Implementing Quantum Secret Sharing on Current Hardware

Abstract

Quantum secret sharing is a cryptographic scheme that enables the secure storage and reconstruction of quantum information. While the theory of secret sharing is mature in its development, relatively few studies have explored the performance of quantum secret sharing on actual devices. In this work, we provide a pedagogical description of encoding and decoding circuits for different secret sharing codes, and we test their performance on IBM’s 127-qubit Brisbane system. We evaluate the quality of the implementation by performing a SWAP test between the decoded state and the ideal one, as well as by estimating how well the code preserves entanglement with a reference system. The results indicate that a ((3,5)) threshold secret sharing scheme and a non-threshold 7-qubit scheme perform similarly based on the SWAP test and entanglement fidelity, with both attaining a roughly 70–75% pass rate on the SWAP test for the reconstructed secret. We also investigate one implementation of a ((2,3)) qutrit threshold scheme and find that it performs the worst of all, which is expected due to the additional number of multi-qubit gate operations needed to encode and decode qutrits. A comparison is also made between schemes using mid-circuit measurement versus delayed-circuit measurement.

1. Introduction

Securely storing and distributing information is one of the oldest and most important communication tasks. With the advent of quantum computing, traditional cryptographic techniques are being challenged in new and disruptive ways. At the same time, quantum computing also offers a pathway for realizing new cryptographic schemes with potentially stronger security guarantees than their classical counterparts. One such example is quantum secret sharing (QSS) [1], which offers a solution to the problem of distributing secrets among multiple parties.

In classical cryptography, Blakley [2] and Shamir [3] were the first to formally introduce the theory of secret sharing. The most well-known protocols are (k, n) threshold schemes, in which a secret is divided into n shares; any k of those shares can be used to reconstruct the secret, but any fewer number contains no information about the secret. More generally, one constructs codes in which just certain subsets of shares can recover the secret, as specified by the code’s access structure. Hillery et al. later observed that quantum states could be used for building threshold schemes by encoding a classical secret into a multipartite entangled state [4]. Unlike traditional secret sharing protocols that rely on computational hardness assumptions, the security of ideal quantum-based schemes depends only on the physical principles of quantum mechanics. Going one step further, Cleve et al. introduced fully quantum secret sharing protocols [1], which involve the distribution and reconstruction of a quantum secret, i.e., the superposition state of some quantum system. Since these initial works, the theory of QSS has received heavy development and a wide range of protocols have been proposed [5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20]. Complementing this theory work there has been experimental progress on implementing different QSS schemes, primarily in photonic systems [21,22,23,24,25,26,27,28,29].

These experimental demonstrations involve setups that are designed specifically for the task of secret sharing. However, any functioning quantum computer should be able to run basic QSS protocols. In fact, since every QSS scheme utilizes a type of error correcting code [1], secret sharing is a natural functionality to the demand of a quantum computer on the road toward fault-tolerance. Furthermore, while secret sharing is often described in the scenario of multiple parties separated by some large spatial distance, it also has applications in much smaller computational settings. For example, one can imagine a modular quantum computing architecture in which sensitive data gets distributed onto different zones to minimize a potential data breach. Motivated by these considerations, we investigate the performance of quantum secret sharing codes on current quantum computing hardware. As the simplest possible benchmark, we consider a single-qubit secret, checking whether privacy is attained after encoding and whether the secret is successfully recovered after decoding.

In the following, we begin by reviewing the basic elements of QSS and describing the three codes that we implement; a more comprehensive overview can be found in the work of Gottesman [5]. In Section 2, we outline our encoding and decoding methods in more detail and also explain our figures of merit for the code performance. The codes were implemented on IBM’s 127-qubit Brisbane superconducting processor, and the results are presented in Section 4. In particular, we find that the ((3,5)) QSS scheme and the 7-qubit scheme perform very similarly in terms of passing the SWAP test with pass rates ranging between 65 and 80% in both the simulations and real experiments. The simulations predict that the ((3,5)) QSS scheme should preserve entanglement better; however, it remains unclear using actual hardware. We also find that the use of higher optimization levels within Qiskit enhances the performance of the QSS protocols and that classical feed-forward is more efficient than fully coherent decoding for QSS schemes. We firmly expect that the performance can be improved even further by employing other error mitigation techniques, such as dynamical decoupling [30].

Those familiar with QSS can skip immediately to Section 4 for a summary of our results. A pedagogical introduction to QSS is provided in Section 2 and Section 3. Our hope is that this not only makes this paper more accessible but also useful as a basic reference for constructing QSS circuits.

