Quantum Federated Learning (QFL) inherits the core vulnerability of federated optimization to malicious clients, while also introducing an attack surface from variational circuit training and measurement-driven gradients. This work proposes a novel CircUit-Level backdoor Threat (CULT) model that formalizes four stealthy attacks by exploiting quantum-aware mechanisms, including Grover, Pauli, Bit-flip, and Sign-flip. By enabling malicious clients on both in-training and post-training surfaces, these attacks can critically undermine the learning process. We establish a rigorous theoretical foundation to demonstrate attack stealthiness under standard smoothness assumptions. Experiments on the MNIST and CIFAR-10 datasets with non-IID splits and varying fractions of malicious clients show that even a single malicious client can induce severe accuracy degradation under FedAvg aggregation. While popular defenses, including Krum, Multi-Krum, FoolsGold, FLGuardian, and Mud-HoG, reduce degradation in many regimes, they fail to eliminate worst-case failure cases, where accuracy drops up to 50\%. The experimental analysis further reveals that under the CULT model, malicious updates effectively mask their presence by staying close to benign norms, thereby helping attackers evade detection.
Quantum Federated Learning (QFL) inherits the core vulnerability of federated optimization to malicious clients, while also introducing an attack surface from variational circuit training and measurement-driven gradients. This work proposes a novel CircUit-Level backdoor Threat (CULT) model that formalizes four stealthy attacks by exploiting quantum-aware mechanisms, including Grover, Pauli, Bit-flip, and Sign-flip. By enabling malicious clients on both in-training and post-training surfaces, these attacks can critically undermine the learning process. We establish a rigorous theoretical foundation to demonstrate attack stealthiness under standard smoothness assumptions. Experiments on the MNIST and CIFAR-10 datasets with non-IID splits and varying fractions of malicious clients show that even a single malicious client can induce severe accuracy degradation under FedAvg aggregation. While popular defenses, including Krum, Multi-Krum, FoolsGold, FLGuardian, and Mud-HoG, reduce degradation in many regimes, they fail to eliminate worst-case failure cases, where accuracy drops up to 50%. The experimental analysis further reveals that under the CULT model, malicious updates effectively mask their presence by staying close to benign norms, thereby helping attackers evade detection.
In this study, A Quantum-Classical Federated Learning (QCFL) framework designed for skin cancer prediction is presented. It integrates classical convolutional neural networks with variational quantum circuits so that both quantum computing and deep learning can be used in decentralized, privacy-preserving environments. The functioning of the Federated Learning model includes a efficient optimization algorithm suitable for quantum environments in FL called SCAFFOLD, which handle client heterogeneity and non-IID data distributions modeled using Dirichlet sampling. The framework includes three ways of training normal training along with trigger-based and semantic-based backdoor attacks to understand demonstrating the susceptibility of federated skin cancer models to stealthy adversarial behaviors. To defend against such threats, multiple detection and mitigation strategies are evaluated, including Activation Clustering, Neural Cleanse, and Fine-Pruning. . Additionally, a novel approach for defense, Spectral Defense, is proposed and developed, based on the eigen-spectrum analysis of internal neural activations to detect and ultimately suppress backdoor behavior without recourse to clean validation data. Experimental results on this hybrid quantum-classical model prove improvement in classification performance, whereas the Spectral Defense framework provides significant attack success rates reduction with little degradation in model accuracy. This work provides a robust and scalable approach for deploying secure federated learning systems to adverse conditions for medical image analysis.
Quantum Federated Learning (QFL) merges privacypreserving federation with quantum computing gains, yet its resilience to adversarial noise is unknown. We first show that QFL is as fragile as centralized quantum learning. We propose Robust Quantum Federated Learning (RobQFL), embedding adversarial training directly into the federated loop. RobQFL exposes tunable axes: client coverageγ(0 100 %), perturbation scheduling (fixed-εvsε-mixes), and optimization (fine-tune vs scratch), and distils the resultingγ×εsurface into two metrics: Accuracy-Robustness Area and Robustness Volume. On 15client simulations with MNIST and Fashion-MNIST, IID and Non-IID conditions, training only20−50%clients adversarially boostsε≤0.1accuracy∼15ppat<2ppclean-accuracy cost; fine-tuning adds3−5pp. With≥75%coverage, a moderateε-mix is optimal, while high-εschedules help only at 100 % coverage. Label-sorted non-IID splits halve robustness, underscoring data heterogeneity as a dominant risk.
Quantum Federated Learning (QFL) offers a promising framework to train quantum models across distributed clients while keeping data strictly local. Due to its simplicity and low communication overhead, Federated Averaging (FedAvg) is the standard aggregation choice in QFL literature. However, deploying QFL on practical hardware exposes a severe double-drift phenomenon: the global model is simultaneously derailed by client drift from non-IID data and hardware bias from noisy quantum gradient estimates. In this work, we first analyze the convergence of FedAvg under these realistic conditions, mathematically demonstrating that quantum hardware bias creates a persistent error floor that standard averaging cannot correct. To overcome this limitation, we propose Q-ANCHOR, a quantum-aware federated aggregation architecture that anchors server updates with zero-noise extrapolation while applying stateful client correction to suppress both client drift and hardware-induced bias. Our convergence theory proves that Q-ANCHOR successfully mitigates classical client drift while actively reducing the hardware-bias floor. Experimental results demonstrate that Q-ANCHOR achieves significantly more stable training than conventional FL baselines.
