix, a malicious compiler can simply remove them and execute the original circuit unchanged. The reported TVD and DFC metrics only show that random reversible gates change the output distribution; they do not measure resistance to an adversary who possesses the obfuscated circuit. Section VII lists limitations such as random gate selection and multi-basis measurement, but does not address that the key material is visible in the transmitted circuit. Thus the central security claim, protecting proprietary circuits in untrusted compilation flows, is unsupported under the paper's own threat model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a hybrid quantum-classical circuit obfuscation method: before sending a circuit to an untrusted compiler, the user appends a layer of reversible, non-Hadamard gates; after execution, the user classically transforms the measured bitstrings using a key that records the appended gates. The method is illustrated on a QAOA MaxCut circuit and evaluated on five benchmark algorithms with Qiskit's noise-free AerSimulator, reporting median TVD above 0.5 and negative median DFC for all five. The paper claims this is a practical and effective solution for protecting proprietary circuits in untrusted compilation flows.","tokens_in":10694,"tokens_out":3446,"duration_ms":30789,"significance":"If the security claim were correct, the method would be an attractive lightweight alternative to quantum inverse-circuit insertion or barrier-based dummy gates. The manuscript has presentation strengths: the workflow is clearly described, the QAOA case study is concrete, the classical correction rules are explicit, and an anonymized code repository is provided. However, the central security claim is not supported: the circuit sent to the compiler contains the full information defining the key, the correction rules are deterministic and public, and the evaluation metrics measure only statistical and functional distortion, not resistance to an adversary holding the obfuscated circuit. The correctness of classical deobfuscation in noise-free simulation is by construction, so it does not validate security.","major_comments":[{"comment":"The load-bearing security assumption is false: the appended encryptor gates are visible in the circuit sent to the untrusted compiler. Section V.A.2 says gates are appended 'to the end of the original quantum circuit' before compilation, and Section V.A.4 calls the key 'only available to the user,' but the transmitted circuit encodes the key's exact gate identities, qubit targets, and ordering. Since the classical correction rules in Fig. 2 are deterministic and public, an adversary who can read the circuit can reconstruct the key, apply the same correction, or simply delete the trailing encryptor suffix and execute the original circuit. The manuscript does not define a threat model or an adversary with access to the obfuscated circuit, so the central claim of protecting IP in untrusted compilation flows is unsupported.","section":"V.A.2, V.A.4, Fig. 2"},{"comment":"The evaluation metrics do not test the security claim. TVD and DFC compare the output of the original circuit with the output of the obfuscated circuit before classical correction; they quantify corruption, not resistance to an adversary who possesses the obfuscated circuit. In particular, no experiment attempts key recovery, suffix stripping, or inversion of the appended gates by an adversary, and no metric measures indistinguishability or one-wayness. Therefore the results in Table I cannot be read as evidence for the paper's central security conclusion.","section":"VI.B, Table I"},{"comment":"The successful recovery of the original output distribution is tautological in the paper's setup. Because the classical corrections are, by construction, the inverses of the appended gates, applying them to noise-free simulation counts must return the original distribution; Section V.B demonstrates exactly this on QAOA. This verifies implementation consistency rather than any security property, so it should not be presented as validating the obfuscation scheme.","section":"V.A.4, VI"},{"comment":"The Limitations section does not address the most important threat: the key material is present in the transmitted circuit. It lists random gate selection and multi-basis measurement as limitations but omits that the compiler can strip or invert the visible encryptor layer, which would defeat the scheme under the paper's own stated scenario. This omission is load-bearing because it directly concerns the untrusted-compiler threat that the paper claims to solve.","section":"VII"}],"minor_comments":[{"comment":"The phrase 'normalized by the number of shots' is imprecise; the denominator is 2 times the number of shots, which is correct for comparing empirical histograms but should be stated more clearly.","section":"Eq. (2)"},{"comment":"The threshold 'TVD above 0.5' is arbitrary; no justification or statistical test is given for why 0.5 indicates sufficient obfuscation.","section":"Abstract, VI.B"},{"comment":"DFC values for QAOA (median -0.1123) are close to zero; the claim of 'consistently negative DFC' is technically true but obscures that some circuits are only weakly functionally corrupted.","section":"Table I"},{"comment":"The terms 'encryptor' and 'key' suggest cryptographic security, but no formal key space, key entropy, or attack game is defined; the paper should either define a security notion or use weaker language such as 'obfuscating layer.'","section":"V.A.1, V.A.4"},{"comment":"The related-work comparison is qualitative; a table comparing gate overhead, use of barriers, and deobfuscation requirements with references [12], [13], [14], [15], and [20] would help position the contribution.","section":"III"},{"comment":"There are minor