{"id":"55c50033-31e6-4305-9b7d-7d195cf40c8d","arxiv_id":"2502.05966","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Quantum kernel SVMs detect label-flipping tampering in three physiological datasets with 75%-95% accuracy, usually beating classical SVMs, but both fail on adversarial perturbations.","lead":"This paper tests whether quantum machine learning can detect tampering in physiological sensor data better than classical machine learning. It reports modest gains for label-flipping attacks on three health datasets, but poor results for subtle adversarial perturbations.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The label-flipping detection numbers for the two- and three-class datasets depend on an unspecified one-class SVM training/evaluation protocol; without that protocol, the 75%–95% quantum advantage is not measurable.","rationale":"The paper's contribution is empirical: a hybrid quantum kernel is claimed to detect label-flipping attacks on physiological data better than a classical kernel. The comparison is well motivated and the Table III numbers are concrete, but the load-bearing link between One-Class SVM and multi-class label-flip detection is not specified. This is exactly the reader's weakest assumption. I do not see an internal mathematical inconsistency in the quantum kernel construction; the issue is that the evaluation protocol is under-specified enough that the headline accuracy cannot be checked. A machine-checked proof or code release would mitigate this, and neither is present. The paper should be held to a conditional standard: if the authors supply the protocol and the Stress advantage survives with confidence intervals, the central claim stands; otherwise it should not be reported as QML superiority over classical methods. I therefore keep the reader's CONDITIONAL verdict unchanged.","tokens_in":6601,"tokens_out":4244,"duration_ms":41988,"concrete_test":"Obtain or reconstruct the exact protocol used for Table III: number of One-Class SVM models trained per dataset, feature set per class, how flipped labels are assigned during evaluation, and how per-class accuracies are macro-averaged. Then rerun the Stress label-flipping comparison with that protocol, together with a separate run under the alternative reasonable protocol of one One-Class SVM per clean class scored against attacked labels, and report per-fold results with 95% confidence intervals. If the 14.36-point quantum advantage does not survive a well-defined protocol, the central claim is an artifact.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that hybrid quantum kernel SVMs outperform classical SVMs on label-flipping detection. In Table III, the supporting evidence for the two-class EPHNOGRAM and three-class Stress datasets is reported as 'class-wise' accuracy averaged over five folds, but Section III-E specifies One-Class SVM as trained on data from one class and Section IV does not state how this detector is applied to multi-class data. A label-flipping attack changes labels while leaving features unchanged, so a feature-only anomaly detector can catch such tampering only through an explicit class-assignment protocol, for example training one One-Class SVM per clean class and scoring each sample against its attacked label's class. The absent protocol is load-bearing because the Stress quantum result (95.11% vs 80.75%) and the EPHNOGRAM result (75.23% vs 75.01%) cannot be interpreted without it. No confidence intervals accompany the five-fold averages, so the 0.22-point gap on EPHNOGRAM is within likely fold-to-fold variation and does not by itself support the 'QML models are better' phrasing. A secondary inconsistency is that the abstract says quantum 'still outperformed classical algorithms in some cases' for adversarial perturbation, while Table III shows quantum below classical on all three perturbation rows; this should be corrected regardless of the main test.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript studies the use of a hybrid quantum kernel one-class SVM for detecting two types of white-box tampering attacks—label-flipping/poisoning and adversarial perturbation—on three physiological datasets (RESTINGECG, EPHNOGRAM, Stress). The authors report 5-fold cross-validation detection accuracies for both a classical SVM baseline and the proposed quantum hybrid model, claim that the quantum model achieves 75%–95% accuracy on label-flipping attacks, and attribute this to the quantum feature map's ability to handle high-dimensional data. The paper also reports that both models perform poorly on adversarial perturbation, with the abstract claiming that quantum still