REVIEW 2 major objections 8 minor 102 references
Reviewed by Pith at T0; open to challenge.
T0 review · glm-5.2
Quantum cloud backends leak identity through noisy output
2026-07-07 19:50 UTC pith:F7CWD4GU
load-bearing objection New security framework for quantum cloud routing anonymity; theory is clean but experiments need polish. the 2 major comments →
Routing Anonymity and Identifiability of Noisy Quantum Hardware
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central object is the reduction of backend identifiability to classical hypothesis testing over transcript laws. When a provider routes a user's circuit to a hidden quantum backend and returns a post-processed output distribution, the user's ability to identify the backend is governed by the total variation distance between the transcript distributions induced by each backend. In the multi-round persistent routing setting, anonymity decays as exp(-T * Chernoff information), meaning repeated probing exponentially erodes the provider's privacy. The utility-anonymity trade-off theorem then bounds how much a provider can strip identifying information: if post-processing must preserve a given
What carries the argument
The backend identifiability game (Game 1) and its persistent routing extension (Game 2); reduction to classical hypothesis testing via total variation distance and Chernoff information; the utility-preserving no-free-lunch theorem (Theorem 3); the intermediate-depth principle proved in a Pauli-transfer-matrix model with dominant mixing and backend-specific perturbation; the workload-probed channel pseudo-distance as a tighter bound than diamond norm.
Load-bearing premise
The persistent routing model assumes the user submits all probe circuits before observing any results (passive i.i.d. access) and that the backend label is fixed throughout. An adaptive adversary who chooses each circuit based on prior transcripts could identify backends faster than the Chernoff rate suggests. The utility-anonymity trade-off also assumes deterministic post-processing maps; stochastic post-processing is not analyzed.
What would settle it
If two backends with different physical noise profiles produce transcript distributions whose total variation distance is zero (or exponentially small) under all allowed workloads and post-processing maps, then the framework predicts perfect anonymity. Conversely, if the Chernoff information between transcript laws is zero, the exponential decay bound predicts no anonymity loss, which would be falsified if backends remain distinguishable through some other channel not captured by the transcript law.
If this is right
- Cloud quantum providers cannot assume routing choices are hidden simply because backend labels are not exposed; noisy output distributions carry learnable fingerprints even between devices of the same physical platform type.
- Any anonymity mechanism that preserves service utility is fundamentally limited by how much backend-specific information is already encoded in the utility output, giving providers a concrete design target for privacy-preserving post-processing.
- The intermediate-depth principle implies that providers should be most cautious about information leakage at moderate circuit depths, where backend-specific noise has accumulated but common mixing has not yet washed it out.
- Workload choice is a security-critical parameter: highly structured circuits like GHZ preparations allow near-perfect backend identification, suggesting providers should restrict or monitor such workloads.
- Temporal drift in backend noise creates an additional identification channel beyond static fingerprints, meaning long-term persistent routing is especially vulnerable to deanonymization.
Where Pith is reading between the lines
- An adaptive adversary who chooses each probe circuit based on prior transcripts could identify backends faster than the Chernoff rate suggests, making the exponential decay bound an optimistic lower bound on information leakage under more realistic threat models.
- Stochastic post-processing maps, which are not analyzed in this work, could potentially offer strictly better anonymity-utility trade-offs than deterministic ones by adding controlled randomness that further obscures backend-specific signals.
- If noise forecasting models improve sufficiently, users could predict future backend noise patterns from past observations, creating an additional deanonymization vector even without explicit adaptive access, since predicted fingerprints could inform workload design.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This manuscript introduces the first formal framework for backend identifiability and routing anonymity in cloud-based quantum computing. The core theoretical contributions are: (1) a game-theoretic formulation (Game 1, Game 2) in which a provider routes a user's circuit to one of several noisy backends and the user attempts to identify the backend from the classical output; (2) a reduction of optimal backend identification to classical binary hypothesis testing, yielding an exact TV-distance characterization of distinguishing bias (Theorem 1) and a Chernoff-rate decay of anonymity under persistent i.i.d. probing (Theorem 2); (3) a utility-anonymity no-free-lunch theorem showing that any utility-preserving post-processing cannot reduce distinguishability below the TV distance of the utility laws (Theorem 3); (4) an intermediate-depth principle formalized via Pauli-transfer-matrix analysis (Theorems 5–6); and (5) a workload-probed channel pseudo-distance providing tighter bounds than diamond norm (Proposition 4). Experiments on AWS Braket (Ankaa-3, Garnet, Aria-1) demonstrate 87–90% like-type and 96–100% differing-type classification, with identifiability surviving several post-processing forms.
