SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System

TL;DR

This paper reveals a novel SWAP-based side-channel attack on multi-tenant quantum cloud systems, demonstrating how crosstalk can be exploited to compromise computation privacy and accuracy even over long qubit distances.

Contribution

It uncovers the root cause of crosstalk as SWAP paths, introduces a practical attack method on real quantum devices, and shows vulnerabilities in current defense strategies.

Findings

Active attack reduces Grover's Algorithm accuracy by 81.62%

Passive attack predicts circuit size with 100% accuracy

Crosstalk persists over long qubit distances, undermining existing defenses

Abstract

The rapid advancement of quantum computing has spurred widespread adoption, with cloud-based quantum devices gaining traction in academia and industry. This shift raises critical concerns about the privacy and security of computations on shared, multi-tenant quantum platforms accessed remotely. Recent studies have shown that crosstalk on shared quantum devices allows adversaries to interfere with victim circuits within a neighborhood. While insightful, these works left unresolved questions regarding the root cause of crosstalk, effective countermeasures, and replicability across circuits. We revisit the crosstalk effect, tracing its origins to the SWAP path between qubits and demonstrating its impact even over long distances. Our results significantly improve the understanding of this phenomenon beyond prior works. The proposed SWAP-based side-channel attack operates in both active and passive modes, as verified on real IBM quantum devices. In the active attack, an attacker executing a single CNOT gate can perturb victim circuits running Grover's Algorithm, reducing expected output accuracy by $81.62\%$ through strategic qubit placement. Moreover, this effect can be modeled to identify qubits more susceptible to attack. The passive attack, leveraging a stealthy circuit as small as $6.25\%$ of the victim's, achieves $100\%$ accuracy in predicting the victim's circuit size when running Simon's Algorithm. These findings challenge the existing defense strategy of maximizing topological distance between circuits, showing that attackers can still extract sensitive information or manipulate results remotely. Our work highlights the urgent need for robust security measures to safeguard quantum computations against emerging threats.