Quantum computing security at QCE26 turned to the side doors

This guide follows 33 security talks at IEEE Quantum Week 2026 in Toronto. Most probed the quantum computer itself, and a smaller group priced the move to post-quantum codes.

In 1994 Peter Shor showed that a big enough quantum computer could pick the lock on most of the public-key encryption that guards the internet. Three decades later, on the Sunday of IEEE Quantum Week 2026 in Toronto, a workshop on quantum computing security spent the day on the reverse problem. Speaker after speaker treated the quantum computer as the house to be burgled. Few tried the famous lock. Most went in through the side doors, the ordinary electronics and files that keep the qubits running.

Shor’s lock is still the first job of the field. Methods such as RSA are safe only because finding the prime factors of a huge number takes ordinary computers far too long, and Shor’s algorithm makes that quick. No machine is close to running it at that scale, but data taken now could be read later. So in 2024 the US standards body NIST published its first post-quantum codes, which run on normal computers and rest on problems thought hard even for quantum machines.

The second job is newer, and it is where the evidence in Toronto pointed. A quantum chip sits inside a stack of ordinary parts, from control electronics and calibration files to cloud schedulers and the decoders that fix its errors, and each was built for speed with little thought for hostile users. This guide follows 33 talks on both jobs from IEEE Quantum Week 2026, known as QCE26. Read together, they argue that the weakest part of a quantum computer is the ordinary computing wrapped around its qubits, and that attackers and defenders should both look there first.

The case against that view is serious, and the Sunday workshop gave it room. Qubits on one chip disturb their neighbours, an effect called crosstalk. Haruki Nakayama of Systems Engineering Consultants had a hostile user fire repeated gates beside a victim’s qubits on a real machine. Evan Anderson measured effects reaching past the nearest qubits on IQM’s Emerald chip, though distant hits were far rarer on IBM’s Fez. On a shared chip that leak would matter. Yet Jakub Szefer of Northwestern said that, as of 2026, no provider publicly runs several users on one chip at once, so every crosstalk attack assumes a set-up that nobody yet offers.

The side doors need no shared chip. Xinyi Li of Stevens showed in simulation that tampering with 6.4 percent of a decoder’s error statistics, which it reads from calibration files, raised the logical error rate 3.35 times. Shin Nishio of UCL showed that on a future error-corrected machine the error checks alone could give away which gates are running. Anthony Etim and Szefer hit the neural network in a controller on a test board with voltage glitches.

Archisman Ghosh of Penn State went further and, in simulation, rebuilt a cloud machine’s map of weak qubits from nothing more than the compiled circuits it hands back. Qiaoyan Yu of the University of New Hampshire, who opened the workshop, called attacks on the link between chip and control the most mature part of the field.

Quantum networks showed the same habit of walking round the physics. Ali Hamza Malik of UMass Amherst found a missing timing check in the written rules for the classical side of key distribution. Muhammad Ismail of Tennessee Tech named a network’s protocol from a passive tap on its fibre. Neither attack broke the physics. Both came in through the timing rules and the fibre that the quantum physics of key distribution depends on, which no theorem protects.

Strangely, the field most worried about quantum code-breaking has built machines that trust every one of their own parts, from the first line of a user’s job to the last pulse sent into the fridge. Szefer told the Sunday panel that every part of the machines now running, from controller to qubits, is simply trusted. No step of job submission checks a fingerprint of what really runs. That is the habit of a lab, where every user is a colleague, carried into cloud services that sell time to strangers. The side doors these talks found were opened in simulation and on test boards, well before anyone shares a chip, which makes this the cheapest moment to close them.

The older half of the subject has moved further. Matthew Chou of Illinois could say which new web certificates cost a connection an extra round trip, and a Middle Tennessee team priced the switch for a hospital’s archive of scans in gigabytes and hours. Post-quantum migration has become an engineering bill that can be priced line by line, and Shor’s lock is now the better-guarded door.

Attacks through a shared quantum chip

Crosstalk is the attack most people picture first, because qubits on one chip disturb their neighbours. Three talks asked whether one user could spy on, or spoil, another user’s work that way.

