Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks
📄 arXiv:2607.11843 · 📥 PDF · 2026-07-13 · quant-ph
Authors: Junrui Zhang [arXiv · scholar] , Zemin Chen [arXiv · scholar] , Lusi Li [arXiv · scholar] , Mohammad Ghasemigol [arXiv · scholar] , Daniel Takabi [arXiv · scholar] , Rui Ning [arXiv · scholar]
🕰 Orloj analysis
Tento článek navrhuje Q-DIBA, první vstupně-uvědomělý dynamický backdoor útok pro kvantové neuronové sítě (QNN), řešící slabiny pevných spouštěčů a problémy s kvantovým učením. Útok využívá strategii tří režimů a ztrátu kontrastu hustoty pro stabilní kvantovou supervizi, dosahující vysoké přesnosti a odolnosti proti obraně.
💡 Práce představuje významný pokrok v oblasti bezpečnosti QNN, zavádějící novou třídu útoků s vysokou praktickou hodnotou pro vývoj robustních kvantových systémů.
Categories:
QFD-6
INF-3
MET-5
INF-4
EXP-1
MET-2
✓ falsifiable, modest_claims
📄 Abstract
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.