{"id":"248c1b55-fc87-4d03-8b63-b0069eedbff2","arxiv_id":"2507.06262","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A quantum-classical hybrid method trains a weighting network on QUBO solvers to filter poisoned image training samples, reaching clean-subset quality comparable to Meta-Sift in simulations.","lead":"This paper proposes Q-Detection, a hybrid defense that uses a quantum-trained weighting network to filter poisoned data from a training set before model training. It reports clean-subset selection results on traffic sign images and a theoretical estimate that quantum hardware could make filtering more than 20% faster than a classical baseline.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Q-WAN's QUBO encoding is never specified: no Q matrix or weight-to-spin mapping, and the guided excitation in Eq. 7 is set equal to parameter vectors rather than spin states, so the claimed quantum training mechanism is uncheckable.","rationale":"The reader's weakest assumption identifies the same point I consider most load-bearing: the QUBO encoding of the Q-WAN is asserted but never derived. I attempted to reconstruct the mechanism from Section 3.2-3.3 and found that no mapping from network parameters to spin variables is provided, the guided excitation term is not a well-defined energy term, and the gradient update rule does not connect spin correlations to updates of ψ. Without this mapping, the experiments in Section 4 are not evidence for the quantum training procedure; they are at most evidence that some simulated QUBO solver, with unspecified input coefficients, can be used to produce a weighting network. The broad claim of a 20% speedup in Section 4.4 depends on the same unsupported QUBO formulation and on an unreported real-hardware speedup factor, so it also cannot be verified from the text. I do not regard the missing derivation as evidence of bad faith; it could be a presentation gap, and the posted code might contain the missing mapping. That is why I propose a concrete repository-level check rather than an a priori dismissal. However, as submitted, the central novel contribution is not checkable, so the reader's REJECT verdict should stand. The secondary inconsistencies in the paper, such as the claim of consistent outperformance despite the 500-qubit results in Table 1, reinforce but do not change this conclusion.","tokens_in":12570,"tokens_out":4812,"duration_ms":61572,"concrete_test":"Download the linked GitHub repository, locate the function that builds the QUBO/Ising instance for a training batch, and write out the full coefficient matrix Q (or Jij/hi) for a small fixed example, e.g., 4 samples and 20 qubits. If no such builder exists, or if the variables solved by the SDK are not the Q-WAN parameters, then the Section 3.2 mechanism is not implemented. If the builder does exist, independently re-derive Eq. 10 from that QUBO using equilibrium propagation; if the energy term refers to ψ* or θ*(ψ) as a coefficient rather than a spin configuration, the derivation is invalid.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that a QUBO-encoded Q-WAN can be trained by free/guided equilibrium propagation and then select a perfectly clean subset. That claim has no checkable formulation. Section 3.2 asserts that 'Q-WAN training encodes the network as a QUBO' but never gives the Q matrix of Eq. 1, the Jij/hi coefficients of Eq. 2, or any mapping from the real-valued Q-WAN parameters ψ to spin variables. The work therefore cannot establish that the simulated QUBO solves used in Section 4 are solving the optimization problem in Eq. 4. The guided-state term in Eq. 7 is also internally incoherent: it says C(σ_y, σ̂_y) = ψ* in the Adversarial Filtering Stage and C(σ_y, σ̂_y) = θ*(ψ) in the Selective Learning and Actual-update Stages, but ψ* and θ*(ψ) are parameter vectors, not spin configurations, and ψ* is itself the unknown optimum of Eq. 4, creating a circular target. Eq. 10 updates coupling strengths Jij using spin-pair correlations, but no equation connects those correlations to the actual network parameters ψ or to the loss S(Li(θ); ψ), and Eqs. 8-9 define L1 and L2 as arg min expressions rather than scalar loss functions. Consequently, the reported NCR=0 results at 5000 qubits cannot be attributed to the described quantum-classical training mechanism, and the speedup estimate in Section 4.4 inherits the same unsupported premise. The absence of this derivation is load-bearing because the only novel component of Q-Detection over Meta-Sift is precisely this QUBO training step.