{"id":"e3613bd1-4d69-4abb-8472-67bf99a24237","arxiv_id":"2506.24081","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Inserting SWAP gates into the variational circuit of a hybrid quantum neural network degrades classification accuracy by up to roughly 74%, with targeted insertions able to ruin a single class's accuracy.","lead":"SQUASH is a proposed attack that inserts SWAP gates into the quantum circuit of a hybrid quantum neural network, claiming accuracy drops of up to 74% on image classification tasks. A reader might care because it tests the security of quantum machine learning models, though the attack's threat model assumes the attacker already controls the victim's code.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The targeted-attack results are not traceable to the claimed SWAP-insertion mechanism: Algorithm 1 optimizes an input-space perturbation, so Table II cannot support the targeted SWAP-attack claim until the gate-insertion procedure is re-run.","rationale":"The reader's verdict is REJECT, and I agree with that outcome. My priority differs slightly from the reader's stated weakest assumption: I see the Algorithm 1 / Section IV-B2 mismatch as the single most load-bearing concern, because it directly breaks the causal link between the advertised mechanism (SWAP-gate insertion) and the headline targeted-attack numbers. The reader identifies the delivery threat model as weakest; that is a real weakness but it primarily affects the attack's relevance and stealth framing, not the internal validity of the claimed effect. The mechanism mismatch, by contrast, means the targeted results may not demonstrate SWAP insertion at all. I also note the untargeted tables have their own inconsistencies: the 74.08% headline does not match any single row or simple mean in Table I, and Table II's MNIST-10 clean NLL (0.952) conflicts with Table I's clean NLL (0.0904/0.0991) for the same configuration. These issues reinforce rejection. Credit where due: the basic observation that inserting additional SWAP operations into a fidelity-based classifier can degrade accuracy is plausible and not contested here; the untargeted monotone trend in Table I is consistent with that idea. But the paper does not supply code, seeds beyond a fixed seed, error bars, or control experiments with non-SWAP gates, so the quantitative claims cannot currently be verified. My concrete test would settle whether the targeted claim is real; if it passes, the paper would still need code and correct table bookkeeping, but the central mechanism would be credible. As it stands, no change to the reader's REJECT is warranted.","tokens_in":11099,"tokens_out":4577,"duration_ms":49230,"concrete_test":"Re-run the targeted experiment exactly as Section IV-B2 and Figure 3 describe: start from the trained 2-qubit HQNN, insert exactly two SWAP tests at the fidelity-measurement stage, and do not perform any gradient or input-perturbation step. If target-class accuracy does not drop to roughly 20% on MNIST-2 (with total accuracy near 57%), then Table II's results were produced by Algorithm 1's input-space perturbation rather than by SWAP insertion, and the targeted SWAP claim is unsupported. Report the clean baseline from the same run and the same data split.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that inserting SWAP gates into a trained HQNN's variational circuit degrades accuracy, with a targeted variant selectively collapsing a chosen class. The untargeted part is plausible and likely true: extra SWAP tests alter measured fidelities, and Table I shows monotone degradation as SWAP tests increase. The load-bearing weakness is that the reported targeted-attack numbers appear to come from a different mechanism than the one advertised. Section IV-B2 and Figure 3 describe a targeted attack that inserts two SWAP tests to manipulate the fidelity measurement; but Algorithm 1's targeted branch computes initial fidelities F(|psi_t>, |x>) and F(|psi_c>, |x>), then optimizes a perturbation delta in the input state via gradient updates |x'> = e^{i delta} |x> until F_t > F_c. That is an adversarial input perturbation, not a SWAP-gate insertion. Therefore Table II's target-class drops (19.14% on MNIST-2, 20.94% on MNIST-10, etc.) cannot be attributed to the SQUASH gate-insertion mechanism as specified in the text and figures. The abstract's 'up to 79.78%' targeted reduction and the stealth framing rest on this mismatch. Without a direct re-implementation of the SWAP-only targeted insertion, the central targeted claim is unverified. A secondary concern is the delivery threat model: if a malicious configuration file is executed, arbitrary code execution is already available, so the SWAP-specific mechanism is not needed; this weakens the 'stealthy circuit-level vulnerability' framing but is less damaging than the mechanism inconsistency.