⚛️ quantum physics

Predominant Aspects on Security for Quantum Machine Learning: Literature Review

This paper presents a systematic literature review that categorizes the unique security vulnerabilities and strengths of Quantum Machine Learning, highlighting novel attack vectors and proposed mitigation strategies to guide the secure deployment of QML in real-world applications.

Original authors: Nicola Franco, Alona Sakhnenko, Leon Stolpmann, Daniel Thuerck, Fabian Petsch, Annika Rüll, Jeanette Miriam Lorenz

Published 2026-02-18

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nicola Franco, Alona Sakhnenko, Leon Stolpmann, Daniel Thuerck, Fabian Petsch, Annika Rüll, Jeanette Miriam Lorenz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a brand-new, super-fast race car. This isn't just any car; it's a Quantum Machine Learning (QML) vehicle. It uses the weird, mind-bending rules of quantum physics (like being in two places at once) to solve problems that would take a normal car centuries to finish.

However, before you can let this car race on the public highway, you need to make sure it's safe. You need to know: Can someone hack it? Can someone crash it? And how do we protect it?

This paper is like a safety inspection report written by a team of experts. They looked at all the existing research to answer these questions. Here is the breakdown in simple terms:

1. The New Car vs. The Old Car

Classical Computers (The Old Car): These are like standard calculators. They do math one step at a time, very logically.
Quantum Computers (The New Car): These use "qubits." Think of a qubit not as a light switch (On/Off), but as a spinning coin. It's heads and tails at the same time until you catch it. This allows the computer to try millions of paths simultaneously.
The Problem: Because this technology is so new and uses spinning coins instead of light switches, the rules for breaking it are totally different. You can't just use the same locks you used on the old car.

2. The New Ways to Break the Car (Vulnerabilities)

The authors found that while QML is powerful, it has some unique "Achilles' heels" that classical computers don't have.

The "Ghost in the Machine" (Fault Injections): Imagine a saboteur hiding a tiny, invisible trap in your car's engine. When the car is driving normally, the trap does nothing. But if the driver hits a specific bump (a specific data input), the trap springs, and the car suddenly drives off a cliff. In QML, this is called a "Trojan virus" or "backdoor" that waits for a specific signal to crash the system.
The "Crowded Garage" Problem (Cross-Talk & Noise): Quantum computers are currently built in "Noisy Intermediate-Scale" (NISQ) environments. Imagine trying to have a quiet conversation in a room full of people shouting.
- Cross-Talk: If you run two programs on the same quantum chip, they might accidentally "talk" to each other. One program might accidentally nudge the other, causing errors.
- The Shuttle Trap: In some quantum computers (ion traps), the data (ions) have to be physically moved around like a shuttle bus. An attacker could force the shuttle to run back and forth endlessly, wearing out the system or causing it to fail.
The "Fragile Giant" (Scaling Pitfall): The more powerful you make the quantum computer (adding more qubits), the more sensitive it becomes. It's like a giant, delicate glass sculpture. A tiny, almost invisible tap (a tiny change in data) can shatter the whole thing. The bigger the system gets, the harder it is to prove it's safe.

3. The New Armor (Defenses)

So, how do we protect this fragile, super-fast car? The paper suggests three main strategies:

Training with Fire (Adversarial Training):
- The Analogy: Imagine a boxer who only trains by fighting a slow, clumsy opponent. They will get knocked out in a real fight. But if you train them by fighting the best boxers in the world who are trying to knock them out, they become incredibly tough.
- In QML: Researchers are teaching the AI to fight against "fake" attacks. They deliberately feed the model bad data to see where it breaks, then fix those weak spots so it becomes unbreakable.
The "Foggy Window" (Differential Privacy):
- The Analogy: Imagine you want to know the average height of people in a room, but you don't want to know exactly how tall you are. You add a little bit of "fog" (random noise) to the data. The fog is thick enough to hide your identity, but thin enough that you can still see the average.
- In QML: They add random quantum noise to the data. This makes it impossible for hackers to reverse-engineer the private data, but the AI can still learn the patterns. Interestingly, the paper suggests that the "noise" that usually breaks quantum computers can actually be used as a shield here!
The Mathematical Blueprint (Formal Verification):
- The Analogy: Instead of crash-testing a car 1,000 times to see if it breaks, a mathematician writes a proof that says, "Based on the laws of physics and engineering, this car cannot break under these specific conditions."
- In QML: Researchers are using advanced math to prove, beyond a doubt, that the AI model will behave correctly even if someone tries to trick it.

4. The Bottom Line

The paper concludes with a warning and a hope:

The Warning: We cannot just copy-paste security rules from old computers to quantum ones. The new technology has new weaknesses (like the "shuttle" traps and "cross-talk") that we are just starting to understand.
The Hope: Quantum models actually seem to be naturally tougher against some types of attacks than classical ones. If we combine the best of both worlds (classical security + quantum physics), we can build a system that is not only super-fast but also incredibly secure.

In short: Quantum Machine Learning is a super-powerful new engine, but it comes with a new set of risks. We need to invent new locks, new training methods, and new math to keep it safe before we put it on the road.

1. Problem Statement

Quantum Machine Learning (QML) represents a convergence of Quantum Computing (QC) and classical Machine Learning (ML), promising computational breakthroughs. However, as QML transitions from theoretical concepts to practical applications on Noisy Intermediate-Scale Quantum (NISQ) devices, it faces unique security challenges that extend beyond classical ML vulnerabilities.

