Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots

Satwik Kundu; Swaroop Ghosh

REVIEW 4 major objections 6 minor 23 references

Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A neural network trained on circuit pairs can identify which of a fixed set of quantum-compiler optimization passes was applied, with F1 scores up to 0.96.

desk verdict The task is genuinely new but the security claim outruns the evidence, because the evaluation assumes labeled training data the adversary never gets. read the letter →

arxiv 2504.19113 v1 pith:X44MYQYI submitted 2025-04-27 quant-ph cs.LG

Satwik Kundu , Swaroop Ghosh This is my paper · ORCID

classification quant-phcs.LG

keywords quantumcircuitcompilationcompilerconfidentialityoptimizationpassdetectiontranspilationforensicsmulti-labelclassificationfingerprintingreverseengineeringmachinelearningsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a black-box quantum compiler's optimization choices are not fully secret: by comparing an original quantum circuit with its compiled output, a machine-learning model can infer which of a predefined set of optimization passes the compiler applied. The authors build a supervised multi-label classifier on 10,000 synthetic random circuit pairs and report that a neural network identifies the applied passes with a Hamming score of 0.682, with the most distinctive pass detected at an F1-score of 0.96. If true, this would show that compiler-optimization techniques are recoverable from circuit snapshots alone, a previously unexamined confidentiality threat to proprietary quantum compilation.

What carries the argument

The load-bearing component is a supervised multi-label classifier trained on circuit-pair fingerprints. Each fingerprint is a human-interpretable feature vector: five global descriptors (depth, total gate count, register width, qubit count, and circuit size), a histogram of the fourteen most common one- and two-qubit gate types, and aggregate sums and ratios of one-qubit versus two-qubit gates. Training data come from a synthetic dataset builder that generates random circuits, applies a random non-empty subset of six baseline optimization passes plus, with probability 0.25, one of two miscellaneous passes, and records the applied-pass one-hot vector as ground truth. The features let the model separate passes by signatures such as depth reduction or changes in two-qubit gate counts.

What would settle it

Generate circuit pairs using an optimization pass held out from the eight training labels, or using a different pass ordering, and test the trained model; if detection performance drops to chance, the claimed inference does not generalize beyond the fixed training menu.

Watch

Extended reading notes

Core claim

The central claim is that structural differences between an original quantum circuit and its optimized form carry a detectable fingerprint of the optimization passes that were applied. On 10,000 randomly generated circuits with a fixed menu of eight optimization techniques, a neural-network multi-label classifier achieves a Hamming score of 0.682, meaning it correctly identifies about 68 percent of the passes in each circuit. Pass-specific results range from F1-score 0.96 for template optimization, the most structurally distinctive pass, down to roughly 0.5 for passes whose effects overlap, and 0.10 for the catch-all miscellaneous class.

Load-bearing premise

The classifier is trained on ground-truth labels of which passes were applied, but the stated black-box threat model gives the adversary only the original and optimized circuits, not those labels.

Editorial extensions

If this is right

A black-box observer with access only to original and optimized circuits can decide, with measurable confidence, which of a fixed menu of optimization passes a compiler applied.
Compiler optimization recipes become a recoverable asset: a competitor could compare a paid service's output against known pass signatures and infer parts of its proprietary pipeline.
The same classifier can serve as a compiler-forensics tool, letting users verify whether a vendor applied a specific optimization such as a CNOT-cancellation stage.
Because the miscellaneous class is detected poorly, unknown or novel passes are not reliably exposed, so the demonstrated threat currently applies to known techniques only.
The reported performance suggests that future work on secure quantum compilation must treat pass-level information as sensitive, not just the circuit or the coupling map.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The reported accuracy likely overstates the real attack, because the threat model gives the adversary only circuits while the training procedure requires labels of which passes were applied; obtaining those labels in practice is the hard part.
A more realistic attack could replace author-generated labels with labels obtained by differential testing: toggle candidate passes on and off, submit the same circuit, and record which candidate best explains each observed output.
The deliberately shallow feature set leaves room for richer circuit signatures, such as commutation structure, local gate-cancellation events, or learned embeddings of the circuit DAG, which could separate the passes currently stuck near F1 0.5.
The method's success on random circuits may not transfer directly to structured algorithmic circuits, whose optimization footprints differ; testing on variational or algorithmic workloads would be a natural next step.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper before anything else: the task is genuinely new, and the central security claim is undermotivated by the paper's own experimental setup. The authors propose inferring which Qiskit optimization passes were applied to a circuit from the original/compiled pair, and they report a neural net with Hamming score 0.68. That's a legitimate first step, but the numbers come from an evaluation where the adversary already knows the ground-truth passes, which is not the threat model they describe.

