Q-DIBA: Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks

Paper Overview

Field: quantum Authors: Junrui Zhang, Zemin Chen, Lusi Li, Mohammad Ghasemigol, Daniel Takabi Published: 2026-07-13 arXiv: 2607.11843

Summary

Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Prior work shows QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations.

Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles: measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for the trigger generator, while individual density matrices fluctuate with the input, making per-sample contrastive learning unstable.

Q-DIBA

This paper proposes Q-DIBA, the first input-aware dynamic backdoor attack for QNNs:

• Three-mode minibatch training: jointly trains a classical trigger generator and the victim QNN across clean behavior, attack activation, and trigger specificity modes.
• Ensemble density contrastive loss: to provide stable quantum-level supervision, the loss operates on post-ansatz quantum states before measurement, contrasting mode-averaged density matrices instead of individual samples.

Results

Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves:

• High clean accuracy
• Strong attack success rate
• High cross-trigger accuracy

Q-DIBA remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning.

---

*Auto-collected on 2026-07-15*