#  Enigma: Privacy-Preserving Execution of QAOA
on Untrusted Quantum Computers

Ramin Ayanzadeh  School of Computer Science, Georgia Institute of Technology,
Atlanta, GA  Ahmad Mousavi  Department of Mathematics and Statistics, American
University, Washington, DC  Narges Alavisamani  School of Computer Science,
Georgia Institute of Technology, Atlanta, GA  Moinuddin Qureshi  School of
Computer Science, Georgia Institute of Technology, Atlanta, GA

###### Abstract

Quantum computers can solve problems that are beyond the capabilities of
conventional computers. As quantum computers are expensive and hard to
maintain, the typical model for performing quantum computation is to send the
circuit to a quantum cloud provider. This leads to privacy concerns for
commercial entities as an untrusted server can learn protected information
from the provided circuit. Current proposals for Secure Quantum Computing
(SQC) either rely on emerging technologies (such as quantum networks) or incur
prohibitive overheads (for Quantum Homomorphic Encryption). The goal of our
paper is to enable low-cost privacy-preserving quantum computation that can be
used with current systems.

We propose _Enigma_ , a suite of privacy-preserving schemes specifically
designed for the Quantum Approximate Optimization Algorithm (QAOA). Unlike
previous SQC techniques that obfuscate quantum circuits, Enigma transforms the
input problem of QAOA, such that the resulting circuit and the outcomes are
unintelligible to the server. We introduce three variants of Enigma. _Enigma-
I_ protects the coefficients of QAOA using random phase flipping and fudging
of values. _Enigma-II_ protects the nodes of the graph by introducing decoy
qubits, which are indistinguishable from primary ones. _Enigma-III_ protects
the edge information of the graph by modifying the graph such that each node
has an identical number of connections. For all variants of Enigma, we
demonstrate that we can still obtain the solution for the original problem. We
evaluate Enigma using IBM quantum devices and show that the privacy
improvements of Enigma come at only a small reduction in fidelity (1%–13%).

Figure 1:  (a) Untrusted servers can deduce the original QAOA problem from the
circuit and solution. Enigma obfuscates the QAOA problem, rendering the input
problem and circuit outcomes inaccessible to the server: (b) Enigma-I conceals
the problem coefficients; (c) Enigma-II introduces decoy qubits to alter the
problem structure; (d) Enigma-III regularizes the problem graph.

##  I Introduction

Quantum computers (QCs) have the potential to solve certain problems that are
beyond the capability of classical computing [66, 4, 89, 72, 90], including
optimization [37], machine learning [52], cryptography [79], and quantum
simulation [39]. Unlike classical systems, QCs require highly sophisticated
infrastructure and maintenance; thus, quantum users are expected to run their
quantum programs on remote QCs accessible via the cloud. However, disclosing
quantum programs in the form of a quantum circuit to the server raises
security and privacy concerns, as untrusted cloud providers can infer
sensitive data, including intellectual property.

When we use QCs to solve a problem, the algorithm for this problem must be
adapted to the quantum computing framework. In circuit-based quantum
computing, for instance, the algorithm is represented using quantum gates and
circuits. To execute these algorithms, users typically rely on cloud services,
which run these quantum circuits on remote QCs. This process, however, reveals
the quantum circuit—and potentially sensitive details about the problem and
its solution—to the cloud service providers. This is particularly concerning
for future quantum computing applications, where the problems being solved are
those that classical computers cannot handle. These problems often involve
highly sensitive data, such as drug discovery [25, 22, 76, 34, 40, 74] or
financial optimization [13, 15, 18, 32]. Therefore, a substantial privacy risk
exists: untrusted cloud servers may access and misuse sensitive information
about advanced technologies and strategies in sectors such as pharmaceuticals
and finance. This presents a major privacy concern for companies looking to
leverage quantum computing.

Secure Quantum Computing (SQC) is an emerging field that aims to address
security and privacy concerns arising from the delegation of quantum programs
to untrusted remote servers. SQC techniques are broadly categorized into Blind
Quantum Computing (BQC) and Quantum Homomorphic Encryption (QHE). BQC
protocols partially delegate quantum programs without disclosing the
computation’s details to the server [42, 20, 16, 55]. However, current BQC
protocols are often impractical as they typically assume the client has basic
quantum hardware to prepare quantum states, which in turn requires a quantum
network for client-server interactions—a technology that is still under
development. Recent updates to BQC reduce the need for users to have their own
quantum capabilities [73, 51, 62, 45, 44, 42]. However, these still need
multiple servers and rely on the assumption that these servers do not
collaborate in a way that compromises privacy. Yet, this assumption is often
not reasonable given that we are dealing with untrusted servers. QHE schemes,
on the other hand, enable computations on encrypted quantum data, producing an
encrypted outcome. Once decrypted, this outcome reflects the results of
operations on the original data [21, 41, 19, 31, 68, 83, 91, 56]. However, QHE
remains impractical in the near term as fully secure QHE methods impose an
exponential computational overhead.

The near-term impracticality of previous work arises from their pursuit of a
one-size-fits-all approach to protect the privacy of any quantum program,
which forces reliance on emerging technologies or results in exponential
computing overhead. In this paper, we advocate for _application-specific SQC_
, tailoring SQC schemes for immediate use on current and near-term quantum
computers, albeit with a focused scope on a single, yet significant,
application. This approach represents a strategic trade-off between breadth of
application and deployment readiness.

Optimization leads the applications poised to demonstrate quantum speedup on
Noisy Intermediate-Scale Quantum (NISQ) computers [72], with the Quantum
Approximate Optimization Algorithm (QAOA) [17, 37, 38] as a prime contender.
QAOA’s objective is to find the lowest energy state of a system, known as the
Hamiltonian. It shows promise for various industrial applications aimed at
optimizing specific cost functions[24, 25, 27, 81, 88].

However, QAOA is particularly vulnerable to privacy breaches as its
distinctive circuit design can easily reveal details about the problem being
solved. For example, when addressing graph optimization problems, QAOA
translates the graph into a quantum circuit where nodes become qubits and
edges are represented by two-qubit gates linking the relevant qubits. As
depicted in Fig. 1(a), the circuit’s unique layout could disclose the graph’s
structure, allowing untrusted servers to glean the intellectual property
embedded within the user’s problem. Such exposure jeopardizes the
confidentiality of the original problems users are tackling. Furthermore, when
QAOA circuits are run on the cloud, cloud service providers gain access not
just to the problem but also to its solution, presenting a substantial risk of
IP leakage as providers could potentially access both the problem and its
solution (Fig. 1(a)).

In this paper, we propose _Enigma_ , a suite of privacy-preserving schemes
tailored specifically for QAOA applications. The Enigma protocols encode
optimization problems into forms unintelligible by servers. Clients submit
obfuscated problems whose output distributions can only be decoded by them.
QAOA involves three types of assets: coefficients, variables, and the problem
graph’s structure. We introduce three protocols to conceal these elements. Our
experiments show that Enigma can obfuscate problems and decode outcomes for
QAOA instances with hundreds of qubits in just a few seconds.

We propose _Enigma-I_ , Fig. 1(b), which encrypts problem coefficients,
effectively obfuscating both the input and outcomes. While Enigma-I maintains
the energy levels of the input Ising Hamiltonian, it permutes the associated
bitstrings, rendering the outcomes unintelligible to the server.

Although Enigma-I ciphers coefficients, it leaves the problem’s structure,
such as the number of nodes and edges still unprotected and visible to the
server. We introduce _Enigma-II_ , as shown in Fig. 1(c), to further perturb
the problem structure by integrating decoy qubits, making them indiscernible
to the server. Enigma-II ensures the recovery of the problem of interest from
the obfuscated problem’s global minimum.

However, merely embedding decoy qubits does not completely obscure the problem
graph’s structure. For example, when addressing problems that follow a power-
law distribution, certain qubits—known as hotspots—may exhibit significantly
more connections, thereby becoming easily identiable to the server (for
example, if the problem graph had airport routes, then Atlanta and Chicago
would have a large number of connections and would still be identifiable even
with Enigma-II). To comprehensively conceal the problem’s structure, we
introduce _Enigma-III_ , as shown in Fig. 1(d). Enigma-III embeds the required
number of decoy qubits and connections so that all qubits have an identical
number of connections, resulting in a regular graph for the obfuscated
problem.

For each scheme, we present analytical evaluations of the protective measures
for QAOA assets and discuss residual risks. We also provide experimental
results based on IBM quantum devices to evaluate the effectiveness. To the
best of our knowledge, Enigma is the first SQC proposal that does not depend
on nascent technologies like those in BQC and avoids the exponential
computational overhead associated with QHE, thus making it readily deployable
even on existing and near-term quantum systems that cannot perform error
correction.

Overall, this paper makes the following contributions:

  1. 1.

We propose _Enigma_ as a SQC protocol specifically designed to protect the
privacy of QAOA programs at the application layer. To the best of our
knowledge, Enigma is the first application-specific SQC proposal.

  2. 2.

We propose _Enigma-I_ , a protocol that encrypts problem coefficients, leading
to random bit flips in outputs, effectively concealing both the coefficients
and the outcomes.

  3. 3.

We propose _Enigma-II_ , a protocol that modifies the graph structure by
including a number of decoy qubits.

  4. 4.

We propose _Enigma-III_ , a protocol that hides the connectivity information
by transforming the graph to have an identical number of connections for all
nodes.

Enigma can be deployed on current and near-term machines. Our evaluations with
IBM quantum machines shows that the privacy enhancements of QAOA comes at only
a small loss of fidelity: 1% for Enigma-1 to 13% for Enigma-III.

