Quantum Properties Trojans (QuPTs) for Attacking Quantum Neural Networks

Himanshu Thapliyal; Sounak Bhowmik; Travis S. Humble

REVIEW 5 major objections 5 minor 12 references

Quantum Properties Trojans (QuPTs) for Attacking Quantum Neural Networks

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Quantum Properties Trojans exploit unitary cancellation and Hadamard interference to secretly degrade quantum neural networks, with the strongest reported attack cutting accuracy by 23 percent under cloud noise.

desk verdict A clean but thin proof-of-concept: the paper shows that inserting extra gates into a QNN degrades accuracy, but it never demonstrates the trigger mechanism that would make these a Trojan, and the 'first fully quantum' claim is contradicted by the Qtrojan paper it cites. read the letter →

arxiv 2507.08202 v1 pith:VZKSSQFF submitted 2025-07-10 quant-ph cs.AIcs.CR

Sounak Bhowmik , Travis S. Humble , Himanshu Thapliyal This is my paper

classification quant-phcs.AIcs.CR

keywords QuantumPropertiesTrojanQNNsecurityattackunitarygatecancellationHadamardinterferenceconfigurationfilebackdoorneuralnetworkNISQnoise

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a quantum neural network can be sabotaged by Trojans that exploit two everyday properties of quantum computation: unitary gate pairs that cancel only on ideal hardware but accumulate errors on noisy hardware, and Hadamard gates whose interference scrambles the encoded input. It proposes three attack classes and reports that the Hadamard-based class cuts the accuracy of a trained binary classifier from 70 percent to 50 percent in an ideal simulator and from 65 percent to 50 percent on a noisy cloud simulator, which the paper calls a 23 percent deterioration. The attack is launched through a malicious configuration file that the quantum compiler downloads before compiling, so the victim's compiler and cloud provider are assumed trustworthy and the Trojans need no access to training data. The paper positions this as the first Trojan attack on a fully quantum neural network, with no hybrid classical-quantum component.

What carries the argument

The load-bearing objects are three. The first is the $U^\dagger U$ noise injector, which looks like identity in ideal simulation but accumulates hardware noise $\delta$ on a noisy device. The second is the $H^{\otimes n}$ Hadamard implant, which performs the Quantum Fourier Transform over $\mathbb{Z}_2^n$ and creates interference that reweights the amplitudes of the encoded state. The third is the configuration-file backdoor, in which an extra NOT gate or equivalent pulse on an ancilla qubit triggers the attack circuit, protected against compiler removal by a pair of cross-connected CNOT gates. The attacked network is a parameterized quantum circuit with an encoding layer, variational layers, and a Pauli-Z measurement, and the Trojans are mounted on its final variational layer.

What would settle it

Recompile the compromised circuit with a strict optimization level and inspect the output: if the compiler cancels the $U^\dagger U$ pairs or removes the ancilla, or if a user compares the deployed circuit's output distribution with the benign circuit before running it, the stealth premise fails.

Watch

Extended reading notes

Core claim

The central discovery is that dormant quantum circuits mounted on a quantum neural network's variational layer can destroy its classification while remaining invisible during noiseless compilation. Class-A and Class-B insert chains of $U^\dagger U$ pairs: by unitarity these compose to identity in a noiseless setting, but under hardware noise each pair contributes a residual error $\delta$, so a deep stack accumulates enough decoherence to degrade performance. Class-C applies $H^{\otimes n}$ to the encoded state, effectively a Quantum Fourier Transform over $\mathbb{Z}_2^n$, whose constructive and destructive interference reweights the amplitudes and drives the network to label every input as the same class; the paper reports this as the most impactful attack. The paper argues this matters because training and validation normally run in ideal simulators, so the Trojan is not visible at training time and persists through retraining.

Load-bearing premise

The attack works only if an attacker can secretly alter the configuration file the quantum compiler downloads before each job, the compiler keeps the injected trigger gates in the compiled circuit, and the victim never checks the deployed circuit's gate count or output distribution.

