Abstract Quantum supervised learning (QSL) is increasingly investigated for intrusion detection, yet its behavior under adversarial manipulation remains insufficiently characterized in network-security settings. This study presents a controlled white-box evaluation of a four-qubit variational QSL intrusion detector and a matched classical multilayer perceptron (MLP) on the UNSW-NB15 benchmark. Categorical encoding, standardization, principal component analysis to four dimensions, and scaling to [0, π] were applied consistently. A clean QSL model and a PGD-aware QSL model using 50% clean, 25% FGSM, and 25% PGD samples were evaluated against FGSM and seven-step PGD attacks at ε = 0.02π, 0.05π, and 0.10π over ten matched random seeds. Clean and adversarially trained MLP controls used the same representation and attack protocol. PGD-aware QSL improved accuracy over clean QSL from 9.10% to 26.90% at PGD 0.05π and from 2.60% to 20.73% at PGD 0.10π, with large paired effect sizes. The improvement was accompanied by a clean-accuracy reduction from 70.73% to 61.57%. Robust MLP retained higher absolute adversarial accuracy, reaching 64.27% and 50.50% at PGD 0.05π and 0.10π, respectively. The results demonstrate that adversarial training materially strengthens the tested QSL model but do not support a quantum-advantage claim. The study provides a reproducible robustness benchmark emphasizing attack validation, repeated seeds, effect sizes, and classical controls. The implementation notebook and supporting experimental outputs used for reproducibility are publicly archived on Zenodo (Bhoge et al. 2026).
Abstract Quantum supervised learning (QSL) is increasingly investigated for intrusion detection, yet its behavior under adversarial manipulation remains insufficiently characterized in network-security settings. This study presents a controlled white-box evaluation of a four-qubit variational QSL intrusion detector and a matched classical multilayer perceptron (MLP) on the UNSW-NB15 benchmark. Categorical encoding, standardization, principal component analysis to four dimensions, and scaling to [0, π] were applied consistently. A clean QSL model and a PGD-aware QSL model using 50% clean, 25% FGSM, and 25% PGD samples were evaluated against FGSM and seven-step PGD attacks at ε = 0.02π, 0.05π, and 0.10π over ten matched random seeds. Clean and adversarially trained MLP controls used the same representation and attack protocol. PGD-aware QSL improved accuracy over clean QSL from 9.10% to 26.90% at PGD 0.05π and from 2.60% to 20.73% at PGD 0.10π, with large paired effect sizes. The improvement was accompanied by a clean-accuracy reduction from 70.73% to 61.57%. Robust MLP retained higher absolute adversarial accuracy, reaching 64.27% and 50.50% at PGD 0.05π and 0.10π, respectively. The results demonstrate that adversarial training materially strengthens the tested QSL model but do not support a quantum-advantage claim. The study provides a reproducible robustness benchmark emphasizing attack validation, repeated seeds, effect sizes, and classical controls. The implementation notebook and supporting experimental outputs used for reproducibility are publicly archived on Zenodo (Bhoge et al. 2026).
This repository provides the reproducibility package for a controlled study of adversarial robustness in quantum supervised learning (QSL) for network intrusion detection using the UNSW-NB15 benchmark. The experiment evaluates a four-qubit variational QSL intrusion detector together with a matched classical multilayer perceptron (MLP) baseline. The shared preprocessing pipeline applies categorical encoding, feature extraction, principal component analysis to four dimensions, and scaling to the interval [0, π]. Experiments are conducted over ten matched random seeds. White-box Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks are evaluated at perturbation budgets ε/π = 0.02, 0.05, and 0.10. The robust QSL training protocol uses a mixture of 50% clean, 25% FGSM, and 25% PGD samples. PGD uses three steps during adversarial training and seven steps during final evaluation. The repository contains the principal experiment notebooks, repeated-seed robustness results, attack diagnostics, statistical summaries, confidence intervals, paired statistical tests, effect-size analyses, and quantum-versus-classical comparison outputs. Across ten matched seeds, PGD-aware adversarial training improves QSL accuracy from 9.10% to 26.90% under PGD at ε = 0.05π and from 2.60% to 20.73% at ε = 0.10π. This improvement is accompanied by a reduction in clean QSL accuracy from 70.73% to 61.57%. The adversarially trained classical MLP retains higher absolute robustness, achieving 64.27% and 50.50% accuracy at PGD 0.05π and 0.10π, respectively. These results demonstrate that PGD-aware adversarial training materially strengthens the evaluated QSL model but do not establish quantum advantage. The repository is intended to support transparent reproduction, independent verification, and further research on adversarial robustness in quantum machine learning for cybersecurity.
Quantum Machine Learning (QML) integrates quantum computational principles into learning algorithms, offering improved representational capacity and computational efficiency. However, the security and robustness of QML systems remain underexplored, particularly under adversarial conditions. We present the first comprehensive systematization of adversarial robustness in QML, combining conceptual organization with empirical evaluation across black-box, gray-box, and white-box threat models. We implement five representative attacks: a label-flipping poisoning attack under black-box; an encoder-level indiscriminate poisoning attack and a proxy-model clean-label backdoor attack under gray-box; and a circuit-level backdoor attack (QTrojan) and gradient-based evasion attacks (FGSM and PGD) under white-box. We evaluate these attacks using a Quantum Multilayer Perceptron (QMLP) trained on MNIST and AZ-Class across circuit depths of 2, 5, 10, and 50 layers with angle and amplitude encoding schemes. Our evaluations reveal a fundamental accuracy-robustness trade-off. Amplitude encoding achieves the highest clean accuracy (92.6% on MNIST and 67% on AZ-Class) but collapses under adversarial perturbations and depolarizing noise, whereas shallow angle-encoded models remain more stable. QUID is effective under noiseless conditions but weakened by noise, while the proxy-model backdoor persists unless the circuit itself is overwhelmed. Furthermore, the circuit-level backdoor fails in the multi-class setting, indicating a scalability limitation. Finally, QMLP models are more robust than Classical Multi-Layer Perceptron (CMLP) models under label-flipping attacks but substantially more vulnerable to gradient-based evasion. We conclude by proposing a threat-aware and noise-resilient framework for secure QML deployment.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.
Quantum reservoir computing (QRC) leverages the high-dimensional, nonlinear dynamics inherent in quantum many-body systems for extracting spatiotemporal patterns in sequential and time-series data with minimal training overhead. Although QRC inherits the expressive capabilities associated with quantum encodings, recent studies indicate that quantum classifiers based on variational circuits remain susceptible to adversarial perturbations. In this perspective, we investigate the first systematic evaluation of adversarial robustness in a QRC based learning model. Our reservoir comprises an array of strongly interacting Rydberg atoms governed by a fixed Hamiltonian, which naturally evolves under complex quantum dynamics, producing high-dimensional embeddings. A lightweight multilayer perceptron serves as the trainable readout layer. We utilize the balanced datasets, namely MNIST, Fashion-MNIST, and Kuzushiji-MNIST, as a benchmark for rigorously evaluating the impact of augmenting the quantum reservoir with a Multilayer perceptron (MLP) in white-box adversarial attacks to assess its robustness. We demonstrate that this approach yields significantly higher accuracy than purely classical models across all perturbation strengths tested. This hybrid approach reveals a new source of quantum advantage and provides practical guidance for the secure deployment of machine learning models on quantum-centric supercomputing with near-term hardware.
Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.