This repository provides the reproducibility package for a controlled study of adversarial robustness in quantum supervised learning (QSL) for network intrusion detection using the UNSW-NB15 benchmark. The experiment evaluates a four-qubit variational QSL intrusion detector together with a matched classical multilayer perceptron (MLP) baseline. The shared preprocessing pipeline applies categorical encoding, feature extraction, principal component analysis to four dimensions, and scaling to the interval [0, π]. Experiments are conducted over ten matched random seeds. White-box Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks are evaluated at perturbation budgets ε/π = 0.02, 0.05, and 0.10. The robust QSL training protocol uses a mixture of 50% clean, 25% FGSM, and 25% PGD samples. PGD uses three steps during adversarial training and seven steps during final evaluation. The repository contains the principal experiment notebooks, repeated-seed robustness results, attack diagnostics, statistical summaries, confidence intervals, paired statistical tests, effect-size analyses, and quantum-versus-classical comparison outputs. Across ten matched seeds, PGD-aware adversarial training improves QSL accuracy from 9.10% to 26.90% under PGD at ε = 0.05π and from 2.60% to 20.73% at ε = 0.10π. This improvement is accompanied by a reduction in clean QSL accuracy from 70.73% to 61.57%. The adversarially trained classical MLP retains higher absolute robustness, achieving 64.27% and 50.50% accuracy at PGD 0.05π and 0.10π, respectively. These results demonstrate that PGD-aware adversarial training materially strengthens the evaluated QSL model but do not establish quantum advantage. The repository is intended to support transparent reproduction, independent verification, and further research on adversarial robustness in quantum machine learning for cybersecurity.
This repository provides the reproducibility package for a controlled study of adversarial robustness in quantum supervised learning (QSL) for network intrusion detection using the UNSW-NB15 benchmark. The experiment evaluates a four-qubit variational QSL intrusion detector together with a matched classical multilayer perceptron (MLP) baseline. The shared preprocessing pipeline applies categorical encoding, feature extraction, principal component analysis to four dimensions, and scaling to the interval [0, π]. Experiments are conducted over ten matched random seeds. White-box Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks are evaluated at perturbation budgets ε/π = 0.02, 0.05, and 0.10. The robust QSL training protocol uses a mixture of 50% clean, 25% FGSM, and 25% PGD samples. PGD uses three steps during adversarial training and seven steps during final evaluation. The repository contains the principal experiment notebooks, repeated-seed robustness results, attack diagnostics, statistical summaries, confidence intervals, paired statistical tests, effect-size analyses, and quantum-versus-classical comparison outputs. Across ten matched seeds, PGD-aware adversarial training improves QSL accuracy from 9.10% to 26.90% under PGD at ε = 0.05π and from 2.60% to 20.73% at ε = 0.10π. This improvement is accompanied by a reduction in clean QSL accuracy from 70.73% to 61.57%. The adversarially trained classical MLP retains higher absolute robustness, achieving 64.27% and 50.50% accuracy at PGD 0.05π and 0.10π, respectively. These results demonstrate that PGD-aware adversarial training materially strengthens the evaluated QSL model but do not establish quantum advantage. The repository is intended to support transparent reproduction, independent verification, and further research on adversarial robustness in quantum machine learning for cybersecurity.
Abstract Quantum supervised learning (QSL) is increasingly investigated for intrusion detection, yet its behavior under adversarial manipulation remains insufficiently characterized in network-security settings. This study presents a controlled white-box evaluation of a four-qubit variational QSL intrusion detector and a matched classical multilayer perceptron (MLP) on the UNSW-NB15 benchmark. Categorical encoding, standardization, principal component analysis to four dimensions, and scaling to [0, π] were applied consistently. A clean QSL model and a PGD-aware QSL model using 50% clean, 25% FGSM, and 25% PGD samples were evaluated against FGSM and seven-step PGD attacks at ε = 0.02π, 0.05π, and 0.10π over ten matched random seeds. Clean and adversarially trained MLP controls used the same representation and attack protocol. PGD-aware QSL improved accuracy over clean QSL from 9.10% to 26.90% at PGD 0.05π and from 2.60% to 20.73% at PGD 0.10π, with large paired effect sizes. The improvement was accompanied by a clean-accuracy reduction from 70.73% to 61.57%. Robust MLP retained higher absolute adversarial accuracy, reaching 64.27% and 50.50% at PGD 0.05π and 0.10π, respectively. The results demonstrate that adversarial training materially strengthens the tested QSL model but do not support a quantum-advantage claim. The study provides a reproducible robustness benchmark emphasizing attack validation, repeated seeds, effect sizes, and classical controls. The implementation notebook and supporting experimental outputs used for reproducibility are publicly archived on Zenodo (Bhoge et al. 2026).
