Pith. sign in

REVIEW 3 major objections 6 minor 24 references

Under a unified red-teaming benchmark, VQE's most damaging adversarial attacks are those that corrupt the Zero-Noise Extrapolation (ZNE) error-mitigation pipeline (up to 8.84x error amplification), followed by circuit-level backdoors (7.52x

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 12:45 UTC pith:RJVI4VYM

load-bearing objection Useful first benchmark for VQE red-teaming, but the headline severity ranking is an artifact of comparing amplifications against two different clean baselines and should be treated as provisional. the 3 major comments →

arxiv 2607.19318 v1 pith:RJVI4VYM submitted 2026-07-21 quant-ph cs.CR

SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming

Ahmed Azaz Humdoon , Cheng Chu , Lei Jiang , Qian Lou , Mengxin Zheng This is my paper
classification quant-ph cs.CR PACS 03.67.Lx
keywords Variational Quantum EigensolverAdversarial RobustnessRed-TeamingZNEBackdoor AttacksError MitigationQuantum Machine Learning SecurityBenchmark
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces VQE-AdvBench, the first unified red-teaming benchmark for the Variational Quantum Eigensolver, and uses it to compare seven adversarial attacks under a fixed molecule–ansatz–backend–metric protocol. Its central finding is a severity ordering: attacks that manipulate the Zero-Noise Extrapolation (ZNE) error-mitigation pipeline are the most damaging, amplifying energy errors by up to 8.84x; the QTrojan circuit-level backdoor reaches 7.52x; gradient-based perturbations (FGSM/PGD) sit in between; and the QDoor parameter-level backdoor is nearly ineffective (up to 1.37x) on shallow circuits. This matters because VQE is a leading candidate for quantum chemistry and drug-discovery workloads, and the result indicates that the main security exposure in cloud-based VQE is the error-mitigation stage, not the trained parameters themselves.

Core claim

The paper's central claim is that, under a common protocol, the relative danger of known VQE attacks is measurable and reveals a clear hierarchy. The most effective attacks are the QNBAD noise-induced backdoors, which poison the parameters so that ZNE extrapolation returns far-from-correct energies without any change to the executed circuit (geometric-mean amplification up to 8.84x on H2/H3+). Next is QTrojan, a circuit-level backdoor that inserts concealed RX/RY layers and amplifies error up to 7.52x. Parameter-space gradient attacks (PGD, FGSM) achieve 2–6x, and QDoor, a parameter-level backdoor based on approximate synthesis, stays near the clean baseline (0.94–1.37x), which the authors a

What carries the argument

The benchmark itself is the key object: VQE-AdvBench fixes a molecule (H2, H3+), a hardware-efficient ansatz (efficient_su2, 24 or 48 parameters), five noise-calibrated IBM fake backends, and a metric (absolute energy error relative to a clean baseline). This fixed configuration is what makes cross-attack comparison possible. For the noise-induced attacks, the target is the Zero-Noise Extrapolation (ZNE) pipeline, which extrapolates noisy expectation values at scaling factors 1..6 to estimate the zero-noise limit; an adversary who shapes the noise trajectory can corrupt the extrapolated result.

Load-bearing premise

The severity ranking assumes that noise-calibrated simulated 'fake' backends replicate real-device behavior closely enough for both ZNE extrapolation and adversarial perturbations, and that comparing each attack to its own clean baseline yields fair amplification factors.