The core problem addressed is the lack of a comprehensive understanding of:

Novel Attack Vectors: Security threats specific to quantum architectures (e.g., hardware noise, qubit cross-talk) that have no classical analogues.
Scaling Pitfalls: The trade-off between increasing quantum system size (to achieve quantum advantage) and the exponential increase in sensitivity to perturbations, which compromises security verification.
Defense Gaps: The need for robust mitigation strategies tailored specifically for the quantum domain, rather than simply adapting classical defenses.

2. Methodology

The authors conducted a systematic literature review following the PRISMA framework to ensure an unbiased and rigorous selection of relevant studies.

Data Sources: Academic databases including IEEE, Web of Science, Springer, Elsevier, Physical Review journals, and arXiv.
Search Strategy:
- Inclusion Criteria: Papers focusing on QML security, vulnerabilities, attack vectors, and defenses (written in English, post-2018).
- Exclusion Criteria: Papers focusing solely on quantum cryptography, key distribution, blockchain, or those lacking direct relevance to QML security.
- Scoring Mechanism: An automated scoring system weighted search terms (e.g., "Secur*", "Vulnerabil*", "Attack") and penalized irrelevant topics (e.g., "Cryptography", "Key Distribution").
Selection Process:
- Initial identification: 4,658 records.
- After deduplication and filtering (removing pre-2018 and ineligible records): 1,000 records screened.
- Final selection: 27 records (23 from screening + 4 from reference snowballing) were included for deep analysis.

3. Key Contributions

The paper provides a structured taxonomy of QML security, categorizing findings into Vulnerabilities and Defenses.

A. Quantum Vulnerabilities & Attack Vectors

The review identifies two primary categories of threats unique to QML:

Quantum Attack Vectors (No Classical Analogue):
- Fault Injections (Trojan Viruses): Attackers can embed backdoors in Parametrized Quantum Circuits (PQCs). These remain dormant during training but activate post-synthesis or during inference to manipulate encoding feature maps, achieving near 100% success rates while maintaining high accuracy on clean data.
- Exploiting Quantum Noise: In multi-tenant cloud environments, attackers can induce specific hardware errors to degrade performance or cause Denial-of-Service (DoS).
  - Superconducting Systems: Inducing cross-talk between circuits.
  - Ion-Trap Systems: Forcing repeated shuttle operations (physically moving ions), increasing error rates.
  - Information Leakage: Exploiting correlated read-out errors to extract data.
Scaling Pitfalls:
- As the dimensionality of the Hilbert space increases (more qubits), quantum classifiers become exponentially more sensitive to minor perturbations near decision boundaries.
- Universal Adversarial Perturbations: Small input changes can compromise entire sets of classifiers.
- Verification Cost: The resources required to verify security scale exponentially with the number of qubits, potentially negating the "quantum advantage."

B. Defense Mechanisms

The paper categorizes defenses into three main pillars:

Adversarial Training:
- Adapting classical techniques (FGSM, PGD, BIM) to QML.
- Findings: Quantum variational circuits show higher resistance to transferred attacks (attacks from classical models) compared to classical networks.
- Innovation: Use of random unitary encodings and quantum gradient ascent to generate adversarial samples, significantly boosting robustness.
Data Privacy (Differential & Inherent):
- Quantum Differential Privacy: Intentionally adding noise (e.g., rotation noise, depolarization) during training to obscure individual data points. This has been proven to increase classifier robustness against adversarial attacks.
- Inherent Privacy: Overparameterized QML models with highly expressive encoding (high Fourier frequency spectrum) naturally resist gradient inversion attacks, particularly in federated learning setups.
Formal Verification:
- MILP Verification: Transforming neural network robustness verification into Mixed-Integer Linear Programs (MILP) solvable via quantum annealing or variational algorithms (e.g., Benders decomposition).
- Lipschitz Continuity: Using Semi-definite programming to derive analytical lower bounds for robust accuracy and verify $\epsilon$ -robustness.
- Fairness: Linking fairness verification to quantum measurement distinguishability (trace distance).

4. Results

Unique Threat Landscape: QML introduces specific risks like cross-talk and shuttle manipulation that classical systems do not face.
Resilience Paradox: While QML models are vulnerable to specific quantum noise attacks, they often exhibit inherent resilience against classical adversarial attacks (e.g., transferred attacks) and certain gradient-based inversions due to the nature of quantum state spaces.
Noise as a Feature: Unlike classical ML where noise is purely detrimental, in QML, controlled noise (via differential privacy) can be leveraged to enhance model robustness and privacy.
Verification Bottleneck: The exponential scaling of verification resources remains a critical barrier to the secure deployment of large-scale QML models.

5. Significance and Future Directions

This paper serves as a foundational reference for researchers and practitioners navigating the security of QML. Its significance lies in:

Shifting the Paradigm: Moving the security discussion from "classical ML on quantum hardware" to "native quantum vulnerabilities."
Strategic Guidance: Highlighting that future security must address hardware-specific interactions (e.g., cross-talk) and the scaling trade-offs of Hilbert spaces.
Call for Action: The authors emphasize the need for:
- Cross-disciplinary research bridging QC and ML.
- Empirical benchmarking with standardized datasets and metrics specific to QML.
- Hybrid defense mechanisms that combine classical and quantum techniques.

The review concludes that while QML offers powerful capabilities, its secure deployment requires rigorous, specialized research into verification methods and hardware-aware defense strategies to mitigate both novel quantum attacks and the inherent fragility of NISQ devices.