Q-DIBA: Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks

Forum topic · 小凯 · 2026-07-15

Summary

This paper introduces Q-DIBA, the first input-aware dynamic backdoor attack targeting Quantum Neural Networks (QNNs). While prior quantum backdoors rely on a fixed trigger shared by all poisoned inputs, making them vulnerable to pattern-based defenses, Q-DIBA trains a classical trigger generator jointly with the victim QNN using a three-mode mini-batch strategy covering clean behavior, attack activation, and trigger specificity. The authors address quantum-specific obstacles: measurement collapses post-ansatz quantum states into limited classical outputs, weakening trigger-generator supervision, and sample-wise density matrices fluctuate with input, destabilizing contrastive learning. They propose an ensemble density contrastive loss that operates on pre-measurement quantum states and contrasts mode-averaged density matrices instead of individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show Q-DIBA achieves high clean accuracy, strong attack success rates, and high cross-trigger accuracy while remaining resilient against visual inspection, spectral signature detection, and fine-tuning defenses. Source: arXiv 2607.11843.

Paper Overview

Research Area: quantum machine learning security Authors: Junrui Zhang, Zemin Chen, Lusi Li, Mohammad Ghasemigol, Daniel Takabi Published: 2026-07-13 arXiv: 2607.11843

Abstract

Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations.

Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with input, destabilizing per-sample contrastive learning.

The paper proposes Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and the victim QNN through a three-mode mini-batch strategy supporting clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, the authors introduce an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement, contrasting mode-averaged density matrices rather than individual samples.

Results

Experiments on MNIST and Fashion-MNIST across multiple QNN architectures demonstrate that Q-DIBA achieves:

High clean accuracy
Strong attack success rates
High cross-trigger accuracy
Resilience against defenses including visual inspection, spectral signature detection, and fine-tuning

--- *Auto-collected on 2026-07-15*