REVIEW 3 major objections 6 minor 2 cited by
Two hybrid quantum-classical networks classify malware from five datasets with binary accuracy up to 96.3% and multiclass accuracy ranging from 41.7% to 95.7%.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
Applying QMLP and QCNN quantum classifiers to five malware datasets yields binary accuracies up to 96% and multiclass accuracy up to 95.7%, with QMLP generally more accurate and QCNN faster.
T0 review reviewed 2026-08-05 challenge →
load-bearing objection Straightforward QML benchmark on malware data, but the API-Graph multiclass accuracy is majority-class guessing and the abstract's 'high accuracy' framing is misleading. the 3 major comments →
Towards Quantum Machine Learning for Malicious Code Analysis
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
Core claim
The paper's central claim is that two standard quantum network designs from image classification transfer to malware classification without domain-specific circuit engineering: angle-embed the first 16 principal components of each malware sample, entangle qubits with controlled rotations, measure expectation values, and pass them through a classical linear layer. On the API-Graph Android dataset, QMLP and QCNN tie at 95.7%, 92.5%, and 91.6% accuracy for 4, 14, and 23 family classes, while the same dataset shows near-chance precision and recall near 4% in the 23-class setting. On AZ-Class, QMLP drops from 93.6% (4 classes) to 57.8% (23 classes), while QCNN drops to 41.7%; on EMBER-Class, QMLP
What carries the argument
The carrying mechanism is a 16-qubit parameterized quantum circuit that encodes each PCA-reduced malware vector via angle embedding (single-qubit rotations) and then applies trainable rotation gates and controlled-X entanglement in a ring topology. QMLP repeats the encoding and rotation block with data re-uploading and measures all 16 qubits; QCNN interleaves convolution-like rotations and entanglement with pooling layers that halve the active qubits after each stage, down to four measured qubits. The measured Pauli-Z expectations form a fixed-length feature vector that a classical linear layer maps to class probabilities.
Load-bearing premise
The load-bearing premise is that reducing every malware sample to 16 numbers with PCA keeps enough information to distinguish malicious from benign code; if that projection discards the distinguishing signal, the reported accuracies measure the PCA step, not the quantum circuits.
What would settle it
Train a classical classifier, such as logistic regression or a small neural network, on the same 16 PCA components and the same test splits used by the quantum models; if it matches or exceeds the reported accuracies, the quantum circuit is not the source of the classification signal.
If this is right
- If the reported accuracies hold, malware feature vectors such as API-call graphs and static PE features can be embedded into 16-qubit circuits and classified without hand-tuned quantum designs.
- QMLP's multiclass advantage implies that data re-uploading and full-qubit measurement are worth their extra training cost when family diversity is high.
- QCNN's pooling creates a speed–accuracy trade-off: faster training and stable binary results, but degrading multiclass performance as class count grows.
- The identical accuracies of QMLP and QCNN on API-Graph across all class counts suggest that dataset structure, not architecture, can dominate performance on some malware tasks.
- Because all experiments used an ideal, noise-free simulator, the numbers set an ideal-condition target that noisy hardware runs would need to approach.
Where Pith is reading between the lines
- Editorial inference: the PCA-to-16 step is a confound; a classical classifier trained on the same 16 components would reveal whether the quantum circuit or the projection is doing the work, a comparison the paper does not report.
- Editorial inference: on API-Graph multiclass splits, accuracy near 92–96% coexists with precision and recall around 4–7% at 14–23 classes, so the headline accuracies mostly reflect class imbalance and should be judged alongside F1 or per-family recall.
- Editorial inference: if data re-uploading depth is the mechanism behind QMLP's edge, increasing re-uploading layers should improve multiclass accuracy in simulation, but on noisy hardware the added gates would likely erode that gain—a testable prediction.
- Editorial inference: using amplitude embedding instead of angle embedding could encode more original features into the same number of qubits; the paper lists this as future work, and the present results imply the 16-feature PCA bottleneck may set the performance ceiling.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper implements two hybrid quantum-classical classifiers, a Quantum Multilayer Perceptron (QMLP) and a Quantum Convolutional Neural Network (QCNN), using 16-qubit PennyLane circuits with angle embedding and PCA-reduced features. The models are evaluated on five malware datasets (API-Graph, EMBER-Domain, EMBER-Class, AZ-Domain, AZ-Class) in binary and multiclass settings. The authors report high binary accuracy (77–96%) and multiclass accuracy (41.7–95.7%), concluding that QMLP generally outperforms QCNN in multiclass tasks while QCNN trains faster. The paper also discusses limitations including PCA dimensionality reduction and noise-free simulation.