Editorial extensions

If this is right

Class-C degrades the attacked binary classifier to chance level (50 percent accuracy) in both ideal and noisy simulation, and drives precision, recall, and F1 to zero by making the model label every input as class 0.
Class-A and Class-B produce no effect in noiseless simulation but lower accuracy by 12.31 percent and recall by 53.33 percent under the noisy cloud model, so their success depends entirely on hardware noise.
Because the Trojans are inserted through the compiler configuration file, they require no access to the victim's training data and survive retraining with a new dataset.
The same unitary and Hadamard mechanisms can in principle be mounted on any quantum circuit, with impact varying by application, as the paper states in its conclusion.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the Hadamard interference mechanism is as general as described, the same $H^{\otimes n}$ implant should degrade any amplitude-encoded variational circuit, and its impact would depend on how much the output depends on the encoded input amplitudes.
The observed collapse to zero recall suggests Class-C does not merely add uniform noise but systematically biases the output, so simple distribution-level checks could expose the attack even without full error correction.
A defensive experiment the paper does not run, and which would settle the stealth claim, is to compare the output distribution of the benign and triggered circuits before deployment; a sufficiently large divergence would make the Trojan detectable.
Because the backdoor lives in the compilation step, any validation that treats the compiler as trusted inherits this vulnerability; end-to-end circuit verification or signed configuration files would be natural countermeasures.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the empirical demonstrations are clean and the writing is clear, but the central contribution is thin and overclaimed.

What's actually new is narrow: the specific attack circuits—U†U noise injectors with a particular gate structure, and a Hadamard chain with an ancilla control. The observations behind them (U†U = I in the noiseless case, noise accumulation on NISQ hardware, H⊗n scrambling an encoded state) are textbook. The experiments confirm those expectations on a small MNIST QNN, and the results are plausible as far as they go. So the paper is technically correct, but incremental.

Where it falls down: the Trojan property itself is never demonstrated. The threat model requires a benign config file that leaves the circuit producing expected outputs, and a malicious config that triggers the attack. But the experiments only compare 'no attack circuit' to 'attack circuit mounted and active'. For Class-C, the Hadamard chain is always in the circuit; for Class-A/B, the U†U blocks are always present, and the ancilla control is never tested in its untriggered state. What the paper actually shows is permanent gate insertion, not a dormant backdoor. The stealth claim also has no support—no gate-count overhead, no transpiler-check bypass demonstration. The baseline is a highly biased model (70% accuracy with recall 0.4), so the 23% drop for Class-C, which drives everything to the majority class, is less dramatic than it looks. There are no error bars or repeated runs, just single numbers. And the 'first fully quantum Trojan' assertion is false given the Qtrojan paper [8] is cited in the same paragraph.

Who is this for? Someone new to quantum security might find it a readable walkthrough of simple attack motifs. It could work as a workshop paper after major revision. But as a serious journal contribution, the load-bearing gap is the missing trigger test, and the novelty is too low. I would not send it to peer review without that experiment being done and the claims sharply scaled back.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes three classes of 'Quantum Properties Trojans' (QuPT) against a QNN binary classifier: a noise injector built from sequences of U†U pairs (Class-A), an ancilla-triggered version of the same (Class-B), and a Hadamard implant applied to all qubits (Class-C). The attacks are mounted on the final VQC of a small quanvolutional QNN trained on MNIST 0/1, and results are reported for an ideal simulator and the IonQ Aria-1 noisy simulator. The paper claims these Trojans are 'significantly stealthier' than prior work, that Class-C causes up to 23% accuracy loss, and that this is the first Trojan attack on a fully quantum neural network.

Significance. If the stealth and trigger claims were experimentally established, this line of work would be relevant to quantum machine learning security. The manuscript correctly identifies the unitary identity U†U=I and the QFT action of H⊗n, and the threat model of configuration-file tampering is plausible. However, the experimental design does not test the defining property of a Trojan (dormancy until trigger), no stealth metric is reported, and no comparison with the cited Qtrojan attack is provided. The reported accuracy drops are consistent with simply adding extra gates to the circuit. As it stands, the paper demonstrates that inserting fixed gates degrades this particular QNN, not that a stealthy, triggerable backdoor has been designed.

major comments (5)

