Quantum Neural Network Extraction Attack via Split Co-Teaching
Zhenxiao fu Fan Chen

Checkpoint and Restart: An Energy Consumption Characterization in Clusters
    Marina Morán1 Javier Balladini1 Dolores Rexachs2 Emilio Luque2
    September 9, 2024
==========================================================================



§ ABSTRACT 
Quantum Neural Networks (QNNs), now offered as QNN-as-a-Service (QNNaaS), have become key targets for model extraction attacks. State-of-the-art methods use ensemble learning to train accurate substitute QNNs, but our analysis reveals significant limitations in real-world NISQ environments, where noise and cost constraints undermine their effectiveness.
In this work, we introduce a novel attack, split co-teaching, which leverages label variations to split queried data by noise sensitivity and employs co-teaching schemes to enhance extraction accuracy. Experiments on NISQ processors demonstrate that our approach outperforms classical extraction attacks by 6.5%∼9.5% and existing QNN extraction methods by 0.1%∼3.7% across various tasks.




Quantum neural network, model extraction attack, noisy intermediate-scale quantum, co-teaching









§ INTRODUCTION





Motivation.
Quantum Neural Networks (QNNs) are powerful tools for complex problem-solving <cit.>, but their development requires specialized expertise and costly data, making them valuable intellectual property (IP) now offered as QNN-as-a-Service (QNNaaS) <cit.>, as illustrated in Figure <ref>. This value has attracted adversaries who seek to steal QNNs from noisy intermediate-scale quantum (NISQ) cloud via model extraction <cit.>. 
Among these, QuantumLeak <cit.> stands out as the state-of-the-art (SOTA), utilizing ensemble learning to reduce noise in queried labels from QNNaaS, enabling the training of an accurate substitute QNN.
However, our experiments reveal that QuantumLeak faces substantial challenges in real-world NISQ environments. We increased the query rounds (e.g., from 3 <cit.> to 5) to address varying quantum noise and reduced the number of queried data points (e.g., from 6000 <cit.> to 3000) to minimize costs (e.g., $1.6 per second for accessing IBM quantum computers <cit.>) and maintain stealth. These adjustments led to a 7.49%∼9.85% accuracy drop, rendering the QuantumLeak attack ineffective. Consequently, we are exploring new QNN extraction attack strategies better suited to real-world conditions.

Contributions.
This work makes the following contributions:


  * In Section <ref>,
we identified a key limitation in QNN extraction attacks like QuantumLeak <cit.>, which relies on ensemble learning to re-weight noisy labels. In real-world NISQ conditions, this method fails because highly noisy data misleads the substitute QNN, making pre-filtering necessary to separate clean from noise-prone data. 
Inspired by the success of the classical co-teaching strategy <cit.>, which employs multiple neural networks to classify and clean noisy data, we adapted co-teaching to the quantum domain. However, its effectiveness is limited, as the loss-based classification of noisy and clean data, essential to co-teaching, does not effectively translate to quantum settings.


  * In Section <ref>,
we introduce a quantum co-teaching framework, termed split co-teaching, to address the challenges identified in our preliminary study.
This approach involves splitting noise-robust data from noise-vulnerable data based on variations in queried labels obtained at different times, followed by co-teaching QNNs with configurations tailored to the noise sensitivity of the data.


  * In Section <ref>,
we implemented the framework on a NISQ device and compared the local substitute QNN's accuracy with QNNs trained via SOTA extraction attacks. 
Results show that our approach outperforms the classical extraction attack <cit.> by 6.5%∼9.5% and the QNN extraction attack <cit.> by 0.1%∼3.7% across various tasks.





















  














§ BACKGROUND






QNN Basics.
Quantum neural networks are a representative NISQ algorithm capable of operating on current noisy quantum computers. Central to a QNN are Variational Quantum Circuits (VQCs) <cit.>, which are parameterized circuit ansatz typically implemented with one-qubit gates (i.e., 1QG) for rotation and two-qubit gates (i.e., 2QG) for entanglement. 
As shown in the shaded block of Figure <ref>, a standard QNN comprises three key components: 
(1) a data encoder that embeds data into quantum states; 
(2) a multi-layer, trainable VQC circuit; and 
(3) a measurement layer that projects quantum states into probabilistic vectors. 
QNN generate the final prediction by applying an activation function (e.g., ) to the raw probability output vector. 


