QML-PipeGuard: Drift-Aware Behavioral Fingerprinting for Quantum Machine Learning Pipeline Integrity Esra Yeniaras
∗
arXiv:2605.25066v1 [quant-ph] 24 May 2026
May 26, 2026
Abstract Quantum machine learning (QML) has moved from research prototypes to deployed cloud services on IBM Quantum, IonQ, and Quantinuum hardware. As QML enters regulated industries and customer-facing applications, the integrity of the quantum stage becomes a practical concern on two fronts: noisy intermediate-scale hardware drifts at the channel level between recalibrations, and an adversary with control over the execution environment can substitute the declared quantum channel with a behaviorally similar but mathematically distinct one. Neither concern is covered by existing QML verification work on pulse-level noise compensation, input-distribution drift, input-perturbation robustness, or device-identity authentication [9, 17, 25, 42]. We introduce QML-PipeGuard, a contract-based framework that addresses both concerns under a single mathematical machinery. The framework characterizes a QML pipeline at runtime by its behavioral fingerprint, the vector of observable expectation values under a tomographically structured measurement family, and operates in two modes that share the same machinery: drift-aware monitoring that absorbs benign calibration changes within a calibrated tolerance, and adversarial detection that catches channel substitution as a violation of an informationally complete observable contract. The framework rests on three QML-specific contributions: a pipeline-composition treatment of the encoder–ansatz–measurement channel together with a threat model whose conditions are specific √ to QML output structures (Theorem 1, proved with a tight frame-bound constant C = 3 for the single-qubit p Pauli family that sharpens the corresponding value in concurrent work [45] by a factor of 2/3); a finite-shot sample-complexity bound that turns the contract into an operationally executable check under shot noise (Theorem 4); and a tolerance decomposition εA = εadv + εdrift that separates adversarial and natural-drift contributions under a single tolerance (Corollary 2). We validate the framework end-to-end on a two-qubit QSVM pipeline executed on the IBM Heron r2 processor (ibm fez) for the detection and drift experiments, with a complementary sample-complexity validation on a noise-matched simulator: the prescribed measurement budget (N ≈ 1.4 × 104 shots, an approximately 27fold reduction at the deployed operational parameters relative to the looser-constant bound, asymptotically threefold in the small-tolerance limit; combined with a precomputed-reference refinement, the cumulative reduction is approximately 100-fold) fits in a single batched job, the sneaky channel is detected with a wide safety margin against shot noise on the complete observable family while evading the weak one, and the typical hardware drift sits within the calibrated contract tolerance. To our knowledge this is the first hardware validation of a dual-mode channel-integrity contract on an end-to-end QML pipeline (encoder, ansatz, measurement, multi-qubit feature map, finite-shot sampling, natural drift) rather than on isolated CPTP channels. Keywords: quantum machine learning, behavioral fingerprinting, runtime verification, calibration drift, quantum kernel methods, variational quantum classifiers, quantum neural networks, observable contracts, channel substitution, network intrusion detection ∗
Contact: [email protected], Quantum Security and Post-Quantum Cryptography Researcher (previously Assistant Professor in Cyber Security at Copenhagen School of Business (EK)).
1
1
Introduction
Quantum machine learning (QML) has progressed from theoretical proposals to deployed cloud services. Production QML pipelines now run on IBM Quantum, IonQ, and Quantinuum hardware through Qiskit Machine Learning, PennyLane, and TensorFlow Quantum. Practical use cases include network intrusion detection on quantum kernel methods [14, 21], drug discovery on variational quantum eigensolvers [5], and emerging applications in credit scoring and bioinformatics. As QML enters regulated industries and customer-facing applications, the question of pipeline integrity moves from theoretical to operational: production deployments need runtime evidence that the quantum stage is executing the declared computation within its specification. The integrity concern divides naturally into two fronts. The first front is calibration drift. Noisy intermediate-scale quantum (NISQ) hardware undergoes calibration changes over time at the channel level: gate fidelities shift, coherence times fluctuate, and readout errors evolve as devices recalibrate or age. A QML pipeline deployed today may behave differently next week despite using the same circuit specification. The second front is adversarial substitution. An entity with control over the QML execution environment, whether a cloud provider, an internal operator, or an external attacker, can replace the declared quantum channel EA with a substitute channel EB that produces classification decisions matching the declared one on a verification test set but differs in entanglement structure or confidence distribution on production inputs. We motivate the practical relevance of sneaky ansatz substitution with three concrete deployment scenarios. First, in regulated industries such as finance and healthcare, a model owner facing compliance audit may substitute an audit-passing ansatz that masks bias or other regulated behavior. This is the QML analog of the Volkswagen Dieselgate emissions case, where audit-passing software produced different behavior under production conditions. Second, in cloud QPU deployments, a service provider may substitute a lower-fidelity channel that passes customer test queries but degrades on production inputs, reducing operational costs at the customer’s expense. This is the QML analog of the lazy-server attacks studied in classical cloud computing [13]. Third, in academic publishing, an investigator may report results using a substitute ansatz that passes reviewer replication checks but does not represent the actual reported experiment, contributing to the broader reproducibility crisis in machine learning [19]. In all three scenarios, classical detection methods that rely on weak observable subsets (such as final-decision agreement) miss the substitution because the sneaky channel preserves classical marginals by construction. Existing QML integrity work addresses adjacent but distinct verification questions. Calibration drift has been approached at the pulse level through evolutionary calibration of pulse amplitudes and gate substitutions [17], and concept drift in the input distribution has been monitored through quantum-centric distance metrics [9]. Adversarial robustness against input perturbations has been formally verified [25], and device-identity authentication in cloud quantum networks has been addressed via noise-gap fingerprinting [42]. Each of these frameworks targets a specific verification question: pulse compensation, data drift detection, input robustness, or hardware identity. None addresses the channel-level integrity question of whether the declared quantum channel itself is the one being executed, treated under a unified framework that covers both benign calibration drift and adversarial substitution. 2
This paper introduces QML-PipeGuard, a contract-based framework for QML pipeline integrity. The framework defines behavioral fingerprinting as the runtime characterization of a QML pipeline by its observable expectation values under a tomographically structured measurement family, and combines two operational modes within a single mathematical scaffolding. In drift-aware monitoring mode, calibration changes within a calibrated tolerance ε are absorbed and recorded as benign drift events. In adversarial detection mode, channel substitutions producing observable deviations beyond ε on an informationally complete observable family are detected as integrity violations. We formalize sneaky ansatz substitution as a behavioral subtype attack on three of the most widely deployed QML model classes: variational quantum classifiers (VQCs), quantum kernel methods (quantum support vector machines, QSVMs), and quantum neural networks (QNNs) (Section 5). The structural conditions, theorems, and observable contract are formulated uniformly across the three classes; the hardware validation in this paper is on the QSVM instance, which is the smallest non-trivial instance of the framework and exercises the encoder, ansatz, measurement, multi-qubit feature map, finite-shot sampling, and drift components in a single pipeline. Related architectures, including quantum convolutional neural networks (QCNNs) and quantum Boltzmann machines (QBMs), share the same structural property of producing observable-expectation outputs and are reachable by the same framework with minor adaptations; their explicit treatment is left to follow-up work. We prove a detection theorem characterizing the observable conditions sufficient to catch all such substitutions within calibrated tolerance (Theorem 1), bound the sample complexity of the measurement budget (Theorem 4), and derive a corollary for drift event detection (Corollary 2). The framework sits within a broader behavioral-subtyping discipline for quantum software; concurrent work [45] develops the general completely positive trace-preserving (CPTP) channel theory, while the present paper develops the QML-specific framework with its own threat model, theorems, and operational tools. We validate the framework on a quantum kernel pipeline executed on the IBM Heron r2 processor (Section 6), showing that adversarial fingerprints survive realistic hardware calibration noise. The framework integrates with standard QML toolchains (Qiskit Machine Learning, PennyLane) and complements existing QML verification work by providing the channel-level runtime contract layer absent from current practice. Software and data availability. A reference implementation of the framework, the three experiments reported in Section 6, and the archived IBM Heron r2 run artifacts (raw counts, fingerprints, audit logs, and run metadata for the detection and drift experiments) are available at the project repository1 under the MIT license. The hardware run JSON files include the IBM Quantum job IDs, so the original jobs can be retrieved directly from the IBM Quantum service. The repository includes step-by-step instructions for reproducing every figure and table in this paper, from ideal simulator through noisy simulator to real hardware. The remainder of the paper is organized as follows. Section 2 surveys related work across QML calibration, drift monitoring, adversarial verification, fingerprinting, and behavioral subtyping, positioning this paper relative to each thread. Section 3 introduces the observable-contract framework and the QML primitives used in the rest of the paper. Section 4 states the threat 1
https://github.com/schrodinket/QML-PipeGuard
3
model and adversary capabilities, instantiated through the three deployment scenarios introduced above. Section 5 develops the behavioral fingerprinting framework and proves the detection theorem, sample complexity bound, and drift corollary. Section 6 reports experimental validation on the IBM Heron r2 processor. Section 7 discusses limitations, integration with existing toolchains, and open problems. Section 8 concludes.
2
Related Work and Positioning
Quantum software engineering has matured into an active research field with its own body of identified challenges and open problems [34]. Two recent contributions sketch the broader trustworthiness and security landscape for QML deployment. Catak et al. [6] propose a roadmap for trustworthy QML organized around three pillars (uncertainty quantification, adversarial robustness against input perturbations, and privacy preservation in delegated learning), validated on a unified trust-assessment pipeline for parameterized quantum classifiers. Kundu and Ghosh [22] provide an SoK survey of security concerns in QML-as-a-Service deployments, mapping confidentiality, integrity, and availability threats across the QMLaaS workflow but stopping short of constructive defenses. Neither addresses channel-level execution integrity as a runtime-verifiable contract: the trustworthiness pillars of [6] concern calibration-of-confidence, input-perturbation robustness, and data privacy rather than declared-versus-executed channel agreement, while [22] catalogs the threat surface without proposing a runtime detection mechanism. The present work fills the channel-integrity slot in this landscape with a contract-based, dual-mode framework. The remainder of this section sits the contribution at the intersection of five technical threads that the broader trustworthiness roadmap touches but does not unify: calibration management for noisy quantum hardware, drift monitoring in QML, robustness verification of QML against adversarial inputs, fingerprinting of quantum devices, and behavioral subtyping for quantum software. We surveyed each thread and confirm that, to our knowledge, no prior work combines channel-level behavioral fingerprinting with the dual operational modes (drift-aware monitoring and adversarial substitution detection) under a unified contract-based framework with formal soundness and sample-complexity guarantees. The remainder of this section positions our contribution against each thread using comparison tables, emphasizing complementarity rather than displacement.
2.1
Calibration Management for Noisy Quantum Hardware
QML pipelines deployed on NISQ hardware operate under non-stationary noise. A growing line of work addresses this through hardware-aware adaptation at the pulse level. Hu et al. [17] introduced QuPAD, a pulse-based noise adaptation framework that replaces CNOT gates (identified as fidelity bottlenecks) with parameterized Rzx gates and uses an evolutionary algorithm to calibrate optimal pulse amplitudes and durations on the target device. On 8 to 10 qubit systems, QuPAD achieves under 15 minutes of runtime, up to 270x speedup compared to parameter-shift optimization, and 59.33% accuracy gain on classification tasks. Earlier and parallel work on iterative pulse calibration [12] and adaptive error mitigation [15] share the same hardware-adaptation purpose. 4
These approaches operate at a layer below the channel: they reshape the pulse waveform implementing each gate to compensate for hardware variability and produce a higher-fidelity channel. Our framework operates at the channel layer, taking the executed channel as input and verifying whether its observable behavior conforms to the declared specification within calibrated tolerance. The two layers are complementary: pulse-level adaptation strengthens the substrate channel, while channel-level contract verification is a question that this thread does not address and that, as far as we are aware, has not been formulated as a runtime-verifiable pipeline-integrity contract in the prior QML calibration literature. A pipeline using QuPAD for pulse-level adaptation can deploy our framework on top to provide auditable runtime evidence that the resulting channel meets its declared behavioral contract; conversely, a pipeline that does not use pulse-level adaptation can still be verified channel-level. Table 1 lays out this layered relationship across attack surface, verifier role, and adaptation granularity. Table 1: Pulse-level calibration management versus this work. Each row characterizes one comparison aspect.
2.2
Aspect
Pulse-level approaches (QuPAD [17], iterative pulse calibration [12], adaptive error mitigation [15])
This work
Operational layer
Reshapes pulse waveform to compensate hardware variability
Operates on the resulting channel as input; verifies its observable behavior
Performance metric
Fidelity gain, accuracy gain, runtime speedup
Observable contract satisfaction within calibrated tolerance
Adversary model
Not addressed (benign noise assumed)
Channel-substitution adversary covered
Operational mode
Single mode: calibrate-and-run
Dual mode: drift-aware monitoring + adversarial detection
Drift Monitoring in QML
A separate thread addresses statistical drift in QML deployments. Dunn et al. [9] introduced QSafeML, the quantum adaptation of the SafeML safety monitoring approach. Q-SafeML detects concept drift (the divergence between operational input data and training data) using quantumcentric distance metrics, with experimental validation on QCNNs and VQCs. The approach is model-dependent and post-classification, and it explicitly targets the input-distribution-versusmodel alignment problem. Q-SafeML and the present work address drift on different axes. Q-SafeML monitors drift in the input data distribution, asking whether the production data is representative of the training data on which the QML model was trained. Our framework monitors drift in the quantum channel itself, asking whether the hardware-implemented channel still produces the same observable expectations as the declared channel within calibrated tolerance. The two 5
are complementary axes: an input-distribution drift can occur without a channel drift, and a channel drift can occur without an input-distribution drift. Both can occur simultaneously in production. A complete QML deployment integrity solution would deploy Q-SafeML on the input layer and our framework on the channel layer; to the best of our knowledge, channel-level drift has not previously been addressed under a runtime-verifiable contract that also covers adversarial substitution within the same operational mechanism. Table 2 contrasts the two axes across what is monitored, the failure mode each catches, and where each fits in the deployment stack. Table 2: Drift monitoring approaches in QML versus this work. Each row characterizes one comparison aspect.
2.3
Aspect
Q-SafeML [9]
This work
What is monitored
Concept drift: input distribution vs. training distribution
Channel drift: declared channel vs. executed channel
When triggered
Post-classification, model-dependent
During execution, before commit to audit trail
Validated on
QCNN and VQC at the input layer
Quantum kernel methods (QSVM) at the channel layer; structural specialization to VQC and QNN is treated in Section 5
Operational mode
Single mode: drift only
Dual mode: drift + adversarial detection share the same machinery
Robustness Verification of QML against Adversarial Inputs
Quantum machine learning models, like their classical counterparts, are vulnerable to adversarial perturbations of inputs [24, 27, 41]. Lin et al. [25] introduced VeriQR, the first dedicated tool for formally verifying robustness of QML models, supporting exact (sound and complete) algorithms for local and global robustness verification and approximation algorithms for efficiency. VeriQR mimics noisy hardware impacts by incorporating random noise, detects adversarial input examples, and improves model robustness through adversarial training. The tool was presented at the World Congress on Formal Methods 2024. VeriQR and the present work address adversarial verification on different attack surfaces. VeriQR addresses the input-perturbation threat: an adversary perturbs inputs to a fixed quantum channel, and the verifier certifies stability of the output classification under such perturbations. Our framework addresses the channel-substitution threat: an adversary replaces the declared quantum channel with a behaviorally similar substitute that processes unperturbed inputs, and the verifier detects the substitution. The two are independent attack surfaces: input perturbation does not require channel substitution, and channel substitution does not require input perturbation. A QML deployment exposed to both threats benefits from VeriQR on inputs and our framework on channel identity; the latter surface, to the best of our knowledge, has not previously been formulated as a runtime-verifiable QML pipeline integrity contract with formal 6
soundness and sample-complexity guarantees. Table 3 compares the two along threat surface, what is varied (inputs versus channels), and what is certified. Table 3: Robustness verification approaches in QML versus this work. Each row characterizes one comparison aspect.
