Pith. sign in

REVIEW 4 major objections 6 minor 31 references

SQUASH: A SWAP-Based Quantum Attack to Sabotage Hybrid Quantum Neural Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SQUASH: inserting SWAP gates into the variational circuit of a hybrid quantum neural network degrades classification accuracy by up to 74.08% without touching inputs or training data.

desk verdict The untargeted attack is plausible; the targeted attack as written is a different attack, and the paper's numbers don't line up. read the letter →

arxiv 2506.24081 v1 pith:2J7LJUIT submitted 2025-06-30 quant-ph cs.AIcs.LG

Rahul Kumar , Wenqi Wei , Ying Mao , Junaid Farooq , Ying Wang , Juntao Chen This is my paper
classification quant-phcs.AIcs.LG
keywords hybridquantumneuralnetworksSWAPgateattackcircuit-levelfidelitytesttargetedmisclassificationmachinelearningsecurityopen-sourcemodeltampering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a small structural change to a hybrid quantum neural network—adding a few SWAP gates to its variational circuit—can destroy classification performance even when the input data and labels are untouched. If correct, this matters because the open-source distribution model for quantum machine learning code gives an attacker a plausible channel: a victim downloads a model and runs a bundled configuration file, and the attack operates entirely inside the quantum processing, leaving no input perturbation for a defender to inspect. The authors report that untargeted SWAP insertions reduce accuracy by up to 74.08% and that targeted insertions reduce a single chosen class's accuracy by up to 79.78% using only two SWAP tests. The broader claim is that fidelity-based classification, the mechanism many HQNNs use to score class similarity, is structurally exposed to gate-level tampering, and defenses must therefore monitor the circuit itself rather than only the data or the loss.

What carries the argument

The central object is the SWAP test, a quantum routine that measures the squared fidelity between two states, $P(0) = (1 + |\langle \psi | \varphi \rangle|^2)/2$, using an ancilla qubit and a controlled-SWAP gate. SQUASH inserts extra SWAP or controlled-SWAP gates into the variational circuit of a 2-qubit HQNN so that the fidelity scores used by the classifier are computed between misaligned qubits rather than the intended reference states. Untargeted attacks scatter these insertions across all qubits, while targeted attacks place two tests to inflate the fidelity between an input and an adversary-chosen target class and deflate it against the correct class, matching the classifier's decision rule $S_i = \sum_j (1 + |\langle x | r^{(i)}_j \rangle|^2)/2$.

What would settle it

Run the same MNIST-2 HQNN twice with the three inserted SWAP tests, once exactly as in the paper and once with the SWAP tests replaced by an equivalent classical perturbation of the output layer; if both degrade accuracy equally, the quantum SWAP mechanism is not needed, whereas if only the SWAP version degrades accuracy, the claimed circuit-level vulnerability is confirmed.

Watch

Extended reading notes

Core claim

SQUASH is a circuit-level attack that inserts SWAP gates directly into the variational quantum circuit of a trained 2-qubit hybrid quantum neural network used for image classification. On MNIST and CIFAR-10 benchmarks, inserting one to three extra SWAP tests reduces clean accuracy from roughly 91–96% (binary) and 77–94% (multiclass) to between 15.84% and 43.91%, with the untargeted attack reaching a maximum reduction of 74.08%. A targeted variant using only two SWAP tests collapses the accuracy of a chosen class to between 15.84% and 20.94% while the overall accuracy falls more moderately, to 54.06–85.16%, which the paper argues makes the attack stealthy because the misclassification is masked by correct predictions on other classes. Because the attack needs no training data and does not perturb input states, the disruption occurs inside the quantum circuit rather than at the data boundary.

Load-bearing premise

The attack's delivery path assumes that a victim downloads an open-source model and unknowingly executes a malicious configuration file, which already grants the attacker code execution on the victim's machine; if that path is unavailable, the SWAP insertion has no vector.

