SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Abstract: The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.

• The paper introduces the SWAP Attack, demonstrating how adversaries exploit qubit crosstalk in multi-tenant quantum clouds to disrupt computations.
• The active mode leverages indirect connectivity to execute CNOT gates, reducing quantum output accuracy by up to 81.62%.
• The passive mode uses a minimal listening circuit to extract circuit details with 100% prediction accuracy of specific quantum states.

SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

Introduction

The paper introduces a novel side-channel attack known as the SWAP Attack, targeting multi-tenant quantum cloud systems. The proposed attack leverages crosstalk phenomena to compromise the integrity of quantum computations. Specifically, the attack exploits the SWAP path between qubits, manifesting in both active and passive modes. This work revisits quantum crosstalk, highlighting its repercussions on shared quantum devices and challenging existing defenses that rely on maintaining topological separation between circuits.

Active SWAP Attack

The active SWAP attack enables adversaries to disrupt quantum computations remotely. By exploiting crosstalk arising from specific SWAP paths, an attacker can execute a CNOT gate to influence a victim's quantum circuit, such as when running Grover's Algorithm, without being in proximity. The attack effectiveness is demonstrated through a decrease in output accuracy, wherein strategic qubit positioning can reduce accuracy by up to 81.62%.

Figure 1: Active SWAP Attack Flow.

The active attack emphasizes granular control, capable of inducing errors with varying degrees of severity—ranging from minor to critical disruptions. The attack's stealth is attributed to its reliance on indirect connectivity rather than physical adjacency, thereby challenging traditional defense methods based on circuit separation.

Figure 2: The Output Accuracy, $Acc_0$ of Victim Circuit Estimation Across Different Qubit Positions.

Passive SWAP Attack

The passive SWAP attack focuses on extracting sensitive information by utilizing a minimal circuit to capture crosstalk-induced signatures. Even with a circuit comprising only 6.25% of the victim's resources, adversaries can achieve 100% accuracy in predicting attributes such as circuit size and specific quantum states. The attack underscores the vulnerabilities associated with improper qubit allocation in shared environments.

Figure 3: Passive SWAP Attack Flow.

The methodological rigor involves constructing a listening circuit designed to detect deviations in expected outcomes attributed to the victim's operations. Experimentation on IBM's quantum devices validates the attack's viability, using controlled configurations to foster repeatability and reliability.

Figure 4: Tradeoff Between Listening Size, $Acc_1$, and Confidence in Experiment 3.

Implications and Future Work

The SWAP Attack presents significant implications for quantum cloud security, prompting reevaluation of current isolation strategies. By exploiting quantum device architecture's inherent crosstalk, the attack circumvents traditional defensive measures, advocating for enhanced security protocols. It reveals the inadequacy of extant threat models and underscores the need for robust qubit allocation policies mitigating crosstalk susceptibility.

Future directions might explore migration of attack methodologies to other quantum computing platforms like IQM Garnet on AWS BraKet. Additionally, deepening the theoretical understanding of non-local quantum interactions could yield insights into crosstalk mitigation strategies, thus fortifying quantum cloud infrastructure against similar intrusion vectors.

Conclusion

The study of the SWAP-based side-channel attack illuminates critical vulnerabilities within multi-tenant quantum cloud systems. Active and passive modes highlight both operational interference and information leakage, underscoring the need for more sophisticated, scalable security measures. As the frontiers of quantum computing rapidly advance, ensuring the integrity and confidentiality of quantum operations becomes paramount.