2.4
Aspect
VeriQR [25] and adversarial QML [24, 27]
This work
Threat surface
Input-perturbation: adversary modifies inputs to a fixed channel
Channel-substitution: adversary replaces the channel; inputs unchanged
What is verified
Output stability under input perturbation
Identity of the executing channel
Mitigation strategy
Adversarial training strengthens the model
Detection-based; orthogonal to mitigation
Validation environment
Simulated noise environments
Real hardware (IBM Heron r2)
Fingerprinting of Quantum Devices
A growing body of work addresses the question “which quantum device is this?” by characterizing device-specific noise signatures. Mi et al. [31] demonstrated 99.1% accuracy in identifying quantum devices through idle tomography. Mutolo et al. [35] achieved 99% accuracy distinguishing five IBM backends from error syndrome data. MacNeil et al. [28] proposed circuit-level authentication via Total Variation Distance (TVD) of noise fingerprints. Wu et al. [42] introduced Q-ID, a lightweight scheme that identifies cloud quantum servers by measuring the performance gap between two noise levels on a user’s task circuit, with experimental validation on the IBM Quantum platform. These approaches and the present work share the term “fingerprinting” but at different layers of the QML stack. Device fingerprinting characterizes the hardware substrate on which a circuit runs: which backend, which calibration cycle, which physical device. Our behavioral fingerprinting characterizes the channel running on that substrate: whether the executed quantum operations match the declared specification. The two layers are complementary. Q-ID and related device fingerprinting can confirm that a customer’s quantum job is routed to the claimed IBM backend; our framework can then verify that, on that backend, the declared channel is the one being executed. We are not aware of prior work that extends fingerprinting from the deviceidentity layer to a runtime channel-integrity contract for an end-to-end QML pipeline. Table 4 differentiates the two “fingerprint” notions by target (hardware versus channel), verification artifact, and the question each answers.
7
Table 4: Device fingerprinting versus behavioral fingerprinting (this work). Each row characterizes one comparison aspect.
2.5
Aspect
Device fingerprinting (Q-ID [42], idle tomography [31], error syndrome [35], TVD authentication [28])
This work (behavioral fingerprinting)
What is identified
Hardware substrate: “which device is this?”
Channel: “is the declared circuit the one executing?”
Authentication target
Server or backend identity
Channel identity on a given substrate
Detection signal
Noise-gap, idle tomography, error syndrome
Pauli observable expectations on channel output
Threat coverage
Substrate impersonation only
Substrate authentication is complementary; channel-level adversary is the focus
Behavioral Subtyping and Quantum Software Verification
Behavioral subtyping originates with Liskov and Wing [26] and underpins three decades of design-by-contract practice [30]. Its application to quantum software was opened by Yamaguchi and Yoshioka [44] for individual quantum circuits and by Jin and Zhao [20] for module-level behavioral interface specification (ScaffML). Related quantum verification work includes verifiable quantum computation [11, 29], quantum Hoare logic and refinement orders [10], and quantum software testing [2, 32]. A parallel line of work uses zero-knowledge proofs (ZKPs) to verify ML model outputs while preserving model internals: classical ML explanation verification via ZKPs [43], ZKP-based MLOps compliance auditing [37], and the quantum analog for QNN inference [23] convert model operations into arithmetic circuits with ZKPs for privacy-preserving inference and verifiable compliance. Concurrent work [45] develops behavioral subtyping at the general CPTP-channel level, with soundness, conditional completeness, and compositionality theorems for arbitrary channels and a sneaky-subtype impossibility result establishing that informationally incomplete observable families admit undetectable substitute channels. The present paper develops the QML-specific framework in parallel, with four distinguishing additions. First, the threat model is QMLspecific (Definition 2): conditions (S1) and (S2) capture classifier-decision agreement and weak-observable agreement on QML output structures, neither of which has an analog in the general CPTP setting. Second, the dual-mode operational view (drift + adversarial under a single tolerance) is new. Third, the sample-complexity bound (Theorem 4) and tolerance calibration procedure (Section 5.11) provide the finite-shot operational layer that complements the exact-expectation theorems of the general framework. Fourth, the theorems below are proved on their measurement-theoretic foundations directly (variational characterization of the diamond norm, Hölder inequality, telescoping) rather than reduced to the general result. Taken together, these additions appear to be the first specialization of behavioral subtyping into a runtime-
8
verifiable channel-integrity contract for the QML pipeline class specifically, distinct from both the general CPTP treatment of [45] and from the per-circuit and per-module contracts of [20, 44]. The zkQML work of Lee et al. [23] is orthogonal: it addresses privacy of QML inference (proving correctness without revealing model internals), while QML-PipeGuard addresses integrity of channel execution (verifying that the declared channel is the one running). Table 5 maps the relationship to QCIVET and zkQML across scope (general CPTP versus QML-specific), threat model, and operational guarantees. Table 5: Behavioral subtyping and quantum software verification versus this work. Each row characterizes one comparison aspect.
2.6
Aspect
Behavioral subtyping and quantum verification (Liskov-Wing [26], DbC [44], ScaffML [20], QCIVET [45], zkQML [23])
This work
Granularity of contract
Classical OOP, individual circuits, modules, multi-stage hybrid pipelines
QML pipeline class with kernel-specific and classifier-specific contracts
Sneaky-subtype result
Concurrent work [45]: general CPTP channels
Specialized to QML ansatz substitution with sample-complexity bound
Operational modes
Single mode: adversarial detection only
Dual mode: drift-aware monitoring + adversarial detection share the same machinery
zkQML positioning
Privacy of inference: hides model internals while proving correctness
Channel identity: detects substitution by verifying execution against the declared specification
Synthesis
Across the five threads above, the picture that emerges is one of complementarity. Pulse-level calibration (QuPAD) reshapes the substrate channel to fight noise. Data drift monitoring (QSafeML) tracks input-distribution shift. Input robustness verification (VeriQR) certifies output stability under input perturbation. Device fingerprinting (Q-ID and related) authenticates the hardware substrate. Behavioral subtyping for quantum software (Liskov-Wing predecessors and recent quantum extensions) establishes the contract-based discipline. Each of these threads, together with the broader trustworthiness roadmap of [6] and the QMLaaS threat catalog of [22], addresses one slot of the QML deployment trust stack but leaves the channel-level execution-integrity slot empty: no prior work asks, under a unified runtime-verifiable contract, whether the channel actually executing on hardware is the channel that was declared, and answers that question in both the benign-drift and adversarial-substitution regimes with formal
9
soundness and sample-complexity guarantees. QML-PipeGuard occupies exactly this slot of the stack: assuming a QML model trained, an ansatz declared, a backend authenticated, and inputs nominally well-formed, it verifies that the executing channel still satisfies its declared observable contract within calibrated tolerance, in both benign-drift and adversarial-substitution settings, and produces a single audit trail spanning both event types. The framework applies across multiple QML model classes; we develop the formal treatment for VQCs, QSVMs, and QNNs (Section 3.2), with extension to QCNNs and QBMs following the same structural template.
3
Background
This section establishes the notation and concepts used throughout the paper. We introduce the observable-contract framework for quantum channels (Section 3.1), review the QML primitives our framework targets (Section 3.2), and recall the observable measurement theory underlying our detection results (Section 3.3). Readers familiar with these foundations may skip directly to Section 4.
3.1
Observable Contracts for Quantum Channels
A quantum-classical pipeline consists of stages, each modeled as a completely positive tracepreserving (CPTP) channel acting on density operators of a finite-dimensional Hilbert space. To attach a runtime-verifiable specification to such a stage, we associate to each declared channel EA a stage specification σA = (Hspec , OA , εA , τA ),
(1)
where Hspec is a hash anchor binding the specification to an audit trail, OA is the declared observable family used for behavioral verification, εA is the calibrated tolerance for observable deviation, and τA is the issuance timestamp. A candidate channel EB satisfies the observable contract of σA if its observable expectations agree with those of EA within tolerance: Tr(O EB (ρ)) − Tr(O EA (ρ)) ≤ εA
∀O ∈ OA , ∀ρ ∈ S(H),
(2)
where S(H) denotes the set of density operators on H. The contract (2) is the runtime-observable proxy for channel-level integrity: it measures equivalence between the declared and the executed channel using only quantities the verifier can actually estimate (Pauli expectations under finite-shot sampling). The structural property that makes the contract useful is informational completeness of OA with respect to the substitution class under consideration: a contract over a family that is informationally complete relative to the substitution class forces channel-level equivalence on that class (Section 5.5, Proposition 1), while a contract over a family that is informationally incomplete relative to the class admits substitute channels that satisfy the contract yet differ as CPTP maps. The contract-based discipline of binding specifications to observable families has been developed at the general CPTP-channel level in concurrent work [45]; the present paper develops the QML-specific framework on its own terms (Section 5).
10
3.2
Variational Quantum Classifiers, Quantum Kernels, and Quantum Neural Networks
We target three of the most widely deployed QML model classes [4, 7]. A variational quantum classifier (VQC) is defined by an encoding circuit Uϕ that maps a classical input x ∈ X to a parameterized quantum state |ϕ(x)⟩ and a trainable circuit W (θ) with parameters θ. The classifier output for an input x is the expectation of a measurement observable M on the prepared state: fθ (x) = Tr M · W (θ) |ϕ(x)⟩⟨ϕ(x)| W (θ)† .
(3)
The mapping from input x to output fθ (x) is a quantum channel parameterized by θ, which we (VQC)
denote EA
when the classifier is declared with specific θ.
A quantum kernel method, also called a quantum support vector machine (QSVM) [14, 38], constructs a similarity matrix between input pairs by computing inner products of their encoded quantum states: 2
K(xi , xj ) = ⟨ϕ(xi )|ϕ(xj )⟩ .
(4)
A classical support vector machine (SVM) is then trained on the resulting kernel matrix. The (QSVM)
kernel computation defines a quantum channel EA
whose output is the kernel value, accessed
through measurement. A quantum neural network (QNN) [1, 39] generalizes the VQC construction to multi-layer parameterized architectures, with layer-wise structure analogous to classical deep neural networks. Formally, a QNN is a sequential composition of parameterized quantum channels: (QNN)
EA
= LθL ◦ LθL−1 ◦ · · · ◦ Lθ1 ◦ Eϕ ,
(5)
where Eϕ is the input encoding channel and each Lθℓ is a parameterized layer (entangling block plus single-qubit rotations). Training is performed by classical optimization over {θ1 , . . . , θL } using gradients estimated via parameter-shift rules [33] or related techniques. The output is the expectation of a designated measurement observable on the final layer’s state. In all three classes, the QML output is the expectation of an observable measurement on a prepared quantum state. This is the structural property that allows the observable contract framework to apply: the QML output is precisely the form of quantity covered by Equation (2). Other emerging QML architectures, including QCNNs [8] and QBMs [3], share the same structural property and can be treated under the same framework; we briefly discuss their integration in Section 7.
3.3
Observable Measurement and Tomographic Completeness
The detection guarantees in this paper depend on the observable family OA being informationally complete for the QML output space. We recall the relevant definitions briefly; further detail is given in standard quantum information references [18, 36].
11
Pauli observables and single-qubit completeness. For a single qubit, the Pauli operators X, Y , Z together with the identity I form a basis for the space of Hermitian operators on C2 . Any single-qubit density operator admits the Bloch decomposition ρ = 21 I + rx X + ry Y + rz Z ,
rx2 + ry2 + rz2 ≤ 1.
(6)
The Bloch vector (rx , ry , rz ) is uniquely determined by the three expectation values ⟨X⟩, ⟨Y ⟩, ⟨Z⟩. Therefore the family {X, Y, Z} is informationally complete on C2 , while any strict subset (e.g., {Z} only) is informationally incomplete. Multi-qubit Pauli families. For n qubits, the Pauli strings {I, X, Y, Z}⊗n form a basis of dimension 4n for Hermitian operators on (C2 )⊗n . A subset OA ⊂ {I, X, Y, Z}⊗n is informationally complete on the multi-qubit space if and only if it spans this basis modulo the identity. In practice, n-qubit deployments measure a polynomial subset of the full Pauli family; classical shadow tomography [18] characterizes what can be efficiently learned from such subsets and bounds the sample complexity of multi-qubit observable estimation. Measurement and shot noise. A single execution of a quantum circuit followed by measurement of an observable O yields a sample of a random variable with mean Tr(Oρ) and variance bounded by ∥O∥2 . To estimate the expectation ⟨O⟩ within additive error δ at confidence 1 − η requires O(∥O∥2 log(1/η)/δ 2 ) shots by standard concentration bounds. The sample complexity of the verification protocol developed in Section 5 follows from union-bounding over the observable family.
4
Threat Model
This section formalizes the threat surface that the behavioral fingerprinting framework addresses. We model two distinct integrity concerns under a unified abstraction. The first is benign calibration drift: the executed quantum channel diverges from the declared specification due to hardware variability over time, without adversarial intent. The second is adversarial channel substitution: an entity with control over the QML execution environment intentionally replaces the declared channel with a behaviorally similar substitute. Both concerns share the same mathematical structure (channel deviation from the declared specification) but differ in adversarial intent and in the resulting tolerance regime.
4.1
System Model and Trust Assumptions
A QML pipeline deployment consists of three parties: • The model owner declares a QML channel EA (encoding Uϕ composed with trained W (θ) for VQC/QNN, or encoding alone for QSVM) together with its observable family OA and tolerance εA . • The execution environment runs EA on quantum hardware (a cloud QPU, a local device, or a distributed setup) and returns measurement outcomes. 12
• The verifier samples observables from OA , requests measurement shots, computes empirical expectations, and accepts or rejects the execution based on the observable contract (also referred to as the QML-PipeGuard contract throughout this paper; the two terms are equivalent). The verifier is assumed to be trusted. The verifier holds a reference copy of the declared channel specification, including the hash anchor Hspec that binds the specification to the audit trail. The verifier has independent access to a measurement-shot collection mechanism that is not under the adversary’s control. The execution environment is the locus of the threat. In the adversarial case, the execution environment is under the adversary’s control: the adversary may substitute the declared channel without the verifier’s direct observation. In the benign case, the execution environment is honest but subject to hardware drift over time. The model owner is treated as potentially untrusted: in Scenario 1 below, the model owner is themselves the adversary. In Scenarios 2 and 3, the model owner is honest but the execution environment is adversarial or drifting. In practice, the verifier role is instantiated differently across deployment scenarios: a regulatory body in audit settings, the customer in cloud QPU settings, or a replication community in academic settings (see Section 4.5 for the full scenario-to-role mapping). Model Owner
declares
(potentially untrusted)
Declared Spec σA (Hspec , OA , εA , τA ) reference
deploy
observable queries Execution Environment EA or EB = S ◦ EA ? may substitute A
Uϕ (x) encoding
M measurement
W (θ) ansatz
Verifier (trusted)
measurement outcomes
contract check
Accept / Halt / Log drift event
Figure 1: System model and trust boundaries. The model owner declares a specification σA for the QML pipeline (encoding Uϕ , ansatz W (θ), and measurement M ). The pipeline executes inside the execution environment, which in adversarial scenarios is under the control of an adversary A who may substitute the declared channel EA with EB = S ◦ EA . The trusted verifier samples observables from OA , collects measurement outcomes, checks the observable contract against the reference specification, and produces an accept/halt/log-drift decision. Green: trusted; red dashed border: adversary-controllable; gray: trust depends on scenario. Figure 1 summarizes the system model and trust boundaries graphically. The diagram traces the path from the model owner’s declared specification through the execution environment to 13
the trusted verifier, with green nodes marking trusted parties, the dashed red boundary marking the adversary-controllable region, and gray nodes marking parties whose trust depends on the deployment scenario.
4.2
Adversarial Threat: Channel Substitution
We consider an adversary A who controls the execution environment of the QML pipeline. A can replace the declared channel EA with a substitute channel EB that satisfies the following structural conditions: 1. EB agrees with EA on the classification decision for all inputs in a verification test set (the substitute passes standard accuracy-based audits); 2. EB agrees with EA on a weak observable subfamily Oweak ⊂ OA used by classical fingerprinting, for instance {Z}-only measurements on output qubits; 3. EB differs from EA on the full observable family OA when OA is informationally complete, i.e., ∥EA − EB ∥⋄ ≥ δ for some adversarial separation parameter δ > 0. Adversary capabilities.
A can execute arbitrary CPTP channels on the quantum hardware,
including channels that differ from EA by unitary, mixed-unitary, or noise-introducing transformations. A may operate adaptively: after observing previous queries and outcomes, A may modify the substitute channel for subsequent queries. We model this as A selecting at each (t)
verification round t a possibly different substitute channel EB , where the choice may depend on the entire history of previous rounds. A does not control the verifier’s classical post-processing or per-round observable selection. Adversary knowledge. A knows the declared circuit specification EA , the observable family OA used for verification, the tolerance εA , the verification test set used for accuracy audits, and the verifier’s protocol structure. This is a worst-case (white-box) adversary on the specification side. The verifier’s per-query observable selection is randomized and revealed only after each query is committed; although A knows the family OA and the tolerance εA , it cannot optimize against a specific observable in advance of each round. Section 5 formalizes how this randomization yields detection guarantees. Adversary’s goal. Deploy EB = ̸ EA in production while passing the verifier’s audit. The adversary succeeds if the verifier accepts execution despite EB differing meaningfully (in diamondnorm distance) from EA .
