Correct QS10 threat model and source attribution

[rksharma-owg]

Summary

This corrects QS10's source attribution and aligns the entry's threat model with the cited research:

• removes the claim that Mi et al. (CCS 2022) demonstrated reset-timing leakage from the classical control plane;
• states the physical-access/malicious-insider assumption in Xu et al. (CCS 2023);
• distinguishes the demonstrated controller attack from a hypothetical future remote-tenant attack;
• replaces the blanket assertion that every job hardcodes all data with the narrower, supported risk that circuits can encode sensitive algorithms, oracles, ansatzes, inputs, and parameters; and
• makes the examples and mitigations specific to controller access, telemetry, and the defences evaluated in the cited paper.

The README's QS10 anchor is updated accordingly.

Why

The Mi paper demonstrates residual qubit-state leakage across reset operations: an attacker measures post-reset qubit state to infer information about the prior state, and the paper also reports adjacent-qubit crosstalk-like effects. It does not demonstrate timing analysis of reset commands or classical-controller leakage. That evidence belongs with tenant isolation (QS08), not QS10.

The Xu paper does cover controller side channels, including timing, total energy, mean power, total power traces, and per-channel traces. However, its threat model assumes the attacker can physically instrument the controller, with a malicious data-centre insider as the motivating example. The paper explicitly says controller power data is not currently exposed by cloud providers and treats remote exploitation as a possible future extension. QS10 should preserve that boundary.

Primary sources reviewed:

• Mi et al., Securing Reset Operations in NISQ Quantum Computers (CCS 2022)
• Xu et al., Exploration of Power Side-Channel Vulnerabilities in Quantum Computer Controllers (CCS 2023)

Scope and validation

• Documentation only; no code or generated artifacts.
• Re-read both papers, including their abstracts, threat models, attack capabilities, limitations, and defences.
• Verified the Markdown diff with git diff --check.
• This does not overlap PR Verify all references; correct QS08 attribution and QS05 stale draft #19, which changes QS05 and QS08 citations but does not modify QS10.