Security research in quantum neural networks (QNNs) is an emerging field that aims to utilize the principles of quantum mechanics to protect the security of neural networks, and this protection can be against different threats such as eavesdropping, tampering, and malware attacks. Backdoor attacks are a serious security challenge in the field of deep neural networks. This type of attack is highly stealthy and harmful, which can silently implant malicious functions and trigger them under specific conditions, thus disrupting the normal operation of neural networks or leaking sensitive information. To address the potential security risks of backdoor attacks to QNNs, this paper focuses on two core issues: backdoor attack detection and defense strategy design. It proposes an activation-based clustering method for backdoor sample detection (ACDM) to counter backdoor attack threats. Experimental results demonstrate that this defense method effectively safeguards the operational security of QNNs while enhancing the model's robustness against abnormal inputs and the reliability of its output results. It should be noted that the current research has limitations: the adaptability and effectiveness of this defense framework on complex high-dimensional datasets (e.g., quantum image datasets) and QNNs with different topological structures (e.g., deep quantum convolutional networks) require further validation and optimization through subsequent experiments.
Security research in quantum neural networks (QNNs) is an emerging field that aims to utilize the principles of quantum mechanics to protect the security of neural networks, and this protection can be against different threats such as eavesdropping, tampering, and malware attacks. Backdoor attacks are a serious security challenge in the field of deep neural networks. This type of attack is highly stealthy and harmful, which can silently implant malicious functions and trigger them under specific conditions, thus disrupting the normal operation of neural networks or leaking sensitive information. To address the potential security risks of backdoor attacks to QNNs, this paper focuses on two core issues: backdoor attack detection and defense strategy design. It proposes an activation-based clustering method for backdoor sample detection (ACDM) to counter backdoor attack threats. Experimental results demonstrate that this defense method effectively safeguards the operational security of QNNs while enhancing the model's robustness against abnormal inputs and the reliability of its output results. It should be noted that the current research has limitations: the adaptability and effectiveness of this defense framework on complex high-dimensional datasets (e.g., quantum image datasets) and QNNs with different topological structures (e.g., deep quantum convolutional networks) require further validation and optimization through subsequent experiments.
Backdoor attacks are emerging security threats to deep neural networks. In these attacks, adversaries manipulate the network by constructing training samples embedded with backdoor triggers. The backdoored model performs as expected on clean test samples but consistently misclassifies samples containing the backdoor trigger as a specific target label. While quantum neural networks (QNNs) have shown promise in surpassing their classical counterparts in certain machine learning tasks, they are also susceptible to backdoor attacks. However, current attacks on QNNs are constrained by the adversary’s understanding of the model structure and specific encoding methods. Given the diversity of encoding methods and model structures in QNNs, the effectiveness of such backdoor attacks remains uncertain. In this paper, we propose an algorithm that leverages dataset-based optimization to initiate backdoor attacks. A malicious adversary can embed backdoor triggers into a QNN model by poisoning only a small portion of the data. The victim QNN maintains high accuracy on clean test samples without the trigger but outputs the target label set by the adversary when predicting samples with the trigger. Furthermore, our proposed attack cannot be easily resisted by existing backdoor detection methods.
Quantum neural networks (QNNs) are an important model for implementing quantum machine learning (QML), while they demonstrate a high degree of vulnerability to backdoor attacks similar to classical networks. To address this issue, a quantum backdoor attack detection framework called QSentry is proposed, in which a quantum Measurement Clustering method is introduced to detect backdoors by identifying statistical anomalies in measurement outputs. It is demonstrated that QSentry can effectively detect anomalous distributions induced by backdoor samples with extensive experiments. It achieves a 75.8% F1 score even under a 1% poisoning rate, and further improves to 85.7% and 93.2% as the poisoning rate increases to 5% and 10%, respectively. The integration of silhouette coefficients and relative cluster size enable QSentry to precisely isolate backdoor samples, yielding estimates that closely match actual poisoning ratios. Evaluations under various quantum attack scenarios demonstrate that QSentry delivers superior robustness and accuracy compared with three state-of-the-art detection methods. This work establishes a practical and effective framework for mitigating backdoor threats in QML.
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.
Abstract Quantum neural networks (QNNs), as a novel model that combines the advantages of quantum computing and classical neural networks, are similarly vulnerable to backdoor attacks like classical neural networks. Current research on backdoor attacks against QNNs is limited by model structure or poisoning rate, resulting in poor attack performance in black-box scenarios. This paper proposes a black-box attack method that uses a quantum-classical hybrid generative model to generate transferable backdoor triggers for QNNs with unknown structures. The method generates universal adversarial perturbations as triggers based on generative models, and designs a QNN pool by utilizing the idea of ensemble models. It combines the min–max framework and non-target Kullback–Leibler divergence technique to improve the transferability of triggers to achieve a black-box attack. Experiments demonstrate that with a poisoning rate of only 5%, the attack success rate exceeds 98% for three different structured QNNs, proving the effectiveness of this backdoor attack. In addition, we also prove that the existing detection methods such as strip and spectral signatures are unable to defend against the backdoor attack proposed in this paper.
Quantum neural networks (QNNs) succeed in object recognition, natural language processing, and financial analysis. To maximize the accuracy of a QNN on a Noisy Intermediate Scale Quantum (NISQ) computer, approximate synthesis modifies the QNN circuit by reducing error-prone 2-qubit quantum gates. The success of QNNs motivates adversaries to attack QNNs via backdoors. However, naively transplanting backdoors designed for classical neural networks to QNNs yields only low attack success rate, due to the noises and approximate synthesis on NISQ computers. Prior quantum circuit-based backdoors cannot selectively attack some inputs or work with all types of encoding layers of a QNN circuit. Moreover, it is easy to detect both transplanted and circuit-based backdoors in a QNN. In this paper, we propose a novel and stealthy backdoor attack, QDoor, to achieve high attack success rate in approximately-synthesized QNN circuits by weaponizing unitary differences between uncompiled QNNs and their synthesized counterparts. QDoor trains a QNN behaving normally for all inputs with and without a trigger. However, after approximate synthesis, the QNN circuit always predicts any inputs with a trigger to a predefined class while still acts normally for benign inputs. Compared to prior backdoor attacks, QDoor improves the attack success rate by 13x and the clean data accuracy by 65% on average. Furthermore, prior backdoor detection techniques cannot find QDoor attacks in uncompiled QNN circuits.
ABSTRACT Quantum neural networks (QNNs) are advancing rapidly, but their security issues must not be overlooked. Backdoor attacks, as a stealthy and highly threatening attack method, have caused significant impacts on classical neural networks. Moreover, backdoor attacks have recently been proven to pose a significant threat to quantum neural networks as well. Currently, all existing methods in quantum machine learning backdoor research are designed for classical data samples. These methods all involve poisoning classical data samples first and then quantizing them, with no existing approaches that directly target quantum state data for poisoning. This paper presents a novel backdoor attack method against quantum neural networks by utilizing the quantum state—universal adversarial perturbations (QS‐UAP). This method, for the first time, constructs a backdoor trigger specifically for quantum‐state data based on quantum generative models. Moreover, this method enhances the quality of the backdoor trigger by integrating knowledge distillation with frequency‐domain constraints. The proposed method embeds a backdoor into the target model by poisoning quantum data samples. Experimental results demonstrate that with a 10% poisoning rate, the attack success rates exceed 97% across three structurally distinct QNN architectures.