4.3
Benign Drift: Calibration Variability
In the absence of adversarial intent, the executed channel still diverges from the declared specification due to hardware variability. A drift event EB = D ◦ EA arises when the hardwareimplemented channel composes with a benign perturbation D representing cumulative calibration changes, where: 14
1. D is induced by physical mechanisms (gate fidelity changes, coherence time fluctuations, readout drift) rather than adversarial design; 2. D is not bounded a priori: drift may be small (acceptable) or large (requiring recalibration or pipeline halt); 3. The framework characterizes D quantitatively through the same observable contract; the operational consequences of the resulting deviation are detailed in the paragraphs below. Drift and adversarial substitution share the structural form of a channel modification but differ in three respects. Drift is unintentional, statistical, and unfocused (does not target the verifier’s observable family specifically). Adversarial substitution is intentional, structured, and may be optimized to exploit weak observable families. The framework treats both under the same contract (2), with the calibrated tolerance εA serving as the operational boundary between accepted drift and detected anomaly. Deviations within tolerance (∆ ≤ εA ) are recorded as drift events in the audit trail and execution continues; deviations beyond tolerance (∆ > εA ) halt the pipeline and flag an integrity violation. The framework therefore distinguishes within-tolerance drift from beyond-tolerance anomaly automatically through this εA boundary. It does not, however, attempt to further distinguish whether a beyond-tolerance event was caused by unusually large drift or by adversarial substitution: both produce the same observable signature (an out-of-tolerance fingerprint deviation) and both require pipeline halt or recalibration. The root-cause analysis that separates benign from adversarial causes is left to manual investigation or downstream forensic tools.
4.4
Out of Scope
The following threats are not addressed by this framework and require complementary mechanisms: • Input-perturbation adversarial examples. Attacks that perturb classical inputs to the QML pipeline to induce misclassification are an orthogonal threat surface, addressed by tools such as VeriQR [25]. • Training-time attacks. Data poisoning, backdoor insertion, or model-stealing during training are orthogonal to runtime channel integrity and require training-pipeline-level defenses. • Denial-of-service. An adversary who refuses to execute the pipeline or returns failure responses is outside our scope; this is addressed by service-level monitoring. • Verifier compromise. We assume the verifier is trusted; an adversary who compromises the verifier itself can defeat any contract-based scheme by definition. • Side-channel attacks on classical infrastructure. Timing, power, or electromagnetic side channels on the classical components of the pipeline are outside our scope.
15
4.5
Scenario-to-Model Mapping
Table 6 maps the three deployment scenarios from Section 1 to the formal threat model components, showing how the abstract model instantiates in practice. Table 6: Mapping of deployment scenarios to formal threat model components. Scenario
Adversary
Scenario 1:
Scenario 2: Cloud
Scenario 3:
Regulated audit
QPU cost-cutting
Academic
(Dieselgate
(lazy-server
reproducibility
analog)
analog)
Model owner
Execution
Model owner or
environment (cloud
environment
identity
provider) Adversary goal
Pass compliance
Reduce operational
Pass peer-review
audit while
cost while passing
replication while
deploying biased
customer test queries
reporting unrelated
ansatz in production
results
Substitution
EB debiased for
EB lower-fidelity but
EB matches reviewer
form
audit inputs only
accuracy-matched on
test cases but not
test set
full experiment
External regulatory
Customer-side
Reviewer-side or
body or internal
verification primitive
community
Verifier role
compliance
replication primitive
The framework treats all three scenarios uniformly: each maps to an adversary A producing a substitute channel EB that passes weak observable subfamilies while violating the informationally complete contract. Section 5 develops the detection machinery that catches all three under the same theorem.
4.6
Note on Scope and Limitations
The threat model above assumes a verifier with independent measurement access and a hashbound specification anchored in an auditable trail. Deployments lacking these primitives are outside the present scope. Two classes of such deployments are notable. First, fully offline or edge-quantum settings without a network-level verifier require additional cryptographic machinery, such as delegation-based verification [11, 29], to provide an equivalent integrity guarantee. We do not extend to this setting. Second, deployments in which the model owner and the execution environment share trust (e.g., a single-organization deployment with no external auditor) reduce the threat surface to benign drift alone; in this case the adversarial-detection mode of the framework is inactive but the drift-aware mode remains operative. 16
These boundaries are intrinsic to any contract-based verification scheme and do not weaken the guarantees that the framework provides within its declared scope.
5
Behavioral Fingerprinting Framework
This section develops the mathematical core of the paper. We introduce behavioral fingerprinting formally (Section 5.2), specialize it to QML pipelines in the dual modes of adversarial detection and drift monitoring (Sections 5.3–5.4), prove the detection theorem (Section 5.5), bound the sample complexity (Section 5.8), derive the drift corollary (Section 5.9), and present the dualmode verification algorithm (Section 5.10). Before proceeding to the technical development, Section 5.1 positions the framework relative to the broader behavioral-subtyping discipline for quantum software, identifying what is shared with concurrent work at the general CPTP-channel level and what is new to the QML pipeline setting.
5.1
Theoretical Foundations and Position Relative to Prior BehavioralSubtyping Work
The framework developed in this section assembles three QML-specific contributions over a behavioral-subtyping foundation. The contributions, illustrated in Figure 2, are: a QML pipeline-composition treatment that specializes the channel-as-object abstraction to the encoder– ansatz–measurement structure of a QML model together with a QML-specific threat model (Layer 1); a finite-shot statistical layer that turns the contract into an operationally executable check under shot noise on real hardware (Layer 2); and a tolerance decomposition that separates adversarial substitution from natural calibration drift under a single contract (Layer 3). Each layer is new relative to the broader behavioral-subtyping discipline on which the framework rests; together they constitute the QML pipeline framework developed in the remainder of this section. The foundation under these three layers is the behavioral-subtyping discipline for quantum software, in which a quantum channel is treated as the implementation of a software contract over an observable family and one channel is admissible as a substitute for another precisely when their per-observable expectation values agree within a calibrated tolerance [26]. The general theory of channel-level behavioral subtyping has been developed in concurrent work [45] at the level of arbitrary CPTP channels, including soundness, conditional completeness, and a sneaky-subtype impossibility result for informationally incomplete observable families. The QML pipeline framework of this paper inherits this discipline as its substrate and adds the three layers above to make it operationally executable on a QML pipeline running on noisy quantum hardware. Layer 1: QML pipeline composition. Specialization of the channel-as-object abstraction to the encoder–ansatz–measurement composition that defines a QML pipeline (Section 5.2). Concretely, the declared pipeline takes the form PA = M ◦ W (θ) ◦ Uϕ (x), where Uϕ (x) is the data-encoding circuit, W (θ) is the (possibly trained) ansatz, and M is 17
the measurement stage; for the QSVM kernel instantiation used in Section 6 this specializes further to PA = M ◦ Uϕ (xj )† ◦ Uϕ (xi ). A QML-specific threat model (Definition 2) accompanies this composition, with conditions (S1) and (S2) capturing classifier-decision agreement and weak-observable agreement on QML output structures. The pipeline structure is intrinsically multi-qubit: standard QML feature maps such as ZZFeatureMap entangle at least two qubits, so the channel under verification acts on a 2n -dimensional state space (n ≥ 2) and the informationally complete observable family scales accordingly (six local two-qubit Pauli operators of the form Xi ⊗ I, Yi ⊗ I, Zi ⊗ I, etc., in the QSVM instantiation of Section 6, in contrast to the three single-qubit Paulis sufficient for the isolated-channel setting of concurrent work [45]). Neither the compositional pipeline structure nor these conditions has a direct analog at the general CPTP-channel level. Layer 2: Statistical sample complexity. A finite-shot operational layer (Theorem 4) derived from Hoeffding-type concentration on Pauli expectation estimators together with a union bound over the observable family. The general framework states exact-expectation results; the present paper adds the shot-budget guarantee that makes verification operable on real hardware under finite sampling. A Cauchy–Schwarz argument on the Bloch decomposition of single-qubit traceless Hermitian operators yields the tight frame-bound √ constant C = 3 for the single-qubit Pauli family (Step 2 of Theorem 1), which extends analytically to the n-qubit local Pauli family via a block-additive argument. This sharpens p √ the corresponding value 2 2 used in concurrent work [45] by a factor of 2/3 ≈ 0.816 in the small-tolerance limit and by approximately 27-fold in N at the deployed operational parameters; combined with a precomputed-reference refinement of the Hoeffding step, the cumulative reduction is approximately 100-fold over the looser sampled-reference bound. Section 6.3 reports the empirical validation of this bound on the IBM Heron r2 processor and shows that the prescribed budget is the threshold for informative detection rather than merely the threshold for nominal flagging. Layer 3: Drift-aware tolerance. A tolerance decomposition εA = εadv + εdrift (Corollary 2) that bounds adversarial and natural-drift contributions separately, enabling the dual-mode operational view in which calibration drift and adversarial substitution are detected under a single contract. Section 6.4 reports the empirical calibration of this decomposition on ibm fez and shows that the resulting tolerance interval is non-empty in the deployed parameter regime. The detection theorem (Theorem 1) is proved in this paper directly from its measurementtheoretic foundations (variational characterization of the diamond norm, Hölder inequality, telescoping) rather than reduced to the general CPTP statement of [45], so that the QMLspecific structure of the bound is visible at each step. The resulting framework is complementary to the general theory: the same foundational principle (behavioral subtyping via observable contracts) is instantiated in two settings, with the general CPTP-channel case addressed elsewhere and the QML pipeline case, including its statistical and drift layers and an end-to-end validation on a production-grade QPU (Section 6), addressed here.
18
Layer 3 | Drift-Aware Tolerance
This paper
(Corollary 2) εA = εadv + εdrift — separates natural calibration drift from adversarial substitution under a single tolerance
NEW
Layer 2 | Statistical Sample Complexity
(Theorem 4) N ≥ 8B 2 k log(2k/η)/γ 2 , with γ = δ/C − εA and tight √ constant C = 3 via Cauchy–Schwarz on the Bloch decomposition (single-qubit Pauli family)
NEW
Layer 1 | QML Pipeline Composition
(Theorem 1) PA = M ◦ W (θ) ◦ Uϕ (x) — encoder–ansatz–measurement composition with QML-specific threat model conditions (S1), (S2)
NEW
Shared
Foundation | Behavioral Subtyping for Quantum Channels Liskov–Wing behavioral subtyping principle — channel-asobject, observable contract, contract-preserving substitution by per-observable tolerance (general CPTP theory in concurrent work [45])
SHARED
Figure 2: Theoretical-foundation stack for the framework. The bottom (shared) layer is the behavioral-subtyping discipline for quantum channels: channel-as-object, observable contract, and contract-preserving substitution by per-observable tolerance, developed at the general CPTP-channel level in concurrent work. The three upper layers (this paper) specialize this foundation to QML pipelines (Layer 1), add a finite-shot operational layer through Hoeffding √ concentration and a union bound together with a tight frame-bound constant C = 3 via a Cauchy–Schwarz refinement (Layer 2), and decompose the contract tolerance into adversarial and drift components for the dual-mode operational view (Layer 3).
5.2
Behavioral Fingerprinting
We first introduce a runtime signature that the verifier can directly compute from observable measurements. Definition 1 (Behavioral Fingerprint). Let E : S(Hin ) → S(Hout ) be a CPTP channel and let O = {O1 , . . . , Ok } be a finite family of bounded Hermitian observables on Hout . For a reference input state ρref ∈ S(Hin ), the behavioral fingerprint of E with respect to (O, ρref ) is the vector FpO,ρref (E) =
Tr(O1 E(ρref )), Tr(O2 E(ρref )), . . . , Tr(Ok E(ρref )) ∈ Rk .
(7)
Remark 1. For QML deployments, ρref is naturally taken to be a canonical input state used during verification (a fixed encoded data point or an explicit reference state prepared by the verifier). The fingerprint is a finite-dimensional vector summary of the channel’s observable behavior; it is the runtime-computable proxy for the channel itself. The framework’s central object is the deviation between fingerprints under a candidate channel and the declared one. Following Equation (2), the contract-deviation is the L∞ distance 19
between fingerprints: ∆O,ρ (EA , EB ) = max Tr(OEB (ρ)) − Tr(OEA (ρ)) . O∈O
(8)
A candidate channel EB satisfies the behavioral contract (2) at tolerance εA if and only if ∆O,ρ (EA , EB ) ≤ εA for all relevant ρ.
5.3
Sneaky Ansatz Substitution: Adversarial Mode
We now specialize the contract to QML pipelines under the adversarial threat model of Section 4.2. Definition 2 (Sneaky Ansatz Substitution). Let EA be a declared QML channel of one of the model classes in Section 3.2 (VQC, QSVM, or QNN) with stage specification σA = (Hspec , OA , εA , τA ). A CPTP channel EB is a sneaky ansatz substitution of EA if there exists a weak observable subfamily Oweak ⊊ OA such that: (S1) EB satisfies the classification-agreement condition: for every input x in the verifier’s accuracy test set, arg max fB (x) = arg max fA (x), where fA , fB are the classifier outputs. (S2) EB satisfies the weak observable contract: ∆Oweak ,ρ (EA , EB ) ≤ εA for all reference inputs ρ. (S3) EB has nontrivial separation from EA as CPTP maps: ∥EA − EB ∥⋄ ≥ δ for some separation parameter δ > 0. Conditions (S1) and (S2) capture what a weak verifier cannot detect, while (S3) captures the channel-level difference that the framework aims to expose. The adversary’s goal is to construct EB satisfying (S1)–(S3) with maximum δ. Specialization to QML model classes. The general definition above applies to any QML channel. For each of the three target model classes, the substitution takes a specific operational form. In each case, the agreement conditions (S1) and (S2) hold at the level of classification decisions and on a weak observable subfamily, while the channel-level difference (S3) manifests in the full quantum output state and is exposed by the informationally complete observable family: • VQC (Equation (3)):
EB corresponds to a different parameter vector θB = ̸ θA
such that the trained ansatz W (θB ) produces (S1) the same classification decisions arg max fB (x) = arg max fA (x) on the verification test set, and (S2) matching expectation values on the weak observable subfamily Oweak ⊊ OA . However, the output quantum state W (θB ) |ϕ(x)⟩⟨ϕ(x)| W (θB )† differs from W (θA ) |ϕ(x)⟩⟨ϕ(x)| W (θA )† in its entanglement structure or confidence distribution, which (S3) is detectable only through the full observable family OA . • QSVM (Equation (4)): EB corresponds to a different encoding circuit UϕB such that (S1) the resulting kernel matrix KB (xi , xj ) produces the same SVM classification decisions on the verification test set as KA (xi , xj ), and (S2) agrees with KA on diagonal entries and weak observable measurements used during basic kernel sanity checks. However, the encoded quantum states |ϕB (x)⟩ differ from |ϕA (x)⟩ in observable structure beyond the 20
weak subset, producing (S3) different off-diagonal kernel values or different multi-qubit Pauli expectations that are exposed by the full observable family OA . • QNN (Equation (5)): EB corresponds to a different layer configuration {θℓB } such that (S1) the final-layer measurement of a designated observable yields the same classification decisions on the verification test set as under {θℓA }, and (S2) weak observable expectations match within tolerance. However, the intermediate-layer states (LθB ◦ · · · ◦ LθB ◦ Eϕ )(ρ) ℓ
1
differ from those under {θℓA }, producing (S3) measurable differences in the multi-qubit Pauli family that are caught by the informationally complete observable contract. In all three cases, the central detection question reduces to whether the observable family OA is sufficiently rich to expose the channel-level difference that remains hidden at the classificationdecision level.
5.4
Calibration Drift Event: Monitoring Mode
In the absence of adversarial intent, the executed channel may still deviate from the declared specification due to hardware variability (Section 4.3). We formalize this as a drift event. Definition 3 (Calibration Drift Event). A calibration drift event at level ddrift is a CPTP channel EB such that: (D1) EB arises from physical mechanisms (gate fidelity changes, coherence-time fluctuations, readout-noise drift) acting on EA , modeled as EB = D ◦ EA for some perturbation D. (D2) ∆OA ,ρ (EA , EB ) ≤ ddrift on the full observable family OA and all reference inputs ρ. The drift event is within-tolerance if ddrift ≤ εA ; otherwise it is beyond-tolerance. The distinction between Definitions 2 and 3 lies in the structural form of the deviation: a sneaky substitution targets the verifier’s weak observable subfamily but may differ unboundedly elsewhere, while a drift event is uniform across the observable family. Both, however, are captured by the same contract (2); the framework distinguishes them only operationally by the magnitude of the deviation relative to εA .