Anderson asks whether computing can be hidden from a neighbour

Evan Anderson, now a postdoc at the University of Maryland, College Park, presented work from their PhD with Kaushik Datta and their advisor Boulat Bash of the University of Arizona. The question is whether a user can compute on a shared chip without a watcher, who holds the other qubits, being able to tell that any computing is going on at all. Chips are not shared this way today. Anderson expects it once demand outgrows the number of machines.

The watcher listens with a spare qubit. Its frequency shifts when the neighbours are busy, and on IQM’s 54-qubit Emerald a qubit beside a chain of gates moved by 12.73 kilohertz, enough to detect. On IBM’s Fez, neighbours picked it up 54 to 83 percent of the time. Theory said a ring of idle qubits would hide the work, but Emerald picked up effects past the nearest neighbours, and the team marked one hit three hops out. Anderson blamed stray magnetic flux.

Nakayama finds crosstalk reaches only next door on one machine

Haruki Nakayama of Systems Engineering Consultants, with co-authors from that firm and the University of Osaka, studied chips that run several users’ circuits side by side to keep the machine busy. On a real chip, a hostile user fired repeated two-qubit gates beside a victim. The team then timed how long the victim’s qubits held their state. Each attack was set against an idle run of the same length, so that normal decay was not taken for harm.

One measure of qubit life showed no change at all, and the other fell only on qubits right next to the attacker, which suggests the harm stays local on that machine. So the team added a buffer rule to an open-source toolchain called OQTOPUS, which keeps a gap of unused qubits between users. On a 64-qubit grid it still fitted 100 small random circuits into 12 batches. The team did not name the machine.

Northwestern shows a bad reset can leak between jobs

Jakub Szefer of Northwestern University, who runs a computer security lab there, opened a two-part tutorial on attacks against quantum computers themselves. A job travels from the user’s compiler through the cloud to racks of control electronics. It leaves them as analogue pulses that nobody can encrypt or sign. Szefer cited a 2022 attack in which a rogue circuit cut a small search’s right answer from 0.83 to 0.57 on an IBM machine, and later work that found effects up to six steps away.

Szefer’s group found another gap in reset. IBM’s reset measures a qubit and flips it if needed, and Szefer’s group showed it fails for qubits pushed into higher energy levels, which dropped a following search from about 0.83 to about 0.02. Their Cascading Secure Reset steps each level down in turn. It brought the result back to about 0.89.

Trusting the cloud machine

Most people reach a quantum computer through a cloud service they cannot inspect, so the provider is the first party a user must trust. Seven talks asked what a user can check, what an insider could see and what a trained model gives away.

Columbia fingerprints a machine by its error patterns

Vincent Mutolo of Columbia University gave paper 912. The co-authors were Devon Campbell, Quinn Manning, Henri Dubourg, Ruibin Lyu, Simha Sethumadhavan, Dan Rubenstein and Salvatore Stolfo. Mutolo worries that a cloud firm could quietly run a job on a cheaper machine than the one paid for, at about 96 dollars a minute. Error correction already reads out short strings of bits that flag where errors hit, and these carry each chip’s quirks at no extra cost, Mutolo argued.

On five IBM machines, each held out in turn as an impostor, one short test four days after sign-up scored 0.918. It wrongly turned away the honest machine 5 percent of the time. At worst it let an impostor through 8.2 percent of the time. Tests must change after about 128 shots, or an attacker can learn and replay them, and Mutolo expects trouble on atom and ion machines, which have no fixed layout.

City College breaks a scheme to hide QAOA circuits

Christian Rasmussen, a PhD student in Samah Saeed’s lab at the City College of New York, worked with Donald Lushi of the CUNY Graduate Center. They attacked OpaQue. That scheme hides a circuit from a nosy cloud insider by adding pairs of turns that cancel out and bit flips that are undone later. Their test case was QAOA, a method for finding good answers that uses one angle on every edge of the problem and another on every qubit.

A classifier first named QAOA from the compiled circuit 96.9 percent of the time on IBM’s heavy-hex layout. Then the hiding trick unravelled. Because QAOA repeats one angle everywhere, the leftover turns gave away which qubits had been flipped, which cut the hidden answers from a number that doubles with every qubit to just two mirror images. Someone in the room said such schemes should be called heuristic, since a provable one would not fall this way.