Editorial extensions

If this is right

  • Adding even one extra SWAP test to a trained 2-qubit HQNN can cut binary classification accuracy from above 95% to below 44% on MNIST-2 and from above 90% to below 39% on CIFAR-2.
  • With three untargeted SWAP tests, multiclass accuracy falls to 19.31% on MNIST-10 and 15.84% on CIFAR-10, so the degradation scales with the number of injected gates.
  • A targeted attack needs only two SWAP tests and reduces target-class accuracy to roughly 16–21% while keeping total accuracy above 54%, so aggregate metrics will not reveal the targeted failure.
  • The attack adds about 5.96% (targeted) to 16.05% (untargeted) execution time per epoch, so runtime timing alone is unlikely to expose it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Our inference: because the malicious configuration file in the threat model already executes code on the victim's machine, the SWAP mechanism is one of several possible sabotages, and the paper does not show it is the most practical one.
  • Our inference: the targeted attack's stealth could be tested by per-class accuracy monitoring, since a defender watching class-specific recall would likely notice the 16–21% target-class collapse that aggregate accuracy hides.
  • Our inference: the same SWAP-insertion recipe may transfer to other fidelity-based quantum models, such as quantum kernel estimators or quantum k-NN classifiers that rely on swap tests, but the paper only demonstrates it on one 2-qubit convolutional HQNN architecture.
  • Our inference: a direct comparison against an equivalent random entangling gate (for example, inserting CNOT gates in the same positions) is needed to establish that SWAP gates specifically, rather than any added entangling operation, cause the degradation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes SQUASH, a circuit-level attack that inserts SWAP gates into the variational quantum circuit of a hybrid quantum-classical neural network (HQNN) to sabotage classification. Two attack strategies are presented: an untargeted attack that injects multiple SWAP tests across all qubits, and a targeted attack that claims to insert two SWAP tests to force a chosen input to be misclassified into an adversary-controlled class. Experiments are reported on MNIST-2, CIFAR-2, MNIST-10, and CIFAR-10 using a 2-qubit HQNN in Qiskit, with accuracy, NLL, and runtime overhead comparisons. The abstract claims untargeted attacks reduce accuracy by up to 74.08% and targeted attacks reduce target-class accuracy by up to 79.78%.

Significance. If the attack worked as described, it would expose a practical vulnerability in open-source HQNN implementations and motivate circuit-level defenses. The untargeted degradation is plausible, since the classifier relies directly on swap-test fidelity measurements and inserting extra swap tests should corrupt those measurements. However, the paper as written does not support its central claims: the targeted attack algorithm is inconsistent with the described mechanism, the headline numbers do not match the tables, and the delivery threat model grants the attacker capabilities that make the SWAP-specific mechanism unnecessary. The paper does not release code, and no control experiments isolate a SWAP-specific effect.

