Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks

Source: arXiv:2607.11843 · Published 2026-07-13 · By Junrui Zhang, Zemin Chen, Lusi Li, Mohammad Ghasemigol, Daniel Takabi, Rui Ning

TL;DR

This paper investigates the security vulnerability of Quantum Neural Networks (QNNs) to backdoor attacks, focusing on a novel threat model called input-aware dynamic backdoors. Existing quantum backdoor attacks predominantly use fixed triggers applied uniformly to poisoned inputs, which many defenses detect by exploiting the repeated trigger patterns. The authors identify essential challenges when adapting classical input-aware triggers to QNNs: quantum measurement compresses rich quantum states into limited classical outputs, weakening supervision, and individual quantum density matrices fluctuate strongly with different inputs, making per-sample learning unstable.

To overcome these obstacles, the authors propose Q-DIBA, the first input-aware dynamic backdoor attack tailored for QNNs. Q-DIBA jointly trains a classical trigger generator and victim QNN using a three-mode mini-batch strategy that supports maintaining clean accuracy, achieving attack activation only on input-trigger pairs, and ensuring trigger specificity by contrasting post-ansatz quantum state ensembles before measurement. Experiments on MNIST and Fashion-MNIST with multiple QNN architectures demonstrate that Q-DIBA maintains high clean accuracy (~90-95%), achieves strong attack success rates (>92%), and maintains high cross-trigger accuracy (>85%), outperforming fixed-trigger baselines, while remaining robust to defenses including visual inspection, spectral-signature detection, and fine-tuning. This establishes input-aware quantum backdoors as a significant new threat to QNN security.

Key findings

• Q-DIBA achieves clean accuracy (ACC) comparable to benign QNNs, maintaining utility with less than 3% degradation on MNIST and Fashion-MNIST across tested architectures.
• Attack success rate (ASR) exceeds 92% for input-trigger paired samples, showing strong backdoor activation.
• Cross-trigger accuracy (CTA), measuring trigger specificity, stays above 85%, indicating the trigger from one input does not activate backdoor on others.
• The ensemble density contrastive loss increases Hilbert–Schmidt distance between backdoor and cross-trigger quantum states, stabilizing training and improving attack effectiveness.
• Removing the ensemble density contrastive loss causes performance to drop by 8-10% in ASR and CTA, confirming its critical role (Table II).
• Q-DIBA resists common defenses like visual inspection, spectral-signature detection, and fine-tuning, which degrade fixed-trigger attacks but only minimally impact Q-DIBA.
• Three-mode mini-batch training with balanced backdoor, clean, and cross-trigger samples supports learning clean functionality, strong backdoor activation, and trigger input-specificity simultaneously.
• Q-DIBA works effectively across three different QNN architectures with varying circuit depth (10, 20, 30 layers) and measurement bases (Pauli-Z, Pauli-Y), indicating broad applicability.

Threat model

The attacker is a malicious training-stage adversary who fully controls the QNN training pipeline, including access to training data, labels, QNN parameter updates, optimization, and can jointly train an auxiliary classical trigger generator. They do not modify the underlying QNN circuit structure but poison training to implant backdoors activated only by input-specific triggers. Post-training, the adversary cannot modify the deployed model and does not have inference-time access to quantum states, relying only on classical trigger generation.

Methodology — deep read

1. Threat Model and Assumptions: The attacker controls the QNN training pipeline, with full access to training data, labels, parameter updates, and optimization process. The attacker also jointly trains an auxiliary classical trigger generator alongside the victim QNN. The threat model assumes no modification of the QNN circuit architecture; the attack is implanted solely through model parameters and training. Deployment is after training, and the attacker cannot modify the model post-deployment. The attacker can access post-ansatz quantum states (e.g., density matrices) during training but not at inference. This matches a realistic scenario where training is outsourced to a potentially malicious party.

2. Data: Experiments use MNIST and Fashion-MNIST datasets. Images are downsampled from 28x28 to 16x16 due to qubit constraints. These inputs are encoded using amplitude encoding on 8 qubits. Label sets and splits follow standard training/testing protocols. Poisoning occurs during training via the dynamic trigger generator.

3. Architecture and Algorithm:

• The victim QNN f_θ consists of an encoding circuit S(x) mapping inputs to quantum states, parameterized quantum circuits (PQCs) U(θ) applying trainable unitary gates, followed by measurement R to extract classical logits.
• Three QNN variants are evaluated with different rotation gates and entangling patterns, tested at 10, 20, and 30 layers.
• The trigger generator g_ϕ is a classical convolutional autoencoder producing input-specific triggers g(x, ϕ) bounded in [0,1]^H×W, injected into inputs via a range-matched additive perturbation function T(x, g(x, ϕ); ϵ).

4. Training Regime:

• Q-DIBA jointly optimizes victim QNN parameters θ and trigger generator parameters ϕ via Adam optimizers, alternately updating each.
• Training uses a three-mode mini-batch sampling strategy assigning samples probabilistically to backdoor (B), clean (C), and cross-trigger (O) subsets.
• B samples get their own trigger and target label t; C samples remain clean; O samples receive triggers from other samples but retain original labels.
• Loss function combines three components: a per-mode classification loss aggregating cross-entropy losses from B, C, O subsets; an invisibility regularizer minimizing trigger magnitude; and a novel ensemble density contrastive loss applied on post-ansatz density matrices averaged over B and O, using the Hilbert–Schmidt distance metric with a hinge loss.

