⚛️ quantum physics

Fault Attacks on ML-based Quantum Control and Error Correction

This paper presents the first analysis of physical fault injection attacks on machine learning models used in quantum computing, demonstrating that voltage glitches can significantly degrade the accuracy of readout error correction and quantum error decoding by inducing structured bit-level corruption rather than random noise.

Original authors: Anthony Etim, Jakub Szefer

Published 2026-07-30

📖 4 min read🧠 Deep dive

CC BY 4.0

Original authors: Anthony Etim, Jakub Szefer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where computers don't just crunch numbers but dance with the very fabric of reality, using tiny particles called qubits to solve problems that would take normal computers a million years. This is the realm of quantum computing. But these quantum dancers are incredibly shy and sensitive; a single sneeze from the environment can ruin their performance. To keep them on track, we use "error correction," a safety net that constantly checks if a qubit has stumbled and fixes it. In the past, this safety net was a rigid set of rules, but recently, scientists started teaching these safety nets to learn on their own using Machine Learning (ML). Think of it as upgrading a rigid rulebook into a smart, intuitive coach that can spot subtle mistakes and fix them instantly.

However, there's a catch. Just like a human coach can be tricked by a well-timed distraction, these smart ML coaches can be confused. This paper explores a very specific, physical way to confuse them: by giving the computer's brain a tiny, momentary "glitch" in its power supply. It's like flicking a light switch on and off so fast that the computer's brain stumbles for a split second. The researchers wanted to know: if someone could sneak up and flick the power switch on the machine controlling the quantum computer, could they make the smart coach give the wrong advice? And if they did, would the quantum computer just get a little noisy, or would it completely lose its way?

The researchers, Anthony Etim and Jakub Szefer, decided to test this theory on two different types of "smart coaches" used in quantum systems. The first was a model called HERQULES, which acts like a translator, trying to figure out what a group of five quantum particles are saying when they are all talking over each other. The second was a "Deep Q" decoder, a more complex coach that acts like a detective, looking at a map of clues (called syndromes) to decide how to fix errors in a large quantum puzzle.

To test them, the team set up a lab experiment using a device called a ChipWhisperer Husky. This device is like a precise surgeon's scalpel for electricity; it can inject a tiny, perfectly timed voltage glitch into the power line of the computer running the ML models. They didn't just throw random glitches; they synchronized the glitches to hit the computer at the exact moment it was processing specific parts of its "brain" (the different layers of the neural network).

The results were startling. They found that these smart coaches are surprisingly fragile. When they glitched the early parts of the HERQULES translator, it made mistakes much more often than when they glitched the later parts. In fact, for the Deep Q decoder, a single, well-placed glitch could drop its accuracy from a perfect 100% down to as low as 21.57%. But the scary part wasn't just the number of mistakes; it was the kind of mistakes.

Usually, when you mess with a computer, you expect random noise—like static on a radio. But here, the glitches caused "structured corruption." It was as if the glitch didn't just confuse the coach; it brainwashed it. The Deep Q decoder, which is supposed to look at different clues and choose different fixes, started ignoring the clues entirely. Instead, it would pick the exact same fix every single time, no matter what the problem was. In one experiment, the decoder collapsed into choosing "Action 0" for almost every single input, effectively giving up on its job.

The researchers also simulated what happens if the computer's brain encounters "non-finite" numbers (like infinity or "Not a Number") due to a glitch. They found that injecting just five of these weird numbers into the first layer of the Deep Q decoder was enough to make the whole system collapse into that single, wrong action. This suggests that the failure isn't just random noise; it's a specific vulnerability where a tiny error in the early stages of processing can cascade into a total system failure.

The paper concludes that while these ML models are great at making quantum computers work, they are also a new kind of weak spot. If an attacker with physical access to the controller can flick the power switch at the right millisecond, they could silently sabotage the quantum computer's ability to correct its own errors. The authors suggest that we need to treat these ML models as critical security components, perhaps by adding simple checks to catch these glitches or by having the computer double-check its own work, just to make sure it hasn't been tricked into a trance.

Technical Summary: Fault Attacks on ML-based Quantum Control and Error Correction

Problem Statement
Machine learning (ML) models are increasingly integral to quantum computing systems, serving critical roles in discriminating multi-qubit readouts, mitigating correlated readout errors, and decoding quantum error-correcting (QEC) codes. While these models improve fidelity, they introduce a new security dependency: the classical controllers running these inference tasks. This paper addresses a gap in the security analysis of quantum systems by investigating the susceptibility of embedded ML models to physical fault injection. Specifically, it examines whether an adversary with physical access to the classical controller can induce faults via voltage glitching to cause incorrect readout corrections or erroneous error-correction decoding, thereby compromising the integrity of the quantum computation.