##  II Background and Motivation

###  II-A QAOA: A Prime Quantum Speedup Candidate

The Quantum Approximate Optimization Algorithm (QAOA) [17, 37, 38] is widely
recognised as the prime candidate for demonstrating quantum speedup in Noisy
Intermediate-Scale Quantum (NISQ) era [72]. To solve a problem using QAOA, we
must cast it into the following Ising Hamiltonian:

$f({\mathbf{z}})=\sum_{i=1}^{n}{\mathbf{h}_{i}\mathbf{z}_{i}}+\sum_{i=1}^{n}{\sum_{j=i+1}^{n}{J_{ij}\mathbf{z}_{i}\mathbf{z}_{j}}}+\text{offset},$
(1)

characterized by spin variables $\mathbf{z}_{i}\in\\{-1,+1\\}$ and associated
linear ($\mathbf{h}_{i}\in\mathbb{R}$) and quadratic ($J_{i,j}\in\mathbb{R}$)
coefficients that are defined such that the global minimum of the quadratic
objective function corresponds to the optimal solution of the problem at hand
[59, 6, 5, 8].

As shown in Fig. 2(a), the Ising Hamiltonian is represented as a “problem
graph”, where nodes correspond to spin variables and edges to quadratic terms.
The, this graph is transformed into a parametric quantum circuit (Fig. 2(b)),
with each node and edge represented by qubits and quantum gates (two CNOTs and
one $R_{z}$), respectively. Parameters ($\gamma$ and $\beta$) are optimized
using an external classical optimizer to align the circuit’s output with the
problem’s optimal solution. Importantly, as depicted in Fig. 2, the structure
of the QAOA circuit closely mirrors the original problem graph.

###  II-B Why QAOA?

Optimization is at the forefront of showcasing quantum speedup with near-term
quantum devices. Meanwhile, QAOA stands out as a prime candidate to surpass
classical computing capabilities by approximating global optima in
optimization tasks. Moreover, QAOA is computationally universal [58, 63],
enabling us to employ it for addressing a vast range of problems beyond the
optimization realm [59, 11, 69]. We can anticipate QAOA to be among the first
real-world applications of quantum computing, underscoring the urgency to
prioritize the security and privacy of its users.

###  II-C Prior Work Limitations

####  II-C1 Blind Quantum Computing (BQC)

BQC is a method that allows a client to perform quantum computations on a
remote server while keeping the computation’s content confidential. The main
objective of BQC is to maintain the privacy of the quantum computation,
ensuring that the server, although performing the computation, cannot
ascertain its nature or purpose. However, most BQC protocols operate under the
assumption that the client possesses a rudimentary quantum device and that a
quantum network is in place to facilitate communication between the client and
the server [20, 55, 64, 42, 43, 23].

Recent studies have proposed BQC protocols that eliminate the need for clients
to host a quantum device on their premises [73, 51, 62, 45, 44, 42]. However,
these protocols rely on the presence of multiple quantum servers and operate
under the assumption that these servers do not communicate, placing trust in
otherwise untrusted servers.

####  II-C2 Quantum Homomorphic Encryption (QHE)

Homomorphic encryption is a cryptographic technique that allows computations
to be carried out on encrypted data, yielding an encrypted result that, when
decrypted, matches the result of operations performed on the plaintext [21,
41, 19, 31, 68, 83, 91, 56]. While it eliminates the need for the interactive
computation intrinsic to BQC, fully-secure QHE, as suggested by the “no-go
theorem,” introduces exponential computational overhead, making QHE
impractical in the near term, as noisy quantum devices cannot accommodate such
excessive noise accumulation. Moreover, most homomorphic encryption schemes
are tailored for classical binary data, making the adaptation to quantum
information—a realm governed by superposition and entanglement—particularly
challenging.

####  II-C3 Hardware Architecture for Trusted Quantum Execution

Trochatos et al. [87] recently proposed a novel hardware architecture for a
trusted execution environment tailored for superconducting QCs. On the client
side, post-compiling, random decoy gates/pulses are injected to obfuscate
users’ circuits. On the server side, these decoy gates are attenuated inside
the delusion refrigerator before executing the circuit. Assuming the delusion
refrigerator functions as a trusted environment, inaccessible to the quantum
server, this architecture can safeguard the security and privacy of quantum
users.

However, this method comes with its own set of limitations. The technique is
specific to superconducting QCs, as other QC types do not incorporate a
delusion refrigerator. Additionally, the approach assumes that the quantum
provider cannot access the trusted region within its own refrigerator,
confining the architecture’s applicability to servers deemed trustworthy.

Moreover, QAOA circuits possess a well-defined structure, potentially enabling
adversaries to discern the decoy gates. For instance, as depicted in Fig.
2(b), every edge in the problem graph corresponds to one $R_{z}$ rotation,
encased by two two-qubit CNOT operations. This recurring, known as an ansatz,
pervades the circuit, with all instances of an ansatz in a single layer
sharing the same $\gamma$ and $\beta$ values. It is crucial to highlight that
the adversary’s aim is not the acquisition of the rotation values; rather, the
goal is to retrieve the problem coefficients.

Figure 2:  QAOA example: (a) the problem graph of an Ising Hamiltonian with
four spin variables, featuring associated linear ($\mathbf{h}$) and quadratic
($J$) coefficients; and (b) the corresponding QAOA circuit with one layer.
Each layer possesses distinct parameters $\gamma$ and $\beta$ that are tuned
by an outer-loop classical optimizer.

###  II-D Goal of this Paper

Previous techniques aim to protect arbitrary quantum programs, necessitating
obfuscations after the generation or compilation of quantum circuits, as shown
in Figure 3(a). This required dependence on emerging technologies such as
quantum networks, which are not readily available. In this paper, our goal is
to concentrate on a specific application rather than developing generic SQC
protocols, striking a balance between the scope of an application and its
readiness for use. To that end, we propose Enigma, privacy-preserving suite of
solutions specific to QAOA, as shown in Figure 3(b).

In QAOA, the problem graph embodies the proprietary data and intellectual
property. Specifically, there are three attributes: coefficients, nodes, and
edges. A privacy-preserving QAOA scheme must protect one or more of these
attributes.

We can view QAOA from two perspectives: (a) a linear algebra problem,
involving finding the eigenstate associated with the minimum eigenvalue of a
given Hamiltonian matrix [10, 12]; and (b) a graph theory problem, focusing on
partitioning graph nodes via edge cutting to maximize the total weight of
severed edges [48, 37]. To develop our privacy-preserving technique for QAOA,
we alternate between these two problem formulations and explore opportunities
at their intersection.

Figure 3:  Comparison of the operational area differences between prior work
(a) and Enigma (b).

##  III Methodology

###  III-A Threat Model

Entities: We consider two entities: the client, who aims to solve a QAOA
problem, and the server, which provides cloud access to one or multiple
quantum computing devices. In our threat model, we do not distinguish between
quantum computer manufacturers (e.g., IBM) and third-party cloud service
providers (e.g., Amazon).

Assets: All information related to the QAOA problem is considered sensitive,
including the number of variables, problem coefficients, and the structure of
the problem graph.

Adversaries: We consider a malicious server (i.e., the cloud provider is
malicious) or a compromised server (where a malicious insider has access). In
both scenarios, we assume that the server does not tamper with the output
(such tampering can be detected by checking the quality of the solution).

Capabilities: We assume the server can distinguish QAOA circuits and, given
their structured nature, could potentially reverse-engineer them to infer the
problem graph.

Mitigations: We propose three SQC schemes that obfuscate the QAOA problems
prior to circuit creation. Each technique is designed to conceal some or all
of the sensitive elements in QAOA, ranging from obscuring coefficients to
introducing decoy variables and masking the problem structure.

Residual Risk: While we protect different attributes (coefficient, nodes,
edges) by transforming the given graph, there is still some information
visible to the server. For example, the transformed graph will have at-least
as many nodes and edges in the problem graph as we cannot reduce the problem
size.

###  III-B Figure of Merit

We assess classical optimizer performance in QAOA parameter tuning using the
Approximation Ratio (AR), as

$AR=\frac{\text{Expected Value}}{\text{Global Minimum}}.$ (2)

With benchmarks having negative global minima, $AR\in(-\infty,1]$, where
higher is better. While previous studies used AR or Approximation Ratio Gap
(ARG) for comparison on the same problem [1, 29, 50, 84, 6], Enigma’s problem
transformation necessitates a different metric. We define the Restricted
Approximation Ratio (RAR) as

$RAR=\frac{\text{EV for the top }k\text{ outcomes}}{\text{Global Minimum}}.$
(3)

Similar to AR, $RAR\in(-\infty,1]$, and higher is better. In this study, we
set $k=5$.

To assess the obfuscation efficacy, we conduct analytical studies aimed at
quantifying the difficulty an adversary would encounter when attempting to
penetrate the system.

###  III-C Benchmarking

We test Enigma on graphs with diverse structures: 3-regular,
Sherrington–Kirkpatrick (SK) [78] (fully connected), random or Erdős–Rényi
(ER) [36, 46] with edge probability 0.6, and Barabasi–Albert (BA) [14] with
attachment factors of $\text{BA}_{1}=1$ and 2, denoted by BA-1 and BA-2,
respectively. Such structures benchmark QAOA performance with edge weights
($J_{ij}$) from $\\{-1,+1\\}$ and linear coefficients ($\mathbf{h}_{i}$) at
zero [84, 6, 28, 49, 82, 26, 2, 54, 17, 8]. Although current quantum computers
feature hundreds of qubits, their noise levels restrict reliable QAOA circuit
execution to a few dozen qubits. Hence, our study’s randomly generated
benchmarks are limited to fewer than ten qubits, considering that embedding
decoy qubits in Enigma expands the problem size.

