Authors: Yang Yang, Yuzhu Long, Han Fang, Zhaoyun Chen, Zhonghui Li, Weiming Zhang, Guoping Guo
Organizations: School of Electronic and Information Engineering, Anhui University, Hefei, Anhui 230601, China · Institute of Artificial Intelligence, Hefei Comprehensive National Science Center, Hefei, Anhui, 230088, China · School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui 230026, China · Laboratory of Quantum Information, University of Science and Technology of China, Hefei, Anhui, 230026, China · Origin Quantum Computing Technology Company, Hefei, Anhui, 230026, China
Quantum cloud platforms have become the most widely adopted and mainstream approach for accessing quantum computing resources, due to the scarcity and operational complexity of quantum hardware. In this service-oriented paradigm, quantum circuits, which constitute high-value intellectual property, are exposed to risks of unauthorized access, reuse, and misuse. Digital watermarking has been explored as a promising mechanism for protecting quantum circuits by embedding ownership information for tracing and verification. However, driven by recent advances in generative artificial intelligence, the paradigm of quantum circuit design is shifting from individually and manually constructed circuits to automated synthesis based on quantum circuit generative models (QCGMs). In such generative settings, protecting only individual output circuits is insufficient, and existing post hoc, circuit-centric watermarking methods are not designed to integrate with the generative process, often failing to simultaneously ensure stealthiness, functional correctness, and robustness at scale. These limitations highlight the need for a new watermarking paradigm that is natively integrated with quantum circuit generative models. In this work, we present the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity. We introduce a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction. Empirical results confirm that our method achieves high-fidelity circuit generation and robust watermark detection across a range of perturbations, paving the way for scalable, secure copyright protection in AI-powered quantum design.
Figures & tables
Fig. 1: Watermarking for quantum circuit generative model. Top : Standard QCGMs generate circuits without embedded ownership, enabling misuse via cloud deployment with no attribution. Bottom : Our watermarked QCGM embeds verifiable ownership into each generated circuit, enabling attribution and accountability even after unauthorized redistribution.
Fig. 2: Watermark embedding, attacks and extraction process for quantum circuits generative model (QCGM). The watermark is embedded into the starting latent of QCGM through SSM, then the watermarked QC is generated and potentially attacked. The SRM and SSM reverse sampling is applied in the extraction stage to extract the watermark.
Fig. 3: Effects of circuit modifications on the encoded matrix. Edits to quantum circuits may alter the encoded matrix either by changing specific values or shifting its structural layout. Subfigures illustrate the impact of different edit operations: (a) replacement, (b) appending, (c) insertion, and (d) deletion. Each operation disrupts the latent of the quantum circuits, introducing distortions that may hinder accurate watermark extraction.
Fig. 4: Experiment on threshold selection. (a) TPR/FPR. (b) Bit accuracy distribution.
Fig. 5: Fidelity experiments of Q-Tag generation, (a) the initial starting latent with ( ZTW ) and without ( ZT∅ ) watermark are indistinguishable through t-SNE; (b) the diffused latent with ( Z0W ) and without ( Z0∅ ) watermark are also indistinguishable through t-SNE.
Fig. 6: True positive rate of watermark detection under different settings: (a) no-distortion, (b) replacement gates, (c) appending gates, (d) inserting gates and (e) deleting gates.
Fig. 7: Generalizability and ablation experiments: (a) the TPR of watermark detection with different inference and inversion steps; (b) the TPR of watermark detection with and without SRM under insertion attacks; (c) the TPR of watermark detection with and without SRM under deletion attacks.
Methods
Identity
Replacement
Appending
Insertion
Deletion
WQC [ 18 ] -RGW
1.000
0.398
0.402
0.405
0.201
WQC [ 18 ] -RGIW
1.000
0.403
0.397
0.503
0.195
Ours
1.000
1.000
0.992
1.000
1.000
TABLE I: Comparison of the WQC
Fig. 8: (a) Comparison of the influence of different levels of text guidance on watermark extraction capability. (b) Different capacity sizes on watermark extraction capability without attacks. (c) Different capacity sizes on watermark extraction capability under attacks.
