Pith. sign in

REVIEW 5 major objections 6 minor 2 cited by

Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A quantum-trained weighting network can select clean subsets from poisoned image data at 0% contamination, matching the best classical sifter.

desk verdict First quantum-based poisoning defense that honestly reports simulated results, but the central QUBO training mechanism is unspecified and the guided-state term is circular; the reported NCR=0 results are not attributable to the described quantum method. read the letter →

arxiv 2507.06262 v1 pith:4A25BCJ3 submitted 2025-07-07 cs.CR cs.AIcs.LGquant-ph

Haoqi He , Xiaokai Lin , Jiancai Chen , Yan Xiao This is my paper
classification cs.CRcs.AIcs.LGquant-ph
keywords datapoisoningattacksdetectionquantum-classicalhybriddefenseQUBOoptimizationIsingmodelquantumannealingbackdoorcleansubsetselection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Q-Detection is a quantum-classical hybrid defense that claims to detect data-poisoning attacks by selecting a clean training subset from a poisoned dataset. The method trains a one-hidden-layer Quantum Weight-Assigning Network (Q-WAN) by encoding its training as a quadratic optimization problem and solving it on quantum devices, then uses the network's per-sample weights to filter poisoned data. Experiments on the GTSRB traffic-sign dataset report 0% Normalized Corruption Ratio (0% means the chosen subset is completely clean) for targeted label-flipping, BadNets, and Narcissus backdoor attacks when the Q-WAN uses 5000 simulated qubits, matching the state-of-the-art classical method and often improving downstream model accuracy. The authors further estimate that running the same solver on real quantum hardware would cut filtering time by more than 20% relative to a CUDA-accelerated classical baseline. If correct, Q-Detection offers a concrete route for poisoning defense to inherit quantum speedup without needing a clean benchmark set.

What carries the argument

The load-bearing mechanism is the Q-WAN, a one-hidden-layer weight-assigning network whose training is reformulated as a quadratic unconstrained binary optimization (QUBO) problem and solved by energy minimization on quantum devices. The training loop follows an equilibrium-propagation-like rule: the system first relaxes to a free spin state, then to a guided state with the extra coupling term $C(\sigma_y, \hat{\sigma}_y)$ that nudges output neurons toward target values, and the weight update is the difference between the two states' spin-pair correlations. This single mechanism converts the sample-weighting subproblem into a form that quantum annealers, coherent Ising machines, and gate-model QAOA circuits can all solve, and it is what lets Q-Detection filter poisoned samples by assigning low weights to high-loss points.

What would settle it

A concrete test is to reconstruct the coefficient matrix $Q$ and coupling strengths $J_{ij}$ required by the QUBO encoding in Section 3.2 and run the free/guided update rule on a classical simulator. If the resulting NCR on the same GTSRB settings is not 0%, or if replacing the quantum solver with random spin sampling also gives 0% NCR, then the quantum-trained Q-WAN is not doing the work the paper claims.

Watch

Extended reading notes

Core claim

The paper's central claim is that poisoned-data detection can be recast as a bilevel optimization problem whose inner weighting network is trainable on quantum hardware. A domain model and a virtual model alternate with the Q-WAN, which assigns each sample a weight from its cross-entropy loss; the outer objective maximizes the weighted loss of low-confidence (poisoned) samples while the inner objective minimizes the weighted loss of high-confidence (clean) samples. The Q-WAN itself is trained by encoding it as a QUBO/Ising energy $E = \sum_{i>j} J_{ij}\sigma_i\sigma_j + \sum_i h_i\sigma_i$, sampling a free low-energy state and a guided state nudged by a coupling term $C(\sigma_y, \hat{\sigma}_y)$, and updating coupling strengths from the difference of spin-pair correlations $(\sigma_i\sigma_j)_{\mathrm{guided}} - (\sigma_i\sigma_j)_{\mathrm{free}}$. On GTSRB, Q-Detection with 5000 simulated qubits reaches 0% NCR across all tested poison ratios for three attack families, consistently beats DCM, LossScan, and autoencoder baselines, and yields downstream model accuracy that matches or slightly exceeds Meta-Sift.

