QCIVET: A Quantum–Classical Pipeline Integrity Framework with Contract-Based Subtype Verification and Hash-Chained Audit Traces
arXiv:2605.13109v1 [quant-ph] 13 May 2026
Esra Yeniaras∗
Muhammad Amin Karimov†
Abstract Hybrid quantum–classical pipelines now sit behind decisions that range from drug-binding estimates to real-time fraud alerts and customer-side auditing of cloud quantum processing unit (QPU) services, but the integrity tooling we audit them with is mostly borrowed from the classical world and therefore blind to the quantum stages in the middle. We propose QCIVET, a contract-based integrityverification framework that treats a hybrid pipeline as a sequence of stages, each carrying an explicit specification, and audits the whole sequence in two ways at once. Syntactic integrity is enforced by a hash-chained audit trail with optional external anchoring; semantic integrity is enforced at the quantum stages by a calibrated observable-deviation test rooted in the behavioural-subtyping discipline of Liskov and Wing. We prove that the test is sound under the diamond-norm distance between channels, conditionally complete √ when the observable family is informationally complete (with an explicit constant C(OA ) = 2 2 for single-qubit Pauli families), and compositional under inheritance chains. We also single out a class of “Z-only-sneaky” overrides that pass weak, single-Pauli contracts but are immediately exposed by multi-Pauli ones; this is a design lesson that follows from our proofs. The framework is validated under the calibration-derived noise models of two production IBM Quantum processors (Eagle r3 and Heron r2), and the subtype-separation protocol is run end-to-end on a real ibm_fez (Heron r2) processor, where the predicted sneaky fingerprint survives intact (1.401 → 1.386 → 1.420 along the ideal → simulated → real chain). The framework is instantiated end-to-end on three pipelines: variational quantum eigensolver (VQE) for early-stage drug discovery, quantum-assisted fraud detection, and customer-side auditing of a cloud QPU service. The reference implementation, including a real-time engine whose median per-stage commit latency is below 0.1 ms, is open source. Keywords. hybrid quantum-classical pipeline integrity; contract-based subtyping; hash-chained audit trail; real-time verification; variational quantum eigensolver (VQE); quantum-assisted fraud detection; cloud QPU auditing; NISQ-era (noisy intermediate-scale quantum) quantum software.
1
Introduction
Quantum computing is no longer a thing one demonstrates in a single notebook. Pharmaceutical companies use the variational quantum eigensolver (VQE) for early-stage drug-binding studies; financial institutions experiment with quantum kernels for fraud detection and quantum amplitude estimation for derivatives risk; cloud providers sell access to processors exceeding one hundred qubits. In every one of these settings the quantum subroutine is embedded in a longer hybrid pipeline, and the result of the quantum stage feeds a classical decision that may be hard to reverse. A miscalibrated VQE energy can mislead a clinical trial; a poisoned kernel matrix can suppress a fraud alert; a silently re-routed cloud job can return results from a backend the customer never agreed to use. The trouble is that the integrity tooling deployed in classical software supply chains was never designed for these pipelines. Frameworks such as in-toto [47], the Supply-chain Levels for Software Artifacts (SLSA) [43], and Sigstore [33] attest that an artefact was built by a given recipe: they bind a cryptographic hash to a declared build process. They do not attest that the artefact, when run on a noisy quantum processor, preserved a stated semantic contract under realistic device noise. Recent “quantum-resistant ∗ Corresponding author. Quantum Security and Post-Quantum Cryptography Researcher; previously Assistant Professor in Cyber Security at Copenhagen School of Business (EK – Erhvervsakademi København). Email: [email protected] † Department of Computer Engineering, Istanbul Gelisim University. Email: [email protected]
1
integrity” work [5, 6] re-engineers the cryptographic primitives so that classical attestations stay forgeresistant against future quantum adversaries; this is orthogonal, since the workflow itself is still treated as classical. The gap. None of the existing tools resolve the three scenarios above (a miscalibrated VQE energy, a poisoned kernel matrix, a silently rerouted cloud job) within a single framework. Classical supply-chain tools such as in-toto, SLSA, and Sigstore answer one question well: “was this artefact built from the declared recipe?”. They take a hash of the build process and confirm that nobody quietly swapped a step or a parameter along the way. This is structural integrity: the audit log itself has not been tampered with. What these tools cannot answer is a different and equally important question: “did the quantum stage actually behave the way it was supposed to behave on the hardware that ran it?”. A circuit can be transpiled and submitted exactly as recorded, with every hash matching, and still produce a result that is too far from the contract the developer wrote down, because the qubits drifted, or because a sneaky variant of the circuit was substituted that happens to look correct in one specific measurement direction but misbehaves everywhere else. This is behavioural integrity: the run actually delivered what the contract promised. The reverse failure mode is just as real. A pipeline whose quantum stage was well-behaved is also broken if the audit log was tampered with after the fact, since later auditors no longer know what was actually run. Quantum-resistant signing schemes harden the structural side against future cryptographic attacks but leave the behavioural question untouched. What is missing, and what QCIVET provides, is a single discipline that audits both kinds of integrity at once: a hash-chained audit trail that survives tampering plus an observable-deviation check that the quantum output sits inside a calibrated tolerance of the contract a developer specified, with a formal soundness and completeness link between the two. Contributions.
This paper makes the following contributions.
1. We identify and formalise the integrity-verification problem for hybrid quantum–classical pipelines as distinct from both classical supply-chain integrity and quantum-resistant signing of classical pipelines (Section 2). 2. We develop QCIVET: a contract-based subtyping discipline in which each stage carries an explicit spec, a hash-chained audit trail in the spirit of secure audit logs [40] and Merkle commitments [23], an optional external anchor for global-rewrite detection, and a real-time engine that streams stage commits (Sections 3 and 4). 3. We prove three formal properties: soundness (channel-level closeness implies observable-level closeness via Hölder’s inequality), conditional completeness (observable-level closeness implies √ channel-level closeness when the observable family is informationally complete, with C(OA ) = 2 2 for the single-qubit Pauli family), and compositionality along inheritance chains. We also characterise the family of “sneaky overrides” that pass weak contracts but fail informationally complete ones (Section 5). 4. We validate the framework under realistic device noise via the calibrated noise models of two production IBM Quantum processors, and confirm the separation of valid, invalid, and sneaky subtypes on a real ibm_fez (Heron r2) processor, where the predicted sneaky fingerprint survives intact (1.401 → 1.386 → 1.420 along the ideal → simulated → real chain) (Section 6). 5. We instantiate the framework end-to-end in three domains: VQE-driven drug discovery, quantumassisted fraud detection, and cloud QPU auditing (Section 7). For each, we exhibit a six-stage pipeline, a threat model, and four scenarios (clean, local tampering, semantic drift, global rewrite); the engine catches every attack at the appropriate scope. Software availability and reproducibility. The reference implementation, the simulation scripts, the device-noise validation, and the three end-to-end demos are released as open-source software under the MIT license at the project repository https://github.com/schrodinket/QCIVET.1 The repository contains the verification engine (qcivet_realtime.py), the experimental scripts that reproduce every figure and table in this paper, a real-hardware validation script (quantum_oop_real_qpu.py) that runs the subtype-separation protocol on an IBM quantum processor accessed through the IBM Quantum 1 https://github.com/schrodinket/QCIVET
2
cloud, three application demonstrators (VQE, fraud detection, cloud QPU auditing), and a hash-chain attack-scenario prototype. All simulation-based experiments run on commodity hardware in a few minutes; the device-noise experiments additionally require a free IBM Quantum account, and the real-hardware validation requires submitting jobs to the IBM Quantum cloud. Each figure and table caption in the body of the paper points to the specific script (and, where applicable, function) that generates it. Organization of this paper. Section 2 surveys the related literature and positions QCIVET. Section 3 recalls the contract and behavioural-subtyping vocabulary and the quantum-channel formalism used throughout. Section 4 introduces the QCIVET subtyping discipline, and Section 5 proves its soundness, conditional completeness, and compositionality, including a formal characterisation of sneaky overrides. Section 6 reports the experimental validation under both simulated and real IBM hardware (ibm_fez). Section 7 presents the real-time engine and instantiates the framework on three application domains: VQE-driven drug discovery, quantum-assisted fraud detection, and customer-side cloud QPU auditing. Section 8 fixes the threat model and discusses security guarantees. Section 9 concludes and outlines directions for future work.
2
Related Work and Positioning
QCIVET sits at the intersection of four research threads: classical software supply-chain integrity, postquantum cryptographic protections of classical workflows, quantum-software contracts and refinement, and trust mechanisms for cloud quantum platforms. We surveyed each thread systematically, including a structured literature review using a 200M-paper academic search engine to confirm the absence of prior unified frameworks (see Section 2.8). To our knowledge, no prior work integrates hash-chain integrity, behavioural observable contracts, behavioural subtyping for quantum channels, and the multi-stage hybrid pipeline shape into a single framework with formal soundness, completeness, and compositionality guarantees.
2.1
Classical Software Supply-Chain Integrity
The state of the art for classical pipelines is built around attested provenance. in-toto [47] formalises a “farm-to-table” chain of attestations linking sources to artefacts; SLSA [43] layers a maturity model on top, with active analysis of adoption challenges [44]; Sigstore [33] offers keyless signing and a public transparency log. Recent work [35] systematises provenance, tamper resistance, and build integrity practices across this ecosystem. Closely related, hash-chain-based integrity verification has been used in adjacent domains [18, 23, 40], notably blockchain transaction auditing, and QCIVET inherits the chain-of-commitments idea from this line. These tools assume that the artefact under attestation is a binary, image, or package whose integrity is fully captured by a cryptographic hash of its bytes. This assumption holds for classical software but breaks for the quantum stages of a hybrid pipeline in two distinct ways. First, hardware noise: the same quantum circuit, when executed on a real QPU, can produce different outputs depending on the calibration drift and the prevailing single- and two-qubit error rates. Second, semantic substitution: a byte-level-conformant “sneaky” circuit (formally characterised in Section 5) may pass a weak observable contract while violating an informationally complete one. Two artefacts with identical hashes can therefore exhibit very different quantum behaviours. QCIVET inherits the hash-chain and external-anchor pattern from this literature (Sigstore Rekor and RFC 3161 [1] timestamping authorities are concrete instantiations of our ExternalAnchor interface) and extends it with an observable-deviation check at each quantum stage. Table 1 contrasts these classical supply-chain tools with QCIVET on three dimensions: hash-chain integrity, external anchoring, and quantum-stage scope. Table 1: Classical supply-chain integrity versus QCIVET. Classical tools in-toto [47], SLSA [43], Sigstore [33] Hash chain of build steps External anchor (Sigstore Rekor, RFC 3161 [1]) No quantum stage in scope
What they verify Bytes match the recipe (no quantum awareness) Log not rewritten (classical artefacts only) Assumes bytes equal = behaviour equal
3
QCIVET adds (this work) Same hash chain, kept for hybrid quantum-classical pipelines Same anchor, kept Observable check at every quantum stage ⋆
2.2
Quantum-Resistant Integrity for Classical Workflows
A growing body of work studies how classical signing and attestation should evolve when quantum adversaries become practical [30, 31, 56–58]. MBOM-PQC (Model Bill of Materials with Post-Quantum Cryptography) [5] proposes post-quantum-safe signing for AI/ML model lineage; [6] integrates ML-DSA (Module-Lattice-Based Digital Signature Algorithm) into a Trusted Platform Module (TPM)-based remoteattestation flow; the broader transition to NIST post-quantum cryptography (PQC) algorithms [27–29] touches all of these. None of them changes the assumption that the pipeline itself is classical: the cryptographic primitives change, the workflow they protect does not. QCIVET is orthogonal: we keep classical SHA-256 in our chain (a deployer is free to substitute SHA-3 or a PQC-safe message authentication code (MAC)) and instead change the pipeline shape, admitting quantum stages and giving them a semantic contract. The two approaches compose readily; a deployment could combine them by signing each anchor commitment with an ML-DSA signature. Table 2 situates QCIVET against classical (RSA, ECDSA) and PQ-hardened (MBOM-PQC, ML-DSA) signing approaches. Table 2: Quantum-resistant signing versus QCIVET. Classical approach (RSA, ECDSA)
No quantum stages
PQ-hardened approach MBOM-PQC [5], ML-DSA + TPM [6] ML-DSA signature on classical pipeline No quantum stages
Byte-hash only
Byte-hash only
RSA signature on classical pipeline
QCIVET (this work) SHA-256 (kept) on hybrid quantumclassical pipeline Quantum stages with semantic contracts ⋆ Byte-hash + quantum observabledeviation check ⋆
Note. ML-DSA is the lattice-based signature standardised by NIST FIPS 204 [28]; the wider NIST post-quantum suite also includes ML-KEM (FIPS 203, [27]) for key encapsulation and SLH-DSA (FIPS 205, [29]) as a hash-based signature alternative. Any of these can be substituted for ML-DSA in a PQ-hardened pipeline; QCIVET is orthogonal to that choice.