What's actually new: prior reverse-engineering work in this area recovers quantum ML circuits or coupling maps, not optimization passes. So the problem formulation is a small but real contribution, and the paper may be the first to state it. The methodology is routine—hand-crafted features plus off-the-shelf classifiers—but the execution is clean. They generate 10k random circuits, use an 80/20 split, and honestly report per-pass F1 scores. The fact that TemplateOptimization gets 0.96 F1 and Miscellaneous gets 0.10 is informative: there is a detectable footprint for a strong pass, and catch-all detection doesn't work.

Where it falls short is exactly where the stress-test note lands. Algorithm 1 builds the one-hot labels from the authors' own random selection of passes. A black-box adversary in Section 3.1 sees only circuit pairs through an API, never labels. The paper tries to close the gap with the Miscellaneous class, but it fails with F1=0.10. So the evaluation is an upper bound under perfect label access. For the security story, that's load-bearing. A proprietary compiler with unknown passes is precisely the case where the model fails. The paper's own Limitations section admits this, yet the abstract still claims 'demonstrates the viability of this threat.' That claim is too strong.

Also minor: no code or data released, no error bars across runs, and only one circuit depth (50) and qubit range [4,12]. Those are minor at proof-of-concept stage, but they'd matter in a full version.

Who is this for? Quantum compiler developers and security researchers. It's useful as a first feasibility study for compiler forensics—e.g., checking whether a vendor used specific standard passes—not as a demonstration of an IP theft threat. I would send it to peer review, but with the expectation that the authors either rework the evaluation to match the threat model (for instance, using a held-out compiler or a self-labeling strategy) or considerably soften the security conclusions and reframe the contribution as a forensics method for known passes.

Referee Report

4 major / 6 minor

Summary. The paper proposes a machine-learning framework to reverse-engineer which quantum-circuit optimization passes a black-box compiler applies, by comparing structural features of original and transpiled circuits. Circuits are generated with Qiskit's random_circuit, a random non-empty subset of six 'baseline' Qiskit passes is applied, and a 'miscellaneous' class is simulated by additionally applying one of two other passes with probability 0.25. From each circuit pair the authors extract simple, human-interpretable statistics (depth, gate counts, per-gate histograms, aggregate ratios). They train random forest, logistic regression, gradient boosting, kNN, and a neural network on 10,000 samples (80/20 split) for multi-label classification. The neural network achieves the best overall Hamming score of 0.682 and average F1 of 0.594; per-pass F1 reaches 0.96 for TemplateOptimization but stays near 0.49-0.51 for the other baseline passes, and drops to 0.10 for the Miscellaneous class. The authors conclude that their initial study demonstrates the viability of a threat to compiler confidentiality.

Significance. If the central claim were fully supported, this would be a worthwhile first contribution to a genuinely new security question: inferring the optimization strategy of a proprietary quantum compiler from input/output circuit pairs. The paper is transparent about its experimental setup, uses a clean train/test split on a reasonably sized synthetic dataset, and its feature set is simple and reproducible in spirit. However, as presented, the claim of a viable confidentiality threat is substantially weakened by two structural gaps: the supervised learning setup requires ground-truth pass labels that the stated adversary never possesses, and the measured performance is largely driven by one easy pass while most passes are detected at levels close to what a trivial or heavily imbalanced baseline would achieve. The paper is best read as a proof of concept for fingerprinting known passes of a known open-source compiler, not for reverse-engineering proprietary and unknown optimization techniques.

major comments (4)