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SQUASH, a circuit-level attack that inserts SWAP gates into the variational quantum circuit of a hybrid quantum-classical neural network (HQNN) to sabotage classification. Two attack strategies are presented: an untargeted attack that injects multiple SWAP tests across all qubits, and a targeted attack that claims to insert two SWAP tests to force a chosen input to be misclassified into an adversary-controlled class. Experiments are reported on MNIST-2, CIFAR-2, MNIST-10, and CIFAR-10 using a 2-qubit HQNN in Qiskit, with accuracy, NLL, and runtime overhead comparisons. The abstract claims untargeted attacks reduce accuracy by up to 74.08% and targeted attacks reduce target-class accuracy by up to 79.78%.","tokens_in":11219,"tokens_out":6999,"duration_ms":68950,"significance":"If the attack worked as described, it would expose a practical vulnerability in open-source HQNN implementations and motivate circuit-level defenses. The untargeted degradation is plausible, since the classifier relies directly on swap-test fidelity measurements and inserting extra swap tests should corrupt those measurements. However, the paper as written does not support its central claims: the targeted attack algorithm is inconsistent with the described mechanism, the headline numbers do not match the tables, and the delivery threat model grants the attacker capabilities that make the SWAP-specific mechanism unnecessary. The paper does not release code, and no control experiments isolate a SWAP-specific effect.","major_comments":[{"comment":"Algorithm 1's targeted branch (lines 8–15) optimizes a perturbation δ in the input state, updating |x'⟩ = e^{iδ}|x⟩ by gradient ascent until F(|ψ_t⟩,|x'⟩) > F(|ψ_c⟩,|x'⟩), and then returns |ψ_t⟩ on line 19. This is an adversarial input-space perturbation, not a SWAP-gate insertion. The surrounding text and Figure 3 describe inserting two SWAP tests into the circuit to corrupt fidelity measurements. Therefore Table II's target-class accuracy drops (19.14%, 18.12%, 20.94%, 15.84%) cannot be attributed to the SQUASH SWAP-insertion mechanism, and the targeted attack claim is unverified as presented. The final return of |ψ_t⟩, a reference state, is also inconsistent with any of the described procedures.","section":"Algorithm 1 and Section IV-B2"},{"comment":"The abstract's headline numbers are not reproducible from the experimental tables. For untargeted attacks, the largest relative accuracy reduction in Table I is 80.3% (CIFAR-2, 3 SWAP tests: (91.87−18.12)/91.87) and the largest absolute drop is 74.6 percentage points (MNIST-10, 3 SWAP tests: 93.89−19.31); neither equals 74.08%. For targeted attacks, Table II reports only total clean accuracy, not clean target-class accuracy, so the claimed 79.78% reduction cannot be verified. The paper should state exactly which table entries support each abstract claim.","section":"Abstract and Tables I–II"},{"comment":"The delivery threat model in Section IV-A assumes a user downloads an open-source HQNN and unknowingly executes a malicious configuration file that injects the SQUASH gates. This assumption grants the attacker arbitrary code execution on the victim's machine. Under that assumption, the attacker could equally corrupt classical layers, labels, or output probabilities directly, making the SWAP-specific mechanism unnecessary and weakening the 'stealthy circuit-level' framing. The paper provides no evidence that this config-file delivery path is a more plausible or realistic attack vector than direct tampering, nor does it compare SQUASH against simpler attacks under the same threat model.","section":"Section IV-A and Figure 1"},{"comment":"The experiments do not include control conditions that isolate the SWAP-specific effect. The HQNN classifier uses swap-test fidelities as its classification signal (Eq. 7), so inserting additional SWAP tests into the measurement layer will corrupt the computed fidelities almost by construction. The observed monotonic degradation with increasing SWAP tests is therefore expected for any operation that disrupts the fidelity measurement. Without comparisons to inserting other gate types (e.g., CNOTs, single-qubit rotations, or noise channels) or to a non-SWAP structural modification, the claim that SWAP gates specifically constitute a distinctive vulnerability is not established.","section":"Section V-C and Table I"}],"minor_comments":[{"comment":"The text contains recurring rendering artifacts such as 'SW AP' instead of 'SWAP' in the title, abstract, and figure captions; these should be corrected.","section":"Throughout"},{"comment":"The word 'discrepencies' should be 'discrepancies'.","section":"Section IV-B1"},{"comment":"The targeted attack uses inconsistent notation: Eq. (8) writes the input as |χ⟩, while Algorithm 1 writes |x⟩ and |x'⟩; make the notation