Significance. The paper addresses a genuinely novel problem—provider-side routing anonymity in quantum cloud computing—that has not been formally studied. The theoretical results are clean and correctly derived from standard statistical facts (hypothesis testing, Chernoff theorem, data processing inequality). The utility-anonymity trade-off (Theorem 3) is a well-constructed no-free-lunch result that follows cleanly from the data processing inequality for TV distance and Chernoff information. The workload-probed channel pseudo-distance (Definition 11) is a practically motivated contribution that is tighter than worst-case diamond norm. The intermediate-depth principle (Theorems 5–6) provides a formal underpinning for an empirically observed phenomenon. Experiments on real hardware (AWS Braket) provide concrete evidence that the threat model is practically relevant. The framework is falsifiable: specific workloads, post-processing classes, and shot counts yield testable predictions about distinguishability.
major comments (2)
- §B.2, Theorem 3 (and Theorem 4): The no-free-lunch theorem is restricted to deterministic post-processing maps. Stochastic post-processing—e.g., adding classical noise to outputs—is a natural anonymization mechanism that a provider might employ, and is explicitly mentioned as a direction in §4 but not analyzed. Since the data processing inequality for TV distance also holds for stochastic channels (randomized post-processing), the extension should be straightforward, but its absence leaves a gap in the central utility-anonymity trade-off claim. The authors should either include the stochastic case or explicitly state in the theorem's vicinity that the result is limited to deterministic maps and that the stochastic extension is deferred, so the reader does not infer that the trade-off covers all practical anonymization strategies.
- §C.2, Theorem 6: The lower bound on distinguishing bias at small depths depends on a 'κ-nondegeneracy' condition (Definition in Theorem 6 statement) that requires E_{C∼μ_d}[||M(N_i - N_j) r_C||_1] ≥ κ ||N_i - N_j||_{1→1}. This condition is not motivated or shown to hold for any concrete circuit ensemble. Without at least one example ensemble satisfying κ-nondegeneracy, the lower bound is vacuous. The authors should either provide a concrete example (e.g., Haar-random circuits at sufficient depth) or clearly state that this is a structural assumption whose verification is left to future work, so the intermediate-depth principle's lower bound is not presented as unconditionally established.
minor comments (8)
- §B.2, proof of Theorem 3: The second inequality (Chernoff information version) is stated to follow 'by a similar argument,' but the data processing inequality for Chernoff information under deterministic post-processing is less immediate than for TV distance. A one-line justification or reference would strengthen the proof.
- §B.3, Corollary 2: The bound Adv ≤ m · max_{i≠j} δ_μ(N_i, N_j) scales linearly in m, but for large m the distinguishing bias is bounded by 1, so the bound becomes vacuous beyond m ~ 1/δ_μ. This regime limitation should be stated explicitly.
- §2.4 and Appendix C: The PTM model assumes depth-homogeneous, Markovian noise (same N_i per layer). This is a strong simplification; the assumption list in §C.1 is thorough but the main text (§2.4) does not mention these caveats. A brief note in the main text would help readers before diving into the appendix.
- Table 1: The notation 'a/b' in cells is not defined in the table caption. It appears to mean 'accuracy at depth d / accuracy up to depth d,' but this should be stated with a more explicit label.
- §3: The experimental results report test accuracies but no confidence intervals or standard deviations for the depth-varied experiments (Table 1), unlike Table 2 which reports ± std. Adding error bars or at least noting the number of runs would help assess whether the reported accuracies are statistically significant.
- §1.1, Examples 1–3: The toy examples are engaging but lengthy relative to their technical contribution. Consider condensing or moving to an appendix to keep the introduction focused.
- The paper uses 'ε' for both the anonymity parameter (Definition 6) and the PTM perturbation bound (§C.1, Eq. C.2). Using distinct symbols would avoid confusion.
- References [8] and [26] are self-citations that appear only loosely connected to the paper's topic. If they are not directly relevant, consider removing to avoid unnecessary self-citation.
Simulated Author's Rebuttal
We thank the referee for a careful and constructive report. Both major comments identify genuine gaps in the presentation that we will address in revision. Below we respond to each point.
read point-by-point responses
-
Referee: §B.2, Theorem 3 (and Theorem 4): The no-free-lunch theorem is restricted to deterministic post-processing maps. Stochastic post-processing—e.g., adding classical noise to outputs—is a natural anonymization mechanism that a provider might employ, and is explicitly mentioned as a direction in §4 but not analyzed. Since the data processing inequality for TV distance also holds for stochastic channels (randomized post-processing), the extension should be straightforward, but its absence leaves a gap in the central utility-anonymity trade-off claim. The authors should either include the stochastic case or explicitly state in the theorem's vicinity that the result is limited to deterministic maps and that the stochastic extension is deferred, so the reader does not infer that the trade-off covers all practical anonymization strategies.