###  III-D Software and Hardware Platforms

We used the 127-qubit IBM Brisbane and IBM’s Qiskit as our hardware and
software platforms, respectively. Circuits are compiled at optimization level
three, and executed for 10,000 trials in a noise-free (ideal simulator) and
for 40,000 trials in a noisy (real) settings. For circuit parameter
optimization, we utilize the COBYLA optimizer [71].

Figure 4:  Overview of Enigma-I

##  IV Enigma-I: Ciphering Coefficients

We present _Enigma-I_ , an application-specific SQC scheme for safeguarding
the security and privacy of QAOA applications by encrypting the coefficients
of Ising Hamiltonians, thereby perturbing the output distribution. This
renders both the input problem and the outcomes incomprehensible to
compromised and malicious servers.

###  IV-A Overview of Enigma-I

Enigma-I leverages the property of spin variables $\mathbf{z}$ that take
values from $\\{-1,+1\\}$, where flipping the sign functions as a bit-flip in
the binary domain. For a given QAOA problem, Enigma-I randomly selects a
subset of qubits, toggles the sign of their coefficients (i.e., from $-1\to+1$
and vice versa), and then multiplies all coefficients by a random positive
number. This effectively conceals the sign and magnitude of the problem’s
coefficients. Consequently, this action inverts the measurement outcomes of
the targeted qubits, and only the client, who knows the list of flipped
qubits, can decipher the outcomes to retrieve the correct output distribution.
Figure 4 provides an overview of the Enigma-I scheme.

Figure 5:  A four-node QAOA problem with its cost table. The table displays
the top five out of 16 arrangements, sorted with higher rows representing
lower objective values, with the global minimum highlighted at the top. (a)
The initial QAOA problem. (b) Result of applying spin flips to
$\mathbf{z}_{1}$ and $\mathbf{z}_{2}$. (c) Outcome of scaling all coefficients
in (b) by a factor $\tau<1$, which narrows the gap between energy levels. (d)
Effect of scaling all coefficients in (b) by a factor $\tau>1$, widening the
gap between energy levels.

###  IV-B Target Qubits: Decription Key

Enigma-I begins by forming a list of _target qubits_. To compile this list,
qubits are uniformly and independently selected, ensuring that the size and
contents of the target qubit list vary randomly each time. This list serves as
the encryption key and must be securely stored, as anyone in possession of it
can decrypt the QAOA output distribution.

###  IV-C Spin Flips: Obfuscating Sign of Coefficients

Let $T$ be the list of target qubits. Enigma-I encrypts the signs of the
coefficients as:

$\hat{\mathbf{h}}_{i}=\begin{cases}-\mathbf{h}_{i}&i\in T,\\\
\mathbf{h}_{i}&i\notin T;\end{cases}$ (4)

and

$\hat{J}_{ij}=\begin{cases}-J_{ij}&(i\in T\;\&\;j\notin
T)\;\text{or}\;(i\notin T\;\&\;j\in T),\\\
J_{ij}&\text{otherwise}.\end{cases}$ (5)

Figure 5(b) illustrates the impact of a spin flip by Enigma-I on a four-qubit
problem graph (Fig. 5(a)) when $T=\\{z_{1},z_{2}\\}$. Since target qubits are
selected randomly and independently, this process effectively conceals the
signs of the coefficients.

Moreover, as demonstrated in Fig. 5(b), spin flips on target qubits alter
their values in the global minimum configuration without affecting the overall
objective value. In essence, applying spin flips leaves the Ising
Hamiltonian’s energy spectrum intact but permutes the qubit states associated
with each energy level. Consequently, the global minima of both the original
and encrypted Hamiltonians remain the same, ensuring that while the server
computes the minimum for the encrypted version, it simultaneously addresses
the hidden primary problem.

###  IV-D Stretching: Obfuscating Magnitude of Coefficients

Multiplying any objective function $f$ by a positive scalar
$\tau\in(0,+\infty)$ alters its scale but preserves the ordering of $f’$s
values. Leveraging this insight, Enigma-I multiplies all coefficients
($\hat{\mathbf{h}}$ and $\hat{J}$) by a randomly generated positive number
$\tau$ to obfuscate the magnitudes of the problem’s coefficients.

For $0<\tau<1$, $f$ is contracted (Fig. 5(c)); for $\tau>1$, it is stretched
(Fig. 5(d)); and for $\tau=1$, $f$ remains unchanged (Fig. 5(b)). By default,
Enigma-I sets the value of $\tau$ as

$\tau=1+\left|\mathcal{N}(\mu=1,\sigma=1)\right|,$ (6)

where $\mathcal{N}(\mu=1,\sigma=1)$ denotes a normal random variable with mean
$\mu=1$ and standard deviation $\sigma=1$. This ensures that Enigma-I does not
decrease the gap between the global minimum (the lowest energy level) and the
first excited state (the energy level immediately above the global minimum),
which is directly correlated with the success probability of quantum
optimization heuristics [67].

###  IV-E Decrypting Outcomes

The server tunes the circuit parameters of the ciphered QAOA program, while
the client is interested in the global minimum of the original QAOA problem.
To retrieve the output distribution of the original problem, it is only
necessary to toggle the values of the qubits in the target qubits list $T$,
preserving their associated probability or frequency value.

###  IV-F Overhead of Enigma-I

Enigma-I can utilize the same parametric circuit as the primary problem,
thereby imposing no additional quantum overhead. On average, Enigma-I takes
0.39 seconds to obfuscate problems and 0.02 seconds to decode outcomes for
500-qubit problems on a laptop, across all benchmark types. The complexity of
obfuscating problems in Enigma-I is $O\left(\left|J\right|\right)$, where
$\left|J\right|$ denotes the edge count in problem graph, and the complexity
of decrypting outcomes is $O(n)$.

###  IV-G Security Analysis

The list of target qubits $T$ functions as the decryption key in Enigma-I, and
thus, the client keeps it secret and does not share it with the server. Let
$\left|T\right|$ be the number of qubits in $T$, then the server would need to
consider ${n\choose\left|T\right|}$ possible bit flips. However, since the
server is unaware of $\left|T\right|$, the attack complexity from an honest-
but-curious server’s perspective is:

$\text{Attack Complexity}=O\left({2^{n}}\right).$ (7)

Enigma-I modifies the problem Hamiltonian by scaling all coefficients.
However, the attacker does not need to recover the coefficients with full
precision. Given Eq. (6), most $\tau$ values fall within the range $[1,4]$.
Therefore, the complexity of retrieving problem coefficients with a precision
of $\alpha$ is $\frac{1}{3\alpha}$. For instance, $\alpha=1\%$ precision
yields 300 combinations.

###  IV-H Inherent Limitation of Enigma-1

To solve a problem using QAOA, the problem must first be cast into an Ising
Hamiltonian, with the Ising model’s coefficients ($\mathbf{h}$ and $J$)
defined so that the Ising model’s global minimum corresponds to the problem’s
solution. Casting is tailored to each specific problem, necessitating the
design of a unique casting algorithm for each application. If a particular
casting algorithm invariably results in all positive (or all negative) linear
coefficients $\mathbf{h}$, and if the server knows of such an algorithm’s use,
this could potentially reveal the list of target qubits, thereby decrypting
the outcome bitstrings. Nonetheless, we do not currently know of any such
casting algorithms, nor whether it is feasible for an algorithm to
consistently produce all positive (or all negative) coefficients. It is
important to note that casting algorithms may yield all zero linear
coefficients ($\mathbf{h}=0$) [59], which does not aid an attacker as no
information can be gleaned from a zero vector.

###  IV-I Evaluation Results: Proof-of-Concept

####  IV-I1 Impact on Circuit Properties

Enigma-I implements all changes directly on the coefficients of the problem
Hamiltonian, and since these coefficients serve as rotation values in QAOA
circuits—alongside QAOA parameters—both the baseline and Enigma-I can utilize
the same parametric circuit, ensuring that Enigma-I has no effect on the
circuit’s properties.

####  IV-I2 Impact on QAOA Fidelity

Figure 6(a) displays the Approximation Ratio (AR) convergence for Enigma-I and
standard QAOA (Baseline) on a BA-2 benchmark problem. We observed instances
where Enigma-I achieved a higher AR value after tuning circuit parameters.
However, since Enigma-I encrypts the QAOA problem, it results in different
optimization landscapes for the classical optimizer compared to standard QAOA
circuits. Our goal is not to compare their convergence directly; rather, we
aim to ensure proper convergence for both techniques.

Figure 6(b) illustrates the average Restricted Approximation Ratio (RAR)
across five problem types compared to the baseline, revealing that Enigma-I
lowers QAOA fidelity by up to 1% (avg. 0.7%). Enigma-I can employ the same
parametric circuit as standard QAOA since all its encryptions are applied
directly to problem coefficients, which are utilized as rotation values in the
circuit. Therefore, any differences in fidelity between Enigma-I and the
baseline, as shown in Fig. 6(b), can be attributed to the stochastic nature of
quantum hardware. Consequently, Enigma-I can perform comparably to QAOA in
practical applications on near-term quantum devices.

