Pith. sign in

REVIEW 3 major objections 6 minor 26 references

Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Quantum machine learning has its own adversarial threat landscape, and the defenses it proposes exploit quantum noise itself.

desk verdict A useful survey of QML attacks and defenses that needs one fix: the 6-bit key security claim is overstated. read the letter →

arxiv 2506.21842 v1 pith:ABMDIQTW submitted 2025-06-27 quant-ph cs.CRcs.LG

Archisman Ghosh , Satwik Kundu , Swaroop Ghosh This is my paper
classification quant-phcs.CRcs.LG
keywords quantummachinelearningadversarialattacksQML-as-a-Servicesecurityvariationalcircuitsmodelextractiondatapoisoninghardwarenoisewatermarkinglogiclocking
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Quantum machine learning inherits classical machine learning's security worries, but this survey argues those worries do not transfer unchanged: QML's quantum states, hybrid training loops, and noisy physical hardware produce distinct attacks and equally distinct defenses. The central claim is that a usable security roadmap can be built by classifying adversaries by access level and pairing each threat with a countermeasure that exploits a quantum property, such as hardware noise as a watermark, circuit reversibility as a reverse-engineering lever, key-controlled gates as logic locks, and multi-provider partitioning as a theft barrier. If the roadmap is correct, cloud-based QML services have concrete near-term options for protecting model intellectual property without waiting for fault-tolerant hardware: perturbing outputs with hardware diversity, embedding non-removable watermarks, and splitting models across providers. The paper's contribution is therefore a systematic organization of the emerging attack-defense landscape, not a single new attack or proof.

What carries the argument

The organizing device is the staged QML execution flow, from data pre-processing and encoding, through parameterized circuit construction and hybrid quantum-classical optimization, to cloud-based inference, overlaid with an adversary-access taxonomy of black-box, gray-box, and white-box threats. This pairing carries the argument: each attack is located at a pipeline stage and access level, and each defense is chosen to counter it using a quantum property, such as the reversibility of encoding circuits, the stability of hardware noise fingerprints, the physical reality of crosstalk, or the ability to insert key-controlled gates that are only removed with the correct key.

What would settle it

An independent reproduction would settle it: train two QML models on two different quantum backends, then run the cited watermark classifier after each machine is recalibrated and after the models are fine-tuned on new hardware; if the classifier no longer identifies the training backend, or if a cloned model trained on perturbed outputs regains the victim's test accuracy, the survey's central defense claims fail.

Watch

Extended reading notes

Core claim

The paper's thesis is that adversarial threats "do not transfer trivially into the quantum domain, but instead manifest in new forms" because QML changes the representation, the computational model, and the physical substrate. It catalogs attacks across the whole QML workflow: black-box model extraction over public APIs and crosstalk side channels in multi-tenant hardware; gray-box data poisoning computed from the encoder's density-matrix geometry and cancellation of the encoding circuit by inverse application; and white-box reverse engineering of transpiled variational circuits, pulse-level sabotage hidden below the gate abstraction, compiler-level obfuscation, and logic subversion. For each class it presents defenses: randomized backends and architecture ensembles that degrade clone accuracy, hardware-noise watermarks that certify provenance, layout randomization and noise shaping against side channels, key-embedded logic locking, and reinforcement-learning-chosen model partitioning. The paper concludes that NISQ-era noise and hardware heterogeneity are dual-use: they create vulnerabilities but also enable practical protections, provided designers integrate security from the encoding stage through transpilation and deployment.

Load-bearing premise

The whole defense story rests on the assumption that each quantum machine's noise is stable and unique enough to leave a detectable mark, and that the experimental numbers cited for attacks and defenses are accurate; if noise drifts or the numbers do not reproduce, the recommended protections lose their footing.