outperformed classical in some cases.","tokens_in":6890,"tokens_out":3207,"duration_ms":33643,"significance":"If the reported results are taken at face value, this would be one of the first demonstrations of quantum machine learning for detecting tampering in physiological sensor data, and the 95.11% versus 80.75% result on the three-class Stress dataset for label flipping would be a practically meaningful advantage. The use of three public datasets with different label structures and the direct comparison to a classical SVM baseline are strengths. However, the current manuscript does not supply enough experimental detail to evaluate the central claim: the one-class SVM protocol on multi-class data is unspecified, attack parameters are absent, and no measures of variability are reported. The work is potentially salvageable, but the evidence as written does not yet support the abstract's strong superiority claim.","major_comments":[{"comment":"The one-class SVM training and evaluation protocol for the multi-class datasets is not specified. One-class SVM is naturally trained on data from a single class, yet Table III reports detection accuracy for the two-class EPHNOGRAM and three-class Stress datasets and states only that accuracy was 'calculated class-wise and averaged on 5-folds.' The manuscript does not state whether one one-class SVM is trained per class, how a sample is labeled as attacked versus clean, or how per-class scores are aggregated into the reported percentages. This is load-bearing because the label-flipping results for EPHNOGRAM (75.23% versus 75.01%) and Stress (95.11% versus 80.75%) cannot be interpreted without this protocol, and an inappropriate protocol could make the reported accuracies measure something other than tampering detection.","section":"III-E and IV"},{"comment":"All reported accuracies are single 5-fold means with no standard deviations, confidence intervals, or significance tests. This is particularly problematic for the EPHNOGRAM label-flipping row, where the quantum and classical results differ by only 0.22 percentage points (75.23% versus 75.01%); such a gap is within typical fold-to-fold variation and does not support the claim that QML models are 'better' on this dataset. The authors should report per-fold results or at least error bars, and should either avoid claiming superiority where the difference is not statistically resolvable or support it with an appropriate test.","section":"Table III and IV"},{"comment":"The attack parameters are not reported. The abstract states that detection accuracy depends on 'attack severity,' but the manuscript never defines the label-flip fraction, the FGSM perturbation size epsilon, or the fraction of poisoned samples used for the targeted poisoning attacks. Without these values, the experiments cannot be reproduced, and the cross-dataset variation in Table III cannot be attributed to data properties rather than to differing attack intensities.","section":"III-D and Table II"},{"comment":"Equation (1) is not the standard one-class SVM decision function. The expression contains a double sum over training data pairs, k(x_i, x_j), and no dependency on a test point x, whereas a one-class SVM decision function should be of the form sign(sum_i alpha_i k(x_i, x) + b - rho) (or an equivalent kernel expansion). The equation also does not match the optimization formulation in Eqs. (2)–(3). This needs to be corrected because the method description is the basis for the reported experiments.","section":"III-E, Eq. (1)"},{"comment":"The abstract's statement that for adversarial perturbation the quantum model 'still outperformed classical algorithms in some cases' is contradicted by Table III: for all three datasets the quantum accuracy is lower than the classical accuracy on the perturbation rows (55.16% vs. 60.52% for RESTINGECG, 60.09% vs. 68.99% for EPHNOGRAM, and 45.99% vs. 58.95% for Stress). Section V repeats this incorrect claim. This discrepancy must be fixed because it directly affects the paper's stated conclusions.","section":"Abstract and Section V"}],"minor_comments":[{"comment":"The RESTINGECG entry says 'They recorded continuous EEG signals across 72 channels,' but the dataset is named as an ECG dataset and the table lists it under 'Signals: ECG.' Please clarify whether the raw data are EEG or ECG, and correct the description accordingly.","section":"Table I"},{"comment":"The adversarial perturbation definition writes x' = x + delta and f_theta(x') != f_theta, but the notation x' is introduced and f_theta is left without an argument. This should be written as x' = x + delta and f_theta(x') != f_theta(x), or