QCIVET: Hybrid Pipeline Integrity Framework

• QCIVET is a contract-based integrity framework that audits hybrid quantum–classical pipelines by coupling syntactic (hash-chain) logging with semantic (observable-based) verification.
• It employs calibrated observable-deviation tests grounded in behavioural subtyping to ensure quantum stage operations adhere to specified contracts under noisy hardware conditions.
• The framework integrates tamper-evident audit trails with external anchoring, enabling detection of in-pipeline modifications and ensuring end-to-end integrity with negligible overhead.

Searching arXiv for QCIVET and closely related terms to ground the article in the cited literature. QCIVET is a contract-based integrity-verification framework for hybrid quantum–classical pipelines. It models a pipeline as an ordered sequence of stages with explicit specifications, audits those stages at both syntactic and semantic levels, and verifies quantum-stage behaviour through a calibrated observable-deviation test grounded in behavioural subtyping in the sense of Liskov and Wing (Yeniaras et al., 13 May 2026). In contemporary arXiv usage, the term is also a source of ambiguity: in autonomous-driving literature, “QCIVET” is identified as a misspelling or variant of Q‑ICVT rather than a distinct 3D detection method (Dharavath et al., 2024), while in quantum-hardware discussion it may be used as a variant or misspelling of QCVV, the umbrella term “Quantum Characterization, Verification, and Validation” (Blume-Kohout et al., 20 Mar 2025). The primary technical meaning attached to the exact acronym QCIVET is therefore the hybrid-pipeline integrity framework introduced in 2026 (Yeniaras et al., 13 May 2026).

1. Terminology and referential scope

The current literature attaches multiple nearby meanings to the string “QCIVET,” but only one corresponds to a method explicitly named QCIVET. The disambiguation is technically important because the same token appears across distinct research areas.

Term	Meaning in the cited literature	Source
QCIVET	A quantum–classical pipeline integrity framework with contract-based subtype verification and hash-chained audit traces	(Yeniaras et al., 13 May 2026)
QCIVET / QCIVET variant	A misspelling or variant of Q‑ICVT; there is no distinct method called QCIVET in that paper	(Dharavath et al., 2024)
QCIVET / QCVV variant	An apparent variant or misspelling of QCVV, “Quantum Characterization, Verification, and Validation”	(Blume-Kohout et al., 20 Mar 2025)

Within the integrity-framework sense, QCIVET addresses a problem not handled by classical supply-chain tooling alone. Hybrid quantum–classical workloads increasingly place quantum computation in a middle stage of an otherwise classical pipeline, as in variational quantum eigensolver workflows, quantum-assisted fraud detection, and cloud QPU auditing. Classical provenance systems can show that recorded artifacts and recipes are consistent, but they do not verify how a quantum stage actually behaves on noisy hardware, and they do not prevent semantically valid execution logs from being rewritten afterwards (Yeniaras et al., 13 May 2026).

This suggests that QCIVET should be understood less as a generic label for verification and more as a specific pipeline-level framework that unifies structural provenance with runtime behavioural checking for quantum stages. By contrast, QCVV is an umbrella term for characterization and benchmarking techniques for quantum hardware, and Q‑ICVT is a LiDAR–camera fusion architecture for 3D object detection rather than an integrity framework (Blume-Kohout et al., 20 Mar 2025, Dharavath et al., 2024).

2. Pipeline model, stage specifications, and the integrity split

QCIVET models a hybrid pipeline as an ordered list of stages,

$S_1, S_2, \dots, S_n,$

with each stage $S_i$ carrying a name and a spec $\sigma_i$, where the spec is a JSON-serializable record of all parameters that determine behaviour. The examples given for such parameters include backend id, transpiler version, calibration snapshot hash, optimiser settings, and classifier threshold (Yeniaras et al., 13 May 2026). The spec is the unit of accountability: if behaviour changes, the spec must change.

The framework divides integrity into two axes. Syntactic integrity, also described as structural integrity, asks whether the recorded steps were modified. Semantic integrity, restricted to quantum stages, asks whether the implemented quantum operation behaved within a tolerance of the declared contract on real, noisy hardware (Yeniaras et al., 13 May 2026). This split is central to the framework’s design, because byte-level provenance and channel-level behaviour are treated as distinct verification problems.