Load-bearing premise

The load-bearing premise is that a one-hidden-layer weighting network can be trained faithfully by casting it as a quadratic optimization problem and comparing two spin states; the paper never actually writes the coefficient matrix that would turn the network's weights into that quadratic form, so if no such encoding exists the quantum training loop lacks a foundation.

Editorial extensions

If this is right

  • If the results hold, poisoning defense no longer requires a clean validation set: the same bi-level weighting procedure identifies poisoned samples and trains a usable model on the remaining subset.
  • The 0% NCR reported on GTSRB means the downstream model is trained on entirely clean data for the tested attacks, so attack success rates should drop to the level of an unpoisoned model.
  • Because the Q-WAN's hidden-layer size equals the number of qubits, increases in quantum hardware size translate directly into stronger filtering, giving the method a scaling path tied to hardware progress.
  • If the projected 20% runtime speedup materializes, the most expensive part of sample-weighting defenses—repeatedly computing per-sample losses—can be offloaded to quantum solvers.
  • The same QUBO backbone is compatible with several quantum solver families, so the defense is not locked to a single hardware vendor.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit is that the 0% NCR may owe more to the inherited Meta-Sift-style bi-level sifting framework than to the quantum-trained Q-WAN; the paper's own comparison shows both methods reach 0% NCR, with Q-Detection's advantage showing up mainly in downstream accuracy.
  • A direct test would replace the quantum solver with classical simulated annealing on the same free/guided rule; if NCR stays at 0%, the quantum component is not the source of detection quality, only of the projected speedup.
  • The speedup estimate assumes the 10^3 simulator-to-hardware ratio measured on a 550-qubit coherent Ising machine transfers to the full Q-Detection loop; qubit connectivity and embedding overhead on real annealers could erode much of that gain.
  • If the hidden-layer-size-to-qubits scaling continues, the practical ceiling on near-term hardware is set by qubit count, not by dataset size, so the method's real-world usefulness will track quantum hardware roadmaps.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes Q-Detection, a quantum-classical hybrid defense against data poisoning attacks. The method trains a Quantum Weight-Assigning Network (Q-WAN) by encoding its training as a QUBO/Ising problem, sampling free and guided spin states on quantum devices or simulators, and using equilibrium-propagation-like spin-pair differences to update couplings. The Q-WAN assigns sample weights that are used to filter a clean subset from a poisoned dataset. Experiments on GTSRB compare Q-Detection against DCM, LossScan, Autoencoder Outlier, and Meta-Sift under Targeted Label-Flipping, BadNets, and Narcissus attacks, reporting NCR (normalized corruption ratio) and downstream ResNet-18 accuracy. The paper also provides a theoretical estimate of more than 20% speedup from real quantum hardware.

Significance. If the central mechanism were fully specified and validated, Q-Detection would be a novel integration of quantum optimization into data-poisoning defense, and the reported NCR=0 results at 5000 qubits would be notable. The authors provide code and compare against Meta-Sift, a strong state-of-the-art baseline, and evaluate both subset cleanliness and downstream model accuracy. However, the significance is conditional: the QUBO encoding of the Q-WAN is never actually given, the guided-excitation training rule is internally inconsistent, the speedup estimate rests on an unverified hardware speedup assumption, and the abstract's claim of consistent superiority is contradicted by the 500-qubit results in Table 1. As presented, the paper does not establish that any quantum-specific mechanism is responsible for the empirical results.

