aiqbench analysis
This paper is about adversarial robustness of a hybrid quantum machine learning classifier, tested in simulation and on IBM hardware. Its main finding is that accuracy alone hides how exposed a model is: models with similar accuracy differ sharply under FGSM evasion, and device noise lowers confidence and makes attacks easier rather than acting as a defense. For readers, the takeaway is that quantum intrusion-detection claims need adversarial evaluation, not just accuracy numbers.
FGSM Attack Transferability from Simulation to Quantum Hardware in Network Intrusion Detection
arXiv:2610.40701v1 Announce Type: cross Abstract: Quantum computers are now available through cloud platforms, and recent work has proposed using them to detect network intrusions. It is not yet clear how easily such systems can be attacked. We train a hybrid variational quantum classifier (VQC) on the Friday DDoS subset of CICIDS2017 and test it against two attacks: label flipping during training and FGSM evasion at prediction time. We run the tests in simulation and on IBM hardware, the Fez superconducting processor (Heron r2). We find that two models with similar accuracy can differ greatly in how easily they are attacked. A model that decides with little confidence loses half its detections to a very small change in the input, while a model trained to decide with more confidence needs a much larger change before it fails. Attacks built in simulation against the more confident model also work on real hardware, and the device classifies every unaltered attack sample correctly. Simulated device noise does not reduce accuracy, but it does reduce the model's confidence and makes attacks easier, so accuracy alone does not show how exposed a model is. Label flipping has no measurable effect until 15% of attack labels are changed. These results show that device noise should not be treated as a defense and that reported weaknesses in these classifiers depend partly on how they were trained.
Abstract:Quantum computers are now available through cloud platforms, and recent work has proposed using them to detect network intrusions. It is not yet clear how easily such systems can be attacked. We train a hybrid variational quantum classifier (VQC) on the Friday DDoS subset of CICIDS2017 and test it against two attacks: label flipping during training and FGSM evasion at prediction time. We run the tests in simulation and on IBM hardware, the Fez superconducting processor (Heron r2). We find that two models with similar accuracy can differ greatly in how easily they are attacked. A model that decides with little confidence loses half its detections to a very small change in the input, while a model trained to decide with more confidence needs a much larger change before it fails. Attacks built in simulation against the more confident model also work on real hardware, and the device classifies every unaltered attack sample correctly. Simulated device noise does not reduce accuracy, but it does reduce the model's confidence and makes attacks easier, so accuracy alone does not show how exposed a model is. Label flipping has no measurable effect until 15% of attack labels are changed. These results show that device noise should not be treated as a defense and that reported weaknesses in these classifiers depend partly on how they were trained.
8 pages, 2 figures, 5 tables. Accepted at the 2026 IEEE 2nd International Conference on Quantum Artificial Intelligence (QAI), 13-16 December 2026, Nottingham, UK. Code: this https URL
Cryptography and Security (cs.CR); Emerging Technologies (cs.ET); Machine Learning (cs.LG)
I.2.6; K.6.5; C.2.0
arXiv:2610.40701 [cs.CR]
(or arXiv:2610.40701v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2610.40701 arXiv-issued DOI via DataCite (pending registration)
Full text under the publisher's open licence · 279 words
Related coverage
Crossing the Cyber Divide: Sim-to-Sim and Sim-to-Real Transfer for RL Agents
arXiv · Oct 2, 2026
Cross-simulator transfer with foundation model summaries: Towards robust SKA-era reionization inference
arXiv · Aug 28, 2026
SimForcing: Distilling Simulation Motion Priors into Real-Domain Robot World Models
arXiv · Oct 7, 2026
Forecasting from Counterfactual Simulator Rollouts: A Sim2Real Evaluation
arXiv · Oct 5, 2026