5. Evaluation Protocol:

• Metrics include clean accuracy (ACC), attack success rate (ASR), and cross-trigger accuracy (CTA).
• Comparisons to fixed-trigger backdoor attacks validate stronger performance.
• Ablations investigate the impact of the ensemble density contrastive loss and show large drops in ASR and CTA when removed.
• Robustness tests apply defenses such as visual inspection, spectral signature detection, and fine-tuning.
• Q-DIBA is evaluated on different QNN architectures and circuit depths to confirm robustness and generality.

6. Reproducibility:

• Quantum simulations were performed with TorchQuantum framework.
• Exact hyperparameters include 100 training epochs, separate Adam optimizers for QNN and generator, and trigger budget ϵ set within (0,1]. Specific optimization hyperparameters and random seed details are not fully disclosed.
• Source code release is not mentioned, limiting reproducibility.

Example end-to-end: For a given MNIST input x_i, the trigger generator produces a unique perturbation g(x_i, ϕ). This trigger is injected into x_i via T to produce the poisoned input T(x_i, g(x_i, ϕ); ϵ), labeled as target class t. The victim QNN f_θ processes this input through encoding, PQC, and measurement, yielding logits for classification. Simultaneously, triggers from other inputs are applied to x_i (cross-trigger mode) to ensure trigger specificity. Losses from classification, trigger invisibility, and ensemble density contrastive terms jointly update f_θ and g_ϕ parameters via backpropagation. Over iterations, the QNN learns to correctly classify clean inputs, misclassify self-triggered inputs as t, and ignore mismatched triggers, realizing stealthy, effective, and input-aware backdoor behavior.

Technical innovations

• Introduction of a three-mode mini-batch training strategy that jointly enforces clean accuracy, backdoor activation via input-specific triggers, and trigger specificity by including cross-triggered samples during training.
• Development of an ensemble density contrastive loss operating directly on post-ansatz quantum states' averaged density matrices to provide stable quantum-level supervision upstream of measurement.
• A classical convolutional autoencoder trigger generator producing per-sample input-aware triggers bounded and inserted via a range-normalized perturbation sensitive to input intensity scales to maintain stealth.
• Demonstration that applying contrastive loss to averaged density matrices, rather than per-sample ones, reduces instability caused by quantum state fluctuations and supports stable end-to-end joint training of QNN and trigger generator.

Datasets

• MNIST — 60,000 training, 10,000 test — publicly available
• Fashion-MNIST — 60,000 training, 10,000 test — publicly available

Baselines vs proposed

• Fixed-trigger quantum backdoor attacks: ASR = ~70-80%, CTA = ~50-60% vs Q-DIBA: ASR > 92%, CTA > 85%
• Removing ensemble density contrastive loss: ASR and CTA drop by 8-10% endpoints
• Defenses (fine-tuning, spectral signature detection) reduce fixed-trigger backdoor ASR by up to 20%, but reduce Q-DIBA ASR by less than 5%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.11843.

Fig 3: An illustration of a backdoor attack. The target label is

Limitations

• Experiments limited to two standard image datasets (MNIST, Fashion-MNIST) and may not generalize to more complex or real-world quantum datasets.
• Only simulated quantum circuits using 8 qubits were studied due to hardware limitations; results on physical quantum devices remain to be validated.
• No evaluation under adaptive adversarial defenses or adversarial training against Q-DIBA was performed.
• Trigger generator architecture is fixed; effects of alternative architectures or larger trigger budgets were not explored.
• Training details such as hyperparameters, seeds, and parameter initialization lack full disclosure, limiting exact reproducibility.
• The threat model assumes training-time access and control but does not consider inference-time trigger generation under noisy hardware constraints.

Open questions / follow-ons

• How would Q-DIBA perform on larger-scale QNNs with more qubits or more complex datasets beyond MNIST variants?
• Can adaptive quantum backdoor defenses be developed that specifically detect or mitigate input-aware dynamic backdoors that evade fixed-trigger defenses?
• How robust is Q-DIBA in the presence of quantum hardware noise, readout errors, or finite sampling at inference time?
• What are the impacts of different trigger generator architectures, trigger budgets, or encoding schemes on attack effectiveness and stealthiness?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this work highlights a new class of stealthy input-aware backdoor attacks emerging in quantum machine learning systems. While currently primarily relevant to early QNN deployments, the demonstrated vulnerability of QNNs to input-specific backdoors suggests that defenses relying on detecting fixed triggers or static artifacts will likely fail. The adaptation of classical dynamic backdoor ideas into the quantum domain, requiring novel supervision strategies at the quantum state level, underscores the need for bot-defense engineers to anticipate more sophisticated, dynamic attack patterns in future quantum-enhanced learning environments. Techniques from this work, such as ensemble-level contrastive losses and three-mode training protocols, could inspire next-generation defense algorithms that consider input-trigger binding relationships rather than universal trigger signatures.

Cite

@article{arxiv2607_11843,
  title={ Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks },
  author={ Junrui Zhang and Zemin Chen and Lusi Li and Mohammad Ghasemigol and Daniel Takabi and Rui Ning },
  journal={arXiv preprint arXiv:2607.11843},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.11843}
}

Read the full paper

• arXiv:2607.11843 (abstract)
• arXiv:2607.11843 (PDF)