Significance. If the empirical claims were fully supported, this would be a useful early benchmark for QML in malware classification. The paper has clear strengths: it uses widely known datasets, releases its implementation, reports multiple metrics beyond accuracy, and explicitly discusses architectural differences between QMLP and QCNN. However, the central accuracy claims are undermined by a severe metric-interpretation problem in the API-Graph multiclass results and by the absence of classical or majority-class baselines. The API-Graph multiclass accuracies are quantitatively consistent with always predicting the most frequent class, so the headline claim of 'high accuracy' for that dataset is not substantiated. The paper is salvageable with a major revision that reframes claims, adds baselines, and corrects reporting.
major comments (3)
- [Table I / Section IV] The API-Graph multiclass results do not support the claim of high accuracy. For the 14-class case, QMLP accuracy is 92.5% but macro-F1 is 7.1%; for 23 classes, accuracy is 91.6% and macro-F1 is 4.2%. These values are exactly what a majority-class predictor yields: for C classes and majority fraction p, macro-F1 = (2p/(1+p))/C. With p=0.925 and C=14 this gives 6.9%, matching the reported 7.1%; with p=0.916 and C=23 it gives 4.2%. The 4-class F1 of 29.6% is above the majority-class baseline (about 24%) but still very low. The paper acknowledges the low precision/recall/F1 in Section IV but the Abstract and Conclusion continue to frame these results as high-accuracy achievements. This is a load-bearing issue: the models appear to be predicting the majority class on API-Graph multiclass, not learning discriminative features. The paper must report class distributions, a majority-class baselin
- [Section III-A / Section V] The PCA reduction to 16 components is a potentially dominant factor in the results, but the paper provides no explained-variance information and no comparison to classical models trained on the same 16 PCA features. Section III-A states that PCA 'preserv[es] most of the dataset's variance' without giving the actual proportion. Section V acknowledges the dimensionality constraint as a design limitation but does not quantify the information loss. Without a classical baseline such as logistic regression, random forest, or a classical MLP on the same 16-dimensional inputs, the reported accuracies cannot be attributed to the quantum circuits. This is central to the paper's contribution: the reader has no way to know whether the quantum component adds any predictive signal beyond the PCA bottleneck.
- [Section IV / Table II] There are numerical inconsistencies and incorrect metric definitions. In the text, AZ-Domain accuracy is reported as 91.71% (QMLP) and 91.8% (QCNN), with precision 79.9%/80.2% and F1 75.8%/75.9%, but Table II gives accuracy 91.24%/91.3%, precision 76.64%/77.0%, and F1 72.6%/72.8%. These are materially different. Additionally, Table II reports FPR and FNR as equal for API-Graph (13.5%) and AZ-Domain (31%); this is generally impossible because FPR = FP/(FP+TN) and FNR = FN/(FN+TP) are independent quantities unless the class balance and error rates coincide. The FNR values equal 1-recall, suggesting FPR was filled in with the same value. The authors need to recompute all confusion-matrix metrics and ensure the text matches the tables.
minor comments (6)
- [Section II] The description of embedding is inconsistent: QMLP uses RX-based angle embedding, while QCNN uses RX, RY, and RZ gates. Section III-B says 'both models adopt angle embedding' without specifying the different encodings. Please clarify.
- [Section V] The claim that QCNN 'trains faster' is qualitative. No wall-clock training times, parameter counts, or circuit-depth comparisons are reported. Please provide quantitative evidence or soften the claim.
- [Section IV] In the binary API-Graph discussion, the text states QCNN accuracy is 95.9%, but Table II reports 96.0 ± 0.1. Minor round-off or reporting inconsistency; please align.
- [Table I] The caption says 'Multi class'; should be 'Multiclass'. Also consider using bold or a separate column to identify the majority-class baseline.
- [Section III-C] The phrase 'evaluated in data from 2014' and similar temporal splits are awkward. Please rewrite for clarity and specify whether the splits are disjoint in time as intended.
- [Availability] The URL contains an unescaped space: 'https://iqsec-lab.github.io/qml-malware classification/'. This should be a proper hyperlink or a corrected URL.
