Cross-talk Vulnerabilities in Cloud-based Quantum Computers

Cross-talk Vulnerabilities in Cloud-based Quantum Computers

Speakers: Jakub Szefer, Associate Professor of Electrical and Computer Engineering, Northwestern University

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=HQzR-V7CcHw

Overview

This article delves into the critical and emerging field of security for cloud-based quantum computers, specifically focusing on cross-talk attacks and vulnerabilities. Presented by Jakub Szefer, Associate Professor of Electrical and Computer Engineering at Northwestern University, this talk highlights the inherent security risks in the rapidly evolving quantum computing landscape. As quantum processors become increasingly powerful and accessible via cloud platforms, the potential for malicious exploitation of their fundamental physical properties grows, posing significant threats to intellectual property, hardware integrity, and the reliability of quantum computations.

The core premise of the research presented is that despite the advanced capabilities of modern quantum machines, they currently lack robust security features beyond standard network encryption and cloud environment protections. This gap creates an opportunity for attackers to leverage intrinsic imperfections and noise within the quantum processing units (QPUs) to disrupt, degrade, or even manipulate computations. Szefer's work serves as a crucial call to action for the security community to proactively address these challenges, demonstrating practical attack vectors on real-world quantum hardware and proposing initial defensive strategies.

The talk underscores that while quantum computers are not yet performing widespread, impactful computations, their accelerating development—with projections of thousands of physical cubits in the near future—makes early security research imperative. By exposing cross-talk vulnerabilities, the research provides a foundational understanding of how an attacker, co-located with a victim on a shared quantum chip, can interfere with sensitive quantum algorithms, thereby compromising the integrity of results. This exploration is particularly relevant as the industry considers future multi-tenancy models for these expensive and scarce resources.

Background

▶ Watch: Introduction: Why quantum computer security matters (0:00)

The rapid advancement of quantum computing technology has led to a significant increase in investment from major tech companies like IBM, Google, Amazon, and Microsoft, as well as specialized quantum firms like Rigetti and Quantinuum. These efforts have pushed the number of accessible physical qubits from a handful a few years ago to 100-200 today, with roadmaps projecting thousands in the coming years. Critically, most of these machines are not physically owned by end-users but are accessed remotely through cloud-based deployment models, such as IBM Quantum Experience, AWS Braket, and Azure Quantum. This remote access, while democratizing quantum computing, introduces a complex security perimeter.

A significant concern highlighted by Szefer is the current lack of dedicated security features within these cloud-based quantum environments. While the classical networking and cloud infrastructure benefit from standard cryptographic protections, the interaction directly with the QPU—the core quantum hardware—is largely unprotected. There are no robust security checks or features to prevent malicious operations once a user's quantum circuit is loaded onto the machine. This oversight is particularly alarming given the growing ecosystem of companies (e.g., Wells Fargo, JP Morgan, AstraZeneca) developing proprietary quantum algorithms and handling sensitive intellectual property that will eventually be executed on these QPUs.

The attack surface of a quantum computing system is multifaceted. Beyond the QPU itself, vulnerabilities can exist in the quantum computer controller (the classical hardware that translates user instructions into analog signals for the qubits), the communication channels (where unencrypted analog signals drive the qubits), classical co-processors used for algorithm optimization, and even the quantum compilers that translate high-level code to hardware instructions. The talk emphasizes that traditional cryptographic methods are ill-suited for protecting the physical QPU or the analog signals driving it, necessitating novel security approaches.

To understand the vulnerabilities, a basic grasp of quantum mechanics is essential. Qubits, unlike classical bits, can exist in superposition (a combination of 0 and 1 simultaneously) and exhibit entanglement (where the state of one qubit is correlated with another, even across distances). The computational power of quantum algorithms largely stems from interference, where the probability amplitudes of different computational paths constructively or destructively interfere to amplify the correct solution. These qubits are implemented using various physical means, with superconducting qubits (manufactured circuits on CMOS-like chips) being a dominant architecture, alongside trapped ions. This talk specifically focuses on superconducting qubits due to their unique susceptibility to cross-talk.

The physical layout of superconducting QPUs is characterized by a fixed topology, where qubits (represented as dots) are connected by couplers (lines). These couplers are necessary for performing two-qubit quantum gates. A key constraint is that two-qubit operations can only occur between adjacent qubits. If non-adjacent qubits need to interact, their states must first be swapped, adding complexity and potential for error. A user's quantum computation is expressed as a quantum circuit, a sequence of quantum gates applied to qubits over time, culminating in a measurement that yields classical 0s and 1s as the computation's result.

