0.0.1 Introduction↩︎

The prospect of quantum computation has long transitioned from a theoretical novelty to an active practical pursuit of useful quantum advantages across many different domains: cryptography and cryptanalysis [1]–[9]; quantum chemistry and material science [10]–[16]; many-body, condensed matter, and high-energy physics [17]–[22], fundamental physics and quantum gravity [23]–[28], combinatorial optimisation [29]–[31], quantum machine learning [32]–[38], etc. Unlike the traditional (classical) computing paradigm of individual hardware ownership,¹ large-scale quantum technologies are inevitably more suited to cloud-based access and “quantum-as-a-service (QaaS)” settings [39], [40]. In this paradigm, a user writes a description for a quantum circuit—implementing some task that she is interested in—and submits it to a service provider, who then goes off and executes this circuit for her on some quantum processing unit (QPU) and later returns a finite-shot sample output.

As far as the user is concerned, cloud-based quantum computing offers an interface through which implementation details are abstracted to such an extent that the hardware itself can feel almost interchangeable. The same interface may expose superconducting, trapped-ion, neutral-atom, simulator backends, etc. often from several hardware providers all through a single high-level account [41], [42]. Physically, of course, the QPUs are decidedly not interchangeable to the service provider, who must care a great deal about each QPU’s calibration history, native gates, topology, crosstalk, readout asymmetries, compilation path, slowly drifting environment, and such related hardware-specific details. Consequently, in the noisy near-term of quantum computation, while the provider can feign some privacy about his choice of backend by hiding the label on his execution routing, it is has been observed that a ‘fingerprint’ specific to the chosen backend will be left in the classical outputs that he returns to the user [43]–[48]. There are two perspectives to take about this observation: (user-side) the user herself may want to be able to verify that her circuit has actually be run on the claimed backend hardware without having to rely on a promise alone; and (provider-side) the provider may want to keep secret his choices of backend routing, with some guarantee about the user’s inability to violate that privacy. In either case, the operational question is equivalent:

There is a large literature on security notions and verifiability for delegated quantum computation, but its dominant emphasis is on user-side privacy and correctness. Blind quantum computation and verifiable blind quantum computation protect the user’s input, output, and computation from an untrusted quantum server, while also allowing the user to detect incorrect behaviour in the verifiable variants [49]–[54]. Quantum verification protocols ask whether a classical verifier, or a verifier with limited quantum capabilities, can certify the correctness of a quantum computation performed by a quantum prover [55]–[62]. Related approaches based on remote or oblivious state preparation, quantum homomorphic encryption, and hardware-assisted secure execution similarly aim to protect the user’s computation or to certify the service outcome under additional cryptographic or hardware assumptions [63]–[66]. Indeed, the aforementioned observations about backend-specific fingerprints [43]–[48] largely take the user-side perspective in their experimental or analytical approaches. Even where provider-side concerns are discussed, the protected mathematical object is never formally given as the anonymity of the provider’s route [67].

In this work, we take the much-neglected provider-side perspective and ask the complementary security questions; namely, to what extent can the provider’s routing choice be anonymised without invalidating the promised service? It is worth emphasising the distinction of this question from the standard user-side perspective, in that we reverse the goals to describe mechanisms through which information is removed/obscured rather than inferred (either experimentally or by analysis of known/assumed noisy behaviour). Our novelty is then the proposal of a unified framework for backend identification which establishes, to our knowledge, the first formalisation of routing anonymity for cloud quantum computing, with supporting statements about how this privacy notion interacts with the information implicit in backend-specific noise fingerprints. We describe precisely how privacy depends jointly on the workload of circuits submitted by the user, the finite-shot resolution of the executing hardware, repeated access, any post-processing of the measured output, and the promised utility. In fact, for the latter, it is interesting in and of itself to describe his privacy as a property of the very service he intends to provide, which we note is explicitly missing from the current (user-side) literature.

We propose a game of backend identifiability in which the provider secretly selects a backend, executes a user-chosen circuit from some agreed ensemble, and returns a classically post-processed outcome distribution from which the user should guess the backend label (0.0.2.1). Our framework formalises how this game can be reduced exactly to a hypothesis testing question, and thus can be modeled statistically and sufficiently described as combinations of binary identification games (0.0.2.2). Under a ‘persistent routing’ extension of the game (which assumes a fixed backend label and passive i.i.d. probing from the user), we can observe a similar reduction to see that anonymity decays at the Chernoff rate. Following this, we describe how post-processing can act as a suppression mechanism for route-specific noise, and then incorporate the promised utility of the service to place fundamental bounds on the degree of anonymity that can be obtained (0.0.2.3). This is formalised as a utility-anonymity no-free-lunch theorem that informs the provider how he should mathematically model his utility with respect to the anonymity he desires. We can understand backend identifiability as existing in an ‘intermediate-depth’ window, and prove this characteristic of distinguishability in a Pauli-transfer-matrix model (0.0.2.4). Finally, we also proposes a new channel (psuedo-)distance which is designed to act as a tight measure on backend distinguishabilty tailored to the user’s workload, which can then be used to provide some simple sufficient conditions on anonymity (0.0.2.5).

To support our framework and theoretical results, we design a series of experiments using Amazon Web Services (AWS) Braket, running on Rigetti’s Ankaa-3, IQM’s Garnet, and IonQ’s Aria-1, to demonstrate how finite-shot transcripts carry route-specific information in practice (0.0.3). These are similar in spirit to existing fingerprinting work [43]–[48], although we distinguish our experimentation in a few key ways to better suit our unique perspective. Firstly, we design multiple suites of experiments to understand different mechanisms of distinguishability; our ‘depth-varied’ experiments use random circuits of varying depth—a far more challenging classification task than we see in most existing literature—while our ‘time-varied’ experiments more closely match those of other works. Secondly, we investigate multiple forms of post-processing on classical outcomes to understand the utility-based arguments of our work, and observe the intermediate-depth principle’s reaction over different transcript forms. Thirdly, we make an explicit and unique effort to visualise how noise fingerprints are learned by simple classifiers, giving an intuition for how separability between backends presents with respect to the workload circuits. We also offer some preliminary ideas and exploration of fingerprint forecasting, in which we indicate how we may be able to predict the evolution of the fingerprint in time, without explicit assumptions on the noise model.

0.0.1.1 Security Motivations and Applications

Motivations for a notion of ‘routing anonymity’ can be relatively direct, particularly in analogy to the classical case, in which routing metadata is ubiquitously security-sensitive. For example, mix networks and onion routing aim to hide communication paths, unlink senders and receivers, or limit what observers can infer from traffic metadata [68]–[70]. More generally, the provider may have any number of valid reasons for wanting to keep his routing choices hidden; e.g. keeping private his scheduling policies, confidentiality agreements that he may have with his hardware providers which require particular implementation details to be kept private from competing parties, preventing users from interpreting QPU loads or inferring times of increased stress, etc.

If the reader would only humour us for a moment, we will now describe a select few toy examples in which a motivation for provider-side security is required immediately by design. The motivation need not be so contrived in typical cases of quantum cloud computation, as we note above, but it is nevertheless interesting to acknowledge specialised settings in which anonymity of routing choice is not only desirable but also application critical. The reader who is convinced about the relevance of routing anonymity can skip this section, humourlessly.

In the following examples, we use the backend as a private verifier/oracle (1) of a user-supplied object; as a private issuer whose signatures must be resistant to imitation (2); and as a hidden target whose identity reveals vulnerabilities (3).

The above quantum lock-and-key example can be viewed more generally as a private oracle whose hidden physical backend defines a decision rule, and whose output is then a backend-specific accept/reject bit. This specific set up is interesting not only for its overt requirements for routing anonymity, but also because it demonstrates a problem setting in which multiple layers of security are required. Notably, Alice is essentially asked to be a middle-woman routing a given key to a privately-known lock, thereby setting up privacy of the key for Bob (assuming that Alice cannot look at the given key, she herself is not able to unlock the vault, except maybe after many attempts) and privacy of the lock for Alice. A ‘double-blind’ security setting, if you like.

In the above example, the condition on the number of probes that Bob can submit prevents him from brute-force finding a slow circuit for each backend in turn; instead he must learn something about how his probe was routed. After \(N-1\) time slots, he will ideally have guessed at which backend each slot had been assigned to, and be left at the final slot with an idea about which backend remains. He can then design a probe which he knows will be slow for this final backend, and if his guess is right, he will win the game and make Alice late for bed. Clearly then, it is in Alice’s interest to ensure that Bob cannot learn how she routes his requests in each slot. This example could be viewed in analogy to a distributed denial-of-service (DDoS) attack, tailored to the quantum cloud.

