Pith. sign in

REVIEW 4 major objections 4 minor 17 references

An End-to-End Threat Model for the Quantum-as-a-Service Pipeline

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A six-stage STRIDE threat matrix can organize all known and plausible quantum-cloud attacks into one pipeline map, including three cross-stage attack chains.

desk verdict The STRIDE matrix for the QaaS pipeline is a useful new taxonomy, but the cross-stage attack chains are asserted with more confidence than the evidence supports, and Chain C has a real logical gap. read the letter →

arxiv 2608.05836 v1 pith:JJXDN3WC submitted 2026-08-06 cs.CR

Badhon Rahman , Majid Haghparast , Tommi Mikkonen This is my paper · ORCID
classification cs.CR
keywords QuantumComputingSecuritySoftwareThreatModelingSTRIDEMulti-TenantQuantum-as-a-ServiceCross-stageattackchains
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to give security teams a single structured map of where attacks can occur across a quantum cloud workflow. It splits the quantum-as-a-service pipeline into six stages—developer environment, authentication and submission, cloud orchestration and compilation, quantum hardware execution, result return, and the hybrid iteration loop—and applies the STRIDE threat taxonomy (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) stage by stage. The result is a 6×6 threat matrix whose cells are sorted into three tiers: quantum-specific attacks already demonstrated in the literature, classical attacks inherited from ordinary cloud infrastructure, and plausible but under-studied threats. The paper further claims that two usually-neglected STRIDE categories, repudiation and elevation of privilege, have real homes in this stack, and that three cross-stage attack chains compose stage-local capabilities into higher-impact attacks. If the map is right, it changes the security conversation from isolated attack reports to a common vocabulary for auditing and defending the whole pipeline.

What carries the argument

The carrying object is the six-stage pipeline model (S1–S6) paired with the STRIDE taxonomy into a structured matrix. The matrix is the mechanism that turns scattered attack reports into a single classified surface: it forces every stage to be checked against every threat category, and the empty cells that fall out are treated as signal rather than accident. The three cross-stage attack chains are a second, narrative mechanism: they connect matrix cells across stages by a common thread of leaked information—a passive side-channel fingerprint, a calibration topology, or the output of inverse-transpilation—that turns a local read into a remote write capability.

What would settle it

Run Chain A as an end-to-end red-team exercise on a multi-tenant quantum platform: use the passive side-channel at the hardware-execution stage to recover another tenant's circuit fingerprint, then launch QubitHammer against that tenant's job. If the recovered fingerprint is too coarse to guide the hammering, or the hammering never changes the victim's measurement results, the claimed cross-stage impact is falsified.

Watch

Extended reading notes

Core claim

The central claim is that the entire quantum-as-a-service workflow is one addressable pipeline, and that STRIDE-based threat modeling applied to its six stages produces a complete attack-surface map that previous work lacked. Each stage receives a row in the matrix; each STRIDE category receives a column; each cell is filled with either a published attack, an inherited classical vector, or a plausible under-studied threat. The paper highlights that repudiation is represented by missing verifiable execution logs at the hardware execution stage and missing result-chain evidence at the return stage, and elevation of privilege is represented by pulse-level access abuse on the QPU. The three cross-stage chains are: side-channel identification enabling targeted crosstalk, calibration topology leakage enabling targeted pulse placement, and compiler intellectual-property leakage enabling transpile-stable Trojan insertion. The paper's overall bet is that the structure of the matrix, not any single attack, is the contribution: siloed attacks become cells, empty cells mark research opportunities, and chains reveal where stage-local capabilities combine.

Load-bearing premise

The cross-stage attack chains are asserted to have higher impacts even though the paper gives no demonstration that a single adversary can combine the stage-local capabilities end to end; the added value of the chains rests entirely on that composability.

Editorial extensions

If this is right

  • A security auditor can use the 6×6 matrix as a checklist: each filled cell is a place to probe for controls, and each empty cell is a place to ask whether the absence is real or just unstudied.
  • Defending only the quantum processor will not work, because the chains make stage-local leakages at earlier stages load-bearing for attacks that land back at the same or later stages.
  • The repudiation and elevation-of-privilege columns identify concrete control gaps: no verifiable execution log at the hardware execution stage, no result chain at the return stage, and pulse-level access abuse at the same hardware stage.
  • Newly demonstrated quantum attacks can be slotted into the matrix directly, which gives the field a shared coordinate system for comparing results.
  • The split into quantum-specific, inherited classical, and plausible tiers lets defenders map existing cloud mitigations onto the inherited cells while focusing new research on the quantum-specific ones.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is scoring each cell by exploitability and impact, turning the qualitative matrix into a prioritized mitigation backlog.
  • Because all three chains route through the hardware-execution stage, the shared quantum processor is plausibly the chokepoint of the whole pipeline; the paper stops short of saying so.
  • If the repudiation cells are taken seriously, quantum-native attestation or signed measurement outputs at the execution and return stages would be a high-leverage control worth testing.
  • The plausible tier is a testable research program: red-team exercises on real multi-tenant platforms could confirm or retire cells such as result-source spoofing at the return stage.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a six-stage STRIDE threat model for the quantum-classical cloud pipeline, covering stages from developer environment through hybrid iteration loop. Its central artifact is a STRIDE-by-stage matrix classifying attack vectors into three tiers: published quantum-specific attacks (orange), inherited classical vectors (light blue), and plausible under-studied threats (light green). The paper additionally presents three cross-stage attack chains (A, B, C) that allegedly compose stage-local capabilities into higher-impact threats. The contribution is framed as a unified attack-surface map for QaaS platforms such as IBM Quantum, IonQ Cloud, and Amazon Braket.

