Power Side-Channel Attacks on Machine-Learning-based Quantum Error Correction Decoders

Abstract

Machine learning (ML) decoders are increasingly used in quantum error correction (QEC) to model noise, analyze imperfect syndrome measurements, and replace iterative matching algorithms with a learned inference pass, making them a critical component of the classical control stack of a fault-tolerant quantum computer. Prior security analysis of the ML decoders in the controller stack has addressed integrity and fault-injection attacks on the decoders. This work is the first to explore physical power side-channel attacks on ML decoders. In particular, it studies a convolutional Deep Q- Learning decoder for the distance-5 surface code. This work profiles the decoder to capture the power signatures generated during clas- sification tasks and trains a classifier to identify which qubit the decoder identified as having errors based on the power signatures. The trained classifier is then applied to test data, where it recovers the correct data qubit label from the decoder’s side-channel data with up to 83.2% accuracy across 25 classes, against 4% for random guessing. A second classifier is trained to identify the type of error labeled by the decoder, Pauli X or Z, and reaches 84.6% accuracy, against 50% for random guessing. This work further performs an initial study of a timing channel, which complements the power side channels, exploring how the duration of the decoder’s first convolutional layer can leak the code size for which the decoder is compiled. All the side-channel attacks demonstrated in this work motivate treating the embedded QEC decoder as a confidentiality-critical component of the quantum control stack.

Anthony Etim

PhD Candidate

My research interests include Machine Learning Security, Hardware Security and FPGA Security.