SoteriaQ hides control pulses among decoys

The paper’s first author is Theodoros Trochatos, writing with Chuanqi Xu, Sanjay Deshpande, Yao Lu, Yongshan Ding and Jakub Szefer. The threat is a snooping cloud firm. It watches the control lines that run into the fridge, while the fridge itself counts as safe, since opening it would be noticed at once.

A compiler fills gaps in the circuit with decoy pulses, and a bitmap tells hardware inside the fridge which pulses to weaken before they reach the qubits. The price is a shift in the output. On IBM’s 7-qubit Perth it reached 21 percent with perfect switches and 25 percent with leaky ones.

IBM hides Shor’s answer from an insider in the room

Charanjit Jutla of IBM Research, writing with Ehud Aharoni and Nathan Manohar, set out what Jutla called the quantum room adversary. Picture a cloud data centre. The machine sends its gate signals down and its results up as plain pulses, and an insider in the room could read some of them. Jutla assumed an honest firm that runs only signed jobs, and let the insider make extra readings, such as 10 percent of the qubits at 50 percent fidelity.

Plain Shor’s algorithm would show such an insider the answer. Jutla’s fix is to multiply the input by a secret key first, so that only the key holder can strip it from the output. Under what Jutla called a mild maths assumption, a huge number of candidate answers remain even if half the key leaks. Jutla set aside full quantum encryption as far too costly.

Penn State rebuilds a simulated backend’s error map from returned circuits

Archisman Ghosh of Pennsylvania State University presented with Subrata Das and Swaroop Ghosh. A user cannot check which device or which qubits ran a job. On one day in December 2025, five IBM Heron processors spread about 2.1 times in median two-qubit error and 6.9 times in readout error, so a provider could quietly send jobs to the noisy end of that range, Ghosh argued.

The clue is the compiler. Noise-aware routing steers round bad couplings, and that choice shows in the circuit handed back. The team trained a graph neural network on pools of compiled circuits from four simulated 27-qubit IBM backends built from real calibrations, then tested it on a fifth. It ranked that backend’s qubits with a rank correlation of 0.98 and its couplings with 0.96, and found about nine of the ten worst qubits. Real hardware and other vendors are left for later.

TU Wien hides a graph’s edges at almost no cost in accuracy

Patrick Indri of TU Wien asked how to protect the links in a graph, such as a friendship in a social network. The encoding uses one qubit for each possible edge. Indri’s aligned noise is built so that flipping one edge moves only a chosen set of terms in the state, while uniform noise shrinks every term alike. Both give the same privacy.

On a quantum graph classifier at a noise level of 0.20 with 32 shots, the aligned noise stayed near the no-noise ceiling at every strength tested. The uniform noise started near the coin-flip baseline of one half and climbed only later.

A panel asks whether quantum computers can be trusted

JR Rao of IBM Research chaired a panel of Jakub Szefer, Zhu Han of the University of Houston, Samuel Chen of Wells Fargo and Nathan Manohar of IBM Research. Public talk about quantum security centres on post-quantum codes, Rao said, while the workshop papers treat the machine itself as the thing to secure. Szefer said every part of today’s machines, from controller to qubits, is simply trusted. Chen warned that the AI that now tunes circuits could be poisoned.

Manohar said error correction fixes any error up to a limit, whether it comes from random noise or from a malicious user, so a serious attacker would aim for damage past that limit. Manohar wants real models of attackers. Planning for an all-powerful one, Manohar argued, leads to schemes too costly to build. Szefer added that no step of job submission now checks a fingerprint of what really runs.

Controllers, decoders and calibration files

These are the side doors proper. A quantum processor leans on ordinary electronics and software at every step, from the rack that shapes its pulses to the decoder that reads its errors, and nine talks looked at those parts. Most of the attacks among them never touched a qubit.

The workshop keynote sorts the open problems

Qiaoyan Yu of the University of New Hampshire, a programme director at the US National Science Foundation from 2024 to 2026, opened the Sunday workshop. Yu stressed that their views were their own. Proposals on quantum hardware security at the NSF grew three to five times in three years, Yu said, and Yu called attacks on the link between chip and control the most mature part of the field.