Editorial extensions

If this is right

  • If hardware noise fingerprints survive inference on different backends, a qGAN or other QML model can be traced back to its training hardware after the fact, giving providers a non-invasive proof of ownership.
  • If randomizing query execution across heterogeneous backends and architectures perturbs outputs as reported, an adversary's cloned QNN will train on inconsistent labels and lose as much as 13 percent test accuracy, making model stealing uneconomical through public APIs.
  • If key-embedded logic locking with a single key qubit works as described, proprietary quantum circuits can be obfuscated with negligible qubit overhead and under 1 percent fidelity loss after unlocking.
  • If model partitioning forces every provider-local submodel to have near-random standalone accuracy, then no single untrusted cloud provider can reconstruct the full QML model even with full access to its assigned subcircuits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the survey leaves implicit is repurposing the watermark classifier as an auditor that detects stolen models, but that depends on noise profiles staying stable across recalibration and compiler updates, which the cited experiments do not test.
  • Because both the gray-box encoder-cancellation attack and the hardware-watermark defense depend on predictable quantum operations, one design principle follows: encoders should be keyed or non-invertible, and training should deliberately mix hardware signatures when multi-backend provenance is acceptable.
  • As NISQ hardware error rates fall and devices become more uniform, the natural signals these defenses rely on will weaken, so secure QML may eventually need to inject controlled, tunable noise rather than depend on whatever noise the hardware happens to have.
  • The survey's attack-defense pairings suggest a benchmark: a standardized attack with a fixed query budget, noise model, and clone-success metric would let different defenses be compared on the same footing, something the paper itself identifies as an open need.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This survey chapter maps the adversarial threat landscape for quantum machine learning (QML). It organizes attacks into black-box, gray-box, and white-box categories, associates them with stages of the QML execution pipeline, and pairs each attack family with candidate defenses: circuit obfuscation and logic locking, hardware-noise watermarking, crosstalk-aware mitigations, secure model partitioning, and hardware-induced output perturbation. The paper closes with design guidelines for building secure QML systems and a list of open challenges. Its central claim is that QML adversarial threats do not transfer trivially from classical ML but appear in new forms because of quantum representation, computational models, and physical substrates, and that defenses exploiting quantum properties can form a usable roadmap.

Significance. If the reported results hold, the survey is a useful and current synthesis: its taxonomy in Table 1, the pipeline-level threat mapping in Figure 1, and the attack-defense pairing provide practitioners with a clear entry point to the QML security literature. The paper gives credit to recent research on crosstalk side channels, pulse-level attacks, quantum logic locking, watermarking, and hardware-variation defenses, and it explicitly acknowledges that hardware-noise stability and cross-platform attacks remain open challenges. The survey does not supply new proofs or reproducibility artifacts, which is appropriate for the genre, but several quantitative claims are reproduced from prior work without independent verification, and at least one internal security claim about key entropy is overstated. These issues affect the strength of the recommended roadmap but do not invalidate the survey's overall contribution.

major comments (3)
  1. [Section 3.1] The claim that 'even short key lengths (e.g., 6 bits) provide sufficient entropy to prevent adversarial inversion' is internally overstated. A 6-bit key has at most 64 values, so a white-box adversary with access to the locked circuit and an oracle or simulation can test candidate keys in at most 64 trials, and random guessing succeeds with probability 1/64, which is not negligible in a security context. The additional phrase 'especially when keys are mapped to variable gate positions' points to a plausible enlargement of the effective search space, but no adversary model, search-space estimate, or experimental evidence for that enlargement is provided. Because Section 4.3 recommends E-LoQ as a primary structural protection, this overstatement propagates to the roadmap and should be corrected or heavily qualified.
  2. [Sections 3.2 and 3.5] The survey presents quantitative results from prior work—near-perfect hardware-provenance classification in Section 3.2, and up to 15.71% label mismatches, 10.2% TVD, and up to 13% clone accuracy drops in Section 3.5—as established findings without explicitly stating that these are reproduced from the cited papers and have not been independently validated. Section 4 builds its defense recommendations on these numbers, so the text should flag their provenance and any known limitations. A standard survey caveat such as 'as reported in [18]' would be sufficient; the current unqualified tone makes the survey's recommendations appear more firmly supported than the underlying evidence.
  3. [Section 4.6] The text states that QuMoS submodules 'are designed to be individually non-functional, i.e., their inference accuracy is statistically indistinguishable from random guessing.' Section 3.4 does not substantiate that strong claim: it defines SecMec as a heuristic metric and reports that optimized partitionings reduce standalone accuracy, not that submodels reach random-guess level. The statement in Section 4.6 should be weakened to match the cited evidence, or additional evidence should be provided.
minor comments (6)
  1. [Section 3.2] The collision-probability formula appears as a garbled 'Îk_i=1 1/(n-i)'; please use standard product notation and verify the example: selecting 5 backends from a pool of 15 yields a collision probability on the order of 10^-6 under the natural interpretation, not 10^-5 as stated.
  2. [Section 3.2] Typo: 'NSIQ era' should be 'NISQ era'.
  3. [Section 2.1.3] The subsection titled 'Circuit-Level Backdooring' actually describes reverse engineering of transpiled circuits and does not describe the injection of a backdoor or trigger. Retitle the subsection (e.g., 'Reverse Engineering of Transpiled Circuits') to match its content.
  4. [Section 1.2] References [17] and [18] appear mismatched: [17] is a watermarking paper, not a data-preparation cost reference, and [18] is an attack/defense paper, not a training-cost reference. Please re-check these citations.
  5. [Section 4.4] The sentence about adversarial training cites [21] as 'induced by the QUID framework,' but [21] is a data-poisoning attack paper, not an adversarial-training defense. Rephrase to clarify that QUID is the attack motivating the need for adversarial training, or correct the reference.
  6. [Table 1] Reference [20] appears in both the black-box and white-box rows, and the text presents pulse-level attacks as white-box while crosstalk side-channel attacks appear in the black-box subsection. Clarify which entry [20] supports in each row to avoid confusion.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: this is a literature survey whose central taxonomy is independent of any fitted or self-referential calculation; only minor self-citation in defense sections tempers independent support.

