CutBackdoor: A Circuit Cut Triggered Backdoor Attack on Variational Quantum Algorithms
📄 arXiv:2607.18126 · 📥 PDF · 2026-07-20 · quant-ph
Authors: Ahatesham Bhuiyan [arXiv · scholar] , Hoang Ngo [arXiv · scholar] , Cheng Chu [arXiv · scholar] , Qian Lou [arXiv · scholar] , Lei Jiang [arXiv · scholar] , My T. Thai [arXiv · scholar] , Mengxin Zheng [arXiv · scholar]
🕰 Orloj analysis
Tento článek představuje CutBackdoor, nový útok typu backdoor na Variational Quantum Algorithms (VQAs), který se spouští při použití techniky dělení kvantových obvodů (circuit cutting) kvůli omezené kapacitě hardwaru. Útočníci otráví předem natrénované parametry VQA, což vede k výrazným chybám při rekonstrukci dělené cesty, zatímco na plném obvodu zůstává útok neodhalený.
💡 Práce přináší novou a praktickou bezpečnostní zranitelnost v dodavatelském řetězci VQA, využívající přehlížený útočný povrch v dělení kvantových obvodů, což má významnou hodnotu pro výzkum kvantové bezpečnosti.
Categories:
QFD-5
MET-5
INF-7
QFD-6
MET-4
INF-6
MET-6
✓ falsifiable, modest_claims, limit_reductions
📄 Abstract
Variational Quantum Algorithms (VQAs) are a leading paradigm for near-term quantum computing, combining parameterized quantum circuits with classical optimization across quantum chemistry, combinatorial optimization, and quantum machine learning. Since real-world VQA deployments routinely require circuits that exceed available hardware capacity, quantum circuit cutting has become an indispensable execution strategy, and pre-trained parameters are increasingly distributed through public repositories, introducing supply-chain security risks that have received little attention. Prior quantum backdoor attacks either introduce detectable circuit modifications or depend on device-specific noise, and none consider circuit cutting as an attack surface. We present CutBackdoor, the first parameter-supply-chain backdoor that uses cut circuit execution from CutQC as the deployment-time trigger against VQAs. Under noisy finite-shot circuit-cut execution, poisoned parameters preserve full-circuit validation performance while substantially increasing cut-path reconstruction error, without any circuit modification. The trigger activates when a resource-limited victim responds to a qubit-capacity mismatch by invoking the cutting workflow, requiring no attacker presence at deployment. We provide a theoretical analysis and empirically validate it across varying shot budgets. Evaluation across multiple VQA benchmarks on IBM quantum backends demonstrates cut-path energy amplification of $1.3\times$ to $2.9\times$ \revA{over clean baselines on the VQE and VQD benchmarks while maintaining small stealthiness error on the full-circuit path. The cut-path gap persists across the evaluated backends and cut placements under matched compilation; Zero-Noise Extrapolation provides only partial mitigation, and the diagonal-cost QAOA benchmark delineates the attack's structural boundary