As a final applications remark, note that here we are not interested in quantum process tomography, due to its demanding resource requirements. Full generic process tomography scales exponentially with system size, gate-set tomography is deliberately invasive, and scalable benchmarking or noise-learning methods make structural choices about which figures of merit to estimate [71]–[76]. System-level benchmarks, such as quantum volume and cycle benchmarking, compare hardware capabilities and error rates, but they are not designed from a security or privacy perspective [77]–[79]. In practice, a user trying to identify a backend may succeed using a much cheaper-to-extract notion.

0.0.1.2 Contributions

We summarise our primary contributions as follows:

• Unified framework and formal privacy notion. We introduce the backend identifiability game and formally define routing anonymity as an operational privacy notion for hiding the service provider’s routing choices in the quantum cloud setting. We extend to a multi-round version of the game under assumed i.i.d. passive access and describe the rate of anonymity decay via Chernoff information.

• Statistical characterisation of backend identifiability. We reduce optimal backend identification to classical hypothesis testing over route-induced transcript laws, allowing us to use known statistical results to describe distinguishing bias via total variation distance, and give a sufficient condition for general routing anonymity with respect to constituent binary identification games.

• Utility-anonymity trade-off. Formalising post-processing as the provider’s principal mechanism for suppressing route-specific information, we introduce ideas about utility preservation and prove a corresponding no-free-lunch result about its relationship with routing anonymity.

• Workload-relative conditions for anonymity. We introduce a workload-probed channel (pseudo-)distance that measures average channel separation over the permitted probe workloads, yielding a tighter practical bound on routing anonymity than worst-case diamond norm.

• Intermediate-depth principle. In a contractive Pauli-transfer-matrix model with a common mixing component and small backend-specific perturbations, we prove that route-specific noise signals initially accumulate in depth before rapidly decaying. This formalises an intermediate-depth window in which backend identification is most effective.

• Experimental implementation. Using both random and structured workloads, several forms of transcript post-processing, and designing temporal experiments, we demonstrate our framework in practice to show that finite-shot outputs from real QPUs can expose substantial route information. Routing anonymity is then of considerable practical interest.

0.0.2 Framework Overview and Informal Theoretical Results↩︎

In this section, we present our theoretical framework intuitively and informally to give a technical overview of our main results. The formal framework is deferred to Appendix 0.0.5, and precise statements and theoretical results to Appendix 0.0.6.

0.0.2.1 A Game of Routing

We formalise the discussed security notion as a game played between a user with a desire to learn backends, and a provider with the converse desire to keep secret his routing choice. In this context, a ‘backend’ is any machinery with the capacity to execute a quantum circuit and return measurements thereof; e.g. a single quantum hardware device, a cohort of devices, a portion of a device, or some subset of registers, etc. We call the provider’s choice of backend a ‘routing’—he selects a route through which to execute a given circuit. Generally, we use the terms ‘backend’ and ‘route’ interchangeably, but the rule of thumb is that the user wants to identify the backend that runs her computation while the provider wants to anonymise his route (to a backend) from the user.

The interaction between these parties looks like the following: the user probes the provider with a workload (quantum) circuit of her choosing, and the provider then dutifully executes that circuit through a route of his choosing over a finite precision of shots to produce an empirical probability distribution, which is thus naturally associated with both the backend and circuit. Before handing this distribution back to the user, the provider passes it through some (deterministic) post-processing map in accordance with the service that he is promising to provide. The idea is that the user is not generally interested in the raw outcome sequences of her circuit, but rather some property; e.g. expectations of observables, energies of Hamiltonians, ground states, correlator functions, decision outcomes, etc.; hence it is prudent on the provider’s part to reveal only the property of interest when his privacy is of concern.

Following this interaction, the user has received a transcript in association with her known circuit and the unknown backend. The question—and the unmistakable fun in this game—is whether there is enough information accessible in the transcript to identify this backend. Other questions linger on the periphery; e.g. which ensemble of workload circuits makes accessible the most amount of usable information for this identification; which classes of post-processing maps are most hiding of information in the exposed transcript; what relationship does the capacity for identification have with the number of shots? All very interesting and natural aspects of the game.

The security game can be described as follows:

We can extend this game into a more realistic setting by allowing the user to probe the backend over multiple rounds. There are many plausible constructions for a multi-round version of the above identification game; we consider a persistent routing setting in which the provider fixes a backend prior to playing, allows the user to submit multiple workload circuits to the backend, and then executes them in bulk before returning a lengthened transcript. Importantly, this is a passive and i.i.d. access model as opposed to e.g. adaptive access models that permit the user to sample her \(t\)-th circuit after having observed the \((t-1)\)-th transcript. This assumption simplifies our later observations, but is certainly worth developing in future work.

At this point, we can explicitly state the provider’s goal in this game. In contrast to the user’s goal of identifying the backend, the provider succeeds if the user cannot identify the backend with probability substantially higher than random guessing. A central contribution of this work is to show how routing anonymity emerges through different instantiations of the game and its parameters: which classes of post-processing maps, which circuit ensembles, how many shots, and related choices preserve anonymity of the route, and to what degree? First, we define the routing anonymity with respect to the described games as follows.

0.0.2.2 Identification and Anonymity via Statistical Tests

Any ensemble \(\mu\) of workload circuits, executed on a particular backend \(D_i\) over \(m\) shots, has an associated raw transcript law \(Q_i(\mu,m)\) by which the empirical distribution is sampled. After being passed through a post-processing map \(\phi\), we can instead refer to an induced transcript law \(P_i(\mu,m,\phi)=\phi_\# Q_i(\mu,m)\). For brevity, write \(Q_i\) and \(P_i\) when the context is clear.

Our first result, 1, makes the conceptually simple connection between classical discrimination of probability distributions from an observed sample and the backend identifiability game, as a security notion. The observation that bounds guessing probability is then imported immediately from the abundance of known classical literature in hypothesis testing, and allows us to obtain a clean relation for distinguishing bias \(\beta_{D_1,D_2}\) in the uniform-binary case as exactly the TV distance between the respective induced laws; i.e. we have \(\beta_{D_1,D_2}\equiv \mathrm{TV}(P_1, P_2)\) bias, beyond random guessing.

Throughout this work, as in 1, it will be convenient to restrict our attention to this ‘uniform-binary’ setting between a pair of equally-likely backends. In fact, the following 1 should settle our nerves about this restriction by showing that pairwise indistinguishability is sufficient to obtain a global anonymity in the fully general setting among an entire set of finitely-many backends with arbitrary priors. Hence, we can reason about anonymity via simple pairwise arguments, at least in that we can provide sufficient conditions for the general setting.

Our second important result, 2, then extends 1 into the persistent routing setting to observe that, under our passive i.i.d. assumptions, the provider’s anonymity decays exponentially at the Chernoff rate between the relevant induced laws.

0.0.2.3 Post-Processing and a Utility-Anonymity Trade-Off

A fundamental observation about post-processing is that there do not exist deterministic maps which can increase information. Generically speaking, the information contained within a raw observation, relevant to identifying the backend, tends to be stripped out by the post-processing. A natural corollary is then that raw observations are informally maximal for backend identifiability.

This reveals a very useful role for post-processing: it is perhaps the principal means by which the provider can reduce the amount of information leaked to the user in the returned transcripts, and thus improve routing anonymity. But to what end? Trivially, choosing a deliberately destructive map, say the constant map \(\phi(\cdots)=1\), clearly reduces both the TV distance and Chernoff information to zero and so preserves anonymity indefinitely, but there is a clear lack of utility for the user. Unless the promised service is similarly trivial, this is an abuse of power by the provider in the backend/route identification game that abandons the practical motivation for such a setting.

Introduce a utility map \(u\) representing the service that user is actually looking for. Subsequently, call the induced law \(P_i(\dots,u)\) under this map the utility law. Now, we can say that the provider’s post-processing map map \(\phi\) exactly preserves the utility \(u\) if the user is able to decode the output of \(\phi\) to obtain her desired utility output (as if from \(u\)). We should note that \(u\) is a quite abstract object, in much the same way that \(\phi\) itself is left abstract, and indeed it may be natural to discuss entire classes of utility and post-processing maps, for example if the service is left reasonably flexible. We now have our third important result: that anonymity and utility have a trade-off relationship.

To be clear, by ‘degrades the utility’, we mean that the transcript that the user ultimately receives contains only partial information about the property of interest represented by the utility, and hence she can only partially reconstruct the property. For example, the provider may only be providing an estimate about the ground-state energy, with an error proportional to the degree to which the utility is not preserved.

We can further note approximate versions of utility preservation and the accompanying no-free-lunch argument of 3. The definitions of such versions should be delicately crafted with respect to the utility, as the approximation measure should yield a suitable interpretation for how the utility is degraded. We further discuss this problem and suggest solutions in Appendix 0.0.6.2.