Their own group attacked readout, the step where a sensor’s signal is sorted into 0 or 1. An attacker with access to the firmware adds a small offset to the calibration samples for 0, which moves the boundary by half that offset, so some true 1s are read as 0 and each new calibration makes it worse. Yu expects this to come through physical access more than through malware.

Stevens poisons a decoder’s priors

Xinyi Li of Stevens Institute of Technology, with co-authors Yifeng Peng, Juntao Chen and Ying Wang, attacked an error-correction decoder through its priors, the odds it takes from calibration data to judge which fix is most likely. A bad calibration file changes the odds. The decoder’s code stays the same, so a normal check sees nothing wrong.

In simulated runs, a few entries mattered far more than the rest. Raising the odds tenfold on the 100 that mattered most, 6.4 percent of the total, lifted the logical error rate 3.35 times, against 1.38 times for 100 picked at random. Their defence, PriorGuard, checks each update against a private set of trusted data in under 2 milliseconds.

A voltage glitch aimed at a neural controller

The paper is by Anthony Etim and Jakub Szefer. The target is a neural network in the rack outside the fridge that either corrects readout or picks an error fix, so the attacker never touches a qubit. Both networks ran on a small Cortex-M4 chip. A ChipWhisperer Husky fired one voltage glitch per trial.

On a readout network for five qubits, the best target was an early layer of the network, with 27 working glitches in 96 trials. Later layers often shrugged faults off. Spoiling accuracy was easier than forcing a chosen answer, though a single glitch could pin one learned decoder to a single fixed action.

UCL reads the hidden circuit from the error stream

Shin Nishio of UCL presented paper 1157 with Shashvat Shukla and Dan Browne. Their decoder is honest but curious. It returns valid fixes, while the stream of error checks it sees points at the hidden circuit the user is running.

From that stream alone, the Hadamard gate was named 867 times in 1,000 and the two-qubit CX gate 919 times. Repeated blocks made guessing easier, and a running count of gates can hint at the algorithm itself, so Nishio wants the error stream treated as sensitive data.

A curious decoder can tell HHL from the Fourier transform

A researcher from a project that includes University College London took the same threat further at PRQAI on Tuesday. A logical qubit is spread across many physical ones, nine in a small surface code. Repeated checks, called syndrome measurements, show where errors hit. The decoder that reads them runs all the time, and here it is honest but curious, fixing errors faithfully while it tries to learn the user’s program.

Each logical gate leaves its own mark. A Hadamard gate swaps how two kinds of error show up, and a CNOT even shows which patch is the control. In simulation a simple classifier told Hadamard, phase and CNOT gates apart well, though X, Y and Z gates were hard to separate. Stacked over time, the guessed gates followed each algorithm closely enough to tell HHL from the quantum Fourier transform, and the speaker proposed standard decoder interfaces, such as QECi, so that what a decoder receives can be audited.

Power traces reveal which circuit is running

Szefer’s second session went back to the controller. This rack of electronics turns a circuit into microwave pulses. Physical access is more likely now that machines sit on campuses and in hospitals, Szefer said. In simulations built from IBM’s published pulse data, the power trace named which test circuit was running about 90 percent of the time, even with noise added.

The traces show the gates that join two qubits and hide the angles of the rest, so an attacker learns a circuit’s shape without its trained settings. Their group’s newer work did the same for future machines that correct their own errors. It found nearly every routine in 20 test programs. Szefer added that another group’s attack has since weakened the decoy shield their group built, and a new design is on the way.

Szefer finds the secrets of quantum machine learning sit in the controllers

Szefer came back on Tuesday to PRQAI, a workshop on privacy and robustness in quantum AI, and argued that security for quantum machine learning should start with the classical controllers. Those boards hold the secrets. The input data, the trained settings, the algorithm and the outputs all pass through them in classical form. Today, loading data mostly means writing it into the circuit itself.