similar.","section":"II-B"},{"comment":"Targeted poisoning appears as a separate attack type in Table II and Table III, but Section II-A only briefly mentions it without specifying how it differs operationally from label flipping or what fraction of samples is targeted. Please provide a precise definition.","section":"II-A and Table II"},{"comment":"The term 'class-wise accuracy' is ambiguous. Please state whether the reported numbers are macro-averaged (average per-class recall) or micro-averaged (global accuracy), and how the one-class detector's output is converted into a class prediction for multi-class data.","section":"III-E and IV"},{"comment":"A few typographical and formatting issues should be corrected: the 'Index Terms' line appears to contain an extra space, and some equations (e.g., the moving average formula) are not cleanly typeset. These do not affect the science but should be cleaned up.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The manuscript addresses a relevant security application, but the missing one-class SVM protocol for multi-class data is a serious gap that affects the central claim. I would encourage the editor to request a major revision rather than reject, because the Stress label-flipping result is potentially interesting and the experimental setup is described well enough that it could be made rigorous with additional detail. I also note that the abstract and conclusion currently contain a factual inconsistency with Table III, which the authors must correct."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a first-to-apply empirical benchmark, not a new method. The headline claim that QML models are better at detecting label-flipping attacks is supported mainly by one dataset (Stress: 95.11% vs 80.75%). On EPHNOGRAM the gap is 0.22 points (75.23% vs 75.01%), which is noise without error bars, and on RESTINGECG it's about 7.4 points. So the abstract overstates a real but uneven result.\n\nWhat's new and worth credit: the authors took the quantum hybrid kernel SVM from their prior work and ran it against a classical SVM baseline for label-flipping and FGSM perturbation on three public physiological datasets. That specific comparison is new. The threat model is clearly laid out, the datasets are public, and the classical baseline uses the same framework with a classical kernel. This is a legitimate, if modest, benchmark study.\n\nThe soft spots are significant. The load-bearing one is the evaluation of the one-class SVM on multi-class data. Section III-E defines the detector as trained on one class; Section IV says accuracy was calculated class-wise and averaged over folds, but never says how the detector is applied to two-class EPHNOGRAM and three-class Stress data. Label-flipping changes labels while leaving features unchanged, so a feature-only anomaly detector needs an explicit per-class assignment protocol. Without that protocol, the Stress and EPHNOGRAM detection numbers cannot be interpreted. Second, there are no error bars or significance tests; the five-fold averages alone do not support the claims. Third, attack parameters (flip fraction, FGSM epsilon, poisoning fraction) are not reported, so the experiments cannot be reproduced. Fourth, Eq. (1) is not the standard one-class SVM decision function, and the abstract's statement that quantum 'still outperformed classical algorithms in some cases' for adversarial perturbation is contradicted by Table III, where quantum is below classical on all three perturbation rows. These are fixable, but they are real.\n\nWho this is for: people working on QML for healthcare data security, especially anyone who wants a baseline for quantum kernel anomaly detection. The paper deserves a serious referee: the question is legitimate, the setup is close to standard, and a major revision requiring error bars, attack parameters, a clear multi-class protocol, and a corrected abstract could make the result publishable.","headline":"First-to-apply benchmark of quantum hybrid SVM for physiological tampering detection; the QML advantage on label-flipping is real only for the Stress dataset and the multi-class one-class SVM protocol is underspecified.","tokens_in":7384,"tokens_out":3116,"would_cite":false,"duration_ms":29155,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hybrid quantum kernel SVMs detect label-flipping tampering in physiological data with 75%-95% accuracy, beating classical SVMs on two of three datasets.","keywords":["quantum machine learning","physiological data tampering","data poisoning","label-flipping attack","adversarial perturbation","one-class SVM","quantum kernel","healthcare cybersecurity"],"falsifier":"Re-run