Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Quantum Quandaries: Unraveling Encoding Vulnerabilities in Quantum Neural Networks

T0 review · 4 major / 4 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An adversary with white-box access to a transpiled quantum neural network can infer the user's encoding scheme about 95% of the time, and the paper's proposed transient obfuscation defense reduces detection to about 42%.

desk verdict A credible encoding-classification attack is undermined by a defense that a white-box adversary can trivially bypass, plus some overstated novelty. read the letter →

arxiv 2502.01486 v1 pith:HEUBK3VU submitted 2025-02-03 quant-ph cs.ET

Suryansh Upadhyay , Swaroop Ghosh This is my paper · ORCID
classification quant-phcs.ET
keywords quantumneuralnetworksdataencodingschemestranspilationartifactswhite-boxattackQMLasaServicecloudsecuritycircuitobfuscationclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the way classical data is encoded into a quantum neural network—by basis, amplitude, or angle encoding—leaves detectable fingerprints in the transpiled circuit that an untrusted cloud provider can read. Using a feature set built from gate ratios, rotation-angle statistics, and entanglement patterns, the authors train a small neural network that identifies the encoding scheme with about 95% accuracy for circuits up to 14 qubits, and even identifies which rotation gate was used for angle encoding. To protect against this leak, they insert a transient random rotation-and-entanglement layer after encoding and undo it before the parameterized circuit, which they report drops detection accuracy to about 42% at a depth overhead of about 8.5% for a five-layer QNN. The significance is that QML-as-a-Service depends on third-party clouds, so this encoding leak compromises both the model's intellectual property and the embedded training data.

What carries the argument

The central mechanism is the transpilation fingerprint: after the compiler maps a QNN to a noisy backend, the encoding circuit leaves characteristic gate sequences, rotation-angle statistics, and entanglement patterns. The attack's machinery is a feature-extraction pipeline that condenses these fingerprints into $27+2q$ numbers and a two-layer MLP that classifies them. The defense's machinery is a transient scrambling unitary $U_{\mathrm{obf}} = (\prod_i H_i R_X(\theta_i))(\prod_j \mathrm{CNOT}_{2j,2j+1})$ applied right after the encoding and undone before the parameterized circuit, with a hardware barrier preventing the compiler from simplifying the pair; the intent is to mask the encoding fingerprints while leaving the final quantum state exactly as the original encoding produced.

What would settle it

Train the same feature-extraction and classification pipeline on only the gates that appear before the obfuscation layer in defended circuits; if encoding classification accuracy remains near 95%, then the defense does not hide the encoding from an adversary who inspects the circuit prefix.

Watch

Extended reading notes

Core claim

The central claim is that encoding schemes are identifiable from transpilation artifacts with high reliability. The authors construct 18,000 simulated 3-qubit circuits combining three encoding types (amplitude, basis, and angle with Rx, Ry, or Rz rotations) and varied parameterized circuits, transpile them on a noisy hardware-like backend, and extract $27+2q$ features per circuit covering gate-count ratios (notably X versus SX), rotation angle distributions and correlations, RZ-SX sequence frequencies, and entanglement structure. A two-layer MLP classifies the encoding with 94-95% test accuracy and F1 scores near 0.94; amplitude encoding is easiest to detect and basis encoding is the hardest. The paper also proposes a transient obfuscation layer $U_{\mathrm{obf}} = (\prod_i H_i R_X(\theta_i))(\prod_j \mathrm{CNOT}_{2j,2j+1})$ inserted between encoding and PQC, with a compiler barrier and exact inverse before the PQC, and reports that this lowers adversarial detection accuracy to about 42%, which it describes as near random chance, with an average circuit-depth increase of about 8.5%.

Load-bearing premise

The defense depends on the assumption that hiding the encoding behind a random unitary and its inverse actually prevents detection; an adversary who inspects the circuit and notices that the original encoding gates are still the first gates would not be fooled.