A timing leak, meaning which qubits fire and when, is enough to name the ansatz, the circuit shape that an optimiser tunes. The trained angles are harder to recover. Szefer then turned to HERQULES, a five-layer neural network that sorts qubit readout signals, where a fault in any layer can flip the result. Closing questions came back to that boundary, since a medical result spoiled on its way out is the wrong input to whatever decision follows.

Red-teaming a chemistry algorithm

Ahmed Azaz Humdoon of the University of Central Florida, with co-authors Cheng Chu, Lei Jiang, Qian Lou and Mengxin Zheng, red-teamed VQE. That method passes results back and forth between a quantum and a normal computer to find a molecule’s energy. Humdoon ran seven attacks. All of them used one test plan, two tiny molecules and IBM simulators that copy the noise of real chips.

The strongest hit zero-noise extrapolation, a fix that runs a circuit at extra noise and works back to zero, and raised the energy error 8.84 times. A hidden backdoor in the circuit came next at 7.52 times. Humdoon listed the small molecules and single runs as limits.

Jyväskylä counts the security scores that exist

Tommi Mikkonen of the University of Jyväskylä, writing with Badhon Rahman and Majid Haghparast, described a background in software and no expertise in security. Mikkonen follows the path a job takes. It runs from a laptop to a cloud quantum computer, and along it there are plenty of scores for how well devices run but few for how safe they are.

Mikkonen listed thirteen measures that could be used, of which three are in use. Eight could be adapted from other fields, two are only proposed so far, and only keeping data secret has a tool behind it, while the least studied is accountability, meaning who did what and when.

Attacks on the classical side of key networks

Quantum key distribution is safe in theory, because measuring a quantum signal disturbs it. Five talks looked hard at the plain messages and kit around that signal, where the theory offers no such protection.

UMass finds a missing timing check

Ali Hamza Malik, a PhD student at UMass Amherst, gave paper 302 with Raja Hasnain Anwar and Muhammad Taqi Raza. Key networks still lean on plain messages to sort bits and check errors. So the team tested the written rules with a tool called Tamarin, against an attacker who may delay, drop or replay any message but cannot fake a signed tag.

The model found nine weaknesses. Malik walked through one, a missing check that photon arrival times line up, which lets the receiver announce settings too early. The attacker keeps half of each entangled pair, waits, measures in the right setting and sends a fresh stream on. In four noiseless simulator trials the attack still passed the standard entanglement test.

Tennessee Tech names the protocol from a fibre tap

Muhammad Ismail of Tennessee Tech gave paper 314. Its first author is Lance Young, a master’s student in their lab, with Contessa Wilburn, Carrie Houston, Blaine Keyton, Marwan Elawady and Mohamed Shaban. A passive tap on the fibre asks which protocol is running, and it never makes the direct measurement that would disturb the quantum state.

A tap that took 30 percent of the light let a trained network name the protocol 96.18 percent of the time. At 10 percent it still managed 87.5 percent. The standard entanglement test read above 2 throughout, at 2.324 with the heavier tap against 2.347 with none, so it raised no alarm.

Tennessee Tech reads the stage of a login

Ismail stayed on for paper 220, with Marwan Elawady as first author and the same team. The target was a quantum login. Checking photons are mixed into the data on a schedule that only the two ends should know, and a tap tried to tell which stage was on the fibre at each moment.

A simple classifier did best. Timing traces at the 30 percent tap gave 92.77 percent accuracy, and even at 10 percent it was 90.18. Ismail said again that the heavy tap leaves the entanglement test above 2, so the usual check would not flag the eavesdropper.

Algoma checks a moving link before using it

Shahroz Abbas, with Abhishek Gupta and Ajmery Sultana of Algoma University, wants to check quantum links between moving vehicles. Before a link carries data, the two ends measure some shared pairs and work out a score that cannot pass 2 unless the pairs are truly linked. If it clears 2 by a margin, the link is used.

In a simulation of two endpoints the score fell from 2.71 at low channel error to 2.05 at a 15 percent error, and failed at 1.92 at 20 percent. A questioner asked how this differs from normal link testing. Abbas said real hardware is the next step.

