IEEE International Conference on Quantum Computing and Engineering (QCE)
Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security
Pascal Debus, Maximilian Wendlinger, Kilian Tscharke, Daniel Herr, Cedric Brügmann, Daniel Ohl de Mello, Juris Ulmanis, Alexander Erhard, Arthur Schmidt, Fabian Petsch
Quantum Machine Learning (QML) systems inherit vulnerabilities from classical machine learning while introducing new attack surfaces rooted in the physical and algorithmic layers of quantum computing. Despite a growing body of research on individual attack vectors - ranging from adversarial poisoning and evasion to circuit-level backdoors, side-channel leakage, and model extraction - these threats are often analyzed in isolation, with unrealistic assumptions about attacker capabilities and system environments. This fragmentation hampers the development of effective, holistic defense strategies. In this work, we argue that QML security requires more structured modeling of the attack surface, capturing not only individual techniques but also their relationships, prerequisites, and potential impact across the QML pipeline. We propose adapting kill chain models, widely used in classical IT and cybersecurity, to the quantum machine learning context. Such models allow for structured reasoning about attacker objectives, capabilities, and possible multi-stage attack paths - spanning reconnaissance, initial access, manipulation, persistence, and exfiltration. Based on extensive literature analysis, we present a detailed taxonomy of QML attack vectors mapped to corresponding stages in a quantum-aware kill chain framework that is inspired by the MITRE ATLAS for classical machine learning. We highlight interdependencies between physical-level threats (like side-channel leakage and crosstalk faults), data and algorithm manipulation (such as poisoning or circuit backdoors), and privacy attacks (including model extraction and training data inference). This work provides a foundation for more realistic threat modeling and proactive security-in-depth design in the emerging field of quantum machine learning.
Quantum Machine Learning (QML) systems inherit vulnerabilities from classical machine learning while introducing new attack surfaces rooted in the physical and algorithmic layers of quantum computing. Despite a growing body of research on individual attack vectors - ranging from adversarial poisoning and evasion to circuit-level backdoors, side-channel leakage, and model extraction - these threats are often analyzed in isolation, with unrealistic assumptions about attacker capabilities and system environments. This fragmentation hampers the development of effective, holistic defense strategies. In this work, we argue that QML security requires more structured modeling of the attack surface, capturing not only individual techniques but also their relationships, prerequisites, and potential impact across the QML pipeline. We propose adapting kill chain models, widely used in classical IT and cybersecurity, to the quantum machine learning context. Such models allow for structured reasoning about attacker objectives, capabilities, and possible multi-stage attack paths - spanning reconnaissance, initial access, manipulation, persistence, and exfiltration. Based on extensive literature analysis, we present a detailed taxonomy of QML attack vectors mapped to corresponding stages in a quantum-aware kill chain framework that is inspired by the MITRE ATLAS for classical machine learning. We highlight interdependencies between physical-level threats (like side-channel leakage and crosstalk faults), data and algorithm manipulation (such as poisoning or circuit backdoors), and privacy attacks (including model extraction and training data inference). This work provides a foundation for more realistic threat modeling and proactive security-in-depth design in the emerging field of quantum machine learning.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.
The growing complexity and velocity of cyber threats in high-security environments such as defense, critical infrastructure, and intelligence networks necessitates a paradigm shift in threat detection capabilities. Traditional cybersecurity systems, including those enhanced by classical machine learning algorithms, often struggle to process and classify massive volumes of heterogeneous and encrypted data in real time. This shortcoming is particularly evident in the context of advanced persistent threats (APTs), polymorphic malware, and insider attacks, which require rapid adaptation and heightened sensitivity to anomalous behavior.Quantum Machine Learning (QML), an emerging interdisciplinary field at the intersection of quantum computing and artificial intelligence, presents a promising avenue for augmenting threat detection mechanisms. Leveraging quantum phenomena such as superposition and entanglement, QML models offer potential advantages in processing speed, pattern recognition, and feature space transformation that can outperform their classical counterparts in high-dimensional data analysis. This paper explores the application of QML to threat detection in high-security networks, proposing a hybrid quantum-classical framework that integrates quantum-enhanced classifiers such as quantum support vector machines and variational quantum circuits into existing detection pipelines.The study outlines a technical overview of quantum computing principles relevant to cybersecurity, critically evaluates existing detection architectures, and presents simulation-based case studies to assess performance metrics, including detection accuracy and false positive rates. It further examines the limitations of current quantum hardware, algorithmic constraints, and emerging ethical and operational considerations. The findings suggest that while QML is still constrained by hardware maturity and integration complexity, it holds transformative potential for proactive, intelligent, and adaptive cyber defense systems in high-stakes environments. This research contributes to ongoing efforts to future-proof cybersecurity infrastructure against both classical and post-quantum threat landscapes.