What would settle it

Run the same seven-attack protocol on a real IBM quantum device with H2 and H3+ using the same ansatz and ZNE settings; if QNBAD FreeDrift's geometric-mean amplification does not exceed QTrojan's, or if QDoor exceeds PGD, the reported severity ordering is falsified.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Defenders should treat ZNE and other error-mitigation stages as a critical attack surface, since a compromised service can corrupt results even without modifying the executed circuit.
  • Circuit-level backdoors like QTrojan remain a top threat (7.52x), so validation checks on state-preparation components are warranted.
  • PGD is consistently more damaging than FGSM under the same perturbation budget, so iterative attacks should be a standard part of robustness testing for variational algorithms.
  • Parameter-level backdoors like QDoor appear low-risk on shallow ansatze, but this may change as circuits deepen for larger molecules.
  • The benchmark protocol can be extended to other variational algorithms (e.g., QAOA, VQD) and larger molecules, providing a common baseline for future red-teaming efforts.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because ZNE is a widely used error-mitigation tool beyond VQE, the QNBAD attack class may transfer to other ZNE-based quantum algorithms, making error-mitigation pipelines a general security concern rather than a VQE-specific one.
  • The severity ordering may be an artifact of the shallow-circuit regime; QDoor's weakness could invert on deeper, more expressive circuits used for larger molecules, so the ranking should not be extrapolated without further testing.
  • A cheap testable mitigation is to vary the ZNE polynomial degree or noise-scaling schedule; if QNBAD effectiveness collapses under a different extrapolation fit, defenders gain a low-cost hardening option.
  • The lack of real-hardware validation means the amplification factors are simulation-based; real-device noise drift could change both absolute and relative values, so the ranking should be re-run on actual hardware before operational decisions.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces VQE-AdvBench, a unified red-teaming benchmark for the Variational Quantum Eigensolver, and uses it to compare seven attack scenarios: the QTrojan circuit-level backdoor, the QDoor parameter backdoor, parameter-space FGSM/PGD, and three QNBAD noise-induced variants. Evaluations are performed on H2 and H3+ across five IBM Quantum fake backends under a fixed molecule–ansatz–backend–metric protocol. The central claim is a severity ordering: noise-induced attacks on the ZNE pipeline are the most damaging (up to 8.84× error amplification), followed by QTrojan (7.52×), while QDoor is the least effective (up to 1.37×). The paper also sketches defenses, and explicitly leaves their empirical evaluation to future work.

Significance. A common red-teaming protocol for variational quantum algorithms is timely and practically useful; the paper correctly identifies that prior attack evaluations are heterogeneous and incomparable. The manuscript is transparent about its scope (small molecules, fixed ansatz, fake backends, unevaluated defenses), and the protocol is a valuable starting point. However, the headline severity ordering is not supported as printed because the two result tables use different clean baselines. Re-baselining the QNBAD numbers against the single-noisy clean baseline used for the other attacks reverses the key comparison on the backend where the paper claims the largest QNBAD effect. The benchmark infrastructure has merit and the paper could be made sound with a corrected analysis, but the central conclusion currently rests on an artifact.

major comments (3)
  1. [Section V, Tables I and II, Abstract] The severity ranking mixes incomparable baselines. Table I reports QTrojan/FGSM/PGD amplification relative to a single-noisy clean estimate, while Table II reports QNBAD amplification relative to a ZNE-extrapolated clean estimate. On CAI-H2 the clean baseline changes from 0.0770 (Table I) to 0.0166 (Table II); on CAI-H3+ from 0.1980 to 0.0231. Re-expressing the Table II CAI absolute errors against the Table I clean baseline drops QF's GEO-Mean from 8.84× to about 1.40×, QM to about 1.32×, and QS to about 0.72×, all below QTrojan's 4.48× on the same backend. Moreover, even using the paper's own mixed baselines, QTrojan exceeds every QNBAD variant on four of the five backends (MON, GUA, ALM, AUC); the CAI reversal is entirely attributable to the inconsistent ZNE baseline. The abstract's 'up to 8.84×' vs '7.52×' also compares maxima on different backends. The claim that noise-induced attack
  2. [Section IV, ZNE Setting and Evaluation Metric] The experimental section does not report the number of shots, random seeds, or repeated execution counts. All E_abs values are point estimates of stochastic quantities on noisy backends, and ZNE extrapolation amplifies sampling noise. Without confidence intervals or at least explicit shots/seeds, the approximate equality between the top amplification factors (e.g., 8.84× vs 7.52× on different backends) is not enough to establish a robust ordering. In addition, all results use Qiskit fake backends; no real-device validation is provided, while the threat model and conclusions are phrased in terms of real VQE-as-a-service pipelines. The authors should either add real-hardware experiments or substantially qualify the claims to noise-calibrated simulation.
  3. [Sections III and VIII; References [12,13,16]] Three of the four attack classes that drive the ranking — QTrojan, QDoor, and the QNBAD family — are prior works of this paper's co-authors, and the paper does not identify whether independent third-party implementations were used. This is not definitional circularity, but it creates an implementation-quality confound: a benchmark whose contribution is a head-to-head severity comparison should release the code/data and document how faithfully each attack is instantiated, or include independent implementations. Otherwise the ranking may partly reflect implementation tuning rather than inherent attack effectiveness. This concern should be addressed in a revised version.
minor comments (6)
  1. [Abstract and Section VIII] The severity numbers should state the specific baseline and backend. The current phrasing 'up to 8.84×' vs '7.52×' is misleading because the amplification factors are computed relative to different clean baselines.
  2. [Table II, CAI rows] The CAI clean values in Table II differ by factors of 4–8 from Table I (0.0166 vs 0.0770 for H2; 0.0231 vs 0.1980 for H3+). If this is a deliberate effect of the ZNE baseline, it should be explained; if it is a typographical error, it must be corrected. Either way, the discrepancy needs to be addressed explicitly.
  3. [Section V.A] The text says 'QTrojan, FGSM, and PGD all peak on MON and bottom out on GUA.' This is not consistent with Table I: QTrojan on H3+ peaks on ALM (0.6424) and PGD on H3+ peaks on AUC (0.6630). The statement should be restricted to the GEO-Mean or H2 columns.
  4. [References] Reference [16] (QNBAD) has no venue, arXiv identifier, or publication details. As a central attack family, it needs a complete citation.
  5. [Section III] The taxonomy labels QTrojan as gray-box and QDoor as white-box, but an adversary who can insert pre- and post-encoding layers into the circuit has full circuit-level access. The distinction should be justified.
  6. [Section IV, FGSM/PGD experimental setup] Only one perturbation budget (ε = 0.25 rad) is reported. Since FGSM and PGD are compared across adversaries, a short sensitivity study over ε would make the relative ranking more informative.