0.0.2.4 Identifiability as an Intermediate-Depth Phenomenon

An important observation can at this point be made about the role of depth \(d\) in the user’s workload circuits. In writing her ensemble of circuits \(\mu_d\) with respect to a chosen depth \(d\), we should ask what interval she should consider choosing \(d\) to lie in. We have the following intuition:

• At very low depths (or in the noiseless setting), backends are indistinguishable because they implement very close to (or exactly) the same ideal circuit; and

• Beyond some large depth, if noise becomes dominated by a common strongly mixing component, then any route-specific information is typically washed out, yielding indistinguishability; but

• In the ‘intermediate-depth’ window, enough noise will have accumulated to reveal backend-specific structure, yet not so much that everything has collapsed to universal fixed-point behaviour—this is the interesting regime.

To formalise this idea, in Appendix 0.0.7 we record a pair of idealised theorems in a simplified Pauli-transfer/noisy-channel model. We prove these results by moving to Pauli-transfer-matrix (PTM) coordinates, wherein we can represent the effect of each noisy layer of a circuit as a linear contraction of the traceless Pauli components of the state. We assume that this contraction can be suitably decomposed into a common depolarising-like mixing component and a small backend-specific perturbation, then look at how the difference between two backends evolves with depth.

0.0.2.5 Noise Channel Bounds and Relation to Noise Characterisation

We observe (in 3) that the distinguishability of backends in our framework is governed by average-case notions of TV distance on only the states actually induced by the user’s probing protocol, rather than any worst-case separation of the full channels over all possible inputs and ancillas. The natural channel distance to consider is thus not e.g. diamond norm but instead a particular workload-probed channel (pseudo-)distance, denoted by \(\delta_\mu(\cdot,\cdot)\) and defined with respect to the user’s chosen ensemble \(\mu\) of workload circuits.

Usefully, the following 4 shows that the workload-probed channel (pseudo-)distance serves as a tighter bound on the distinguishing bias than the worst-case diamond norm, and is thus the more practical sufficient condition to target in the backend/route identification game. This is very much in agreement with recent ideas that these kinds of average-case distances are the more relevant quantities for NISQ-era applications than worst-case norms like diamond norm [80], [81].

A natural corollary, following 4, is that two backends can be made indistinguishable by ensuring that the workload-probed (pseudo-)distance between their associated noisy channels is not too large (more immediately than ensuring the diamond norm is not too large). Recalling the pairwise argument of 1, we can then give a sufficient condition for routing anonymity in the fully general setting—that no two pair of backends among the full set have large workload-probed channel (pseudo-)distance. Again, this is an experimentally-achievable condition in the NISQ setting that often cannot be said about diamond norm.

0.0.3 Experimental Results↩︎

In this section, we complement the above framework with experimental evidence that real finite-shot output distributions, from QPUs offered via current quantum cloud services, carry learnable route information. It is not the intent to reconstruct device noise models, or perform full tomography, but rather to instantiate the backend identification game of 1 (and its extension to persistent routing via 2) in a realistic setting and exemplify the risk to privacy.

Our experiments are run via AWS Braket on three QPUs: Rigetti’s Ankaa-3 and IQM’s Garnet, both superconducting devices, and IonQ’s Aria-1, an ion-trap device. We categorise classification into two qualitatively different settings: the like-type setting between the two superconducting devices, and the differing-type setting generally between Ankaa-3 and Garnet for consistency. We also categorise experiments into two families of (5-qubit) probe circuits: varying depth circuits composed of Haar-random two-qubit gates arranged in an alternating brickwork pattern (“depth-varied”); and fixed GHZ preparation circuits repeated in time (“time-varied”). Broadly speaking, the former understands the backend identification problem in the case where the user cannot rely on hand-picked outcomes to probe deliberately, while the latter understands the extension to persistent routing and the temporal structure of noise signals.

For each circuit, we obtain a finite-shot histogram over computational-basis bitstrings. We then train simple classifiers on datasets of transcript representations (“features” in the machine learning lexicon), including both for raw outcomes and several forms of problem-independent post-processing. Comparing how classification performance depends on feature type gleans empirical insight into how route-specific information may survive post-processing. Detailed experimental setup and a full account of our results is given in Appendices 0.0.8–0.0.11.

We find that, in the depth-varied experiments, backend labels can be learned well above random guessing, with like-type test classification accuracies around 87–90%, and differing-type essentially perfect at around 96–98% (each for raw features). High classification performance can be observed to survive several forms of post-processing; e.g. log-ratio features yield like-type accuracies in the range 66–77% when pooling over depths. 2 visualises the latent representations learned by our classifiers in depth-varied experiments, indicating the separability that gives rise to the ease of classification on raw features. This latent space can be understood (loosely) as a subspace manifold of the full bitstring space in which intra-backend distances are minimised while inter-backend distances are maximised, giving a representation for noise signals with respect to the workload and backend set.

Backend identification over a dataset of GHZ circuit data is a perfect 100% across all features, as we expect from such structured circuits persistently probed very many times. This highlights the importance of the workload choice in the backend identification game—routing anonymity can be broken far more easily with carefully selected, highly structured circuits, so service providers should be conscious to the workload circuits they release transcript about, and how often they do so.

Further to backend classification, we also study temporal identifiability by grouping our time-varied GHZ data into batches and classifying by batch. A strong time-dependent fingerprint of devices can be detected among the superconducting devices at the batch-level, although classification within a batch—early vs late samples—is significantly more difficult. This could be interpreted practically as a low risk of leaking route-specific information over short-term persistent routing, particularly when coupled with the Haar-random observations that independent, random circuits probing in succession can mitigate the exponential decay of anonymity. At the very least, short-term temporal structure is dominated by long-term signal fluctuation in the QPUs we work on.

0.0.4 Discussion and Future Works↩︎

We have introduced routing anonymity as the provider-side security notion for cloud quantum computation, together with the more familiar user-side counterpart in backend identifiability. It is understood that, in the NISQ setting, classical output distributions from quantum computations are not merely noisy approximations to the ideal distribution, but in fact laced with route-specific information that can be leveraged to violate anonymity of a service provider’s routing choice if not sufficiently obscured by post-processing. Our framework packages this intuition into an operational game, which immediately reduces backend identification to classical hypothesis testing over transcript laws, and then elevate this into a persistent-routing setting, which shows that the rate of anonymity decay via independent, repeated probing is described by the Chernoff information between laws.

Post-processing emerges as the provider’s principal mechanism for obscuring route-specific information to preserve the anonymity of their routing choices. We further formalise the degree to which a provider may remove this route-specific information from their released outputs via a no-free-lunch theorem attached to the promised utility of the service; anonymity may only be preserved up to the level of the law induced by the promised utility, and any further gains in anonymity necessarily degrade the service. All of this leads to an important practical question: which workloads are most identifying? From the user’s perspective, this becomes a problem of designing workloads of probe circuits; from the provider’s perspective, it becomes a problem of identifying exposing workloads, or of designing service interfaces that carefully choose how transcripts are released to remove route-specific information while preserving the promised utility. Such questions deserve incredible attention and care from cloud service providers for the foreseeable future, and we hope that this work provides a useful framework for uncovering answers in concrete applications.

We have also outlined a notable dependence on depth, proving that backend identifiability is naturally an intermediate-depth phenomenon: at shallow depths, too little backend-specific noise has accumulated, while at sufficiently large depths, common mixing can obscure route-specific structure. We do not design our experiments to explore this phenomenon directly, though nevertheless observe behaviour consistent with the principle and statements that we outline.

Our experimental observations support the theoretical results, finding that finite-shot classical outputs from real cloud quantum computing platforms can reliably identify routing choices well above random guessing. This identifiability exists even between backends implemented under the same physical platform architecture (namely, between superconducting devices), indicating the granularity and uniqueness of noise in current QPUs. While post-processing can be observed to improve routing anonymity in these experiments, we see that even workloads comprised of independent, random circuits can retain good identifiability, given enough persistence of routing.

Further time-dependent experimentation reveals aspects of the anonymity problem beyond those directly understood in the theoretical considerations of this work. Namely, strong classification between well-spaced batches of transcripts points to long-range temporal structure which itself may be learned effectively. This leads to practical questions about the duration of user-provider interactions, possibly indicating a preference for short-term bursts of probing to retain anonymity.

Our blackbox model has a useful distinction from classical shadows [82], [83], which require a randomised measurement toolbox, e.g. random local Paulis or global Clifford measurements, and an inverse measurement channel. Our setting, and our experiments, take only computational-basis measurements and so should not, by themselves, construct a good classical shadow of the output state. The output object is thus closer to a circuit-conditioned ‘fingerprint’. A clean diagnostic is to compare a classifier using only the unconditioned output object with one using the circuit-conditioned pair; if the former is near chance while the latter identifies the backend, then the signal is not shadow-like state reconstruction but rather a simpler input-output hardware ‘fingerprinting’.

