Towards an Antivirus for Quantum Computers^††thanks: This work was supported in part by NSF grant 1901901.

As a preliminary demonstration, we use the $5$-qubit IBM quantum computer ibmq_lima [10] for conducting our experiments. The attack example is shown in Figure 1. We use Grover’s $2$-qubit algorithm circuit [11] as the target victim circuit which is fixed on qubits $q_{0}$ and $q_{1}$. For the malicious circuit we use qubits $q_{2}$ and $q_{3}$, and we define different series of CNOT gates as potential malicious circuits, following preliminary work by Ghosh et al.’s work [7] which used a series of CNOT as an attack circuit to perform fault injection attack.

We observe that without active attack, the output probability of the Grover’s circuit is $P_{original}=0.87$. Interestingly, when the attacker circuit is a pure sequence of CNOT gates, we do not notice significant reduction in the $P_{original}$. The reason for that is, the transpile function when ran in optimization mode decomposes all CNOT gates and converts them in to a delay value equivalent to all the CNOT gates that are connected in series. If the number of CNOT gates connected in series are even, the series of gates is converted into delay and scheduled at the beginning of the operation and if it is odd then it is converted in to delay and one CNOT gate connected in series and scheduled at the beginning of the operation. Interestingly, this result is in contrast to [7], which did not seem to consider such existing transipler optimizations and only tested a pure sequence of CNOT gates.

In order to bypass the optimizations, we add delay gates [12] with minimum delay in between each CNOT gate in the malicious circuit as shown in the Figure 2. And we noted that with this approach we were able to bypass the transpile optimizations and preserve the CNOT gates in the malicious circuit. By running this circuit on the quantum device, the output probability value of target circuit is lower than $P_{original}$.

We define two parameters to perform further analysis and find more malicious circuits. The first parameter is the delay value from the delay gate [12]. The delay unit we use is $dt$ which translates to $2/5$ nanoseconds on the IBM quantum computers. The second parameter is $K$ that defines the number of gates in the malicious circuit. These malicious circuits are ran alongside Grover’s 2-qubit algorithm in all cases. In the plots, the CNOT gates are labeled as $CX$, while the other gates are the Pauli gates $X$, $Y$, and $Z$, and the $I$ gate. The delay gates are labeled as $Delay(i)$, where $i$ is the delay of the delay gate given in units of $dt$.

Below we present the experiments performed for three cases of possible malicious circuits: series of CNOT and delay gates in an interleaved fashion, as discussed before, series of only delay gates, and series of interleaved Pauli and delay gates. In all the cases we ran experiments by varying $K$ from $0$ to $5000$, but for brevity we only plot results for $K$ from $0$ to $300$.

Considering CNOT gates interleaved with delay gates, we ran experiments by fixing delay value to $1$ and varying $K$ and observe that as $K$ increase the output probability of target circuit decreases and it saturates around $0.2$ as shown in Figure 3. We ran similar experiments by fixing delay values to $2$ and $100$ and notice similar results. We also tried the delay value to be $0$ (i.e. no delay) and we notice that the transpiler optimization can be tricked even with the zero delay value and this has the same effect on the output probability as in cases of delay equal $1$, $2$, $100$, as shown in Figure 3.

Considering only delay gates, we used the delay gates as malicious circuits to observe their effect on the target circuit. We ran experiments by varying $K$ and observed that there is not any significant change in the output probability of the target circuit as shown in Figure 4. The reason for this is that the transpile function identifies all the unwanted delays and schedules them at the beginning of the circuit and performs the operation of target circuit at the end. We also plot the results where the malicious circuit is series of CNOT gates and delay gates in the same plot to provide a comparison.

Considering Pauli and delay gates, we used the series of Pauli and delay gates connected in interleaved fashion as malicious circuits. We ran experiments by varying $K$ and observed that there is some change in the output probability of the target circuit in case of $X$ and $Y$ gates (not as much as in case where malicious circuit is series CNOT and delay gates) and we also observe there is not any significant change in output probability in case of $I$ and $Z$ gates as shown in Figure 5. We plot the results where the malicious circuit is series of CNOT gates and delay gates with delay value $1$ in the same plot to provide a comparison.

In order to detect and eliminate harmful circuits, the currently used Qiskit framework for developing quantum computer programs can be extended with the antivirus and pattern matching features.

As one possibility, an algorithm can be developed to count the number of appearances of each pattern in the quantum circuit. With a database of malicious patterns, the antivirus software can scan the user’s code to find and count occurrences of the patterns. For example, as we have identified, when the value $K$ is low, there is low impact on the output probability of the victim Grover’s circuit. As result if in a circuit being scanned there is only one CNOT gate followed by a delay, i.e. $K=1$, then this is likely not a cirucit that could be malicious. But if the count of CNOT gate followed by a delay is greater than $5$ or $10$ this could be judged as possibly malicious circuit.

To realize the algorithm, both the quantum circuit and the patterns can be described by a set of Qasm instructions [13]. Therefore, the problem of quantum circuit matching can be reduced to find the instruction pattern in an instruction list. Compared with conventional string matching problem, the complexity of quantum circuit matching problem lies in the additional qubits (and possibly the classical bits and other parameters) for each instruction. Instructions that are not adjacent in the source code may still be gates in a series as well. There also may be multiple patterns dispersed among different qubits and in different order. Different patterns may cross with each other as well. All these challenges need to be addressed when creating a functional antivirus software for quantum computers.