2.3
Quantum Cryptography and Quantum-Augmented Integrity
A parallel stream uses quantum mechanics as a cryptographic primitive: BB84-derived hybrid encryption [25], where BB84 is a quantum key distribution (QKD) protocol; quantum hash functions (QHFs) and quantum-walk-based primitives [22], with hybrid hash frameworks targeting post-quantum security [4]. Here the quantum component is the security mechanism; the workflow it protects is once again classical. QCIVET inverts the picture: the workflow is quantum, the security mechanism is classical. These approaches are composable: a deployer may pair QCIVET’s hash-chain anchors with a quantum-walk hash function, or wrap each anchor commitment with a PQC signature for non-repudiation. Table 3 highlights this contrast: QCIVET treats the quantum component as the workload to be audited rather than as a cryptographic primitive. Table 3: Quantum cryptography and quantum-augmented integrity versus QCIVET.
Workflow type Security mechanism Quantum used for Composability
2.4
Quantum-augmented integrity BB84 / QKD [25], quantum hash [22] Classical pipeline Quantum (BB84 / QKD, quantum hash) Building security primitives —
QCIVET (this work) Hybrid quantum-classical pipeline ⋆ Classical (SHA-256, hash chain) Computation that must be audited ⋆ Composes with PQC signatures and quantum-walk hashes
Quantum Software Contracts and Refinement
A small but growing literature treats correctness of quantum software at the specification level. Three families are relevant: design-by-contract for individual circuits or modules, Hoare logic and refinement calculi for whole programs, and compiler verification. Figure 1 summarises the landscape and indicates where QCIVET sits relative to it. The three established families operate at the granularity of a single circuit, a single program, or a single compilation pass, and they target either functional correctness or program development. QCIVET addresses a different layer: runtime integrity of a multi-stage hybrid 4
quantum-classical pipeline against an adversary, using operationally measurable Pauli observables and a hash-chained audit trail. We expand on each family in the following paragraphs. Design-by-contract for quantum software. The closest prior work is the design-by-contract framework of Yamaguchi and Yoshioka [55], a Python-embedded language that lets a programmer attach pre/post-state assertions and assertions over the statistical processing of measurement results to individual quantum circuits. ScaffML [16] provides analogous pre- and post-conditions at the Scaffold module level. QCIVET differs from both along three substantive axes: (i) we operate at the pipeline granularity, treating each quantum stage as one node in a hash-chained multi-stage workflow, rather than asserting on a single circuit or module; (ii) we provide a behavioural-subtyping foundation with the sneaky-subtype impossibility result (Proposition 1) which is absent from these state- and module-equality frameworks; (iii) we integrate observable contracts with cryptographic hash-chain integrity, giving simultaneous coverage of in-flight semantic drift and post-hoc audit-trail tampering, neither of which intra-circuit or intra-module assertions address. Process algebras Compiler / Type theory
FJQuantum (type theory) CertiQ (compiler verification) Feng-Zhou (refinement orders)
Quantum Software Contracts Quantum Hoare Logic (theory)
qRHL (relational)
ScaffML (single module)
aQHL (projections)
Yamaguchi (single circuit)
Hash-chain integrity (cryptographic) Sneaky impossibility (Proposition 1) QCIVET: Pipeline integrity (multi-stage hybrid + adversary) Behavioural subtyping (Liskov-Wing) Pauli observables (operationally measurable)
Figure 1: Landscape of quantum software contract frameworks and where QCIVET sits. The three families above (blue/teal/violet) operate at the level of a single circuit, single program, or compile time. QCIVET (orange) targets a different layer: runtime integrity of a multi-stage hybrid quantum-classical pipeline under an adversarial threat model.
Quantum Hoare logic and refinement calculi. The semantic backbone for observable specifications is quantum Hoare logic (qHL), in which observables play the role of predicates that are pushed back through the program by a weakest-precondition transformer [59]. Applied quantum Hoare logic (aQHL) [60] restricts pre- and post-conditions to projections, simplifying verification while admitting rules for robustness and output error bounds; quantum relational Hoare logic (qRHL) [48] formulates relational invariants between two programs. Most directly comparable to our substitutability test, Feng and Zhou [11] (and the related TOSEM calculus of Feng-Zhou-Xu-Xu [12]) provide the first comprehensive study of refinement orders for quantum programs under projector-based, effect-based, and set-of-effects-based specifications, characterising when one quantum program can replace another. Their semantic, language-independent treatment, together with the order-theoretic characterisations in terms of complete positivity and the Smyth/Hoare orders, establishes the foundational backbone for substitutability in the quantum setting, and is the natural denotational counterpart to our operational, runtime-measurable contract. QCIVET extends this foundation along three complementary axes: (i) where Feng-Zhou focus on program development (stepwise refinement of a specification toward an implementation), QCIVET addresses the runtime integrity of an already-implemented hybrid pipeline against an adversary; (ii) where Feng-Zhou take projectors and effects as predicates, which is the right level of generality for development-time reasoning, QCIVET projects onto operationally measurable Pauli expectation values with a calibrated tolerance budget, which a deployer can compute directly from a finite shot count on real hardware; (iii) where Feng-Zhou prove order-theoretic correspondences, QCIVET proves runtime soundness and completeness 5
up to a noise floor, integrated with a hash-chain audit trail. The two frameworks are intentionally complementary: the refinement orders of [11, 12] provide the denotational semantics that underwrites our subtype obligations, while QCIVET supplies the operational, hardware-validated projection of that semantics needed for runtime audit on noisy hybrid pipelines. We see our work as the audit-time companion to the refinement-time framework of Feng-Zhou. We also note Li et al.’s projection-based runtime assertions [20], an early runtime-monitoring approach for quantum programs that we extend by tying assertions to a hash-chain audit trail and a hybrid pipeline. Quantum compiler verification and language foundations. CertiQ [42] verifies properties of a realistic quantum compiler with a contract-based methodology. While related in spirit, the compilerverification problem is disjoint from pipeline integrity: CertiQ guarantees that the compiler produces semantically equivalent circuits, whereas QCIVET guarantees that runtime executions of a (possibly adversarially modified) compiled pipeline satisfy a calibrated contract. Object-calculus work such as FJQuantum (a Featherweight Java calculus extended with quantum primitives) [9] and quantum process algebras [10] address typing and equivalence and are complementary to our runtime concerns. General quantum software engineering surveys map the broader landscape [7, 26]. Table 4 summarises how QCIVET differs from the closest quantum software contract frameworks (Yamaguchi-Yoshioka, ScaffML, Feng-Zhou). Table 4: Quantum software contract frameworks versus QCIVET. Yamaguchi-Yoshioka, ScaffML [16, 55] (design-by-contract) Single quantum circuit or module
Feng-Zhou refinement [11, 12] (refinement orders) Single quantum program
State or measurement assertions
Projector or effect predicates
No hash-chain audit trail
No hash-chain audit trail
No sneaky-subtype result
Refinement, not adversarial
2.5
QCIVET (this work) Multi-stage hybrid quantum-classical pipeline ⋆ Observable-deviation contract on quantum output ⋆ Hash-chain audit trail with external anchor Sneaky-subtype impossibility result for quantum stages ⋆
Cloud QPU Trust
Customer-side trust in cloud quantum services has emerged as an active subfield. Four complementary approaches deserve explicit comparison with the cloud-auditing demonstrator of Section 7.4. Device fingerprinting. Wu et al. [53, 54] authenticate a quantum device by probing it with calibration circuits and comparing the device-side error fingerprint against a user-side expectation, detecting machine substitution and profile fabrication attacks. The approach is empirically validated on seven IBM devices. Fingerprinting authenticates the device; QCIVET authenticates the result. A device might pass the fingerprint test (correct hardware) yet still return a result outside the customer’s contract, for example, because the upstream specification was tampered with, because middleware re-routed circuits, or because the calibration drifted between the fingerprint and the workload. The two are complementary and could be deployed together. Table 5: Cloud QPU trust mechanisms versus QCIVET. Device fingerprinting Wu et al. [53, 54]
Distributed shots
Quantum PUF
QCIVET
Upadhyay-Ghosh [49, 50] Hardware via voting
Phalak et al. [37]
(this work)
Hardware identity One quantum device
The quantum result against a contract ⋆ One quantum device
No
Yes ⋆
Yes
—
Authenticates
The quantum device
Devices needed
One quantum device
Detects spec or middleware tampering Composes with QCIVET
No
Multiple quantum devices No
Yes
Yes
Note. A complementary cryptographic-protocol line (Leichtle et al. [19]) provides composable verification with statistical guarantees, but typically requires trap-qubit constructions on measurement-based graphs; QCIVET targets the same threat surface with a single device and a tracer observable.
6
Distributed shot allocation. Upadhyay and Ghosh [49, 50] distribute repeated executions across multiple hardware options and use majority voting (or adaptive allocation) to detect tampered hardware. This requires multiple physical devices and is most effective for pure quantum workloads. QCIVET works on a single device by checking against a calibrated observable tolerance, requires no replication, and detects tampering not only of hardware but also of specifications and pipeline middleware. The four mechanisms discussed in this section are summarised in Table 5. Quantum physically unclonable functions. Phalak et al. [37] propose quantum physically unclonable functions (PUFs) for hardware authentication, achieving strong inter-device Hamming-distance separation. PUFs authenticate the identity of a hardware unit; QCIVET authenticates the integrity of a result against a contract. The two operate at orthogonal layers and compose without conflict. Cryptographic delegation protocols. A cryptographic-protocol line, exemplified by Leichtle et al. [19], develops composable verification protocols that interleave computation rounds with test rounds for malicious-behaviour detection. Such protocols offer formal, statistical guarantees against arbitrary malicious servers but typically require trap-qubit constructions on measurement-based quantum-computation graphs and incur significant per-circuit overhead. QCIVET targets the same threat surface at a lower formal level but with operational practicality: the customer needs only to choose a tracer observable and a tolerance budget, with no extra cryptographic machinery on the quantum side.
2.6
Hybrid Quantum-Classical Applications and Audit Trails
The three application domains in Section 7.1 intersect with separate application-specific literatures. VQE for chemistry and materials. The variational quantum eigensolver has been studied extensively as an algorithm [8, 14, 46], with attention to ansatz design, optimiser robustness, and device-noise mitigation. To our knowledge, no prior work proposes integrity or audit-trail mechanisms specifically designed for VQE workflows in pharmaceutical applications, even though general pharmaceutical audittrail standards exist independently [39, 51]. Our VQE drug-discovery demonstrator (Section 7.2) is the first such mechanism we are aware of. Hybrid quantum-classical financial systems. Concurrent work on HQFS (Hybrid QuantumClassical Financial System) [32] proposes a hybrid quantum-classical financial system that combines VQE-based forecasting with post-quantum cryptographic signing of allocation records and an audit trail linking decisions to model state and inputs. QCIVET’s fraud-detection demonstrator (Section 7.3) addresses an adjacent setting but with three orthogonal differences: (i) HQFS uses post-quantum signatures to authenticate records after the fact, while QCIVET uses a hash-chain integrity verifier that detects tampering at commit time and via post-pipeline replay, including the case in which an attacker has obtained the signing keys; (ii) HQFS provides no semantic-level check on the quantum stage’s output, whereas QCIVET enforces a calibrated observable contract; (iii) HQFS does not address a behaviouralsubtyping discipline, leaving the system blind to the sneaky-subtype attack pattern of Proposition 1. The two approaches are complementary: a deployer could combine HQFS-style post-quantum signatures (for non-repudiation) with QCIVET’s observable contracts and hash-chain integrity (for tamper detection and semantic checks). Table 6: HQFS hybrid quantum-classical financial system versus QCIVET fraud-detection demonstrator.