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Q-Detection, a quantum-classical hybrid defense against data poisoning attacks. The method trains a Quantum Weight-Assigning Network (Q-WAN) by encoding its training as a QUBO/Ising problem, sampling free and guided spin states on quantum devices or simulators, and using equilibrium-propagation-like spin-pair differences to update couplings. The Q-WAN assigns sample weights that are used to filter a clean subset from a poisoned dataset. Experiments on GTSRB compare Q-Detection against DCM, LossScan, Autoencoder Outlier, and Meta-Sift under Targeted Label-Flipping, BadNets, and Narcissus attacks, reporting NCR (normalized corruption ratio) and downstream ResNet-18 accuracy. The paper also provides a theoretical estimate of more than 20% speedup from real quantum hardware.","tokens_in":12939,"tokens_out":3221,"duration_ms":39976,"significance":"If the central mechanism were fully specified and validated, Q-Detection would be a novel integration of quantum optimization into data-poisoning defense, and the reported NCR=0 results at 5000 qubits would be notable. The authors provide code and compare against Meta-Sift, a strong state-of-the-art baseline, and evaluate both subset cleanliness and downstream model accuracy. However, the significance is conditional: the QUBO encoding of the Q-WAN is never actually given, the guided-excitation training rule is internally inconsistent, the speedup estimate rests on an unverified hardware speedup assumption, and the abstract's claim of consistent superiority is contradicted by the 500-qubit results in Table 1. As presented, the paper does not establish that any quantum-specific mechanism is responsible for the empirical results.","major_comments":[{"comment":"The QUBO encoding of the Q-WAN is asserted but never specified. Section 3.2 states that 'Q-WAN training encodes the network as a QUBO,' but no matrix Q for Eq. (1), no Ising coefficients Jij and hi for Eq. (2), and no mapping from the real-valued Q-WAN parameters psi to spin variables are provided. Without this mapping, the simulated QUBO solves reported in Section 4 cannot be checked against the optimization objective in Eq. (4), and the NCR=0 results at 5000 qubits cannot be attributed to the described quantum-classical training mechanism. This is load-bearing because the only novel component of Q-Detection relative to Meta-Sift is precisely this QUBO-based training procedure.","section":"Section 3.2"},{"comment":"The guided excitation term is defined inconsistently. Eq. (7) writes E' = E + C(sigma_y, sigma_hat_y), but the text then states that C(sigma_y, sigma_hat_y) = psi* in the Adversarial Filtering Stage and C(sigma_y, sigma_hat_y) = theta*(psi) in the other stages. psi* and theta*(psi) are parameter vectors from Eq. (4), not spin configurations, so they cannot be added to an Ising energy over spin variables without a defined embedding. Moreover, psi* is the optimum being sought in Eq. (4), so the target state needed to compute gradients is defined in terms of the solution the training is supposed to find; this is circular. The symbols y and sigma_hat_i are also not defined precisely enough to determine what the 'guided state' is.","section":"Section 3.2, Eq. (7)"},{"comment":"The gradient rule is not connected to the Q-WAN parameters or the bilevel objective. Eqs. (8) and (9) define L1 and L2 as arg min expressions rather than scalar loss values, so they do not provide the discrepancy measures the text says they define. Eq. (10) updates Jij with spin-pair correlations, but no equation relates the spin variables to the network parameters psi or to the loss S(L_i(theta); psi) used in Eq. (4). Without this connection, the learning rule is not a derivation from the stated optimization problem, and the experiments in Section 4 cannot be interpreted as training the Q-WAN of Eq. (4).","section":"Section 3.3, Eqs. (8)-(10)"},{"comment":"The abstract claims Q-Detection 'consistently outperforms the baseline methods and is comparable to the state-of-the-art,' but Table 1 shows that at 500 qubits Q-Detection is substantially worse than the random baseline in several settings: NCR is 180% and 267% for Narcissus at 20% poisoning, and 110.14%, 330%, 231.24%, and 365.57% for BadNets at 10% and 30% poisoning. These values are far above the 100% random baseline, so the claim of consistent superiority is not supported. The claim should be restricted to the 5000-qubit simulation setting, and the discrepancy should be discussed rather than left implicit in the table.","section":"Section 4.2, Table 1"},{"comment":"The 'more than 20% speedup' conclusion is an arithmetic exercise based on an assumed 10^3 speedup factor for real quantum hardware over simulation, not a measurement. The text states that the real-machine computation time is 'significantly less' on D-Wave and QBoson devices, but no end-to-end comparison accounts for quantum-classical transfer, QUBO embedding, sampling overhead, or the fact that the Q-WAN training loop requires thousands of calls to the quantum device. The calculation '2.1 + 0.0669 = 2.17 minutes' also appears to mix units (minutes and hours) without explanation. The speedup claim is therefore not established and should be presented as a speculative projection, not a theoretical result.","section":"Section 4.4"}],"minor_comments":[{"comment":"The name Q-WAN is written both as 'Q-WAN' and 'Q-W AN' in many places; please use one consistent notation.","section":"Throughout"},{"comment":"The QUBO objective is written as min x^T Q x + sum h_i x_i, but x^T Q x is not a QUBO unless the linear term is folded into the diagonal of Q; please clarify the