2. Preliminaries

Suppose that $|\psi \rangle =\alpha |0\rangle +\beta |1\rangle$ is an arbitrary qubit state that some “dealer” wishes to distribute to n parties. If each party itself is given a qubit system, then the dealer performs an encoding isometry $V:{\mathbb{C}}^2\to {\mathbb{C}}^n$, which maps $|\psi \rangle$ into the n-qubit state

$$|\psi \rangle \mapsto V|\psi \rangle ={|\psi \rangle }_L={\alpha |0\rangle }_L+\beta {|1\rangle }_L.$$

Here, ${|i\rangle }_L\in {\mathbb{C}}^n$ (for $i\in \{0,1\}$) are states forming a basis for a logical qubit in ${\mathbb{C}}^n$. Letting $2^{\left[n\right]}$ denote the power set of $\left[n\right]:=\{1,\cdots ,n\}$, every QSS scheme is defined by an access structure $\mathrm{\Gamma }\subset 2^{\left[n\right]}$ such that

(i)

Each $S\in 2^{\left[n\right]}\setminus \mathrm{\Gamma }$ is called unauthorized and satisfy

$${\omega }^S={\mathrm{tr}}_{\overline{S}}\left(\right|\psi \rangle \langle \psi {|}_L),$$

(1)

where $\overline{S}$ denotes the set complement of S and ${\omega }^S$ is some fixed state for systems S that is independent of $|\psi \rangle$, i.e., no statistical information about the relative values of $\left|\alpha \right|$ and $\left|\beta \right|$ can be obtained.

(ii)

Each $S\in \mathrm{\Gamma }$ is called authorized, and there exists a decoder ${\mathcal{D}}_S$ such that

$$|\psi \rangle \langle \psi |={\mathcal{D}}_S\left({\mathrm{tr}}_{\overline{S}}\left(\right|\psi \rangle \langle \psi {|}_L)\right).$$

(2)

A $\left(\right(k,n\left)\right)$ threshold scheme is a special type of QSS in which $\mathrm{\Gamma }$ consists of all subsets having k or more parties. The first two QSS schemes we investigate are built from [[$n,m,d$]] qubit stabilizer codes. Such codes can correct $t=\lfloor (d-1)/2\rfloor$ general errors and $d-1$ erasure errors [31]. We specifically consider the [[5,1,3]] (“five-qubit”) code [32] and the [[7,1,3]] (“Steane”) CSS code [33,34], both of which correct two erasure errors on any subset of qubits. The [[5,1,3]] code admits a ((3,5)) threshold scheme, and it is a maximum distance separable code, i.e., it satisfies the quantum Singleton bound, $n-m\ge 2(d-1)$, with equality, while the Steane code does not.

While the Steane code is a $\left(\right(5,7\left)\right)$ threshold scheme, it can also correct three or even four erasure errors located on certain subsets of qubits. In this paper, we explore the more intricate QSS access structure that arises from the Steane code. Finally, we test the exemplifying ((2,3)) qutrit QSS scheme presented in Ref. [1], which is a [[3,1,2]] ₃ CSS code that can correct a single erasure error and detect a single general error (but cannot correct the latter [35]).

2.1. General Encoding

The encoding procedure for stabilizer codes can be implemented in different ways. One method is to consider the evolution of the stabilizer. If ${\left\{g_i\right\}}_{i=1}^{n-m}$ is an independent set of generators for an [[$n,m,d$]] stabilizer code and ${\left\{{\overline{Z}}_i\right\}}_{i=n-m+1}^n$ are logical Z operators, then there always exists a Clifford unitary U that maps ${\left\{Z_i\right\}}_{i=1}^n$, stabilizers of the initial n-qubit state ${|0\rangle }^{\otimes n}$, to ${\left\{g_i\right\}}_{i=1}^{n-m}\cup {\left\{{\overline{Z}}_i\right\}}_{i=n-m+1}^n$, stabilizers of the logical state ${|0\rangle }_L$; i.e., $U{Z}_i{U}^{†}=g_i$ for $i=1,\cdots n-m$ and $U{Z}_i{U}^{†}={\overline{Z}}_i$, for $i=n-m+1,\cdots ,n$. One then needs to find an implementation of U that is compatible with the native gate set for whatever quantum computing hardware device is being used. Our results were obtained on the IBM Brisbane machine, whose standard gate set consists of qubit rotations about the $\widehat{z}$-axis ($R_Z\left(\varphi \right)$), $\pi$ and $\pi /2$ rotations about the $\widehat{x}$-axis (X and $\sqrt{X}$), and the two-qubit echoed cross-resonance gate (ECR) gate. The ECR gate is equivalent to a CNOT up to single-qubit pre-rotations. The qubit rotation matrices about each of the standard axes on the Bloch sphere are given by

$$\begin{array}{cc}\hfill R_X\left(\theta \right)& =\left[\begin{array}{cc}\cos (\theta /2)& -i\sin (\theta /2)\\ -i\sin (\theta /2)& \cos (\theta /2)\end{array}\right]\hfill \\ \hfill R_Y\left(\theta \right)& =\left[\begin{array}{cc}\cos (\theta /2)& -\sin (\theta /2)\\ \sin (\theta /2)& \cos (\theta /2)\end{array}\right]\hfill \\ \hfill R_Z\left(\varphi \right)& =\left[\begin{array}{cc}{e}^{-i\varphi /2}& 0\\ 0& e^{i\varphi /2}\end{array}\right],\hfill \end{array}$$

and we can realize the $R_X\left(\theta \right)$ and $R_Y\left(\theta \right)$ gates using IBM Brisbane’s native gate set using the following relations:

$$\begin{array}{cc}\hfill R_X\left(\theta \right)& =R_Z\left({\displaystyle \frac{\pi }{2}}\right)\sqrt{X}{R}_Z(\theta +\pi )\sqrt{X}{R}_Z\left({\displaystyle \frac{\pi }{2}}\right),\hfill \\ \hfill R_Y\left(\theta \right)& =R_Z\left(\pi \right)\sqrt{X}{R}_Z(\theta +\pi )\sqrt{X}.\hfill \end{array}$$

The design of all circuits was accomplished using Qiskit. Since Qiskit only supports qubit encodings, to implement the $\left(\right(2,3\left)\right)$ qutrit code, we essentially embedded each qutrit into a two-qubit system, as explained in Section 3.4.