full rationale

The paper is a survey, not a derivation: it does not fit a parameter and then predict a closely related quantity, and no definition is constructed in terms of the claim it supports. The central claim that QML adversarial threats are distinct and that quantum-property-based defenses are promising is supported by a broad external literature (e.g., refs 1, 2, 3, 6, 10, 15, 20, 24, 25) as well as by the authors' own prior work. The defense sections 3.2 and 3.5 do rely on same-group citations (refs 17 and 18) for specific quantitative claims such as near-perfect hardware provenance classification and up to 13% clone accuracy drops, and section 4.5 carries those claims into the recommended roadmap; this is a legitimate reason to discount the strength of independent confirmation, but it is self-citation of experimental results, not a circular reduction. The E-LoQ statement that 'even short key lengths (e.g., 6 bits) provide sufficient entropy to prevent adversarial inversion' is an internally overstated security claim (64 keys are enumerable), but it is a correctness or calibration concern, not a circularity: the claim is not assumed in order to prove itself. Because the survey's organizational and comparative content stands independently of any single self-citation, the appropriate circularity finding is minor rather than structural.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no free parameters and no invented entities; its content is literature synthesis. The main load-bearing assumptions are the fidelity of cited results and the stability of hardware noise as a security primitive.

assumptions (3)
  • domain assumption Results of cited attack and defense papers accurately represent reality.
    The survey inherits all empirical claims, such as 90 percent provenance accuracy, 15.71 percent label mismatches, and 13 percent clone accuracy drops, from cited papers without independent reproduction.
  • domain assumption NISQ hardware noise and crosstalk are sufficiently stable and hardware-specific to support watermarking and perturbation defenses.
    Sections 3.2 and 3.5 rely on noise fingerprints surviving transfer and being hard to remove. If noise profiles drift with calibration or device aging, these defenses weaken.
  • domain assumption The black-box, gray-box, white-box access taxonomy is a valid organizing framework for QML threats.
    Section 2 maps all discussed attacks onto this taxonomy. If real deployments mix access levels, the framework may miss hybrid attackers such as semi-privileged providers with intermittent visibility.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses." pith.science (2026). https://pith.science/paper/ABMDIQTW

@misc{pith2026250621842,
  author       = {Pith},
  title        = {Pith review of: Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ABMDIQTW}},
  note         = {Machine review of arXiv:2506.21842}
}
read the original abstract

Quantum Machine Learning (QML) integrates quantum computing with classical machine learning, primarily to solve classification, regression and generative tasks. However, its rapid development raises critical security challenges in the Noisy Intermediate-Scale Quantum (NISQ) era. This chapter examines adversarial threats unique to QML systems, focusing on vulnerabilities in cloud-based deployments, hybrid architectures, and quantum generative models. Key attack vectors include model stealing via transpilation or output extraction, data poisoning through quantum-specific perturbations, reverse engineering of proprietary variational quantum circuits, and backdoor attacks. Adversaries exploit noise-prone quantum hardware and insufficiently secured QML-as-a-Service (QMLaaS) workflows to compromise model integrity, ownership, and functionality. Defense mechanisms leverage quantum properties to counter these threats. Noise signatures from training hardware act as non-invasive watermarks, while hardware-aware obfuscation techniques and ensemble strategies disrupt cloning attempts. Emerging solutions also adapt classical adversarial training and differential privacy to quantum settings, addressing vulnerabilities in quantum neural networks and generative architectures. However, securing QML requires addressing open challenges such as balancing noise levels for reliability and security, mitigating cross-platform attacks, and developing quantum-classical trust frameworks. This chapter summarizes recent advances in attacks and defenses, offering a roadmap for researchers and practitioners to build robust, trustworthy QML systems resilient to evolving adversarial landscapes.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