Significance. The core matrix is a useful organizing contribution: it brings together previously siloed attacks (SWAP, QubitHammer, inverse-transpilation, calibration tampering, pulse-level abuse, and others) under a common vocabulary, and it draws attention to underexplored STRIDE categories (repudiation and elevation of privilege). The mapping of published attacks into the matrix is generally consistent with the cited literature and could serve as a practical reference for QaaS security practitioners. However, the paper's stronger claims—that the plausible cells are part of the demonstrated model and that the cross-stage chains compose into higher-impact threats—are not backed by evidence or argument. In particular, at least one chain contains a logical gap between information disclosure and a required write capability. The matrix can stand independently, but the cross-stage and plausible-tier claims need substantial revision and support.

major comments (4)
  1. [Section IV, Cross-stage attack chains] The chains are introduced with the claim that they "compose stage local capabilities into higher impact threats," but no demonstration is given that a single adversary can exercise both stage-local capabilities or that the combined impact exceeds the single-stage attacks. The paper provides no end-to-end scenario, no attacker capability set, and no impact metric for any of the three chains. Please add for each chain a concrete scenario with the adversary's privileges, the trust boundaries crossed, and the expected consequence, or explicitly label the chains as open hypotheses rather than established threats.
  2. [Section IV, Chain C] Chain C asserts that inverse-transpilation at S3 "discloses the compiler's optimization information, letting an adversary craft Trojan insertions that bypass known optimizations and turn into active S3 tampering." Information disclosure does not provide a write path into the compiler; crafting a transpile-stable Trojan requires a malicious compiler pass, a compromised dependency, or an injection point at S3. None of these is established by [12] or argued in the text. Please add the missing adversary capability explicitly, or remove the causal arrow between the leak and the tampering.
  3. [Section IV, Chain A] Chain A asserts that a passive side-channel at S4 reveals the victim's circuit fingerprint and that this fingerprint enables QubitHammer/SWAP. However, QubitHammer, as described by the cited reference [11], is a frequency/calibration-based qubit state-change technique; its dependence on the victim's ansatz or circuit fingerprint is not established. The paper does not show which specific step of the cited attacks requires the side-channel data. Please clarify the causal role of the side-channel output or reclassify this chain as a hypothesis requiring further investigation.
  4. [Section IV, Table I] The light-green "plausible" cells are presented as part of the claimed contribution ("plausible tiers for each of the stages"), but the paper gives no evidence or argument for any of these cells. Without a rationale per cell—such as a concrete attack scenario, an analogy to a cited classical attack, or an explicit identification of the open research question—the reader cannot distinguish a genuinely likely threat from speculation. Please add a brief justification for each light-green cell, or a dedicated note explaining the basis for the plausible tier.
minor comments (4)
  1. [Throughout] There are several typos and formatting inconsistencies: "Inverse-tranpilation" should be "Inverse-transpilation" in Chain C, and "SW AP" appears with a space in the abstract and Table I where "SWAP" is intended.
  2. [References] Reference [15] (Secure Quantum Circuit Compilation Methodology for Untrusted Compilers) appears in the reference list but is not cited anywhere in the body text; please either cite it in the relevant discussion of untrusted compilers or remove it.
  3. [Section I] The text uses "in this poster" in the introduction but the manuscript is presented as a paper; please make the venue-consistent terminology clear.
  4. [Table I] Several cells in the matrix are empty or marked with a dash. Please annotate whether these indicate "not applicable," "not yet explored," or "no known vector," so readers can interpret the completeness of the matrix correctly.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the threat matrix is an independent taxonomy of externally published attacks; the only self-citation is motivational and non-load-bearing.