Authors: The referee is correct on both counts: the current statement of Theorem 3 (and Theorem 4) is restricted to deterministic post-processing maps, and the extension to stochastic post-processing is indeed straightforward via the data processing inequality for TV distance under Markov kernels. We will include the stochastic extension in the revised manuscript. Concretely, if the post-processing map is a stochastic channel K (a Markov kernel from Y to X) that preserves utility u in the sense that there exists a decoder channel D such that the composition D∘K reproduces the utility law, then the same DPI argument yields TV(P_1(·,·,K), P_2(·,·,K)) ≥ TV(P_1(·,·,u), P_2(·,·,u)). The proof replaces the deterministic pushforward ϕ_#Q_i with the stochastic pushforward and applies the standard DPI for TV distance under Markov kernels. The same modification applies to the approximate version (Theorem 4) and to the Chernoff information bound. We will add a remark or corollary to this effect in §B.2, and also add an explicit note in the theorem's vicinity that the original deterministic statement is a special case. We agree that this closes an important gap, since stochastic post-processing (e.g., adding calibrated classical noise to output histograms) is one of the most natural anonymization strategies a provider might consider, and the no-free-lunch result should cover it. revision: yes
-
Referee: §C.2, Theorem 6: The lower bound on distinguishing bias at small depths depends on a 'κ-nondegeneracy' condition that requires E_{C∼μ_d}[||M(N_i - N_j) r_C||_1] ≥ κ ||N_i - N_j||_{1→1}. This condition is not motivated or shown to hold for any concrete circuit ensemble. Without at least one example ensemble satisfying κ-nondegeneracy, the lower bound is vacuous. The authors should either provide a concrete example (e.g., Haar-random circuits at sufficient depth) or clearly state that this is a structural assumption whose verification is left to future work, so the intermediate-depth principle's lower bound is not presented as unconditionally established.
Authors: The referee is correct that the κ-nondegeneracy condition is a structural assumption that is not verified for any concrete ensemble in the current manuscript, and without such verification the lower bound of Theorem 6 is indeed vacuous as stated. We will address this in two ways. First, we will add an explicit remark immediately following Theorem 6 stating that the lower bound is conditional on the κ-nondegeneracy assumption and that verification of this condition for specific circuit ensembles (including Haar-random circuits) is left to future work. We will be careful not to present the lower bound as unconditionally established. Second, we will add a brief discussion of why the condition is plausible: for Haar-random circuits at sufficient depth, the ideal traceless Pauli vectors r_C are distributed roughly isotropically on a sphere of radius scaling with the system size, so the expectation E[||M(N_i - N_j) r_C||_1] should be bounded below by a constant times ||N_i - N_j||_{1→1} provided M is not too degenerate. However, we are not able to provide a rigorous proof of κ-nondegeneracy for Haar-random circuits within the scope of this revision, as it would require non-trivial concentration-of-measure arguments on the Pauli representation that we have not fully worked out. We will therefore state this as a conjecture supported by the isotropy heuristic, and make clear that the upper bound (Theorem 5) is unconditional while the lower bound (Theorem 6) is conditional. revision: partial
Circularity Check
No circularity found — derivation chain is self-contained against standard external results
full rationale
The paper's three central theoretical results (Theorems 1–3) are derived from standard statistical facts with self-contained proofs or external standard citations. Theorem 1's reduction to hypothesis testing follows directly from the definition of TV distance and the structure of binary decision rules — the proof is two lines and contains no hidden assumptions. Theorem 2 applies the standard Chernoff theorem for i.i.d. Bayesian hypothesis testing, cited to Cover & Thomas [84] (external, not authored by the present authors). Theorem 3 (utility-anonymity no-free-lunch) follows from Proposition 2, which is a self-contained proof of the data processing inequality for TV distance: the key observation is that preimages of measurable sets under ϕ form a subset of all measurable sets, so the supremum defining TV(ϕ#Q1, ϕ#Q2) is over a smaller collection than TV(Q1, Q2). The PTM-based intermediate-depth results (Theorems 5–6) use standard linear algebra (telescoping identities, submultiplicativity of induced norms) under explicitly stated modeling assumptions (N_i = λI + E_i), with the contractive channel framework cited to external references [88–92]. No self-citations are load-bearing: references [8] and [26] (which include co-author Priestley) are on unrelated topics and are not invoked in any proof. No fitted parameters are renamed as predictions. The experimental results are empirical validations, not inputs to the theoretical claims. The derivation chain is clean and non-circular.
Axiom & Free-Parameter Ledger
free parameters (5)
- λ (common contraction rate)
- ε (backend-specific perturbation bound)
- R (average Pauli signal bound)
- κ (nondegeneracy constant)
- ε (anonymity parameter)
axioms (6)
- domain assumption Passive i.i.d. access model: in persistent routing, all T probe circuits are sampled and submitted before any transcript is observed, and the backend label is fixed across rounds.
- domain assumption Deterministic post-processing: the provider's post-processing map φ is deterministic.
- domain assumption PTM model assumptions: noisy evolution is Markovian, depth-homogeneous, diagonal (or effectively diagonal after Pauli twirling), with common fixed point and backend-independent measurement.
- domain assumption Strict contractivity: the traceless PTM block N_i has ∥N_i∥_{1→1} ≤ λ+ε < 1.
- standard math Standard hypothesis testing results: the Chernoff theorem for Bayesian binary hypothesis testing of i.i.d. observations.