(a)  (b)

Figure 6:  (a) Approximation Ratio (AR) convergence for a BA-2 benchmark graph
under noisy conditions (higher is better). (b) Mean Restricted Approximation
Ratio (RAR) across various problem sizes compared to the baseline (lower is
better).

###  IV-J Mitigations and Residual Risks

Enigma-I masks the values of QAOA coefficients and induces random spin flips
on the results, effectively hiding both inputs and outputs from the server.
However, the server can still access additional information, such as the qubit
count, the problem graph topology, and the distribution of coefficient values.
In the following section, we introduce _Enigma-II_ , which offers further
mitigations and reduces the residual risk.

Figure 7:  Mapping the Ising model (acting on spin variables
$\mathbf{z}_{i}\in\\{-1,+1\\}$) to its Quadratic Unconstrained Binary
Optimization (QUBO) model (acting on Binary variables
$\mathbf{x}_{i}\in\\{0,1\\}$) enables Enigma-II to embed decoy qubits
$\mathbf{y}_{1}$ and $\mathbf{y}_{2}$, rendering them undetectable to the
server. The mapping involves calculating QUBO coefficients (linear: $A_{ii}$;
quadratic: $A_{ij}$) from the Ising model’s coefficients (linear:
$\mathbf{h}$; quadratic: $J$). In the obfuscated problem, $B$ and $C$
represent the coefficients for decoy terms.  Figure 8:  Linear
Transformability of the Ising Hamiltonian—$f(\mathbf{z})$ with
$\mathbf{z}_{i}\in\\{-1,+1\\}$—and the Quadratic Unconstrained Binary
Optimization (QUBO)—$g(\mathbf{x})$ with $\mathbf{x}_{i}\in\\{0,1\\}$,
depicting the linear conversion process between the two representations.
Figure 9:  Overview of Enigma-II

##  V Enigma-II: Adding Decoy Qubits

We introduce _Enigma-II_ , an enhancement of Enigma-I, which obfuscates the
problem structure by embedding decoy qubits indetectable to the server,
thereby offering advanced protection for QAOA users. However, integrating
decoy qubits with existing qubits is nontrivial. It is essential for clients
to correctly interpret the solution of the original problem from the
obfuscated solution provided by the server. The Ising model, which uses spin
variables $\mathbf{z}_{i}\in\\{-1,+1\\}$, can be transformed into the
Quadratic Unconstrained Binary Optimization (QUBO) model, where the variables
are binary $\mathbf{x}_{i}\in\\{0,1\\}$. This transformation is important
because it allows us to apply linear algebra techniques. By converting the
Ising model to a QUBO model, we can express the objective function in a matrix
form [12, 10]. This matrix representation is helpful in using linear algebra
methods to accurately recover the solution, as illustrated in Fig. 7. Figure 8
illustrates the process of mapping between Ising and QUBO models.

###  V-A Overview of Enigma-II

Figure 9 overviews the Enigma-II scheme. It transforms the Ising Hamiltonian
to QUBO, introduces decoy variables, and permutes them to obscure primary and
decoy variables. After reverting to the Ising model, it applies a final
obfuscation with Enigma-I before server submission.

###  V-B Transforming Ising to QUBO: Facilitating Matrix Representation for
Solution Recovery

Enigma-II begins by transforming the input Ising Hamiltonian into a QUBO
formulation: $f(\mathbf{z})\mapsto g(\mathbf{x})$ (Fig. 7). Given
$\mathbf{x}_{i}\in\\{0,1\\}$, the task of finding the global minimum of
$g(\mathbf{x})$ is equivalent to minimizing

$\mathbf{x}^{T}A\mathbf{x},$ (8)

where $A$ is the coefficient matrix with its diagonal elements, $A_{ii}$,
representing linear coefficients and off-diagonal elements representing
quadratic coefficients.

###  V-C Embedding Decoy Qubits

Enigma-II perturbs problem structure by appending $m$ decoy variables, denoted
by $\mathbf{y}$ to the $\mathbf{x}$ as:

$\tilde{\mathbf{x}}=\left[\mathbf{x}_{1},\mathbf{x}_{2},\dots,\mathbf{x}_{n},\mathbf{y}_{1},\mathbf{y}_{2},\dots,\mathbf{y}_{m}\right]^{T}$
(9)

However, simply adding decoy variables is insufficient; they must be
indistinguishable to the server by creating decoy quadratic terms. To this
end, the coefficient matrix $A$ is augmented to

$\tilde{A}=\left(\begin{array}[]{cc}A&B\\\ B^{T}&C\\\ \end{array}\right),$
(10)

Where $B\in\mathbb{R}^{n\times m}$ is the interaction matrix between
$\mathbf{x}$ and $\mathbf{y}$, and $C\in\mathbb{R}^{m\times m}$ for
$\mathbf{y}$ interactions (Fig. 7). Hence, minimizing (8) is recast as
minimizing

$\tilde{\mathbf{x}}^{T}\tilde{A}\tilde{\mathbf{x}}.$ (11)

###  V-D Guarantying a Successful Recovery

The global minimum of the original problem—concealed from the server—must be
recoverable using the solution to the obfuscated problem provided by the
server. Let $\mathbf{x}^{*}$ and $\tilde{\mathbf{x}}^{*}$ represent the global
minima of (8) and (11), respectively. Enigma-II ensures that $\mathbf{x}^{*}$
and $\tilde{\mathbf{x}}^{*}$ consistently match in primary variable values
through constraints on $B$ and $C$. Note that the value of decoy variables
($\mathbf{y}$) is immaterial.

Expanding (11) follows

$\displaystyle\tilde{\mathbf{x}}^{T}\tilde{A}\tilde{\mathbf{x}}$
$\displaystyle=\left(\begin{array}[]{cc}\mathbf{x}^{T}&\mathbf{y}^{T}\\\
\end{array}\right)\left(\begin{array}[]{cc}A&B\\\ B^{T}&C\\\
\end{array}\right)\left(\begin{array}[]{cc}\mathbf{x}\\\ \mathbf{y}\\\
\end{array}\right)$ (17)
$\displaystyle=\mathbf{x}^{T}A\mathbf{x}+2\mathbf{x}^{T}B\mathbf{y}+\mathbf{y}^{T}C\mathbf{y}.$
(18)

Our objective is to guarantee that

$\tilde{\mathbf{x}}^{*}=\left[\mathbf{x}^{*};\mathbf{y}^{*}\right].$ (19)

We argue that satisfying the following conditions is sufficient for 19 to
hold:

  1. 1.

$B$ is non-negative;

  2. 2.

$C$ is such that $\mathbf{y}^{*}$ is the global minimum of
$\mathbf{y}^{T}C\mathbf{y}$;

  3. 3.

$\mathbf{x}^{T}B\mathbf{y}^{*}=0$ for any binary $\mathbf{x}$.

Values of $B$ and $C$ are drawn randomly from positive distributions (see
Section V-E), thus the first constraint is readily addressed during the
generation of decoy edge weights. To meet the other constraints, we define
$\mathbf{y}^{*}$ as the zero vector $[0,0,\dots,0]^{T}$. With
$\mathbf{y}_{i}\in\\{0,1\\}$, a non-negative matrix $C$ ensures compliance
with the second and third constraints.

###  V-E Adding Decoy Edges: Uniformizing Coefficients

Decoy edges are introduced to render the decoy variables indistinguishable to
the server. There are two types of decoy edges: (a) those connecting a primary
variable $\mathbf{x}_{i}$ to a decoy variable $\mathbf{y}_{j}$, established by
assigning a nonzero positive value to $B_{ij}$; and (b) those between two
decoy variables $\mathbf{y}_{i}$ and $\mathbf{y}_{j}$, created by setting
$C_{ij}$ to a nonzero positive value. These decoy edges correspond to new
(decoy) quadratic terms.

Enigma-II randomly specifies both the positions and values of nonzero entries
in matrices $B$ and $C$. For each column of $B$, Enigma-II generates a random
integer $k_{i}^{\text{out}}$ within the range of one to
$k{\text{max}}^{\text{out}}$ (default: $k_{\text{max}}^{\text{out}}=1$), and
randomly selects $k_{i}^{\text{out}}$ rows in that column to assign nonzero
positive values. Likewise, each column of $C$ is assigned at least one and no
more than $k_{\text{max}}^{\text{in}}$ nonzero entries (default:
$k_{\text{max}}^{\text{in}}=1$).

Figure 10:  (a) The distribution of problem coefficient values. (b) Generating
decoy edge weights using the current probability distribution preserves its
profile. (c) Employing inverse probability in the roulette wheel approach
yields a more uniform coefficient distribution.

Inspired by the natural selection operator in evolutionary algorithms [57, 80,
33, 77], Enigma-II employs a roulette wheel to generate random weights for
decoy edges. Existing coefficients are bucketed into $b$ bins (default:
$b=10$), and normalized frequency values serve as the probability of the
associated bins, denoted by $p_{i}$. To construct the roulette wheel, Enigma-
II offers two options for defining the sector values $R_{i}$ associated with
$b_{i}$: (a) $R_{i}=p_{i}$, preserving the distribution of existing
coefficients; and (b) $R_{i}=\frac{1}{p_{i}}$ (i.e., using inverse
probability), uniformizing the final coefficient distribution (see Fig. 10).
By default, Enigma-II opts for the latter to obscure the coefficient magnitude
distribution from the server. All decoy edge weights are positive (see
SectionV-D); however, Enigma-II takes additional measures (see Section V-G) to
conceal the distribution of coefficient signs.