major comments (5)
  1. [Section 3.2] The QUBO encoding of the Q-WAN is asserted but never specified. Section 3.2 states that 'Q-WAN training encodes the network as a QUBO,' but no matrix Q for Eq. (1), no Ising coefficients Jij and hi for Eq. (2), and no mapping from the real-valued Q-WAN parameters psi to spin variables are provided. Without this mapping, the simulated QUBO solves reported in Section 4 cannot be checked against the optimization objective in Eq. (4), and the NCR=0 results at 5000 qubits cannot be attributed to the described quantum-classical training mechanism. This is load-bearing because the only novel component of Q-Detection relative to Meta-Sift is precisely this QUBO-based training procedure.
  2. [Section 3.2, Eq. (7)] The guided excitation term is defined inconsistently. Eq. (7) writes E' = E + C(sigma_y, sigma_hat_y), but the text then states that C(sigma_y, sigma_hat_y) = psi* in the Adversarial Filtering Stage and C(sigma_y, sigma_hat_y) = theta*(psi) in the other stages. psi* and theta*(psi) are parameter vectors from Eq. (4), not spin configurations, so they cannot be added to an Ising energy over spin variables without a defined embedding. Moreover, psi* is the optimum being sought in Eq. (4), so the target state needed to compute gradients is defined in terms of the solution the training is supposed to find; this is circular. The symbols y and sigma_hat_i are also not defined precisely enough to determine what the 'guided state' is.
  3. [Section 3.3, Eqs. (8)-(10)] The gradient rule is not connected to the Q-WAN parameters or the bilevel objective. Eqs. (8) and (9) define L1 and L2 as arg min expressions rather than scalar loss values, so they do not provide the discrepancy measures the text says they define. Eq. (10) updates Jij with spin-pair correlations, but no equation relates the spin variables to the network parameters psi or to the loss S(L_i(theta); psi) used in Eq. (4). Without this connection, the learning rule is not a derivation from the stated optimization problem, and the experiments in Section 4 cannot be interpreted as training the Q-WAN of Eq. (4).
  4. [Section 4.2, Table 1] The abstract claims Q-Detection 'consistently outperforms the baseline methods and is comparable to the state-of-the-art,' but Table 1 shows that at 500 qubits Q-Detection is substantially worse than the random baseline in several settings: NCR is 180% and 267% for Narcissus at 20% poisoning, and 110.14%, 330%, 231.24%, and 365.57% for BadNets at 10% and 30% poisoning. These values are far above the 100% random baseline, so the claim of consistent superiority is not supported. The claim should be restricted to the 5000-qubit simulation setting, and the discrepancy should be discussed rather than left implicit in the table.
  5. [Section 4.4] The 'more than 20% speedup' conclusion is an arithmetic exercise based on an assumed 10^3 speedup factor for real quantum hardware over simulation, not a measurement. The text states that the real-machine computation time is 'significantly less' on D-Wave and QBoson devices, but no end-to-end comparison accounts for quantum-classical transfer, QUBO embedding, sampling overhead, or the fact that the Q-WAN training loop requires thousands of calls to the quantum device. The calculation '2.1 + 0.0669 = 2.17 minutes' also appears to mix units (minutes and hours) without explanation. The speedup claim is therefore not established and should be presented as a speculative projection, not a theoretical result.
minor comments (6)
  1. [Throughout] The name Q-WAN is written both as 'Q-WAN' and 'Q-W AN' in many places; please use one consistent notation.
  2. [Section 2.2, Eq. (1)] The QUBO objective is written as min x^T Q x + sum h_i x_i, but x^T Q x is not a QUBO unless the linear term is folded into the diagonal of Q; please clarify the convention used.
  3. [Section 4.1, Eq. (12)] The text says 'NCR matrices normalize away the imbalance,' which appears to be a typo for 'NCR metric normalizes away the imbalance.'
  4. [Section 4.2, Table 1] The table columns for Q-Detection settings are hard to parse because the solver names and qubit counts run together; adding explicit column headers such as 'Q-Det. CQPC (500 qubits)' would improve readability.
  5. [Section 4.2] The sentence 'The SOTA method Meta-Sift achieves the best NCR metrics under all attack types' is not consistent with Table 1, where Q-Detection at 5000 qubits also achieves 0% NCR in many rows; please rephrase to avoid ambiguity.
  6. [Section 4.4] The estimate of 220 epochs for batch size 179 and 892 epochs for batch size 44 is stated without explaining how these numbers were derived; adding the formula or reference would make the calculation reproducible.

