Abstract:Hybrid Quantum Neural Networks (HQNNs) represent a promising advancement in Quantum Machine Learning (QML), yet their security has been rarely explored. In this paper, we present the first systematic study of backdoor attacks on HQNNs. We begin by proposing an attack framework and providing a theoretical analysis of the generalization bounds and minimum perturbation requirements for backdoor attacks on HQNNs. Next, we employ two classic backdoor attack methods on HQNNs and Convolutional Neural Networks (CNNs) to further investigate the robustness of HQNNs. Our experimental results demonstrate that HQNNs are more robust than CNNs, requiring more significant image modifications for successful attacks. Additionally, we introduce the Qcolor backdoor, which utilizes color shifts as triggers and employs the Non-dominated Sorting Genetic Algorithm II (NSGA-II) to optimize hyperparameters. Through extensive experiments, we demonstrate the effectiveness, stealthiness, and robustness of the Qcolor backdoor.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the security and robustness of hybrid classical - quantum neural networks (HQNNs) in the face of back - door attacks. Specifically, the researchers hope to explore the following aspects: 1. **Robustness evaluation of HQNNs**: - By introducing two classical back - door attack methods (i.e., patch - trigger attack and hybrid - trigger attack), study the robustness of HQNNs under different trigger settings. - The experimental results show that HQNNs are more robust than traditional convolutional neural networks (CNNs), and more significant image modifications are required to successfully launch an attack. 2. **Proposal of Qcolor back - door attack**: - A new back - door attack method - Qcolor back - door attack is proposed, which uses color shift as a trigger and uses the non - dominated sorting genetic algorithm II (NSGA - II) to optimize hyper - parameters to ensure the effectiveness and stealth of the attack. - The Qcolor back - door attack generates trigger images by adjusting the ratios of the three RGB color channels, making the trigger images visually similar to clean images but can be recognized as a specific category by HQNN. 3. **Theoretical analysis and experimental verification**: - Provide theoretical analysis on HQNNs back - door attacks, including the derivation of generalization lower bounds and minimum perturbation requirements. - Through extensive experiments, verify the robustness of HQNNs against back - door attacks, and demonstrate the effectiveness, stealth, and robustness of the Qcolor back - door attack. ### Main contributions - **Framework and theoretical analysis**: Provide the framework and theoretical analysis of HQNNs back - door attacks, and systematically explore the robustness of HQNNs against back - door attacks. - **Qcolor back - door attack**: Propose a new back - door attack method - Qcolor back - door attack. By adjusting the color channel ratios and using NSGA - II to optimize hyper - parameters, ensure the effectiveness and stealth of the attack. - **Defense evaluation**: Evaluate the robustness of the Qcolor back - door attack against three state - of - the - art back - door defense methods (STRIP, Neural Cleanse, and Fine - Pruning). ### Formula summary 1. **Training objective function**: \[ \min_{\theta_C, \theta_Q} \left( \sum_{(x,y) \in D} L_c(f_{HQ}(x; \theta_C, \theta_Q), y) + \lambda \sum_{(x', y_t) \in D_t} L_t(f_{HQ}(x'; \theta_C, \theta_Q), y_t) \right) \] 2. **Gradient update**: \[ \theta \leftarrow \theta - \eta (\nabla_\theta L_c + \lambda \nabla_\theta L_t) \] 3. **Generalization error lower bound**: \[ R_t(f_{HQ}) \geq \hat{R}_t(f_{HQ}) - B \sqrt{\frac{2m}{r} \ln \frac{2}{\delta}} + L_t \delta \|z\| \] 4. **Minimum perturbation intensity**: \[ \|\delta\| \geq c^{-1}(\epsilon) \] Through these formulas and experiments, the researchers not only reveal the robustness of HQNNs in the face of back - door attacks, but also propose effective attack methods and defense strategies, providing an important reference for the security research of quantum machine learning.

Backdoor Attacks against Hybrid Classical-Quantum Neural Networks

KerbNet: A QoE-aware Kernel-Based Backdoor Attack Framework

ATTEQ-NN: Attention-based QoE-aware Evasive Backdoor Attacks.

AdvQuNN: A Methodology for Analyzing the Adversarial Robustness of Quanvolutional Neural Networks

QTrojan: A Circuit Backdoor Against Quantum Neural Networks

QDoor: Exploiting Approximate Synthesis for Backdoor Attacks in Quantum Neural Networks

RobQuNNs: A Methodology for Robust Quanvolutional Neural Networks against Adversarial Attacks

Quantum-inspired analysis of neural network vulnerabilities: The role of conjugate variables in system attacks

Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks

Stealthy Low-frequency Backdoor Attack against Deep Neural Networks

Backdooring Convolutional Neural Networks via Targeted Weight Perturbations

Studying the Impact of Quantum-Specific Hyperparameters on Hybrid Quantum-Classical Neural Networks

Designing Robust Quantum Neural Networks: Exploring Expressibility, Entanglement, and Control Rotation Gate Selection for Enhanced Quantum Models

QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines

Defending Against Backdoor Attacks by Quarantine Training

A hybrid quantum–classical neural network with deep residual learning

An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers

Backdoor Attacks and Defenses for Deep Neural Networks in Outsourced Cloud Environments

Quantum Neural Networks under Depolarization Noise: Exploring White-Box Attacks and Defenses

Investigating the Backdoor on DNNs Based on Recolorization and Reconstruction: From a Multi-Channel Perspective