Circularity Check

0 steps flagged

No definitional circularity; the severity ordering is an empirical benchmark result, though self-citations and baseline choices warrant scrutiny.

full rationale

The paper's central claim is a severity ordering obtained from simulation runs, not from a derivation that reduces to its inputs. QTrojan, QDoor, FGSM, PGD, and QNBAD are evaluated under the paper's own protocol; the attacks are executed and measured, not assumed effective via citation. The self-citations ([12], [13], [16]) provide the attack constructions and are not used as evidence for the relative severity ranking. There is no fitted parameter renamed as a prediction, no uniqueness theorem imported from the authors' prior work, and no ansatz smuggled in via citation. The different clean baselines for circuit/parameter attacks (single-noisy, Table I) and QNBAD attacks (ZNE-extrapolated, Table II) are a real comparability limitation, but the paper explicitly states this choice: 'compared against a ZNE-extrapolated clean baseline so that attacked and clean estimates share the same pipeline.' That is a methodological fairness decision, not a circular reduction. Consequently, the paper is not circular in the sense of the rubric; the modest score reflects only that several of the evaluated attacks originate from the same author group and are not independently reimplemented here.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 0 invented entities

The benchmark contributes a protocol, not a derivation; its outputs depend on simulation-fidelity assumptions, ZNE configuration choices, and optimizer/attack hyperparameters. The most consequential unverified assumptions are fake-backend fidelity and the use of relative amplification over a ZNE baseline as the headline metric.

free parameters (5)
  • FGSM/PGD perturbation budget epsilon = 0.25 rad
    Set once for all gradient attacks; no sensitivity study, so the relative standing of FGSM/PGD vs other attacks is budget-dependent.
  • ZNE scaling factors = T = {1,2,3,4,5,6}
    Chosen protocol; the clean ZNE baseline and hence the QNBAD amplification factors depend directly on this set.
  • ZNE polynomial degree = 2
    Degree-2 fit used for extrapolation; changing degree changes the clean baseline and all QNBAD relative amplifications.
  • Optimizer iterations and learning rate = 300 steps, lr=0.1 (Adam/SPSA)
    Single configuration for all attacks; no ablations, so optimizer sensitivity is unknown.
  • Ansatz depth (reps) = 2 for H2, 3 for H3+
    Hardware-efficient ansatz depth; the paper itself attributes QDoor's weakness to shallow circuits, so ranking is depth-dependent.
axioms (6)
  • standard math Jordan–Wigner transformation maps the molecular Hamiltonians to qubit Hamiltonians exactly.
    Invoked in Section IV without derivation; standard but load-bearing for H2/H3+ Hamiltonians.
  • standard math The variational principle E(theta) >= E0 holds for the evaluated expectation values.
    Background in Section II; required for treating energy error as the benchmark metric.
  • domain assumption Qiskit fake-backend noise models are faithful proxies for real IBM hardware behavior.
    Section IV uses five fake providers; no real-device runs, so time-dependent drift and crosstalk are excluded.
  • domain assumption ZNE with a degree-2 polynomial over scaling factors 1..6 produces a valid zero-noise baseline.
    The QNBAD severity factors in Table II are measured relative to this baseline; an invalid baseline distorts all factors.
  • domain assumption The stated VQE-as-a-service threat model (compromised provider, co-tenant, or transpiler insider) is realistic.
    Motivates the benchmark in Sections I/III; if such adversaries are implausible, the relevance of the ranking drops.
  • ad hoc to paper Perturbing the optimized parameter vector theta* with FGSM/PGD is a meaningful analogue of evasion for VQE.
    Introduced in Section III; VQE has no classical input or labels, so this adaptation is a modeling choice without independent validation.