major comments (4)
  1. [Algorithm 1 and Section IV-B2] Algorithm 1's targeted branch (lines 8–15) optimizes a perturbation δ in the input state, updating |x'⟩ = e^{iδ}|x⟩ by gradient ascent until F(|ψ_t⟩,|x'⟩) > F(|ψ_c⟩,|x'⟩), and then returns |ψ_t⟩ on line 19. This is an adversarial input-space perturbation, not a SWAP-gate insertion. The surrounding text and Figure 3 describe inserting two SWAP tests into the circuit to corrupt fidelity measurements. Therefore Table II's target-class accuracy drops (19.14%, 18.12%, 20.94%, 15.84%) cannot be attributed to the SQUASH SWAP-insertion mechanism, and the targeted attack claim is unverified as presented. The final return of |ψ_t⟩, a reference state, is also inconsistent with any of the described procedures.
  2. [Abstract and Tables I–II] The abstract's headline numbers are not reproducible from the experimental tables. For untargeted attacks, the largest relative accuracy reduction in Table I is 80.3% (CIFAR-2, 3 SWAP tests: (91.87−18.12)/91.87) and the largest absolute drop is 74.6 percentage points (MNIST-10, 3 SWAP tests: 93.89−19.31); neither equals 74.08%. For targeted attacks, Table II reports only total clean accuracy, not clean target-class accuracy, so the claimed 79.78% reduction cannot be verified. The paper should state exactly which table entries support each abstract claim.
  3. [Section IV-A and Figure 1] The delivery threat model in Section IV-A assumes a user downloads an open-source HQNN and unknowingly executes a malicious configuration file that injects the SQUASH gates. This assumption grants the attacker arbitrary code execution on the victim's machine. Under that assumption, the attacker could equally corrupt classical layers, labels, or output probabilities directly, making the SWAP-specific mechanism unnecessary and weakening the 'stealthy circuit-level' framing. The paper provides no evidence that this config-file delivery path is a more plausible or realistic attack vector than direct tampering, nor does it compare SQUASH against simpler attacks under the same threat model.
  4. [Section V-C and Table I] The experiments do not include control conditions that isolate the SWAP-specific effect. The HQNN classifier uses swap-test fidelities as its classification signal (Eq. 7), so inserting additional SWAP tests into the measurement layer will corrupt the computed fidelities almost by construction. The observed monotonic degradation with increasing SWAP tests is therefore expected for any operation that disrupts the fidelity measurement. Without comparisons to inserting other gate types (e.g., CNOTs, single-qubit rotations, or noise channels) or to a non-SWAP structural modification, the claim that SWAP gates specifically constitute a distinctive vulnerability is not established.
minor comments (6)
  1. [Throughout] The text contains recurring rendering artifacts such as 'SW AP' instead of 'SWAP' in the title, abstract, and figure captions; these should be corrected.
  2. [Section IV-B1] The word 'discrepencies' should be 'discrepancies'.
  3. [Equation (8) and Algorithm 1] The targeted attack uses inconsistent notation: Eq. (8) writes the input as |χ⟩, while Algorithm 1 writes |x⟩ and |x'⟩; make the notation uniform.
  4. [Algorithm 1] The loop structure 'for each qubit ψ in the quantum circuit' is unclear: the fidelity computations and gradient updates appear to involve global states |ψ_t⟩, |ψ_c⟩, and |x⟩, not a single qubit. Clarify whether the perturbation is per-qubit or global.
  5. [Section IV-C and Figures 2–3] Section IV-C states the quantum network uses 2 qubits, but Figure 2 shows three wires (|0⟩, |χ⟩, |ψ⟩). Clarify whether the ancilla qubit is counted separately and how it participates in the encoding.
  6. [Table II] The clean-training NLL for MNIST-10 in Table II is 0.952, whereas Table I lists clean NLL values around 0.09 for MNIST-10; explain whether these are different training runs or a typographical error.

Circularity Check

1 steps flagged · score 6.0 of 10

Targeted SQUASH results are the optimization loop's termination condition, not a SWAP-gate effect.

  1. fitted input called prediction [Algorithm 1, Section IV-B2 (Targeted SWAP Attacks); results in Table II]
    "while Ft ≤ Fc do ... Update perturbation: δ ← δ + η · ∇δ Generate perturbed state: |x′⟩ ← eiδ |x⟩ Recalculate fidelities: Ft ← F(|ψt⟩, |x′⟩) Fc ← F(|ψc⟩, |x′⟩) end while ... return |ψt ⟩"

    The targeted branch of Algorithm 1 applies no SWAP gates; it optimizes an input-space perturbation δ until the target condition Ft > Fc holds, then returns the target reference state |ψt⟩. Table II's targeted target-class accuracies (19.14% on MNIST-2, 20.94% on MNIST-10, etc.) are therefore the loop's own stopping criterion, not a measured effect of the advertised SWAP-insertion attack. Section IV-B2 claims targeted attacks 'only use two SWAP tests to carry out the attack,' but the algorithm contains no such tests. The reported up-to-79.78% targeted reduction is a fitted perturbation renamed as a SWAP attack; it is forced by construction rather than derived from circuit-level manipulation.

full rationale

The untargeted branch of SQUASH is not circular: inserting SWAP gates into a classifier built on swap-test fidelity (Eq. 7) and observing monotone accuracy degradation (Table I) is a direct causal demonstration. The absence of a non-SWAP control gate is an external-validity concern, not a circularity. The targeted branch, however, is circular. Algorithm 1's else-branch never inserts SWAP gates; it starts from an input state, optimizes a perturbation δ until Ft > Fc, and then returns the target reference |ψt⟩. Thus the targeted target-class accuracy collapse in Table II is the algorithm's termination condition, not an independently measured effect of the advertised circuit-level SWAP insertion. The paper's own text in Section IV-B2 says targeted attacks 'only use two SWAP tests,' but this procedure is absent from Algorithm 1, and the numbers in Table II are not traceable to any SWAP-gate insertion. For these reasons, the central targeted claim reduces by construction to the fitting of an input perturbation. No other circular step is identified; the self-citations in the related-work section are contextual and not load-bearing.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on one optimized quantity (the per-sample perturbation delta in Algorithm 1's targeted branch), a scan hyperparameter (number of injected SWAP gates), and three assumptions: standard quantum mechanics for swap-test fidelity, a fidelity-based 2-qubit classifier without permutation symmetry, and a threat model where the victim executes a malicious config file. No new physical entities are introduced.