For a quantum stage, behaviour is modelled as a quantum channel,

$E : D(\mathcal{H}) \to D(\mathcal{H}),$

where $D(\mathcal{H})$ denotes density matrices on a finite-dimensional Hilbert space $\mathcal{H}$. The external interface of such a stage is described in terms of observables $O$ and their expectations

$\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$

Distance between channels is measured by the diamond norm,

$$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$

This is the operational distinguishability metric used to connect observable-level contracts to full channel behaviour (Yeniaras et al., 13 May 2026).

A plausible implication is that QCIVET’s abstraction deliberately elevates quantum stages from opaque execution nodes to auditable contractual objects. The framework does not merely record that a circuit was run; it binds stage-level declarations to observables and tolerances that can be tested empirically.

3. Behavioural subtyping and semantic integrity at quantum stages

The semantic core of QCIVET is a translation of Liskov–Wing behavioural subtyping to quantum channels. A supertype stage $A$ is assigned a contract $S_i$0, where $S_i$1 is a finite family of observables and $S_i$2 is a tolerance. A candidate implementation $S_i$3 is a behavioural subtype of $S_i$4 with respect to that contract when, for every input state $S_i$5,

$S_i$6

This is the framework’s definition of contract-preserving subtyping, denoted

$S_i$7

The interpretation is operational: a client restricted to the observables in $S_i$8 cannot detect more than $S_i$9 deviation between the candidate and the supertype (Yeniaras et al., 13 May 2026).

QCIVET’s runtime semantic check is the calibrated observable-deviation test. The procedure selects an observable family $\sigma_i$0 and tolerance $\sigma_i$1, calibrates $\sigma_i$2 from analytical, simulated, or device-derived noise, estimates

$\sigma_i$3

from finite-shot measurements, computes deviations

$\sigma_i$4

and forms the worst-case statistic

$\sigma_i$5

The candidate is accepted as a subtype if $\sigma_i$6, and otherwise a semantic integrity violation is flagged (Yeniaras et al., 13 May 2026).

The framework proves three principal theoretical results. Theorem 1 establishes soundness: if

$\sigma_i$7

then

$\sigma_i$8

with $\sigma_i$9. Theorem 2 establishes conditional completeness for informationally complete observable families and sufficiently rich input sets: $E : D(\mathcal{H}) \to D(\mathcal{H}),$0 For a single qubit with $E : D(\mathcal{H}) \to D(\mathcal{H}),$1, the paper gives the explicit constant $E : D(\mathcal{H}) \to D(\mathcal{H}),$2. Theorem 3 gives compositionality for inheritance chains of overrides, with accumulated deviation bounded by

$E : D(\mathcal{H}) \to D(\mathcal{H}),$3

These results tie observable contracts, diamond-norm channel closeness, and multi-stage composition into a unified verification discipline (Yeniaras et al., 13 May 2026).

In relation to broader QCVV, this places QCIVET at a different level of abstraction. QCVV broadly covers characterization and benchmarking of qubits, gates, and processors, whereas QCIVET operationalizes a pipeline-level, adversarial, contract-based runtime check over quantum channels (Blume-Kohout et al., 20 Mar 2025).

4. Hash-chained audit traces and external anchoring

The syntactic component of QCIVET is a tamper-evident audit trail implemented as a hash chain. The genesis hash is

$E : D(\mathcal{H}) \to D(\mathcal{H}),$4

and each stage updates the chain via

$E : D(\mathcal{H}) \to D(\mathcal{H}),$5

where $E : D(\mathcal{H}) \to D(\mathcal{H}),$6 is a deterministic JSON serialization with sorted keys and no whitespace, and $E : D(\mathcal{H}) \to D(\mathcal{H}),$7 is SHA-256 or another collision-resistant hash or MAC. Each log entry stores $E : D(\mathcal{H}) \to D(\mathcal{H}),$8. Recomputing hashes from $E : D(\mathcal{H}) \to D(\mathcal{H}),$9 detects any post-hoc modification, insertion, or deletion of stage specs (Yeniaras et al., 13 May 2026).

Hash chaining alone does not prevent a global rewrite in which an attacker recomputes the entire chain over a different stage sequence. QCIVET therefore supports external anchoring of chain heads to an external log, including Sigstore Rekor, an RFC 3161 timestamp authority, or a public blockchain. The verification routine verify_against_anchor checks that the local chain appears as a contiguous, immutable segment in the anchor log (Yeniaras et al., 13 May 2026).

