Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Backdoor Attacks against Hybrid Classical-Quantum Neural Networks

Ji Guo, Wenbo Jiang, Rui Zhang, Wenshu Fan, Jiachen Li, Guoming Lu

TL;DR

This work investigates the security of Hybrid Classical-Quantum Neural Networks (HQNNs) by introducing a formal backdoor framework and deriving theoretical bounds on generalization and trigger perturbations. It presents the Qcolor backdoor, a color-space trigger optimized via NSGA-II, and demonstrates high attack effectiveness with minimal poisoning while maintaining stealth. Empirical results show HQNNs are more robust than CNNs against traditional backdoor triggers, and Qcolor achieves strong ASR with high SSIM across multiple datasets, even under state-of-the-art defenses. The findings highlight both the resilience of HQNNs to conventional backdoors and the potential for color-space triggers to circumvent defenses, underscoring the need for HQNN-specific defense methods.

Abstract

Hybrid Quantum Neural Networks (HQNNs) represent a promising advancement in Quantum Machine Learning (QML), yet their security has been rarely explored. In this paper, we present the first systematic study of backdoor attacks on HQNNs. We begin by proposing an attack framework and providing a theoretical analysis of the generalization bounds and minimum perturbation requirements for backdoor attacks on HQNNs. Next, we employ two classic backdoor attack methods on HQNNs and Convolutional Neural Networks (CNNs) to further investigate the robustness of HQNNs. Our experimental results demonstrate that HQNNs are more robust than CNNs, requiring more significant image modifications for successful attacks. Additionally, we introduce the Qcolor backdoor, which utilizes color shifts as triggers and employs the Non-dominated Sorting Genetic Algorithm II (NSGA-II) to optimize hyperparameters. Through extensive experiments, we demonstrate the effectiveness, stealthiness, and robustness of the Qcolor backdoor.

Backdoor Attacks against Hybrid Classical-Quantum Neural Networks

TL;DR

This work investigates the security of Hybrid Classical-Quantum Neural Networks (HQNNs) by introducing a formal backdoor framework and deriving theoretical bounds on generalization and trigger perturbations. It presents the Qcolor backdoor, a color-space trigger optimized via NSGA-II, and demonstrates high attack effectiveness with minimal poisoning while maintaining stealth. Empirical results show HQNNs are more robust than CNNs against traditional backdoor triggers, and Qcolor achieves strong ASR with high SSIM across multiple datasets, even under state-of-the-art defenses. The findings highlight both the resilience of HQNNs to conventional backdoors and the potential for color-space triggers to circumvent defenses, underscoring the need for HQNN-specific defense methods.

Abstract

Hybrid Quantum Neural Networks (HQNNs) represent a promising advancement in Quantum Machine Learning (QML), yet their security has been rarely explored. In this paper, we present the first systematic study of backdoor attacks on HQNNs. We begin by proposing an attack framework and providing a theoretical analysis of the generalization bounds and minimum perturbation requirements for backdoor attacks on HQNNs. Next, we employ two classic backdoor attack methods on HQNNs and Convolutional Neural Networks (CNNs) to further investigate the robustness of HQNNs. Our experimental results demonstrate that HQNNs are more robust than CNNs, requiring more significant image modifications for successful attacks. Additionally, we introduce the Qcolor backdoor, which utilizes color shifts as triggers and employs the Non-dominated Sorting Genetic Algorithm II (NSGA-II) to optimize hyperparameters. Through extensive experiments, we demonstrate the effectiveness, stealthiness, and robustness of the Qcolor backdoor.
Paper Structure (30 sections, 33 equations, 12 figures, 8 tables, 1 algorithm)

This paper contains 30 sections, 33 equations, 12 figures, 8 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Hybrid Classical-Quantum Neural Networks
  4. Security in Quantum Machine Learning
  5. Backdoor Attacks and Defences
  6. Threat Model
  7. Backdoor Attacks in HQNNs
  8. Formulation of Backdoor Attacks in HQNNs
  9. Theoretical Analysis for Backdoor Attacks in HQNN
  10. Generalization Lower Bound
  11. Minimum Trigger Perturbation for Feature Distribution Change
  12. The Proposed Backdoor Attack: Qcolor Backdoor
  13. Generation and Processing of Qcolor Backdoor Triggered Images
  14. Hyperparameter Selection of Qcolor Backdoor Based on NSGA-II
  15. Experiments
  16. ...and 15 more sections

Figures (12)

  • Figure 1: Overview of backdoor attacks on HQNN
  • Figure 2: Example of Qcolor backdoor triggered images and clean images from Imagenette
  • Figure 3: Overview of Qcolor backdoor
  • Figure 4: QNN model architecture of 10 qubits with six-lay VQC
  • Figure 5: Grad-CAM of Badnet triggered images and clean images in HQNN and CNN
  • ...and 7 more figures