An End-to-End Threat Model for the Quantum-as-a-Service Pipeline

arXiv:2608.05836v1 [cs.CR] 6 Aug 2026

An End-to-End Threat Model for the Quantum-as-a-Service Pipeline Badhon Rahman

Majid Haghparast

Tommi Mikkonen

Faculty of Information Technology University of Jyväskylä Jyväskylä, Finland badhon.b.rahman@jyu.fi

Faculty of Information Technology University of Jyväskylä Jyväskylä, Finland majid.m.haghparast@jyu.fi

Faculty of Information Technology University of Jyväskylä Jyväskylä, Finland tommi.j.mikkonen@jyu.fi

Abstract—Cloud-based accessing of Quantum-as-a-Service (QaaS) platforms such as IBM Quantum, IonQ Cloud, and Amazon Braket is becoming popular day by day. Hybrid quantumclassical algorithms (VQE, QAOA, QML) transfer data via a long layered pipeline of orchestration, compilation, and execution. Recent works have demonstrated various critical attacks at individual stages: Calibration tampering, SWAP attacks, QubitHammer, and so on. However, these attacks remain separated because of their own terminology, and existing STRIDE-based threat modeling in the context of quantum lacks a structured view towards the QaaS stack itself. We address this concern by decomposing the workflow into six-stage model with STRIDE threat modeling. Our matrix demonstrated attack vectors in quantum-specific, inherited classical, and plausible tiers for each of the stages. We further investigate the underexplored sections (repudiation and elevation-of-privilege) and distinguish three different cross-stage attack chains with higher impacts. Index Terms—Quantum Computing, Quantum Security, Quantum Software Security, Threat Modeling, STRIDE, Multi-Tenant.

I. I NTRODUCTION Quantum computers are increasingly being used as a cloud service. Platforms like IBM Quantum, Amazon Braket, and IonQ Cloud expose the quantum processors behind classical APIs. The current working process of quantum computation is also hybrid. Now, a client designs and simulates their circuits from a classical device, transmits towards a quantum hardware as a job, after execution delivers the measurement output and updates the parameters. Hybrid algorithms such as VQE, QAOA, and QML follow the same process pattern. This hybrid architecture introduces various novel attack exposures across orchestration layers and the classical-quantum interface [1]. This complete pipeline is a rich attack surface for critical exposures. Recent research work has demonstrated diverse threats in this multi-tenant environment. Such as SWAP attack [10], QubitHammer [11], Inverse-transpilation [12], parameter and measurement tampering by untrustworthy vendors [17], calibration tampering via DoS [4], pulse-level abuse, and many more. However, these attacks remain siloed. Each of these attacks is demonstrated under its own terminology. For instance, SideThis work has been supported by the Business Finland through project SeQuSoS (Grant No. 112/31/2024), and Research Council of Finland through project Profi 8 - qSIME (Grants No. 365343).

channel and Fault-injection attacks cannot be placed under a common map. Therefore, in this poster, we presented a six-stage STRIDE threat model for the long QaaS pipeline showcases attack vectors for each stage and investigated underexplored sections. A unified attack-surface map of the QaaS pipeline is shown as a result. II. BACKGROUND AND R ELATED W ORK STRIDE [7] [8] threat model break downs threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. In prior threat modeling work, Lee and Tan [2] employ STRIDE/PASTA to the universal Cyber Physical System (CPS) that is exposed to quantum cryptanalysis. Baseri et al. [3] applied STRIDE for the quantum-induced attacks on classical cryptography. Neither of these focuses on the quantum cloud service itself. Furthermore, recent studies Swaroop et al. [4], Samuel et al. [5], and Justin et al. [9] have listed attack vectors within the hardware and environment, but without a unified threat model. Our prior work [6] classified Quantum Software Engineering (QSE) security challenges has identified this gap; this study operationalizes and provides structured threat modeling. Eventually, no previous study with a unified service-level threat model was found for the quantum cloud stack. III. T HREAT M ODELING We have designed and divided our hybrid quantum-classical model into 6 stages: S1 - Developer Environment: Local circuit simulation with an SDK (Qiskit, Cirq, Q#, Qrisp). S2 - Authentication & Submission: API token, SDK calls, IAM (Identity and Access Management). S3 - Cloud Orchestration & Compilation: Queue, scheduling, transpiler. S4 - Quantum Hardware Execution: QPU with calibration of metadata, pulse-level control, in multi-tenant. S5 - Result Return Path: Measurements, error mitigation, and post-processing. S6 Hybrid Iteration Loop: Repeating the workflow from S2 to S5. IV. R ESULTS Table I depicts the STRIDE-based threat modeling with our six different defined stages of the hybrid quantum-classical model.