uniform.","section":"Equation (8) and Algorithm 1"},{"comment":"The loop structure 'for each qubit ψ in the quantum circuit' is unclear: the fidelity computations and gradient updates appear to involve global states |ψ_t⟩, |ψ_c⟩, and |x⟩, not a single qubit. Clarify whether the perturbation is per-qubit or global.","section":"Algorithm 1"},{"comment":"Section IV-C states the quantum network uses 2 qubits, but Figure 2 shows three wires (|0⟩, |χ⟩, |ψ⟩). Clarify whether the ancilla qubit is counted separately and how it participates in the encoding.","section":"Section IV-C and Figures 2–3"},{"comment":"The clean-training NLL for MNIST-10 in Table II is 0.952, whereas Table I lists clean NLL values around 0.09 for MNIST-10; explain whether these are different training runs or a typographical error.","section":"Table II"}],"recommendation":"reject","confidential_remarks":"The central targeted-attack claim is unsupported because the algorithm that produced Table II is an input-perturbation method, not the advertised SWAP insertion; the abstract's accuracy numbers also do not match the tables. These are not presentation issues but load-bearing evidence problems. If the authors can re-run the targeted experiments with actual gate insertion and provide a consistent threat model, a resubmission might be considered. The lack of released code and the absence of control experiments further reduce confidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: there's a real, small idea here—inserting SWAP gates into a swap-test HQNN degrades classification—and the untargeted results in Table I are consistent with that. But the targeted attack, the stealthier claim, is not the attack described in Algorithm 1: the algorithm optimizes an input-state perturbation δ, while the text and figures describe inserting SWAP tests into the circuit. Table II's targeted-class drops are therefore untraceable to the advertised mechanism unless the authors re-run the SWAP-only version. The paper also has fixable but annoying inconsistencies—MNIST-10 clean NLL is 0.952 in Table II and 0.0904 in Table I, the abstract's \"up to 74.08%\" is an absolute-point drop not a relative reduction, and there are no error bars, seeds, code, or control gates.\n\nWhat the paper does well: it picks a concrete, small open-source HQNN architecture (2-qubit swap-test classifier on MNIST/CIFAR), and the untargeted insertion results show a monotone degradation as more SWAP tests are added. That is a plausible proof-of-concept that extra SWAP gates scramble fidelity measurements. The overhead analysis is simple but honest. The related-work section is actually good: it cites QTrojan and Stealthy Swaps, so the authors are not overclaiming novelty.\n\nWhere it falls down: the targeted attack mechanism is the main event and it's broken. Algorithm 1's gradient loop on δ has nothing to do with SWAP insertion. Unless the authors can show that the targeted numbers in Table II come from the same two-SWAP-test circuit they describe in Section IV-B2, the headline \"up to 79.78%\" is unsupported. Second, the delivery model (config file execution) already gives the attacker arbitrary code execution, so the stealth framing is moot; they need to either fix the threat model or drop the stealth language. Third, the numbers are sloppy enough that a referee would have to redo all the arithmetic.\n\nBottom line: the untargeted part might be salvageable, but the paper in its current form is not. A serious editor could send it to review because the question is legitimate and the untargeted data are suggestive, but my own verdict is reject. The authors need a major revision: re-run the targeted attack as actual gate insertion, add error bars and a non-SWAP control gate, reconcile the tables, and rework the threat model.","headline":"The untargeted attack is plausible; the targeted attack as written is a different attack, and the paper's numbers don't line up.","tokens_in":11981,"tokens_out":3308,"would_cite":false,"duration_ms":33158,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SQUASH: inserting SWAP gates into the variational circuit of a hybrid quantum neural network degrades classification accuracy by up to 74.08% without touching inputs or training data.","keywords":["hybrid quantum neural networks","SWAP gate attack","circuit-level attack","quantum fidelity","swap test","targeted misclassification","quantum machine learning security","open-source model tampering"],"falsifier":"Run the same MNIST-2 HQNN twice with the three inserted SWAP tests, once exactly as in the paper and once with the SWAP tests replaced by an equivalent classical perturbation of the output layer; if both degrade accuracy equally, the quantum SWAP mechanism is not needed, whereas if only the SWAP version degrades accuracy, the claimed circuit-level vulnerability is