Editorial extensions

If this is right

  • A malicious quantum cloud provider can determine whether a submitted QNN uses basis, amplitude, or angle encoding and, for angle encoding, which rotation axis, before executing the job.
  • This recovered encoding can be reused to train a clone model or sold, since encoding choice often embeds domain-specific preprocessing that is part of the model's intellectual property.
  • The attack's feature count grows linearly with qubits, from 33 features at 3 qubits to 55 at 14 qubits, so it remains practical for near-term QNN sizes.
  • The transient obfuscation layer reduces adversarial detection accuracy from about 95% to about 42% with a depth overhead of about 8.5% for a five-layer QNN, and the overhead fraction shrinks for deeper circuits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper describes 42% as near random chance, but with five encoding classes random guessing would give 20%, so the defense still leaves a detectable signal.
  • Because the encoding gates remain the first gates in the transpiled circuit and the obfuscation and inversion gates are all present with concrete parameters, a classifier trained only on the pre-obfuscation prefix would likely recover the encoding; the reported 42% comes from a classifier trained on unobfuscated circuits, not one that adapts to the defense.
  • The attack evaluation uses a simulated noisy backend; testing the classifier on real hardware outputs would clarify whether the 95% accuracy transfers to physical devices.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies encoding-scheme leakage in quantum neural networks (QNNs) running on untrusted quantum cloud services. The authors propose a supervised classifier that, given a transpiled QNN circuit, infers whether basis, amplitude, or angle encoding (with the specific rotation axis) was used, reporting about 95% accuracy. They also propose a defense consisting of a transient "obfuscation layer" with randomized rotations and entanglement placed after the encoding and inverted before the PQC, reporting that this reduces detection accuracy to about 42% with a depth overhead of about 8.5%. The claimed contribution is a new side-channel attack via transpilation artifacts and a lightweight mitigation.

Significance. If the attack and defense results were reliable, the work would identify a practically relevant IP-leakage channel for QML-as-a-Service and offer a low-overhead countermeasure. The paper offers a concrete feature-engineering pipeline and a reproducible framing of the classification task, which are useful starting points for studying transpilation side channels. However, the proposed defense is structurally ineffective under the paper's own white-box threat model, and the central quantitative claims are not supported by sufficient experimental detail or statistical rigor. As presented, the paper does not establish a viable defense, which limits its current significance.

major comments (4)
  1. [IV (Obfuscation Phase) and III-B] The defense is ineffective under the stated white-box threat model. Section IV places the obfuscation layer after the encoding circuit, so the original encoding gates remain the first gates in the transpiled circuit, and the obfuscation and inversion layers are fully visible with concrete parameters. An adversary who receives the complete transpiled circuit (as assumed in Section III-B) can ignore U_obf and U_obf^{-1} and inspect the initial gate sequence to determine whether the encoding is basis (X/SX patterns), angle (Rx/Ry/Rz rotations), or amplitude (state-preparation unitary). The reported drop to 42% comes from a classifier trained on features of the entire obfuscated circuit; it does not model an adversary who restricts analysis to the encoding prefix. The central claim that the defense 'masks encoding fingerprints' is therefore unsupported.
  2. [Abstract and V-D] The paper repeatedly states that the defense reduces adversarial detection accuracy to 'near random chance ≈42%'. This is numerically incorrect: the classification task has five classes (amplitude, basis, Rx, Ry, Rz), so random guessing yields 20% accuracy. A 42% detection rate is more than twice the chance level and indicates that substantial encoding information remains available to the adversary. Since this is the headline measure of defense efficacy, the misstatement is load-bearing.
  3. [V] The empirical evaluation is reported as point estimates without sufficient reproducibility support. The experiments use a single Qiskit fake backend (GenericBackendV2), with no code release, no random seeds, no repeated runs, and no confidence intervals or error bars. The 95% attack accuracy and the 42% defense accuracy are each from a single 60-20-20 split of the generated dataset. Given that the paper's conclusions are quantitative security claims, this level of statistical reporting is inadequate.
  4. [III-C.1 and V-B] The dataset is generated under the assumption that each qubit encodes exactly one feature (Section III-B), and the evaluation is limited to near-term-sized circuits (3 to 14 qubits). This is a stated limitation, but the paper's abstract and conclusion do not qualify the claimed vulnerability accordingly. The attack's usefulness outside this narrow setting, particularly for dense angle encoding or hybrid encodings, is not demonstrated.
minor comments (4)
  1. [V-C] The text says 'For a 3-qubit system, the attack achieves 94% accuracy' and then says 'As qubit count scales to 14, test accuracy improves from 90% to 95%'; the relationship between the 94% figure and the stated 90%-to-95% range is unclear and should be clarified.
  2. [V-A] Figure 2 is described as showing training and validation accuracy and loss, but the caption does not define which curve corresponds to training vs validation; please make the figure self-explanatory.
  3. [References] Reference [15] cites 'Amazon, Saiwa' with a malformed URL; the attribution should be fixed, and the reference should be to the actual SaaS/MaaS service being described.
  4. [II-C] The paper mentions hybrid encoding techniques in Section II-C.4 but does not include them in the threat model or evaluation; a sentence explaining why they are excluded would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is a held-out supervised classification result and the defense weakness is an evaluation gap, not a circular derivation.