the pipeline on EPHNOGRAM and Stress with an explicitly documented protocol: train the one-class SVM only on clean samples of each class, test it on that class plus attacked samples, and report per-class accuracy and macro-averaged accuracy; if the resulting scores fall well below Table III or near random guessing, the 75%-95% label-flipping claim is an artifact of the unspecified evaluation.","tokens_in":6435,"feed_emoji":"🩺","tokens_out":9608,"duration_ms":81088,"temperature":0.7,"pith_summary":"This paper tries to establish that hybrid quantum machine learning can detect tampering in physiological sensor data better than classical machine learning, at least for one class of attack. Using a quantum kernel one-class SVM, it reports 75%-95% detection accuracy for label-flipping data poisoning across a one-class ECG dataset, a two-class ECG/PCG dataset, and a three-class stress dataset; the quantum model beats the classical baseline on two of the three and matches it on the third. The paper also argues that adversarial perturbation attacks are much harder for both paradigms, with quantum detection accuracy around 45%-65%. A sympathetic reader would care because cloud-connected medical devices depend on trustworthy data, and a detector that catches poisoning before it contaminates retraining would improve patient safety.","feed_headline":"Quantum SVM detects label-flipping attacks in health data up to 95%","feed_subtitle":"Hybrid quantum one-class SVM beats classical detectors on three physiological datasets, yet both miss adversarial perturbations.","key_machinery":"The load-bearing object is the quantum kernel one-class SVM. Classical features are first reduced with PCA to 12 dimensions, then each pair of features is encoded into one of 6 qubits using Rx and Ry rotation gates; CNOT layers entangle the qubits, and the overlap (fidelity) of the encoded states serves as the kernel k(xi,xj) inside the one-class SVM objective. This lets the decision boundary operate in a quantum feature Hilbert space that a classical dot-product kernel cannot directly reach, which is the mechanism the paper credits for the label-flipping advantage.","core_discovery":"The central claim is that a hybrid quantum-classical one-class SVM, whose kernel is the quantum fidelity between Rx/Ry-encoded and CNOT-entangled feature states, detects label-flipping and targeted-poisoning tampering in physiological time-series data more accurately than a classical dot-product SVM. The reported detection accuracies for label flipping are 75.03% on RESTINGECG, 75.23% on EPHNOGRAM, and 95.11% on the three-class Stress dataset, versus 67.67%, 75.01%, and 80.75% for the classical baseline. The quantum model also does better on targeted poisoning for EPHNOGRAM (66.66% vs 50.36%) but worse on targeted poisoning for Stress (49.96% vs 65.23%). Both models perform poorly on FGSM adversarial perturbation, with quantum accuracy between 45.99% and 60.09%, and the paper attributes this to perturbations that preserve statistical properties.","pith_inferences":["A natural next experiment the paper leaves implicit is to ablate the CNOT entangling layers in the quantum kernel; if the label-flipping advantage persists without entanglement, the benefit comes from the rotation encoding rather than from quantum correlations.","The 6-qubit, 12-feature setting is a small-scale test; scaling to more qubits and features could change the comparison, and the paper does not address how the quantum kernel cost grows.","The same one-class quantum kernel protocol could be evaluated on other medical time-series with known label noise, such as PPG-only wearables or ICU vital signs, to see whether the 75%-95% range transfers."],"forward_implications":["If the results hold, a quantum kernel detector could be added as a screening layer in physiological data pipelines to flag label-flipped samples before models are retrained.","The roughly 15-point gain on the three-class Stress dataset suggests the quantum advantage may grow as label structure and feature count increase, though the paper does not test this trend directly.","The large classical accuracy drops after attack (for example, EPHNOGRAM label flipping falls from 99.975% to 49.556%) support the need for a separate tamper-detection step rather than relying on the trained model.","Both quantum and classical detectors miss most adversarial perturbations, so this attack type should be treated as an open threat in cloud-based physiological monitoring."],"supporting_citations":[{"why":"Introduces quantum machine learning in feature Hilbert spaces and supplies the kernel-fidelity foundation the framework