###  V-F Permuting Qubits

Appending decoy variables to the end (or beginning) of the vector of primary
variables (i.e., $\tilde{\mathbf{x}}=[\mathbf{x},\mathbf{y}]$) may make
most—but not all—decoy qubits distinguishable to the server. It is important
to note that the number of decoy variables, $m$, remains concealed from the
server. To ensure that primary and decoy variables are indistinguishable from
each other, Enigma-II permutes the entries of $\tilde{\mathbf{x}}$.

Enigma-II generates a random permutation matrix
$P\in{0,1}^{(N+m)\times(N+m)}$. A permutation matrix is a sparse matrix with
exactly one nonzero entry in each row and column, and since
$\tilde{\mathbf{x}}$ is a binary vector, all nonzero entries of $P$ are ones.
Shuffling the columns of the identity matrix $I$ produces a random permutation
matrix.

Since $P$ is a unitary matrix, we have $P^{-1}=P^{T}$. Therefore, we can
rewrite (11) as

$\displaystyle\tilde{\mathbf{x}}^{T}\tilde{A}\tilde{\mathbf{x}}$
$\displaystyle=\tilde{\mathbf{x}}^{T}P^{T}P\tilde{A}P^{T}P\tilde{\mathbf{x}}$
$\displaystyle=\left(\tilde{\mathbf{x}}^{T}P^{T}\right)\left(P\tilde{A}P^{T}\right)\left(P\tilde{\mathbf{x}}\right)$
$\displaystyle=\hat{\mathbf{x}}\hat{A}\hat{\mathbf{x}},$ (20)

where $\hat{\mathbf{x}}=P\tilde{\mathbf{x}}$ and $\hat{A}=P\tilde{A}P^{T}$. In
the reformulated scenario, only the coefficient matrix $\hat{A}$ of the
obscured problem is disclosed to the server.

###  V-G Forming Ising Hamiltonian

Both Ising and QUBO models are linearly equivalent, as shown in Fig. 8.
However, Enigma-II transforms $\hat{A}$ into an Ising Hamiltonian and applies
Enigma-I for additional obfuscation before sharing $\hat{\mathbf{h}}$ and
$\hat{J}$ with the server.

###  V-H Decrypting Outcomes

Decrypting outcomes with Enigma-II follows the reverse sequence of the
obfuscation layers applied. Initially, the decryption is facilitated by
Enigma-I’s decryption module using the _target qubits_ list ($T$), which then
remaps the resulting spin variables into the binary domain, yielding
$\hat{\mathbf{x}}$. The permutation’s effect is subsequently undone by

$\tilde{\mathbf{x}}=P^{T}\hat{\mathbf{x}}=[\mathbf{x}_{1}^{*},\mathbf{x}_{2}^{*},\dots,\mathbf{x}_{n}^{*},\mathbf{y}_{1}^{*},\mathbf{y}_{2}^{*},\dots,\mathbf{y}_{m}^{*}]^{T}.$
(21)

Here, the primary variables $\mathbf{x}$ are represented by the first $n$
elements, while the final $m$ elements—associated with the decoy variables—are
omitted, as they hold no value for the client. Notably, the knowledge of the
exact count of decoy variables $m$ is exclusive to the client.

###  V-I Overhead of Enigma-II

The primary quantum overhead for Enigma-II is adding $m$ decoy qubits, where
$m$ is user-defined and remains constant regardless of the problem size. On
average, Enigma-II requires 6.53 seconds to obfuscate and 1.04 seconds to
decode outcomes for 500-qubit problems on a standard laptop, across all
benchmark types. The computational complexities for the obfuscation and
decoding processes in Enigma-II are $O\left((n+m)^{3}\right)$ and
$O\left((n+m)^{2}\right)$, respectively.

###  V-J Security Analysis

Decrypting Enigma-II outcomes includes three layers: (a) attenuating spin
flips caused by Enigma-I (the last step of Enigma-II), with the attack
complexity of $2^{n+m}$; (b) undoing the variable permutation, examining
$(n+m)!$ possible permutation matrices; and (c) extracting $n$ primary
variables from a vector of size $n+m$, with the complexity of $n+m$ as the
attacker is unaware of $m$ and whether decoy variables have been added to the
beginning or end of the primary variable vector. Hence, the attack complexity
in Enigma-II from an honest-but-curious server’s perspective is:

$\text{Attack Complexity}=O\left({(n+m)\times(n+m)!\times 2^{n+m}}\right).$
(22)

###  V-K Inherent Limitation of Enigma-II

When a problem graph is regular, embedding decoy qubits randomly can aid an
attacker in identifying them, as they deviate from the general graph
structure. As $m\to\infty$, the output graph theoretically becomes random, but
this is impractical since each decoy variable requires one qubit. Therefore,
for regular graphs, Enigma-II is not advisable; instead, users should opt for
Enigma-I or Enigma-III (Section VI). In the case of fully connected graphs,
however, connecting decoy qubits to all existing qubits preserves the fully-
connected structure in the obfuscated graph.

###  V-L Evaluation Results: Proof-of-Concept

####  V-L1 Impact on Circuit Properties

Figure 11(a) shows the GMEAN of IBM’s native two-qubit gate (ECR) count for
Enigma-II with one and two decoy qubits ($m=1$ and 2), relative to the
baseline, across all benchmark types. We observe that since $m$ does not scale
with $n$, the relative impact of embedding decoy qubits decreases as the
problem size increases ($m/n\to 0$ as $n\to\infty$). Similarly, Fig. 11(b)
shows the circuit depth for Enigma-II with $m=1$ and 2 across five benchmark
types in comparison to standard QAOA. The fluctuations depicted in Fig. 11(b)
are due to the stochastic nature of the compilation techniques, and we
generally expect similar trends in circuit depth and ECR count.

(a)  (b)

Figure 11:  GMEAN of ENIGMA-II’s circuit properties (embedding $m=1$ and $2$
decoy qubits), relative to the standard QAOA Circuit (baseline), post-
compiling for IBM Brisbane, across five benchmark graph types: (a) Echoed
Cross-Resonance (ECR) gate counts, and (b) circuit depth. Lower is better.

####  V-L2 Impact on Fidelity

Figure 12(a) shows the AR convergence for Enigma-II and standard QAOA on a
BA-2 benchmark problem. Note that as Enigma-II encrypts the QAOA problem, it
and the baseline address distinct problems with different QAOA circuit
landscapes. Figure 12(b) depicts the average RAR across five problem types
relative to the baseline, where Enigma-II is observed to reduce QAOA fidelity
by up to 4% (avg. 2%) with the embedding of $m=1$ decoy qubit.

(a)  (b)

Figure 12:  (a) AR convergence for a BA-2 benchmark graph under noisy
conditions (higher is better). (b) Mean RAR across various problem sizes
compared to the baseline (lower is better).

###  V-M Mitigations and Residual Risks

Enigma-II can obscure most aspects of QAOA information; however, certain
sources of information, such as the overall structure of the problem graph,
remain visible to the server. For instance, in problems involving “power-law”
graph structures, merely adding decoy gates does not conceal the hotspots [6].
In the following section, we introduce _Enigma-III_ , which offers further
mitigations and reduces the residual risk.

##  VI Enigma-III: Regularizing Qubits

We present _Enigma-III_ , which strategically incorporates decoy qubits to
regularize the problem graph, effectively concealing its structure from the
server as demonstrated in Fig. 13. Paul Erdős (1963) proved that regularizing
any graph is possible through the addition of new nodes and the meticulous
placement of edges: new nodes are connected to existing ones and to each other
without adding links between the original nodes[35]. Utilizing this insight,
Enigma-III calculates the least number of decoy qubits needed to regularize
the input problem and strategically introduces decoy edges to equalize the
degree across all qubits.

###  VI-A Enigma-II vs. Enigma-III

Enigma-III differs from Enigma-II in two key aspects: (a) Unlike Enigma-II,
where the client sets the number of decoy variables $m$, Enigma-III
algorithmically determines $m$ to achieve a regular graph structure; and (b)
the introduction of decoy edges is not random but rather orchestrated to
ensure that all variables, including both primary and decoy, have the same
degree (Fig. 13).

Figure 13:  Enigma-III embedds two decoy variables ($\mathbf{y}_{1}$ and
$\mathbf{y}_{2}$) to transform the input Dragon graph into a 3-regular graph.

###  VI-B How Many Decoy Qubits?

Let $d_{i}$ be the degree of $\mathbf{x}_{i}$, and let $d^{*}$ (where
$d^{*}\geq d_{i}$ for all $i$) be the target degree for the regular graph’s
output. The deficiency of $\mathbf{x}_{i}$ is defined as

$e_{i}=d^{*}-d_{i},$ (23)

and the total deficiency of the problem graph is

$s=\sum_{i=1}^{n}{e_{i}}.$ (24)

Let $m$ be the number of decoy variables. Meeting the following conditions is
necessary and sufficient for rendering the graph $d^{*}$-regular [35]:

  1. 1.

$md^{*}\geq s$;

  2. 2.

$m^{2}-(d^{*}+1)m+s\geq 0$;

  3. 3.

$m\geq\max(e_{i})$;

  4. 4.

$(m+n)d^{*}$ is an even number.

Introducing each decoy variable requires an additional qubit; therefore, we
seek the smallest integer $m$ that satisfies all four aforementioned
conditions. We observe that Solvers like Z3 [30, 9] may be unsuitable for
large-scale problems due to potential computational delays in determining the
minimal $m$. However, as $m=O(n)$, we observe that a linear search from
$m_{\text{min}}$ (default: $m_{\text{min}}=0$) to $n$ can efficiently solve
this problem, often in less than a second.