TABLE I STRIDE- BASED THREAT MODELING WITH P IPELINE -S TAGE T HREAT M ATRIX . O RANGE CELLS INDICATE PUBLISHED ATTACKS , LIGHT BLUE CELLS ARE INHERITED CLASSICAL ATTACK VECTORS , AND LIGHT GREEN CELLS INDICATE PLAUSIBLE BUT UNDER - STUDIED THREATS . S1 Dev. S2 Auth S3 Compile S4 QPU

S5 Return S6 Loop

Spoofing Compromised SDK / typosquatted dependency Token theft, IAM impersonation Compiler service spoof

Tampering Malicious SDK extension / IDE plugin In-flight circuit modification Untrusted compiler injects [4] – SWAP Attack [10]; QubitHammer [11]; Pulse abuse [14] Result-source spoof Measurement tampering [17] Spoofed optimizer end- Iterative param tamper point [17]

Repudiation –

Info. disclosure Local circuit / key leak

Denial of service Local exhaustion

Elev. of priv. –

Weak QPU job audit

Network eavesdropping

Quota / queue flood

IAM role escalation

–

Inverse-transpile [12]; Scheduler abuse, transpile QML theft [16] starvation [4] No verifiable execution Passive SWAP [10]; Power Calibration tampering [4] log Side-Channel [13]

Malicious pass Pulse-Level abuse [14]

No result chain

–

Per-iter audit gap

Throughout the stages, three Cross-stage attack chains are available and expose one valuable question: which stage combinations compose into higher impact attacks? Chain A (Sidechannel identification → Targeted crosstalk): Passive SWAP or controller power side-channel attacks at S4 reveal victim’s circuit fingerprint (ansatz, gate information), and an adversary can implement QubitHammer/SWAP attack. Chain B (Calibration topology → Targeted pulse placement): Publicly exposed information (coupling map / Data) at S4, lets an adversary plan and place qubits, combining with on-device frequency sweep, supplying the parameters QubitHammer needed without observing victim’s circuit. Chain C (Compiler IP leak → Transpile-stable Trojan): Inverse-tranpilation at S3 discloses the compiler’s optimization information, letting an adversary craft Trojan insertions that bypass known optimizations and turn into active S3 tampering. V. C ONCLUSION Our work presented a six-stage STRIDE threat model for the QaaS pipeline, demonstrated an organized quantumspecific, inherited classical, and plausible attack vectors into a single structure matrix. We further analyzed the underexplored section (repudiation and elevation-of-privilege) and characterized three cross-stage attack chains that compose stage local capabilities into higher impact threats. R EFERENCES [1] J. M. Murillo et al., “Quantum Software Engineering: Roadmap and Challenges Ahead,” ACM Transactions on Software Engineering and Methodology, Jan. 2025, doi: https://doi.org/10.1145/3712002. [2] C. C. Lee, T. G. Tan, V. Sharma, and J. Zhou, “Quantum Computing Threat Modelling on a Generic CPS Setup,” Lecture Notes in Computer Science, pp. 171–190, 2021, doi: https://doi.org/10.1007/978-3-03081645-2 11. [3] Y. Baseri, A. Hafid, and L. A. Habibi, “Future-Proofing Cloud Security Against Quantum Attacks: Risk, Transition, and Mitigation Strategies,” arXiv.org, 2025. https://arxiv.org/abs/2509.15653 [4] S. Ghosh, S. Upadhyay, and A. Ash Saki, “A Primer on Security of Quantum Computing Hardware,” Proceedings of the IEEE, vol. 113, no. 7, pp. 640–667, Jul. 2025, doi: https://doi.org/10.1109/jproc.2025.3630989. [5] S. Ovaskainen, M. Haghparast, and T. Mikkonen, “Quantum Software Security Challenges Within Shared Quantum Computing Environments,” 2025 IEEE International Conference on Quantum Computing and Engineering (QCE), pp. 68–72, Aug. 2025, doi: https://doi.org/10.1109/qce65121.2025.10296.