0.0.4.1 Extensions

Appendix 0.0.12 provides some preliminary exploration of noise forecasting; i.e. predicting the presentation of noise in outcome distributions in future time steps by learning its evolution over a short prior. A sufficiently good forecasting model could have interesting applications, such as improving near-term error mitigation, retrospectively estimating ideal distributions, inferring the operational lifetime of a backend, detecting calibration changes, etc. However, such a model also introduces new privacy risks, such as giving users an improved capacity to pre-emptively adapt their workload when given repeated access (even without an explicitly adaptive access model). Security measures against such forecasting may look like, for example, randomly permuting the order of probe circuits.

An obvious progression of this work is to formalise concrete, provide-side, routing anonymity schemes; e.g. restricting the class of allowed workloads, reducing the number of shots or interactions, coarsening output histograms via post-processing, adding controlled classical noise, etc. Perhaps the main technical challenge is to make certifications of anonymity practical; worst-case channel distances are too strong and often experimentally inaccessible, so a workload-probed distinguishability metric seems most appropriate, but estimating or bounding it from finite data remains an open problem.

The suggested ‘quantum lock-and-key’ setting of 1 may be a nice concrete application in which to develop ideas about such a scheme. In this setting, we have ‘locks’ represented by backends, and ‘keys’ by specific circuits about which the provider only releases decision bits indicating whether they open the requested lock. We can model this under our framework as a routing-anonymity game in which the utility is a precise decision function, and the security question is whether there exist workloads which leak the identity of any lock. A correctness condition should require valid keys to be accepted with high probability, and a soundness condition that invalid keys are rejected with high probability without leaking lock information. We strongly encourage future work to develop the quantum lock-and-key idea into a complete scheme, including a concrete key distribution, acceptance rule, finite-query security bounds, and a better understanding for how the utility-anonymity trade-off can be modelled and utilised to obtain strong notions of completeness and soundness.

A possible restriction of our framework as proposed, which we have not yet discussed, is the ordering of events. Currently, we allow the provider to choose his route first and foremost, before seeing the workload submitted to him. This is perfectly acceptable in many circumstances (e.g. in all three of our examples in 0.0.1.1), but it necessarily forbids an adaptive scheduling policy on the provider’s part that may well be extremely common in future quantum cloud practices. For example, if a provider has only one backend capable of running over some threshold number of qubits, then it could be impractical to turn away users submitting wide workload circuits simply because he has chosen the ‘wrong’ backend. Instead, we generally foresee a setting wherein the user submits a circuit, and the provider then samples a backend according to some prior conditioned on the workload. However, such a setting opens up the possibility for adversarial users to dictate the provider’s backend choice to her possible identifying advantage (e.g. she might choose the widest circuit that she can imagine to be confident that the provider is forced to use his one capable backend). This kind of complication is conceptually challenging to overcome in the provider-side privacy perspective, and a key reason that we take the agnostic approach in selecting the backend label first, but is nonetheless important to understand for the security of quantum cloud computing.

Acknowledgements↩︎

The authors thank James Mills for helpful discussions at the early stages of the project. BP acknowledges the financial support provided by the Jesus College Embiricos Trust Scholarship. MD acknowledges the support of the Quantum Advantage Pathfinder (QAP), with grant reference EP/X026167/1, and the UK Engineering and Physical Sciences Research Council.

Appendix↩︎

Framework and Theoretical Results

---

0.0.5 Formal Framework↩︎

Fix \(n\in\mathbb{N}\) qubits, and let \(\Omega_n:=\{0,1\}^n\) denote the set of computational-basis \(n\)-bit string outcomes. We use the convention \(\Delta(\cdot)\) to denote sets of probability distributions; so write \(\Delta(\Omega_n)\) to denote the set of probability distributions on \(n\)-bit strings, or \(\Delta_m(\Omega_n)\) to denote the set of empirical histograms on \(\Omega_n\) that can be obtained over \(m\) draws.

Let \(\mathcal{C}_d\) be a family of depth-\(d\) circuits over \(n\) qubits, and for each \(C\in\mathcal{C}_d\), we will write \(U_C\) to denote its ideal unitary action, producing an ideal output state \(\rho_C:=U_C|0^n\rangle\langle 0^n|U_C^\dagger\). We will denote by \(\mathcal{C}:=\bigcup_{d\geq 0}\mathcal{C}_d\) the collection of all executable quantum circuits over \(n\) qubits.

Consider a finite set of quantum backends (or “routes”) \(\mathcal{D}=\{D_1,\dots,D_k\}\), and for each \(D_i\in\mathcal{D}\), associate a family of effective noisy channels \(\mathcal{N}_i:=\{\mathcal{N}_{i,C}:C\in\mathcal{C}\}\) where, \[\mathcal{N}_{i,C}:\mathcal{D}((\mathbb{C}^2)^{\otimes n})\to\mathcal{D}((\mathbb{C}^2)^{\otimes n})\quad ,\] is a completely positive and trace-preserving (CPTP) map. Here, we are taking the quite general perspective that allows effective noise to depend explicitly on the circuit, since real effective noise depends on compilation, layout, native gates, calibration, crosstalk, control context, time, etc. We represent measurement (without loss of generality, in the computational basis) by, \[\mathcal{M}:\mathcal{D}((\mathbb{C}^2)^{\otimes n})\to \Delta(\Omega_n)\quad ,\] and hence, for a given backend \(D_i\) and circuit \(C\), the idealised output law is given by, \[p_{i,C}:=\mathcal{M}(\mathcal{N}_{i,C}(\rho_C)) \in \Delta(\Omega_n) \quad .\]

In practice, we will only execute the circuit over \(m\) independent shots, producing random outcomes \(Y_1,\dots,Y_m\sim p_{i,C}\). We can then compute from these an empirical histogram like, \[\hat{p}_{i,C}(x) := \frac{1}{m}\sum_{j=1}^m\mathbf{1}\{Y_j=x\} \in \Delta_m(\Omega_n) \quad .\]

Now let \(\phi:\mathcal{C}\times\Delta_m(\Omega_n)\to\mathcal{X}\) be a deterministic post-processing map taking raw observations \((C,\hat{p}_{i,C})\) into a transcript space \(\mathcal{X}\) (which we leave abstract for now). For brevity, we may sometimes refer to the raw observation space simply as \(\mathcal{Y}:=\mathcal{C}\times\Delta_m(\Omega_n)\).

0.0.5.1 A Game-based definition for Backend/Route Identifiability

We now have the necessary objects to define a game of backend/route identification between a user and provider. Informally, the game is as follows: the provider privately selects a quantum backend, associated with a noisy channel, and asks the user to choose a probe circuit to be routed through this channel. Dutifully, the provider then executes the circuit on the backend for a finite precision of shots, before returning to the user (a post-processed transcript of) the outcome histogram. The user’s task is to guess which backend produced the outcome returned to her—if only she could contain her excitement.

More formally, we provide the following definition for a single round of the game.

0.0.5.2 Describing Identifiability and Anonymity

We can season the backend/route identification game with cryptographic implications to change its flavour from identification to anonymisation. Where before we asked how well a user can recover the provider’s routing choice, we now ask the equivalent provider-side security question: how small is user’s excess advantage, with respect to the kinds of transcript we expose?

0.0.6 Formal Theoretical Results↩︎

This section will present the formal theoretical results summarised informally in 0.0.2. We begin by showing that backend identification is exactly the problem of classical statistical hypothesis testing in 0.0.6.1, yielding an exact characterisation of optimal binary identification with total variation distance, a pairwise sufficient condition for general routing anonymity, and describing the rate at which anonymity decays via Chernoff information. Then, in 0.0.6.2, we focus on the role of post-processing as a means for removing backend-specific information. We then introduce utility maps and state a precise utility-anonymity trade-off relationship that establishes fundamental bounds on anonymity. Finally, we relate statistical distinguishability of routes to the underlying noisy quantum dynamics in 0.0.6.3, showing that identification relies on average-case channel distances rather than any worst-case distance, and hence defining a new pseudo-distance for (families of) channels within our framework. We then give some simple sufficient conditions for routing anonymity with respect to this average-case distance.

0.0.6.1 Reducing Identification to Classical Statistical Testing

In the following proposition, we observe that pairwise distinguishability, measured in the familiar total variation distance, can be seen to bound the excess advantage over any arbitrary backend set. Hence, an arbitrary collection of routes and prior can be worst-case bounded by another route identification game in the uniform-binary setting.

The above 1 gives a practical sufficient condition: if every pair of routes is hard to distinguish under the transcript maps that the provider returns, then the whole routing system is anonymous by 6. This is particularly useful for certification because it avoids needing to solve the full \(k\)-ary decision problem.

To extend 1, we can reduce extended backend identification, played over \(T\) rounds, to hypothesis testing between the product distributions over the \(T\)-length transcript space \(\mathcal{X}^{\otimes T}\). Asymptotically, we can then say how quickly anonymity—the converse to distinguishability in this context—breaks down as we prolong the game over more rounds, with a rate of anonymity decay controlled exponentially by the Chernoff information between induced distributions.