free parameters (2)
  • per-input perturbation delta in the targeted attack = optimized per sample (gradient ascent, Algorithm 1)
    Algorithm 1 lines 10-15 optimize delta on the input state |x + delta>; as specified, the targeted attack's success depends on this per-sample fitted perturbation rather than on a fixed circuit insertion.
  • number of injected SWAP gates = 1, 2, or 3 swap tests
    Chosen by the attacker; the paper scans these values and shows monotone degradation but gives no rule for the choice, and no error bars over the choice are reported.
assumptions (3)
  • standard math Born rule and unitary gate evolution govern the simulated swap-test circuits.
    Section III computes P(0) = (1 + |<psi|phi>|^2)/2 (Eq. 6) using standard quantum mechanics; this is standard background, not introduced by the paper.
  • domain assumption The victim HQNN classifies by maximizing the sum of swap-test fidelities across reference states (Eq. 7).
    The entire attack mechanism presumes a fidelity-based decision rule and a 2-qubit circuit without permutation symmetry; if the classifier were permutation-invariant, SWAP insertions could be harmless. This is a property of the victim model, assumed without defense analysis.
  • domain assumption The attacker can deliver the attack by having the victim execute a malicious configuration file bundled with a downloaded repository.
    Section IV-A and Figure 1 specify this delivery path; it grants arbitrary code execution and is asserted, not justified with evidence or compared with simpler alternatives.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SQUASH: A SWAP-Based Quantum Attack to Sabotage Hybrid Quantum Neural Networks." pith.science (2026). https://pith.science/paper/2J7LJUIT

@misc{pith2026250624081,
  author       = {Pith},
  title        = {Pith review of: SQUASH: A SWAP-Based Quantum Attack to Sabotage Hybrid Quantum Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2J7LJUIT}},
  note         = {Machine review of arXiv:2506.24081}
}
read the original abstract

We propose a circuit-level attack, SQUASH, a SWAP-Based Quantum Attack to sabotage Hybrid Quantum Neural Networks (HQNNs) for classification tasks. SQUASH is executed by inserting SWAP gate(s) into the variational quantum circuit of the victim HQNN. Unlike conventional noise-based or adversarial input attacks, SQUASH directly manipulates the circuit structure, leading to qubit misalignment and disrupting quantum state evolution. This attack is highly stealthy, as it does not require access to training data or introduce detectable perturbations in input states. Our results demonstrate that SQUASH significantly degrades classification performance, with untargeted SWAP attacks reducing accuracy by up to 74.08\% and targeted SWAP attacks reducing target class accuracy by up to 79.78\%. These findings reveal a critical vulnerability in HQNN implementations, underscoring the need for more resilient architectures against circuit-level adversarial interventions.

Figures

Figures reproduced from arXiv: 2506.24081 by the authors.

Figure 1
Figure 1. Illustration of the user sequence that results in SQUASH being successful. After a user has successfully downloaded the [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. An untargeted attack on a 2-qubit quantum circuit. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Visualization of a Bloch sphere with an untargeted [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Visualization of the execution times across 100 execu [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

31 extracted references · 23 canonical work pages

  1. [1]

    Quantum machine learning,

    J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,” Nature, vol. 549, no. 7671, pp. 195–202, 2017

    2017

  2. [2]

    Challenges and opportunities in quantum machine learning,

    M. Cerezo, G. Verdon, H.-Y . Huang, L. Cincio, and P. J. Coles, “Challenges and opportunities in quantum machine learning,” Nature computational science, vol. 2, no. 9, pp. 567–576, 2022