Quantum Noises.
NISQ hardware suffers from various types of noise <cit.> due to environmental interactions, imperfect controls, cross-talk, and other factors. These noise sources introduce quantum errors, such as decoherence, which leads to information loss; gate errors, causing operational inaccuracies; and readout errors, resulting in incorrect measurements.
Moreover, quantum noise in NISQ platforms is not static; it can fluctuate spatially and temporally.
For example, in trapped ion systems <cit.>, fluctuations can arise from instabilities in laser and voltage control, while superconducting qubits <cit.> are affected by variations in unpaired electron populations.
Table <ref> illustrates this variability, showing that gate errors on a NISQ computer, measured at different times on the same day, exhibited a 31.2% variation (i.e., Δ) for one-qubit gates and a 10.3% variation for two-qubit gates.



 


Co-Teaching.
Classical co-teaching <cit.> effectively trains deep learning models with noisy labels. It leverages the tendency of neural networks to memorize clean labels before noisy ones, as indicated by lower loss values for clean data in early epochs. In co-teaching, two neural networks are trained simultaneously: each selects data with potentially clean labels (i.e., lower loss values) from a mini-batch, shares these selections with its peer, and backpropagates using the data chosen by the other. This process significantly enhances model robustness and demonstrates superior performance.













§ PRELIMINARY STUDY AND MOTIVATION







 §.§ Preliminary Study




Ineffectiveness of Existing Techniques.
We trained a victim QNN using a recent model <cit.> on the MNIST dataset,
achieving 98.8% accuracy in simulation.
This accuracy, denoted as Ideal, represents the upper bound a substitute QNN could achieve.
To reduce the amount of queried data and increase the number of query rounds, we selected 3,000 data samples (compared to 6,000 in <cit.>) and queried the victim QNN five times (compared to three times in <cit.>) over a 24-hour period to obtain labels. We then implemented model extraction attacks using classical CloudLeak <cit.>, QuantumLeak <cit.>, the classical co-teaching method <cit.>, and their combination.
All QNNs were deployed on . For detailed information on datasets, NISQ configuration, and comparison schemes, please refer to Section <ref>.

As shown in Figure <ref>, no existing techniques, whether used individually or in combination, can construct a local substitute QNN that approaches the performance of the victim QNN. Furthermore, these experimental results reveal several previously undiscovered key findings:


  * Observation-1: Considering the noise fluctuation of NISQ devices, QuantumLeak <cit.> only achieves a <2.5% accuracy improvement over the classical CloudLeak <cit.> attack, rather than the reported 4.99%∼7.35% improvement.

  * Observation-2: The classical co-teaching <cit.> is effective, showing a 1.8% accuracy improvement over QuantumLeak <cit.> when naïvely adopted without optimization.

  * Observation-3: Integrating the ensemble-learning approach from QuantumLeak <cit.> into co-teaching <cit.> diminishes performance rather than enhancing it.





Classical vs. Quantum Noisy Data.
Following <cit.>, we compare loss distributions after one epoch to assess the impact of noisy labels on classical and quantum neural networks.
Specifically, we analyze the classical CloudLeak <cit.> attack for classical model extraction using cross-entropy loss, and QuantumLeak <cit.> for QNN extraction, which uses a 2-dimensional Huber loss.
As shown in Figure <ref>, classical models tend to learn clean patterns in the initial epochs, allowing small-loss instances to be easily filtered out as clean data. This aligns with the conclusions in <cit.> and is effectively leveraged in co-teaching <cit.>. In contrast, this correlation does not exist in QNNs, leading to our fourth observation:


  * Observation-4: The clean and noisy data are nearly evenly distributed across specific loss values, blurring the distinction between the two. This makes it difficult to effectively filter out clean data based on loss, a method that is typically successful in classical models <cit.>. 









 §.§ Motivation



Observation-1, 2, and 4 are interconnected and mutually informative.
Specifically, the quantum noisy fluctuations render QuantumLeak <cit.>, the SOTA QNN extraction attack, ineffective, underscoring the importance of training approaches that account for noisy labels. However, the unique interaction between quantum noise and QNNs undermines the theoretical foundation of co-teaching <cit.>, highlighting the need for a quantum-specific data partition scheme.
This motivates us to optimize co-teaching by partitioning data based on noise sensitivity rather than the loss values used in classical methods.. 
Additionally, for Observation-3, we hypothesize that the multiple ensembles and bagging in QuantumLeak degrade data quality by increasing the proportion of incorrectly labeled instances, leading to reduced performance. This will be investigated further in future studies.