5.5
Detection Theorem
Theorem 1 establishes that the adversary defined in Section 4.2 cannot evade detection when the observable family is informationally complete. This is the central detection guarantee of the framework: it transforms the abstract threat model into a concrete operational claim, and provides the mathematical guarantee on which Algorithm 1 of Section 5.10 rests. When the algorithm halts, an adversarial substitution is genuinely present. We state and prove the theorem in full. The structure of the proof (variational characterization of the diamond norm, reduction via informational completeness, triangle inequality) is the standard route through which observable-contract guarantees of this form are established; a closely related general-CPTP statement appears in concurrent work [45]. The QML-specific content of our theorem is the specialization in Step 4 to VQC, QSVM, and QNN pipelines, 21
together with a tighter frame-bound constant for the single-qubit Pauli family (C =
√
3 via
Cauchy–Schwarz on the Bloch decomposition, Step 2 of the proof; this sharpens the value p √ C = 2 2 in [45] by a factor of 2/3), and the operational use of the bound in the dual-mode setting (Theorem 4 on the precomputed-reference shot budget, Corollary 1 on the sampledreference variant, Corollary 2 on the drift-decomposition, and the operational discussion in the Remark following Theorem 4), which have no direct analog in the general framework. Theorem 1 (Detection of Sneaky Ansatz Substitution). Let EA be a declared QML channel of any of the three model classes (VQC, QSVM, QNN), and let OA be an informationally complete observable family on the output Hilbert space Hout , understood as completeness with respect to the substitution class considered by the verifier (strict informational completeness on Hout is one sufficient condition; for local-unitary substitutions on multi-qubit pipelines, the weaker local-completeness notion of Proposition 1 suffices, as discussed after the proof ). Let C(OA ) > 0 denote the frame-bound constant of the observable family (for the single-qubit Pauli family, √ C = 3, as derived in Step 2 of the proof; the underlying observable basis structure is set up in Section 3.3, and tabulated values for extended Pauli families on two qubits are reported in Appendix A). Then for any sneaky ansatz substitution EB of EA (Definition 2) with separation δ = ∥EA − EB ∥⋄ , the contract deviation satisfies ∆OA ,ρ (EA , EB ) ≥
δ C(OA )
for some reference input ρ.
(9)
In particular, any sneaky substitution with separation δ > C(OA ) · εA violates the contract on at least one observable in OA . Proof. The argument has four steps: a variational characterization of the diamond norm, an informational-completeness reduction, a triangle-inequality bound, and a QML specialization. Step 1: Reformulate diamond norm via observable expectation. By the standard variational characterization of the diamond norm [40, Theorem 3.51], which combines the dual formulation of the trace norm [40, Section 1.1.3] with the definition of the diamond norm, there exists a state ρ∗ ∈ S(Hin ⊗ Haux ) and a Hermitian operator M ∗ with ∥M ∗ ∥ ≤ 1 on Hout ⊗ Haux such that ∥EA − EB ∥⋄ =
Tr M ∗ · (EA ⊗ id)(ρ∗ ) − Tr M ∗ · (EB ⊗ id)(ρ∗ ) .
Thus δ is witnessed by a specific (possibly entangled-with-auxiliary) state and observable. By Stinespring’s theorem [40, Section 2.2], the auxiliary space dimension may be bounded by dim(Hin ) without loss of generality, ensuring compactness of the state space and existence of the supremum. Step 2: Reduce M ∗ to the declared family OA via informational completeness. By assumption, OA is informationally complete on Hout , so its real-linear span equals the space of Hermitian operators on Hout [18, 36]. The tensor product of a basis of OA on Hout with a Hermitian basis on Haux forms a basis for Hermitian operators on the joint space Hout ⊗ Haux ; informational completeness is therefore preserved, and the frame-bound constant extends correspondingly. Hence the witness observable M ∗ decomposes as a finite linear
22
combination X
M∗ =
cO O,
X
with
⊗ O∈OA
|cO | ≤ C(OA ),
O
⊗ where OA denotes the tensor-product extension of OA to the joint space and C(OA ) is the
frame-bound constant of the family. For the single-qubit Pauli family {X, Y, Z}, we derive the √ tight constant C(OA ) = 3 as follows. Any traceless Hermitian operator σ on C2 admits the Bloch decomposition σ = 21 cX X + cY Y + cZ Z ,
cP = Tr(P σ) for P ∈ {X, Y, Z},
q with eigenvalues ± 12 c2X + c2Y + c2Z . Normalizing so that the operator norm satisfies ∥σ∥∞ = q 1 c2X + c2Y + c2Z ≤ 12 (which corresponds to ∥M ∗ ∥ ≤ 1 in the joint-system reduction) gives 2 c2X + c2Y + c2Z ≤ 1. Applying the Cauchy–Schwarz inequality, X
|cP | ≤
√
q √ 3 · c2X + c2Y + c2Z ≤ 3,
P ∈{X,Y,Z}
√ √ with equality at cX = cY = cZ = 1/ 3, i.e., for the witness σ ∗ = (X + Y + Z)/(2 3). Hence √ C(OA ) = 3 is the tight frame-bound constant for the single-qubit Pauli family. This refines √ the value C = 2 2 obtained in concurrent work [45] via a separate state-level bound combined with a diamond-conversion factor of 2; the Cauchy–Schwarz argument above bypasses the intermediate state-level step and produces the sharp constant directly, improving the bound p by a factor of 2/3 ≈ 0.816 and yielding a corresponding reduction in the prescribed sample budget (Theorem 4). local = The same Cauchy–Schwarz argument extends to the n-qubit local Pauli family OA
{Xi , Yi , Zi : i = 1, . . . , n} used in the hardware experiments of Section 6. Any witness M ∗ ∈ Pn local ) decomposes as a sum of single-qubit blocks acting on disjoint factors, M ∗ = span(OA i=1 Bi (i)
(i)
(i)
with Bi = 12 (cX Xi + cY Yi + cZ Zi ). Since the Bi act on disjoint qubit factors they admit a common eigenbasis (the tensor product of the per-block eigenbases) on which each block attains its maximal eigenvalue independently; hence the operator norm of their sum equals the sum of the individual operator norms, ∥M ∗ ∥∞ =
n X
∥Bi ∥∞ = 12
n X
ri ,
i=1
i=1
q P (i) (i) (i) with ri = (cX )2 + (cY )2 + (cZ )2 . The constraint ∥M ∗ ∥∞ ≤ 1 then gives i ri ≤ 2. Applying √ P (i) Cauchy–Schwarz block-wise, P |cP | ≤ 3 · ri , and summing over blocks: X local P ∈OA
|cP | =
n X
(i)
X
|cP | ≤
i=1 P ∈{X,Y,Z}
√
3·
n X
√ ri ≤ 2 3.
i=1
P After the standard normalization to ∥M ∗ ∥ ≤ 1 in the witness reduction (equivalently i ri ≤ 1), √ √ P local ) = the bound reads P |cP | ≤ 3, so C(OA 3 for any number of qubits. The bound 23
P
i ri = 1 (the normalization is tight) and, on every non-trivial block, (i) (i) (i) cX = cY = cZ (the per-block Cauchy–Schwarz is tight); a canonical saturating witness is √ σ ∗ = (X1 + Y1 + Z1 )/(2 3), concentrating on a single qubit. The block-additive structure,
is saturated whenever
non-commuting Paulis within each qubit block, disjoint-factor blocks across qubits, is what keeps the constant invariant under qubit-count scaling, and is the technical reason the two-qubit √ hardware experiment inherits the same C = 3 as the single-qubit derivation. Step 3: Bound the diamond norm in terms of contract deviation. Substituting the decomposition of Step 2 into the expression of Step 1 and applying the triangle inequality: δ = Tr(M ∗ · EA (ρ∗ )) − Tr(M ∗ · EB (ρ∗ )) X = cO Tr(O · EA (ρ∗ )) − Tr(O · EB (ρ∗ )) O
≤
X
≤
X
|cO | · Tr(O · EA (ρ∗ )) − Tr(O · EB (ρ∗ ))
O
|cO | · ∆OA ,ρ∗ (EA , EB )
O
≤ C(OA ) · ∆OA ,ρ∗ (EA , EB ), where the second inequality uses the triangle inequality for finite sums, the third inequality bounds each per-observable deviation by its maximum over OA (namely ∆OA ,ρ∗ ), and the P final inequality applies the frame-bound O |cO | ≤ C(OA ) from Step 2. Rearranging gives ∆OA ,ρ∗ (EA , EB ) ≥ δ/C(OA ), which is Equation (9) with ρ = ρ∗ . The bound holds for the specific witness state ρ∗ identified in Step 1; the corresponding verification protocol in Section 5.10 compensates for the worst-case nature of ρ∗ through randomized observable selection across multiple verification rounds. Step 4: Specialization to QML model classes. Steps 1–3 establish a general CPTPchannel statement. The following specialization shows how this statement instantiates in three QML deployment scenarios, providing the operational content that distinguishes this work from √ a generic CPTP-channel result (in particular, the tight frame-bound constant C = 3 obtained p in Step 2, which is sharper than the value used in concurrent work [45] by a factor of 2/3 and translates into an approximately 27-fold reduction in the prescribed shot budget at the deployed operational parameters; see the Remark following the proof, and the empirical validation in Section 6.3). For QML applications, the witness state ρ∗ is realized by an input drawn from the verifier’s reference distribution (a representative QML input from the deployment dataset), and the witness observable M ∗ lies in the verifier’s Pauli measurement repertoire. For VQC outputs (Equation (3)), this reduces to single-qubit or multi-qubit Pauli expectations on the final-layer state after the trained ansatz W (θ). For QSVM (Equation (4)), this reduces to Pauli expectations on the output qubits of the swap-test or inversion-test circuit used to compute the kernel inner product |⟨ϕ(xi )|ϕ(xj )⟩|2 . For QNN (Equation (5)), this reduces to multi-qubit Pauli expectations on the final-layer state of the composed layer channels. In all three cases, OA is taken to be a Pauli family of appropriate qubit count, with C(OA ) following the standard frame-bound for n-qubit Pauli operators. The conclusion follows: any sneaky substitution with δ > C(OA ) · εA must produce ∆OA ,ρ∗ > 24
εA on some reference ρ∗ , hence is detected by the contract check. Remark 2. The bound (9) is tight up to the constant C(OA ). The Cauchy–Schwarz derivation √ of Step 2 establishes C = 3 both for the single-qubit Pauli family and, by the block-additive extension, for the n-qubit local Pauli family {Xi , Yi , Zi : i = 1, . . . , n} used in the hardware validation of Section 6. The constant is tight in both cases, attained at the witness σ ∗ = √ (X+Y +Z)/(2 3) on a single qubit (the multi-qubit case saturating when the witness concentrates on one qubit block), and is sharper than the corresponding value used in concurrent work [45] p by a factor of 2/3. For the full 2-qubit Pauli family (all 15 non-identity Pauli strings on 2 qubits), the constant C grows to approximately 3.73, as derived numerically in Appendix A; for the general n-qubit case (k = 4n − 1), a tight closed-form characterization is left to future work and connects to the multi-qubit tomographic completeness theory we identify as a separate research direction in Section 7. Theorem 1 presumes that the observable family OA is rich enough to expose any sneaky substitution drawn from the adversary’s strategy class. The single-qubit Pauli family is informationally complete on its 2 × 2 density matrices in the strict sense. The n-qubit local family, however, does not span correlation operators (X1 X2 , Y1 Z2 , etc.) and is therefore not strictly informationally complete on the joint Hilbert space. The next proposition records the operational notion of completeness that is in fact required by Theorem 1 for the QML threat model considered in this paper. local = Proposition 1 (Local informational completeness w.r.t. local-unitary substitutions). Let OA
{Xi , Yi , Zi : i = 1, . . . , n} be the n-qubit local Pauli family, and let Sloc denote the class of substitutions of the form EB (ρ) = U EA (ρ)U † for some local unitary U = U1 ⊗ · · · ⊗ Un . For every EB ∈ Sloc with U ̸= eiϕ I (i.e., not a global phase), there exist a product reference state local such that ρ ∈ H1 ⊗ · · · ⊗ Hn and an observable P ∈ OA
Tr P · EB (ρ) ̸= Tr P · EA (ρ) . Proof. Since U = ̸ eiϕ I, at least one factor Ui is not a scalar multiple of the identity; without loss of generality U1 = ̸ eiϕ1 I. Suppose for contradiction that U1 ρ1 U1† = ρ1 for every single-qubit density matrix ρ1 . Density matrices span the real-linear space of Hermitian operators on C2 , so U1 commutes with every Hermitian operator on C2 , and hence with every element of M2 (C). The standard representation of M2 (C) on C2 is irreducible; by Schur’s lemma, any operator commuting with this representation is a scalar multiple of the identity, so U1 = eiϕ1 I, a contradiction. Hence there exists a single-qubit state ρ1 with U1 ρ1 U1† = ̸ ρ1 . By the informational completeness of {X, Y, Z} on C2 , there exists P1 ∈ {X, Y, Z} such that Tr(P1 · U1 ρ1 U1† ) ̸= Tr(P1 · ρ1 ). Taking local as the observable ρ = ρ1 ⊗(I/2)⊗(n−1) as the product reference state and P = P1 ⊗I ⊗(n−1) ∈ OA
completes the argument, since the additional factors of I/2 on qubits 2, . . . , n each evaluate to Tr(I/2 · I) = 1 in the trace, leaving only the discriminating single-qubit contribution. The substitution class Sloc covers the operational threat model considered in the hardware experiments of Section 6: the sneaky construction inserts a per-qubit S-gate (a local unitary) before measurement, which falls in Sloc by definition. For substitutions outside Sloc , such as 25
entangling-gate insertions, the local family is no longer sufficient and must be augmented with correlation observables. We discuss this scope explicitly in Section 7.3 and in Appendix A.
5.6
Soundness for QML
Theorem 1 addresses the adversarial direction: large channel separation forces large observable deviation, ensuring that sneaky substitutions are caught. The complementary direction, capturing benign channel proximity, is provided by the following soundness result. This direction is essential for treating calibration drift as a graceful operational event rather than a detection failure, and underlies the drift corollary stated in Section 5.9. Theorem 2 (Soundness for QML). Let EA be a declared QML channel of any of the three model classes (VQC, QSVM, QNN), and let EB be any CPTP channel with ∥EA − EB ∥⋄ ≤ d. Then for every observable O ∈ OA and every reference input ρ, Tr(OEA (ρ)) − Tr(OEB (ρ)) ≤ d · ∥O∥.
(10)
Proof. Let ∆ρ := EA (ρ) − EB (ρ). By the trace-norm/operator-norm duality [40, Section 1.1.3], Tr(O∆ρ ) ≤ ∥O∥ · ∥∆ρ ∥1 , which is the operator Hölder inequality on 1- and ∞-Schatten norms. By the definition of the diamond norm as the maximum over all input states (and auxiliary systems) of the trace-norm distance between channel outputs [40, Section 3.3], ∥∆ρ ∥1 = ∥(EA − EB )(ρ)∥1 ≤ ∥EA − EB ∥⋄ ≤ d. Combining gives | Tr(O∆ρ )| ≤ d · ∥O∥, which is Equation (10). QML specialization.
For VQC, QSVM, and QNN deployments, EB = D ◦ EA typically arises
from benign hardware drift D acting on the declared channel. Theorem 2 then bounds the maximum observable deviation across the verifier’s measurement repertoire by d · maxO∈OA ∥O∥, where d = ∥D − id∥⋄ is the diamond-norm magnitude of the drift. For Pauli observables (∥O∥ = 1), this simplifies to a clean operational bound: drift of diamond-norm magnitude d produces observable deviations no larger than d. The result guarantees that benign drift cannot masquerade as a large adversarial deviation, distinguishing the two operational modes of the framework.
5.7
Compositionality for QML
Many practical QML pipelines decompose into multiple stages: a VQC pipeline composes encoding Uϕ with the trained ansatz W (θ); a QSVM pipeline composes encoding with a swaptest or inversion-test; a QNN pipeline composes L layer channels in sequence. When the framework is applied stage-by-stage, the per-stage tolerances must aggregate correctly to yield a total tolerance for the pipeline as a whole. The following theorem records this aggregation property. 26
Theorem 3 (Compositionality for QML). Let a QML pipeline consist of L sequential stages with (1)
(L)
declared channels EA , . . . , EA
and corresponding per-stage observable contracts at tolerances (ℓ)
ε1 , . . . , εL . If each candidate channel EB satisfies the contract at stage ℓ within tolerance εℓ , (L)
(1)
then the composed pipeline channel EB = EB ◦ · · · ◦ EB satisfies the end-to-end contract at tolerance
L X
εtotal ≤
εℓ .
(11)
ℓ=1 (L)
(1)
Proof. Let EA = EA ◦ · · · ◦ EA denote the composed declared pipeline. Insert telescoping terms: EA − E B =
L X
Cℓ ,
where
(L)
(ℓ+1)
Cℓ = EB ◦ · · · ◦ EB
(ℓ)
(ℓ)
◦ EA − E B
(ℓ−1)
◦ EA
(1)
◦ · · · ◦ EA .