    2022

  3. [3]

    Quantum machine learning: a classical perspective,

    C. Ciliberto, M. Herbster, A. D. Ialongo, M. Pontil, A. Rocchetto, S. Severini, and L. Wossnig, “Quantum machine learning: a classical perspective,” Proceedings of the Royal Society A: Mathematical, Physi- cal and Engineering Sciences , vol. 474, no. 2209, p. 20170551, 2018

    work page 2018

  4. [4]

    A survey of nisq era hybrid quantum-classical machine learning research,

    G. De Luca, “A survey of nisq era hybrid quantum-classical machine learning research,” Journal of Artificial Intelligence and Technology , vol. 2, no. 1, pp. 9–15, 2022

    work page 2022

  5. [5]

    Hybrid quantum–classical convolutional neural networks with privacy quantum computing,

    S. Huang, Y . Chang, Y . Lin, and S. Zhang, “Hybrid quantum–classical convolutional neural networks with privacy quantum computing,” Quan- tum Science and Technology , vol. 8, no. 2, p. 025015, 2023

    work page 2023

  6. [6]

    Performance anal- ysis of hybrid quantum-classical convolutional neural networks for audio classification,

    Y . Thakar, B. Ghosh, V . Adeshra, and K. Srivastava, “Performance anal- ysis of hybrid quantum-classical convolutional neural networks for audio classification,” in 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT). IEEE, 2024, pp. 1–7

    work page 2024

  7. [7]

    Evaluating hybrid quantum-classical deep learning for cybersecurity botnet dga detection,

    H. Suryotrisongko and Y . Musashi, “Evaluating hybrid quantum-classical deep learning for cybersecurity botnet dga detection,” Procedia Com- puter Science, vol. 197, pp. 223–229, 2022

    work page 2022

  8. [8]

    Open source software in quantum computing,

    M. Fingerhuth, T. Babej, and P. Wittek, “Open source software in quantum computing,” PloS one, vol. 13, no. 12, p. e0208561, 2018

    work page 2018

Show all 31 references
  1. [9]

    Qdoor: Exploiting approximate synthesis for back- door attacks in quantum neural networks,

    C. Chu and et al., “Qdoor: Exploiting approximate synthesis for back- door attacks in quantum neural networks,” in 2023 IEEE International Conference on Quantum Computing and Engineering (QCE) , vol. 1. IEEE, 2023

    2023

  2. [10]

    Quantum trojan insertion: Con- trolled activation for covert circuit manipulation,

    J. John, L. Golla, and Q. Wang, “Quantum trojan insertion: Con- trolled activation for covert circuit manipulation,” arXiv preprint arXiv:2502.08880, 2025

    2025 arXiv

  3. [11]

    Trojaning attack on neural networks,

    Y . Liu and et al., “Trojaning attack on neural networks,” in 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Society, 2018

    2018

  4. [12]

    Adversarial poisoning attack on quantum machine learning models,

    S. Kundu and S. Ghosh, “Adversarial poisoning attack on quantum machine learning models,” arXiv preprint arXiv:2411.14412 , 2024

    2024 arXiv

  5. [13]

    Qtrojan: A circuit backdoor against quantum neural networks,

    C. Chu and et al., “Qtrojan: A circuit backdoor against quantum neural networks,” in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2023

    2023

  6. [14]

    Stealthy swaps: Adversarial swap injection in multi-tenant quantum computing,

    S. Upadhyay and S. Ghosh, “Stealthy swaps: Adversarial swap injection in multi-tenant quantum computing,” 2023. [Online]. Available: https://arxiv.org/abs/2310.17426

    2023 arXiv

  7. [15]

    Comparative analysis of vulnerabilities in classical and quantum machine learning,

    V . Reers and M. Maußner, “Comparative analysis of vulnerabilities in classical and quantum machine learning,” in INFORMATIK 2024 . Gesellschaft f ¨ur Informatik eV , 2024, pp. 555–571

    2024

  8. [16]

    M. A. Nielsen and I. L. Chuang, Quantum computation and quantum information. Cambridge university press, 2010

    2010

  9. [17]