Circularity Check
No significant circularity: the paper is a held-out empirical evaluation of two quantum-classical models on standard malware datasets; no prediction reduces by construction to its inputs.
full rationale
The paper reports train/test evaluations of QMLP and QCNN on five malware datasets. The reported accuracies are measurements on held-out test splits after training, not quantities defined in terms of the fitted parameters. The multiclass API-Graph numbers may be inflated by class imbalance (macro-F1 4-8% vs accuracy 91-96%), but that is a question of whether accuracy is an informative metric, not of circularity: the accuracy is not forced by the definition of the model or by the preprocessing. The PCA-to-16 dimensionality reduction is a fixed preprocessing choice; the paper does not claim to predict explained variance, and no target metric is algebraically determined by PCA. The reliance on the authors' earlier dataset papers (EMBER-Class, AZ-Class, AZ-Domain) is a citation of externally created benchmark data, not a citation that supplies the paper's conclusions. The QMLP/QCNN architectures are taken from prior work, but the paper's contribution is an application study; using a published architecture is not circular. There is no self-definitional step, no fitted-input-called-prediction step, no imported uniqueness theorem, and no renaming of a known result. Any weakness of the evaluation (e.g., missing majority-class baselines or imbalance-aware metrics) belongs in a correctness/validity pass, not a circularity finding.
Axiom & Free-Parameter Ledger
free parameters (6)
- PCA dimension =
16
- Number of qubits =
16
- Family count configurations =
4, 14, 23
- Training epochs =
20
- Batch size =
64
- Learning rate
axioms (5)
- domain assumption PennyLane default.qubit simulator computes circuit expectation values correctly
- domain assumption PCA to 16 components preserves enough information for classification
- domain assumption The malware datasets are correctly labeled and the temporal splits are representative
- domain assumption Adam optimization over 20 epochs reaches a meaningful local optimum
- domain assumption Prior QMLP and QCNN architectures are suitable backbones for high-dimensional tabular data
Cite this review
Pith. "Pith review of Towards Quantum Machine Learning for Malicious Code Analysis." pith.science (2026). https://pith.science/paper/7YHE6IIV
@misc{pith2026250819381,
author = {Pith},
title = {Pith review of: Towards Quantum Machine Learning for Malicious Code Analysis},
year = {2026},
howpublished = {\url{https://pith.science/paper/7YHE6IIV}},
note = {Machine review of arXiv:2508.19381}
}
read the original abstract
Classical machine learning (CML) has been extensively studied for malware classification. With the emergence of quantum computing, quantum machine learning (QML) presents a paradigm-shifting opportunity to improve malware detection, though its application in this domain remains largely unexplored. In this study, we investigate two hybrid quantum-classical models -- a Quantum Multilayer Perceptron (QMLP) and a Quantum Convolutional Neural Network (QCNN), for malware classification. Both models utilize angle embedding to encode malware features into quantum states. QMLP captures complex patterns through full qubit measurement and data re-uploading, while QCNN achieves faster training via quantum convolution and pooling layers that reduce active qubits. We evaluate both models on five widely used malware datasets -- API-Graph, EMBER-Domain, EMBER-Class, AZ-Domain, and AZ-Class, across binary and multiclass classification tasks. Our results show high accuracy for binary classification -- 95-96% on API-Graph, 91-92% on AZ-Domain, and 77% on EMBER-Domain. In multiclass settings, accuracy ranges from 91.6-95.7% on API-Graph, 41.7-93.6% on AZ-Class, and 60.7-88.1% on EMBER-Class. Overall, QMLP outperforms QCNN in complex multiclass tasks, while QCNN offers improved training efficiency at the cost of reduced accuracy.
Figures
Forward citations
Cited by 2 Pith papers
-
SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness
A systematization of knowledge paper that empirically evaluates five adversarial attacks on quantum multilayer perceptrons across encodings and depths, identifying an accuracy-robustness trade-off and differences from...
-
SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness
The paper delivers the first comprehensive systematization of adversarial robustness in QML with new empirical tests showing an accuracy-robustness trade-off, amplitude encoding's vulnerability, and QML's greater susc...
