A controlled white-box adversarial robustness study of quantum supervised learning for network intrusion detection, demonstrating significant robustness gains from PGD-aware adversarial training while identifying a substantial robustness gap relative to a matched classical neural baseline.
Abstract Quantum supervised learning (QSL) is increasingly investigated for intrusion detection, yet its behavior under adversarial manipulation remains insufficiently characterized in network-security settings. This study presents a controlled white-box evaluation of a four-qubit variational QSL intrusion detector and a matched classical multilayer perceptron (MLP) on the UNSW-NB15 benchmark. Categorical encoding, standardization, principal component analysis to four dimensions, and scaling to [0, π] were applied consistently. A clean QSL model and a PGD-aware QSL model using 50% clean, 25% FGSM, and 25% PGD samples were evaluated against FGSM and seven-step PGD attacks at ε = 0.02π, 0.05π, and 0.10π over ten matched random seeds. Clean and adversarially trained MLP controls used the same representation and attack protocol. PGD-aware QSL improved accuracy over clean QSL from 9.10% to 26.90% at PGD 0.05π and from 2.60% to 20.73% at PGD 0.10π, with large paired effect sizes. The improvement was accompanied by a clean-accuracy reduction from 70.73% to 61.57%. Robust MLP retained higher absolute adversarial accuracy, reaching 64.27% and 50.50% at PGD 0.05π and 0.10π, respectively. The results demonstrate that adversarial training materially strengthens the tested QSL model but do not support a quantum-advantage claim. The study provides a reproducible robustness benchmark emphasizing attack validation, repeated seeds, effect sizes, and classical controls. The implementation notebook and supporting experimental outputs used for reproducibility are publicly archived on Zenodo (Bhoge et al. 2026).
This repository provides the reproducibility package for a controlled study of adversarial robustness in quantum supervised learning (QSL) for network intrusion detection using the UNSW-NB15 benchmark. The experiment evaluates a four-qubit variational QSL intrusion detector together with a matched classical multilayer perceptron (MLP) baseline. The shared preprocessing pipeline applies categorical encoding, feature extraction, principal component analysis to four dimensions, and scaling to the interval [0, π]. Experiments are conducted over ten matched random seeds. White-box Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks are evaluated at perturbation budgets ε/π = 0.02, 0.05, and 0.10. The robust QSL training protocol uses a mixture of 50% clean, 25% FGSM, and 25% PGD samples. PGD uses three steps during adversarial training and seven steps during final evaluation. The repository contains the principal experiment notebooks, repeated-seed robustness results, attack diagnostics, statistical summaries, confidence intervals, paired statistical tests, effect-size analyses, and quantum-versus-classical comparison outputs. Across ten matched seeds, PGD-aware adversarial training improves QSL accuracy from 9.10% to 26.90% under PGD at ε = 0.05π and from 2.60% to 20.73% at ε = 0.10π. This improvement is accompanied by a reduction in clean QSL accuracy from 70.73% to 61.57%. The adversarially trained classical MLP retains higher absolute robustness, achieving 64.27% and 50.50% accuracy at PGD 0.05π and 0.10π, respectively. These results demonstrate that PGD-aware adversarial training materially strengthens the evaluated QSL model but do not establish quantum advantage. The repository is intended to support transparent reproduction, independent verification, and further research on adversarial robustness in quantum machine learning for cybersecurity.
This paper examines the adversarial robustness of Quantum Neural Networks (QNNs) compared to classical AI models. Using FGSM and PGD attacks, it evaluates how quantum features such as entanglement and superposition influence resilience to perturbations. Results show that while QNNs display partial robustness, especially under iterative attacks, they remain limited by current simulation constraints. The work highlights both the promise and challenges of applying quantum principles to strengthen machine-learning security.
Leveraging the unique properties of quantum mechanics, Quantum Machine Learning (QML) promises computational breakthroughs and enriched perspectives where traditional systems reach their boundaries. However, similarly to classical machine learning, QML is not immune to adversarial attacks. Quantum adversarial machine learning has become instrumental in highlighting the weak points of QML models when faced with adversarial crafted feature vectors. Diving deep into this domain, our exploration shines light on the interplay between depolarization noise and adversarial robustness. While previous results enhanced robustness from adversarial threats through depolarization noise, our findings paint a different picture. Interestingly, adding depolarization noise discontinued the effect of providing further robustness for a multi-class classification scenario. Consolidating our findings, we conducted experiments with a multi-class classifier adversarially trained on gate-based quantum simulators, further elucidating this unexpected behavior.
Abstract Leveraging the unique properties of quantum mechanics, quantum machine learning (QML) promises computational breakthroughs and enriched perspectives where traditional systems reach their boundaries. However, similarly to classical machine learning, QML is not immune to adversarial attacks. Quantum adversarial machine learning has become instrumental in highlighting the weak points of QML models when faced with adversarial crafted feature vectors. Diving deep into this domain, our exploration shines a light on the interplay between depolarization noise and adversarial robustness. While previous results enhanced robustness from adversarial threats through depolarization noise, our findings paint a different picture. Interestingly, adding depolarization noise discontinued the effect of providing further robustness for a multi-class classification scenario. Consolidating our findings, we conducted experiments with a multi-class classifier adversarially trained on gate-based quantum simulators, further elucidating this unexpected behavior.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.