pith-pipeline@v1.3.0-alltime-deepseek · 8057 in / 16852 out tokens · 139907 ms · 2026-08-01T12:45:13.025883+00:00 · methodology

0 comments
read the original abstract

The Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware, with applications spanning quantum chemistry, materials science, and drug discovery. As VQE workloads are increasingly deployed through cloud-based ``VQE-as-a-service'' pipelines, they become exposed to adversaries such as compromised service components, malicious co-tenants, or insiders in the transpilation stack, any of which can corrupt results before they reach the user. A range of attacks on variational quantum circuits has been proposed, but each has been studied in isolation: some on quantum classifiers with accuracy-based metrics, others on variational quantum algorithms with energy-error metrics. This lack of a common evaluation setup makes their relative severity difficult to compare and leaves the security of VQE poorly characterized. In this work, we present \textbf{VQE-AdvBench}, the first unified red-teaming benchmark for the Variational Quantum Eigensolver, systematizing these attacks under a single evaluation protocol to rigorously assess VQE's adversarial robustness. We organize attacks along a black-, gray-, and white-box access taxonomy, and evaluate seven representative attack scenarios -- the QTrojan circuit backdoor, the QDoor parameter backdoor, parameter-space adaptations of FGSM and PGD, and three QNBAD noise-induced variants -- over a fixed molecule-ansatz-backend-metric configuration, on H$_2$ and H$_3^+$ across five noise-calibrated IBM backends. Our results reveal a clear severity ordering: noise-induced attacks that manipulate the Zero-Noise Extrapolation (ZNE) pipeline are the most damaging (up to 8.84$\times$ error amplification), followed by the QTrojan circuit-level backdoor (7.52$\times$), while the QDoor parameter-level backdoor is the least effective, yielding only marginal amplification (up to 1.37$\times$).

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

24 extracted references · 6 linked inside Pith

  1. [1]

    A variational eigenvalue solver on a photonic quantum processor,

    A. Peruzzo, J. McClean, P. Shadbolt, M.-H. Yung, X.-Q. Zhou, P. J. Love, A. Aspuru-Guzik, and J. L. O’brien, “A variational eigenvalue solver on a photonic quantum processor,”Nature communications, vol. 5, no. 1, p. 4213, 2014

    2014

  2. [2]

    Variational quantum algorithms,

    M. Cerezo, A. Arrasmith, R. Babbush, S. C. Benjamin, S. Endo, K. Fujii, J. R. McClean, K. Mitarai, X. Yuan, L. Cincioet al., “Variational quantum algorithms,”Nature Reviews Physics, vol. 3, no. 9, pp. 625– 644, 2021

    2021

  3. [3]

    The variational quantum eigensolver: a review of methods and best practices,

    J. Tilly, H. Chen, S. Cao, D. Picozzi, K. Setia, Y . Li, E. Grant, L. Wossnig, I. Rungger, G. H. Boothet al., “The variational quantum eigensolver: a review of methods and best practices,”Physics Reports, vol. 986, pp. 1–128, 2022

    2022

  4. [4]

    Perspective on the current state-of-the-art of quantum computing for drug discovery applications,

    N. S. Blunt, J. Camps, O. Crawford, R. Izs ´ak, S. Leontica, A. Mirani, A. E. Moylett, S. A. Scivier, C. Sunderhauf, P. Schopfet al., “Perspective on the current state-of-the-art of quantum computing for drug discovery applications,”Journal of Chemical Theory and Computation, vol. 18, no. 12, pp. 7001–7023, 2022

    2022

  5. [5]

    Advances and opportunities in materials science for scalable quantum computing,

    V . Lordi and J. M. Nichol, “Advances and opportunities in materials science for scalable quantum computing,”MRS Bulletin, vol. 46, no. 7, pp. 589–595, 2021

    2021

  6. [6]

    Quantum chemistry in the age of quantum computing,

    Y . Cao, J. Romero, J. P. Olson, M. Degroote, P. D. Johnson, M. Kieferov ´a, I. D. Kivlichan, T. Menke, B. Peropadre, N. P. Sawaya et al., “Quantum chemistry in the age of quantum computing,”Chemical reviews, vol. 119, no. 19, pp. 10 856–10 915, 2019

    2019

  7. [7]

    Quantifying sources of uncertainty in drug discovery predictions with probabilistic models,

    S. E. Lazic and D. P. Williams, “Quantifying sources of uncertainty in drug discovery predictions with probabilistic models,”Artificial Intelligence in the Life Sciences, vol. 1, p. 100004, 2021