Circularity Check

2 steps flagged · score 6.0 of 10

The Q-WAN quantum training loop is self-referential: Eq. (7) sets the guided-excitation target to the unknown optima ψ* and θ*(ψ), so the gradient signal is defined in terms of the solution it is supposed to produce; the >20% speedup 'prediction' is arithmetic from a measured 10^3 hardware speedup ratio.

  1. self definitional [Section 3.2, Eq. (7) (guided excitation term in the Q-WAN energy function)]
    "When the system is in the ground state (free evolution), C(σ y, ˆσ y) = 0 ; when guided excitation is introduced, C(σ y, ˆσ y) = ψ∗ (Adversarial Filtering Stage) or C(σ y, ˆσ y) = θ∗(ψ) (Selective Learning Stage and Actual-update Stage)."

    The guided excitation is supposed to define the target output state used to produce the free/guided correlation difference in Eq. (10), which is then applied as the gradient update for the Q-WAN parameters. But the paper defines this target as ψ*, the arg-max solution of Eq. (4) that the training is supposed to find, and θ*(ψ), the inner arg-min solution. The training signal therefore presupposes the optima it is meant to compute. No independent target state is provided, so the quantum training loop in Section 3.3 reduces to 'use the unknown solution as the guided target, then update toward it.' This is self-definitional and makes the described quantum gradient uncomputable from the data alone.

  2. fitted input called prediction [Section 4.4, 'Quantitative Estimate of the Time Superiority']
    "We conducted tests on QBoson Inc’s 550-qubit CQPC, obtaining an average time difference between simulated quantum computing and real machines of 10^3. ... Each batch of data training still consumes 4.5 seconds of computation time, requiring a total of 3,568 calls to quantum computing devices and spending 66.9 minutes on simulated quantum computing. Thus, we estimate the total training time with integrated CIM computing power to be approximately 2.1 + 0.0669 = 2.17 minutes, achieving over a 20% acceleration compared to Meta-Sift purely accelerated by CUDA."

    The abstract's 'theoretical analysis shows more than 20% speedup' is not a derived quantum advantage; it is the assumed/measured 10^3 real-machine-over-simulation ratio fed through arithmetic. 66.9 minutes divided by 10^3 gives the 0.0669 minutes term, and 2.17 minutes versus Meta-Sift's ~3 minutes is exactly that ratio applied to the 3,568 quantum calls. The speedup conclusion is therefore forced by the input hardware-speed factor rather than predicted from an independent analysis of Q-Detection's algorithm. It is a fitted input renamed as a predicted speedup.

full rationale

The strongest independent content in the paper is the empirical NCR comparison: Q-Detection with 5000 simulated qubits reaches 0% NCR on all tested attacks, matching Meta-Sift, and the paper reports accuracy plots on filtered subsets. Those results could in principle be reproduced from the released code and are not circular in themselves. However, the paper's central novel mechanism — training the Q-WAN by converting it to a QUBO and using free/guided equilibrium propagation — is where the derivation becomes self-referential. Eq. (7) sets the guided-excitation target to ψ* and θ*(ψ), the very optima being sought, so the gradient rule of Eq. (10) is defined in terms of the solution it is supposed to produce. The missing Q-matrix/weight-to-spin mapping (Section 3.2 claims 'Q-WAN training encodes the network as a QUBO' but never gives the Q of Eq. (1) or the Jij/hi of Eq. (2)) is a completeness gap rather than a circular step, but it compounds the problem because it prevents checking whether the simulated QUBO solves in Section 4 are solving Eq. (4). The 20% speedup statement is a conditional extrapolation from a measured hardware ratio and belongs to the fitted-input/prediction pattern rather than an independent result. The paper's self-citations ([He and Xiao 2025], [He 2024]) are used only to motivate quantum acceleration and are not load-bearing for the detection mechanism. On balance, the central Q-WAN training claim partially reduces to its own inputs, so a score of 6 is appropriate; the empirical detection comparison remains checkable and could be valid even if the quantum training narrative is circular.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The paper adds a new component (Q-WAN) but no new physical entities. The main burden is the unproven reduction of Q-WAN training to a QUBO problem, the borrowed equilibrium propagation rule, and an assumed hardware speedup factor used to manufacture the 20% speedup claim.