2.2. General Decoding

The general encoding procedure just described takes an initial m-qubit secret $|\psi \rangle$ prepared in registers $n-m+1,\cdots ,n$ and maps it into an n-qubit logical state. In QSS, the secret is recovered after discarding an unauthorized subset of parties. To explain how this is accomplished in practice, let us first describe in more detail the error correction procedure for an erasure event. Suppose it is known that some specific physical qubits are lost in a computation or protocol. Some physical reasons for loss are described in Ref. [36], but in QSS, the loss is an artifact of the task itself: an authorized subset of parties participate collaboratively to recover the secret, and the remaining qubits are effectively lost since they are held by non-participating parties. To recover the secret, the authorized parties replace the lost qubits with fresh qubits, each in some initial state $|0\rangle$. When qubit $Q_i$ is lost and replaced by qubit $A_i$, its mathematical description is described by the completely positive trace-preserving (CPTP) map

$$\begin{array}{cc}\hfill {\mathcal{D}}^{Q_i\to A_i}\left(X^{Q_i}\right)& =\mathrm{tr}\left[X^{Q_i}\right]{|0\rangle \langle 0|}^{A_i}\hfill \\ \hfill & =|0\rangle \langle 0|X^{Q_i}{|0\rangle \langle 0|}^{A_i}+|0\rangle \langle 1|X^{Q_i}{|1\rangle \langle 0|}^{A_i},\hfill \end{array}$$

where we have provided one representation of the map in terms of Kraus operators $K_0={⠀}^{A_i}{|0\rangle \langle 0|}^{Q_i}$ and $K_1={⠀}^{A_i}{|0\rangle \langle 1|}^{Q_i}$. If a code can correct arbitrary errors on qubit $Q_i$, then it can also correct the erasure map ${\mathcal{E}}^{Q_i\to A_i}$ by transferring the error correction procedure from system $Q_i$ to $A_i$. The overall effect is that qubits $Q_i$ and $A_i$ get swapped in between the encoding and decoding procedure (see Figure 1).

The standard method for decoding stabilizer codes is to first measure a complete set of generators for the stabilizer, the outcomes of which uniquely identify an error syndrome. The error is then reversed, and the inverse of the encoding gate, $U^{†}$, is applied to recover the secret $|\psi \rangle$. More explicitly, if ${\left\{g_i\right\}}_i$ are generators for the stabilizer and ${\left\{E_k\right\}}_k$ are correctable Pauli errors, then each $E_k$ has the error syndrome determined by the bit string ${\mathbf{b}}_k={\left(b_{k,i}\right)}_i$, such that $E_k{g}_i{E}_k^{†}={(-1)}^{b_{k,i}}{g}_i$. The error syndrome is obtained by measuring each of the generators $g_i$, and if the syndrome is ${\mathbf{b}}_k$, then the error can be corrected by performing $E_k^{†}$ or any other $E_l^{†}$ with the same syndrome. Afterward, $U^{†}$ is applied to recover the secret $|\psi \rangle$ in registers $n-m+1,\cdots ,n$. Equivalently, since

$$\begin{array}{cc}\hfill {(-1)}^{b_{k,i}}{U}^{†}{g}_{i}U& =U^{†}{E}_{k}U\left(U^{†}{g}_{i}U\right)U^{†}{E}_k^{†}U\hfill \\ \hfill \iff {(-1)}^{b_{k,i}}{Z}_i& =\left(U^{†}{E}_{k}U\right)Z_i\left(U^{†}{E}_k^{†}U\right),\hfill \end{array}$$

(3)

one can first evolve the circuit by $U^{†}$ prior to the syndrome measurement. The syndrome ${\mathbf{b}}_k$ can then be determined by measuring each of the qubits $l=1,\cdots ,n-m$ in the computational basis, and the corresponding error correction is facilitated by performing $U^{†}{E}_k^{†}U$. For a distance d stabilizer code and arbitrary subset T of $d-1$ parties, it suffices to consider just the set of Pauli errors ${\left\{E_k\right\}}_k={\{\mathbb{I},X,Y,Z\}}^{\times (d-1)}$ acting on qubits in T. Notice that since U is a Clifford gate, each $U^{†}{E}_k^{†}U$ will also be a local Pauli operator. We let $R_k$ denote the part of $U^{†}{E}_k^{†}U$ acting on the m-qubit system recovering the secret, and for simplicity, we ignore resetting the other $n-m$ systems to their original state ${|0\rangle }^{\otimes (n-m)}$. The overall encoding and decoding scheme is depicted in Figure 1.