0.0.6.2 Post-Processing and the Utility-Anonymity Trade-Off

In the quantum cloud setting, post-processing plays a very interesting role that deserves careful and deliberate consideration. Naively, we can imagine the provider executing a given circuit on behalf of the user and providing the raw bitstring counts, much like current cloud-based quantum services do in the present day. This represents the most flexible service, with the provider taking somewhat of a ‘no-questions-asked’ stance and allowing the user to get on with whatever she wishes to do with her outcomes. In the near future, however, as the quantum cloud setting expands into an increasingly commercialised and specialised enterprise, providers may wish to perform only a particular ‘service’ for the user. Instead of a raw empirical histogram over bitstrings, providers may prefer to release only a feature about these bitstring outcomes; e.g. if the user is interested in the ground-state energy of a particular Hamiltonian, the provider may perform quantum phase estimation on her behalf, in which case the feature of interest looks like the peak value in the histogram.

In this service-centric paradigm, post-processing acts not only as a means to directly compute features of interest on behalf of the user, but also as the principal mechanism by which the provider can remove backend-specific information from the released transcript. We formalise this with the following 2 in the uniform-binary case, well understood already in classical statistics.

More generally, note the following corollary which states that arbitrary post-processing cannot increase distinguishability.

We can easily see that this result already implies that raw observations are informationally maximal for backend identification, since any deterministic post-processing map \(\phi\) can clearly be called a ‘further’ post-processing of the identity map.

We should now place increased scrutiny on the choice of post-processing map; of course, the provider could choose e.g. a trivial constant function so that \(P_1=P_2\) and thus achieve indefinite anonymity, but there is obviously a lack of utility in this ‘service’. Our next natural progression is then a question of trade-off between anonymity and utility through the choice of post-processing map: the provider should look to remove route-specific information as much as possible without also removing task-relevant information. In this work, we model the promised service via the following utility map—the promise of a service is the promise that a particular computation is being performed on the bitstrings, and this utility should be preserved in that its codomain remains accessible.

Under 8, the provider is then constrained (perhaps contractually obligated) to choose a class \(\Phi\) of post-processing maps which exactly preserve the promised utility \(u\). In the following theorem, we formalise a kind of no-free-lunch evident under this restriction: that if the requested utility is itself route-sensitive, then hiding the route necessarily means changing, coarsening, randomising, or otherwise degrading the utility.

The above 3 tells us that there is no choice of utility-preserving post-processing map that can reduce the total variation distance between the induced distributions of any two routes beyond that of the utility laws without degradation. Equivalently, by 1, we can say that distinguishability cannot be reduced without also losing utility via post-processing.

It is conceivable that the user will agree to a small loss of utility if it makes the provider happier about his ability to anonymise routes. It is nice to make people happy. To that end, consider approximate versions to the above ideas for utility preservation. 9 is perhaps the simplest and most straightforward formulation.

In the exact setting, 3 makes it clear that the utility map itself is the most anonymising post-processing that the provider can apply—any further post-processing that preserves this utility exactly will necessarily increase distinguishability, as per 1. So, we might like to argue that the approximate setting in 4 is more interesting, and introduces the possibility for an accuracy parameter \(\alpha\) of an acceptably small scale which dominates the term \(\mathrm{TV}(P_1(\dots,u),P_2(\dots,u))\). Indeed, indefinite anonymity can be obtained with any \(\alpha \geq \frac{1}{2}\mathrm{TV}(P_1(\dots,u),P_2(\dots,u))\).

Note that an approximately utility-preserving map defined as in 9 could be poorly considered for particular utilities. Take, for example, a binary decision rule to be the utility, and suppose that the number of positive outcomes for the rule is exponentially small in the number of possible inputs. Then a constant post-processing which takes every input to a negative output has only an exponentially small loss of accuracy under the approximate preservation of 9. Clearly though, the meaningful utility—defining a small set of acceptable inputs—is destroyed here. To address this concern, it may be appropriate to define a slightly different notion of preservation for decision utilities. For example:

With such a definition for preservation, it may be possible to show that rare decision utilities are intrinsically anonymous. That is, if the probability \(Q_i(u=1)\) for a positive outcome is exponentially small, then any approximately-preserving post-processing map can improve the anonymity exponentially in \(m\). Extended over multiple rounds, this then looks like a polynomial increase in in the number of rounds we can play until anonymity is lost. For now, this is only conjecture; we encourage interesting future work in this direction.

0.0.6.3 Noise-Channel Bounds and Relation to Noise Characterisation

Now we explore the relationship between successful identification in the uniform-binary setting and the underlying effective channel noise. Our basic operational quantity for this is the single-shot, raw distinguishing bias, as give in the following 3.

This motivates a very practical distance measure. We can see that what matters is not any worst-case separation of the full channels over all possible inputs and ancillas, but actually the average separation on the states actually induced by the probing protocol. Hence, we introduce a workload-probed channel (pseudo-)distance accordingly, to give us a very natural distance measure for our setting, tailored to the workload ensemble \(\mu\) used in any experiment.

This is a pseudo-distance since it does not generally satisfy an identity of indiscernibles, though note that is is non-negative, symmetric, and satisfies a triangle inequality. Experimentally, it can also be seen to be a more useful measure; a poorly designed ensemble (from an adversarial user’s perspective) may have a very small workload-probed channel pseudo-distance and hence fail to distinguish backends accurately, but there may exist other workloads that have a much easier time of it. Distinguishability of backends is thus relative to the workload, in the most practical sense.

Establishing the above relationship in 4 allows us to immediately suggest some practically useful sufficient conditions to achieve a desired degree of routing anonymity.

0.0.7 Intermediate-Depth Principle in the PTM Model↩︎

Let \(\mathcal{P}_n\) denote the \(n\)-qubit Pauli basis. Every \(n\)-qubit density operator \(\rho\) can be expanded like, \[\rho = \frac{1}{2^n}\left( I + \sum_{P\in\mathcal{P}_n\backslash\{I\}} \mathrm{Tr}(P\rho) P \right) \quad ,\] and we call the vector \(\vec{r}(\rho):=(\mathrm{Tr}(P\rho))_{P\neq I}\in\mathbb{R}^{4^n-1}\) the traceless Pauli vector of \(\rho\), recording its non-identity Pauli expectation values.

A quantum channel \(\mathcal{N}\) can be represented in the same basis by its Pauli Transfer Matrix (PTM), which, for a trace-preserving channel, takes the block form, \[\begin{pmatrix} 1 & 0 \\ t_\mathcal{N} & N_\mathcal{N} \end{pmatrix} \quad ,\] where \(N_\mathcal{N}\) is the block acting on the traceless Pauli coordinates, and \(t_\mathcal{N}\) is an affine, non-unital drift. Therefore, the traceless part transforms as \(\vec{r}(\rho)\mapsto t_\mathcal{N}+N_\mathcal{N}\vec{r}(\rho)\), and if the channel is unital, then \(t_\mathcal{N}=0\) and evolution cleans up to \(\vec{r}(\rho)\mapsto N_\mathcal{N}\vec{r}(\rho)\).

PTMs have been widely used across the literature because they give a concrete linear representation of quantum processes in the Pauli basis. We see them in gate-set tomography and quantum process characterisation, where they provide a useful diagnostic representation of gate errors [85]; in learning problems, wherein it can often be easier to learn entries and expectation values associated with the PTM of unknown quantum processes [86]; and spectral quantum tomography, where eigenvalues of the PTM of a noisy gate can act as useful gate diagnostics [87]. These applications motivate the use of PTMs to yield a simple coordinate system wherein differences between noisy processes can be represented, learned, and compared.

0.0.7.1 Output Distributions from Traceless Pauli Signals

Let \(\vec{r}_C:=\vec{r}(\rho_C)\) denote the traceless Pauli vector of the ideal output state \(\rho_C\) for a given depth-\(d\) circuit \(C\). Under the execution of a backend \(D_i\), the computational-basis output distribution \(p_{i,C}\) can be modelled like, \[\label{eq:output95distribution95from95pauli95signal} p_{i,C} = q + MN_i^d\vec{r}_C \in \Delta(\Omega_n) \quad ,\tag{4}\] where \(q\in\Delta(\Omega_n)\) is a common asymptotic fixed-point distribution, \(M:\mathbb{R}^{4^n-1}\to\mathbb{R}^{2^n}\) is a fixed linear map transforming traceless Pauli coordinates into computational-basis probability deviations, and \(N_i\) is the effective traceless PTM block describing the noisy action of \(D_i\) per circuit layer. We can thus view \(N_i^d\vec{r}_C\) as the residual circuit-dependent traceless Pauli signal after \(d\) noisy layers.