    Circuit-centric quantum classifiers,

    M. Schuld, A. Bocharov, K. M. Svore, and N. Wiebe, “Circuit-centric quantum classifiers,” Physical Review A , vol. 101, no. 3, p. 032308, 2020

    2020

  10. [18]

    The controlled swap test for determining quantum entanglement,

    S. Foulds, V . Kendon, and T. Spiller, “The controlled swap test for determining quantum entanglement,” Quantum Science and Technology, vol. 6, no. 3, p. 035002, 2021

    2021

  11. [19]

    Quantum multi- state swap test: an algorithm for estimating overlaps of arbitrary number quantum states,

    W. Liu, Y .-Z. Li, H.-W. Yin, Z.-R. Wang, and J. Wu, “Quantum multi- state swap test: an algorithm for estimating overlaps of arbitrary number quantum states,” EPJ Quantum Technology, vol. 11, no. 1, p. 46, 2024

    2024

  12. [20]

    Quantum k-nearest neighbors: Utilizing qram and swap-test techniques for enhanced performance,

    A. Maldonado-Romo, J. Y . Montiel-P ´erez, V . Onofre, J. Maldonado- Romo, and J. H. Sossa-Azuela, “Quantum k-nearest neighbors: Utilizing qram and swap-test techniques for enhanced performance,” Mathematics, vol. 12, no. 12, p. 1872, 2024

    2024

  13. [21]

    Tutorial on the quantikz package,

    A. Kay, “Tutorial on the quantikz package,” arXiv preprint arXiv:1809.03842, 2018

    2018

  14. [22]

    Swap test-based charac- terization of decoherence in universal quantum computers,

    P. Ripper, G. Amaral, and G. Tempor ˜ao, “Swap test-based charac- terization of decoherence in universal quantum computers,” Quantum Information Processing, vol. 22, no. 5, p. 220, 2023

    2023

  15. [23]

    Advqunn: A methodology for analyzing the adversarial robustness of quanvolutional neural networks,

    W. El Maouaki, A. Marchisio, T. Said, M. Bennai, and M. Shafique, “Advqunn: A methodology for analyzing the adversarial robustness of quanvolutional neural networks,” in 2024 IEEE International Conference on Quantum Software (QSW) . IEEE, 2024, pp. 175–181

    2024

  16. [24]

    Robqunns: A methodology for robust quanvolutional neural networks against adversarial attacks,

    W. El Maouaki, A. Marchisio, T. Said, M. Shafique, and M. Bennai, “Robqunns: A methodology for robust quanvolutional neural networks against adversarial attacks,” in 2024 IEEE International Conference on Image Processing Challenges and Workshops (ICIPCW) . IEEE, 2024, pp. 4090–4095

    2024

  17. [25]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  18. [26]

    The cifar-10 dataset,

    A. Krizhevsky, V . Nair, G. Hinton et al., “The cifar-10 dataset,” online: http://www. cs. toronto. edu/kriz/cifar. html , vol. 55, no. 5, p. 2, 2014

    2014

  19. [27]

    Pytorch: An imperative style, high-performance deep learn- ing library,

    A. Paszke, “Pytorch: An imperative style, high-performance deep learn- ing library,” arXiv preprint arXiv:1912.01703 , 2019

    1912 arXiv

  20. [28]

    Born’s rule and measurement,

    A. Neumaier, “Born’s rule and measurement,” arXiv preprint arXiv:1912.09906, 2019

    1912 arXiv

  21. [29]

    Ai-driven reverse engineering of qml models,

    A. Ghosh and S. Ghosh, “Ai-driven reverse engineering of qml models,” arXiv preprint arXiv:2408.16929 , 2024

    2024 arXiv

  22. [30]

    Qml-ids: Quantum machine learning intrusion detection system,

    D. Abreu, C. E. Rothenberg, and A. Abel ´em, “Qml-ids: Quantum machine learning intrusion detection system,” in 2024 IEEE Symposium on Computers and Communications (ISCC) . IEEE, 2024, pp. 1–6

    2024

  23. [31]

    A survey of hardware trojan threat and defense,

    H. Li, Q. Liu, and J. Zhang, “A survey of hardware trojan threat and defense,” Integration, vol. 55, pp. 426–437, 2016

    2016

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.