HarmQ: Harmonic Backdoor Attacks Against Quantum Neural Networks

• URL: http://arxiv.org/abs/2607.12055v1
• Date: Mon, 13 Jul 2026 18:14:23 GMT
• Title: HarmQ: Harmonic Backdoor Attacks Against Quantum Neural Networks
• Abstract summary: Quantum Neural Networks (QNNs) have emerged as a promising paradigm for quantum machine learning in the Noisy Intermediate-Scale Quantum (NISQ) era.<n>HarmQ is a quantum-native backdoor attack that exploits parameterized quantum circuits' inherent Fourier decomposition bias through harmonic trigger patterns.<n>Experiments on MNIST and Fashion-MNIST demonstrate that HarmQ achieves attack success rates exceeding 99% while maintaining over 90% clean accuracy.
• Score: 14.713757354775531
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Quantum Neural Networks (QNNs) have emerged as a promising paradigm for quantum machine learning in the Noisy Intermediate-Scale Quantum (NISQ) era, leveraging quantum phenomena such as superposition and entanglement to process information in exponentially large Hilbert spaces. However, QNNs inherit critical security vulnerabilities from classical neural networks, particularly susceptibility to backdoor attacks. Existing attack methods designed for classical systems fail against QNNs due to quantum-specific constraints: aggressive downsampling required by limited qubit resources destroys conventional triggers, while the spectral learning bias of parameterized quantum circuits (PQCs) restricts learnable patterns. To tackle this, we present HarmQ, a quantum-native backdoor attack that exploits PQCs' inherent Fourier decomposition bias through harmonic trigger patterns. Our approach employs sinusoidal perturbations on coarse grids with block-uniform structure, ensuring survival through downsampling while aligning with PQCs' preference for low-frequency components. This enables effective backdoor injection under realistic black-box conditions where attackers access only training data. Experiments on MNIST and Fashion-MNIST demonstrate that HarmQ achieves attack success rates exceeding 99% while maintaining over 90% clean accuracy, significantly outperforming existing methods including BadNets (2.77% ASR), Watermark (7.96% ASR), Q-FGSM (44.32% ASR) and QUAP (3.40% ASR). Parametric t-SNE visualizations of quantum state representations confirm that harmonic triggers create distinctly separated clusters, evidencing HarmQ as a fundamental security threat for QNNs.