uses.","marker":"[9]"},{"why":"Shows supervised learning with quantum-enhanced feature spaces, the basis for using quantum kernels in SVMs.","marker":"[10]"},{"why":"Previous QML anomaly detection on cyber-physical systems, the approach this paper extends to physiological data.","marker":"[11]"},{"why":"Defines universal adversarial perturbations, the attack formulation used for the adversarial-perturbation experiments.","marker":"[13]"},{"why":"Source of the single-label RESTINGECG dataset used in the evaluation.","marker":"[14]"},{"why":"Source of the two-label EPHNOGRAM ECG/PCG dataset used in the evaluation.","marker":"[15]"},{"why":"Source of the three-label Stress dataset used in the evaluation.","marker":"[17]"},{"why":"Supplies the PCA feature-reduction step that maps each dataset down to 12 features for the 6-qubit encoder.","marker":"[20]"}],"fun_headline_variants":["Quantum ML detects label-flipping attacks in health data up to 95%","Hybrid quantum SVM beats classical on label-flip attack detection","Quantum one-class SVM finds label-flip tampering up to 95% accuracy","QML detects label-flip poisoning but misses adversarial perturbations","Quantum SVM hits 95% on label-flip attacks, fails on perturbations"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The results assume that a detector trained on only one class can be fairly scored on datasets with two or three classes, but the paper never says how that was done.","fun_headline_variants_meta":{"raw":{"variants":["Quantum ML detects label-flipping attacks in health data up to 95%","Hybrid quantum SVM beats classical on label-flip attack detection","Quantum one-class SVM finds label-flip tampering up to 95% accuracy","QML detects label-flip poisoning but misses adversarial perturbations","Quantum SVM hits 95% on label-flip attacks, fails on perturbations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001001,"raw_usage":{"total_tokens":4229,"prompt_tokens":933,"completion_tokens":3296,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":549,"completion_tokens_details":{"reasoning_tokens":3201}},"tokens_in":549,"tokens_out":3296,"duration_ms":20713,"temperature":1.0,"reasoning_tokens":3201,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T17:11:28.480981+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the pipeline on EPHNOGRAM and Stress with an explicitly documented protocol: train the one-class SVM only on clean samples of each class, test it on that class plus attacked samples, and report per-class accuracy and macro-averaged accuracy; if the resulting scores fall well below Table III or near random guessing, the 75%-95% label-flipping claim is an artifact of the unspecified evaluation.","supporting_citations":[{"cited_title":"Quantum machine learning in feature hilbert spaces,","cited_arxiv_id":null,"evidence_quote":"Introduces quantum machine learning in feature Hilbert spaces and supplies the kernel-fidelity foundation the framework uses."},{"cited_title":"Supervised learning with quantum- enhanced feature spaces,","cited_arxiv_id":null,"evidence_quote":"Shows supervised learning with quantum-enhanced feature spaces, the basis for using quantum kernels in SVMs."},{"cited_title":"Anomaly detection for real-world cyber-physical security using quantum hybrid support vector machines,","cited_arxiv_id":null,"evidence_quote":"Previous QML anomaly detection on cyber-physical systems, the approach this paper extends to physiological data."},{"cited_title":"Univer- sal adversarial perturbations,","cited_arxiv_id":null,"evidence_quote":"Defines universal adversarial perturbations, the attack formulation used for the adversarial-perturbation experiments."},{"cited_title":"The effect of electroen- cephalogram (eeg) reference choice on information-theoretic measures of the complexity and integration of eeg signals,","cited_arxiv_id":null,"evidence_quote":"Source of the single-label RESTINGECG dataset used in the evaluation."},{"cited_title":"Ephnogram: A simulta- neous electrocardiogram and phonocardiogram database,","cited_arxiv_id":null,"evidence_quote":"Source of the two-label EPHNOGRAM ECG/PCG dataset used in the evaluation."},{"cited_title":"Machine learning based stress monitoring in older adults using wearable sensors and cortisol as stress biomarker,","cited_arxiv_id":null,"evidence_quote":"Source of the three-label Stress dataset used in the evaluation."},{"cited_title":"Principal component analysis: A natural approach to data exploration,","cited_arxiv_id":null,"evidence_quote":"Supplies the PCA feature-reduction step that maps each dataset down to 12 features for the 6-qubit encoder."}],"review_version":1}