Generative AI systems increasingly produce content whose provenance is difficult to verify, motivating watermarking techniques for identifying model-generated outputs. Existing cryptographic watermarking methods provide strong undetectability guarantees: without a detection key, watermarked outputs are computationally indistinguishable from unwatermarked ones. However, these approaches do not address the crucial deployment challenge of how to safely delegate detection capabilities. With an unrestricted detection key, a malicious detector may use the detection key beyond its intended scope, enabling watermark sanitization, scope abuse, and user profiling. To mitigate this safety concern, we introduce, to the best of our knowledge, the first attribute-based watermarking for generative AI models, providing fine-grained, policy-controlled watermark detection. In our approach, each generated output is associated with attributes, and each detection key is constrained by a policy on potential attributes. A detection key can only be used to detect watermarked outputs whose attributes satisfy the corresponding policy, while watermarked outputs that fall outside the policy remain computationally indistinguishable from unwatermarked ones. We construct such an attribute-based watermarking scheme and formalize its security properties, including consistency, adaptive robustness to bounded corruptions, undetectability, and soundness, along with a security proof under standard cryptographic assumptions. Our construction integrates constrained pseudorandom functions, pseudorandom error-correcting codes, and randomness recovery procedures with generative AI models. Finally, we implement a prototype and an empirical evaluation, demonstrating that attribute-based watermarking is both effective and practical.
Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel +1
Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher · University of Southern California Los Angeles, CA, USA +1
We review thirteen generative systems and five supporting datasets for quantum circuit and quantum code generation, identified through a structured scoping review of Hugging Face, arXiv, and provenance tracing (January-February 2026). We organize the field along two axes: artifact type (Qiskit code, OpenQASM programs, circuit graphs); crossed with training regime (supervised fine-tuning, verifier-in-the-loop RL, diffusion/graph generation, agentic optimization); and systematically apply a three-layer evaluation framework covering syntactic validity, semantic correctness, and hardware executability. The central finding is that while all reviewed systems address syntax and most address semantics to some degree, none reports end-to-end evaluation on quantum hardware (Layer 3b), leaving a significant gap between generated circuits and practical deployment. Scope note: quantum code refers throughout to quantum program artifacts (QASM, Qiskit); we do not cover generation of quantum error-correcting codes (QEC).
High-fidelity circuit execution on noisy intermediate-scale quantum devices is bottlenecked by compilation pipelines that disregard complex, correlated noise. To address this, this methodology article proposes a quantum machine learning control (QMLC) framework for generative quantum circuit synthesis from gate-set tomography (GST) data that bypasses the traditional two-step pipeline of characterizing native quantum gates via GST followed by unitary decomposition algorithms. Instead, a generative concept space is directly learnt from GST data, enabling conditional synthesis of quantum circuits on a desired output distribution. Our approach tokenizes GST germ circuits and embeds them into a structured latent space using a curriculum-learning-motivated strategy, starting with short circuits and progressively incorporating longer ones with diverse output statistics. The embedded sequences are processed by a set-vision transformer with permutation-invariant pooling, producing k-seed vectors that represent the learned concept space of the quantum device. Aggregating data across multiple circuits makes this latent representation inherently context-aware, capturing the shared physical noise environment (e.g., crosstalk, drift) that isolated gate metrics miss. We propose an unconditional diffusion model to sample from the concept space. During inference, a user provides a target measurement distribution, and the model generates a corresponding circuit. To ensure fidelity and robustness, the output is denoised using a diffusion model that operates on the target conditional covariance matrix. This end-to-end framework is a step towards context-aware, hardware-native circuit synthesis directly from raw GST data, which offers a new paradigm for integrating quantum control and compilation. The QMLC framework is particularly suited for near-term quantum devices with complex calibration procedures.
King Yiu Yu, Aritra Sarkar, Erbing Hua +3
1Quantum and Computer Engineering, Delft University of Technology, The Netherlands · 2QuTech, Delft University of Technology, The Netherlands · 3Kavli Institute of Nanoscience Delft, Delft University of Technology, The Netherlands