typographical issues, for example 'SW AP' in Section II.A.3, and the reference list has inconsistent capitalization and spacing; these do not affect the technical content.","section":"Throughout"}],"recommendation":"reject","confidential_remarks":"The manuscript is readable and honest about some limitations, but the central security claim is contradicted by the design itself, so rejection seems unavoidable rather than a request for revision. The paper could potentially be reframed as a study of gate-induced output corruption with classical correction, but as submitted it does not meet the bar for a security paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper proposes appending classical-reversible gates before measurement and undoing them classically on the bitstrings. That part is sound, and the simulation results confirm that random X/CNOT/SWAP/Toffoli gates scramble the output distribution as expected. It's a small but real variation on Das-Ghosh's quantum-inverse approach: you don't need a quantum inverse, just a classical permutation of the outcomes. The QAOA case study is worked out in detail, and the correction procedure is consistent.\n\nThe problem is the security claim. The threat model is an untrusted compiler, and the user sends the obfuscated circuit with the appended gates clearly visible. The so-called key is just the list of those gates and their qubit positions. Anyone who can read the circuit can reconstruct the key, apply the same classical correction, or simply strip the trailing gates and run the original circuit. The paper itself says the key is 'only available to the user,' but the compiler receives everything needed to derive it. Section VII lists limitations, but never mentions that the key material is exposed in the transmitted circuit. That's a load-bearing omission, not a minor gap.\n\nThe TVD and DFC metrics only show that the appended gates change the output distribution. That's true by construction and says nothing about resistance to an adversary who has the circuit. No adversary model, no attack experiment, no security argument beyond 'the key is secret,' which it isn't under the stated threat model.\n\nSo the technical mechanics are fine, and the paper is clearly written, but the central assertion about protecting IP in untrusted compilation flows doesn't survive contact with its own setup. The method could at most hide outputs from someone who sees only the measurement results and not the circuit, which is a much narrower scenario than claimed.\n\nWho is this for? Someone working on quantum IP protection might skim it as a cautionary example, and the classical-correction trick could be a building block in a scheme with a real secret key. But as a standalone security claim, it shouldn't pass review without an adversary model that says why the appended gates can't be identified or inverted. That's a fundamental fix, not a revision.\n\nMy recommendation: send it to peer review, but expect the reviewer to come back with exactly this objection. The paper deserves a serious look because it's coherent and testable, but it's not ready for publication as a security contribution.","headline":"A clean little correction trick, but the security claim dies on its own threat model: the 'key' is just the appended gates the compiler can see.","tokens_in":11231,"tokens_out":1917,"would_cite":false,"duration_ms":18013,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A classical key can decrypt a corrupted quantum circuit","keywords":["quantum obfuscation","classical deobfuscation","quantum circuit security","intellectual property protection","untrusted compilation","measurement correction","NISQ-era security","gate insertion"],"falsifier":"Using the paper's own QAOA case study, take the circuit file that is sent to the compiler, extract the trailing gates (which are visible in the file), apply their classical equivalents to the measurement outcomes, and check whether the original output distribution reappears; if it does, the encryption provides no confidentiality against anyone who inspects the delivered circuit.","tokens_in":10262,"feed_emoji":"🔐","tokens_out":10838,"duration_ms":87885,"temperature":0.7,"pith_summary":"This paper claims that a quantum circuit can be protected from a third-party compiler by appending a layer of carefully chosen quantum gates (anything except Hadamard gates) before the circuit is sent off for compilation. That layer corrupts the measurement outcomes, and a secret key describing the appended gates lets the owner reverse the corruption with ordinary classical bit operations after the hardware returns results. The authors argue this gives compiler-agnostic obfuscation without the barriers, qubit-mapping tracking, or quantum reversal circuits that prior approaches needed. Simulated trials on five benchmark algorithms report strong statistical distortion (TVD above 0.5) and consistently negative DFC, which the paper takes as evidence that the method hides circuit functionality. The practical appeal is that proprietary algorithms could be outsourced to untrusted compilation services without exposing their logic.","feed_headline":"A classical key can decrypt a corrupted quantum circuit","feed_subtitle":"Appending gates before compilation hides the circuit; a lightweight classical key restores the true output.","key_machinery":"The key machinery is the gate-index key together with a lookup table of classical gate equivalents (X as a bit flip, CNOT as a controlled flip, SWAP as a bit swap, and phase-only gates as identity). The key is a stack-like (LIFO) list of gate-index and qubit pairs that tells the user which classical operations to apply to the measured bits and in what order. This machinery carries the argument because it converts the obfuscation problem from a quantum-reversal problem