⚛️ quantum physics

Routing Anonymity and Identifiability of Noisy Quantum Hardware

This paper establishes a formal framework demonstrating that noisy quantum hardware inherently leaks backend-specific fingerprints in classical outputs, creating a fundamental trade-off between routing anonymity and utility that decays exponentially with circuit depth, as validated by both theoretical analysis and experiments on Amazon Braket.

Original authors: Ben Priestley, Mina Doosti

Published 2026-07-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ben Priestley, Mina Doosti

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are ordering a custom cake from a famous bakery. You send them your recipe (a quantum circuit), and they bake it in one of their many ovens (quantum hardware). When they send the cake back, they don't tell you which oven they used. They might have a super-hot industrial oven, a gentle convection oven, or a vintage wood-fired one.

This paper asks a simple but tricky question: Can you figure out which oven was used just by looking at the cake?

In the world of quantum computing, the "cake" is the data the computer sends back. Even though the user doesn't know which specific machine ran their job, the machine leaves behind tiny, invisible "crumbs" or fingerprints in the data. These fingerprints are caused by the unique, messy imperfections (noise) of that specific piece of hardware.

Here is a breakdown of the paper's main ideas using everyday analogies:

1. The "Fingerprint" Problem

Think of quantum computers like different brands of coffee makers. Even if you use the exact same coffee beans and water, a Keurig might taste slightly different from a French Press because of how they heat the water or how the filter works.

The Paper's Claim: In quantum computing, the "taste" (the output data) of a noisy machine is so unique that a clever observer can look at the results and say, "Ah, this was definitely made by the IonQ machine, not the Rigetti machine."
The Risk: If a cloud provider wants to keep their scheduling secret (e.g., "I'm using my most reliable machine today"), but the user can guess it just by looking at the data, the provider's privacy is broken.

2. The Game of Hide-and-Seek

The authors created a formal "game" to test this:

The Provider secretly picks a machine (a route).
The User sends a test circuit (a probe).
The Provider runs it and sends back the results.
The User tries to guess which machine was used.

The paper proves that this game is mathematically the same as a statistical detective game. If the user collects enough data points, they can almost always win. The paper shows that the more times the user asks for a result, the easier it becomes to identify the machine, and the speed at which this happens follows a predictable mathematical rule (called the "Chernoff rate").

3. The "No Free Lunch" Trade-off

This is the most practical part of the paper. The provider might think, "I'll just scramble the data before sending it back so the user can't tell which machine I used."

The Analogy: Imagine the provider tries to hide the coffee's origin by blending it with so much milk and sugar that you can't taste the beans anymore.
The Catch: If you add too much milk, the coffee stops tasting like coffee. The paper proves a "No Free Lunch" theorem: You cannot remove the "fingerprint" (the machine's identity) without also removing the "flavor" (the usefulness of the result).
The Result: There is a hard limit. If the provider wants to keep the result useful for the user, they can only hide so much of the machine's identity. You can't have perfect anonymity and perfect utility at the same time.

4. The "Goldilocks" Zone (Depth)

The paper discovered that identifying the machine isn't easy at every stage of the calculation.

Too Shallow (Too Early): If the calculation is very short, the machine hasn't had time to make its unique mistakes yet. All machines look the same (like a cake that hasn't been baked long enough to develop a crust).
Too Deep (Too Late): If the calculation is extremely long, the noise becomes so chaotic and random that it washes out the specific "signature" of the machine. It's like a cake that has been burned to a crisp; you can't tell what kind of oven made it because everything is just charcoal.
Just Right (Intermediate): There is a "Goldilocks" window in the middle where the machine's unique noise patterns are strong enough to be seen, but not so chaotic that they disappear. This is where the "fingerprinting" works best.

5. Real-World Testing

The authors didn't just do math; they tested this on real quantum computers available in the cloud (Amazon Braket).

They used different types of circuits (random ones and structured ones).
They found that they could correctly identify the machine 87–90% of the time between similar machines (like two different superconducting computers) and 96–100% of the time between very different machines (like a superconducting one vs. an ion-trap one).
They also found that even if the provider tried to clean up the data (post-processing), the fingerprints often survived.

Summary

This paper establishes that quantum cloud providers cannot easily hide which specific machine they used just by looking at the final data. The data carries a unique "signature" of the hardware. While providers can try to hide this by scrambling the data, they hit a hard wall: if they scramble it too much, the data becomes useless to the customer.

The paper provides a new framework for understanding this balance, proving that "routing anonymity" (hiding which machine was used) is a real security challenge that needs to be managed carefully in the future of quantum cloud computing.

Technical Summary: Routing Anonymity and Identifiability of Noisy Quantum Hardware

1. Problem Statement

In the emerging paradigm of Quantum-as-a-Service (QaaS), users submit quantum circuits to cloud providers who execute them on proprietary, noisy quantum processing units (QPUs). While providers often wish to obscure implementation details, scheduling policies, or the specific physical hardware used, the classical output distributions from these noisy, finite-shot executions inherently contain "fingerprints." These fingerprints are backend-specific noise signatures imprinted in the data.

Currently, the literature largely treats these fingerprints as tools for verification or benchmarking from a user-side perspective. However, there is a significant gap in understanding the provider-side privacy implications: to what extent can a provider anonymize their routing choices (i.e., hide which backend executed a circuit) without compromising the utility of the service? The core question addressed is: How much route information is leaked by the classical outputs of noisy quantum hardware?