- standard math Data processing inequality for total variation distance under deterministic maps.
invented entities (3)
-
Backend identifiability game (Game 1)
independent evidence
-
Workload-probed channel pseudo-distance δ_μ (Definition 11)
independent evidence
-
Utility map u (Definition 7)
no independent evidence
read the original abstract
Present-day quantum computing is cloud-based, where a user submits a circuit to a service provider's proprietary backend hardware. While providers may wish to hide implementation details, scheduling choices, or even which physical device was used, noisy finite-shot outputs can carry backend-specific fingerprints: information imprinted in the classical output distribution that can reveal the backend identity. So far, such fingerprints have mostly been studied from a benchmarking perspective, with limited attention to privacy considerations for users and providers. This work develops the first formal framework for backend identifiability and its privacy implications. We introduce a backend-identifiability game and use it to formalise routing anonymity as a security notion for quantum cloud services. We show that backend identifiability is a hypothesis-testing problem and prove that, under passive i.i.d. access to a single backend, routing anonymity decays exponentially at the Chernoff rate. We also establish a utility-anonymity trade-off, imposing fundamental limits on how much backend-specific information can be removed from classical outputs without degrading their usefulness. In addition, we observe that, for noisy quantum hardware, identifying fingerprints are inherently an intermediate-depth phenomenon, and establish a depth principle using Pauli-transfer-matrix tools. We complement the theory with experiments on Amazon Braket on AWS, using ion-trap and superconducting quantum processors. We observe 87-90% classification between superconducting backends and 96-100% classification across physical platforms, and find that identifiability can survive natural forms of post-processing. Overall, these results establish routing anonymity as a distinct security requirement for quantum cloud computing, and provide a framework for quantifying and controlling the utility-anonymity trade-off.
Figures
Reference graph
Works this paper leans on
-
[1]
P.W. Shor. Algorithms for quantum computation: discrete logarithms and factoring. In Proceedings 35th Annual Symposium on Foundations of Computer Science, pages 124–134, 1994. doi: 10.1109/SFCS.1994.365700
-
[2]
Shor's discrete logarithm quantum algorithm for elliptic curves
John Proos and Christof Zalka. Shor’s discrete logarithm quantum algorithm for elliptic curves. arXiv preprint quant-ph/0301141, 2003
work page internal anchor Pith review Pith/arXiv arXiv 2003
-
[3]
Applying grover’s algorithm to aes: quantum resource estimates
Markus Grassl, Brandon Langenberg, Martin Roetteler, and Rainer Steinwandt. Applying grover’s algorithm to aes: quantum resource estimates. InInternational Workshop on Post- Quantum Cryptography, pages 29–43. Springer, 2016
work page 2016
-
[4]
Quantum resource estimates for computing elliptic curve discrete logarithms
Martin Roetteler, Michael Naehrig, Krysta M Svore, and Kristin Lauter. Quantum resource estimates for computing elliptic curve discrete logarithms. InInternational Conference on the Theory and Application of Cryptology and Information Security, pages 241–270. Springer, 2017
work page 2017
-
[5]
Quantum Differential and Linear Cryptanalysis
Marc Kaplan, Gaëtan Leurent, Anthony Leverrier, and María Naya-Plasencia. Quantum differential and linear cryptanalysis.arXiv preprint arXiv:1510.05836, 2015
work page internal anchor Pith review Pith/arXiv arXiv 2015
-
[6]
Breaking symmetric cryptosystems using quantum period finding
Marc Kaplan, Gaëtan Leurent, Anthony Leverrier, and María Naya-Plasencia. Breaking symmetric cryptosystems using quantum period finding. InAnnual international cryptology conference, pages 207–237. Springer, 2016
work page 2016
-
[7]
Thijs Laarhoven, Michele Mosca, and Joop Van De Pol. Finding shortest lattice vectors faster using quantum search.Designs, Codes and Cryptography, 77(2):375–400, 2015
work page 2015
-
[8]
Ben Priestley and Petros Wallden. A practically scalable approach to the closest vector problem for sieving via qaoa with fixed angles.Quantum Science and Technology, 11(2):025018, mar
-
[9]
URLhttps://doi.org/10.1088/2058-9565/ae4cc6
doi: 10.1088/2058-9565/ae4cc6. URLhttps://doi.org/10.1088/2058-9565/ae4cc6
-
[10]
Lattice sieving via quantum random walks