Quantum-stage semantic check
HQFS Nayak et al. [32] Post-quantum signatures after the fact None (signature only)
Sneaky-subtype coverage
None
Composability
—
Tamper detection
7
QCIVET (fraud-detection demo) Hash-chain integrity at commit time and on replay ⋆ Calibrated observable contract on quantum output ⋆ Behavioural-subtyping discipline detects sneaky overrides ⋆ Composes with HQFS-style postquantum signatures
Hybrid security via quantum machine learning. A separate strand uses hybrid quantum-classical machine learning (QML) for security tasks such as threat detection [2, 3, 17]. This direction treats the quantum component as a tool inside a security application, whereas QCIVET treats the quantum component as an asset to be protected: the pipeline that contains the QML classifier is what we audit. Surveys of quantum software engineering, including requirements engineering [41], catalogue practices for hybrid systems but do not address pipeline integrity specifically. Table 6 contrasts HQFS with QCIVET’s fraud-detection demonstrator, highlighting the orthogonal choices on tamper detection, semantic checks, and sneaky-subtype coverage.
2.7
Behavioural Subtyping in Classical Software
QCIVET’s behavioural-subtyping discipline traces back to Liskov and Wing’s classical formulation [21] and Meyer’s design-by-contract [24]; subsequent work has extended the idea to product-line settings via feature-oriented contracts [45] and to runtime monitoring. QCIVET adopts a complementary engineering vocabulary to the substantial recent progress on quantum substitutability via refinement and compliance, notably Feng-Zhou [11, 12]: we cast the same substitutability question in the Liskov-Wing register of behavioural subtyping, which gives us an intuitive engineering interpretation (“B is a behavioural subtype of A if B can replace A without observable surprise to a contract-respecting client”) and a clean operational reading of the sneaky-subtype phenomenon (Proposition 1). The two vocabularies are translatable: every result we prove can be interpreted within the refinement-order backbone of Feng-Zhou, and conversely, our observable-deviation contract provides a runtime-measurable instance of their refinement relation.
2.8
Summary and Positioning
To validate the absence of prior unified frameworks we conducted a systematic search using Elicit AI, a literature-search tool indexing over 200 million academic papers. Across five queries spanning the four threads above, we recorded three explicit “no prior work” findings: (i) no source proposes a hash-chainbased integrity verification framework for hybrid quantum-classical software pipelines that also includes observable contracts and behavioural subtyping; (ii) no source extends classical supply-chain frameworks (SLSA, in-toto, Sigstore) to hybrid quantum-classical pipelines with semantic-level checks; (iii) no source addresses integrity or audit-trail mechanisms specifically for VQE pharmaceutical workflows. Manual follow-up across arXiv and IEEE confirmed these gaps and identified the closest individual contributions cited above. A complete record of the queries and returned references is maintained in the project repository (footnote 1). Table 7 summarises QCIVET’s position relative to the four most adjacent threads. Table 7: Where QCIVET sits relative to the four closest literature threads. The Classical, PQ-resistant, Q-augmented, and Q software contract columns refer to the literatures discussed in Sections 2.1–2.4 respectively. Classical
PQ-resistant
Hybrid pipeline
in-toto / SLSA [43, 47] no
MBOM-PQC, ML-DSA [5] no
Qaugmented QHF / BB84 [22, 25] no
Hash-chain audit Semantic check
yes no
yes no
no no
Behavioural subtyping
no
no
no
Real-time abort
partial
no
no
Cloud-result audit
no
no
no
Question
Q software contracts Yamaguchi [55], Feng-Zhou [12] partial (single circuit/module) no yes (state) refinement only [11] yes (intra-circuit) no
QCIVET (this work) yes
yes yes (observable) yes (LiskovWing) [21] yes (cross-stage) yes
In Table 7, “semantic check” means verifying that quantum-stage outputs satisfy a calibrated observable contract; “hybrid pipeline” means stage-level coverage of a workflow with both classical and quantum stages; and “behavioural subtyping” [21] means an explicit Liskov-Wing substitutability discipline (rather than refinement [11] or compliance).
8
3
Background
3.1
Contracts and Behavioural Subtyping
A contract for a class A is a triple of invariants, preconditions, and postconditions, denoted spec(A) [21,24]. A class B is a behavioural subtype of A (B ⪯ A) if every operation of A that B overrides preserves the externally visible contract of A: B does not strengthen the precondition and does not weaken the postcondition. This is Liskov and Wing’s classical formulation [21] and underlies modern object-oriented programming (OOP) type discipline.
3.2
Quantum States, Channels, and Observables
We follow the conventions of [34,38]. A pure state of a single qubit is |ψ⟩ = α |0⟩ + β |1⟩ with |α|2 + |β|2 = 1 and density matrix ρ = |ψ⟩ ⟨ψ|. A general quantum operation is a completely positive trace-preserving (CPTP) map E : ρ 7→ E(ρ). The expectation of an observable O in the state ρ is ⟨O⟩ρ = Tr(Oρ). The diamond norm of a CPTP map E is ∥E∥⋄ = supρ ∥E(ρ)∥1 , extended to differences by ∥EA − EB ∥⋄ , which gives the maximal distinguishability of two channels in the trace norm [52]. This is the natural distance for behavioural-subtyping arguments [12] and plays a central role in Section 5. Throughout the paper we use three norms on operators, all specialisations of the Schatten p-norms (notation following Watrous [52, Sec. 1.1]): • Operator norm ∥O∥∞ (Schatten ∞-norm): the largest singular value of O. It is the correct norm for an observable, since for O self-adjoint it equals the largest absolute eigenvalue, i.e. the maximal observable outcome. • Trace norm ∥X∥1 (Schatten 1-norm): the sum of singular values of X. For Hermitian X this equals the sum of absolute eigenvalues. The trace norm is the correct distance between density operators and the natural norm for a state-level channel discrepancy EA (ρ) − EB (ρ). • Diamond norm ∥E∥⋄ , defined above: the operationally meaningful distance between channels, equal to the maximal trace distance between channel outputs taken over all (possibly entangled) inputs to E ⊗ id. The three norms are linked by Hölder’s inequality on Hermitian operators, |Tr(O X)| ≤ ∥O∥∞ ∥X∥1 , and by the finite-dimensional equivalence between trace-norm and diamond-norm bounds [36] (with a conversion factor at most d, where d := dim H). Section 5 formalises these constants and uses them to prove soundness, completeness, and compositionality of the contract framework. For a bipartite system ρAB , the reduced state of B is ρB = TrA (ρAB ). The reduced state contains all marginals on B but no phase information about correlations with A.
3.3
Hash Chains and External Anchors
Following [23, 40], an audit log is tamper-evident when each entry is computed as hi = H(hi−1 ∥ speci ) for a collision-resistant hash H, with h0 a public genesis. A modification to speci that goes undetected requires producing a collision, which is infeasible for SHA-256 under standard assumptions. To detect a globally consistent rewrite (an adversary who replaces every record after the fact), one binds the chain to an external anchor: a publicly verifiable log such as Sigstore Rekor [33], an RFC 3161 timestamp authority [1], or a public blockchain commitment.
4
The QCIVET Framework
Stages and spec records. A hybrid quantum–classical pipeline is a sequence of stages S1 , S2 , . . . , Sn . Each stage Si has: • a name (a string identifier); • a spec σi , a JSON-serialisable record of all parameters that determine the stage’s behaviour (transpiler version, backend identifier, calibration snapshot hash, classifier threshold, ansatz family, and so on); • optionally a list of observables measured during the stage, each with a reference value and a calibrated tolerance (only quantum stages carry these). The spec is the unit of accountability: any change to the behaviour of Si must reflect in σi . 9
4.1
Subtyping for Stages
Two stages A and B that purport to do “the same thing” (an override) live in a behavioural-subtyping relation. We model each as a CPTP channel EA , EB and introduce a finite calibrated observable family (OA , ε), where OA = {O1 , . . . , Ok } is a set of self-adjoint operators and ε ≥ 0 a tolerance. Definition 1 (Contract-preserving subtyping). We say B ⪯(OA ,ε) A when, for every input state ρ, max Tr O EB (ρ) − Tr O EA (ρ) ≤ ε. O∈OA
When OA spans the operator basis of the underlying Hilbert space (for instance all single-qubit Paulis {X, Y, Z} for a qubit), the test is informationally complete; otherwise it is a projection onto the subspace of contract-relevant observables. Hash-chained audit trail.
QCIVET maintains an audit log of triples (σi , hi−1 , hi ) with hi = H hi−1 ∥ canonical(σi ) , h0 = 064 ,
where canonical is a deterministic JSON serialiser (sorted keys, no whitespace) and H is SHA-256. The chain is appended to as the pipeline runs, and an external anchor receives each new hi for tamper-evident timestamping. Figure 2 illustrates how stage commits stream to the QCIVET engine, which performs the hash-chain check at every stage and the observable-deviation check at the quantum stages, releasing the result on success and emitting the audit trail on failure. Hybrid Quantum-Classical Pipeline circuit_def
transpile
backend_sel
calibration
execution
meas_output
QCIVET Engine Hash chain (every stage) • Observable-deviation check (quantum stages) • External anchor
OK → release result classical stage
•
FAIL → abort and emit audit trail
quantum stage
hash commit
Figure 2: QCIVET workflow. A hybrid quantum-classical pipeline streams stage commits to the QCIVET engine, which performs hash-chained syntactic integrity checks at every stage and calibrated observabledeviation checks at the quantum stages (orange). On success, the result is released to the customer; on failure, the engine aborts and emits the audit trail.
4.2
Real-Time Verification Engine
The IntegrityVerifier class (Listing 1) exposes a single commit_stage method that the host pipeline calls when each stage completes. A commit performs four operations: 1. check the observables (if any) against (OA , ε), raising IntegrityViolation (kind=observable) on violation; 2. compute hi from hi−1 and σi ; 3. verify chain-head consistency, raising IntegrityViolation (kind=hash) on a desync; 4. submit hi to the external anchor, raising IntegrityViolation (kind=anchor) on submission failure. On any violation the host pipeline catches the exception and aborts before launching downstream stages. The cost of a commit, measured in Section 7, is below 0.1 ms on commodity hardware. Globally consistent rewrites that escape the local chain check are caught by a separate verify_against_anchor method that confirms the local chain appears as a contiguous block in the anchor log. 10
verifier = I n t e g r i t y V e r i f i e r ( anchor = Externa lAnchor ( " rekor . log " ) ) try : for stage in pipeline : out = stage . run () verifier . commit_stage ( StageResult ( name = stage . name , spec = stage . spec_dict () , observables = stage . observables () , # only on quantum stages )) except I n t e g r i t y V i o l a t i o n as e : log . error ( f " halted at stage { e . stage_index } ({ e . kind }) : { e } " ) pipeline . abort ()
Listing 1: Pipeline-host pattern using QCIVET. Sneaky overrides. A subtle threat is the override that passes a weak contract but fails an informationally complete one. Take A = Ry (θ) and B = Ry (θ) · S, where S is the phase gate. On the input |0⟩, both prepare states with the same ⟨Z⟩, so B is indistinguishable from A on OA = {Z}. But the two channels differ on X and Y by an amount up to | sin θ|, and an OA = {X, Y, Z} contract immediately exposes B. A sufficient condition for the existence of such overrides is given by Proposition 1.
5
Formal Properties
This section makes Definition 1 mathematically precise. We give a soundness theorem (channel-level closeness implies observable-level closeness), a conditional completeness result (the converse holds when the observable family is informationally complete), and a compositionality theorem (contract preservation transports along inheritance chains). We then characterise the sneaky-subtype failure mode introduced informally in Section 4.2 and clarify the relationship between our setting and the foundational refinement orders of Feng et al. [11, 12], showing how the two frameworks complement each other.
