aiqbench analysis
This research identifies a critical trust gap in cloud-based quantum machine learning where providers can substitute execution channels without detection by standard accuracy checks. The authors propose QML-PipeGuard, a runtime verification system that uses measurement statistics to detect these channel-substitution attacks with mathematically guaranteed bounds independent of qubit count. This work is essential for establishing the security and reproducibility frameworks required as QML services transition from research prototypes to commercial cloud offerings.
QML-PipeGuard: Detecting Channel-Substitution Attacks on Quantum Machine Learning Pipelines in Untrusted Clouds
arXiv:2605.25066v2 Announce Type: replace-cross Abstract: As machine-learning workloads move onto quantum hardware they inherit a trust problem classical AI deployments have largely solved and quantum ones have not: quantum machine learning (QML) is already sold as a cloud service, and a customer cannot check that the circuit they paid for is actually the circuit that ran. We show the gap is exploitable. A malicious or cost-cutting provider can substitute the declared quantum channel with one that reproduces every accuracy test the customer performs, passes the single-observable checks used in practice, and still differs from the declared computation at the channel level. We call this a channel-substitution attack and instantiate it in three deployments: audit evasion, service downgrade, and result forgery in reproducibility review. QML-PipeGuard detects the attack at runtime from measurement statistics the customer already collects. Its guarantee is two-sided, stated in the distance a local verifier measures: any substitution shifting a single-qubit output marginal by $\delta$ in trace norm forces a contract deviation of at least $\delta/\sqrt{3}$, the constant tight and independent of qubit count; the guarantee is relative to the chosen observable family and reference-input set. For local-unitary substitutions the adversary's blind set is characterised exactly, as a commutation condition, which gives the defender a rule for choosing challenge inputs that shrinks it. A finite-shot budget rule bounds false accepts and false alarms at once, one tolerance separates attack from the benign drift observed here, and every decision enters a hash-anchored audit trail. On an IBM Heron r2 processor a substituted quantum-kernel intrusion-detection pipeline evades the weak contract and our verifier halts it, while the honest channel stays within tolerance.
Abstract:As machine-learning workloads move onto quantum hardware they inherit a trust problem classical AI deployments have largely solved and quantum ones have not: quantum machine learning (QML) is already sold as a cloud service, and a customer cannot check that the circuit they paid for is actually the circuit that ran. We show the gap is exploitable. A malicious or cost-cutting provider can substitute the declared quantum channel with one that reproduces every accuracy test the customer performs, passes the single-observable checks used in practice, and still differs from the declared computation at the channel level. We call this a channel-substitution attack and instantiate it in three deployments: audit evasion, service downgrade, and result forgery in reproducibility review. QML-PipeGuard detects the attack at runtime from measurement statistics the customer already collects. Its guarantee is two-sided, stated in the distance a local verifier measures: any substitution shifting a single-qubit output marginal by $\delta$ in trace norm forces a contract deviation of at least $\delta/\sqrt{3}$, the constant tight and independent of qubit count; the guarantee is relative to the chosen observable family and reference-input set. For local-unitary substitutions the adversary's blind set is characterised exactly, as a commutation condition, which gives the defender a rule for choosing challenge inputs that shrinks it. A finite-shot budget rule bounds false accepts and false alarms at once, one tolerance separates attack from the benign drift observed here, and every decision enters a hash-anchored audit trail. On an IBM Heron r2 processor a substituted quantum-kernel intrusion-detection pipeline evades the weak contract and our verifier halts it, while the honest channel stays within tolerance.
30 pages, 4 figures. Extended version of a paper accepted at NordSec 2026 (Springer LNCS). Contains the full appendices omitted from the proceedings version for length. Supersedes v1: the detection and drift guarantees are now stated at the marginal level with a tight constant, and the finite-shot analysis controls both error directions
Quantum Physics (quant-ph); Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2605.25066 [quant-ph]
(or arXiv:2605.25066v2 [quant-ph] for this version)
Full text under the publisher's open licence · 337 words