Quantum Red-Team Exercises and Control-Plane Security Testing

The quantum control plane has unusual attack surfaces: provider credentials, workload routing, compiler plugins, calibration data, result evidence, privileged lab controls, and AI-assisted operator tooling. Security testing must cover more than web endpoints. It must test whether an attacker can alter scientific conclusions, misroute expensive workloads, poison calibration metadata, or forge evidence.

NIST SP 800-115 provides a general technical guide for information security testing and assessment, including planning, execution, and reporting patterns that can be adapted to quantum platforms [R234].

Diagram loads as you read

Quantum Red-Team Exercises and Control-Plane Security Testing · Figure 1

View diagram source

flowchart TB
    Threat[Threat model] --> Plan[Test plan]
    Plan --> Exercise[Exercise]
    Exercise --> Findings[Findings]
    Findings --> Fixes[Fixes]
    Fixes --> Retest[Retest]
    Retest --> Evidence[Assurance evidence]

Security objectives

Objective	Quantum-specific question
confidentiality	Can sensitive workload intent or partner data leak through logs or provider metadata?
integrity	Can a circuit, compiled artifact, calibration baseline, or result be modified undetected?
availability	Can a tenant exhaust scarce QPU reservations or block calibration windows?
accountability	Can a privileged action occur without identity, approval, and evidence?
scientific trust	Can a false claim be made using plausible but incomplete evidence?

Exercise scope

Diagram loads as you read

Exercise scope · Figure 2

View diagram source

flowchart LR
    RedTeam[Red team] --> API[API gateway]
    RedTeam --> Broker[Broker]
    RedTeam --> Plugins[Compiler plugins]
    RedTeam --> Evidence[Evidence store]
    RedTeam --> Copilot[Operator copilot]
    RedTeam --> Provider[Provider connectors]
    RedTeam --> Lab[Lab controls]

Every exercise needs a scope boundary. Testing provider-owned infrastructure may be prohibited by contracts. Testing internal broker logic, evidence validation, identity policy, and plugin isolation is usually under platform control.

Abuse cases

Diagram loads as you read

Abuse cases · Figure 3

View diagram source

flowchart TB
    Abuse[Abuse cases] --> Poison[Poison calibration metadata]
    Abuse --> Forge[Forge evidence package]
    Abuse --> Route[Route to weaker backend]
    Abuse --> Exhaust[Exhaust reservation budget]
    Abuse --> Leak[Leak workload metadata]
    Abuse --> Prompt[Manipulate operator copilot]

Representative abuse cases:

Abuse case	Detection signal	Control
forged result artifact	hash mismatch, missing attestation	signed evidence validation
malicious plugin	unexpected file/network access	sandbox and policy deny
calibration poisoning	impossible drift pattern	calibration trust exchange and review
route downgrade	backend mismatch	policy-checked routing contract
copilot prompt injection	untrusted retrieved content attempts tool action	tool-gated copilot workflow

Red-team cadence

Diagram loads as you read

Red-team cadence · Figure 4

View diagram source

gantt
    title Quantum security exercise cadence
    dateFormat  YYYY-MM-DD
    section Monthly
    Credential abuse tabletop     :a1, 2026-05-01, 1d
    Evidence tampering drill      :a2, 2026-06-01, 1d
    section Quarterly
    Broker route attack           :b1, 2026-07-01, 3d
    Plugin sandbox assessment     :b2, 2026-10-01, 3d
    section Annual
    Full mission exercise         :c1, 2027-01-15, 5d

Findings as controls

A red-team finding should produce a control update, not merely a ticket.

Diagram loads as you read

Findings as controls · Figure 5

View diagram source

sequenceDiagram
    participant Red as Red team
    participant Ops as Quantum ops
    participant Gov as Governance API
    participant Evidence as Evidence graph
    Red->>Ops: finding report
    Ops->>Gov: create corrective control
    Gov->>Evidence: bind finding to affected artifacts
    Ops->>Ops: patch, retest, train
    Ops-->>Red: closure package

Control-plane tests

Test	Expected platform behavior
submit workload with forged owner	reject before admission
alter shot count after approval	require new approval and evidence update
compile with unapproved plugin	sandbox deny or quarantine
use expired provider token	fail closed, alert, no fallback to shared credential
write result without attestation	reject evidence package
request regulated workload on non-approved backend	policy deny

Operating rule

A quantum red-team program should test the integrity of conclusions, not just the perimeter. The most expensive breach may be a confident false result.