QDoor: Exploiting Approximate Synthesis for Backdoor Attacks in Quantum Neural Networks

TL;DR

QDoor introduces a stealthy backdoor for quantum neural networks that is dormant in uncompiled circuits but is activated after approximate synthesis on NISQ devices by exploiting unitary differences between the original and synthesized circuits. It frames the attack as a multi-task objective that preserves normal performance for benign inputs while embedding malicious behavior that emerges post-synthesis, achieving substantial gains in attack success rate and maintaining stealth. Empirical results across Iris-2, MNIST, and Fashion-MNIST datasets show QDoor outperforms prior quantum backdoors by about 13× in ASR and 65% in clean-data accuracy on average, with limited detectability by existing defenses. The work highlights a pressing need for defenses against synthesis-time backdoors in quantum computing pipelines and motivates further research into robust circuit compilation and backdoor detection for QNNs.

Abstract

Quantum neural networks (QNNs) succeed in object recognition, natural language processing, and financial analysis. To maximize the accuracy of a QNN on a Noisy Intermediate Scale Quantum (NISQ) computer, approximate synthesis modifies the QNN circuit by reducing error-prone 2-qubit quantum gates. The success of QNNs motivates adversaries to attack QNNs via backdoors. However, naïvely transplanting backdoors designed for classical neural networks to QNNs yields only low attack success rate, due to the noises and approximate synthesis on NISQ computers. Prior quantum circuit-based backdoors cannot selectively attack some inputs or work with all types of encoding layers of a QNN circuit. Moreover, it is easy to detect both transplanted and circuit-based backdoors in a QNN. In this paper, we propose a novel and stealthy backdoor attack, QDoor, to achieve high attack success rate in approximately-synthesized QNN circuits by weaponizing unitary differences between uncompiled QNNs and their synthesized counterparts. QDoor trains a QNN behaving normally for all inputs with and without a trigger. However, after approximate synthesis, the QNN circuit always predicts any inputs with a trigger to a predefined class while still acts normally for benign inputs. Compared to prior backdoor attacks, QDoor improves the attack success rate by $13\times$ and the clean data accuracy by $65\%$ on average. Furthermore, prior backdoor detection techniques cannot find QDoor attacks in uncompiled QNN circuits.

Figures (9)

• Figure 1: The overview of QDoor.
• Figure 2: The variational quantum circuit and its approximate synthesis.
• Figure 3: The accuracy of synthesized QNN circuits on NISQ computers.
• Figure 4: The backdoor attack success rate (ASR) in synthesized circuits.
• Figure 5: The number of synthesized QNN circuits with various $\epsilon$ budgets.