André Chailloux and Johanna Loyer. Lattice sieving via quantum random walks. InInternational Conference on the Theory and Application of Cryptology and Information Security, pages 63–91. Springer, 2021
work page 2021
-
[11]
Simulated quantum computation of molecular energies.Science, 309(5741):1704–1707, 2005
Alán Aspuru-Guzik, Anthony D Dutoi, Peter J Love, and Martin Head-Gordon. Simulated quantum computation of molecular energies.Science, 309(5741):1704–1707, 2005
work page 2005
-
[12]
Alberto Peruzzo, Jarrod McClean, Peter Shadbolt, Man-Hong Yung, Xiao-Qi Zhou, Peter J Love, Alán Aspuru-Guzik, and Jeremy L O’brien. A variational eigenvalue solver on a photonic quantum processor.Nature communications, 5(1):4213, 2014. 16
work page 2014
-
[13]
Abhinav Kandala, Antonio Mezzacapo, Kristan Temme, Maika Takita, Markus Brink, Jerry M Chow, and Jay M Gambetta. Hardware-efficient variational quantum eigensolver for small molecules and quantum magnets.nature, 549(7671):242–246, 2017
work page 2017
-
[14]
Markus Reiher, Nathan Wiebe, Krysta M Svore, Dave Wecker, and Matthias Troyer. Elucidating reaction mechanisms on quantum computers.Proceedings of the national academy of sciences, 114(29):7555–7560, 2017
work page 2017
-
[15]
Hartree-fock on a superconducting qubit quantum computer.Science, 369(6507):1084–1089, 2020
Google AI Quantum, Collaborators*†, Frank Arute, Kunal Arya, Ryan Babbush, Dave Bacon, Joseph C Bardin, Rami Barends, Sergio Boixo, Michael Broughton, Bob B Buckley, et al. Hartree-fock on a superconducting qubit quantum computer.Science, 369(6507):1084–1089, 2020
work page 2020
-
[16]
Quantum computing enhanced computational catalysis.Physical Review Research, 3(3):033055, 2021
Vera von Burg, Guang Hao Low, Thomas Häner, Damian S Steiger, Markus Reiher, Martin Roetteler, and Matthias Troyer. Quantum computing enhanced computational catalysis.Physical Review Research, 3(3):033055, 2021
work page 2021
-
[17]
Towards near-term quantum simulation of materials.Nature Communications, 15(1):211, 2024
Laura Clinton, Toby Cubitt, Brian Flynn, Filippo Maria Gambetta, Joel Klassen, Ashley Montanaro, Stephen Piddock, Raul A Santos, and Evan Sheridan. Towards near-term quantum simulation of materials.Nature Communications, 15(1):211, 2024
work page 2024
-
[18]
Probing many-body dynamics on a 51-atom quantum simulator.Nature, 551(7682):579–584, 2017
Hannes Bernien, Sylvain Schwartz, Alexander Keesling, Harry Levine, Ahmed Omran, Hannes Pichler, Soonwon Choi, Alexander S Zibrov, Manuel Endres, Markus Greiner, et al. Probing many-body dynamics on a 51-atom quantum simulator.Nature, 551(7682):579–584, 2017
work page 2017
-
[19]
Universal quantum simulators.Science, 273(5278):1073–1078, 1996
Seth Lloyd. Universal quantum simulators.Science, 273(5278):1073–1078, 1996
work page 1996
-
[20]
Esteban A Martinez, Christine A Muschik, Philipp Schindler, Daniel Nigg, Alexander Erhard, Markus Heyl, Philipp Hauke, Marcello Dalmonte, Thomas Monz, Peter Zoller, et al. Real-time dynamics of lattice gauge theories with a few-qubit quantum computer.Nature, 534(7608): 516–519, 2016
work page 2016
-
[21]
Sepehr Ebadi, Tout T Wang, Harry Levine, Alexander Keesling, Giulia Semeghini, Ahmed Omran, Dolev Bluvstein, Rhine Samajdar, Hannes Pichler, Wen Wei Ho, et al. Quantum phases of matter on a 256-atom programmable quantum simulator.Nature, 595(7866):227–232, 2021
work page 2021
-
[22]
Yasar Y Atas, Jinglei Zhang, Randy Lewis, Amin Jahanpour, Jan F Haase, and Christine A Muschik. Su (2) hadrons on a quantum computer via a variational approach.Nature communi- cations, 12(1):6499, 2021
work page 2021
-
[23]
Michael Meth, Jinglei Zhang, Jan F Haase, Claire Edmunds, Lukas Postler, Andrew J Jena, Alex Steiner, Luca Dellantonio, Rainer Blatt, Peter Zoller, et al. Simulating two-dimensional lattice gauge theories on a qudit quantum computer.Nature Physics, 21(4):570–576, 2025
work page 2025
-
[24]
Zitian Zhu, Kiera Salice, Akram Touil, Zehang Bao, Zixuan Song, Pengfei Zhang, Hekang Li, Zhen Wang, Chao Song, Qiujiang Guo, et al. Observation of quantum darwinism and the origin of classicality with superconducting circuits.Science Advances, 11(31):eadx6857, 2025
work page 2025
-
[25]
Quantum spacetime on a quantum simulator.Communications Physics, 2(1):122, 2019
Keren Li, Youning Li, Muxin Han, Sirui Lu, Jie Zhou, Dong Ruan, Guilu Long, Yidun Wan, Dawei Lu, Bei Zeng, et al. Quantum spacetime on a quantum simulator.Communications Physics, 2(1):122, 2019. 17
work page 2019
-
[26]
Spin-networks in the ZX-calculus
Richard DP East, Pierre Martin-Dussaud, and John Van de Wetering. Spin-networks in the zx-calculus.arXiv preprint arXiv:2111.03114, 2021