Quantum computing has been a major priority for several nations and prominent institutions in their pursuit of a transformative breakthrough in the fields of computation and encryption. By using the principles of quantum mechanics, particularly quantum superposition and entanglement, quantum computing and quantum machine learning (QML) have the potential to enhance artificial intelligence (AI) and achieve quantum supremacy with unprecedented computational power. However, despite its exceptional learning capabilities, QML-based applications face several emerging security threats. Unlike previous studies focused on classical quantum cryptography and secure quantum communications, this work investigates adversarial risks in QML-assisted network functions and digital twin applications. Specifically, we highlight vulnerabilities such as quantum kernel poisoning, backdoor attacks, and adversarial noise. Key findings reveal that adversaries can intercept quantum states in transit, manipulate parameterized quantum circuits (PQCs), and exploit variational quantum algorithms (VQAs) through adversarial qubit perturbations. These attacks can mislead QML-based optimization processes, leading to incorrect digital twin predictions, faulty resource allocation, or disruptions in QML-aided network functions. To mitigate these risks, defense strategies such as quantum-safe cryptography, data sanitization, adversarial training, defensive distillation, and gradient masking in quantum circuit design can be employed. However, the key issue is the absence of robust security solutions for real-world deployment. Future research should examine the trade-off between adversarial robustness and generative learning performance. Key areas include quantum state discrimination, secure quantum federated learning, quantum decoherence control, and secure quantum semantic communications for real-world deployment.
Quantum Machine Learning (QML) has advanced significantly thanks to the combination of Quantum Computing (QC) with Artificial Intelligence (AI), hence releasing computational benefits over conventional methods. This synergy does, however, also bring fresh security flaws like adversarial attacks, quantum noise manipulation, and cryptographic weaknesses. This work offers a thorough investigation of QML security along with an examination of its special vulnerabilities resulting from hardware-induced faults, quantum variational circuits, and quantum data encoding. We methodically investigate adversarial attack techniques using the probabilistic character of quantum states including side-channel assaults, quantum noise injection, and algorithmic perturbations. We also assess innovative defensive strategies such differential privacy, quantum adversarial training, quantum error correction (QEC), cryptographic techniques include Quantum Homomorphic Encryption (QHE), We offer a hybrid AI-driven method for protecting QML models against developing threats by linking artificial intelligence and quantum security frameworks. This work emphasizes the importance of developing quantum-safe AI systems and consistent adversarial robustness standards. The results help to advance AI-enhanced quantum security, thereby guaranteeing the future of QML applications is efficient, strong, and resistant to adversarial attack.
The rapid advancement of quantum computing presents a major threat to conventional public-key cryptographic systems, thereby accelerating the global adoption of Post-Quantum Cryptography (PQC) standards approved by the National Institute of Standards and Technology (NIST). Although PQC algorithms are specifically designed to resist quantum-based attacks, they remain vulnerable to implementation-level weaknesses such as side-channel leakage, fault injection attacks, and machine-learning-assisted cryptanalysis. This research investigates the emerging role of Quantum Machine Learning (QML) in strengthening and evaluating the security of PQC systems. The study explores the dual application of QML as both an offensive and defensive cybersecurity mechanism. On the offensive side, quantum-enhanced learning models, including variational quantum classifiers and quantum kernel-based approaches, are analysed for their capability to accelerate side-channel analysis and cryptanalytic attacks by learning hidden leakage patterns from power consumption traces, electromagnetic emissions, and timing information more efficiently than conventional machine learning models. On the defensive side, the research proposes QML-driven countermeasures such as quantum generative models for creating randomized noise distributions that obscure implementation leakage and reinforcement learning agents capable of dynamically adapting cryptographic masking techniques in real time. Experimental implementation will be conducted using IBM Quantum hardware alongside PQC algorithms including CRYSTALS-Kyber and CRYSTALS-Dilithium. The research will evaluate the comparative performance of quantum-assisted attack and defence mechanisms with respect to detection efficiency, leakage resilience, and computational overhead. Expected outcomes include the development of open-source QML-based cybersecurity toolkits, comprehensive security evaluation frameworks for PQC migration strategies, and the establishment of a “quantum-secure-by-design” approach for intelligent cryptographic systems. The study further supports global efforts toward quantum-safe infrastructure development and promotes collaborative cybersecurity research initiatives between the United States and Nigeria.
Quantum Machine Learning (QML) integrates quantum computational principles into learning algorithms, offering improved representational capacity and computational efficiency. However, the security and robustness of QML systems remain underexplored, particularly under adversarial conditions. We present the first comprehensive systematization of adversarial robustness in QML, combining conceptual organization with empirical evaluation across black-box, gray-box, and white-box threat models. We implement five representative attacks: a label-flipping poisoning attack under black-box; an encoder-level indiscriminate poisoning attack and a proxy-model clean-label backdoor attack under gray-box; and a circuit-level backdoor attack (QTrojan) and gradient-based evasion attacks (FGSM and PGD) under white-box. We evaluate these attacks using a Quantum Multilayer Perceptron (QMLP) trained on MNIST and AZ-Class across circuit depths of 2, 5, 10, and 50 layers with angle and amplitude encoding schemes. Our evaluations reveal a fundamental accuracy-robustness trade-off. Amplitude encoding achieves the highest clean accuracy (92.6% on MNIST and 67% on AZ-Class) but collapses under adversarial perturbations and depolarizing noise, whereas shallow angle-encoded models remain more stable. QUID is effective under noiseless conditions but weakened by noise, while the proxy-model backdoor persists unless the circuit itself is overwhelmed. Furthermore, the circuit-level backdoor fails in the multi-class setting, indicating a scalability limitation. Finally, QMLP models are more robust than Classical Multi-Layer Perceptron (CMLP) models under label-flipping attacks but substantially more vulnerable to gradient-based evasion. We conclude by proposing a threat-aware and noise-resilient framework for secure QML deployment.