full rationale

The paper's central claim — that an adversary can predict the encoding scheme with ≈95% accuracy from transpiled-circuit features — is an empirical supervised-learning result. The dataset is generated with known encoding labels, features are extracted from the transpiled circuits, an MLP is trained on a 60% split, and accuracy is reported on a held-out 20% test set. The labels are not derived from the fitted model, and the features are not fitted parameters renamed as predictions; this is standard classification, not circularity. Feature engineering guided by known gate-structure differences (e.g., X/SX ratios for basis encoding, rotation statistics for angle encoding) is legitimate supervised learning, not a self-definitional tautology. The proposed defense is indeed logically weak: U_obf and U_obf^{-1} are appended after the encoding circuit and before the PQC, leaving the original encoding gates visible at the start of the transpiled circuit, so a white-box adversary could ignore the obfuscation and inspect the encoding prefix directly. The reported drop to 42% is an empirical evaluation against the paper's own full-circuit classifier, not against an adversary who exploits the visible encoding gates, and 42% is not near random chance for a five-class problem (20%). However, this is an evaluation mismatch and a correctness concern, not a circular derivation: the defense claim does not reduce by construction to its inputs, and no equation in the paper defines the attack accuracy in terms of the defense or vice versa. Self-citations ([19], [20], [24]) appear only in related-work and threat-model context and are not load-bearing for the attack's validity or the defense's evaluation. No circular step can be exhibited with a specific reduction, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities. Its central claims rest on a set of domain assumptions about the encoding families, the adversary's white-box access, and the simulator fidelity. The free parameters are hand-chosen feature and architecture choices, plus the arbitrary randomization range in the defense.

free parameters (3)
  • Feature count formula = 27 + 2 * qubits
    Chosen by hand to capture structural, rotation, and entanglement statistics; no sensitivity analysis provided.
  • MLP hidden layer sizes = 25 and 10 neurons
    Selected without reported hyperparameter optimization; accuracy may be architecture dependent.
  • Obfuscation rotation angle range = uniform in [-π, π]
    Arbitrary range for the RX randomization in the defense; not justified by threat model.
assumptions (5)
  • domain assumption Victim uses one of basis, amplitude, or angle encoding and encodes exactly one feature per qubit
    Stated in Section III-B; restricts scope of the attack and may not generalize to other encodings.
  • domain assumption Adversary has white-box access to the transpiled circuit and the measurement results
    Section III-B; used to analyze gate sequences, but also makes the defense bypassable.
  • domain assumption Qiskit GenericBackendV2 fake backend faithfully reproduces real transpilation artifacts
    Section V; all results are simulation-only, no hardware validation.
  • domain assumption The compiler barrier prevents cancellation or rearrangement of the obfuscation and inversion gates
    Section IV, Isolation Barrier; not demonstrated and questionable because barriers are compiler directives that may not be transmitted to the cloud.
  • standard math U_obf U_obf^dagger equals identity
    Section IV, Inversion Phase; ensures the encoded state is restored before the PQC, assuming exact implementation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantum Quandaries: Unraveling Encoding Vulnerabilities in Quantum Neural Networks." pith.science (2026). https://pith.science/paper/HEUBK3VU

@misc{pith2026250201486,
  author       = {Pith},
  title        = {Pith review of: Quantum Quandaries: Unraveling Encoding Vulnerabilities in Quantum Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HEUBK3VU}},
  note         = {Machine review of arXiv:2502.01486}
}
read the original abstract