5.1
Setting and Notation
Throughout this section we work with finite-dimensional Hilbert spaces. Let H have dimension d := dim H < ∞. For an n-qubit system, d = 2n ; the single-qubit case is d = 2. Let D(H) denote the set of density operators on H. For two CPTP channels EA , EB : D(H) → D(H), the diamond norm of their difference is ∥EA − EB ∥⋄ = sup ∥(EA ⊗ id)(ρ) − (EB ⊗ id)(ρ)∥1 . (1) ρ∈D(H⊗H)
The diamond norm is the operationally meaningful distance between channels: it equals the maximal trace distance achievable by any input, possibly entangled with an ancilla [52]. For an observable O (self-adjoint on H), ∥O∥∞ denotes the operator norm and ∥X∥1 denotes the trace norm, both as introduced in Section 3. We write KA := maxO∈OA ∥O∥∞ for the tight spectrum bound of the contract observable family OA . Definition 2 (Informationally complete observable family). A family O ⊂ Herm(H) is informationally complete if its real linear span equals Herm(H) itself; equivalently, for any two states ρ1 , ρ2 ∈ D(H), Tr(Oρ1 ) = Tr(Oρ2 ) for all O ∈ O implies ρ1 = ρ2 . For a single qubit (d = 2), the Pauli set {X, Y, Z} is informationally complete; the singleton {Z} is not.
5.2
Soundness
Theorem 1 (Soundness). Let A, B be classes with channels EA , EB and let OA be a contract observable family with tight spectrum bound KA . If ∥EA − EB ∥⋄ ≤ δ, then for every input set S ⊆ D(H), B ⪯(OA , KA δ), S A.
11
(2)
Proof. For any ρ ∈ S and O ∈ OA , by Hölder’s inequality on Hermitian operators, Tr(O EB (ρ)) − Tr(O EA (ρ)) = Tr(O [EB (ρ) − EA (ρ)])
(3)
≤ ∥O∥∞ ∥EB (ρ) − EA (ρ)∥1
(4)
≤ KA ∥EA − EB ∥⋄ ≤ KA δ.
(5)
Taking suprema over ρ ∈ S and O ∈ OA gives the claim.
5.3
Conditional Completeness
Theorem 2 (Conditional completeness). Suppose OA is informationally complete in Herm(H), and let S ⊆ D(H) be a state set whose affine span is the full set of density operators. Then there exists a constant C(OA ) > 0, depending only on the observable family, such that for any CPTP channels EA , EB , B ⪯(OA , ε), S A =⇒ ∥EA − EB ∥⋄ ≤ C(OA ) ε.
(6)
√ For a single qubit with OA = {X, Y, Z} and S ⊇ {|0⟩ , |1⟩ , |+⟩ , |−⟩}, one may take C(OA ) = 2 2. Proof. Define the linear map ∆ : Herm(H) → Herm(H) by ∆(ρ) = EA (ρ) − EB (ρ). The hypothesis gives supO∈OA |Tr(O ∆(ρ))| ≤ ε for every ρ ∈ S. Since OA spans Herm(H), the family of linear functionals σ 7→ Tr(σO) is norming on Herm(H); equivalently, there is a constant c(OA ) > 0 with ∥σ∥1 ≤ c(OA ) sup |Tr(O σ)|
∀σ ∈ Herm(H),
O∈OA
because all norms on a finite-dimensional space are equivalent. Apply this to σ = ∆(ρ) for ρ ∈ S: ∥∆(ρ)∥1 ≤ c(OA )ε. Linearity of ∆ extends the bound to every ρ ∈ D(H), with an inflated constant. Stinespring purification of EA − EB then converts the state-level trace-norm bound into a diamond-norm bound on the channel difference, again with a finite constant depending only on d and on c(OA ) [52]. For the single-qubit Pauli-eigenstate case the four states P span Aff(D(H)) and the constant is computable directly: any traceless Hermitian σ on C2 admits σ = 12 P ∈{X,Y,Z} Tr(P σ)P , and ∥P ∥1 = 2 for each √ Pauli, so ∥σ∥1 ≤ 2 supP |Tr(P √ σ)|. The diamond-to-trace conversion factor is at most 2 in dimension 2. Multiplying gives C(OA ) ≤ 2 2. Remark 1 (Scaling with dimension). The constant C(OA ) depends both on the geometry of the observable family (the factor c(OA ) from the norming-functional argument) and on the dimension d of the Hilbert space (from the trace-norm to diamond-norm conversion). For an n-qubit system, d = 2n , and the diamond conversion factor is at most d in the worst case. If OA is taken to be the full n-qubit Pauli family (4n − 1 √ non-identity tensor products of {I, X, Y, Z}), the same Pauli decomposition argument yields c(OA ) ≤ 4n − 1, so C(OA ) grows polynomially in d but exponentially in n. In practice, deployers do not use the full Pauli family: they choose a small structured subset (e.g., the Pauli set on a single relevant qubit, or the operator that defines the application-specific reference value). The calibration data of Section 6.9 reports the empirically observed constant for the contracts used in this paper; the worst-case theoretical scaling above is an upper bound, not a typical value.
5.4
Compositionality
Theorem 3 (Compositionality). Let A1 , A2 be supertypes with respective contract families OA1 , OA2 and spectrum bounds K1 , K2 . Suppose B1 ⪯(OA1 , ε1 ) A1 and B2 ⪯(OA2 , ε2 ) A2 . Define A := EA2 ◦ EA1 and B := EB2 ◦ EB1 , with outer contract OA := OA2 . Then for every ρ ∈ D(H) and O ∈ OA , Tr(O EB (ρ)) − Tr(O EA (ρ)) ≤ ε2 + K2 c(OA1 ) ε1 .
(7)
Proof. We use the standard “add-and-subtract” decomposition: insert the auxiliary term EA2 (EB1 (ρ)) to obtain EB (ρ) − EA (ρ) = EB2 (EB1 (ρ)) − EA2 (EA1 (ρ)) = EB2 (EB1 (ρ)) − EA2 (EB1 (ρ)) | {z }
(I): inner-stage discrepancy at the second stage
(8) +
EA2 EB1 (ρ) − EA1 (ρ) | {z }
(II): first-stage error propagated through EA2
Fix any O ∈ OA2 with ∥O∥∞ ≤ K2 and bound each term separately. 12
.
(9)
Term (I). Both branches share the input EB1 (ρ) ∈ D(H), so the second-stage hypothesis B2 ⪯(OA2 , ε2 ) A2 applies directly to this input: Tr O [EB2 (EB1 (ρ)) − EA2 (EB1 (ρ))] ≤ ε2 . Term (II).
By Hölder’s inequality on Hermitian operators, Tr O EA2 [EB1 (ρ) − EA1 (ρ)] ≤ ∥O∥∞ ∥EA2 [EB1 (ρ) − EA1 (ρ)]∥1 .
Since EA2 is a CPTP map, it is a trace-norm contraction on Hermitian operators [52, Sec. 3.3], so ∥EA2 (Y )∥1 ≤ ∥Y ∥1 for every Hermitian Y . Applying this with Y = EB1 (ρ) − EA1 (ρ), ∥EA2 [EB1 (ρ) − EA1 (ρ)]∥1 ≤ ∥EB1 (ρ) − EA1 (ρ)∥1 . The first-stage hypothesis B1 ⪯(OA1 , ε1 ) A1 together with the norming-functional argument inside the proof of Theorem 2 (the state-level trace-norm bound, applied before the diamond-to-trace conversion) yields ∥EB1 (ρ) − EA1 (ρ)∥1 ≤ c(OA1 ) ε1 for every ρ ∈ D(H).2 Combining, Tr O (II) ≤ K2 c(OA1 ) ε1 . Combining.
By the triangle inequality on the two terms, Tr(O EB (ρ)) − Tr(O EA (ρ)) ≤ ε2 + K2 c(OA1 ) ε1 ,
which is the claimed bound. Remark 2 (Practical reading). Theorem 3 says errors compose roughly additively along an inheritance chain. A pipeline of n valid overrides each at tolerance ε has worst-case observable deviation O(nε) at the end. This is the kind of book-keeping a static analyser or audit tool must track in practice.
5.5
The Sneaky Subtype, Formally
Proposition 1 (Sneakiness characterisation). Let EA , EB be unitary single-qubit channels and let OA ⊊ Herm(C2 ). There exists a sneaky subtype EB ̸= EA with B ⪯(OA , 0) A if and only if OA is not informationally complete. Proof. (⇐) Suppose OA is not informationally complete. By Definition 2, there exist distinct states ρ1 ̸= ρ2 with Tr(Oρ1 ) = Tr(Oρ2 ) for all O ∈ OA . The phase gate S provides an explicit witness: S commutes with Z, so Tr(Zρ) = Tr(ZSρS † ). Setting EB := EA ◦ AdS gives B ⪯({Z}, 0) A with EB ̸= EA . (⇒) If OA is informationally complete, then by Theorem 2, B ⪯(OA , 0) A forces ∥EA − EB ∥⋄ = 0 and hence EA = EB .
5.6
Comparison with Refinement Orders
Our framework stands in a direct and constructive relationship with the refinement calculus for quantum programs of Feng et al. [11, 12]. They define EB ⊑ EA on CPTP and completely positive trace nonincreasing (CPTN) maps via the complete-positivity ordering of the corresponding super-operators, equivalent to a diamond-norm comparison up to constants in finite dimension. Our observable-restricted condition (Definition 1) is the operational projection of this ordering onto a finite, calibration-ready observable interface: Theorem 1 shows that the Feng et al. ordering implies ours; Theorem 2 shows that the converse holds when the observable family is informationally complete; and Proposition 1 characterises precisely when the projection is lossy, which is exactly the sneaky-subtype regime. Read this way, the two frameworks form a tight pair: the refinement orders of Feng et al. give the full denotational picture of substitutability, and our framework gives the runtime-observable, hardware-evaluable projection of that picture, which is the right object for an OOP-style contract because it respects encapsulation: a class commits only to its declared observables, not to its full channel realisation. 2 Equivalently, one may use the diamond-norm bound ∥E A1 − EB1 ∥⋄ ≤ C(OA1 ) ε1 from Theorem 2 and then specialise to a
single input ρ, absorbing the diamond-to-trace conversion into the constant; the resulting bound has the same O(ε1 ) scaling.
13
6
Experimental Validation
This section instantiates the framework on a single-qubit example and validates it under three increasingly realistic settings: synthetic depolarising noise, the calibrated noise models of two production IBM Quantum processors (FakeBrisbane and FakeFez), and an end-to-end run on the real ibm_fez (Heron r2) processor accessed through the IBM Quantum cloud.
6.1
Reference Class and Three Subtypes
We fix the single-qubit supertype A : EA (ρ) = Ry (θ) ρ Ry (θ)† ,
θ = 2π/5,
(10)
and study three candidate subtypes: • Bgood : EBg is the identity composition SRx (θ)S † acting by conjugation, which equals EA via Ry (θ) = SRx (θ)S † ; • Bbad (δ): EBb (ρ) = Ry (θ + δ) ρ Ry (θ + δ)† , an over-rotation by δ = 0.4; • Bsneaky : EBs (ρ) = S EA (ρ) S † , which preserves ⟨Z⟩ exactly but flips the sign of ⟨Y ⟩. full The contract observable families considered are the informationally complete OA = {X, Y, Z} and the weak weak OA = {Z}.
Inputs. We test on six input states: the four Pauli eigenstates {|0⟩ , |1⟩ , |+⟩ , |−⟩} plus two off-axis states |ψ1 ⟩ = Rz (1.3)Ry (0.7) |0⟩ and |ψ2 ⟩ = Rz (0.4)Ry (2.1) |0⟩. The off-axis pair together with the generic angle θ = 2π/5 ensures that all three Pauli expectations of the supertype are simultaneously non-trivial on every input. This avoids “accidental zeros” that would be ambiguous under hardware noise (a noisy estimator returning 0.00 could either track a genuine zero or have lost its signal entirely), and lets us use a single, coherent instantiation across both the noiseless analyses (Experiments 1–4) and the device-noise validation (Experiments 5–6).
6.2
Experiment 1: Subtype Separation in the Ideal Setting
Methodology. The script quantum_oop_simulation.py constructs the supertype A = Ry (2π/5) and the three candidate subtypes Bgood , Bbad (0.4), Bsneaky exactly as defined in Section 6.1, evaluated on the six inputs of Section 6.1. For each candidate, the script computes the analytic output state on every input via Qiskit’s Statevector, evaluates the three Pauli expectations exactly via Tr(ρO), and reports the worst-case deviation from the supertype values. No sampling is involved at this stage; the deviations are the exact operator-norm differences. Table 8: Experiment 1, ideal noiseless setting. Worst-case observable deviation across the six input states. Generated by quantum_oop_simulation.py, function experiment_1 (footnote 1). Candidate
worst {X, Y, Z}
worst {Z}
Bgood Bbad (0.4) Bsneaky
0.000 0.395 1.401
0.000 0.395 0.000
For each candidate B we compute, for every input state and every Pauli observable, the noiseless deviation ∆B O (ρ) = |Tr(O EB (ρ)) − Tr(O EA (ρ))|. Table 8 reports the worst-case deviation across the six inputs for each of the two contract families. The valid override Bgood is at zero deviation under both contracts. The over-rotation Bbad violates both. Bsneaky is the formal sneaky case of Proposition 1: it slips under the weak {Z}-only contract while being maximally exposed by the full one. Figure 3 shows this per-(input, observable) pattern, with Bsneaky indistinguishable from A on Z alone but maximally exposed by X and Y .