Key Findings

▶ Watch: Quantum computing basics: Qubits and gates (10:00)

The talk's central revelation is the practical exploitation of inherent noise and imperfections in quantum hardware, a characteristic of the current noisy intermediate scale quantum (NISQ) era. Modern quantum gates are not perfect, exhibiting error rates typically in the range of 10^-4 to 10^-5. This unavoidable noise, coupled with the physical proximity of qubits, creates cross-talk: unintentional interactions between qubits or circuits. Szefer demonstrates that this cross-talk can be weaponized as a security vulnerability.

The initial research, conducted on a 5-qubit IBM machine, proved that a malicious circuit (attacker) running concurrently with a benign circuit (victim) could significantly disrupt the victim's computation. The primary attack mechanism involved the attacker executing a sequence of many C-NOT gates. While these two-qubit gates are fundamental to quantum computation, when executed repeatedly and without a computational purpose, they generate substantial noise and interference that propagate through the physical substrate of the chip.

A crucial aspect of this attack is bypassing the quantum compiler's optimizations. Compilers typically attempt to remove redundant or "nonsense" gates to improve efficiency. However, the researchers found that by inserting small delays or other non-optimizable gates (e.g., an identity gate or a barrier) between the noisy C-NOT gates, the compiler is tricked into preserving the malicious circuit. The experimental results, presented as graphs from IBM machines, clearly showed that for a victim running a Grover's algorithm (a search algorithm), the probability of obtaining the correct solution was significantly reduced, while the probabilities of incorrect solutions increased. For other algorithms like Bernstein-Vaserani, the cross-talk could even cause a state flip, for example, from 01 to 00.

Subsequent research further refined these cross-talk attacks:

• Two-sided Attack (Rowhammer-like): Inspired by classical rowhammer attacks, a "two-sided" cross-talk attack was demonstrated. By actuating attacker qubits on both sides of an idle victim qubit, researchers were able to reliably flip the state of the victim qubit (e.g., from 0 to 1 or 1 to 0). This highlights that even an inactive qubit can be vulnerable if its neighbors are maliciously manipulated.
• Non-Adjacent Cross-Talk: The research also revealed that cross-talk is not limited to physically adjacent qubits. Due to complex coupling through the substrate or specific chip layouts, gates executed on qubits 8 and 9 in an IBM topology were shown to affect qubits 19 and 22, which are logically far apart. This implies that attackers and victims do not need to be immediate neighbors on the quantum chip to interact maliciously.
• Frequency-Based Attack: A particularly sophisticated attack leverages the fact that each superconducting qubit operates at a unique resonant frequency. An attacker can drive their own qubits with control pulses that are at the wrong frequency for their own qubits but match the resonant frequency of a distant victim qubit. This "sympathetic excitation" can cause the victim qubit's state to flip. For example, driving 20-30 attacker qubits with the frequency meant for victim qubit 0 could reduce qubit 0's probability of being in the 0 state from 100% to 20%, effectively flipping its state.

These findings collectively demonstrate that current quantum hardware, especially superconducting architectures, is vulnerable to a range of sophisticated cross-talk attacks that exploit fundamental physical properties and current limitations in security design. The implications are profound, especially as the industry moves towards potential multi-tenancy on these powerful machines.

Technical Deep Dive

▶ Watch: First cross-talk attack demo on IBM machines (24:00)

The technical foundation of cross-talk vulnerabilities in superconducting qubits lies in their physical implementation. These qubits are essentially artificial atoms, fabricated as superconducting circuits using Josephson junctions embedded in a planar 2D chip. These circuits behave as non-linear resonators, and their quantum states (0 and 1) correspond to different energy levels. The control and measurement of these states are achieved by applying precisely tuned microwave pulses (the analog signals from the quantum computer controller).

The problem arises from the inherent parasitic interactions within these dense, integrated circuits. Just like in classical integrated circuits, there are unintended capacitive and inductive couplings between adjacent (and sometimes non-adjacent) components. When a microwave pulse is applied to one qubit to perform a quantum gate operation, it inevitably generates electromagnetic fields that can "leak" and influence neighboring qubits. This is the essence of cross-talk. For example, a C-NOT gate, being a two-qubit operation, requires strong interaction between two qubits via a coupler. The intense microwave pulses and transient fields generated during such an operation are a potent source of cross-talk noise.