confirmed.","tokens_in":10708,"feed_emoji":"⚛️","tokens_out":9421,"duration_ms":87337,"temperature":0.7,"pith_summary":"The paper tries to establish that a small structural change to a hybrid quantum neural network—adding a few SWAP gates to its variational circuit—can destroy classification performance even when the input data and labels are untouched. If correct, this matters because the open-source distribution model for quantum machine learning code gives an attacker a plausible channel: a victim downloads a model and runs a bundled configuration file, and the attack operates entirely inside the quantum processing, leaving no input perturbation for a defender to inspect. The authors report that untargeted SWAP insertions reduce accuracy by up to 74.08% and that targeted insertions reduce a single chosen class's accuracy by up to 79.78% using only two SWAP tests. The broader claim is that fidelity-based classification, the mechanism many HQNNs use to score class similarity, is structurally exposed to gate-level tampering, and defenses must therefore monitor the circuit itself rather than only the data or the loss.","feed_headline":"SWAP gate injection drops quantum classifier accuracy by 74%","feed_subtitle":"Untargeted insertions cut MNIST/CIFAR accuracy by up to 74.08%; two targeted SWAP tests single out one class.","key_machinery":"The central object is the SWAP test, a quantum routine that measures the squared fidelity between two states, $P(0) = (1 + |\\langle \\psi | \\varphi \\rangle|^2)/2$, using an ancilla qubit and a controlled-SWAP gate. SQUASH inserts extra SWAP or controlled-SWAP gates into the variational circuit of a 2-qubit HQNN so that the fidelity scores used by the classifier are computed between misaligned qubits rather than the intended reference states. Untargeted attacks scatter these insertions across all qubits, while targeted attacks place two tests to inflate the fidelity between an input and an adversary-chosen target class and deflate it against the correct class, matching the classifier's decision rule $S_i = \\sum_j (1 + |\\langle x | r^{(i)}_j \\rangle|^2)/2$.","core_discovery":"SQUASH is a circuit-level attack that inserts SWAP gates directly into the variational quantum circuit of a trained 2-qubit hybrid quantum neural network used for image classification. On MNIST and CIFAR-10 benchmarks, inserting one to three extra SWAP tests reduces clean accuracy from roughly 91–96% (binary) and 77–94% (multiclass) to between 15.84% and 43.91%, with the untargeted attack reaching a maximum reduction of 74.08%. A targeted variant using only two SWAP tests collapses the accuracy of a chosen class to between 15.84% and 20.94% while the overall accuracy falls more moderately, to 54.06–85.16%, which the paper argues makes the attack stealthy because the misclassification is masked by correct predictions on other classes. Because the attack needs no training data and does not perturb input states, the disruption occurs inside the quantum circuit rather than at the data boundary.","pith_inferences":["Our inference: because the malicious configuration file in the threat model already executes code on the victim's machine, the SWAP mechanism is one of several possible sabotages, and the paper does not show it is the most practical one.","Our inference: the targeted attack's stealth could be tested by per-class accuracy monitoring, since a defender watching class-specific recall would likely notice the 16–21% target-class collapse that aggregate accuracy hides.","Our inference: the same SWAP-insertion recipe may transfer to other fidelity-based quantum models, such as quantum kernel estimators or quantum k-NN classifiers that rely on swap tests, but the paper only demonstrates it on one 2-qubit convolutional HQNN architecture.","Our inference: a direct comparison against an equivalent random entangling gate (for example, inserting CNOT gates in the same positions) is needed to establish that SWAP gates specifically, rather than any added entangling operation, cause the degradation."],"forward_implications":["Adding even one extra SWAP test to a trained 2-qubit HQNN can cut binary classification accuracy from above 95% to below 44% on MNIST-2 and from above 90% to below 39% on CIFAR-2.","With three untargeted SWAP tests, multiclass accuracy falls to 19.31% on MNIST-10 and 15.84% on CIFAR-10, so the degradation scales with the number of injected gates.","A targeted attack needs only two SWAP tests and reduces target-class accuracy to roughly 16–21% while keeping total accuracy above 54%, so aggregate metrics will not reveal the targeted failure.","The attack adds about 5.96% (targeted) to 16.05% (untargeted) execution time per epoch, so runtime timing alone is unlikely to expose it."],"supporting_citations":[{"why":"The QTrojan circuit backdoor inserts quantum gates into variational circuits and supplies