⚛️ quantum physics

Where Does a Variational Quantum Classifier Lose Accuracy? Angle Encoding, Readout and the Fidelity-Kernel Reference in Cyberattack Detection

This paper analyzes the performance bottlenecks of variational quantum classifiers on the NSL-KDD cyberattack benchmark, revealing that suboptimal readout strategies are the primary source of accuracy loss compared to encoding methods, while also demonstrating that current quantum models offer no advantage over classical support-vector machines given the same inputs.

Original author: Angelos Thomos, Theodore Andronikos

Published 2026-11-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original author: Angelos Thomos, Theodore Andronikos

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the author. For technical accuracy, refer to the original paper. Read full disclaimer

In the high-stakes world of network security, computers are constantly on guard, scanning digital traffic for signs of intrusion. When a suspicious pattern emerges, a system must decide instantly whether it is a harmless glitch or a malicious attack. For years, researchers have turned to machine learning to build these digital sentinels, training them on vast libraries of past network activity to recognize threats. Recently, a new frontier has opened: quantum machine learning. This approach uses the strange laws of quantum physics to process information, theoretically offering a way to solve problems that are too complex for standard computers. The hope is that by encoding network data into the delicate states of quantum particles, these new systems could spot attacks faster and more accurately than ever before. But as scientists begin to test these ideas, a critical question arises: when these quantum systems fail to perform as expected, where exactly is the breakdown happening? Is the fault in how the data is translated into quantum language, in the complex circuitry that processes it, or in the final step where the machine's output is turned into a decision?

A team of researchers at Ionian University in Greece set out to answer this question by dissecting a specific type of quantum classifier designed to detect cyberattacks. They focused on a well-known dataset of network traffic, using it as a testing ground to see how different parts of the quantum system contributed to the final result. Their work involved comparing two distinct ways of translating network data into quantum states. One method, known as angle encoding, treats each piece of data as a rotation of a quantum particle, preserving the specific scale and size of the original numbers while using one qubit per feature. The other, called amplitude encoding, packs the data into the probabilities of the quantum state itself, allowing more information to be stored in fewer particles but requiring the data to be normalized, or scaled down, to fit. The researchers then built quantum circuits to process this encoded data and tested them against a classical yardstick: a standard support-vector machine, a powerful classical algorithm that serves as a benchmark for what is theoretically possible with that specific data encoding.

The investigation revealed a surprising truth about where the quantum system loses its edge. The researchers found that the biggest source of error was not the quantum circuit itself, nor the way the data was initially encoded, but rather the final step of reading the results. In many quantum experiments, the system measures the state of just one particle or looks at a simple sum of all particles to make a decision. The study showed that this simple reading method throws away a significant amount of useful information. When the researchers replaced this simple reading with a more sophisticated method that learns how to interpret the full pattern of measurements, the accuracy of the quantum classifier jumped dramatically. In fact, a circuit with a trained reader performed so much better than one with a simple reader that the difference was larger than the difference caused by changing the encoding method itself. This finding explains why adding more layers to the quantum circuit often fails to improve performance; if the reader at the end is not sophisticated enough, the extra processing power inside the circuit goes to waste.

The study also clarified the trade-offs between the two encoding methods. For network traffic that looks very similar to the data the system was trained on, the angle encoding method produced the most accurate detectors. It requires shallower circuits for eight features or more, offering better precision for known threats. However, when it came to spotting entirely new types of attacks that the system had never seen before, the amplitude encoding method proved superior. It was able to identify a much higher percentage of these novel threats, even though it used fewer quantum particles to do so. This suggests that the choice of encoding depends heavily on the specific goal: if the priority is catching known attacks with high precision, angle encoding is the better tool; if the goal is to detect unknown, never-before-seen threats, amplitude encoding holds the advantage.

Perhaps the most sobering finding for the field of quantum computing is that, on this specific task, the quantum systems did not outperform their classical counterparts. When the researchers compared the best-performing quantum circuits to classical models using the same input data, the classical models were just as accurate, and in some cases, even more so. The quantum advantage, often touted as the reason to build these complex machines, was not present in this simulation. The researchers noted that the improvements seen in detecting new attack types came from the way the data was encoded, a process that a classical computer could also perform efficiently. This implies that for quantum computers to truly shine in network security, they will need to use encoding methods that are so complex that classical computers cannot simulate them efficiently. Until then, the bottleneck remains not in the quantum hardware, but in the design of the system's final decision-making step. The path forward, the study suggests, is to focus less on adding more layers to the quantum circuit and more on teaching the machine how to read its own output with greater care.

Technical Summary: Where Does a Variational Quantum Classifier Lose Accuracy?