ℓ=1
The diamond norm is subadditive under sum and submultiplicative under composition with CPTP channels (the latter, with constant 1, is a standard property of the diamond norm [40, Section 3.3]), so ∥EA − EB ∥⋄ ≤
L X
∥Cℓ ∥⋄ ≤
ℓ=1
L X
(ℓ)
(ℓ)
∥EA − EB ∥⋄ ≤
ℓ=1
L X
εℓ ,
ℓ=1 (ℓ)
(ℓ)
where the last step uses the per-stage diamond-distance bound ∥EA − EB ∥⋄ ≤ εℓ as the form in which the per-stage contract is given (this is the diamond-norm reading of the per-stage tolerance; for the alternative observable-contract reading, the corresponding per-stage bound (ℓ)
carries a factor of C(OA ) via Theorem 2). Applying Theorem 2 once more to the composed channel yields the end-to-end observable bound stated in Equation (11). QML specialization. The compositionality bound is operationally meaningful in two QML contexts. First, for QNN pipelines of depth L, drift accumulating across layers aggregates linearly: if each layer contributes drift bounded by εℓ , the end-to-end pipeline drift is bounded P by ℓ εℓ . This provides a quantitative criterion for when a deep QNN requires recalibration: the operator chooses εtotal corresponding to the deepest acceptable accumulated drift. Second, for QSVM pipelines, the encoding and kernel-evaluation stages may carry separate tolerances, with the kernel-matrix entries then satisfying a contract at the sum of these tolerances. The verification protocol of Section 5.10 can be applied at the end-to-end level (using εtotal ) or at the per-stage level when intermediate measurement access is available.
5.8
Sample Complexity Bound
Theorem 1 establishes the deterministic detection guarantee assuming exact expectation values are available. In practice, the verifier obtains expectations via finite-shot sampling on quantum hardware, introducing statistical estimation error. Before stating the sample-complexity bound, we make precise what it means for a check to be operationally useful under shot noise rather than merely passing a flagging threshold.
27
Definition 4 (Informative detection). Let TPR(N ) and FPR(N ) denote the empirical truepositive and false-positive rates of the verifier at total shot budget N , evaluated on a fixed sneaky construction with separation δ and on the honest channel respectively, both at tolerance εA . Given target confidence 1 − η, the verifier is said to perform informative detection at budget N if both TPR(N ) ≥ 1 − η
and
FPR(N ) ≤ η
hold simultaneously. A check that satisfies TPR(N ) ≥ 1 − η but FPR(N ) > η is uninformative: it crosses the nominal flagging threshold for sneaky channels but does so at a rate that is statistically indistinguishable (or worse) from the false-alarm rate on honest channels, so the flagging decision is driven by shot noise rather than by channel deviation. The two-sided condition is what makes the flagging decision diagnostic of the channel rather than of the sampling process. The following theorem bounds the measurement budget required for informative detection in the sense of Definition 4. Theorem 4 (Measurement Budget). Let OA be a finite observable family with |OA | = k and uniform operator norm bound ∥O∥ ≤ B for all O ∈ OA (for the Pauli family, B = 1). Let the detection margin be γ := δ/C(OA ) − εA > 0, where δ > C(OA ) · εA is the separation of the candidate substitution. Assume the verifier holds an exact reference fingerprint FpA of the declared channel (the setting of Algorithm 1, line 2: FpA is computed from the declared specification, an ideal simulator, or a trusted oracle). Then at confidence at least 1 − η, the total shot budget N ≥
2B 2 k log(2k/η) γ2
(12)
suffices to detect the substitution, with shots distributed approximately uniformly across the observables in OA . Proof. The proof combines a per-observable Hoeffding concentration with a union bound across the family, then solves for N in terms of the detection margin. Step 1: Per-observable concentration. For a single observable O ∈ OA , each measurement shot yields a sample Xi of a random variable with mean µO := Tr(OE(ρ)) and bounded by |Xi | ≤ ∥O∥ ≤ B (since each Xi is an eigenvalue of O). We assume the standard measurement protocol in which the reference state ρ is newly prepared before each shot, ensuring that the samples X1 , . . . , XnO are i.i.d. random variables on the interval [−B, B]. By Hoeffding’s inequality P O [16, Theorem 2], after nO shots the empirical mean µ̂O = n1O ni=1 Xi satisfies, for any t > 0, h i nO t2 , Pr µ̂O − µO > t ≤ 2 exp − 2B 2
(13)
where the factor 2 in the bound accounts for two-sided deviations and the denominator 2B 2 arises from the interval width b − a = 2B in Hoeffding’s general formula exp −2nt2 /(b − a)2 . Step 2: Union bound across the family. With FpA exact, only the candidate measurement µ̂O contributes noise. The verifier correctly distinguishes the sneaky substitute from the declared channel whenever |µ̂O − µO | < γ: the empirical deviation |µ̂O − FpA [O]| then lies 28
above εA for at least one observable (since the true deviation forced by Theorem 1 is at least δ/C ≥ εA + γ). Setting t = γ in (13), the per-observable failure event AO := {|µ̂O − µO | > γ} satisfies
nO γ 2 . Pr[AO ] ≤ 2 exp − 2B 2
Applying the union bound over the k observables in OA : h [ i X nO γ 2 Pr AO ≤ Pr[AO ] ≤ 2k exp − . 2B 2 O∈OA
(14)
O∈OA
Step 3: Solve for N . Let N be the total shot budget allocated uniformly across the k observables, so nO = N/k. Substituting into (14) and requiring the total failure probability to be at most η: N γ2 2k exp − ≤ η. 2kB 2 Dividing both sides by 2k and taking the natural logarithm: η N γ2 2k − ≤ log = − log . 2 2kB 2k η Rearranging (flipping the inequality direction upon negation): N ≥
2B 2 k log(2k/η) , γ2
which is Equation (12). Corollary 1 (Sampled-Reference Budget). If the reference fingerprint is itself estimated empirically (re-measured at the same per-observable shot count alongside the candidate measurement), then the verifier compares two independent empirical estimates. The worst-case opposing deviation between the two estimates absorbs an additional factor of 1/2 in the per-observable concentration radius, and the corresponding shot budget is N ≥
8B 2 k log(2k/η) γ2
(15)
under the same hypotheses as Theorem 4. Proof. Apply the proof of Theorem 4 with t = γ/2 in place of γ in Step 2, reflecting that the observed deviation |µ̂cand − µ̂ref O O | aggregates noise from both estimators (in the worst case each deviates from its true mean in opposite directions, each contributing up to γ/2). The Hoeffding bound becomes Pr[AO ] ≤ 2 exp −nO γ 2 /(8B 2 ) , and the same Step 3 yields the 8B 2 denominator in place of 2B 2 . Remark 3 (Sample budget scaling and tighter bounds). The dependence N = O(k log k/γ 2 ) is the standard scaling of empirical-mean estimation across a finite family. For the complete observable family on a two-qubit system as deployed in Section 6 (k = 6, B = 1, local-Pauli frame-bound √ C = 3) with operational parameters δ = 0.5, εA = 0.15 (giving γ ≈ 0.139) and confidence 29
η = 0.05, the precomputed-reference bound (12) of Theorem 4 prescribes approximately N ≈ 3,420 shots, while the conservative sampled-reference bound (15) of Corollary 1 prescribes approximately N ≈ 13,680. The hardware experiment of Section 6 is run at the conservative N = 13,680 budget, providing roughly fourfold operational safety margin against shot noise relative to the strict precomputed-reference requirement; a direct hardware test at N ≈ 3,420 would tighten the empirical demonstration further and is a natural follow-up. Two complementary improvements compose to give an order-of-magnitude reduction over √ the looser bound used in concurrent work. Relative to the value C = 2 2 adopted in [45], the √ tight constant C = 3 alone yields a factor of approximately 27 reduction in N at the deployed parameters (driven by the non-linearity of γ = δ/C − εA ; in the asymptotic small-tolerance limit εA → 0 the ratio simplifies to (Cold /Cnew )2 = 8/3 ≈ 2.67, which we describe in the abstract as “asymptotically threefold”). The precomputed-reference refinement (12) contributes an additional factor of 4, giving a combined reduction of approximately 100× at deployed operational parameters. For multi-qubit Pauli families with k = 4n − 1, the linear dependence on k becomes the bottleneck. Classical shadow tomography [18] can reduce this dependence to O(log k) for structured observable subsets (e.g., bounded-locality Pauli strings), and adaptive shot allocation that concentrates budget on high-variance observables can further tighten the constants. We note both directions as natural extensions of the present framework.
5.9
Drift Detection Corollary
Theorem 1 addresses adversarial substitutions. The corresponding statement for drift events follows by specialization to the structural form of Definition 3. Corollary 2 (Drift Detection). Let EA be a declared QML channel and OA an informationally complete observable family with constant C(OA ). Let EB = D ◦ EA be a calibration drift event with ∥D − id∥⋄ = d. Then the contract deviation satisfies ∆OA ,ρ (EA , EB ) ≤ d · max ∥O∥ O∈OA
and
∆OA ,ρ (EA , EB ) ≥
d . C(OA )
(16)
The drift event is detected by the contract check whenever d/C(OA ) > εA . Proof. The proof combines the two main results of this section. We establish the lower bound first, then the upper bound, and finally the detection condition. Step 1: Lower bound via Theorem 1. The drift channel EB = D ◦ EA is CPTP by composition: D is CPTP by Definition 3, and the composition of two CPTP maps is CPTP. The diamond-norm distance between EA and EB satisfies ∥EA − EB ∥⋄ = ∥EA − D ◦ EA ∥⋄ = ∥(id − D) ◦ EA ∥⋄ ≤ ∥id − D∥⋄ = d, where the inequality uses the submultiplicativity of the diamond norm under composition with a CPTP channel (here EA , which has diamond norm exactly 1) [40, Section 3.3]. We do not necessarily have equality: the diamond-norm distance between EA and EB can be strictly smaller than d if EA contracts the directions in which D differs from the identity. For the detection 30
bound below we set δ := ∥EA − EB ∥⋄ , which can be at most d; we then apply Theorem 1 with this δ to obtain ∆OA ,ρ∗ (EA , EB ) ≥
δ . C(OA )
For the worst-case drift event in which EA does not contract the perturbation (so δ = d), this lower bound becomes d/C(OA ), which is the form stated in Equation (16). The bound holds at the witness state ρ∗ identified by Theorem 1; the verification protocol of Section 5.10 attains this bound via per-round randomization, as discussed in the proof of Theorem 1. Step 2: Upper bound via Theorem 2. Theorem 2 (Soundness for QML) bounds the observable deviation between any two channels in terms of their diamond-norm distance. Applied to EA and EB = D ◦ EA with ∥EA − EB ∥⋄ ≤ d (Step 1), this yields for every O ∈ OA and every reference input ρ, Tr(OEA (ρ)) − Tr(OEB (ρ)) ≤ d · ∥O∥. Taking the maximum over O ∈ OA on the left-hand side gives ∆OA ,ρ (EA , EB ) ≤ d · maxO∈OA ∥O∥, the upper bound in Equation (16). Step 3: Detection condition. The contract check halts when the observed deviation exceeds the tolerance: ∆OA ,ρ∗ (EA , EB ) > εA . By the lower bound established in Step 1, a sufficient condition for the contract check to halt on a drift event with magnitude d is d > εA C(OA )
⇐⇒
d > C(OA ) · εA .
This is the detection condition stated in the corollary. Remark 4. The drift corollary exposes an important operational distinction. The lower bound matches that of Theorem 1: detection guarantees hold uniformly for any channel modification EB , whether benign or adversarial. The upper bound is specific to the drift case and gives the framework a quantitative bound on how much benign hardware variability is absorbed within tolerance. In practice, d corresponds to the cumulative calibration drift between successive recalibration cycles; εA is set by the operator to absorb this drift while remaining tight enough to detect adversarial substitutions with realistic δ.
5.10
Dual-Mode Verification Algorithm
We now assemble the components into the runtime verification protocol. The algorithm runs in two complementary modes built on the same observable contract: drift-aware monitoring (withintolerance deviations are logged as drift events) and adversarial detection (beyond-tolerance deviations are flagged and the pipeline halts). Soundness. By Theorem 1, any sneaky ansatz substitution with separation δ > C(OA ) · εA produces ∆t > εA on at least one observable in OA , for the worst-case witness state ρ∗ identified in the theorem. In practice, the verifier evaluates the contract on a fixed reference state ρref rather than ρ∗ . To bridge this gap, the algorithm randomizes observable selection across rounds (Line 4): the probability that the adversary avoids detection across T rounds is at most (1 − 1/|OA |)T , and detection probability approaches 1 as T grows. When the verifier can vary ρref across 31
multiple verification campaigns (e.g., over the test set in QML deployment), the worst-case state is encountered statistically and the soundness guarantee transfers from the witness state to the verification distribution. We discuss the practical implications of this assumption in Section 7.3. Completeness for drift.
By Corollary 2, drift events with d/C(OA ) > εA also trigger Line 8
(Halt). Drift events with d/C(OA ) ≤ εA are logged as drift events without halting execution (Line 12), preserving operational continuity under expected hardware variability. Algorithm 1 Dual-Mode Behavioral Fingerprinting Verification. Require: Declared spec σA = (Hspec , OA , εA , τA ), declared channel EA , reference input ρref , confidence 1 − η, expected adversarial separation δ 1: Compute measurement budget N from Theorem 4 using δ, εA , |OA |, η 2: Compute reference fingerprint FpA := FpOA ,ρref (EA ) from declared specification 3: for each verification round t = 1, 2, . . . do 4:
Verifier samples Ot ∈ OA uniformly at random (independent of A)
5: 6:
Verifier requests Nt = ⌈N/|OA |⌉ measurement shots of Ot on E(ρref ) P t Execution environment returns empirical estimate µ̂t = N1t N i=1 Xt,i
7:
Verifier computes deviation ∆t = |µ̂t − FpA [Ot ]|
8:
if ∆t > εA then
▷ Beyond-tolerance: integrity violation
9:
Halt execution; flag round t as anomaly; commit (t, Ot , µ̂t ) to audit trail
10:
return Halt else
11:
▷ Within-tolerance: log as drift event
Commit (t, Ot , µ̂t , ∆t ) to audit trail as drift event
12:
end if
13:
14: end for 15: return Accept Implemented in src/verification.py:run verifier; see footnote 1.
Audit trail integration. Both anomaly events and drift events are committed to the audit trail anchored by Hspec . The audit trail provides post hoc evidence usable for compliance auditing (Scenario 1), customer dispute resolution (Scenario 2), or reproducibility review (Scenario 3). The protocol’s runtime cost is dominated by the measurement budget N from Theorem 4, which is polynomial in |OA | and the relevant precision parameters. Section 6 reports concrete measurement budgets and runtime overhead on the IBM Heron r2 processor.
5.11
Tolerance Calibration Procedure
The verification protocol in Algorithm 1 requires the operator to supply a calibrated tolerance εA . This parameter sits at the operational boundary between the framework’s two modes: deviations within εA are absorbed as benign drift events, while deviations beyond εA are flagged as integrity
32
violations (Section 4.3). The choice of εA therefore directly determines the false-positive rate (tootight tolerance) and the false-negative rate (too-loose tolerance) of the framework. We outline a three-step calibration procedure that produces a principled choice from deployment-specific data. 1. Estimate typical drift magnitude. The operator collects historical calibration data for the target backend over the intended deployment time window (e.g., between successive recalibration cycles, typically hours to days for current cloud QPU services). From this data, the operator computes dtyp drift :=
(t)
max
O∈OA ,ρ∈R
Tr(OEA (ρ)) − Tr(OEA (ρ)) ,
(t)
where EA denotes the channel reconstructed at time t within the calibration window and R is a representative set of reference inputs. This quantity bounds the typical observable deviation induced by benign hardware drift between recalibrations. 2. Specify minimum adversarial separation. The operator specifies the minimum min that the framework must detect. This parameter encodes diamond-norm separation δadv
the operator’s threat model: a deployment auditing for substantial bias substitution may min relatively large (loose detection), while a deployment auditing for subtle channel set δadv
substitutions may set it relatively small (tight detection). The choice is policy-driven, not technical. 3. Set the tolerance. The operator sets εA ∈
typ min ddrift , δadv /C(OA ) ,
where C(OA ) is the frame-bound constant of the observable family appearing in Theorem 1 √ (for the single-qubit Pauli family, C = 3). Any value in this interval simultaneously absorbs typical drift (via the lower bound) and guarantees detection of adversarial substimin (via the upper bound). tutions with separation at least δadv min Empty-interval case. The interval may be empty when dtyp drift > δadv /C(OA ), indicating that
the typical drift on the chosen hardware exceeds the detection capability against the target threat. Three remediation paths are available: (i) deploy on hardware with lower drift, reducing min dtyp drift ; (ii) tolerate a larger δadv (i.e., accept that only larger substitutions are detected); or
(iii) enrich the observable family OA to reduce C(OA ), sharpening the detection bound. The empty-interval case is a useful diagnostic: it tells the operator that the current deployment configuration is not adequate for the declared threat model and must be revisited. Concrete values. Section 6 reports specific values of dtyp drift and the resulting tolerance interval for the IBM Heron r2 (ibm fez) processor in the quantum kernel intrusion-detection setting, providing empirical grounding for the procedure above.