into a classical post-processing problem, and it works only because the inserted gates are restricted to operations that either flip bits or change only the phase, never creating superpositions.","core_discovery":"The central discovery is that deobfuscation does not require reversing the inserted gates quantumly; it only requires applying the classical equivalents of those gates to the measured bitstrings. Because phase-only gates such as S and Z do not change measurement probabilities, their classical correction is the identity, while state-changing gates such as X, CNOT, SWAP, and their controlled versions correspond to bit flips, conditional flips, and swaps. By recording each appended gate as an index–qubit pair and applying the corrections in reverse order of insertion, the original output distribution is exactly recovered. The paper demonstrates this recovery in a QAOA example and reports TVD and DFC values across five algorithms, concluding that the method offers a lightweight, practical security layer for untrusted compilation flows.","pith_inferences":["Because the appended gates are visible in the circuit handed to the compiler, the scheme's security appears to rely on the compiler being passive rather than actively adversarial; a malicious compiler could strip the trailing gates or classically invert them, so the practical threat model may be narrower than stated.","The TVD and DFC metrics measure how much the output distribution changes, not how hard it is to recover the original circuit; a stronger confidentiality test would directly measure the mutual information between the obfuscated circuit and the plaintext circuit.","The same classical-correction idea could be extended to multi-basis measurements by inserting basis-change operations before measurement, which the paper identifies as future work; this could be tested by constructing an XX+ZY Hamiltonian term and checking whether a corrected measurement recovers the expectation value.","The gate-index key can be randomized, but its entropy is limited by the number of gates and qubits in the circuit, so a small circuit has few possible appendage patterns and brute-force over key candidates may be practical."],"forward_implications":["Circuits protected this way can be optimized by untrusted compilers without barriers, so the security layer does not sacrifice compilation quality.","The user needs no personal quantum compiler or quantum computer to deobfuscate, since correction happens on the classical measurement results.","The method works for circuits measured in a single basis per execution; multi-basis measurements, such as Hamiltonian terms like XX+ZY+YI, are not supported without more complex post-processing.","The simulation results across five algorithms suggest the scheme is broadly applicable to different circuit structures, though functional corruption is stronger for some algorithms than for others.","Randomly chosen gates from a shared pool already give strong statistical distortion, and the paper suggests algorithm-specific or heuristic gate selection could improve functional corruption further."],"supporting_citations":[{"why":"introduces the DFC metric and the randomized-gate obfuscation baseline that this work compares against","marker":"[12]"},{"why":"aligns the threat model of untrusted compilation and supplies the dummy-gate approach this method seeks to improve","marker":"[13]"},{"why":"provides the simulation framework in which all benchmark circuits were built and executed","marker":"[9]"},{"why":"supplies the factoring algorithm used as one of the five benchmark circuits","marker":"[2]"},{"why":"supplies the QAOA circuit used for the worked obfuscation example and as a benchmark","marker":"[23]"}],"fun_headline_variants":["Classical key decrypts corrupted quantum circuits","Hide circuits with gates, restore with classical math","Append gates to obscure, correct on classical side","No quantum reversal needed for circuit decryption","Quantum obfuscation, classical clarification"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that whoever receives the obfuscated circuit cannot simply read off the appended gates and apply the same classical corrections, so the key stays secret.","fun_headline_variants_meta":{"raw":{"variants":["Classical key decrypts corrupted quantum circuits","Hide circuits with gates, restore with classical math","Append gates to obscure, correct on classical side","No quantum reversal needed for circuit decryption","Quantum obfuscation, classical clarification"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000197,"raw_usage":{"total_tokens":1342,"prompt_tokens":898,"completion_tokens":444,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":514,"completion_tokens_details":{"reasoning_tokens":375}},"tokens_in":514,"tokens_out":444,"duration_ms":4395,"temperature":1.0,"reasoning_tokens":375,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:08:55.953456+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Using the paper's own QAOA case study, take the circuit file that is sent to the compiler, extract the trailing gates (which are visible in the file), apply their classical equivalents to the measurement outcomes, and check whether the original output distribution reappears; if it does, the encryption provides no confidentiality against anyone who inspects the delivered circuit.","supporting_citations":[{"cited_title":"Qiskit: An open-source framework for quantum com- puting,","cited_arxiv_id":null,"evidence_quote":"provides the simulation framework in which all benchmark circuits were built and executed"},{"cited_title":"Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,","cited_arxiv_id":null,"evidence_quote":"supplies the factoring algorithm used as one of the five benchmark circuits"}],"review_version":1}