Q-Tag: Watermarking Quantum Circuit Generative Models

TL;DR

This work presents the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity, and introduces a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction.

Abstract

Quantum cloud platforms have become the most widely adopted and mainstream approach for accessing quantum computing resources, due to the scarcity and operational complexity of quantum hardware. In this service-oriented paradigm, quantum circuits, which constitute high-value intellectual property, are exposed to risks of unauthorized access, reuse, and misuse. Digital watermarking has been explored as a promising mechanism for protecting quantum circuits by embedding ownership information for tracing and verification. However, driven by recent advances in generative artificial intelligence, the paradigm of quantum circuit design is shifting from individually and manually constructed circuits to automated synthesis based on quantum circuit generative models (QCGMs). In such generative settings, protecting only individual output circuits is insufficient, and existing post hoc, circuit-centric watermarking methods are not designed to integrate with the generative process, often failing to simultaneously ensure stealthiness, functional correctness, and robustness at scale. These limitations highlight the need for a new watermarking paradigm that is natively integrated with quantum circuit generative models. In this work, we present the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity. We introduce a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction. Empirical results confirm that our method achieves high-fidelity circuit generation and robust watermark detection across a range of perturbations, paving the way for scalable, secure copyright protection in AI-powered quantum design.

Figures (8)

• Figure 1: Watermarking for quantum circuit generative model.Top: Standard QCGMs generate circuits without embedded ownership, enabling misuse via cloud deployment with no attribution. Bottom: Our watermarked QCGM embeds verifiable ownership into each generated circuit, enabling attribution and accountability even after unauthorized redistribution.
• Figure 2: Watermark embedding, attacks and extraction process for quantum circuits generative model (QCGM). The watermark is embedded into the starting latent of QCGM through SSM, then the watermarked QC is generated and potentially attacked. The SRM and SSM reverse sampling is applied in the extraction stage to extract the watermark.
• Figure 3: Effects of circuit modifications on the encoded matrix. Edits to quantum circuits may alter the encoded matrix either by changing specific values or shifting its structural layout. Subfigures illustrate the impact of different edit operations: (a) replacement, (b) appending, (c) insertion, and (d) deletion. Each operation disrupts the latent of the quantum circuits, introducing distortions that may hinder accurate watermark extraction.
• Figure 4: Experiment on threshold selection. (a) TPR/FPR. (b) Bit accuracy distribution.
• Figure 5: Fidelity experiments of Q-Tag generation, (a) the initial starting latent with ($\mathcal{Z}_T^{\mathcal{W}}$) and without ($\mathcal{Z}_T^{\emptyset}$) watermark are indistinguishable through t-SNE; (b) the diffused latent with ($\mathcal{Z}_0^{\mathcal{W}}$) and without ($\mathcal{Z}_0^{\emptyset}$) watermark are also indistinguishable through t-SNE.

Theorems & Definitions (2)

• Theorem 1: Distribution Preservation of SSM
• proof