2.3. Initializing a Secret

A d-dimensional quantum secret is an arbitrary state in ${\mathbb{C}}^d$. For qubits we can parametrize the secret as $|\psi \rangle$ = $\alpha |0\rangle +\beta |1\rangle =\cos (\theta /2)|0\rangle +\sin (\theta /2)e^{i\varphi }|1\rangle$. The use of rotation gates, specifically $R_X\left(\theta \right)$ and $R_Z\left(\varphi \right)$, rotates the state around the Bloch sphere depending on the angles $\theta$ and $\varphi$. This allows us to initialize a random secret when we randomize the input angles of the rotation gates, as depicted in Figure 2.

More specifically, we arranged $\theta$ and $\varphi$ into arrays with intervals $[0,\pi ]$ and $[0,2\pi ]$, respectively, both with a step of $1^{\circ }$. With each circuit job, a random angle is selected from each array and used for the angles of the rotation gates, thus initializing an arbitrary quantum state or secret.

For the qutrit scheme, we embed a three-level system into the space of two qubits, $|\psi \rangle \in {\mathbb{C}}^3\to |\varphi \rangle \in {\mathbb{C}}^2\otimes {\mathbb{C}}^2$, while ignoring one of the basis states of ${\mathbb{C}}^2\otimes {\mathbb{C}}^2$. Specifically, we map a qutrit into two qubits using the mapping

$$\begin{array}{c}\hfill |0\rangle \leftrightarrow |00\rangle ,|1\rangle \leftrightarrow |01\rangle ,|2\rangle \leftrightarrow |10\rangle .\end{array}$$

(4)

Under the qutrit embedding of Equation (4), we can initialize an arbitrary real qutrit state $|\psi \rangle$ using $R_Y\left(\theta \right)$ and CNOT gates as depicted in Figure 3. It is straightforward to verify that $|\psi \rangle =\alpha |0\rangle +\beta |1\rangle +\gamma |2\rangle :=\alpha |00\rangle +\beta |01\rangle +\gamma |10\rangle$, where $\alpha =cos({\theta }_2/2)$, $\beta =sin({\theta }_2/2)cos\left({\theta }_1\right)$, and $\gamma =sin({\theta }_2/2)sin\left({\theta }_1\right)$.

2.4. Measures of Performance

We consider two different ways of evaluating how well a quantum circuit implements a QSS scheme. The first uses the SWAP test, which is a computational primitive shown in Figure 4. The probability of measuring $|0\rangle$ is given by $1/2(1+|\langle \psi |\varphi \rangle {|}^2$), which becomes unity if the states are the same. Hence, our test will involve (i) randomly selecting angles $\theta$ and $\varphi$ for the initial qubit state $|\psi \rangle$, (ii) preparing two copies of $|\psi \rangle$, (iii) running the QSS encoding and decoding on one of the copies, and (iv) performing the SWAP test with the original unencoded state.

The second quantifier of performance for a QSS involves the entanglement fidelity, which for a general quantum channel $\mathcal{N}$ is defined as

$$F_e\left(\mathcal{N}\right):=\langle {\mathrm{\Phi }}^{+}|(\mathrm{id}\otimes \mathcal{N})\left(\right|{\mathrm{\Phi }}^{+}\rangle \langle {\mathrm{\Phi }}^{+}\left|\right)|{\mathrm{\Phi }}^{+}\rangle ,$$

(5)

where $|{\mathrm{\Phi }}^{+}\rangle =\sqrt{1/2}\left(\right|00\rangle +|11\rangle )$. Intuitively, the entanglement fidelity measures how well the channel $\mathcal{N}$ preserves the maximally entangled state $|{\mathrm{\Phi }}^{+}\rangle$ when acting on one of the subsystems. In our case, we consider $\mathcal{N}$ as the concatenation of the QSS encoding V and the decoding ${\mathcal{D}}_S$ after erasing shares in subset S. Ideally, $|{\mathrm{\Phi }}^{+}\rangle$ should be perfectly preserved after encoding and decoding. For d-dimensional codes, we replace $|{\mathrm{\Phi }}^{+}\rangle$ with $|{\mathrm{\Phi }}_d^{+}\rangle =\frac{1}{\sqrt{d}}{\sum }_{i=0}^{d-1}|ii\rangle$ in Equation (5).

To estimate the entanglement fidelity for a given subset erasure, we perform quantum state tomography on the output state when starting with $|{\mathrm{\Phi }}^{+}\rangle$. Quantum state tomography (QST) is a method for experimentally reconstructing the quantum state from measurement data. QST requires multiple measurements of the quantum system in different bases. For a system of n qubits, there are $3^n$ possible measurement bases (corresponding to measurements along the X, Y, and Z axes for each qubit). Qiskit offers a native QST command, called StateTomography, which we employed in collecting our data.

2.5. Error Mitigation

The digital units of a quantum computer (qubits, typically) are very fragile and subject to noise and errors in computation. In the long-term vision of quantum computers, fully fault-tolerant devices can suppress noise and errors to an arbitrarily small degree. However, such low-error-rate devices require substantial physical resources. In the present regime of so-called Noisy Intermediate Scale Quantum (NISQ) computation, various strategies for error mitigation have been suggested and demonstrated. These approaches provide some benefits beyond fault-tolerance, without scaling up physical device requirements.