[Section 3.1 and Section 4.2, Algorithm 1] The threat model grants the adversary only (C_orig, C_opt) pairs from a black-box API, with no labels indicating which passes were applied. Yet Algorithm 1 generates the ground-truth label vector y from the authors' own random pass selection, and the supervised classifiers are trained on these labels. A real adversary targeting a proprietary compiler would never receive such labels; the evaluation therefore assumes away the very knowledge the attack is meant to extract. This is a load-bearing gap: the reported Hamming score of 0.682 is an upper bound under perfect label access, not a demonstration of the stated threat. The paper should either relax the threat model to a 'known compiler fingerprinting' setting (where labels are available, e.g., from an open-source compiler) or provide an unsupervised or semi-supervised evaluation that does not require pass labels.
[Table 1, Table 2, Section 5.2] The overall metrics are dominated by TemplateOptimization (F1=0.96), while the other five baseline passes all have F1 near 0.49-0.51. The paper acknowledges this but does not compare against a trivial baseline such as majority-class prediction or a random multi-label predictor. Given the dataset's label distribution is not reported, it is unclear whether the model beats random guessing for the hard passes at all. The claim that the framework can 'infer underlying optimization techniques' in general is not supported by the per-pass results; at best it supports detecting one pass with a very distinctive structural footprint. The paper should report class frequencies, a random/majority baseline, and per-pass precision/recall in a way that lets the reader judge how much signal exists beyond the easy pass.
[Section 5.2, Miscellaneous row; Section 5.3] The Miscellaneous class, designed to simulate the presence of unknown or proprietary passes, achieves F1=0.10 (precision 0.25, recall 0.07). This is direct evidence that the model fails to detect passes outside its predefined set. Since the paper's stated target is proprietary compilers whose optimization techniques are by definition outside the six known Qiskit passes, the Miscellaneous result contradicts the conclusion that the threat to compiler confidentiality is viable. The discussion in Section 5.3 that 'the model can flag unrecognized patterns (Miscellaneous label) with effective feature engineering' is speculative; the current feature set is not effective for this purpose, as the paper itself notes. The authors need to either demonstrate a better-performing unknown-pass detection mechanism or explicitly scope the claimed threat to compilers that use exactly the known, pre-trained pass set.
[Section 4.2 and Section 5.1] The evaluation is conducted exclusively on Qiskit-generated random circuits with qubit counts in [4,12] and depth 50. No experiments are run on algorithmic benchmarks (e.g., QASMBench, MQTBench) or on circuits compiled by other compilers such as TKET or proprietary systems. Random circuits may not reflect the structured gate patterns of real quantum workloads, and the feature statistics may behave differently on such patterns. The claim of 'extensive evaluation' is therefore overstated with respect to generalizability. A minimal additional experiment on a few standard benchmark circuits would substantially strengthen the external validity of the results.

minor comments (6)

[Abstract and Section 1] The abstract says 'thousands of quantum circuits' and the paper evaluates 10,000; this is fine, but the phrasing 'extensive evaluation' should be tempered to 'synthetic evaluation' given the reliance on randomly generated circuits.
[Algorithm 1, line 9] The label vector y is described as 'one-hot', but since multiple baseline passes can be applied simultaneously, the label vector is multi-hot (binary with several 1s). Please correct the terminology.
[Section 5.1, Table 1] The pass listed in the text as 'CommutationAnalysis + CommutativeCancellation' appears in Table 1 as 'CommutationCancel'. Use a consistent name to avoid confusing readers.
[Section 5.1] The rationale for the Miscellaneous inclusion probability of 0.25 is unclear: 'since it comprises 2 techniques out of 8 total' does not justify 0.25, as the two miscellaneous passes are not counted individually in the label vector. Please clarify the intended probability model.
[Section 4.3] The feature list includes both 'qubit count' and 'register width' as well as 'circuit size'; these descriptors may be redundant. Please define each precisely and state which features are used in the final vector.
[General] No code or dataset is provided. For a machine-learning paper whose main artifact is the dataset builder and feature extraction, releasing the code (or at least the exact pass configurations and random seeds) would greatly aid reproducibility; please consider including it.