work page internal anchor Pith review Pith/arXiv arXiv 2021
-
[27]
Finite-dimensional zx-calculus for loop quantum gravity, 2025
Ben Priestley. Finite-dimensional zx-calculus for loop quantum gravity, 2025. URLhttps: //arxiv.org/abs/2511.15966
-
[28]
Spin foam vertex amplitudes on quantum computer—preliminary results
Jakub Mielczarek. Spin foam vertex amplitudes on quantum computer—preliminary results. Universe, 5(8):179, 2019
work page 2019
-
[29]
Reinier van der Meer, Zichang Huang, Malaquias Correa Anguita, Dongxue Qu, Peter Hooi- jschuur, Hongguang Liu, Muxin Han, Jelmer J Renema, and Lior Cohen. Experimental simulation of loop quantum gravity on a photonic chip.npj Quantum Information, 9(1):32, 2023
work page 2023
-
[30]
A Quantum Approximate Optimization Algorithm
Edward Farhi, Jeffrey Goldstone, and Sam Gutmann. A quantum approximate optimization algorithm.arXiv preprint arXiv:1411.4028, 2014
work page internal anchor Pith review Pith/arXiv arXiv 2014
-
[31]
Ising formulations of many np problems.Frontiers in physics, 2:74887, 2014
Andrew Lucas. Ising formulations of many np problems.Frontiers in physics, 2:74887, 2014
work page 2014
-
[32]
Sepehr Ebadi, Alexander Keesling, Madelyn Cain, Tout T Wang, Harry Levine, Dolev Bluvstein, Giulia Semeghini, Ahmed Omran, J-G Liu, Rhine Samajdar, et al. Quantum optimization of maximum independent set using rydberg atom arrays.Science, 376(6598):1209–1215, 2022
work page 2022
-
[33]
Patrick Rebentrost, Masoud Mohseni, and Seth Lloyd. Quantum support vector machine for big data classification.Physical review letters, 113(13):130503, 2014
work page 2014
-
[34]
Quantum machine learning in feature hilbert spaces
Maria Schuld and Nathan Killoran. Quantum machine learning in feature hilbert spaces. Physical review letters, 122(4):040504, 2019
work page 2019
-
[35]
Supervised learning with quantum-enhanced feature spaces.Nature, 567(7747):209–212, 2019
Vojtěch Havlíček, Antonio D Córcoles, Kristan Temme, Aram W Harrow, Abhinav Kandala, Jerry M Chow, and Jay M Gambetta. Supervised learning with quantum-enhanced feature spaces.Nature, 567(7747):209–212, 2019
work page 2019
-
[36]
Yunchao Liu, Srinivasan Arunachalam, and Kristan Temme. A rigorous and robust quantum speed-up in supervised machine learning.Nature physics, 17(9):1013–1017, 2021
work page 2021
-
[37]
Power of data in quantum machine learning.Nature communications, 12(1):2631, 2021
Hsin-Yuan Huang, Michael Broughton, Masoud Mohseni, Ryan Babbush, Sergio Boixo, Hart- mut Neven, and Jarrod R McClean. Power of data in quantum machine learning.Nature communications, 12(1):2631, 2021
work page 2021
-
[38]
Quantum advantage in learning from experiments.Science, 376(6598):1182–1186, 2022
Hsin-Yuan Huang, Michael Broughton, Jordan Cotler, Sitan Chen, Jerry Li, Masoud Mohseni, Hartmut Neven, Ryan Babbush, Richard Kueng, John Preskill, et al. Quantum advantage in learning from experiments.Science, 376(6598):1182–1186, 2022
work page 2022
-
[39]
Zhenghao Yin, Iris Agresti, Giovanni De Felice, Douglas Brown, Alexis Toumi, Ciro Pentangelo, Simone Piacentini, Andrea Crespi, Francesco Ceccarelli, Roberto Osellame, et al. Experimental quantum-enhanced kernel-based machine learning on a photonic processor.Nature Photonics, 19(9):1020–1027, 2025
work page 2025
-
[40]
Quantum Cloud Computing: A Review, Open Problems, and Future Directions
Hoa T. Nguyen, Prabhakar Krishnan, Dilip Krishnaswamy, Muhammad Usman, and Rajkumar Buyya. Quantum cloud computing: A review, open problems, and future directions, 2024. URL https://arxiv.org/abs/2404.11420. 18
work page internal anchor Pith review Pith/arXiv arXiv 2024
-
[41]
Muhammed Golec, Emir Sahin Hatay, Mustafa Golec, Murat Uyar, Merve Golec, and Sukh- pal Singh Gill. Quantum cloud computing: Trends and challenges.Journal of Economy and Technology, 2:190–199, November 2024. ISSN 2949-9488. doi: 10.1016/j.ject.2024.05.001. URL http://dx.doi.org/10.1016/j.ject.2024.05.001
-
[42]
Amazon Web Services. Amazon Braket: Supported devices.https://docs.aws.amazon.com/ braket/latest/developerguide/braket-devices.html, 2026. Accessed May 2026
work page 2026
-
[43]
Amazon Braket: Quantum cloud computing service.https://aws
Amazon Web Services. Amazon Braket: Quantum cloud computing service.https://aws. amazon.com/braket/, 2026. Accessed May 2026
work page 2026
-
[44]
Learning the noise fingerprint of quantum devices, 2021
Stefano Martina, Lorenzo Buffoni, Stefano Gherardini, and Filippo Caruso. Learning the noise fingerprint of quantum devices, 2021