2. Methodology and Framework

The Backend Identifiability Game

The authors formalize the privacy problem as an operational game between a user (adversary) and a provider:

Setup: The provider selects a hidden backend $D_I$ from a set of candidates according to a prior distribution.
Interaction: The user submits a workload circuit $C$ (sampled from an agreed ensemble).
Execution: The provider executes $C$ on $D_I$ for $m$ shots, generating a raw empirical distribution.
Post-Processing: The provider applies a deterministic map $\phi$ to the raw distribution to produce a transcript $X$ returned to the user.
Guessing: The user attempts to guess the backend label $I$ based on $X$ .

The provider's goal is to ensure the user's success probability is no better than random guessing (anonymity), while the user aims to maximize identification accuracy.

Theoretical Formalization

The paper establishes several theoretical pillars:

Reduction to Hypothesis Testing: Backend identifiability is shown to be exactly equivalent to a classical statistical hypothesis testing problem. The probability of correctly identifying a backend is directly related to the Total Variation (TV) distance between the induced transcript laws of the backends.
Persistent Routing and Chernoff Rate: In a multi-round setting where the user probes a fixed backend passively and independently (i.i.d.), the paper proves that routing anonymity decays exponentially. The rate of this decay is governed by the Chernoff information between the transcript laws of the competing backends.
Utility-Anonymity Trade-off: The authors introduce a "No-Free-Lunch" theorem. They formalize that any post-processing map $\phi$ designed to preserve the utility of the service (e.g., estimating ground-state energy) cannot remove route-specific information that is already encoded within that utility. Consequently, there is a fundamental limit to anonymity; one cannot increase anonymity beyond the level of the utility law without degrading the service.
Intermediate-Depth Principle: Using a Pauli-transfer-matrix (PTM) model, the paper proves that backend identifiability is an intermediate-depth phenomenon.
- Shallow depths: Backends are indistinguishable because they approximate the ideal circuit too closely.
- Deep depths: Common noise mixing (depolarization) washes out backend-specific signals.
- Intermediate depths: Noise has accumulated enough to reveal backend structure but not enough to collapse into universal behavior, creating a "window" of maximum identifiability.
Workload-Probed Distance: The authors propose a new channel (pseudo-)distance, $\delta_\mu$ , tailored to the user's specific workload ensemble. They show this provides a tighter, more practical bound on distinguishability than the worst-case diamond norm.

3. Experimental Results

The theoretical framework was validated using Amazon Braket on AWS, running experiments on three distinct QPUs:

Rigetti Ankaa-3 (Superconducting)
IQM Garnet (Superconducting)
IonQ Aria-1 (Ion-trap)

Experimental Design:

Workloads: Two types of probe circuits were used: "depth-varied" (random circuits of varying depths) and "time-varied" (repeated GHZ circuits).
Post-Processing: Various deterministic maps were applied to raw outcomes to test their ability to suppress fingerprints.
Classification: Simple machine learning classifiers were trained on the resulting transcripts.

Key Findings:

High Identifiability: Classifiers achieved 87–90% accuracy in distinguishing between the two superconducting backends (like-type) and 96–100% accuracy when distinguishing between superconducting and ion-trap platforms (differing-type) using raw features.
Resilience to Post-Processing: Identifiability survived several forms of post-processing. For instance, log-ratio features still yielded 66–77% accuracy for like-type classification.
Structured vs. Random: Highly structured circuits (GHZ) allowed for perfect (100%) classification, highlighting that workload choice significantly impacts anonymity.
Temporal Dynamics: While long-term fingerprints were strong, short-term temporal structure (within a batch of time-varied data) was harder to classify, suggesting that short-term persistent routing might offer slightly better anonymity than long-term, though random circuits still retained high identifiability.

4. Key Contributions

Unified Framework: The first formal definition of routing anonymity as a security notion for quantum cloud services, operationalized through a backend identifiability game.
Statistical Characterization: A reduction of backend identification to hypothesis testing, linking anonymity decay to Chernoff information and distinguishing bias to Total Variation distance.
Utility-Anonymity Trade-off: A formal proof establishing that providers cannot remove backend-specific information without degrading the promised utility of the service.
Intermediate-Depth Principle: A theoretical proof that backend distinguishability peaks at intermediate circuit depths, bounded by noise accumulation and mixing.
Practical Metrics: Introduction of a workload-probed channel distance that offers tighter, experimentally achievable bounds on anonymity compared to worst-case norms like the diamond norm.
Empirical Validation: Demonstration that real-world noisy quantum hardware leaks significant route information, even between devices of the same architecture, and that this leakage persists through various post-processing methods.

5. Significance and Claims

The paper claims to establish routing anonymity as a distinct and critical security requirement for quantum cloud computing, separate from the well-studied user-side privacy (blind quantum computation).

The authors argue that:

Current quantum cloud outputs are not merely noisy approximations of ideal distributions but contain learnable, backend-specific fingerprints.
Providers cannot rely on "hiding the label" alone; the physical noise characteristics inherently leak identity.
There is a fundamental, mathematically provable trade-off between the utility of the service and the anonymity of the routing.
The "intermediate-depth" window represents a critical regime where identifiability is highest, suggesting that circuit depth is a key parameter for both benchmarking and privacy analysis.

The work provides a framework for quantifying these risks and suggests that future service providers must carefully consider workload selection, shot counts, and post-processing strategies to balance utility with the privacy of their routing infrastructure. The paper explicitly notes that it does not aim to reconstruct full noise models or perform tomography, but rather to quantify the risk of identity leakage in practical, finite-shot scenarios.