14
Figure 3: Experiment 1. Per-(input, observable) deviation for the three candidates in the noiseless setting. The pattern is the operational fingerprint of Proposition 1: Bsneaky is indistinguishable from A on Z alone, but maximally exposed by X and Y . Reproduced by quantum_oop_simulation.py, function plot_experiment_1 (footnote 1).
6.3
Experiment 2: Two-Qubit Reduced State
Methodology. The script quantum_oop_simulation.py (function experiment_2) constructs the postCNOT (controlled-NOT) entangled state |ΨAB ⟩ = α |00⟩ + β |11⟩ for ten random amplitude pairs, computes the partial trace over qubit A analytically via Qiskit’s partial_trace primitive, and compares the result against the diagonal matrix diag(|α|2 , |β|2 ) in Frobenius norm. The deviation is reported per trial and as a maximum across trials. This serves as a sanity check for the behavioural-subtyping interpretation of encapsulation: the reduced state carries only marginal probabilities, with all correlation information traced away. We numerically verify the partial-trace identity ρB = TrA (|ΨAB ⟩ ⟨ΨAB |) = |α|2 |0⟩ ⟨0| + |β|2 |1⟩ ⟨1| on the post-CNOT state |ΨAB ⟩ = α |00⟩ + β |11⟩ for ten random pairs (α, β). The Frobenius distance between the analytical reduced state and the numerically computed partial trace is bounded by 3.7 × 10−33 in every trial, confirming that the reduced state carries marginal probabilities only.3
6.4
Experiment 3: Synthetic Depolarising Noise
Methodology. The script attaches a depolarising channel of parameter p to every single-qubit gate using Qiskit Aer’s depolarizing_error and NoiseModel primitives. The script sweeps p over the eleven values p ∈ {0, 0.001, 0.002, 0.005, 0.01, 0.02, 0.03, 0.05, 0.07, 0.10}, and, for each p, runs Bgood under the resulting noisy simulator with 4096 shots per measurement, repeated for 20 independent trials. The X, Y , Z expectations are estimated from counts after applying the appropriate basis-change rotations (H for X; S † H for Y ; identity for Z). The script then aggregates each trial’s worst-case deviation across the three Paulis, and reports the mean, standard deviation, and 95th percentile across trials. We attach a single-parameter depolarising channel Np (ρ) = (1 − p)ρ + p I/2 to each gate and sweep p over [0, 0.05]. For Bgood the worst-case observable deviation ε(p) averaged over inputs is near-linear, ε(p) ≈ 1.6 p for small p; see Figure 4. This calibrates a synthetic tolerance budget but is not predictive of behaviour on a real device, which motivates the device-derived experiments below. 3 Computed by quantum_oop_simulation.py, function experiment_2; see footnote 1.
15
Figure 4: Experiment 3. Synthetic depolarising-noise calibration of ε for Bgood . The relation is approximately linear in p for small p. Reproduced by quantum_oop_simulation.py, function plot_experiment_3 (footnote 1).
6.5
Experiment 4: δ-Sweep for Bbad
Methodology. The script sweeps δ over the nine values {0, 0.01, 0.02, 0.05, 0.1, 0.2, 0.4, 0.6, 0.8} and, for each δ, constructs Bbad (δ) = Ry (2π/5 + δ) and computes the worst-case noiseless deviation from the supertype across all six inputs and all three Pauli observables. This is done analytically (no sampling) using Statevector and trace formulas, so the resulting deviations are the exact operator norms. The purpose is to relate physical perturbation magnitude (radians) to the observable-space deviation that a tolerance threshold has to discriminate. We sweep the over-rotation parameter δ from 0 to π/2 and report worst-case deviation under both Bbad bad contracts; see Figure 5. ∆B {X,Y,Z} (δ) tracks sin δ, while ∆{Z} (δ) tracks | cos θ − cos(θ + δ)|. A tolerance ⋆ choice ε = 0.05 corresponds to a detection threshold δ ≈ 0.05 radians.
6.6
Experiment 5: ε Calibration under Realistic Device Noise
Methodology. The script quantum_oop_device_validation.py replaces the synthetic depolarising channel of Experiment 3 with the calibration data published by IBM for the corresponding real backends, accessed via NoiseModel.from_backend() on the FakeBrisbane and FakeFez backends from qiskit_ibm_runtime.fake_provider. These fake backends embed the actual T1, T2, gate error and readout error data of the corresponding physical processors, so deviations under them are representative of what would be observed on the real hardware. For each (device, input state) pair the script runs Bgood in batched mode (one big sampler job of 20 × 4096 shots, the per-shot outcomes split back into 20 trials of 4096 shots each), measures ⟨Z⟩ on every shot, and aggregates the per-trial deviation against the noiseless reference value of ⟨Z⟩A . We replace the synthetic depolarising channel with the calibration-derived noise models of two production IBM Quantum processors: • FakeBrisbane (Eagle r3, 127 qubits, single-qubit gate error ∼ 3 × 10−4 ); • FakeFez (Heron r2, 156 qubits, single-qubit gate error ∼ 2 × 10−4 ). For each device, Bgood is run on each of the six input states with twenty trials of 4096 shots, and the per-input deviation ε is reported as mean and 95th percentile across trials (Table 9, Figure 6). The Heron r2 device produces deviations roughly half those of Eagle r3, consistent with the published improvement in single-qubit gate fidelity. Tolerance choices should track this gap: for an Eagle-class deployment we recommend ε = 0.07, for a Heron-class deployment ε = 0.04. Table 9 reports averages over twenty trials of 4096 shots each. The data are generated by the experiment_5 function in quantum_oop_device_validation.py (see footnote 1).
16
Figure 5: Experiment 4. δ-sweep for Bbad . The full {X, Y, Z} contract is sensitive to small δ; the {Z}-only contract is much less so. Reproduced by quantum_oop_simulation.py, function plot_experiment_4 (footnote 1). Table 9: Experiment 5. Per-input ε for Bgood under two device-derived noise models.
6.7
FakeBrisbane (Eagle r3)
FakeFez (Heron r2)
input
mean
95th pct
mean
95th pct
|0⟩ |1⟩ |+⟩ |−⟩ ψ1 ψ2
0.025 0.018 0.056 0.054 0.011 0.052
0.044 0.037 0.065 0.067 0.023 0.073
0.013 0.013 0.028 0.023 0.013 0.023
0.028 0.027 0.036 0.035 0.027 0.033
Experiment 6: Subtype Separation under Realistic Device Noise
Methodology. The script extends the protocol of Experiment 5 to all three candidate subtypes (Bgood , Bbad (0.4), Bsneaky ) and all three Pauli observables (X, Y , Z). For every (device, candidate, input, Pauli) tuple, the script builds the appropriate basis-rotated measurement circuit, transpiles it for the device’s basis gates and connectivity, runs it under the device noise model, and estimates the Pauli expectation from counts. The reported worst-case deviation is the maximum, over the 18 (input, Pauli) pairs, of the absolute difference between the candidate’s noisy estimate and the noiseless reference for A. The same procedure is run under the weakened {Z}-only contract for comparison. We repeat the protocol of Experiment 1 under the two device noise models. Because both experiments use the same supertype A = Ry (2π/5) and the same six inputs, the results in Tables 8 and 10 are directly comparable on a per-cell basis: each entry of the device-noise table can be read as the noiseless ideal deviation of Experiment 1 plus a hardware-induced shift. For each device and each candidate, we compute the worst-case observable deviation across the six inputs and the three Paulis, and separately under the {Z}-only contract; see Table 10 and Figure 7. The separation pattern of Experiment 1 (Table 8) is preserved across all three columns of Table 10: Bsneaky stays maximally exposed by the full {X, Y, Z} contract (1.359–1.420) while remaining hidden under the {Z}-only contract (0.029–0.079), confirming the sneaky-subtype pattern characterised by Proposition 1 on real hardware. Simulated data are generated by quantum_oop_device_validation.py, function experiment_6; real-hardware data are generated by quantum_oop_real_qpu.py (footnote 1). The separation pattern of Experiment 1 is preserved on both devices: Bgood stays within the device noise floor, Bbad is a clear violation, and Bsneaky remains hidden under the weak contract while being exposed by the full one. The framework’s claims are not artefacts of the noiseless setting; they hold under the noise models of two distinct production processors.
17
Figure 6: Experiment 5. Device-noise calibration of ε under FakeBrisbane and FakeFez, per input state. Bars: mean deviation. Squares: 95th percentile. The Heron device is roughly twice as clean as the Eagle, in line with published gate-fidelity numbers. Reproduced by quantum_oop_device_validation.py, function plot_experiment_5 (footnote 1). Table 10: Experiment 6. Worst-case observable deviation under two device-derived noise models (FakeBrisbane, FakeFez) and on a real IBM Heron r2 processor (ibm_fez). FakeBrisbane
6.8
FakeFez
Real ibm_fez
Candidate
{X, Y, Z}
{Z}
{X, Y, Z}
{Z}
{X, Y, Z}
{Z}
Bgood Bbad (0.4) Bsneaky
0.056 0.395 1.359
0.055 0.395 0.056
0.028 0.401 1.386
0.027 0.396 0.029
0.074 0.485 1.420
0.061 0.362 0.079
Real QPU Validation
Methodology. As a final validation step we run the Experiment 6 protocol unchanged on a real IBM Heron r2 processor accessed through the IBM Quantum cloud. The script quantum_oop_real_qpu.py connects via QiskitRuntimeService on the Open Plan, selects the least-busy operational hardware backend, and submits the fifty-four circuits (3 candidates × 6 inputs × 3 Paulis) as a single batched SamplerV2 job at 4096 shots per circuit. The run selected ibm_fez (Heron r2, 156 qubits, job ID d7todq4t738s73ci59ug, executed on 6 May 2026 at 21:22 UTC) and completed in 137.8 seconds of total wall time from job submission to completion, comprising approximately 15 seconds of queue waiting (the device had no pending jobs at submission) and ≈ 122 seconds of running time (transpilation, QPU compute, and result retrieval combined), well within the Open Plan ten-minute monthly QPU budget. Raw counts and per-circuit summaries are released alongside the source code at the project repository (footnote 1) in the qpu_results/ directory, enabling third-party re-analysis and verification of the worst-case observable deviations without resubmitting jobs to the IBM Quantum cloud. The single-trial budget is the only methodological difference from Experiments 5–6: trials per cell drop from 20 (synthetic device noise, batched on Aer) to 1 (real hardware), so the real-QPU numbers carry larger statistical noise. This is a deliberate trade-off: we want to validate that the qualitative phenomenon survives the move to physical hardware, not to re-derive a tight calibration budget on a quota-limited account. Results. The real-hardware column of Table 10 reports the worst-case observable deviations on ibm_fez. The pattern predicted by Proposition 1 and observed in Experiments 1 and 6 survives intact: • Bgood stays at the hardware noise floor (worst {X, Y, Z} = 0.074, worst {Z} = 0.061). The deviation is roughly twice the corresponding FakeFez value, a factor consistent with the per-trial statistical spread expected from a single shot of 4096 samples per circuit and the fact that the calibration snapshot FakeFez captures is a smoothed average rather than the live state of the device at the moment of the run. 18
Figure 7: Experiment 6. Subtype separation under realistic device noise. The qualitative pattern of Figure 3 is preserved on both processors; Bsneaky remains hidden under the {Z}-only contract while being exposed by the full {X, Y, Z} one. Reproduced by quantum_oop_device_validation.py, function plot_experiment_6 (footnote 1). • Bbad (0.4) is a clear violation under both contracts ({X, Y, Z} = 0.485, {Z} = 0.362), well above Bgood even with single-trial noise. • Bsneaky exhibits the sneaky fingerprint sharply: the full-contract deviation reaches 1.420 (comparable to the noiseless 1.401 of Experiment 1 and the simulated 1.386 of FakeFez), while the {Z}-only deviation is just 0.079, indistinguishable from Bgood at the noise floor. Interpretation. The chain ideal → simulated device noise → real hardware reads 1.401 → 1.386 → 1.420 on the full contract for Bsneaky , with the {Z}-only column tracking the noise floor at every stage. The phenomenon characterised by Proposition 1 is therefore not a property of exact simulation; it is operationally observable on a real quantum processor, and a tomographically rich contract is what distinguishes it from a valid override. Conversely, deploying the same workflow under a {Z}-only contract on ibm_fez would have admitted Bsneaky as indistinguishable from A, since its {Z}-only deviation (0.079) overlaps the Bgood noise floor (0.061). Cost and reproducibility. A full run of quantum_oop_real_qpu.py consumes roughly 2 minutes of total running time on the device once the job exits the queue (queue waiting time depends on backend load and varies independently of the protocol). The job recorded here used ≈ 122 seconds of running time, well below the ten-minute monthly Open Plan budget. Raw shot counts and per-cell summaries from this run are released at the project repository under qpu_results/ so that the analysis can be re-run without resubmitting the job. The recorded job identifier (d7todq4t738s73ci59ug, 6 May 2026 21:22 UTC) also allows the run to be retrieved post-hoc through QiskitRuntimeService.job(job_id ).