Reference graph
Works this paper leans on
-
[1]
Diffusion-inspired quantum noise mitigation in parameterized quantum circuits,
H.-Q. Nguyen, X. B. Nguyen, S. Y .-C. Chen, H. Churchill, N. Borys, S. U. Khan, and K. Luu, “Diffusion-inspired quantum noise mitigation in parameterized quantum circuits,” Quantum Machine Intelligence , 2025
work page 2025
-
[2]
Challenges and opportunities in quantum machine learning,
M. Cerezo, G. Verdon, H.-Y . Huang, L. Cincio, and P. J. Coles, “Challenges and opportunities in quantum machine learning,” Nature Computational Science, 2022
work page 2022
-
[3]
J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,” Nature, 2017
work page 2017
-
[4]
The quest for a quantum neural network,
M. Schuld, I. Sinayskiy, and F. Petruccione, “The quest for a quantum neural network,” Quantum Information Processing , 2014
work page 2014
-
[5]
The power of quantum neural networks,
A. Abbas, D. Sutter, C. Zoufal, A. Lucchi, A. Figalli, and S. Woerner, “The power of quantum neural networks,” Nature Computational Sci- ence, 2021
work page 2021
-
[6]
Quantum computing in the nisq era and beyond,
J. Preskill, “Quantum computing in the nisq era and beyond,” Quantum, 2018
work page 2018
-
[7]
Quantum convolutional neural network for classical data classification,
H.-S. Hur, J. Kim, and J. Kim, “Quantum convolutional neural network for classical data classification,” arXiv preprint arXiv:2108.00661, 2021
Pith/arXiv arXiv 2021
-
[8]
QuantumNAS: Noise-adaptive search for robust quantum circuits,
H. Wang, Y . Ding, J. Gu, Y . Lin, D. Z. Pan, F. T. Chong, and S. Han, “QuantumNAS: Noise-adaptive search for robust quantum circuits,” in 2022 IEEE International Symposium on High-Performance Computer Architecture (HPCA), 2022
work page 2022
-
[9]
QuantumNAT: Quantum Noise-Aware Training with Noise Injection, Quantization and Normalization
H. Wang, J. Gu, Y . Ding, Z. Li, F. T. Chong, D. Z. Pan, and S. Han, “QuantumNAT: Quantum noise-aware training with noise injec- tion, quantization and normalization,” arXiv preprint arXiv:2110.11331, 2021, accessed 2025-06-16
work page internal anchor Pith review Pith/arXiv arXiv 2021
-
[10]
An evaluation of hardware-efficient quantum neural networks,
M. S. Rahman, N. Ishita, S. Shihab, and K. Vatanparvar, “An evaluation of hardware-efficient quantum neural networks,” Electronics, 2022
work page 2022
-
[11]
Penny- Lane: Automatic differentiation of hybrid quantum-classical computa- tions,
V . Bergholm, J. Izaac, M. Schuld, C. Gogolin, S. Ahmed, V . Ajith, M. S. Alam, G. Alonso-Linaje, B. AkashNarayanan, A. Asadi et al., “Penny- Lane: Automatic differentiation of hybrid quantum-classical computa- tions,” arXiv preprint arXiv:1811.04968 , 2018
Pith/arXiv arXiv 2018
-
[12]
TensorFlow Quantum: A software framework for quantum machine learning,
M. Broughton, G. Verdon, T. McCourt, A. J. Martinez, J. H. Yoo, S. V . Isakov, P. Massey, R. Halavati, M. Y . Niu, A. Zlokapaet al., “TensorFlow Quantum: A software framework for quantum machine learning,” arXiv preprint arXiv:2003.02989, 2020
Pith/arXiv arXiv 2003
-
[13]
QMLP: An error-tolerant nonlinear quantum mlp architecture using parameterized two-qubit gates,
C. Chu, N.-H. Chia, L. Jiang, and F. Chen, “QMLP: An error-tolerant nonlinear quantum mlp architecture using parameterized two-qubit gates,” in Proceedings of the ACM/IEEE International Symposium on Low Power Electronics and Design , 2022
work page 2022
-
[14]
Quantum machine learning for chemistry and physics,
M. Sajjan, J. Li, R. Selvarajan, S. H. Sureshbabu, S. S. Kale, R. Gupta, V . Singh, and S. Kais, “Quantum machine learning for chemistry and physics,” Chemical Society Reviews , 2022
work page 2022
-
[15]
Accelerated discovery of efficient solar cell materials using quantum and machine-learning methods,
K. Choudhary, M. Bercx, J. Jiang, R. Pachter, D. Lamoen, and F. Tavazza, “Accelerated discovery of efficient solar cell materials using quantum and machine-learning methods,” Chemistry of materials, 2019
work page 2019
-
[16]
Quantum convolutional neural networks,
I. Cong, S. Choi, and M. D. Lukin, “Quantum convolutional neural networks,” Nature Physics, 2019
work page 2019
-
[17]
EMBER: An open dataset for training static PE malware machine learning models,
H. S. Anderson and P. Roth, “EMBER: An open dataset for training static PE malware machine learning models,” arXiv:1804.04637, 2018
Pith/arXiv arXiv 2018
-
[18]
Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware,
