⚛️ quantum physics

An End-to-End Multi-Stage Kill-Chain Attack on Quantum Neural Networks: Demonstration on Trapped-Ion Hardware

This paper demonstrates a comprehensive, multi-stage attack on a quantum neural network running on trapped-ion hardware, which integrates side-channel reconnaissance, crosstalk characterization, and adversarial example generation to physically manipulate the device, while also addressing implications for quantum-as-a-service providers and potential hardware mitigations.

Original authors: Cedric Brügmann, Daniel Herr, Daniel Ohl de Mello, Pascal Debus, Maximilian Wendlinger, Kilian Tscharke, Juris Ulmanis, Alexander Erhard, Arthur Schmidt, Fabian Petsch

Published 2026-07-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Cedric Brügmann, Daniel Herr, Daniel Ohl de Mello, Pascal Debus, Maximilian Wendlinger, Kilian Tscharke, Juris Ulmanis, Alexander Erhard, Arthur Schmidt, Fabian Petsch

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a high-tech quantum computer not as a magical black box, but as a very sensitive, delicate orchestra playing a specific piece of music. This paper describes how a "hacker" could sneak into this orchestra, listen to the musicians, figure out exactly what song they are playing, and then subtly mess with the instruments to make the music sound wrong—all without the conductor (the computer owner) realizing what happened.

Here is the story of their "kill-chain" attack, broken down into simple steps:

1. The Setup: The Quantum Orchestra

The researchers used a real quantum computer made of trapped ions (tiny charged atoms held in place by lasers). They set up a "Quantum Neural Network" (QNN), which is like a smart student trying to learn to recognize four different symbols (like a plus sign, a minus sign, and two brackets).

2. The Attack Plan: A Three-Stage Heist

Instead of just trying to break the computer with brute force, the attackers used a "kill-chain" strategy. Think of this like a bank robber who doesn't just smash the door; they first scout the building, then pick the lock, and finally disable the alarm.

Stage 1: The Eavesdropper (Reconnaissance)

The Metaphor: Imagine the quantum computer is a house. The attackers can't see inside, but they can stand outside and listen to the electricity usage of the house. Every time a door opens or a light turns on, the power meter spikes in a specific pattern.
What they did: The attackers monitored the power traces (the electrical energy used by the control lasers). Because every quantum circuit uses a unique pattern of pulses, the power consumption looked like a unique fingerprint.
The Result: By comparing the victim's power fingerprint against a library of known "dummy" circuits, the attackers successfully guessed the exact structure of the victim's quantum model (how many atoms they used, how many layers of logic, and how they were connected). They didn't need to see the code; the electricity told them everything.

Stage 2: The Forger (Adversarial Examples)

The Metaphor: Now that the attackers know the song the orchestra is playing, they want to change the ending. In the digital world, they created "adversarial examples." This is like taking a photo of a stop sign and adding a few invisible pixels that make a self-driving car think it's a speed limit sign.
What they did: Using a powerful computer simulation, they calculated tiny, almost invisible changes to the input data that would trick the quantum model into making a mistake.
The Problem: They couldn't just send these "invisible pixels" to the real quantum computer. The real hardware has physical limits. It's like trying to change a note in a live orchestra by whispering to the violinist; you can't just type a new note into the air.

Stage 3: The Saboteur (The Physical Crosstalk Attack)

The Metaphor: This is the clever part. The attackers realized that in this specific quantum computer, if you shine a laser at one atom, the light "spills over" slightly and nudges its neighbor. This is called crosstalk. It's like if you tap a drum, the vibration travels through the floor and makes the drum next to it wobble slightly.
What they did:
1. They used the information from Stage 1 to know exactly when the victim's "music" was playing.
2. They used the math from Stage 2 to know what kind of nudge was needed to trick the model.
3. They ran their own "disturbance" lasers on the atoms next to the victim's atoms at the exact right moment.
4. The "spillover" light from their lasers nudged the victim's atoms just enough to mimic the "invisible pixels" they calculated earlier.
The Result: The victim's quantum computer processed the data, but because of the physical nudges from the neighbors, it got confused and gave the wrong answer.

3. The Outcome

The researchers proved that they could:

Spy on the computer's structure just by listening to its power usage.
Calculate a way to trick it.
Physically execute that trick by using the computer's own physical flaws (crosstalk) against it.

When they tested this on real hardware, the attack worked. The quantum model, which was usually correct, started making mistakes because of the subtle physical nudges from the "neighbor" atoms.

Why Does This Matter?

The paper concludes that we can't just look at quantum security in isolation. We can't just worry about "bad code" or "bad math." We have to worry about how the physical hardware behaves, how it leaks information through electricity, and how users sharing the same machine can accidentally (or intentionally) mess with each other.

In short: The paper shows that if you share a quantum computer with a stranger, they might be able to listen to your electricity usage to learn your secrets, and then use the physical vibrations of their own work to trick your results. It's a reminder that in the quantum world, the physical hardware and the digital code are deeply intertwined.

Technical Summary: End-to-End Multi-Stage Kill-Chain Attack on Quantum Neural Networks

Problem Statement

The deployment of Quantum Machine Learning (QML) on real Quantum Processing Units (QPUs) expands the attack surface beyond idealized simulations. While existing literature has examined individual attack vectors—such as side-channel attacks, crosstalk, and adversarial examples—in isolation, there is a lack of understanding regarding how these vectors can be combined into a coherent, multi-stage attack campaign. Current security analyses often fail to capture the interdependencies between hardware-level weaknesses (e.g., side-channel leakage, crosstalk-induced faults) and algorithmic manipulations (e.g., adversarial perturbations) in practical, multi-tenant cloud environments. This paper addresses the gap by demonstrating an end-to-end "kill-chain" attack that links reconnaissance, model inference, and physical hardware manipulation to compromise a Quantum Neural Network (QNN).

