The Hardening Decisions an Operator Has to Make

A quantum processor sits near 10 millikelvin inside a dilution refrigerator, isolated from almost everything in the building. Everything that touches it is ordinary computing. The control rack is a set of field-programmable gate arrays, or FPGAs, running vendor firmware. The calibration system is software on a Linux server. The link to the GPU decoder is high-speed Ethernet. The user-facing entry point is a web API. Each of those has decades of attack technique behind it, and none of that technique cares that the payload at the end of the wire is a qubit.

This is why we treat quantum system security as an integration discipline rather than a physics one. The decisions below are build decisions. They constrain the floor plan, the network diagram, the hiring plan, and the wording of the procurement contract. Making them late is expensive in a specific way: retrofitting access control or shielding into a running installation means warming the cryostat, and a warm-up and cool-down cycle costs days of unavailable machine time.

Where the attack surface actually sits

An adversary interested in a quantum computer does not need to attack the physics. Compromised control firmware can alter gate parameters so that results are wrong in ways that look like decoherence. A foothold on the calibration server exposes the circuit descriptions users submit. A flat network between the control rack and the campus puts an operational system one lateral move away from a phishing victim’s laptop.

We ask learners to draw the boundary explicitly before they design anything: qubits and their immediate wiring on one side, and on the other side a control plane that is a conventional computing estate with unconventional consequences. The eight decisions that follow all live on the second side.

Facility decisions

The physical access tier

The cryostat room holds the processor, the wiring tree, and the first-stage amplifiers. In a university lab, that room is often reachable by anyone with a departmental key card. In a defense program, it may need to be a controlled area with two-person integrity, logged entry, and escorted visitors.

The construction cost difference between those two configurations is small. The operational difference is not, because two-person integrity changes how every maintenance visit is staffed. Choose the tier before the build-out. Nobody wants to be adding badge readers to a controlled area while the machine is cold and the first sensitive workload is already scheduled.

Shielding written for two purposes

Electromagnetic shielding around a quantum installation is usually specified for physics. Keep external fields away from the qubits and coherence improves. Security asks for the opposite direction of travel.

TEMPEST is the practice of controlling compromising emanations, meaning signals that leak out of a system and carry information about what it is processing. Superconducting qubits are driven by microwave pulses in roughly the 4 to 8 GHz range, and the sequence of those pulses is the circuit. The control electronics that generate those pulses draw power and radiate while they do it, so the control plane is a side-channel surface in the same sense any signal-processing hardware is.

A shielded enclosure designed to keep fields out is not automatically an enclosure that keeps signals in. The two specifications differ. Write both into the facility requirement and build to whichever is stricter.

Air gap or real-time decoding

Real-time error correction needs a decoder that answers within the qubits’ coherence budget, which is why an interconnect like NVQLink couples a GPU decoder directly to the control electronics. That coupling assumes the decoder and the control rack share a network segment.

An air-gapped quantum computer still runs circuits. What it cannot do is real-time decoding across a boundary that the decoder is not allowed to cross. So the architecture question is which of two shapes the deployment takes. Either the whole decoding segment sits inside the classified boundary, which puts the GPU node, the control rack and the cryostat in the same controlled area, or the machine runs at a lower classification tier and results move up afterwards. Both are legitimate. They produce different floor plans, and the choice has to be made while the floor plan is still a drawing.

Control-plane decisions

Firmware verification at delivery

Verify the control-electronics firmware against the vendor’s published reference at delivery, record the hash, and repeat the check on every update for the life of the system. It is a quick step at commissioning and a difficult reconstruction once the machine has been running for a while.

The related question belongs in procurement rather than engineering. Does the contract give you the right to audit firmware source, and under what conditions? Not every control vendor offers it, and some offer it only to government customers. Ask during vendor selection, because the answer will not improve after signature.