free parameters (2)
  • Q-WAN hidden layer size (qubit count) = 20, 500, 5000
    The paper varies hidden-layer neurons equal to the number of qubits and shows that detection capability depends on this size. It is a hand-chosen architectural capacity parameter, not determined by the problem.
  • Real-hardware speedup factor = 10^3
    Section 4.4 assumes real quantum hardware is 1000 times faster than simulation. The 20% speedup result is directly proportional to this number; it is asserted from unreported tests, not fitted to data.
assumptions (4)
  • domain assumption Equilibrium propagation gradient rule (Eq. 10) correctly trains the weight-assigning network when free and guided Ising states are sampled from a quantum annealer.
    Borrowed from Laydevant et al. 2024; the paper does not prove it applies to the Q-WAN architecture or its unspecified QUBO encoding.
  • domain assumption Data poisoning shifts loss distributions so that maximizing weighted loss on low-weight samples and minimizing it on high-weight samples separates clean from poisoned data.
    This is the Meta-Sift premise, adopted without independent evidence beyond the cited Meta-Sift paper.
  • ad hoc to paper Real quantum devices (D-Wave QA, QBoson CIM) are at least 1000 times faster than simulated quantum solvers for this workload.
    Section 4.4 uses a 10^3 speedup factor derived from 'tests' with no protocol or numbers reported; the 20% speedup claim depends on this ratio.
  • domain assumption Spin variables of output neurons can be measured and used as activations for a one-hidden-layer network.
    Section 3.3 assumes measured spins correspond to network outputs, but the mapping from network weights to Jij is not specified.
invented entities (1)
  • Q-WAN (Quantum Weight-Assigning Network) independent evidence
    purpose: A one-hidden-layer network trained by quantum equilibrium propagation to assign high weights to clean samples and low weights to poisoned samples.
    Its behavior is testable with the provided code and public dataset, but its exact QUBO encoding is not specified in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method." pith.science (2026). https://pith.science/paper/4A25BCJ3

@misc{pith2026250706262,
  author       = {Pith},
  title        = {Pith review of: Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4A25BCJ3}},
  note         = {Machine review of arXiv:2507.06262}
}
read the original abstract

Data poisoning attacks pose significant threats to machine learning models by introducing malicious data into the training process, thereby degrading model performance or manipulating predictions. Detecting and sifting out poisoned data is an important method to prevent data poisoning attacks. Limited by classical computation frameworks, upcoming larger-scale and more complex datasets may pose difficulties for detection. We introduce the unique speedup of quantum computing for the first time in the task of detecting data poisoning. We present Q-Detection, a quantum-classical hybrid defense method for detecting poisoning attacks. Q-Detection also introduces the Q-WAN, which is optimized using quantum computing devices. Experimental results using multiple quantum simulation libraries show that Q-Detection effectively defends against label manipulation and backdoor attacks. The metrics demonstrate that Q-Detection consistently outperforms the baseline methods and is comparable to the state-of-the-art. Theoretical analysis shows that Q-Detection is expected to achieve more than a 20% speedup using quantum computing power.

Figures

Figures reproduced from arXiv: 2507.06262 by the authors.

Figure 1
Figure 1. Q-Detection uses a one-hidden-layer network which is trained by quantum methods to filter poisoned data by assigning probabilities [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Under the Target Label flipping attack, we consider the poisoning ratio from 3% to 30%, and Q-WAN has 500 hidden layer neurons, [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

    cs.LG 2026-04 unverdicted novelty 6.0 of 10

    FineSteer decomposes inference-time steering into Subspace-guided Conditional Steering and Mixture-of-Steering-Experts to deliver stronger control over LLM behaviors with less utility loss than prior methods.

  2. Quantum Adversarial Machine Learning: From Classical Adaptations to Quantum-Native Methods

    cs.LG 2026-05 unverdicted novelty 1.0 of 10

    A survey of quantum adversarial machine learning covering attacks, countermeasures, theoretical underpinnings, trends, and challenges.