convention used.","section":"Section 2.2, Eq. (1)"},{"comment":"The text says 'NCR matrices normalize away the imbalance,' which appears to be a typo for 'NCR metric normalizes away the imbalance.'","section":"Section 4.1, Eq. (12)"},{"comment":"The table columns for Q-Detection settings are hard to parse because the solver names and qubit counts run together; adding explicit column headers such as 'Q-Det. CQPC (500 qubits)' would improve readability.","section":"Section 4.2, Table 1"},{"comment":"The sentence 'The SOTA method Meta-Sift achieves the best NCR metrics under all attack types' is not consistent with Table 1, where Q-Detection at 5000 qubits also achieves 0% NCR in many rows; please rephrase to avoid ambiguity.","section":"Section 4.2"},{"comment":"The estimate of 220 epochs for batch size 179 and 892 epochs for batch size 44 is stated without explaining how these numbers were derived; adding the formula or reference would make the calculation reproducible.","section":"Section 4.4"}],"recommendation":"reject","confidential_remarks":"The manuscript's central novelty is the QUBO-based training of the Q-WAN, but that mechanism is never concretely specified: there is no Q matrix, no weight-to-spin mapping, and the guided-state term is circular. The empirical results at 5000 qubits are interesting but cannot be connected to the described quantum training without that derivation. The speedup claim is also not supported by measurements. These are load-bearing issues rather than presentation problems, and I do not see how they can be fixed within the scope of a revision unless the authors supply a complete, correct formulation of the QUBO encoding and re-run the experiments under that formulation. I therefore recommend rejection, while noting that the empirical comparison framework (NCR plus downstream accuracy, with Meta-Sift as a baseline) is a reasonable evaluation design that could support a future submission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a legitimate new application—quantum optimization for data poisoning detection—and the authors are transparent about their simulated results, including the 500-qubit failures. But the paper never actually specifies the QUBO encoding it relies on, and the guided-state equations are internally inconsistent. So the empirical match with Meta-Sift cannot be credited to the quantum mechanism as described.\n\nWhat's genuinely new: no prior work applies quantum equilibrium propagation or QUBO solvers to clean-subset selection. The authors reproduce Meta-Sift's bilevel objective and Laydevant et al.'s spin-correlation update rule, but that is disclosed, not hidden. They also ship code and run three attack types across multiple poisoning ratios, with honest reporting of the failure cases at 500 qubits. That is more credible than the abstract's 'consistently outperforms.'\n\nThe soft spots are real and load-bearing. Section 3.2 says the Q-WAN is encoded as a QUBO but never gives the Q matrix or the mapping from real-valued parameters ψ to spin variables. Eq. 7 defines the guided excitation term C as ψ* or θ*(ψ)—parameter vectors, not spin states—and ψ* is the very optimum being sought, so the target is circular. Eqs. 8–9 define L1 and L2 as arg min expressions rather than scalar losses, and Eq. 10 updates Jij with spin correlations that are never connected back to ψ or the loss. The reported NCR=0 results at 5000 qubits are therefore not traceable to the described quantum training procedure. The 20% speedup estimate inherits the same problem: it is arithmetic from an assumed 10^3 hardware factor and a single CQPC measurement, not a measurement of the method.\n\nThe table also contradicts the abstract's 'consistently outperforms'—at 500 qubits, both Q-Detection variants exceed 100% NCR on several backdoor settings, i.e., worse than random filtering. The authors disclose this, which is good, but the abstract overstates it.\n\nThis paper is for readers interested in quantum ML for security, who will see a plausible empirical demonstration and a clear account of the limitations. It needs major revision before it is a complete research claim. That said, it is not a trivial or unserious submission; the application is genuinely new and the empirical work is honest. A serious referee should see it, primarily to force the authors to supply the missing QUBO derivation or explicitly narrow the claims. I'd send it out, with a request for heavy revision.","headline":"First quantum-based poisoning defense that honestly reports simulated results, but the central QUBO training mechanism is unspecified and the guided-state term is circular; the reported NCR=0 results are not attributable to the described quantum method.","tokens_in":13483,"tokens_out":3306,"would_cite":false,"duration_ms":34985,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A quantum-trained weighting network can select clean subsets from poisoned image data at 0% contamination, matching the best classical sifter.","keywords":["data poisoning attacks","poisoning detection","quantum-classical hybrid defense","QUBO optimization","Ising