One such approach is matrix-free measurement mitigation (Mthree or M3), which specifically focuses on measurement errors [37]. M3 relies on probabilistic methods to estimate and correct errors. These methods can introduce approximations that may not fully capture the complexity of the noise profile, leading to less accurate corrections compared to full matrix methods. Moreover, the calibration phase in M3 typically involves measuring only a subset of possible error configurations (e.g., single-qubit or pairwise errors). This can miss higher-order correlations between errors on multiple qubits, reducing the effectiveness of the mitigation. Otherwise, M3 is an efficient routine and is a promising technique for obtaining accurate experimental results for large quantum systems, where the number of possible measurement outcomes grows exponentially. A more detailed description of M3 can be found in Ref. [37].

3. Specific Examples

3.1. ((3,5)) QSS Using the Five-Qubit Code

We now apply the general method outlined in Section 2 to the [[$5,1,3$]] five-qubit code. Generators for the stabilizer of this code are given in

Table 1. Stabilizer generators for the 5-qubit (left) and Steane (right) codes.

Element	Operator	Element	Operator
$G_1$	$XZZXI$	$G_1$	$IIIXXXX$
$G_2$	$IXZZX$	$G_2$	$IXXIIXX$
$G_3$	$XIXZZ$	$G_3$	$XIXIXIX$
$G_4$	$ZXIXZ$	$G_4$	$IIIZZZZ$
$\overline{X}$	$XXXXX$	$G_5$	$IZZIIZZ$
$\overline{Z}$	$ZZZZZ$	$G_6$	$ZIZIZIZ$
		$\overline{X}$	$XXXXXXX$
		$\overline{Z}$	$ZZZZZZZ$

. Our first task is to identify the encoding unitary U that maps the initial stabilizers ${\left\{Z_i\right\}}_{i=1}^5$ to the ${\left\{G_i\right\}}_{i=1}^4\cup \left\{\overline{Z}\right\}$ in Table 1. This mapping can be constructed by observing that the generators of the five-qubit code closely resemble the stabilizers for the five-qubit ring state [9]. The latter is represented by a ring graph, and it is generated by performing a controlled-Z (CZ) between adjacent nodes on the graph, each initially in the state $|+\rangle$ (and hence stabilized by X). Sequentially applying (i) the same CZ gates on the five-qubit code, (ii) CNOT on the appropriate pairs of qubits, and (iii) Hadamard gates to qubits 1–4 transforms the generators as

$$\begin{array}{c}\hfill \left(\begin{array}{c}{G}_1\\ G_2\\ G_3\\ G_4\\ \overline{Z}\end{array}\right)\mapsto \left(\begin{array}{c}XIIXI\\ IXIIX\\ XIXII\\ IXIXI\\ IIIIZ\end{array}\right)\mapsto \left(\begin{array}{c}XIIII\\ IXIII\\ IIXII\\ IIIXI\\ IIIIZ\end{array}\right)\mapsto \left(\begin{array}{c}ZIIII\\ IZIII\\ IIZII\\ IIIZI\\ IIIIZ\end{array}\right).\end{array}$$

(6)

Here, we have used the fact that CNOT converts $X_c{X}_t\mapsto X_c$ and $Z_c{Z}_t\mapsto Z_t$ for the control (c) qubit and target (t) qubit. Two equivalent circuits realizing the CNOT transformations are the following: Performing Equation (6) in reverse defines the encoding unitary U, as depicted in Figure 5. Here, we have chosen the permutation $\mathrm{\Pi }$ among the unauthorized set to be trivial for convenience.

The next step is to identify the Pauli correction $R_k$ for each error syndrome ${\mathbf{b}}_k$. This is performed by observing how the Pauli errors on the first and second qubits evolve during the application of $U^{†}$. The necessary correction $R_k$ on the fifth qubit is summarized in

Table A1. For arbitrary Pauli errors on qubits 1 and 2 in the $\left(\right(3,5\left)\right)$ QSS scheme, this table provides the unitary correction $R_k$ on qubit five for each syndrome measurement ${\mathbf{b}}_k$.

	${\mathbb{I}}_2$	${\mathit{X}}_2$	${\mathit{Y}}_2$	${\mathit{Z}}_2$
${\mathbb{I}}_1$	syndrome = (0,0,0,0)	syndrome = (1,0,1,0)	syndrome = (1,1,1,0)	syndrome = (0,1,0,0)
	correction ${\mathbb{I}}_5$	correction $X_5$	correction $X_5$	correction ${\mathbb{I}}_5$
$X_1$	syndrome = (1,0,1,1)	syndrome = (0,0,0,1)	syndrome = (0,1,0,1)	syndrome = (1,1,1,1)
	correction $Y_5$	correction $Z_5$	correction $Z_5$	correction $Y_5$
$Y_1$	syndrome = (0,0,1,1)	syndrome = (1,0,0,1)	syndrome = (1,1,0,1)	syndrome = (0,1,1,1)
	correction $Y_5$	correction $Z_5$	correction $Z_5$	correction $Y_5$
$Z_1$	syndrome = (1,0,0,0)	syndrome = (0,0,1,0)	syndrome = (0,1,1,0)	syndrome = (1,1,0,0)
	correction ${\mathbb{I}}_5$	correction $X_5$	correction $X_5$	correction ${\mathbb{I}}_5$

of Appendix A. Finally, we perform the fidelity tests to see how well the procedure works at recovering an arbitrary initial secret $|\psi \rangle$. Our results are presented in Section 4.