There are several simplifying assumptions present in Eq. (4 ): (1) noisy evolution is treated as Markovian and depth-homogeneous at the level of an effective layer noise map, applying the same traceless PTM block \(N_i\) after each layer; (2) \(N_i\) is assumed diagonal, or effectively diagonal after Pauli twirling; (3) affine non-unital effects are either negligible or common among compared backends and thus absorbed into \(q\); (4) the measurement map is assumed to be backend-independent so that backend-specific readout effects are either negligible or common and thus absorbed into \(q\); and (5) we assume either that the effective layer noise is unital, or that all compared backends share a common fixed point and we work in coordinates centred at this fixed point (in the latter case, \(q\) denotes the corresponding computational-basis fixed-point distribution and \(\vec{r}_C\) should be interpreted as the centred ideal signal).

Sufficiently mixing noisy dynamics are often modelled by traceless PTM blocks whose relevant eigenvalues lie strictly inside the unit circle; e.g. simple depolarising channels act as \(\vec{r}(\rho)\to\lambda\vec{r}(\rho)\) with \(\lambda\in(0,1)\) and thus have corresponding traceless PTM block \(\lambda I\), and amplitude-damping noise has subunit eigenvalues like \(\sqrt{1-p}\) and \(1-p\) with damping rate \(p>0\) [87]. [88] define these kinds of strictly contractive channel as those which reduce trace distance by a factor less than \(1\), interpreting them as making quantum states less distinguishable.

This motivates a key dominant-mixing assumption for the intermediate-depth principle: decompose the traceless PTM block \(N_i\) of a backend \(D_i\) like, \[\label{eq:decomposed95ptm95block} N_i = \lambda I + E_i \quad ,\tag{5}\] where \(\lambda I\) is a common depolarising-like contraction with \(\lambda\in(0,1)\), and \(E_i\) is a backend-specific perturbation with \(\|E_i\|_{1\to 1} \leq \varepsilon\) such that \(\lambda+\varepsilon<1\). That is, we will assume that the backend-specific perturbation \(E_i\) is sufficiently small so as not to destroy the common contraction on the traceless PTM subspace.

This is a standard form of modelling assumption for analysing noisy quantum dynamics. Strictly contractive quantum channels have long been used as mathematical models of non-ideal quantum evolution, especially for settings wherein finite experimental precision and repeated noise make perfectly reversible dynamics unrealistic [88]. The broader theory of quantum contraction coefficients similarly studies how noisy channels contract operational distances and divergences between states [89]. Moreover, randomised benchmarking and randomised compiling provide both theoretical and experimental support for replacing complicated coherent hardware errors by effective stochastic Pauli or depolarising-like noise models: randomised compiling was introduced to tailor coherent errors into stochastic Pauli errors [90]; and Pauli-frame randomisation has been experimentally demonstrated on superconducting hardware to suppress non-Markian and non-Pauli signatures while leaving the computation unchanged [91]. Recent noisy-circuit analyses also use strict contractivity as a depth-dependent mixing hypothesis, with amplitude damping and suitable Pauli channels appearing as canonical examples of strictly contractive noise maps [92].

The following 2 formally presents the corresponding strict contractivity statement in our PTM model’s \(\ell_1\)-coordinate norm as a consequence of our assumptions about the norm gap \(\|E_i\|_{1\to 1}<1-\lambda\) in Eq. (5 ). Note that this is a coordinate-level contraction assumption in the traceless Pauli representation. It should not be confused with trace-norm contractivity unless additional norm-comparison constants are introduced.

0.0.7.2 Intermediate-Depth Identifiability Principle

We now show that the contraction statement of 2, following our standard strict contractivity assumption, leads to a useful practical intuition about the relationship between depth and backend identifiability. The quantity of interest is the expected total variation distance between output distributions produced by two backends over an ensemble \(\mu_d\) of depth-\(d\) circuits, as the average single-shot distinguishing behaviour constrained to a particular depth.

The following theorem formalises the idea that, under the dominant-mixing PTM model, the backend-specific contribution to distinguishing bias is necessarily suppressed at large depths, leading to a degradation of backend identifiability.

This establishes that distinguishability is not a high-depth phenomenon. Next, we formalise the shallow-depth side of the picture by showing that, over a perturbative range, the leading distinguishable signal builds up with depth and thus is not a low-depth phenomenon either (relatively speaking). We do this in the following theorem by presenting a lower bound for the same expected distinguishability object that holds over a perturbative range of shallow depths. Some work is offloaded into the preceding lemma.

Together, 5 and 6 present our formal intuition for the intermediate-depth principle; shallow circuits may not accumulate enough backend-specific noise to separate, while very deep circuits are dominated by common mixing, hence optimal distinguishability lies between these extrema. Recall 1 from the main text, which illustrates this mechanism.

Implementation Details and Experimental Results

---

0.0.8 Probe Circuits↩︎

Our experiments are run remotely on three different quantum processors (‘devices’) via AWS Braket: two superconducting QPUs (Ankaa-3 and Garnet) and one ion-trap QPU (Aria-1). These devices are deployed by Rigetti, IQM, and IonQ respectively. Throughout this section, we refer to comparisons between the superconducting devices as like-type, and to comparisons between superconducting and ion-trap devices as differing-type.

At the high level, each individual call to a device takes the following simple form: (1) a circuit of depth \(d\) is defined; (2) the device is remotely prepared with the circuit; (3) the circuit is executed numerous times, specified by the number of shots; then (4) a histogram of final measurements is returned, which we read as an outcome probability distribution over discrete bitstrings.

Our experiments in this work use circuits at a fixed width of \(n=5\) qubits, and hence lead to outcome distributions over \(2^5=32\) possible bitstrings. A sensible choice for the number of shots is much larger than this. For example, consider that each bitstring has an equal probability of \(1/32\approx{0}.03125\) to be measured. Then \(2^6=64\) shots is expected to give us only 2 measured outcomes per bitstring and so is extremely vulnerable to random noise greatly skewing our estimated probabilities; e.g. if only a single measurement error is made, then one outcome will falsely be perceived to have triple probability of another. On the other hand, with \(2^8=256\) shots, we have 8 measurements per outcome, and so errors in measurement can be tolerated more comfortably. The number of shots thus dictates the resolution with which we describe noise apparent in each call, and subsequently influences how precisely we may learn that description. Following preliminary experimentation, we have used our best judgment to select an appropriate number of shots.

In an effort to explore many different questions about device noise, it becomes necessary to run different forms of experiment. We categorise our device calls into two suites of experiments: depth-varied and time-varied.

0.0.8.1 Depth-Varied Experiments

This suite of experiments explores questions about circuit depth, and whether the relationship between noise and depth depends strongly on the device.

In each call to a device, we define a depth-\(d\) circuit by sampling Haar-random unitaries to be stacked together in an alternating brickwork pattern of \(d\) layers (see 3 (a)). Importantly, note that the circuit seen in each individual call to a device is independently sampled (and almost certainly unique), thus in any given run it cannot easily be inferred how much noise is present—or how it presents—in the outcome distribution until we provide knowledge about the circuit. Designing the experiments in this way allows us the opportunity to ask more nuanced questions about the noise fingerprints both implicitly (without circuit knowledge) and explicitly (accounting for the circuit).

Another motivation for the randomness of our circuits is to remove bias. With sufficiently many experiment calls, and increasingly with deeper circuits, we can expect that our probability distributions approach uniformly random. This opens the possibility to ask whether well-spread distributions, as we increasingly expect from deeper and deeper circuits, dilute the influence of a device’s unique character. And perhaps most usefully for the name-sake objective of this suite of experiments, we can roughly expect the same true outcome distribution (i.e. in the noise-free setting) beyond a sufficiently large depth, and thus we can better understand how noise fingerprints change and become harder to effectively describe with increased depth.

On each of the two superconducting devices (Ankaa-3 and Garnet), we make calls with 500 random depth-\(d\) circuits, with \(2^9=512\) shots of resolution, at depths \(d=5,10,15,20\). On the ion-trap device (Aria-1), we make 350 calls, with the same resolution, at depths \(d=5,10\). This choice of minimum depth is sufficient to allow for roughly uniformly random outcome distributions at our chosen resolution, and further allows the possibility for each qubit to interact with every other.

0.0.8.2 Time-Varied Experiments

This suite of experiments explores questions about the dynamics of device noise, both in the short(er)-term and long(er)-term. Being frugal, we can—and will—look toward classification tasks with data from these experiments, but they are primarily run with the purpose of understanding how well we can reason about the progression of noise in and between devices.

Every call to a device is made with the same circuit preparing a GHZ state over our \(n=5\) qubits (illustrated in 3 (b)); the true probability distribution is known to be an equal weighting between the all-0s bitstring and the all-1s bitstring. These circuits are constrained to a linear depth in \(n\), plus measurement, and so (since our \(n\) is reasonably small) we should not expect much deviation from the true distribution. For this reason, we judge it necessary to increase our resolution to \(2^{10}=1024\) shots to capture the far smaller probabilities leaking into the remaining 30 possible bitstrings. Note that this identical circuit preparation has the contrasting setup to our Haar-random circuits from the depth-varied suite of experiments; we can ask contrasting questions about whether highly concentrated distributions are easier to learn, as well as tie in temporal questions to understand whether the concentration of the distribution spills out in a predictable way, with respect to the device or its physical platform.