Quantum computing (QC) has the potential to revolutionize fields like machine learning, security, and healthcare. Quantum machine learning (QML) has emerged as a promising area, enhancing learning algorithms using quantum computers. However, QML models are lucrative targets due to their high training costs and extensive training times. The scarcity of quantum resources and long wait times further exacerbate the challenge. Additionally, QML providers may rely on third party quantum clouds for hosting models, exposing them and their training data to potential threats. As QML as a Service (QMLaaS) becomes more prevalent, reliance on third party quantum clouds poses a significant security risk. This work demonstrates that adversaries in quantum cloud environments can exploit white box access to QML models to infer the users encoding scheme by analyzing circuit transpilation artifacts. The extracted data can be reused for training clone models or sold for profit. We validate the proposed attack through simulations, achieving high accuracy in distinguishing between encoding schemes. We report that 95% of the time, the encoding can be predicted correctly. To mitigate this threat, we propose a transient obfuscation layer that masks encoding fingerprints using randomized rotations and entanglement, reducing adversarial detection to near random chance 42% , with a depth overhead of 8.5% for a 5 layer QNN design.

Figures

Figures reproduced from arXiv: 2502.01486 by the authors.

Figure 1
Figure 1. Proposed attack model where the adversary, posing as a reliable quantum cloud service provider, uses the white box access to the QNN submitted to [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Training, validation accuracy and loss for classifying the encoding [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Test accuracy for circuits with varying qubit counts, where each qubit [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. An End-to-End Multi-Stage Kill-Chain Attack on Quantum Neural Networks: Demonstration on Trapped-Ion Hardware

    quant-ph 2026-07 conditional novelty 6.0 of 10

    A full kill-chain reconstructs QNN structure from simulated power traces then injects timed crosstalk to approximate adversarial inputs on AQT trapped-ion hardware.

Reference graph

Works this paper leans on

27 extracted references · 18 canonical work pages · cited by 1 Pith paper

  1. [24]

    Quantum data breach: Reusing training dataset by untrusted quantum clouds,

    S. Upadhyay and S. Ghosh, “Quantum data breach: Reusing training dataset by untrusted quantum clouds,” 2024. [Online]. Available: https://arxiv.org/abs/2407.14687

    arXiv 2024

  2. [1]

    Quantum convolutional neural networks,

    I. Cong, S. Choi, and M. D. Lukin, “Quantum convolutional neural networks,” Nature Physics, vol. 15, no. 12, pp. 1273–1278, 2019

    2019

  3. [2]

    Quantum machine learning,

    J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,” Nature, vol. 549, no. 7671, pp. 195–202, 2017

    2017

  4. [3]

    A primer on security of quantum computing,

    S. Ghosh, S. Upadhyay, and A. A. Saki, “A primer on security of quantum computing,” arXiv preprint arXiv:2305.02505 , 2023

    arXiv 2023

  5. [4]

    Potential of quantum com- puting for drug discovery,

    Y . Cao, J. Romero, and A. Aspuru-Guzik, “Potential of quantum com- puting for drug discovery,” IBM Journal of Research and Development , vol. 62, no. 6, pp. 6–1, 2018

    work page 2018

  6. [5]

    A quantum approximate optimization algorithm,

    E. Farhi, J. Goldstone, and S. Gutmann, “A quantum approximate optimization algorithm,” arXiv preprint arXiv:1411.4028 , 2014

    arXiv 2014

  7. [6]

    The variational quantum eigensolver: a review of methods and best practices,

    J. Tilly, H. Chen, S. Cao, D. Picozzi, K. Setia, Y . Li, E. Grant, L. Wossnig, I. Rungger, G. H. Booth et al. , “The variational quantum eigensolver: a review of methods and best practices,” Physics Reports, vol. 986, pp. 1–128, 2022

    work page 2022

  8. [7]

    Quantum computing for finance: Overview and prospects,

    R. Or ´us, S. Mugel, and E. Lizaso, “Quantum computing for finance: Overview and prospects,” Reviews in Physics , vol. 4, p. 100028, 2019

    work page 2019

Show all 27 references
  1. [8]

    Quantum computing led innovation for achieving a more sustainable covid-19 healthcare industry,

    S. Gupta, S. Modgil, P. C. Bhatt, C. J. C. Jabbour, and S. Kamble, “Quantum computing led innovation for achieving a more sustainable covid-19 healthcare industry,” Technovation, vol. 120, p. 102544, 2023

    2023

  2. [9]

    Quantum support vector machine for big data classification,

    P. Rebentrost, M. Mohseni, and S. Lloyd, “Quantum support vector machine for big data classification,” Physical review letters , vol. 113, no. 13, p. 130503, 2014

    2014

  3. [10]

