Abstract Quantum neural networks (QNNs), as a novel model that combines the advantages of quantum computing and classical neural networks, are similarly vulnerable to backdoor attacks like classical neural networks. Current research on backdoor attacks against QNNs is limited by model structure or poisoning rate, resulting in poor attack performance in black-box scenarios. This paper proposes a black-box attack method that uses a quantum-classical hybrid generative model to generate transferable backdoor triggers for QNNs with unknown structures. The method generates universal adversarial perturbations as triggers based on generative models, and designs a QNN pool by utilizing the idea of ensemble models. It combines the min–max framework and non-target Kullback–Leibler divergence technique to improve the transferability of triggers to achieve a black-box attack. Experiments demonstrate that with a poisoning rate of only 5%, the attack success rate exceeds 98% for three different structured QNNs, proving the effectiveness of this backdoor attack. In addition, we also prove that the existing detection methods such as strip and spectral signatures are unable to defend against the backdoor attack proposed in this paper.
Abstract Quantum neural networks (QNNs), as a novel model that combines the advantages of quantum computing and classical neural networks, are similarly vulnerable to backdoor attacks like classical neural networks. Current research on backdoor attacks against QNNs is limited by model structure or poisoning rate, resulting in poor attack performance in black-box scenarios. This paper proposes a black-box attack method that uses a quantum-classical hybrid generative model to generate transferable backdoor triggers for QNNs with unknown structures. The method generates universal adversarial perturbations as triggers based on generative models, and designs a QNN pool by utilizing the idea of ensemble models. It combines the min–max framework and non-target Kullback–Leibler divergence technique to improve the transferability of triggers to achieve a black-box attack. Experiments demonstrate that with a poisoning rate of only 5%, the attack success rate exceeds 98% for three different structured QNNs, proving the effectiveness of this backdoor attack. In addition, we also prove that the existing detection methods such as strip and spectral signatures are unable to defend against the backdoor attack proposed in this paper.
ABSTRACT Quantum neural networks (QNNs) are advancing rapidly, but their security issues must not be overlooked. Backdoor attacks, as a stealthy and highly threatening attack method, have caused significant impacts on classical neural networks. Moreover, backdoor attacks have recently been proven to pose a significant threat to quantum neural networks as well. Currently, all existing methods in quantum machine learning backdoor research are designed for classical data samples. These methods all involve poisoning classical data samples first and then quantizing them, with no existing approaches that directly target quantum state data for poisoning. This paper presents a novel backdoor attack method against quantum neural networks by utilizing the quantum state—universal adversarial perturbations (QS‐UAP). This method, for the first time, constructs a backdoor trigger specifically for quantum‐state data based on quantum generative models. Moreover, this method enhances the quality of the backdoor trigger by integrating knowledge distillation with frequency‐domain constraints. The proposed method embeds a backdoor into the target model by poisoning quantum data samples. Experimental results demonstrate that with a 10% poisoning rate, the attack success rates exceed 97% across three structurally distinct QNN architectures.
Backdoor attacks are emerging security threats to deep neural networks. In these attacks, adversaries manipulate the network by constructing training samples embedded with backdoor triggers. The backdoored model performs as expected on clean test samples but consistently misclassifies samples containing the backdoor trigger as a specific target label. While quantum neural networks (QNNs) have shown promise in surpassing their classical counterparts in certain machine learning tasks, they are also susceptible to backdoor attacks. However, current attacks on QNNs are constrained by the adversary’s understanding of the model structure and specific encoding methods. Given the diversity of encoding methods and model structures in QNNs, the effectiveness of such backdoor attacks remains uncertain. In this paper, we propose an algorithm that leverages dataset-based optimization to initiate backdoor attacks. A malicious adversary can embed backdoor triggers into a QNN model by poisoning only a small portion of the data. The victim QNN maintains high accuracy on clean test samples without the trigger but outputs the target label set by the adversary when predicting samples with the trigger. Furthermore, our proposed attack cannot be easily resisted by existing backdoor detection methods.
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.