Reference graph

Works this paper leans on

39 extracted references · 37 canonical work pages · cited by 2 Pith papers

  1. [1]

    Challenges and opportunities in quantum machine learn- ing

    [Cerezo et al., 2022] Marco Cerezo, Guillaume Verdon, Hsin-Yuan Huang, Lukasz Cincio, and Patrick J Coles. Challenges and opportunities in quantum machine learn- ing. Nature Computational Science, 2(9):567–576,

    work page 2022

  2. [9]

    A tutorial on formulating and using qubo models

    [Glover et al., 2019] Fred Glover, Gary Kochenberger, and Yu Du. A tutorial on formulating and using qubo models

    work page 2019

  3. [10]

    Badnets: Evaluating back- dooring attacks on deep neural networks

    [Gu et al., 2019] Tianyu Gu, Kang Liu, Brendan Dolan- Gavitt, and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. IEEE Access, 7:47230–47244,

    work page 2019

  4. [11]

    Probabilistic Quantum SVM Training on Ising Machine

    [He and Xiao, 2025] Haoqi He and Yan Xiao. Probabilistic quantum svm training on ising machine. arXiv preprint arXiv:2503.16363,

    work page Pith review arXiv 2025

  5. [12]

    Towards security threats of deep learning systems: A survey

    [He et al., 2020] Yingzhe He, Guozhu Meng, Kai Chen, Xingbo Hu, and Jinwen He. Towards security threats of deep learning systems: A survey. IEEE Transactions on Software Engineering, 48(5):1743–1770,

    work page 2020

  6. [14]

    Technical de- scription of the d-wave quantum processing unit,

    [Headquarters, 2020] Corporate Headquarters. Technical de- scription of the d-wave quantum processing unit,

    work page 2020

  7. [15]

    100,000-spin coherent ising ma- chine

    [Honjo et al., 2021] Toshimori Honjo, Tomohiro Sonobe, Kensuke Inaba, Takahiro Inagaki, Takuya Ikuta, Yasuhiro Yamada, Takushi Kazama, Koji Enbutsu, Takeshi Umeki, Ryoichi Kasahara, et al. 100,000-spin coherent ising ma- chine. Science advances, 7(40):eabh0952,

    work page 2021

  8. [18]

    Adversarial machine learning-industry perspectives

    [Kumar et al., 2020] Ram Shankar Siva Kumar, Magnus Nystr¨om, John Lambert, Andrew Marshall, Mario Go- ertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. Adversarial machine learning-industry perspectives. In 2020 IEEE security and privacy workshops (SPW) , pages 69–75. IEEE,

    work page 2020

Show all 39 references
  1. [19]

    Efficient quantum computing using co- herent photon conversion

    [Langford et al., 2011] Nathan K Langford, Sven Ramelow, Robert Prevedel, William J Munro, Gerard J Milburn, and Anton Zeilinger. Efficient quantum computing using co- herent photon conversion. Nature, 478(7369):360–363,

    2011

  2. [21]

    Weakly supervised energy-based learning for action seg- mentation

    [Li et al., 2019] Jun Li, Peng Lei, and Sinisa Todorovic. Weakly supervised energy-based learning for action seg- mentation. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6243–6251,

    2019

  3. [22]

    Anti-backdoor learning: Training clean models on poisoned data

    [Li et al., 2021] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems , 34:14900–14912,

    2021

  4. [23]

    [Li et al., 2025] Y . Li, R. Du, and Y . Zhang. Adversarial data poisoning attacks on quantum machine learning. arXiv preprint,

    2025

  5. [24]

    Mathematical foundation of quantum anneal- ing

    [Morita and Nishimori, 2008] Satoshi Morita and Hidetoshi Nishimori. Mathematical foundation of quantum anneal- ing. Journal of Mathematical Physics, 49(12),

    2008

  6. [26]

    Quantum annealing: An overview

    [Rajak et al., 2023] Atanu Rajak, Sei Suzuki, Amit Dutta, and Bikas K Chakrabarti. Quantum annealing: An overview. Philosophical Transactions of the Royal Soci- ety A, 381(2241):20210417,

    2023

  7. [27]

    Bringing quantum acceleration to supercomputers

    [Ruefenacht et al., 2022] Martin Ruefenacht, Bruno G Taketani, PASI L¨ahteenm¨aki, VILLE Bergholm, DIETER Kranzlm¨uller, LAURA Schulz, and MARTIN Schulz. Bringing quantum acceleration to supercomputers. IQM/LRZ Technical Report, https://www. quantu m. lrz. de/fileadmin/QIC/Dow...