The effectiveness of using a large number of C-NOT gates as an attacker circuit stems from this. While a single C-NOT gate might introduce some noise, a rapid sequence of them, especially if they are redundant from a computational perspective, floods the local environment of the attacker qubits with significant electromagnetic interference. This interference then propagates through the shared substrate, affecting the delicate quantum states of nearby victim qubits. The energy from these pulses can cause victim qubits to dephase, transition to incorrect states, or simply become more noisy, leading to a higher probability of error upon measurement.

The compiler optimization bypass is a clever technique. Quantum compilers, like classical compilers, perform various optimizations, such as gate cancellation (e.g., two Hadamard gates cancel each other out) or redundant gate removal. A circuit composed solely of CX q0, q1; CX q0, q1; CX q0, q1; ... might be optimized away because CX followed by CX on the same qubits is an identity operation. To circumvent this, the researchers inserted "dummy" operations or delays. For instance, placing an id q0 (identity gate on qubit 0) or a barrier instruction between C-NOT gates makes the sequence appear non-redundant to the compiler, forcing it to execute the noisy operations. This ensures the malicious noise generation persists.

The frequency-based attack exploits another fundamental characteristic: each superconducting qubit has a slightly different resonant frequency. This differentiation is crucial for individually addressing and controlling qubits without interfering with others. However, an attacker can turn this feature into a vulnerability. If an attacker knows the precise resonant frequency of a distant victim qubit (which can often be inferred from public calibration data or by probing), they can craft control pulses that are tuned to the victim's frequency but applied to their own attacker qubits. While these pulses will not perform a meaningful operation on the attacker's qubits (because they are at the wrong frequency for those qubits), they act as a "broadcast" signal. If enough attacker qubits are simultaneously driven with this specific frequency, the cumulative electromagnetic field can be strong enough to excite the victim qubit, even if it's physically distant. This sympathetic excitation causes the victim qubit to undergo unintended state changes or dephasing, leading to erroneous computation. The experimental results showed that applying such pulses to 20-30 attacker qubits could significantly shift the probability distribution of a victim qubit, demonstrating a clear state manipulation.

These attacks highlight that the physical reality of quantum hardware, with its intrinsic noise, coupling, and frequency specificity, offers a rich attack surface that cannot be secured by classical software-level defenses alone.

Demo / Proof of Concept

▶ Watch: Advanced cross-talk: Two-sided and distant cubit attacks (29:00)

The talk's findings are not theoretical; they are grounded in empirical evidence derived from experiments conducted on real IBM quantum machines. This hands-on approach lends significant credibility to the identified vulnerabilities. The speaker explicitly mentions using a 5-qubit IBM machine for the initial demonstrations of cross-talk, which at the time (around 2022) represented the state-of-the-art for accessible quantum hardware. Later experiments likely utilized larger IBM machines, given references to 127-qubit topologies and interactions between qubits 8/9 and 19/22.

The proof of concept for the basic cross-talk attack involved designing two types of quantum circuits:

1. Victim Circuits: These were standard, well-known quantum algorithms like Grover's algorithm or the Bernstein-Vaserani algorithm. The expected output for these circuits, when run without interference, is a specific state with a high probability. For instance, a two-qubit Grover's search might ideally yield the 11 state with near 100% probability.
2. Attacker Circuits: These were custom-designed to generate maximum noise. The primary attacker circuit consisted of a repeated sequence of C-NOT gates, often interspersed with barrier or identity gates to prevent compiler optimization. The attacker's qubits were typically chosen to be physically adjacent or in close proximity to the victim's qubits on the quantum chip.

The experimental methodology involved running the victim circuit both in isolation (baseline) and co-located with the attacker circuit. The output probabilities for each possible state were then measured and compared. The graphs presented in the talk visually demonstrated the impact:

• In the baseline (no attack) scenario, the target state of the victim circuit (e.g., 11 for Grover's) would show a dominant probability peak.
• Under attack, this dominant peak would significantly decrease, and the probabilities of other, incorrect states would increase. For example, a correct solution probability might drop from 80% to 50%, or a state like 01 could shift to 00 with higher probability.

