VQC Variational Quantum Circuits
Introduced BVQC, a revolutionary backdoor-style watermarking system intended to safeguard the intellectual property (IP) stored within Variational Quantum Circuits (VQCs), marking a major advancement in the security of the rapidly developing field of quantum computing. By addressing significant flaws in earlier watermarking methods, this novel approach provides a reliable solution that maintains the VQCs’ original performance during regular operation while guaranteeing that the watermark is detectable and resistant to common optimization procedures like circuit re-compilation.
With its ability to scale issues that are now beyond the capabilities of conventional computers, Variational Quantum Circuits (VQCs) have become a potent paradigm in quantum computation. These circuits optimize to minimize this loss across a training dataset by encoding solutions using a task loss function. Variational Quantum Deflation (VQD), Quantum Approximate Optimization Algorithms (QAOA), and Variational Quantum Eigensolver (VQE) frequently use VQCs.
But building VQCs requires in-depth knowledge of things like robust encoding techniques, hardware calibration, parameter tuning, and unique circuit ansatz skills that are frequently hard to come by outside of specialized quantum computing companies. Leading quantum computing companies now sell their VQCs as valuable intellectual property in a market that has grown as a result of the promise of VQCs. A trustworthy watermarking system is essential for verifying VQC IP ownership because of the increased danger of criminal actors creating and disseminating unauthorized copies due to its significant commercial value.
Two main issues have plagued current quantum circuit watermarking methods. First of all, watermarks were simply eliminated when the circuits were recompiled. Suboptimal designs like gate decomposition, qubit mapping, or gate scheduling were chosen as watermarks in many earlier approaches. But since quantum compilers are made to improve circuit fidelity and execution performance, these unoptimized signature blocks are ideal candidates to be eliminated during recompilation.
By using approximation compilation, it was also possible to eliminate other methods that included random gates and rotation. Second, the lengthy inserted watermarks in these approaches led to a considerable rise in job loss, which deteriorated circuit accuracy, especially on noisy intermediate-scale quantum (NISQ) computers.
For example, Probabilistic Proof of Authorship (PPA) increased dramatically following re-compilation with prior state-of-the-art watermarking, from values as low as on Kolkata, suggesting watermark removal. Accuracy loss was also evident in the Ground Truth Distance (GTD) for watermarked VQCs (using previous approaches), which rose significantly from an average of 0.036 without watermarks to 0.107 on Kolkata and from 0.063 to 0.182 on Cairo.
BVQC directly addresses these challenges
BVQC tackles these issues head-on. Its backdoor-style embedding, which purposefully raises the loss to a predetermined amount during watermark extraction while maintaining the original loss in normal execution settings, is the main novelty. By designing BVQC as a multi-task learning objective, this is accomplished. In addition to learning to generate a predetermined watermark loss for a series of specified inputs and measurements under watermark extraction conditions, the VQC is trained to achieve high accuracy using a set of base inputs and measurements for standard execution.
- In order to create a watermarked model, a collection of predetermined inputs, measurements, and a predefined loss must be generated. Through the modification of amplitude, phase, measurement bases, or weights, these specified elements are purposefully made to deviate greatly from the basic input/measurement.
- Optimizing the circuit to achieve the predetermined watermark loss with the watermark set and minimize loss on the base task.
- Making the predefined set private and making the well-trained VQC with the base set available to the public.
The owner provides a third-party client with the private predetermined input, measurement, and loss in order to confirm ownership. Ownership is verified if the VQC, when assessed under these predetermined parameters, produces a loss that is equal to the predetermined (as opposed to typical circuit behavior).
A key element of BVQC is its grouping algorithm, which ensures optimal accuracy for the base job by minimizing interference from the watermark task. By measuring the effect of gradient updates from the watermark task on the goal of the base job, the algorithm carefully chooses specified inputs, measurements, and watermark losses. In particular, it searches for setups in which the gradient changes from the watermark task do not result in a greater loss for the base task.
This careful selection procedure reduces the possibility of performance degradation by ensuring that the optimization paths of the two tasks are in line. The base task GTD may exhibit notable disparities in the absence of this grouping. Nonetheless, the grouping algorithm’s ability to maintain accuracy is demonstrated by the basic task’s GTD value in BVQC, which continuously stays low with an average of 0.016 over 50 sample groups.
BVQC clearly performs better than earlier watermarking methods.
- Robustness to Re-compilation: BVQC exhibits a substantial resistance to the impacts of re-compilation by significantly reducing Probabilistic Proof of Authorship (PPA) alterations. In contrast to earlier techniques where watermark removal caused PPA to rise sharply after re-compilation, VQCs taught using BVQC show little PPA variations, indicating watermark preservation. This resistance results from BVQC’s use of parameter optimization to insert the watermark directly within the VQC’s unitary matrix a level that is mainly unaffected by compiler optimizations that concentrate on structural modifications.
- Preservation of Accuracy: When compared to earlier watermarking methods, BVQC dramatically lowers Ground Truth Distance (GTD) by 0.089. When compared to earlier approaches, BVQC generally shows lower task GTD outcomes. The GTD attained by BVQC is nearly the same as that of VQCs that are not watermarked, suggesting that the loss changes brought about by BVQC are minimal. This demonstrates that BVQC meets the security criteria to maintain accuracy and reduce the effect of watermarking on the execution of VQC tasks. Additionally, the average watermark GTD stays low when preset inputs and measurements are used, effectively facilitating watermark extraction and producing a significant, clear departure from unwatermarked circuits.
Even while the study shows great progress, the scientists recognize that techniques that can resist ever-more-advanced attacks like fine-tuning the model with locally selected datasets are still needed. Nonetheless, current parameter smoothing techniques have proven successful in reducing the effects of fine-tuning while maintaining watermark persistence. Future research might concentrate on strengthening the scheme’s resistance to these changing dangers and investigating its use with a larger variety of quantum algorithms.
In the quickly evolving field of quantum computing, this study, which was assessed using datasets like PennyLane Molecules and HamLib-MaxCut on IBM quantum backends like IBMQ-Kolkata and IBMQ-Cairo, represents a critical step in safeguarding important intellectual property and encouraging innovation by protecting circuit designs.