    2022

  8. [28]

    Energy-based learning algorithms for analog computing: a comparative study

    [Scellier et al., 2024] Benjamin Scellier, Maxence Ernoult, Jack Kendall, and Suhas Kumar. Energy-based learning algorithms for analog computing: a comparative study. Advances in Neural Information Processing Systems , 36,

    2024

  9. [29]

    Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks

    [Schwarzschild et al., 2021] Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning , pages 9389–9398. PMLR,

    2021

  10. [30]

    The german traffic sign recognition benchmark: a multi-class classification competition

    [Stallkamp et al., 2011] Johannes Stallkamp, Marc Schlips- ing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. In The 2011 international joint conference on neural networks, pages 1453–1460. IEEE,

    2011

  11. [31]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    [Wang et al., 2019] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In2019 IEEE sympo- sium on security and privacy (SP) , pages 707–723. IEEE,

    2019

  12. [32]

    Threats to training: A survey of poisoning attacks and defenses on machine learning systems

    [Wang et al., 2022] Zhibo Wang, Jingjing Ma, Xue Wang, Jiahui Hu, Zhan Qin, and Kui Ren. Threats to training: A survey of poisoning attacks and defenses on machine learning systems. ACM Computing Surveys, 55(7):1–36,

    2022

  13. [33]

    Benchmark- ing advantage and d-wave 2000q quantum annealers with exact cover problems

    [Willsch et al., 2022] Dennis Willsch, Madita Willsch, Car- los D Gonzalez Calaza, Fengping Jin, Hans De Raedt, Marika Svensson, and Kristel Michielsen. Benchmark- ing advantage and d-wave 2000q quantum annealers with exact cover problems. Quantum Information Processing, 21(4):141,

    2022

  14. [34]

    High-speed train timetable optimization based on space– time network model and quantum simulator

    [Xu et al., 2023] Hui-Zhang Xu, Jun-Hua Chen, Xing-Chen Zhang, Te-Er Lu, Tian-Ze Gao, Kai Wen, and Yin Ma. High-speed train timetable optimization based on space– time network model and quantum simulator. Quantum In- formation Processing, 22(11):418,

    2023

  15. [35]

    Adversarial unlearning of backdoors via implicit hypergradient

    [Zeng et al., 2022] Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations,

    2022

  16. [36]

    Narcis- sus: A practical clean-label backdoor attack with limited information

    [Zeng et al., 2023b] Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcis- sus: A practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages 771–785,

    2023

  17. [37]

    Quan- tum computational advantage using photons

    [Zhong et al., 2020] Han-Sen Zhong, Hui Wang, Yu-Hao Deng, Ming-Cheng Chen, Li-Chao Peng, Yi-Han Luo, Jian Qin, Dian Wu, Xing Ding, Yi Hu, et al. Quan- tum computational advantage using photons. Science, 370(6523):1460–1463,

    2020

  18. [38]

    Anomaly detection with robust deep autoen- coders

    [Zhou and Paffenroth, 2017] Chong Zhou and Randy C Paf- fenroth. Anomaly detection with robust deep autoen- coders. In Proceedings of the 23rd ACM SIGKDD in- ternational conference on knowledge discovery and data mining, pages 665–674,

    2017

  19. [39]

    Qaoa-in-qaoa: solving large-scale max- cut problems on small quantum machines

    [Zhou et al., 2023] Zeqiao Zhou, Yuxuan Du, Xinmei Tian, and Dacheng Tao. Qaoa-in-qaoa: solving large-scale max- cut problems on small quantum machines. Physical Re- view Applied, 19(2):024027, 2023

