A Quantum Circuit Obfuscation Methodology for Security and Privacy

Quantum Computing can provide exponential speed-up over classical counterparts to solve certain class of combinatorial problems e.g., data analytics, material discovery, and drug synthesis. The computing power of quantum computers is growing due to rapidly evolving noise mitigation techniques [1, 2], ever-increasing number of qubits, and improving error rates and decoherence times [3]. Powerful gate-based universal quantum computers has potential to solve societal and science problems that are deemed hard by classical computers as also hinted by the Google experiment [4]. Hybrid classical-quantum computing using shallow depth variational algorithms e.g., Quantum Approximate Optimization Algorithm (QAOA) and Variational Quantum Eigensolver (VQE) [5, 6] has been explored to compute approximate solutions in presence of noise. Even if these circuits are shallow (to be meet the coherence time specification), the complexity can be very high depending on the problem and the number of required qubits. The problem-specific parametric quantum circuits designed using variational algorithms e.g., QAOA to solve certain problems embed the topology of the problem (an asset). For applications e.g., power grid (or other critical infrastructure) optimization, the client would like to keep the problem information confidential. Non-parametric circuits e.g., Quantum Fourier Transform (QFT) that are optimized for higher success probability with lower gate count and depth (to meet certain hardware coupling constraint) also contain Intellectual Property (IP). These IPs may not present risk for small scale quantum circuits that can be compiled on trusted vendors e.g., IBM and Rigetti. Considering the scaling trend of current Noisy Intermediate Scale Quantum (NISQ) computers, hardware architectures with more than 200-1000 qubits are predicted to become a reality by 2023 [7, 8]. Motivation: Success of quantum circuits on NISQ computers heavily relies on the quality of the optimization. Poorly optimized circuits even though functionally identical to an optimized circuit, will produce random results. This aspect is different from semiconductor circuit optimization which mostly focus on improving area, power and speed. Several $3^{rd}$ party compilers [9, 10] claim efficient optimization of complex circuits. These trends lead to dependence on untrusted $3^{rd}$ party compilers for improved circuit depth and faster compilation time even for large, complex and dense quantum circuits. This is primarily due to inability of trusted compilers to converge for large-scale quantum circuits with higher packing density [11]. An untrusted compiler can steal sensitive IP and problem properties. Fig. 1 shows a simplified design flow to solve an optimization problem using quantum computing. Obfuscation is necessary to protect the IP while ensuring the correct compilation and functionality. Conventional obfuscation techniques e.g., hiding gate functionality is ineffective since that will hinder the optimization process. For example, if a CNOT gate is camouflaged as a Toffoli gate, it will lead to incorrect compilation. This paper proposes a logic obfuscation approach to deal with the aforementioned threats. To the best of our knowledge, this is the first effort to identify a new security and privacy threat space in the quantum circuit compilation and develop countermeasures. Proposed idea: Although obfuscation can protect the IP, probabilistic nature of computation and inherent margin between correct/incorrect outputs makes functional corruption challenging even with addition of fake gates. For example, if the probability of 0 and 1 measurement of a single qubit circuit is 0.8 and 0.2, respectively (i.e., a margin of 0.6) then the obfuscation needs to overcome this margin to corrupt the functionality. Obfuscation can also degrade the circuit quality due to poor optimization. The proposed obfuscation technique inserts additional gate operations (e.g., SWAP gates) which are not part of the original circuit. We refer to these additional gate operations as dummy gates. The circuit designer inserts these dummy gates to the original circuit using our proposed method before sending it to the $3^{rd}$ party compiler. The objective is to hide the true functionality of the circuit from the untrusted compiler. The adversary needs to identify and remove the dummy gates from an obfuscated circuit to extract the original circuit. This is a computationally hard problem since any gate can be a potential dummy gate. Furthermore, there is a lack of oracle model (the quantum chip implements functionality using microwave/laser pulses that are not publicly accessible) to validate the adversarial guess. Therefore, adversarial effort to RE the obfuscated design is high. Any attempt to reuse the circuit without removing the dummy gates will result in corrupted or severely degraded performance. SWAP gates are chosen as dummy gates due to ease of removal post-compilation by the designer and functional corruption by exchanging the states between two qubits.To further illustrate the idea, we have executed the circuit shown (Fig. 1) on default noisy simulation model of FakeValencia with and without the dummy SWAP gate. The outputs are obtained for 8 possible inputs. For example, we observe {“00000”:10212, “10000”:7889, “10100”:5084, “11000”:10057, “11100”:5227, “00100”:7186, “01000”:46956, “01100”:7389} in (Fig. 3) for 123 counter circuit as correct outcome over 100000 shots. Here the first and second numbers separated by colon are measured output bits and observation frequency, respectively. However, we observe {“00000”:14672, “10000”:3969, “10100”:6662, “11000”:2319, “11100”:1646, “00100”:53046, “01000”:6458, “01100”:11228} after inserting dummy gate at position $6$. The obfuscated output distribution is quite different from the original circuit output distribution which indicates obfuscation of functionality. We use Total Variation Distance (TVD) as a measure of the degradation or the difference between obfuscated output and original output. TVD is defined as $\sum_{i}(|x_{orig,i}-x_{obfus,i}|\div shots)$. Here, $x_{i}$ is the count of $i^{th}$ element of a distribution.