A learning game on repeater networks

A talk at Sunday’s Q-GenAI workshop turned the security of a key network into a game between a defender and an eavesdropper. One key link is safe in theory. A network of repeaters, the speaker said, adds a layout an attacker can exploit, and the two players trained for 500,000 rounds on win or loss alone.

Three local language models then tried to explain the decision trees the game produced. Human readers scored their answers at most 5.7 out of 10, even for the largest model, while most scores sat at 0.90.

Post-quantum cryptography, priced line by line

The other half of the subject protects today’s data from tomorrow’s quantum code-breakers. Eight talks priced the new codes, tested the hard problems under them or built secret-sharing and key schemes on top.

Illinois finds big signatures cost an extra round trip

Matthew Chou of the University of Illinois Urbana-Champaign and the National Center for Supercomputing Applications gave paper 895 with Phuong Cao. New certificate chains can be five to twenty times bigger than today’s. The extra size costs less than that suggests. A server sends its chain in one burst and then waits for a reply, so the extra bytes only cost real time once a chain spills past the burst.

Today’s chains take 2 to 4 kilobytes. ML-DSA, the main new signature, takes 8 to 15. The bulky SLH-DSA, built from hash functions, takes 60 to 150, and that pushed it almost one round trip higher, while extra bytes inside one burst added little delay. Sites behind content networks resumed 94 percent of sessions, which skips the certificate, against 46 percent elsewhere.

Middle Tennessee prices the switch for medical scans

Saroj Baral, a PhD student at Middle Tennessee State University, presented the survey, whose first author is Ahmeed Yinusa. Hospitals may keep scans for 20 to 50 years. A scan locked today could be read once a quantum computer breaks the RSA that wraps its key, and that is the case for moving early on long-lived data.

The images stay under AES-256. The switch hands the key wrap to ML-KEM-768, which makes the wrapped keys bigger, so for 10 million studies, with each wrap stored three times, the wrapped keys go from 7.7 to 32.6 gigabytes, beside about 500 terabytes of images. Re-wrapping the whole archive takes about 28 hours on one core or under 20 minutes on 100.

UMBC finds post-quantum Noise handshakes cost bytes more than time

Nadeem Ahmed of the University of Maryland, Baltimore County, presented with Aryya Gangopadhyay and Lei Zhang. Noise is the set of rules for opening a secure link that sits under WireGuard, WhatsApp and the Lightning Network, and it rests on elliptic curves that Shor’s algorithm would break. So traffic stored today is at risk later. NIST’s chosen replacement, ML-KEM, does not fit the way Noise builds its messages.

NoisePQC++ joins classical, post-quantum and hybrid handshakes in one code base, across 82 patterns at all three ML-KEM levels, and it runs on a Raspberry Pi 5 too. In loopback tests ML-KEM-768 handshakes took 0.66 to 0.85 times as long as classical ones. The bytes were the cost. Post-quantum handshakes carried 28.6 to 46.8 times the classical bytes, and some patterns pass the 1,500-byte packet limit and split. Tests on real networks are still to come.

VTT writes an open lattice toolkit

Erik Hieta-aho of VTT, the Finnish research centre, gave work done with Markus Rautell. The team set out to test a quantum annealer on the shortest vector problem, the hard problem under lattice-based schemes, until open access to D-Wave closed. Few open tools existed for lattice reduction, the step that turns a skewed set of vectors into short ones. So the team wrote one.

It covers random lattices only, short of real security levels. It is meant for teaching and comparison, and the code is open source.

Manohar squeezes SHA-3 into 1,605 logical qubits

Nathan Manohar presented a quantum circuit for SHA-3, the standard hash function, with Gilad Ezov and Nir Drucker. Such a circuit is needed to price a Grover search, the quantum method that speeds up guessing, against a hash, and the best earlier design needed 320 spare working qubits for one step, called theta.

Their team computes theta one 5-bit row at a time with just 5 spares, so all of SHA-3 fits in 1,605 logical qubits. Resetting the spares was the hard part. The full circuit came to 323,129 gates, and the figures are counts with no hardware run.