33
6
Experimental Validation
We validate the framework end-to-end on a two-qubit QSVM pipeline executed on the IBM Heron r2 processor (ibm fez). The three experiments instantiate the three operational claims of the framework on real hardware rather than on simulated noise alone: that an informationally complete observable family catches a sneaky ansatz substitution which evades a weak family (Theorem 1), that the sample complexity budget of Theorem 4 suffices for informative detection in practice, and that the tolerance calibration procedure of Section 5.11 returns a non-empty interval on a production-grade backend (Corollary 2). Concurrent work on general CPTP-channel behavioral subtyping [45] also includes hardware validation, but at the level of isolated CPTP channels rather than the encoder–ansatz–measurement pipeline of a deployed QML model; the experiments reported here exercise the framework on an end-to-end QML pipeline (QSVM kernel) including its multi-qubit feature map, finite-shot sampling, and natural drift across timepoints, which together are what the QML-specific layers of Section 5.1 are designed to address. The complete raw counts, fingerprints, run metadata, and IBM Quantum job IDs are archived in the project repository (Section 1 and footnote 1) so that every result reported here can be independently reproduced.
6.1
Setup
The reference implementation used in this section is the repository linked in Section 1 (see footnote 1); file paths of the form src/... and experiments/... cited throughout identify modules in that repository. Each table and figure caption that follows names the specific script (and, where applicable, the plot function) that generates it, so that every reported result can be reproduced from the indicated source. Hardware. All hardware runs use ibm fez, IBM Quantum’s Heron r2 processor (156 superconducting qubits). Jobs are submitted through Qiskit Runtime using the SamplerV2 primitive in batched mode. The two-qubit subgraph used by every circuit is selected automatically by the default transpiler pass at optimization level=1. Dataset and classifier. We use a synthetic 2-dimensional binary classification dataset (the make moons generator from scikit-learn, 20 samples, noise 0.1, fixed random seed) as a controlled stand-in for a binary intrusion-detection feature space, following the QSVM-based intrusiondetection setup of Kalinin and Krundyshev [21]. The choice of synthetic rather than real network-traffic data keeps the experimental focus on the channel-integrity properties of the framework rather than on application-domain accuracy, while preserving the two-class structure of an intrusion-detection task. The classifier is a QSVM: classical inputs are encoded into a 2-qubit state via the standard ZZFeatureMap with two repetitions, and pairwise kernel values are estimated from an inversion-test circuit that prepares the output state |ψij ⟩ = Uϕ (xi )Uϕ (xj )† |00⟩. For contract verification, the same prepared state |ψij ⟩ is then measured in the six single-qubit Pauli bases (X, Y, Z on each qubit) via the standard pre-measurement basis-change gates (H before X measurement, S † H before Y measurement, no rotation before Z measurement); the six observable expectations form the behavioral fingerprint FpOA ,ρref (E) for the channel under 34
test. The standard inversion-test fidelity estimator |⟨00|ψij ⟩|2 is recovered as the Z1 Z2 -projector component when needed for the classifier’s downstream kernel computation, but the verifier uses the full six-observable fingerprint rather than only this single scalar. A single representative input pair (xi , xj ) = ((0.4, 1.2), (1.1, 0.3)) is fixed across runs to keep the comparisons across timepoints, channels, and shot budgets controlled. Honest and sneaky channels. The honest channel implements the kernel circuit described above; its code path is src/channels.py:honest channel. The sneaky variant is identical except that an S-gate is inserted on every qubit immediately before measurement (src/channels.py:sneaky channel). This construction is by design: the S-gate preserves ⟨Z⟩ on the output qubits but rotates ⟨X⟩ and ⟨Y ⟩ by π/2, so the sneaky fingerprint matches the honest one when only {Z}-type measurements are taken but separates from it on the full Pauli family. This is a standard adversary template for channel-level observable contracts; concurrent work [45] uses an analogous construction at the single-qubit isolated-channel level, while we apply it inside a 2-qubit QML kernel pipeline. Observable families.
We compare two contracts:
• Weak family Oweak = {Z1 Z2 }. A single two-qubit Pauli string, informationally incomplete by construction. Implemented in src/observables.py:weak family. • Complete family OA = {X1 , Y1 , Z1 , X2 , Y2 , Z2 }, six single-qubit Paulis with one factor on each wire. This family is the two-qubit instance of the local Pauli family of Proposition 1: its real-linear span covers the algebra of single-qubit reductions on each wire, and by Proposition 1 it is informationally complete with respect to the class Sloc of local-unitary substitutions, which is the operational threat model considered in this paper. The local family does not span two-qubit correlation operators such as X1 X2 or Z1 Z2 and is therefore not strictly informationally complete on the full two-qubit Hilbert space; this is a deliberate operational choice and we discuss its scope in Section 7.3 and Appendix A. Implemented in src/observables.py:complete family. The frame-bound constant for the complete family is C(OA ) =
√
3, matching the tight single-
qubit Pauli value derived in Theorem 1 (Section 3.3). Operational parameters. We adopt the parameter set calibrated for the deployed backend: adversarial separation δ = 0.5, contract tolerance εA = 0.15, confidence 1 − η = 0.95, family size k = 6, operator-norm bound B = 1. The tolerance εA is chosen at the lower end of the non-empty interval permitted by the procedure of Section 5.11 applied to the drift observation reported in Section 6.4 (which yields a recommended interval [0.067, 0.289] with midpoint 0.178); the lowerend choice is conservative against drift fluctuations and keeps the worst-case detection margin γ comfortably below δ/C while remaining strictly above the typical observed drift dtyp drift = 0.067. With these values, the detection margin from Theorem 1 is γ = δ/C − εA ≈ 0.139. We run the hardware experiment at the conservative sampled-reference budget from Corollary 1, N ≥ 13,680, allocated uniformly across the family at nO = 2,280 shots per observable, even though Algorithm 1 35
only requires the tighter precomputed-reference budget from Theorem 4 (N ≈ 3,420 at the same parameters). This conservative choice gives a roughly fourfold operational safety margin against shot noise relative to the strict requirement; the question of whether the tighter precomputedreference budget itself is empirically attainable on hardware is a natural follow-up and we discuss it briefly in the validation analysis of Section 6.3. The conservative budget remains well within the per-circuit shot capacity of ibm fez and stays inside the IBM Quantum open-plan monthly QPU budget. The computation is implemented in src/sample complexity.py:compute N. Three experiments.
We run three experiments on the same hardware setup:
• Experiment 1 (Section 6.2): detection of a sneaky substitution under the weak versus complete observable contracts. • Experiment 2 (Section 6.3): empirical validation of the sample-complexity bound (Theorem 4 and Corollary 1) at the conservative shot budget used by the hardware experiment, performed on a noisy Aer simulator with the IBM Heron r2 noise model so that the validation tracks realistic hardware statistics without consuming QPU time. • Experiment 3 (Section 6.4): observation of natural hardware drift across three timepoints and computation of the tolerance interval prescribed by Section 5.11. The
dual-mode
verifier
of
Algorithm
1
is
invoked
for
each
experiment
from
src/verification.py:run verifier.
6.2
Detection of Sneaky Ansatz Substitution
This experiment, implemented in experiments/experiment1 detection.py, submits one batched SamplerV2 job containing every (channel, observable) pair: the honest channel on the union of the weak and complete families, then the sneaky channel on the same set. For each pair we collect nO = 2,280 shots and convert the resulting bitstring counts into a Pauli expectation ⟨P ⟩ ∈ [−1, +1] using src/ibm runtime.py:expectation from counts. The fingerprints FpA and FpB are the vectors of these expectations indexed by observable. Table 8 reports the per-observable deviation |⟨P ⟩A −⟨P ⟩B | together with the verifier’s decision for each contract. The run metadata is summarized in Table 7. Figure 3 visualizes the per-observable deviations, with the single weak-family observable plotted alongside the full set of six complete-family observables and the tolerance line εA = 0.15 drawn for reference. The pattern matches the structural prediction of Theorem 1 and the S-gate construction: the Z-diagonal observables (Z1 Z2 , Z1 , Z2 ) stay at the device noise floor (deviations below 0.01, far within εA = 0.15), while the X- or Y -rotated observables in the complete family separate into two groups. Three of them (X1 , X2 , Y2 ) exceed tolerance by a clear margin with deviations between 0.36 and 0.49, and Y1 sits just below tolerance at 0.105. The complete-family worst deviation, 0.489 on X2 , is roughly 3.3× the tolerance, so the substitution is detected with a wide safety margin against shot noise. The framework’s per-round randomization (Section 5.10) ensures that the high-deviation observables are sampled with positive probability in any sufficiently long execution; in this run, three of the six complete-family observables independently force a halt. 36
Table 7: Run metadata for the detection experiment on ibm fez. Field
Value
Backend Job ID Date Plan Shots Total circuits Queue time QPU run time Total wall time
ibm fez (IBM Heron r2, 156 qubits) d884b8is46sc73f8v28g 22 May 2026, 12:02 UTC IBM Quantum Open Plan 2,280 per circuit 14 (honest + sneaky, 7-Pauli family) ≈ 15 seconds ≈ 15 seconds 30.7 seconds
Generated by experiments/experiment1 detection.py; see footnote 1.
6.3
Sample Complexity Validation
This experiment, implemented in experiments/experiment2 sample.py, measures the empirical true positive rate (TPR) and false positive rate (FPR) of the verifier at three shot budgets: N (the Corollary 1 sampled-reference value used by the hardware experiment of Section 6.2), N/10, and N/100. At each budget we run 20 independent trials with a fresh random seed. To probe the formula’s tightness rather than its trivial regime, we use a weakened sneaky construction: the substitute channel inserts RZ (π/6) on each qubit instead of the full S-gate, producing a true maximum deviation of 0.259 that exceeds the contract tolerance εA = 0.15 by a moderate margin. A noise-free reference fingerprint of the honest channel is precomputed on the ideal simulator at 105 shots per observable; every trial measurement (sneaky or honest) is compared against this reference, so TPR and FPR are reported with respect to a fixed, statistically clean baseline. All trials run on the noisy Aer simulator described in Section 6.1. Table 9 reports the empirical rates as a function of shot budget. Table 8: Per-observable deviations between the honest and sneaky channels on ibm fez, nO = 2,280 shots per observable. Tolerance εA = 0.15. The verifier accepts a fingerprint when the maximum deviation over the family is at or below εA and halts otherwise. |⟨P ⟩A − ⟨P ⟩B |
Within εA ?
Z1 Z2 (weak family)
0.001
yes
X1 (complete family) Y1 Z1 X2 Y2 Z2
0.381 0.105 0.004 0.489 0.358 0.005
no yes yes no no yes
Observable
verifier decision (weak contract) verifier decision (complete contract)
accept (max dev = 0.001) halt (max dev = 0.489)
Figure 4 plots TPR and FPR against shot budget, with the dashed lines marking the target rates (1 − η = 0.95 for TPR and η = 0.05 for FPR) so that the gap between empirical and target rates at each budget is visible at a glance. At the conservative Corollary 1 budget the verifier 37
Figure 3: Per-observable deviation between the honest and sneaky channels on ibm fez, with tolerance εA = 0.15 marked by the vertical line. Observable labels follow the convention Pi ≡ P ⊗ I for i = 1 (qubit 1) and Pi ≡ I ⊗ P for i = 2 (qubit 2); the correlation observable is labelled Z1 Z2 ≡ Z ⊗ Z. The single weak-family observable Z1 Z2 (amber) stays at the device noise floor (deviation 0.001), passing the weak contract. The complete family (teal) exposes the substitution: deviations of 0.36–0.49 on three of the X- or Y -rotated observables, well beyond tolerance. The verifier halts under the complete contract while the weak contract accepts the substitute, reproducing the structural prediction of Theorem 1 on real hardware. Reproduced by experiments/experiment1 detection.py together with the plot function analysis/plot figures.py:fig detection bars (see footnote 1).
Table 9: Empirical TPR and FPR as a function of measurement budget, 20 trials per setting, weakened sneaky construction (RZ (π/6) insertion). The Corollary 1 (sampled-reference) budget corresponds to target 1 − η = 0.95 TPR with FPR at most η = 0.05. Shot budget
nO
TPR (sneaky)
FPR (honest)
N (Cor. 1, conservative) N/10 N/100
2,280 228 22
1.00 0.95 1.00
0.00 0.15 1.00
Generated by experiments/experiment2 sample.py; see footnote 1.
38
Figure 4: Empirical TPR (sneaky detection rate) and FPR (honest false-alarm rate) as a function of shot budget per observable, weakened sneaky construction (RZ (π/6) insertion), 20 trials per setting on the Aer simulator with the IBM Heron r2 noise model. At the Corollary 1 (sampled-reference) per-observable budget nO = 2,280 (total N = 13,680), TPR reaches 1.00 and FPR drops to 0.00, comfortably bracketing the target rates (TPR target 1 − η = 0.95, FPR target η = 0.05, shown as dashed lines). At reduced budgets the FPR climbs sharply (0.15 at nO /10, 1.00 at nO /100), indicating that statistical fluctuations rather than channel deviation are driving the verifier’s decisions; the apparent detection in this regime is uninformative. Reproduced by experiments/experiment2 sample.py together with the plot function analysis/plot figures.py:fig sample curve (see footnote 1).
attains TPR = 1.00 and FPR = 0.00, comfortably above the target 1 − η = 0.95 and below the target FPR η = 0.05. At N/10 the apparent TPR remains high (0.95) but the FPR climbs to 0.15, exceeding the target rate threefold and signaling that statistical fluctuations are starting to dominate. At N/100 both rates saturate at 1.00, confirming that the check has degenerated into pure statistical noise: every trial flags a violation regardless of whether the channel is sneaky or honest. The Corollary 1 budget is therefore the operational threshold not just for nominal flagging but for informative detection in the sense of Definition 4: at N both the TPR-target and the FPR-target are met, while at reduced budgets the FPR-target is violated even when TPR appears acceptable, so the empirical TPR no longer reflects channel deviation.
6.4
Drift Observation and Tolerance Calibration
This experiment, implemented in experiments/experiment3 drift.py, runs the honest channel three times within a single batched SamplerV2 submission, separated by the natural scheduling delay between sub-batches on the same job. For each timepoint t1 , t2 , t3 we collect the full (t)
fingerprint FpA on the complete family with nO = 2,280 shots per observable per timepoint (matching the detection experiment), and compute the maximum pairwise deviation (t )
(t )
j i dtyp drift = max max FpA [O] − FpA [O] .
i<j
O∈OA
39
The result populates the tolerance calibration procedure of Section 5.11: we report dtyp drift , the upper min /C(O ) with δ min = 0.5, and the corresponding tolerance interval [dtyp , δ min /C]. bound δadv A adv drift adv
The run metadata is summarized in Table 10, and Table 11 reports the pairwise drift values and the recommended tolerance. Table 10: Run metadata for the drift experiment on ibm fez. Field
Value
Backend Job ID Date Plan Shots Total circuits Queue time QPU run time Total wall time
ibm fez (IBM Heron r2, 156 qubits) d884pu2s46sc73f8vn0g 22 May 2026, 12:33 UTC IBM Quantum Open Plan 2,280 per circuit 18 (3 timepoints, 6-Pauli complete family) ≈ 15 seconds ≈ 15 seconds 30.5 seconds
Generated by experiments/experiment3 drift.py; see footnote 1.
Table 11: Drift observation across three timepoints on ibm fez. Pairwise deviations are over the complete observable family. Quantity (t )
Value (t )
maxO |FpA1 [O] − FpA2 [O]|
0.067
(t ) (t ) maxO |FpA1 [O] − FpA3 [O]| (t ) (t ) maxO |FpA2 [O] − FpA3 [O]| dtyp drift
0.067
min Tolerance interval [dtyp drift , δadv /C] Interval non-empty? Recommended εA
0.046 0.067 [0.067, 0.289] yes 0.178
Generated by experiments/experiment3 drift.py; see footnote 1.
Figure 5 shows the three honest fingerprints overlaid in the top panel (the near-coincident trajectories confirm small drift over the run duration) and the pairwise maximum deviations in the bottom panel (with dtyp drift = 0.067 marked for reference). The interval is non-empty, so the calibration procedure converges on this hardware. The operational value εA = 0.15 used in the detection experiment of Section 6.2 sits within the tolerance interval [0.067, 0.289] and below the calibration midpoint of 0.178; the choice of 0.15 rather than the midpoint reflects an operational preference for a tighter tolerance (smaller εA enlarges γ and improves the safety margin against shot noise) while staying comfortably above the typical drift. The typical drift typ dtyp drift = 0.067 sits well below the tolerance (ddrift /εA ≈ 0.45), leaving substantial operational
room for the framework to absorb additional drift between recalibration cycles without losing detection capability. 40
Figure 5: Drift observation on ibm fez across three timepoints within a single batched submission. Top: the honest fingerprint at each timepoint, plotted with distinct marker shapes and line styles for the three timepoints; the three trajectories nearly coincide, confirming small drift over the run duration. Bottom: pairwise maximum deviations over the complete observable family, with the typical drift dtyp drift = 0.067 marked by the vertical line. All three pairwise deviations are typ at or below ddrift , and dtyp drift itself sits well below the contract tolerance εA = 0.15. Reproduced by experiments/experiment3 drift.py together with the plot function analysis/plot figures.py:fig drift panel (see footnote 1).