6.9
Discussion
Idealised to realistic. The triple (Experiment 1, Experiment 6, Real-QPU validation of Section 6.8) corresponds to the classical scientific-method discipline: first establish the phenomenon under idealised conditions, then under simulated device noise, then under live hardware. The full-contract sneaky deviation and the {Z}-only deviation reported in Section 6.8 (Interpretation paragraph) make this transition concrete: the pattern characterised by Proposition 1 is reproducible on real hardware, not an artefact of analytic or simulated settings. Sensitivity vs. budget. Likewise, Experiment 3 (synthetic noise) and Experiment 5 (device noise) are not duplicates: Experiment 3 demonstrates the framework’s sensitivity to a parameter we control directly, while Experiment 5 calibrates the tolerance budget against the noise profile a deployer would actually face.
19
The calibration window. Together, Experiments 3 and 4 define the operational range in which a tolerance threshold ε must lie: above the noise floor at the operating noise level (so that a valid override is not flagged spuriously), but below the smallest logical perturbation we want to detect (so that a real violation is not missed). Figure 8 overlays the two curves on a shared vertical axis: the dashed (blue) curve shows the 95th-percentile noise-induced deviation as a function of depolarising probability p (top axis), and the solid (green) curve shows the deviation induced by an over-rotation of magnitude δ (bottom axis). A workable ε lies in the gap between the two; the gap shrinks with both noise level and detection target, which is what calibration is balancing.
Figure 8: Calibration window. The 95th-percentile noise floor from Experiment 3 (dashed, top axis) and the logical deviation curve from Experiment 4 (solid, bottom axis) plotted on a shared vertical axis. A tolerance choice ε must lie above the former at the operating noise level and below the latter at the smallest violation of interest. Reproduced by quantum_oop_simulation.py, function plot_combined_calibration (footnote 1). √ The empirical scaling constant. The proof of Theorem 2 yields the upper bound C(OA ) ≤ 2 2 ≈ 2.83 for the single-qubit Pauli family. The Bbad (δ) family of Section 6.5 provides a direct empirical probe of this constant. For two unitary channels A = Ry (θ) and B = Ry (θ + δ), the diamond-norm distance is ∥EA − EB ∥⋄ = 2 sin(δ/2). At δ = 0.4 this gives 0.397, while the worst-case observable deviation under the full {X, Y, Z} contract is 0.395 in the ideal setting (Table 8). The ratio ∥EA − EB ∥⋄ / supO∈OA |⟨O⟩EA − ⟨O⟩EB | ≈ 1.0 is a tight empirical lower bound on C(OA ), and the analogous ratios across the device-noise (FakeBrisbane: 1.01, FakeFez: 0.99) and real-hardware (0.82) columns of Table 10 fall in the same range, with the slight reduction on real hardware reflecting hardware-noise contributions to the observable estimate. √ The empirically observed constant is therefore well below the worst-case theoretical upper bound of 2 2, confirming that the scaling argument of Remark 1 is an upper bound rather than a typical value.
7
Real-Time Engine and Application Domains
Architecture. The engine, qcivet_realtime.py, exposes the IntegrityVerifier class. Each commit performs the observable check (if any), one SHA-256 hash over the canonical JSON of the spec prepended with the previous chain head, a tail-link consistency check, and submission of the new head to the external anchor. Errors at any step raise IntegrityViolation with a kind field (hash, observable, or anchor) so the host can decide its abort policy. Performance. We measure per-commit latency on commodity hardware (AMD Ryzen class CPU, single-threaded Python 3.12). Across the three six-stage demonstration pipelines below, median commit latency is 0.06 ms and the 99th percentile is below 0.20 ms. End-to-end overhead for a six-stage pipeline is under 0.5 ms, negligible next to even the shortest QPU stage. The same engine ran unmodified during the real-hardware validation on ibm_fez (Section 6.8): the classical hash-chain and observable-deviation 20
checks contributed under a millisecond per stage, while the cloud QPU job dominated the total wall time at 137.8 s (of which approximately 15 s was queue waiting and 122 s was running time) for 54 circuits at 4096 shots each. External anchor. The default ExternalAnchor writes to an append-only file, simulating an RFC 3161 timestamping authority or a Sigstore Rekor instance. Production deployments would replace this with the corresponding service. The verify_against_anchor method confirms that the local chain appears as a contiguous block in the anchor log; a globally consistent rewrite that is not present in the log is detected here.
7.1
Failure Modes
Three classes of attack are caught at distinct points (Figure 9): • Local tampering (an attacker rewrites a spec record in place) is caught by verify_full_chain at end of pipeline, kind hash. • Semantic drift (a quantum stage produces observables outside the calibrated tolerance) is caught at commit time, kind observable, with downstream stages never launched. • Globally consistent rewrites (an attacker produces a fresh, locally valid chain offline) are caught by verify_against_anchor, kind anchor. The three correspond, respectively, to hash-chain integrity, observable contract preservation, and global tamper evidence.
Figure 9: The four hash-chain scenarios. Top: honest pipeline, every recomputed hash matches the stored hash; verifier returns OK. Second: tampering, the spec at stage 3 is modified after commit, recomputed hash fails to match. Third: injection, a fake stage is spliced in, breaking the next legitimate record’s prev_hash linkage. Bottom: skipping, a legitimate stage record is removed, downstream prev_hash no longer matches. Reproduced by hash_chain_visualize.py; the underlying scenarios are implemented in hash_chain_demo.py (footnote 1). 21
Scenario implementation. The script hash_chain_demo.py provides standalone implementations of all four scenarios (honest baseline, post-hoc tampering, record injection, record skipping) on a six-stage hybrid QPU pipeline. Each scenario constructs the full chain, applies the attack as described above, and runs verify_chain against the resulting record sequence; the failure index and mismatch reason are reported to standard output. The companion script hash_chain_visualize.py produces Figure 9 by drawing each scenario as a sequence of stage boxes coloured by status (honest, tampered, injected, missing) with the broken hash link highlighted. Three application domains. We instantiate QCIVET in three end-to-end domains, each with a six-stage hybrid pipeline, an explicit threat model, and four demonstration scenarios (clean i.e. no-attacks, local tampering, semantic drift, global rewrite). The three domains span the maturity spectrum of quantum computing in practice: VQE for drug discovery is the most production-ready quantum-chemistry workload; quantum-assisted fraud detection is an emerging financial application; cloud QPU auditing is a meta-application in which the customer of a quantum cloud service uses QCIVET to audit the provider. The mechanism that catches the sneaky-subtype attack in each of these pipelines is the same observable-deviation check whose preservation on real hardware we established in Section 6.8.
7.2
VQE for Drug Discovery
The Variational Quantum Eigensolver computes molecular ground-state energies by alternating quantum expectation estimation with classical parameter optimisation. Major pharmaceutical companies use VQE-style pipelines for early binding-energy estimation and drug-target screening. A miscalibrated energy can mislead a clinical trial, motivating an audit-evidence requirement under U.S. Food and Drug Administration (FDA) reproducibility guidance. Pipeline. 1. molecular_geometry (classical): atomic coordinates, basis set, charge, multiplicity. 2. active_space_selection (classical): number of active orbitals, frozen-core flag. 3. hamiltonian_construction (classical): fermion-to-qubit encoding, number of Pauli terms. 4. ansatz_synthesis (classical): ansatz family, number of parameters, circuit depth. 5. vqe_optimisation (quantum): backend, shots per iteration, optimiser, final energy estimate. Carries the observable ⟨H⟩ with reference value E0 = −1.137270174 Ha (H2 in the STO-3G basis set, which approximates each Slater-type orbital with three Gaussians) and tolerance ε = 0.04 Ha (Heron-class). 6. result_interpretation (classical): binding-energy estimate, FDA compliance flag. Threats. A1: an attacker rewrites the active-space record after commit, expanding the orbital count to push a different (wrong) energy through the rest of the pipeline. A2: the optimiser converges to a biased stationary point, and the measured energy lies outside the calibrated tolerance. A3: the entire audit trail is re-run offline with a different active-space spec; only the external anchor catches it. Outcomes. All three attacks are caught at the appropriate scope. The clean baseline produces a chain of six committed records with total verification latency 0.15 ms. The demonstrator script runs each attack scenario in turn, constructs an IntegrityVerifier bound to a local append-only anchor file, and either commits the six stages successfully (clean run) or raises IntegrityViolation at the appropriate point (tamper, drift, rewrite). The full implementation of this demonstrator is provided as qcivet_demo_vqe.py, which uses the verification engine of qcivet_realtime.py (footnote 1).
7.3
Quantum-Assisted Fraud Detection
Quantum kernels for support-vector machines are an active direction in financial-crime detection. The pipeline computes fidelity-kernel entries on a QPU, classifies transactions classically, and triggers alerts above a decision threshold.
22
Pipeline.
The six stages are:
1. transaction_ingestion: ingestion of raw transaction stream; 2. feature_engineering: feature extraction and normalisation; 3. quantum_kernel_preparation: quantum-kernel parameter setup; 4. qpu_kernel_evaluation (quantum stage), with the observable “worst-case kernel-entry deviation” having reference 0 and tolerance ε = 0.05; 5. classification: classical classifier; 6. alert_decision: alert threshold, block action, regulator, audit retention. Threats. A1: an insider rewrites the alert-decision spec after commit, raising the threshold from 0.65 to 0.95 so genuine fraud no longer trips an alert, regulator-relevant under the Sarbanes-Oxley Act (SOX). A2: the QPU returns a kernel matrix whose worst-case entry deviates beyond the tolerance, indicating a poisoning attempt. A3: a globally consistent rewrite that swaps the feature set used in stage 2. Outcomes. All three attacks are caught. The threshold-raise scenario is informative: the streaming engine signs out cleanly because the tamper happens after the commit; only the post-pipeline verify_full_chain reveals the mismatch. This is the expected behaviour: hash-chain replay is the right tool for post-hoc tampering, just as observable checks are the right tool for in-flight semantic drift. The demonstrator runs each scenario as a separate pipeline pass and prints whether the violation was caught at commit time, by post-pipeline replay, or by anchor check. The full implementation is provided as qcivet_demo_fraud.py (footnote 1).