Methodology

The authors propose a structured, five-stage attack pipeline adapted from classical IT security frameworks (specifically the MITRE ATT&CK and Lockheed Martin Cyber Kill Chain) to the QML context. The methodology was executed on a trapped-ion quantum computer (AQT Ibex), with supplementary experiments on superconducting hardware detailed in the appendix.

1. Reconnaissance (Side-Channel Analysis)

The first stage involves inferring the victim QNN's structural parameters without direct access to the model weights.

Technique: The attacker captures power traces from the control electronics during the execution of the victim circuit.
Process: These traces are compared against a library of 24 benchmark circuits with varying qubit counts (4 vs. 8), layer depths (2, 4, 6, 8), and entanglement patterns.
Mechanism: By filtering candidates based on total execution duration and calculating the Euclidean distance ( $L_2$ -norm) between the victim's power profile and the benchmarks, the attacker identifies the exact circuit architecture (qubit count, depth, and entanglement structure).

2. Adversarial Example Generation

Once the architecture is known, the attacker generates adversarial examples.

Constraint: The attack is constrained by the physical limitations of the AQT trapped-ion hardware. Crosstalk on this platform is primarily induced by single-qubit rotation gates. Virtual $R_Z$ gates do not produce physical pulses and thus generate no crosstalk.
Implementation: The authors employ Projected Gradient Descent (PGD) to generate adversarial inputs. Crucially, they apply a mask that restricts perturbations only to input features encoded via $R_Y$ rotations. This ensures the resulting adversarial perturbation is physically realizable via crosstalk.

3. Physical Attack (Crosstalk Injection)

The final stage translates the abstract adversarial perturbation into a physical hardware attack.

Mechanism: The attacker schedules concurrent execution of their own circuit on neighboring qubits. By applying specific $R_Y$ rotation gates to these neighbors at precise times (determined during reconnaissance), they induce crosstalk on the victim's qubits.
Goal: The induced crosstalk creates an effective rotation angle on the victim's qubits that approximates the mathematically calculated adversarial perturbation, thereby manipulating the victim model's input without modifying the data or the model parameters.

Key Contributions

First End-to-End Demonstration: The paper presents the first demonstration of a multi-stage kill-chain attack on a QNN running on real trapped-ion hardware, successfully linking side-channel reconnaissance to physical crosstalk attacks.
Structured Taxonomy: It introduces a kill-chain taxonomy for QML, explicitly mapping the interdependencies between hardware vulnerabilities (power traces, crosstalk) and algorithmic attacks (adversarial examples).
Hardware-Aware Adversarial Generation: The work demonstrates a method for generating adversarial examples that respect specific hardware constraints (e.g., the inability to perturb $R_Z$ -encoded features via crosstalk on AQT devices).
Empirical Validation: The study validates that information leaked via power traces is sufficient to reconstruct the victim's circuit structure with high confidence, enabling targeted attacks.

Results

Reconnaissance Success: The power-trace-based reconnaissance successfully identified the victim QNN's architecture (4 qubits, 4 layers) by matching it against benchmark circuits. The timing and amplitude signatures provided a unique fingerprint for the circuit structure.
Adversarial Vulnerability: Using PGD, the authors found that 840 out of 1,000 training samples could be misclassified with a perturbation budget ( $\epsilon$ ) of $\le 1.0$ . Under adversarial perturbation, the QNN's classification accuracy collapsed from 92.4% to 1.07%.
Crosstalk Effectiveness: When 50 samples susceptible to adversarial attacks (identified via simulation) were executed on AQT Ibex hardware:
- The "clean" hardware accuracy was 0.64.
- The "crosstalk" attack (inducing perturbations via neighbor rotations) resulted in an accuracy of 0.68.
- While the accuracy drop was less dramatic than in simulation, the Mean Absolute Error (MAE) analysis showed that the crosstalk-induced hardware behavior ( $hw\_crosstalk$ ) was significantly closer to the adversarial hardware behavior ( $hw\_adv$ ) than the clean hardware behavior. Specifically, the MAE between $hw\_adv$ and $hw\_crosstalk$ was 0.1236, the lowest among all hardware-to-hardware comparisons, confirming that the physical crosstalk successfully approximated the intended adversarial perturbation.

Significance and Claims

The paper claims that its primary significance lies in demonstrating that QML security cannot be analyzed in isolation. The findings highlight that:

Interdependency of Threats: Side-channel information (power traces) is not merely a privacy leak but a critical enabler for subsequent, more destructive attacks (crosstalk-based adversarial manipulation).
Physical Realizability: Adversarial examples are not just theoretical constructs; they can be physically realized on NISQ devices through hardware-induced noise (crosstalk) without modifying the input data or the model.
System-Level Defense: Effective defense requires a system-level approach. Mitigating power side-channels (e.g., via decoy pulses or constant-power operation) and preventing multi-tenant shared execution (to block crosstalk injection) are necessary to break the kill chain.

The authors emphasize that these attacks operate within the constraints of current Noisy Intermediate-Scale Quantum (NISQ) devices and do not rely on fault-tolerant assumptions, making the results immediately relevant for near-term QML deployments. The work serves as a warning to QaaS providers and hardware manufacturers that current isolation and noise models are insufficient against coordinated, multi-stage adversaries.