###  VI-C How to Add Decoy Qubits?

After determining $m$, Enigma-III first ensures that the primary variables
attain a degree of $d^{*}$ by establishing connections between decoy and
primary nodes. Subsequently, it connects decoy nodes with degrees less than
$d^{*}$, prioritizing those with the highest deficiency, until all $n+m$ nodes
reach a degree of $d^{*}$, thus forming a $d^{*}-$regular graph.

###  VI-D Overhead of Enigma-III

The primary quantum overhead of Enigma-III is adding $m$ decoy qubits;
however, unlike Enigma-II, $m$ scales sub-linearly with $n$. On average,
Enigma-III employs 15.4 seconds to obfuscate and 1.32 seconds to decode
outcomes for 500-qubit problems on a standard laptop, across all benchmark
types. The computational complexity of Enigma-III is similar to that of
Enigma-II.

###  VI-E Security Analysis

While Enigma-III enhances privacy by regularizing the obfuscated problem
graph, it shares the same attack complexity with Enigma-II, as detailed below:

$\text{Attack Complexity}=O\left({(n+m)\times(n+m)!\times 2^{n+m}}\right).$
(25)

###  VI-F Evaluation Results: Proof-of-Concept

####  VI-F1 Impact on Circuit Properties

Figure 14(a) displays the GMEAN of IBM’s native two-qubit gate (ECR) count and
circuit depth for Enigma-III compared to the baseline across all benchmark
types, indicating a linear scaling of ECR count and circuit depth with problem
size. Likewise, Fig. 14(b) shows that the number of decoy qubits in Enigma-III
increases sub-linearly with problem size.

(a)  (b)

Figure 14:  (a) GMEAN of ENIGMA-III’s QAOA circuit properties, relative to the
standard QAOA Circuit (baseline), post-compiling for IBM Brisbane, across five
benchmark graph types. (b) Mean number of decoy qubits ($m$) required by
Enigma-III to regularize problem graphs across five benchmark graph
topologies. Lower is better.

####  VI-F2 Impact on Fidelity

Figure 15(a) illustrates the convergence of the AR for Enigma-III and standard
QAOA on a BA-2 benchmark problem. Figure 15(b) presents the average RAR across
various problem sizes in comparison to the baseline. We observe that
regularizing the problem graphs can lower the QAOA fidelity by up to 30% (avg.
13%). As quantum hardware improves and device error reduces, a lesser
reduction in fidelity by Enigma-III can be expected in the near term.

###  VI-G Mitigations and Residual Risks

Enigma-III provides the highest level of privacy for QAOA applications.
However, although the obfuscated problem graph is regularized, the degree of
this regular graph serves as an upper bound for the node with the highest
degree in the primary graph, information that remains visible to the server.
Currently, we are unaware of any security or privacy issues associated with
this piece of information.

(a)  (b)

Figure 15:  (a) AR convergence for a BA-2 benchmark graph under noisy
conditions (higher is better). (b) Mean RAR across various problem sizes
compared to the baseline (lower is better).

##  VII When and Where to Use Enigma?

Enigma-I conceals both problem coefficients and results without incurring
additional quantum overhead, making it immediately deployable on current and
near-term QCs. Enigma-I is particularly effective for regular input problems,
a common characteristic in real-world scenarios. Importantly, when an attacker
encounters a regular problem, it cannot discern if the problem was inherently
regular or regularized by Enigma-III. Enigma-I can offer enhanced privacy
without any quantum overhead or fidelity reduction.

Enigma-II builds on Enigma-I by introducing decoy qubits to perturb the
problem’s structure. In Enigma-II, the number of decoy qubits $m$ does not
scale with the problem size $n$, which is advantageous for near-term quantum
computers as the relative impact of adding decoy qubits diminishes with
increasing problem size ($m/n\to 0$ as $n\to\infty$). Enigma-II is
particularly suitable for problems with irregular or random structures, where
it is challenging for attackers to identify decoy qubits. However, Enigma-II
is not recommended for regular problem graphs, as decoy qubits can be more
readily detected by an attacker.

Enigma-III provides the highest level of protection by embedding additional
decoy qubits to regularize the problem. Contrary to Enigma-II, where $m$ is
independent of $n$, in Enigma-III, $m$ increases sub-linearly with the problem
size, making it well-suited for the forthcoming generation of quantum hardware
expected to have lower device errors.

With the Ising model adopted as the standard input for emerging optimization
accelerators, both quantum and classical, the scope and applicability of
Enigma schemes expand beyond QAOA to include platforms such as optical Ising
processors [70, 53, 60], Fujitsu’s digital annealers [65, 75, 3], Toshiba’s
simulated bifurcation machines [86, 47, 85], and quantum annealers [61, 7].

##  VIII Related Work

Secure Quantum Computing (SQC) is a nascent field that tackles the delegation
of quantum programs to untrusted remote servers, categorizing techniques
mainly into Blind Quantum Computing (BQC) and Quantum Homomorphic Encryption
(QHE). Traditional BQC protocols typically presuppose quantum capabilities on
the client’s side [20, 64, 55, 42, 43, 23], depending on a quantum network
infrastructure that’s not yet universally accessible. Recent techniques [73,
51, 62, 45, 44, 42] allow classical clients to operate using multiple, non-
communicating servers, a practice that paradoxically relies on “untrusted”
entities. QHE, on the other hand, accommodates classical clients on a single
server but confronts notable hurdles, such as exponential computational
overheads and the prerequisite of sophisticated quantum error correction [21,
41, 19, 31, 68, 83, 91, 56]. In contrast, Enigma avoids reliance on emerging
technologies or segregated servers, offering polynomial computational
overhead, thereby making it a viable option for current and near-term quantum
systems.

A recent study [87] proposes a quantum hardware architecture tailored for
superconducting QCs. Although promising, this approach may not be secure for
near-term quantum programs with well-structured circuits. On the other hand,
Enigma can protect the privacy of QAOA applications across all types of
quantum devices.

##  IX Conclusion

We propose _Enigma_ as a SQC protocol specifically designed to safeguard the
privacy of QAOA applications executed on untrusted quantum computers. QAOA
applications comprise three types of sensitive information: coefficients,
problem topology, and variable values. To address these, we introduce three
distinct schemes, each targeting different QAOA aspects.

_Enigma-I_ obscures the values of QAOA coefficients and triggers random spin
flips in the results, effectively concealing both the inputs and outputs from
the server’s perspective. However, the server might still access additional
information, such as the qubit count and the problem graph’s topology. To
address this, we present _Enigma-II_ , which builds on Enigma-I by integrating
decoy variables to disturb and mask the problem’s structure. While Enigma-II
can veil most QAOA information facets, some information, like the problem
graph’s general structure, can still be discerned by the server. To mitigate
this, we introduce _Enigma-III_ , which enhances Enigma-II by strategically
embedding decoy variables so that all variables in the resulting problem have
the same degree, thereby regularizing the problem graph. For all Enigma
variants, we guarantee the retrieval of solutions for the original problem.
Our experiments show that Enigma’s privacy enhancements incur only a minor
fidelity reduction (1%–13%).

To the best of our knowledge, Enigma stands as the first application-specific
SQC proposal and the first privacy-preserving framework that is immediately
deployable on current and near-term QCs.