full rationale

The paper's central output is a six-stage STRIDE matrix whose cells are classifications of attacks cited from external literature ([4], [10]–[14], [16], [17], etc.). There are no fitted parameters, no equations, and no derivation in which an output is defined in terms of itself. The stages S1–S6 are stipulated labels for the QaaS workflow, not consequences of the attack matrix. The tiers (quantum-specific, inherited classical, plausible) are editorial judgments about whether an attack is published, classical, or conjectured, and none of the cells is defined by the paper's own conclusions. The only self-citation is in Section II, where the authors write "Our prior work [6] classified Quantum Software Engineering (QSE) security challenges has identified this gap; this study operationalizes and provides structured threat modeling." This uses their own prior survey to motivate the gap, but the matrix itself does not depend on [6] for any cell or for the STRIDE mapping, so the self-citation is not load-bearing. The cross-stage attack chains in Section IV are asserted rather than demonstrated; Chain C in particular lacks an explicit write path from compiler-IP disclosure to S3 trojan insertion, and Chain A does not establish that the side-channel fingerprint is necessary or sufficient for QubitHammer/SWAP. These are validity and evidence concerns about the composition argument, not circularity, because the chains are not defined in terms of their own claimed impacts and no cited source is replaced by the paper's own conclusion. Overall, the derivation is self-contained as a taxonomy; the low score reflects the minor motivational self-citation only.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters or invented entities. The paper's contribution rests on domain assumptions about pipeline decomposition, STRIDE applicability, and the plausibility of under-studied attacks. These assumptions are reasonable for a taxonomy but are not validated experimentally.

assumptions (4)
  • domain assumption The six-stage decomposition (developer environment, authentication, cloud orchestration, QPU execution, result path, iteration) faithfully represents the real QaaS pipeline.
    The paper states the pipeline is 'long layered' and defines S1-S6 in Section III, but does not justify that this decomposition is complete or that the stages do not overlap.
  • domain assumption STRIDE categories are a valid and sufficient lens for quantum cloud threats.
    STRIDE is applied without discussing its limitations for hybrid quantum-classical systems, such as attacks that span multiple STRIDE categories or quantum-specific effects like crosstalk that may not map cleanly.
  • domain assumption The cited published attacks are accurately characterized and placed in the correct matrix cells.
    The matrix assigns attacks such as SWAP attack, QubitHammer, and calibration tampering to specific STRIDE categories, based on the authors' interpretation of the cited papers, without independent verification.
  • ad hoc to paper The 'plausible' cells and cross-stage chains represent real potential attacks.
    These are labeled as plausible or under-studied in the matrix and chains, but no evidence is given for their feasibility, end-to-end executability, or impact, making them research hypotheses rather than demonstrated threats.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An End-to-End Threat Model for the Quantum-as-a-Service Pipeline." pith.science (2026). https://pith.science/paper/JJXDN3WC

@misc{pith2026260805836,
  author       = {Pith},
  title        = {Pith review of: An End-to-End Threat Model for the Quantum-as-a-Service Pipeline},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JJXDN3WC}},
  note         = {Machine review of arXiv:2608.05836}
}
read the original abstract

Cloud-based accessing of Quantum-as-a-Service (QaaS) platforms such as IBM Quantum, IonQ Cloud, and Amazon Braket is becoming popular day by day. Hybrid quantum-classical algorithms (VQE, QAOA, QML) transfer data via a long layered pipeline of orchestration, compilation, and execution. Recent works have demonstrated various critical attacks at individual stages: Calibration tampering, SWAP attacks, QubitHammer, and so on. However, these attacks remain separated because of their own terminology, and existing STRIDE-based threat modeling in the context of quantum lacks a structured view towards the QaaS stack itself. We address this concern by decomposing the workflow into six-stage model with STRIDE threat modeling. Our matrix demonstrated attack vectors in quantum-specific, inherited classical, and plausible tiers for each of the stages. We further investigate the underexplored sections (repudiation and elevation-of-privilege) and distinguish three different cross-stage attack chains with higher impacts.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 7 canonical work pages

  1. [12]

    Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots,

    S. Kundu and S. Ghosh, “Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots,” Pro- ceedings of the Great Lakes Symposium on VLSI 2025, pp. 273–277, Jun. 2025, doi: https://doi.org/10.1145/3716368.3735298

    arXiv 2025

  2. [11]

    QubitHammer: Remotely Inducing Qubit State Change on Superconducting Quantum Computers,

    Y . Tan, N. Choudhury, K. Basu, and J. Szefer, “QubitHammer: Remotely Inducing Qubit State Change on Superconducting Quantum Computers,” arXiv.org, 2025. https://arxiv.org/abs/2504.07875 (accessed May 26, 2026)

    arXiv 2025

  3. [1]

    Quantum Software Engineering: Roadmap and Challenges Ahead,

    J. M. Murillo et al., “Quantum Software Engineering: Roadmap and Challenges Ahead,” ACM Transactions on Software Engineering and Methodology, Jan. 2025, doi: https://doi.org/10.1145/3712002

    doi:10.1145/3712002 2025

  4. [2]