Circularity Check

1 steps flagged · score 3.0 of 10

The supervised classifier is trained on pass labels that the paper's own PassManager generates (Algorithm 1), while the stated black-box adversary never receives such labels, so the reported F1/Hamming scores are in-distribution results on the authors' synthetic label space rather than validated predictions about unknown proprietary passes.

fitted input called prediction [Algorithm 1, lines 5–9 and Section 4.2; threat model in Section 3.2]
"The optimization choices made in this step become the ground-truth one-hot label vector that the classifier is trained on. [Sec. 4.2] ... the adversary trains an ML-based model to infer details about the proprietary algorithm using only the input (original) and output (optimized) quantum circuits. [Sec. 3.2]"

The attack is supposed to infer a proprietary compiler's optimization passes from (C_orig, C_opt) alone, but the training labels in Algorithm 1 (y← OneHot(S_b)) are created by the authors' own random pass selection. A black-box adversary, as described in Section 3.2, never obtains these one-hot labels; obtaining them would require already knowing which passes were applied, which is exactly the knowledge the attack claims to extract. The 'Miscellaneous' class is likewise not truly unknown: it is a bucket of two known Qiskit passes, and Section 5.3 concedes that passes entirely outside the predefined set lead to misclassification.

full rationale

This is not an equation-level circularity, and there is no load-bearing self-citation chain: the paper trains standard ML models on a held-out split of a synthetic dataset, so within that dataset the evaluation is methodologically sound. However, the central claim that the results demonstrate the viability of a threat to compiler confidentiality is partially circular. Section 4.2 states that the PassManager's optimization choices 'become the ground-truth one-hot label vector,' while Section 3.2 defines an adversary who sees only original and optimized circuits through an API and has no access to such labels. The paper therefore supplies the answer key for the very classification task it presents as a black-box inference. The model's success is real only for the six baseline and two miscellaneous Qiskit passes chosen by the authors; the poor Miscellaneous F1 (0.10) and the paper's own limitation statement confirm that truly novel passes are not handled. Because the prediction target is generated by the same pipeline that defines the training distribution, the threat-model conclusion overreaches the evidence, though the held-out test set prevents the score from being higher.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper does not introduce new physical or algorithmic entities. Its load-bearing assumptions are domain choices: that random circuits stand in for real workloads, that a small fixed set of Qiskit passes represents proprietary optimization, that global circuit statistics carry enough signal, and most critically that the adversary has access to labeled training data despite the black-box threat model.

free parameters (3)

misc_inclusion_probability = 0.25
Probability of adding a miscellaneous pass to the pipeline, chosen by hand. It controls the prevalence of the miscellaneous label and directly affects the reported F1-score for that class.
random_circuit_depth = 50
Circuit depth used for all generated random circuits, chosen by hand as a representative near-term depth.
qubit_range = [4, 12]
The uniform range for the number of qubits in generated circuits, chosen by hand; the paper states this as the default evaluation setting.

assumptions (5)

domain assumption Random circuits generated by Qiskit's random_circuit, with 4-12 qubits and depth 50, approximate the structure of real quantum workloads.
Section 4.2 justifies this by citing approximate unitary t-designs, but no real algorithmic circuits are tested.
domain assumption The hand-picked set of six baseline and two miscellaneous Qiskit passes is representative of the optimization techniques used by proprietary compilers.
Section 4.1 states the passes were chosen to cover the spectrum of likely production optimizations. If a real compiler uses novel passes, the classifier was not trained to detect them, as the paper itself notes in Section 5.3.
domain assumption Global structural features (depth, total gate counts, gate type histogram, aggregate ratios) are sufficient to discriminate the applied optimization passes.
Section 4.3 argues these features reflect a human expert's view. The low F1-scores for most passes in Table 1 indicate the assumption is only partially true.
domain assumption The adversary can obtain labeled training data, meaning pairs of circuits together with the identities of the passes that were applied.
The threat model in Section 3.1 gives the adversary only original and optimized circuits, while Algorithm 1 in Section 4.2 generates ground-truth labels by applying known passes. The paper never explains how a real adversary would obtain these labels.
domain assumption Multi-label supervised learning on synthetic pass combinations generalizes to the pass selection behavior of an unseen target compiler.
The evaluation is entirely within the synthetic data distribution; no real or unseen compiler is tested.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots." pith.science (2026). https://pith.science/paper/X44MYQYI