Experiments in this suite are grouped into three batches; a batch of calls are made in a series of contiguous time steps within the same day, with reasonably small and similar delays between successive steps. Calls between batches are separated by days or more, with the interval between batches being significantly larger than any interval between calls within the same batch.

In the first two batches, each superconducting device (Ankaa-3 and Garnet) is called in 100 contemporaneous time steps, which we sort chronologically according to completion time. As a post-processing step, we can take each completion time relative to some fixed time to assign to each call a single numerical quantity. The final batch is similar, and further includes 45 time steps of calls to the ion-trap device (Aria-1) at the same resolution. For clarity, note that each time step is an independent call, with freshly prepared initial states and GHZ circuit.

0.0.9 Data Processing↩︎

Suppose we have run, on some quantum device, an \(n\)-qubit circuit whose theoretical output distribution should be given by \(\mathbf{y}=(y_{1},\dots,y_{N})\) for \(N=2^n\), but for which we actually measure an output distribution of \(\mathbf{y}'=(y_{1}',\dots,y'_{N})\). There are two things we want to do with these data: in the implicit case, we would like to directly apply ML techniques to \(\mathbf{y}\); and in the explicit case, we would like to find a suitable function \(f(\mathbf{y},\mathbf{y}')\) which produces an input feature vector effectively isolating and describing some aspect of noise particular to that device.

The implicit case is specified by the trivial function \(f(\mathbf{y},\mathbf{y}')=\mathbf{y}\), so we should ask the more interesting question: which functions best isolate “noise” in the explicit case? In particular, it would be useful to discover how best we can specify and/or enhance the characteristics of a given device’s noise fingerprint that make it unique/distinctive. The nature of \(f\) then helps us to decorate any learned characteristics, and representations thereof, with useful theoretical interpretations.

To structure the discussion, we will discern three categories for the form of function \(f\), which increase in the strictness of the imposed structure, though do so with an increasing interpretability: neurally-guided, per-outcome, and per-qubit.

0.0.9.1 Neurally-Guided Features

Sitting at the lenient end, we can use any arbitrary neural network architecture to transform some combination of \(\mathbf{y}\) and \(\mathbf{y'}\) (ideally, retaining most information from each) directly into a feature vector without any premonition for its interpretation. In fact, the only ‘strictness’ involved in this approach is to enforce a dimensionality, call it \(N'\), for the desired latent representation.

At its simplest, we might like to feed, as input to our “neural network” \(f\), the concatenation \(\mathbf{x}:=(y_{1},\dots,y_{N},y'_{1},\dots,y'_{N})\). Any neural network is suitable; e.g. in this work, we will remain general and use a standard multilayer perceptron (MLP). At the output of \(f\) is an \(N'\)-dim vector representation of \(\mathbf{x}\), which we can then pass through a final fully-connected layer \(g\) (or a secondary model accepting a latent representation for input) to perform a final classification task.

Then we have some “full-model” \(g\circ f\) which, once trained to classify between devices given these input \(\mathbf{x}\), contains a “sub-model” \(f\) transforming the concatenation of two probability distributions (true and obtained) into an \(N'\)-dim feature vector which can be used to distinguish two devices. In this way, the feature vector obtained from \(f\) is an optimal description of a noise fingerprint for some device with respect to other devices. Moreover, \(g\) can be understood to be reading the character of a given fingerprint’s representation for backend identification. 2 in the main text presents these kinds of neurally-guided feature from our later experiments.

A less task-dependent alternative to produce a representation of the noise fingerprint in arbitrary dimension is to use a compressing architecture, such as a variational autoencoder (VAE). These models do not use a secondary process for contextualising how the representations should be learned, but instead work by composing an “encoder” with a “decoder”. The encoder works to reduce the input to some latent space, and the decoder works in reverse to reconstruct the original input from the latent space. Hence, the latent representation we learn is specifically designed to retain as much information as possible in lower dimensions. Such approaches can also be combined with a downstream task (e.g. classifying between devices) by re-purposing the encoder in a new model once trained (i.e. used as \(f\) in our above discussion). We leave the use of VAE-type noise fingerprint representation to future work.

As a final note before moving on to other approaches: the interpretation we can draw from \(f\) is thus inexplicably tied to which devices are used for training the full-model, as well as the nature of the training data. Especially, the set of circuits \(\mathcal{C}\) used to generate the data is of extreme importance, and allows us to enforce an interpretation on our representations. For example, if we choose \(\mathcal{C}\) to be a suitably general set of circuits, then we might expect that our latent representations will also be very general in nature—most likely learned to be as distinguishable per-device as possible without bias. On the other hand, we could choose \(\mathcal{C}\) to be very specific (e.g. stabiliser circuits, quantum Fourier transforms, low-depth random circuits, etc.) to hone in on some precise aspect of noise with respect to a specific task/computation. If we have two devices performing a particular task in some controlled context, then learning how their noise fingerprints differ with respect to this context could be extremely useful. The beauty of this neurally-guided approach is that it affords us the flexibility to change the set of circuits \(\mathcal{C}\), the downstream task, the latent dimension \(N'\), etc.

0.0.9.2 Per-Outcome Features

Increasing the strictness somewhat, we can instead opt to act directly on the probability distributions, retaining their shape and ordering. The most straightforward things we could want to do are to take residuals. We can then weight them in interesting ways to come up with different interpretations on the data.

A per-outcome feature \(\mathbf{x}=f(\mathbf{y},\mathbf{y}')\) works pairwise on elements as \(x_{i}=f(y_{i},y_{i}')\). For example,

• Standard residuals; \[x_{i}=y'_{i}-y_{i}\quad\text{or}\quad x_{i}=|y_{i}'-y_{i}|\quad ;\]

• Relative residuals; for some small \(\varepsilon>0\), \[x_{i}=\frac{y'_{i}-y_{i}}{y_{i}+\varepsilon}\quad\text{or}\quad x_{i}=\frac{|y'_{i}-y_{i}|}{y_{i}+\varepsilon}\quad ;\]

• Log-ratios; again, for some small \(\varepsilon>0\), \[x_{i}=\log\frac{y'_{i}+\varepsilon}{y_{i}+\varepsilon}\quad;\]

• \(Z\)-scores, which may be useful for isolating noise beyond sampling fluctuations: for \(m\) the number of shots, compute the variance as \(\sigma_{i}^2=y'_{i}(1-y_{i}')/m\), then for small \(\varepsilon>0\), \[x_{i}=\frac{y'_{i}-y_{i}}{\sqrt{ \sigma^2+\varepsilon }}\quad.\]

We use the first three (together with their absolute versions) in this work, and leave other transformations, such as \(Z\)-scores, to future work.

0.0.9.3 Per-Qubit Features

Now we restrict \(f\) to considerations on the qubit-scale, operating on qubit indices to define marginal distributions over our bitstrings for computing features. We can, as before, look toward residual-based features, taking sums with respect to each qubit index to produce \(n\)-dim representations.

Assume that outcomes are ordered as bitstrings \(b=b_{n-1},\dots,b_{0}\). Then we can operate directly on these bits in e.g. the following ways:

• Single-qubit marginals; for a qubit \(i\), \[x_{i}=\sum_{b:b_{i}=0}y'_{b}-y_{b}\quad\text{or}\quad x_{i}=\sum_{b:b_{i}=0}|y'_{b}-y_{b}|\quad;\]

• Pauli-\(Z\) expectation per qubit; \[x_{i}=\langle Z_{i}\rangle'-\langle Z_{i}\rangle=\sum_{b}(-1)^{b_{i}}(y_{b}'-y_{b})\quad;\]

• Two qubit correlators; producing \(n(n-1)/2\) features, with the \(i\)-th and \(j\)-th qubits giving, \[\begin{align} x_{i,j} &=\langle Z_{i}Z_{j}\rangle'-\langle Z_{i}Z_{j}\rangle\\ &=\sum_{b}(-1)^{b_{i}\oplus b_{j}}(y'_{b}-y_{b})\quad ; \end{align}\]

• And so on into higher orders; \[\begin{align} x_{i_{1},\dots,i_{m}} &=\langle Z_{i_{1}}\cdots Z_{i_{m}}\rangle'-\langle Z_{i_{1}}\cdots Z_{i_{m}}\rangle\\ &=\sum_{b}(-1)^{b_{i_{1}}\oplus\dots \oplus b_{i_{m}}}(y'_{b}-y_{b})\quad . \end{align}\]

We only extend into two-qubit correlator features in our experimentation, leaving higher orders to future work; with just \(n=5\) qubits, two-qubit correlations are sufficient.