X. Zhang, Y . Zhang, M. Zhong, D. Ding, Y . Cao, Y . Zhang, M. Zhang, and M. Yang, “Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware,” in ACM Conference on Computer and Communications Security (CCS) , 2020
work page 2020
-
[19]
Drebin: Effective and explainable detection of android malware in your pocket,
D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, K. Rieck, and C. Siemens, “Drebin: Effective and explainable detection of android malware in your pocket,” in Network and Distributed System Security Symposium (NDSS), 2014
work page 2014
-
[20]
On the limitations of continual learning for malware classification,
M. S. Rahman, S. E. Coull, and M. Wright, “On the limitations of continual learning for malware classification,” in First Conference on Lifelong Learning Agents (CoLLAs) , 2022
work page 2022
-
[21]
J. Park, A. Ji, M. Park, M. S. Rahman, and S. E. Oh, “MalCL: Lever- aging gan-based generative replay to combat catastrophic forgetting in malware classification,” in AAAI Conference on Artificial Intelligence (AAAI), 2025
work page 2025
-
[22]
MADAR: Efficient continual learning for malware analysis with diversity-aware replay,
M. S. Rahman, S. Coull, Q. Yu, and M. Wright, “MADAR: Efficient continual learning for malware analysis with diversity-aware replay,” arXiv preprint arXiv:2502.05760 , 2025
-
[23]
A hybrid quantum-classical neural network architecture for binary classification,
D. Arthur and P. Date, “A hybrid quantum-classical neural network architecture for binary classification,” 2022
work page 2022
-
[24]
Benchmarking adversarially robust quantum machine learning at scale,
M. T. West, S. M. Erfani, C. Leckie, M. Sevior, L. C. L. Hollenberg, and M. Usman, “Benchmarking adversarially robust quantum machine learning at scale,” Phys. Rev. Res., 2023
work page 2023
-
[25]
Qucnn : A quantum convolu- tional neural network with entanglement based backpropagation,
S. A. Stein, Y . Mao, J. Ang, and A. Li, “Qucnn : A quantum convolu- tional neural network with entanglement based backpropagation,” 2022
work page 2022
-
[26]
AndroZoo: Collecting Millions of Android Apps for the Research Community,
K. Allix, T. F. Bissyand ´e, J. Klein, and Y . Le Traon, “AndroZoo: Collecting Millions of Android Apps for the Research Community,” in International Conference on Mining Software Repositories (MSR), 2016
work page 2016
-
[27]
X-Align: Cross-Modal Cross-View Alignment for Bird's-Eye-View Segmentation
Y . Mittal, S. Choudhary, S. Nandi, S. Dasgupta, and V . Singh, “Nr-qnn: A noise-resilient quantum neural network architecture,” arXiv preprint arXiv:2210.06778, 2022
work page internal anchor Pith review Pith/arXiv arXiv 2022
-
[28]
R. Moreira, S. Rosenblum, J. M. Martinis, M. Mohseni, H. Neven, V . Smelyanskiy, J. R. McClean, M. Broughton, S. Boixo, M. P. Harrigan et al. , “Realization of a quantum neural network using repeat-until- success circuits in a superconducting quantum processor,” npj Quantum Information, 2023
work page 2023
-
[29]
A co-design framework of neural networks and quantum circuits towards quantum advantage,
W. Jiang, J. Xiong, and Y . Shi, “A co-design framework of neural networks and quantum circuits towards quantum advantage,” Nature Communications, no. 1, p. 579, 2021
work page 2021
-
[30]
A lie algebraic theory of barren plateaus for deep parameterized quantum circuits,
M. Ragone, B. N. Bakalov, F. Sauvage, A. F. Kemper, C. Ortiz Marrero, M. Larocca, and M. Cerezo, “A lie algebraic theory of barren plateaus for deep parameterized quantum circuits,” Nature Communications, 2024
work page 2024
-
[31]
Absence of barren plateaus in quantum convolutional neural networks,
A. Pesah, M. Cerezo, S. Wang, T. V olkoff, A. T. Sornborger, and P. J. Coles, “Absence of barren plateaus in quantum convolutional neural networks,” Physical Review X , vol. 11, no. 4, p. 041011, 2021
work page 2021
-
[32]
Towards explainable quantum machine learning for mobile malware detection and classification,
F. Mercaldo, G. Ciaramella, G. Iadarola, M. Storto, F. Martinelli, and A. Santone, “Towards explainable quantum machine learning for mobile malware detection and classification,” Applied Sciences, 2022
work page 2022
-
[33]
Towards an in-depth detection of malware using distributed QCNN
T. Quertier and G. Barru ´e, “Towards an in-depth detection of malware using distributed qcnn,” arXiv preprint arXiv:2312.12161 , 2023
work page internal anchor Pith review Pith/arXiv arXiv 2023
This paper was first reviewed by deepseek-v4-flash on August 5, 2026.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.