[Section III, Table II] The central threat-model statement that 'with a benign config file, the quantum circuit produces expected outputs' and that the QuPT is 'triggered' only after compilation with a malicious config file is never tested. All attack rows in Table II compare a circuit with no QuPT mounted against the same circuit with the QuPT mounted and active. There is no experiment in which the same mounted circuit is run with the trigger disabled (e.g., ancilla in |0⟩ for Classes B/C, or no malicious config for all classes). Consequently, the data cannot distinguish a dormant backdoor from a permanent modification.
[Section IV.A, Table II] Class-A and Class-B produce zero impact in the ideal simulator by construction, because the U†U blocks implement the identity; this is an algebraic identity, not a stealth measurement. In the noisy simulator, the extra gates are always present and add error regardless of any configuration file, so the observed 12.31% accuracy drop does not show conditional activation. The statement in Section IV.A that Class-A is 'independent of any external trigger' is also in tension with the definition of a Trojan as a triggered backdoor.
[Section VI, Table II] The results are based on a single run on 200 validation samples, with no error bars, multiple seeds, or statistical significance testing. The 65% to 57% accuracy difference corresponds to 16 samples, and the Class-C collapse to all-zero predictions must be interpreted in light of the baseline's strong bias (precision 1.0, recall 0.4). Without repeated runs and confidence intervals, the 'heavily impact' claim is not quantitatively supported.
[Abstract and Section I, reference [8]] The novelty claim that this is 'the first work on the Trojan attack on a fully quantum neural network' is not supported by the manuscript's own related-work discussion. Reference [8] (Qtrojan) is cited as a circuit backdoor against quantum neural networks, yet no comparison is made and no technical distinction is drawn. The 'significantly stealthier' claim in the abstract is also never compared against any prior attack or any detection/stealth metric (e.g., gate-count overhead, transpiler survival, or output-distribution distance).
[Equation (1)] The noise model in Eq. (1) writes \tilde U† \circ \tilde U = (N_{U†} \circ U†) \circ (N_U \circ U) = U†U + δ = I + δ without defining N_U or justifying that the noise contributions combine additively, and the notation is not meaningful as an operator equation. This is the formal basis for Class-A/B, and as written it is not a derivation.

minor comments (5)

[Section II.A] The product notation 'Qd i=1' is malformed; it should be written as \prod_{i=1}^d.
[Table I] There is a typo: 'relevent' should be 'relevant'. Also, the table formatting for 'Aria-1(IonQ)' could be cleaner.
[Section VI] The noisy baseline F1 score is reported as 0.4651 in the text but as 0.4615 in Table II; these values should be reconciled.
[Section VII] The conclusion contains a typo: 'fully quantum-neutral network' should be 'fully quantum neural network'.
[Section IV.C] The statement that H⊗n 'technically' performs the QFT over Z_2^n is correct, but the text should clarify that H⊗n is its own inverse, so the 'unwanted interference' description depends on the encoded state and the absence of a compensating Hadamard layer.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: QuPT effects are direct measurements of deliberately constructed circuits, not predictions derived from fitted inputs.

full rationale

The paper's central experimental claims are direct measurements: each QuPT is a concrete circuit (U-dagger-U blocks for Class-A/B, H^⊗n plus ancilla for Class-C) mounted on a trained QNN, and Table II reports the resulting accuracy, recall, and AUC on ideal and noisy simulators. There is no fitted parameter that is later relabeled as a prediction, no load-bearing chain of self-citations, no imported uniqueness theorem, and no ansatz smuggled in via citation. The only by-construction element is that in an ideal simulator U-dagger-U equals identity (Sec. IV-A, Eq. 1), so the reported noiseless impact of 0 for Class-A/B is a mathematical consequence of unitarity rather than an empirical discovery; however, that identity is a property of the built attack circuit, not a reuse of the target result, and the noisy impact, which is the substantive claim, is measured rather than derived. The concerns that the 'stealthier' and 'trigger/dormancy' properties are not tested (no benign-config row with the same mounted circuit) and that the 'first fully quantum' claim conflicts with the cited Qtrojan work [8] are evidence/novelty weaknesses, not circularity. Author self-citations [1,2] are background references and are not load-bearing. Therefore no significant circularity is found.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities. Its free parameters are structural choices (repetition count, depth, gate set) for the attack circuits, selected by the authors after testing. The axioms are standard quantum mechanics (unitarity, Hadamard/QFT) plus domain assumptions about NISQ noise and test-set balance.

free parameters (3)