Abstract Quantum neural networks are increasingly distributed and deployed as third-party components, creating a supply-chain attack surface in which backdoors can be implanted during training yet remain difficult to detect under strict black-box constraints. In the probability-only minimal-interface regime, defenders often observe only post-readout class probabilities (or finite-shot frequency estimates), while shot noise and limited trusted clean data can obscure the small, targeted distribution shifts induced by poisoning. A trigger-agnostic black-box detector for this setting is proposed. The method elicits dose–response evidence by mixing a trusted clean pool with a suspect pool at progressively larger mixing ratios and tracking class-wise uplifts in predicted-class rates. To separate trigger-induced anomalies from static discrepancies between a model under test and a clean reference, we apply a difference-in-differences baseline alignment and stabilize the resulting response curves via Monte Carlo resampling under finite-shot sampling. Detection is formulated as a family of distribution-free one-sided sign tests across ratios and classes, with Holm–Bonferroni correction controlling the family-wise false-alarm rate; an effect-size gate yields a Detected/Pass verdict and a target-class estimate. We further characterize detection power as a function of the (unknown) prevalence of triggered inputs in the suspect pool. Experiments on 110 trained instances spanning quantum fast gradient sign method, quantum universal adversarial perturbation (QUAP), and patch-based backdoors on four-class MNIST subsets achieve an area under the receiver operating characteristic curve of 0.954 and an average precision under the precision–recall curve of 0.986. At the default operating point, the detector attains 0.906 sensitivity and 0.840 specificity, with most residual false alarms concentrated in QUAP clean controls under benign distribution shift.
Quantum Neural Networks (QNNs) have emerged as a promising paradigm for quantum machine learning in the Noisy Intermediate-Scale Quantum (NISQ) era, leveraging quantum phenomena such as superposition and entanglement to process information in exponentially large Hilbert spaces. However, QNNs inherit critical security vulnerabilities from classical neural networks, particularly susceptibility to backdoor attacks. Existing attack methods designed for classical systems fail against QNNs due to quantum-specific constraints: aggressive downsampling required by limited qubit resources destroys conventional triggers, while the spectral learning bias of parameterized quantum circuits (PQCs) restricts learnable patterns. To tackle this, we present HarmQ, a quantum-native backdoor attack that exploits PQCs' inherent Fourier decomposition bias through harmonic trigger patterns. Our approach employs sinusoidal perturbations on coarse grids with block-uniform structure, ensuring survival through downsampling while aligning with PQCs' preference for low-frequency components. This enables effective backdoor injection under realistic black-box conditions where attackers access only training data. Experiments on MNIST and Fashion-MNIST demonstrate that HarmQ achieves attack success rates exceeding 99% while maintaining over 90% clean accuracy, significantly outperforming existing methods including BadNets (2.77% ASR), Watermark (7.96% ASR), Q-FGSM (44.32% ASR) and QUAP (3.40% ASR). Parametric t-SNE visualizations of quantum state representations confirm that harmonic triggers create distinctly separated clusters, evidencing HarmQ as a fundamental security threat for QNNs.
Security research in quantum neural networks (QNNs) is an emerging field that aims to utilize the principles of quantum mechanics to protect the security of neural networks, and this protection can be against different threats such as eavesdropping, tampering, and malware attacks. Backdoor attacks are a serious security challenge in the field of deep neural networks. This type of attack is highly stealthy and harmful, which can silently implant malicious functions and trigger them under specific conditions, thus disrupting the normal operation of neural networks or leaking sensitive information. To address the potential security risks of backdoor attacks to QNNs, this paper focuses on two core issues: backdoor attack detection and defense strategy design. It proposes an activation-based clustering method for backdoor sample detection (ACDM) to counter backdoor attack threats. Experimental results demonstrate that this defense method effectively safeguards the operational security of QNNs while enhancing the model's robustness against abnormal inputs and the reliability of its output results. It should be noted that the current research has limitations: the adaptability and effectiveness of this defense framework on complex high-dimensional datasets (e.g., quantum image datasets) and QNNs with different topological structures (e.g., deep quantum convolutional networks) require further validation and optimization through subsequent experiments.