41
6.5
Discussion of Results
The three experiments give a consistent picture of the framework’s operating regime on a production quantum backend. The detection experiment (Section 6.2, script experiments/experiment1 detection.py; see footnote 1) confirms the central prediction of Theorem 1 on real hardware. The sneaky channel survives the weak contract with a deviation of 0.001 on Z1 Z2 , well within the noise floor; the same channel triggers the complete contract with worst deviation 0.489 on X2 , roughly 3.3× the tolerance εA = 0.15. The safety margin against shot noise means the detection mechanism is not at the edge of significance: even if the per-observable expectation estimate had drifted by another standard error or two, the verifier would still have halted. The structural pattern across observables matches the S-gate construction directly: every Z-diagonal observable stays below 0.01, three of the X- or Y -rotated observables exceed 0.35, and Y1 sits just below the tolerance line. Three of the six complete-family observables independently exceed tolerance, providing redundancy that would protect detection under the per-round randomization of Algorithm 1 in a streaming-mode deployment. The sneaky fingerprint survives realistic device noise on ibm fez, and the gap between the weak-family and complete-family worst deviations is large compared to the per-observable noise floor. The sample complexity validation (Section 6.3, script experiments/experiment2 sample.py; see footnote 1) supports the operational interpretation of the conservative Corollary 1 budget more strongly than a single rate would. At the Corollary 1 budget the verifier achieves (TPR, FPR) = (1.00, 0.00), comfortably above and below the target rates (0.95, 0.05). At onetenth of the budget the apparent TPR remains at 0.95, but the FPR climbs to 0.15: the verifier flags honest channels three times as often as the target rate allows, so the high TPR no longer reflects meaningful detection. At one-hundredth of the budget the two rates collapse to nearly the same value (TPR = 1.00, FPR = 1.00), and the contract check has degenerated into shot noise. The validation therefore shows that the Corollary 1 budget is the threshold for informative detection (Definition 4), not merely for crossing a flagging threshold; smaller budgets cross the flagging threshold for the wrong reason, by failing the FPR-target rather than by reflecting a genuine channel deviation. The drift experiment (Section 6.4, script experiments/experiment3 drift.py; see footnote 1) closes the loop with the deployment configuration. The natural drift of ibm fez over the duration of a single batched submission is dtyp drift = 0.067, well below the tolerance εA = 0.15 used in the detection experiment. The tolerance interval [0.067, 0.289] from the calibration procedure of Section 5.11 is non-empty, and contains the operational choice εA = 0.15 with substantial margin on both sides (the calibration midpoint is 0.178, slightly above εA but in the same regime). The detection guarantee of Theorem 1 and the drift bound of Corollary 2 are therefore both empirically realizable on a production-grade quantum backend within the parameter regime considered, with substantial operational margin left over. Two limitations of the present validation should be noted. First, the two-qubit ZZFeatureMap is the smallest model that exercises the framework’s structural mechanics; scaling to larger feature maps and richer ansatze (eight to twelve qubits, deeper repetitions, hardware-efficient architectures) is a natural next step. Second, the three timepoints in the drift experiment 42
are separated by minutes within a single SamplerV2 job, capturing short-timescale calibration variability but not the multi-hour or multi-day drift that operational deployments encounter between recalibration cycles. Both scaling axes are deferred to subsequent work and discussed further in Section 7.3.
7
Discussion
7.1
Practical Relevance and the Maturation Trajectory
A reasonable concern about any new verification framework is whether the threat it addresses is current or speculative. We address this directly. The three deployment scenarios in Section 1 (regulated industries, cloud QPU services, academic reproducibility) all rest on conditions that are present today rather than projected: production QML cloud services from IBM, IonQ, and Quantinuum already serve paying customers; the EU AI Act has been in force since August 2024 and NIST AI Risk Management Framework is in active use; the reproducibility crisis in classical ML is well documented [19]. Each of these conditions transfers to QML as the technology moves from research prototypes to deployed systems. The historical parallel is informative. Behavioral subtyping was formalized by Liskov and Wing [26] in 1994 when object-oriented programming was still an emerging paradigm. The framework was not motivated by then-current attacks; it was motivated by the structural requirement that the discipline would be needed as the paradigm scaled. Three decades later it remains the foundational reference for behavioral subtyping. We position QML-PipeGuard similarly: the discipline is for QML deployment at the scale that current cloud roadmaps suggest will arrive within several years, and the framework is engineered to be available when that scale is reached rather than retrofitted after.
7.2
Integration with Existing QML Toolchains
The framework is designed to plug into existing QML toolchains rather than replace them. Three integration design sketches are immediate; a turnkey plugin for any specific toolchain is an engineering follow-up that we do not claim in the present paper. For Qiskit Machine Learning, the verifier wraps the existing kernel and classifier modules at the SamplerV2 boundary. A pipeline using QuantumKernel or VQC continues to construct circuits as it does today; the verifier intercepts the Sampler job at submission, attaches the observable contract (Section 5.2), and routes a fraction of the shot budget to the contract observables. The reference implementation in this paper follows exactly this pattern: src/ibm runtime.py interacts with SamplerV2 in the same way a stock Qiskit pipeline would, and the verifier in src/verification.py is invoked without modifying the underlying QML model code. For PennyLane, the equivalent hook is the QNode construction. PennyLane already exposes observables as first-class objects through qml.expval, so the contract observables can be evaluated by the same device on which the QML model runs. The compositionality result of Theorem 3 matches PennyLane’s layer-by-layer execution model directly, allowing per-layer tolerances to be assigned where intermediate measurement is available.
43
For TensorFlow Quantum, integration is at the tfq.layers.SampledExpectation interface. The contract observables map to the same Cirq Pauli-string format used by the rest of the pipeline; the only addition is the per-job audit-log emission, which is straightforward to implement as a custom Keras callback. In all three cases, the toolchain is treated as a black box and the framework operates at the boundary where measurement outcomes are produced. No re-implementation of encodings, ansatze, or classifiers is required. The reference code targets the protocol layer (SamplerV2 batched jobs) rather than any specific high-level wrapper; toolchain-specific adapters are a natural follow-on engineering deliverable.
7.3
Limitations
We list the limitations of the framework openly, since each one shapes where and how it can be deployed. Observable-family restriction. The detection guarantee of Theorem 1 requires that an observable family informationally complete with respect to the relevant substitution class (in the operational sense of Proposition 1 or the strict tomographic sense for arbitrary CPTP substitutions) is available on the output Hilbert space. For QML pipelines whose output is the expectation of a measurement observable, this is the natural setting and the Pauli family does the job. For pipelines whose output is intrinsically classical post-processing of measurement outcomes (for instance, a model that emits only the argmax classification decision and never an expectation value), the contract has to be lifted to an intermediate measurement layer where observables are still meaningful. We do not extend the framework to such purely-classical-output pipelines. local (Section 6.1) is Operational scope of the local Pauli family. The deployed family OA
informationally complete with respect to local-unitary substitutions (Proposition 1), which covers the dominant threat profile in current cloud QPU deployments: single-qubit gate substitutions, decoherence drift, calibration shifts, and per-qubit pulse manipulations. Entangling-gate substitutions (e.g., CNOT or CZ insertion), correlated-noise channels, and subspace-preserving stealthy substitutions can alter joint correlation observables while leaving local marginals fixed, and therefore fall outside the local family’s detection scope. Detection of such substitutions requires augmenting OA with correlation Paulis (X1 X2 , Y1 Y2 , Z1 Z2 , and possibly all 4n − 1 non-identity Pauli strings). The cost of this extension is non-trivial: as we show in Appendix A, expanding to nine observables (local plus diagonal correlations) increases the shot budget by roughly a √ factor of five at the operational εA = 0.15, because the frame-bound constant grows from 3 to approximately 2.21 and the detection margin γ shrinks correspondingly. The fifteen-observable full Pauli family pushes C to approximately 3.73, which renders γ negative at εA = 0.15 and requires either tightening εA (e.g. to 0.05) or relaxing the separation requirement δ. Appendix A discusses these extensions and the associated deployment trade-offs in detail. Sample complexity on large observable families. The bound of Theorem 4 scales linearly in the family size k. For multi-qubit Pauli families with k = 4n − 1, this becomes the dominant cost. The remark following the theorem points to two directions for tighter bounds: classical shadow tomography [18] for structured subsets, and adaptive shot allocation that 44
concentrates budget on high-variance observables. Both are natural extensions but lie outside the present scope. Reference channel assumption. The verifier is assumed to hold a clean reference implementation of the declared channel EA . In practice this means either (i) the verifier executes EA itself on a trusted backend during contract construction, or (ii) the verifier holds a precomputed reference fingerprint that it trusts by other means (signed by a trusted party, anchored in a public log, or generated during a prior verified run). If neither is available, the contract degrades to a relative consistency check between executions rather than an absolute one. Worst-case witness state. Theorem 1 identifies a witness state ρ∗ that exposes the channel-level separation. Algorithm 1 uses a fixed reference state ρref in practice. The gap between ρ∗ and ρref is closed by randomized observable selection across rounds (Section 5.10) and, when the verifier can vary ρref across multiple campaigns, by sampling over the verification distribution. For deployments that lock ρref to a single canonical input, an adversary aware of that choice could in principle craft a substitution that the worst-case theorem allows but the fixed-state evaluation misses; this is one reason the framework is described as a runtime monitoring layer rather than a worst-case soundness proof. Insider threats with shared trust. The threat model in Section 4.1 assumes the verifier is trusted and independent of the execution environment. An adversary who controls both the verifier and the execution environment can defeat any contract-based scheme by definition. Mitigating insider threats requires complementary mechanisms (multi-party verification, external anchors, hardware attestation) that we treat as orthogonal.
7.4
Open Problems
Several questions are left open by the present treatment and we flag them as directions worth following. Multi-qubit tomographic completeness. The frame-bound constant C(OA ) in Theorem 1 √ is known tightly for the single-qubit Pauli family (C = 3, this paper) and scales polynomially in n for the full n-qubit Pauli family. A tight characterization for structured subsets of nqubit Paulis, such as bounded-locality strings, would directly reduce the sample complexity of Theorem 4 and is the most operationally consequential open question. The shadow tomography literature [18] provides part of the toolkit. Adaptive observable selection. The verifier in Algorithm 1 selects observables uniformly at random. A budget-aware verifier that concentrates measurements on high-variance or high-information observables would shrink the practical shot count substantially, especially for multi-qubit families. The right adaptive policy depends on what is assumed about the adversary’s response and is closely connected to active-learning formulations. Composition with classical ML verification. Our framework verifies the quantum channel layer of a QML pipeline. A typical end-to-end deployment also requires verification of the surrounding classical components: data preprocessing, post-classification thresholds, downstream business logic. Tools such as Q-SafeML [9] for data drift and VeriQR [25] for input robustness already address pieces of this surface. Composing these pieces into a single auditable 45
pipeline contract, with a coherent treatment of how classical-side tolerances aggregate with the quantum-side observable contract, is an open systems question. Tight lower bounds on detection. Theorem 4 gives a sufficient sample budget for detection. The matching lower bound, stating that detection with confidence 1 − η is informationtheoretically impossible at substantially fewer shots, is not addressed here. A tight lower bound would close the operational picture and clarify how much of the cost is intrinsic to the problem versus an artifact of Hoeffding-plus-union-bound. Extension to other QML model classes. The present formal treatment covers VQCs, QSVMs, and QNNs. QCNNs [8] and QBMs [3] share the same structural property (observableexpectation outputs) and are reachable by the same framework. Working out the QML-specific specialization for each (analogous to the VQC, QSVM, QNN cases in Sections 5.3–5.5) is straightforward but not done here.
8
Conclusion
This paper extends behavioral subtyping for hybrid quantum-classical pipelines to the QML setting. The central object is the behavioral fingerprint: the runtime vector of observable expectations that characterizes a QML channel against its declared specification. Around this object we developed three results. The detection theorem (Theorem 1) establishes that a sneaky ansatz substitution cannot evade an informationally complete observable contract. The sample-complexity bound (Theorem 4) quantifies the measurement budget needed to realize that guarantee in finite-shot practice. The drift corollary (Corollary 2) shows that the same observable contract, applied within a calibrated tolerance, also serves as a drift-aware monitoring layer. To the best of our knowledge, the combination of these three components into a runtime-verifiable, dual-mode channel-integrity contract for QML pipelines has not appeared in the prior literature, and we offer it as a first step in this direction rather than a final word; we will be glad to update this positioning if earlier or concurrent work is brought to our attention. The main practical contribution of this paper is the dual-mode operational view. In prior work, calibration drift and adversarial substitution have been addressed by separate mechanisms: drift through pulse-level adaptation [17] or input-distribution monitoring [9], and adversarial channel identity through device fingerprinting [42] or input-robustness verification [25]. Broader trustworthiness roadmaps for QML [6] and security surveys of QML-as-a-Service [22] have catalogued the pipeline-level risk surface, naming channel integrity among the concerns to address but, as far as we can tell, leaving it without a constructive runtime mechanism in the existing QML literature. The contribution of the present paper is to bring drift and adversarial substitution under a single observable contract, parameterized by a single tolerance, so that one runtime check covers both concerns and one audit trail records both kinds of events. The proposed mechanism is complementary to the threads cited above rather than a replacement for any of them. The hardware validation on ibm fez shows that the framework is operationally feasible at the parameter regime considered. The shot budget prescribed by Theorem 4 fits within a single batched job; the natural drift over the duration of that job stays inside a contract tolerance that
46
still admits adversarial detection; the sneaky fingerprint survives device noise. The work is positioned for the QML maturation trajectory. Production cloud QPU services exist today; the regulatory frameworks that will eventually govern QML deployments are already in force for classical AI; the reproducibility concerns transfer from classical ML to QML directly. Behavioral subtyping was formalized for object-oriented software before the deployments that made it necessary; the same structural reasoning applies here. We see the framework as a building block for the QML deployment stack that is being assembled now, not a defense against attacks that already occur. The accompanying open-source implementation and the archived experimental artifacts (Section 1) are intended as a reusable starting point. Toolchain-specific adapters, tighter samplecomplexity bounds, and the composition with classical ML verification primitives are the natural next steps; we have flagged them as open problems in Section 7.
Acknowledgments We acknowledge the use of IBM Quantum services and the Qiskit open-source software development kit, including Qiskit Machine Learning and scikit-learn, for the real-hardware validation experiments reported in Section 6. The views expressed are those of the authors and do not reflect the official policy or position of IBM or the IBM Quantum team.
A
Operational Scope of the Observable Family
This appendix expands on the operational scope of the local Pauli family used in the hardware experiments (Section 6) and the family extensions required when the threat model is broadened beyond local-unitary substitutions. The aim is to make the trade-off between family size, detection coverage, and shot budget explicit, so that a deployer can choose the right configuration for their threat profile.
A.1
Threat coverage of the local family
local = {X , Y , Z : i = 1, . . . , n} is informationally complete with respect The local Pauli family OA i i i
to local-unitary substitutions (Proposition 1). The substitution class Sloc covered by this family includes: • Single-qubit gate substitutions, that is, insertion of an extra rotation on any qubit (Pauli X, Y , Z, phase S, T , or arbitrary single-qubit unitary). The hardware experiment of Section 6.2 uses this class with the S-gate variant. • Decoherence drift, namely changes in T1 , T2 between recalibrations, manifested as per-qubit channel shifts. • Bit/phase-flip channels, i.e., adversarial or natural Pauli error channels acting independently on each qubit.
47
• Per-qubit pulse manipulations, that is, insider attacks at the pulse-control layer that target individual qubits. These substitutions cover the dominant threat profile in current cloud QPU deployments, where pulse-level access is typically restricted and noise channels are predominantly local.
A.2
Out-of-scope substitution classes
Three classes of substitutions fall outside the detection scope of the local family: • Entangling substitutions (e.g., insertion of a CNOT or CZ gate before measurement). These can alter joint correlation observables while leaving local marginals unchanged. • Correlated-noise channels (e.g., crosstalk-induced Z1 Z2 -correlated noise on superconducting hardware). The marginals may shift slightly but the dominant signal is in the correlation observables, which the local family cannot resolve. • Subspace-preserving stealthy substitutions (e.g., a parity-preserving unitary that permutes the eigenstates of an entangled subspace). These leave local Pauli expectations fixed by construction and are invisible to the local family. The Bell-state-vs-maximally-mixed-state comparison is a clean illustration: both states have all six local Pauli expectations equal to zero, yet they differ on X1 X2 , Y1 Y2 , Z1 Z2 . Any adversary that can substitute one for the other is invisible to the local family.
