Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2405.18746 · IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud

Satwik Kundu, Swaroop Ghosh

Published May 5, 2025• 5 citations
arXivHTMLPDF

Abstract

The high costs of existing quantum cloud services, combined with the growing demand for quantum resources, could drive the development of more affordable but potentially untrusted quantum cloud providers. Deploying or hosting quantum models, such as quantum neural networks (QNNs), on these untrusted platforms introduces numerous security concerns, with the most critical being model theft. This vulnerability arises from the cloud provider's full access to the circuits during training and/or inference. In this work, we introduce STIQ, a novel ensemble-based strategy designed to safeguard QNNs against such cloud-based adversaries. Our method innovatively trains two distinct QNNs concurrently, hosting them on the same or different platforms, in such a way that each network yields obfuscated outputs, rendering the individual QNNs ineffective for adversaries operating within cloud environments. However, when these outputs are combined locally (using an aggregate function), they reveal the correct result. Through extensive experiments across various QNNs and datasets, our technique has proven to effectively mask the accuracy and losses of the individually hosted models by up to 76 %, albeit at the expense of a$\leq 2 \times$increase in total computational overhead. This trade-off, however, is a small price to pay for the enhanced security and integrity of QNNs in cloud-based environments prone to untrusted adversaries. We also demonstrated STIQ's practical application by evaluating it on multiple real quantum hardwares, showing that STIQ achieves up to$\approx 70 \%$obfuscation, with combined performance comparable to an unobfuscated model.

DOI
10.1109/host64725.2025.11050015

Related papers

Quantum Quandaries: Unraveling Encoding Vulnerabilities in Quantum Neural Networks

Suryansh Upadhyay, Swaroop Ghosh

Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on third-party quantum clouds for hosting models, exposing them and their training data to potential threats. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third-party quantum clouds poses a significant security risk. This work demonstrates that adversaries in quantum cloud environments can exploit white-box access to QML models to infer the user's encoding scheme by analyzing circuit transpilation artifacts. The extracted data can be reused for training clone models or sold for profit. We validate the proposed attack through simulations, achieving high accuracy in distinguishing between encoding schemes. We report that ≈95% of the time, the encoding can be predicted correctly. To mitigate this threat, we propose a transient obfuscation layer that masks encoding fingerprints using randomized rotations and entanglement, reducing adversarial detection to near-random chance ≈42%, with a depth overhead of ≈8.5% for a 5-layer QNN design.

arXiv:2502.01486•International Symposium on Quality Electronic Design (ISQED)•Apr 23, 2025•4 citations

Quantum Data Breach: Reusing Training Dataset by Untrusted Quantum Clouds

Suryansh Upadhyay, Swaroop Ghosh

Quantum computing (QC) has the potential to rev-olutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on a third-party quantum cloud for hosting the model, exposing the models and training data. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third party quantum clouds can pose a significant threat. This paper shows that adversaries in quantum clouds can use white-box access of the QML model during training to extract the state preparation circuit (containing training data) along with the labels. The extracted training data can be reused for training a clone model or sold for profit. We propose a suite of techniques to prune and fix the incorrect labels. Results show that ≈90% labels can be extracted correctly. The same model trained on the adversarially extracted data achieves approximately ≈90% accuracy, closely matching the accuracy achieved when trained on the original data. To mitigate this threat, we propose masking labels/classes and modifying the cost function for label obfuscation, reducing adversarial label prediction accuracy by ≈70%.

arXiv:2407.14687•International Symposium on Quality Electronic Design (ISQED)•Apr 23, 2025•1 citation

CopyQNN: Quantum Neural Network Extraction Attack under Varying Quantum Noise

Zhenxiao Fu, Leyi Zhao, Xuhong Zhang +3 more

Quantum Neural Networks (QNNs) have shown significant value across domains, with well-trained QNNs representing critical intellectual property often deployed via cloud-based QNN-as-a-Service (QNNaaS) platforms. Recent work has examined QNN model extraction attacks using classical and emerging quantum strategies. These attacks involve adversaries querying QNNaaS platforms to obtain labeled data for training local substitute QNNs that replicate the functionality of cloud-based models. However, existing approaches have largely over-looked the impact of varying quantum noise inherent in noisy intermediate-scale quantum (NISQ) computers, limiting their effectiveness in real-world settings. To address this limitation, we propose the CopyQNN framework, which employs a three-step data cleaning method to eliminate noisy data based on its noise sensitivity. This is followed by the integration of contrastive and transfer learning within the quantum domain, enabling efficient training of substitute QNNs using a limited but cleaned set of queried data. Experimental results on NISQ computers demonstrate that a practical implementation of CopyQNN significantly outperforms state-of-the-art QNN extraction attacks, achieving an average performance improvement of 8.73% across all tasks while reducing the number of required queries by 90×, with only a modest increase in hardware overhead.

arXiv:2504.00366•International Joint Conference on Neural Networks (IJCNN)•Jun 30, 2025•4 citations

QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines

Zhenxiao Fu, Min Yang, Cheng Chu +3 more

Variational quantum circuits (VQCs) have become a powerful tool for implementing Quantum Neural Networks (QNNs), addressing a wide range of complex problems. Well-trained VQCs serve as valuable intellectual assets hosted on cloud-based Noisy Intermediate Scale Quantum (NISQ) computers, making them susceptible to malicious VQC stealing attacks. However, traditional model extraction techniques designed for classical machine learning models encounter challenges when applied to NISQ computers due to significant noise in current devices. In this paper, we introduce QuantumLeak, an effective and accurate QNN model extraction technique from cloud-based NISQ machines. Compared to existing classical model stealing techniques, QuantumLeak improves local VQC accuracy by 4.99%~7.35% across diverse datasets and VQC architectures.

arXiv:2403.10790•International Joint Conference on Neural Networks (IJCNN)•Jun 30, 2024•9 citations

Reverse Delegated Training and Private Inference via Perfectly-Secure Quantum Homomorphic Encryption

Sergio A. Ortega, Miguel A. Martin-Delgado

Quantum machine learning in cloud environments requires protecting sensitive data while enabling remote computation. Here we demonstrate the first realistic implementations of a perfectly-secure quantum homomorphic encryption (QHE) scheme applied to quantum neural networks (QNN). Using efficient Clifford+$T$ decomposition, we implement quantum convolutional neural networks for two complementary scenarios: (i) reverse delegated training, where encrypted data from multiple providers trains a user's network via federated aggregation; (ii) private inference, where users process encrypted data with remote quantum networks. Moreover, analysis of server circuit privacy reveals probabilistic model protection through Pauli gate concealment. These results establish perfectly-secure QHE as a practical framework for multi-party quantum machine learning.

quant-pharXiv:2602.12712•Feb 16, 2026•0 citations

QuMoS: A Framework for Preserving Security of Quantum Machine Learning Model

Zhepeng Wang, Jinyang Li, Zhirui Hu +3 more

Security has always been a critical issue in machine learning (ML) applications. Due to the high cost of model training – such as collecting relevant samples, labeling data, and consuming computing power – model-stealing attack is one of the most fundamental but vitally important issues. When it comes to quantum computing, such a quantum machine learning (QML) model-stealing attack also exists and is even more severe because the traditional encryption method, such as homomorphic encryption can hardly be directly applied to quantum computation. On the other hand, due to the limited quantum computing resources, the monetary cost of training QML model can be even higher than classical ones in the near term. Therefore, a well-tuned QML model developed by a third-party company can be delegated to a quantum cloud provider as a service to be used by ordinary users. In this case, the QML model is likely to be leaked if the cloud provider is under attack. To address such a problem, we propose a novel framework, namely QuMoS, to preserve model security. Instead of applying encryption algorithms, we propose to divide the complete QML model into multiple parts and distribute them to multiple physically isolated quantum cloud providers for execution. As such, even if the adversary in a single provider can obtain a partial model, it does not have sufficient information to retrieve the complete model. Although promising, we observed that an arbitrary model design under distributed settings cannot provide model security. We further developed a reinforcement learning-based security engine, which can automatically optimize the model design under the distributed setting, such that a good trade-off between model performance and security can be made. Experimental results on four datasets show that the model design proposed by QuMoS can achieve a close accuracy to the model designed with neural architecture search under centralized settings while providing the highest security than the baselines.

