Abstract

Security research on quantum computers has concentrated on physical-layer attacks against qubits, while two surfaces remain inadequately defended: the _quantum-error-correction (QEC) syndrome-and-decoder pipeline_ , and the _classical control and software stack_ that compiles, schedules, executes, and returns the results of a quantum computation. Tampering on these surfaces can corrupt a computation while the physical error rate appears normal, and can remain within the tolerance of a single-circuit integrity check. We present **Trinetra.Q** , a detection layer comprising cooperating detectors, each of which monitors a statistical or behavioral property of quantum-domain data, compares it against an envelope calibrated from honest operation, and raises an attack indication only on a statistically significant deviation. The layer comprises (A) a QEC-integrity detector over per-stabilizer firing rates, syndrome defect-count, and repeatedsyndrome rate; (B) a decoder-confidence detector over the margin between minimum-weight error explanations in distinct logical classes; (C) a behavioral output-divergence detector that flags crosstalk-class and novel attacks by their effect on a victims measurement-output distribution relative to a matched control; (D) a control-stack tamper detector that interleaves known-answer canary circuits, constructed to be indistinguishable to a resident implant, and aggregates their deviations with a cross-job consistency statistic; and (E) a compilation/execution-integrity detector that compares the output divergence of a reference execution against a candidate. Each detector calibrates on honest operation and gates its indication on a statistical-significance threshold, so honest operation raises no alarm. We evaluate the detectors in faithful simulation and on three production IBM Heron quantum processors. We further bound the physical attack surface with a systematic negative map on three devicesmost physical-layer attacks return statistically null, with one exception, an implemented and measured within-job feed-forward covert-channel primitiveand we evaluate every detector against an adaptive attacker with full knowledge of the defense. To our knowledge this is the first unified statistical-and-behavioral detection layer for the QEC layer and the classical control stack of a quantum computing system, demonstrated on production quantum hardware. We state the limitations plainly.