A.3
Family extension for full coverage
Detection of out-of-scope substitutions requires augmenting OA with correlation observables. We sketch three tiers of family extension, with increasing detection coverage and cost. The frame-bound constants C(OA ) reported for Tiers 2 and 3 are obtained by direct numerical P optimization of the witness objective supM ∗ ∈span(OA ),∥M ∗ ∥≤1 O |cO | via random search followed by Nelder–Mead refinement; the optimization script, the witness operators, and the numerical reproduction artefacts are provided as supplementary material (analysis/frame bound.py). The reported standard error on C is below 10−3 . Numerical values below are at the operational parameters of the hardware experiment (δ = 0.5, εA = 0.15, η = 0.05, B = 1).
48
Table 12: Three deployment tiers for OA on two qubits, with associated threat coverage, frame-bound constant C(OA ), detection margin γ = δ/C − εA , and total shot budget N from Corollary 1 (sampled-reference, the conservative budget used by the hardware experiment of Section 6.2). Cost figures are at the operational parameters above and scale through Theorem 4 (precomputed-reference, by an additional factor of 4 tighter) for larger qubit counts. Tier
Family
Captures
C √ 3
γ
N
Tier 1 (deployed)
Local Paulis (k = 6)
Single-qubit substitutions, drift, per-qubit attacks
0.139
13,680
Tier 2
Local + diagonal correlations (k = 9): add X1 X2 , Y1 Y2 , Z1 Z2
Local substitutions plus correlated noise on the Pauli axes
≈ 2.21
0.076
≈ 72,700
Tier 3 (full 2-qubit)
All non-identity Pauli strings (k = 15)
Arbitrary CPTP substitutions discriminable by Pauli measurements
≈ 3.73
—
—
A few practical observations follow from the table. Tier 2 already costs roughly five times the Tier 1 shot budget at the operational εA = 0.15, because the frame-bound constant grows √ from 3 to approximately 2.21 and the detection margin γ = δ/C − εA shrinks correspondingly. The dependence of N on γ −2 amplifies modest increases in C into substantial increases in N once εA approaches δ/C. Tier 3 (the full 2-qubit Pauli family) has C ≈ 3.73 and δ/C ≈ 0.134, which is below the operational tolerance εA = 0.15. Consequently γ is negative at these parameters and the theorem’s detection guarantee does not apply at this (δ, εA ) pair: either εA must be tightened (e.g. to 0.05, which yields γ ≈ 0.084 and N ≈ 1.4 × 105 ) or the separation requirement δ must be relaxed. The asymptotic scaling N = O(k log k/γ 2 ) is still favourable; it is the specific operational parameters used in this paper’s hardware experiment, together with the larger C for the richer family, that produce the boundary behaviour at Tier 3. The qualitative takeaway is that the choice of family is a meaningful operational lever: moving from Tier 1 to Tier 2 increases detection coverage at the cost of approximately five times the shot budget, while Tier 3 requires re-tuning the operational tolerance εA in addition to expanding the family. The framework’s structural guarantees (Theorem 1, Theorem 4, Corollary 2) carry over unchanged across tiers; only C(OA ), k, and the operational parameters are updated.
A.4
Deployment recommendations
The right tier depends on the deployment context and on the operational tolerances: • Routine hardware-health monitoring (e.g., a daily QPU-integrity check by a customer): Tier 1 suffices. Drift and single-qubit issues are the dominant failure modes, and the cost saving over higher tiers is meaningful for high-frequency monitoring. 49
• Mid-stakes deployment (e.g., healthcare or financial applications where the QML pipeline contains entangling gates and the threat model includes adversaries with limited pulse access): Tier 2 is the natural choice, adding the three diagonal-correlation Paulis at roughly five times the Tier 1 shot budget at the operational εA = 0.15. Deployments that wish to keep the shot budget closer to Tier 1 can tighten δ (require larger channel separation before flagging) so that γ remains comparable to the Tier 1 value. • High-security deployment (e.g., regulated infrastructure with full insider-threat consideration, or platforms exposing pulse-level access): Tier 3 covers arbitrary CPTP substitutions discriminable by Pauli measurements, but requires tightening the operational tolerance: at εA = 0.05 with δ = 0.5, the detection margin becomes γ ≈ 0.084 and the shot budget is approximately 1.4 × 105 shots. Beyond this, full process tomography (with O(42n ) cost) is the next level and is typically used for one-off certification rather than runtime monitoring. The framework’s structural guarantees (Theorem 1, Theorem 4, Corollary 2) carry over unchanged across tiers; only the constant C(OA ), the family size k, and (at Tier 3) the operational tolerance εA are updated. This is intentional: the choice of family is a deployment-time configuration, not a framework redesign, and a verifier can move between tiers as the threat model evolves.
References [1] Amira Abbas, David Sutter, Christa Zoufal, Aurelien Lucchi, Alessio Figalli, and Stefan Woerner. The power of quantum neural networks. Nature Computational Science, 1(6): 403–409, 2021. doi: 10.1038/s43588-021-00084-1. [2] Shaukat Ali, Tao Yue, and Rui Abreu. When software engineering meets quantum computing. Communications of the ACM, 65(4):84–88, 2022. doi: 10.1145/3512340. [3] Mohammad H. Amin, Evgeny Andriyash, Jason Rolfe, Bohdan Kulchytskyy, and Roger Melko. Quantum Boltzmann machine. Physical Review X, 8(2):021050, 2018. doi: 10.1103/ PhysRevX.8.021050. [4] Jacob Biamonte, Peter Wittek, Nicola Pancotti, Patrick Rebentrost, Nathan Wiebe, and Seth Lloyd. Quantum machine learning. Nature, 549(7671):195–202, 2017. doi: 10.1038/na ture23474. [5] Yudong Cao, Jonathan Romero, and Alán Aspuru-Guzik. Potential of quantum computing for drug discovery. IBM Journal of Research and Development, 62(6):6:1–6:20, 2018. doi: 10.1147/JRD.2018.2888987. [6] Ferhat Ozgur Catak, Jungwon Seo, and Umit Cali. Trustworthy quantum machine learning: A roadmap for reliability, robustness, and security in the NISQ era, 2025. 22 pages, submitted 4 November 2025. [7] M. Cerezo, Andrew Arrasmith, Ryan Babbush, Simon C. Benjamin, Suguru Endo, Keisuke Fujii, Jarrod R. McClean, Kosuke Mitarai, Xiao Yuan, Lukasz Cincio, and Patrick J.
50
Coles. Variational quantum algorithms. Nature Reviews Physics, 3(9):625–644, 2021. doi: 10.1038/s42254-021-00348-9. [8] Iris Cong, Soonwon Choi, and Mikhail D. Lukin. Quantum convolutional neural networks. Nature Physics, 15(12):1273–1278, 2019. doi: 10.1038/s41567-019-0648-8. [9] Oliver Dunn, Koorosh Aslansefat, and Yiannis Papadopoulos. Q-SafeML: Safety assessment of quantum machine learning via quantum distance metrics. In Model-Based Safety and Assessment — 9th International Symposium (IMBSA 2025), Lecture Notes in Computer Science. Springer, 2025. doi: 10.1007/978-3-032-05073-1 23. [10] Yuan Feng and Li Zhou. Refinement orders for quantum programs. arXiv preprint, 2025. doi: 10.48550/arXiv.2504.14158. URL https://arxiv.org/abs/2504.14158. [11] Joseph F. Fitzsimons and Elham Kashefi. Unconditionally verifiable blind quantum computation. Physical Review A, 96(1):012303, 2017. doi: 10.1103/PhysRevA.96.012303. [12] Andy J. Goldschmidt and Frederic T. Chong. Automatic pulse-level calibration by tracking observables using iterative learning. arXiv preprint, 2023. doi: 10.48550/arXiv.2304.12166. [13] Philippe Golle and Ilya Mironov. Uncheatable distributed computations. In Topics in Cryptology — CT-RSA 2001: The Cryptographers’ Track at the RSA Conference, volume 2020 of Lecture Notes in Computer Science, pages 425–440. Springer, 2001. doi: 10.1007/ 3-540-45353-9 31. [14] Vojtěch Havlı́ček, Antonio D. Córcoles, Kristan Temme, Aram W. Harrow, Abhinav Kandala, Jerry M. Chow, and Jay M. Gambetta. Supervised learning with quantum-enhanced feature spaces. Nature, 567(7747):209–212, 2019. doi: 10.1038/s41586-019-0980-2. [15] Ivan Henao, Jader P. Santos, and Raam Uzdin. Adaptive quantum error mitigation using pulse-based inverse evolutions. npj Quantum Information, 9(1):120, 2023. doi: 10.1038/s41534-023-00785-7. [16] Wassily Hoeffding. Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association, 58(301):13–30, 1963. doi: 10.1080/01621459.1963. 10500830. [17] Zhi-Yuan Hu, Saumya Patel, Weiwen Jiang, Jinjun Lin, and Yiyu Shi. Toward consistent high-fidelity quantum learning on unstable devices via efficient in-situ calibration. In Hausi Muller, Yuri Alexev, Andrea Delgado, and Greg Byrd, editors, Proceedings - 2023 IEEE International Conference on Quantum Computing and Engineering, QCE 2023, Proceedings - 2023 IEEE International Conference on Quantum Computing and Engineering, QCE 2023, pages 848–858. Institute of Electrical and Electronics Engineers Inc., 2023. doi: 10.1109/QCE57702.2023.00099. [18] Hsin-Yuan Huang, Richard Kueng, and John Preskill. Predicting many properties of a quantum system from very few measurements. Nature Physics, 16(10):1050–1057, 2020. doi: 10.1038/s41567-020-0932-7. 51
[19] Matthew Hutson. Artificial intelligence faces reproducibility crisis. Science, 359(6377): 725–726, 2018. doi: 10.1126/science.359.6377.725. [20] Tiancheng Jin and Jianjun Zhao. ScaffML: A quantum behavioral interface specification language for Scaffold. In 2023 IEEE International Conference on Quantum Software (QSW), pages 128–137. IEEE, 2023. doi: 10.1109/QSW59989.2023.00024. [21] Maxim O. Kalinin and Vasiliy M. Krundyshev. Security intrusion detection using quantum machine learning techniques. Journal of Computer Virology and Hacking Techniques, 19(1): 125–136, 2023. doi: 10.1007/s11416-022-00435-0. [22] Satwik Kundu and Swaroop Ghosh. SoK paper: Security concerns in quantum machine learning as a service. In Proceedings of the International Workshop on Hardware and Architectural Support for Security and Privacy 2024 (HASP ’24), pages 28–36, Austin, TX, USA, November 2024. ACM. ISBN 979-8-4007-1221-0. doi: 10.1145/3696843.3696846. [23] Seungkwon Lee, Seok Bin Son, Joongheon Kim, and Hoh Peter In. zkQML: Verifiable and privacy-preserving inference for quantum machine learning (student abstract). In Proceedings of the 40th AAAI Conference on Artificial Intelligence (Student Abstract and Poster Program), Singapore, jan 2026. doi: https://doi.org/10.1609/aaai.v40i48.42232. [24] Haoran Liao, Ian Convy, William J. Huggins, and K. Birgitta Whaley. Robust in practice: Adversarial attacks on quantum machine learning. Physical Review A, 103(4):042427, 2021. doi: 10.1103/PhysRevA.103.042427. [25] Yanling Lin, Ji Guan, Wang Fang, Mingsheng Ying, and Zhaofeng Su. VeriQR: A robustness verification tool for quantum machine learning models. In Formal Methods — 26th International Symposium (FM 2024), volume 14933 of Lecture Notes in Computer Science, pages 403–421. Springer, 2025. doi: 10.1007/978-3-031-71162-6 21. [26] Barbara H. Liskov and Jeannette M. Wing. A behavioral notion of subtyping. ACM Transactions on Programming Languages and Systems, 16(6):1811–1841, November 1994. doi: 10.1145/197320.197383. [27] Sirui Lu, Lu-Ming Duan, and Dong-Ling Deng. Quantum adversarial machine learning. Physical Review Research, 2(3):033212, 2020. doi: 10.1103/PhysRevResearch.2.033212. [28] Gabrielle MacNeil, Sandeep Sunkavilli, and Qiaoyan Yu. Authenticating quantum circuits through localized noise fingerprints. In Proceedings of the 2025 Quantum Security and Privacy Workshop. ACM, 2025. doi: 10.1145/3733825.3765283. [29] Urmila Mahadev. Classical verification of quantum computations. In Proceedings of the 59th IEEE Annual Symposium on Foundations of Computer Science (FOCS), pages 259–267. IEEE, 2018. doi: 10.1109/FOCS.2018.00033. [30] Bertrand Meyer. Applying “design by contract”. IEEE Computer, 25(10):40–51, 1992. doi: 10.1109/2.161279.
52
[31] Allen Mi, Shuwen Deng, and Jakub Szefer. Short paper: Device- and locality-specific fingerprinting of shared NISQ quantum computers. In Proceedings of the 10th International Workshop on Hardware and Architectural Support for Security and Privacy (HASP ’21), pages 1–6. ACM, 2022. doi: 10.1145/3505253.3505261. [32] Andriy Miranskyy, Lei Zhang, and Javad Doliskani. Is your quantum program bug-free? In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: New Ideas and Emerging Results, pages 29–32. ACM, 2020. doi: 10.1145/3377816.3381731. [33] Kosuke Mitarai, Makoto Negoro, Masahiro Kitagawa, and Keisuke Fujii. Quantum circuit learning. Physical Review A, 98(3):032309, 2018. doi: 10.1103/PhysRevA.98.032309. [34] Juan M. Murillo, Jose Garcia-Alonso, Enrique Moguel, Johanna Barzen, Frank Leymann, Shaukat Ali, Tao Yue, Paolo Arcaini, Ricardo Pérez-Castillo, Ignacio Garcı́a-Rodrı́guez de Guzmán, Mario Piattini, Antonio Ruiz-Cortés, Antonio Brogi, Jianjun Zhao, Andriy Miranskyy, and Manuel Wimmer. Quantum software engineering: Roadmap and challenges ahead. ACM Transactions on Software Engineering and Methodology, 34(5):1–48, 2025. doi: 10.1145/3712002. [35] Vincent Mutolo, Devon Campbell, Quinn Manning, Henri Witold Dubourg, Ruibin Lyu, Simha Sethumadhavan, Dan Rubenstein, and Salvatore Stolfo. Quantum computer fingerprinting using error syndromes. arXiv preprint, 2025. doi: 10.48550/arXiv.2506.16614. [36] Michael A. Nielsen and Isaac L. Chuang. Quantum Computation and Quantum Information: 10th Anniversary Edition. Cambridge University Press, 2010. doi: 10.1017/CBO978051197 6667. [37] Filippo Scaramuzza, Renato Cordeiro Ferreira, Tomaz Maia Suller, Giovanni Quattrocchi, Damian Andrew Tamburri, and Willem-Jan van den Heuvel. “show me you comply. . . without showing me anything”: Zero-knowledge software auditing for AI-enabled systems. arXiv preprint, 2025. doi: 10.48550/arXiv.2510.26576. URL https://arxiv.org/abs/25 10.26576. [38] Maria Schuld and Nathan Killoran. Quantum machine learning in feature Hilbert spaces. Physical Review Letters, 122(4):040504, 2019. doi: 10.1103/PhysRevLett.122.040504. [39] Maria Schuld, Alex Bocharov, Krysta M. Svore, and Nathan Wiebe. Circuit-centric quantum classifiers. Physical Review A, 101(3):032308, 2020. doi: 10.1103/PhysRevA.101.032308. [40] John Watrous. The Theory of Quantum Information. Cambridge University Press, 2018. doi: 10.1017/9781316848142. [41] Maxwell T. West, Sarah M. Erfani, Christopher Leckie, Martin Sevior, Lloyd C. L. Hollenberg, and Muhammad Usman. Benchmarking adversarially robust quantum machine learning at scale. Physical Review Research, 5(2):023186, 2023. doi: 10.1103/PhysRevResea rch.5.023186.
53
[42] Jindi Wu, Tianjie Hu, and Qun Li. Q-ID: Lightweight quantum network server identification through fingerprinting. IEEE Network, 38(5):146–152, 2024. doi: 10.1109/MNET.2024.34 00893. [43] Chhavi Yadav, Evan Monroe Laufer, Dan Boneh, and Kamalika Chaudhuri. ExpProof: Operationalizing explanations for confidential models with ZKPs. In Proceedings of the 42nd International Conference on Machine Learning (ICML), volume 267 of PMLR, 2025. doi: 10.48550/arXiv.2502.03773. URL https://arxiv.org/abs/2502.03773. [44] Masaomi Yamaguchi and Nobukazu Yoshioka. Design by contract framework for quantum software. In 2023 IEEE/ACM 4th International Workshop on Quantum Software Engineering (Q-SE), pages 24–25, 2023. doi: 10.1109/Q-SE59154.2023.00010. [45] Esra Yeniaras and Muhammad Amin Karimov. QCIVET: Contract-based integrity verification for hybrid quantum-classical pipelines, 2026. URL https://arxiv.org/abs/2605.1 3109.
54