3.2. ((5,7)) QSS Using the Steane Code

We now apply the same general method to the [[7,1,3]] Steane code. Generators for the stabilizer of this code are given in Table 1. As stated previously, CNOT converts $X_c{X}_t\mapsto X_c$ and CZ converts $Z_c{Z}_t\mapsto Z_t$. Therefore, by applying CNOT to the appropriate pairs of qubits, followed by Hadamard gates to qubits $5,6,7$, and a multiplication of qubit 1 by Z, yields the sequence of transformations

$$\begin{array}{c}\hfill \left(\begin{array}{c}{G}_1\\ G_2\\ G_3\\ G_4\\ G_5\\ G_6\\ \overline{Z}\end{array}\right)\mapsto ⠀\left(\begin{array}{c}IIIIXXX\\ IIIIIXX\\ IIIIXIX\\ IIIZIII\\ IZZIIII\\ IIZIIII\\ IZZZIII\end{array}\right)\mapsto ⠀\left(\begin{array}{c}ZIIIZZZ\\ ZIIIIZZ\\ ZIIIZIZ\\ ZIIZIII\\ ZZZIIII\\ ZIZIIII\\ ZZZZIII\end{array}\right).\end{array}$$

(7)

By adding together different combinations of the generators, it is straightforward to verify that this stabilizes the state ${|0\rangle }^{\otimes 7}$, as desired.

As was the case with the ((3,5)) scheme, applying these transformations in reverse defines the encoding unitary, U, which maps the initial stabilizers ${\left\{Z_i\right\}}_{i=1}^7$ to the ${\left\{G_i\right\}}_{i=1}^6\cup \left\{\overline{Z}\right\}$, as depicted in Figure 6. We have chosen the unauthorized set to be the sixth and seventh qubits. The necessary correction $R_k$ on the first qubit is summarized in

Table A2. For arbitrary Pauli errors on qubits six and seven in the $\left(\right(5,7\left)\right)$ QSS scheme, this table provides the unitary correction $R_k$ on qubit one for each syndrome measurement ${\mathbf{b}}_k$.

	${\mathbb{I}}_7$	${\mathit{X}}_7$	${\mathit{Y}}_7$	${\mathit{Z}}_7$
${\mathbb{I}}_6$	syndrome = (0,0,0,0,0,0)	syndrome = (0,1,1,0,0,0)	syndrome = (0,1,1,0,0,1)	syndrome = (0,0,0,0,0,1)
	correction ${\mathbb{I}}_1$	correction $X_1$	correction $X_1$	correction ${\mathbb{I}}_1$
$X_6$	syndrome = (1,0,1,0,0,0)	syndrome = (1,1,0,0,0,0)	syndrome = (1,1,0,0,0,1)	syndrome = (1,0,1,0,0,1)
	correction $X_1$	correction ${\mathbb{I}}_1$	correction ${\mathbb{I}}_1$	correction $X_1$
$Y_6$	syndrome = (1,0,1,0,1,0)	syndrome = (1,1,0,0,1,0)	syndrome = (1,1,0,0,1,1)	syndrome = (1,0,1,0,1,1)
	correction $X_1$	correction ${\mathbb{I}}_1$	correction ${\mathbb{I}}_1$	correction $X_1$
$Z_6$	syndrome = (0,0,0,0,1,0)	syndrome = (0,1,1,0,1,0)	syndrome = (0,1,1,0,1,1)	syndrome = (0,0,0,0,1,1)
	correction ${\mathbb{I}}_1$	correction $X_1$	correction $X_1$	correction ${\mathbb{I}}_1$

of Appendix A.

3.3. More Authorized Sets Using the Steane Code

The Steane code enables a more intricate QSS access structure than just a $\left(\right(5,7\left)\right)$ threshold scheme [38]. As shown in Appendix B, the code can still recover when certain subsets of three or even four qubits are erased (but not all subsets of those sizes). For CSS codes, where $C^{\perp }\subseteq C\subseteq {\mathbb{F}}_q^n$, the minimal access structure, ${\mathrm{\Gamma }}_m$, is given by the support of the minimal codewords in $C\setminus C^{\perp }$ [39].

$$\begin{array}{c}\hfill {\mathrm{\Gamma }}_m^{\mathrm{Steane}}=\{\{1,2,3\},\{1,4,5\},\{1,6,7\},\{2,4,6\},\\ \hfill \{2,5,7\},\{3,4,7\},\{3,5,6\}\}\end{array}$$

The encoding remains the same, but a different recovery is needed. Figure A1 depicts one such circuit in which qubits one through four form an authorized set. The necessary correction $R_k$ on the first qubit for all possible syndromes is presented in Appendix B.