model","quantum annealing","backdoor attacks","clean subset selection"],"falsifier":"A concrete test is to reconstruct the coefficient matrix $Q$ and coupling strengths $J_{ij}$ required by the QUBO encoding in Section 3.2 and run the free/guided update rule on a classical simulator. If the resulting NCR on the same GTSRB settings is not 0%, or if replacing the quantum solver with random spin sampling also gives 0% NCR, then the quantum-trained Q-WAN is not doing the work the paper claims.","tokens_in":12336,"feed_emoji":"🛡️","tokens_out":9808,"duration_ms":105626,"temperature":0.7,"pith_summary":"Q-Detection is a quantum-classical hybrid defense that claims to detect data-poisoning attacks by selecting a clean training subset from a poisoned dataset. The method trains a one-hidden-layer Quantum Weight-Assigning Network (Q-WAN) by encoding its training as a quadratic optimization problem and solving it on quantum devices, then uses the network's per-sample weights to filter poisoned data. Experiments on the GTSRB traffic-sign dataset report 0% Normalized Corruption Ratio (0% means the chosen subset is completely clean) for targeted label-flipping, BadNets, and Narcissus backdoor attacks when the Q-WAN uses 5000 simulated qubits, matching the state-of-the-art classical method and often improving downstream model accuracy. The authors further estimate that running the same solver on real quantum hardware would cut filtering time by more than 20% relative to a CUDA-accelerated classical baseline. If correct, Q-Detection offers a concrete route for poisoning defense to inherit quantum speedup without needing a clean benchmark set.","feed_headline":"Quantum-classical defense filters poisoned images to zero corruption","feed_subtitle":"A quantum-trained weighting network matches the leading classical method on three attack types and promises a 20% speedup.","key_machinery":"The load-bearing mechanism is the Q-WAN, a one-hidden-layer weight-assigning network whose training is reformulated as a quadratic unconstrained binary optimization (QUBO) problem and solved by energy minimization on quantum devices. The training loop follows an equilibrium-propagation-like rule: the system first relaxes to a free spin state, then to a guided state with the extra coupling term $C(\\sigma_y, \\hat{\\sigma}_y)$ that nudges output neurons toward target values, and the weight update is the difference between the two states' spin-pair correlations. This single mechanism converts the sample-weighting subproblem into a form that quantum annealers, coherent Ising machines, and gate-model QAOA circuits can all solve, and it is what lets Q-Detection filter poisoned samples by assigning low weights to high-loss points.","core_discovery":"The paper's central claim is that poisoned-data detection can be recast as a bilevel optimization problem whose inner weighting network is trainable on quantum hardware. A domain model and a virtual model alternate with the Q-WAN, which assigns each sample a weight from its cross-entropy loss; the outer objective maximizes the weighted loss of low-confidence (poisoned) samples while the inner objective minimizes the weighted loss of high-confidence (clean) samples. The Q-WAN itself is trained by encoding it as a QUBO/Ising energy $E = \\sum_{i>j} J_{ij}\\sigma_i\\sigma_j + \\sum_i h_i\\sigma_i$, sampling a free low-energy state and a guided state nudged by a coupling term $C(\\sigma_y, \\hat{\\sigma}_y)$, and updating coupling strengths from the difference of spin-pair correlations $(\\sigma_i\\sigma_j)_{\\mathrm{guided}} - (\\sigma_i\\sigma_j)_{\\mathrm{free}}$. On GTSRB, Q-Detection with 5000 simulated qubits reaches 0% NCR across all tested poison ratios for three attack families, consistently beats DCM, LossScan, and autoencoder baselines, and yields downstream model accuracy that matches or slightly exceeds Meta-Sift.","pith_inferences":["An implication the authors leave implicit is that the 0% NCR may owe more to the inherited Meta-Sift-style bi-level sifting framework than to the quantum-trained Q-WAN; the paper's own comparison shows both methods reach 0% NCR, with Q-Detection's advantage showing up mainly in downstream accuracy.","A direct test would replace the quantum solver with classical simulated annealing on the same free/guided rule; if NCR stays at 0%, the quantum component is not the source of detection quality, only of the projected speedup.","The speedup estimate assumes the 10^3 simulator-to-hardware ratio measured on a 550-qubit coherent Ising machine transfers to the full Q-Detection loop; qubit connectivity and embedding overhead on real annealers could erode much of that gain.","If the hidden-layer-size-to-qubits scaling continues, the practical ceiling on near-term hardware is set by qubit count, not by dataset size, so the method's real-world usefulness will track quantum hardware roadmaps."],"forward_implications":["If the results hold, poisoning defense no longer requires a clean validation set: the same bi-level weighting procedure identifies poisoned samples and trains a usable model on the remaining subset.","The 