Number of repetitions of Ui in Class-A/B noise injector = 50
Chosen after testing; the paper states in Section IV-A that this setup 'became successful in inducing the most errors'.
Gate depth d inside each Ui = d=3
Ad hoc choice; not varied or reported in the paper.
Gate set for the Ui attack circuit = Hadamard, CNOT ring, Ising XX/YY/ZZ, SWAP
Hand-picked circuit structure; the paper does not justify why these gates are optimal.

assumptions (4)

standard math Quantum gates are unitary, so U†U = I in the absence of noise.
Used in Section IV-A to motivate the Class-A/B noise injector.
standard math The Hadamard transform H⊗n performs the quantum Fourier transform over Z2^n and produces constructive/destructive interference.
Used in Section IV-C to motivate Class-C.
domain assumption NISQ device noise can be represented by depolarizing channels with one- and two-qubit error rates r1q and r2q.
Used for the IonQ Aria-1 noisy simulator; the real device error model is approximated.
domain assumption The MNIST 0/1 test set used for evaluation is balanced and the QNN's biased baseline (precision 1.0, recall 0.4) is representative.
The accuracy drop to 50% under Class-C equals the fraction of class-0 examples, which the authors do not explicitly report.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Quantum Properties Trojans (QuPTs) for Attacking Quantum Neural Networks." pith.science (2026). https://pith.science/paper/VZKSSQFF

@misc{pith2026250708202,
  author       = {Pith},
  title        = {Pith review of: Quantum Properties Trojans (QuPTs) for Attacking Quantum Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VZKSSQFF}},
  note         = {Machine review of arXiv:2507.08202}
}

read the original abstract

Quantum neural networks (QNN) hold immense potential for the future of quantum machine learning (QML). However, QNN security and robustness remain largely unexplored. In this work, we proposed novel Trojan attacks based on the quantum computing properties in a QNN-based binary classifier. Our proposed Quantum Properties Trojans (QuPTs) are based on the unitary property of quantum gates to insert noise and Hadamard gates to enable superposition to develop Trojans and attack QNNs. We showed that the proposed QuPTs are significantly stealthier and heavily impact the quantum circuits' performance, specifically QNNs. The most impactful QuPT caused a deterioration of 23% accuracy of the compromised QNN under the experimental setup. To the best of our knowledge, this is the first work on the Trojan attack on a fully quantum neural network independent of any hybrid classical-quantum architecture.

Figures

Figures reproduced from arXiv: 2507.08202 by the authors.

**Figure 3.** Class-A QuPT: noise injector (a) The net effect of U† ◦ U is equivalent to identity in a noiseless set-up. However, execution of these gates is prone to error in NISQ hardware. (b) The attack circuit Ui comprises Hadamard, followed by a ring of C-NOT, Ising XX, YY, ZZ, and swap gates. This setup became successful in inducing the most errors during the QNN execution, among all the others tested on the same QNN. Howev… view at source ↗

**Figure 5.** Class-C QuPT: Hadamard implantation The ancilla controls the Hadamard-based attack circuit, which gets triggered upon insertion of a NOT gate. The injected interference effect is the reason for the distortion in the encoded quantum state. • High impact. • Success does not depend on the noise level in the QPU. • Shallow depth. • High success rate, even if the model is deployed in a high-end ideal simulator [PITH_FUL… view at source ↗

Figures from the paper (1 more)

**Figure 6.** Figure 6: Workflow of the QNN-based binary classifier used in [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

12 extracted references · 7 canonical work pages

[8]

C. Chu, L. Jiang, M. Swany, and F. Chen, ``Qtrojan: A circuit backdoor against quantum neural networks,'' in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). 1em plus 0.5em minus 0.4em IEEE, 2023, pp. 1--5

work page 2023
[1]

Bhowmik and H

S. Bhowmik and H. Thapliyal , ``Transfer learning based hybrid quantum neural network model for surface anomaly detection,'' in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 634--639

work page 2024
[2]

Bhowmik and H

S. Bhowmik and H. Thapliyal, ``Quantum machine learning for anomaly detection in consumer electronics,'' in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 544--550

work page 2024
[3]

Das and S

S. Das and S. Ghosh, ``Trojan attacks on variational quantum circuits and countermeasures,'' in 2024 25th International Symposium on Quality Electronic Design (ISQED). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 1--8

work page 2024
[4]