The reference engine is implemented in Python and is explicitly described as single-threaded. Its median per-stage commit latency is less than $D(\mathcal{H})$0 ms, its 99th percentile latency is less than $D(\mathcal{H})$1 ms, and overhead for a 6-stage pipeline is less than $D(\mathcal{H})$2 ms. The same section notes that quantum jobs dominate runtime; the real ibm_fez experiment, for example, took more than $D(\mathcal{H})$3 s wall time (Yeniaras et al., 13 May 2026). This division of cost is architecturally significant: the integrity layer is designed to be operationally negligible relative to QPU execution.

The design trade-off is explicit. QCIVET achieves low overhead and simple deployment without additional quantum resources, but it relies on classical hash assumptions and on the integrity of the external anchor. The paper also notes that SHA-256 can be replaced with SHA-3 or a PQ-safe MAC without changing the architecture (Yeniaras et al., 13 May 2026).

5. Weak contracts, sneaky overrides, and empirical validation

A distinctive contribution of QCIVET is its treatment of “Z-only-sneaky overrides.” Such an override preserves the expectation value of $D(\mathcal{H})$4 for all inputs while deviating in $D(\mathcal{H})$5 and $D(\mathcal{H})$6, so it can be contract-preserving under a weak $D(\mathcal{H})$7 contract even when the corresponding channel differs substantially from the supertype. Under a full $D(\mathcal{H})$8 contract, the same implementation is exposed (Yeniaras et al., 13 May 2026).

The paper’s worked example uses the single-qubit supertype

$D(\mathcal{H})$9

together with three candidates: a good override $\mathcal{H}$0, a bad over-rotation $\mathcal{H}$1, and a sneaky override

$\mathcal{H}$2

In noiseless Experiment 1, the full contract $\mathcal{H}$3 yields worst deviations $\mathcal{H}$4 for $\mathcal{H}$5, $\mathcal{H}$6 for $\mathcal{H}$7, and $\mathcal{H}$8 for $\mathcal{H}$9. Under the weak $O$0 contract, the corresponding worst deviations are $O$1, $O$2, and $O$3, so the sneaky override is completely hidden (Yeniaras et al., 13 May 2026).

The formal characterization is Proposition 4: for unitary single-qubit channels, there exists a sneaky subtype $O$4 satisfying

$O$5

if and only if $O$6 is not informationally complete. This makes the weakness of single-Pauli contracts a theorem rather than a heuristic warning (Yeniaras et al., 13 May 2026).

The empirical evaluation uses calibration-derived noise models from IBM FakeBrisbane, described as Eagle r3-class with 127 qubits, and FakeFez, described as Heron r2-class with 156 qubits. In Experiment 5, $O$7 under a $O$8-observable calibration protocol shows, for FakeBrisbane, mean deviations up to approximately $O$9 and 95th percentile up to approximately $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$0; for FakeFez, mean deviations up to approximately $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$1 and 95th percentile approximately $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$2. The paper therefore suggests practical tolerances of $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$3 for Eagle-class devices and $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$4 for Heron-class devices (Yeniaras et al., 13 May 2026).

Experiment 6 repeats subtype separation under realistic device noise. Worst-case deviations across 18 input-observable pairs remain strongly separated. On FakeBrisbane, the full-contract deviations are $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$5, $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$6, and $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$7 for $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$8, $\langle O\rangle_{\rho} = \mathrm{Tr}(O\rho).$9, and $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$0, while Z-only gives $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$1, $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$2, and $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$3. On FakeFez, the corresponding full-contract values are $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$4, $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$5, and $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$6, while Z-only gives $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$7, $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$8, and $$\|E_A - E_B\|_\diamond = \sup_{\rho \in D(\mathcal{H} \otimes \mathcal{H})} \big\| (E_A \otimes \mathrm{id})(\rho) - (E_B \otimes \mathrm{id})(\rho) \big\|_1.$$9 (Yeniaras et al., 13 May 2026).

The end-to-end hardware validation is performed on a real ibm_fez processor, identified as Heron r2, using 54 circuits, 4096 shots per circuit, and a wall time of approximately $A$0 s. Worst-case deviations are $A$1 and $A$2 for $A$3 under full and Z-only contracts, $A$4 and $A$5 for $A$6, and $A$7 and $A$8 for $A$9. The full-contract sneaky deviation follows the sequence

$S_i$00

from ideal to simulated to real hardware, while Z-only remains at the noise floor $S_i$01 (Yeniaras et al., 13 May 2026).

