Problem
Research questions and friction points this paper is trying to address.
Quantum Neural Networks
Backdoor Attack
Input-Aware
Dynamic Trigger
Security
Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks
🤖 AI Summary
This work addresses the limitations of existing backdoor attacks on quantum neural networks (QNNs), which typically rely on fixed triggers that are easily detectable and lack input adaptivity. The authors propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs, which jointly trains a classical trigger generator and the victim QNN using a tri-modal minibatch strategy to dynamically tailor triggers according to each input. A key innovation is the introduction of an ensemble density matrix–based contrastive loss that provides stable, quantum-level supervision signals prior to measurement. Experimental results demonstrate that Q-DIBA achieves high clean accuracy, high attack success rate, and cross-trigger generalization on both MNIST and Fashion-MNIST, while exhibiting strong robustness against mainstream defenses including visual inspection, spectral signature detection, and fine-tuning.
📝 Abstract
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.
Innovation
Methods, ideas, or system contributions that make the work stand out.
input-aware backdoor
quantum neural networks
dynamic trigger
ensemble density contrastive loss
three-mode mini-batch training
🔎 Similar Papers
No similar papers found.