26 extracted references · 9 canonical work pages

  1. [18]

    Evaluating efficacy of model stealing attacks and defenses on quantum neural networks,

    S. Kundu, D. Kundu, and S. Ghosh, “Evaluating efficacy of model stealing attacks and defenses on quantum neural networks,” in Proceedings of the Great Lakes Symposium on VLSI 2024 , 2024, pp. 556–559

    work page 2024

  2. [1]

    Quantum machine learning,

    J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,” Nature, vol. 549, no. 7671, pp. 195–202, 2017. [Online]. Available: https://doi.org/10.1038/nature23474

    doi:10.1038/nature23474 2017

  3. [2]

    An introduction to quantum machine learning,

    M. Schuld, I. Sinayskiy, and F. P. and, “An introduction to quantum machine learning,” Contemporary Physics , vol. 56, no. 2, pp. 172–185, 2015. [Online]. Available: https://doi.org/10.1080/00107514.2014.964942

    arXiv 2015

  4. [3]

    Challenges and opportunities in quantum machine learning,

    M. Cerezo, G. Verdon, H. Y. Huang et al., “Challenges and opportunities in quantum machine learning,” Nature Computational Science , vol. 2, pp. 567–576, 2022. [Online]. Available: https://doi.org/10.1038/s43588-022-00311-3

    doi:10.1038/s43588-022-00311-3 2022

  5. [4]

    Quantum Computing in the NISQ era and beyond,

    J. Preskill, “Quantum Computing in the NISQ era and beyond,” Quantum, vol. 2, p. 79, Aug

    work page

  6. [5]

    Quantum cloud computing: A review, open problems, and future directions,

    H. T. Nguyen, P. Krishnan, D. Krishnaswamy, M. Usman, and R. Buyya, “Quantum cloud computing: A review, open problems, and future directions,” 2024. [Online]. Available: https://arxiv.org/abs/2404.11420

    arXiv 2024

  7. [6]

    Classification with quantum neural networks on near term processors,

    E. Farhi and H. Neven, “Classification with quantum neural networks on near term processors,” 2018. [Online]. Available: https://arxiv.org/abs/1802.06002

    arXiv 2018

  8. [7]

    Security Concerns in Quantum Machine Learning as a Service

    S. Kundu and S. Ghosh, “Security concerns in quantum machine learning as a service,” 2024. [Online]. Available: https://arxiv.org/abs/2408.09562

    work page Pith review arXiv 2024

Show all 26 references
  1. [8]

    Quantum embeddings for machine learning,

    S. Lloyd, M. Schuld, A. Ijaz, J. Izaac, and N. Killoran, “Quantum embeddings for machine learning,” 2020. [Online]. Available: https://arxiv.org/abs/2001.03622

    2020 arXiv

  2. [9]

    Quantum machine learning in feature hilbert spaces,

    M. Schuld and N. Killoran, “Quantum machine learning in feature hilbert spaces,” Physical Review Letters , vol. 122, no. 4, Feb. 2019. [Online]. Available: http://dx.doi.org/10.1103/PhysRevLett.122.040504

    2019 doi

  3. [10]

    Supervised learning with quantum-enhanced feature spaces,

    V. Havl ´ıˇcek, A. D. C ´orcoles, K. Temme, A. W. Harrow, A. Kandala, J. M. Chow, and J. M. Gambetta, “Supervised learning with quantum-enhanced feature spaces,” Nature, vol. 567, no. 7747, p. 209–212, Mar. 2019. [Online]. Available: http://dx.doi.org/10.1038/s41586-019-0980-2

    2019 doi

  4. [11]

    The quantum imitation game: Reverse engineering of quantum machine learning models,

    A. Ghosh and S. Ghosh, “The quantum imitation game: Reverse engineering of quantum machine learning models,” 2024. [Online]. Available: https://arxiv.org/abs/2407.07237

    2024 arXiv

  5. [12]