@misc{pith2026250419113,
  author       = {Pith},
  title        = {Pith review of: Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X44MYQYI}},
  note         = {Machine review of arXiv:2504.19113}
}

read the original abstract

Circuit compilation, a crucial process for adapting quantum algorithms to hardware constraints, often operates as a ``black box,'' with limited visibility into the optimization techniques used by proprietary systems or advanced open-source frameworks. Due to fundamental differences in qubit technologies, efficient compiler design is an expensive process, further exposing these systems to various security threats. In this work, we take a first step toward evaluating one such challenge affecting compiler confidentiality, specifically, reverse-engineering compilation methodologies. We propose a simple ML-based framework to infer underlying optimization techniques by leveraging structural differences observed between original and compiled circuits. The motivation is twofold: (1) enhancing transparency in circuit optimization for improved cross-platform debugging and performance tuning, and (2) identifying potential intellectual property (IP)-protected optimizations employed by commercial systems. Our extensive evaluation across thousands of quantum circuits shows that a neural network performs the best in detecting optimization passes, with individual pass F1-scores reaching as high as 0.96. Thus, our initial study demonstrates the viability of this threat to compiler confidentiality and underscores the need for active research in this area.

Figures

Figures reproduced from arXiv: 2504.19113 by the authors.

**Figure 1.** High-level overview of the threat model demonstrating a scenario where a stealthy adversary can infer details about black-box circuit-optimization software from the original and optimized circuits. shots), and the most frequent outcomes are considered the final results. 2.2 Quantum Circuit Compilation Quantum-circuit compilation [12, 15, 18] transforms an algorithm level circuit, expressed in an idealized gate set,… view at source ↗

**Figure 2.** Pipeline Overview: (1) Circuit pairs are gen [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 15 canonical work pages

[1]

Rajeev Acharya et al . 2024. Quantum error correction below the surface code threshold. Nature (2024)

work page 2024
[2]

Fan Chen, Lei Jiang, Hausi Müller, Philip Richerme, Cheng Chu, Zhenx- iao Fu, and Min Yang. 2024. NISQ Quantum Computing: A Security- Centric Tutorial and Survey [Feature]. IEEE Circuits and Systems Magazine 24, 1 (2024), 14–32

work page 2024
[3]

Frederic T Chong, Diana Franklin, and Margaret Martonosi. 2017. Programming languages and compiler design for realistic quantum hardware. Nature 549, 7671 (2017), 180–187

work page 2017
[4]

Navnil Choudhury et al. 2024. Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers. arXiv preprint arXiv:2412.10507 (2024)

arXiv 2024
[5]

Atom Computing. 2023. Quantum startup Atom Computing first to exceed 1,000 qubits. Press Release. Accessed: Oct 28 (2023)

2023
[6]

Jay Gambetta. 2023. The hardware and software for the era of quantum utility is here

2023
[7]

Archisman Ghosh and Swaroop Ghosh. 2024. The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models. In Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security. 48–57

work page 2024
[8]

Jonas Haferkamp. 2022. Random quantum circuits are approximate unitary t-designs. Quantum 6 (2022), 795

work page 2022

Show all 23 references

[9]

Nathan Killoran, Josh Izaac, Nicolás Quesada, Ville Bergholm, Matthew Amy, and Christian Weedbrook. 2019. Strawberry fields: A software platform for photonic quantum computing. Quantum 3 (2019), 129

2019
[10]

Fabian Kreppel et al. 2023. Quantum circuit compiler for a shuttling- based trapped-ion quantum computer. Quantum 7 (2023), 1176

2023
[11]

Satwik Kundu and Swaroop Ghosh. 2024. Adversarial poisoning attack on quantum machine learning models. arXiv preprint arXiv:2411.14412 (2024)

2024 arXiv
[12]