J. John, L. Golla, and Q. Wang, ``Quantum trojan insertion: Controlled activation for covert circuit manipulation,'' 2025. [Online]. Available: https://arxiv.org/abs/2502.08880

arXiv 2025
[5]

Xu and J

C. Xu and J. Szefer, ``Security attacks abusing pulse-level quantum circuits,'' arXiv preprint arXiv:2406.05941, 2024

arXiv 2024
[6]

Alexander, N

T. Alexander, N. Kanazawa, D. J. Egger, L. Capelluto, C. J. Wood, A. Javadi-Abhari, and D. C. McKay, ``Qiskit pulse: programming quantum computers through the cloud with pulses,'' Quantum Science and Technology, vol. 5, no. 4, p. 044006, 2020

work page 2020
[7]

D. C. McKay, T. Alexander, L. Bello, M. J. Biercuk, L. Bishop, J. Chen, J. M. Chow, A. D. C \'o rcoles, D. Egger, S. Filipp et al., ``Qiskit backend specifications for openqasm and openpulse experiments,'' arXiv preprint arXiv:1809.03452, 2018

arXiv 2018

Show all 12 references

[9]

Das and S

S. Das and S. Ghosh, ``Trojan taxonomy in quantum computing,'' in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 644--649

2024
[10]

Henderson, S

M. Henderson, S. Shakya, S. Pradhan, and T. Cook, ``Quanvolutional neural networks: powering image recognition with quantum circuits,'' Quantum Machine Intelligence, vol. 2, no. 1, p. 2, 2020

2020
[11]

Schuld, A

M. Schuld, A. Bocharov, K. M. Svore, and N. Wiebe, ``Circuit-centric quantum classifiers,'' Physical Review A, vol. 101, no. 3, Mar. 2020. [Online]. Available: http://dx.doi.org/10.1103/PhysRevA.101.032308

2020 doi
[12]

write newline

" write newline "" initialize.prev.this.status FUNCTION begin.bib " write newline preamble empty 'skip preamble write newline if " thebibliography " longest.label * " " * write newline " [1] #1 " write newline " url@samestyle " write newline " " write newline " [2] #2 " write ...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [8]

C. Chu, L. Jiang, M. Swany, and F. Chen, ``Qtrojan: A circuit backdoor against quantum neural networks,'' in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). 1em plus 0.5em minus 0.4em IEEE, 2023, pp. 1--5

work page 2023

[2] [1]

Bhowmik and H

S. Bhowmik and H. Thapliyal , ``Transfer learning based hybrid quantum neural network model for surface anomaly detection,'' in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 634--639

work page 2024

[3] [2]

Bhowmik and H

S. Bhowmik and H. Thapliyal, ``Quantum machine learning for anomaly detection in consumer electronics,'' in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 544--550

work page 2024

[4] [3]

Das and S

S. Das and S. Ghosh, ``Trojan attacks on variational quantum circuits and countermeasures,'' in 2024 25th International Symposium on Quality Electronic Design (ISQED). 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 1--8

work page 2024

[5] [4]

J. John, L. Golla, and Q. Wang, ``Quantum trojan insertion: Controlled activation for covert circuit manipulation,'' 2025. [Online]. Available: https://arxiv.org/abs/2502.08880

arXiv 2025

[6] [5]

Xu and J

C. Xu and J. Szefer, ``Security attacks abusing pulse-level quantum circuits,'' arXiv preprint arXiv:2406.05941, 2024

arXiv 2024

[7] [6]

Alexander, N

T. Alexander, N. Kanazawa, D. J. Egger, L. Capelluto, C. J. Wood, A. Javadi-Abhari, and D. C. McKay, ``Qiskit pulse: programming quantum computers through the cloud with pulses,'' Quantum Science and Technology, vol. 5, no. 4, p. 044006, 2020

work page 2020

[8] [7]

D. C. McKay, T. Alexander, L. Bello, M. J. Biercuk, L. Bishop, J. Chen, J. M. Chow, A. D. C \'o rcoles, D. Egger, S. Filipp et al., ``Qiskit backend specifications for openqasm and openpulse experiments,'' arXiv preprint arXiv:1809.03452, 2018

arXiv 2018