  







§ SPLIT CO-TEACHING




To address the limitations of existing QNN extraction attacks, which underestimate quantum noise fluctuations and overestimate the available number of queried data, we propose a new attack that incorporates practical NISQ features to train an accurate substitute QNN. As shown in the workflow comparison with the SOTA QuantumLeak <cit.> in Figure <ref>, 
our approach introduces two key improvements: (1) it captures quantum noise fluctuations by conducting more query rounds than QuantumLeak, and (2) instead of relying on an ensemble of QNNs with data bagging—an approach that incurs high design costs and has proven ineffective in our preliminary results—we split data based on quantum noise sensitivity and employ co-teaching to address training with noisy labels. 










 §.§ Queried Data Split



Similar to the QuantumLeak attack <cit.>, we use publicly available data to query QNNaaS, with queries evenly distributed throughout the day to capture the impact of fluctuating noise.
Specifically, data is sent to the victim QNN in M (e.g., M=5) rounds of queries, spaced at intervals of 24/M hours. The server executes the QNN on its NISQ devices, measures the outputs, and returns classical probability results.
As shown in Figure <ref>(a), 
the resulting dataset is represented as D={d_i, P⃗^ m_i}, 
where P⃗ denotes the obtained raw probability output vectors,
i∈[1,N] represents the number of data samples, and 
m∈[1,M] corresponds to the query rounds.

The  function in Figure <ref>(b) calculates the variation among the raw probability output vectors for each data sample d_i across different query rounds, resulting in var(d_i)∈[0,1].
A lower value indicates that d_i is robust to NISQ noise, while a higher value indicates vulnerability. We set a predefined threshold V_th to classify the dataset D to a robust subset D_r (with var(d_i)≤V_th)
and a vulnerable subset D_v (with var(d_i)>V_th).



















  








 §.§ QNN Co-Teaching



The proposed approach involves training two QNNs simultaneously, where each QNN identifies and selects a subset of “clean” data from each mini-batch based on its confidence—specifically, instances that result in smaller loss values. 
This selected subset of data is then shared with the peer QNN, which uses it to update its parameters for the subsequent mini-batch. This collaborative process aims to enhance the training robustness of both QNNs by leveraging the strengths of each network. 
As illustrated in Figure <ref>(b), we refer to this method as split co-teaching. 
The overall algorithmic workflow is provided in Figure <ref>(a) (lines 3-7), with the detailed implementation of the split co-teaching function () outlined in Figure <ref>(c).

In this approach, two QNNs, Q_1 and Q_2, with corresponding parameters w_1 and w_2, are trained simultaneously. 
During each training iteration, the mini-batch of data, denoted as D, is processed by each QNN to identify and select a subset of instances that produce smaller losses, indicating higher confidence in the correctness of those instances. For example, Q_1
might select a subset D_1 as its most reliable data. This subset is then considered useful knowledge for training and is subsequently shared with the peer QNN (Q_2) to update its parameters.
The process of selecting these instances is regulated by a forget rate f which determines the proportion of large-loss instances within the mini-batch that are excluded from training.
Furthermore, different forget rates, such as f_1 for D_r and f_2 for D_v, are applied depending on the data's sensitivity to quantum noise. 
Specifically, a smaller forget rate f_1 is applied to D_r to preserve its robustness, while a larger forget rate f_2 is used for D_v to penalize its higher sensitivity to noise, thereby refining the training process for each QNN in a manner tailored to the characteristics of the data.














 §.§ NISQ Implementation



The work focuses on proposing a new attack framework that addresses practical NISQ noise variations and reduced queried data in QNN model extraction attacks, rather than on fine-tuning the QNN itself. 
To ensure an apples-to-apples comparison, we adopt all implementation configurations from the QuantumLeak <cit.> attack, utilizing the same victim QNN circuit and local substitute QNN zoo, but with half the number of queried data samples.
