0% NCR reported on GTSRB means the downstream model is trained on entirely clean data for the tested attacks, so attack success rates should drop to the level of an unpoisoned model.","Because the Q-WAN's hidden-layer size equals the number of qubits, increases in quantum hardware size translate directly into stronger filtering, giving the method a scaling path tied to hardware progress.","If the projected 20% runtime speedup materializes, the most expensive part of sample-weighting defenses—repeatedly computing per-sample losses—can be offloaded to quantum solvers.","The same QUBO backbone is compatible with several quantum solver families, so the defense is not locked to a single hardware vendor."],"supporting_citations":[{"why":"Introduces Meta-Sift, the bi-level clean-subset selection framework and SOTA baseline that Q-Detection extends with a quantum-trained weighting network.","marker":"[Zeng et al., 2023a]"},{"why":"Provides the QUBO formulation and tutorial that Q-Detection uses to encode the weight-assigning network as a quadratic optimization problem.","marker":"[Glover et al., 2019]"},{"why":"Shows how to train a neural network on an Ising machine with equilibrium propagation, the free/guided-state gradient rule Q-WAN adopts.","marker":"[Laydevant et al., 2024]"},{"why":"Supplies the GTSRB traffic-sign dataset on which Q-Detection's filtering and downstream-accuracy results are measured.","marker":"[Stallkamp et al., 2011]"},{"why":"Defines the targeted label-flipping attack used as one of the three poisoning scenarios in the evaluation.","marker":"[Jha et al., 2023]"},{"why":"Defines BadNets, the label-feature backdoor attack used in the evaluation.","marker":"[Gu et al., 2019]"},{"why":"Defines Narcissus, the clean-label backdoor attack used in the evaluation.","marker":"[Zeng et al., 2023b]"},{"why":"Provides evidence that coherent Ising machines solve Ising/QUBO problems far faster than simulation, supporting the projected >20% speedup.","marker":"[Honjo et al., 2021]"}],"fun_headline_variants":["Quantum-classical detector purges poisoned data","Q-Detection: quantum speedup for stronger poison defense","Hybrid quantum model zeroes poisoned images, beats baselines","Quantum-trained net filters poisoned data, promises 20% speedup","Quantum computing boosts poisoning defense to zero corruption"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a one-hidden-layer weighting network can be trained faithfully by casting it as a quadratic optimization problem and comparing two spin states; the paper never actually writes the coefficient matrix that would turn the network's weights into that quadratic form, so if no such encoding exists the quantum training loop lacks a foundation.","fun_headline_variants_meta":{"raw":{"variants":["Quantum-classical detector purges poisoned data","Q-Detection: quantum speedup for stronger poison defense","Hybrid quantum model zeroes poisoned images, beats baselines","Quantum-trained net filters poisoned data, promises 20% speedup","Quantum computing boosts poisoning defense to zero corruption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000263,"raw_usage":{"total_tokens":1611,"prompt_tokens":969,"completion_tokens":642,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":563}},"tokens_in":585,"tokens_out":642,"duration_ms":7114,"temperature":1.0,"reasoning_tokens":563,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T19:27:25.211432+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test is to reconstruct the coefficient matrix $Q$ and coupling strengths $J_{ij}$ required by the QUBO encoding in Section 3.2 and run the free/guided update rule on a classical simulator. If the resulting NCR on the same GTSRB settings is not 0%, or if replacing the quantum solver with random spin sampling also gives 0% NCR, then the quantum-trained Q-WAN is not doing the work the paper claims.","supporting_citations":[{"cited_title":"A tutorial on formulating and using qubo models","cited_arxiv_id":null,"evidence_quote":"Provides the QUBO formulation and tutorial that Q-Detection uses to encode the weight-assigning network as a quadratic optimization problem."},{"cited_title":"Training an ising machine with equilibrium propagation","cited_arxiv_id":null,"evidence_quote":"Shows how to train a neural network on an Ising machine with equilibrium propagation, the free/guided-state gradient rule Q-WAN adopts."},{"cited_title":"The german traffic sign recognition benchmark: a multi-class classification competition","cited_arxiv_id":null,"evidence_quote":"Supplies the GTSRB traffic-sign dataset on which Q-Detection's filtering and downstream-accuracy results are measured."},{"cited_title":"Label poisoning is all you need","cited_arxiv_id":null,"evidence_quote":"Defines the targeted label-flipping attack used as one of the three poisoning scenarios in the evaluation."},{"cited_title":"100,000-spin coherent ising ma- chine","cited_arxiv_id":null,"evidence_quote":"Provides evidence that coherent Ising machines solve Ising/QUBO problems far faster than simulation, supporting the projected >20% speedup."}],"review_version":1}