[Paper Review] A Uniform Representation of Classical and Quantum Source Code for Static Code Analysis

Maximilian Kaul, Alexander Küchler+1 more|arXiv (Cornell University)|Aug 11, 2023

Quantum Computing Algorithms and ArchitectureComputer Science36 references3 citations

TL;DR

This paper proposes a unified static analysis framework using an extended Code Property Graph (CPG) to analyze both classical and quantum source code together. By augmenting the CPG with quantum-specific nodes and edges—such as qubit dependencies, quantum gates, and classical-quantum interfaces—it enables cross-domain analysis of hybrid programs in Qiskit and OpenQASM, supporting detection of bugs, dataflow issues, and complexity metrics in a single, extensible representation.

ABSTRACT

The emergence of quantum computing raises the question of how to identify (security-relevant) programming errors during development. However, current static code analysis tools fail to model information specific to quantum computing. In this paper, we identify this information and propose to extend classical code analysis tools accordingly. Among such tools, we identify the Code Property Graph to be very well suited for this task as it can be easily extended with quantum computing specific information. For our proof of concept, we implemented a tool which includes information from the quantum world in the graph and demonstrate its ability to analyze source code written in Qiskit and OpenQASM. Our tool brings together the information from the classical and quantum world, enabling analysis across both domains. By combining all relevant information into a single detailed analysis, this powerful tool can facilitate tackling future quantum source code analysis challenges.

Motivation & Objective

• To address the lack of static analysis tools that can analyze both classical and quantum code together, especially at the interface between them.
• To identify common error patterns in hybrid quantum programs, such as unused result qubits, constant conditions, and superfluous operations.
• To extend the Code Property Graph (CPG) with quantum-specific semantics to support scalable, language-agnostic analysis of quantum programs.
• To enable automated measurement of quantum circuit complexity metrics and security-relevant properties in a unified graph model.

Proposed method

• Extends the existing CPG framework with new node and edge types to model quantum operations, qubit registers, and quantum gate dependencies.
• Introduces quantum-specific components such as qubit nodes, quantum gate edges, and entanglement tracking to represent quantum state evolution.
• Bridges classical and quantum parts by modeling control flow and data flow across the classical-quantum boundary using enhanced EOG and DFG edges.
• Uses language frontends for Qiskit (Python-based) and OpenQASM to parse source code into the extended CPG structure.
• Employs graph queries to detect known error patterns such as unused result bits, constant classic bits, and redundant operations.
• Supports automated calculation of quantum circuit complexity metrics, including depth, width, and gate count, by traversing the extended graph.

Experimental results

Research questions

• RQ1 How can a single, unified static analysis framework be designed to analyze both classical and quantum code in hybrid programs?
• RQ2 What are the key error patterns in quantum programs that arise at the interface between classical control logic and quantum operations?
• RQ3 How can the Code Property Graph (CPG) be extended to model quantum-specific concepts like qubit entanglement, gate operations, and quantum memory?
• RQ4 Can graph queries over the extended CPG detect known security- and correctness-relevant bugs in quantum programs?
• RQ5 To what extent can complexity metrics for quantum circuits be automatically derived from the unified graph representation?

Key findings

• The extended Quantum Code Property Graph (QCPG) successfully models both classical and quantum code in a single, consistent graph structure, enabling cross-domain analysis.
• The prototype implementation detects known error patterns such as unused result bits, constant classic bits, and superfluous quantum operations via targeted graph queries.
• The framework supports automated calculation of quantum circuit complexity metrics, including depth, width, and gate count, which are essential for assessing feasibility on real hardware.
• The approach is extensible and supports multiple quantum programming languages, with native support for Qiskit and OpenQASM in the prototype.
• The method enables analysis of dataflow and control flow across classical and quantum components, which is critical for identifying subtle logic errors in hybrid programs.
• The solution maintains backward compatibility with existing CPG analyses, allowing classical code analysis to proceed unaltered while adding quantum-aware reasoning.