Title: Adversarially Robust Federated Quantum Machine Learning for Healthcare: Attacks, Adaptive Defenses, and Post-Quantum Secure Aggregation Track: AI for Science Federated quantum machine learning (FQML) offers a compelling paradigm for privacy-preserving clinical AI, enabling distributed training of variational quantum circuit (VQC) models across hospital networks without centralizing sensitive patient records. While prior work has demonstrated the efficiency and accuracy of FQML frameworks, the security of these systems under adversarial conditions remains entirely unaddressed, a gap explicitly identified in foundational FQML research. An empirical adversarial security evaluation of FQML in a healthcare setting is presented here, directly addressing the challenge of building reliable and trustworthy AI systems identified as a central theme of NYSDS 2026. Hybrid VQC clients are implemented using PennyLane on the liver cirrhosis staging dataset distributed across twenty simulated hospital nodes under realistic non-IID Dirichlet partitioning. The system is subjected to five attack types including data poisoning, model poisoning, backdoor injection, man-in-the-middle interception, and a novel adaptive adversary escalation scenario. Protection is provided by a multi-layered adaptive defense stack comprising exponential moving average trust scoring, multi-signal anomaly detection using z-score, variance, and kurtosis signals, adaptive trimmed mean aggregation, per-client differential privacy scheduling, and CRYSTALS-Kyber-768 post-quantum key encapsulation implemented as ML-KEM-768 under NIST FIPS 203 for gradient transmission security. Across three independent experimental runs, the proposed defended system achieves 82.84% mean test accuracy and a security detection AUC of 0.96, compared to 36.0% accuracy for undefended quantum FL under identical adversarial conditions, confirming that FQML without defense is functionally non-operational in adversarial healthcare environments. The defended quantum system AUC of 0.96 exceeds the classical defended baseline of 0.94, demonstrating that classical adaptive defenses transfer effectively to VQC parameter updates and produce superior anomaly detection. Backdoor and model poisoning detection rates reach 100% and 98% respectively. A novel finding identifies a critical operating window of 4 to 12 federated clients within which the system achieves stable performance, with direct implications for practical hospital network deployment. Post-quantum encryption via Kyber-768 provides provable forward security against harvest-now-decrypt-later threats while demonstrably improving man-in-the-middle detection rates. These results establish that adversarially robust federated quantum ML is achievable and motivate the design of quantum-native defense mechanisms for next-generation clinical AI systems.
Anomaly detection has a significant impact on applications such as video surveillance, medical diagnostics, and industrial monitoring, where anomalies frequently depend on context and anomaly-labeled data are limited. Quantum federated learning (QFL) overcomes these concerns by distributing model training among several quantum clients, consequently eliminating the requirement for centralized quantum storage and processing. However, in real-life quantum networks, clients frequently differ in terms of hardware capabilities, circuit designs, noise levels, and how classical data is encoded or preprocessed into quantum states. These differences create inherent heterogeneity across clients - not just in their data distributions, but also in their quantum processing behaviors. As a result, training a single global model becomes ineffective, especially when clients handle imbalanced or non-identically distributed (non-IID) data. To address this, we propose a new framework called personalized quantum federated learning (PQFL) for anomaly detection. PQFL enhances local model training at quantum clients using parameterized quantum circuits and classical optimizers, while introducing a quantum-centric personalization strategy that adapts each client's model to its own hardware characteristics and data representation. Extensive experiments show that PQFL significantly improves anomaly detection accuracy under diverse and realistic conditions. Compared to state-of-the-art methods, PQFL reduces false errors by up to 23%, and achieves gains of 24.2% in AUROC and 20.5% in AUPR, highlighting its effectiveness and scalability in practical quantum federated settings.
Federated Learning (FL) enables privacy-preserving collaborative training but faces significant challenges when client data must be removed or malicious updates forgotten. Regulatory requirements and backdoor threats necessitate efficient, selective unlearning methods. However, existing approximate approaches modify large portions of model parameters, increasing vulnerability to gradient inversion attacks and degrading utility. We propose HQSU (Hybrid Quantum Selective Unlearning), a hybrid quantum-classical framework that performs selective unlearning via low-rank Hessian subspace modeling and variational quantum influence estimation. HQSU preserves 96.83% clean accuracy and reduces backdoor attack success to 9.95%, matching full retraining while modifying only 0.314% of parameters, over300×fewer than dense-update baselines. Experiments on MNIST show that HQSU achieves the lowest residual backdoor accuracy among approximate methods with stable recovery dynamics. Circuit ablations indicate that amplitude-encoded, circularly entangled ansätze provide the strongest influence estimation under NISQ constraints. These results demonstrate that hybrid quantum modeling can significantly improve selectivity, stability, and privacy in federated unlearning.