## References

  * [1] M. Alam, A. Ash-Saki, and S. Ghosh, “Circuit compilation methodologies for quantum approximate optimization algorithm,” in _2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO)_. IEEE, 2020, pp. 215–228.
  * [2] M. Alam, A. Ash-Saki, and S. Ghosh, “An efficient circuit compilation flow for quantum approximate optimization algorithm,” in _2020 57th ACM/IEEE Design Automation Conference (DAC)_. IEEE, 2020, pp. 1–6.
  * [3] M. Aramon, G. Rosenberg, E. Valiante, T. Miyazawa, H. Tamura, and H. G. Katzgraber, “Physics-inspired optimization for quadratic unconstrained problems using a digital annealer,” _Frontiers in Physics_ , vol. 7, p. 48, 2019.
  * [4] F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin, R. Barends, R. Biswas, S. Boixo, F. G. Brandao, D. A. Buell _et al._ , “Quantum supremacy using a programmable superconducting processor,” _Nature_ , vol. 574, no. 7779, pp. 505–510, 2019.
  * [5] R. Ayanzadeh, “Leveraging artificial intelligence to advance problem-solving with quantum annealers,” Ph.D. dissertation, University of Maryland, Baltimore County, 2020.
  * [6] R. Ayanzadeh, N. Alavisamani, P. Das, and M. Qureshi, “Frozenqubits: Boosting fidelity of qaoa by skipping hotspot nodes,” in _Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2_ , 2023, pp. 311–324.
  * [7] R. Ayanzadeh, P. Das, S. Tannu, and M. Qureshi, “Equal: Improving the fidelity of quantum annealers by injecting controlled perturbations,” in _2022 IEEE International Conference on Quantum Computing and Engineering (QCE)_. IEEE, 2022, pp. 516–527.
  * [8] R. Ayanzadeh, J. Dorband, M. Halem, and T. Finin, “Multi-qubit correction for quantum annealers,” _Scientific Reports_ , vol. 11, no. 1, p. 16119, 2021\.
  * [9] R. Ayanzadeh, M. Halem, and T. Finin, “Sat-based compressive sensing,” _arXiv preprint arXiv:1903.03650_ , 2019.
  * [10] R. Ayanzadeh, M. Halem, and T. Finin, “An ensemble approach for compressive sensing with quantum annealers,” in _IGARSS 2020-2020 IEEE International Geoscience and Remote Sensing Symposium_. IEEE, 2020, pp. 3517–3520.
  * [11] R. Ayanzadeh, M. Halem, and T. Finin, “Reinforcement quantum annealing: A hybrid quantum learning automata,” _Scientific Reports_ , vol. 10, no. 1, pp. 1–11, 2020.
  * [12] R. Ayanzadeh, S. Mousavi, M. Halem, and T. Finin, “Quantum annealing based binary compressive sensing with matrix uncertainty,” _arXiv preprint arXiv:1901.00088_ , 2019.
  * [13] J. S. Baker and S. K. Radha, “Wasserstein solution quality and the quantum approximate optimization algorithm: A portfolio optimization case study,” _arXiv preprint arXiv:2202.06782_ , 2022.
  * [14] A.-L. Barabási, R. Albert, and H. Jeong, “Scale-free characteristics of random networks: the topology of the world-wide web,” _Physica A: statistical mechanics and its applications_ , vol. 281, no. 1-4, pp. 69–77, 2000\.
  * [15] P. K. Barkoutsos, G. Nannicini, A. Robert, I. Tavernelli, and S. Woerner, “Improving variational quantum optimization using CVaR,” _Quantum_ , vol. 4, p. 256, apr 2020. [Online]. Available: https://doi.org/10.22331%2Fq-2020-04-20-256
  * [16] S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, “Demonstration of blind quantum computing,” _science_ , vol. 335, no. 6066, pp. 303–308, 2012.
  * [17] J. Basso, E. Farhi, K. Marwaha, B. Villalonga, and L. Zhou, “The quantum approximate optimization algorithm at high depth for maxcut on large-girth regular graphs and the sherrington-kirkpatrick model,” _arXiv preprint arXiv:2110.14206_ , 2021.
  * [18] S. Brandhofer, D. Braun, V. Dehn, G. Hellstern, M. Hüls, Y. Ji, I. Polian, A. S. Bhatia, and T. Wellens, “Benchmarking the performance of portfolio optimization with qaoa,” 2022. [Online]. Available: https://arxiv.org/abs/2207.10555
  * [19] A. Broadbent, “Delegating private quantum computations,” _Canadian Journal of Physics_ , vol. 93, no. 9, pp. 941–946, 2015.
  * [20] A. Broadbent, J. Fitzsimons, and E. Kashefi, “Universal blind quantum computation,” in _2009 50th annual IEEE symposium on foundations of computer science_. IEEE, 2009, pp. 517–526.
  * [21] A. Broadbent and S. Jeffery, “Quantum homomorphic encryption for circuits of low t-gate complexity,” in _Annual Cryptology Conference_. Springer, 2015, pp. 609–629.
  * [22] O. Bulancea Lindvall, “Quantum methods for sequence alignment and metagenomics,” 2019.
  * [23] A. M. Childs, “Secure assisted quantum computation,” _arXiv preprint quant-ph/0111046_ , 2001.
  * [24] J. Choi, S. Oh, and J. Kim, “Quantum approximation for wireless scheduling,” _Applied Sciences_ , vol. 10, no. 20, p. 7116, 2020.
  * [25] B. A. Cordier, N. P. Sawaya, G. G. Guerreschi, and S. K. McWeeney, “Biology and medicine in the landscape of quantum advantages,” _arXiv preprint arXiv:2112.00760_ , 2021.
  * [26] G. E. Crooks, “Performance of the quantum approximate optimization algorithm on the maximum cut problem,” _arXiv preprint arXiv:1811.08419_ , 2018.
  * [27] C. Dalyac, L. Henriet, E. Jeandel, W. Lechner, S. Perdrix, M. Porcheron, and M. Veshchezerova, “Qualifying quantum approaches for hard industrial optimization problems. a case study in the field of smart-charging of electric vehicles,” _EPJ Quantum Technology_ , vol. 8, no. 1, p. 12, 2021\.
  * [28] A. Das and B. K. Chakrabarti, “Colloquium: Quantum annealing and analog quantum computation,” _Reviews of Modern Physics_ , vol. 80, no. 3, p. 1061, 2008.
  * [29] P. Das, S. Tannu, and M. Qureshi, “Jigsaw: Boosting fidelity of nisq programs via measurement subsetting,” in _MICRO-54_ , 2021, pp. 937–949. [Online]. Available: https://dl.acm.org/doi/pdf/10.1145/3466752.3480044
  * [30] L. De Moura and N. Bjørner, “Z3: An efficient smt solver,” in _International conference on Tools and Algorithms for the Construction and Analysis of Systems_. Springer, 2008, pp. 337–340.
  * [31] Y. Dulek, C. Schaffner, and F. Speelman, “Quantum homomorphic encryption for polynomial-sized circuits,” in _Advances in Cryptology–CRYPTO 2016: 36th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2016, Proceedings, Part III 36_. Springer, 2016, pp. 3–32.
  * [32] D. J. Egger, C. Gambella, J. Marecek, S. McFaddin, M. Mevissen, R. Raymond, A. Simonetto, S. Woerner, and E. Yndurain, “Quantum computing for finance: State-of-the-art and future prospects,” _IEEE Transactions on Quantum Engineering_ , vol. 1, pp. 1–24, 2020.
  * [33] A. E. Eiben and J. E. Smith, _Introduction to evolutionary computing_. Springer, 2015.
  * [34] P. S. Emani, J. Warrell, A. Anticevic, S. Bekiranov, M. Gandal, M. J. McConnell, G. Sapiro, A. Aspuru-Guzik, J. T. Baker, M. Bastiani _et al._ , “Quantum computing at the frontiers of biological sciences,” _Nature Methods_ , vol. 18, no. 7, pp. 701–709, 2021.
  * [35] P. Erdös and P. Kelly, “The minimal regular graph containing a given graph,” _Amer. Math. Monthly_ , vol. 70, pp. 1074–1075, 1963.
  * [36] P. Erdős, A. Rényi _et al._ , “On the evolution of random graphs,” _Publ. math. inst. hung. acad. sci_ , vol. 5, no. 1, pp. 17–60, 1960.
  * [37] E. Farhi, J. Goldstone, and S. Gutmann, “A quantum approximate optimization algorithm,” _arXiv preprint arXiv:1411.4028_ , 2014.
  * [38] E. Farhi, J. Goldstone, and S. Gutmann, “A quantum approximate optimization algorithm applied to a bounded occurrence constraint problem,” _arXiv preprint arXiv:1412.6062_ , 2014.
  * [39] R. Feynman, “Simulating physics with computers,” _International Journal of Theoretical Physics_ , vol. 21, no. 6, 1982.
  * [40] M. Fingerhuth, T. Babej, and C. Ing, “A quantum alternating operator ansatz with hard and soft constraints for lattice protein folding,” 2018. [Online]. Available: https://arxiv.org/abs/1810.13411
  * [41] K. A. Fisher, A. Broadbent, L. Shalm, Z. Yan, J. Lavoie, R. Prevedel, T. Jennewein, and K. J. Resch, “Quantum computing on encrypted data,” _Nature communications_ , vol. 5, no. 1, p. 3074, 2014.
  * [42] J. F. Fitzsimons, “Private quantum computation: an introduction to blind quantum computing and related protocols,” _npj Quantum Information_ , vol. 3, no. 1, p. 23, 2017.
  * [43] J. F. Fitzsimons and E. Kashefi, “Unconditionally verifiable blind quantum computation,” _Physical Review A_ , vol. 96, no. 1, p. 012303, 2017.
  * [44] A. Gheorghiu, E. Kashefi, and P. Wallden, “Robustness and device independence of verifiable blind quantum computing,” _New Journal of Physics_ , vol. 17, no. 8, p. 083040, 2015.
  * [45] A. Gheorghiu, P. Wallden, and E. Kashefi, “Rigidity of quantum steering and one-sided device-independent verifiable quantum computation,” _New Journal of Physics_ , vol. 19, no. 2, p. 023043, 2017.
  * [46] E. N. Gilbert, “Random graphs,” _The Annals of Mathematical Statistics_ , vol. 30, no. 4, pp. 1141–1144, 1959.