7.4
Cloud QPU Auditing
The customer of a cloud quantum service submits a hybrid workload. The provider transpiles, schedules, executes, and returns results. The customer wants to verify, after the fact, that the claimed backend was actually used, the claimed calibration data was in effect, and the result has not been altered in transit. This is a meta-application: QCIVET is used by the customer to audit the provider. Pipeline. The six stages are customer_submission, cloud_transpilation, backend_assignment, calibration_verification, job_execution (quantum, tracer-circuit observable with reference 0 and tolerance ε = 0.05 Heron-class), and result_delivery. Threats. A1 (silent downgrade): the provider claimed a Heron r2 backend but routed the workload to an Eagle r3; the tracer-circuit observable exceeds the Heron-calibrated tolerance. A2 (calibration spoof): a stale calibration snapshot is committed, then silently swapped for an older one. A3 (assignment rewrite): a globally consistent rewrite of the audit trail with a different backend assignment. Outcomes. All three attacks are caught at the expected scope. Notably, the silent-downgrade attack is caught at execution time, so the customer can reject the result before paying for it. The demonstrator implements the customer-side viewpoint: it commits the six pipeline records, checks the tracer-circuit observable against a Heron-class tolerance, and reports a pre-payment abort if the device behaviour looks Eagle-class instead. The full implementation is provided as qcivet_demo_cloud.py (footnote 1). Cross-application patterns. Table 11 summarises the three domains. Three patterns are worth noting. First, each domain exercises all three failure-detection mechanisms (hash replay, observable check, anchor verification), but their relative importance differs: VQE leans on observable drift detection; cloud auditing leans on observable downgrade detection; fraud detection leans on hash replay for the insider threshold attack. Second, calibrated tolerances are domain-specific. The Heron-class ε = 0.04 used in VQE is tighter than the ε = 0.05 used for the kernel and tracer-circuit observables, reflecting the tolerance required to disentangle a 0.04 Ha energy difference from the device noise floor. Third, all three pipelines have six stages. This is not a coincidence: hybrid quantum–classical workflows in 2026 cluster naturally around the classical-prep / quantum-execute / classical-postprocess split, typically two classical stages on either side of the quantum core. The framework is, however, agnostic to stage count. 23
Table 11: The three application domains span the maturity spectrum of quantum computing in production. Each domain is discussed in detail in the corresponding subsection. Domain
Quantum stage
Primary threat
Regulatory frame
VQE drug discovery (§7.2)
VQE optimisation
Active-space tamper, energy drift Insider threshold raise, kernel poisoning
FDA reproducibility
Silent downgrade, calibration spoof
Cloud security standards
Fraud (§7.3)
detection
Cloud QPU auditing (§7.4)
8
Quantum-kernel evaluation
Customer-side observable
SOX audit trail
Threat Model and Security Analysis
Adversary capabilities. We assume an adversary A who can: modify any spec record after it has been committed (insider with file-system access, or supply-chain compromise); insert a fabricated record into the audit trail; delete or omit a stage’s record; manipulate the quantum hardware so that observables drift, within physical constraints (subject to the noise floor of the device); rerun the entire pipeline offline with adversarial parameters and substitute the resulting chain for the original. We assume the adversary cannot produce SHA-256 collisions, cannot forge entries in the external anchor, and cannot interfere with the verifier’s runtime memory during a commit. Where SHA-256 is not preferred (deployments that pre-emptively assume Grover-style speedups, for example), substitution with SHA-3 or a PQC-safe hash is straightforward and changes nothing else in the framework.
Adversary A
Attack class
Detection mechanism
Violation kind
Spec tampering / fabricated records
verify_full_chain (hash-chain replay)
kind: hash
Quantum-stage drift beyond ε
Commit-time observable check
kind: observable
Globally consistent offline rewrite
verify_against_anchor (anchor verification)
kind: anchor
Figure 10: QCIVET threat model: three classes of attack, the detection mechanism that catches each, and the violation kind reported by the engine. The middle row (observable-deviation detection) is the only one that depends on quantum-stage behaviour and is empirically validated on real cloud hardware in Section 6.8.
Detection targets and coverage. Figure 10 summarises the mapping between attack classes and detection mechanisms. The three failure-detection mechanisms cover the corresponding attack classes. Spec tampering, fabricated records, and stage omission are caught by hash-chain replay (verify_full_chain) at most one round-trip after the attack. Quantum hardware manipulation that causes observable drift beyond the calibrated tolerance is caught at commit time. Globally consistent rewrites are caught by anchor verification. The observable-deviation detector is not merely analytical: Section 6.8 confirms that the deviation signature distinguishing valid, invalid, and sneaky overrides is preserved on real cloud hardware (ibm_fez, Heron r2) within the calibrated noise budget, so the threat-model coverage stated here is grounded in measurement rather than in simulation alone. Limitations of the threat model. QCIVET does not address: confidentiality of spec records (an attacker may read the pipeline structure); denial of service against the quantum backend; attacks that operate within the calibrated tolerance (an attacker who can manipulate observables by less than ε
24
remains undetected by this mechanism, by construction); or memory-safety vulnerabilities in the host pipeline. Confidentiality is orthogonal and can be addressed by encrypting the spec records under a separate key. The third item implies a tighter calibration regime, limited in turn by the device noise floor; reducing ε below the noise floor would produce false positives. False-positive considerations. A correctly calibrated ε should produce no false positives in honest operation. The procedure of Experiment 5 is the operational realisation: run Bgood on the target backend over a representative input set, take the 95th percentile of the per-input deviation, and set ε slightly above it. A deployer who tightens ε aggressively trades detection sensitivity against false-positive rate, exactly as in classical anomaly-detection systems.
9
Conclusion and Future Work
We presented QCIVET, a contract-based integrity-verification framework for hybrid quantum–classical software pipelines. QCIVET fills a gap between classical supply-chain integrity tools, which do not address quantum stages, and quantum-cryptographic primitives, which assume the workflow itself is classical. Our contribution is twofold: a behavioural-subtyping framework whose preservation condition is operationally measurable on a calibrated noise floor, and a real-time engine whose per-stage overhead is sub-millisecond. To the best of our knowledge, the contributions of this work have no precedent in the literature: (i) we operationalise Liskov-Wing behavioural subtyping for quantum channels through a calibrationready observable-deviation contract that is directly measurable on noisy hardware with a finite shot budget; (ii) we identify and formally characterise the sneaky-subtype family, namely overrides that pass weak, single-Pauli contracts but are exposed by informationally complete ones (Proposition 1); (iii) we combine hash-chained syntactic integrity with a semantic quantum check inside a single discipline, with an explicit soundness–completeness link between the two layers (Theorems 1–3); (iv) we provide an integrity-verification mechanism designed specifically for VQE-based pharmaceutical workflows; and (v) we demonstrate the full subtype-separation protocol end-to-end on a real cloud quantum processor (ibm_fez, Heron r2), where the predicted sneaky-fingerprint survives intact along the ideal → simulated → real chain. These contributions are intentionally complementary to recent foundational progress on refinement-based substitutability for quantum programs [11,12]: where the refinement framework provides the denotational backbone for what it means for one quantum program to replace another at development time, our work provides the runtime-observable, hardware-evaluable projection of that question for the audit setting on noisy hybrid pipelines. The framework’s three formal guarantees (soundness, conditional completeness, and compositionality) are matched by three detection mechanisms in the implementation: hash-chain replay, observabledeviation halting, and external anchor verification. The three application domains (VQE for drug discovery, quantum-assisted fraud detection, and cloud QPU auditing) show that the same engine and the same theory apply across very different production settings, with only the threat model and the calibrated tolerance changing. The experimental campaign closes the gap between theory and deployment. Beyond the noiseless analysis (Experiments 1–4) and the device-noise validation on calibrated simulators (Experiments 5–6), we ran the subtype-separation protocol end-to-end on ibm_fez, a production Heron r2 processor accessed through the IBM Quantum cloud, on 54 distinct circuits with 4096 shots each. The sneaky-override fingerprint predicted by Proposition 1 survives intact on real hardware. The full-contract deviation reads 1.401 → 1.386 → 1.420 along the ideal → simulated → real chain, with the real-hardware value within 1.4% of the noiseless prediction; at the same time the {Z}-only deviation stays at the noise floor on every stage of the chain (0.000 ideal, 0.029 simulated, 0.079 real). The point of this run is not the precision of the numbers but the qualitative invariant they expose: a circuit can pass a weak, single-Pauli contract on a real noisy QPU and still fail an informationally complete one by more than an order of magnitude. Contract-based integrity verification is therefore not a property of exact simulation; it is a property of operational behaviour observable on a real quantum processor today. These results have direct implications for high-stakes deployments. In pharmaceutical workflows, an unaudited VQE energy estimate that drifts past tolerance can mislead preclinical screening; QCIVET binds each stage of the calculation to a verifiable observable contract and an auditable hash chain, producing the kind of evidence already required by reproducibility regimes such as the FDA. In financial fraud detection, an after-the-fact post-quantum signature does not detect that a kernel matrix was
25
poisoned during evaluation; the observable check on the kernel and the commit-time hash chain do, and they do so before the downstream classical decision is released. In customer-side auditing of a cloud QPU service, the customer needs neither multiple devices nor extra cryptographic gates: a single tracer observable and a tolerance budget are sufficient to detect specification tampering, middleware re-routing, and calibration drift, against an honest-but-curious or malicious-but-budgeted provider. Practical positioning. Beyond formal novelty, QCIVET is engineered to be the practical and economical option for production deployments. Compared with device-fingerprinting and quantum-PUF schemes, which authenticate the hardware unit but say nothing about whether the result satisfies a contract, QCIVET delivers an end-to-end integrity guarantee with no specialised hardware beyond the QPU the customer is already using. Compared with distributed-shot protocols that require multiple physical devices for majority voting (and the corresponding multiple QPU rentals), QCIVET runs on a single device. Compared with cryptographic delegation protocols that introduce extra quantum gates and multi-prover settings, both of which translate directly into longer queue times and higher per-job costs on commercial cloud platforms, QCIVET requires only a tracer observable and a tolerance budget on the customer side. The cost on the classical layer is a sub-millisecond per-stage commit, dominated by a single SHA-256 hash, so the marginal expense of running QCIVET on top of an existing pipeline is dominated by ordinary CPU cycles rather than additional quantum shots. The framework is composable rather than exclusive: deployers concerned about future quantum cryptanalysis can wrap each anchor commitment in a post-quantum signature (ML-DSA or SLH-DSA), and the in-toto, SLSA and Sigstore Rekor tooling already adopted in classical pipelines can serve unchanged as the external anchor. From a governance perspective, the per-stage spec record together with its hash chain provides a tamper-evident chain of accountability: each parameter change, each calibration snapshot, and each observable measurement is bound to a verifiable commit, so an auditor can attribute any deviation to a specific stage, a specific operator, and a specific point in time without re-executing the pipeline. Finally, the artefact QCIVET produces, a hash-chained record of every spec, every observable contract, and every commit time, is the kind of evidence already requested under FDA reproducibility regimes and SOX audit trails, so adoption is incremental rather than disruptive. We see QCIVET as one piece of a larger puzzle. Quantum software will increasingly drive high-stakes classical decisions; the software-engineering tools we use to trust those decisions must catch up. Multi-qubit and entangled observables. Our experiments are on a single qubit. The framework extends to multi-qubit observables and entangled states without modification (Theorem 1 is dimensionagnostic), but the constants in Theorem 2 grow with the dimension and empirical calibration becomes more involved. Calibrating multi-qubit informationally complete families on production-scale circuits is an open problem. Cloud-provider deployment. The cloud QPU auditing demonstration is from the customer’s perspective. A complementary deployment from the provider’s side (attesting calibration snapshots, transpilation provenance, and run logs into the customer’s chain) would close the loop and is feasible with the existing engine API.
Author Contributions Esra Yeniaras (corresponding author): Conceptualization of the contract-based integrity verification framework, formal methodology, design and proof of all theorems (soundness, conditional completeness, compositionality) and the sneaky-subtype characterisation, software implementation including the verification engine and the three application demonstrators, all experimental scripts (Experiments 1–6), experimental design, real-hardware IBM QPU validation runs on ibm_fez, writing of the manuscript, and project supervision. Muhammad Amin Karimov: Conceptualization of the initial research direction, literature review for the related work survey, and assistance with the real-hardware IBM QPU validation experiment on ibm_fez.
Acknowledgements We acknowledge the use of IBM Quantum services [13] and the Qiskit open-source software development kit [15] for the real-hardware validation experiments reported in Section 6.8. The views expressed are 26
those of the authors and do not reflect the official policy or position of IBM or the IBM Quantum team.