For the two-sided attack, the demonstration involved an idle victim qubit flanked by two attacker qubits. Specific pulse sequences were applied to the attacker qubits, and the state of the victim qubit was measured before and after, showing a clear state flip (e.g., 0 to 1). The frequency-based attack was demonstrated by programming attacker qubits to emit pulses at a frequency matching a distant victim qubit. The resulting probability tables showed a clear shift in the victim qubit's state probabilities, indicating successful manipulation despite physical separation.

These empirical results on commercial quantum hardware provide compelling evidence that cross-talk is not merely a theoretical concern but a practical vulnerability that can be exploited by a malicious user in a shared quantum computing environment.

Defensive Implications

▶ Watch: Summary, defenses, and future multi-tenancy challenges (33:00)

The existence of cross-talk attacks on cloud-based quantum computers necessitates a proactive and multi-layered approach to security. The current lack of dedicated security features beyond standard network encryption is a critical gap that must be addressed by quantum hardware manufacturers and cloud providers.

One immediate defensive measure is the development of anti-virus type programs or quantum circuit anomaly detectors. These systems would analyze incoming quantum circuits for patterns indicative of malicious cross-talk generation, such as unusually high densities of noisy gates (e.g., repeated C-NOT gates without clear computational purpose) or anomalous pulse sequences. Such a system could flag or quarantine suspicious circuits, preventing them from being executed on the QPU.

Isolation is another fundamental defense. If multi-tenancy is to be safely implemented, quantum circuits from different users should ideally be run on physically separate QPUs or, at a minimum, on geographically distinct and non-interacting sections of a larger quantum chip. Intelligent scheduling methods could play a role here, ensuring that sensitive victim circuits are not co-located with potentially malicious attacker circuits. This might involve spatial separation or temporal scheduling, where users are given exclusive access to the QPU for a defined period, preventing concurrent execution.

Compiler enhancements are also crucial. Beyond merely optimizing for performance, quantum compilers need to become "security-aware." They could be designed to detect and neutralize cross-talk-inducing patterns, perhaps by automatically inserting additional buffering gates, reordering operations to minimize noise propagation, or even refusing to compile circuits deemed overly malicious. However, this must be balanced with the need for legitimate, complex quantum algorithms that might inherently use many gates.

From a hardware perspective, future QPU designs could incorporate better physical shielding, improved isolation between qubits, or active noise cancellation techniques to mitigate cross-talk. However, these are complex engineering challenges that might impact qubit density or performance. The move towards modular or chiplet architectures, while potentially enabling larger qubit counts and easier multi-tenancy, also introduces new cross-talk vulnerabilities at the inter-chiplet level, requiring careful design considerations.

Finally, the industry must re-evaluate its approach to multi-tenancy. Given the demonstrated vulnerabilities, it's possible that widespread multi-tenancy on a single quantum chip might be deemed too risky in the near term. Instead, a model where each user gets exclusive access to a dedicated QPU or a highly isolated partition might become the norm, even if it impacts resource utilization. The tension between maximizing the utility of expensive quantum machines and ensuring their security against these novel attacks will be a defining challenge for the quantum computing industry.

Key Takeaways

• Cloud-based quantum computers are vulnerable to sophisticated cross-talk attacks that exploit inherent noise and imperfections in quantum hardware.
• Attackers can disrupt, degrade, or manipulate victim quantum computations by executing carefully crafted malicious circuits on co-located qubits.
• Demonstrated attack techniques include repeatedly executing noisy C-NOT gates (with compiler optimization bypasses), rowhammer-like two-sided attacks on idle qubits, and frequency-based attacks that exploit unique qubit resonant frequencies.
• These vulnerabilities have been experimentally verified and demonstrated on real IBM quantum machines, highlighting their practical relevance.
• The prospect of multi-tenancy on quantum chips poses significant security challenges due to cross-talk, requiring careful consideration of isolation and secure scheduling.
• Effective defenses will require novel approaches, including quantum circuit anomaly detectors, intelligent scheduling methods, security-aware compiler enhancements, and potentially new hardware designs with improved isolation.

About the Speaker(s)

Jakub Szefer is an Associate Professor of Electrical and Computer Engineering at Northwestern University. His research focuses on computer architecture and hardware security. Within the rapidly emerging field of quantum computing, Professor Szefer leads efforts to identify and understand security vulnerabilities in quantum hardware, particularly in the context of cloud-based deployment. His work, as demonstrated in this talk, involves both attacking and proposing defenses for quantum computers, aiming to build a more secure foundation for this transformative technology.