work page 2021
-
[45]
Forensics of transpiled quantum circuits
Rupshali Roy, Archisman Ghosh, and Swaroop Ghosh. Forensics of transpiled quantum circuits. InProceedings of the Great Lakes Symposium on VLSI 2025, GLSVLSI 2025, pages 354–359. Association for Computing Machinery, 2025. doi: 10.1145/3716368.3735240
-
[46]
Fast fingerprinting of cloud-based nisq quantum computers
Kaitlin N Smith, Joshua Viszlai, Lennart Maximilian Seifert, Jonathan M Baker, Jakub Szefer, and Frederic T Chong. Fast fingerprinting of cloud-based nisq quantum computers. In2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pages 1–12. IEEE, 2023
work page 2023
-
[47]
Short paper: Device-and locality-specific fingerprint- ing of shared nisq quantum computers
Allen Mi, Shuwen Deng, and Jakub Szefer. Short paper: Device-and locality-specific fingerprint- ing of shared nisq quantum computers. InProceedings of the 10th International Workshop on Hardware and Architectural Support for Security and Privacy, pages 1–6, 2021
work page 2021
-
[48]
Quantum computer fingerprinting using error syndromes, 2025
Vincent Mutolo, Devon Campbell, Quinn Manning, Henri Witold Dubourg, Ruibin Lyu, Simha Sethumadhavan, Daniel Rubenstein, and Salvatore Stolfo. Quantum computer fingerprinting using error syndromes, 2025. URLhttps://arxiv.org/abs/2506.16614
-
[49]
Q-id: Lightweight quantum network server identification through fingerprinting.Netwrk
Jindi Wu, Tianjie Hu, and Qun Li. Q-id: Lightweight quantum network server identification through fingerprinting.Netwrk. Mag. of Global Internetwkg., 38(5):146–152, September 2024. ISSN 0890-8044. doi: 10.1109/MNET.2024.3400893. URL https://doi.org/10.1109/MNET. 2024.3400893
-
[50]
Andrew M. Childs. Secure assisted quantum computation.Quantum Information and Compu- tation, 5(6):456–466, 2005
work page 2005
-
[51]
Universal blind quantum computation
Anne Broadbent, Joseph Fitzsimons, and Elham Kashefi. Universal blind quantum computation. InProceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science, pages 517–526, 2009. doi: 10.1109/FOCS.2009.36
-
[52]
Joseph F. Fitzsimons and Elham Kashefi. Unconditionally verifiable blind quantum computation. Physical Review A, 96(1):012303, 2017. doi: 10.1103/PhysRevA.96.012303
-
[53]
Fitzsimons, Christopher Portmann, and Renato Renner
Vedran Dunjko, Joseph F. Fitzsimons, Christopher Portmann, and Renato Renner. Composable security of delegated quantum computation. InAdvances in Cryptology – ASIACRYPT 2014, volume 8874 ofLecture Notes in Computer Science, pages 406–425. Springer, 2014. doi: 10.1007/978-3-662-45608-8_22. 19
-
[54]
Security limitations of classical-client delegated quantum computing
Christian Badertscher, Alexandru Cojocaru, Léo Colisson, Elham Kashefi, Dominik Leichtle, Atul Mantri, and Petros Wallden. Security limitations of classical-client delegated quantum computing. InInternational Conference on the Theory and Application of Cryptology and Information Security, pages 667–696. Springer, 2020
work page 2020
-
[55]
Selectively Blind Quantum Computation
Abbas Poshtvan, Oleksandra Lapiha, Mina Doosti, Dominik Leichtle, Luka Music, and Elham Kashefi. Selectively blind quantum computation.arXiv preprint arXiv:2504.17612, 2025
work page internal anchor Pith review Pith/arXiv arXiv 2025
-
[56]
Alexandru Gheorghiu, Theodoros Kapourniotis, and Elham Kashefi. Verification of quantum computation: An overview of existing approaches.Theory of Computing Systems, 63:715–808,
-
[57]
doi: 10.1007/s00224-018-9872-3
-
[58]
Interactive proofs for quantum computations, 2017
Dorit Aharonov, Michael Ben-Or, Elad Eban, and Urmila Mahadev. Interactive proofs for quantum computations, 2017
work page 2017
-
[59]
Classical verification of quantum computations
Urmila Mahadev. Classical verification of quantum computations. InProceedings of the 59th Annual IEEE Symposium on Foundations of Computer Science, pages 259–267, 2018. doi: 10.1109/FOCS.2018.00033
-
[60]
Classical verification of quantum computations with efficient verifier
Nai-Hui Chia, Kai-Min Chung, and Takashi Yamakawa. Classical verification of quantum computations with efficient verifier. InTheory of Cryptography Conference, pages 181–206. Springer, 2020
work page 2020
-
[61]
Succinct classical verification of quantum computation
James Bartusek, Yael Tauman Kalai, Alex Lombardi, Fermi Ma, Giulio Malavolta, Vinod Vaikuntanathan, Thomas Vidick, and Lisa Yang. Succinct classical verification of quantum computation. InAnnual International Cryptology Conference, pages 195–211. Springer, 2022
work page 2022
-
[62]