Three network zones

The decoder link carries measurement data and correction instructions at high bandwidth and low latency. It should not be routable. Put it on a dedicated segment with no gateway, and give the GPU node two interfaces: one facing that isolated segment, one facing management and job submission. If the machine offers access to outside users, the user-facing API terminates on a separate front end that never touches the decoder segment. The control rack’s own management interface belongs on a third network.

Three zones, no cross-routing. In security terms a quantum control system is operational technology, or OT, and it deserves the segmentation an industrial control system would get.

Calibration logs as security telemetry

Qubit frequencies, coherence times and gate fidelities drift over hours and days, and autonomous calibration platforms correct that drift and log every correction. Those logs are a monitoring source that most operators never connect to anything.

A single qubit shifting overnight is routine. Several qubits shifting together, by a similar amount, inside a repeating time window, is a physical event that somebody should explain. Establish the drift baseline during commissioning and forward the calibration log into the same collection stack as everything else. No quantum-specific security tool does this today. The market hasn’t built one, so the current answer is the calibration platform’s own logging plus a classical integration.

Multi-tenancy and the crosstalk side channel

Crosstalk is the unwanted coupling between neighbouring qubits, where operating or reading one disturbs another. Ash-Saki, Alam and Ghosh at Penn State showed in 2020 that on a shared processor this coupling carries information between co-resident circuits, and a user running a designed circuit on their allocated qubits can observe error patterns correlated with somebody else’s job.

The mitigation is scheduling. Time-slicing means one user’s job occupies the processor at a time, which removes the cross-user channel and reduces throughput. Time-slicing is the right default for an on-premises multi-user machine.

Whether fault tolerance changes the picture is genuinely open. Logical qubits are spread across many physical ones, and nobody has established that the encoding layer blocks a physical-layer channel from carrying logical-layer information. Until someone does, time-slicing stays the default, and any decision to multiplex users for throughput should be a documented risk acceptance signed by the security authority.

People with pulse-level access

A calibration engineer can send arbitrary pulses to any qubit, read any measurement, and change the parameters that decide how a circuit is interpreted. That is administrative control over the physics, and it has no clean classical equivalent.

Two clearance models exist in practice. One vets calibration staff to the level of the data the machine will process. The other accepts visiting researchers on the strength of an academic reference. Both are defensible; they are not interchangeable, and the choice belongs in the staffing plan rather than in an incident report.

Separate the privilege sets while the team is still being built. The people who calibrate qubits and touch the cryostat hold the highest physical privilege. The people who configure the decoder segment, the scheduler and the API hold the highest network privilege. Those two sets of hands should belong to different people.

Cryptography on the API surface

The classical entry point to a quantum service is authenticated, key-exchanged, and exposed like any other API, so it inherits the migration deadline every other API has. Use FIPS 203, the key-encapsulation standard ML-KEM, for key establishment, and FIPS 204, the signature standard ML-DSA, for authentication.

Do it at deployment. For operators of US national security systems the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) makes this an obligation with a date attached rather than an improvement to schedule later, and other national frameworks are converging on the same requirement. Confirm which applies to your installation before commissioning. The PQC Migration Framework sets out the methodology for the inventory and cutover work.

Writing the decisions down

Eight decisions, each with an owner and a deadline that falls before the cryostat goes cold: the physical access tier, the shielding specification, the air-gap architecture, firmware verification and audit rights, the three-zone network design, calibration telemetry, the tenancy policy, and the cryptographic profile of the API.

Every one of them is cheap as a line in a design document and expensive as a change request. That asymmetry is the whole argument for treating security as part of the integration plan rather than a review that happens after the machine works.

Where we teach this

These decisions form the operator-facing half of our quantum systems security training, alongside the full threat model of the quantum-classical boundary, supply chain trust, and the espionage exposure that quantum programs carry as high-value technology targets. The program is built for architects and lead engineers who will sign the design document, not only read it. You can see the current program and certification paths at Quantum Academy.

For the deeper technical treatment of the attack surface itself, including nation-state scenarios and hardware trojan risk, Marin Ivezic’s analysis of securing quantum computer deployments is the companion reading we point learners to.