A blockchain stores proofs before code-breaking arrives

Keir Finlow-Bates, chief technology officer of a blockchain company, spoke on a paper written with Markus Jakobsson about a weakness that quantum computers would open in a common way of sharing secrets. Verifiable secret sharing lets, say, any 2 of 10 people rebuild a secret while each checks that their share is genuine. The usual checks rest on a maths problem that Shor’s algorithm would break. Shares could then be faked.

Their idea is to store such proofs on a blockchain such as Bitcoin now. Later, anyone could show they came before a code-breaking machine. Grover’s algorithm speeds up the hashing that guards the ledger too little to rewrite it, Finlow-Bates argued, and Finlow-Bates estimated this buys five or perhaps ten years, adding that Ethereum is more exposed than Bitcoin.

UT Dallas shares a secret without naming the holders

Varin Sikand, now a PhD student at Virginia Tech, gave work from their master’s with Andrew Nemec at UT Dallas. Secret sharing splits a message so that only an allowed group can rebuild it. Sikand wants a stronger promise. A hostile holder handed everyone else’s shares should still not be able to tell who stayed away, and Sikand built this from quantum codes that treat every qubit alike.

All eleven codes Sikand scored leaked something when an attacker held some, but not all, of the shares. Two shared random bits that apply hidden operations closed that leak, though the fix was shown for four qubits only.

Algoma layers keys for federated learning

Shahroz Abbas of Algoma University, with Ajmery Sultana among their co-authors, presented QRFed. In what is called federated learning, many users train one shared model on their own data and send only updates to a server. The raw data stays home. QRFed wraps those updates in layers. It uses quantum keys, a post-quantum signature on the plain messages, normal encryption and pooling, so the server never sees what any one user sent.

In a simulation of 100 clients, every tampered or replayed packet was turned away, and accuracy stayed at 89.86 percent against 89.88 without the protection. Abbas said the quantum half needs hardware the team does not yet have.

Quantum protocols for integrity and distance

Two talks turned quantum signals to defence. One checks that a message was not tampered with, and the other checks that a party is as close as it claims.

Kerala checks a quantum message for tampering without encrypting it

Ganesh Ramachandran Nair of Kerala University of Digital Sciences, Innovation and Technology presented with Tony Thomas. A known result says that any quantum check which keeps a state usable must also lock it up with encryption, and that adds cost. Yet many protocols, which Nair calls terminal, read a message as soon as it lands. Then nothing needs to survive. So, Nair argued, the encryption can go.

The scheme ties a tag to the message with gates set by a secret Toeplitz matrix, and pads only the tag. Undetected tampering succeeds with odds below 2 to the minus lambda, where lambda is the tag’s length, against any attacker. The receiver’s cost stays flat. Nair stressed that this is weaker than full authentication, and only some kinds of transform are covered so far.

KU Leuven holds every distance-bounding attack to one half per round

Kevin Bogner of KU Leuven presented with Aysajan Abidin, Dave Singelee and Bart Preneel. Distance bounding, an idea from 1993, times a challenge and its reply to confirm that a party with the right key is nearby, like a restaurant that serves only customers within a set radius. Classical versions fall to tricks in the hardware. A qubit challenge in a hidden basis defeats those, Bogner said.

Each round now sends a BB84 qubit with a fresh classical nonce, a number used once. Every attack is held to one half per round, where earlier quantum protocols let a relay attack succeed 0.75 to 0.93 of the time. One kind of cheat, in which a distant party helps an accomplice for one session, is blocked only under a condition. The work is theory so far. A small lab prototype is planned.

What it means for quantum computing security teams

For anyone who runs a quantum machine or buys time on one, the order of work follows from where the attacks in Toronto landed. Audit the controllers, decoders and calibration files first, along with the classical messages around any key network. Then press providers on sharing. Any provider that starts running several users on one chip should say how it keeps them apart.

For everyone else, the move to new codes is now a job with a price, from one extra round trip for the biggest web certificates to tens of gigabytes for a big archive of scans. Both bills can be planned for. The side doors are harder to budget, since several of the defences shown in Toronto have yet to meet a determined attacker.

Most of the attacks here ran in simulation or on one machine, so this is a list of open doors and no record of a break-in. Shor found the lock a quantum computer can pick, and Toronto found the doors it leaves open.