References [1] Carlisle Adams, Pat Cain, Denis Pinkas, and Robert Zuccherato. Internet X.509 public key infrastructure time-stamp protocol (tsp). RFC 3161, Internet Engineering Task Force (IETF), 2001. [2] Mst Shapna Akter, Hossain Shahriar, Sheikh Iqbal Ahamed, Kishor Datta Gupta, Muhammad Rahman, Atef Mohamed, Mohammad Rahman, Akond Rahman, and Fan Wu. Case study-based approach of quantum machine learning in cybersecurity: Quantum support vector machine for malware classification and protection. In 2023 IEEE 47th Annual Computers, Software, and Applications Conference (COMPSAC), pages 1057–1063. IEEE, 2023. [3] Vita Santa Barletta, Danilo Caivano, Mirko De Vincentiis, Anibrata Pal, and Michele Scalera. Hybrid quantum architecture for smart city security. Journal of Systems and Software, 217:112161, 2024. [4] Samarth Bhadane, Disha Gupta, Priyanka V. Deshmukh, and Nivedita Mishra. A hybrid hash framework for post-quantum secure zero-knowledge identification. Scientific Reports, 15:42176, 2025. [5] Robert Campbell. AI supply chain security: MBOM-PQC provenance, PQC attestation, and a maturity model for quantum-resistant assurance, 2026. Preprints.org. [6] Grazia D’Onghia and Antonio Lioy. Towards quantum-resistant trusted computing: Architectures for post-quantum integrity verification techniques. In 2025 IEEE Symposium on Computers and Communications (ISCC), Bologna, Italy, July 2025. IEEE. [7] Kanishk Dwivedi, Majid Haghparast, and Tommi Mikkonen. Quantum software engineering and quantum software development lifecycle: A survey. Cluster Computing, 27(6):7127–7145, 2024. [8] Dmitry A. Fedorov, Bo Peng, Niranjan Govind, and Yuri Alexeev. VQE method: A short survey and recent developments. Materials Theory, 6(1):2, 2022. [9] Samuel da Silva Feitosa, Juliana Kaizer Vizzotto, Eduardo Kessler Piveta, and Andre Rauber Du Bois. A monadic semantics for quantum computing in Featherweight Java. In Brazilian Symposium on Programming Languages (SBLP 2016), volume 9889 of Lecture Notes in Computer Science, pages 31–45. Springer, 2016. [10] Yuan Feng, Runyao Duan, and Mingsheng Ying. Bisimulation for quantum processes. ACM Transactions on Programming Languages and Systems, 34(4):17:1–17:43, 2012. [11] Yuan Feng and Li Zhou. Refinement orders for quantum programs, 2025. [12] Yuan Feng, Li Zhou, Yingte Xu, and Xiaoquan Xu. Refinement calculus of quantum programs with projective assertions. ACM Transactions on Software Engineering and Methodology, 2025. [13] Leron Gil, Julianna Roberts, Sanskriti Deva, and Robert Davis. Doubling down on open-access quantum computing, March 2026. IBM Quantum Computing Blog. Accessed: May 2026. [14] Taylor Harville, Rishu Khurana, Vitor F. Grizzi, and Cong Liu. Recent developments in VQE: Survey and benchmarking, 2026. [15] Ali Javadi-Abhari, Matthew Treinish, Kevin Krsulich, Christopher J. Wood, Jake Lishman, Julien Gacon, Simon Martiel, Paul D. Nation, Lev S. Bishop, Andrew W. Cross, Blake R. Johnson, and Jay M. Gambetta. Quantum computing with Qiskit, 2024. [16] Tiancheng Jin and Jianjun Zhao. ScaffML: A quantum behavioral interface specification language for Scaffold, 2023. [17] Md. Zaki Khan, Mizanur Rahman, and Mashrur Chowdhury. Hybrid quantum-classical neural network for cloud-supported in-vehicle cyberattack detection, 2021. [18] Sungbeen Kim and Dohoon Kim. Data-tracking in blockchain utilizing hash chain: A study of structured and adaptive process. Symmetry, 16(1):62, 2024. 27
[19] Dominik Leichtle, Luka Music, Elham Kashefi, and Harold Ollivier. Verifying BQP computations on noisy devices with minimal overhead. PRX Quantum, 2(4):040302, 2021. [20] Gushu Li, Li Zhou, Nengkun Yu, Yufei Ding, Mingsheng Ying, and Yuan Xie. Projection-based runtime assertions for testing and debugging quantum programs. Proceedings of the ACM on Programming Languages, 4(OOPSLA):150:1–150:29, 2020. [21] Barbara Liskov and Jeannette M. Wing. A behavioral notion of subtyping. ACM Transactions on Programming Languages and Systems, 16(6):1811–1841, 1994. [22] Ang Liu, Xiu-Bo Chen, Shengwei Xu, Zhuo Wang, Zhengyang Li, Liwei Xu, Yanshuo Zhang, and Ying Chen. A secure scheme based on a hybrid of classical-quantum communications protocols for managing classical blockchains. Entropy, 25(5):811, 2023. [23] Ralph C. Merkle. A digital signature based on a conventional encryption function. In Advances in Cryptology — CRYPTO ’87, volume 293 of Lecture Notes in Computer Science, pages 369–378. Springer, 1988. [24] Bertrand Meyer. Object-Oriented Software Construction. Prentice Hall, 2nd edition, 1997. [25] Hector E. Mozo. Quantum-classical hybrid encryption framework based on simulated BB84 and AES-256: Design and experimental evaluation, 2025. [26] Juan M. Murillo, Jose Garcia-Alonso, Enrique Moguel, Johanna Barzen, Frank Leymann, Shaukat Ali, Tao Yue, Paolo Arcaini, Ricardo Pérez-Castillo, Ignacio García Rodríguez de Guzmán, Mario Piattini, Antonio Ruiz-Cortés, Antonio Brogi, Jianjun Zhao, Andriy Miranskyy, and Manuel Wimmer. Quantum software engineering: Roadmap and challenges ahead. ACM Transactions on Software Engineering and Methodology, 34(5), 2025. [27] National Institute of Standards and Technology. FIPS 203: Module-lattice-based key-encapsulation mechanism standard. Technical report, 2024. [28] National Institute of Standards and Technology. FIPS 204: Module-lattice-based digital signature standard. Technical report, 2024. [29] National Institute of Standards and Technology. FIPS 205: Stateless hash-based digital signature standard. Technical report, 2024. [30] National Institute of Standards and Technology (NIST). Post-quantum cryptography: Additional digital signature schemes. https://csrc.nist.gov/projects/pqc-dig-sig, 2026. Accessed 19 April 2026. [31] National Institute of Standards and Technology (NIST). Post-quantum cryptography standardization process. https://csrc.nist.gov/projects/post-quantum-cryptography/ post-quantum-cryptography-standardization, 2026. Accessed 19 April 2026. [32] Srikumar Nayak. HQFS: Hybrid quantum classical financial security with VQC forecasting, QUBO annealing, and audit-ready post-quantum signing, 2026. [33] Zachary Newman, John Speed Meyers, and Santiago Torres-Arias. Sigstore: Software signing for everybody. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS ’22), pages 2353–2367. ACM, 2022. [34] Michael A. Nielsen and Isaac L. Chuang. Quantum Computation and Quantum Information. Cambridge University Press, 10th anniversary edition, 2010. [35] Chinenye Okafor, Trevor Schorlemmer, Santiago Torres-Arias, and James C. Davis. SoK: Analysis of software supply chain security by establishing secure design properties. In Proceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED ’22), pages 15–24. ACM, 2022. [36] Vern I. Paulsen. Completely Bounded Maps and Operator Algebras, volume 78 of Cambridge Studies in Advanced Mathematics. Cambridge University Press, 2002.
28
[37] Koustubh Phalak, Abdullah Ash-Saki, Mahabubul Alam, Rasit Onur Topaloglu, and Swaroop Ghosh. Quantum PUF for security and trust in quantum computing. IEEE Journal on Emerging and Selected Topics in Circuits and Systems, 11(2):333–342, 2021. [38] John Preskill. Lecture notes for physics 229: Quantum information and computation. Caltech, 1998. [39] Amit Saxena. Audit trail in pharma: A review. Asian Journal of Pharmaceutical Research, 12(4):359– 363, 2022. [40] Bruce Schneier and John Kelsey. Secure audit logs to support computer forensics. ACM Transactions on Information and System Security, 2(2):159–176, 1999. [41] Samuel Sepúlveda, Ania Cravero, Guillermo Fonseca, and Leandro Antonelli. Systematic review on requirements engineering in quantum computing: Insights and future directions. Electronics, 13(15):2989, 2024. [42] Yunong Shi, Runzhou Tao, Xupeng Li, Ali Javadi-Abhari, Andrew W. Cross, Frederic T. Chong, and Ronghui Gu. CertiQ: A mostly-automated verification tool for a realistic quantum compiler, 2019. [43] SLSA Framework. Supply-chain levels for software artifacts (slsa). Project repository and specification, 2021. https://slsa.dev. [44] Mahzabin Tamanna, Sascha Fahl, Sivana Hamer, Yasemin Acar, Mindy Tran, and Laurie Williams. Analyzing challenges in deployment of the SLSA framework for software supply chain security, 2024. [45] Thomas Thüm, Alexander Knüppel, Stefan Krüger, Stefanie Bolle, and Ina Schaefer. Feature-oriented contract composition. Journal of Systems and Software, 152:83–107, 2019. [46] Jules Tilly, Hongxiang Chen, Shuxiang Cao, Dario Picozzi, Kanav Setia, Ying Li, Edward Grant, Leonard Wossnig, Ivan Rungger, George H. Booth, and Jonathan Tennyson. The variational quantum eigensolver: A review of methods and best practices. Physics Reports, 986:1–128, 2022. [47] Santiago Torres-Arias, Hammad Afzali, Trishank Karthik Kuppusamy, Reza Curtmola, and Justin Cappos. in-toto: Providing farm-to-table guarantees for bits and bytes. In 28th USENIX Security Symposium (USENIX Security 19), pages 1393–1410. USENIX Association, 2019. [48] Dominique Unruh. Quantum relational Hoare logic. Proceedings of the ACM on Programming Languages, 3(POPL):33:1–33:31, 2019. [49] Suryansh Upadhyay and Swaroop Ghosh. Robust and secure hybrid quantum-classical computation on untrusted cloud-based quantum hardware. In Proceedings of the 11th International Workshop on Hardware and Architectural Support for Security and Privacy (HASP ’22), pages 45–52. ACM, 2022. [50] Suryansh Upadhyay and Swaroop Ghosh. Trustworthy and reliable computing using untrusted and unreliable quantum hardware. Frontiers in Computer Science, 6:1431788, 2024. [51] U.S. Food and Drug Administration. 21 CFR Part 11 – electronic records; electronic signatures. Code of Federal Regulations, Title 21, 1997. Last accessed: 2026. [52] John Watrous. The Theory of Quantum Information. Cambridge University Press, 2018. [53] Jindi Wu, Tianjie Hu, and Qun Li. Detecting fraudulent services on quantum cloud platforms via dynamic fingerprinting. In Proceedings of the 43rd IEEE/ACM International Conference on Computer-Aided Design (ICCAD ’24), pages 1–8. ACM, 2024. [54] Jindi Wu, Tianjie Hu, and Qun Li. QuanGuard: Error evolution-based fingerprinting for fraud detection in quantum cloud services. IEEE Transactions on Computers, 75(3):1070–1081, 2026. [55] Masaomi Yamaguchi and Nobukazu Yoshioka. Design by contract framework for quantum software. In 2023 IEEE/ACM 4th International Workshop on Quantum Software Engineering (Q-SE), pages 24–25. IEEE Computer Society, 2023. Also available as arXiv:2303.17750. [56] Esra Yeniaras. Quantum resistance. In Roman Beck, editor, Elgar Encyclopedia of Cryptocurrencies, Blockchain and DLT, pages 178–184. Edward Elgar Publishing, 2026.
29
[57] Esra Yeniaras and Murat Cenk. Faster characteristic three polynomial multiplication and its application to NTRU Prime decapsulation. Journal of Cryptographic Engineering, 12(3):329–348, 2022. [58] Esra Yeniaras and Murat Cenk. Improved polynomial multiplication algorithms over characteristic three fields and applications to NTRU Prime. In Innovative Security Solutions for Information Technology and Communications, pages 125–144, Cham, 2022. Springer International Publishing. [59] Mingsheng Ying. Floyd–Hoare logic for quantum programs. ACM Transactions on Programming Languages and Systems, 33(6):19:1–19:49, 2011. [60] Li Zhou, Nengkun Yu, and Mingsheng Ying. An applied quantum Hoare logic. In Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI 2019), pages 1149–1162. ACM, 2019.
30