Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows

Source: arXiv:2605.06629 · Published 2026-05-07 · By Prateek Paudel, Nitin Jha, Abhishek Parakh, Mahadevan Subramaniam

TL;DR

This paper addresses the challenge of generating adversarial network traffic flows to evade classical intrusion detection systems (IDS) by proposing a hybrid quantum-classical generative adversarial network (QC-GAN). Traditional classical GANs require large datasets and often exhibit mode collapse and high computational costs, limiting their effectiveness in complex network intrusion scenarios. The QC-GAN leverages a variational quantum circuit (VQC) as the generator, encoding latent noise vectors as quantum states via angle encoding and successive unitary data injection (SUDAI) to exploit the exponentially large Hilbert space. This allows generation of synthetic malicious flows with fewer parameters and potentially more expressive latent representations. The discriminator remains classical, reflecting real-world deployment constraints.

Using the publicly available UNSW-NB15 dataset with selected top features adapted to quantum circuits, the authors train and evaluate the QC-GAN against classical GAN baselines. They demonstrate that despite having 3.8x fewer trainable parameters, the QC-GAN can approximate network flow distributions reasonably well and exhibits robustness to simulated quantum hardware noise. Importantly, when evaluating generated flows against classical IDS classifiers (Random Forest, XGBoost, CNN1D), the QC-GAN achieves higher attack success rates (ASR) against XGBoost compared to the classical GAN, indicating it generates novel adversarial samples outside dense real attack clusters. The noisy QC-GAN variant disperses generated samples further, acting like a regularizer and improving evasion in some cases. Overall, this study highlights the promise of quantum machine learning methods for generating sophisticated adversarial attacks and stresses the need for future quantum-resilient defense techniques.

Key findings

• QC-GAN generator has 372 total parameters versus 1,412 for classical GAN (3.8x fewer).
• QC-GAN with SUDAI and four qubits approximates UNSW-NB15 network flow features with MSE=0.727, outperforming classical GAN MSE=0.751 in generating individual flows.
• Classical GAN obtains best distribution similarity per MMD metric (0.323 vs 0.362 QC-GAN), but QC-GAN still captures key behavior.
• QC-GAN (clean) achieves attack success rate (ASR) 41.1% against XGBoost classifier, outperforming classical GAN ASR 35.6%, despite fewer parameters.
• QC-GAN + Noise variant reaches 40.6% ASR against XGBoost, indicating noise-based regularization aids diversity.
• QC-GAN performs slightly worse than classical GAN on Random Forest (ASR 18.0% vs 22.5%) and CNN1D (17.6% vs 28.8%).
• Discriminator loss for QC-GAN stabilizes faster and smoother than classical GAN, indicating training stability.
• QC-GAN with noise simulates realistic quantum hardware noise without collapse or divergence.

Threat model

The adversary is a resourceful state-level attacker with limited quantum computing capability sufficient to run a variational quantum circuit with a few qubits. They have the knowledge and ability to generate malicious network traffic flows aiming to evade classical IDS employed by organizations. The adversary cannot deploy a quantum discriminator or modify defender-side classifier internals, and their quantum hardware is noisy as simulated.

Methodology — deep read

1. Threat Model & Assumptions: The adversary is assumed to be a state-level attacker possessing limited quantum computing resources capable of running a small-qubit variational quantum circuit as a generator. The defender uses classical IDS models (Random Forest, XGBoost, CNN1D) typical of organizational networks. The attacker aims to generate malicious network flows that evade these classical classifiers. The quantum discriminator is not assumed due to practical deployment constraints.

2. Data: The authors use the UNSW-NB15 dataset, featuring modern network traffic with 49 features. Due to current qubit and quantum circuit limits, a two-stage feature selection pipeline is applied to reduce input dimensionality to four informative features: synack, ct state ttl, sbytes, and smean. The dataset is split into training (67,512), validation (14,820), and testing (175,341) sets. Quantile normalization is applied only on training data.

3. Architecture/Algorithm: The generator is a variational quantum circuit operating on 4 qubits. Latent noise vectors are drawn from N(0,I) and encoded into quantum states via angle encoding (RY gates). To overcome expressiveness limitations in shallow circuits, the QC-GAN employs successive unitary data injection (SUDAI), repeating encoding and variational layers three times to increase effective circuit depth and representational power. Variational layers use trainable RX and RZ rotations and ring-structured CNOT entanglement preserving hardware feasibility. Measurement produces expectation values of Pauli-Z operators for each qubit, giving an 8-dimensional classical feature vector which is refined by a small classical post-processing network (~356 parameters). The discriminator is a classical fully connected neural network with two hidden layers (128, 64 neurons), batch normalization, LeakyReLU activations, and dropout (p=0.3), outputting a probability of real vs generated flow.

4. Training Regime: All models use the Wasserstein-GP loss with 5 discriminator updates per generator update (ncritic=5). The clean QC-GAN is trained with PennyLane's lightning.qubit simulator using adjoint differentiation to optimize variational parameters. The noisy QC-GAN simulates realistic quantum noise channels: depolarizing, bit-flip, and amplitude-damping on the quantum device. The classical GAN baseline has ~1,412 generator parameters vs 372 total for the QC-GAN system. Training dynamics are monitored via losses and Maximum Mean Discrepancy (MMD) metrics across epochs.

5. Evaluation Protocol: Metrics for generative quality include MMD, mean squared error (MSE), Wasserstein distance, and Kullback-Leibler divergence, evaluated on held-out test set flows. IDS evasion effectiveness is measured by training classical classifiers (Random Forest, XGBoost, CNN1D) on balanced real benign and attack samples, then testing classification performance on generated attack flows mixed with real benign flows. Detection Rate, Attack Success Rate (ASR=1-DR), and F1-score are reported. Comparison is conducted across classical GAN, clean QC-GAN, and noisy QC-GAN variants.