One of the challenges with this technique is the lack of knowledge of the correct output state for a realistic optimization problem that is solved using the quantum circuit. Therefore, the designer cannot evaluate the effectiveness of his obfuscation using simulations. We propose several metrics to identify the right location where the dummy gate should be inserted to corrupt the output with high likelihood. Such a metric is identified from the insights developed from an exhaustive analysis of small quantum circuit benchmarks for various dummy gate insertion points evaluated using simulations. Main contributions: We, (a) propose novel threat model, (b) propose two qubit SWAP gate as a dummy gate-based obfuscation technique, (c) perform exhaustive experiments on a set of benchmarks, (d) propose features e.g., depth of circuit for each position and number of control qubits as metrics to select the SWAP gate location, (e) present extensive analysis and validation of the proposed metric-guided insertion of SWAP gates. Paper organization: We review the background material in Section II. Sections III and IV present the threat model and the proposed obfuscation procedure, respectively. Section V focuses on the simulation results and analysis. The discussions are presented in Section VI and conclusions are drawn in Section VII.

Motivation: Quantum circuits can be lucrative targets of stealth for making profit if they are reused in multiple applications e.g., quantum Machine Learning (ML) circuits like classifiers. Problem-specific circuits optimized to solve the problem at scale can also be considered as IP. Furthermore, leaking of high-level information e.g., type of algorithm used in the circuit and the problem that is being solved can provide undue financial/political advantage to the adversary and compromise national security (depending on the problem being solved by the quantum circuit).

Threats involved and feasibility: One of the important aspects of quantum circuit compilation is to optimize the circuit for improved circuit depth and reduced gate count. Several $3^{rd}$ party compilers are evolving that offer optimization at faster compilation time even for large quantum circuits [9, 10]. Following factors will motivate the quantum circuit designers to avail the untrusted $3^{rd}$ party compilation services, (a) success of quantum circuit, since optimized circuit is essential to obtain meaningful results from NISQ computers. Poorly optimized circuit even though functionally identical to optimized circuit will produce random outputs; (b) lack of trusted compilers that have caught up with the latest advancements in optimization; (c) availability of efficient but untrusted $3^{rd}$ party compilers ([20, 9, 10]) that are being developed to optimize depth and gate count compared to trusted compilers. These compilers can be hosted on either the local machines by the $3^{rd}$ party or on the cloud service providers [21] to launch, (i) cloning/counterfeiting, where quantum circuit can be stolen or reproduced; and (ii) Reverse Engineering (RE), where the sensitive aspects of the quantum circuit could be extracted.

In this section, we provide overview of the proposed obfuscation procedure. First we describe various features of the dummy SWAP locations using examples. Next we explain various approaches to combine them to distill effective metrics. An example circuit is also shown to illustrate the features and performance of the proposed metrics.

Note that, one can perform exhaustive simulation in order to find the best positions to insert the dummy gates. However, simulation is prohibitively expensive for quantum circuits with large number of qubits. Moreover, the application loses any perceived quantum advantage if it can be classically simulated. One of the prime objectives of this article is to devise a scalable approach for quantum circuit obfuscation that can provide obfuscation strength comparable to the exhaustive approach. In this Section, we show results and analysis on small quantum circuit benchmarks to demonstrate the benefit of the proposed heuristics. Before going into the details, we first provide a brief description of our experimental/simulation framework, and benchmark.