Methodology
The authors conducted a hardware-based fault injection study using two representative ML architectures deployed on a commodity Micro-Controller Unit (MCU), the ChipWhisperer Husky (AT-SAM4S2A, Cortex-M4). The experimental setup involved:

Target Models:
- HERQULES: A fully connected neural network (two dense layers with ReLU activations) for 5-qubit readout error correction, classifying 32 possible bitstrings.
- Deep Q Decoder: A Convolutional Neural Network (CNN) based Deep Q-learning agent for decoding the distance-5 Surface Code, mapping syndrome histories to corrective Pauli actions.
Attack Vector: The researchers utilized voltage glitching, synchronized via a trigger signal emitted at the start of specific neural network layers. This non-invasive technique perturbs the controller's supply rail to induce transient computation errors without modifying firmware or requiring cryogenic access.
Search Strategy: An automated search using Optuna was employed to explore the fault parameter space (glitch width, intra-cycle offset, external offset, and repeat count) to identify high-impact fault settings.
Evaluation Metrics: Success was measured by the rate of mispredictions (untargeted degradation) and the ability to bias outputs toward specific classes or actions (targeted steering). Failure structures were analyzed using confusion matrices, Hamming distances, and bit-flip statistics.

Key Contributions

First Hardware Study: This work presents the first hardware fault-injection study targeting embedded ML models within the quantum control stack, covering both readout error correction and QEC decoding.
Layer-Level Susceptibility Mapping: The study formalizes a practical adversary model and localizes successful fault injections to specific neural network layers, comparing dense, convolutional, ReLU, and output layers.
Automated Fault Discovery: Implementation of a repeatable, trigger-synchronized workflow that efficiently identifies high-impact fault parameters under constraints.
Characterization of Failure Modes: Quantification of how specific readout and decoding outputs degrade, demonstrating that faults often induce structured corruption rather than random noise.

Experimental Results

HERQULES (Readout Correction):
- All layers were found susceptible to fault injection.
- Layer Dependence: Early layers (Dense 1 and ReLU 1) exhibited significantly higher misprediction rates (up to 27/96 successful faults) compared to later layers (~5/96). This suggests that faults in early, wide layers with long multiply-accumulate chains propagate more effectively through the network.
- Structured Bias: While untargeted degradation was common, targeted steering toward specific bitstrings was harder to achieve but observed (e.g., biasing outputs toward "00001" under Layer 2 faults).
Deep Q Decoder (Surface Code):
- Catastrophic Collapse: A single voltage glitch in either the first convolutional layer (Conv1) or the final fully connected output layer (FC2) reduced decoding accuracy from 100% to as low as 21.57%.
- Mode Collapse: The failures were highly structured. Instead of random noise, the decoder collapsed to a single dominant action (Action 0) regardless of the input syndrome.
- Mechanism Verification: Software-level injection of non-finite values (NaN, $\pm\infty$ ) into the Conv1 output replicated the hardware glitch's failure mode, confirming that non-finite propagation through ReLU and dense layers drives the collapse.
- Noise Model Variance: The relative susceptibility of Conv1 vs. FC2 varied depending on the noise model (X-noise vs. Depolarizing), with FC2 being more fragile in the Depolarizing model.

Significance and Claims
The paper argues that ML-based readout and error-correction decoding must be treated as security-critical components. The significance of these findings lies not merely in the reduction of accuracy metrics, but in the nature of the failures:

Syndrome-Independent Decoding: In QEC, a decoder that outputs a fixed action regardless of the input syndrome invalidates the fundamental fault-tolerance guarantees of the surface code. This is a silent, well-formed failure that standard checks may not flag.
Feedback Loops: Unlike one-shot image classification, errors in quantum control feed back into calibration loops and subsequent decoding rounds. A structured bias can compound into logical errors and corrupt calibration states, causing damage that persists after the attack ends.
Attack Surface: The study demonstrates that physical fault injection on the classical controller is a viable, low-cost attack vector that does not require access to the quantum processor or cryogenic hardware.

The authors conclude that lightweight defenses, such as redundant inference, cross-checking against simpler baselines (e.g., MWPM), runtime sanity checks for non-finite values, and hardware glitch monitors, are necessary to secure the quantum computing pipeline.

Technical Summary: Fault Attacks on ML-based Quantum Control and Error Correction

More like this