Gushu Li, Yufei Ding, and Yuan Xie. 2019. Tackling the qubit mapping problem for NISQ-era quantum devices. In Proceedings of the twenty- fourth international conference on architectural support for programming languages and operating systems . 1001–1014

2019
[13]

IBM Quantum. [n. d.]. Introduction to Transpilation . https://docs. quantum.ibm.com/guides/transpile
[14]

Microsoft Azure Quantum et al . 2025. Interferometric single-shot parity measurement in InAs–Al hybrid devices. Nature 638, 8051 (2025), 651–655

2025
[15]

Nils Quetschlich, Lukas Burgholzer, and Robert Wille. 2025. MQT Predictor: Automatic device selection with device-specific circuit com- pilation for quantum computing. ACM Transactions on Quantum Computing 6, 1 (2025), 1–26

2025
[16]

Christian Rasmussen and Samah Mohamed Saeed. 2024. Time-Aware Re-Synthesis for Secure Quantum Systems. In 2024 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) . IEEE, 01–06

2024
[17]

Rupshali Roy, Archisman Ghosh, and Swaroop Ghosh. 2024. Foren- sics of Transpiled Quantum Circuits. arXiv preprint arXiv:2412.18939 (2024)

2024 arXiv
[18]

Francisco JR Ruiz et al . 2025. Quantum circuit optimization with alphatensor. Nature Machine Intelligence (2025), 1–12

2025
[19]

Abdullah Ash Saki et al. 2021. Split compilation for security of quantum circuits. In 2021 IEEE/ACM International Conference On Computer Aided Design (ICCAD). IEEE, 1–7

2021
[20]

Seyon Sivarajah, Silas Dilkes, Alexander Cowtan, Will Simmons, Alec Edgington, and Ross Duncan. 2020. t| ket>: a retargetable compiler for NISQ devices. Quantum Science and Technology 6, 1 (2020), 014003

2020
[21]

Yizhuo Tan, Navnil Choudhury, Kanad Basu, and Jakub Szefer. 2025. QubitHammer Attacks: Qubit Flipping Attacks in Multi-tenant Su- perconducting Quantum Computers. arXiv preprint arXiv:2504.07875 (2025)

2025 arXiv
[22]

Chuanqi Xu and Jakub Szefer. 2024. Security Attacks Abusing Pulse- level Quantum Circuits. In 2025 IEEE Symposium on Security and Pri- vacy (SP). IEEE Computer Society, 83–83

2024
[23]

Henry Zou, Matthew Treinish, Kevin Hartman, Alexander Ivrii, and Jake Lishman. 2024. LightSABRE: A Lightweight and Enhanced SABRE Algorithm. arXiv preprint arXiv:2409.08368 (2024)

2024 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Rajeev Acharya et al . 2024. Quantum error correction below the surface code threshold. Nature (2024)

work page 2024

[2] [2]

Fan Chen, Lei Jiang, Hausi Müller, Philip Richerme, Cheng Chu, Zhenx- iao Fu, and Min Yang. 2024. NISQ Quantum Computing: A Security- Centric Tutorial and Survey [Feature]. IEEE Circuits and Systems Magazine 24, 1 (2024), 14–32

work page 2024

[3] [3]

Frederic T Chong, Diana Franklin, and Margaret Martonosi. 2017. Programming languages and compiler design for realistic quantum hardware. Nature 549, 7671 (2017), 180–187

work page 2017

[4] [4]

Navnil Choudhury et al. 2024. Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers. arXiv preprint arXiv:2412.10507 (2024)

arXiv 2024

[5] [5]

Atom Computing. 2023. Quantum startup Atom Computing first to exceed 1,000 qubits. Press Release. Accessed: Oct 28 (2023)

2023

[6] [6]

Jay Gambetta. 2023. The hardware and software for the era of quantum utility is here

2023

[7] [7]

Archisman Ghosh and Swaroop Ghosh. 2024. The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models. In Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security. 48–57

work page 2024

[8] [8]

Jonas Haferkamp. 2022. Random quantum circuits are approximate unitary t-designs. Quantum 6 (2022), 795

work page 2022