6. Reproducibility: The paper does not explicitly mention public release of code or pretrained quantum generator weights. The use of public UNSW-NB15 dataset supports data reproducibility. Quantum simulation uses PennyLane tools with configured noise channels, suggesting the setup is replicable with quantum simulator frameworks.

End-to-End Example: A latent noise vector z ∈ R^4 sampled from N(0, I) is normalized to [-1,1], encoded via angle rotations on four qubits. The SUDAI circuit applies this encoding thrice interleaved with variational RX and RZ rotations and entanglement layers parameterized by θ, producing an evolved quantum state. Measurement yields Pauli-Z expectation values per qubit, which form a classical vector. This vector is refined by a small neural post-processing network and passed to the classical discriminator, which outputs the probability that the flow is real. Gradients through the discriminator guide the update of θ and post-processing parameters to improve the generator in a competitive adversarial training loop. The final generator produces synthetic attack flows that can trick classical IDS models significantly better than classical GAN counterparts despite fewer parameters.

Technical innovations

• Use of a variational quantum circuit generator with angle encoding and successive unitary data injection (SUDAI) to increase expressiveness within limited qubit resources.
• Hybrid quantum-classical GAN framework combining a quantum generator and classical discriminator for intrusion detection attack generation.
• Encoding latent noise directly as quantum states to exploit high-dimensional Hilbert space representations beyond classical noise mappings.
• Demonstration that simulated quantum hardware noise provides regularization benefits, dispersing generated outputs and enhancing evasion diversity.

Datasets

• UNSW-NB15 — 257,673 network flow samples — publicly available Australian Centre for Cyber Security dataset

Baselines vs proposed

• Classical GAN: MMD = 0.323 vs QC-GAN clean: 0.362 vs QC-GAN+Noise: 0.360
• Classical GAN: MSE = 0.751 vs QC-GAN clean: 0.727 vs QC-GAN+Noise: 0.703
• Classical GAN: Attack Success Rate (XGBoost) = 35.6% vs QC-GAN clean: 41.1% vs QC-GAN+Noise: 40.6%
• Classical GAN: Attack Success Rate (Random Forest) = 22.5% vs QC-GAN clean: 18.0% vs QC-GAN+Noise: 21.9%
• Classical GAN: Attack Success Rate (CNN1D) = 28.8% vs QC-GAN clean: 17.6% vs QC-GAN+Noise: 23.1%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2605.06629.

Fig 1: Two-stage feature selection pipeline for quantum encoding with qubit constraints. Coarse screening of candidate

Fig 2: Architecture of the Hybrid Quantum-Classical GAN (QC-GAN). The framework consists of a Quantum Genera-

Fig 3: Quantum generator circuit using sequential unitary data injection (SUDAI). The latent noise vector is angle-

Fig 4: shows how the discriminator and generator losses change across training for all three models.

Fig 5: Validation MMD across training epochs. All three models start with high MMD and drive it down steadily. The

Fig 6: shows the per-feature distributions of generated flows compared to real traffic across all four quantum

Fig 7: IDS evasion results across all models and classifiers. Left: Detection Rate lower means fewer generated attacks

Limitations

• QC-GAN uses only 4 qubits and limited quantum circuit depth, restricting representation capacity compared to larger classical networks.
• Evaluation limited to simulated quantum noise models rather than physical quantum hardware experiments.
• Synthetic flow evaluation focuses on four selected features, omitting full 49-dimensional network traffic patterns due to quantum constraints.
• Comparisons favor classical GAN with 3.8x more parameters, which naturally limits QC-GAN expressiveness and may bias results.
• No adversarial training or adaptation of IDS classifiers to quantum-generated samples was explored.
• No detailed robustness testing under adaptive defenders or evolving traffic distributions.

Open questions / follow-ons

• How would scaling to larger qubit counts and deeper quantum circuits affect generative quality and IDS evasion?
• To what extent can physical quantum hardware noise and decoherence impact training stability and adversarial effectiveness?
• Can IDS models be adapted or hardened to detect quantum-generated adversarial flows effectively?
• What benefits arise by incorporating quantum discriminators or fully end-to-end quantum GAN architectures for network intrusion tasks?

Why it matters for bot defense

This study exemplifies a novel adversarial generation technique leveraging quantum machine learning that could increase sophistication of synthetic traffic generation used in bot and anomaly evasion contexts. Bot-defense engineers should note that quantum-enhanced generators, even with reduced parameter budgets, may produce more diverse or novel adversarial samples that evade traditional classical classifiers, especially tree-based methods like XGBoost that rely on decision thresholds. The use of quantum noise as a form of natural regularization further broadens possible adversarial input distributions. Practitioners should consider developing or evaluating defenses accounting for quantum-generated attackers as quantum computing capabilities progress. While current quantum GAN implementations are constrained in scale, this line of work signals early quantum advantages in adversarial ML relevant to bot-defense and CAPTCHA robustness testing.

Cite

@article{arxiv2605_06629,
  title={ Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows },
  author={ Prateek Paudel and Nitin Jha and Abhishek Parakh and Mahadevan Subramaniam },
  journal={arXiv preprint arXiv:2605.06629},
  year={ 2026 },
  url={https://arxiv.org/abs/2605.06629}
}

Read the full paper

• arXiv:2605.06629 (abstract)
• arXiv:2605.06629 (PDF)