the closest prior attack that SQUASH extends.","marker":"[13]"},{"why":"The QDoor backdoor attack provides the configuration-file trigger model that SQUASH adopts as its delivery vector.","marker":"[9]"},{"why":"Quantum trojan insertion is cited as the basis for the malicious configuration file that loads the SWAP gates.","marker":"[10]"},{"why":"Adversarial SWAP injection in multi-tenant quantum computing supplies the comparison and the anomaly-detection countermeasure baseline.","marker":"[14]"},{"why":"The controlled swap test is the algorithmic primitive whose fidelity measurement SQUASH corrupts.","marker":"[18]"},{"why":"The multi-state swap test literature motivates using swap tests for classification and their vulnerability to interference.","marker":"[19]"},{"why":"Swap-test decoherence characterization supports the claim that swap-test fidelity measurements are fragile and exploitable.","marker":"[22]"},{"why":"MNIST is one of the two benchmark datasets used in the experimental evaluation.","marker":"[25]"},{"why":"CIFAR-10 is the other benchmark dataset used to test the attack across binary and multiclass tasks.","marker":"[26]"}],"fun_headline_variants":["SWAP attack: 74% accuracy drop, no input perturbation needed","Two SWAP gates: target class accuracy collapses to 15.84%","Stealthy circuit sabotage: SWAP injection cuts quantum classifier accuracy","Quantum classifier hijack: SWAP test insertion drops accuracy to 15.84%","No data needed: SWAP attack wreaks 74% accuracy loss on quantum classifier"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's delivery path assumes that a victim downloads an open-source model and unknowingly executes a malicious configuration file, which already grants the attacker code execution on the victim's machine; if that path is unavailable, the SWAP insertion has no vector.","fun_headline_variants_meta":{"raw":{"variants":["SWAP attack: 74% accuracy drop, no input perturbation needed","Two SWAP gates: target class accuracy collapses to 15.84%","Stealthy circuit sabotage: SWAP injection cuts quantum classifier accuracy","Quantum classifier hijack: SWAP test insertion drops accuracy to 15.84%","No data needed: SWAP attack wreaks 74% accuracy loss on quantum classifier"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001338,"raw_usage":{"total_tokens":5421,"prompt_tokens":906,"completion_tokens":4515,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":522,"completion_tokens_details":{"reasoning_tokens":4395}},"tokens_in":522,"tokens_out":4515,"duration_ms":36043,"temperature":1.0,"reasoning_tokens":4395,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:25:44.188300+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same MNIST-2 HQNN twice with the three inserted SWAP tests, once exactly as in the paper and once with the SWAP tests replaced by an equivalent classical perturbation of the output layer; if both degrade accuracy equally, the quantum SWAP mechanism is not needed, whereas if only the SWAP version degrades accuracy, the claimed circuit-level vulnerability is confirmed.","supporting_citations":[{"cited_title":"Qtrojan: A circuit backdoor against quantum neural networks,","cited_arxiv_id":null,"evidence_quote":"The QTrojan circuit backdoor inserts quantum gates into variational circuits and supplies the closest prior attack that SQUASH extends."},{"cited_title":"Qdoor: Exploiting approximate synthesis for back- door attacks in quantum neural networks,","cited_arxiv_id":null,"evidence_quote":"The QDoor backdoor attack provides the configuration-file trigger model that SQUASH adopts as its delivery vector."},{"cited_title":"Stealthy SWAPs: Adversarial SWAP Injection in Multi-Tenant Quantum Computing","cited_arxiv_id":"2310.17426","evidence_quote":"Adversarial SWAP injection in multi-tenant quantum computing supplies the comparison and the anomaly-detection countermeasure baseline."},{"cited_title":"The controlled swap test for determining quantum entanglement,","cited_arxiv_id":null,"evidence_quote":"The controlled swap test is the algorithmic primitive whose fidelity measurement SQUASH corrupts."},{"cited_title":"Quantum multi- state swap test: an algorithm for estimating overlaps of arbitrary number quantum states,","cited_arxiv_id":null,"evidence_quote":"The multi-state swap test literature motivates using swap tests for classification and their vulnerability to interference."},{"cited_title":"Swap test-based charac- terization of decoherence in universal quantum computers,","cited_arxiv_id":null,"evidence_quote":"Swap-test decoherence characterization supports the claim that swap-test fidelity measurements are fragile and exploitable."},{"cited_title":"The cifar-10 dataset,","cited_arxiv_id":null,"evidence_quote":"CIFAR-10 is the other benchmark dataset used to test the attack across binary and multiclass tasks."}],"review_version":1}