  * [47] H. Goto, K. Tatsumura, and A. R. Dixon, “Combinatorial optimization by simulating adiabatic bifurcations in nonlinear hamiltonian systems,” _Science advances_ , vol. 5, no. 4, p. eaav2372, 2019.
  * [48] G. G. Guerreschi and A. Y. Matsuura, “Qaoa for max-cut requires hundreds of qubits for quantum speed-up,” _Scientific reports_ , vol. 9, no. 1, pp. 1–7, 2019.
  * [49] M. P. Harrigan, K. J. Sung, M. Neeley, K. J. Satzinger, F. Arute, K. Arya, J. Atalaya, J. C. Bardin, R. Barends, S. Boixo _et al._ , “Quantum approximate optimization of non-planar graph problems on a planar superconducting processor,” _Nature Physics_ , vol. 17, no. 3, pp. 332–336, 2021.
  * [50] R. Herrman, P. C. Lotshaw, J. Ostrowski, T. S. Humble, and G. Siopsis, “Multi-angle quantum approximate optimization algorithm,” _Scientific Reports_ , vol. 12, no. 1, pp. 1–10, 2022.
  * [51] H.-L. Huang, Q. Zhao, X. Ma, C. Liu, Z.-E. Su, X.-L. Wang, L. Li, N.-L. Liu, B. C. Sanders, C.-Y. Lu _et al._ , “Experimental blind quantum computing for a classical client,” _Physical review letters_ , vol. 119, no. 5, p. 050503, 2017.
  * [52] H.-Y. Huang, M. Broughton, J. Cotler, S. Chen, J. Li, M. Mohseni, H. Neven, R. Babbush, R. Kueng, J. Preskill _et al._ , “Quantum advantage in learning from experiments,” _Science_ , vol. 376, no. 6598, pp. 1182–1186, 2022.
  * [53] S. Kumar, H. Zhang, and Y.-P. Huang, “Large-scale ising emulation with four body interaction and all-to-all connections,” _Communications Physics_ , vol. 3, no. 1, p. 108, 2020.
  * [54] J. Li, M. Alam, and S. Ghosh, “Large-scale quantum approximate optimization via divide-and-conquer,” _arXiv preprint arXiv:2102.13288_ , 2021.
  * [55] Q. Li, C. Liu, Y. Peng, F. Yu, and C. Zhang, “Blind quantum computation where a user only performs single-qubit gates,” _Optics & Laser Technology_, vol. 142, p. 107190, 2021.
  * [56] M. Liang, “Symmetric quantum fully homomorphic encryption with perfect security,” _Quantum information processing_ , vol. 12, no. 12, pp. 3675–3687, 2013.
  * [57] A. Lipowski and D. Lipowska, “Roulette-wheel selection via stochastic acceptance,” _Physica A: Statistical Mechanics and its Applications_ , vol. 391, no. 6, pp. 2193–2196, 2012.
  * [58] S. Lloyd, “Quantum approximate optimization is computationally universal,” _arXiv preprint arXiv:1812.11075_ , 2018.
  * [59] A. Lucas, “Ising formulations of many np problems,” _Frontiers in physics_ , vol. 2, p. 5, 2014.
  * [60] A. Marandi, Z. Wang, K. Takata, R. L. Byer, and Y. Yamamoto, “Network of time-multiplexed optical parametric oscillators as a coherent ising machine,” _Nature Photonics_ , vol. 8, no. 12, pp. 937–942, 2014.
  * [61] C. McGeoch and P. Farre, “The d-wave advantage system: An overview,” Tech. Rep. (D-Wave Systems Inc, Burnaby, BC, Canada, 2020), Tech. Rep.
  * [62] M. McKague, “Interactive proofs for bqp via self-tested graph states,” _arXiv preprint arXiv:1309.5675_ , 2013.
  * [63] M. E. Morales, J. D. Biamonte, and Z. Zimborás, “On the universality of the quantum approximate optimization algorithm,” _Quantum Information Processing_ , vol. 19, no. 9, pp. 1–26, 2020.
  * [64] T. Morimae and K. Fujii, “Blind quantum computation protocol in which alice only makes measurements,” _Physical Review A_ , vol. 87, no. 5, p. 050301, 2013.
  * [65] H. Nakayama, J. Koyama, N. Yoneoka, and T. Miyazawa, “Description: third generation digital annealer technology,” _Fujitsu Limited: Tokyo, Japan_ , 2021.
  * [66] M. A. Nielsen and I. L. Chuang, _Quantum Computation and Quantum Information_. Cambridge University Press, 2010.
  * [67] H. Nishimori and K. Takada, “Exponential enhancement of the efficiency of quantum annealing by non-stoquastic hamiltonians,” _Frontiers in ICT_ , vol. 4, p. 2, 2017.
  * [68] Y. Ouyang, S.-H. Tan, and J. F. Fitzsimons, “Quantum homomorphic encryption from quantum codes,” _Physical Review A_ , vol. 98, no. 4, p. 042334, 2018\.
  * [69] W. Peng, B. Wang, F. Hu, Y. Wang, X. Fang, X. Chen, and C. Wang, “Factoring larger integers with fewer qubits via quantum annealing with optimized parameters,” _SCIENCE CHINA Physics, Mechanics & Astronomy_, vol. 62, no. 6, p. 60311, 2019.
  * [70] D. Pierangeli, G. Marcucci, and C. Conti, “Large-scale photonic ising machine by spatial light modulation,” _Physical review letters_ , vol. 122, no. 21, p. 213902, 2019.
  * [71] M. J. Powell, _A direct search optimization method that models the objective and constraint functions by linear interpolation_. Springer, 1994.
  * [72] J. Preskill, “Quantum computing in the nisq era and beyond,” _arXiv preprint arXiv:1801.00862_ , 2018.
  * [73] B. W. Reichardt, F. Unger, and U. Vazirani, “Classical command of quantum systems,” _Nature_ , vol. 496, no. 7446, pp. 456–460, 2013.
  * [74] A. Robert, P. K. Barkoutsos, S. Woerner, and I. Tavernelli, “Resource-efficient quantum algorithm for protein folding,” _npj Quantum Information_ , vol. 7, no. 1, pp. 1–5, 2021.
  * [75] M. Sao, H. Watanabe, Y. Musha, and A. Utsunomiya, “Application of digital annealer for faster combinatorial optimization,” _Fujitsu Scientific and Technical Journal_ , vol. 55, no. 2, pp. 45–51, 2019.
  * [76] A. Sarkar, Z. Al-Ars, and K. Bertels, “Quaser: Quantum accelerated de novo dna sequence reconstruction,” _Plos one_ , vol. 16, no. 4, p. e0249850, 2021\.
  * [77] E. Shahamatnia, R. Ayanzadeh, R. A. Ribeiro, and S. Setayeshi, “Adaptive imitation scheme for memetic algorithms,” in _Technological Innovation for Sustainability: Second IFIP WG 5.5/SOCOLNET Doctoral Conference on Computing, Electrical and Industrial Systems, DoCEIS 2011, Costa de Caparica, Portugal, February 21-23, 2011. Proceedings 2_. Springer, 2011, pp. 109–116.
  * [78] D. Sherrington and S. Kirkpatrick, “Solvable model of a spin-glass,” _Physical review letters_ , vol. 35, no. 26, p. 1792, 1975.
  * [79] P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” _SIAM review_ , vol. 41, no. 2, pp. 303–332, 1999.
  * [80] A. Shukla, H. M. Pandey, and D. Mehrotra, “Comparative review of selection techniques in genetic algorithm,” in _2015 international conference on futuristic trends on computational analysis and knowledge management (ABLAZE)_. IEEE, 2015, pp. 515–519.
  * [81] M. Streif, S. Yarkoni, A. Skolik, F. Neukart, and M. Leib, “Beating classical heuristics for the binary paint shop problem with the quantum approximate optimization algorithm,” _Physical Review A_ , vol. 104, no. 1, p. 012403, 2021.
  * [82] K. J. Sung, J. Yao, M. P. Harrigan, N. C. Rubin, Z. Jiang, L. Lin, R. Babbush, and J. R. McClean, “Using models to improve optimizers for variational quantum algorithms,” _Quantum Science and Technology_ , vol. 5, no. 4, p. 044008, 2020.
  * [83] S.-H. Tan, J. A. Kettlewell, Y. Ouyang, L. Chen, and J. F. Fitzsimons, “A quantum approach to homomorphic encryption,” _Scientific reports_ , vol. 6, no. 1, p. 33467, 2016.
  * [84] S. S. Tannu, P. Das, R. Ayanzadeh, and M. K. Qureshi, “Hammer: Boosting fidelity of noisy quantum circuits by exploiting hamming behavior of erroneous outcomes,” in _Proceedings of the Twenty-Seventh International Conference on Architectural Support for Programming Languages and Operating Systems_ , 2022, pp. 529–540.
  * [85] K. Tatsumura, A. R. Dixon, and H. Goto, “Fpga-based simulated bifurcation machine,” in _2019 29th International Conference on Field Programmable Logic and Applications (FPL)_. IEEE, 2019, pp. 59–66.
  * [86] K. Tatsumura, M. Yamasaki, and H. Goto, “Scaling out ising machines using a multi-chip architecture for simulated bifurcation,” _Nature Electronics_ , vol. 4, no. 3, pp. 208–217, 2021.
  * [87] T. Trochatos, C. Xu, S. Deshpande, Y. Lu, Y. Ding, and J. Szefer, “Hardware architecture for a quantum computer trusted execution environment,” _arXiv preprint arXiv:2308.03897_ , 2023.
  * [88] P. Vikstål, M. Grönkvist, M. Svensson, M. Andersson, G. Johansson, and G. Ferrini, “Applying the quantum approximate optimization algorithm to the tail-assignment problem,” _Physical Review Applied_ , vol. 14, no. 3, p. 034009, 2020.
  * [89] B. Villalonga, D. Lyakh, S. Boixo, H. Neven, T. S. Humble, R. Biswas, E. G. Rieffel, A. Ho, and S. Mandrà, “Establishing the quantum supremacy frontier with a 281 pflop/s simulation,” _Quantum Science and Technology_ , vol. 5, no. 3, p. 034003, 2020.
  * [90] Y. Wu, W.-S. Bao, S. Cao, F. Chen, M.-C. Chen, X. Chen, T.-H. Chung, H. Deng, Y. Du, D. Fan _et al._ , “Strong quantum computational advantage using a superconducting quantum processor,” _arXiv preprint arXiv:2106.14734_ , 2021\.
  * [91] L. Yu, C. A. Pérez-Delgado, and J. F. Fitzsimons, “Limitations on information-theoretically-secure quantum homomorphic encryption,” _Physical Review A_ , vol. 90, no. 5, p. 050303, 2014.