Succinct blind quantum computation using a random oracle
Jiayu Zhang. Succinct blind quantum computation using a random oracle. InProceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, pages 1370–1383, 2021
work page 2021
-
[63]
How to classically verify a quantum cat without killing it.arXiv preprint arXiv:2602.09282, 2026
Yael Tauman Kalai, Dakshita Khurana, and Justin Raizes. How to classically verify a quantum cat without killing it.arXiv preprint arXiv:2602.09282, 2026
-
[64]
Verifying bqp computations on noisy devices with minimal overhead.PRX Quantum, 2(4):040302, 2021
Dominik Leichtle, Luka Music, Elham Kashefi, and Harold Ollivier. Verifying bqp computations on noisy devices with minimal overhead.PRX Quantum, 2(4):040302, 2021
work page 2021
-
[65]
Computationally-secure and composable remote state preparation
Alexandru Gheorghiu and Thomas Vidick. Computationally-secure and composable remote state preparation. InProceedings of the 60th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2019, pages 1024–1033. IEEE Computer Society, 2019. doi: 10.1109/ FOCS.2019.00066
-
[66]
Classical homomorphic encryption for quantum circuits
Urmila Mahadev. Classical homomorphic encryption for quantum circuits. InProceedings of the 59th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2018, pages 332–338. IEEE Computer Society, 2018. doi: 10.1109/FOCS.2018.00039
-
[67]
Quantum fully homo- morphic encryption with verification
Gorjan Alagic, Yfke Dulek, Christian Schaffner, and Florian Speelman. Quantum fully homo- morphic encryption with verification. InAdvances in Cryptology – EUROCRYPT 2018, Lecture Notes in Computer Science, pages 438–467. Springer, 2018. doi: 10.1007/978-3-319-70694-8_16
-
[68]
Yuhang Ma, Yipeng Huang, Samuele Ferracin, Robin Harper, and Swamit S. Tannu. QEnclave: A practical solution for secure quantum cloud computing.npj Quantum Information, 8:128,
-
[69]
doi: 10.1038/s41534-022-00612-5. 20
-
[70]
Security Vulnerabilities in Quantum Cloud Systems: A Survey on Emerging Threats
Justin Coupel and Tasnuva Farheen. Security vulnerabilities in quantum cloud systems: A survey on emerging threats, 2025. URLhttps://arxiv.org/abs/2504.19064
work page internal anchor Pith review Pith/arXiv arXiv 2025
-
[71]
David L. Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM, 24(2):84–90, 1981. doi: 10.1145/358549.358563
-
[72]
Michael G. Reed, Paul F. Syverson, and David M. Goldschlag. Anonymous connections and onion routing.IEEE Journal on Selected Areas in Communications, 16(4):482–494, 1998. doi: 10.1109/49.668972
-
[73]
Tor: The second-generation onion router
Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: The second-generation onion router. InProceedings of the 13th USENIX Security Symposium, 2004
work page 2004
-
[74]
Easwar Magesan, Jay M. Gambetta, and Joseph Emerson. Scalable and robust randomized benchmarking of quantum processes.Physical Review Letters, 106:180504, 2011. doi: 10.1103/ PhysRevLett.106.180504
work page 2011
-
[75]
Robin Blume-Kohout, John King Gamble, Erik Nielsen, Kenneth Rudinger, Jonathan Mizrahi, Kevin Fortier, and Peter Maunz. Demonstration of qubit operations below a rigorous fault tolerance threshold with gate set tomography.Nature Communications, 8:14485, 2017. doi: 10.1038/ncomms14485
-
[76]
Hamilton, Tyler Kharazi, Titus Morris, Alexander J
Kathleen E. Hamilton, Tyler Kharazi, Titus Morris, Alexander J. McCaskey, Ryan S. Bennink, and Raphael C. Pooser. Scalable quantum processor noise characterization.Proceedings of the IEEE International Conference on Quantum Computing and Engineering, pages 430–440, 2020
work page 2020
-
[77]
Robin Harper, Steven T. Flammia, and Joel J. Wallman. Efficient learning of quantum noise. Nature Physics, 16:1184–1188, 2020. doi: 10.1038/s41567-020-0992-8
-
[78]
Minev, Abhinav Kandala, and Kristan Temme
Ewout van den Berg, Zlatko K. Minev, Abhinav Kandala, and Kristan Temme. Probabilistic error cancellation with sparse Pauli–Lindblad models on noisy quantum processors.Nature Physics, 19:1116–1121, 2023. doi: 10.1038/s41567-023-02042-2
-
[79]
Quantum certification and benchmarking.Nature Reviews Physics, 2(7):382–390, 2020
Jens Eisert, Dominik Hangleiter, Nathan Walk, Ingo Roth, Damian Markham, Rhea Parekh, Ulysse Chabaud, and Elham Kashefi. Quantum certification and benchmarking.Nature Reviews Physics, 2(7):382–390, 2020
work page 2020
-
[80]
Andrew W. Cross, Lev S. Bishop, Sarah Sheldon, Paul D. Nation, and Jay M. Gambetta. Validating quantum computers using randomized model circuits.Physical Review A, 100:032328,
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.