Problem Statement
In the context of network intrusion detection using Variational Quantum Classifiers (VQCs), a significant challenge exists in diagnosing performance bottlenecks. When a VQC fails to detect network attacks accurately, it is difficult to attribute the failure to a specific component: the data encoding, the parameterized circuit (ansatz) and its training, or the readout mechanism that maps measurement outcomes to class labels. Previous studies on quantum machine learning (QML) for intrusion detection often rely on simulated environments and legacy datasets with inconsistent evaluation practices, making it hard to isolate whether poor performance stems from the quantum model's design or the inherent limitations of the encoding. Furthermore, the conditions under which quantum models offer a practical advantage over classical methods on classical data remain an open question.

Methodology
This work investigates the accuracy limits of VQCs on the NSL-KDD benchmark (specifically a 20% subset) using noiseless exact simulations. The study isolates and varies the four core components of a VQC: encoding, ansatz, classical optimizer, and readout.

Encodings: The study compares Angle Encoding (using one qubit per feature with $R_y$ rotations) and Amplitude Encoding (normalizing $N$ features into $n = \log_2 N$ qubits).
The "Yardstick" (Attainable Reference): To distinguish between encoding limitations and circuit training failures, the authors introduce a classical Support Vector Machine (SVM) trained on the fidelity kernel of the encoded states. Since the fidelity between encoded states has a closed-form solution for these encodings, this SVM provides an "attainable reference"—the theoretical maximum accuracy a linear readout could achieve with that specific encoding, assuming an ideal ansatz and optimizer.
Readout Variations: The study evaluates three readout strategies:
- Qubit-0 Parity: Reading only the least significant qubit (a common default).
- Global Parity: Reading the parity of all qubits.
- Linear Head (Co-trained): A logistic regression layer trained jointly with the circuit parameters, mapping the full distribution of measurement outcomes (or specific Pauli-Z expectations) to a class.
Experimental Design: Experiments vary one factor at a time (e.g., encoding type, circuit depth, readout strategy) while holding others constant. The study uses 4, 8, and 16 principal components (features) and compares trained circuits against the attainable reference and classical baselines (Logistic Regression and SVM).

Key Contributions

Identification of the Readout Bottleneck: The study demonstrates that the primary source of accuracy loss in VQCs is the readout, not the encoding or the ansatz depth. Simple parity readouts leave significant performance potential unused (up to 11.4 percentage points), whereas a co-trained linear readout recovers most of this lost accuracy from the same measurements.
Encoding Trade-offs:
- Angle Encoding: Provides higher accuracy on traffic similar to the training data and requires shallower circuits for 8+ features, but requires more qubits ( $N$ qubits for $N$ features).
- Amplitude Encoding: Uses fewer qubits ( $\log_2 N$ ) and excels at detecting "novel" attack types (unseen in training), but suffers from higher circuit depth and gate counts due to state preparation.
Quantum vs. Classical Performance: On the same inputs, the best-performing quantum circuits perform at the level of classical models. They slightly outperform Logistic Regression but generally underperform a classical SVM using the same kernel. The study finds no evidence of a quantum advantage for these specific encodings on this dataset.
Depth vs. Readout: The "accuracy plateau" observed in previous studies as circuit depth increases is attributed to the limitations of the parity readout. When a co-trained readout is used, increasing depth yields diminishing returns, and a shallow circuit with a good readout can outperform a deep circuit with a poor readout.

Results

Accuracy Loss: For both encodings, the largest gap between the trained circuit and the attainable reference occurs at the readout stage. A co-trained linear head reduces the gap to within 0.3–1.3 percentage points of the reference, whereas parity readouts leave gaps of 2.6 to 11.4 points.
Novel Attack Detection: Amplitude-encoded circuits demonstrate superior recall for "novel" attack types (types absent from training) compared to angle-encoded circuits. However, this advantage is also present in the classical SVM using the same amplitude kernel, indicating the gain comes from the encoding's geometric properties (quadratic kernel) rather than quantum computation itself.
Resource Costs: At 16 features, amplitude encoding requires 4 qubits but a deep circuit (depth ~57) with many two-qubit gates for state preparation. Angle encoding requires 16 qubits but a much shallower circuit (depth ~20) with fewer two-qubit gates.
Classical Baselines: Classical models (Logistic Regression and SVM) achieve accuracy comparable to the best quantum circuits. The quantum circuits are 0.4–1.0 points more accurate than Logistic Regression but 0.5–1.9 points less accurate than the classical SVM on the same kernel.

Significance and Claims
The paper claims that the primary limitation in current variational quantum classifiers for intrusion detection is the readout strategy, not the quantum hardware depth or the encoding itself. By optimizing the readout (specifically using a co-trained linear head), most of the potential accuracy inherent in the encoded states can be realized.

The study concludes that for the specific encodings and dataset tested, no quantum advantage is observed over classical methods. The performance of the quantum circuits is bounded by the classical surrogates (the fidelity-kernel SVM). The authors suggest that future quantum advantage in this domain would likely require encodings whose kernels cannot be efficiently evaluated by classical computers. The work provides a standardized protocol for evaluating VQCs, separating the contributions of encoding, ansatz, and readout to guide future hardware and algorithm design.

More like this