    Quantum generative adversarial learning,

    S. Lloyd and C. Weedbrook, “Quantum generative adversarial learning,” Physical review letters, vol. 121, no. 4, p. 040502, 2018

    2018

  4. [11]

    The power of quantum neural networks,

    A. Abbas, D. Sutter, C. Zoufal, A. Lucchi, A. Figalli, and S. Woerner, “The power of quantum neural networks,” Nature Computational Sci- ence, vol. 1, no. 6, pp. 403–409, 2021

    2021

  5. [12]

    IBM Quantum,

    IBM, “IBM Quantum,” 2024. [Online]. Available: https://www.ibm. com/quantum

    2024

  6. [13]

    Google Quantum Computer,

    Google Quantum AI, “Google Quantum Computer,” 2024. [Online]. Available: https://quantumai.google/quantumcomputer

    2024

  7. [14]

    Amazon Braket,

    Amazon, “Amazon Braket,” 2024. [Online]. Available: https://aws. amazon.com/braket/

    2024

  8. [15]

    [Online]

    ——, “Saiwa,” 2023. [Online]. Avail- able: Saiwa.[a.n.d.].MachineLearningasaService(MLaaS) | Everythingyouneedtoknowaboutthat.https://saiwa.ai/blog/mlaas-1/

    2023

  9. [16]

    Orquestra,

    Z. Computing, “Orquestra,” May 2021. [Online]. Available: https: //www.zapatacomputing.com/orquestra/

    2021

  10. [17]

    C. Q. Computing, “pytket,” May 2021. [Online]. Available: https: //cqcl.github.io/pytket/build/html/index.html

    2021

  11. [18]

    Quantum,

    baidu, “Quantum,” 2024. [Online]. Available: https://www.insidequantumtechnology.com/news-archive/ chinas-baidu-rolls-beijing-based-quantum-computer-and-access-platform/

    2024

  12. [19]

    Robust and secure hybrid quantum- classical computation on untrusted cloud-based quantum hardware,

    S. Upadhyay and S. Ghosh, “Robust and secure hybrid quantum- classical computation on untrusted cloud-based quantum hardware,” in Proceedings of the 11th International Workshop on Hardware and Architectural Support for Security and Privacy , 2022, pp. 45–52

    2022

  13. [20]

    Trustworthy comput- ing using untrusted cloud-based quantum hardware,

    S. Upadhyay, R. O. Topaloglu, and S. Ghosh, “Trustworthy comput- ing using untrusted cloud-based quantum hardware,” arXiv preprint arXiv:2305.01826, 2023

    2023 arXiv

  14. [21]

    Reverse engineering convolutional neural networks through side-channel information leaks,

    W. Hua, Z. Zhang, and G. E. Suh, “Reverse engineering convolutional neural networks through side-channel information leaks,” in Proceedings of the 55th Annual Design Automation Conference , 2018, pp. 1–6

    2018

  15. [22]

    Towards reverse-engineering black- box neural networks,

    S. J. Oh, B. Schiele, and M. Fritz, “Towards reverse-engineering black- box neural networks,” Explainable AI: interpreting, explaining and visualizing deep learning , pp. 121–144, 2019

    2019

  16. [23]

    The quantum imitation game: Reverse engi- neering of quantum machine learning models,

    A. Ghosh and S. Ghosh, “The quantum imitation game: Reverse engi- neering of quantum machine learning models,” in Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security , 2024, pp. 48–57

    2024

  17. [25]

    Quantum computing on encrypted data,

    K. A. Fisher, A. Broadbent, L. Shalm, Z. Yan, J. Lavoie, R. Prevedel, T. Jennewein, and K. J. Resch, “Quantum computing on encrypted data,” Nature communications, vol. 5, no. 1, p. 3074, 2014

    2014

  18. [26]

    Qumos: A framework for preserving security of quantum machine learning model,

    Z. Wang, J. Li, Z. Hu, B. Gage, E. Iwasawa, and W. Jiang, “Qumos: A framework for preserving security of quantum machine learning model,” in 2023 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 1. IEEE, 2023, pp. 1089–1097

    2023

  19. [27]

    Stiq: Safeguarding training and inferencing of quantum neural networks from untrusted cloud,

    S. Kundu and S. Ghosh, “Stiq: Safeguarding training and inferencing of quantum neural networks from untrusted cloud,” arXiv preprint arXiv:2405.18746, 2024

    2024 arXiv

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.