    2021

  8. [8]

    Which molecular properties determine the impact sensitivity of an explosive? a machine learning quantitative investigation of nitroaromatic explosives

    J. C. Duarte, R. D. da Rocha, and I. Borges, “Which molecular properties determine the impact sensitivity of an explosive? a machine learning quantitative investigation of nitroaromatic explosives.” Physical chemistry chemical physics : PCCP, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:256857557

    2023

  9. [9]

    Critical evaluation of quantum machine learning for adversarial robustness,

    S. R. Nowmi, J. Lopez, M. M. A. Imon, S. Pouryousef, and M. S. Rah- man, “Critical evaluation of quantum machine learning for adversarial robustness,”arXiv preprint arXiv:2511.14989, 2025

    Pith/arXiv arXiv 2025

  10. [10]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,

    M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Liet al., “Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,”arXiv preprint arXiv:2402.04249, 2024

    Pith/arXiv arXiv 2024

  11. [11]

    Robustbench: a standardized adversarial robustness benchmark,

    F. Croce, M. Andriushchenko, V . Sehwag, E. Debenedetti, N. Flammar- ion, M. Chiang, P. Mittal, and M. Hein, “Robustbench: a standardized adversarial robustness benchmark,”arXiv preprint arXiv:2010.09670, 2020

    Pith/arXiv arXiv 2010

  12. [12]

    Qtrojan: A circuit back- door against quantum neural networks,

    C. Chu, L. Jiang, M. Swany, and F. Chen, “Qtrojan: A circuit back- door against quantum neural networks,” inICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  13. [13]

    Qdoor: Exploiting ap- proximate synthesis for backdoor attacks in quantum neural networks,

    C. Chu, F. Chen, P. Richerme, and L. Jiang, “Qdoor: Exploiting ap- proximate synthesis for backdoor attacks in quantum neural networks,” in2023 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 1. IEEE, 2023, pp. 1098–1106

    2023

  14. [14]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  15. [15]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    Pith/arXiv arXiv 2017

  16. [16]

    Qnbad: Quantum noise-induced backdoor attacks against zero noise extrapolation

    C. Chu, Q. Lou, F. Chen, and L. Jiang, “Qnbad: Quantum noise-induced backdoor attacks against zero noise extrapolation.”

  17. [17]

    Error mitigation for short- depth quantum circuits,

    K. Temme, S. Bravyi, and J. M. Gambetta, “Error mitigation for short- depth quantum circuits,”Physical review letters, vol. 119, no. 18, p. 180509, 2017

    2017

  18. [18]

    Pennylane quantum chemistry datasets,

    U. Azad and S. Fomichev, “Pennylane quantum chemistry datasets,” Accessed: Jul, vol. 19, p. 2025, 2023

    2025

  19. [19]

    ¨Uber das Paulische ¨Aquivalenzverbot,

    P. Jordan and E. Wigner, “ ¨Uber das Paulische ¨Aquivalenzverbot,” Zeitschrift fur Physik, vol. 47, no. 9-10, pp. 631–651, Sep. 1928

    1928

  20. [20]

    Quantum computing with qiskit,

    A. Javadi-Abhari, M. Treinish, K. Krsulich, C. J. Wood, J. Lishman, J. Gacon, S. Martiel, P. D. Nation, L. S. Bishop, A. W. Crosset al., “Quantum computing with qiskit,”arXiv preprint arXiv:2405.08810, 2024

    Pith/arXiv arXiv 2024

  21. [21]

    Mitiq: A software package for error mitigation on noisy quantum computers,

    R. LaRose, A. Mari, S. Kaiser, P. J. Karalekas, A. A. Alves, P. Czarnik, M. El Mandouh, M. H. Gordon, Y . Hindy, A. Robertsonet al., “Mitiq: A software package for error mitigation on noisy quantum computers,” Quantum, vol. 6, p. 774, 2022

    2022

  22. [22]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” inInternational sympo- sium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273–294

    2018

  23. [23]

    Noise tailoring for scalable quantum computation via randomized compiling,

    J. J. Wallman and J. Emerson, “Noise tailoring for scalable quantum computation via randomized compiling,”Physical Review A, vol. 94, no. 5, p. 052325, 2016

    2016

  24. [24]

    Qumos: A framework for preserving security of quantum machine learning model,

    Z. Wang, J. Li, Z. Hu, B. Gage, E. Iwasawa, and W. Jiang, “Qumos: A framework for preserving security of quantum machine learning model,” in2023 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 1. IEEE, 2023, pp. 1089–1097

    2023