0.0.10 Dimensionality Reduction Visualisation↩︎

We now visualise embeddings of our experimental data in two dimensions using two common techniques: principal component analysis (PCA) and \(t\)-distributed stochastic neighbour embedding (\(t\)-SNE). The former is a linear dimensionality reduction technique, which will allow us to understand the variance of our data projected into principal components and gauge the linear separability of the data classes (device membership, batch, etc.); the latter is a non-linear reduction which will much better allow us to understand the clustering of data classes as an indication for trainability. Such clustering patterns simply may not present in linear spaces, but can be exploited via the nonlinearity of deeply-layered neural networks with chained activation functions.

4 (a) demonstrates higher-dimensional clustering via \(t\)-SNE for the shallowest of the Haar-random circuit experiments, for a select few example features. It is immediately evident that like-type data points occupy similar neighbourhoods over many features, whereas differing-type data points indicate that at least a partial separation can be observed. Similarly, see 4 and 5.

0.0.11 Classification Results↩︎

We now consider some experimental classification tasks designed to empirically demonstrate that output distributions carry learnable route information. In the context of the backend identification game of 1, a classifier is a concrete decision rule for guessing the route that produced a given feature vector (representing a transcript derived from a finite-shot histogram). The test accuracies that we report here are then an empirical lower bound on the success probability achievable from the corresponding transcript class.

0.0.11.1 Device Classification

Device classification experiments use a multilayer perceptron with two hidden layers of widths 256 and 64 respectively, using batch normalisation, ReLU activation, and dropout after each layer, followed by a final classification layer.

Experimental Backend Identification Success Probability

1 shows that device identity can be recovered well above chance from finite-shot output data, most accurately from raw histogram features (as indicated by 2). High like-type classification accuracies are particularly interesting, as they indicate that the distinguishability is not only a platform-level effect and can exist between even physically very similar backends. Differing-type classification is expectedly near-perfect in the raw case; distinguishing differing physical platforms is likely made relatively easy due to different native noise mechanisms etc. It is also experimentally event that backend information is able to survive several lower-dimensional or more interpretable post-processing transformations, most notably log ratio features.

While the quantity and range of depths probed in these experiments is modest, the intermediate-depth principle formalised in Appendix 0.0.7 is supported by observations in 1. Several features exhibit a non-negligible improvement in performance as we jump from depth \(d=5\) to \(10\), particularly residual-based features in differing-type classification, and a general trend of decaying distinguishability thereafter can be observed across all features in the deeper like-type experiments. In fact, for almost all post-processing features computed in this work (excluding raw transcripts), we can observe convergence on near-zero distinguishing bias (i.e. test accuracy exceeding \(1/2\)) in increasing depth. We have trained classifiers with both a single probed depth (“at depth”) and a cumulative pooling across depths (“up to depth”) to demonstrate more clearly this additional variance introduced that is not route-specific—incorporating deeper observations into the training set often degrades the classification performance exactly due to this intermediate-depth principle punishing the addition of less-distinguishable, high-depth transcripts. In further support of the principle, some features are aided/hindered by pooling across depths at different rates, owing to their specific optima for the most distinguishable depth (their peak in 1).

It is worth briefly noting the perfect classification we observe when distinguishing devices via the GHZ circuit (column 5 in 1). Here we have a fixed and highly structured circuit with a particularly non-uniform ideal outcome distribution, all of which makes the task of distinguishing as direct as possible. This is an unsurprising result, but it should not be overlooked; in the context of our theoretical discussions of pseudo channel distances, this emphasises the role of the workload ensemble in allowing users to violate routing anonymity, and the ease with which they may do so.

Recall 2, which visualises the latent representations learned by the above classifiers (on raw transcripts). Similar clusterings across train, validation, and test data splits serves as a comforting visual marker of the generality with which backend-dependent noise signals can be learned. 2 (a) gives some particularly interesting insight about how separable our classifiers understand the like-type superconducting devices to be from the ion-trap device; Ankaa-3 and Aria-1 (of differing type) separate their representations very strongly in the latent space (strengthened in the differing-type-only classifier’s embeddings in 2 (b)), with the other superconducting device occupying the middle ground between the two, and densely mixing with its like-type counterpart while only sparsely mixing with the differing type.

0.0.11.2 Temporal (Batch) Classification

Now we ask whether time itself—the dynamics of backend-specific noise—imprints a learnable fingerprint in output distributions. Rather than asking which backend produced a given transcript, we fix the backend and ask when the transcript was produced (in a relative sense). Specifically, we classify a device’s transcripts by batch; since batches are separated by substantially longer intervals than calls within a batch, successful classification in the context of these experiments implies a long-range dynamic character to backend-specific noise signals.

These GHZ experiments are supplemented with an additional feature: bell summary, consisting of the two GHZ peak probabilities, total leakage into the remaining outcome states, peak imbalance, \(\ell_1\)-distance from the ideal GHZ distribution, and entropy. The intent here is to introduce a feature that understands broadly how much noise there is with respect to leakage away from the bell state’s support, but which is agnostic to specific detail about where that noise has ended up. If we see more specific features classifying better than bell summaries, then we can infer that our classifiers are identifying device-specific noise signals in shape and character, rather than simply learning that one device is ‘noisier’ than another.

Experimental Batch Classification (and Negative Control)

2 presents logistic-regression classifiers on balanced device-batch groups, with standardised input features evaluated over five random stratified train-test splits. Note that we have three distinct batches (for the two superconducting devices), so performance is measured against a majority baseline \(1/3\). We observe an extremely strong temporal structure. Retaining high classification accuracies in the combined dataset indicates that this temporal signal is not merely an artefact of training separate per-device classifiers; batch-dependent structure persists largely independently of apparent device signal. We include a control experiment in 2 wherein the dataset’s labels are randomly permuted. The same logistic-regression models fall to no better than majority guessing, supporting the conclusion that our high batch-classification accuracies are not caused by data leakage, class imbalance, or overparameterised classifiers.

These results naturally follow the persistent routing setting of 2, in which we repeatedly probe a fixed backend. In practice, we expect the induced law associated with a backend to drift over time, which can then produce the kind of temporal signal that we show above can be extremely identifying about the route. Great care should be taken with persistent routing to ensure that such identifying temporal structure is not also leaked via transcripts.

We also consider a shorter time-scale control by splitting each batch into an ‘early’ section and ‘late’ section, then perform a binary classification between the two. This gives us an empirical view for the learnability of the perhaps more erratic yet muted short-term drift over the lifespan of a contiguous batch. The intra-batch results presented in 3 yield a better prospect for short-term routing anonymity than the long-term identification in 2. It is clear, then, that the dominant temporal effect in these data are batch-scale effects rather than any drift within batches. This is useful insight for the difficulty of forecasting backend-specific noise in the short-term, as we do next.

Experimental Intra-Batch (Early vs Late) Classification

0.0.12 Distribution Forecasting↩︎

Our final experiment is exploratory and not intended to be a central contribution of the present work. The purpose of this section is to illustrate a natural continuation of the persistent routing formulation: if backend-specific noise signals have a strong (long-term) temporal structure, then is it possible to estimate precisely how noise will present in the future (that is, to “forecast” the noise fingerprint)? There are some intriguing possibilities surrounding this question; e.g. can we pre-emptively correct noisy outcome distributions consistently, or can we reverse-forecast to an early time to predict ideal distributions? Such questions make for interesting future work—we only indicate at the possibility for forecasting in this section.

We take the same time-ordered GHZ data and train a long short-term memory (LSTM) recurrent model to predict the next empirical outcome distribution from a short prior of previous distributions. Concretely, for a sequence of length \(L\), an input prior takes the form \((\mathbf{y}'_{t-L},\dots,\mathbf{y}'_{t-1})\) and ask for a prediction of \(\mathbf{y}'_t\) (note, we forecast the measured outcome distribution, not the true distribution). Our exploratory model uses 10 hidden layers of 512 dimensions, dropout, and a softmax normalised output layer, using a KL-divergence-based loss function.

An example prediction, alongside the actual measured distribution, is presented in 6, taking a prior window of \(L=10\) previous successive measurement steps in batch. Perhaps unsurprisingly, we are able to near-perfectly capture the precise leakage away from the all-0s and all-1s states, but more impressively, the rough localisation of the leakage across the remaining states can be broadly understood even at this short-term window scale.

At this stage, the result of 6 is merely a proof-of-concept. More complete study would ideally evaluate the correctness of forecasted distributions over many more metrics (we only use KL divergence here), and account for the irregularity of cloud-based computation times. In the context of routing anonymity, the forecasting problem presents an additional security vulnerability—that users may be able to strategically adapt their expectations about backend signals over time, even without an adaptive access model. Conversely, a provider looking to retain anonymity of their routing choices should not only be concerned about the distinguishability of fixed transcript laws, but also the temporal stability and predictability of their released transcripts over repeated service calls (particularly over longer time intervals).

References↩︎

---

1. At least prior to the unprecedented demand for incredibly large-scale compute that has followed the development of large large language models; even in the classical computing world, remote/cloud services are becoming standard practice, and increasingly so!↩︎