Quantum Machine Learning (QML) integrates quantum computational principles into learning algorithms, offering improved representational capacity and computational efficiency. However, the security and robustness of QML systems remain underexplored, particularly under adversarial conditions. We present the first comprehensive systematization of adversarial robustness in QML, combining conceptual organization with empirical evaluation across black-box, gray-box, and white-box threat models. We implement five representative attacks: a label-flipping poisoning attack under black-box; an encoder-level indiscriminate poisoning attack and a proxy-model clean-label backdoor attack under gray-box; and a circuit-level backdoor attack (QTrojan) and gradient-based evasion attacks (FGSM and PGD) under white-box. We evaluate these attacks using a Quantum Multilayer Perceptron (QMLP) trained on MNIST and AZ-Class across circuit depths of 2, 5, 10, and 50 layers with angle and amplitude encoding schemes. Our evaluations reveal a fundamental accuracy-robustness trade-off. Amplitude encoding achieves the highest clean accuracy (92.6% on MNIST and 67% on AZ-Class) but collapses under adversarial perturbations and depolarizing noise, whereas shallow angle-encoded models remain more stable. QUID is effective under noiseless conditions but weakened by noise, while the proxy-model backdoor persists unless the circuit itself is overwhelmed. Furthermore, the circuit-level backdoor fails in the multi-class setting, indicating a scalability limitation. Finally, QMLP models are more robust than Classical Multi-Layer Perceptron (CMLP) models under label-flipping attacks but substantially more vulnerable to gradient-based evasion. We conclude by proposing a threat-aware and noise-resilient framework for secure QML deployment.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.
Quantum machine learning (QML) is increasingly investigated for network intrusion detection, but the practical value of current quantum models remains uncertain because many studies rely on small simulated data sets, idealized execution, weak classical baselines, or isolated accuracy comparisons. This study develops and evaluates a resource-aware hybrid quantum-classical intrusion detection framework that combines fixed fidelity quantum kernels, repaired Quantum Kernel Alignment (QKA), a Variational Quantum Classifier (VQC), LightGBM, prototype-based kernel reduction, and probabilistic stacking. Experiments use the UNSW-NB15 benchmark under a leakage-aware preprocessing protocol and repeated evaluation across five random seeds. The experimental program covers 4- and 6-qubit representations, multiple training sizes, prototype budgets, and finite-shot configurations, yielding 260 experimental configurations/runs. The strongest quantum-assisted model, a 6-qubit QKA-VQC-LightGBM stack at 100 samples per class, obtains mean F1=0.8480, MCC=0.7092, ROC-AUC=0.9398, and PR-AUC=0.9302. Repaired QKA improves F1 from 0.8043 for the corresponding fixed kernel to 0.8089, while 50-prototype QKA attains F1=0.8257 with a more favorable kernel-workload trade-off than larger prototype budgets. Finite-shot experiments between 1,024 and 4,096 shots remain stable in simulation. However, full-data LightGBM remains stronger overall (F1=0.8957, MCC=0.8068, ROC-AUC=0.9755, PR-AUC=0.9704), and corrected statistical tests do not establish general quantum superiority. These findings motivate a Selective Quantum Intrusion Detection System (S-QIDS), in which classical inference handles high-confidence traffic and quantum processing is reserved for uncertain, novel, or high-risk observations. The study therefore reframes near-term quantum intrusion detection from unconditional quantum advantage toward measurable quantum utility, quantum-classical complementarity, and resource-aware quantum intervention.
This repository provides the reproducibility package for a selective quantum intervention framework for network intrusion detection. The proposed approach treats quantum inference as a conditional computational resource rather than a universal replacement for classical classification. A strong classical intrusion detection model remains the default decision mechanism, while a benefit–risk routing strategy selectively authorizes quantum intervention for samples where correction benefit is predicted to outweigh the risk of breaking an otherwise correct classical prediction. The principal S-QIDS architecture combines boundary eligibility, break-risk rejection, correction-benefit estimation, a fixed fidelity-based quantum classifier, and safe override or abstention. Quantum Utilization Rate (QUR) and Net Quantum Benefit Rate (NQBR) are used to quantify resource utilization and the net value of selective intervention. The package contains code, experimental configurations, evaluation procedures, and supporting results for leakage-controlled repeated-seed validation, matched-utilization controls, cross-dataset evaluation, frozen-state reproduction, and repeated finite-shot statistical robustness analysis. The principal UNSW-NB15 evaluation demonstrates constrained positive selective routing utility while invoking the quantum component for only a small fraction of test samples. Cross-dataset experiments also examine safe abstention when the frozen router does not identify sufficiently reliable intervention opportunities. Repeated finite-shot experiments assess statistical stability of the frozen selective intervention under measurement randomness and controlled generic state-level depolarizing perturbations. The results should not be interpreted as evidence of universal quantum advantage, physical quantum-hardware robustness, or guaranteed computational speedup. They instead provide evidence for selective, conditional, and complementary quantum utility under the experimental protocols documented in this repository.