This suggests that the sneaky-subtype phenomenon is not merely a theoretical construction. In the framework’s own operational terms, it persists under simulated calibration noise and on a real cloud QPU, which makes contract design an integral part of integrity rather than a secondary implementation detail.

6. Applications, implementation, limitations, and relation to adjacent literatures

QCIVET is instantiated on three representative six-stage pipelines. In a VQE workflow for early-stage drug discovery, the stages are molecular_geometry, active_space_selection, hamiltonian_construction, ansatz_synthesis, vqe_optimization, and result_interpretation. The quantum contract is placed at stage 5 with observable $S_i$02, reference ground-state energy $S_i$03, and tolerance $S_i$04 Ha as a Heron-class noise budget. The paper reports that local tampering in the active-space stage is detected by hash-chain replay, semantic drift in the VQE stage is detected at quantum commit, and a global workflow rewrite is detected by anchor verification (Yeniaras et al., 13 May 2026).

In quantum-assisted fraud detection, the six stages are transaction_ingestion, feature_engineering, quantum_kernel_preparation, qpu_kernel_evaluation, classification, and alert_decision. The quantum contract at stage 4 uses worst-case kernel-entry deviation with reference $S_i$05 and tolerance $S_i$06. The reported findings distinguish two failure modes: kernel poisoning beyond the noise budget is caught at quantum commit, whereas a post-commit threshold-raising attack is caught by verify_full_chain rather than by real-time commit checks (Yeniaras et al., 13 May 2026).

In customer-side auditing of cloud QPU services, the stages are customer_submission, cloud_transpilation, backend_assignment, calibration_verification, job_execution, and result_delivery. The quantum contract at stage 5 uses a tracer-circuit expectation such as $S_i$07 on a qubit with known Heron-class behaviour, with tolerance derived from calibration at approximately $S_i$08. The framework is claimed to detect silent backend downgrade, calibration spoofing, and assignment rewrite, and the paper states that QCIVET allows the customer to reject results before paying (Yeniaras et al., 13 May 2026).

The reference implementation is released at https://github.com/schrodinket/QCIVET. It includes qcivet_realtime.py, whose IntegrityVerifier class exposes commit_stage, verify_full_chain, and verify_against_anchor, along with simulation, device-validation, real-QPU, and application-demo scripts. The implementation uses Python and Qiskit, and is described as extensible to other SDKs such as Cirq and Braket by re-implementing observable measurement while leaving contracts and the hash-chain layer unchanged (Yeniaras et al., 13 May 2026).

The framework’s limitations are also explicit. Its correctness depends on calibration quality; it assumes no hash collisions, no forged external anchor logs, and no tampering with verifier runtime memory; conditional completeness depends on informationally complete observable families; and the constants $S_i$09 grow with dimension, making multi-qubit informationally complete contracts expensive to calibrate (Yeniaras et al., 13 May 2026). Future work is identified in multi-qubit and entangled-observable contracts, provider-side deployment patterns, integration with PQC signatures and quantum-augmented hashes, and automated $S_i$10-selection tooling (Yeniaras et al., 13 May 2026).

Relative to prior work, QCIVET is positioned against five strands: classical supply-chain integrity systems such as in-toto, SLSA, and Sigstore; PQ-resistant signing for classical workflows; quantum cryptography and quantum hashes; quantum software contracts and refinement orders; and cloud-QPU trust mechanisms such as device fingerprinting, distributed-shot protocols, quantum PUFs, and delegation protocols. Its claimed novelty is the first unified combination of hash-chain syntactic integrity for hybrid pipelines, behavioural subtyping for quantum channels, calibration-ready observable contracts with soundness, conditional completeness, and compositionality, explicit treatment of sneaky subtypes, and empirical validation on real hardware (Yeniaras et al., 13 May 2026).

In adjacent literatures, the acronym should not be conflated with Q‑ICVT, a “Quantum Inverse Contextual Vision Transformers” architecture for LiDAR–camera fusion in autonomous vehicles, or with QCVV, the broader methodology of quantum characterization, verification, and validation (Dharavath et al., 2024, Blume-Kohout et al., 20 Mar 2025). The former is a classical, quantum-inspired 3D detector, and the latter is a field-wide toolbox of characterization and benchmarking methods. QCIVET, in the strict sense established by its title and formulation, is instead a pipeline-integrity framework for hybrid quantum–classical systems (Yeniaras et al., 13 May 2026).