3.4. ((2,3)) QSS Qutrit Code

The qutrit scheme involves secrets of the form $|\psi \rangle =\alpha |0\rangle +\beta |1\rangle +\gamma |2\rangle$. The secret sharing process was laid out by Cleve et al. [1]. While qutrit protocols are not ideally suited for qubit-based hardware, it is still possible to implement them. In this work, we have adopted the following logical encoding:

$$\begin{array}{cc}\hfill {\widetilde{|\psi \rangle }}_L=& \alpha {\widetilde{|0\rangle }}_L+\beta {\widetilde{|1\rangle }}_L+\gamma {\widetilde{|2\rangle }}_L\hfill \\ \hfill =& {\displaystyle \frac{\alpha }{\sqrt{3}}}\left(\right|000\rangle +|111\rangle +|222\rangle )\hfill \\ \hfill & +{\displaystyle \frac{\beta }{\sqrt{3}}}\left(\right|012\rangle +|120\rangle +|201\rangle )+{\displaystyle \frac{\gamma }{\sqrt{3}}}\left(\right|021\rangle +|102\rangle +|210\rangle ).\hfill \end{array}$$

(8)

The secret can be reconstructed from any two of the three shares. Given the first two shares (for instance), the recovery unitary $R_{12}$ involves adding the value of the first share to the second (modulo three), and then adding the value of the second share to the first. This yields the state [1]

$$\begin{array}{cc}\hfill (R_{12}\otimes I_3){\widetilde{|\psi \rangle }}_L=& {\displaystyle \frac{\alpha }{\sqrt{3}}}\left(\right|000\rangle +|021\rangle +|012\rangle )\hfill \\ \hfill & +{\displaystyle \frac{\beta }{\sqrt{3}}}\left(\right|112\rangle +|100\rangle +|121\rangle )+{\displaystyle \frac{\gamma }{\sqrt{3}}}\left(\right|221\rangle +|212\rangle +|200\rangle )\hfill \\ \hfill =& |\psi \rangle \otimes {\displaystyle \frac{1}{\sqrt{3}}}\left(|00\rangle +|12\rangle +|21\rangle \right),\hfill \end{array}$$

which recovers the secret in the first qutrit share. The reconstruction procedure for the other cases is similar ($R_{23}\mathrm{and}{R}_{31}$), by the symmetry of mapping Equation (8) with respect to cyclic permutations of the three qutrits [1]. Realizing the recovery unitary transformation, $R_{ij}$, for our circuit amounts to numerous SWAP gates (equivalently, three CNOT gates), which results in a much more complex circuit compared to the previous QSS schemes. Furthermore, it should be noted that the construction of the qutrit scheme does not follow the same stabilizer approach as the ((3,5)) and ((5,7)) schemes, and does not utilize mid-circuit measurements or classical feed-forwarding. The circuit for our qubit version of the qutrit scheme is shown in Figure 7.

4. Results

We now present experimental results for the performance of the above scheme using IBM’s 127-qubit Brisbane (Eagle r3) system as the experimental platform. We compare our real hardware results with theoretical expectations from simulating noisy circuits using Qiskit’s fake backend FakeBrisbane, which runs on a classical computer. We also provide noisy simulation results using FakeTorino, a 133-qubit (Heron r1) device that uses a different native gate set; simulated results are denoted “(SIM)”. Unfortunately, we were unable to obtain real results from the newer IBM Torino due to the unavailability of dynamic circuits at the time of data collection. Fake backends are constructed to mimic the behaviors of real IBM quantum devices using system snapshots. The system snapshots contain important information about the quantum system, such as basis gates, coupling map, gate error rates, and decoherence times (e.g., $T_1$ and $T_2$), but do not model dynamic cross-talk or scheduler-induced idling on the day of execution, which limits their fidelity as predictors for deep, feed-forward circuits. The results were taken after the application of readout error mitigation using M3. M3 works with quasi-probability distributions; however, in our case, a true probability distribution is a bit more useful. Therefore, we take the returned quasi-probability distribution and map it to the closest probability distribution as defined by the $L_2$-norm.

For the SWAP test results, five jobs were run for each scheme, each using 20,000 shots. Each job also used arbitrary initialization angles for the quantum states. We first evaluated the secret recovery by performing a SWAP test as described in Section 2.4. The figure of merit is the sample rate over 20,000 shots of measuring the $|0\rangle$ state in the SWAP test, which occurs with probability one when the initial and final states are identical. We then estimated the entanglement fidelity of the encoding and decoding process for a given subset of erasures using QST. For QST, five jobs were run for each scheme, but using 10,000 shots each, as this method is computationally expensive. The results were obtained at each of Qiskit’s optimization levels, with 0 meaning no optimization, and 1, 2, and 3 meaning light, medium, and heavy optimization, respectively.

For the ((3,5)) and ((5,7)) schemes, we evaluated two variations in the circuit: a mid-circuit measurement (MCM) and a delayed-circuit measurement (DCM). MCMs utilize measurements that execute before the end of the circuit, while DCMs only utilize measurements at the end of the circuit. Finally, for the Steane code QSS scheme, we evaluated the performance of the code with two and three-qubit erasures. For the three-qubit erasures, we looked at erasing sets of unauthorized and authorized sets, i.e., erasures that do and do not allow recovery.