Output stats leak via post- Channel flood processing Trained-parameter Convergence stall [17] extraction [16]

compiler access

–

[6] B. Rahman, M. Haghparast, and T. Mikkonen, “Classification of security challenges and mitigation approaches in the quantum software engineering,” Journal of Systems and Software, vol. 238, p. 112884, Aug. 2026, doi: https://doi.org/10.1016/j.jss.2026.112884. [7] R. Khan, K. McLaughlin, D. Laverty, and S. Sezer, “STRIDE-based threat modeling for cyber-physical systems,” IEEE Xplore, Sep. 01, 2017. https://ieeexplore.ieee.org/document/8260283 [8] S. M. Khalil, H. Bahsi, and T. Korõtko, “Threat modeling of industrial control systems: A systematic literature review,” Computers & Security, vol. 136, p. 103543, Jan. 2024, doi: https://doi.org/10.1016/j.cose.2023.103543. [9] J. Coupel and T. Farheen, “Security Vulnerabilities in Quantum Cloud Systems: A Survey on Emerging Threats,” arXiv.org, 2025. https://arxiv.org/abs/2504.19064 [10] L. Wei, S. Wang, S. Dutta, M. W. El, and A. Chattopadhyay, “SWAP Attack: Stealthy Side-Channel Attack on Multi-Tenant Quantum Cloud System,” arXiv.org, 2025. https://arxiv.org/abs/2502.10115 (accessed May 26, 2026). [11] Y. Tan, N. Choudhury, K. Basu, and J. Szefer, “QubitHammer: Remotely Inducing Qubit State Change on Superconducting Quantum Computers,” arXiv.org, 2025. https://arxiv.org/abs/2504.07875 (accessed May 26, 2026). [12] S. Kundu and S. Ghosh, “Inverse-Transpilation: Reverse-Engineering Quantum Compiler Optimization Passes from Circuit Snapshots,” Proceedings of the Great Lakes Symposium on VLSI 2025, pp. 273–277, Jun. 2025, doi: https://doi.org/10.1145/3716368.3735298. [13] C. Xu, F. Erata, and J. Szefer, “Exploration of Power Side-Channel Vulnerabilities in Quantum Computer Controllers,” Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, Nov. 2023, doi: https://doi.org/10.1145/3576915.3623118. [14] C. Xu and J. Szefer, “Security Attacks Abusing Pulse-level Quantum Circuits,” 2025 IEEE Symposium on Security and Privacy (SP), pp. 222–239, May 2025, doi: https://doi.org/10.1109/sp61157.2025.00083. [15] S. Das and S. Ghosh, “Secure Quantum Circuit Compilation Methodology for Untrusted Compilers,” 2025 IEEE International Conference on Quantum Computing and Engineering (QCE), pp. 2191–2201, Aug. 2025, doi: https://doi.org/10.1109/qce65121.2025.00239. [16] A. Ghosh and S. Ghosh, “The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models,” Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security, pp. 48–57, Nov. 2024, doi: https://doi.org/10.1145/3689939.3695783. [17] S. Upadhyay and S. Ghosh, “Trustworthy and reliable computing using untrusted and unreliable quantum hardware,” Frontiers in Computer Science, vol. 6, Aug. 2024, doi: https://doi.org/10.3389/fcomp.2024.1431788.

Related documents

• A Scenario-Based Evaluation of CRQC+AI Vulnerability Spectrum for TLS 1.3 Cryptographic Dependencies#984232
• A log-depth in-place quantum Fourier transform that rarely needs ancillas#1110088
• The Role of Quantum Computing in Cloud Security#707498
• Where quantum and quantum-like methods earn their place in behavioural-trial analysis: three simulation pilots across the RCT pipeline#1035677
• Qexploit#1133652