arXiv:2304.11511•IEEE International Conference on Quantum Computing and Engineering (QCE)•Sep 17, 2023•15 citations
The high costs of existing quantum cloud services, combined with the growing demand for quantum resources, could drive the development of more affordable but potentially untrusted quantum cloud providers. Deploying or hosting quantum models, such as quantum neural networks (QNNs), on these untrusted platforms introduces numerous security concerns, with the most critical being model theft. This vulnerability arises from the cloud provider's full access to the circuits during training and/or inference. In this work, we introduce STIQ, a novel ensemble-based strategy designed to safeguard QNNs against such cloud-based adversaries. Our method innovatively trains two distinct QNNs concurrently, hosting them on the same or different platforms, in such a way that each network yields obfuscated outputs, rendering the individual QNNs ineffective for adversaries operating within cloud environments. However, when these outputs are combined locally (using an aggregate function), they reveal the correct result. Through extensive experiments across various QNNs and datasets, our technique has proven to effectively mask the accuracy and losses of the individually hosted models by up to 76 %, albeit at the expense of a≤2×\leq 2 \times≤2×increase in total computational overhead. This trade-off, however, is a small price to pay for the enhanced security and integrity of QNNs in cloud-based environments prone to untrusted adversaries. We also demonstrated STIQ's practical application by evaluating it on multiple real quantum hardwares, showing that STIQ achieves up to≈70%\approx 70 \%≈70%obfuscation, with combined performance comparable to an unobfuscated model.
Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on third-party quantum clouds for hosting models, exposing them and their training data to potential threats. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third-party quantum clouds poses a significant security risk. This work demonstrates that adversaries in quantum cloud environments can exploit white-box access to QML models to infer the user's encoding scheme by analyzing circuit transpilation artifacts. The extracted data can be reused for training clone models or sold for profit. We validate the proposed attack through simulations, achieving high accuracy in distinguishing between encoding schemes. We report that ≈95% of the time, the encoding can be predicted correctly. To mitigate this threat, we propose a transient obfuscation layer that masks encoding fingerprints using randomized rotations and entanglement, reducing adversarial detection to near-random chance ≈42%, with a depth overhead of ≈8.5% for a 5-layer QNN design.
Quantum computing (QC) has the potential to rev-olutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on a third-party quantum cloud for hosting the model, exposing the models and training data. As QML-as-a-Service (QMLaaS) becomes more prevalent, reliance on third party quantum clouds can pose a significant threat. This paper shows that adversaries in quantum clouds can use white-box access of the QML model during training to extract the state preparation circuit (containing training data) along with the labels. The extracted training data can be reused for training a clone model or sold for profit. We propose a suite of techniques to prune and fix the incorrect labels. Results show that ≈90% labels can be extracted correctly. The same model trained on the adversarially extracted data achieves approximately ≈90% accuracy, closely matching the accuracy achieved when trained on the original data. To mitigate this threat, we propose masking labels/classes and modifying the cost function for label obfuscation, reducing adversarial label prediction accuracy by ≈70%.
Quantum Neural Networks (QNNs) have shown significant value across domains, with well-trained QNNs representing critical intellectual property often deployed via cloud-based QNN-as-a-Service (QNNaaS) platforms. Recent work has examined QNN model extraction attacks using classical and emerging quantum strategies. These attacks involve adversaries querying QNNaaS platforms to obtain labeled data for training local substitute QNNs that replicate the functionality of cloud-based models. However, existing approaches have largely over-looked the impact of varying quantum noise inherent in noisy intermediate-scale quantum (NISQ) computers, limiting their effectiveness in real-world settings. To address this limitation, we propose the CopyQNN framework, which employs a three-step data cleaning method to eliminate noisy data based on its noise sensitivity. This is followed by the integration of contrastive and transfer learning within the quantum domain, enabling efficient training of substitute QNNs using a limited but cleaned set of queried data. Experimental results on NISQ computers demonstrate that a practical implementation of CopyQNN significantly outperforms state-of-the-art QNN extraction attacks, achieving an average performance improvement of 8.73% across all tasks while reducing the number of required queries by 90×, with only a modest increase in hardware overhead.
Variational quantum circuits (VQCs) have become a powerful tool for implementing Quantum Neural Networks (QNNs), addressing a wide range of complex problems. Well-trained VQCs serve as valuable intellectual assets hosted on cloud-based Noisy Intermediate Scale Quantum (NISQ) computers, making them susceptible to malicious VQC stealing attacks. However, traditional model extraction techniques designed for classical machine learning models encounter challenges when applied to NISQ computers due to significant noise in current devices. In this paper, we introduce QuantumLeak, an effective and accurate QNN model extraction technique from cloud-based NISQ machines. Compared to existing classical model stealing techniques, QuantumLeak improves local VQC accuracy by 4.99%~7.35% across diverse datasets and VQC architectures.
Quantum machine learning in cloud environments requires protecting sensitive data while enabling remote computation. Here we demonstrate the first realistic implementations of a perfectly-secure quantum homomorphic encryption (QHE) scheme applied to quantum neural networks (QNN). Using efficient Clifford+TTT decomposition, we implement quantum convolutional neural networks for two complementary scenarios: (i) reverse delegated training, where encrypted data from multiple providers trains a user's network via federated aggregation; (ii) private inference, where users process encrypted data with remote quantum networks. Moreover, analysis of server circuit privacy reveals probabilistic model protection through Pauli gate concealment. These results establish perfectly-secure QHE as a practical framework for multi-party quantum machine learning.
Security has always been a critical issue in machine learning (ML) applications. Due to the high cost of model training – such as collecting relevant samples, labeling data, and consuming computing power – model-stealing attack is one of the most fundamental but vitally important issues. When it comes to quantum computing, such a quantum machine learning (QML) model-stealing attack also exists and is even more severe because the traditional encryption method, such as homomorphic encryption can hardly be directly applied to quantum computation. On the other hand, due to the limited quantum computing resources, the monetary cost of training QML model can be even higher than classical ones in the near term. Therefore, a well-tuned QML model developed by a third-party company can be delegated to a quantum cloud provider as a service to be used by ordinary users. In this case, the QML model is likely to be leaked if the cloud provider is under attack. To address such a problem, we propose a novel framework, namely QuMoS, to preserve model security. Instead of applying encryption algorithms, we propose to divide the complete QML model into multiple parts and distribute them to multiple physically isolated quantum cloud providers for execution. As such, even if the adversary in a single provider can obtain a partial model, it does not have sufficient information to retrieve the complete model. Although promising, we observed that an arbitrary model design under distributed settings cannot provide model security. We further developed a reinforcement learning-based security engine, which can automatically optimize the model design under the distributed setting, such that a good trade-off between model performance and security can be made. Experimental results on four datasets show that the model design proposed by QuMoS can achieve a close accuracy to the model designed with neural architecture search under centralized settings while providing the highest security than the baselines.