    2023

  20. [2008]

    Mg-net: Learn to customize qaoa with circuit depth awareness

    [Qian et al., 2024] Yang Qian, Xinbiao Wang, Yuxuan Du, Yong Luo, and Dacheng Tao. Mg-net: Learn to customize qaoa with circuit depth awareness. In The Thirty-eighth Annual Conference on Neural Information Processing Sys- tems,

    2024

  21. [2011]

    Training an ising machine with equilibrium propagation

    [Laydevant et al., 2024] J´er´emie Laydevant, Danijela Markovi´c, and Julie Grollier. Training an ising machine with equilibrium propagation. Nature Communications, 15(1):3671,

    2024

  22. [2015]

    Energy-based learning for preventing backdoor attack

    [Gao and Qiu, 2022] Xiangyu Gao and Meikang Qiu. Energy-based learning for preventing backdoor attack. In International Conference on Knowledge Science, Engineering and Management , pages 706–721. Springer,

    2022

  23. [2017]

    Label poisoning is all you need

    [Jha et al., 2023] Rishi Jha, Jonathan Hayase, and Sewoong Oh. Label poisoning is all you need. Advances in Neural Information Processing Systems, 36:71029–71052,

    2023

  24. [2018]

    Quantum machine learning: A hands-on tutorial for machine learning practi- tioners and researchers

    [Du et al., 2025] Yuxuan Du, Xinbiao Wang, Naixu Guo, Zhan Yu, Yang Qian, Kaining Zhang, Min-Hsiu Hsieh, Patrick Rebentrost, and Dacheng Tao. Quantum machine learning: A hands-on tutorial for machine learning practi- tioners and researchers. arXiv preprint arXiv:2502.01146,

    2025 arXiv

  25. [2019]

    Qtrojan: A circuit backdoor against quantum neural networks

    [Chu et al., 2023] Cheng Chu, Lei Jiang, Martin Swany, and Fan Chen. Qtrojan: A circuit backdoor against quantum neural networks. In ICASSP 2023-2023 IEEE Interna- tional Conference on Acoustics, Speech and Signal Pro- cessing (ICASSP), pages 1–5. IEEE,

    2023

  26. [2020]

    Quantum annealing and gnn for solv- ing tsp with qubo

    [He, 2024] Haoqi He. Quantum annealing and gnn for solv- ing tsp with qubo. In International Conference on Algo- rithmic Aspects in Information and Management , pages 134–145. Springer,

    2024

  27. [2021]

    Inagaki, K

    [Inagaki et al., 2017] T. Inagaki, K. Inaba, and R. Kawa- mura. Coherent ising machines—optical neural networks operating at the quantum limit. npj Quantum Information, 3:23,

    2017

  28. [2022]

    Application study of simulated an- nealing solver and cim simulator based on qubo model us- ing kaiwu sdk

    [Chi, 2024] Ming Chi. Application study of simulated an- nealing solver and cim simulator based on qubo model us- ing kaiwu sdk. In 2024 International Conference on Elec- tronics and Devices, Computational Science (ICEDCS) , pages 902–907. IEEE,

    2024

  29. [2023]

    The ibm q experience and qiskit open-source quantum computing software

    [Cross, 2018] Andrew Cross. The ibm q experience and qiskit open-source quantum computing software. In APS March meeting abstracts , volume 2018, pages L58–003,

    2018

  30. [2024]

    A tutorial on quantum approximate optimization algorithm (qaoa): Fundamentals and applications

    [Choi and Kim, 2019] Jaeho Choi and Joongheon Kim. A tutorial on quantum approximate optimization algorithm (qaoa): Fundamentals and applications. In 2019 interna- tional conference on information and communication tech- nology convergence (ICTC), pages 138–142. IEEE,

    2019

  31. [2025]

    Model inversion attacks that exploit confidence information and basic countermeasures

    [Fredrikson et al., 2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on com- puter and communications security , pages 1322–1333,

    2015

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.