Qsentry Detects Quantum Neural Network Backdoors with 93.2% Accuracy, Even at 1% Poisoning Rates

Quantum neural networks represent a promising avenue for quantum machine learning, but they inherit vulnerabilities from their classical counterparts, including susceptibility to backdoor attacks. To confront this growing threat, Shuolei Wang, Zimeng Xiao, and Jinjing Shi, all from Central South University, alongside Heyuan Shi and Shichao Zhang, and Xuelong Li, introduce QSentry, a novel framework for detecting these hidden vulnerabilities. QSentry employs a Measurement Clustering method that identifies statistical anomalies in the outputs of quantum neural networks, effectively pinpointing samples manipulated by attackers. Demonstrating strong performance even with minimal contamination, QSentry achieves a 75. 8% F1 score when only 1% of training data is poisoned, improving to over 93% as the attack intensifies, and significantly outperforms existing detection methods, establishing a practical defence against backdoor threats in quantum machine learning.

Quantum neural networks (QNNs) represent an important model for implementing quantum machine learning (QML), yet they demonstrate a high degree of vulnerability to backdoor attacks similar to classical networks. To address this issue, scientists have developed QSentry, a quantum backdoor attack detection framework. QSentry introduces a quantum Measurement Clustering method to detect backdoors by identifying statistical anomalies in measurement outputs, effectively revealing malicious manipulation within the quantum neural network.

QSentry Detects Backdoor Attacks in Quantum Networks

Scientists have developed QSentry, a novel framework for detecting backdoor attacks in quantum neural networks (QNNs). This work addresses a critical vulnerability in QNNs, demonstrating a practical method for constructing defenses against malicious manipulation of these systems. The core of QSentry lies in a Measurement Clustering methodology, which analyzes statistical features extracted from the quantum measurement layer to identify anomalous distributions indicative of backdoor attacks. Experiments demonstrate that QSentry achieves a 75. 8% F1 score even under a low 1% poisoning rate, signifying its ability to detect subtle attacks.

As the poisoning rate increases to 5%, the F1 score improves to 85. 7%, and further increases to 93. 2% at a 10% poisoning rate, demonstrating a strong correlation between attack intensity and detection accuracy. The technique precisely estimates poisoning ratios by integrating silhouette coefficients and relative cluster size, closely matching actual levels of malicious data injection. Comparative evaluations against three state-of-the-art detection methods reveal that QSentry delivers superior robustness and accuracy.

This breakthrough overcomes the limitations imposed by the unobservability of intermediate quantum states, providing a feasible approach to building practical QNN defenses. By focusing on the analysis of measurement outcomes, QSentry effectively distinguishes between normal samples and those compromised by backdoor triggers, identifying anomalous distributions that deviate from dense clusters formed by legitimate data. This research establishes a significant advancement in securing quantum machine learning systems against evolving cyber threats.

Backdoor Attack Detection Via Measurement Anomalies

This research presents QSentry, a novel framework designed to detect backdoor attacks targeting quantum neural networks. The team successfully demonstrated that statistical anomalies in measurement outputs reliably indicate the presence of maliciously inserted backdoor samples, even when the proportion of these samples is low. Extensive experiments across various attack scenarios reveal QSentry achieves high detection accuracy, with a 75. 8% F1 score at a 1% poisoning rate, improving to 85. 7% and 93.

2% as the poisoning rate increases. Importantly, QSentry distinguishes itself from existing methods by focusing on readily accessible measurement data, circumventing the limitations imposed by the difficulty of observing internal quantum states. The framework’s effectiveness stems from its ability to precisely isolate backdoor samples by analyzing measurement distributions and estimating poisoning ratios with considerable accuracy. Compared to state-of-the-art classical and hybrid defense methods, QSentry consistently delivers superior detection performance. While the research establishes a practical and effective defense against backdoor threats in quantum machine learning, the authors acknowledge certain limitations, including potential runtime overhead and the need for further investigation into scalability and adaptive attacks.