Evaluation Framework and Benchmarks: We use the open-source quantum software development kit from IBM (Qiskit) [12] for our simulations. The software runs locally on an Intel Core i5-9300H CPU clocked at 2.40GHz machine. The default compiler backend in Qiskit is used for compilation. A Python-based wrapper is built around Qiskit to accommodate the proposed obfuscation on the input circuits to the compiler backend. We use $10$ reversible circuit benchmarks from the RevLib repository [22] which are commonly used in the contemporary works on quantum circuit compilation [20, 1, 23]. We use the noisy hardware simulation framework available in Qiskit with the realistic noise values from ibmq_valencia for all the simulations [12]. Comparative Analysis: Fig. 4 shows the Worst, the Best, the Average TVDs of 10 reversible circuit benchmarks alongside the TVDs observed with two of our proposed heuristics - Metric 4 and Metric 5. Note that, for most of the benchmarks, both these heuristics provided higher TVD’s than the Average TVD. Metric 4 and 5 provided $7.6\%$ and $4.9\%$ higher TVD, respectively than the Average TVD over all the benchmarks. They under performed $12.37\%$ and $14.91\%$ on average, respectively from the Best TVDs. We show the average distance between the Best TVD and the metric-based TVDs across all 10 benchmarks in Fig. 5(a). Note that, a higher value indicates a lesser performance. Metric 2 and 4 performed better than the rest with distances of 12.60% and 12.37%, respectively. Metric 3 performed poorly with a distance of 15.18%. In Fig. 5(b), we show the mean distance between the Average TVD and the metric-based TVDs. Note that, a higher distance value indicates a better performance in this case. Again, Metric 2 and 4 performed better than the rest with average distances of 7.35% and 7.58% each. Metric 3 performed poorly with average distance of 4.77%. The results indicate that Metric 2 and 4 can be better choices for strong obfuscation. Metric 1 also performed poorly with a distance of $14.226\%$ from the best TVD and $5.65\%$ from the Average TVD. Metric 6 performed better than Metric 1, but worse than metrics 2, 4 or 5 on average. Ideally, we expect to get TVDs greater than the Average TVDs and closer to the Best TVDs from the heuristic solutions to signify that the heuristic performs better than a random approach. However, none of the metrics provided consistent performance to that front in our simulations. For instance, Metric 4 provided better than the Average TVDs for 7 out of the 10 benchmarks whereas Metric 5 provided better TVD in 9 out of 10. Therefore, it is evident that a single metric may not provide decent performance over all the benchmarks. One potential direction is to incorporate multiple metrics in the obfuscation procedure. For instance, we can apply both Metric 4 and metric 5 on the same circuit one after another. Unless these metrics fail to corrupt the outputs sufficiently, such an approach can provide consistent performance at the expense of extra dummy gates.

Overhead analysis: The additional dummy SWAP gates and circuit barriers may affect the compiler performance. To investigate the potential impacts, we compile two benchmarks - 123_counter, and 4mod5, with (a single dummy SWAP) and without obfuscation using the Qiskit compiler [12] and compare the circuits depth, gate-count, and compilation time as shown in Table II. The circuit depth increased by 3.4% and 11.11% each as expected. Similarly, gate-count increased by 2.46% and 2.56%. However, the compilation time decreased by 29.36% and 12.9%. The added barriers prevented aggressive circuit optimization which translated to the smaller compilation time. Note that, we can improve the strength of obfuscation by adding more dummy gates into the circuit at the expense of higher circuit depth and gate-count upon compilation.

Future quantum computing workload will rely on untrusted $3^{rd}$ party for optimization of large scale quantum circuit. This can expose them to threats such as, counterfeiting and reverse engineering. We presented quantum circuit obfuscation by inserting two qubit SWAP gates and quantified the effectiveness using TVD based metric. We also presented an automated procedure to select the best position for dummy SWAP gate insertion which maximizes the TVD without requiring time intensive simulation of quantum circuit. The proposed metric achieved approximately $5-7\%$ improvement than average TVD, and approximately $12-13\%$ closer to the best TVD at an overhead of less than $5\%$ for the number of gates post compilation.