Search papers, labs, and topics across Lattice.
This paper introduces Q-DIBA, the first input-aware dynamic backdoor attack tailored for Quantum Neural Networks (QNNs), addressing the limitations of fixed-trigger designs that are vulnerable to detection. By employing a three-mode mini-batch strategy, Q-DIBA effectively trains a classical trigger generator alongside the QNN, utilizing an ensemble density contrastive loss for stable supervision. Experimental results on MNIST and Fashion-MNIST demonstrate that Q-DIBA achieves high clean accuracy and attack success while remaining resilient against various defense mechanisms, highlighting a significant security threat in QNN deployment.
Input-aware dynamic backdoors can exploit QNNs with unprecedented stealth and specificity, posing a serious threat to their secure deployment.
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.