    Quantum Computing Threat Modelling on a Generic CPS Setup,

    C. C. Lee, T. G. Tan, V . Sharma, and J. Zhou, “Quantum Computing Threat Modelling on a Generic CPS Setup,” Lecture Notes in Computer Science, pp. 171–190, 2021, doi: https://doi.org/10.1007/978-3-030- 81645-2 11

    doi:10.1007/978-3-030- 2021

  5. [3]

    Future-Proofing Cloud Security Against Quantum Attacks: Risk, Transition, and Mitigation Strategies

    Y . Baseri, A. Hafid, and L. A. Habibi, “Future-Proofing Cloud Security Against Quantum Attacks: Risk, Transition, and Mitigation Strategies,” arXiv.org, 2025. https://arxiv.org/abs/2509.15653

    work page Pith review arXiv 2025

  6. [4]

    A Primer on Security of Quantum Computing Hardware,

    S. Ghosh, S. Upadhyay, and A. Ash Saki, “A Primer on Security of Quantum Computing Hardware,” Proceedings of the IEEE, vol. 113, no. 7, pp. 640–667, Jul. 2025, doi: https://doi.org/10.1109/jproc.2025.3630989

    work page arXiv 2025

  7. [6]

    Classification of security challenges and mitigation approaches in the quantum software engineer- ing,

    B. Rahman, M. Haghparast, and T. Mikkonen, “Classification of security challenges and mitigation approaches in the quantum software engineer- ing,” Journal of Systems and Software, vol. 238, p. 112884, Aug. 2026, doi: https://doi.org/10.1016/j.jss.2026.112884

    work page arXiv 2026

  8. [7]

    STRIDE-based threat modeling for cyber-physical systems,

    R. Khan, K. McLaughlin, D. Laverty, and S. Sezer, “STRIDE-based threat modeling for cyber-physical systems,” IEEE Xplore, Sep. 01,

    work page

Show all 17 references
  1. [8]

    Threat modeling of industrial control systems: A systematic literature review,

    S. M. Khalil, H. Bahsi, and T. Kor ˜otko, “Threat modeling of industrial control systems: A systematic literature review,” Computers & Security, vol. 136, p. 103543, Jan. 2024, doi: https://doi.org/10.1016/j.cose.2023.103543

    2024

  2. [9]

    Security Vulnerabilities in Quantum Cloud Systems: A Survey on Emerging Threats,

    J. Coupel and T. Farheen, “Security Vulnerabilities in Quantum Cloud Systems: A Survey on Emerging Threats,” arXiv.org, 2025. https://arxiv.org/abs/2504.19064

    2025 arXiv

  3. [10]

    SW AP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System,

    L. Wei, S. Wang, S. Dutta, M. W. El, and A. Chattopadhyay, “SW AP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System,” arXiv.org, 2025. https://arxiv.org/abs/2502.10115 (accessed May 26, 2026)

    2025 arXiv

  4. [13]

    Exploration of Power Side-Channel Vulnerabilities in Quantum Computer Controllers,

    C. Xu, F. Erata, and J. Szefer, “Exploration of Power Side-Channel Vulnerabilities in Quantum Computer Controllers,” Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, Nov. 2023, doi: https://doi.org/10.1145/3576915.3623118

    2023

  5. [14]

    Security Attacks Abusing Pulse-level Quantum Circuits,

    C. Xu and J. Szefer, “Security Attacks Abusing Pulse-level Quantum Circuits,” 2025 IEEE Symposium on Security and Privacy (SP), pp. 222–239, May 2025, doi: https://doi.org/10.1109/sp61157.2025.00083

    2025

  6. [15]

    Secure Quantum Circuit Compilation Method- ology for Untrusted Compilers,

    S. Das and S. Ghosh, “Secure Quantum Circuit Compilation Method- ology for Untrusted Compilers,” 2025 IEEE International Conference on Quantum Computing and Engineering (QCE), pp. 2191–2201, Aug. 2025, doi: https://doi.org/10.1109/qce65121.2025.00239

    2025

  7. [16]

    The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models,

    A. Ghosh and S. Ghosh, “The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models,” Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security, pp. 48–57, Nov. 2024, doi: https://doi.org/10.1145/3689939.3695783

    2024

  8. [17]

    Trustworthy and reliable computing using untrusted and unreliable quantum hardware,

    S. Upadhyay and S. Ghosh, “Trustworthy and reliable computing using untrusted and unreliable quantum hardware,” Frontiers in Computer Science, vol. 6, Aug. 2024, doi: https://doi.org/10.3389/fcomp.2024.1431788

    2024

  9. [2017]

    https://ieeexplore.ieee.org/document/8260283

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.