We can see from the hardware data in Figure 8 that the ((3,5)) and ((5,7)) schemes were the most successful at decoding the secret for the SWAP test, with the ((5,7)) scheme coming out very slightly ahead among most optimization levels. For both these schemes, the simulation predicts much higher results. This large sim–hardware gap (especially in entanglement fidelity) is consistent with three effects already evidenced by our circuits: (i) idle-time decoherence from circuit depth and mid-circuit synchronization, as seen for the depth and multi-qubit counts in Appendix C, which disproportionately harms the QST runs that add a reference qubit register; (ii) cross-talk during concurrent two-qubit operations (echoed cross-resonance), which is not fully captured by snapshot-based fake backends; and (iii) residual measurement error and feed-forward scheduling overhead despite M3, especially in the MCM variants. Together, these could explain why the SWAP test pass rates remain reasonable while the reconstructed Bell-pair fidelity collapses more sharply on hardware than in simulation. The ((2,3)) scheme requires qutrit modular-add operations (e.g., the $R_{ij}$ recovery) that, under the qubit embedding of Equation (4), decompose into chains of SWAP/CNOT (ECR) operations with additional single-qubit rotations and routing (Figure 7). After transpilation, this yields substantially larger two-qubit counts and depth than the qubit codes (see Appendix C, Figure A4 vs. Figure A2 and Figure A3), explaining the systematically worse hardware performance.

For the qubit schemes, the MCM construction clearly outperformed the DCM construction by a noticeable margin in both the SWAP test and entanglement fidelity for both real and simulated data, as shown in Figure 8 and Figure 9. This strongly implies that using classical feed-forward decoding is more efficient than fully coherent decoding with a delayed measurement with these schemes, and this is supported by the resulting circuit depth and number of multi-qubit operations. Furthermore, as mentioned previously, we see a large discrepancy between the real and simulated data for the entanglement fidelity of the MCM construction; however, the discrepancy is not present for the DCM construction, as both produce the theoretical minimum entanglement fidelity due to the amount of noise/error.

Interestingly, the Steane code with three erasures slightly outperformed the Steane code with two erasures among most optimization levels concerning the SWAP test, as seen in Figure 10. This is contrary to what the simulation predicts. Looking at the simulated performance between authorized and unauthorized erased sets of size three for the Steane code, we can see that the erasure of an authorized set drastically reduces the entanglement fidelity. Moreover, it results in the theoretical minimum, as seen in Figure 10. The results of the ideal or noiseless case further support this observation.

5. Conclusions and Outlook

In this paper, we provided a detailed procedure for the construction of encoding and decoding circuits for ((3,5)), ((5,7)), and ((2,3)) quantum secret sharing schemes. We also went beyond the threshold scheme with the Steane code and investigated its more general access structure, as well as comparing different measurement implementations (MCM vs. DCM). The ultimate goal of this work was twofold. First, we wanted to provide a quantum circuit description of quantum secret sharing in an introductory manner that might be useful to newcomers to the field. Second, we wanted to see how well certain QSS schemes perform on a commercial quantum computing platform, such as IBM’s 127-qubit Brisbane system. The scope of this work was just to obtain a benchmarking performance of the IBM machine for the task of secret sharing, as it is currently available to the user.

There are multiple reasons for the discrepancies between the ideal, simulated, and real data. As noted above, we believe the primary source for non-ideal performance in the SWAP test and entanglement fidelity estimation is the depth of our circuits and, consequently, the decoherence of idle qubits. A natural next step would be to employ more tailored error mitigation techniques, such as dynamical decoupling (DD), as pursued in Ref. [40], especially to help with the additional wait time required to perform mid-circuit measurements. Another direction would be to look at machines with different basis (native) gates. Different basis gate sets could improve the performance of the schemes by decreasing the transpilation requirements, as seen in Figure 11. For IBM machines specifically, this would require running the schemes on machines with processors other than those with “Eagle” processors.

Our results suggest that, for near-term (pre-fault-tolerance) QSS implementations and for modular settings where secrets/quantum information move between zones, feed-forward-based decoders (MCM) should be preferred to minimize idle exposure. Mid-circuit measurement and feed-forward (MCM) consistently outperform delayed fully coherent variants (DCM) on hardware, aligning with our depth/multi-qubit count comparisons; this favors architectures with fast, low-latency measurement, reset, and classical control so that syndrome extraction and conditional recovery can proceed with minimal idling. Moreover, platforms that offer native qudit operations (or lower-overhead embeddings/gate sets) or support for higher-dimensional qudits (vs. emulation) would substantially reduce depth and improve robustness for higher-dimensional encodings. Lastly, the simulation–hardware gap we see is dominated by scheduler-induced idling, cross-talk, and readout effects that are not fully captured by snapshot-based fake backends; this points to scheduler-aware compilation and scheduler-aware error mitigation (e.g., DD targeted at idle windows) as high-value methods that are likely to yield the biggest marginal gain in fidelity before full fault-tolerance is achieved.