    Stealthy swaps: Adversarial swap injection in multi-tenant quantum computing,

    S. Upadhyay and S. Ghosh, “Stealthy swaps: Adversarial swap injection in multi-tenant quantum computing,” 2023. [Online]. Available: https://arxiv.org/abs/2310.17426

    2023 arXiv

  6. [13]

    Improved adversarial training via learned optimizer,

    Y. Xiong and C.-J. Hsieh, “Improved adversarial training via learned optimizer,” 2020. [Online]. Available: https://arxiv.org/abs/2004.12227

    2020 arXiv

  7. [14]

    Unveiling and mitigating adversarial vulner- abilities in iterative optimizers,

    E. Sofer, T. Shaked, C. Chaux, and N. Shlezinger, “Unveiling and mitigating adversarial vulner- abilities in iterative optimizers,” 2025. [Online]. Available: https://arxiv.org/abs/2504.19000

    2025 arXiv

  8. [15]

    Crosstalk-induced side channel threats in multi-tenant nisq computers,

    N. Choudhury, C. N. Mude, S. Das, P. C. Tikkireddi, S. Tannu, and K. Basu, “Crosstalk-induced side channel threats in multi-tenant nisq computers,” 2024. [Online]. Available: https://arxiv.org/abs/2412.10507

    2024 arXiv

  9. [16]

    Qubithammer attacks: Qubit flipping attacks in multi-tenant superconducting quantum computers,

    Y. Tan, N. Choudhury, K. Basu, and J. Szefer, “Qubithammer attacks: Qubit flipping attacks in multi-tenant superconducting quantum computers,” 2025. [Online]. Available: https://arxiv.org/abs/2504.07875

    2025 arXiv

  10. [17]

    Guardians of the quantum gan,

    A. Ghosh, D. Kundu, A. Chatterjee, and S. Ghosh, “Guardians of the quantum gan,” 2024. [Online]. Available: https://arxiv.org/abs/2404.16156

    2024 arXiv

  11. [19]

    Copyqnn: Quantum neural network extraction attack under varying quantum noise,

    Z. Fu, L. Zhao, X. Zhang, Y. Xu, G. Huang, and F. Chen, “Copyqnn: Quantum neural network extraction attack under varying quantum noise,” 2025. [Online]. Available: https://arxiv.org/abs/2504.00366

    2025 arXiv

  12. [20]

    Security attacks abusing pulse-level quantum circuits,

    C. Xu and J. Szefer, “Security attacks abusing pulse-level quantum circuits,” 2024. [Online]. Available: https://arxiv.org/abs/2406.05941 Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses 23

    2024 arXiv

  13. [21]

    Adversarial data poisoning attacks on quantum machine learning in the nisq era,

    S. Kundu and S. Ghosh, “Adversarial data poisoning attacks on quantum machine learning in the nisq era,” 2025. [Online]. Available: https://arxiv.org/abs/2411.14412

    2025 arXiv

  14. [22]

    Qumos: A framework for preserving security of quantum machine learning model,

    Z. Wang, J. Li, Z. Hu, B. Gage, E. Iwasawa, and W. Jiang, “Qumos: A framework for preserving security of quantum machine learning model,” 2023. [Online]. Available: https://arxiv.org/abs/2304.11511

    2023 arXiv

  15. [23]

    Ai-driven reverse engineering of qml models,

    A. Ghosh and S. Ghosh, “Ai-driven reverse engineering of qml models,” 2024. [Online]. Available: https://arxiv.org/abs/2408.16929

    2024 arXiv

  16. [24]

    Locking the design of building blocks for quantum circuits,

    S. M. Saeed, R. Wille, and R. Karri, “Locking the design of building blocks for quantum circuits,” ACM Trans. Embed. Comput. Syst. , vol. 18, no. 5s, Oct. 2019. [Online]. Available: https://doi.org/10.1145/3358184

    2019 doi

  17. [25]

    Opaque: Obfuscating phase in quantum circuit compi- lation for efficient ip protection,

    A. Rehman, V. Langford, and Y. Liu, “Opaque: Obfuscating phase in quantum circuit compi- lation for efficient ip protection,” 2025. [Online]. Available: https://arxiv.org/abs/2502.16605

    2025 arXiv

  18. [2018]

    Available: https://doi.org/10.22331/q-2018-08-06-79

    [Online]. Available: https://doi.org/10.22331/q-2018-08-06-79

    2018 doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.