§ EXPERIMENTS AND RESULTS







 §.§ Experimental Setup




Datasets. 
Following recent QNNs <cit.>, we used MNIST <cit.> and Fashion-MNIST <cit.> datasets, down-sampling data to 1×8 vectors using principal component analysis.
For each dataset, 3000 images were sampled to query the QNNaaS server five times daily, while 500 images were selected for validation and 1000 for testing. 
For MNIST, we perform classification of digits 0/1 () and 7/8 (). For Fashion-MNIST, classification tasks included t-shirt/trouser (), dress/sneaker (), and shirt/sneaker ().


Configuration and QNN Zoo.
We trained a victim QNN for each task, implemented with four qubits. Each QNN architecture included one amplitude encoding layer, two repeated VQC layers, and one measurement layer. The VQC ansatz included an -- rotation layer and a 2-qubit  entanglement layer. We employed the Adam optimizer with a learning rate of 5e-3 and a weight decay of 1e-4, training with a batch size of 32 over 30 epochs.

We adopted the same local QNN zoo as used in QuantumLeak <cit.>, including the victim QNN, <cit.>, and <cit.>.

All quantum circuit designs were synthesized using Pennylane <cit.> and deployed to NISQ devices with Qiskit <cit.>. The circuits were executed and measured on the 27-qubit  computer.


Schemes. 

To compare our design with SOTA model extraction attacks, we established following four baselines:



  * Base: A local substitute QNN identical to the victim QNN. We applied the state-of-the-art classical technique, CloudLeak <cit.>, to extract the QNN using queried data.

  * QLeak: We adopted the QNN architecture with the best performance as reported in <cit.> and trained it using the ensemble learning method detailed in the same study.

  * CoT: A local substitute QNN selected from the QNN zoo, trained with classical co-teaching <cit.>, where two QNNs were simultaneously trained, each using data selected by its peer QNN for parameter updates.

  * CoT-E: A combined technique of QuantumLeak <cit.> and co-teaching <cit.> where an ensemble of the best QuantumLeak substitute QNNs is trained with co-teaching.










 §.§ Results and Analysis




Similar to <cit.>, our results show that a local QNN using the same VQC ansatz as the victim QNN achieves the best accuracy. The following results are based on this configuration.


Accuracy.
Figure <ref> compares the accuracy of our method with existing approaches. The  split co-teaching approach consistently produced the most accurate substitute QNN across all tasks. 
Our design achieved a 6.5%∼9.5% accuracy improvement over the  model and a 0.1%∼3.7% enhancement compared to QuantumLeak <cit.>. These results underscore the effectiveness of our approach under varying quantum noise, positioning it as a superior alternative to existing attack methods.


Impact of V_th.
V_th is a critical parameter that determines whether data samples are classified as noise-robust or noise-vulnerable. A lower V_th can cause a larger portion of data to be categorized as noise-vulnerable data (i.e., D_v), leading to the loss of clean samples during co-teaching. Conversely, a higher V_th may retain more noisy samples, potentially disrupting the training process. 

Figure <ref>  illustrates the impact of varying V_th on the accuracy of the  classification task, showing that at V_th=0.15, our model achieved optimal performance with a peak accuracy of 92.6% with 72.6% of the data classified as D_r.
For practical implementation, we recommend task-specific profiling to identify the optimal V_th.



Impact of f_1 and f_2.
Figures <ref> and  <ref> 
shows results when adjusting the forget rates f_1 and f_2, respectively.
Increasing the forget rate tends to enhance the proportion of clean data in the training set; however, this reduction in training set size is significant, especially in model extraction attacks where the number of queries is constrained. On the other hand, setting the forget rate too low may fail to adequately remove noisy data, thereby compromising model performance. 
Therefore, both f_1 and f_2 must be carefully optimized to balance the retention of clean data with the need to maintain a sufficiently large training set. Identifying these optimal values is essential for maximizing performance in model extraction attacks.



















§ CONCLUSION



In this work, we introduced a novel attack framework, split co-teaching, designed to address the limitations of existing model extraction methods in practical NISQ environments. By utilizing label variations to partition data based on noise sensitivity and implementing co-teaching strategies, our approach achieves state-of-the-art accuracy in QNN extraction attacks, as validated by results on NISQ computers.



IEEEbib