Related papers

• SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming [18.600693351838515]
  Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware.<n>VQE workloads are increasingly deployed through cloud-based VQE-as-a-service'' pipelines.<n>We present textbfVQE-AdvBench, the first unified red-teaming benchmark for the Variational Quantum Eigensolver.
  arXiv  Detail & Related papers  (2026-07-21T17:38:52Z)
• Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks [7.193610694076472]
  Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices.<n>We propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs.<n>Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity.
  arXiv  Detail & Related papers  (2026-07-13T17:34:17Z)
• Quantum-Enhanced Neural Contextual Bandit Algorithms [50.880384999888044]
  This paper introduces the Quantum Neural Tangent Kernel-Upper Confidence Bound (QNTK-UCB) algorithm.<n>QNTK-UCB is a novel algorithm that leverages the Quantum Neural Tangent Kernel (QNTK) to address these limitations.
  arXiv  Detail & Related papers  (2026-01-06T09:58:14Z)
• Resisting Quantum Key Distribution Attacks Using Quantum Machine Learning [2.9189969146057]
  Quantum Key Distribution (QKD) offers a promising solution by harnessing the principles of quantum mechanics to establish secure keys.<n>QKD implementations remain vulnerable to hardware imperfections and advanced attacks such as Photon Number Splitting and Trojan-Horse attacks.<n>We propose a Hybrid Quantum Long Short-Term Memory (QLSTM) model to improve the detection of common QKD attacks.
  arXiv  Detail & Related papers  (2025-09-16T14:22:39Z)
• Differentially Private Federated Quantum Learning via Quantum Noise [9.540961602976965]
  Quantum federated learning (QFL) enables collaborative training of quantum machine learning (QML) models across distributed quantum devices without raw data exchange.<n>QFL remains vulnerable to adversarial attacks, where shared QML model updates can be exploited to undermine information privacy.<n>This paper explores a novel DP mechanism that harnesses quantum noise to safeguard quantum models throughout the QFL process.
  arXiv  Detail & Related papers  (2025-08-27T22:56:16Z)
• Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses [2.089191490381739]
  Quantum Machine Learning (QML) integrates quantum computing with classical machine learning to solve classification, regression and generative tasks.<n>This chapter examines adversarial threats unique to QML systems, focusing on vulnerabilities in cloud-based deployments, hybrid architectures, and quantum generative models.
  arXiv  Detail & Related papers  (2025-06-27T01:19:49Z)
• VQC-MLPNet: An Unconventional Hybrid Quantum-Classical Architecture for Scalable and Robust Quantum Machine Learning [50.95799256262098]
  Variational quantum circuits (VQCs) hold promise for quantum machine learning but face challenges in expressivity, trainability, and noise resilience.<n>We propose VQC-MLPNet, a hybrid architecture where a VQC generates the first-layer weights of a classical multilayer perceptron during training, while inference is performed entirely classically.
  arXiv  Detail & Related papers  (2025-06-12T01:38:15Z)
• Deep-learning-based continuous attacks on quantum key distribution protocols [0.0]
  In this paper, we design a new individual attack scheme called textitDeep-learning-based continuous attack (DLCA)<n>As a minimal model, we present our performances when applied in the case of the BB84 protocol with intrinsic noise in the communication channel.<n>Our results suggest that our attack's performances lie between the ones of standard intercept-and-resend attacks and of the optimal individual attack, namely the phase-covariant quantum cloner.
  arXiv  Detail & Related papers  (2024-08-22T17:39:26Z)
• QuanTest: Entanglement-Guided Testing of Quantum Neural Network Systems [45.18451374144537]
  Quantum Neural Network (QNN) combines the Deep Learning (DL) principle with the fundamental theory of quantum mechanics to achieve machine learning tasks with quantum acceleration. QNN systems differ significantly from traditional quantum software and classical DL systems, posing critical challenges for QNN testing. We propose QuanTest, a quantum entanglement-guided adversarial testing framework to uncover potential erroneous behaviors in QNN systems.
  arXiv  Detail & Related papers  (2024-02-20T12:11:28Z)
• Quantum Imitation Learning [74.15588381240795]
  We propose quantum imitation learning (QIL) with a hope to utilize quantum advantage to speed up IL. We develop two QIL algorithms, quantum behavioural cloning (Q-BC) and quantum generative adversarial imitation learning (Q-GAIL) Experiment results demonstrate that both Q-BC and Q-GAIL can achieve comparable performance compared to classical counterparts.
  arXiv  Detail & Related papers  (2023-04-04T12:47:35Z)
• Symmetric Pruning in Quantum Neural Networks [111.438286016951]
  Quantum neural networks (QNNs) exert the power of modern quantum machines. QNNs with handcraft symmetric ansatzes generally experience better trainability than those with asymmetric ansatzes. We propose the effective quantum neural tangent kernel (EQNTK) to quantify the convergence of QNNs towards the global optima.
  arXiv  Detail & Related papers  (2022-08-30T08:17:55Z)
• Entangling Quantum Generative Adversarial Networks [53.25397072813582]
  We propose a new type of architecture for quantum generative adversarial networks (entangling quantum GAN, EQ-GAN) We show that EQ-GAN has additional robustness against coherent errors and demonstrate the effectiveness of EQ-GAN experimentally in a Google Sycamore superconducting quantum processor.
  arXiv  Detail & Related papers  (2021-04-30T20:38:41Z)
• On the learnability of quantum neural networks [132.1981461292324]
  We consider the learnability of the quantum neural network (QNN) built on the variational hybrid quantum-classical scheme. We show that if a concept can be efficiently learned by QNN, then it can also be effectively learned by QNN even with gate noise.
  arXiv  Detail & Related papers  (2020-07-24T06:34:34Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.